joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5921d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a8761
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x604654]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 1
mov dword [ebp - 0x1c], 0
mov dword [edi], 0
call fcn.0040c960
mov ecx, eax
test ecx, ecx
je 0x592364
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x24], 1
push eax
push 0xf003f
push 0
push dword [ebp + 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x592325
lea eax, [ebp - 0x14]
xorps xmm0, xmm0
push eax
push 0
lea eax, [ebp - 0x18]
movlpd qword [ebp - 0x18], xmm0
push eax
push 0
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x592317
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x592325
add eax, 0x10
push 0x610b3a
push eax
mov dword [ebp - 0x20], eax
call fcn.004a4984
mov esi, eax
add esp, 8
test esi, esi
je 0x592325
push dword [ebp - 0x20]
push 0
push esi
call fcn.0053c7b0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
push esi
push 0
push 0
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x5922da
push esi
call fcn.004a3dec
add esp, 4
jmp 0x592325
mov ecx, esi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5922e0
sub ecx, edx
sar ecx, 1
je 0x59230e
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5922f6
sub ecx, edx
sar ecx, 1
push ecx
push esi
mov ecx, edi
call fcn.0040e8d0
push esi
call fcn.004a3dec
add esp, 4
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x592325
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 0
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x592344
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a408b
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.0040c4f0
int3
Function at 0x592370
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x604654]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, edi
mov dword [ebp - 0xc], eax
lea edx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x592394
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0xf003f
push 0
push dword [ebp + 0xc]
sub esi, edx
push ecx
sar esi, 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ebx, ebx
test eax, eax
sete bl
test eax, eax
jne 0x5923f6
lea eax, [esi*2 + 2]
push eax
push edi
push 1
push 0
push dword [ebp - 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb ebx, ebx
mov eax, dword [ebp - 8]
inc ebx
test eax, eax
je 0x5923f6
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0xc]
or ecx, 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x592411
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a408b
mov esp, ebp
pop ebp
ret 0x10
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..idata
nop
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x2b062d8e
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0xaa97957
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x401600
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
call dbg.debug_is_active
test eax, eax
je 0x40167c
call dbg.debug_get_time_stack_tabs
mov ebx, eax
call dbg.debug_get_time_str_now
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x40e064
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xb
mov dword [esp + 4], 1
mov dword [esp], str....bridging
call sym._fwrite
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sym._fputc
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], 4
lea edx, [ebp + 0x10]
mov dword [esp + 0xc], edx
mov dword [esp + 8], dbg.bridged_socket_event_handler
mov dword [esp + 4], eax
mov dword [esp], 0x418978
call dbg.socket_list_insert
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x10], 4
lea ecx, [ebp + 8]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], dbg.bridged_socket_event_handler
mov dword [esp + 4], eax
mov dword [esp], 0x418978
call dbg.socket_list_insert
add esp, 0x24
pop ebx
pop ebp
ret
Function at 0x4023f9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
call dbg.debug_is_active
test eax, eax
je 0x402475
call dbg.debug_get_time_stack_tabs
mov ebx, eax
call dbg.debug_get_time_str_now
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x40e392
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xf
mov dword [esp + 4], 1
mov dword [esp], 0x40e409
call sym._fwrite
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sym._fputc
mov eax, dword [0x413020]
add eax, 1
mov dword [0x413020], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], str.Scanning_vsocket_ports_for_CID_u..._n
call sym._printf
mov dword [ebp - 0xc], 0
jmp 0x4024db
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dbg.try_connection
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jle 0x4024d7
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], str.__host_port__d_open_n
call sym._printf
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call dbg.socket_close
add dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0x101cf
jle 0x40249e
mov eax, dword [0x413020]
sub eax, 1
mov dword [0x413020], eax
call dbg.debug_is_active
test eax, eax
je 0x402566
call dbg.debug_get_time_stack_tabs
mov ebx, eax
call dbg.debug_get_time_str_now
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x40e392
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xf
mov dword [esp + 4], 1
mov dword [esp], str._host_port_scan
call sym._fwrite
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sym._fputc
mov eax, 0
add esp, 0x24
pop ebx
pop ebp
ret
Function at 0x402571
