joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ccd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push edi
push esi
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
test ecx, ecx
sete dl
test eax, eax
sete dh
or dh, dl
jne 0x41cd15
mov dh, byte [ecx]
test dh, dh
je 0x41cd20
inc ecx
nop
movzx esi, byte [eax]
test esi, esi
setne dl
je 0x41cd22
movzx edi, dh
mov dh, byte [edi + 0x994128]
cmp dh, byte [esi + 0x994128]
jne 0x41cd30
inc eax
mov dh, byte [ecx]
inc ecx
test dh, dh
jne 0x41ccf0
jmp 0x41cd22
or ecx, eax
sete al
movzx eax, al
pop esi
pop edi
ret
mov dl, 1
cmp byte [eax], 0
setne al
xor al, dl
movzx eax, al
pop esi
pop edi
ret
xor eax, eax
movzx eax, al
pop esi
pop edi
ret

Function at 0x41d5e0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
test byte [esp + 0x194], 2
jne 0x41d652
push str.iphlpapi.dll
call fcn.0041d690
add esp, 4
mov dword [0xae4064], eax
test eax, eax
je 0x41d61b
push str.if_nametoindex
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41d61b
mov dword [0xae4060], eax
sub esp, 0x14
movaps xmm0, xmmword [0x995c50]
movups xmmword [esp], xmm0
mov dword [esp + 0x10], 3
call fcn.00427620
add esp, 0x14
mov byte [0xae4068], al
push 0xae4070
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor eax, eax
add esp, 0x190
ret
mov eax, esp
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x41d670
mov eax, 2
add esp, 0x190
ret
cmp word [esp], 0x202
je 0x41d5f0
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
add esp, 0x190
ret
Function at 0x41d690
Capabilities:
Get common file path

Disassembly:
push ebp
push ebx
push edi
push esi
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edi, edi
test eax, eax
je 0x41d7a2
mov ebx, eax
mov ebp, dword [esp + 0x14]
push str.LoadLibraryExA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push 0x995c94
push ebp
call sub.api_ms_win_crt_string_l1_1_0.dll_strpbrk
add esp, 8
test eax, eax
je 0x41d6d7
test esi, esi
je 0x41d6fa
push 8
jmp 0x41d6f0
test esi, esi
je 0x41d706
push str.AddDllDirectory
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41d706
push 0x800
push 0
push ebp
call esi
jmp 0x41d7a4
push ebp
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x41d7a4
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x41d7a2
mov ebp, eax
push dword [esp + 0x14]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
add eax, ebp
inc eax
push str.system_win32.c
push 0xd9
push eax
call fcn.004071e0
add esp, 0xc
mov ebx, eax
xor edi, edi
test eax, eax
je 0x41d78f
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x41d78f
push ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
mov word [ebx + eax], 0x5c
push ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
mov ecx, ebx
add ecx, eax
push dword [esp + 0x14]
push ecx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
add esp, 8
test esi, esi
je 0x41d786
push 8
push 0
push ebx
