joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42a364
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push edi
push esi
mov edi, 0x4714ec
mov esi, 0x427d65
push ebx
add esp, 0xfffffff4
cld
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
mov dword [0x47108c], 0x2e3
push 5
call fcn.00424f6c
mov edi, eax
add esp, 0x10
cmp edi, 0xffffffff
jne 0x42a3a8
mov eax, 1
jmp 0x42a582
mov eax, dword [0x45c504]
add esp, 0xfffffff4
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x44]
push eax
call fcn.0043e958
mov esi, eax
add esp, 0x10
cmp esi, 0xffffffff
jne 0x42a3dc
add esp, 0xfffffff4
push edi
call fcn.00422aa4
mov eax, 2
jmp 0x42a582
add esp, 0xfffffff8
push 0x2f
mov eax, dword [ebp + 8]
push eax
call sub.cygwin1.dll_strrchr
mov dword [ebp - 0x48], eax
add esp, 0x10
test eax, eax
jne 0x42a3fc
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x48], ecx
jmp 0x42a3ff
inc dword [ebp - 0x48]
call fcn.0043dba0
lea ebx, [edi*8]
mov dword [ebp - 0x4c], eax
add esp, 0xfffffff8
lea eax, [ebp - 0x40]
sub ebx, edi
push eax
lea ebx, [edi + ebx*4]
mov eax, dword [ebp + 8]
shl ebx, 3
push eax
call sub.cygwin1.dll_stat
mov dword [ebx + 0x46256c], esi
mov dword [ebx + 0x462570], 0xdeadf00d
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp + 0xc]
mov dword [ebx + 0x462574], eax
add esp, 0xfffffff8
push ecx
lea eax, [ebx + 0x46257c]
push eax
mov esi, 0x462650
call sub.cygwin1.dll_strcpy
mov eax, dword [0x42a317]
add esp, 0x20
mov dword [ebx + 0x46259c], eax
add esp, 0xfffffff8
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebx + esi]
push eax
call sub.cygwin1.dll_strcpy
add esp, 0xfffffff8
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebx + esi]
add eax, 0x10c
push eax
call sub.cygwin1.dll_strcpy
add esp, 0x20
mov eax, dword [ebp + 0x14]
add esp, 0xfffffff8
push eax
mov eax, dword [ebx + esi]
add eax, 0x79
push eax
call sub.cygwin1.dll_strcpy
mov edx, dword [ebx + esi]
mov eax, dword [ebp - 0x2c]
mov dword [edx + 0xf4], eax
add esp, 0xfffffff4
mov eax, dword [ebx + esi]
mov dword [eax + 0xf8], 0
mov eax, dword [ebx + esi]
mov byte [eax + 0x104], 0
mov eax, dword [ebx + esi]
mov dword [eax + 0xfc], 0
push 0
call sub.cygwin1.dll_time
mov edx, eax
add esp, 0x20
mov eax, dword [ebx + esi]
add esp, 0xfffffff8
mov dword [eax + 0x108], edx
push 0x42a31b
mov ecx, dword [ebp + 8]
push ecx
call sub.cygwin1.dll_fopen
mov edx, eax
add esp, 0x10
mov eax, dword [ebx + esi]
mov dword [eax + 0x12c], edx
mov eax, dword [ebx + esi]
cmp dword [eax + 0x12c], 0
jne 0x42a524
add esp, 0xfffffff4
push edi
call fcn.00422aa4
mov eax, 3
jmp 0x42a582
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0x2a
je 0x42a580
mov eax, dword [ebp - 0x2c]
add esp, 0xfffffffc
push eax
mov eax, dword [ebp - 0x44]
push eax
add esp, 0xfffffff4
mov ecx, dword [ebp - 0x4c]
push ecx
call fcn.0043fcc8
