joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431b60
Capabilities:
Check os version

Disassembly:
mov ecx, dword [0x5eda74]
cmp ecx, 0xffffffff
jne 0x431c57
push esi
xor esi, esi
cmp dword [0x5eda78], ecx
jne 0x431c56
cmp dword [0x5fdc90], esi
jne 0x431bac
push 0x5fdc90
mov dword [0x5fdc90], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call fcn.0053b370
add esp, 4
test eax, eax
je 0x431c5a
mov edx, dword [0x5fdc94]
mov eax, dword [0x5fdc98]
push edi
movzx edi, word [0x5fdda4]
cmp edx, 0xa
jg 0x431c23
jne 0x431bd1
test eax, eax
jns 0x431c23
mov esi, 6
jmp 0x431c28
cmp edx, 6
jg 0x431bca
jne 0x431c00
cmp eax, 3
jge 0x431bca
cmp eax, 2
jge 0x431bf9
cmp eax, 1
jge 0x431bf2
test eax, eax
js 0x431c1c
mov esi, 3
jmp 0x431c28
mov esi, 4
jmp 0x431c28
mov esi, 5
jmp 0x431c28
cmp edx, 5
jg 0x431c1c
jne 0x431c28
cmp eax, 2
jge 0x431c1c
cmp eax, 1
jge 0x431c1c
test eax, eax
js 0x431c28
mov esi, 1
jmp 0x431c28
mov esi, 2
jmp 0x431c28
mov esi, 7
mov dword [0x5eda7c], eax
mov ecx, esi
mov eax, dword [0x5fdc9c]
mov dword [0x5eda80], eax
mov eax, dword [0x5fdca0]
mov dword [0x5eda88], edi
mov dword [0x5eda74], ecx
mov dword [0x5eda78], edx
mov dword [0x5eda84], eax
pop edi
pop esi
mov eax, ecx
ret
push str.GetVersionEx_failed__m
push 0x55
call fcn.00420560
int3

Function at 0x431d70
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [0x5eda78]
push ebx
push esi
xor esi, esi
push edi
cmp ecx, 0xffffffff
je 0x431da9
mov edx, dword [0x5eda80]
mov esi, dword [0x5eda74]
mov eax, dword [0x5eda7c]
mov ebx, dword [0x5eda84]
mov edi, dword [0x5eda88]
mov dword [ebp - 4], edx
jmp 0x431e84
cmp dword [0x5fdc90], esi
jne 0x431dd7
push 0x5fdc90
mov dword [0x5fdc90], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call fcn.0053b370
add esp, 4
test eax, eax
je 0x431ec4
mov ecx, dword [0x5fdc94]
mov edx, dword [0x5fdc9c]
mov eax, dword [0x5fdc98]
mov ebx, dword [0x5fdca0]
movzx edi, word [0x5fdda4]
mov dword [ebp - 4], edx
cmp ecx, 0xa
jg 0x431e5c
jne 0x431e0a
test eax, eax
jns 0x431e5c
mov esi, 6
jmp 0x431e61
cmp ecx, 6
jg 0x431e03
jne 0x431e39
cmp eax, 3
jge 0x431e03
cmp eax, 2
jge 0x431e32
cmp eax, 1
jge 0x431e2b
test eax, eax
js 0x431e55
mov esi, 3
jmp 0x431e61
mov esi, 4
jmp 0x431e61
mov esi, 5
jmp 0x431e61
cmp ecx, 5
jg 0x431e55
jne 0x431e61
cmp eax, 2
jge 0x431e55
cmp eax, 1
jge 0x431e55
test eax, eax
js 0x431e61
mov esi, 1
jmp 0x431e61
mov esi, 2
jmp 0x431e61
mov esi, 7
mov dword [0x5eda74], esi
mov dword [0x5eda78], ecx
mov dword [0x5eda7c], eax
mov dword [0x5eda80], edx
mov dword [0x5eda84], ebx
mov dword [0x5eda88], edi
mov edx, dword [ebp + 8]
test edx, edx
je 0x431e8d
mov dword [edx], esi
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x431e96
mov dword [edx], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x431e9f
mov dword [ecx], eax
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x431eab
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x431eb4
mov dword [eax], ebx
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x431ebd
mov dword [eax], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.GetVersionEx_failed__m
push 0x55
call fcn.00420560
int3
Function at 0x431ee0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
