joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405070
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x437cf8
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x454288]
xor eax, esp
mov dword [esp + 0x58], eax
push esi
mov eax, dword [0x454288]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0xffffffff
mov byte [esp + 0x10], 0
mov dword [esp + 0x14], eax
push 0x40
lea eax, [esp + 0x20]
mov dword [esp + 0x74], 0
push 0
push eax
call fcn.00430ad0
add esp, 0xc
push 0
push esi
call fcn.004274f5
add esp, 8
cmp eax, 0xffffffff
jne 0x405113
mov eax, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x4051f6
cmp byte [esp + 0x10], 0
push eax
je 0x405106
call dword [sym.imp.WS2_32.dll_closesocket]
jmp 0x4051f6
call fcn.0042794d
add esp, 4
jmp 0x4051f6
sub esp, 8
lea ecx, [esp + 0x14]
push esi
call fcn.00404890
test al, al
je 0x4050e6
cmp dword [esp + 0xc], 0xffffffff
je 0x4051ed
push 0x3f
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x1c]
push dword [eax]
call fcn.00427ac2
add esp, 0xc
test eax, eax
jle 0x4051ed
cmp eax, 0x40
jae 0x405215
mov byte [esp + eax + 0x1c], 0
xor eax, eax
lea esp, [esp]
cmp byte [esp + eax + 0x1c], 0
je 0x405191
cmp byte [esp + eax + 0x1d], 0
je 0x405190
cmp byte [esp + eax + 0x1e], 0
je 0x40518b
cmp byte [esp + eax + 0x1f], 0
je 0x405186
add eax, 4
cmp eax, 0x40
jb 0x405160
jmp 0x405191
add eax, 3
jmp 0x405191
add eax, 2
jmp 0x405191
inc eax
test eax, eax
jle 0x405245
cmp byte [esp + eax + 0x1b], 0xa
jne 0x4051ab
dec eax
cmp eax, 0x40
jae 0x405215
mov byte [esp + eax + 0x1c], 0
push 0
lea edx, [esp + 0x1c]
mov dword [esp + 0x1c], 0xffffffff
lea ecx, [esp + 0x20]
call fcn.00401680
add esp, 4
cmp eax, 2
je 0x40521a
call fcn.00426c8a
push dword [eax]
push str.INTERNAL_ERROR___d_._Please__contact_WTware_tech_support.
push 0x28a
push str.....commonmisc3.cpp
push str.ERROR
call fcn.0040ae90
add esp, 0x14
lea ecx, [esp + 0xc]
call fcn.004057f0
or eax, 0xffffffff
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.00426c47
mov esp, ebp
pop ebp
ret
call fcn.004276e6
mov eax, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x40523f
cmp byte [esp + 0x10], 0
push eax
je 0x405237
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [esp + 0x18]
jmp 0x4051f9
call fcn.0042794d
add esp, 4
mov eax, dword [esp + 0x18]
jmp 0x4051f9
call fcn.00426c8a
push dword [eax]
push str.INTERNAL_ERROR___d_._Please__contact_WTware_tech_support.
