joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10017c58
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push pe_nt_image_headers32
mov eax, 0x1011241e
call fcn.1011094d
mov ebx, ecx
xor edi, edi
mov dword [ebp - 4], edi
mov esi, edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x124], eax
test eax, eax
jle 0x10017c97
mov eax, dword [ebp + 8]
push dword [eax]
call fcn.10065032
mov esi, eax
mov dword [ebp - 0x11c], esi
test esi, esi
js 0x10017e37
cmp dword [ebx + 0xac], edi
je 0x10017caa
lea ecx, [ebx + 0xa8]
call fcn.10065032
mov ecx, dword [ebp - 0x124]
cmp ecx, 0x64
jle 0x10017d58
mov dword [ebp - 0x11c], edi
mov dword [ebp - 0x120], edi
push 0xa5a9
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], 2
call fcn.10065032
push 0xa5aa
lea ecx, [ebp - 0x120]
call fcn.10065032
push ecx
push dword [ebp - 0x11c]
lea ecx, [ebx + 0x30]
push dword [ebp - 0x120]
call fcn.10065032
push dword [ebp - 0x120]
mov ebx, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call ebx
push dword [ebp - 0x11c]
call ebx
mov esi, 0x80004005
mov dword [ebp - 0x11c], esi
mov eax, dword [ebp + 8]
test eax, eax
je 0x10017d4e
cmp dword [ebp + 0xc], 0
jle 0x10017d46
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [eax + edi*4]
call esi
mov eax, dword [ebp + 8]
inc edi
cmp edi, dword [ebp + 0xc]
jl 0x10017d32
mov esi, dword [ebp - 0x11c]
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
mov eax, esi
call fcn.101108ff
ret 0xc
mov eax, edi
mov dword [ebp - 0x120], eax
test ecx, ecx
jle 0x10017d19
push eax
lea ecx, [ebp + 8]
call fcn.10065032
lea ecx, [ebp - 0x118]
push dword [eax]
call fcn.10065032
push dword [eax]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov esi, eax
lea eax, [ebp - 0x114]
cmp dword [ebp - 0x118], eax
je 0x10017d9f
push dword [ebp - 0x118]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
cmp esi, 0xffffffff
jne 0x10017dca
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 2
je 0x10017de4
cmp eax, 3
je 0x10017de4
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov dword [ebp - 0x11c], esi
jmp 0x10017de0
mov eax, esi
shr eax, 4
and eax, 1
mov dword [ebp - 0x128], eax
mov esi, edi
mov dword [ebp - 0x11c], edi
test esi, esi
js 0x10017e37
push dword [ebp - 0x120]
lea ecx, [ebp + 8]
call fcn.10065032
mov ecx, ebx
cmp dword [ebp - 0x128], edi
jne 0x10017e06
push edi
push dword [eax]
call fcn.100180b3
jmp 0x10017e0d
push dword [eax]
call fcn.10018284
mov esi, eax
mov dword [ebp - 0x11c], esi
test esi, esi
js 0x10017e37
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp eax, dword [ebp - 0x124]
jl 0x10017d64
jmp 0x10017d19
lea ecx, [ebx + 0xa8]
call fcn.10065032
push dword [ebx + 0xbc]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [ebx + 0xbc], edi
jmp 0x10017d1f
Function at 0x10018284
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0x370
mov eax, 0x10112487
call fcn.1011094d
mov dword [ebp - 0x37c], ecx
mov eax, dword [ebp + 8]
xor ebx, ebx
or dword [ebp - 0x374], 0xffffffff
mov esi, ebx
mov dword [ebp - 0x378], eax
mov dword [ebp - 0x370], esi
mov dword [ebp - 4], ebx
test eax, eax
je 0x1001849d
push 1
push eax
call fcn.100180b3
mov edi, eax
test edi, edi
js 0x1001848f
mov edi, dword [ebp - 0x378]
push edi
call dword [sym.imp.OLEAUT32.dll_VariantInit]
cmp eax, 0x101
ja 0x1001849d
mov ecx, edi
call fcn.10006afa
push eax
push edi
lea ecx, [ebp - 0x370]
call fcn.10065032
mov edi, eax
test edi, edi
js 0x10018489
push 2
push 0x1011c2b0
lea ecx, [ebp - 0x370]
call fcn.10065032
mov edi, eax
test edi, edi
js 0x10018489
mov esi, dword [ebp - 0x370]
lea ecx, [ebp - 0x118]
push esi
