joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4130cc
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [esp + 0x40]
mov eax, dword [esp + 0x44]
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x3c4]
test eax, eax
je 0x413238
mov eax, dword [esi + 0x4d8]
test eax, eax
je 0x4130ff
mov dword [esp], esi
call fcn.00412fac
mov dword [esp + 8], 2
mov dword [esp + 4], 2
mov dword [esp], esi
call fcn.0041a8fc
mov edi, dword [esi + 0x3c4]
mov ebx, dword [esi + 0x4e0]
test ebx, ebx
je 0x41312e
mov eax, dword [ebx + 0xc]
test eax, eax
jne 0x413168
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x413150
mov eax, dword [esi + 0x48]
mov edx, dword [esi + 0x4e0]
test eax, eax
je 0x413148
cmp edx, dword [eax + 0x18]
je 0x413150
mov dword [esp], edx
call fcn.00412d80
mov dword [esp + 0x44], 2
mov dword [esp + 0x40], esi
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.0041a954
lea edx, [ebx + 0xc]
mov eax, ebx
call fcn.00411c14
mov dword [esp + 4], edi
mov dword [esp], 0x5a5fdd
call sym.curl.exe_curl_strequal
test eax, eax
je 0x413298
mov dword [esp + 0x1c], 1
mov edi, dword [sym.imp.msvcrt.dll__iob]
add edi, 0x20
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x87
mov dword [esp + 4], 1
mov dword [esp], str._Netscape_HTTP_Cookie_File_n_http:__curl.haxx.se_docs_http_cookies.html_n_This_file_was_generated_by_libcurl__Edit_at_your_own_risk._n_n
call sub.msvcrt.dll_fwrite
mov ebx, dword [ebx]
test ebx, ebx
jne 0x4131ef
jmp 0x41327c
mov dword [esp + 8], eax
mov dword [esp + 4], 0x5a60b9
mov dword [esp], edi
call sym.curl.exe_curl_mfprintf
mov dword [esp], ebp
call dword [0x59b00c]
mov ebx, dword [ebx]
test ebx, ebx
je 0x41327c
mov eax, ebx
call fcn.00411908
mov ebp, eax
test eax, eax
jne 0x4131c8
mov dword [esp + 4], str._n_Fatal_libcurl_error_n
mov dword [esp], edi
call sym.curl.exe_curl_mfprintf
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x4132c0
mov eax, dword [esi + 0x3c4]
mov dword [esp + 8], eax
mov dword [esp + 4], str.WARNING:_failed_to_save_cookies_in__s_n
mov dword [esp], esi
call fcn.0040e21c
jmp 0x41312e
mov ebx, dword [esp + 0x18]
test ebx, ebx
je 0x41325c
mov eax, dword [esi + 0x4d8]
test eax, eax
je 0x41325c
mov dword [esp], eax
call sym.curl.exe_curl_slist_free_all
mov dword [esi + 0x4d8], 0
mov dword [esp + 8], 2
mov dword [esp + 4], 2
mov dword [esp], esi
call fcn.0041a8fc
jmp 0x41312e
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x41312e
mov dword [esp], edi
call sub.msvcrt.dll_fclose
jmp 0x41312e
mov dword [esp + 4], 0x5a6014
mov dword [esp], edi
call sub.msvcrt.dll_fopen
mov edi, eax
test eax, eax
je 0x413218
mov dword [esp + 0x1c], 0
jmp 0x41319b
mov dword [esp], edi
call sub.msvcrt.dll_fclose
jmp 0x413218
Function at 0x413644
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x13c
mov ebx, dword [esp + 0x150]
mov ebp, dword [ebx]
cmp dword [ebx + 0x8c], 2
je 0x4136cf
mov esi, dword [ebx + 0x1f0]
test esi, esi
jne 0x41370c
mov dword [esp + 0x2c], pe_nt_image_headers32
lea edx, [esp + 0x2c]
mov dword [esp + 8], edx
lea esi, [esp + 0x30]
mov dword [esp + 4], esi
mov eax, dword [esp + 0x154]
mov dword [esp], eax