add esp, 0x10
push eax
mov eax, dword [ebp - 0x48]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0x42a324
push 0x7ff4
call fcn.0041fb30
add esp, 0x20
mov eax, dword [ebp + 0xc]
add esp, 0xfffffff4
push eax
mov ecx, dword [ebp - 0x48]
push ecx
push 0x42a34a
push 0x427dcb
push 0x100
call fcn.00437adc
xor eax, eax
lea esp, [ebp - 0x68]
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x434608
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push esi
push ebx
add esp, 0xfffffff4
mov esi, dword [ebp + 8]
push esi
call sub.cygwin1.dll_rewind
add esp, 0x10
test byte [esi + 0xc], 0x20
jne 0x434661
add esp, 0xfffffff4
push esi
call sub.cygwin1.dll_ftell
push esi
mov ebx, eax
push 1
lea eax, [ebp - 0x200]
push 0x200
push eax
call sub.cygwin1.dll_fread
mov ax, word [esi + 0xc]
add esp, 0x20
and eax, 0x20
jne 0x43465c
test byte [ebp - 0x1fe], 1
jne 0x43467c
test ax, ax
je 0x434628
add esp, 0xfffffffc
push 2
push 0
push esi
call sub.cygwin1.dll_fseek
add esp, 0xfffffff4
push esi
call sub.cygwin1.dll_ftell
mov ebx, eax
jmp 0x43467e
mov eax, ebx
lea esp, [ebp - 0x218]
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x434c20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push ebx
call sub.cygwin1.dll_random
mov ecx, eax
mov edx, 0xb60b60b7
mov eax, edx
imul ecx
mov eax, ecx
add edx, ecx
sar eax, 0x1f
sar edx, 6
sub edx, eax
lea edx, [edx + edx*2]
mov eax, edx
shl eax, 4
sub eax, edx
add eax, eax
sub ecx, eax
push ecx
push 0x430810
push 0x427dcb
push 0x20
call fcn.00437adc
mov eax, dword [0x45d650]
add esp, 0x10
test eax, eax
jl 0x434c7c
add esp, 0xfffffff4
push eax
call fcn.0043e450
add esp, 0x10
xor ebx, ebx
mov esi, 0x46256c
cmp ebx, dword [0x45c238]
jge 0x434cb0
nop
lea eax, [ebx*8]
add esp, 0xfffffff4
sub eax, ebx
lea eax, [ebx + eax*4]
inc ebx
mov eax, dword [esi + eax*8]
push eax
call fcn.0043e450
add esp, 0x10
cmp ebx, dword [0x45c238]
jl 0x434c8c
add esp, 0xfffffff4
push 0x4716ec
call sub.cygwin1.dll_unlink
add esp, 0xfffffff4
push 2
call sub.cygwin1.dll_exit
nop
Function at 0x435138
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push edi
push esi
push ebx
add esp, 0xfffffffc
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
lea ebx, [ebp - 0x100]
push 0xff
push eax
push ebx
call sub.cygwin1.dll_strncpy
mov byte [ebp - 1], 0
add esp, 0x10
cmp byte [ebp - 0x100], 0
je 0x4351d1
mov eax, ebx
mov edx, edi
mov edx, dword [eax]
test dh, dl
jne 0x435181
test dl, dl
je 0x435199
test dh, dh
je 0x435198
test edx, 0xff0000
je 0x435197
add eax, 4
test edx, 0xff000000
jne 0x435173
sub eax, 3
inc eax
inc eax
cmp byte [eax - 1], 0x2f
jne 0x4351d1
mov eax, ebx
mov edx, dword [ebp - 0x104]
mov edx, dword [eax]
test dh, dl
jne 0x4351b5
test dl, dl
je 0x4351cd
test dh, dh
je 0x4351cc
test edx, 0xff0000
je 0x4351cb
add eax, 4
test edx, 0xff000000
jne 0x4351a7
sub eax, 3
inc eax