call fcn.10065032
lea ecx, [ebp - 0x368]
push ecx
push dword [eax]
call dword [sym.imp.kernel32.dll_FindFirstFileW]
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x374], eax
cmp dword [ebp - 0x118], ecx
je 0x1001836a
push dword [ebp - 0x118]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword [ebp - 0x374]
pop ecx
cmp eax, 0xffffffff
je 0x100184a2
mov edx, 0x1011c2b8
lea ecx, [ebp - 0x33c]
movzx eax, byte [ecx]
cmp al, byte [edx]
jne 0x10018392
movzx eax, byte [ecx + 1]
cmp al, byte [edx + 1]
je 0x10018452
mov edx, 0x1011c2bc
lea ecx, [ebp - 0x33c]
movzx eax, byte [ecx]
cmp al, byte [edx]
jne 0x100183b1
movzx eax, byte [ecx + 1]
cmp al, byte [edx + 1]
je 0x10018452
push dword [ebp - 0x378]
lea ecx, [ebp - 0x36c]
call fcn.10065032
push 1
push 0x101191cc
lea ecx, [ebp - 0x36c]
mov byte [ebp - 4], 1
call fcn.10065032
mov edi, eax
test edi, edi
js 0x1001847b
lea ecx, [ebp - 0x33c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x100183eb
sub ecx, edx
lea eax, [ebp - 0x33c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x36c]
call fcn.10065032
mov edi, eax
test edi, edi
js 0x1001847b
test byte [ebp - 0x368], 0x10
mov eax, dword [ebp - 0x36c]
mov ecx, dword [ebp - 0x37c]
mov dword [ebp - 0x36c], ebx
je 0x10018436
push eax
call fcn.10018284
jmp 0x1001843d
push ebx
push eax
call fcn.100180b3
mov edi, eax
test edi, edi
js 0x1001847b
mov byte [ebp - 4], bl
push dword [ebp - 0x36c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea eax, [ebp - 0x368]
push eax
push dword [ebp - 0x374]
call dword [sym.imp.kernel32.dll_FindNextFileW]
test eax, eax
jne 0x10018373
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x12
cmovne edi, eax
jmp 0x1001848f
push dword [ebp - 0x36c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x1001848f
mov esi, dword [ebp - 0x370]
push dword [ebp - 0x374]
call dword [sym.imp.kernel32.dll_FindClose]
jmp 0x100184a4
mov ebx, 0x80070057
mov edi, ebx
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, edi
call fcn.101108ff
ret 4
Function at 0x1001f752
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push edi
push 0x10
mov esi, ecx
push 1
push esi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x1001f794
push edi
push esi
call dword [sym.imp.kernel32.dll_SizeofResource]
test eax, eax
je 0x1001f794
push edi
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
je 0x1001f794
cmp word [eax + 2], 0
je 0x1001f794
cmp dword [eax + 0x28], 0xfeef04bd
jne 0x1001f794
add eax, 0x30
jmp 0x1001f799
mov eax, 0x1011ec80
pop edi
pop esi
ret

Function at 0x10042ae4
Capabilities:
Hash data using djb2

Disassembly:
movzx eax, word [ecx]
mov edx, 0x1505
push esi
xor esi, esi
jmp 0x10042afe
imul edx, edx, 0x21
movzx eax, ax
xor edx, eax
inc esi
movzx eax, word [ecx + esi*2]
test ax, ax
jne 0x10042af1
imul eax, edx, 0x41c64e6d
imul ecx, edx, 0x10dcd
pop esi
add eax, 0x3039
shr eax, 0x10
inc ecx
and ecx, 0xffff0000
or eax, ecx
ret

Function at 0x10045201
Capabilities:
Hash data using djb2

Disassembly:
push esi
mov esi, ecx
test esi, esi
jne 0x1004520d
or eax, 0xffffffff
pop esi
ret
movzx eax, word [esi]
push ebx
push edi
mov edi, 0x1505
xor ebx, ebx
jmp 0x10045235
movzx ecx, ax
add eax, 0xffffffbf
cmp ax, 0x19
lea edx, [ecx + 0x20]
cmova edx, ecx
imul edi, edi, 0x21
xor edi, edx
inc ebx
movzx eax, word [esi + ebx*2]
test ax, ax
jne 0x1004521b
imul eax, edi, 0x41c64e6d
imul ecx, edi, 0x10dcd
pop edi
pop ebx
pop esi
add eax, 0x3039
shr eax, 0x10
inc ecx
and ecx, 0xffff0000
or eax, ecx
ret

Function at 0x10053b70
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, edx
push edi
test ecx, ecx
je 0x10053bc6
