joyce8/EMBER2024-capa huggingface dataset:
Function at 0x476302
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0xeabf8baa
xor edi, ecx
or dword [esp], 0x28bdb2b4
shr dword [esp], 0x86
jbe 0x466853
mov edx, 0xe2326b85
movsx ecx, dx
mov ecx, dword [esi + ecx*8 - 0x35c28]
btr edx, edx
lea eax, [edx*8 - 0x7deaa5f]
not dx
lea esi, [eax + esi - 0x9b4b1c5]
xor ecx, ebx
bt edx, edx
inc ecx
not eax
not edx
imul ax, ax
not ecx
mul edx
rol edx, 0x43
xchg edx, eax
ror ecx, 1
inc edx
push eax
bts eax, edx
dec ecx
and dl, 0x1b
sal eax, 0x25
xchg byte [esp + 1], dl
ror ecx, 1
add dword [esp], edx
xor ebx, ecx
mul edx
inc dword [esp + eax*8 - 0x71eaf000]
seta byte [esp + eax - 0xe3d5dfe]
lea edi, [eax + edi - 0xe3d5e04]
sub ax, dx
setns byte [esp + eax - 0xe3da8ab]
mov dword [edi + eax*4 - 0x38f6a2ac], ecx
movzx ecx, ax
jbe 0x4a6f24
test al, 0x29
movzx edi, byte [eax + edi - 0x74390000]
jge 0x433858
or al, 0xe
inc edi
push 0xda69d423
sub ah, byte [edi - 0x5cda6dfa]
popfd
inc esi
insd dword es:[edi], dx
invalid
mov edx, dword [esi + eax*2 - 0x1c7b5156]
adc cx, 0x4703
adc byte [esp + eax - 0xe3da8ab], cl
lea esi, [esi + eax - 0xe3da8a7]
xor eax, eax
xor edx, ebx
xchg ecx, eax
call fcn.0049d2b5
not al
sub al, 0x9c
ror edx, 0xff
neg al
bt dx, 0x3c
movzx ecx, byte [esp]
xchg word [esp + ecx], dx
xor bl, al
lea eax, [esp + eax + 4]
dec ecx
mov cx, word [eax]
sub edi, 2
ror word [esp + 1], 0xe9
mov word [edi], cx
or dword [esp], edx
pop eax
ja fcn.004584fe
Function at 0x47799a
Capabilities:
Encode data using base64

Disassembly:
mov word [edi + eax - 0x461efff5], cx
rol ax, 0x49
rol al, 0x62
jb fcn.004584fe
add byte [eax], al
inc ebp
js 0x4386ea
jns 0x43870c
je 0x438700
insd dword es:[edi], dx
push esp
imul ebp, dword [ebp + 0x65], 0x6f4c6f54
arpl word [ecx + 0x6c], sp
push esp
imul ebp, dword [ebp + 0x65], 0xcabb0f00
add byte [ebx], dh
leave
enter 0xf66, 0xffffffffffffffab
ror byte [ebx + 0x377d3894], 0xcc
bt cx, cx
bt cx, cx
mov al, byte [eax + edi - 0xc33c87f]
jae 0x449770
mov eax, 0xf0965199
movsx ecx, al
mov eax, dword [edi]
push ecx
sar cx, 0xc3
mov ecx, dword [edi + 4]
call fcn.0048d311
sub ch, dl
inc ebx
push 0xda6d3005
or al, 0x81
loop 0x4386d8
and eax, 0x69a2a7f5
ficom dword [ebx + 0x78]
jl 0x4387b7
fimul dword [0x964b2a09]
and eax, 0x96b36cee
and eax, 0x94d3d77b
and eax, 0x6ab3e4e1
fisub dword [ebp - 0x25970135]
push es
pop esp
mov ecx, 0x319c2c7f
pushfd
sar edi, 0xb9
xchg ecx, eax
add dword [edx + 0x10], esp
rcl dl, cl
fidiv dword [edi - 0x61]
pop ss
clc
ret 0xa017
aas
xchg ebx, eax
jbe 0x43876e
fsub st(4)
lds ebp, [ebx - 0xc]
lds esp, [edx]
adc byte [esi + 0x598d86ba], 7
mov ds, word [esi - 0x79]
and bl, 0xe8
jecxz 0x4387a1
enter 0x6e70, 0x34
mov ah, 0xf6
dec eax
pop es
iretd
lea edi, [edi + ecx*4 - 0x30cf21fe]
neg cl
or ecx, ecx
bt ecx, ecx
mov byte es:[edx + ecx*2 - 0x186790fe], al
movsx edx, cl
movzx eax, dx
neg dl
mov edx, dword [ecx + esi - 0xc33c87f]
or ecx, eax
adc eax, 0x9b0664bc
seto cl
lea esi, [esi + ecx - 0xc33c7fc]
xor cl, cl
shr cl, 0x25
xor edx, ebx
inc ax
and eax, eax
lea edx, [edx + ecx*8 + 0x6f90af0d]
sar ecx, 0x59
xor edx, 0x43a43624
neg edx
xor cl, ah
ror cx, cl
bswap ecx
ror edx, 1
ror ecx, 0x92
sal ax, 0x63
call fcn.0043393b
call fcn.0046120b
xor dl, bl
sub dl, 0xd
xor dl, 0x97
sub dl, 0x9b
not dl
sub cx, word [esp + eax*4 - 0x9ff2]
sbb dl, 0x9b
sub eax, 0xcc21eabb
xchg word [esp + eax*2 - 0x67bc7a84], cx
sub dword [esp + eax - 0x33de3d42], ecx
neg dl
pop eax
xor bl, dl
bt cx, 0x15
adc edx, esp
jmp 0x4840a2
shl dword [esp + ecx - 0x5ba12c24], 0x75
mov cx, word [edi + ecx - 0x5ba12c26]
lea edi, [edx + edi - 0x2f2effff]
neg dx
je 0x46ae97
and ax, cx
lea ecx, [edx + edx + 0x51a738aa]
inc dl
rol edx, cl
not ax
rol byte [esp + edx - 0x2fff0028], 0x81
shl word [esp + edx - 0x2fff0027], 0xef
sub dword [esp + edx - 0x2fff0026], ecx
mov word [edx + edi - 0x2fff002f], ax
or cx, 0x5ab7
pop eax
adc eax, 0x21041
jmp eax
jmp 0x491b1f
mov cx, word [edx + eax - 0x461efff5]
lea edi, [edi + eax - 0x461efff7]
jmp 0x43867d

Function at 0x480d6a
Capabilities:
Encode data using base64

Disassembly:
rol al, 1
mov dword [esp + eax - 0xffff], ecx
sub dx, ax
idiv cl
inc word [esp + eax - 0xff00]
sar byte [esp + eax - 0xfefd], 2
xor bx, dx
lea edi, [edi + eax*2 - 0x1fe02]
shr ax, 0x2f
mov word [edi + eax*4 - 4], dx
lea edx, [ecx*2 + 0x4a9be0b]
sbb edx, 0xf000063a
not dx
mov edx, dword [esi + eax*2 - 2]
setns cl
sub byte [esp + eax*2], 0xa4
lea esi, [esi + eax*8 - 4]
or cl, ah
sete cl
xor edx, ebx
xadd ecx, eax
call fcn.00474e31
Function at 0x4842e6
Capabilities:
Encode data using base64

Disassembly:
test ebx, ebx
jmp 0x42cc1d
adc eax, edx
mov dword [esp], 0x1b154ca8
push 0xa888a9b8
ror dword [esp + 4], 0x4a
mov dword [ebp - 4], eax
push 0xa90f5723
jae 0x458384

Function at 0x492f16
Capabilities:
Encode data using base64

Disassembly:
inc dx
dec ax
xor dx, 0x67a6
call fcn.00480d6a
xor dx, bx
pop eax
mov eax, 0x979f22a5
mov ecx, eax
inc dx
xor eax, eax
not dx
xor cl, 0xa9
jne 0x47f887

Function at 0x493160
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x10]
je 0x42d6b7
push 0x25b7141e
test ebx, ebx
push 0xa7bc0e98
jmp 0x461ac0

Function at 0x49d2b5
Capabilities:
Encode data using base64

Disassembly:
neg edx
ror ecx, 0x1d
inc edx
xchg byte [esp + eax - 0xefab], cl
neg edx
xor edx, 0xeb2d0280
add al, cl
btr eax, eax
xor ebx, edx
or word [esp + eax - 0xef58], 0x5c83
adc ebp, edx
mul byte [esp + eax - 0xef58]
pop edx
pop eax
jb fcn.004584fe

Function at 0x4a0f2b
Capabilities:
Encode data using base64

Disassembly:
setae byte [esp]
push 0x24a96e00
adc edi, 3
push 0x7994bfa4
shrd ax, dx, cl
mov word [edi], ax
mov ecx, 0xd1aedfb2
mov ecx, dword [esi]
shr word [esp + 8], 6
adc esi, 4
mov eax, dword [esp + 6]
movzx edx, ax
xor ecx, ebx
call fcn.0046f2bc
bswap esi
bts bx, bx
bts ebx, ebx
lea esi, [eax + esi + 0x3feb7759]
jae 0x47f92f
and eax, 0x11467a8
dec ax
neg esi
shr bx, 0xc7
sar eax, 0x2e
sbb esi, 0x8422cd1a
div al
sal eax, 0xd7
rol eax, 0xd1
not esi
not bl
imul eax, eax
shl bx, 0xc1
inc esi
push ecx
neg ax
push ebp
mov ebp, 0
ror eax, 0xcc
movzx ecx, ax
ror ecx, cl
mov dword [esp + eax*4 - 0x34], ebp
ror al, 0x25
idiv al
add esi, ebp
sal ebx, 0x2d
shl cx, 0xa3
mov dword [esp + eax*4 - 0x3e0], edi
movsx ebp, bl
xor cx, bp
movsx edi, cx
mov dword [esp + eax - 0xdf], edx
add edi, esp
inc cx
add bl, ah
rol ebp, cl
lea eax, [edi + eax*2 - 0x2e2]
mov esp, eax
mov ebx, esi
mov ecx, 0x2d96d41c
movsx edx, cx
movsx eax, cl
mov edx, 0
sub ebx, edx
mov ebp, 0x899e4f87
movsx edx, bp
lea ebp, [0x47e7f2]
mov ecx, edx
mov ecx, dword [edx + esi - 0x4f87]
lea esi, [esi + edx - 0x4f83]
shl edx, 0x47
movsx eax, dl
xor ecx, ebx
neg ecx
inc dx
lea ecx, [ecx + edx*2 - 0x6367870e]
xor ecx, 0xcb1e51b8
dec ecx
not dl
mul edx
ror ecx, 2
bt edx, 0x84
setb al
inc ecx
lea edx, [eax*4 + 0x109e3a0a]
or ax, 0x8f15
xor ebx, ecx
shr ax, 0x4e
sub ax, ax
adc ebp, ecx
jmp ebp
mov ax, word [edi + edx*2 - 0xb07be2e]
rol edx, 0x9c
mov dx, word [edi + edx - 0x70583def]
push 0x818c012c
mov ecx, dword [esp]
mov cl, byte [edi + 4]
jb 0x450030
not al
mov dword [esp + eax - 0x1938f27d], ebx
push esi
pushfd
mov esi, dword [esp + eax*2 - 0x3271e4e2]
inc eax
mov ebx, 0xcd256cbc
add bx, bx
xor esi, 0x1e0f9193
add eax, 0x2a04330f
rol eax, 0x5e
jb 0x47e750

Function at 0x4a3a3b
Capabilities:
Encode data using base64

Disassembly:
inc eax
push 0x6e8a1105
xor edx, 0x7a3981bb
mov dword [esp + 4], 0xc4adc6b4
jmp 0x478046
push 0xec9d5001
dec ecx
push 0x949b028c
call fcn.0045c6d1
xor edx, esi
jmp 0x451b4b
Function at 0x4a8251
Capabilities:
Encode data using xor

Disassembly:
pop edx
pop eax
pop ecx
pop eax
pop ecx
pop edx
pop eax
jl fcn.004584fe
mov esi, 0xbb68495e
adc byte ss:[ebx - 0x795bfbdb], bl
lcall 0xda67, 0x87966025
shr dh, cl
pop ebx
fcmovu st(0), st(7)
fisub dword fs:[ebp + 0x37]
and byte [edi + 0x6031c325], bl
pushal
ficom dword [esi - 0x76]
mov esi, 0x9c2fda62
sub ah, byte [0x2559259c]
jmp 0x4a82ed
mov eax, 0x4f4ac89c
adc dword [esi - 0x3e], edx
invalid
Function at 0x408cf8
Capabilities:
Get common file path
Get program files directory

Disassembly:
push 0x170
mov eax, 0x6d4950
call fcn.0057bf64
mov esi, ecx
mov dword [ebp - 0x17c], esi
xor ebx, ebx
mov dword [ebp - 0x17c], esi
push 0xf
pop edi
mov dword [ebp - 0x120], ebx
mov byte [ebp - 0x130], bl
mov dword [ebp - 0x11c], edi
cmp byte [ebp + 8], bl
je 0x408e03
lea eax, [ebp - 0x118]
mov dword [ebp - 4], ebx
push eax
push ebx
push ebx
push 0x26
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea ecx, [ebp - 0x130]
test eax, eax
js 0x408eba
lea eax, [ebp - 0x118]
push eax
call fcn.004024ce
push str.JiSu
lea ecx, [ebp - 0x148]
mov dword [ebp - 0x138], ebx
mov dword [ebp - 0x134], edi
mov byte [ebp - 0x148], bl
call fcn.004024ce
push 0x78b534
lea edx, [ebp - 0x130]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x178]
call fcn.0040a446
lea ecx, [ebp - 0x148]
mov byte [ebp - 4], 2
push ecx
mov edx, eax
lea ecx, [ebp - 0x160]
call fcn.0040267c
pop ecx
pop ecx
push str.Application
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.00402325
push eax
mov ecx, esi
call fcn.00402367
lea ecx, [ebp - 0x160]
call fcn.004024a8
lea ecx, [ebp - 0x178]
call fcn.004024a8
lea ecx, [ebp - 0x148]
call fcn.004024a8
lea ecx, [ebp - 0x130]
call fcn.004024a8
jmp 0x408ec7
lea eax, [ebp - 0x118]
mov dword [ebp - 4], 4
push eax
push ebx
push ebx
push 0x1c
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea ecx, [ebp - 0x130]
test eax, eax
js 0x408eba
lea eax, [ebp - 0x118]
push eax
call fcn.004024ce
push str.JiSu
lea ecx, [ebp - 0x148]
mov dword [ebp - 0x138], ebx
mov dword [ebp - 0x134], edi
mov byte [ebp - 0x148], bl
call fcn.004024ce
push 0x78b534
lea edx, [ebp - 0x130]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x160]
call fcn.0040a446
lea ecx, [ebp - 0x148]
mov byte [ebp - 4], 6
push ecx
mov edx, eax
lea ecx, [ebp - 0x178]
call fcn.0040267c
pop ecx
pop ecx
push str.Application
mov ecx, eax
mov byte [ebp - 4], 7
call fcn.00402325
push eax
mov ecx, esi
call fcn.00402367
lea ecx, [ebp - 0x178]
call fcn.004024a8
lea ecx, [ebp - 0x160]
jmp 0x408de3
call fcn.004024a8
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], edi
mov byte [esi], bl
mov eax, esi
call fcn.0057bf0e
ret
Function at 0x40d726
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x324
mov eax, dword [0x7bee5c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov edx, ecx
push esi
push edi
push 0x41
pop ecx
mov dword [ebp - 0x104], edx
lea esi, [ebp - 0x108]
mov dword [ebp - 0x108], 1
lea edi, [ebp - 0x20c]
rep movsd dword es:[edi], dword [esi]
push 0x41
pop ecx
lea esi, [ebp - 0x108]
mov dword [ebp - 0x324], eax
mov eax, dword [ebp + 0x10]
lea edi, [ebp - 0x310]
rep movsd dword es:[edi], dword [esi]
push 4
mov dword [ebp - 0x314], edx
mov dword [ebp - 0x320], eax
pop edi
lea eax, [ebp - 0x324]
push eax
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [edx + 1]
push eax
call dword [sym.imp.WS2_32.dll_select]
mov esi, eax
test esi, esi
jns 0x40d7c9
call fcn.0069c39a
cmp dword [eax], edi
jne 0x40d7c7
mov edx, dword [ebp - 0x314]
