joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40363e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._fseek
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._ftell
mov dword [ebp - 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._fseek
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._malloc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
sete al
test al, al
je 0x4036a8
mov eax, 0
jmp 0x4036f0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._fread
cmp dword [ebp - 0xc], eax
setne al
test al, al
je 0x4036e5
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._free
mov eax, 0
jmp 0x4036f0
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, dword [ebp - 0x10]
leave
ret

Function at 0x4057bf
Capabilities:
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x44
mov dword [esp], 0xfffffff6
mov eax, dword [sym.imp.KERNEL32.dll_GetStdHandle]
call eax
sub esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x20], 1
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetFileType]
call eax
sub esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jne 0x405851
mov dword [esp + 0x14], 0
lea eax, [ebp - 0x20]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
call eax
sub esp, 0x18
test eax, eax
sete al
test al, al
je 0x405894
mov eax, 0xffffffff
jmp 0x405902
cmp dword [ebp - 0x18], 2
jne 0x405894
mov dword [ebp - 0x10], 0
jmp 0x40587f
mov eax, dword [sym.imp.msvcrt.dll__getch]
call eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov ebx, eax
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x10]
lea edx, [eax + 1]
mov dword [ebp - 0x10], edx
add eax, ecx
mov byte [eax], bl
mov eax, dword [sym.imp.msvcrt.dll__kbhit]
call eax
test eax, eax
setne al
test al, al
jne 0x405860
mov eax, dword [ebp - 0x10]
jmp 0x405902
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0xc]
jae 0x4058a2
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x4058b0
mov eax, 0
jmp 0x405902
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x24]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_ReadFile]
call eax
sub esp, 0x14
test eax, eax
je 0x4058ef
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x4058ef
mov eax, 1
jmp 0x4058f4
mov eax, 0
test al, al
je 0x4058fd
mov eax, dword [ebp - 0x24]
jmp 0x405902
mov eax, 0xffffffff
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x4093a4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x34
mov dword [esp + 4], 1
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._fread
cmp eax, 0x34
je 0x4093d8
mov eax, 0
jmp 0x4093fb
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], 9
mov dword [esp + 4], eax
mov dword [esp], 0x4d06c4
call sym._memcmp
test eax, eax
sete al
movzx eax, al
leave
ret

Function at 0x4096c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x10]
mov dword [esp], eax
call sym._malloc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4096e7
mov eax, 0
jmp 0x409767
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x44]
mov dword [esp + 8], 0
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._fseek
test eax, eax
je 0x40971f
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._free
mov eax, 0
jmp 0x409767
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x44]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x10]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._fread
mov edx, eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x10]
cmp edx, eax
je 0x409764
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._free
mov eax, 0
jmp 0x409767
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x409866
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x20]
mov eax, dword [ebp + 8]
movzx eax, word [eax + 0x2e]
movzx eax, ax
imul eax, dword [ebp + 0xc]
add eax, edx
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x44]
mov dword [esp + 8], 0
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._fseek
test eax, eax
jne 0x4098d3
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x44]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x28
mov dword [esp + 4], 1
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call sym._fread
cmp eax, 0x28
jne 0x4098d3
mov eax, 1
jmp 0x4098d8
mov eax, 0
leave
ret

Function at 0x409996
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x1c]
mov eax, dword [ebp + 8]
movzx eax, word [eax + 0x2a]
movzx eax, ax
imul eax, dword [ebp + 0xc]
add eax, edx
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x44]
mov dword [esp + 8], 0
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._fseek
test eax, eax
jne 0x409a03
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x44]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x20
mov dword [esp + 4], 1
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call sym._fread
cmp eax, 0x20
jne 0x409a03
mov eax, 1
jmp 0x409a08
mov eax, 0
leave
ret
Function at 0x409a7b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x38]
mov edx, dword [ebp + 0xc]
shl edx, 4
add eax, edx
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x44]
mov dword [esp + 8], 0
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._fseek
test eax, eax
jne 0x409adf
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x44]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x10
mov dword [esp + 4], 1
mov eax, dword [ebp + 0x14]
mov dword [esp], eax
call sym._fread
cmp eax, 0x10
je 0x409ae6
mov eax, 0xffffffff
jmp 0x409b5b
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
test eax, eax
je 0x409b50
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x3c]
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
add eax, edx
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x44]
mov dword [esp + 8], 0
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._fseek
mov dword [ebp - 0x10], 0
jmp 0x409b2f
mov eax, dword [ebp - 0xc]
lea edx, [eax + 1]
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 0x14]
mov byte [eax], dl
add dword [ebp - 0x10], 1
cmp dword [ebp - 0x10], 0x7f
jg 0x409b50
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x44]
mov dword [esp], eax
call sym._getc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x409b21
mov eax, dword [ebp - 0xc]
mov byte [eax], 0
mov eax, 0
leave
ret