mov dword [esp + 0x14], edx
call sub.WS2_32.dll_getpeername
sub esp, 0xc
test eax, eax
mov edx, dword [esp + 0x14]
je 0x413720
call sub.WS2_32.dll_WSAGetLastError
mov esi, eax
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.0040227c
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov dword [esp + 4], str.getpeername___failed_with_errno__d:__s
mov dword [esp], ebp
call fcn.0040dcf0
add esp, 0x13c
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebx + 0x58]
mov ecx, 0x2e
mov edi, eax
mov esi, dword [esp + 0x1c]
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebx + 0x11c]
lea edx, [ebx + 0xec]
lea eax, [esp + 0xb0]
call fcn.00413494
test eax, eax
je 0x4137f0
mov dword [esp], ebx
call fcn.004135f4
add esp, 0x13c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x2c], pe_nt_image_headers32
lea eax, [esp + 0xb0]
mov dword [esp + 0x18], eax
mov ecx, pe_nt_image_headers32
xor eax, eax
mov edi, dword [esp + 0x18]
rep stosb byte es:[edi], al
mov dword [esp + 8], edx
lea eax, [esp + 0xb0]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x154]
mov dword [esp], eax
call sub.WS2_32.dll_getsockname
sub esp, 0xc
test eax, eax
jne 0x4137b8
lea eax, [ebx + 0xb8]
mov dword [esp + 0x1c], eax
lea ecx, [ebx + 0xe8]
mov edx, eax
mov eax, esi
call fcn.00413494
test eax, eax
jne 0x4136dc
call sub.KERNEL32.dll_GetLastError
mov esi, eax
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.0040227c
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov dword [esp + 4], str.ssrem_inet_ntop___failed_with_errno__d:__s
mov dword [esp], ebp
call fcn.0040dcf0
jmp 0x4136cf
call sub.WS2_32.dll_WSAGetLastError
mov esi, eax
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.0040227c
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov dword [esp + 4], str.getsockname___failed_with_errno__d:__s
mov dword [esp], ebp
call fcn.0040dcf0
add esp, 0x13c
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.KERNEL32.dll_GetLastError
mov esi, eax
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.0040227c
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov dword [esp + 4], str.ssloc_inet_ntop___failed_with_errno__d:__s
mov dword [esp], ebp
call fcn.0040dcf0
jmp 0x4136cf
Function at 0x413820
Capabilities:
Check os version
Set socket configuration

Disassembly:
push edi
sub esp, 0xc8
mov dword [esp + 0x20], 0x4020
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 4
mov eax, dword [0x65d044]
test eax, eax
je 0x4138d8
cmp eax, 2
je 0x413891
lea eax, [esp + 0x28]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x24]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1001
mov dword [esp + 4], 0xffff
mov eax, dword [esp + 0xd0]
mov dword [esp], eax
call sub.WS2_32.dll_getsockopt
sub esp, 0x14
test eax, eax
jne 0x41389c
mov eax, dword [esp + 0x20]
cmp dword [esp + 0x24], eax
jle 0x41389c
add esp, 0xc8
pop edi
ret
mov dword [esp + 0x10], 4
lea eax, [esp + 0x20]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1001
mov dword [esp + 4], 0xffff
mov eax, dword [esp + 0xd0]
mov dword [esp], eax
call sub.WS2_32.dll_setsockopt
sub esp, 0x14
add esp, 0xc8
pop edi
ret
lea edx, [esp + 0x2c]
mov ecx, 0x94
mov edi, edx
rep stosb byte es:[edi], al
mov dword [esp + 0x2c], 0x94
mov dword [0x65d044], 1
mov dword [esp], edx
call sub.KERNEL32.dll_GetVersionExA
push edi
test eax, eax
je 0x41391c
cmp dword [esp + 0x30], 5
jbe 0x41391c
mov dword [0x65d044], 2
jmp 0x413891
mov eax, dword [0x65d044]
jmp 0x41384c

Function at 0x413928
Capabilities:
Receive data
Receive data on socket

Disassembly:
push esi
push ebx
sub esp, 0x24
mov ebx, dword [esp + 0x30]
mov esi, dword [ebx + 0x608]
test esi, esi
je 0x41397b
mov eax, dword [ebx + 0x44]
test eax, eax
je 0x41397b
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], 0
mov dword [esp + 8], 0x4133e0
lea edx, [esp + 0x18]
mov dword [esp + 4], edx
mov eax, dword [eax + 0x34]
mov dword [esp], eax
call fcn.0043953c
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x413988
mov dword [ebx + 0x608], 0
mov ebx, 0xffffffff
mov eax, ebx
add esp, 0x24
pop ebx
pop esi
ret
mov eax, dword [esp + 0x34]
test eax, eax
je 0x413996
mov eax, dword [esp + 0x34]
mov dword [eax], esi
mov ebx, dword [esi + 0x154]
mov eax, dword [esi + 0x17c]
test eax, eax
je 0x4139b4
mov dword [esp], esi
call fcn.00404f3c
test eax, eax
je 0x41397b
jmp 0x413980
mov dword [esp + 0xc], 2
mov dword [esp + 8], 1
lea eax, [esp + 0x17]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.WS2_32.dll_recv
sub esp, 0x10
test eax, eax
je 0x41397b
jmp 0x413980
Function at 0x414ed4
Capabilities:
Create thread

Disassembly:
sub esp, 0x2c
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x34]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.msvcrt.dll__beginthreadex
lea edx, [eax - 1]
cmp edx, 0xfffffffd
ja 0x414f18
add esp, 0x2c
ret
xor eax, eax
add esp, 0x2c
ret

Function at 0x414f88
Capabilities:
Resolve dns

Disassembly:
push esi
push ebx
sub esp, 0x24
mov ebx, dword [esp + 0x30]
lea esi, [esp + 0x1c]
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], 2
call fcn.00414ffc
test eax, eax
jle 0x414fd0
mov eax, dword [esp + 0x34]
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], 2
call fcn.00414ca8
add esp, 0x24
pop ebx
pop esi
ret
mov dword [esp], ebx
call sub.WS2_32.dll_gethostbyname
push edx
test eax, eax
je 0x414ff4
mov edx, dword [esp + 0x34]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00414b50
add esp, 0x24
pop ebx
pop esi
ret
xor eax, eax
add esp, 0x24
pop ebx
pop esi
ret
Function at 0x4217ac
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, eax
mov edi, dword [eax]
mov esi, dword [eax + 0x158]
mov dword [esp + 0x2c], 0x10
lea edx, [esp + 0x2c]
mov dword [esp + 8], edx
lea ebp, [esp + 0x30]
mov dword [esp + 4], ebp
mov dword [esp], esi
mov dword [esp + 0x1c], edx
call sub.WS2_32.dll_getsockname
sub esp, 0xc
test eax, eax
mov edx, dword [esp + 0x1c]
je 0x421818
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.004139e0
mov dword [esp + 4], str.Error_accept__ing_server_connect
mov dword [esp], edi
call fcn.0040dcf0
mov eax, 0x1e
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x2c], 0x10
mov dword [esp + 8], edx
mov dword [esp + 4], ebp
mov dword [esp], esi
call sub.WS2_32.dll_accept
sub esp, 0xc
mov ebp, eax
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.004139e0
cmp ebp, 0xffffffff
je 0x4217f8
mov dword [esp + 4], str.Connection_accepted_from_server_n
mov dword [esp], edi
call fcn.0040e21c
mov dword [ebx + 0x158], ebp
mov dword [esp + 4], 1
mov dword [esp], ebp
call fcn.0043f3bc
mov dword [ebx + 0x168], 1
mov eax, dword [edi + 0x1e8]
test eax, eax
je 0x42189b
mov dword [esp + 8], 1
mov dword [esp + 4], ebp
mov edx, dword [edi + 0x1ec]
mov dword [esp], edx
call eax
test eax, eax
jne 0x4218a8
xor eax, eax
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], ebp
mov dword [esp], ebx
call fcn.004139e0
mov dword [ebx + 0x158], 0xffffffff
mov eax, 0x2a
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x422958
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov esi, eax
mov edi, ecx
cmp edx, 1
sbb ebx, ebx
and ebx, 8
add ebx, 0x41
cmp bl, byte [eax + 0x4fc]
je 0x4229ac
movsx eax, bl
mov dword [esp + 8], eax
mov dword [esp + 4], str.TYPE__c
lea eax, [esi + 0x498]
mov dword [esp], eax
call fcn.004422f4
test eax, eax
jne 0x4229a2
mov dword [esi + 0x50c], edi
mov byte [esi + 0x4fc], bl
add esp, 0x10
pop ebx
pop esi
pop edi
ret
mov dword [esi + 0x50c], ecx
mov edx, ecx
add esp, 0x10
pop ebx
pop esi
pop edi
jmp fcn.00422e78

Function at 0x4229c0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push esi
push ebx
mov edx, dword [eax]
mov ebx, dword [edx + 0x160]
mov esi, dword [edx + 0x34c]
test esi, esi
je 0x422a14
mov ecx, dword [eax + 0x4e0]
test ecx, ecx
je 0x422a14
movsx esi, byte [eax + 0x4fc]
cmp dword [edx + 0x31c], 1
sbb ecx, ecx
and ecx, 8
add ecx, 0x41
cmp esi, ecx
je 0x422a14
mov dword [ebx + 0xc], 1
mov edx, dword [edx + 0x31c]
mov ecx, 0x13
pop ebx
pop esi
jmp fcn.00422958
pop ebx
pop esi
jmp 0x422e24
push ebx
sub esp, 0x18
mov ebx, eax
mov eax, dword [eax]
mov eax, dword [eax + 0x160]
cmp dword [eax + 0xc], 1
je 0x422e40
mov eax, ebx
add esp, 0x18
pop ebx
jmp fcn.00422dc8
mov eax, dword [ebx + 0x4e0]
test eax, eax
je 0x422e38
mov dword [esp + 8], eax
mov dword [esp + 4], str.SIZE__s
lea eax, [ebx + 0x498]
mov dword [esp], eax
call fcn.004422f4
test eax, eax
jne 0x422e72
mov dword [ebx + 0x50c], 0x17
add esp, 0x18
pop ebx
ret
Function at 0x422a1c
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebx
sub esp, 0x18
mov ebx, eax
mov eax, dword [eax]
mov edx, dword [eax + 0x314]
test edx, edx
jne 0x422a38
mov eax, dword [eax + 0x290]
test eax, eax
je 0x422a70
mov eax, dword [ebx + 0x4e0]
test eax, eax
je 0x422a70
mov dword [esp + 8], eax
mov dword [esp + 4], str.MDTM__s
lea eax, [ebx + 0x498]
mov dword [esp], eax
call fcn.004422f4
test eax, eax
jne 0x422a6a
mov dword [ebx + 0x50c], 0x12
add esp, 0x18
pop ebx
ret
mov eax, ebx
add esp, 0x18
pop ebx
jmp fcn.004229c0
Function at 0x422a7c
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov edi, eax
mov eax, dword [eax]
mov ebp, dword [eax + 0x160]
cmp ecx, 0xd
jae 0x422bd0
mov ebx, dword [eax + 0x270]
test edx, edx
je 0x422bc4
mov dword [edi + 0x500], 0
test ebx, ebx
je 0x422b1c
mov esi, dword [edi + 0x500]
test esi, esi
jle 0x422ad0
xor edx, edx
jmp 0x422ac4
test ebx, ebx
je 0x422b1c
mov ebx, dword [ebx + 4]
inc edx
cmp edx, esi
jne 0x422ac0
test ebx, ebx
je 0x422b1c
mov eax, dword [ebx]
cmp byte [eax], 0x2a
je 0x422bf4
mov dword [edi + 0x504], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 0x5a842d
lea eax, [edi + 0x498]
mov dword [esp], eax
mov dword [esp + 0x1c], ecx
call fcn.004422f4
test eax, eax
mov ecx, dword [esp + 0x1c]
jne 0x422b11
mov dword [edi + 0x50c], ecx
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
cmp ecx, 0xe
je 0x422c04
cmp ecx, 0xf
je 0x422c14
cmp ecx, 0xd
je 0x422c1e
mov ebp, dword [edi + 0x4ec]
test ebp, ebp
jne 0x422c90
mov dword [edi + 0x504], 0
cmp dword [eax + 0x304], 2
sete al
movzx eax, al
mov dword [edi + 0x508], eax
mov esi, dword [edi + 0x1f0]
test esi, esi
jne 0x422c73
mov ebx, dword [edi + 0x4d8]
test ebx, ebx
je 0x422c90
mov dword [edi + 0x500], 1
mov eax, dword [edi + 0x4d4]
mov eax, dword [eax]
mov dword [esp + 8], eax
mov dword [esp + 4], str.CWD__s
lea eax, [edi + 0x498]
mov dword [esp], eax
call fcn.004422f4
test eax, eax
jne 0x422b11
mov dword [edi + 0x50c], 0x10
jmp 0x422b11
inc dword [edi + 0x500]
jmp 0x422aae
cmp ecx, 0xe
ja 0x422be0
mov ebx, dword [eax + 0x278]
jmp 0x422a9c
cmp ecx, 0xf
jne 0x422a96
mov ebx, dword [eax + 0x274]
jmp 0x422a9c
inc eax
mov dword [edi + 0x504], 1
jmp 0x422ae5
xor edx, edx
mov eax, edi
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00420b8c
xor eax, eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x422c62
mov ecx, dword [edi + 0x528]
mov edx, dword [edi + 0x52c]
mov ebx, ecx
and ebx, edx
inc ebx
je 0x422c9e
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp], eax
call fcn.004199c0
mov edx, dword [edi + 0x528]
mov ecx, dword [edi + 0x52c]
mov eax, edi
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00420860
mov dword [edi + 0x50c], 0
xor eax, eax
jmp 0x422b11
mov eax, dword [edi + 0x4d0]
test eax, eax
je 0x422b70
mov dword [edi + 0x500], 0
jmp 0x422b90
mov eax, edi
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00422a1c
mov eax, dword [edi + 0x4e0]
mov dword [esp + 8], eax
mov dword [esp + 4], str.SIZE__s
lea eax, [edi + 0x498]
mov dword [esp], eax
call fcn.004422f4
test eax, eax
jne 0x422b11
mov dword [edi + 0x50c], 0x18
jmp 0x422b11
Function at 0x422cd8
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebx
sub esp, 0x18
mov ebx, eax
mov eax, dword [eax]
mov edx, dword [eax + 0x160]
mov edx, dword [edx + 0xc]
test edx, edx
jne 0x422d4c
mov ecx, dword [eax + 0x328]
test ecx, ecx
jne 0x422d6c
mov edx, dword [eax + 0x374]
test edx, edx
je 0x422d88
mov edx, dword [ebx + 0x4e0]
test edx, edx
je 0x422d94
mov eax, dword [eax + 0x354]
test eax, eax
mov dword [esp + 8], edx
jne 0x422d7c
mov dword [esp + 4], str.PRET_RETR__s
lea eax, [ebx + 0x498]
mov dword [esp], eax
call fcn.004422f4
test eax, eax
jne 0x422d47
mov dword [ebx + 0x50c], 0x1d
xor eax, eax
add esp, 0x18
pop ebx
ret
mov dword [ebx + 0x50c], 0xd
mov ecx, 0xd
mov edx, 1
mov eax, ebx
add esp, 0x18
pop ebx
jmp fcn.00422a7c
xor edx, edx
mov eax, ebx
add esp, 0x18
pop ebx
jmp fcn.00420eb4
mov dword [esp + 4], str.PRET_STOR__s
jmp 0x422d29
mov eax, ebx
add esp, 0x18
pop ebx
jmp fcn.00420af8
mov edx, dword [eax + 0x3c8]
test edx, edx
je 0x422daf
mov dword [esp + 8], edx
mov dword [esp + 4], str.PRET__s
jmp 0x422d29
mov eax, dword [eax + 0x324]
test eax, eax
je 0x422dc0
mov edx, str.NLST
jmp 0x422d9e
mov edx, 0x5a89a2
jmp 0x422d9e

Function at 0x422dc8
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebx
sub esp, 0x18
mov ebx, eax
mov eax, dword [eax]
mov eax, dword [eax + 0x160]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x422e18
mov ecx, dword [ebx + 0x4e0]
test ecx, ecx
je 0x422e18
mov dword [esp + 8], 0
mov dword [esp + 4], str.REST__d
lea eax, [ebx + 0x498]
mov dword [esp], eax
call fcn.004422f4
test eax, eax
jne 0x422e13
mov dword [ebx + 0x50c], 0x1a
add esp, 0x18
pop ebx
ret
mov eax, ebx
add esp, 0x18
pop ebx
jmp fcn.00422cd8
Function at 0x422e78
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, eax
cmp edx, 0x13
je 0x422ea8
cmp edx, 0x14
je 0x422eb4
cmp edx, 0x15
je 0x422f50
cmp edx, 0x16
je 0x422f68
xor eax, eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp 0x422e24
mov esi, dword [eax]
cmp dword [esi + 0x300], 2
je 0x422f88
mov edx, 0x5a8420
xor ebp, ebp
mov ecx, edx
mov eax, dword [esi + 0x3c8]
test eax, eax
je 0x423008
mov dword [esp + 0xc], edx
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
mov dword [esp], 0x5a89d8
call sym.curl.exe_curl_maprintf
mov esi, eax
test eax, eax
je 0x422f70
mov dword [esp + 8], eax
mov dword [esp + 4], 0x5a842d
lea eax, [ebx + 0x498]
mov dword [esp], eax
call fcn.004422f4
test ebp, ebp
je 0x422f27
mov dword [esp], ebp
mov dword [esp + 0x1c], eax
call dword [0x59b00c]
mov eax, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 0x1c], eax
call dword [0x59b00c]
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x422e9f
mov dword [ebx + 0x50c], 0x1f
jmp 0x422e9f
mov ecx, 0xd
mov dl, 1
mov eax, ebx
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00422a7c
mov ecx, 0xe
jmp 0x422f55
test ebp, ebp
je 0x422f7d
mov dword [esp], ebp
call dword [0x59b00c]
mov eax, 0x1b
jmp 0x422e9f
mov ebp, dword [esi + 0x8754]
test ebp, ebp
je 0x422ec3
cmp byte [ebp], 0
je 0x422ec3
mov dword [esp + 4], 0x2f
mov dword [esp], ebp
call sub.msvcrt.dll_strchr
test eax, eax
je 0x422ec3
mov dword [esp], ebp
call dword [0x59b004]
mov edx, eax
test eax, eax
je 0x422f7d
xor eax, eax
mov ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
cmp byte [edx + ecx - 2], 0x2f
je 0x422ffb
mov dword [esp + 4], 0x2f
mov dword [esp], edx
mov dword [esp + 0x1c], edx
call sub.msvcrt.dll_strrchr
test eax, eax
mov edx, dword [esp + 0x1c]
je 0x422ffb
mov byte [eax + 1], 0
mov ebp, edx
mov ecx, 0x5a89d6
jmp 0x422ecc
mov eax, dword [esi + 0x324]
test eax, eax
je 0x42301c
mov eax, str.NLST
jmp 0x422eda
mov eax, 0x5a89a2
jmp 0x422eda
Function at 0x429524
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
sub esp, 0x28
mov ebx, eax
mov dword [esp + 8], str.Connected_for_receive
mov dword [esp + 4], 0x5aa240
mov eax, dword [eax + 0x10]
mov eax, dword [eax]
mov dword [esp], eax
mov dword [esp + 0x1c], edx
call fcn.0040e21c
mov dword [ebx], 1
mov eax, ebx
call fcn.00429340
test eax, eax
mov edx, dword [esp + 0x1c]
je 0x429568
add esp, 0x28
pop ebx
ret
mov eax, ebx
add esp, 0x28
pop ebx
jmp fcn.00428ff0
Function at 0x429934
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
sub esp, 0x28
mov ebx, eax
mov dword [esp + 8], str.Connected_for_transmit
mov dword [esp + 4], 0x5aa240
mov eax, dword [eax + 0x10]
mov eax, dword [eax]
mov dword [esp], eax
mov dword [esp + 0x1c], edx
call fcn.0040e21c
mov dword [ebx], 2
mov eax, ebx
call fcn.00429340
test eax, eax
mov edx, dword [esp + 0x1c]
je 0x429978
add esp, 0x28
pop ebx
ret
mov eax, ebx
add esp, 0x28
pop ebx
jmp fcn.00429574
Function at 0x43be6c
Capabilities:
Query environment variable

Disassembly:
push ebx
sub esp, 0x128
mov dword [esp], eax
call sub.msvcrt.dll_getenv
mov byte [esp + 0x1c], 0
test eax, eax
je 0x43be60
mov dword [esp + 8], 0x104
lea ebx, [esp + 0x1c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.KERNEL32.dll_ExpandEnvironmentStringsA
sub esp, 0xc
cmp byte [esp + 0x1c], 0
je 0x43be60
mov dword [esp], ebx
call dword [0x59b004]
add esp, 0x128
pop ebx
ret
xor eax, eax
add esp, 0x128
pop ebx
ret
mov eax, dword [esp + 4]
jmp 0x43be14
Function at 0x43f3bc
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x2c
xor eax, eax
mov edx, dword [esp + 0x34]
test edx, edx
setne al
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x8004667e
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call sub.WS2_32.dll_ioctlsocket
sub esp, 0xc
add esp, 0x2c
ret
Function at 0x4402ec
Capabilities:
Read file on windows

Disassembly:
push esi
push ebx
sub esp, 0x24
mov ebx, eax
mov esi, dword [eax]
cmp dword [esi + 4], 2
je 0x440344
mov eax, dword [eax + 8]
test eax, eax
je 0x440368
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
mov dword [esp + 4], 1
mov dword [esp], edx
call sub.msvcrt.dll_fread
mov esi, eax
test esi, esi
jne 0x44033c
mov eax, dword [ebx + 8]
test eax, eax
je 0x440336
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov dword [ebx + 8], 0
mov eax, dword [ebx]
mov eax, dword [eax]
mov dword [ebx], eax
mov eax, esi
add esp, 0x24
pop ebx
pop esi
ret
mov eax, dword [eax + 0xc]
test eax, eax
je 0x4403a0
mov esi, dword [esi + 8]
mov dword [esp + 0xc], esi
mov dword [esp + 8], ecx
mov dword [esp + 4], 1
mov dword [esp], edx
call eax
mov esi, eax
jmp 0x44031c
mov dword [esp + 4], 0x5ae860
mov eax, dword [esi + 8]
mov dword [esp], eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], ecx
call sub.msvcrt.dll_fopen
mov dword [ebx + 8], eax
test eax, eax
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
jne 0x440302
mov esi, 0xffffffff
jmp 0x44033c
xor esi, esi
jmp 0x44033c
Function at 0x4453b4
Capabilities:
Get hostname

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov ebx, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
mov byte [ebx], 0
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.WS2_32.dll_gethostname
sub esp, 8
mov edi, eax
mov byte [ebx + esi - 1], 0
test eax, eax
jne 0x4453f6
mov dword [esp + 4], 0x2e
mov dword [esp], ebx
call sub.msvcrt.dll_strchr
test eax, eax
je 0x4453f6
mov byte [eax], 0
mov eax, edi
add esp, 0x10
pop ebx
pop esi
pop edi
ret