joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431c20
Capabilities:
Check os version

Disassembly:
mov ecx, dword [0x5eda74]
cmp ecx, 0xffffffff
jne 0x431d17
push esi
xor esi, esi
cmp dword [0x5eda78], ecx
jne 0x431d16
cmp dword [0x5fdc90], esi
jne 0x431c6c
push 0x5fdc90
mov dword [0x5fdc90], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call fcn.0053b400
add esp, 4
test eax, eax
je 0x431d1a
mov edx, dword [0x5fdc94]
mov eax, dword [0x5fdc98]
push edi
movzx edi, word [0x5fdda4]
cmp edx, 0xa
jg 0x431ce3
jne 0x431c91
test eax, eax
jns 0x431ce3
mov esi, 6
jmp 0x431ce8
cmp edx, 6
jg 0x431c8a
jne 0x431cc0
cmp eax, 3
jge 0x431c8a
cmp eax, 2
jge 0x431cb9
cmp eax, 1
jge 0x431cb2
test eax, eax
js 0x431cdc
mov esi, 3
jmp 0x431ce8
mov esi, 4
jmp 0x431ce8
mov esi, 5
jmp 0x431ce8
cmp edx, 5
jg 0x431cdc
jne 0x431ce8
cmp eax, 2
jge 0x431cdc
cmp eax, 1
jge 0x431cdc
test eax, eax
js 0x431ce8
mov esi, 1
jmp 0x431ce8
mov esi, 2
jmp 0x431ce8
mov esi, 7
mov dword [0x5eda7c], eax
mov ecx, esi
mov eax, dword [0x5fdc9c]
mov dword [0x5eda80], eax
mov eax, dword [0x5fdca0]
mov dword [0x5eda88], edi
mov dword [0x5eda74], ecx
mov dword [0x5eda78], edx
mov dword [0x5eda84], eax
pop edi
pop esi
mov eax, ecx
ret
push str.GetVersionEx_failed__m
push 0x55
call fcn.004205f0
int3

Function at 0x431e30
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [0x5eda78]
push ebx
push esi
xor esi, esi
push edi
cmp ecx, 0xffffffff
je 0x431e69
mov edx, dword [0x5eda80]
mov esi, dword [0x5eda74]
mov eax, dword [0x5eda7c]
mov ebx, dword [0x5eda84]
mov edi, dword [0x5eda88]
mov dword [ebp - 4], edx
jmp 0x431f44
cmp dword [0x5fdc90], esi
jne 0x431e97
push 0x5fdc90
mov dword [0x5fdc90], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call fcn.0053b400
add esp, 4
test eax, eax
je 0x431f84
mov ecx, dword [0x5fdc94]
mov edx, dword [0x5fdc9c]
mov eax, dword [0x5fdc98]
mov ebx, dword [0x5fdca0]
movzx edi, word [0x5fdda4]
mov dword [ebp - 4], edx
cmp ecx, 0xa
jg 0x431f1c
jne 0x431eca
test eax, eax
jns 0x431f1c
mov esi, 6
jmp 0x431f21
cmp ecx, 6
jg 0x431ec3
jne 0x431ef9
cmp eax, 3
jge 0x431ec3
cmp eax, 2
jge 0x431ef2
cmp eax, 1
jge 0x431eeb
test eax, eax
js 0x431f15
mov esi, 3
jmp 0x431f21
mov esi, 4
jmp 0x431f21
mov esi, 5
jmp 0x431f21
cmp ecx, 5
jg 0x431f15
jne 0x431f21
cmp eax, 2
jge 0x431f15
cmp eax, 1
jge 0x431f15
test eax, eax
js 0x431f21
mov esi, 1
jmp 0x431f21
mov esi, 2
jmp 0x431f21
mov esi, 7
mov dword [0x5eda74], esi
mov dword [0x5eda78], ecx
mov dword [0x5eda7c], eax
mov dword [0x5eda80], edx
mov dword [0x5eda84], ebx
mov dword [0x5eda88], edi
mov edx, dword [ebp + 8]
test edx, edx
je 0x431f4d
mov dword [edx], esi
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x431f56
mov dword [edx], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x431f5f
mov dword [ecx], eax
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x431f6b
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x431f74
mov dword [eax], ebx
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x431f7d
mov dword [eax], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.GetVersionEx_failed__m
push 0x55
call fcn.004205f0
int3
Function at 0x431fa0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
push 0x4320e0
lea eax, [ebp - 0xc]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp + 4]
sub eax, 4
push eax
call fcn.00420810
mov edi, eax
mov dword [ebp - 8], 0
lea eax, [ebp - 4]
mov dword [ebp - 0xc], edi
push 0x104
push eax
or ebx, 0xffffffff
call fcn.004222c0
add esp, 0x14
cmp dword [ebp + 0x10], 0
je 0x432026
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
push eax
call sub.WTSAPI32.dll_WTSQueryUserToken
push eax
call fcn.0053b400
add esp, 4
test eax, eax
jne 0x432026
push str.failed_get_token_for_active_user__m