inc eax
mov byte [eax - 1], 0
add esp, 0xfffffffc
push 0
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
push eax
push esi
call sub.cygwin1.dll_fseek
add esp, 0x10
test byte [esi + 0xc], 0x20
jne 0x43523c
add esp, 0xfffffff4
push esi
call sub.cygwin1.dll_ftell
mov edx, dword [ebp + 0x10]
mov dword [edx], eax
push esi
push 1
push 0x200
push 0x461640
call sub.cygwin1.dll_fread
add esp, 0x20
test byte [esi + 0xc], 0x20
jne 0x4351e5
test byte [0x461642], 1
jne 0x4351e5
add esp, 0xfffffff8
push 0x461648
push ebx
call fcn.00435f78
add esp, 0x10
test eax, eax
je 0x4351e5
mov eax, 0x461640
jmp 0x43523e
xor eax, eax
lea esp, [ebp - 0x128]
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x437708
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
push edi
push esi
push ebx
add esp, 0xfffffffc
mov eax, dword [ebp + 8]
push 0
push 0
push eax
call sub.cygwin1.dll_open
mov dword [ebp - 0x244], eax
add esp, 0x10
test eax, eax
jge 0x43773c
mov eax, 1
jmp 0x43782a
add esp, 0xfffffff8
lea eax, [ebp - 0x240]
push eax
mov eax, dword [ebp - 0x244]
push eax
call sub.cygwin1.dll_fstat
add esp, 0x10
cmp word [ebp - 0x238], 0
jl 0x43776c
mov eax, 3
jmp 0x43782a
mov eax, dword [ebp - 0x238]
add esp, 0xfffffff8
and eax, 0x1ff
push eax
mov edx, dword [ebp + 0xc]
push edx
call sub.cygwin1.dll_creat
mov edi, eax
add esp, 0x10
test edi, edi
jge 0x4377a8
add esp, 0xfffffff4
mov eax, dword [ebp - 0x244]
push eax
call sub.cygwin1.dll_close
mov eax, 2
jmp 0x43782a
lea esi, [ebp - 0x200]
mov esi, esi
add esp, 0xfffffffc
push 0x200
push esi
mov edx, dword [ebp - 0x244]
push edx
call sub.cygwin1.dll_read
mov ebx, eax
add esp, 0x10
test ebx, ebx
jle 0x437810
add esp, 0xfffffffc
push ebx
push esi
push edi
call sub.cygwin1.dll_write
add esp, 0x10
cmp eax, ebx
jge 0x4377b0
add esp, 0xfffffff4
push edi
call sub.cygwin1.dll_close
add esp, 0xfffffff4
mov eax, dword [ebp - 0x244]
push eax
call sub.cygwin1.dll_close
add esp, 0x20
mov edx, dword [ebp + 0xc]
add esp, 0xfffffff4
push edx
call sub.cygwin1.dll_unlink
mov eax, 4
jmp 0x43782a
add esp, 0xfffffff4
push edi
call sub.cygwin1.dll_close
add esp, 0xfffffff4
mov eax, dword [ebp - 0x244]
push eax
call sub.cygwin1.dll_close
xor eax, eax
lea esp, [ebp - 0x268]
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x43e1e0
Capabilities:
Set socket configuration

Disassembly:
push ebp
xor edx, edx
mov ebp, esp
mov ecx, 0x47238c
sub esp, 0x1c
push edi
push esi
push ebx
lea esi, [ebp - 4]
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
lea esi, [esi]
lea eax, [edx + edx*2]
shl eax, 3
test byte [eax + ecx + 4], 1
je 0x43e2bc
mov dword [eax + 0x472398], 0
mov dword [eax + 0x472394], 0
mov dword [eax + 0x47239c], 0
mov edx, edi
mov byte [eax + ecx + 4], dl
mov dword [eax + ecx], ebx
cmp ebx, 1
jne 0x43e242
cmp dword [0x45d654], 0
je 0x43e285
mov eax, edi
test al, 0x10