test esi, esi
je 0x10053bc6
push 2
pop edx
call fcn.10065032
mov edi, eax
test edi, edi
jne 0x10053b91
mov eax, 0x80004005
jmp 0x10053bcb
mov ecx, esi
call fcn.10006995
lea eax, [eax*2 + 2]
push eax
push esi
push 1
push 0
push 0
push edi
call dword [sym.imp.advapi32.dll_RegSetValueExW]
push edi
mov esi, eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
movzx eax, si
or eax, 0x80070000
test esi, esi
cmovle eax, esi
jmp 0x10053bcb
mov eax, 0x80070057
pop edi
pop esi
ret 4

Function at 0x10053bd0
Capabilities:
Delete registry key

Disassembly:
push ecx
push esi
mov esi, ecx
push edi
test esi, esi
jne 0x10053be0
mov eax, 0x80070057
jmp 0x10053c24
call fcn.10065032
mov edi, eax
test edi, edi
je 0x10053c21
push 0
call fcn.10053fa0
neg eax
sbb eax, eax
and eax, 0x100
push eax
push esi
push edi
call dword [sym.imp.advapi32.dll_RegDeleteKeyExW]
push edi
mov esi, eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
cmp esi, 2
je 0x10053c21
movzx eax, si
or eax, 0x80070000
test esi, esi
cmovle eax, esi
jmp 0x10053c24
xor eax, eax
inc eax
pop edi
pop esi
pop ecx
ret
Function at 0x10062739
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc0
mov eax, 0x10114a80
call fcn.1011094d
mov eax, dword [ebp - 0xc8]
xor ebx, ebx
mov dword [ebp - 0xcc], ebx
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc8], 0x101bb940
mov dword [0x101bb940], ebx
mov dword [0x101bb944], ebx
mov dword [0x101bb948], ebx
xor ecx, ecx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0xc4]
mov dword [ebp - 0xc4], ebx
push eax
inc ecx
push ecx
push ebx
push str.Control_PanelInternational
push SysReAllocString
mov dword [ebp - 0xcc], ecx
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100628b0
mov edi, dword [sym.imp.advapi32.dll_RegGetValueW]
lea eax, [ebp - 0xc0]
push eax
push ebx
push ebx
push 0x20000020
push str.Languages
push str.User_Profile
push dword [ebp - 0xc4]
mov dword [ebp - 0xc0], ebx
call edi
test eax, eax
jne 0x100628a4
cmp dword [ebp - 0xc0], 3
jbe 0x100628a4
push dword [ebp - 0xc0]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
pop ecx
test esi, esi
je 0x100628a4
lea eax, [ebp - 0xc0]
push eax
push esi
push ebx
push 0x20
push str.Languages
push str.User_Profile
push dword [ebp - 0xc4]
call edi
test eax, eax
jne 0x1006289c
mov ebx, dword [ebp - 0xc0]
cmp ebx, 3
jbe 0x1006289c
xor edx, edx
shr ebx, 1
push edx
pop ecx
mov eax, edx
mov edi, edx
mov word [esi + ebx*2 - 2], cx
je 0x1006289c
jmp 0x10062847
cmp eax, ebx
jae 0x1006284d
inc eax
cmp word [esi + eax*2], dx
je 0x10062842
cmp word [esi + edi*2], dx
jne 0x10062897
cmp edi, eax
jbe 0x10062897
xor ecx, ecx
lea eax, [esi + eax*2]
mov word [ebp - 0xbc], cx
lea ecx, [ebp - 0xbc]
push 0x55
push ecx
push eax
call dword [sym.imp.kernel32.dll_ResolveLocaleName]
test eax, eax
je 0x10062892
cmp word [ebp - 0xbc], 0
je 0x10062892
lea eax, [ebp - 0xbc]
mov ecx, 0x101bb940
push eax
call fcn.10065032
lea eax, [edi + 1]
xor edx, edx
inc edi
cmp edi, ebx
jb 0x10062847
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
push dword [ebp - 0xc4]
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, 0x101bb940
call fcn.101108ff
ret 4

Function at 0x10065032
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x10065041
pop dword [ebp - 0x14]
mov eax, 0x10065041
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0xbacd3
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0x3e2c
mov edx, eax
mov edi, 0xa1e46315
add edi, 0x6e3908eb
add edi, dword [ebp - 0x14]
mov esi, 0x53cac7e1
add esi, 0x927c70a6
add dword [ebp - 8], 0x37182fac
mov ebx, dword [edi]
xor dword [ebp - 0x10], edx
sub ebx, esi