Function at 0x40bd98
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._getenv
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40be0b
jmp 0x40bdd9
mov eax, dword [ebp - 0x10]
mov byte [eax], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call dbg.xbAddPath
test eax, eax
jne 0x40bdd0
mov eax, 0
jmp 0x40be10
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0xc], eax
mov dword [esp + 4], 0x3b
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._strchr
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40bdb4
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call dbg.xbAddPath
test eax, eax
jne 0x40be0b
mov eax, 0
jmp 0x40be10
mov eax, 1
leave
ret
Function at 0x40bfab
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test al, al
je 0x40c03f
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
movsx eax, al
sub eax, 0x30
cmp eax, 9
setbe al
movzx eax, al
test eax, eax
je 0x40c03f
jmp 0x40c008
mov edx, dword [ebp - 0x10]
mov eax, edx
shl eax, 2
add eax, edx
add eax, eax
mov ecx, eax
mov eax, dword [ebp - 0xc]
lea edx, [eax + 1]
mov dword [ebp - 0xc], edx
movzx eax, byte [eax]
movsx eax, al
add eax, ecx
sub eax, 0x30
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test al, al
je 0x40c02b
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
movsx eax, al
sub eax, 0x30
cmp eax, 9
setbe al
movzx eax, al
test eax, eax
jne 0x40bfe3
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
cmp al, 0x2d
jne 0x40c03f
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
mov dword [ebp + 8], eax
mov eax, dword [0x52a620]
test eax, eax
jne 0x40c062
cmp dword [ebp - 0x10], 0x63
jg 0x40c062
movzx eax, byte [0x52a060]
xor eax, 1
test al, al
je 0x40c0d5
cmp dword [ebp - 0x10], 0
jle 0x40c0d5
mov eax, dword [0x52a624]
test eax, eax
je 0x40c07e
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov dword [esp], str._03d_
call dbg.printf(char const*, ::)
cmp dword [ebp - 0x10], 0x63
jle 0x40c090
mov dword [esp], str.ERROR:
call dbg.printf(char const*, ::)
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dbg.vprintf(char const*, char*)
cmp dword [ebp + 0x10], 0xa
jne 0x40c0b4
mov dword [esp], 0xd
call sym._putchar
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call sym._putchar
mov dword [esp], 1
mov eax, dword [dbg.__acrt_iob_func]
call eax
mov dword [esp], eax
call sym._fflush
nop
leave
ret
Function at 0x40c1d4
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
jmp 0x40c260
cmp dword [ebp - 0xc], 5
jg 0x40c25a
mov eax, dword [ebp + 0xc]
lea edx, [eax + 1]
mov dword [ebp + 0xc], edx
movzx eax, byte [eax]
movsx eax, al
and eax, 0xff
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
shl eax, 8
or eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
add dword [ebp - 0xc], 8
add dword [ebp - 0x14], 1
jmp 0x40c25a
mov eax, dword [ebp - 0xc]
sub eax, 6
mov edx, dword [ebp - 0x10]
mov ecx, eax
shr edx, cl
mov eax, edx
and eax, 0x3f
mov dword [ebp - 0x1c], eax
sub dword [ebp - 0xc], 6
mov eax, dword [ebp + 8]
lea edx, [eax + 1]
mov dword [ebp + 8], edx
mov edx, dword [ebp - 0x1c]
add edx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
movzx edx, byte [edx]
mov byte [eax], dl
cmp dword [ebp - 0xc], 5
jg 0x40c22a
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0x10]
jl 0x40c1f7
cmp dword [ebp - 0xc], 4
je 0x40c2c1
cmp dword [ebp - 0xc], 4
jg 0x40c2f2
cmp dword [ebp - 0xc], 0
je 0x40c312
cmp dword [ebp - 0xc], 2
jne 0x40c2f2
mov eax, dword [ebp - 0x10]
shl eax, 4
and eax, 0x3f
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
lea edx, [eax + 1]
mov dword [ebp + 8], edx
mov edx, dword [ebp - 0x1c]
add edx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
movzx edx, byte [edx]
mov byte [eax], dl
mov eax, dword [ebp + 8]
lea edx, [eax + 1]
mov dword [ebp + 8], edx
mov byte [eax], 0x3d
mov eax, dword [ebp + 8]
lea edx, [eax + 1]
mov dword [ebp + 8], edx
mov byte [eax], 0x3d
jmp 0x40c313
mov eax, dword [ebp - 0x10]
shl eax, 2
and eax, 0x3f
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
lea edx, [eax + 1]
mov dword [ebp + 8], edx
mov edx, dword [ebp - 0x1c]
add edx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
movzx edx, byte [edx]
mov byte [eax], dl
mov eax, dword [ebp + 8]
lea edx, [eax + 1]
mov dword [ebp + 8], edx
mov byte [eax], 0x3d
jmp 0x40c313
mov dword [esp], 2
mov eax, dword [dbg.__acrt_iob_func]
call eax
mov dword [esp + 4], str.Unexpected_bits_left:_internal_bug__n
mov dword [esp], eax
call dbg.fprintf
jmp 0x40c313
nop
mov eax, dword [ebp + 8]
lea edx, [eax + 1]
mov dword [ebp + 8], edx
mov byte [eax], 0
mov eax, dword [ebp + 8]
sub eax, dword [ebp - 0x18]
leave
ret

Function at 0x40c86e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0xc], 0
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x2c]
mov dword [esp + 0x10], 0
lea ecx, [ebp - 0xc]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WriteFile]
call eax
sub esp, 0x14
test eax, eax
jne 0x40c8c7
mov dword [esp], str.Error_writing_port_n
call sym._printf_3
call dbg.ShowLastError
mov eax, 0xffffffff
jmp 0x40c8ca
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x40c8f7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x2c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
call eax
sub esp, 4
mov eax, dword [ebp + 8]
mov dword [eax + 0x1c], 0
mov eax, dword [ebp + 8]
lea edx, [eax + 0x14]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_SetCommTimeouts]
call eax
sub esp, 8
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x2c]
mov dword [esp + 0x10], 0
lea ecx, [ebp - 0xc]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_ReadFile]
call eax
sub esp, 0x14
test eax, eax
jne 0x40c98a
mov dword [esp], str.Error_reading_port_n
call sym._printf_3
call dbg.ShowLastError
mov eax, 0xffffffff
jmp 0x40c98d
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x40c98f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x2c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
call eax
sub esp, 4
cmp dword [ebp + 0x14], 1
jle 0x40c9b9
sub dword [ebp + 0x14], 1
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
mov dword [eax + 0x1c], edx
mov eax, dword [ebp + 8]
lea edx, [eax + 0x14]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_SetCommTimeouts]
call eax
sub esp, 8
mov dword [esp], 1
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x2c]
mov dword [esp + 0x10], 0
lea ecx, [ebp - 0xc]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_ReadFile]
call eax
sub esp, 0x14
test eax, eax
jne 0x40ca3c
mov dword [esp], str.Error_reading_port_n
call sym._printf_3
call dbg.ShowLastError
mov eax, 0xffffffff
jmp 0x40ca4d
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x40ca4a
mov eax, 0xffffffff
jmp 0x40ca4d
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x40ca4f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x2c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
call eax
sub esp, 4
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
mov dword [eax + 0x1c], edx
mov eax, dword [ebp + 8]
lea edx, [eax + 0x14]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_SetCommTimeouts]
call eax
sub esp, 8
jmp 0x40cb0e
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x2c]
mov dword [esp + 0x10], 0
lea ecx, [ebp - 0x14]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov edx, dword [ebp - 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_ReadFile]
call eax
sub esp, 0x14
test eax, eax
jne 0x40caef
mov dword [esp], str.Error_reading_port_n
call sym._printf_3
call dbg.ShowLastError
mov eax, 0xffffffff
jmp 0x40cb17
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x40cafd
mov eax, 0xffffffff
jmp 0x40cb17
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
sub edx, eax
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x14]
add dword [ebp - 0xc], eax
cmp dword [ebp - 0x10], 0
jg 0x40caa3
mov eax, dword [ebp + 0x10]
leave
ret

Function at 0x40cbd1
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 0xc]
mov word [ebp - 0x1c], ax
call dbg.InitWinSock
test eax, eax
je 0x40cbf1
mov eax, 0xffffffff
jmp 0x40cc95
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call sym._memset
mov eax, dword [ebp + 0x10]
mov word [eax], 2
movzx eax, word [ebp - 0x1c]
movzx eax, ax
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_htons]
call eax
sub esp, 4
mov edx, dword [ebp + 0x10]
mov word [edx + 2], ax
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
movsx eax, al
sub eax, 0x30
cmp eax, 9
ja 0x40cc60
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_inet_addr]
call eax
sub esp, 4
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x10]
mov eax, dword [ebp + 0x10]
mov edx, dword [edx]
mov dword [eax + 4], edx
jmp 0x40cc90
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_gethostbyname]
call eax
sub esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x40cc80
mov eax, 0xffffffff
jmp 0x40cc95
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
mov eax, dword [ebp + 0x10]
mov edx, dword [edx]
mov dword [eax + 4], edx
mov eax, 0
leave
ret
Function at 0x40cc97
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [ebp + 8]
mov word [ebp - 0x2c], ax
mov dword [ebp - 0x10], 1
call dbg.InitWinSock
test eax, eax
je 0x40ccbe
mov eax, 0xffffffff
jmp 0x40cdb1
mov dword [esp + 8], 0x11
mov dword [esp + 4], 2
mov dword [esp], 2
mov eax, dword [sym.imp.WS2_32.dll_socket]
call eax
sub esp, 0xc
mov dword [ebp - 0xc], eax
mov dword [esp + 0x10], 4
lea eax, [ebp - 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x20
mov dword [esp + 4], 0xffff
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_setsockopt]
call eax
sub esp, 0x14
test eax, eax
je 0x40cd2a
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call dbg.CloseSocket
mov eax, 0xffffffff
jmp 0x40cdb1
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
lea eax, [ebp - 0x20]
mov dword [esp], eax
call sym._memset
mov word [ebp - 0x20], 2
mov dword [ebp - 0x1c], 0
movzx eax, word [ebp - 0x2c]
movzx eax, ax
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_htons]
call eax
sub esp, 4
mov word [ebp - 0x1e], ax
mov dword [esp + 8], 0x10
lea eax, [ebp - 0x20]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_bind]
call eax
sub esp, 0xc
test eax, eax
je 0x40cda4
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_closesocket]
call eax
sub esp, 4
mov eax, 0xffffffff
jmp 0x40cdb1
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, 0
leave
ret

Function at 0x40cdb3
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
call dbg.InitWinSock
test eax, eax
je 0x40cdc9
mov eax, 0xffffffff
jmp 0x40ce34
mov dword [esp + 8], 6
mov dword [esp + 4], 1
mov dword [esp], 2
mov eax, dword [sym.imp.WS2_32.dll_socket]
call eax
sub esp, 0xc
mov dword [ebp - 0xc], eax
mov dword [esp + 8], 0x10
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_connect]
call eax
sub esp, 0xc
test eax, eax
je 0x40ce27
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_closesocket]
call eax
sub esp, 4
mov eax, 0xffffffff
jmp 0x40ce34
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, 0
leave
ret
Function at 0x40ce50
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [ebp + 8]
mov word [ebp - 0x2c], ax
call dbg.InitWinSock
test eax, eax
je 0x40ce70
mov eax, 0xffffffff
jmp 0x40cf1b
mov dword [esp + 8], 0x11
mov dword [esp + 4], 2
mov dword [esp], 2
mov eax, dword [sym.imp.WS2_32.dll_socket]
call eax
sub esp, 0xc
mov dword [ebp - 0xc], eax
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
lea eax, [ebp - 0x1c]
mov dword [esp], eax
call sym._memset
mov word [ebp - 0x1c], 2
mov dword [ebp - 0x18], 0
movzx eax, word [ebp - 0x2c]
movzx eax, ax
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_htons]
call eax
sub esp, 4
mov word [ebp - 0x1a], ax
mov dword [esp + 8], 0x10
lea eax, [ebp - 0x1c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_bind]
call eax
sub esp, 0xc
test eax, eax
je 0x40cf0e
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_closesocket]
call eax
sub esp, 4
mov eax, 0xffffffff
jmp 0x40cf1b
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, 0
leave
ret

Function at 0x40cf1d
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x338
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0x3e8
mov dword [ebp - 0x118], 0
mov dword [tv.tv_sec], 0
jmp 0x40cf5a
mov eax, dword [tv.tv_sec]
mov eax, dword [ebp + eax*4 - 0x114]
cmp dword [ebp + 8], eax
je 0x40cf65
add dword [tv.tv_sec], 1
mov eax, dword [ebp - 0x118]
cmp dword [tv.tv_sec], eax
jb 0x40cf47
mov eax, dword [ebp - 0x118]
cmp dword [tv.tv_sec], eax
jne 0x40cf97
mov eax, dword [ebp - 0x118]
cmp eax, 0x3f
ja 0x40cf97
mov eax, dword [tv.tv_sec]
mov edx, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x114], edx
mov eax, dword [ebp - 0x118]
add eax, 1
mov dword [ebp - 0x118], eax
mov eax, dword [ebp + 8]
add eax, 1
mov edx, eax
lea eax, [ebp - 0x14]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
lea eax, [ebp - 0x118]
mov dword [esp + 4], eax
mov dword [esp], edx
mov eax, dword [sym.imp.WS2_32.dll_select]
call eax
sub esp, 0x14
test eax, eax
jle 0x40d024
lea eax, [ebp - 0x118]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym.___WSAFDIsSet_8
sub esp, 8
test eax, eax
je 0x40cf34
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x200
lea eax, [ebp - 0x318]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_recv]
call eax
sub esp, 0x10
test eax, eax
je 0x40d027
jmp 0x40cf34
nop
jmp 0x40d028
nop
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_closesocket]
call eax
sub esp, 4
nop
leave
ret