jne 0x43e285
add esp, 0xfffffff4
mov dword [ebp - 4], 1
push 4
push esi
push 8
push 0xffff
push ebx
call sub.cygwin1.dll_setsockopt
add esp, 0x20
mov dword [ebp - 4], 0
add esp, 0xfffffff4
push 4
push esi
push 0x80
push 0xffff
push ebx
call sub.cygwin1.dll_setsockopt
add esp, 0x20
test edi, 4
je 0x43e2aa
add esp, 0xfffffff4
mov dword [ebp - 4], 1
push 4
push esi
push 4
push 0xffff
push ebx
call sub.cygwin1.dll_setsockopt
add esp, 0x20
add esp, 0xfffffffc
push 0x4000
push 4
push ebx
call sub.cygwin1.dll_fcntl
jmp 0x43e2d8
inc edx
cmp edx, 0x109
jle 0x43e1fc
add esp, 0xfffffff8
push 0
push 0x43e1ca
call fcn.00434c20
lea esp, [ebp - 0x28]
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x43e2e4
Capabilities:
Set socket configuration

Disassembly:
push ebp
xor edx, edx
mov ebp, esp
mov ecx, 0x47238c
sub esp, 0x1c
push edi
push esi
push ebx
lea esi, [ebp - 4]
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
lea esi, [esi]
lea eax, [edx + edx*2]
shl eax, 3
test byte [eax + ecx + 4], 1
je 0x43e3cc
mov dword [eax + 0x472398], 0
mov dword [eax + 0x472394], 0
mov dword [eax + 0x47239c], 0
mov edx, edi
mov byte [eax + ecx + 4], dl
mov dword [eax + ecx], ebx
mov edx, dword [ebp + 0x10]
mov dword [eax + 0x4723a0], edx
cmp ebx, 1
jne 0x43e34f
cmp dword [0x45d654], 0
je 0x43e392
mov eax, edi
test al, 0x10
jne 0x43e392
add esp, 0xfffffff4
mov dword [ebp - 4], 1
push 4
push esi
push 8
push 0xffff
push ebx
call sub.cygwin1.dll_setsockopt
add esp, 0x20
mov dword [ebp - 4], 0
add esp, 0xfffffff4
push 4
push esi
push 0x80
push 0xffff
push ebx
call sub.cygwin1.dll_setsockopt
add esp, 0x20
test edi, 4
je 0x43e3b7
add esp, 0xfffffff4
mov dword [ebp - 4], 1
push 4
push esi
push 4
push 0xffff
push ebx
call sub.cygwin1.dll_setsockopt
add esp, 0x20
add esp, 0xfffffffc
push 0x4000
push 4
push ebx
call sub.cygwin1.dll_fcntl
jmp 0x43e3e8
inc edx
cmp edx, 0x109
jle 0x43e300
add esp, 0xfffffff8
push 0
push 0x43e1ca
call fcn.00434c20
lea esp, [ebp - 0x28]
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x43e750
Capabilities:
Connect socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
push edi
push esi
push ebx
add esp, 0xfffffff8
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
lea ebx, [ebp - 0x90]
push eax
mov esi, ebx
push ebx
call sub.cygwin1.dll_strcpy
lea eax, [ebp - 0x10]
add esp, 0x10
mov edx, 0xf
nop
mov byte [eax], 0
inc eax
sub edx, 1
jae 0x43e780
mov word [ebp - 0x10], 2
cmp byte [0x45fb30], 0
je 0x43e7a0
call fcn.0043dba0
jmp 0x43e7a2
xor eax, eax
mov dword [ebp - 0xc], eax
add esp, 0xfffffffc
push 0x10
lea eax, [ebp - 0x10]
push eax
push edi
call sub.cygwin1.dll_bind
add esp, 0x10
test eax, eax
jge 0x43e7d0
add esp, 0xfffffff4
push edi
call fcn.0043e450
mov eax, 0xffffffff
jmp 0x43e94a
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0x10]
lea ebx, [ebp - 0x10]
mov ecx, 0xf
and eax, 0xff00
mov dh, 0
lea esi, [esi]
mov byte [ebx], 0
inc ebx
sub ecx, 1
jae 0x43e7e8
sar eax, 8
shl edx, 8
or edx, eax
mov word [ebp - 0x10], 2
mov word [ebp - 0xe], dx
mov eax, esi
mov edx, dword [ebp - 0x94]
mov edx, dword [eax]
test dh, dl
jne 0x43e819
test dl, dl
je 0x43e831
test dh, dh
je 0x43e830
test edx, 0xff0000
je 0x43e82f
add eax, 4
test edx, 0xff000000
jne 0x43e80b
sub eax, 3
inc eax
inc eax
cmp byte [eax - 1], 0x2f
jle 0x43e87c
mov eax, esi
mov edx, dword [ebp - 0x98]
mov edx, dword [eax]
test dh, dl
jne 0x43e84d
test dl, dl
je 0x43e865
test dh, dh
je 0x43e864
test edx, 0xff0000
je 0x43e863
add eax, 4
test edx, 0xff000000
jne 0x43e83f
sub eax, 3
inc eax
inc eax
cmp byte [eax - 1], 0x39
jg 0x43e87c
add esp, 0xfffffff4
push esi
call sub.cygwin1.dll_inet_addr
mov dword [ebp - 0xc], eax
add esp, 0x10
jmp 0x43e8df
add esp, 0xfffffff4
push 0xa
call sub.cygwin1.dll_alarm
add esp, 0xfffffff4
push esi
call sub.cygwin1.dll_gethostbyname
add esp, 0x20
mov esi, eax
add esp, 0xfffffff4
push 0
call sub.cygwin1.dll_alarm
add esp, 0x10
test esi, esi
jne 0x43e8b8
add esp, 0xfffffff4
push edi
call fcn.0043e450
mov eax, 0xfffffffe
jmp 0x43e94a
mov eax, dword [esi + 0xc]
lea ebx, [ebp - 0xc]
movsx edx, word [esi + 0xa]
mov ecx, dword [eax]
sub edx, 1
jb 0x43e8d7
lea esi, [esi]
mov al, byte [ecx]
mov byte [ebx], al
inc ecx
inc ebx
sub edx, 1
jae 0x43e8cc
mov ax, word [esi + 8]
mov word [ebp - 0x10], ax
xor ecx, ecx
mov ebx, 0x47238c
mov esi, esi
lea eax, [ecx + ecx*2]
shl eax, 3
mov dl, byte [eax + ebx + 4]
test dl, 1
jne 0x43e908
cmp dword [eax + 0x47238c], edi
jne 0x43e908
or dl, 8
mov byte [eax + 0x472390], dl
inc ecx
cmp ecx, 0x109
jle 0x43e8e8
add esp, 0xfffffffc
lea eax, [ebp - 0x10]
push 0x10
push eax
push edi
call sub.cygwin1.dll_connect
add esp, 0x10
test eax, eax
jge 0x43e948
call sub.cygwin1.dll___errno
cmp dword [eax], 0x77
jne 0x43e938
mov eax, edi
jmp 0x43e94a
add esp, 0xfffffff4
push edi
call fcn.0043e450
mov eax, 0xffffffff
jmp 0x43e94a
mov eax, edi
lea esp, [ebp - 0xb8]
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x43e958
Capabilities:
Create tcp socket
Create udp socket
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push edi
push esi
push ebx
add esp, 0xfffffffc
mov esi, dword [ebp + 8]
push 0
push 1
push 2
call sub.cygwin1.dll_socket
mov ebx, eax
add esp, 0x10
test ebx, ebx
jge 0x43e98d
add esp, 0xfffffff8
push 0
push 0x43e3f2
call fcn.00434c20
add esp, 0x10
add esp, 0xfffffff8
push 4
push ebx
call fcn.0043e1e0
lea eax, [ebp - 0x10]
add esp, 0x10
mov edx, 0xf
mov edi, eax
lea esi, [esi]
mov byte [eax], 0
inc eax
sub edx, 1
jae 0x43e9a8
mov word [ebp - 0x10], 2
xor eax, eax
mov al, byte [esi]
xor edx, edx
mov dl, byte [esi + 1]
shl eax, 8
or eax, edx
mov word [ebp - 0xe], ax
cmp byte [0x45fb30], 0
je 0x43e9dc
call fcn.0043dba0
jmp 0x43e9de
xor eax, eax
add esp, 0xfffffffc
mov dword [ebp - 0xc], eax
push 0x10
push edi
push ebx
call sub.cygwin1.dll_bind
add esp, 0x10
test eax, eax
jge 0x43ea04
add esp, 0xfffffff4
push ebx
call fcn.0043e450
mov eax, 0xffffffff
jmp 0x43ea66
add esp, 0xfffffffc
mov dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x14]
push eax
push edi
push ebx
call sub.cygwin1.dll_getsockname
add esp, 0x10
test eax, eax
jge 0x43ea30
add esp, 0xfffffff4
push ebx
call fcn.0043e450
mov eax, 0xffffffff
jmp 0x43ea66
xor eax, eax
xor edx, edx
mov al, byte [ebp - 0xe]
mov dl, byte [ebp - 0xd]
shl eax, 8
add esp, 0xfffffff8
or edx, eax
mov dword [esi], edx
push 1
push ebx
call sub.cygwin1.dll_listen
add esp, 0x10
test eax, eax
jge 0x43ea64
add esp, 0xfffffff4
push ebx
call fcn.0043e450
mov eax, 0xffffffff
jmp 0x43ea66
mov eax, ebx
lea esp, [ebp - 0x38]
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x43ea7c
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push edi
push esi
push ebx
mov dword [ebp - 0x18], 0x1ff
call sub.cygwin1.dll_getdtablesize
mov dword [ebp - 0x14], eax
cmp eax, 0x40
jle 0x43eaa0
mov dword [ebp - 0x14], pe_nt_image_headers32
mov dword [ebp - 8], 1
lea eax, [ebp - 8]
mov dword [eax + 4], 0
lea edx, [ebp - 0x10]
xor ecx, ecx
mov esi, esi
mov byte [edx], 0
inc ecx
inc edx
cmp ecx, 7
jbe 0x43eab8
xor esi, esi
lea ebx, [ebp - 0x10]
nop
lea edx, [esi + esi]
lea eax, [esi + edx]
mov edi, edx
shl eax, 3
test byte [eax + 0x472390], 1
jne 0x43eb10
cmp dword [eax + 0x47238c], 1
jne 0x43eaf4
cmp dword [0x45d654], 0
jne 0x43eaf4
or byte [ebp - 0x10], 1
jmp 0x43eb10
lea eax, [esi + edi]
mov edx, dword [eax*8 + 0x47238c]
mov ecx, edx
mov eax, 1
and ecx, 0x1f
shr edx, 5
shl eax, cl
or dword [ebx + edx*4], eax
inc esi
cmp esi, 0x109
jle 0x43eac8
add esp, 0xfffffff4
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x10]
push 0
push 0
push edx
mov ecx, dword [ebp - 0x14]
push ecx
call sub.cygwin1.dll_select
add esp, 0x20
test eax, eax
jle 0x43ec78
xor esi, esi
mov esi, esi
lea edx, [esi + esi]
lea eax, [esi + edx]
mov edi, edx
shl eax, 3
mov bl, byte [eax + 0x472390]
test bl, 1
jne 0x43ec68
mov edx, dword [eax + 0x47238c]
mov eax, edx
mov ecx, edx
shr eax, 5
and ecx, 0x1f
mov eax, dword [ebp + eax*4 - 0x10]
sar eax, cl
test eax, 1
jne 0x43eb97
cmp edx, 1
jne 0x43ec68
cmp dword [0x45d654], 0
jne 0x43ec68
test byte [ebp - 0x10], 1
je 0x43ec68
test bl, 0xc
je 0x43ebbe
test bl, 0x20
je 0x43ec84
mov al, byte [0x45fbb0]
test al, al
je 0x43ebbe
cmp al, 0x21
je 0x43ebbe
test bl, 8
je 0x43ebbe
mov dword [ebp - 0x18], 8
lea eax, [esi + edi]
cmp dword [eax*8 + 0x47238c], 1
jne 0x43ebe4
cmp dword [0x45d654], 0
jne 0x43ebe4
add esp, 0xfffffffc
mov eax, dword [ebp - 0x18]
push eax
mov edx, dword [ebp + 8]
push edx
push 0
jmp 0x43ebfa
add esp, 0xfffffffc
mov ecx, dword [ebp - 0x18]
push ecx
mov eax, dword [ebp + 8]
push eax
lea eax, [esi + edi]
mov eax, dword [eax*8 + 0x47238c]
push eax
call sub.cygwin1.dll_read
add esp, 0x10
test eax, eax
jle 0x43ec98
mov edx, dword [ebp + 8]
mov byte [eax + edx], 0
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
cmp byte [0x45fbb0], 0
je 0x43ec64
lea eax, [esi + edi]
test byte [eax*8 + 0x472390], 8
je 0x43ec64
mov al, byte [edx + 1]
cmp al, 0x5b
je 0x43ec44
jg 0x43ec3c
cmp al, 0x5a
je 0x43ec84
jmp 0x43ec98
cmp al, 0x5d
jg 0x43ec98
jmp 0x43ec54
call sub.cygwin1.dll___errno
mov dword [eax], 0x6f
jmp 0x43ec98
call sub.cygwin1.dll___errno
mov dword [eax], 0x72
jmp 0x43ec98
mov eax, esi
jmp 0x43eccc
inc esi
cmp esi, 0x109
jle 0x43eb40
jmp 0x43ecc7
cmp eax, 0xffffffff
jne 0x43ecb8
mov eax, 0xfffffffe
jmp 0x43eccc
mov eax, dword [ebp + 8]
mov byte [eax], 0
mov edx, dword [ebp + 0xc]
mov eax, esi
mov dword [edx], 0
jmp 0x43eccc
lea eax, [esi + edi]
mov ecx, dword [ebp + 0xc]
shl eax, 3
mov edx, dword [eax + 0x47238c]
mov dword [ecx], edx
and byte [eax + 0x472390], 0xf7
mov eax, 0xffffffff
jmp 0x43eccc
mov eax, dword [ebp + 8]
mov byte [eax], 0
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
mov eax, 0xfffffffd
lea esp, [ebp - 0x38]
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x43fd04
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
add esp, 0xfffffffc
push 0
push 1
push 2
call sub.cygwin1.dll_socket
mov ebx, eax
add esp, 0x10
test ebx, ebx
jge 0x43fd34
add esp, 0xfffffff8
push 0
push 0x43e3f2
call fcn.00434c20
add esp, 0x10
mov eax, dword [ebp + 8]
add esp, 0xfffffff8
push eax
push ebx
call fcn.0043e1e0
mov eax, ebx
mov ebx, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret

Function at 0x43fe48
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
add esp, 0xfffffffc
push eax
push edx
add esp, 0xfffffffc
push 0
push 1
push 2
call sub.cygwin1.dll_socket
mov ebx, eax
add esp, 0x10
test ebx, ebx
jge 0x43fe83
add esp, 0xfffffff8
push 0
push 0x43e3f2
call fcn.00434c20
add esp, 0x10
add esp, 0xfffffff8
push 0
push ebx
call fcn.0043e1e0
add esp, 0x10
push ebx
call fcn.0043e750
mov ebx, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret
Function at 0x459f6c
Capabilities:
Hash data with md5
Read file on windows

Disassembly:
push ebp
mov eax, 0x10fc
mov ebp, esp
call 0x45b448
push edi
push esi
push ebx
lea esi, [ebp - 0x10f0]
mov edi, dword [ebp + 8]
mov dword [ebp - 0xa0], 0x67452301
mov dword [ebp - 0x9c], 0xefcdab89
mov dword [ebp - 0x98], 0x98badcfe
mov dword [ebp - 0x94], 0x10325476
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x88], 0
nop
xor ebx, ebx
mov esi, esi
mov eax, 0x1000
push edi
sub eax, ebx
push eax
push 1
lea eax, [ebx + esi]
push eax
call sub.cygwin1.dll_fread
add ebx, eax
add esp, 0x10
cmp ebx, 0xfff
ja 0x459ff5
test eax, eax
jne 0x459fd0
test eax, eax
jne 0x45a00c
test byte [edi + 0xc], 0x40
je 0x45a028