mov dword [edx], ebx
sub dword [ebp - 0x10], 0xf3484a88
add edx, 0x821d4890
sub edx, 0x821d488c
add edi, 0xba6cff48
sub edi, 0xba6cff44
loop 0x10065090
add eax, 0xeb83
xor ebx, ebx
add ebx, eax
add eax, 0xa31cac05
sub eax, 0xa31cac00
mov ecx, 0x78caee26
add ecx, 0x973511da
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x40ff10
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ecx
xorps xmm0, xmm0
push 0x40
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
call dword [0x4715e4]
mov dword [esi + 0x18], eax
test eax, eax
je 0x40ff6d
push 0x40e740
push esi
push 0x40
push eax
mov eax, dword [esi + 0x14]
push dword [eax + 0x20]
call dword [sym.imp.KERNEL32.dll_ReadFileEx]
mov ecx, dword [esi + 0x14]
test eax, eax
jne 0x40ff71
mov eax, dword [ecx]
add eax, 4
cmp dword [eax + 0x14], 0xf
jbe 0x40ff58
mov eax, dword [eax]
push eax
push str.ReadOverlapped::StartRead__:_ReadFileEx____s
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00410070
add esp, 0xc
xor eax, eax
pop esi
ret
inc dword [ecx + 4]
mov eax, 1
pop esi
ret

Function at 0x40fff0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
xorps xmm0, xmm0
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
push 0x40e7b0
push esi
push edi
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov eax, dword [esi + 0x14]
push ebx
push dword [eax + 0x20]
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
mov ecx, dword [esi + 0x14]
test eax, eax
jne 0x410054
mov eax, dword [ecx]
add eax, 4
cmp dword [eax + 0x14], 0xf
jbe 0x410033
mov eax, dword [eax]
push eax
push dword [ecx + 0x20]
push str.WriteOverlapped::StartWrite__:_WriteFileEx__x___s
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00410070
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8
inc dword [ecx + 4]
mov eax, 1
mov dword [esi + 0x1c], edi
pop edi
mov dword [esi + 0x18], ebx
pop esi
pop ebx
pop ebp
ret 8
Function at 0x41e840
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x457208
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x470180]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov edx, dword [ebp + 8]
xorps xmm0, xmm0
mov eax, edx
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41e886
sub eax, esi
mov ecx, edi
push eax
push edx
call fcn.00401500
lea esi, [edi + 0x1c]
mov dword [edi + 0x18], 0
push 0x14
mov dword [ebp - 4], 0
mov dword [ebp + 8], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00434052
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea esi, [edi + 0x24]
mov byte [ebp - 4], 1
push 0x14
mov dword [ebp + 8], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00434052
add esp, 8
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov eax, edi
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x429160
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
push 0x10
push edi
push esi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x42919f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2733
je 0x42919f
push dword [ebp + 8]
push esi
push str.Connect__x_:_connect____s
push eax
call fcn.00410070
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebp
ret
push ebx
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_ntohl]
movzx ecx, word [edi + 2]
mov ebx, eax
push ecx
call dword [sym.imp.WS2_32.dll_ntohs]
push str.:_Connect_
push dword [ebp + 8]
movzx edi, ax
push 0x471740
call fcn.00401200
add esp, 8
push eax
call fcn.00401200
add esp, 8
mov ecx, dword [eax]
push esi
mov edx, dword [ecx + 4]
mov ecx, dword [edx + eax + 0x14]
and ecx, 0xfffff9ff
or ecx, 0x800
mov dword [edx + eax + 0x14], ecx
mov ecx, eax
call fcn.00402f30
push str.__...