push 0x284
jmp 0x4051db
Function at 0x4056d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x437d28
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x454288]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
push 0
push edi
call fcn.004274f5
add esp, 8
cmp eax, 0xffffffff
jne 0x405720
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0xffffffff
mov byte [ebp - 0x14], 0
mov dword [ebp - 0x10], eax
sub esp, 8
mov dword [ebp - 4], 0
mov ecx, eax
push edi
call fcn.00404890
test al, al
je 0x40579c
mov eax, dword [ebp - 0x18]
cmp eax, 0xffffffff
je 0x40579f
mov eax, dword [ebp - 0x10]
push 0x3f
push esi
push dword [eax]
call fcn.00427ac2
mov edx, eax
add esp, 0xc
test edx, edx
jle 0x40579c
xor ecx, ecx
test edx, edx
jle 0x405791
jmp 0x405770
mov al, byte [ecx + esi]
cmp al, 0xa
je 0x40578f
cmp al, 7
je 0x40578f
cmp al, 0xd
je 0x40578f
inc ecx
cmp ecx, edx
jl 0x405770
mov eax, dword [ebp - 0x18]
mov bl, 1
mov byte [edx + esi], 0
jmp 0x4057a1
mov edx, ecx
mov eax, dword [ebp - 0x18]
mov bl, 1
mov byte [edx + esi], 0
jmp 0x4057a1
mov eax, dword [ebp - 0x18]
xor bl, bl
cmp eax, 0xffffffff
je 0x4057cf
cmp byte [ebp - 0x14], 0
push eax
je 0x4057c7
call dword [sym.imp.WS2_32.dll_closesocket]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0042794d
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405840
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x454288]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push 0
push 0x80
push 3
push 0
push 1
push connect
push edi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x405974
test eax, eax
je 0x405974
push 0
push eax
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0xc], eax
test eax, eax
jne 0x4058be
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00426c47
mov esp, ebp
pop ebp
ret 8
push 0
push 0
push 0
push 2
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 4], eax
test eax, eax
jne 0x40591f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
lea ecx, [ebp - 0x408]
call fcn.00405600
push eax
push str.mm_file_map___s__failed__x
push 0x2a
push str.....commonmm_file.cpp
push str.ERROR
call fcn.0040ae90
add esp, 0x18
mov ecx, esi
call fcn.00402aa0
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00426c47
mov esp, ebp
pop ebp
ret 8
push 0
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 8], eax
test eax, eax
jne 0x4058aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.map_file__x
push 0x33
push str.....commonmm_file.cpp
push str.ERROR
call fcn.0040ae90
add esp, 0x14
mov ecx, esi
call fcn.00402aa0
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00426c47
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
lea ecx, [ebp - 0x408]
call fcn.00405600
push eax
push str.mm_file_open___s__failed__x
push 0x17
push str.....commonmm_file.cpp
push str.ERROR
call fcn.0040ae90
mov ecx, dword [ebp - 4]
add esp, 0x18
xor ecx, ebp
xor al, al
pop edi
pop esi
call fcn.00426c47
mov esp, ebp
pop ebp
ret 8
Function at 0x408b40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x43efd4
push dword [eax]
lea eax, [ebp + 8]
mov esi, ecx
push eax
call fcn.0042989e
add esp, 0xc
test eax, eax
jne 0x408c1e
mov eax, dword [ebp + 8]
test eax, eax
je 0x408bfb
push eax
push 0x40
lea edi, [esi + 4]
push 1
push edi
call fcn.00429eec
push dword [ebp + 8]
mov dword [esi + 0x44], eax
call fcn.00429827
mov ebx, dword [esi + 0x44]
add esp, 0x14
mov eax, dword [ebp + 0xc]
mov dword [esi + 0xc8], 7
mov dword [esi], eax
test ebx, ebx
je 0x408bd8
push ebx
mov ecx, edi
call fcn.004097e0
add esp, 4
test al, al
je 0x408bd8
push 0x40
push 0
push edi
mov byte [esi + 0xcc], 1
call fcn.00430ad0
add esp, 0xc
mov dword [esi + 0x44], 0
mov al, 1
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
cmp ebx, 0x40
jbe 0x408bce
push 0x40
push 0
push edi
call fcn.00430ad0
add esp, 0xc
mov dword [esi + 0x44], 0
xor al, al
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
call fcn.00426c8a
push dword [eax]
push str.INTERNAL_ERROR___d_._Please__contact_WTware_tech_support.
push 0x1f2
push str.....commonoptionsDHCP.cpp
push str.ERROR
call fcn.0040ae90
add esp, 0x14
pop edi
pop esi
xor al, al
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x408c70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x454288]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x48]
push edi
push 0x40
push 0
push eax
mov edi, ecx
call fcn.00430ad0
add esp, 0xc
lea eax, [ebp - 0x4c]
push 0x43efd4
push dword [esi]
push eax
call fcn.0042989e
add esp, 0xc
test eax, eax
jne 0x408d76
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x408d53
push eax
push 0x40
lea eax, [ebp - 0x48]
push 1
push eax
call fcn.00429eec
push dword [ebp - 0x4c]
mov esi, eax
call fcn.00429827
mov ecx, dword [ebp + 0xc]
add esp, 0x14
mov dword [edi], ecx
test esi, esi
je 0x408d23
push esi
lea ecx, [ebp - 0x48]
call fcn.004097e0
add esp, 4
test al, al
je 0x408d23
push 0x40
lea eax, [edi + 4]
mov byte [edi + 0xcc], 1
push 0
push eax
call fcn.00430ad0
add esp, 0xc
mov dword [edi + 0x44], 0
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00426c47
mov esp, ebp
pop ebp
ret 8
push 0
lea edx, [ebp - 0x50]
lea ecx, [ebp - 0x48]
call fcn.00409ac0
mov ecx, dword [ebp - 0x50]
or edx, 0xffffffff
add esp, 4
cmp eax, 2
cmovne ecx, edx
mov eax, ecx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00426c47
mov esp, ebp
pop ebp
ret 8
call fcn.00426c8a
push dword [eax]
push str.INTERNAL_ERROR___d_._Please__contact_WTware_tech_support.
push 0x228
push str.....commonoptionsDHCP.cpp
push str.ERROR
call fcn.0040ae90
add esp, 0x14
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
xor ecx, ebp
pop esi
call fcn.00426c47
mov esp, ebp
pop ebp
ret 8
Function at 0x40a7c0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a8
mov eax, dword [0x454288]
xor eax, esp
mov dword [esp + 0x1a4], eax
lea eax, [esp + 0x10]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
lea eax, [esp]
mov dword [esp], str.WTware_DHCP
push eax
mov dword [esp + 8], 0x40a750
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
test eax, eax
jne 0x40a82b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR:_StartServiceCtrlDispatcher____failed:__d
call fcn.0040adf0
add esp, 8
mov ecx, dword [esp + 0x1a4]
xor eax, eax
xor ecx, esp
call fcn.00426c47
mov esp, ebp
pop ebp
ret
Function at 0x40ab80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4380ab
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1050
call fcn.0042cfa0
mov eax, dword [0x454288]
xor eax, esp
mov dword [esp + 0x104c], eax
push esi
push edi
mov eax, dword [0x454288]
xor eax, esp
push eax
lea eax, [esp + 0x1060]
mov dword fs:[0], eax
mov edi, ecx
xor eax, eax
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], 0
mov word [esp + 0x14], ax
mov dword [esp + 0x1068], eax
cmp byte [0x456db0], al
je 0x40ac55
push str.wtdhcp.log
mov edx, 0x456ebc
lea ecx, [esp + 0x40]
call fcn.00403190
mov esi, eax
add esp, 4
lea eax, [esp + 0x14]
cmp eax, esi
je 0x40ac40
cmp dword [esp + 0x28], 8
jb 0x40ac1f
push dword [esp + 0x14]
call fcn.00426e53
add esp, 4
xor eax, eax
mov dword [esp + 0x28], 7
push esi
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], 0
mov word [esp + 0x18], ax
call fcn.00403090
cmp dword [esp + 0x50], 8
jb 0x40ac65
push dword [esp + 0x3c]
call fcn.00426e53
add esp, 4
jmp 0x40ac65
push 0xa
push str.wtdhcp.log
lea ecx, [esp + 0x1c]
call fcn.00404510
cmp dword [esp + 0x28], 8
lea eax, [esp + 0x14]
push 0
cmovae eax, dword [esp + 0x18]
push 0x80
push 4
push 0
push 1
push 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40ad26
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [esp + 0x38]
movzx eax, word [esp + 0x36]
push edi
push ecx
push eax
movzx eax, word [esp + 0x40]
push eax
movzx eax, word [esp + 0x3c]
push eax
movzx eax, word [esp + 0x42]
push eax
movzx eax, word [esp + 0x4a]
push eax
lea eax, [esp + 0x70]
push str.__02d._02d._d__02d:_02d:_02d___s_n
push eax
call fcn.0040b2b0
add esp, 0x24
xor eax, eax
cmp byte [esp + eax + 0x54], 0
je 0x40ad0b
cmp byte [esp + eax + 0x55], 0
je 0x40ad0a
cmp byte [esp + eax + 0x56], 0
je 0x40ad05
cmp byte [esp + eax + 0x57], 0
je 0x40ad00
add eax, 4
cmp eax, 0x1000
jb 0x40acd8
jmp 0x40ad0b
add eax, 3
jmp 0x40ad0b
add eax, 2
jmp 0x40ad0b
inc eax
push 0
lea ecx, [esp + 0x14]
push ecx
push eax
lea eax, [esp + 0x60]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x28], 8
jb 0x40ad39
push dword [esp + 0x14]
call fcn.00426e53
add esp, 4
mov ecx, dword [esp + 0x1060]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x104c]
xor ecx, esp
call fcn.00426c47
mov esp, ebp
pop ebp
ret
Function at 0x40b200
Capabilities:
Create mailslot
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push 1
lea eax, [ebp - 0x20]
mov dword [0x456da4], edx
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea eax, [ebp - 0x20]
mov dword [ebp - 0xc], 0xc
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0xffffffffffffffff
push 0x80
push str..mailslotWTDHCPLogging
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateMailslotA]
mov dword [0x455360], eax
cmp eax, 0xffffffff
jne 0x40b274
push str..mailslotWTDHCPLogging
push str.ERROR:_failed_to_create_mailslot___s_.