push 0x432020
lea eax, [ebp - 0xc]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp + 4]
sub eax, 4
push eax
call fcn.00420780
mov edi, eax
mov dword [ebp - 8], 0
lea eax, [ebp - 4]
mov dword [ebp - 0xc], edi
push 0x104
push eax
or ebx, 0xffffffff
call fcn.00422230
add esp, 0x14
cmp dword [ebp + 0x10], 0
je 0x431f66
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
push eax
call sub.WTSAPI32.dll_WTSQueryUserToken
push eax
call fcn.0053b370
add esp, 4
test eax, eax
jne 0x431f66
push str.failed_get_token_for_active_user__m
push edi
call fcn.00421840
push dword [edi]
push 0x550003
call fcn.004241a0
add esp, 0x10
jmp 0x431ff7
push dword [ebp - 4]
mov ebx, dword [ebp + 0xc]
push 0
push dword [ebp - 8]
push ebx
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x431f9e
push ebx
push str.failed_get_path_for_cid__d
push edi
call fcn.004218d0
push dword [edi]
push 0x550003
call fcn.004241a0
add esp, 0x14
or ebx, 0xffffffff
jmp 0x431ff7
push esi
push dword [ebp - 4]
mov esi, dword [ebp + 8]
push esi
call fcn.004219a0
mov edx, dword [esi]
add esp, 8
test edx, edx
je 0x431fd8
cmp byte [edx], 0
je 0x431fd8
mov ecx, edx
lea esi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x431fc0
sub ecx, esi
cmp byte [edx + ecx - 1], 0x5c
jne 0x431fd4
mov byte [edx + ecx - 1], al
xor ebx, ebx
jmp 0x431ff6
push ebx
push str.got_empty_path_for__d
push edi
call fcn.004218d0
push dword [edi]
push 0x550003
call fcn.004241a0
add esp, 0x14
or ebx, 0xffffffff
pop esi
cmp dword [ebp + 0x10], 0
je 0x432009
lea eax, [ebp - 8]
push eax
call fcn.00443830
add esp, 4
lea eax, [ebp - 4]
push eax
call fcn.004221a0
add esp, 4
mov eax, ebx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x433450
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x3d
push edi
call fcn.0053f150
mov ecx, dword [ebp + 0xc]
add ecx, edi
test eax, eax
mov dword [ebp + 0xc], ecx
cmove eax, ecx
sub eax, 3
mov si, word [eax]
mov bl, byte [eax + 2]
sub eax, edi
push eax
lea eax, [edi + 3]
push edi
push eax
call fcn.0053f960
mov eax, dword [ebp + 0x14]
add esp, 0x14
mov ecx, dword [ebp + 0x10]
add eax, ecx
mov word [edi], si
mov byte [edi + 2], bl
mov ebx, ecx
cmp byte [edi], 0
mov dword [ebp - 4], eax
je 0x433567
lea eax, [ecx + 3]
mov dword [ebp + 8], eax
nop word [eax + eax]
cmp edi, dword [ebp + 0xc]
jae 0x433564
mov al, byte [edi]
cmp al, 0x3d
je 0x4334cf
movzx eax, al
cmp byte [eax + 0x5edad8], 0xff
je 0x433564
mov edx, edi
xor esi, esi
xor eax, eax
lea ecx, [edx + 1]
mov dword [ebp + 0x14], ecx
nop dword [eax + eax]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x4334e0
sub edx, dword [ebp + 0x14]
cmp edx, 4
jb 0x433575
xor edx, edx
mov cl, byte [edx + edi]
shl eax, 6
cmp cl, 0x3d
jne 0x433503
inc esi
jmp 0x433513
test esi, esi
jne 0x433575
movzx ecx, cl
movsx ecx, byte [ecx + 0x5edad8]
add eax, ecx
inc edx
cmp edx, 4
jl 0x4334f5
cmp esi, 2
ja 0x433575
cmp eax, 0xffffffff
je 0x433575
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
add ecx, esi
cmp edx, ecx
ja 0x433575
mov ecx, eax
inc edx
shr ecx, 0x10
mov byte [ebx], cl
inc ebx
mov dword [ebp + 8], edx
cmp esi, 2
jae 0x43354c
mov ecx, eax
shr ecx, 8
mov byte [ebx], cl
inc ebx
inc edx
mov dword [ebp + 8], edx
cmp esi, 1