mov esi, eax
movzx eax, bl
push edi
push 0x3a
push eax
mov ecx, dword [esi]
mov eax, ebx
push 0x2e
shr eax, 8
movzx eax, al
mov edx, dword [ecx + 4]
push eax
mov eax, ebx
shr ebx, 0x18
push 0x2e
mov ecx, dword [edx + esi + 0x14]
shr eax, 0x10
and ecx, 0xfffff3ff
movzx eax, al
or ecx, 0x200
push eax
push 0x2e
push ebx
push 0x45c7b4
push esi
mov dword [edx + esi + 0x14], ecx
call fcn.00401200
add esp, 8
mov ecx, eax
call fcn.00402f30
push eax
call fcn.004285b0
add esp, 8
mov ecx, eax
call fcn.00402f30
push eax
call fcn.004285b0
add esp, 8
mov ecx, eax
call fcn.00402f30
push eax
call fcn.004285b0
add esp, 8
mov ecx, eax
call fcn.00402f30
push eax
call fcn.004285b0
add esp, 8
mov ecx, eax
call fcn.004229e0
push eax
call fcn.00401200
push eax
call fcn.00401eb0
add esp, 0xc
pop ebx
pop edi
mov eax, 1
pop esi
pop ebp
ret

Function at 0x429820
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
xorps xmm0, xmm0
mov eax, 2
push edi
mov edi, dword [ebp + 8]
movups xmmword [edi], xmm0
mov word [edi], ax
test esi, esi
je 0x42986a
push 0x46086c
push esi
call dword [sym.imp.WS2_32.dll_getservbyname]
test eax, eax
je 0x429853
movzx eax, word [eax + 8]
jmp 0x429866
push esi
call fcn.0043cef2
add esp, 4
push eax
call dword [sym.imp.WS2_32.dll_htons]
movzx eax, ax
mov word [edi + 2], ax
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x4298c6
push esi
call dword [sym.imp.WS2_32.dll_inet_addr]
add edi, 4
mov dword [edi], eax
cmp eax, 0xffffffff
jne 0x4298cd
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ecx, eax
test ecx, ecx
jne 0x4298aa
push esi
push str.SetAddr__:_gethostbyname___s__
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00410070
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
ret
movsx eax, word [ecx + 0xa]
push eax
mov eax, dword [ecx + 0xc]
push dword [eax]
push edi
call fcn.00435660
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebp
ret
mov dword [edi + 4], 0
pop edi
mov eax, 1
pop esi
pop ebp
ret
Function at 0x429940
Capabilities:
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
push esi
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x429970
push str.Socket__:_socket__
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00410070
add esp, 8
or eax, esi
pop esi
pop ebp
ret
push edi
mov edi, dword [ebp + 8]
push 0x10
push edi
push esi
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x4299a5
push str.Socket__:_bind__
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00410070
add esp, 8
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret
push ebx
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_ntohl]
movzx ecx, word [edi + 2]
mov ebx, eax
push ecx
call dword [sym.imp.WS2_32.dll_ntohs]
push str.__
movzx ecx, ax
mov eax, ebx
push ecx
push 0x3a
movzx ecx, bl
push ecx
push 0x2e
shr eax, 8
movzx eax, al
push eax
mov eax, ebx
shr ebx, 0x18
push 0x2e
shr eax, 0x10
movzx eax, al
push eax
push 0x2e
push ebx
push str.Socket_
push 0x471740
call fcn.00401200
add esp, 8
mov ecx, eax
call fcn.00402f30
push eax
call fcn.004285b0
add esp, 8
mov ecx, eax
call fcn.00402f30
push eax
call fcn.004285b0
add esp, 8
mov ecx, eax
call fcn.00402f30
push eax
call fcn.004285b0
add esp, 8
mov ecx, eax
call fcn.00402f30
push eax
call fcn.004285b0
add esp, 8
mov ecx, eax
call fcn.004229e0
push eax
call fcn.00401200
add esp, 8
mov ecx, dword [eax]
push esi
mov edx, dword [ecx + 4]
mov ecx, dword [edx + eax + 0x14]
and ecx, 0xfffff9ff
or ecx, 0x800
mov dword [edx + eax + 0x14], ecx
mov ecx, eax
call fcn.00402f30
push eax
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
mov ecx, dword [edx + eax + 0x14]
and ecx, 0xfffff3ff
or ecx, 0x200
mov dword [edx + eax + 0x14], ecx
call fcn.00401eb0
add esp, 4
mov eax, esi
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x429aa0
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ecx
xorps xmm0, xmm0
push 0x40
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
call dword [0x47160c]
mov dword [esi + 0x18], eax
test eax, eax
je 0x429afe
push 0x429780
push esi
push 0x40
push eax
mov eax, dword [esi + 0x14]
push dword [eax + 0x34]
call dword [sym.imp.KERNEL32.dll_ReadFileEx]
test eax, eax
jne 0x429b02
mov ecx, dword [esi + 0x14]
cmp dword [ecx + 0x68], 0xf
lea eax, [ecx + 0x54]
jbe 0x429ae6
mov eax, dword [eax]
push eax
push dword [ecx + 0x34]
push str.ReadOverlapped::StartRead__:_ReadFileEx__x___s
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00410070
add esp, 0x10
xor eax, eax
pop esi
ret
mov eax, 1
pop esi
ret
Function at 0x429bb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
xorps xmm0, xmm0
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
push 0x4297d0
push esi
push edi
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov eax, dword [esi + 0x14]
push ebx
push dword [eax + 0x34]
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
test eax, eax
jne 0x429c12
mov ecx, dword [esi + 0x14]
cmp dword [ecx + 0x68], 0xf
lea eax, [ecx + 0x54]
jbe 0x429bf1
mov eax, dword [eax]
push eax
push dword [ecx + 0x34]
push str.WriteOverlapped::StartWrite__:_WriteFileEx__x___s
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00410070
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8
mov dword [esi + 0x1c], edi
mov eax, 1
pop edi
mov dword [esi + 0x18], ebx
pop esi
pop ebx
pop ebp
ret 8
Function at 0x42cfc0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x457b6d
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x470180]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
push 8
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.00434052
mov edi, eax
add esp, 4
test edi, edi
je 0x42d06d
push 1
mov dword [ebp - 4], 0
call fcn.00432eb2
add esp, 4
mov dword [edi + 4], eax
jmp 0x42d06f
xor edi, edi
mov ecx, esi
mov dword [esi + 0x34], edi
call fcn.004085c0
mov ebx, dword [ebp + 0xc]
mov ecx, ebx
not ecx
mov dword [esi], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
and ecx, 1
mov dword [ebp - 4], 1
shl ecx, 2
mov edx, ecx
or edx, 2
test bl, 2
cmovne edx, ecx
mov ecx, edx
or ecx, 8
test bl, 8
cmove ecx, edx
mov edx, ecx
or edx, 0x10
test bl, 4
mov ebx, dword [ebp + 8]
cmove edx, ecx
mov dword [ebp + 0xc], ebx
mov dword [ebp - 0x10], edx
cmp dword [ebx + 0x14], 0xf
jbe 0x42d0c8
mov eax, dword [ebx]
mov dword [ebp + 0xc], eax
mov ebx, dword [ebx + 0x10]
cmp ebx, 0x7fffffff
ja 0x42d190
test ebx, ebx
je 0x42d170
mov eax, edx
and eax, 6
cmp al, 6
je 0x42d170
lea eax, [ebp + 8]
mov dword [ebp + 8], ebx
push eax
lea eax, [esi + 0x40]
push eax
call fcn.00405ed0
push ebx
push dword [ebp + 0xc]
mov edi, eax
push edi
call fcn.00435660
mov edx, dword [ebp - 0x10]
lea ecx, [edi + ebx]
mov eax, edx
mov dword [esi + 0x38], ecx
add esp, 0x14
and eax, 4
mov dword [ebp + 0xc], eax
jne 0x42d12d
mov eax, dword [esi + 0xc]
mov dword [eax], edi
mov eax, dword [esi + 0x1c]
mov dword [eax], edi
mov eax, dword [esi + 0x2c]
mov dword [eax], ebx
test dl, 2
jne 0x42d16b
test dl, 0x18
je 0x42d13c
mov ebx, dword [esi + 0x38]
jmp 0x42d13e
mov ebx, edi
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x38]
sub ecx, ebx
cmp dword [ebp + 0xc], 0
mov dword [eax], edi
mov eax, dword [esi + 0x20]
mov dword [eax], ebx
mov eax, dword [esi + 0x30]
mov dword [eax], ecx
je 0x42d16b
mov eax, dword [esi + 0xc]
mov dword [eax], edi
mov eax, dword [esi + 0x1c]
mov dword [eax], edi
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
or edx, 1
jmp 0x42d177
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], edx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.00432ca4
int3