joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418550
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x401916
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x401308
mov edx, dword [ebp + 8]
xor esi, esi
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x44], esi
call dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
push 3
lea eax, [ebp - 0x30]
push 0x4036d4
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaAryConstruct2]
call fcn.00417ed0
mov ecx, dword [ebp - 0x18]
or ebx, 0xffffffff
push ecx
push esi
mov word [0x41f06c], si
mov word [0x41f06e], bx
mov dword [0x41f070], esi
mov word [0x41f074], si
mov dword [0x41f078], ebx
mov word [0x41f07c], si
call dword [sym.imp.MSVBVM60.DLL_rtcBstrFromAnsi]
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
mov edx, eax
lea ecx, [ebp - 0x40]
call edi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
mov edx, eax
mov ecx, 0x41f024
call edi
lea ecx, [ebp - 0x40]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
mov edx, dword [0x41f024]
push edx
call dword [sym.imp.MSVBVM60.DLL_VarPtr]
push 0x418350
mov dword [0x41f028], eax
mov dword [0x41f030], eax
call fcn.004181f0
mov edi, dword [sym.imp.KERNEL32.DLL_CreateEventW]
push esi
push esi
push 1
push esi
mov dword [0x41f034], eax
mov dword [0x41f038], esi
mov dword [0x41f03c], esi
call edi
push esi
push esi
push 1
push esi
mov dword [0x41f060], eax
call edi
push esi
push esi
push 1
push esi
mov dword [0x41f068], eax
call edi
mov ecx, dword [0x41f060]
mov dword [0x41f064], eax
cmp ecx, esi
je 0x4186dd
cmp dword [0x41f068], esi
je 0x4186dd
cmp eax, esi
je 0x4186dd
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], esi
push eax
push 4
push esi
push 0x4184a0
push esi
push esi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
cmp eax, esi
mov dword [0x41f02c], eax
je 0x4186e2
push eax
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
mov ecx, dword [ebp - 0x24]
mov edx, dword [0x41f02c]
push ebx
push esi
mov dword [ecx], edx
mov eax, dword [ebp - 0x24]
mov ecx, dword [0x41f064]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 0x24]
push edx
push 2
call dword [sym.imp.KERNEL32.DLL_WaitForMultipleObjects]
cmp eax, 1
jne 0x4186dd
push 4
mov word [0x41f06c], bx
mov word [0x41f06e], si
call fcn.00418200
mov eax, dword [0x41f02c]
cmp word [0x41f06c], si
jne 0x41870e
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
push eax
call esi
mov eax, dword [0x41f060]
push eax
call esi
mov ecx, dword [0x41f068]
push ecx
call esi
mov edx, dword [0x41f064]
push edx
call esi
mov eax, dword [0x41f06c]
push 0x418751
not eax
mov word [0x41f06e], ax
mov ecx, dword [0x41f06c]
mov dword [ebp - 0x3c], ecx
jmp 0x418735
lea ecx, [ebp - 0x18]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
lea eax, [ebp - 0x44]
lea edx, [ebp - 0x30]
push eax
push 0
mov dword [ebp - 0x44], edx
call dword [sym.imp.MSVBVM60.DLL___vbaAryDestruct]
ret
Function at 0x41d660
Capabilities:
Get token membership

Disassembly:
sub esp, 0x10
xor eax, eax
push esi
xor esi, esi
mov dword [esp + 0xc], eax
mov ecx, 5
mov dword [esp + 8], esi
mov dword [esp + 4], esi
mov word [esp + 0x10], ax
call dword [sym.imp.MSVBVM60.DLL___vbaUI1I4]
lea ecx, [esp + 4]
mov byte [esp + 0x11], al
push ecx
push esi
push esi
push esi
push esi
push esi
push esi
push 0x220
push 0x20
mov ecx, 2
call dword [0x40118c]
lea edx, [esp + 0x30]
push eax
push edx
call dword [sym.imp.ADVAPI32.DLL_AllocateAndInitializeSid]
test eax, eax
je 0x41d6e4
mov ecx, dword [esp + 4]
lea eax, [esp + 8]
push eax
push ecx
push esi