call esi
jmp 0x41d78d
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
push str.system_win32.c
push 0xe6
push ebx
call fcn.004075a0
add esp, 0xc
mov eax, edi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x425d50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov esi, edx
mov edi, ecx
mov ebp, dword [esp + 0x1c]
cmp byte [esp + 0x20], 0
mov ebx, edx
jne 0x425db1
mov dword [esp], edi
push 0x996d5e
push esi
call sub.api_ms_win_crt_private_l1_1_0.dll_strstr
add esp, 8
lea edi, [eax + 2]
test eax, eax
cmove edi, esi
push 0x3f
push edi
call sub.api_ms_win_crt_private_l1_1_0.dll_strchr
add esp, 8
mov ebx, eax
push 0x2f
push edi
call sub.api_ms_win_crt_private_l1_1_0.dll_strchr
add esp, 8
test eax, eax
je 0x425e79
test ebx, ebx
mov edi, dword [esp]
je 0x425e8f
cmp eax, ebx
cmovb ebx, eax
xor eax, eax
test ebp, ebp
je 0x425e71
movzx eax, byte [esp + 0x24]
xor al, 1
mov dword [esp], eax
nop word cs:[eax + eax]
cmp esi, ebx
jb 0x425e10
movzx eax, byte [esi]
cmp eax, 0x3f
je 0x425df0
cmp eax, 0x20
jne 0x425df9
test byte [esp], 1
je 0x425e26
push 3
push 0x996d5a
jmp 0x425e13
mov dword [esp], 0
jmp 0x425e10
cmp al, 0x20
jb 0x425e10
cmp eax, 0x20
je 0x425e10
cmp eax, 0x7f
je 0x425e10
cmp al, 0x7f
jae 0x425e2f
nop dword [eax + eax]
push 1
push esi
push edi
call fcn.004482c0
add esp, 0xc
test eax, eax
jne 0x425e5b
inc esi
dec ebp
jne 0x425dd0
jmp 0x425e6f
push 1
push 0x996d1c
jmp 0x425e13
mov byte [esp + 5], 0x25
mov ecx, eax
shr ecx, 4
movzx ecx, byte [ecx + 0x996d1e]
mov byte [esp + 6], cl
and eax, 0xf
movzx eax, byte [eax + 0x996d1e]
mov byte [esp + 7], al
push 3
lea eax, [esp + 9]
push eax
jmp 0x425e13
cmp eax, 0x64
mov eax, 0x1f
mov ecx, 7
cmove ecx, eax
mov eax, ecx
jmp 0x425e71
xor eax, eax
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
add eax, esi
test ebx, ebx
mov edi, dword [esp]
jne 0x425dac
push esi
mov edi, eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
mov ebx, eax
mov eax, edi
mov edi, dword [esp]
add ebx, esi
jmp 0x425dac
Function at 0x4388c0
Capabilities:
Set socket configuration

Disassembly:
push esi
sub esp, 0xc
mov dword [esp + 8], 0x4020
mov dword [esp], 0
mov dword [esp + 4], 4
mov eax, dword [0xae4158]
cmp eax, 2
je 0x438915
test eax, eax
jne 0x438924
sub esp, 0x14
movaps xmm0, xmmword [0x9998e0]
movups xmmword [esp], xmm0
mov dword [esp + 0x10], 3
call fcn.00427620
add esp, 0x14
test al, al
je 0x43891a
mov dword [0xae4158], 2
add esp, 0xc
pop esi
ret
mov dword [0xae4158], 1
mov esi, dword [esp + 0x14]
lea eax, [esp + 4]
mov ecx, esp
push eax
push ecx
push 0x1001
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x43894e
cmp dword [esp], 0x4020
jg 0x438915
lea eax, [esp + 8]
push 4
push eax
push 0x1001
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
add esp, 0xc
pop esi
ret

Function at 0x43a150
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov eax, dword [ecx + 0x98]