mov eax, 1
jmp 0x45a0eb
add esp, 0xfffffffc
lea eax, [ebp - 0xa0]
push eax
push 0x1000
push esi
call fcn.0045a0f8
add esp, 0x10
jmp 0x459fcc
lea edi, [ebp - 0xa0]
test ebx, ebx
je 0x45a040
add esp, 0xfffffffc
push edi
push ebx
push esi
call fcn.0045ac28
add esp, 0x10
mov ebx, dword [ebp - 0x88]
mov eax, ebx
add eax, dword [ebp - 0x90]
mov dword [ebp - 0x90], eax
cmp eax, ebx
jae 0x45a05e
inc dword [ebp - 0x8c]
cmp ebx, 0x37
jbe 0x45a06c
mov esi, 0x78
jmp 0x45a071
mov esi, 0x38
sub esi, ebx
add esp, 0xfffffffc
lea eax, [edi + ebx + 0x1c]
push esi
push 0x459f2c
push eax
call sub.cygwin1.dll_memcpy
lea edx, [esi + ebx]
mov eax, dword [ebp - 0x90]
lea ebx, [edi + edx]
add esp, 0xfffffffc
shl eax, 3
add edx, 8
mov dword [ebx + 0x1c], eax
mov ecx, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x90]
shr eax, 0x1d
shl ecx, 3
or ecx, eax
mov dword [ebx + 0x20], ecx
lea eax, [ebp - 0x84]
push edi
push edx
push eax
call fcn.0045a0f8
mov eax, dword [ebp - 0xa0]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp - 0x9c]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x98]
mov dword [edx + 8], eax
mov eax, dword [ebp - 0x94]
mov dword [edx + 0xc], eax
xor eax, eax
lea esp, [ebp - 0x1108]
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x45aae0
Capabilities:
Terminate process

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
sub esp, 0x6c
push edi
push esi
lea edi, [ebp - 0x40]
push ebx
cld
mov ecx, 0x10
rep stosd dword es:[edi], eax
add esp, 0xfffffff8
push 0x45aa41
lea ebx, [ebp - 0x50]
mov eax, dword [ebp + 8]
push eax
call sub.cygwin1.dll_fopen
mov edi, eax
add esp, 0x10
test edi, edi
je 0x45ab36
add esp, 0xfffffff8
push ebx
push edi
call fcn.00459f6c
add esp, 0x10
mov eax, dword [0x461d40]
cmp edi, dword [eax + 4]
je 0x45ab36
add esp, 0xfffffff4
push edi
call sub.cygwin1.dll_fclose
add esp, 0x10
lea edi, [ebp - 0x54]
xor ebx, ebx
mov esi, edi
lea esi, [esi]
xor eax, eax
add esp, 0xfffffffc
mov al, byte [ebx + ebp - 0x50]
push eax
inc ebx
push 0x45aa77
push esi
call sub.cygwin1.dll_sprintf
add esp, 0xfffffff8
lea ecx, [ebp - 0x40]
push edi
push ecx
call sub.cygwin1.dll_strcat
add esp, 0x20
cmp ebx, 0xf
jle 0x45ab40
add esp, 0xfffffff8
lea eax, [ebp - 0x40]
push eax
mov eax, dword [ebp + 0xc]
push eax
call sub.cygwin1.dll_strcmp
add esp, 0x10
test eax, eax
jne 0x45aba4
cmp dword [0x45e43c], 0
jne 0x45abe0
mov ecx, dword [ebp + 8]
push ecx
push 0x45aa7c
push 0x45aa93
push 0x20
call fcn.00437adc
jmp 0x45abe0
cmp dword [0x45e43c], 0
jne 0x45abc4
mov eax, dword [ebp + 8]
push eax
push 0x45aaac
push 0x45aa93
push 0x20
call fcn.00437adc
jmp 0x45abd1
add esp, 0xfffffff4
push 0x45aacd
call sub.cygwin1.dll_printf
add esp, 0x10
add esp, 0xfffffff4
push 0
call sub.cygwin1.dll_exit
mov esi, esi
lea esp, [ebp - 0x78]
xor eax, eax
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret