joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45a280
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x45a418
test edx, edx
js 0x45a418
cmp dword [esi], 0
jl 0x45a2ad
mov eax, 0xb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push edx
mov dword [esi], edx
call dword [0x717164]
push 0x40
lea edi, [esi + 4]
push edi
push dword [esi]
call dword [0x71715c]
add esp, 0x1c
cmp eax, 0x40
je 0x45a2de
mov eax, 0xfffffffb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x45a418
push 0
push 0
push dword [esi + 0x40]
push dword [esi]
call dword [0x717164]
push 0xf8
lea edi, [esi + 0x48]
push edi
push dword [esi]
call dword [0x71715c]
add esp, 0x1c
cmp eax, 0xf8
jne 0x45a2d2
cmp dword [edi], 0x4550
jne 0x45a418
xor eax, eax
mov ecx, 0x20b
cmp word [esi + 0x60], cx
sete al
mov dword [esi + 0x44], eax
test eax, eax
je 0x45a369
push 0
push 0
push dword [esi + 0x40]
push dword [esi]
call dword [0x717164]
push 0x108
push edi
push dword [esi]
call dword [0x71715c]
add esp, 0x1c
cmp eax, 0x108
jne 0x45a2d2
mov eax, 0x130
jmp 0x45a36e
mov eax, 0x120
lea edi, [eax + esi]
movzx eax, word [esi + 0x4e]
mov dword [esi + 0x150], eax
mov dword [esp + 0xc], edi
lea eax, [eax + eax*4]
shl eax, 3
push eax
call fcn.0060a1f7
movzx ecx, word [esi + 0x5c]
add esp, 4
mov dword [esi + 0x154], eax
add ecx, 0x18
mov eax, dword [esi + 0x40]
add eax, ecx
push 0
push 0
push eax
push dword [esi]
call dword [0x717164]
xor ebx, ebx
add esp, 0x10
cmp dword [esi + 0x150], ebx
jle 0x45a3ee
xor edi, edi
nop dword [eax]
mov eax, dword [esi + 0x154]
push 0x28
add eax, edi
push eax
push dword [esi]
call dword [0x71715c]
add esp, 0xc
cmp eax, 0x28
jne 0x45a2d2
inc ebx
add edi, eax
cmp ebx, dword [esi + 0x150]
jl 0x45a3c0
mov edi, dword [esp + 0xc]
mov ecx, dword [edi]
mov dword [esi + 0x188], ecx
mov eax, dword [edi + 4]
add eax, ecx
mov ecx, esi
mov dword [esi + 0x18c], eax
call fcn.00459b80
mov ecx, esi
call fcn.00459780
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0xffffffea
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45c740
Capabilities:
Allocate or change rwx memory
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0xc], ecx
push ebx
push esi
push edi
test ecx, ecx
jne 0x45c75c
mov eax, 0xffffffea
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x45c750
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x45c750
movzx ebx, word [eax + 0x16]
mov edx, 0x20b
mov edi, dword [eax + 0x50]
cmp word [eax + 0x18], dx
je 0x45c797
mov edx, dword [eax + 0x34]
lea esi, [eax + 0xa0]
mov dword [ebp - 8], 0
jmp 0x45c7a6
mov edx, dword [eax + 0x30]
lea esi, [eax + 0xb0]
mov eax, dword [eax + 0x34]
mov dword [ebp - 8], eax
cmp dword [esi], 0
mov dword [ebp - 4], edx
je 0x45c87e
test bl, 1
jne 0x45c87e
lea eax, [ebp - 0x18]
push eax
push 0x40
push edi
push ecx
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
test eax, eax
jne 0x45c7d9
mov eax, 0xfffffff2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [esi]
mov edx, dword [ebp - 0xc]
add ebx, edx
mov eax, dword [esi + 4]
add eax, ebx
mov dword [ebp - 0x14], eax
cmp ebx, eax
jae 0x45c87e
lea eax, [ebx + 4]
xor edi, edi
mov dword [ebp - 0x10], eax
lea esi, [ebx + 8]
mov eax, dword [eax]
sub eax, 8
test eax, 0xfffffffe
jbe 0x45c870
nop word [eax + eax]
movzx eax, word [esi]
mov cx, ax
shr cx, 0xc
cmp cx, 3
jne 0x45c834
and eax, 0xfff
add eax, dword [ebx]
lea ecx, [eax + edx]
mov eax, dword [ebp + 8]
sub eax, dword [ebp - 4]
add dword [ecx], eax
jmp 0x45c85e
cmp cx, 0xa
jne 0x45c85e
mov ecx, dword [ebp + 8]
and eax, 0xfff
add eax, dword [ebx]
add edx, eax
mov dword [ebp - 0x1c], 0
sub ecx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
sbb eax, dword [ebp - 8]
add dword [edx], ecx
adc dword [edx + 4], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
inc edi
add esi, 2
mov eax, dword [eax]
sub eax, 8
shr eax, 1
cmp edi, eax
jl 0x45c810
mov eax, dword [ebp - 0x10]
add ebx, dword [eax]
cmp ebx, dword [ebp - 0x14]
jb 0x45c7f0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45c890
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, ecx
mov dword [ebp - 4], edx
test edi, edi
je 0x45c954
test edx, edx
je 0x45c954
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x45c954
mov eax, dword [edi + 0x3c]
add eax, edi
cmp dword [eax], 0x4550
jne 0x45c954
mov ecx, 0x20b
cmp word [eax + 0x18], cx
je 0x45c8e7
mov eax, dword [eax + 0x78]
test eax, eax
jne 0x45c8fb
mov eax, 0xfffffffe
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [eax + 0x88]
test eax, eax
jne 0x45c8fb
mov eax, 0xfffffffe
pop edi
mov esp, ebp
pop ebp
ret
mov ecx, dword [eax + edi + 0x1c]
push ebx
lea ebx, [eax + edi]
add ecx, edi
mov eax, dword [ebx + 0x20]
mov dword [ebp - 0xc], ecx
add eax, edi
mov ecx, dword [ebx + 0x24]
push esi
add ecx, edi
mov dword [ebp - 0x10], eax
xor esi, esi
mov dword [ebp - 8], ecx
cmp dword [ebx + 0x18], esi
jbe 0x45c94b
mov ecx, dword [eax + esi*4]
mov eax, dword [ebp - 8]
add ecx, edi
mov edx, dword [ebp - 0xc]
push dword [ebp + 8]
movzx eax, word [eax + esi*2]
push dword [edx + eax*4]
mov edx, dword [ebp - 4]
push ecx
call edx
add esp, 0xc
test eax, eax
je 0x45c94b
mov eax, dword [ebp - 0x10]
inc esi
cmp esi, dword [ebx + 0x18]
jb 0x45c920
mov eax, esi
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
mov eax, 0xffffffea
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x45de70
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x746384]
push ebx
xor ebx, ebx
mov dword [ebp - 4], 0
push esi
mov edx, dword [eax]
cmp eax, 0x746384
je 0x45dead
nop
mov eax, dword [eax - 4]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x45de96
sub eax, esi
inc eax
add ebx, eax
mov eax, edx
mov edx, dword [edx]
cmp eax, 0x746384
jne 0x45de90
push edi
inc ebx
push ebx
call fcn.0060a1f7
push ebx
mov edi, eax
push 0
push edi
mov dword [ebp - 0xc], edi
call fcn.005f46f0
mov esi, dword [0x746384]
add esp, 0x10
mov eax, dword [esi]
mov dword [ebp - 8], eax
cmp esi, 0x746384
je 0x45df1e
nop dword [eax]
mov ecx, dword [esi - 4]
mov edx, edi
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx], al
lea edx, [edx + 1]
test al, al
jne 0x45dee5
mov ecx, dword [esi - 4]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x45df00
mov eax, dword [ebp - 8]
sub ecx, edx
inc edi
mov esi, eax
add edi, ecx
mov eax, dword [eax]
mov dword [ebp - 8], eax
cmp esi, 0x746384
jne 0x45dee0
lea eax, [ebp - 4]
push eax
push 0xf013f
push 0
push str.SystemCurrentControlSetHRKill
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
pop edi
test eax, eax
je 0x45df6a
cmp eax, 2
jne 0x45df91
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.SystemCurrentControlSetHRKill
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x45df91
push ebx
push dword [ebp - 0xc]
push 7
push 0
push 0x6f4ae8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
mov ebx, 0xfffffffe
mov ecx, 1
cmove ebx, ecx
jmp 0x45df96
mov ebx, 0xfffffffe
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x45dfa6
push eax
call fcn.005fa0fb
add esp, 4
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x45dfb4
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x460a70
Capabilities:
Get session user name
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa1c