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
call sym._VMCISock_GetAFValue
mov dword [my_addr.svm_zero], eax
call dbg.debug_is_active
test eax, eax
je 0x4025ec
call dbg.debug_get_time_stack_tabs
mov ebx, eax
call dbg.debug_get_time_str_now
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x40e392
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str.vmci_listening_in_port__d
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sym._fputc
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov eax, dword [my_addr.svm_zero]
mov dword [esp], eax
call sym._socket_12
sub esp, 0xc
mov dword [my_addr.svm_cid], eax
cmp dword [my_addr.svm_cid], 0
jns 0x40262b
mov dword [esp], 0x40e3b8
call sym._perror
mov dword [esp], 1
call sym._exit
call dbg.debug_is_active
test eax, eax
je 0x402697
call dbg.debug_get_time_stack_tabs
mov ebx, eax
call dbg.debug_get_time_str_now
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x40e392
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [my_addr.svm_cid]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x40e3cf
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sym._fputc
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [my_addr.svm_family], 0
mov dword [my_addr.svm_port], 0
mov eax, dword [my_addr.svm_zero]
mov word [ebp - 0x20], ax
mov dword [my_addr.svm_family], 0xffffffff
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [my_addr.svm_cid]
mov dword [esp + 8], 0x10
lea edx, [ebp - 0x20]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._bind_12
sub esp, 0xc
cmp eax, 0xffffffff
jne 0x402760
mov dword [esp], 0x40e3de
call sym._perror
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x33
mov dword [esp + 4], 1
mov dword [esp], str.Maybe_you_are_not_running_as_root_or_Administrator_n
call sym._fwrite
cmp dword [ebp + 8], 0x3ff
jg 0x40274e
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x4c
mov dword [esp + 4], 1
mov dword [esp], str.Listening_in_ports_lower_than_1024_require_running_as_root_or_Administrator_n
call sym._fwrite
mov eax, dword [my_addr.svm_cid]
mov dword [esp], eax
call dbg.socket_close
mov eax, 0xffffffff
jmp 0x402791
mov eax, dword [my_addr.svm_cid]
mov dword [esp + 4], 0x64
mov dword [esp], eax
call sym._listen_8
sub esp, 8
cmp eax, 0xffffffff
jne 0x40278e
mov dword [esp], 0x40e505
call sym._perror
mov eax, 0xffffffff
jmp 0x402791
mov eax, dword [my_addr.svm_cid]
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x402796
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
call sym._VMCISock_GetAFValue
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0xffffffff
call dbg.debug_is_active
test eax, eax
je 0x402818
call dbg.debug_get_time_stack_tabs
mov ebx, eax
call dbg.debug_get_time_str_now
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x40e392
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], str.vsocket_is_available__VMware_vmci_address_familly_d
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sym._fputc
cmp dword [ebp - 0x10], 0
jle 0x402892
call dbg.VMCISock_GetLocalCID
mov dword [ebp - 0xc], eax
call dbg.debug_is_active
test eax, eax
je 0x402892
call dbg.debug_get_time_stack_tabs
mov ebx, eax
call dbg.debug_get_time_str_now
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x40e392
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], str.VMware_vmci_local_CID_u
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sym._fputc
cmp dword [ebp - 0x10], 0
jle 0x40291e
cmp dword [ebp - 0xc], 0xffffffff
je 0x40291e
call dbg.debug_is_active
test eax, eax
je 0x402917
call dbg.debug_get_time_stack_tabs
mov ebx, eax
call dbg.debug_get_time_str_now
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x40e392
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 4
mov dword [esp + 4], 1
mov dword [esp], str.TRUE
call sym._fwrite
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sym._fputc
mov eax, 1
jmp 0x402996
call dbg.debug_is_active
test eax, eax
je 0x402991
call dbg.debug_get_time_stack_tabs
mov ebx, eax
call dbg.debug_get_time_str_now
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x40e392
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], str.FALSE__d__d
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sym._fputc
mov eax, 0
add esp, 0x24
pop ebx
pop ebp
ret
Function at 0x40299c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
call sym._VMCISock_GetAFValue
mov dword [ebp - 0xc], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x27
mov dword [esp + 4], 1
mov dword [esp], str.VMware_vsockets_environment_properties_n
call sym._fwrite
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x28
mov dword [esp + 4], 1
mov dword [esp], str._n
call sym._fwrite
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], str.VMware_vmci_address_familly_d_n
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
cmp dword [ebp - 0xc], 0
jle 0x402ae8
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
mov dword [esp], str.VMware_vmci_is_present_n
call sym._fwrite
call dbg.VMCISock_GetLocalCID
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], str.VMware_vmci_local_CID_u_n
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
cmp dword [ebp - 0x10], 2
jne 0x402a9a
mov dword [esp + 8], 2
mov dword [esp + 4], str.VMware_Hypervisor_host_machine_detected__CID_u__n
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
jmp 0x402ae1
cmp dword [ebp - 0x10], 0xffffffff
jne 0x402ac2