jae 0x433558
mov byte [ebx], al
inc ebx
inc edx
mov dword [ebp + 8], edx
add edi, 4
cmp byte [edi], 0
jne 0x4334b0
mov ecx, dword [ebp + 0x10]
mov byte [ebx], 0
sub ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x433580
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x433591
mov ebx, dword [ebp + 8]
sub esi, ecx
mov eax, esi
cdq
and edx, 3
add eax, edx
sar eax, 2
lea eax, [eax + eax*2]
push eax
push ebx
mov dword [ebp + 0xc], eax
call fcn.004219f0
mov eax, dword [ebx]
push 0x3d
push edi
mov dword [ebp - 4], eax
call fcn.0053f150
add esp, 0x10
test eax, eax
jne 0x4335d1
lea eax, [esi + edi]
mov dword [ebp - 8], eax
jmp 0x4335d7
lea ecx, [esi + edi]
mov dword [ebp - 8], ecx
mov si, word [eax - 3]
sub eax, 3
mov bl, byte [eax + 2]
sub eax, edi
push eax
lea eax, [edi + 3]
push edi
push eax
call fcn.0053f960
mov eax, dword [ebp + 0xc]
add esp, 0xc
mov ecx, dword [ebp - 4]
add eax, ecx
mov word [edi], si
mov byte [edi + 2], bl
mov ebx, ecx
cmp byte [edi], 0
mov dword [ebp - 0x10], eax
je 0x4336c3
lea eax, [ecx + 3]
mov dword [ebp + 0xc], eax
cmp edi, dword [ebp - 8]
jae 0x4336c0
mov al, byte [edi]
cmp al, 0x3d
je 0x433632
movzx eax, al
cmp byte [eax + 0x5edad8], 0xff
je 0x4336c0
mov edx, edi
xor esi, esi
xor eax, eax
lea ecx, [edx + 1]
mov dword [ebp - 0xc], ecx
nop
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x433640
sub edx, dword [ebp - 0xc]
cmp edx, 4
jb 0x4336cd
xor edx, edx
mov cl, byte [edx + edi]
shl eax, 6
cmp cl, 0x3d
jne 0x43365f
inc esi
jmp 0x43366f
test esi, esi
jne 0x4336cd
movzx ecx, cl
movsx ecx, byte [ecx + 0x5edad8]
add eax, ecx
inc edx
cmp edx, 4
jl 0x433651
cmp esi, 2
ja 0x4336cd
cmp eax, 0xffffffff
je 0x4336cd
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 0xc]
add ecx, esi
cmp edx, ecx
ja 0x4336cd
mov ecx, eax
inc edx
shr ecx, 0x10
mov byte [ebx], cl
inc ebx
mov dword [ebp + 0xc], edx
cmp esi, 2
jae 0x4336a8
mov ecx, eax
shr ecx, 8
mov byte [ebx], cl
inc ebx
inc edx
mov dword [ebp + 0xc], edx
cmp esi, 1
jae 0x4336b4
mov byte [ebx], al
inc ebx
inc edx
mov dword [ebp + 0xc], edx
add edi, 4
cmp byte [edi], 0
jne 0x433613
mov ecx, dword [ebp - 4]
mov byte [ebx], 0
sub ebx, ecx
cmp ebx, 0xffffffff
jne 0x4336ee
mov ebx, dword [ebp + 8]
mov ecx, dword [ebx]
test ecx, ecx
je 0x4336e5
push ecx
call fcn.005414d0
add esp, 4
mov dword [ebx], 0
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x433720
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
add edi, esi
cmp esi, edi
jae 0x433800
mov ecx, dword [ebp + 0x14]
mov edx, eax
add edx, 0xfffffffc
add ecx, edx
lea edx, [esi + 1]
mov dword [ebp - 4], ecx
lea ecx, [esi + 2]
mov dword [ebp + 0xc], ecx
mov dword [ebp + 8], edx
cmp edx, edi
jb 0x43375d
xor bh, bh
jmp 0x43375f
mov bh, byte [edx]
cmp ecx, edi
jb 0x433767
xor bl, bl
jmp 0x433769
mov bl, byte [ecx]
cmp eax, dword [ebp - 4]
jae 0x43381d
movzx ecx, byte [esi]
shr ecx, 2
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], cl
movsx edx, byte [esi]
inc esi
and edx, 3
movzx ecx, bh
shr ecx, 4
shl edx, 4
or edx, ecx
movzx ecx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 1], cl
lea ecx, [eax + 3]
mov dword [ebp - 8], ecx
mov byte [ecx], 0x3d
mov byte [eax + 2], 0x3d
mov byte [eax + 4], 0
cmp esi, edi
je 0x43380d
movsx edx, byte [esi]
inc esi
and edx, 0xf
movzx ecx, bl
shl edx, 2
shr ecx, 6
or edx, ecx
mov cl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov edx, dword [ebp - 8]
mov byte [eax + 2], cl
lea eax, [edx + 1]
cmp esi, edi
je 0x433800
movsx ecx, byte [esi]
inc esi
and ecx, 0x3f
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx], cl
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
add edx, 3
add ecx, 3
mov dword [ebp + 8], edx
mov dword [ebp + 0xc], ecx
cmp esi, edi
jb 0x433755
pop edi
pop esi
mov byte [eax], 0
sub eax, dword [ebp + 0x10]
pop ebx
mov esp, ebp
pop ebp
ret
add eax, 4
pop edi
pop esi
pop ebx
mov byte [eax], 0
sub eax, dword [ebp + 0x10]
mov esp, ebp
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x434060
Capabilities:
Connect pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x439160
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 4]
sub eax, 4
push eax
call fcn.00420780
add esp, 0xc
mov dword [ebp - 4], eax
push dword [0x5fde54]
call fcn.0053b950
push eax
push str..pipehola__d__d
push dword [ebp - 4]
call fcn.004218d0
inc dword [0x5fde54]
mov ecx, 7
mov edi, dword [ebp + 0x10]
mov eax, 1
push 0
push 0xffffffffffffffff
push 0x1000
push 0x1000
test edi, edi
push 0xff
cmovne eax, ecx
push eax
mov eax, dword [ebp - 4]
push 0x40000003
push dword [eax]
call fcn.004438b0
mov ebx, eax
add esp, 0x30
test ebx, ebx
je 0x43418b
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
cmp dword [ebp + 0xc], 1
mov ecx, 0xc0000000
push 0
push 0x40000000
push 3
push 0
mov eax, 0x40000000
cmove eax, ecx
push 0
push eax
mov eax, dword [ebp - 4]
push dword [eax]
call fcn.00443860
mov esi, eax
add esp, 0x1c
test esi, esi
je 0x43419a
mov eax, edi
neg eax
push 0
sbb eax, eax
and eax, 2
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
push eax
call fcn.0053b370
add esp, 4
test eax, eax
je 0x4341a9
cmp dword [ebp + 0x10], 0
mov eax, 0x44
mov edi, 0x24
cmovne edi, eax
lea eax, [ebp + 0x10]
push eax
push edi
push 0
push 0
push esi
call fcn.00433870
mov esi, dword [ebp + 8]
mov dword [esi + 4], eax
lea eax, [ebp + 0x10]
push eax
push edi
push 0
push 0
push ebx
call fcn.00433870
add esp, 0x28
mov dword [esi], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.CreateNamedPipe_failed:__m
push 0x360000
call fcn.00424700
push str.CreateFile_failed:__m
push 0x360000
call fcn.00424700
push str.SetNamedPipeHandleState_failed:__m
push 0x360000
call fcn.00424700
int3
Function at 0x4341c0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x601894], 0
push ebx
mov ebx, dword fs:[0x2c]
push esi
push edi
mov edi, dword [ebp + 8]
je 0x434227
mov eax, dword [ebx]
cmp dword [eax + 0x21d0], 0
jne 0x434227
push 0x601860
call fcn.00429170
mov eax, dword [0x60188c]
push 0x601860
mov esi, dword [eax + edi*4]
call fcn.00429180
add esp, 8
test dword [esi + 0x58], 0x10000000
jne 0x434227
push 0
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.00434340
add esp, 0x18
pop edi
pop esi
pop ebx
pop ebp
ret
push 0x601860
call fcn.00429170
mov eax, dword [0x60188c]
push 0x601860
mov esi, dword [eax + edi*4]
call fcn.00429180
mov eax, dword [esi + 0x58]
add esp, 8
test al, 0x40
je 0x434322
cmp dword [esi + 0x3c], 0
je 0x434281
cmp dword [esi + 0xc], 2
jne 0x434281
cmp word [esi + 0x5c], 0
je 0x434281
push 0
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.0043a360
add esp, 0x18
mov esi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
test eax, reloc.WS2_32.dll_connect
je 0x4342a3
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.0043a160
add esp, 0x14
mov esi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
test al, 1
je 0x4342fc
push dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
push edi
push dword [ebp + 0xc]
push dword [esi + 0x60]
call dword [sym.imp.WS2_32.dll_recv]
push eax
call fcn.0053b370
mov esi, eax
add esp, 4
test esi, esi
jns 0x43431b
mov eax, dword [ebx]
mov eax, dword [eax + 0x28f0]
test eax, eax
jne 0x4342da
call fcn.005414b2
cmp dword [eax], 0x2738
jne 0x43431b
push edi
push str.buf_to_small___d__for_packet_recv
push 0x360003
call fcn.004241a0
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret
push eax
push str.invalid_type:__d
push 0x75c
push str.vsock_recv
push 0x360202
call fcn.00424510
add esp, 0x14
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
push str.recv_from_non_packet_socket
push 0x360000
call fcn.00424700
int3
Function at 0x436b00
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
push ebx
push esi
push edi
push 0x439160
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 4]
sub eax, 4
push eax
call fcn.00420780
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov edi, dword [ebp + 0xc]
xorps xmm0, xmm0
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov dword [ebp - 0x38], 0x57093c
mov dword [ebp - 0x34], 0x570944
mov dword [ebp - 0x30], str.except
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], 0
movq qword [ebp - 0x40], xmm0
test edi, edi
je 0x436c75
xor esi, esi
mov eax, edi
mov dword [ebp - 0xc], esi
xor ebx, ebx
cmp dword [eax], ebx
jbe 0x436c60
xor ecx, ecx
lea edx, [ebp - 0x144]
cmp eax, dword [ebp + 0x14]
cmovne edx, ecx
cmp eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x144]
mov dword [ebp - 0x18], edx
cmovne ecx, ebx
cmp eax, edi
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x144]
cmovne ecx, ebx
add eax, 4
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], eax
mov edi, dword [eax]
lea eax, [ebp - 0x40]
push eax
push edx
push dword [ebp - 0x10]
mov dword [ebp - 0x140], edi
push dword [ebp - 0x14]
mov dword [ebp - 0x144], 1
push 1
call dword [sym.imp.WS2_32.dll_select]
push eax
call fcn.0053b370
add esp, 4
test eax, eax
jns 0x436c44
push 0x601860
call fcn.00429170
mov ecx, dword [0x60187c]
add esp, 4
mov edx, dword [0x60188c]
xor esi, esi
test ecx, ecx
jle 0x436c13
mov eax, dword [edx + esi*4]
test eax, eax
je 0x436c13
cmp dword [eax + 0x60], edi
je 0x436c13
inc esi
cmp esi, ecx
jl 0x436c02
cmp esi, ecx
je 0x436c1d
cmp dword [edx + esi*4], 0
jne 0x436c20
or esi, 0xffffffff
push 0x601860
call fcn.00429180
push esi
mov esi, dword [ebp - 0xc]
push edi
push ebx
push dword [ebp + esi - 0x38]
push str._s__d__osfd_d_vfd_d_
push dword [ebp - 8]
call fcn.00421580
add esp, 0x1c
mov ecx, dword [ebp + esi - 0x28]
inc ebx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
add eax, 4
mov dword [ebp - 4], eax
cmp ebx, dword [ecx]
jb 0x436bb1
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + esi - 0x24]
add esi, 4
mov dword [ebp - 0xc], esi
test eax, eax
jne 0x436b73
mov eax, dword [ebp - 8]
push 0x57096c
push eax
call fcn.00421e30
mov eax, dword [ebp - 8]
add esp, 8
push dword [eax]
push str.vsock_select__:_a_member_of_fd_set_was_invalid:__s
push 0x360000
call fcn.00424700
int3
Function at 0x436d60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x2c]
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [eax]
mov eax, dword [edi + 0x28f0]
test eax, eax
jne 0x436d80
call fcn.005414b2
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0xe0]
lea ebx, [esi + 0xd4]
movups xmmword [eax], xmm0
mov dword [eax + 0x10], 0
mov eax, dword [esi + 0xe0]
mov dword [eax + 0x10], esi
lock inc dword [ebx]
push dword [esi + 0x6c]
or dword [esi + 0x58], 0x400
call fcn.00447f40
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push dword [esi + 0x6c]
call fcn.00447ea0
push esi
call fcn.0043b180
add esp, 0x18
push 0x435320
push dword [esi + 0xe0]
push dword [ebp - 4]
push dword [ebp - 8]
push dword [esi + 0x60]
call dword [sym.imp.KERNEL32.dll_ReadFileEx]
push eax
call fcn.0053b370
add esp, 4
mov dword [ebp + 8], eax
test eax, eax
jne 0x436ed9
mov eax, dword [edi + 0x28f0]
test eax, eax
jne 0x436e16
call fcn.005414b2
push 0x15
push 6
push 0xe8
push 1
push 4
push dword [eax]
call fcn.00433ae0
add esp, 0x18
test eax, eax
je 0x436efc
push 0x601860
call fcn.00429170
mov ecx, dword [esi + 0xbc]
add esp, 4
cmp esi, dword [0x601838]
jne 0x436e58
mov dword [0x601838], ecx
jmp 0x436e6a
mov eax, dword [esi + 0xc0]
mov dword [eax + 0xbc], ecx
mov ecx, dword [0x601838]
mov edx, dword [esi + 0xbc]
test edx, edx
je 0x436e82
mov eax, dword [esi + 0xc0]
mov dword [edx + 0xc0], eax
jmp 0x436e92
test ecx, ecx
je 0x436e92
mov eax, dword [esi + 0xc0]
mov dword [ecx + 0xc0], eax
push 0x601860
mov dword [esi + 0xbc], 0
mov dword [esi + 0xc0], 0
call fcn.00429180
or dword [esi + 0x58], 0x4100000
push esi
call fcn.0043b210
and dword [esi + 0x58], 0xfffffbff
add esp, 8
or eax, 0xffffffff
lock xadd dword [ebx], eax
jne 0x436ed9
push esi
call fcn.00434ac0
add esp, 4
mov eax, dword [edi + 0x28f0]
pop edi
pop esi
pop ebx
test eax, eax
jne 0x436eeb
call fcn.005414b2
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
xor eax, eax
cmp dword [ebp + 8], eax
sete al
mov esp, ebp
pop ebp
ret
push str.cant_read_from_handle:__m
push 0x360000
call fcn.00424700
int3
Function at 0x436f10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
push edi
mov eax, dword [esi + 0xe0]
lea ebx, [esi + 0xd4]
movups xmmword [eax], xmm0
mov dword [eax + 0x10], 0
mov eax, dword [esi + 0xe0]
mov dword [eax + 0x10], esi
lock inc dword [ebx]
or dword [esi + 0x58], 0x400
push esi
call fcn.0043b180
add esp, 4
lea eax, [esi + 0x100]
push 0x435320
push dword [esi + 0xe0]
push 1
push eax
push dword [esi + 0x60]
call dword [sym.imp.KERNEL32.dll_ReadFileEx]
mov edi, eax
push edi
call fcn.0053b370
add esp, 4
test eax, eax
jne 0x436faf
mov ecx, dword fs:[0x2c]
mov ecx, dword [ecx]
mov eax, dword [ecx + 0x28f0]
test eax, eax
jne 0x436f92
call fcn.005414b2
push 6
push 0x6d
push 0xe8
push 3
push dword [eax]
call fcn.00433ae0
add esp, 0x14
test eax, eax
je 0x437063
test edi, edi
