joyce8/EMBER2024-capa huggingface dataset:
Function at 0x130594d0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x10c
mov eax, dword [0x1315d264]
xor eax, esp
mov dword [esp + 0x108], eax
push ebx
push ebp
mov ebp, dword [esp + 0x118]
cmp dword [ebp + 0x1c4], 0
push esi
push edi
mov edi, dword [ebp]
mov dword [esp + 0x14], edi
jne 0x1305960b
mov esi, dword [esp + 0x124]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov ebx, 0x80
push esi
mov dword [esp + 0x1c], ebx
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x1305954c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push ebp
call fcn.1304c980
push eax
push esi
push str.getpeername___failed_with_errno__d:__s
push edi
call fcn.130570a0
add esp, 0x18
jmp 0x13059614
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x9c]
push eax
push esi
mov dword [esp + 0x1c], ebx
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x1305958c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push ebp
call fcn.1304c980
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
push edi
call fcn.130570a0
add esp, 0x18
jmp 0x13059614
lea ebx, [ebp + 0xcc]
lea edi, [ebp + 0x9e]
lea esi, [esp + 0x18]
call fcn.13059460
test eax, eax
jne 0x130595ca
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push ebp
call fcn.1304c980
mov ecx, dword [esp + 0x1c]
push eax
push esi
push str.ssrem_inet_ntop___failed_with_errno__d:__s
push ecx
call fcn.130570a0
add esp, 0x18
jmp 0x13059614
lea ebx, [ebp + 0x100]
lea edi, [ebp + 0xd0]
lea esi, [esp + 0x98]
call fcn.13059460
test eax, eax
jne 0x1305960b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push ebp
call fcn.1304c980
mov edx, dword [esp + 0x1c]
push eax
push esi
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push edx
call fcn.130570a0
add esp, 0x18
jmp 0x13059614
push ebp
call fcn.13059400
add esp, 4
mov ecx, dword [esp + 0x118]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1303468b
add esp, 0x10c
ret

Function at 0x13059630
Capabilities:
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, dword [edi]
mov eax, dword [esi + 0x314]
push 4
lea ecx, [esp + 8]
push ecx
push 1
push 6
push edx
mov dword [esp + 0x18], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jge 0x13059673
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
call fcn.1304c980
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.13057010
add esp, 0x14
pop esi
pop ecx
ret
push str.TCP_NODELAY_set_n
push esi
call fcn.13057010
add esp, 8
pop esi
pop ecx
ret
Function at 0x13059690
Capabilities:
Check os version
Set socket configuration

Disassembly:
sub esp, 0xa4
mov eax, dword [0x1315d264]
xor eax, esp
mov dword [esp + 0xa0], eax
cmp dword [0x13169304], 0
mov dword [esp], 0x4020
mov dword [esp + 4], 0
mov dword [esp + 8], 4
jne 0x1305971f
push 0x94
lea eax, [esp + 0x10]
push 0
push eax
call fcn.130309b0
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0x10], 0x94
mov dword [0x13169304], 1
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x1305971f
cmp dword [esp + 0x10], 6
jb 0x1305971f
mov dword [0x13169304], 2
mov ecx, dword [esp + 0xa0]
xor ecx, esp
call fcn.1303468b
add esp, 0xa4
ret
cmp dword [0x13169304], 2
je 0x13059772
push esi
mov esi, dword [esp + 0xac]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0xc]
push eax
push 0x1001
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x13059759
mov ecx, dword [esp + 8]
cmp ecx, dword [esp + 4]
jg 0x13059771
push 4
lea edx, [esp + 8]
push edx
push 0x1001
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
pop esi
mov ecx, dword [esp + 0xa0]
xor ecx, esp
call fcn.1303468b
add esp, 0xa4
ret

Function at 0x130597b0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 8
push esi
push edi
mov edi, dword [esp + 0x14]
mov esi, dword [edi + 0x550]
test esi, esi
je 0x130597fd
mov eax, dword [edi + 0xc]
test eax, eax
je 0x130597fd
push 0x13059790
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 0
mov edx, dword [eax + 0x64]
push ecx
push edx
call fcn.13075e70
add esp, 0xc
cmp dword [esp + 0xc], 0
jne 0x13059806
mov dword [edi + 0x550], 0
pop edi
or eax, 0xffffffff
pop esi
add esp, 8
ret
mov eax, dword [esp + 0x18]
test eax, eax
je 0x13059810
mov dword [eax], esi
cmp dword [esi + 0x150], 0
mov edi, dword [esi + 0x130]
je 0x13059835
push esi
call fcn.1304dfa0
add esp, 4
test eax, eax
jne 0x13059849
pop edi
or eax, 0xffffffff
pop esi
add esp, 8
ret
push 2
push 1
lea eax, [esp + 0x1c]
push eax
push edi
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x130597fd
mov eax, edi
pop edi
pop esi
add esp, 8
ret
Function at 0x13059e50
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x1c]
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
mov esi, dword [edi + ebx*4 + 0x130]
mov ebp, dword [edi]
mov dword [eax], 0
cmp dword [edi + ebx*4 + 0x1e4], 0
mov dword [esp + 0x14], esi
mov dword [esp + 0x24], 0
je 0x13059e98
mov dword [eax], 1
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
call fcn.1305b400
mov dword [esp + 0x18], eax
push 1
lea eax, [esp + 0x1c]
push eax
push ebp
mov dword [esp + 0x28], edx
call fcn.13058e10
add esp, 0xc
test eax, eax
mov dword [esp + 0x10], eax
jge 0x13059ed8
push str.Connection_time_out
push ebp
call fcn.130570a0
add esp, 8
pop edi
pop esi
pop ebp
mov eax, 0x1c
pop ebx
add esp, 0x10
ret
mov eax, esi
call fcn.13058ed0
cmp eax, 1
jne 0x13059f22
mov ecx, dword [edi + 0x228]
mov edx, dword [edi + 0x224]
mov eax, dword [esp + 0x1c]
mov ebx, dword [edi + 0x230]
push ecx
mov ecx, dword [esp + 0x1c]
push edx
push eax
push ecx
call fcn.1305b430
add esp, 0x10
cmp eax, ebx
jl 0x13059e8e
push ebx
push str.After__ldms_connect_time__move_on__n
push ebp
call fcn.13057010
add esp, 0xc
jmp 0x13059fde
test eax, eax
jne 0x13059f8e
push esi
lea esi, [esp + 0x28]
call fcn.13059390
add esp, 4
test eax, eax
je 0x13059fc9
push edi
call fcn.13051810
add esp, 4
test eax, eax
jne 0x1305a03d
test ebx, ebx
mov edx, dword [esp + 0x2c]
mov dword [edi + ebx*4 + 0x1e4], 1
mov dword [edx], 1
jne 0x13059f70
push 2
push ebp
call fcn.1305ffc0
add esp, 8
push edi
call fcn.13051950
mov eax, dword [esp + 0x18]
push eax
push edi
call fcn.130594d0
add esp, 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
cmp eax, 2
jne 0x13059fb9
push esi
lea esi, [esp + 0x28]
call fcn.13059390
mov esi, dword [esp + 0x28]
push esi
push edi
call fcn.1304c980
push eax
push 0x1311673c
push ebp
call fcn.13057010
add esp, 0x18
jmp 0x13059fcd
push str.Connection_failed_n
push ebp
call fcn.13057010
add esp, 8
jmp 0x13059fde
mov esi, dword [esp + 0x24]
test esi, esi
je 0x13059fde
push esi
mov dword [ebp + 0x858c], esi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov ecx, dword [edi + 0x3c]
cmp dword [ecx + 0x1c], 0
mov eax, dword [esp + 0x10]
je 0x13059ff0
cdq
sub eax, edx
sar eax, 1
mov ebx, dword [esp + 0x2c]
mov dword [edi + 0x230], eax
mov eax, dword [esp + 0x28]
mov esi, edi
call fcn.13059dc0
mov esi, eax
test esi, esi
je 0x1305a03b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
mov dword [ebp + 0x858c], eax
call fcn.1304c980
mov edx, dword [edi + 0x98]
push eax
mov eax, dword [edi + 0x80]
push edx
push eax
push str.Failed_connect_to__s:_ld___s
push ebp
call fcn.130570a0
add esp, 0x1c
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x1305b5c0
Capabilities:
Resolve dns

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x1c]
mov dword [esi], 0
push ecx
mov byte [eax], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ecx, eax
test ecx, ecx
mov dword [esp + 0x1c], ecx
je 0x1305b664
cmp word [ecx + 8], 2
push ebx
push ebp
push edi
jne 0x1305b635
cmp word [ecx + 0xa], 4
jne 0x1305b635
mov edi, dword [ecx + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x1305b635
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
lea esp, [esp]
mov edx, dword [eax]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebx
push ebp
call fcn.1305b550
test eax, eax
mov dword [esi], eax
je 0x1305b658
add edi, 4
lea esi, [eax + 0x1c]
mov eax, dword [edi]
test eax, eax
jne 0x1305b610
mov ecx, dword [esp + 0x28]
mov ecx, dword [ecx]
mov edx, dword [esp + 0x24]
push 0x400
push ecx
push 0x401
push edx
call fcn.13040372
add esp, 0x10
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
ret 0x18
pop edi
pop ebp
pop ebx
mov eax, 8
pop esi
ret 0x18
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
add eax, 0xffffd507
cmp eax, 3
ja case.0x1305b674.11001
jmp dword [eax*4 + 0x1305b698]
mov eax, 0x2af9
pop esi
ret 0x18
mov eax, 0x2afa
pop esi
ret 0x18
mov eax, 0x2afb
pop esi
ret 0x18
Function at 0x1305bed0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x230
mov eax, dword [0x1315d264]
xor eax, esp
mov dword [esp + 0x22c], eax
cmp dword [0x13169308], 0
mov dword [esp], str.getaddrinfo
mov dword [esp + 4], 0x1305b920
mov dword [esp + 8], str.getnameinfo
mov dword [esp + 0xc], 0x1305bc10
mov dword [esp + 0x10], str.freeaddrinfo
mov dword [esp + 0x14], fcn.1305b8d0
je 0x1305bf42
movzx eax, word [esp + 0x234]
mov eax, dword [eax*8 + 0x1315e4d4]
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.1303468b
add esp, 0x230
ret 4
push 0x104
lea ecx, [esp + 0x128]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1305c03f
push ebx
push ebp
push esi
push edi
lea edx, [esp + 0x134]
push edx
lea eax, [esp + 0x2c]
push 0x10c
push eax
call fcn.13032479
push str.ws2_32
lea ecx, [esp + 0x38]
push 0x10c
push ecx
call fcn.13040301
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 0x18
lea edx, [esp + 0x28]
push edx
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x1305bfbd
push str.getaddrinfo
push esi
call ebx
test eax, eax
jne 0x1305c004
push esi
call ebp
lea eax, [esp + 0x134]
push eax
lea ecx, [esp + 0x2c]
push 0x10c
push ecx
call fcn.13032479
push str.wship6
lea edx, [esp + 0x38]
push 0x10c
push edx
call fcn.13040301
add esp, 0x18
lea eax, [esp + 0x28]
push eax
call edi
mov esi, eax
test esi, esi
je 0x1305c03b
push str.getaddrinfo
push esi
call ebx
test eax, eax
je 0x1305c06f
xor edi, edi
mov ecx, dword [esp + edi*8 + 0x10]
push ecx
push esi
call ebx
test eax, eax
mov dword [esp + edi*8 + 0x14], eax
je 0x1305c06f
add edi, 1
cmp edi, 3
jl 0x1305c006
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
mov dword [0x1315e4d4], edx
mov dword [0x1315e4dc], eax
mov dword [fcn.1305b8d0], ecx
pop edi
pop esi
pop ebp
pop ebx
movzx edx, word [esp + 0x234]
mov ecx, dword [esp + 0x22c]
mov eax, dword [edx*8 + 0x1315e4d4]
xor ecx, esp
mov dword [0x13169308], 1
call fcn.1303468b
add esp, 0x230
ret 4
push esi
call ebp
jmp 0x1305c03b

Function at 0x1305c6a0
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push 0
push 0
push eax
push ecx
push 0
push 0
call fcn.13080ee3
add esp, 0x18
test eax, eax
je 0x1305c6c3
cmp eax, 0xffffffff
jne 0x1305c6c5
xor eax, eax
ret

Function at 0x1305c770
Capabilities:
Create udp socket

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x23c], 2
jne 0x1305c782
jmp fcn.1305c710
mov eax, 1
ret
Function at 0x1305cac0
Capabilities:
Parse pe header

Disassembly:
mov al, byte [esp + 4]
movsx ecx, al
add ecx, 0xffffff9f
cmp ecx, 0x19
ja case.default.0x1305cacf
jmp dword [ecx*4 + 0x1305cb24]
mov al, 0x41
ret
mov al, 0x42
ret
mov al, 0x43
ret
mov al, 0x44
ret
mov al, 0x45
ret
mov al, 0x46
ret
mov al, 0x47
ret
mov al, 0x48
ret
mov al, 0x49
ret
mov al, 0x4a
ret
mov al, 0x4b
ret
mov al, 0x4c
ret
mov al, 0x4d
ret
mov al, 0x4e
ret
mov al, 0x4f
ret
mov al, 0x50
ret
mov al, 0x51
ret
mov al, 0x52
ret
mov al, 0x53
ret
mov al, 0x54
ret
mov al, 0x55
ret
mov al, 0x56
ret
mov al, 0x57
ret
mov al, 0x58
ret
mov al, 0x59
ret
mov al, 0x5a
ret
Function at 0x130691f0
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esi + 0x10]
mov ecx, dword [eax]
push str.Connected_for_receive
push 0x1311673c
push ecx
call fcn.13057010
add esp, 0xc
mov eax, esi
mov dword [esi], 1
call fcn.13068360
test eax, eax
jne 0x13069220
mov eax, esi
jmp fcn.130687f0
ret
Function at 0x13069630
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x88
mov eax, dword [0x1315d264]
xor eax, esp
mov dword [esp + 0x84], eax
push ebx
push ebp
mov ebp, dword [esp + 0x94]
mov ebx, dword [ebp]
push esi
mov esi, dword [ebp + 0x3e8]
push edi
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 0x80
mov edx, dword [esi + 0x154]
mov eax, dword [esi + 0x15c]
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esi + 0x14]
push 0
add edx, 4
lea edi, [esi + 0x15c]
push edx
push eax
push ecx
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [esi + 0x148], 0
mov dword [esi + 0x14c], eax
jne 0x130696bf
mov edx, dword [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esi + 0xc8]
push ecx
call fcn.13030640
mov edx, dword [esp + 0x1c]
add esp, 0xc
mov dword [esi + 0x148], edx
mov edx, dword [esi + 0x14c]
cmp edx, 4
jge 0x130696fa
push str.Received_too_short_packet
push ebx
call fcn.130570a0
add esp, 8
mov dword [esi + 0xc], 7
xor eax, eax
mov ecx, dword [esp + 0x94]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1303468b
add esp, 0x88
ret
mov eax, edi
call fcn.130684e0
movzx eax, ax
mov dword [esi + 0xc], eax
add eax, 0xfffffffd
cmp eax, 3
ja case.default.0x13069713
jmp dword [eax*4 + 0x13069800]
cmp edx, 4
jle case.0x13069713.4
mov eax, edi
call fcn.130684f0
movzx ecx, word [esi + 0x40]
add ecx, 1
cmp cx, ax
jne case.0x13069713.4
add edx, 0xfffffffc
push edx
mov edx, dword [edi]
add edx, 4
push edx
push 1
push ebp
call fcn.13057380
mov edi, eax
add esp, 0x10
test edi, edi
je 0x13069768
mov ecx, 5
mov eax, esi
call fcn.130695b0
mov eax, edi
jmp 0x130696e1
mov eax, dword [esi + 0x14c]
sub eax, 4
cdq
add dword [ebx + 0x38], eax
mov ecx, dword [ebx + 0x38]
adc dword [ebx + 0x3c], edx
mov eax, dword [ebx + 0x3c]
push eax
push ecx
push ebx
call fcn.13060140
jmp 0x130697d4
mov eax, edi
call fcn.130684f0
movzx edx, ax
mov eax, dword [edi]
add eax, 4
push eax
push 0x1311673c
push ebx
mov dword [esi + 8], edx
call fcn.13057010
jmp 0x130697d4
mov ecx, dword [edi]
add edx, 0xfffffffe
push edx
add ecx, 2
push ecx
push esi
call fcn.13068590
add esp, 0xc
test eax, eax
je case.0x13069713.4
jmp 0x130696e1
push str.Internal_error:_Unexpected_packet
push 0x13116558
push ebx
call fcn.130570a0
add esp, 0xc
push ebp
call fcn.13060200
add esp, 4
test eax, eax
je 0x130696df
mov ecx, 5
mov eax, esi
call fcn.130695b0
mov eax, 0x2a
jmp 0x130696e1

Function at 0x1306b020
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x1315d264]
xor eax, esp
mov dword [esp + 0x190], eax
lea eax, [esp]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x1306b055
push eax
push str.WSAStartup_failed___d_
push esi
call fcn.130570a0
add esp, 0xc
jmp 0x1306b08c
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ax, word [esp]
cmp al, 2
jne 0x1306b07e
test ah, ah
jne 0x1306b07e
xor eax, eax
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.1303468b
add esp, 0x194
ret
push str.insufficient_winsock_version_to_support_telnet
push esi
call fcn.130570a0
add esp, 8
mov ecx, dword [esp + 0x190]
xor ecx, esp
mov eax, 2
call fcn.1303468b
add esp, 0x194
ret
Function at 0x1306b230
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
mov edx, dword [edi + 0x130]
mov al, byte [esp + 8]
push esi
mov esi, dword [edi]
push 0
push 3
lea ecx, [esp + 0xc]
push ecx
push edx
mov byte [esp + 0x14], 0xff
mov byte [esp + 0x15], al
mov byte [esp + 0x16], bl
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jge 0x1306b274
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push esi
call fcn.130570a0
add esp, 0xc
mov esi, dword [esp + 0xc]
mov ecx, dword [edi]
push str.SENT
mov eax, ebx
call fcn.1306b120
add esp, 4
pop esi
pop ecx
ret
Function at 0x1306bfd0
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
cmp dword [esp + 0xc], 0x1f
mov eax, dword [esp + 8]
mov eax, dword [eax]
push ebx
mov ebx, dword [eax + 0x867c]
mov dword [esp + 4], eax
jne 0x1306c143
push ebp
push esi
push edi
lea edi, [ebx + 0x1cb0]
lea ebp, [ebx + 0x1eb0]
cmp edi, ebp
mov dword [ebp], edi
jae 0x1306c00a
mov byte [edi], 0xff
add dword [ebp], 1
mov eax, dword [ebp]
cmp eax, ebp
jae 0x1306c018
mov byte [eax], 0xfa
add dword [ebp], 1
mov eax, dword [ebp]
cmp eax, ebp
jae 0x1306c026
mov byte [eax], 0x1f
add dword [ebp], 1
movzx ecx, word [ebx + 0x1ca8]
mov esi, dword [sym.imp.WS2_32.dll_htons]
push ecx
call esi
movzx edx, ax
movzx eax, word [ebx + 0x1caa]
push eax
mov dword [esp + 0x20], edx
call esi
movzx ecx, ax
mov eax, dword [ebp]
cmp eax, ebp
jae 0x1306c05b
mov dl, byte [esp + 0x1c]
mov byte [eax], dl
add dword [ebp], 1
mov eax, dword [ebp]
cmp eax, ebp
jae 0x1306c06c
mov dl, byte [esp + 0x1d]
mov byte [eax], dl
add dword [ebp], 1
mov eax, dword [ebp]
cmp eax, ebp
jae 0x1306c079
mov byte [eax], cl
add dword [ebp], 1
mov eax, dword [ebp]
cmp eax, ebp
jae 0x1306c086
mov byte [eax], ch
add dword [ebp], 1
mov eax, dword [ebp]
cmp eax, ebp
jae 0x1306c094
mov byte [eax], 0xff
add dword [ebp], 1
mov eax, dword [ebp]
cmp eax, ebp
jae 0x1306c0a2
mov byte [eax], 0xf0
add dword [ebp], 1
mov eax, dword [ebp]
mov esi, dword [esp + 0x10]
mov ecx, eax
sub ecx, edi
sub ecx, 2
push ecx
lea edx, [ebx + 0x1cb2]
push edx
push 0x3e
mov dword [ebx + 0x1eb4], eax
mov dword [ebp], edi
call fcn.1306b5e0
mov ebp, dword [sym.imp.WS2_32.dll_send]
add esp, 0xc
push 0
push 3
push edi
mov edi, dword [esp + 0x24]
mov eax, dword [edi + 0x130]
push eax
call ebp
test eax, eax
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
jge 0x1306c102
call esi
mov ecx, dword [esp + 0x10]
push eax
push str.Sending_data_failed___d_
push ecx
call fcn.130570a0
add esp, 0xc
lea edx, [ebx + 0x1cb3]
push 4
push edx
call fcn.1306be60
mov eax, dword [edi + 0x130]
add esp, 8
push 0
push 2
add ebx, 0x1cb7
push ebx
push eax
call ebp
test eax, eax
jge 0x1306c140
call esi
mov ecx, dword [esp + 0x10]
push eax
push str.Sending_data_failed___d_
push ecx
call fcn.130570a0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x1306cb90
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x88
mov eax, dword [0x1315d264]
xor eax, esp
mov dword [esp + 0x84], eax
push ebx
mov ebx, dword [esi + 0x134]
push ebp
mov ebp, dword [esi]
push edi
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
push ebx
or edi, 0xffffffff
mov dword [esp + 0x18], 0x80
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x1306cbea
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x14]
push eax
push ebx
mov dword [esp + 0x18], 0x80
call dword [sym.imp.WS2_32.dll_accept]
mov edi, eax
push ebx
push esi
call fcn.13059860
add esp, 8
cmp edi, 0xffffffff
jne 0x1306cc24
push str.Error_accept__ing_server_connect
push ebp
call fcn.130570a0
add esp, 8
pop edi
pop ebp
mov eax, 0x1e
pop ebx
mov ecx, dword [esp + 0x84]
xor ecx, esp
call fcn.1303468b
add esp, 0x88
ret
push str.Connection_accepted_from_server_n
push ebp
call fcn.13057010
push 1
push edi
mov dword [esi + 0x134], edi
call fcn.1307ad90
mov dword [esi + 0x13c], 1
mov eax, dword [ebp + 0x16c]
add esp, 0x10
test eax, eax
je 0x1306cc98
mov ecx, dword [ebp + 0x170]
push 1
push edi
push ecx
call eax
add esp, 0xc
test eax, eax
je 0x1306cc98
push edi
push esi
call fcn.13059860
add esp, 8
pop edi
pop ebp
mov dword [esi + 0x134], 0xffffffff
mov eax, 0x2a
pop ebx
mov ecx, dword [esp + 0x84]
xor ecx, esp
call fcn.1303468b
add esp, 0x88
ret
mov ecx, dword [esp + 0x90]
pop edi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.1303468b
add esp, 0x88
ret
Function at 0x130703f0
Capabilities:
Check http status code

Disassembly:
mov eax, 0x51eb851f
imul ecx
sar edx, 5
push ebx
mov ebx, dword [edi]
mov eax, edx
push ebp
mov ebp, dword [esp + 0xc]
shr eax, 0x1f
push esi
add eax, edx
xor esi, esi
cmp eax, 2
je 0x13070428
push str.Couldnt_set_desired_mode
push ebx
call fcn.130570a0
add esp, 8
pop esi
pop ebp
mov eax, 0x11
pop ebx
ret
cmp ecx, 0xc8
je 0x1307043f
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push ebx
call fcn.13057010
add esp, 0xc
cmp ebp, 0x13
jne 0x13070453
push edi
call fcn.13070380
add esp, 4
mov esi, eax
pop esi
pop ebp
pop ebx
ret
cmp ebp, 0x14
jne 0x13070467
push edi
call fcn.1306d6c0
add esp, 4
mov esi, eax
pop esi
pop ebp
pop ebx
ret
cmp ebp, 0x15
jne 0x13070479
mov ecx, edi
call fcn.130703d0
mov esi, eax
pop esi
pop ebp
pop ebx
ret
cmp ebp, 0x16
jne 0x13070487
mov ecx, edi
call fcn.130703e0
mov esi, eax
mov eax, esi
pop esi
pop ebp
pop ebx
ret
Function at 0x13077670
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x1315d264]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
call fcn.1303e670
add esp, 4
test eax, eax
mov byte [esp], 0
je 0x130776d5
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [esp], 0
je 0x130776d5
lea edx, [esp]
push edx
call dword [0x1315e484]
add esp, 4
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.1303468b
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor ecx, esp
xor eax, eax
call fcn.1303468b
add esp, 0x108
ret
jmp 0x13077670