call dword [sym.imp.ADVAPI32.DLL_CheckTokenMembership]
test eax, eax
je 0x41d6d9
mov ecx, dword [esp + 8]
xor edx, edx
cmp ecx, esi
setne dl
neg edx
mov esi, edx
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.DLL_FreeSid]
mov ax, si
pop esi
add esp, 0x10
ret
Function at 0x413810
Capabilities:
Create http request
Delete registry value
Read data from internet
Receive data
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push ebx
push esi
push 0
push 0
push 0
push 0
mov ebx, edx
mov dword [ebp - 4], 1
push str.RookIE_1.0
mov dword [ebp - 0xc], ebx
mov esi, ecx
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x413912
push edi
push 0
push 0x4000000
push 0
push 0
push esi
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov edi, eax
test edi, edi
je 0x413908
lea eax, [ebp - 8]
push eax
push 0x102
push 0
push str.Console
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push 0x1388
call fcn.0040182d
push 0x1388
mov ebx, eax
push 0
push ebx
call fcn.00402c00
xor esi, esi
add esp, 0x10
cmp dword [ebp - 4], esi
jbe 0x4138e6
nop dword [eax]
lea eax, [ebp - 4]
push eax
push 0x3ff
lea eax, [ebp - 0x410]
push eax
push edi
call dword [sym.imp.WININET.dll_InternetReadFile]
push dword [ebp - 4]
lea eax, [ebp - 0x410]
push eax
lea eax, [esi + ebx]
push eax
call fcn.004033c0
mov eax, dword [ebp - 4]
add esp, 0xc
add esi, eax
test eax, eax
jne 0x4138b0
push esi
push ebx
push 3
push 0
push dword [ebp - 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push dword [ebp - 0x10]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401050
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ebx
mov esi, ecx
mov edi, edx
push edi
push dword [esi]
push str.client_write_fd__d_buf__p_len__d
push 6
call fcn.004052a0
add esp, 0x14
cmp dword [esi + 0x28], 4
je 0x40108f
push dword [esi]
push str.Attempted_to_write_to_client__d_not_in_CONNECTED_state
push 1
call fcn.004052a0
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret
push 0
push ebx
push edi
push dword [esi]
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
test edi, edi
jns 0x4010f1
mov ebx, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
call ebx
cmp dword [eax], 0xb
je 0x4010de
call ebx
cmp dword [eax], 0x2733
je 0x4010de
call ebx
push dword [eax]
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
add esp, 4
push eax
push dword [esi]
push str.ERROR:_client_write:_sending_to_fd__d_failed:__s
push 1
call fcn.004052a0
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
push dword [esi]
push str.client_write:_fd__d_not_ready_for_writing
push 5
call fcn.004052a0
add esp, 0xc
xor edi, edi
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4029a0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ecx
push esi
mov esi, ecx
xor edx, edx
push edi
mov ecx, dword [esi + 0x14]
cmp ecx, 0x10
jae 0x402a2c
push edx
mov eax, 0x10
sub eax, ecx
push eax
mov eax, dword [esi + 0x10]
add eax, ecx
push eax
push dword [esi]
call dword [sym.imp.WS2_32.dll_recv]
mov ecx, eax
test ecx, ecx
jg 0x402a18
jns 0x4029fc
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push dword [eax]
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
add esp, 4
push eax
push dword [esi]
push str.Receive_from_client_fd__d_failed:__s
push 1
call fcn.004052a0
add esp, 0x10
mov ecx, esi
call fcn.00401100
pop edi
pop esi
pop ecx
ret
push dword [esi]
push str.Client__d_connection_closed
push 4
call fcn.004052a0
add esp, 0xc
mov ecx, esi
call fcn.00401100
pop edi
pop esi
pop ecx
ret
add ecx, dword [esi + 0x14]
mov dword [esi + 0x14], ecx
cmp ecx, 0x10
jb 0x402acc
mov edx, 1
mov edi, dword [esi + 0x10]
mov eax, dword [edi]
cmp eax, dword [esi + 0x18]
jbe 0x402a53
push eax
push dword [esi]
push str.Client__d_message_is_too_long___d_bytes_
push 4
call fcn.004052a0
add esp, 0x10
mov ecx, esi
call fcn.00401100
pop edi
pop esi
pop ecx
ret
cmp eax, 0x10
jae 0x402a75
push eax
push dword [esi]
push str.Client__d_message_is_too_short___d_bytes_
push 1
call fcn.004052a0
add esp, 0x10
mov ecx, esi
call fcn.00401100
pop edi
pop esi
pop ecx
ret
cmp ecx, eax
jae 0x402abc
test edx, edx
jne 0x402acc
push edx
sub eax, ecx
push eax
lea eax, [edi + ecx]
push eax
push dword [esi]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jns 0x402aac
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push dword [eax]
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
add esp, 4
push eax
push dword [esi]
push str.Receive_from_client_fd__d_failed:__s
jmp 0x402a60
je 0x4029fc
add dword [esi + 0x14], eax
mov eax, dword [esi + 0x14]
cmp eax, dword [edi]
jb 0x402acc
mov edx, edi
mov ecx, esi
call fcn.00401940
mov dword [esi + 0x14], 0
pop edi
pop esi
pop ecx
ret
Function at 0x402ad0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x410510
mov dword [ebp - 4], edx
mov ebx, ecx
call dword [sym.imp.pthreadVC3.dll_pthread_mutex_lock]
mov edi, dword [0x41048c]
add esp, 4
xor eax, eax
test edi, edi
jle 0x402b10
mov ecx, dword [0x410488]
nop dword [eax]
mov esi, dword [ecx + eax*4]
test esi, esi
je 0x402b0b
cmp dword [esi], ebx
je 0x402b35
inc eax
cmp eax, edi
jl 0x402b00
push 0x410510
call dword [sym.imp.pthreadVC3.dll_pthread_mutex_unlock]
add esp, 4
push ebx
push str.client_process:_fd__d_not_found_in_client_list
push 4
call fcn.004052a0
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x410510
call dword [sym.imp.pthreadVC3.dll_pthread_mutex_unlock]
add esp, 4
cmp dword [esi + 0x28], 4
jne 0x402b6c
push str.client_process_in_CONNECTED_state
push 6
call fcn.004052a0
push dword [ebp - 4]
mov ecx, dword [esi + 0x24]
mov edx, esi
call fcn.00403ec0
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
test eax, 0x300
je 0x402b84
mov ecx, esi
call fcn.004029a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test al, 0x10
je 0x402b2e
mov eax, dword [esi + 8]
test eax, eax
jne 0x402bac
push dword [esi]
push str.Client__d_OUT_process_but_nothing_to_send_
push 2
call fcn.004052a0
add esp, 0xc
and word [esi + 0x1c], 0xffef
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
test edi, edi
jg 0x402bf2
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push dword [eax]
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
add esp, 4
push eax
push edi
push dword [esi]
push str.Sending_to_client_fd__d_failed:__d__s
push 1
call fcn.004052a0
add esp, 0x14
mov ecx, esi
call fcn.00401100
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 8]
cmp edi, eax
jne 0x402c49
and word [esi + 0x1c], 0xffef
cmp dword [esi + 0x28], 3
mov dword [esi + 8], 0
jne 0x402b2e
push dword [esi]
push str.Client__d_switching_to_CONNECTED_state
push 5
call fcn.004052a0
mov ax, word [esi + 0x1e]
add esp, 0xc
mov dword [esi + 0x28], 4
mov word [esi + 0x1c], ax
push dword [esi + 4]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov dword [esi + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 4]
sub eax, edi
push eax
mov dword [esi + 8], eax
lea eax, [ecx + edi]
push eax
push ecx
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402ea0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x410004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x410494]
push ebx