jmp 0x40d78a
test esi, esi
jne 0x40d7cf
push 0xd
jmp 0x40d846
test esi, esi
jle 0x40d844
mov esi, dword [sym.imp.WS2_32.dll___WSAFDIsSet]
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x314]
call esi
test eax, eax
jne 0x40d7ff
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x314]
call esi
test eax, eax
je 0x40d844
lea eax, [ebp - 0x31c]
mov dword [ebp - 0x31c], edi
push eax
lea eax, [ebp - 0x318]
xor esi, esi
push eax
push 0x1007
push 0xffff
push dword [ebp - 0x314]
mov dword [ebp - 0x318], esi
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
js 0x40d83d
cmp dword [ebp - 0x318], esi
je 0x40d840
push 2
pop esi
mov eax, esi
jmp 0x40d847
push 2
pop eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0057b43c
leave
ret
Function at 0x40da14
Capabilities:
Connect socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 4]
push esi
mov esi, dword [sym.imp.WS2_32.dll_ioctlsocket]
push edi
push eax
push 0x8004667e
push ebx
mov edi, ecx
mov dword [ebp - 4], 1
call esi
mov eax, dword [ebp + 0xc]
push dword [eax + 0x10]
push dword [eax + 0x18]
push ebx
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jns 0x40da91
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x40da6a
mov eax, dword [edi + 4]
mov dword [eax], 2
xor al, al
jmp 0x40db1d
mov eax, dword [edi + 0xc]
mov ecx, ebx
push dword [eax + 4]
push dword [eax]
mov eax, dword [edi + 8]
push dword [eax + 4]
push dword [eax]
call fcn.0040d726
mov ecx, dword [edi + 4]
add esp, 0x10
mov dword [ecx], eax
mov eax, dword [edi + 4]
cmp dword [eax], 0
jne 0x40da63
and dword [ebp + 8], 0
lea eax, [ebp + 8]
push eax
push 0x8004667e
push ebx
call esi
mov eax, dword [edi + 0x14]
push 0
push 0x3e8
push dword [eax + 4]
push dword [eax]
call fcn.0057c260
mov esi, dword [sym.imp.WS2_32.dll_setsockopt]
mov ecx, eax
mov eax, dword [edi + 0x10]
push 4
imul eax, dword [eax], 0x3e8
add ecx, eax
lea eax, [ebp + 8]
push eax
push 0x1006
push 0xffff
push ebx
mov dword [ebp + 8], ecx
call esi
mov eax, dword [edi + 0x1c]
push 0
push 0x3e8
push dword [eax + 4]
push dword [eax]
call fcn.0057c260
mov ecx, eax
mov eax, dword [edi + 0x18]
push 4
imul eax, dword [eax], 0x3e8
add ecx, eax
mov dword [ebp + 8], ecx
lea ecx, [ebp + 8]
push ecx
push 0x1005
push 0xffff
push ebx
call esi
mov ecx, dword [edi + 4]
mov al, 1
and dword [ecx], 0
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x40db24
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x7bee5c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push 2
mov dword [ebp - 0x40c], eax
mov ebx, edx
pop ecx
movzx eax, word [esi]
cmp ax, cx
je 0x40db5a
cmp eax, 0x17
jne 0x40dbb6
movzx eax, word [esi + 2]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
mov ecx, dword [ebp - 0x40c]
movzx eax, ax
push 0x401
push 0
mov dword [ecx], eax
lea eax, [ebp - 0x408]
push eax
call fcn.00695a40
add esp, 0xc
lea eax, [ebp - 0x408]
push 2
push 0
push 0
push 0x401
push eax
push ebx
push esi
call dword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
jne 0x40dbb6
lea eax, [ebp - 0x408]
mov ecx, edi
push eax
call fcn.004024ce
mov al, 1
jmp 0x40dbb8
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0057b43c
leave
ret
Function at 0x41002f
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x90
mov eax, dword [0x7bee5c]
xor eax, esp
mov dword [esp + 0x8c], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [esp + 8]
push edi
mov edi, dword [ebp + 0xc]
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x10], 0x80
push eax
push dword [ecx + 4]
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x410081
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push edi
push esi
call fcn.0040db24
pop ecx
pop ecx
mov ecx, dword [esp + 0x94]
pop edi
pop esi
xor ecx, esp
call fcn.0057b43c
mov esp, ebp
pop ebp
ret 8

Function at 0x417bd2
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x417bf9
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004188d5
jmp 0x417cae
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x417c1b
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x417c1d
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x417ca2
jg 0x417c32
test esi, esi
je 0x417ca2
test ecx, ecx
jl 0x417c7b
jg 0x417c3c
test eax, eax
je 0x417c7b
cmp edi, ecx
jg 0x417c50
jl 0x417c46
cmp esi, eax
jae 0x417c50
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call fcn.006954c0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x417c7e
mov edx, dword [ebp + 8]
test edi, edi
jl 0x417ca2
jg 0x417c88
test esi, esi
je 0x417ca2
cmp dword [ebx + 0x4c], 0
je 0x417ca2
push dword [ebx + 0x4c]
push esi
push 1
push edx
call fcn.0069f112
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x417cb7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x417cde
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041899e
jmp 0x417dad
mov eax, dword [edi + 0x1c]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], eax
test eax, eax
je 0x417d00
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x417d02
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test ebx, ebx
jl 0x417da1
jg 0x417d1f
test esi, esi
je 0x417da1
test ecx, ecx
jl 0x417d6c
jg 0x417d29
test eax, eax
je 0x417d6c
cmp ebx, ecx
jg 0x417d3d
jl 0x417d33
cmp esi, eax
jae 0x417d3d
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
push eax
push dword [esp + 0x18]
push dword [ebp + 8]
call fcn.006954c0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [edi + 0x2c]
add edx, ecx
sub esi, ecx
mov dword [esp + 0xc], edx
sbb ebx, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x417d73
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
test ebx, ebx
jl 0x417da1
jg 0x417d7d
test esi, esi
je 0x417da1
cmp dword [edi + 0x4c], 0
je 0x417da1
mov ecx, edi
call fcn.00419b84
push dword [edi + 0x4c]
push esi
push 1
push dword [esp + 0x18]
call fcn.0069d465
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x418032
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x7bee5c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, edi
jne 0x418058
xor eax, eax
jmp 0x41811f
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x418081
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
add eax, ecx
cmp ecx, eax
jae 0x418081
dec dword [edx]
mov eax, ebx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
jmp 0x41811f
cmp dword [esi + 0x4c], 0
je 0x41811d
mov ecx, esi
call fcn.00419b84
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4180ae
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.0069d75c
cmp eax, edi
pop ecx
pop ecx
cmovne edi, ebx
jmp 0x41811d
mov byte [ebp - 0x25], bl
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call edx
test eax, eax
js 0x41811d
cmp eax, 1
jle 0x4180ec
cmp eax, 3
jne 0x41811d
push dword [esi + 0x4c]
movsx ecx, byte [ebp - 0x25]
push ecx
jmp 0x4180a0
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
sub eax, ecx
mov dword [ebp - 0x30], eax
je 0x41810f
push dword [esi + 0x4c]
push eax
mov eax, ecx
push 1
push eax
call fcn.0069f112
add esp, 0x10
cmp dword [ebp - 0x30], eax
jne 0x41811d
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x34], eax
mov eax, ebx
jne 0x41811f
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0057b43c
leave
ret 4

Function at 0x419c0c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x7bee5c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x419c90
cmp byte [esi + 0x3d], 0
je 0x419c90
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x419c62
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x419c66
sub eax, 1
je 0x419c6a
dec eax
sub eax, 1
je 0x419c90
xor al, al
jmp 0x419c92
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x419c87
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0069f112
add esp, 0x10
cmp edi, eax
jne 0x419c62
cmp byte [esi + 0x3d], 0
sete al
jmp 0x419c92
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0057b43c
leave
ret
Function at 0x41b6f8
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
push 0x48
mov eax, 0x6d6c6a
call fcn.0057bf64
xor edi, edi
xorps xmm0, xmm0
mov dword [ebp - 4], edi
mov esi, edi
movlpd qword [ebp - 0x44], xmm0
movlpd qword [ebp - 0x3c], xmm0
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0x48], edi
cmp dword [edx + 0x10], edi
je 0x41b73d
cmp dword [edx + 0x14], 0x10
mov esi, edx
jb 0x41b731
mov esi, dword [edx]
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x54], 4
jmp 0x41b755
cmp dword [ecx + 0x10], edi
je 0x41b74c
cmp dword [ecx + 0x14], 0x10
mov esi, ecx
jb 0x41b74c
mov esi, dword [ecx]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x54], edi
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x28]
call fcn.004036dd
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push ecx
cmovae eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x54]
push ecx
push eax
push esi
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x41b83c
mov esi, dword [ebp - 0x2c]
test esi, esi
je 0x41b835
push 0x81
push edi
push edi
push dword [esi + 0xc]
push dword [esi + 8]
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_WSASocketW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x41b7c5
push dword [esi + 0xc]
push dword [esi + 8]
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
cmp edi, 0xffffffff
je 0x41b824
cmp byte [ebp + 0x14], 0
je 0x41b7e1
push 4
xor ecx, ecx
lea eax, [ebp - 0x30]
push eax
inc ecx
push ecx
push 6
push edi
mov dword [ebp - 0x30], ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov ecx, dword [ebp + 0x3c]
test ecx, ecx
je 0x41b7f4
mov dword [ebp - 0x30], edi
lea edx, [ebp - 0x30]
mov eax, dword [ecx]
push edx
call dword [eax + 8]
cmp dword [esi + 4], 0x17
jne 0x41b80f
and dword [ebp - 0x34], 0
lea eax, [ebp - 0x34]
push 4
push eax
push 0x1b
push 0x29
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
push esi
push edi
lea ecx, [ebp + 0x40]
call fcn.0040da14
test al, al
jne 0x41b86e
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
mov esi, dword [esi + 0x1c]
push 0
pop edi
test esi, esi
jne 0x41b792
mov esi, dword [ebp - 0x2c]
push esi
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
or edi, 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004024a8
mov dword [ebp - 4], 4
mov ecx, dword [ebp + 0x3c]
test ecx, ecx
je 0x41b866
mov esi, dword [ecx]
lea eax, [ebp + 0x18]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov eax, edi
call fcn.0057bf0e
ret
push dword [ebp - 0x2c]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
jmp 0x41b83f