cmp eax, 0xffffffff
je 0x43a250
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x1a0
mov esi, dword [edx + 0x18]
mov esi, dword [esi + 0x2a8]
test byte [esi + 0x49], 8
jne 0x43a249
mov esi, ecx
mov edi, edx
mov dword [esp + 0xc], pe_nt_image_headers32
xorps xmm0, xmm0
movaps xmmword [esp + 0x10], xmm0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x30], xmm0
movaps xmmword [esp + 0x40], xmm0
movaps xmmword [esp + 0x50], xmm0
movaps xmmword [esp + 0x60], xmm0
movaps xmmword [esp + 0x70], xmm0
movaps xmmword [esp + 0x80], xmm0
lea ecx, [esp + 0xc]
lea ebx, [esp + 0x10]
push ecx
push ebx
push eax
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x43a1f7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
lea eax, [esp + 0x9c]
push 0x100
push eax
push esi
call fcn.0041d090
add esp, 0xc
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
jmp 0x43a240
lea eax, [esi + 0xca]
add esi, 0xfc
push esi
push eax
push dword [esp + 0x14]
push ebx
call fcn.0043ef30
add esp, 0x10
test al, al
jne 0x43a249
mov ebx, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
call ebx
mov esi, dword [eax]
call ebx
lea ecx, [esp + 0x9c]
push 0x100
push ecx
push dword [eax]
call fcn.0041d090
add esp, 0xc
push eax
push esi
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push edi
call fcn.00444f40
add esp, 0x10
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43b1e0
Capabilities:
Set socket configuration

Disassembly:
push ebx
push edi
push esi
push eax
mov edi, edx
mov esi, ecx
mov eax, dword [ecx + 0x6ec]
shr eax, 7
and eax, 1
mov dword [esp], eax
mov ebx, esp
push 4
push ebx
push 8
push 0xffff
push edx
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
js 0x43b2f3
push dword [esi + 0x690]
call fcn.00427850
add esp, 4
mov dword [esp], eax
push 4
push ebx
push 3
push 6
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x43b264
test byte [esi + 0x6eb], 0x20
je 0x43b264
mov eax, dword [esi + 0xd20]
test eax, eax
je 0x43b24e
cmp dword [eax + 4], 0
jle 0x43b264
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_TCP_KEEPIDLE_on_fd__d:_errno__d
push esi
call fcn.00444fd0
add esp, 0x10
push dword [esi + 0x694]
call fcn.00427850
add esp, 4
mov dword [esp], eax
push 4
push ebx
push 0x11
push 6
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x43b2b6
test byte [esi + 0x6eb], 0x20
je 0x43b2b6
mov eax, dword [esi + 0xd20]
test eax, eax
je 0x43b2a0
cmp dword [eax + 4], 0
jle 0x43b2b6
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_TCP_KEEPINTVL_on_fd__d:_errno__d
push esi
call fcn.00444fd0
add esp, 0x10
push dword [esi + 0x698]
call fcn.00427850
add esp, 4
mov dword [esp], eax
push 4
push ebx
push 0x10
push 6
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x43b323
test byte [esi + 0x6eb], 0x20
je 0x43b323
mov eax, dword [esi + 0xd20]
mov ebx, str.Failed_to_set_TCP_KEEPCNT_on_fd__d:_errno__d
test eax, eax