call fcn.0040adf0
add esp, 8
xor al, al
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0x40b130
call fcn.00429f98
add esp, 0xc
test eax, eax
jne 0x40b29c
push str.ERROR:__beginthread____failed.
call fcn.0040adf0
add esp, 4
xor al, al
mov esp, ebp
pop ebp
ret
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x40d0d0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4381f8
mov eax, dword fs:[0]
push eax
sub esp, 0x84
mov eax, dword [0x454288]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea edi, [ecx + 8]
mov ecx, edi
mov dword [ebp - 0x90], 0
call fcn.00402bd0
test al, al
je 0x40d1e8
lea eax, [ebp - 0x8c]
mov ecx, edi
push eax
call fcn.0040d940
push eax
mov edx, 0x456eec
lea ecx, [ebp - 0x2c]
call fcn.00403190
add esp, 4
mov dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
push 0
cmovae eax, dword [ebp - 0x2c]
push eax
call fcn.004274f5
add esp, 8
cmp eax, 0xffffffff
jne 0x40d194
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call fcn.00429cf6
add esp, 4
test eax, eax
jne 0x40d1b2
push str.WTware_DHCP
push ecx
lea eax, [ebp - 0x4c]
mov ecx, edi
push eax
call fcn.00402b50
push eax
push str.__s__Created._Source:__s.
call fcn.0040d700
add esp, 0xc
lea eax, [ebp - 0x2c]
mov ecx, esi
push eax
call fcn.004030f0
cmp dword [ebp - 0x18], 8
jb 0x40d214
push dword [ebp - 0x2c]
call fcn.00426e53
add esp, 4
jmp 0x40d214
call fcn.00426c8a
push dword [eax]
push str.INTERNAL_ERROR___d_._Please__contact_WTware_tech_support.
push 0x42
push str.e:workcommon_terminalID.h
push str.ERROR
call fcn.0040ae90
add esp, 0x14
mov ecx, esi
push 0x43e9a8
call fcn.00405330
lea ecx, [ebp - 0x2c]
call fcn.00403160
jmp 0x40d214
call fcn.00426c8a
push dword [eax]
push str.INTERNAL_ERROR___d_._Please__contact_WTware_tech_support.
push 0x3e
push str.e:workcommon_terminalID.h
push str.ERROR
call fcn.0040ae90
add esp, 0x14
mov ecx, esi
push 0x43e9a8
call fcn.00405330
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00426c47
mov esp, ebp
pop ebp
ret 4
Function at 0x40d5e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x437d28
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x454288]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
push 0
push edi
call fcn.004274f5
add esp, 8
cmp eax, 0xffffffff
jne 0x40d630
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0xffffffff
mov byte [ebp - 0x14], 0
mov dword [ebp - 0x10], eax
sub esp, 8
mov dword [ebp - 4], 0
mov ecx, eax
push edi
call fcn.00404890
test al, al
je 0x40d6ac
mov eax, dword [ebp - 0x18]
cmp eax, 0xffffffff
je 0x40d6af
mov eax, dword [ebp - 0x10]
push 0xf
push esi
push dword [eax]
call fcn.00427ac2
mov edx, eax
add esp, 0xc
test edx, edx
jle 0x40d6ac
xor ecx, ecx
test edx, edx
jle 0x40d6a1
jmp 0x40d680
mov al, byte [ecx + esi]
cmp al, 0xa
je 0x40d69f
cmp al, 7
je 0x40d69f
cmp al, 0xd
je 0x40d69f
inc ecx
cmp ecx, edx
jl 0x40d680
mov eax, dword [ebp - 0x18]
mov bl, 1
mov byte [edx + esi], 0
jmp 0x40d6b1
mov edx, ecx
mov eax, dword [ebp - 0x18]
mov bl, 1
mov byte [edx + esi], 0
jmp 0x40d6b1
mov eax, dword [ebp - 0x18]
xor bl, bl
cmp eax, 0xffffffff
je 0x40d6df
cmp byte [ebp - 0x14], 0
push eax
je 0x40d6d7
call dword [sym.imp.WS2_32.dll_closesocket]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0042794d
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40d700
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x43826b
mov eax, dword fs:[0]
push eax
sub esp, 0x438
mov eax, dword [0x454288]
xor eax, esp
mov dword [esp + 0x430], eax
push edi
mov eax, dword [0x454288]
xor eax, esp
push eax
lea eax, [esp + 0x440]
mov dword fs:[0], eax
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [esp + 0x18]
push eax
movzx eax, word [esp + 0x1a]
push eax
movzx eax, word [esp + 0x1c]
push eax
movzx eax, word [esp + 0x18]
push eax
movzx eax, word [esp + 0x1e]
push eax
movzx eax, word [esp + 0x26]
push eax
lea eax, [esp + 0x4c]
push str.__02d._02d._d__02d:_02d:_02d_
push eax
call fcn.00405820
lea ecx, [esp + 0x54]
add esp, 0x20
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40d786
lea eax, [ebp + 0xc]
sub ecx, edx
push eax
push dword [ebp + 8]
mov eax, 0x400
sub eax, ecx
push eax
lea eax, [esp + 0x40]
add eax, ecx
push eax
call fcn.00428dfa
push str.wtc_terminal.log
mov edx, 0x456ebc
lea ecx, [esp + 0x30]
call fcn.00403190
add esp, 0x14
push 0
push 0x80
push 4
push 0
mov dword [esp + 0x458], 0
lea eax, [esp + 0x2c]
cmp dword [esp + 0x40], 8
push 1
cmovae eax, dword [esp + 0x30]
push 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x40d85e
xor ecx, ecx
cmp byte [esp + ecx + 0x34], 0
je 0x40d82c
cmp byte [esp + ecx + 0x35], 0
je 0x40d82b
cmp byte [esp + ecx + 0x36], 0
je 0x40d826
cmp byte [esp + ecx + 0x37], 0
je 0x40d821
add ecx, 4
cmp ecx, 0x400
jb 0x40d7f8
jmp 0x40d82c
add ecx, 3
jmp 0x40d82c
add ecx, 2
jmp 0x40d82c
inc ecx
push 0
lea eax, [esp + 0xc]
push eax
push ecx
lea eax, [esp + 0x40]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [esp + 0xc]
push eax
push 1
push 0x44ee6c
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40d87e
call fcn.00426c8a
push dword [eax]
push str.INTERNAL_ERROR___d_._Please__contact_WTware_tech_support.