jne 0x43705e
push 0x601860
call fcn.00429170
mov ecx, dword [esi + 0xbc]
add esp, 4
cmp esi, dword [0x601838]
jne 0x436fda
mov dword [0x601838], ecx
jmp 0x436fec
mov eax, dword [esi + 0xc0]
mov dword [eax + 0xbc], ecx
mov ecx, dword [0x601838]
mov edx, dword [esi + 0xbc]
test edx, edx
je 0x437004
mov eax, dword [esi + 0xc0]
mov dword [edx + 0xc0], eax
jmp 0x437014
test ecx, ecx
je 0x437014
mov eax, dword [esi + 0xc0]
mov dword [ecx + 0xc0], eax
push 0x601860
mov dword [esi + 0xbc], 0
mov dword [esi + 0xc0], 0
call fcn.00429180
and dword [esi + 0x58], 0xfffffbff
add esp, 4
or eax, 0xffffffff
lock xadd dword [ebx], eax
jne 0x43704e
push esi
call fcn.00434ac0
add esp, 4
or dword [esi + 0x58], 0x100000
push esi
call fcn.0043b210
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
ret
push str.cant_read_from_handle:__m
push 0x360000
call fcn.00424700
int3
Function at 0x437700
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
test dword [esi + 0x58], 0x2000
je 0x43771d
call sub.ntdll.dll_NtTestAlert
pop esi
mov esp, ebp
pop ebp
ret
push ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push dword [esi + 0x70]
call fcn.00448290
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x4378ab
mov eax, dword [esi + 0xe4]
xorps xmm0, xmm0
or dword [esi + 0x58], 0x2000
movups xmmword [eax], xmm0
mov dword [eax + 0x10], 0
mov eax, dword [esi + 0xe4]
mov dword [eax + 0x10], esi
lea eax, [esi + 0xd4]
lock inc dword [eax]
push esi
call fcn.0043b2f0
add esp, 4
push 0x435430
push dword [esi + 0xe4]
push dword [ebp - 4]
push dword [ebp - 8]
push dword [esi + 0x60]
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
push eax
call fcn.0053b370
mov ebx, dword fs:[0x2c]
add esp, 4
mov dword [ebp + 8], eax
test eax, eax
jne 0x437888
push edi
mov edi, dword [ebx]
mov eax, dword [edi + 0x28f0]
test eax, eax
jne 0x4377b7
call fcn.005414b2
cmp dword [eax], 0xe8
jne 0x4378c0
mov eax, dword [edi + 0x28f0]
pop edi
test eax, eax
jne 0x4377d3
call fcn.005414b2
cmp dword [eax], 0xe8
jne 0x437885
push 0x601860
call fcn.00429170
mov ecx, dword [esi + 0xb4]
add esp, 4
cmp esi, dword [0x60183c]
jne 0x437802
mov dword [0x60183c], ecx
jmp 0x437814
mov eax, dword [esi + 0xb8]
mov dword [eax + 0xb4], ecx
mov ecx, dword [0x60183c]
mov edx, dword [esi + 0xb4]
test edx, edx
je 0x43782c
mov eax, dword [esi + 0xb8]
mov dword [edx + 0xb8], eax
jmp 0x43783c
test ecx, ecx
je 0x43783c
mov eax, dword [esi + 0xb8]
mov dword [ecx + 0xb8], eax
push 0x601860
mov dword [esi + 0xb4], 0
mov dword [esi + 0xb8], 0
call fcn.00429180
mov eax, dword [esi + 0x58]
lea ecx, [esi + 0xd4]
and eax, 0xffffdfff
add esp, 4
or eax, 0x4000000
mov dword [esi + 0x58], eax
or eax, 0xffffffff
lock xadd dword [ecx], eax
jne 0x437885
push esi
call fcn.00434ac0
add esp, 4
mov eax, dword [ebp + 8]
cmp dword [ebp - 4], 0
je 0x4378ab
test eax, eax
jne 0x4378ba
mov eax, dword [ebx]
mov eax, dword [eax + 0x28f0]
test eax, eax
jne 0x4378a3
call fcn.005414b2
cmp dword [eax], 0xe8
jne 0x4378ba
mov eax, dword [esi + 0x58]
test al, 0x10
jne 0x4378ba
and eax, 0xffffdfff
mov dword [esi + 0x58], eax
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
push str.WriteFileEx_failed:__m
push 0x360000
call fcn.00424700
int3