jne 0x43b30b
jmp 0x43b311
test byte [esi + 0x6eb], 0x20
je 0x43b323
mov eax, dword [esi + 0xd20]
mov ebx, str.Failed_to_set_SO_KEEPALIVE_on_fd__d:_errno__d
test eax, eax
je 0x43b311
cmp dword [eax + 4], 0
jle 0x43b323
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push ebx
push esi
call fcn.00444fd0
add esp, 0x10
add esp, 4
pop esi
pop edi
pop ebx
ret

Function at 0x443270
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push ebx
push edi
push esi
xor edi, edi
test ecx, ecx
je 0x443321
mov esi, ecx
push ecx
call fcn.00452870
add esp, 4
test al, al
jne 0x443321
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
mov edi, eax
push eax
push 0x2e
push esi
call fcn.00444880
add esp, 0xc
xor ebx, ebx
test eax, eax
je 0x4432c6
sub eax, esi
push eax
push 0x2e
push esi
call fcn.00444880
add esp, 0xc
test eax, eax
je 0x4432c6
inc eax
add edi, esi
sub edi, eax
mov ebx, eax
test ebx, ebx
cmovne esi, ebx
test edi, edi
jle 0x44331c
add edi, esi
mov ebx, 0x1505
nop word cs:[eax + eax]
movsx eax, byte [esi]
inc esi
push eax
call fcn.0041ccb0
add esp, 4
movsx eax, al
mov ecx, ebx
shl ecx, 5
add ebx, ecx
xor ebx, eax
cmp esi, edi
jb 0x4432e0
mov ecx, 0x4104105
mov eax, ebx
mul ecx
mov edi, ebx
sub edi, edx
shr edi, 1
add edi, edx
shr edi, 5
mov eax, edi
shl eax, 6
sub edi, eax
add edi, ebx
jmp 0x443321
mov edi, 0x1a
mov eax, edi
pop esi
pop edi
pop ebx
ret
Function at 0x444ea0
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x14]
test byte [esi + 0x6eb], 0x20
je 0x444f36
mov ebp, dword [esp + 0x20]
mov edi, dword [esp + 0x18]
cmp dword [esi + 0x194], 0
je 0x444f01
push esi
call fcn.00413440
add esp, 4
mov ebx, eax
push 1
push esi
call fcn.00413410
add esp, 8
push dword [esi + 0x144]
push ebp
push dword [esp + 0x24]
push edi
push esi
call dword [esi + 0x194]
add esp, 0x14
movzx eax, bl
push eax
push esi
call fcn.00413410
add esp, 8
jmp 0x444f36
cmp edi, 2
ja 0x444f36
lea eax, [edi + edi*2]
add eax, 0x99aac4
push dword [esi + 0x140]
push 1
push 2
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
push dword [esi + 0x140]
push 1
push ebp
push dword [esp + 0x28]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x44c4e0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push esi
mov edx, dword [ecx + 0x18]
test byte [ecx + 0x6e9], 1
jne 0x44c4f6
cmp byte [ecx + 0x3b0], 0
je 0x44c51e
mov eax, dword [edx + 0x374]
test eax, eax
je 0x44c51e
add edx, 0x308
push eax
push str.MDTM__s
push edx
mov esi, ecx
push ecx
call fcn.00467060
add esp, 0x10
test eax, eax
je 0x44c554
pop esi
ret
test byte [ecx + 0x13e], 2
je 0x44c54e
cmp dword [edx + 0x374], 0
je 0x44c54e
xor eax, eax
test byte [ecx + 0xd61], 0x10
sete al
movsx esi, byte [edx + 0x384]
lea eax, [eax*8 + 0x41]
cmp eax, esi
jne 0x44c5af
pop esi
jmp fcn.0044e3e0
mov eax, esi
mov esi, dword [esi + 0x18]
movzx ecx, byte [esi + 0x3b6]
cmp ecx, 0x12
je 0x44c5a4
test byte [eax + 0x6eb], 0x20
je 0x44c5a4
mov edx, dword [eax + 0xd20]
test edx, edx
je 0x44c57e
cmp dword [edx + 4], 0
jle 0x44c5a4
mov edx, dword [0xad5be8]
cmp dword [edx + 4], 0
jle 0x44c5a4
push str.MDTM
push dword [ecx*4 + 0x99b528]
push str.__s_______s_
push eax
call fcn.00445340
add esp, 0x10
mov byte [esi + 0x3b6], 0x12
xor eax, eax
pop esi
ret
mov eax, dword [ecx + 0x130]
mov dword [eax + 8], 1
mov eax, dword [ecx + 0xd60]
shr eax, 0xc
and eax, 1
push 0x13
push eax
call fcn.0044e270
add esp, 8
pop esi
ret

Function at 0x44c9f0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebx
push edi
push esi
lea eax, [edx - 0xc8]
cmp eax, 0x64
jae 0x44ca56
movzx ebx, byte [esp + 0x10]
mov esi, dword [ecx + 0x18]
cmp edx, 0xc8
je 0x44ca3a
test byte [ecx + 0x6eb], 0x20
je 0x44ca3a
mov eax, dword [ecx + 0xd20]
test eax, eax
je 0x44ca27
cmp dword [eax + 4], 0
jle 0x44ca3a
push edx
push str.Got_a__03d_response_code_instead_of_the_assumed_200
push ecx
mov edi, ecx
call fcn.00444fd0
mov ecx, edi
add esp, 0xc
movzx eax, bl
add eax, 0xffffffed
cmp eax, 3
ja case.default.0x44ca45
jmp dword [eax*4 + 0x99b390]
mov edx, esi
pop esi
pop edi
pop ebx
jmp fcn.0044e3e0
push str.Couldnt_set_desired_mode
push ecx
call fcn.00444f40
add esp, 8
mov eax, 0x11
pop esi
pop edi
pop ebx
ret
mov edx, 1
push 0xd
call fcn.0044c1d0
add esp, 4
pop esi
pop edi
pop ebx
ret
pop esi
pop edi
pop ebx
jmp 0x44f170
pop esi
pop edi
pop ebx
jmp 0x44efe0
xor eax, eax
pop esi
pop edi
pop ebx
ret
Function at 0x44d500
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push edi
push esi
mov esi, dword [ecx + 0x18]
add edx, 0xffffff38
cmp edx, 0x64
jae 0x44d5b9
test byte [ecx + 0x6eb], 0x20
je 0x44d542
mov eax, dword [ecx + 0xd20]
test eax, eax
je 0x44d52d
cmp dword [eax + 4], 0
jle 0x44d542
push str.Connect_data_stream_actively
push ecx
mov esi, ecx
call fcn.00444fd0
mov ecx, esi
add esp, 8
mov esi, dword [esi + 0x18]
movzx eax, byte [esi + 0x3b6]
mov edi, esi
test eax, eax
je 0x44d59b
test byte [ecx + 0x6eb], 0x20
mov edi, esi
je 0x44d59b
mov edx, dword [ecx + 0xd20]
test edx, edx
je 0x44d56c
cmp dword [edx + 4], 0
mov edi, esi
jle 0x44d59b
mov edx, dword [0xad5be8]
cmp dword [edx + 4], 0
mov edi, esi
jle 0x44d59b
push 0x99b5b8
push dword [eax*4 + 0x99b528]
push str.__s_______s_
push ecx
mov edi, ecx
call fcn.00445340
mov ecx, edi
add esp, 0x10
mov edi, dword [edi + 0x18]
mov byte [esi + 0x3b6], 0
mov eax, dword [ecx + 0x130]
cmp dword [eax + 8], 0
je 0x44d5df
push ecx
call fcn.0041ef50
add esp, 4
jmp 0x44d5e6
mov edx, dword [esi + 0x3a8]
test edx, edx
je 0x44d5f2
inc edx
cmp edx, 2
jne 0x44d629
push str.Failed_to_do_PORT
push ecx
call fcn.00444f40
add esp, 8
mov eax, 0x1e
pop esi
pop edi
ret
or byte [edi + 0x2a1], 0x10
or byte [edi + 0x3bc], 4
xor eax, eax
pop esi
pop edi
ret
test byte [ecx + 0x6eb], 0x20
je 0x44d61d
mov eax, dword [ecx + 0xd20]
test eax, eax
je 0x44d60b
cmp dword [eax + 4], 0
jle 0x44d61d
push str.disabling_EPRT_usage
push ecx
mov edi, ecx
call fcn.00444fd0
mov ecx, edi
add esp, 8
and byte [esi + 0x2a2], 0xfe
mov edx, 1
pop esi
pop edi
jmp fcn.0044e680
Function at 0x44e3e0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov eax, dword [ecx + 0x130]
cmp dword [eax + 8], 1
jne fcn.0044e480
mov eax, dword [edx + 0x374]
test eax, eax
je fcn.0044e480
push esi
add edx, 0x308
push eax
push str.SIZE__s
push edx
mov esi, ecx
push ecx
call fcn.00467060
add esp, 0x10
test eax, eax
je 0x44e41d
pop esi
ret
mov eax, esi
mov esi, dword [esi + 0x18]
movzx ecx, byte [esi + 0x3b6]
cmp ecx, 0x17
je 0x44e46d
test byte [eax + 0x6eb], 0x20
je 0x44e46d
mov edx, dword [eax + 0xd20]
test edx, edx
je 0x44e447
cmp dword [edx + 4], 0
jle 0x44e46d
mov edx, dword [0xad5be8]
cmp dword [edx + 4], 0
jle 0x44e46d
push 0x99b654
push dword [ecx*4 + 0x99b528]
push str.__s_______s_
push eax
call fcn.00445340
add esp, 0x10
mov byte [esi + 0x3b6], 0x17
xor eax, eax
pop esi
ret

Function at 0x44e480
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov eax, dword [ecx + 0x130]
cmp dword [eax + 8], 0
je fcn.0044e520
cmp dword [edx + 0x374], 0
je fcn.0044e520
push esi
add edx, 0x308
push 0
push str.REST__d
push edx
mov esi, ecx
push ecx
call fcn.00467060
add esp, 0x10
test eax, eax
je 0x44e4bd
pop esi
ret
mov eax, esi
mov esi, dword [esi + 0x18]
movzx ecx, byte [esi + 0x3b6]
cmp ecx, 0x1a
je 0x44e50d
test byte [eax + 0x6eb], 0x20
je 0x44e50d
mov edx, dword [eax + 0xd20]
test edx, edx
je 0x44e4e7
cmp dword [edx + 4], 0
jle 0x44e50d
mov edx, dword [0xad5be8]
cmp dword [edx + 4], 0
jle 0x44e50d
push str.REST
push dword [ecx*4 + 0x99b528]
push str.__s_______s_
push eax
call fcn.00445340
add esp, 0x10
mov byte [esi + 0x3b6], 0x1a
xor eax, eax
pop esi
ret
Function at 0x44e520
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push edi
push esi
mov esi, dword [ecx + 0x18]
mov eax, dword [ecx + 0x130]
cmp dword [eax + 8], 0
je 0x44e599
movzx eax, byte [esi + 0x3b6]
cmp eax, 0xd
je 0x44e580
test byte [ecx + 0x6eb], 0x20
je 0x44e580
mov edx, dword [ecx + 0xd20]
test edx, edx
je 0x44e556
cmp dword [edx + 4], 0
jle 0x44e580
mov edx, dword [0xad5be8]
cmp dword [edx + 4], 0
jle 0x44e580
push str.RETR_PREQUOTE
push dword [eax*4 + 0x99b528]
push str.__s_______s_
push ecx
mov edi, ecx
call fcn.00445340
mov ecx, edi
add esp, 0x10
mov byte [esi + 0x3b6], 0xd
mov edx, 1
push 0xd
call fcn.0044c1d0
add esp, 4
pop esi
pop edi
ret
mov eax, dword [ecx + 0x6e8]
test eax, 0x2000
jne 0x44e5b6
test eax, 0x10000
jne 0x44e5bf
mov edx, esi
pop esi
pop edi
jmp fcn.0044cda0
xor edx, edx
pop esi
pop edi
jmp fcn.0044e680
mov eax, dword [esi + 0x374]
add esi, 0x308
test eax, eax
je 0x44e5e0
test byte [ecx + 0xd62], 2
jne 0x44e606
push eax
push str.PRET_RETR__s
jmp 0x44e60c
mov eax, dword [ecx + 0x568]
test eax, eax
jne 0x44e5fe
test byte [ecx + 0xd61], 0x20
mov edx, 0x99b68b
mov eax, str.NLST
cmove eax, edx
push eax
push str.PRET__s
jmp 0x44e60c
push eax
push str.PRET_STOR__s
push esi
mov esi, ecx
push ecx
call fcn.00467060
add esp, 0x10
test eax, eax
jne 0x44e596
mov eax, esi
mov esi, dword [esi + 0x18]
movzx ecx, byte [esi + 0x3b6]
cmp ecx, 0x1d
je 0x44e670
test byte [eax + 0x6eb], 0x20
je 0x44e670
mov edx, dword [eax + 0xd20]
test edx, edx
je 0x44e64a
cmp dword [edx + 4], 0
jle 0x44e670
mov edx, dword [0xad5be8]
cmp dword [edx + 4], 0
jle 0x44e670
push str.PRET
push dword [ecx*4 + 0x99b528]
push str.__s_______s_
push eax
call fcn.00445340
add esp, 0x10
mov byte [esi + 0x3b6], 0x1d
xor eax, eax
pop esi
pop edi
ret
Function at 0x44f8e0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov esi, ecx
mov eax, dword [ecx + 0x18]
mov dword [esp + 0xc], eax
mov ebx, dword [eax + 0x1ac]
mov dword [esp + 4], pe_nt_image_headers32
lea eax, [esp + 4]
lea edi, [esp + 0x10]
push eax
push edi
push ebx
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x44f936
push str.Error_accept__ing_server_connect
push esi
call fcn.00444f40
add esp, 8
mov eax, 0x1e
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp + 4], pe_nt_image_headers32
push str.ftp.c
push 0x1bc
lea eax, [esp + 0xc]
push eax
push edi
push ebx
call fcn.00407840
add esp, 0x14
mov dword [esp + 8], eax
cmp eax, 0xffffffff
je 0x44f91b
test byte [esi + 0x6eb], 0x20
mov ebx, esi
je 0x44f98d
mov ecx, dword [ebx + 0xd20]
test ecx, ecx
je 0x44f97b
cmp dword [ecx + 4], 0
jle 0x44f98d
push str.Connection_accepted_from_server
push ebx
mov esi, eax
call fcn.00444fd0
mov eax, esi
add esp, 8
mov esi, dword [esp + 0xc]
and byte [esi + 0x2a1], 0xef
push 1
push eax
call fcn.004667e0
add esp, 8
lea eax, [esp + 8]
push eax
push 1
push esi
push ebx
call fcn.0043a260
add esp, 0x10
test eax, eax
je 0x44f9d7
push str.ftp.c
push 0x1cc
push dword [esp + 0x10]
mov esi, eax
call fcn.004078b0
mov eax, esi
add esp, 0xc
jmp 0x44f92e
xor eax, eax
cmp dword [ebx + 0x19c], 0
je 0x44f92e
push 1
push ebx
call fcn.00413410
add esp, 8
push 1
push dword [esp + 0xc]
push dword [ebx + 0x1a0]
call dword [ebx + 0x19c]
add esp, 0xc
mov edi, eax
push 0
push ebx
call fcn.00413410
xor eax, eax
add esp, 8
test edi, edi
je 0x44f92e
test byte [ebx + 0x6eb], 0x20
je 0x44fa6c
mov eax, dword [ebx + 0xd20]
test eax, eax
je 0x44fa36
cmp dword [eax + 4], 0
jle 0x44fa6c
mov eax, dword [0xad5be8]
cmp dword [eax + 4], 0
jle 0x44fa6c
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x44fa58
movzx eax, byte [eax + 0x3b6]
mov eax, dword [eax*4 + 0x99b528]
jmp 0x44fa5d
mov eax, 0x99b5b4
push eax
push str.__s__closing_DATA_connection
push ebx
call fcn.00445340
add esp, 0xc
push 1
push ebx
call fcn.0043b570
add esp, 8
push 1
push dword [ebx + 0x18]
push ebx
call fcn.0043b500
add esp, 0xc
mov eax, 0x2a
jmp 0x44f92e

Function at 0x450d90
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
mov edi, 1
xor ebx, ebx
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
nop word cs:[eax + eax]
push str.getenv.c
push 0x30
push edi
push ebx
call fcn.004074d0
add esp, 0x10
test eax, eax
je 0x450df2
mov esi, eax
push edi
push eax
push dword [esp + 0x1c]
call ebp
test eax, eax
je 0x450de8
cmp eax, edi
je 0x450de8
cmp eax, 0x8001
jae 0x450de8
mov ebx, esi
cmp eax, edi
mov edi, eax
jae 0x450db0
jmp 0x450e04
push str.getenv.c
push 0x3d
push esi
jmp 0x450dfa
push str.getenv.c
push 0x32
push ebx
call fcn.004075a0
add esp, 0xc
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x45f8f0
Capabilities:
Parse credit card information

Disassembly:
test edx, edx
je 0x45fa8a
push ebp
push ebx
push edi
push esi
sub esp, 8
mov esi, edx
mov edi, ecx
mov ebp, dword [esp + 0x1c]
nop word [eax + eax]
movzx eax, byte [edi]
mov ecx, eax
add cl, 0xd0
cmp cl, 0xa
jb 0x45fa00
mov ecx, eax
and cl, 0xdf
add cl, 0xbf
cmp cl, 0x19
jbe 0x45fa00
cmp eax, 0x5e
jg 0x45f9f0
lea ecx, [eax - 0x2d]
cmp ecx, 2
jb 0x45fa00
cmp eax, 0x25
jne 0x45fa1a
movzx eax, byte [edi + 1]
mov ecx, eax
add cl, 0xd0
cmp cl, 0xa
jb 0x45f975
movzx eax, al
lea ecx, [eax - 0x61]
cmp ecx, 6
jb 0x45f975
add eax, 0xffffffbf
cmp eax, 5
ja 0x45fa79
movzx eax, byte [edi + 2]
mov ecx, eax
add cl, 0xd0
cmp cl, 0xa
jb 0x45f99a
movzx eax, al
lea ecx, [eax - 0x61]
cmp ecx, 6
jb 0x45f99a
add eax, 0xffffffbf
cmp eax, 5
ja 0x45fa79
lea ebx, [edi + 2]
mov byte [esp + 6], 0
mov word [esp + 4], 0x25
movsx eax, byte [edi + 1]
push eax
call fcn.0041ccb0
add esp, 4
mov byte [esp + 5], al
movsx eax, byte [edi + 2]
push eax
call fcn.0041ccb0
add esp, 4
mov byte [esp + 6], al
push 3
lea eax, [esp + 8]
push eax
push ebp
call fcn.004482c0
add esp, 0xc
add esi, 0xfffffffe
mov edi, ebx
dec esi
jne 0x45fa0f
jmp 0x45fa82
cmp eax, 0x7e
je 0x45fa00
cmp eax, 0x5f
jne 0x45fa1a
nop word [eax + eax]
push 1
push edi
push ebp
call fcn.004482c0
add esp, 0xc
dec esi
je 0x45fa82
inc edi
test eax, eax
je 0x45f910
jmp 0x45fa82
mov byte [esp + 2], 0
mov word [esp], 0x25
movzx eax, byte [edi]
cmp dword [esp + 0x20], 0
je 0x45fa4c
cmp eax, 0x3d
jne 0x45fa51
push 1
push edi
push ebp
call fcn.004482c0
add esp, 0xc
mov ecx, dword [esp + 0x20]
mov byte [ecx], 1
dec esi
jne 0x45fa0f
jmp 0x45fa82
cmp eax, 0x2f
je 0x45fa00
shr eax, 4
movzx eax, byte [eax + 0x99efdf]
mov byte [esp + 1], al
movzx eax, byte [edi]
and eax, 0xf
movzx eax, byte [eax + 0x99efdf]
mov byte [esp + 2], al
push 3
lea eax, [esp + 4]
push eax
jmp 0x45fa03
push 3
push 0x99efdb
jmp 0x45fa03
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
ret

Function at 0x4667e0
Capabilities:
Set socket configuration

Disassembly:
push eax
mov eax, dword [esp + 8]
xor ecx, ecx
cmp dword [esp + 0xc], 0
setne cl
mov dword [esp], ecx
mov ecx, esp
push ecx
push 0x8004667e
push eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
pop ecx
ret