push esi
push edi
xor edi, edi
test eax, eax
jne 0x403043
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x21c], edi
push eax
push 0x23
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x402fd8
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x21c]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x402fd8
lea esi, [ebp - 0x218]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x402f07
sub esi, ecx
sar esi, 1
mov dword [ebp - 0x22c], esi
test esi, esi
jle 0x402fca
lea eax, [esi + 1]
lea eax, [eax + eax*2]
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [ebp - 0x220], 0x800
xor edx, edx
mov dword [ebp - 0x224], 0x80
mov edi, eax
xor ebx, ebx
nop
movzx ecx, word [ebp + ebx*2 - 0x218]
lea esi, [edx + edi]
inc ebx
mov dword [ebp - 0x228], esi
inc edx
mov eax, ecx
cmp cx, word [ebp - 0x220]
jb 0x402f94
mov ax, cx
shr ax, 0xc
sub al, 0x20
mov byte [esi], al
mov eax, ecx
shr eax, 6
and cl, 0x3f
and al, 0x3f
add cl, 0x80
add al, 0x80
mov byte [edx + edi], al
mov byte [edx + edi + 1], cl
add edx, 2
jmp 0x402fbc
cmp cx, word [ebp - 0x224]
jb 0x402fb2
shr ecx, 6
and al, 0x3f
and cl, 0x1f
add al, 0x80
sub cl, 0x40
mov byte [esi], cl
mov byte [edx + edi], al
inc edx
jmp 0x402fbc
mov ecx, dword [ebp - 0x228]
and al, 0x7f
mov byte [ecx], al
cmp ebx, dword [ebp - 0x22c]
jl 0x402f50
mov byte [edx + edi], 0
jmp 0x402fcc
xor edi, edi
push dword [ebp - 0x21c]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push 0
push str.AppleLockdown
push 0x40ad30
push edi
call fcn.004084f0
mov edx, eax
add esp, 0x10
mov dword [0x410494], edx
test edx, edx
je 0x40301f
mov ecx, edx
lea esi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403000
sub ecx, esi
lea eax, [ecx - 1]
test eax, eax
jle 0x40301f
cmp byte [edx + eax], 0x5c
jne 0x40301f
mov byte [edx + eax], 0
dec eax
test eax, eax
jg 0x403010
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
push dword [0x410494]
push str.Initialized_config_dir_to__s
push 5
call fcn.004052a0
mov eax, dword [0x410494]
add esp, 0xc
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004088e2
mov esp, ebp
pop ebp
ret
Function at 0x403060
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x410004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
test esi, esi
jne 0x40308c
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004088e2
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
add esp, 4
test eax, eax
je 0x4030f1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [eax], 0x11
je 0x4030f1
push edi
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
push 0
mov edi, eax
lea eax, [ebp - 0x404]
push 0
push eax
push 0
push edi
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__splitpath]
mov edx, 0x1ed
lea ecx, [ebp - 0x404]
call fcn.00403060
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 0x1c
mov eax, esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004088e2
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.004088e2
mov esp, ebp
pop ebp
ret
Function at 0x403ec0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x410500
mov ebx, edx
mov dword [ebp - 4], ecx
call dword [sym.imp.pthreadVC3.dll_pthread_mutex_lock]
mov edi, dword [0x41049c]
add esp, 4
xor esi, esi
xor eax, eax
test edi, edi
jle 0x403f37
mov edx, dword [0x410498]
mov ecx, dword [edx + eax*4]
test ecx, ecx
je 0x403f05
mov edi, dword [ebp - 4]
cmp dword [ecx + 4], edi
mov edi, dword [0x41049c]
je 0x403f1a
inc eax
cmp eax, edi
jl 0x403ef0
push 0x410500
call dword [sym.imp.pthreadVC3.dll_pthread_mutex_unlock]
add esp, 4
jmp 0x403f49
mov edx, dword [ecx + 0x14]
xor eax, eax
test edx, edx
jle 0x403f37
mov edi, dword [ecx + 0x10]
mov ecx, dword [edi + eax*4]
test ecx, ecx
je 0x403f32
cmp dword [ecx + 4], ebx
je 0x403f63
inc eax
cmp eax, edx
jl 0x403f26
push 0x410500
call dword [sym.imp.pthreadVC3.dll_pthread_mutex_unlock]
add esp, 4
test esi, esi
jne 0x403f67
push ebx
push dword [ebp - 4]
push str.Could_not_find_connection_for_device__d_client__p
push 2
call fcn.004052a0
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, ecx
jmp 0x403f37
mov ebx, dword [ebp + 8]
movsx eax, bx
push eax
push str.device_client_process___d_
push 6
call fcn.004052a0
add esp, 0xc
test bl, 0x10
je 0x403fe2
mov eax, dword [esi + 0x40]
test eax, eax
je 0x403fe2
mov edx, dword [esi + 0x3c]
mov ecx, dword [esi + 4]
push eax
call fcn.00401050
add esp, 4
test eax, eax
jg 0x403fba
push eax
push str.error_writing_to_client___d_
push 5
call fcn.004052a0
add esp, 0xc
mov ecx, esi
call fcn.00403930
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
add dword [esi + 0x14], eax
mov edx, dword [esi + 0x40]
cmp eax, edx
jne 0x403fcd
mov dword [esi + 0x40], 0
jmp 0x403fe2
mov ecx, dword [esi + 0x3c]
sub edx, eax
push edx
add eax, ecx
mov dword [esi + 0x40], edx
push eax
push ecx
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
test ebx, 0x300
je 0x40407a
mov edi, dword [esi + 0x34]
test edi, edi
je 0x40407a
mov ebx, dword [esi + 4]
mov eax, dword [esi + 0x48]
push edi
push eax
push dword [ebx]
mov dword [ebp - 4], eax
push str.client_read_fd__d_buf__p_len__d
push 6
call fcn.004052a0
add esp, 0x14
cmp dword [ebx + 0x28], 4
je 0x40403a
push dword [ebx]
push str.Attempted_to_read_from_client__d_not_in_CONNECTED_state
push 1
call fcn.004052a0
add esp, 0xc
or edi, 0xffffffff
push edi
push str.error_reading_from_client___d_
jmp 0x403fa2
push 0
push edi
push dword [ebp - 4]
push dword [ebx]
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
test edi, edi
jg 0x40405f
jns 0x403fac
push edi
push str.error_reading_from_client___d_
jmp 0x403fa2
push edi
push dword [esi + 0x48]
mov dl, 0x10
mov ecx, esi
call fcn.00403800
add esp, 8
test eax, eax
js 0x403fac
add dword [esi + 0x10], edi
mov ecx, esi
call fcn.00403de0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4053a0
Capabilities:
Create tcp socket
Initialize winsock library
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1ac
mov eax, dword [0x410004]
xor eax, esp
mov dword [esp + 0x1a8], eax
push esi
push 0x190
lea eax, [esp + 0x1c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push str.Starting_WSA
push 4
call fcn.004052a0
add esp, 8
lea eax, [esp + 0x18]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x405424
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
add esp, 4
push eax
push str.ERROR:_WSAStartup_failed:__s
push 0
call fcn.004052a0
add esp, 0xc
mov eax, 1
pop esi
mov ecx, dword [esp + 0x1a8]
xor ecx, esp
call fcn.004088e2
mov esp, ebp
pop ebp
ret
push str.Opening_socket
push 4
call fcn.004052a0
add esp, 8
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40545c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.ERROR:_socket___failed:__s
push 0
call fcn.004052a0
add esp, 0xc
push str.Setting_socket_to_non_blocking
push 4
mov dword [esp + 0xc], 1
call fcn.004052a0
add esp, 8
lea eax, [esp + 4]
push eax
push 0x8004667e
push esi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x4054ae
push eax
push str.ERROR:_Could_not_set_socket_to_non_blocking:__d
push 0
call fcn.004052a0
add esp, 0xc
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x1a8]
xor ecx, esp