push 0x61
push str.e:workwtdhcp.._common_fileio.h
push str.ERROR
call fcn.0040ae90
add esp, 0x14
cmp dword [esp + 0x30], 8
jb 0x40d891
push dword [esp + 0x1c]
call fcn.00426e53
add esp, 4
mov ecx, dword [esp + 0x440]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x430]
xor ecx, esp
call fcn.00426c47
mov esp, ebp
pop ebp
ret
Function at 0x40e810
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x437d28
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x454288]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
push 0
push edi
call fcn.004274f5
add esp, 8
cmp eax, 0xffffffff
jne 0x40e860
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0xffffffff
mov byte [ebp - 0x14], 0
mov dword [ebp - 0x10], eax
sub esp, 8
mov dword [ebp - 4], 0
mov ecx, eax
push edi
call fcn.00404890
test al, al
je 0x40e8dc
mov eax, dword [ebp - 0x18]
cmp eax, 0xffffffff
je 0x40e8df
mov eax, dword [ebp - 0x10]
push 0x1f
push esi
push dword [eax]
call fcn.00427ac2
mov edx, eax
add esp, 0xc
test edx, edx
jle 0x40e8dc
xor ecx, ecx
test edx, edx
jle 0x40e8d1
jmp 0x40e8b0
mov al, byte [ecx + esi]
cmp al, 0xa
je 0x40e8cf
cmp al, 7
je 0x40e8cf
cmp al, 0xd
je 0x40e8cf
inc ecx
cmp ecx, edx
jl 0x40e8b0
mov eax, dword [ebp - 0x18]
mov bl, 1
mov byte [edx + esi], 0
jmp 0x40e8e1
mov edx, ecx
mov eax, dword [ebp - 0x18]
mov bl, 1
mov byte [edx + esi], 0
jmp 0x40e8e1
mov eax, dword [ebp - 0x18]
xor bl, bl
cmp eax, 0xffffffff
je 0x40e90f
cmp byte [ebp - 0x14], 0
push eax
je 0x40e907
call dword [sym.imp.WS2_32.dll_closesocket]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0042794d
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40ecb0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, 0x1158
call fcn.0042cfa0
mov eax, dword [0x454288]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x1138]
mov dword [ebp - 0x1138], 0
push eax
call fcn.0040f2d0
lea eax, [ebp - 0x114c]
mov dword [ebp - 0x114c], 5
push eax
push 0
push 0
lea eax, [ebp - 0x1138]
mov dword [ebp - 0x1148], 0
push eax
push 0
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
jne 0x40ed67
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 0xffffffffffffffff
push str.select____failed__return__d__errno__d.
push 0x24
push str...ip.cpp
push str.ERROR
call fcn.0040ae90
add esp, 0x18
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00426c47
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
test eax, eax
je 0x40eeeb
push str.select___worked__trying_to_get_data_by_recvfrom__...
call fcn.0040ae40
mov eax, dword [0x455ddc]
add esp, 4
sub eax, dword [0x455dd8]
xor esi, esi
sar eax, 3
test eax, eax
je 0x40eeeb
jmp 0x40eda0
mov eax, dword [0x455ddc]
mov ecx, dword [0x455dd8]
sub eax, ecx
sar eax, 3
cmp esi, eax
jae 0x40edb9
lea edi, [ecx + esi*8]
jmp 0x40edde
call fcn.00426c8a
push dword [eax]
push str.INTERNAL_ERROR___d_._Please__contact_WTware_tech_support.
push 0x7c
push str.e:workcommon_filterSockets.h
push str.ERROR
call fcn.0040ae90
add esp, 0x14
mov edi, 0x4553e8
mov eax, dword [edi + 4]
cmp eax, 0xffffffff
je 0x40eed4
lea ecx, [ebp - 0x1138]
push ecx
push eax
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
setne al
test al, al
je 0x40eed4
push 0x1000
lea eax, [ebp - 0x1008]
xorps xmm0, xmm0
push 0
push eax
movdqa xmmword [ebp - 0x1020], xmm0
call fcn.00430ad0
add esp, 0xc
mov dword [ebp - 0x113c], 0x10
lea eax, [ebp - 0x113c]
push eax
lea eax, [ebp - 0x1020]
push eax
push 0
push 0x1000
lea eax, [ebp - 0x1008]
push eax
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_recvfrom]
mov dword [ebp - 0x1144], eax
cmp eax, 0x22
jl 0x40ee7a
mov edx, dword [ebp - 0x101c]
mov ecx, edi
push eax
lea eax, [ebp - 0x1008]
push eax
call fcn.00425f30
add esp, 8
jmp 0x40eed4
cmp eax, 0xffffffff
jne 0x40eea2
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push eax
push str.recvfrom____failed__error_0x_08x___d_.
push 0x49
push str...ip.cpp
push str.ERROR
call fcn.0040ae90
add esp, 0x18
jmp 0x40eed4
mov eax, dword [ebp - 0x101c]
lea ecx, [ebp - 0x1030]
mov dword [ebp - 0x1140], eax
lea eax, [ebp - 0x1140]
push eax
call fcn.00401350
push eax
push dword [ebp - 0x1144]
push str.Ignore__d_bytes_from__s.
call fcn.0040adf0
add esp, 0xc
mov eax, dword [0x455ddc]
inc esi
sub eax, dword [0x455dd8]
sar eax, 3
cmp esi, eax
jb 0x40eda0
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.00426c47
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret