joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405940
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x418
push ebx
push esi
push edi
mov eax, 0x10
mov ebx, 0x400
push 1
mov word [esp + 0x10], ax
mov word [esp + 0x24], bx
call fcn.00409fbc
push eax
push 0xe
push 1
push str.Error_reading
call fcn.0040a251
mov edi, dword [esp + 0x43c]
add esp, 0x14
movzx ecx, word [edi + 2]
mov eax, ecx
cmp cx, 0x20
jle 0x4059a6
movsx eax, cx
push 0x42f9aa
sub eax, 0x20
push eax
push 0x42caf8
call fcn.004011e0
movzx eax, word [edi + 2]
add esp, 0xc
test ax, ax
jle 0x4059bd
cmp ax, 0x20
jge 0x4059b6
movsx esi, ax
jmp 0x4059bf
mov esi, 0x20
jmp 0x4059bf
xor esi, esi
push 1
call fcn.00409fbc
push eax
push esi
lea eax, [edi + 4]
push 1
push eax
call fcn.0040a251
push 1
call fcn.00409fbc
push eax
push 0x22
push 1
push str..lan_language_descriptor_file_set.
call fcn.0040a251
push 0x42cb20
call fcn.004011e0
add esp, 0x2c
xor eax, eax
mov word [esp + 0x22], ax
lea eax, [esp + 0x20]
push 0x42ca48
push eax
call sym.fxh.exe__string_appends_8
push 0x20
lea eax, [esp + 0x24]
push eax
call sym.fxh.exe__string_append1_8
mov edi, dword [esp + 0x42c]
lea eax, [esp + 0xc]
push dword [edi + 0x914]
push eax
call sym.fxh.exe__string_f_int_8
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x24]
push eax
call sym.fxh.exe__string_append_8
push 0x42ca98
lea eax, [esp + 0x24]
push eax
call sym.fxh.exe__string_appends_8
mov ax, word [esp + 0x22]
cmp ax, bx
jle 0x405a75
cwde
push 0x42f9ab
sub eax, 0x400
push eax
push 0x42cb24
call fcn.004011e0
mov ax, word [esp + 0x2e]
add esp, 0xc
test ax, ax
jle 0x405a88
cmp ax, bx
jge 0x405a84
movsx esi, ax
jmp 0x405a8a
mov esi, ebx
jmp 0x405a8a
xor esi, esi
push 1
call fcn.00409fbc
push eax
push esi
lea eax, [esp + 0x30]
push 1
push eax
call fcn.0040a251
push 0x42cb28
call fcn.004011e0
movzx ecx, word [edi + 0x50e]
add esp, 0x18
mov eax, ecx
cmp cx, bx
jle 0x405adc
movsx eax, cx
push 0x42f9ac
sub eax, 0x400
push eax
push 0x42cb2c
call fcn.004011e0
movzx eax, word [edi + 0x50e]
add esp, 0xc
test ax, ax
jle 0x405aef
cmp ax, bx
jge 0x405aeb
movsx esi, ax
jmp 0x405af1
mov esi, ebx
jmp 0x405af1
xor esi, esi
push 1
call fcn.00409fbc
push eax
push esi
lea eax, [edi + 0x510]
push 1
push eax
call fcn.0040a251
push 0x42cb30
call fcn.004011e0
add esp, 0x18
call sym.fxh.exe__sys_bomb_0
pop edi
pop esi
pop ebx
add esp, 0x418
ret 8
Function at 0x419620
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x208c
call fcn.00406c20
push esi
push edi
mov eax, 0x2000
mov edi, 0x84
mov word [esp + 0x90], ax
lea eax, [esp + 8]
push str.Syntax_error_occurred_on_line
push eax
mov dword [esp + 0x10], edi
call sym.fxh.exe__string_appends_8
push 0x20
lea eax, [esp + 0xc]
push eax
call sym.fxh.exe__string_append1_8
mov esi, dword [esp + 0x2098]
mov eax, dword [esi]
push dword [eax + 0x970]
lea eax, [esp + 0x94]
push eax
call sym.fxh.exe__string_f_int_8
lea eax, [esp + 0x90]
push eax
lea eax, [esp + 0xc]
push eax
call sym.fxh.exe__string_append_8
push 0x42d800
lea eax, [esp + 0xc]
push eax
call sym.fxh.exe__string_appends_8
push 0x20
lea eax, [esp + 0xc]
push eax
call sym.fxh.exe__string_append1_8
mov eax, dword [esi]
add eax, 0x568
push eax
lea eax, [esp + 0xc]
push eax
call sym.fxh.exe__string_append_8
mov ax, word [esp + 0xa]
cmp ax, di
jle 0x4196dd
cwde
push 0x430486
sub eax, edi
push eax
push 0x42d7ac
call fcn.004011e0
mov ax, word [esp + 0x16]
add esp, 0xc
test ax, ax
jle 0x4196f0
cmp ax, di
jge 0x4196ec
movsx esi, ax
jmp 0x4196f2
mov esi, edi
jmp 0x4196f2
xor esi, esi
push 1
call fcn.00409fbc
push eax
push esi
lea eax, [esp + 0x18]
push 1
push eax
call fcn.0040a251
push 0x42d850
call fcn.004011e0
add esp, 0x18
call sym.fxh.exe__sys_bomb_0
pop edi
pop esi
add esp, 0x208c
ret 4
Function at 0x419ff0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x428
push ebx
push esi
push edi
mov eax, 0x20
mov ebx, 0x400
mov word [esp + 0xc], ax
lea eax, [esp + 0x30]
push str.Error_on_line
push eax
mov dword [esp + 0x38], ebx
call sym.fxh.exe__string_appends_8
push 0x20
lea eax, [esp + 0x34]
push eax
call sym.fxh.exe__string_append1_8
mov edi, dword [esp + 0x438]
mov eax, dword [edi]
push dword [eax + 0x970]
lea eax, [esp + 0x10]
push eax
call sym.fxh.exe__string_f_int_8
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x34]
push eax
call sym.fxh.exe__string_append_8
push str._of_file
lea eax, [esp + 0x34]
push eax
call sym.fxh.exe__string_appends_8
mov ax, word [esp + 0x32]
cmp ax, bx
jle 0x41a083
cwde
push 0x43048f
sub eax, ebx
push eax
push 0x42da3c
call fcn.004011e0
mov ax, word [esp + 0x3e]
add esp, 0xc
test ax, ax
jle 0x41a096
cmp ax, bx
jge 0x41a092
movsx esi, ax
jmp 0x41a098
mov esi, ebx
jmp 0x41a098
xor esi, esi
push 1
call fcn.00409fbc
push eax
push esi
lea eax, [esp + 0x40]
push 1
push eax
call fcn.0040a251
push 0x42dae0
call fcn.004011e0
mov eax, dword [edi]
add esp, 0x18
movzx ecx, word [eax + 0x56a]
cmp cx, bx
jle 0x41a0e5
movsx eax, cx
push 0x430490
sub eax, 0x400
push eax
push 0x42dae4
call fcn.004011e0
mov eax, dword [edi]
add esp, 0xc
movzx eax, word [eax + 0x56a]
test ax, ax
jle 0x41a0ff
cmp ax, bx
jge 0x41a0fb
movsx esi, ax
jmp 0x41a101
mov esi, ebx
jmp 0x41a101
xor esi, esi
push 1
call fcn.00409fbc
push eax
mov eax, dword [edi]
push esi
add eax, 0x56c
push 1
push eax
call fcn.0040a251
push 0x42dae8
call fcn.004011e0
add esp, 0x18
pop edi
pop esi
pop ebx
add esp, 0x428
ret 4

Function at 0x41a140
Capabilities:
Write file on windows

Disassembly:
push esi
push edi
push dword [esp + 0xc]
call fcn.00419ff0
mov edi, dword [esp + 0x10]
mov eax, dword [edi]
movzx ecx, word [eax + 2]
cmp cx, 0x50
jle 0x41a176
movsx eax, cx
push 0x43048b
sub eax, 0x50
push eax
push 0x42da28
call fcn.004011e0
mov eax, dword [edi]
add esp, 0xc
movzx eax, word [eax + 2]
test ax, ax
jle 0x41a191
cmp ax, 0x50
jge 0x41a18a
movsx esi, ax
jmp 0x41a193
mov esi, 0x50
jmp 0x41a193
xor esi, esi
push 1
call fcn.00409fbc
push eax
mov eax, dword [edi]
push esi
add eax, 4
push 1
push eax
call fcn.0040a251
push 0x42da2c
call fcn.004011e0
mov eax, dword [esp + 0x2c]
add esp, 0x18
movsx eax, word [eax]
pop edi
pop esi
cmp eax, 2
jle 0x41a1da
push 0x43048e
add eax, 0xfffffffe
push eax
push 0x42da30
call fcn.004011e0
add esp, 0xc
push 0x20
push 0x42da34
call fcn.004011e0
push 0x5e
push 0x42da38
call fcn.004011e0
add esp, 0x10
ret 0xc
Function at 0x41a2a0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x24
push ebx
mov ebx, dword [esp + 0x40]
push esi
mov esi, dword [esp + 0x34]
push edi
mov edi, dword [esp + 0x3c]
mov dword [esp + 0xc], 0x20
mov ax, word [edi]
mov word [ebx], ax
movzx eax, word [edi]
cmp ax, word [esi + 2]
jg 0x41a2fb
nop dword [eax]
cwde
mov cl, byte [eax + esi + 3]
mov al, cl
sub al, 0x30
cmp al, 9
ja 0x41a2fb
push ecx
lea eax, [esp + 0x10]
push eax
call sym.fxh.exe__string_append1_8
mov ax, word [edi]
inc ax
movzx ecx, ax
mov word [edi], ax
mov eax, ecx
cmp cx, word [esi + 2]
jle 0x41a2d0
mov esi, dword [esp + 0x44]
lea eax, [esp + 0xc]
push esi
push dword [esp + 0x44]
push eax
call sym.fxh.exe__string_t_int_12
push esi
call sym.fxh.exe__sys_error_4
test al, al
je 0x41a3d5
cmp byte [esp + 0x34], 0
je 0x41a3cf
push 1
call fcn.00409fbc
push eax
push 0xd
push 1
push str.Bad_integer__
call fcn.0040a251
mov ax, word [esp + 0x22]
add esp, 0x14
cmp ax, 0x20
jle 0x41a367
cwde
push 0x43048a
sub eax, 0x20
push eax
push 0x42da1c
call fcn.004011e0
mov ax, word [esp + 0x1a]
add esp, 0xc
test ax, ax
jle 0x41a37e
cmp ax, 0x20
jge 0x41a377
movsx esi, ax
jmp 0x41a380
mov esi, 0x20
jmp 0x41a380
xor esi, esi
push 1
call fcn.00409fbc
push eax
push esi
lea eax, [esp + 0x1c]
push 1
push eax
call fcn.0040a251
push 1
call fcn.00409fbc
push eax
push 2
push 1
push 0x42da20
call fcn.0040a251
push 0x42da24
call fcn.004011e0
add esp, 0x2c
push ebx
push dword [esp + 0x54]
push dword [esp + 0x54]
call fcn.0041a140
pop edi
pop esi
pop ebx
add esp, 0x24
ret 0x20
mov ax, word [ebx]
mov word [edi], ax
pop edi
pop esi
pop ebx
add esp, 0x24
ret 0x20
Function at 0x41ada0
Capabilities:
Clear file content

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x91c]
test eax, eax
jne 0x41ae0b
test byte [esi], 2
je 0x41adde
cmp byte [esi + 1], al
jne 0x41adde
push dword [esi + 0x920]
call sub.KERNEL32.dll_SetEndOfFile
test al, al
jne 0x41adde
push 0
push 0x430494
push str.truncate
push 0x42daf0
call sym.fxh.exe__sys_sys_error_bomb_16
cmp byte [esi + 1], 6
je 0x41ae18
push dword [esi + 0x920]
call fcn.00407568
test al, al
jne 0x41ae18
push 0
push 0x430494
push str.close
push 0x42daf0
call sym.fxh.exe__sys_sys_error_bomb_16
jmp 0x41ae18
push esi
call eax
mov dword [esi + 0x91c], 0
add esi, 0x918
cmp dword [esi], 0
je 0x41ae29
push esi
call sym.fxh.exe__sys_mem_dealloc_4
pop esi
ret 4

Function at 0x41b1d0
Capabilities:
Clear file content

Disassembly:
mov eax, dword [esp + 4]
mov eax, dword [eax + 0x918]
cmp byte [eax], 0
jne 0x41b1eb
add eax, 8
mov dword [esp + 4], eax
jmp sym.fxh.exe__file_close_4
ret 4

Function at 0x41b560
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 0x18]
push edi
push esi
call sym.fxh.exe__sys_error_none_4
mov edi, dword [esp + 0x10]
test edi, edi
je 0x41b5f9
push ebx
push dword [0x43053c]
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 0x18]
push edi
push dword [esp + 0x24]
push dword [eax + 0x920]
call sub.KERNEL32.dll_ReadFile
mov ebx, dword [esp + 0x1c]
test al, al
jne 0x41b5bb
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x6d
je 0x41b5c5
mov dword [esi + 0xc], eax
mov eax, ebx
pop ebx
pop edi
pop esi
mov dword [eax], 0
ret 0x14
mov eax, dword [esp + 0x20]
mov dword [ebx], eax
test eax, eax
jne 0x41b5db
push esi
push 1
push 0xfffffffffffffffd
mov dword [ebx], 0
call sym.fxh.exe__sys_stat_set_12
pop ebx
pop edi
pop esi
ret 0x14
cmp eax, edi
jae 0x41b5f8
push esi
push 0xa
push 0xfffffffffffffffd
call sym.fxh.exe__sys_stat_set_12
push esi
push edi
call sym.fxh.exe__sys_stat_parm_int_8
push esi
push dword [ebx]
call sym.fxh.exe__sys_stat_parm_int_8
pop ebx
pop edi
pop esi
ret 0x14
Function at 0x41e5b0
Capabilities:
Get disk information

Disassembly:
push ecx
cmp byte [0x430820], 0
jne 0x41e68f
mov al, byte [0x430821]
push ebx
mov ebx, 0x41
mov dword [0x430824], 0x30004
mov word [0x430829], 0x5c3a
mov byte [0x43082b], al
mov byte [0x430820], 1
mov byte [esp + 7], 0x20
mov byte [esp + 6], 0x20
mov byte [0x430828], bl
nop dword [eax + eax]
push 0x430828
call sub.KERNEL32.dll_GetDriveTypeA
add eax, 0xfffffffe
cmp eax, 3
ja case.default.0x41e612
jmp dword [eax*4 + 0x41e6a4]
mov al, byte [esp + 7]
mov dl, byte [esp + 6]
cmp al, 0x20
jne 0x41e652
mov al, byte [0x430828]
mov byte [esp + 7], al
jmp 0x41e652
cmp byte [esp + 6], 0x20
movzx edx, byte [esp + 6]
movzx eax, byte [0x430828]
cmove edx, eax
mov byte [esp + 6], dl
jmp 0x41e64e
mov dl, byte [esp + 6]
mov al, byte [esp + 7]
inc ebx
mov byte [0x430828], bl
cmp ebx, 0x5a
jle 0x41e600
cmp al, 0x20
je 0x41e67a
pop ebx
push dword [esp + 8]
mov byte [0x430828], al
push 0x430824
call sym.fxh.exe__string_copy_8
pop ecx
ret 4
cmp dl, 0x20
movzx eax, dl
mov ecx, 0x43
cmovne ecx, eax
mov byte [0x430828], cl
pop ebx
push dword [esp + 8]
push 0x430824
call sym.fxh.exe__string_copy_8
pop ecx
ret 4

Function at 0x41e6c0
Capabilities:
Initialize winsock library

Disassembly:
mov eax, 0x106c
call fcn.00406c20
cmp byte [0x430680], 0
jne 0x41e7e9
lea eax, [esp + 4]
push eax
call sym.fxh.exe__sys_error_none_4
push 0x430684
mov word [esp + 4], 0x7f7f
push dword [esp + 4]
mov word [0x430686], 0
call sub.WS2_32.dll_WSAStartup
mov dword [esp + 0x10], eax
lea eax, [esp + 4]
push eax
call sym.fxh.exe__sys_error_4
test al, al
je 0x41e7e2
push ebx
mov word [esp + 4], 1
mov ebx, 1
push 0x430684
push dword [esp + 8]
call sub.WS2_32.dll_WSAStartup
mov dword [esp + 0x14], eax
lea eax, [esp + 8]
push eax
call sym.fxh.exe__sys_error_4
test al, al
jne 0x41e76f
call sub.WS2_32.dll_WSACleanup
test eax, eax
je 0x41e76f
call sub.WS2_32.dll_WSAGetLastError
push 0
push 0x43082c
push str.err_netclose
mov dword [esp + 0x20], eax
lea eax, [esp + 0x14]
push 0x42e160
push eax
call sym.fxh.exe__sys_error_abort_20
mov al, byte [0x430686]
test al, al
jne 0x41e7a7
inc ebx
mov byte [esp + 4], bl
cmp ebx, 0x7f
jle 0x41e722
push 0
push 0x43082c
push str.err_netversion
push 0x42e160
call sym.fxh.exe__sys_message_bomb_16
pop ebx
mov byte [0x430680], 1
add esp, 0x106c
ret
mov byte [esp + 4], al
mov al, byte [0x430687]
push 0x430684
mov byte [esp + 9], al
push dword [esp + 8]
call sub.WS2_32.dll_WSAStartup
push 0
push 0x43082c
push str.err_netstart
mov dword [esp + 0x20], eax
lea eax, [esp + 0x14]
push 0x42e160
push eax
call sym.fxh.exe__sys_error_abort_20
pop ebx
mov byte [0x430680], 1
add esp, 0x106c
ret
Function at 0x41e8b0
Capabilities:
Get hostname

Disassembly:
mov eax, 0x146c
call fcn.00406c20
lea eax, [esp]
mov dword [esp], 0x400
push eax
lea eax, [esp + 8]
push eax
call sub.KERNEL32.dll_GetComputerNameA
test al, al
jne 0x41e90a
lea eax, [esp + 0x404]
push eax
call sym.fxh.exe__sys_error_none_4
call sub.KERNEL32.dll_GetLastError
push 0
push 0x430894
push str.node_name_get
mov dword [esp + 0x41c], eax
lea eax, [esp + 0x410]
push 0x42e458
push eax
call sym.fxh.exe__sys_error_abort_20
push dword [esp]
lea eax, [esp + 8]
push eax
push dword [esp + 0x1478]
call sym.fxh.exe__string_vstring_12
push dword [esp + 0x1470]
call sym.fxh.exe__string_downcase_4
add esp, 0x146c
ret 4

Function at 0x41ea40
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x480c
call fcn.00406c20
push esi
mov esi, dword [esp + 0x4818]
mov eax, 0x400
push edi
mov edi, dword [esp + 0x4818]
mov word [esp + 0xc], ax
mov eax, 0x2000
mov word [esp + 0x2810], ax
lea eax, [esp + 0xc]
push esi
push eax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 1
push eax
push edi
call sym.fxh.exe__string_token_16
push esi
call sym.fxh.exe__sys_error_4
test al, al
jne 0x41eb89
lea eax, [esp + 0x2810]
push eax
lea eax, [esp + 0x10]
push eax
call sym.fxh.exe__string_treename_8
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x2814]
push eax
call sym.fxh.exe__string_token_make_8
push 0x400
lea eax, [esp + 0x414]
push eax
lea eax, [esp + 0x14]
push eax
call sym.fxh.exe__string_t_c_12
xor eax, eax
mov word [esp + 0x2812], ax
lea eax, [esp + 0xc]
push esi
push eax
lea eax, [esp + 0x10]
push eax
push edi
call sym.fxh.exe__string_token_16
push esi
call sym.fxh.exe__string_eos_4
test al, al
jne 0x41eb33
push esi
call sym.fxh.exe__sys_error_4
test al, al
jne 0x41eb89
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x2814]
push eax
call sym.fxh.exe__string_append_token_8
push esi
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
push eax
push edi
call sym.fxh.exe__string_token_16
push esi
call sym.fxh.exe__string_eos_4
test al, al
je 0x41eaf8
push 0x2000
lea eax, [esp + 0x814]
push eax
lea eax, [esp + 0x2818]
push eax
call sym.fxh.exe__string_t_c_12
push dword [0x42e620]
lea eax, [esp + 0x814]
push 0x4308a4
push eax
lea eax, [esp + 0x41c]
push eax
push 0x4308a4
push dword [0x4308a0]
call sub.SHELL32.dll_ShellExecuteA
cmp eax, 0x20
ja 0x41eb89
push esi
add eax, 0x64
push eax
push 0xffffffffffffffff
call sym.fxh.exe__sys_stat_set_12
pop edi
pop esi
add esp, 0x480c
ret 8
Function at 0x41efe0
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push esi
call sym.fxh.exe__sys_error_none_4
push dword [0x42e51c]
push dword [esp + 0xc]
call sub.KERNEL32.dll_TerminateProcess
test al, al
jne 0x41f006
call sub.KERNEL32.dll_GetLastError
mov dword [esi + 0xc], eax
pop esi
ret 8

Function at 0x41f850
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x24]
push esi
call sym.fxh.exe__sys_error_none_4
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0x10
push eax
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0x20]
push dword [eax + 0x920]
call sub.WS2_32.dll_getsockname
test eax, eax
je 0x41f892
call sub.WS2_32.dll_WSAGetLastError
mov dword [esi + 0xc], eax
pop esi
add esp, 0x10
ret 0x10
push 4
lea eax, [esp + 0xc]
push eax
call sym.fxh.exe__sys_order_flip_8
push 2
lea eax, [esp + 0xa]
push eax
call sym.fxh.exe__sys_order_flip_8
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 8]
pop esi
mov dword [ecx], eax
mov ecx, dword [esp + 0x1c]
mov ax, word [esp + 2]
mov word [ecx], ax
add esp, 0x10
ret 0x10

Function at 0x41f920
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x24]
push edi
push esi
call sym.fxh.exe__sys_error_none_4
call sym.fxh.exe__sys_sys_netstart_0
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov edi, eax
cmp edi, 0xffffffff
jne 0x41f956
call sub.WS2_32.dll_WSAGetLastError
pop edi
mov dword [esi + 0xc], eax
pop esi
add esp, 0x10
ret 0x10
lea eax, [esp + 8]
push eax
call sym.fxh.exe__file_inet_sockaddr_init_4
mov eax, dword [esp + 0x1c]
mov dword [esp + 0xc], eax
mov ax, word [esp + 0x20]
mov word [esp + 0xa], ax
lea eax, [esp + 0xc]
push 4
push eax
call sym.fxh.exe__sys_order_flip_8
push 2
lea eax, [esp + 0xe]
push eax
call sym.fxh.exe__sys_order_flip_8
push dword [0x42e638]
lea eax, [esp + 0xc]
push eax
push edi
call sub.WS2_32.dll_connect
test eax, eax
jne 0x41f946
mov esi, dword [esp + 0x24]
push esi
call fcn.0041fec0
mov dword [esi + 0x920], edi
pop edi
pop esi
add esp, 0x10
ret 0x10
Function at 0x41f9c0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
push ebx
mov ebx, dword [ebp + 0x1c]
push esi
push edi
push ebx
call sym.fxh.exe__sys_error_none_4
mov esi, dword [ebp + 8]
mov esi, dword [esi + 0x918]
test esi, esi
jne 0x41fa0a
push 1
call fcn.00409fbc
push eax
push 0x36
push 1
push 0x42e640
call fcn.0040a251
push 0x42e678
call fcn.004011e0
add esp, 0x18
call sym.fxh.exe__sys_bomb_0
mov ecx, dword [ebp + 0x18]
xor al, al
mov edi, dword [ebp + 0xc]
mov edx, edi
mov dword [esp + 0x1c], edx
mov byte [esp + 0x1b], al
mov dword [ecx], 0
test edi, edi
je 0x41fbcb
lea edi, [esi + 0x808]
cmp dword [edi], 0
jbe 0x41fa5e
mov eax, dword [esi + 0x80c]
mov ebx, dword [ebp + 0x14]
inc dword [ebp + 0x14]
mov al, byte [eax + esi + 8]
mov byte [ebx], al
dec dword [edi]
inc dword [esi + 0x80c]
inc dword [ecx]
dec edx
mov ebx, dword [ebp + 0x1c]
mov dword [esp + 0x1c], edx
jmp 0x41fb6a
cmp dword [ecx], 0
jbe 0x41fa6d
test byte [ebp + 0x10], 2
jne 0x41fbbb
mov dword [esi + 0x80c], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
test al, al
jne 0x41faa8
push 0x4308b4
push 0
push 1
push dword [0x4308b0]
call sub.KERNEL32.dll_CreateEventA
mov dword [esp + 0x3c], eax
mov byte [esp + 0x1b], 1
lea eax, [esp + 0x2c]
push eax
push edi
push dword [0x42e63c]
lea eax, [esi + 8]
push eax
mov eax, dword [ebp + 8]
push dword [eax + 0x920]
call sub.KERNEL32.dll_ReadFile
test al, al
jne 0x41fb5e
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x3e5
jne 0x41fb7c
movss xmm0, dword [esi]
xorps xmm1, xmm1
or eax, 0xffffffff
comiss xmm0, xmm1
jbe 0x41fb2e
movsd xmm1, qword [0x421230]
sub esp, 8
cvtps2pd xmm0, xmm0
mulsd xmm0, qword [0x426620]
maxsd xmm1, xmm0
addsd xmm1, qword [0x421220]
movsd qword [esp + 0x28], xmm1
fld qword [esp + 0x28]
fstp qword [esp]
call fcn.0040b690
fstp qword [esp + 0x28]
cvttsd2si eax, qword [esp + 0x28]
add esp, 8
push eax
push dword [esp + 0x40]
call sub.KERNEL32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x41fb81
cmp eax, 0xffffffff
je 0x41fb77
push 1
push edi
lea eax, [esp + 0x34]
push eax
mov eax, dword [ebp + 8]
push dword [eax + 0x920]
call sub.KERNEL32.dll_GetOverlappedResult
test al, al
je 0x41fb77
cmp dword [edi], 0
je 0x41fb8d
mov ecx, dword [ebp + 0x18]
mov edx, dword [esp + 0x1c]
test edx, edx
je 0x41fbbb
mov al, byte [esp + 0x1b]
jmp 0x41fa30
call sub.KERNEL32.dll_GetLastError
mov dword [ebx + 0xc], eax
jmp 0x41fbbb
push ebx
push 0x20
push 0xfffffffffffffffd
call sym.fxh.exe__sys_stat_set_12
jmp 0x41fbbb
mov esi, dword [ebp + 0x18]
push ebx
cmp dword [esi], 0
jne 0x41fba1
push 1
push 0xfffffffffffffffd
call sym.fxh.exe__sys_stat_set_12
jmp 0x41fbbb
push 0xa
push 0xfffffffffffffffd
call sym.fxh.exe__sys_stat_set_12
push ebx
push dword [ebp + 0xc]
call sym.fxh.exe__sys_stat_parm_int_8
push ebx
push dword [esi]
call sym.fxh.exe__sys_stat_parm_int_8
cmp byte [esp + 0x1b], 0
je 0x41fbcb
push dword [esp + 0x3c]
call fcn.00407568
mov eax, dword [ebx + 0xc]
cmp eax, 0x208
je 0x41fbda
cmp eax, 0x40
jne 0x41fbe4
push ebx
push 1
push 0xfffffffffffffffd
call sym.fxh.exe__sys_stat_set_12
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x41fbf0
Capabilities:
Create tcp socket
Create udp socket
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x10
push esi
push edi
mov edi, dword [esp + 0x28]
push edi
call sym.fxh.exe__sys_error_none_4
call sym.fxh.exe__sys_sys_netstart_0
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov esi, dword [esp + 0x24]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
jne 0x41fc2b
call sub.WS2_32.dll_WSAGetLastError
mov dword [edi + 0xc], eax
pop edi
pop esi
add esp, 0x10
ret 0x10
lea eax, [esp + 8]
push eax
call sym.fxh.exe__file_inet_sockaddr_init_4
mov ax, word [esp + 0x20]
mov word [esp + 0xa], ax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push 4
push eax
call sym.fxh.exe__sys_order_flip_8
push 2
lea eax, [esp + 0xe]
push eax
call sym.fxh.exe__sys_order_flip_8
push dword [0x42e634]
lea eax, [esp + 0xc]
push eax
push dword [esi + 4]
call sub.WS2_32.dll_bind
test eax, eax
jne 0x41fcc2
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0x10
push eax
lea eax, [esp + 0xc]
push eax
push dword [esi + 4]
call sub.WS2_32.dll_getsockname
test eax, eax
jne 0x41fcc2
push 4
lea eax, [esp + 0x10]
push eax
call sym.fxh.exe__sys_order_flip_8
push 2
lea eax, [esp + 0xe]
push eax
call sym.fxh.exe__sys_order_flip_8
mov ax, word [esp + 0xa]
push 8
push dword [esi + 4]
mov word [esi], ax
call sub.WS2_32.dll_listen
test eax, eax
je 0x41fcd2
call sub.WS2_32.dll_WSAGetLastError
mov dword [edi + 0xc], eax
push dword [esi + 4]
call sub.WS2_32.dll_closesocket
pop edi
pop esi
add esp, 0x10
ret 0x10

Function at 0x41fce0
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
mov esi, dword [esp + 0x18]
push esi
call sym.fxh.exe__sys_error_none_4
mov eax, dword [esp + 0xc]
push 0x10
push dword [eax + 0x918]
push 0
push dword [esp + 0x1c]
push dword [esp + 0x18]
push dword [eax + 0x920]
call sub.WS2_32.dll_sendto
mov ecx, eax
mov eax, dword [esp + 0x14]
test ecx, ecx
jns 0x41fd28
mov dword [eax], 0
call sub.WS2_32.dll_WSAGetLastError
mov dword [esi + 0xc], eax
pop esi
ret 0x14
mov dword [eax], ecx
cmp ecx, dword [esp + 0x10]
je 0x41fd3a
push esi
push 0x1c
push 0xfffffffffffffffd
call sym.fxh.exe__sys_stat_set_12
pop esi
ret 0x14
Function at 0x41fd40
Capabilities:
Create udp socket

Disassembly:
push esi
mov esi, dword [esp + 0x14]
push edi
push esi
call sym.fxh.exe__sys_error_none_4
call sym.fxh.exe__sys_sys_netstart_0
push 0
push 2
push 2
call sub.WS2_32.dll_socket
mov edi, eax
cmp edi, 0xffffffff
jne 0x41fd70
call sub.WS2_32.dll_WSAGetLastError
pop edi
mov dword [esi + 0xc], eax
pop esi
ret 0x10
lea eax, [esp + 0x18]
push eax
push 0x10
call sym.fxh.exe__sys_mem_alloc_8
mov eax, dword [esp + 0x18]
mov ecx, 2
push 4
mov word [eax], cx
mov ecx, dword [esp + 0x1c]
mov ax, word [esp + 0x14]
mov word [ecx + 2], ax
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x1c]
add eax, 4
push eax
call sym.fxh.exe__sys_order_flip_8
mov eax, dword [esp + 0x18]
push 2
add eax, 2
push eax
call sym.fxh.exe__sys_order_flip_8
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov dword [ecx + 0x920], edi
pop edi
mov word [ecx], 0xa03
mov byte [ecx + 2], 0
mov dword [ecx + 4], 0x400
mov dword [ecx + 0x408], 0x100
mov dword [ecx + 0x50c], 0x400
mov dword [ecx + 0x910], 0
mov dword [ecx + 0x914], 0xfffffffe
mov dword [ecx + 0x918], eax
mov dword [ecx + 0x91c], 0x41f8f0
pop esi
ret 0x10