joyce8/EMBER2024-capa huggingface dataset:
Function at 0x61f500
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x73bb00]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00626220
add esp, 8
lea eax, [ebp - 0x1c]
cmp dword [ebp - 8], 7
cmova eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 8]
neg eax
sbb esi, esi
cmp ecx, 7
jbe 0x61f56d
mov edx, dword [ebp - 0x1c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x61f563
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x61f57f
push ecx
push edx
call fcn.00632721
add esp, 8
mov ecx, dword [ebp - 4]
lea eax, [esi + 1]
xor ecx, ebp
pop esi
call fcn.0063292f
mov esp, ebp
pop ebp
ret
call fcn.0063f01f
int3

Function at 0x61f590
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x73bb00]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00626220
add esp, 8
lea eax, [ebp - 0x1c]
cmp dword [ebp - 8], 7
cmova eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [ebp - 8]
neg eax
sbb esi, esi
neg esi
cmp ecx, 7
jbe 0x61f5ff
mov edx, dword [ebp - 0x1c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x61f5f5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x61f611
push ecx
push edx
call fcn.00632721
add esp, 8
mov ecx, dword [ebp - 4]
lea eax, [esi - 1]
xor ecx, ebp
pop esi
call fcn.0063292f
mov esp, ebp
pop ebp
ret
call fcn.0063f01f
int3
Function at 0x61f620
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x677d5d
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x73bb00]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00626220
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push esi
push eax
call fcn.00626220
add esp, 0x10
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x14], 7
lea eax, [ebp - 0x40]
cmova ecx, dword [ebp - 0x28]
cmp dword [ebp - 0x2c], 7
push 3
cmova eax, dword [ebp - 0x40]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [ebp - 0x14]
neg eax
sbb esi, esi
cmp ecx, 7
jbe 0x61f6c7
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x61f6bd
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x61f72e
push ecx
push edx
call fcn.00632721
add esp, 8
mov ecx, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp ecx, 7
jbe 0x61f711
mov edx, dword [ebp - 0x40]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x61f707
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x61f72e
push ecx
push edx
call fcn.00632721
add esp, 8
lea eax, [esi + 1]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0063292f
mov esp, ebp
pop ebp
ret
call fcn.0063f01f
int3

Function at 0x61ffc0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00620020
add esp, 8
mov esi, eax
test byte [ebp + 0xc], 8
je 0x620016
test esi, esi
je 0x620016
push esi
push 3
lea eax, [ebp - 4]
push 1
push eax
call fcn.0064c2b5
add esp, 0x10
cmp eax, 3
jne 0x620007
cmp byte [ebp - 4], 0xef
jne 0x620007
cmp byte [ebp - 3], 0xbb
jne 0x620007
cmp byte [ebp - 2], 0xbf
je 0x620014
push 0
push 0
push esi
call fcn.0064c658
add esp, 0xc
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x6201c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call fcn.0064c2b5
add esp, 0x10
pop ebp
ret
Function at 0x6201e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 2
push 0
push ebx
call fcn.0064c658
push ebx
call fcn.0064ccb7
push 0
push 0
push ebx
mov esi, eax
call fcn.0064c658
mov eax, 0x400
test esi, esi
cmovs esi, eax
lea edi, [esi + 1]
push edi
call fcn.00643185
push dword [ebp + 8]
mov ebx, eax
push edi
push 1
push ebx
call fcn.0064c2b5
add esp, 0x30
mov dword [ebp - 4], eax
cmp eax, esi
jae 0x620240
lea ecx, [eax + 1]
push ecx
push ebx
call fcn.0064ab8c
mov esi, dword [ebp - 4]
jmp 0x6202a0
jbe 0x6202a5
lea edi, [eax + eax]
mov esi, eax
push edi
push ebx
call fcn.0064ab8c
push dword [ebp + 8]
mov ebx, eax
mov eax, esi
push eax
push 1
lea ecx, [eax + ebx]
push ecx
call fcn.0064c2b5
add esp, 0x18
test eax, eax
je 0x620296
add esi, eax
cmp esi, edi
jne 0x62027c
add edi, edi
push edi
push ebx
call fcn.0064ab8c
add esp, 8
mov ebx, eax
push dword [ebp + 8]
mov eax, edi
sub eax, esi
push eax
lea eax, [ebx + esi]
push 1
push eax
call fcn.0064c2b5
add esp, 0x10
test eax, eax
jne 0x620268
lea eax, [esi + 1]
push eax
push ebx
call fcn.0064ab8c
mov ebx, eax
add esp, 8
mov eax, dword [ebp + 0xc]
mov byte [ebx + esi], 0
pop edi
mov dword [eax], ebx
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x6202c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 2
push 0
push ebx
call fcn.0064c658
push ebx
call fcn.0064ccb7
push 0
push 0
push ebx
mov esi, eax
call fcn.0064c658
mov eax, 0x400
test esi, esi
cmovs esi, eax
lea edi, [esi + 1]
push edi
call fcn.00643185
push dword [ebp + 8]
mov ebx, eax
push edi
push 1
push ebx
call fcn.0064c2b5
add esp, 0x30
mov dword [ebp - 4], eax
cmp eax, esi
jae 0x620320
lea ecx, [eax + 1]
push ecx
push ebx
call fcn.0064ab8c
mov esi, dword [ebp - 4]
jmp 0x620380
jbe 0x620385
lea edi, [eax + eax]
mov esi, eax
push edi
push ebx
call fcn.0064ab8c
push dword [ebp + 8]
mov ebx, eax
mov eax, esi
push eax
push 1
lea ecx, [eax + ebx]
push ecx
call fcn.0064c2b5
add esp, 0x18
test eax, eax
je 0x620376
add esi, eax
cmp esi, edi
jne 0x62035c
add edi, edi
push edi
push ebx
call fcn.0064ab8c
add esp, 8
mov ebx, eax
push dword [ebp + 8]
mov eax, edi
sub eax, esi
push eax
lea eax, [ebx + esi]
push 1
push eax
call fcn.0064c2b5
add esp, 0x10
test eax, eax
jne 0x620348
lea eax, [esi + 1]
push eax
push ebx
call fcn.0064ab8c
mov ebx, eax
add esp, 8
xor eax, eax
mov byte [ebx + esi], 0
test esi, esi
je 0x62039b
nop
cmp byte [eax + ebx], 0
je 0x6203a4
inc eax
cmp eax, esi
jb 0x620390
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
call fcn.0064316a
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x620e50
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x73bb00]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x10c], edi
cmp byte [esi], 0x5b
mov dword [ebp - 0x108], 0
mov byte [ebp - 0x104], bl
jne 0x620f47
lea eax, [ebx + 1]
lea ebx, [ebp - 0x104]
lea edi, [ebp - 0x103]
sub ebx, esi
lea ecx, [esi + 3]
sub edi, esi
mov dl, byte [ecx - 2]
test dl, dl
je 0x620f18
cmp dl, 0x5d
je 0x620f18
mov byte [ebp + eax - 0x105], dl
mov dl, byte [ecx - 1]
test dl, dl
je 0x620f17
cmp dl, 0x5d
je 0x620f17
mov byte [ebp + eax - 0x104], dl
mov dl, byte [ecx]
test dl, dl
je 0x620f12
cmp dl, 0x5d
je 0x620f12
mov byte [ebp + eax - 0x103], dl
mov dl, byte [ecx + 1]
test dl, dl
je 0x620f0d
cmp dl, 0x5d
je 0x620f0d
mov byte [ebx + ecx], dl
mov dl, byte [ecx + 2]
test dl, dl
je 0x620f08
cmp dl, 0x5d
je 0x620f08
mov byte [edi + ecx], dl
add eax, 5
add ecx, 5
cmp eax, 0x100
jl 0x620ea3
jmp 0x620f18
add eax, 4
jmp 0x620f18
add eax, 3
jmp 0x620f18
add eax, 2
jmp 0x620f18
inc eax
cmp byte [eax + esi], 0x5d
mov byte [ebp + eax - 0x105], 0
jne 0x62101d
cmp byte [eax + esi + 1], 0x3a
jne 0x620f8c
push 0xa
add eax, 2
add eax, esi
push 0
push eax
call fcn.0064fdcf
add esp, 0xc
mov ebx, eax
jmp 0x620f8e
xor eax, eax
nop dword [eax]
mov cl, byte [esi + eax]
test cl, cl
je 0x620f6b
cmp cl, 0x3a
je 0x620f6b
mov byte [ebp + eax - 0x104], cl
inc eax
cmp eax, 0xff
jl 0x620f50
cmp byte [eax + esi], 0x3a
mov byte [ebp + eax - 0x104], bl
jne 0x620f94
push 0xa
inc eax
add eax, esi
push 0
push eax
call fcn.0064fdcf
add esp, 0xc
mov ebx, eax
jmp 0x620f94
xor ebx, ebx
mov edi, dword [ebp - 0x10c]
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 0x104]
push esi
push ebx
push eax
push str.host_s_port_d__d
push str.host_lookup
call fcn.0061d2f0
xorps xmm0, xmm0
add esp, 0x14
movups xmmword [ebp - 0x12c], xmm0
movups xmmword [ebp - 0x11c], xmm0
cmp esi, 1
jne 0x620fd4
mov dword [ebp - 0x128], 2
jmp 0x620feb
mov eax, dword [ebp - 0x128]
cmp esi, 2
mov ecx, 0x17
cmove eax, ecx
mov dword [ebp - 0x128], eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x12c]
push eax
push 0
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov ecx, dword [ebp - 0x108]
test ecx, ecx
je 0x62101d
test eax, eax
je 0x621031
push ecx
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0063292f
mov esp, ebp
pop ebp
ret
push edi
push dword [ecx + 0x18]
call fcn.00623840
add esp, 8
mov word [edi + 0x14], bx
push dword [ebp - 0x108]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0063292f
mov esp, ebp
pop ebp
ret
Function at 0x621060
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x73bb00]
xor eax, ebp
mov dword [ebp - 4], eax
push str.network_initialization_failed.
lea eax, [ebp - 0x194]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
sete al
movzx eax, al
push eax
push 0x810
push str.D:_acactuscactus_src_base_system.cpp
call fcn.0061d170
mov ecx, dword [ebp - 4]
add esp, 0x10
xor ecx, ebp
call fcn.0063292f
mov esp, ebp
pop ebp
ret

Function at 0x6210c0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov cl, byte [ebp + 0xc]
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_ioctlsocket]
movzx eax, cl
xor eax, 1
mov dword [ebp - 0x10], str.ipv4
test cl, cl
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 8]
mov eax, str.non_blocking
push esi
push edi
mov edi, str.blocking
mov dword [ebp - 0xc], str.ipv6
cmove edi, eax
mov eax, dword [ecx + 4]
mov dword [ebp - 8], eax
xor esi, esi
mov eax, dword [ecx + 8]
mov dword [ebp - 4], eax
nop dword [eax]
mov eax, dword [ebp + esi - 8]
test eax, eax
js 0x621140
lea ecx, [ebp + 0xc]
push ecx
push 0x8004667e
push eax
call ebx
test eax, eax
je 0x621140
push eax
push edi
push dword [ebp + esi - 0x10]
push str.setting__s__s_failed:__d
push str.socket
call fcn.0061d2f0
add esp, 0x14
add esi, 4
cmp esi, 8
jb 0x621110
pop edi
pop esi
pop ebx
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x621160
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x73bb00]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push 0x3e8
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00632e60
mov ebx, eax
mov eax, 0x431bde83
imul ebx
sar edx, 0x12
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [edi + 4]
imul eax, ecx, 0xf4240
mov dword [ebp - 0x110], ecx
mov ecx, ebx
sub ecx, eax
mov dword [ebp - 0x10c], ecx
xor ecx, ecx
mov dword [ebp - 0x108], ecx
test edx, edx
js 0x6211d4
mov ecx, 1
mov dword [ebp - 0x104], edx
mov dword [ebp - 0x108], ecx
mov esi, dword [edi + 8]
xor eax, eax
test edx, edx
cmovs edx, eax
test esi, esi
js 0x62120f
test ecx, ecx
je 0x6211f4
cmp dword [ebp + eax*4 - 0x104], esi
je 0x6211f4
inc eax
cmp eax, ecx
jb 0x6211e6
cmp eax, ecx
jne 0x62120a
cmp ecx, 0x40
jae 0x62120a
mov dword [ebp + eax*4 - 0x104], esi
inc dword [ebp - 0x108]
cmp esi, edx
cmovg edx, esi
inc edx
test ebx, ebx
jns 0x621218
push 0
jmp 0x62121f
lea eax, [ebp - 0x110]
push eax
push 0
push 0
lea eax, [ebp - 0x108]
push eax
push edx
call dword [sym.imp.WS2_32.dll_select]
mov eax, dword [edi + 4]
test eax, eax
js 0x62125f
lea ecx, [ebp - 0x108]
push ecx
push eax
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x62125f