mov eax, dword [0x70e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x100
lea eax, [ebp - 0x104]
mov esi, ecx
push 0
push eax
mov dword [ebp - 0xa14], esi
call fcn.005f46f0
push 0x100
lea eax, [ebp - 0x204]
mov dword [ebp - 0xa08], 0x80
push 0
push eax
call fcn.005f46f0
push 0x800
lea eax, [ebp - 0xa04]
mov dword [ebp - 0xa0c], 0x80
push 0
push eax
call fcn.005f46f0
add esp, 0x24
mov dword [ebp - 0xa10], 0x400
lea eax, [ebp - 0xa08]
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x460bef
lea eax, [ebp - 0xa1c]
push eax
lea eax, [ebp - 0xa0c]
push eax
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0xa10]
push eax
lea eax, [ebp - 0xa04]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x460bef
push ebx
push edi
lea eax, [ebp - 0xa04]
push eax
call dword [sym.imp.ADVAPI32.dll_GetSidIdentifierAuthority]
mov edi, eax
lea eax, [ebp - 0xa04]
push eax
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
push 1
push 0x6f4b90
push 0x80
mov bl, byte [eax]
push esi
call fcn.0040ca40
lea esi, [esi + eax*2]
movzx eax, byte [edi + 5]
push eax
push 0x6f4b9c
push 0x80
push esi
call fcn.0040ca40
add esp, 0x20
xor edi, edi
lea esi, [esi + eax*2]
movzx eax, bl
mov dword [ebp - 0xa18], eax
test bl, bl
je 0x460bd9
mov ebx, dword [ebp - 0xa14]
push edi
lea eax, [ebp - 0xa04]
push eax
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
mov ecx, esi
sub ecx, ebx
sar ecx, 1
push dword [eax]
mov eax, 0x400
push 0x6f4b9c
sub eax, ecx
push eax
push esi
call fcn.0040ca40
inc edi
add esp, 0x10
lea esi, [esi + eax*2]
cmp edi, dword [ebp - 0xa18]
jl 0x460ba1
pop edi
pop ebx
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aa758
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.004aa758
mov esp, ebp
pop ebp
ret

Function at 0x4617c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
xor eax, eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov edx, edi
or edx, esi
or edx, ebx
test edx, 3
jne 0x461830
mov ecx, dword [ebp + 0xc]
xor edx, edx
xor ebx, ebx
lea eax, [esi + ecx]
add ecx, 3
shr ecx, 2
cmp esi, eax
cmova ecx, edx
mov dword [ebp + 0xc], ecx
test ecx, ecx
je 0x461844
sub edi, esi
nop dword [eax]
mov ecx, dword [esi]
lea esi, [esi + 4]
mov edx, ecx
mov eax, ecx
shr edx, 8
inc ebx
shl eax, 8
xor edx, eax
shl ecx, 8
and edx, 0xff00ff
xor edx, ecx
rol edx, 0x10
mov dword [edi + esi - 4], edx
cmp ebx, dword [ebp + 0xc]
jb 0x461800
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x461844
mov cl, byte [eax + esi]
mov edx, eax
xor edx, 3
inc eax
mov byte [edx + edi], cl
cmp eax, ebx
jb 0x461834
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x461960
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0xf013f
push 0
push str.SystemCurrentControlSetControlServiceGroupOrder
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
test edi, edi
jne 0x461a84
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 0x10]
push eax
push edi
push str.List
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
cmp edi, 0xea
je 0x461a84
mov eax, dword [ebp - 8]
add eax, 7
push ebx
push eax
push 1
mov dword [ebp - 0xc], eax
call fcn.0060b9f0
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x461a83
mov ecx, 0x6f4af8
mov edx, ebx
sub edx, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x4619e7
mov ecx, ebx
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x461a00
push esi
sub ecx, edx
lea eax, [ebp - 8]
push eax
lea esi, [ebx + 1]
add esi, ecx
lea eax, [ebp - 0x10]
push esi
push eax
push 0
push str.List
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
test edi, edi
jne 0x461a79
cmp byte [esi], al
je 0x461a60
push 0x6f4af8
push esi
call fcn.00628761
add esp, 8
test eax, eax
je 0x461a99
mov eax, esi
lea edx, [eax + 1]
nop dword [eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x461a50
sub eax, edx
inc esi
add esi, eax
cmp byte [esi], cl
jne 0x461a32
mov edi, dword [ebp - 0xc]
push edi
push ebx
push 7
push 0
push str.List
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, eax
push ebx
call fcn.005fa0fb
add esp, 4
pop esi
pop ebx
mov eax, dword [ebp - 4]
test eax, eax
je 0x461a92
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0xc]
lea eax, [edi + ebx]
sub eax, esi
sub eax, 7
push eax
lea eax, [esi + 7]
push eax
push esi
call fcn.005f40c0
add esp, 0xc
sub edi, 7
jmp 0x461a63
Function at 0x464120
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
test ebx, ebx
jne 0x464162
cmp byte [esi + 0x40], bl
jne 0x46415a
push dword [0x6e7798]
lea ecx, [esi + 0x48]
mov byte [esi + 0x40], 1
mov dword [esi + 0x44], 2
call fcn.004053b0
mov dword [esi + 0x68], 0xffffffff
mov dword [esi + 0x64], 0xffffffff
pop esi
xor al, al
pop ebx
pop ebp
ret 8
push edi
mov edi, dword [esi + 0x18]
test edi, edi
je 0x46417f
nop word [eax + eax]
mov ecx, edi
mov edi, dword [edi + 0x3c]
push 1
mov eax, dword [ecx]
call dword [eax]
test edi, edi
jne 0x464170
push 2
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
push 0
push ebx
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
call fcn.00625095
push ebx
call fcn.00624b8d
push 0
mov edi, eax
push 0
push ebx
mov dword [ebp + 8], edi
call fcn.00625095
add esp, 0x1c
test edi, edi
jg 0x4641d6
cmp byte [esi + 0x40], 0
jne 0x46422f
push dword [0x6e77c0]
mov dword [esi + 0x44], 0xc
jmp 0x464215
lea eax, [edi + 1]
push eax
call fcn.0065e055
push ebx
mov ebx, dword [ebp + 8]
mov edi, eax
push 1
push ebx
push edi
mov byte [edi], 0
call fcn.006254e3
add esp, 0x14
cmp eax, 1
je 0x464238
push edi
call fcn.004aadd5
add esp, 4
cmp byte [esi + 0x40], 0
jne 0x46422f
push dword [0x6e7798]
mov dword [esi + 0x44], 2
lea ecx, [esi + 0x48]
mov byte [esi + 0x40], 1
call fcn.004053b0
mov dword [esi + 0x68], 0xffffffff
mov dword [esi + 0x64], 0xffffffff
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 8
mov byte [edi + ebx], 0
mov eax, edi
cmp byte [edi], 0
mov ecx, edi
je 0x464263
mov dl, byte [eax]
mov ebx, eax
cmp dl, 0xd
jne 0x46425a
inc eax
mov byte [ecx], 0xa
cmp byte [eax], 0xa
cmovne eax, ebx
jmp 0x46425c
mov byte [ecx], dl
inc eax
inc ecx
cmp byte [eax], 0
jne 0x464245
mov byte [ecx], 0
mov ecx, esi
mov eax, dword [esi]
push 0
push 0
push edi
call dword [eax + 8]
push edi
call fcn.004aadd5
add esp, 4
cmp byte [esi + 0x40], 0
sete al
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x467d50
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x198
mov eax, dword [0x70e00c]
xor eax, esp
mov dword [esp + 0x194], eax
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x467da5
mov eax, dword [esp]
cmp al, 2
jne 0x467d9f
shr eax, 8
cmp al, 2
jne 0x467d9f
xor eax, eax
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.004aa758
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x194]
mov eax, 2
xor ecx, esp
call fcn.004aa758
mov esp, ebp
pop ebp
ret
Function at 0x46c420
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, ecx
mov eax, edx
push esi
shl eax, 4
push edi
mov ecx, dword [ebx + edx*4 + 0x1a8]
lea esi, [ebx + 0x1cc]
add esi, eax
mov dword [esp + 0xc], ecx
mov eax, dword [ebx + 0x2e0]
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [eax + 0x40], 3
je 0x46c4e1
cmp dword [ebx + edx*4 + 0x1bc], 0x46c9e0
jne 0x46c4e1
cmp dword [esi], 0
je 0x46c470
test edi, edi
je 0x46c4e1
push 0
push 0
push 0xffffffffffffffff
or edx, 0xffffffff
call fcn.0046ebd0
add esp, 0xc
cmp eax, 0xffffffff
je 0x46c4e1
test al, 1
je 0x46c4e1
cmp dword [esi], 0
jne 0x46c4c7
mov eax, dword [ebx]
mov eax, dword [eax + 0x350]
add eax, eax
push eax
mov dword [esi + 4], eax
call dword [0x7253b8]
mov edi, dword [esi + 4]
add esp, 4
mov dword [esi], eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
test eax, eax
jne 0x46c4c7
mov dword [esi + 4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
add eax, dword [esi + 8]
push 0
push edi
push eax
push dword [esp + 0x18]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x46c4e1
add dword [esi + 8], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46c920
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, edi
mov esi, dword [edi + edx*4 + 0x1a8]
call fcn.0046c420
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
call dword [sym.imp.WS2_32.dll_send]
mov ebx, eax
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
cmp ebx, 0xffffffff
jne 0x46c9a3
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
jne 0x46c979
mov eax, dword [ebp + 0x18]
mov dword [eax], 0x51
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
mov edx, esi
mov ecx, edi
call fcn.00488d10
push eax
push str.Send_failure:__s
push dword [edi]
call fcn.0046c5e0
mov eax, dword [edi]
add esp, 0xc
mov dword [eax + 0x473c], esi
mov eax, dword [ebp + 0x18]
mov dword [eax], 0x37
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x46cf30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 0x1d0]
test eax, eax
je 0x46cf56
push dword [esi + 0x15c]
push dword [ebp + 0xc]
push dword [ebp + 8]
push edx
push esi
call eax
add esp, 0x14
pop esi
pop ebp
ret
cmp edx, 2
ja 0x46cf8a
push dword [esi + 0x158]
lea eax, [edx*2 + 0x6e782c]
push 1
add eax, edx
push 2
push eax
call fcn.0061981f
push dword [esi + 0x158]
push 1
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0061981f
add esp, 0x20
xor eax, eax
pop esi
pop ebp
ret
Function at 0x46cf90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb0
mov eax, dword [0x70e00c]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
push edi
mov edi, edx
mov dword [ebp - 0xb0], ecx
cmp byte [esi + 0x378], 0
je 0x46d04b
test eax, eax
je 0x46d04b
mov edx, dword [eax + 0xa4]
test edx, edx
je 0x46d04b
lea ecx, [edi - 1]
mov eax, str.Data
cmp ecx, 3
ja case.default.0x46cfe2
jmp dword [ecx*4 + 0x46d0c8]
mov eax, str.Header
mov ecx, str.from
jmp 0x46cfff
mov eax, str.Header
mov ecx, 0x6f5558
push edx
push ecx
push eax
push str.__s__s__s_
lea eax, [ebp - 0xac]
push 0xa0
push eax
call sym.hrkill.exe_curl_msnprintf
lea ecx, [ebp - 0xac]
add esp, 0x18
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x46d024
sub ecx, edx
lea eax, [ebp - 0xac]
push ecx
push eax
xor edx, edx
mov ecx, esi
call fcn.0046cf30
add esp, 8
test eax, eax
jne 0x46d0b4
mov ecx, dword [ebp - 0xb0]
mov eax, dword [esi + 0x1d0]
xor ebx, ebx
test eax, eax
je 0x46d07b
push dword [esi + 0x15c]
push dword [ebp + 0xc]
push ecx
push edi
push esi
call eax
add esp, 0x14
mov ebx, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004aa758
mov esp, ebp
pop ebp
ret
cmp edi, 2
ja 0x46d0b2
push dword [esi + 0x158]
lea eax, [edi*2 + 0x6e782c]
push 1
add eax, edi
push 2
push eax
call fcn.0061981f
push dword [esi + 0x158]
push 1
push dword [ebp + 0xc]
push dword [ebp - 0xb0]
call fcn.0061981f
add esp, 0x20
mov eax, ebx
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004aa758
mov esp, ebp
pop ebp
ret

Function at 0x46d0e0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x70e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
xor eax, eax
push edi
push 4
mov edi, edx
cmp byte [esi + 0x4d8], al
setne al
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 8
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x46d13b
push edi
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
push esi
call fcn.0046c560
add esp, 0xc
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aa758
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x4dc]
and eax, 0x7fffffff
mov dword [ebp - 0x14], 1
imul eax, eax, 0x3e8
push 0
push 0
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x4e0]
and eax, 0x7fffffff
imul eax, eax, 0x3e8
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0xc
lea eax, [ebp - 0x14]
push eax
push 0x98000004
push edi
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x46d1a5
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
push esi
call fcn.0046c560
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004aa758
mov esp, ebp
pop ebp
ret
Function at 0x46dae0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x70e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
push edi
mov esi, edx
cmp dword [ebx + 0x94], 2
mov edi, dword [ebx]
mov dword [ebp - 0x10c], edi
je 0x46dcd0
cmp byte [ebx + 0x29e], 0
jne 0x46dcc9
cmp byte [ebx + 0x2ba], 0
jne 0x46dcc9
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x80
push eax
lea eax, [ebp - 0x108]
push eax
push esi
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x46db78
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
mov ecx, ebx
mov edx, esi
call fcn.00488d10
push eax
push esi
push str.getpeername___failed_with_errno__d:__s
push edi
call fcn.0046c5e0
add esp, 0x10
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aa758
mov esp, ebp
pop ebp
ret
push 0x80
lea eax, [ebp - 0x88]
mov dword [ebp - 8], 0x80
push 0
push eax
call fcn.005f46f0
add esp, 0xc
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x88]
push eax
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x46dbdd
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
mov ecx, ebx
mov edx, esi
call fcn.00488d10
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
push edi
call fcn.0046c5e0
add esp, 0x10
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aa758
mov esp, ebp
pop ebp
ret
lea eax, [ebx + 0x138]
lea esi, [ebx + 0x10a]
push eax
mov edx, esi
lea ecx, [ebp - 0x108]
call fcn.0046da70
add esp, 4
test al, al
jne 0x46dc3c
call fcn.0060a381
mov esi, eax
call fcn.0060a381
mov edx, dword [esi]
mov ecx, ebx
mov edi, eax
call fcn.00488d10
push eax
push dword [edi]
push str.ssrem_inet_ntop___failed_with_errno__d:__s
push dword [ebp - 0x10c]
call fcn.0046c5e0
add esp, 0x10
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aa758
mov esp, ebp
pop ebp
ret
movups xmm0, xmmword [esi]
mov eax, dword [esi + 0x28]
lea edx, [ebx + 0x13c]
lea ecx, [ebp - 0x88]
movups xmmword [ebx + 0x60], xmm0
movups xmm0, xmmword [esi + 0x10]
movups xmmword [ebx + 0x70], xmm0
movq xmm0, qword [esi + 0x20]
movq qword [ebx + 0x80], xmm0
mov dword [ebx + 0x88], eax
mov ax, word [esi + 0x2c]
mov word [ebx + 0x8c], ax
lea eax, [ebx + 0x16c]
push eax
call fcn.0046da70
add esp, 4
test al, al
jne 0x46dcc9
call fcn.0060a381
mov esi, eax
call fcn.0060a381
mov edx, dword [esi]
mov ecx, ebx
mov edi, eax
call fcn.00488d10
push eax
push dword [edi]
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push dword [ebp - 0x10c]
call fcn.0046c5e0
add esp, 0x10
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aa758
mov esp, ebp
pop ebp
ret
mov ecx, ebx
call fcn.0046d990
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004aa758
mov esp, ebp
pop ebp
ret