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], str.Physical_machine_without_hypervisor_installation_detected__CID_u__n
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
jmp 0x402ae1
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], str.Guest_machine_detected__CID_u__n
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, 1
jmp 0x402b15
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x14
mov dword [esp + 4], 1
mov dword [esp], str.vmci_is_NOT_present_n
call sym._fwrite
mov eax, 0
leave
ret
Function at 0x402fcf
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
call dbg.debug_is_active
test eax, eax
je 0x403059
call dbg.debug_get_time_stack_tabs
mov ebx, eax
call dbg.debug_get_time_str_now
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x40e6d6
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], str._sock_delete_list_traverse_func__socket_entry_u_socket2delete_u_
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sym._fputc
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x10]
jne 0x403104
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
test eax, eax
je 0x40307f
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0xc]
mov word [eax + 0x10], 1
call dbg.debug_is_active
test eax, eax
je 0x4030fd
call dbg.debug_get_time_stack_tabs
mov ebx, eax
call dbg.debug_get_time_str_now
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x40e6d6
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1f
mov dword [esp + 4], 1
mov dword [esp], str._sock_delete_list_traverse_func
call sym._fwrite
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sym._fputc
mov eax, 0
jmp 0x403109
mov eax, 1
add esp, 0x24
pop ebx
pop ebp
ret
Function at 0x40310f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
call dbg.debug_is_active
test eax, eax
je 0x403182
call dbg.debug_get_time_stack_tabs
mov ebx, eax
call dbg.debug_get_time_str_now
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x40e6d6
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], str._socket_list_delete__socket_u_
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sym._fputc
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp + 0xc], 0
mov dword [esp + 8], dbg.sock_delete_list_traverse_func
lea edx, [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
call dbg.liblist_list_traverse
cmp eax, 1
jne 0x403227
call dbg.debug_is_active
test eax, eax
je 0x403220
call dbg.debug_get_time_stack_tabs
mov ebx, eax
call dbg.debug_get_time_str_now
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x40e6d6
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x19
mov dword [esp + 4], 1
mov dword [esp], str._socket_list_delete_TRUE_
call sym._fwrite
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sym._fputc
mov eax, 1
jmp 0x4032a1
call dbg.debug_is_active
test eax, eax
je 0x40329c
call dbg.debug_get_time_stack_tabs
mov ebx, eax
call dbg.debug_get_time_str_now
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x40e6d6
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1a
mov dword [esp + 4], 1
mov dword [esp], str._socket_list_delete_FALSE_
call sym._fwrite
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sym._fputc
mov eax, 0
add esp, 0x14
pop ebx
pop ebp
ret
Function at 0x403393
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
call dbg.debug_is_active
test eax, eax
je 0x40340f
call dbg.debug_get_time_stack_tabs
mov ebx, eax
call dbg.debug_get_time_str_now
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x40e6d6
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1e
mov dword [esp + 4], 1
mov dword [esp], 0x40e860
call sym._fwrite
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sym._fputc
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax + 0x10]
test ax, ax
jne 0x403507
mov eax, dword [ebp - 0x10]
movzx eax, word [eax + 0x12]
test ax, ax
jne 0x403499
mov dword [ebp - 0xc], 0
jmp 0x403459
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
mov edx, dword [eax + edx*4 + 4]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
cmp edx, eax
jne 0x403455
jmp 0x403463
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
cmp eax, dword [ebp - 0xc]
ja 0x403440
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
cmp eax, dword [ebp - 0xc]
jne 0x403497
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
cmp eax, 0x3f
ja 0x403497
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov ecx, eax
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
mov dword [eax + edx*4 + 4], ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
lea edx, [eax + 1]
mov eax, dword [ebp - 0x14]
mov dword [eax], edx
jmp 0x403507
jmp 0x403507
call dbg.debug_is_active
test eax, eax
je 0x403507
call dbg.debug_get_time_stack_tabs
mov ebx, eax
call dbg.debug_get_time_str_now
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x40e6d6
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [esp + 8], eax
mov dword [esp + 4], str.file_descriptor__d_ignored
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sym._fputc
call dbg.debug_is_active
test eax, eax
je 0x40357c
call dbg.debug_get_time_stack_tabs
mov ebx, eax
call dbg.debug_get_time_str_now
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x40e6d6
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1e
mov dword [esp + 4], 1
mov dword [esp], str._sock_fdset_list_traverse_func
call sym._fwrite
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sym._fputc
mov eax, 1
add esp, 0x24
pop ebx
pop ebp
ret