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0063292f
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 8]
test eax, eax
js 0x621277
lea ecx, [ebp - 0x108]
push ecx
push eax
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x621249
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0063292f
mov esp, ebp
pop ebp
ret
Function at 0x621310
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x73bb00]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x588
call fcn.00643185
movups xmm1, xmmword [ebp + 8]
mov ebx, eax
mov ecx, 0x162
movq xmm0, qword [ebp + 0x18]
mov esi, 0x73b378
mov edi, ebx
movd eax, xmm1
rep movsd dword es:[edi], dword [esi]
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
add esp, 4
or esi, 0xffffffff
movq qword [ebp - 0x34], xmm0
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x2c], eax
movups xmmword [ebp - 0x44], xmm1
test al, 1
je 0x621411
push dword [ebp - 0x30]
xorps xmm0, xmm0
mov eax, 2
movlpd qword [ebp - 0xc], xmm0
mov word [ebp - 0x14], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push 0x10
push eax
push 2
push 2
call fcn.00621f10
mov esi, eax
add esp, 0x10
test esi, esi
js 0x621411
or dword [ebx], 1
lea eax, [ebp - 0x24]
push 4
push eax
push 0x20
push 0xffff
push esi
mov dword [ebx + 4], esi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x6213e0
call edi
push eax
push str.Setting_BROADCAST_on_ipv4_failed:__d
push str.socket
call fcn.0061d2f0
add esp, 0xc
push 4
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0x10
push eax
push 3
push 0
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x621411
call edi
push eax
push str.Setting_TOS_on_ipv4_failed:__d
push str.socket
call fcn.0061d2f0
add esp, 0xc
test byte [ebp - 0x2c], 2
je 0x621492
lea eax, [ebp - 0x20]
mov dword [ebp - 0x44], 2
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.00621720
push 0x1c
lea eax, [ebp - 0x20]
push eax
push 2
push 0x17
call fcn.00621f10
add esp, 0x18
test eax, eax
js 0x621496
or dword [ebx], 2
lea ecx, [ebp - 0x24]
push 4
push ecx
push 0x20
push 0xffff
push eax
mov dword [ebx + 8], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x621474
call edi
push eax
push str.Setting_BROADCAST_on_ipv6_failed:__d
push str.socket
call fcn.0061d2f0
add esp, 0xc
push 0
push ebx
call fcn.006210c0
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0063292f
mov esp, ebp
pop ebp
ret
test esi, esi
jns 0x621474
push ebx
call fcn.0064316a
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
xor eax, eax
pop edi
pop esi
pop ebx
call fcn.0063292f
mov esp, ebp
pop ebp
ret
Function at 0x6214c0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x73bb00]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [sym.imp.WS2_32.dll_recvfrom]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x90], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x8c], eax
mov eax, dword [edi + 4]
lea ebx, [edi + 0x10]
test eax, eax
js 0x621533
lea edx, [ebp - 0x88]
mov dword [ebp - 0x88], 0x10
push edx
lea edx, [ebp - 0x84]
push edx
push esi
push 0x578
push ebx
push eax
call ecx
mov esi, eax
mov eax, dword [ebp - 0x8c]
mov dword [eax], ebx
test esi, esi
jg 0x62156b
mov ecx, dword [sym.imp.WS2_32.dll_recvfrom]
mov eax, dword [edi + 8]
test eax, eax
js 0x6215ae
lea edx, [ebp - 0x88]
mov dword [ebp - 0x88], 0x1c
push edx
lea edx, [ebp - 0x84]
push edx
push 0
push 0x578
push ebx
push eax
call ecx
mov esi, eax
mov eax, dword [ebp - 0x8c]
mov dword [eax], ebx
test esi, esi
jle 0x6215ae
push dword [ebp - 0x90]
lea eax, [ebp - 0x84]
push eax
call fcn.00623840
add esp, 8
mov eax, esi
add dword [0x786338], esi
adc dword [0x78633c], 0
add dword [0x786330], 1
pop edi
adc dword [0x786334], 0
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0063292f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
neg esi
pop edi
sbb esi, esi
xor ecx, ebp
mov eax, esi
pop esi
pop ebx
call fcn.0063292f
mov esp, ebp
pop ebp
ret
Function at 0x6215d0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x73bb00]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov edx, dword [sym.imp.WS2_32.dll_htons]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x24], eax
or edi, 0xffffffff
mov eax, dword [esi]
test al, 1
je 0x621669
cmp dword [ebx + 4], 0
jl 0x621651
test al, 4
je 0x621629
movzx eax, word [esi + 0x14]
xorps xmm0, xmm0
push eax
movlpd qword [ebp - 0xc], xmm0
call edx
mov word [ebp - 0x12], ax
mov eax, 2
mov word [ebp - 0x14], ax
mov dword [ebp - 0x10], edi
jmp 0x621636
lea eax, [ebp - 0x14]
push eax
push esi
call fcn.00621780
add esp, 8
push 0x10
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp + 0x14]
push dword [ebp - 0x24]
push dword [ebx + 4]
call dword [sym.imp.WS2_32.dll_sendto]
mov edi, eax
jmp 0x621663
push str.cant_send_ipv4_traffic_to_this_socket
push 0x6eba98
call fcn.0061d2f0
add esp, 8
mov edx, dword [sym.imp.WS2_32.dll_htons]
mov eax, dword [esi]
test al, 2
je 0x6216e6
cmp dword [ebx + 8], 0
jl 0x6216d4
test al, 4
je 0x6216ac
movzx eax, word [esi + 0x14]
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 8], 0
movq qword [ebp - 0x10], xmm0
call edx
mov word [ebp - 0x1e], ax
mov eax, 0x17
mov word [ebp - 0x20], ax
mov word [ebp - 0x18], 0x2ff
mov byte [ebp - 9], 1
jmp 0x6216b9
lea eax, [ebp - 0x20]
push eax
push esi
call fcn.00621720
add esp, 8
push 0x1c
lea eax, [ebp - 0x20]
push eax
push 0
push dword [ebp + 0x14]
push dword [ebp - 0x24]
push dword [ebx + 8]
call dword [sym.imp.WS2_32.dll_sendto]
mov edi, eax
jmp 0x6216e6
push str.cant_send_ipv6_traffic_to_this_socket
push 0x6eba98
call fcn.0061d2f0
add esp, 8
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 4]
cdq
add dword [0x786328], eax
mov eax, edi
pop edi
adc dword [0x78632c], edx
add dword [0x786320], 1
pop esi
adc dword [0x786324], 0
xor ecx, ebp
pop ebx
call fcn.0063292f
mov esp, ebp
pop ebp
ret
Function at 0x6217e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x460
mov eax, dword [0x73bb00]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x41c]
push edi
push eax
call fcn.00626220
add esp, 8
lea eax, [ebp - 0x41c]
cmp dword [ebp - 0x408], 7
cmova eax, dword [ebp - 0x41c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
mov ecx, dword [ebp - 0x408]
mov esi, eax
cmp ecx, 7
jbe 0x621865
mov edx, dword [ebp - 0x41c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x62185b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x621a56
push ecx
push edx
call fcn.00632721
add esp, 8
test esi, esi
je 0x621924
lea eax, [ebp - 0x204]
push 0x200
push eax
call fcn.0061e990
add esp, 8
test eax, eax
jne 0x621895
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0063292f
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x204]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x6218a0
sub eax, edx
cmp eax, 0x200
jge 0x6218d6
mov edx, 0x6af4ac
sub edx, eax
nop word [eax + eax]
mov cl, byte [edx + eax]
mov byte [ebp + eax - 0x204], cl
test cl, cl
je 0x6218d6
inc eax
cmp eax, 0x200
jl 0x6218c0
lea ecx, [ebp - 0x204]
mov byte [ebp - 5], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x6218e3
sub ecx, edx
test ecx, ecx
jle 0x62192b
dec ecx
lea esi, [ebp - 0x204]
add esi, ecx
mov al, byte [esi]
and al, 0xc0
cmp al, 0x80
jne 0x621905
test ecx, ecx
jne 0x6218f0
lea eax, [ebp - 0x420]
mov dword [ebp - 0x420], esi
push eax
call fcn.006250e0
add esp, 4
cmp eax, 0xffffffff
jne 0x62192b
mov byte [esi], 0
jmp 0x62192b
mov byte [ebp - 0x204], 0
push edi
lea eax, [ebp - 0x204]
push eax
push str.file:___s_s
lea eax, [ebp - 0x404]
push 0x200
push eax
call fcn.00623dd0
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x41c]
push eax
call fcn.00626220
cmp dword [ebp - 0x408], 7
lea eax, [ebp - 0x41c]
xorps xmm0, xmm0
mov dword [ebp - 0x458], 0
cmova eax, dword [ebp - 0x41c]
mov dword [ebp - 0x450], eax
lea eax, [ebp - 0x424]
push eax
movlpd qword [ebp - 0x44c], xmm0
movlpd qword [ebp - 0x440], xmm0
movlpd qword [ebp - 0x438], xmm0
movlpd qword [ebp - 0x430], xmm0
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x460], 0x3c
mov dword [ebp - 0x454], 0
mov dword [ebp - 0x444], 1
mov dword [ebp - 0x45c], 0x500
call fcn.00651190
add esp, 0x20
mov esi, eax
lea eax, [ebp - 0x460]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov edi, eax
test esi, esi
jne 0x621a08
lea eax, [ebp - 0x424]
push eax
call fcn.006511ad
add esp, 4
mov ecx, dword [ebp - 0x408]
cmp ecx, 7
jbe 0x621a44
mov edx, dword [ebp - 0x41c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x621a3a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x621a5b
push ecx
push edx
call fcn.00632721
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0063292f
mov esp, ebp
pop ebp
ret
call fcn.0063f01f
call fcn.0063f01f
int3
Function at 0x621a70
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x73bb00]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00626220
cmp dword [ebp - 8], 7
lea eax, [ebp - 0x1c]
xorps xmm0, xmm0
mov dword [ebp - 0x58], 0
cmova eax, dword [ebp - 0x1c]
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x24]
push eax
movlpd qword [ebp - 0x4c], xmm0
movlpd qword [ebp - 0x40], xmm0
movlpd qword [ebp - 0x38], xmm0
movlpd qword [ebp - 0x30], xmm0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x60], 0x3c
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x44], 1
mov dword [ebp - 0x5c], 0x500
call fcn.00651190
add esp, 0xc
mov esi, eax
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov edi, eax
test esi, esi
jne 0x621b08
lea eax, [ebp - 0x24]
push eax
call fcn.006511ad
add esp, 4
mov ecx, dword [ebp - 8]
cmp ecx, 7
jbe 0x621b3e
mov edx, dword [ebp - 0x1c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x621b34
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x621b50
push ecx
push edx
call fcn.00632721
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0063292f
mov esp, ebp
pop ebp
ret
call fcn.0063f01f
int3

Function at 0x621d70
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push edi
push eax
push str.kernel32.dll
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
jne 0x621d92
xor al, al
pop edi
mov esp, ebp
pop ebp
ret
push esi
push edi
call fcn.00643185
add esp, 4
mov esi, eax
push esi
push edi
push dword [ebp - 4]
push str.kernel32.dll
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x621e00
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0x6ebfac
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x621e00
mov ecx, dword [ebp - 8]
movzx eax, word [ecx + 0x14]
push eax
movzx eax, word [ecx + 0x16]
push eax
movzx eax, word [ecx + 0x10]
push eax
movzx eax, word [ecx + 0x12]
push eax
push str.Windows__hu._hu._hu._hu
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00623dd0
push esi
call fcn.0064316a
add esp, 0x20
mov al, 1
pop esi
pop edi
mov esp, ebp
pop ebp
ret
push esi
call fcn.0064316a
add esp, 4
xor al, al
pop esi
pop edi
mov esp, ebp
pop ebp
ret