Function at 0x130776f0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x1315d264]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
call fcn.1303e670
add esp, 4
test eax, eax
mov byte [esp], 0
je 0x130776d5
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [esp], 0
je 0x130776d5
lea edx, [esp]
push edx
call dword [0x1315e484]
add esp, 4
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.1303468b
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor ecx, esp
xor eax, eax
call fcn.1303468b
add esp, 0x108
ret
jmp 0x13077670
Function at 0x1307af00
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [eax + 0x2c]
push esi
push edi
mov edi, dword [ebx]
mov esi, dword [edi + 0x1a8]
test esi, esi
jne 0x1307af19
mov esi, dword [eax + 0x28]
mov ecx, dword [eax + 0x24]
mov edx, dword [eax + 0x20]
push ecx
push edx
call fcn.1305b400
push edx
push eax
call fcn.1305b430
add esp, 0x10
sub esi, eax
cmp dword [edi + 0x19c], 0
je 0x1307af66
mov eax, dword [ebx + 0x124]
mov ecx, dword [ebx + 0x120]
push eax
push ecx
call fcn.1305b400
push edx
push eax
call fcn.1305b430
mov ecx, dword [edi + 0x19c]
sub ecx, eax
add esp, 0x10
cmp esi, ecx
mov eax, ecx
jge 0x1307af68
mov eax, esi
pop edi
pop esi
pop ebx
ret

Function at 0x1307bf90
Capabilities:
Get hostname

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push esi
mov byte [esi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
mov byte [esi + edi - 1], 0
jne 0x1307bfc2
push 0x2e
push esi
call fcn.1304a550
add esp, 8
test eax, eax
je 0x1307bfc0
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
ret

Function at 0x1307dfc0
Capabilities:
Read file on windows

Disassembly:
push edi
mov edi, eax
mov eax, dword [esi]
cmp dword [eax + 4], 2
jne 0x1307dfe2
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x1307dfd6
xor eax, eax
pop edi
ret
mov eax, dword [eax + 8]
push eax
push edi
push 1
push ebx
call ecx
jmp 0x1307e012
cmp dword [esi + 8], 0
jne 0x1307e005
mov ecx, dword [eax + 8]
push 0x1311cc98
push ecx
call fcn.13036b3f
add esp, 8
test eax, eax
mov dword [esi + 8], eax
jne 0x1307e005
or eax, 0xffffffff
pop edi
ret
mov edx, dword [esi + 8]
push edx
push edi
push 1
push ebx
call fcn.13080706
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x1307e034
mov eax, dword [esi + 8]
test eax, eax
je 0x1307e02e
push eax
call fcn.13033731
add esp, 4
mov dword [esi + 8], edi
mov eax, dword [esi]
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, edi
pop edi
ret