joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431c10
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x3d
push edi
call fcn.0053d970
mov ecx, dword [ebp + 0xc]
add ecx, edi
test eax, eax
mov dword [ebp + 0xc], ecx
cmove eax, ecx
sub eax, 3
mov si, word [eax]
mov bl, byte [eax + 2]
sub eax, edi
push eax
lea eax, [edi + 3]
push edi
push eax
call fcn.0053e180
mov eax, dword [ebp + 0x14]
add esp, 0x14
mov ecx, dword [ebp + 0x10]
add eax, ecx
mov word [edi], si
mov byte [edi + 2], bl
mov ebx, ecx
cmp byte [edi], 0
mov dword [ebp - 4], eax
je 0x431d27
lea eax, [ecx + 3]
mov dword [ebp + 8], eax
nop word [eax + eax]
cmp edi, dword [ebp + 0xc]
jae 0x431d24
mov al, byte [edi]
cmp al, 0x3d
je 0x431c8f
movzx eax, al
cmp byte [eax + 0x5eaad8], 0xff
je 0x431d24
mov edx, edi
xor esi, esi
xor eax, eax
lea ecx, [edx + 1]
mov dword [ebp + 0x14], ecx
nop dword [eax + eax]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x431ca0
sub edx, dword [ebp + 0x14]
cmp edx, 4
jb 0x431d35
xor edx, edx
mov cl, byte [edx + edi]
shl eax, 6
cmp cl, 0x3d
jne 0x431cc3
inc esi
jmp 0x431cd3
test esi, esi
jne 0x431d35
movzx ecx, cl
movsx ecx, byte [ecx + 0x5eaad8]
add eax, ecx
inc edx
cmp edx, 4
jl 0x431cb5
cmp esi, 2
ja 0x431d35
cmp eax, 0xffffffff
je 0x431d35
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
add ecx, esi
cmp edx, ecx
ja 0x431d35
mov ecx, eax
inc edx
shr ecx, 0x10
mov byte [ebx], cl
inc ebx
mov dword [ebp + 8], edx
cmp esi, 2
jae 0x431d0c
mov ecx, eax
shr ecx, 8
mov byte [ebx], cl
inc ebx
inc edx
mov dword [ebp + 8], edx
cmp esi, 1
jae 0x431d18
mov byte [ebx], al
inc ebx
inc edx
mov dword [ebp + 8], edx
add edi, 4
cmp byte [edi], 0
jne 0x431c70
mov ecx, dword [ebp + 0x10]
mov byte [ebx], 0
sub ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x431d40
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x431d51
mov ebx, dword [ebp + 8]
sub esi, ecx
mov eax, esi
cdq
and edx, 3
add eax, edx
sar eax, 2
lea eax, [eax + eax*2]
push eax
push ebx
mov dword [ebp + 0xc], eax
call fcn.004205f0
mov eax, dword [ebx]
push 0x3d
push edi
mov dword [ebp - 4], eax
call fcn.0053d970
add esp, 0x10
test eax, eax
jne 0x431d91
lea eax, [esi + edi]
mov dword [ebp - 8], eax
jmp 0x431d97
lea ecx, [esi + edi]
mov dword [ebp - 8], ecx
mov si, word [eax - 3]
sub eax, 3
mov bl, byte [eax + 2]
sub eax, edi
push eax
lea eax, [edi + 3]
push edi
push eax
call fcn.0053e180
mov eax, dword [ebp + 0xc]
add esp, 0xc
mov ecx, dword [ebp - 4]
add eax, ecx
mov word [edi], si
mov byte [edi + 2], bl
mov ebx, ecx
cmp byte [edi], 0
mov dword [ebp - 0x10], eax
je 0x431e83
lea eax, [ecx + 3]
mov dword [ebp + 0xc], eax
cmp edi, dword [ebp - 8]
jae 0x431e80
mov al, byte [edi]
cmp al, 0x3d
je 0x431df2
movzx eax, al
cmp byte [eax + 0x5eaad8], 0xff
je 0x431e80
mov edx, edi
xor esi, esi
xor eax, eax
lea ecx, [edx + 1]
mov dword [ebp - 0xc], ecx
nop
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x431e00
sub edx, dword [ebp - 0xc]
cmp edx, 4
jb 0x431e8d
xor edx, edx
mov cl, byte [edx + edi]
shl eax, 6
cmp cl, 0x3d
jne 0x431e1f
inc esi
jmp 0x431e2f
test esi, esi
jne 0x431e8d
movzx ecx, cl
movsx ecx, byte [ecx + 0x5eaad8]
add eax, ecx
inc edx
cmp edx, 4
jl 0x431e11
cmp esi, 2
ja 0x431e8d
cmp eax, 0xffffffff
je 0x431e8d
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 0xc]
add ecx, esi
cmp edx, ecx
ja 0x431e8d
mov ecx, eax
inc edx
shr ecx, 0x10
mov byte [ebx], cl
inc ebx
mov dword [ebp + 0xc], edx
cmp esi, 2
jae 0x431e68
mov ecx, eax
shr ecx, 8
mov byte [ebx], cl
inc ebx
inc edx
mov dword [ebp + 0xc], edx
cmp esi, 1
jae 0x431e74
mov byte [ebx], al
inc ebx
inc edx
mov dword [ebp + 0xc], edx
add edi, 4
cmp byte [edi], 0
jne 0x431dd3
mov ecx, dword [ebp - 4]
mov byte [ebx], 0
sub ebx, ecx
cmp ebx, 0xffffffff
jne 0x431eae
mov ebx, dword [ebp + 8]
mov ecx, dword [ebx]
test ecx, ecx
je 0x431ea5
push ecx
call fcn.0053fcf0
add esp, 4
mov dword [ebx], 0
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x431ee0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
add edi, esi
cmp esi, edi
jae 0x431fc0
mov ecx, dword [ebp + 0x14]
mov edx, eax
add edx, 0xfffffffc
add ecx, edx
lea edx, [esi + 1]
mov dword [ebp - 4], ecx
lea ecx, [esi + 2]
mov dword [ebp + 0xc], ecx
mov dword [ebp + 8], edx
cmp edx, edi
jb 0x431f1d
xor bh, bh
jmp 0x431f1f
mov bh, byte [edx]
cmp ecx, edi
jb 0x431f27
xor bl, bl
jmp 0x431f29
mov bl, byte [ecx]
cmp eax, dword [ebp - 4]
jae 0x431fdd
movzx ecx, byte [esi]
shr ecx, 2
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], cl
movsx edx, byte [esi]
inc esi
and edx, 3
movzx ecx, bh
shr ecx, 4
shl edx, 4
or edx, ecx
movzx ecx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 1], cl
lea ecx, [eax + 3]
mov dword [ebp - 8], ecx
mov byte [ecx], 0x3d
mov byte [eax + 2], 0x3d
mov byte [eax + 4], 0
cmp esi, edi
je 0x431fcd
movsx edx, byte [esi]
inc esi
and edx, 0xf
movzx ecx, bl
shl edx, 2
shr ecx, 6
or edx, ecx
mov cl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov edx, dword [ebp - 8]
mov byte [eax + 2], cl
lea eax, [edx + 1]
cmp esi, edi
je 0x431fc0
movsx ecx, byte [esi]
inc esi
and ecx, 0x3f
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx], cl
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
add edx, 3
add ecx, 3
mov dword [ebp + 8], edx
mov dword [ebp + 0xc], ecx
cmp esi, edi
jb 0x431f15
pop edi
pop esi
mov byte [eax], 0
sub eax, dword [ebp + 0x10]
pop ebx
mov esp, ebp
pop ebp
ret
add eax, 4
pop edi
pop esi
pop ebx
mov byte [eax], 0
sub eax, dword [ebp + 0x10]
mov esp, ebp
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x432820
Capabilities:
Connect pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x437920
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 4]
sub eax, 4
push eax
call fcn.0041f380
add esp, 0xc
mov dword [ebp - 4], eax
push dword [0x5fadfc]
call fcn.0053a170
push eax
push str..pipehola__d__d
push dword [ebp - 4]
call fcn.004204d0
inc dword [0x5fadfc]
mov ecx, 7
mov edi, dword [ebp + 0x10]
mov eax, 1
push 0
push 0xffffffffffffffff
push 0x1000
push 0x1000
test edi, edi
push 0xff
cmovne eax, ecx
push eax
mov eax, dword [ebp - 4]
push 0x40000003
push dword [eax]
call fcn.00441650
mov ebx, eax
add esp, 0x30
test ebx, ebx
je 0x43294b
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
cmp dword [ebp + 0xc], 1
mov ecx, 0xc0000000
push 0
push 0x40000000
push 3
push 0
mov eax, 0x40000000
cmove eax, ecx
push 0
push eax
mov eax, dword [ebp - 4]
push dword [eax]
call fcn.00441600
mov esi, eax
add esp, 0x1c
test esi, esi
je 0x43295a
mov eax, edi
neg eax
push 0
sbb eax, eax
and eax, 2
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
push eax
call fcn.00539b90
add esp, 4
test eax, eax
je 0x432969
cmp dword [ebp + 0x10], 0
mov eax, 0x44
mov edi, 0x24
cmovne edi, eax
lea eax, [ebp + 0x10]
push eax
push edi
push 0
push 0
push esi
call fcn.00432030
mov esi, dword [ebp + 8]
mov dword [esi + 4], eax
lea eax, [ebp + 0x10]
push eax
push edi
push 0
push 0
push ebx
call fcn.00432030
add esp, 0x28
mov dword [esi], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.CreateNamedPipe_failed:__m
push 0x360000
call fcn.004232c0
push str.CreateFile_failed:__m
push 0x360000
call fcn.004232c0
push str.SetNamedPipeHandleState_failed:__m
push 0x360000
call fcn.004232c0
int3
Function at 0x432980
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x5fe854], 0
push ebx
mov ebx, dword fs:[0x2c]
push esi
push edi
mov edi, dword [ebp + 8]
je 0x4329e7
mov eax, dword [ebx]
cmp dword [eax + 0x21d0], 0
jne 0x4329e7
push 0x5fe820
call fcn.00427d70
mov eax, dword [0x5fe84c]
push 0x5fe820
mov esi, dword [eax + edi*4]
call fcn.00427d80
add esp, 8
test dword [esi + 0x58], 0x10000000
jne 0x4329e7
push 0
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.00432b00
add esp, 0x18
pop edi
pop esi
pop ebx
pop ebp
push 0x5fe820
call fcn.00427d70
mov eax, dword [0x5fe84c]
push 0x5fe820
mov esi, dword [eax + edi*4]
call fcn.00427d80
mov eax, dword [esi + 0x58]
add esp, 8
test al, 0x40
je 0x432ae2
cmp dword [esi + 0x3c], 0
je 0x432a41
cmp dword [esi + 0xc], 2
jne 0x432a41
cmp word [esi + 0x5c], 0
je 0x432a41
push 0
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.00438b20
add esp, 0x18
mov esi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
test eax, reloc.WS2_32.dll_connect
je 0x432a63
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.00438920
add esp, 0x14
mov esi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
test al, 1
je 0x432abc
push dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
push edi
push dword [ebp + 0xc]
push dword [esi + 0x60]
call dword [sym.imp.WS2_32.dll_recv]
push eax
call fcn.00539b90
mov esi, eax
add esp, 4
test esi, esi
jns 0x432adb
mov eax, dword [ebx]
mov eax, dword [eax + 0x28f0]
test eax, eax
jne 0x432a9a
call fcn.0053fcd2
cmp dword [eax], 0x2738
jne 0x432adb
push edi
push str.buf_to_small___d__for_packet_recv
push 0x360003
call fcn.00422d60
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret
push eax
push str.invalid_type:__d
push 0x75c
push str.vsock_recv
push 0x360202
call fcn.004230d0
add esp, 0x14
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
push str.recv_from_non_packet_socket
push 0x360000
call fcn.004232c0
int3
Function at 0x4352c0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
push ebx
push esi
push edi
push 0x437920
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 4]
sub eax, 4
push eax
call fcn.0041f380
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov edi, dword [ebp + 0xc]
xorps xmm0, xmm0
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov dword [ebp - 0x38], str.read
mov dword [ebp - 0x34], 0x56d468
mov dword [ebp - 0x30], str.except
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], 0
movq qword [ebp - 0x40], xmm0
test edi, edi
je 0x435435
xor esi, esi
mov eax, edi
mov dword [ebp - 0xc], esi
xor ebx, ebx
cmp dword [eax], ebx
jbe 0x435420
xor ecx, ecx
lea edx, [ebp - 0x144]
cmp eax, dword [ebp + 0x14]
cmovne edx, ecx
cmp eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x144]
mov dword [ebp - 0x18], edx
cmovne ecx, ebx
cmp eax, edi
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x144]
cmovne ecx, ebx
add eax, 4
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], eax
mov edi, dword [eax]
lea eax, [ebp - 0x40]
push eax
push edx
push dword [ebp - 0x10]
mov dword [ebp - 0x140], edi
push dword [ebp - 0x14]
mov dword [ebp - 0x144], 1
push 1
call dword [sym.imp.WS2_32.dll_select]
push eax
call fcn.00539b90
add esp, 4
test eax, eax
jns 0x435404
push 0x5fe820
call fcn.00427d70
mov ecx, dword [0x5fe83c]
add esp, 4
mov edx, dword [0x5fe84c]
xor esi, esi
test ecx, ecx
jle 0x4353d3
mov eax, dword [edx + esi*4]
test eax, eax
je 0x4353d3
cmp dword [eax + 0x60], edi
je 0x4353d3
inc esi
cmp esi, ecx
jl 0x4353c2
cmp esi, ecx
je 0x4353dd
cmp dword [edx + esi*4], 0
jne 0x4353e0
or esi, 0xffffffff
push 0x5fe820
call fcn.00427d80
push esi
mov esi, dword [ebp - 0xc]
push edi
push ebx
push dword [ebp + esi - 0x38]
push str._s__d__osfd_d_vfd_d_
push dword [ebp - 8]
call fcn.00420180
add esp, 0x1c
mov ecx, dword [ebp + esi - 0x28]
inc ebx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
add eax, 4
mov dword [ebp - 4], eax
cmp ebx, dword [ecx]
jb 0x435371
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + esi - 0x24]
add esi, 4
mov dword [ebp - 0xc], esi
test eax, eax
jne 0x435333
mov eax, dword [ebp - 8]
push 0x56d490
push eax
call fcn.00420a30
mov eax, dword [ebp - 8]
add esp, 8
push dword [eax]
push str.vsock_select__:_a_member_of_fd_set_was_invalid:__s
push 0x360000
call fcn.004232c0
int3
Function at 0x435520
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x2c]
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [eax]
mov eax, dword [edi + 0x28f0]
test eax, eax
jne 0x435540
call fcn.0053fcd2
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0xe0]
lea ebx, [esi + 0xd4]
movups xmmword [eax], xmm0
mov dword [eax + 0x10], 0
mov eax, dword [esi + 0xe0]
mov dword [eax + 0x10], esi
lock inc dword [ebx]
push dword [esi + 0x6c]
or dword [esi + 0x58], 0x400
call fcn.00446790
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push dword [esi + 0x6c]
call fcn.004466f0
push esi
call fcn.00439940
add esp, 0x18
push 0x433ae0
push dword [esi + 0xe0]
push dword [ebp - 4]
push dword [ebp - 8]
push dword [esi + 0x60]
call dword [sym.imp.KERNEL32.dll_ReadFileEx]
push eax
call fcn.00539b90
add esp, 4
mov dword [ebp + 8], eax
test eax, eax
jne 0x435699
mov eax, dword [edi + 0x28f0]
test eax, eax
jne 0x4355d6
call fcn.0053fcd2
push 0x15
push 6
push 0xe8
push 1
push 4
push dword [eax]
call fcn.004322a0
add esp, 0x18
test eax, eax
je 0x4356bc
push 0x5fe820
call fcn.00427d70
mov ecx, dword [esi + 0xbc]
add esp, 4
cmp esi, dword [0x5fe7f8]
jne 0x435618
mov dword [0x5fe7f8], ecx
jmp 0x43562a
mov eax, dword [esi + 0xc0]
mov dword [eax + 0xbc], ecx
mov ecx, dword [0x5fe7f8]
mov edx, dword [esi + 0xbc]
test edx, edx
je 0x435642
mov eax, dword [esi + 0xc0]
mov dword [edx + 0xc0], eax
jmp 0x435652
test ecx, ecx
je 0x435652
mov eax, dword [esi + 0xc0]
mov dword [ecx + 0xc0], eax
push 0x5fe820
mov dword [esi + 0xbc], 0
mov dword [esi + 0xc0], 0
call fcn.00427d80
or dword [esi + 0x58], 0x4100000
push esi
call fcn.004399d0
and dword [esi + 0x58], 0xfffffbff
add esp, 8
or eax, 0xffffffff
lock xadd dword [ebx], eax
jne 0x435699
push esi
call fcn.00433280
add esp, 4
mov eax, dword [edi + 0x28f0]
pop edi
pop esi
pop ebx
test eax, eax
jne 0x4356ab
call fcn.0053fcd2
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
xor eax, eax
cmp dword [ebp + 8], eax
sete al
mov esp, ebp
pop ebp
ret
push str.cant_read_from_handle:__m
push 0x360000
call fcn.004232c0
int3
Function at 0x4356d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
push edi
mov eax, dword [esi + 0xe0]
lea ebx, [esi + 0xd4]
movups xmmword [eax], xmm0
mov dword [eax + 0x10], 0
mov eax, dword [esi + 0xe0]
mov dword [eax + 0x10], esi
lock inc dword [ebx]
or dword [esi + 0x58], 0x400
push esi
call fcn.00439940
add esp, 4
lea eax, [esi + 0x100]
push 0x433ae0
push dword [esi + 0xe0]
push 1
push eax
push dword [esi + 0x60]
call dword [sym.imp.KERNEL32.dll_ReadFileEx]
mov edi, eax
push edi
call fcn.00539b90
add esp, 4
test eax, eax
jne 0x43576f
mov ecx, dword fs:[0x2c]
mov ecx, dword [ecx]
mov eax, dword [ecx + 0x28f0]
test eax, eax
jne 0x435752
call fcn.0053fcd2
push 6
push 0x6d
push 0xe8
push 3
push dword [eax]
call fcn.004322a0
add esp, 0x14
test eax, eax
je 0x435823
test edi, edi
jne 0x43581e
push 0x5fe820
call fcn.00427d70
mov ecx, dword [esi + 0xbc]
add esp, 4
cmp esi, dword [0x5fe7f8]
jne 0x43579a
mov dword [0x5fe7f8], ecx
jmp 0x4357ac
mov eax, dword [esi + 0xc0]
mov dword [eax + 0xbc], ecx
mov ecx, dword [0x5fe7f8]
mov edx, dword [esi + 0xbc]
test edx, edx
je 0x4357c4
mov eax, dword [esi + 0xc0]
mov dword [edx + 0xc0], eax
jmp 0x4357d4
test ecx, ecx
je 0x4357d4
mov eax, dword [esi + 0xc0]
mov dword [ecx + 0xc0], eax
push 0x5fe820
mov dword [esi + 0xbc], 0
mov dword [esi + 0xc0], 0
call fcn.00427d80
and dword [esi + 0x58], 0xfffffbff
add esp, 4
or eax, 0xffffffff
lock xadd dword [ebx], eax
jne 0x43580e
push esi
call fcn.00433280
add esp, 4
or dword [esi + 0x58], 0x100000
push esi
call fcn.004399d0
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
push str.cant_read_from_handle:__m
push 0x360000
call fcn.004232c0
int3
Function at 0x435ed0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
test dword [esi + 0x58], 0x2000
je 0x435eed
call sub.ntdll.dll_NtTestAlert
pop esi
mov esp, ebp
pop ebp
ret
push ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push dword [esi + 0x70]
call fcn.00446ae0
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x43607b
mov eax, dword [esi + 0xe4]
xorps xmm0, xmm0
or dword [esi + 0x58], 0x2000
movups xmmword [eax], xmm0
mov dword [eax + 0x10], 0
mov eax, dword [esi + 0xe4]
mov dword [eax + 0x10], esi
lea eax, [esi + 0xd4]
lock inc dword [eax]
push esi
call fcn.00439ab0
add esp, 4
push 0x433bf0
push dword [esi + 0xe4]
push dword [ebp - 4]
push dword [ebp - 8]
push dword [esi + 0x60]
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
push eax
call fcn.00539b90
mov ebx, dword fs:[0x2c]
add esp, 4
mov dword [ebp + 8], eax
test eax, eax
jne 0x436058
push edi
mov edi, dword [ebx]
mov eax, dword [edi + 0x28f0]
test eax, eax
jne 0x435f87
call fcn.0053fcd2
cmp dword [eax], 0xe8
jne 0x436090
mov eax, dword [edi + 0x28f0]
pop edi
test eax, eax
jne 0x435fa3
call fcn.0053fcd2
cmp dword [eax], 0xe8
jne 0x436055
push 0x5fe820
call fcn.00427d70
mov ecx, dword [esi + 0xb4]
add esp, 4
cmp esi, dword [0x5fe7fc]
jne 0x435fd2
mov dword [0x5fe7fc], ecx
jmp 0x435fe4
mov eax, dword [esi + 0xb8]
mov dword [eax + 0xb4], ecx
mov ecx, dword [0x5fe7fc]
mov edx, dword [esi + 0xb4]
test edx, edx
je 0x435ffc
mov eax, dword [esi + 0xb8]
mov dword [edx + 0xb8], eax
jmp 0x43600c
test ecx, ecx
je 0x43600c
mov eax, dword [esi + 0xb8]
mov dword [ecx + 0xb8], eax
push 0x5fe820
mov dword [esi + 0xb4], 0
mov dword [esi + 0xb8], 0
call fcn.00427d80
mov eax, dword [esi + 0x58]
lea ecx, [esi + 0xd4]
and eax, 0xffffdfff
add esp, 4
or eax, 0x4000000
mov dword [esi + 0x58], eax
or eax, 0xffffffff
lock xadd dword [ecx], eax
jne 0x436055
push esi
call fcn.00433280
add esp, 4
mov eax, dword [ebp + 8]
cmp dword [ebp - 4], 0
je 0x43607b
test eax, eax
jne 0x43608a
mov eax, dword [ebx]
mov eax, dword [eax + 0x28f0]
test eax, eax
jne 0x436073
call fcn.0053fcd2
cmp dword [eax], 0xe8
jne 0x43608a
mov eax, dword [esi + 0x58]
test al, 0x10
jne 0x43608a
and eax, 0xffffdfff
mov dword [esi + 0x58], eax
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
push str.WriteFileEx_failed:__m
push 0x360000
call fcn.004232c0
int3
Function at 0x436be0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push 0x5fe820
call fcn.00427d70
mov eax, dword [0x5fe84c]
mov ebx, dword [ebp + 8]
push 0x5fe820
mov esi, dword [eax + ebx*4]
call fcn.00427d80
add esp, 8
test byte [esi + 0x58], 1
je 0x436d33
mov eax, dword [0x5fe838]
test eax, eax
je 0x436c2f
push 4
lea ecx, [ebp + 0xc]
push ecx
push 1
push 6
push ebx
call eax
add esp, 0x14
jmp 0x436cec
cmp dword [0x5fe854], 0
push edi
mov edi, dword fs:[0x2c]
je 0x436c7a
mov eax, dword [edi]
cmp dword [eax + 0x21d0], 0
jne 0x436c7a
push 0x5fe820
call fcn.00427d70
mov eax, dword [0x5fe84c]
push 0x5fe820
mov esi, dword [eax + ebx*4]
call fcn.00427d80
add esp, 8
test dword [esi + 0x58], 0x10000000
jne 0x436c7a
mov esi, 1
jmp 0x436c7c
xor esi, esi
push 0x5fe820
call fcn.00427d70
mov eax, dword [0x5fe84c]
add esp, 4
test esi, esi
mov esi, dword [eax + ebx*4]
push 0x5fe820
call fcn.00427d80
add esp, 4
cmp dword [esi + 0x3c], 0
je 0x436ccf
cmp dword [esi + 0xc], 2
jne 0x436ccf
cmp word [esi + 0x5c], 0
je 0x436ccf
mov eax, dword [edi]
mov eax, dword [eax + 0x28f0]
test eax, eax
jne 0x436cc4
call fcn.0053fcd2
mov dword [eax], 0x16
or eax, 0xffffffff
jmp 0x436ceb
push 4
lea eax, [ebp + 0xc]
push eax
push 1
push 6
push dword [esi + 0x60]
call dword [sym.imp.WS2_32.dll_setsockopt]
push eax
call fcn.00539b90
add esp, 4
pop edi
test eax, eax
je 0x436d33
mov eax, dword [0x5fe854]
xor ecx, ecx
test eax, eax
setne cl
lea ecx, [ecx*4 + 3]
test eax, eax
jne 0x436d2c
cmp ecx, 5
jbe 0x436d14
cmp dword [0x5febd8], ecx
jl 0x436d2c
or ecx, 0x360000
push str.failed_setsockopt_TCP_NODELAY_:__m
push ecx
call fcn.00422d60
add esp, 8
pop esi
pop ebx
pop ebp
ret
pop esi
or eax, 0xffffffff
pop ebx
pop ebp
ret
pop esi
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x436d40
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0x5fe820
mov dword [ebp + 0xc], edi
call fcn.00427d70
mov eax, dword [ebp + 8]
push 0x5fe820
lea esi, [eax*4]
mov eax, dword [0x5fe84c]
mov ebx, dword [esi + eax]
call fcn.00427d80
mov eax, dword [ebx + 0x58]
add esp, 8
test al, 1
je 0x436e0c
test edi, edi
jne 0x436db7
test al, al
jns 0x436db7
push edi
push edi
push dword [ebx + 0x60]
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
push eax
call fcn.00539b90
add esp, 4
test eax, eax
je 0x436db7
push str.WSAEventSelect:__m
push 0x360003
call fcn.00422d60
add esp, 8
pop edi
pop esi
pop ebx
pop ebp
ret
push 0x5fe820
call fcn.00427d70
mov eax, dword [0x5fe84c]
push 0x5fe820
mov esi, dword [esi + eax]
call fcn.00427d80
add esp, 8
lea eax, [ebp + 0xc]
push eax
push 0x8004667e
push dword [esi + 0x60]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
push eax
call fcn.00539b90
add esp, 4
test eax, eax
je 0x436e0c
push str.failed_ioctl_FIOBIO_:__m
push 0x360003
call fcn.00422d60
add esp, 8
pop edi
pop esi
pop ebx
pop ebp
ret
mov eax, dword [ebx + 0x58]
neg edi
sbb edi, edi
and eax, 0xffffff7f
and edi, 0x80
or edi, eax
xor eax, eax
mov dword [ebx + 0x58], edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4381b0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x10
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_getsockname]
push eax
call fcn.00539b90
add esp, 4
test eax, eax
je 0x4381e2
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
mov ax, word [ebp - 0x12]
mov word [ecx + 0x78], ax
mov eax, dword [ebp - 0x10]
mov dword [ecx + 0x7c], eax
xor eax, eax
mov esp, ebp
pop ebp
ret