call fcn.004088e2
mov esp, ebp
pop ebp
ret
cmp dword [0x4104b0], 0
xorps xmm0, xmm0
mov eax, 2
movlpd qword [esp + 0x10], xmm0
mov word [esp + 8], ax
jne 0x4054d1
push str.127.0.0.1
jmp 0x4054d6
push str.0.0.0.0
call dword [sym.imp.WS2_32.dll_inet_addr]
push 0x6987
mov dword [esp + 0x10], eax
call dword [sym.imp.WS2_32.dll_htons]
push str.Binding_to_socket
push 4
mov word [esp + 0x12], ax
call fcn.004052a0
add esp, 8
lea eax, [esp + 8]
push 0x10
push eax
push esi
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
je 0x405542
push 0x6987
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.bind___failed._WSAGetLastError_returned_error_code__u._Is_another_process_using_TCP_port__d_
push 0
call fcn.004052a0
add esp, 0x10
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x1a8]
xor ecx, esp
call fcn.004088e2
mov esp, ebp
pop ebp
ret
push str.Starting_to_listen_on_socket
push 4
call fcn.004052a0
add esp, 8
push 5
push esi
call dword [sym.imp.WS2_32.dll_listen]
test eax, eax
je 0x405595
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push dword [eax]
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
add esp, 4
push eax
push str.listen___failed:__s
push 0
call fcn.004052a0
add esp, 0xc
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x1a8]
xor ecx, esp
call fcn.004088e2
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x1ac]
mov eax, esi
pop esi
xor ecx, esp
call fcn.004088e2
mov esp, ebp
pop ebp
ret
Function at 0x4085d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ecx
push 0x40d89c
push eax
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], eax
mov dword [edi], 0
mov dword [edi + 4], 0
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x40863f
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
add esp, 4
cdq
mov ebx, eax
mov dword [ebp + 8], edx
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_rewind]
mov ecx, ebx
add esp, 4
or ecx, dword [ebp + 8]
jne 0x408648
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebx + 1]
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ecx, dword [ebp - 4]
add esp, 4
mov dword [ebp - 8], 1
push esi
push ebx
push 1
push eax
mov dword [ecx], eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
xor ecx, ecx
cmp eax, ebx
jne 0x40867a
cmp ecx, dword [ebp + 8]
je 0x4086b3
push dword [ebp - 0xc]
push ebx
push str.buffer_read_from_filename
push str._s:_ERROR:_couldnt_read__d_bytes_from__s
push 1
call fcn.004052a0
mov eax, dword [ebp - 4]
add esp, 0x14
push dword [eax]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov dword [ebp - 8], 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], 5
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [ebp + 8]
add esp, 4
mov dword [edi], ebx
mov dword [edi + 4], eax
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x408760
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
push ebx
push esi
mov esi, edx
push edi
test ecx, ecx
je 0x408809
test esi, esi
je 0x408809
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ecx
call dword [sym.imp.plist.dll_plist_to_xml]
mov eax, dword [ebp - 4]
mov ebx, dword [ebp - 8]
push 0x40d8e8
push esi
mov dword [ebp - 0xc], eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov edi, eax
add esp, 0x14
test edi, edi
je 0x4087f2
push edi
push ebx
push 1
push dword [ebp - 0xc]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
cmp esi, ebx
jne 0x4087e6
push dword [ebp - 4]
mov esi, 1
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], 5
push dword [ebp - 4]
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret