joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411b84
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [esp + 0x40]
mov eax, dword [esp + 0x44]
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x3c4]
test eax, eax
je 0x411cf0
mov eax, dword [esi + 0x4d8]
test eax, eax
je 0x411bb7
mov dword [esp], esi
call fcn.00411a64
mov dword [esp + 8], 2
mov dword [esp + 4], 2
mov dword [esp], esi
call fcn.004193b4
mov edi, dword [esi + 0x3c4]
mov ebx, dword [esi + 0x4e0]
test ebx, ebx
je 0x411be6
mov eax, dword [ebx + 0xc]
test eax, eax
jne 0x411c20
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x411c08
mov eax, dword [esi + 0x48]
mov edx, dword [esi + 0x4e0]
test eax, eax
je 0x411c00
cmp edx, dword [eax + 0x18]
je 0x411c08
mov dword [esp], edx
call fcn.00411838
mov dword [esp + 0x44], 2
mov dword [esp + 0x40], esi
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.0041940c
lea edx, [ebx + 0xc]
mov eax, ebx
call fcn.004106cc
mov dword [esp + 4], edi
mov dword [esp], 0x5a43dd
call sym.curl.exe_curl_strequal
test eax, eax
je 0x411d50
mov dword [esp + 0x1c], 1
mov edi, dword [sym.imp.msvcrt.dll__iob]
add edi, 0x20
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x87
mov dword [esp + 4], 1
mov dword [esp], str._Netscape_HTTP_Cookie_File_n_http:__curl.haxx.se_docs_http_cookies.html_n_This_file_was_generated_by_libcurl__Edit_at_your_own_risk._n_n
call sub.msvcrt.dll_fwrite
mov ebx, dword [ebx]
test ebx, ebx
jne 0x411ca7
jmp 0x411d34
mov dword [esp + 8], eax
mov dword [esp + 4], 0x5a44b9
mov dword [esp], edi
call sym.curl.exe_curl_mfprintf
mov dword [esp], ebp
call dword [0x59b00c]
mov ebx, dword [ebx]
test ebx, ebx
je 0x411d34
mov eax, ebx
call fcn.004103c0
mov ebp, eax
test eax, eax
jne 0x411c80
mov dword [esp + 4], str._n_Fatal_libcurl_error_n
mov dword [esp], edi
call sym.curl.exe_curl_mfprintf
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x411d78
mov eax, dword [esi + 0x3c4]
mov dword [esp + 8], eax
mov dword [esp + 4], str.WARNING:_failed_to_save_cookies_in__s_n
mov dword [esp], esi
call fcn.0040ccd4
jmp 0x411be6
mov ebx, dword [esp + 0x18]
test ebx, ebx
je 0x411d14
mov eax, dword [esi + 0x4d8]
test eax, eax
je 0x411d14
mov dword [esp], eax
call sym.curl.exe_curl_slist_free_all
mov dword [esi + 0x4d8], 0
mov dword [esp + 8], 2
mov dword [esp + 4], 2
mov dword [esp], esi
call fcn.004193b4
jmp 0x411be6
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x411be6
mov dword [esp], edi
call sub.msvcrt.dll_fclose
jmp 0x411be6
mov dword [esp + 4], 0x5a4414
mov dword [esp], edi
call sub.msvcrt.dll_fopen
mov edi, eax
test eax, eax
je 0x411cd0
mov dword [esp + 0x1c], 0
jmp 0x411c53
mov dword [esp], edi
call sub.msvcrt.dll_fclose
jmp 0x411cd0
Function at 0x4120fc
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x13c
mov ebx, dword [esp + 0x150]
mov ebp, dword [ebx]
cmp dword [ebx + 0x8c], 2
je 0x412187
mov esi, dword [ebx + 0x1f0]
test esi, esi
jne 0x4121c4
mov dword [esp + 0x2c], pe_nt_image_headers32
lea edx, [esp + 0x2c]
mov dword [esp + 8], edx
lea esi, [esp + 0x30]
mov dword [esp + 4], esi
mov eax, dword [esp + 0x154]
mov dword [esp], eax
mov dword [esp + 0x14], edx
call sub.WS2_32.dll_getpeername
sub esp, 0xc
test eax, eax
mov edx, dword [esp + 0x14]
je 0x4121d8
call sub.WS2_32.dll_WSAGetLastError
mov esi, eax
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.004379c0
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov dword [esp + 4], str.getpeername___failed_with_errno__d:__s
mov dword [esp], ebp
call fcn.0040c7a8
add esp, 0x13c
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebx + 0x58]
mov ecx, 0x2e
mov edi, eax
mov esi, dword [esp + 0x1c]
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebx + 0x11c]
lea edx, [ebx + 0xec]
lea eax, [esp + 0xb0]
call fcn.00411f4c
test eax, eax
je 0x4122a8
mov dword [esp], ebx
call fcn.004120ac
add esp, 0x13c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x2c], pe_nt_image_headers32
lea eax, [esp + 0xb0]
mov dword [esp + 0x18], eax
mov ecx, pe_nt_image_headers32
xor eax, eax
mov edi, dword [esp + 0x18]
rep stosb byte es:[edi], al
mov dword [esp + 8], edx
lea eax, [esp + 0xb0]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x154]
mov dword [esp], eax
call sub.WS2_32.dll_getsockname
sub esp, 0xc
test eax, eax
jne 0x412270
lea eax, [ebx + 0xb8]
mov dword [esp + 0x1c], eax
lea ecx, [ebx + 0xe8]
mov edx, eax
mov eax, esi
call fcn.00411f4c
test eax, eax
jne 0x412194
call sub.KERNEL32.dll_GetLastError
mov esi, eax
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.004379c0
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov dword [esp + 4], str.ssrem_inet_ntop___failed_with_errno__d:__s
mov dword [esp], ebp
call fcn.0040c7a8
jmp 0x412187
call sub.WS2_32.dll_WSAGetLastError
mov esi, eax
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.004379c0
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov dword [esp + 4], str.getsockname___failed_with_errno__d:__s
mov dword [esp], ebp
call fcn.0040c7a8
add esp, 0x13c
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.KERNEL32.dll_GetLastError
mov esi, eax
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.004379c0
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov dword [esp + 4], str.ssloc_inet_ntop___failed_with_errno__d:__s
mov dword [esp], ebp
call fcn.0040c7a8
jmp 0x412187
Function at 0x4122d8
Capabilities:
Check os version
Set socket configuration

Disassembly:
push edi
sub esp, 0xc8
mov dword [esp + 0x20], 0x4020
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 4
mov eax, dword [0x65c044]
test eax, eax
je 0x412390
cmp eax, 2
je 0x412349
lea eax, [esp + 0x28]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x24]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1001
mov dword [esp + 4], 0xffff
mov eax, dword [esp + 0xd0]
mov dword [esp], eax
call sub.WS2_32.dll_getsockopt
sub esp, 0x14
test eax, eax
jne 0x412354
mov eax, dword [esp + 0x20]
cmp dword [esp + 0x24], eax
jle 0x412354
add esp, 0xc8
pop edi
ret
mov dword [esp + 0x10], 4
lea eax, [esp + 0x20]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1001
mov dword [esp + 4], 0xffff
mov eax, dword [esp + 0xd0]
mov dword [esp], eax
call sub.WS2_32.dll_setsockopt
sub esp, 0x14
add esp, 0xc8
pop edi
ret
lea edx, [esp + 0x2c]
mov ecx, 0x94
mov edi, edx
rep stosb byte es:[edi], al
mov dword [esp + 0x2c], 0x94
mov dword [0x65c044], 1
mov dword [esp], edx
call sub.KERNEL32.dll_GetVersionExA
push edi
test eax, eax
je 0x4123d4
cmp dword [esp + 0x30], 5
jbe 0x4123d4
mov dword [0x65c044], 2
jmp 0x412349
mov eax, dword [0x65c044]
jmp 0x412304

Function at 0x4123e0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push esi
push ebx
sub esp, 0x24
mov ebx, dword [esp + 0x30]
mov esi, dword [ebx + 0x608]
test esi, esi
je 0x412433
mov eax, dword [ebx + 0x44]
test eax, eax
je 0x412433
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], 0
mov dword [esp + 8], 0x411e98
lea edx, [esp + 0x18]
mov dword [esp + 4], edx
mov eax, dword [eax + 0x34]
mov dword [esp], eax
call fcn.0043911c
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x412440
mov dword [ebx + 0x608], 0
mov ebx, 0xffffffff
mov eax, ebx
add esp, 0x24
pop ebx
pop esi
ret
mov eax, dword [esp + 0x34]
test eax, eax
je 0x41244e
mov eax, dword [esp + 0x34]
mov dword [eax], esi
mov ebx, dword [esi + 0x154]
mov eax, dword [esi + 0x17c]
test eax, eax
je 0x41246c
mov dword [esp], esi
call fcn.004039f4
test eax, eax
je 0x412433
jmp 0x412438
mov dword [esp + 0xc], 2
mov dword [esp + 8], 1
lea eax, [esp + 0x17]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.WS2_32.dll_recv
sub esp, 0x10
test eax, eax
je 0x412433
jmp 0x412438
Function at 0x41398c
Capabilities:
Create thread

Disassembly:
sub esp, 0x2c
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x34]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.msvcrt.dll__beginthreadex
lea edx, [eax - 1]
cmp edx, 0xfffffffd
ja 0x4139d0
add esp, 0x2c
ret
xor eax, eax
add esp, 0x2c
ret

Function at 0x413a40
Capabilities:
Resolve dns

Disassembly:
push esi
push ebx
sub esp, 0x24
mov ebx, dword [esp + 0x30]
lea esi, [esp + 0x1c]
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], 2
call fcn.00413ab4
test eax, eax
jle 0x413a88
mov eax, dword [esp + 0x34]
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], 2
call fcn.00413760
add esp, 0x24
pop ebx
pop esi
ret
mov dword [esp], ebx
call sub.WS2_32.dll_gethostbyname
push edx
test eax, eax
je 0x413aac
mov edx, dword [esp + 0x34]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00413608
add esp, 0x24
pop ebx
pop esi
ret
xor eax, eax
add esp, 0x24
pop ebx
pop esi
ret
Function at 0x420264
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, eax
mov edi, dword [eax]
mov esi, dword [eax + 0x158]
mov dword [esp + 0x2c], 0x10
lea edx, [esp + 0x2c]
mov dword [esp + 8], edx
lea ebp, [esp + 0x30]
mov dword [esp + 4], ebp
mov dword [esp], esi
mov dword [esp + 0x1c], edx
call sub.WS2_32.dll_getsockname
sub esp, 0xc
test eax, eax
mov edx, dword [esp + 0x1c]
je 0x4202d0
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.00412498
mov dword [esp + 4], str.Error_accept__ing_server_connect
mov dword [esp], edi
call fcn.0040c7a8
mov eax, 0x1e
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x2c], 0x10
mov dword [esp + 8], edx
mov dword [esp + 4], ebp
mov dword [esp], esi
call sub.WS2_32.dll_accept
sub esp, 0xc
mov ebp, eax
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.00412498
cmp ebp, 0xffffffff
je 0x4202b0
mov dword [esp + 4], str.Connection_accepted_from_server_n
mov dword [esp], edi
call fcn.0040ccd4
mov dword [ebx + 0x158], ebp
mov dword [esp + 4], 1
mov dword [esp], ebp
call fcn.0043ef9c
mov dword [ebx + 0x168], 1
mov eax, dword [edi + 0x1e8]
test eax, eax
je 0x420353
mov dword [esp + 8], 1
mov dword [esp + 4], ebp
mov edx, dword [edi + 0x1ec]
mov dword [esp], edx
call eax
test eax, eax
jne 0x420360
xor eax, eax
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], ebp
mov dword [esp], ebx
call fcn.00412498
mov dword [ebx + 0x158], 0xffffffff
mov eax, 0x2a
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x421410
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov esi, eax
mov edi, ecx
cmp edx, 1
sbb ebx, ebx
and ebx, 8
add ebx, 0x41
cmp bl, byte [eax + 0x4fc]
je 0x421464
movsx eax, bl
mov dword [esp + 8], eax
mov dword [esp + 4], str.TYPE__c
lea eax, [esi + 0x498]
mov dword [esp], eax
call fcn.00441ed4
test eax, eax
jne 0x42145a
mov dword [esi + 0x50c], edi
mov byte [esi + 0x4fc], bl
add esp, 0x10
pop ebx
pop esi
pop edi
ret
mov dword [esi + 0x50c], ecx
mov edx, ecx
add esp, 0x10
pop ebx
pop esi
pop edi
jmp fcn.00421930

Function at 0x421478
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push esi
push ebx
mov edx, dword [eax]
mov ebx, dword [edx + 0x160]
mov esi, dword [edx + 0x34c]
test esi, esi
je 0x4214cc
mov ecx, dword [eax + 0x4e0]
test ecx, ecx
je 0x4214cc
movsx esi, byte [eax + 0x4fc]
cmp dword [edx + 0x31c], 1
sbb ecx, ecx
and ecx, 8
add ecx, 0x41
cmp esi, ecx
je 0x4214cc
mov dword [ebx + 0xc], 1
mov edx, dword [edx + 0x31c]
mov ecx, 0x13
pop ebx
pop esi
jmp fcn.00421410
pop ebx
pop esi
jmp 0x4218dc
push ebx
sub esp, 0x18
mov ebx, eax
mov eax, dword [eax]
mov eax, dword [eax + 0x160]
cmp dword [eax + 0xc], 1
je 0x4218f8
mov eax, ebx
add esp, 0x18
pop ebx
jmp fcn.00421880
mov eax, dword [ebx + 0x4e0]
test eax, eax
je 0x4218f0
mov dword [esp + 8], eax
mov dword [esp + 4], str.SIZE__s
lea eax, [ebx + 0x498]
mov dword [esp], eax
call fcn.00441ed4
test eax, eax
jne 0x42192a
mov dword [ebx + 0x50c], 0x17
add esp, 0x18
pop ebx
ret
Function at 0x4214d4
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebx
sub esp, 0x18
mov ebx, eax
mov eax, dword [eax]
mov edx, dword [eax + 0x314]
test edx, edx
jne 0x4214f0
mov eax, dword [eax + 0x290]
test eax, eax
je 0x421528
mov eax, dword [ebx + 0x4e0]
test eax, eax
je 0x421528
mov dword [esp + 8], eax
mov dword [esp + 4], str.MDTM__s
lea eax, [ebx + 0x498]
mov dword [esp], eax
call fcn.00441ed4
test eax, eax
jne 0x421522
mov dword [ebx + 0x50c], 0x12
add esp, 0x18
pop ebx
ret
mov eax, ebx
add esp, 0x18
pop ebx
jmp fcn.00421478
Function at 0x421534
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov edi, eax
mov eax, dword [eax]
mov ebp, dword [eax + 0x160]
cmp ecx, 0xd
jae 0x421688
mov ebx, dword [eax + 0x270]
test edx, edx
je 0x42167c
mov dword [edi + 0x500], 0
test ebx, ebx
je 0x4215d4
mov esi, dword [edi + 0x500]
test esi, esi
jle 0x421588
xor edx, edx
jmp 0x42157c
test ebx, ebx
je 0x4215d4
mov ebx, dword [ebx + 4]
inc edx
cmp edx, esi
jne 0x421578
test ebx, ebx
je 0x4215d4
mov eax, dword [ebx]
cmp byte [eax], 0x2a
je 0x4216ac
mov dword [edi + 0x504], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 0x5a682d
lea eax, [edi + 0x498]
mov dword [esp], eax
mov dword [esp + 0x1c], ecx
call fcn.00441ed4
test eax, eax
mov ecx, dword [esp + 0x1c]
jne 0x4215c9
mov dword [edi + 0x50c], ecx
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
cmp ecx, 0xe
je 0x4216bc
cmp ecx, 0xf
je 0x4216cc
cmp ecx, 0xd
je 0x4216d6
mov ebp, dword [edi + 0x4ec]
test ebp, ebp
jne 0x421748
mov dword [edi + 0x504], 0
cmp dword [eax + 0x304], 2
sete al
movzx eax, al
mov dword [edi + 0x508], eax
mov esi, dword [edi + 0x1f0]
test esi, esi
jne 0x42172b
mov ebx, dword [edi + 0x4d8]
test ebx, ebx
je 0x421748
mov dword [edi + 0x500], 1
mov eax, dword [edi + 0x4d4]
mov eax, dword [eax]
mov dword [esp + 8], eax
mov dword [esp + 4], str.CWD__s
lea eax, [edi + 0x498]
mov dword [esp], eax
call fcn.00441ed4
test eax, eax
jne 0x4215c9
mov dword [edi + 0x50c], 0x10
jmp 0x4215c9
inc dword [edi + 0x500]
jmp 0x421566
cmp ecx, 0xe
ja 0x421698
mov ebx, dword [eax + 0x278]
jmp 0x421554
cmp ecx, 0xf
jne 0x42154e
mov ebx, dword [eax + 0x274]
jmp 0x421554
inc eax
mov dword [edi + 0x504], 1
jmp 0x42159d
xor edx, edx
mov eax, edi
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.0041f644
xor eax, eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x42171a
mov ecx, dword [edi + 0x528]
mov edx, dword [edi + 0x52c]
mov ebx, ecx
and ebx, edx
inc ebx
je 0x421756
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp], eax
call fcn.00418478
mov edx, dword [edi + 0x528]
mov ecx, dword [edi + 0x52c]
mov eax, edi
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.0041f318
mov dword [edi + 0x50c], 0
xor eax, eax
jmp 0x4215c9
mov eax, dword [edi + 0x4d0]
test eax, eax
je 0x421628
mov dword [edi + 0x500], 0
jmp 0x421648
mov eax, edi
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.004214d4
mov eax, dword [edi + 0x4e0]
mov dword [esp + 8], eax
mov dword [esp + 4], str.SIZE__s
lea eax, [edi + 0x498]
mov dword [esp], eax
call fcn.00441ed4
test eax, eax
jne 0x4215c9
mov dword [edi + 0x50c], 0x18
jmp 0x4215c9
Function at 0x421790
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebx
sub esp, 0x18
mov ebx, eax
mov eax, dword [eax]
mov edx, dword [eax + 0x160]
mov edx, dword [edx + 0xc]
test edx, edx
jne 0x421804
mov ecx, dword [eax + 0x328]
test ecx, ecx
jne 0x421824
mov edx, dword [eax + 0x374]
test edx, edx
je 0x421840
mov edx, dword [ebx + 0x4e0]
test edx, edx
je 0x42184c
mov eax, dword [eax + 0x354]
test eax, eax
mov dword [esp + 8], edx
jne 0x421834
mov dword [esp + 4], str.PRET_RETR__s
lea eax, [ebx + 0x498]
mov dword [esp], eax
call fcn.00441ed4
test eax, eax
jne 0x4217ff
mov dword [ebx + 0x50c], 0x1d
xor eax, eax
add esp, 0x18
pop ebx
ret
mov dword [ebx + 0x50c], 0xd
mov ecx, 0xd
mov edx, 1
mov eax, ebx
add esp, 0x18
pop ebx
jmp fcn.00421534
xor edx, edx
mov eax, ebx
add esp, 0x18
pop ebx
jmp fcn.0041f96c
mov dword [esp + 4], str.PRET_STOR__s
jmp 0x4217e1
mov eax, ebx
add esp, 0x18
pop ebx
jmp fcn.0041f5b0
mov edx, dword [eax + 0x3c8]
test edx, edx
je 0x421867
mov dword [esp + 8], edx
mov dword [esp + 4], str.PRET__s
jmp 0x4217e1
mov eax, dword [eax + 0x324]
test eax, eax
je 0x421878
mov edx, str.NLST
jmp 0x421856
mov edx, 0x5a6da2
jmp 0x421856

Function at 0x421880
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebx
sub esp, 0x18
mov ebx, eax
mov eax, dword [eax]
mov eax, dword [eax + 0x160]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x4218d0
mov ecx, dword [ebx + 0x4e0]
test ecx, ecx
je 0x4218d0
mov dword [esp + 8], 0
mov dword [esp + 4], str.REST__d
lea eax, [ebx + 0x498]
mov dword [esp], eax
call fcn.00441ed4
test eax, eax
jne 0x4218cb
mov dword [ebx + 0x50c], 0x1a
add esp, 0x18
pop ebx
ret
mov eax, ebx
add esp, 0x18
pop ebx
jmp fcn.00421790
Function at 0x421930
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, eax
cmp edx, 0x13
je 0x421960
cmp edx, 0x14
je 0x42196c
cmp edx, 0x15
je 0x421a08
cmp edx, 0x16
je 0x421a20
xor eax, eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp 0x4218dc
mov esi, dword [eax]
cmp dword [esi + 0x300], 2
je 0x421a40
mov edx, 0x5a6820
xor ebp, ebp
mov ecx, edx
mov eax, dword [esi + 0x3c8]
test eax, eax
je 0x421ac0
mov dword [esp + 0xc], edx
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
mov dword [esp], 0x5a6dd8
call sym.curl.exe_curl_maprintf
mov esi, eax
test eax, eax
je 0x421a28
mov dword [esp + 8], eax
mov dword [esp + 4], 0x5a682d
lea eax, [ebx + 0x498]
mov dword [esp], eax
call fcn.00441ed4
test ebp, ebp
je 0x4219df
mov dword [esp], ebp
mov dword [esp + 0x1c], eax
call dword [0x59b00c]
mov eax, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 0x1c], eax
call dword [0x59b00c]
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x421957
mov dword [ebx + 0x50c], 0x1f
jmp 0x421957
mov ecx, 0xd
mov dl, 1
mov eax, ebx
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00421534
mov ecx, 0xe
jmp 0x421a0d
test ebp, ebp
je 0x421a35
mov dword [esp], ebp
call dword [0x59b00c]
mov eax, 0x1b
jmp 0x421957
mov ebp, dword [esi + 0x8754]
test ebp, ebp
je 0x42197b
cmp byte [ebp], 0
je 0x42197b
mov dword [esp + 4], 0x2f
mov dword [esp], ebp
call sub.msvcrt.dll_strchr
test eax, eax
je 0x42197b
mov dword [esp], ebp
call dword [0x59b004]
mov edx, eax
test eax, eax
je 0x421a35
xor eax, eax
mov ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
cmp byte [edx + ecx - 2], 0x2f
je 0x421ab3
mov dword [esp + 4], 0x2f
mov dword [esp], edx
mov dword [esp + 0x1c], edx
call sub.msvcrt.dll_strrchr
test eax, eax
mov edx, dword [esp + 0x1c]
je 0x421ab3
mov byte [eax + 1], 0
mov ebp, edx
mov ecx, 0x5a6dd6
jmp 0x421984
mov eax, dword [esi + 0x324]
test eax, eax
je 0x421ad4
mov eax, str.NLST
jmp 0x421992
mov eax, 0x5a6da2
jmp 0x421992
Function at 0x427fdc
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
sub esp, 0x28
mov ebx, eax
mov dword [esp + 8], str.Connected_for_receive
mov dword [esp + 4], 0x5a8640
mov eax, dword [eax + 0x10]
mov eax, dword [eax]
mov dword [esp], eax
mov dword [esp + 0x1c], edx
call fcn.0040ccd4
mov dword [ebx], 1
mov eax, ebx
call fcn.00427df8
test eax, eax
mov edx, dword [esp + 0x1c]
je 0x428020
add esp, 0x28
pop ebx
ret
mov eax, ebx
add esp, 0x28
pop ebx
jmp fcn.00427aa8
Function at 0x4283ec
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
sub esp, 0x28
mov ebx, eax
mov dword [esp + 8], str.Connected_for_transmit
mov dword [esp + 4], 0x5a8640
mov eax, dword [eax + 0x10]
mov eax, dword [eax]
mov dword [esp], eax
mov dword [esp + 0x1c], edx
call fcn.0040ccd4
mov dword [ebx], 2
mov eax, ebx
call fcn.00427df8
test eax, eax
mov edx, dword [esp + 0x1c]
je 0x428430
add esp, 0x28
pop ebx
ret
mov eax, ebx
add esp, 0x28
pop ebx
jmp fcn.0042802c
Function at 0x43ba4c
Capabilities:
Query environment variable

Disassembly:
push ebx
sub esp, 0x128
mov dword [esp], eax
call sub.msvcrt.dll_getenv
mov byte [esp + 0x1c], 0
test eax, eax
je 0x43ba40
mov dword [esp + 8], 0x104
lea ebx, [esp + 0x1c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.KERNEL32.dll_ExpandEnvironmentStringsA
sub esp, 0xc
cmp byte [esp + 0x1c], 0
je 0x43ba40
mov dword [esp], ebx
call dword [0x59b004]
add esp, 0x128
pop ebx
ret
xor eax, eax
add esp, 0x128
pop ebx
ret
mov eax, dword [esp + 4]
jmp 0x43b9f4
Function at 0x43ef9c
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x2c
xor eax, eax
mov edx, dword [esp + 0x34]
test edx, edx
setne al
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x8004667e
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call sub.WS2_32.dll_ioctlsocket
sub esp, 0xc
add esp, 0x2c
ret
Function at 0x43fecc
Capabilities:
Read file on windows

Disassembly:
push esi
push ebx
sub esp, 0x24
mov ebx, eax
mov esi, dword [eax]
cmp dword [esi + 4], 2
je 0x43ff24
mov eax, dword [eax + 8]
test eax, eax
je 0x43ff48
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
mov dword [esp + 4], 1
mov dword [esp], edx
call sub.msvcrt.dll_fread
mov esi, eax
test esi, esi
jne 0x43ff1c
mov eax, dword [ebx + 8]
test eax, eax
je 0x43ff16
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov dword [ebx + 8], 0
mov eax, dword [ebx]
mov eax, dword [eax]
mov dword [ebx], eax
mov eax, esi
add esp, 0x24
pop ebx
pop esi
ret
mov eax, dword [eax + 0xc]
test eax, eax
je 0x43ff80
mov esi, dword [esi + 8]
mov dword [esp + 0xc], esi
mov dword [esp + 8], ecx
mov dword [esp + 4], 1
mov dword [esp], edx
call eax
mov esi, eax
jmp 0x43fefc
mov dword [esp + 4], 0x5ae780
mov eax, dword [esi + 8]
mov dword [esp], eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], ecx
call sub.msvcrt.dll_fopen
mov dword [ebx + 8], eax
test eax, eax
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
jne 0x43fee2
mov esi, 0xffffffff
jmp 0x43ff1c
xor esi, esi
jmp 0x43ff1c
Function at 0x444f94
Capabilities:
Get hostname

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov ebx, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
mov byte [ebx], 0
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.WS2_32.dll_gethostname
sub esp, 8
mov edi, eax
mov byte [ebx + esi - 1], 0
test eax, eax
jne 0x444fd6
mov dword [esp + 4], 0x2e
mov dword [esp], ebx
call sub.msvcrt.dll_strchr
test eax, eax
je 0x444fd6
mov byte [eax], 0
mov eax, edi
add esp, 0x10
pop ebx
pop esi
pop edi
ret