push edi
call fcn.004218d0
push dword [edi]
push 0x550003
call fcn.00424230
add esp, 0x10
jmp 0x4320b7
push dword [ebp - 4]
mov ebx, dword [ebp + 0xc]
push 0
push dword [ebp - 8]
push ebx
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x43205e
push ebx
push str.failed_get_path_for_cid__d
push edi
call fcn.00421960
push dword [edi]
push 0x550003
call fcn.00424230
add esp, 0x14
or ebx, 0xffffffff
jmp 0x4320b7
push esi
push dword [ebp - 4]
mov esi, dword [ebp + 8]
push esi
call fcn.00421a30
mov edx, dword [esi]
add esp, 8
test edx, edx
je 0x432098
cmp byte [edx], 0
je 0x432098
mov ecx, edx
lea esi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x432080
sub ecx, esi
cmp byte [edx + ecx - 1], 0x5c
jne 0x432094
mov byte [edx + ecx - 1], al
xor ebx, ebx
jmp 0x4320b6
push ebx
push str.got_empty_path_for__d
push edi
call fcn.00421960
push dword [edi]
push 0x550003
call fcn.00424230
add esp, 0x14
or ebx, 0xffffffff
pop esi
cmp dword [ebp + 0x10], 0
je 0x4320c9
lea eax, [ebp - 8]
push eax
call fcn.004438e0
add esp, 4
lea eax, [ebp - 4]
push eax
call fcn.00422230
add esp, 4
mov eax, ebx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x433510
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x3d
push edi
call fcn.0053f1e0
mov ecx, dword [ebp + 0xc]
add ecx, edi
test eax, eax
mov dword [ebp + 0xc], ecx
cmove eax, ecx
sub eax, 3
mov si, word [eax]
mov bl, byte [eax + 2]
sub eax, edi
push eax
lea eax, [edi + 3]
push edi
push eax
call fcn.0053f9f0
mov eax, dword [ebp + 0x14]
add esp, 0x14
mov ecx, dword [ebp + 0x10]
add eax, ecx
mov word [edi], si
mov byte [edi + 2], bl
mov ebx, ecx
cmp byte [edi], 0
mov dword [ebp - 4], eax
je 0x433627
lea eax, [ecx + 3]
mov dword [ebp + 8], eax
nop word [eax + eax]
cmp edi, dword [ebp + 0xc]
jae 0x433624
mov al, byte [edi]
cmp al, 0x3d
je 0x43358f
movzx eax, al
cmp byte [eax + 0x5edad8], 0xff
je 0x433624
mov edx, edi
xor esi, esi
xor eax, eax
lea ecx, [edx + 1]
mov dword [ebp + 0x14], ecx
nop dword [eax + eax]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x4335a0
sub edx, dword [ebp + 0x14]
cmp edx, 4
jb 0x433635
xor edx, edx
mov cl, byte [edx + edi]
shl eax, 6
cmp cl, 0x3d
jne 0x4335c3
inc esi
jmp 0x4335d3
test esi, esi
jne 0x433635
movzx ecx, cl
movsx ecx, byte [ecx + 0x5edad8]
add eax, ecx
inc edx
cmp edx, 4
jl 0x4335b5
cmp esi, 2
ja 0x433635
cmp eax, 0xffffffff
je 0x433635
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
add ecx, esi
cmp edx, ecx
ja 0x433635
mov ecx, eax
inc edx
shr ecx, 0x10
mov byte [ebx], cl
inc ebx
mov dword [ebp + 8], edx
cmp esi, 2
jae 0x43360c
mov ecx, eax
shr ecx, 8
mov byte [ebx], cl
inc ebx
inc edx
mov dword [ebp + 8], edx
cmp esi, 1
jae 0x433618
mov byte [ebx], al
inc ebx
inc edx
mov dword [ebp + 8], edx
add edi, 4
cmp byte [edi], 0
jne 0x433570
mov ecx, dword [ebp + 0x10]
mov byte [ebx], 0
sub ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x433640
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x433651
mov ebx, dword [ebp + 8]
sub esi, ecx
mov eax, esi
cdq
and edx, 3
add eax, edx
sar eax, 2
lea eax, [eax + eax*2]
push eax
push ebx
mov dword [ebp + 0xc], eax
call fcn.00421a80
mov eax, dword [ebx]
push 0x3d
push edi
mov dword [ebp - 4], eax
call fcn.0053f1e0
add esp, 0x10
test eax, eax
jne 0x433691
lea eax, [esi + edi]
mov dword [ebp - 8], eax
jmp 0x433697
lea ecx, [esi + edi]
mov dword [ebp - 8], ecx
mov si, word [eax - 3]
sub eax, 3
mov bl, byte [eax + 2]
sub eax, edi
push eax
lea eax, [edi + 3]
push edi
push eax
call fcn.0053f9f0
mov eax, dword [ebp + 0xc]
add esp, 0xc
mov ecx, dword [ebp - 4]
add eax, ecx
mov word [edi], si
mov byte [edi + 2], bl
mov ebx, ecx
cmp byte [edi], 0
mov dword [ebp - 0x10], eax
je 0x433783
lea eax, [ecx + 3]
mov dword [ebp + 0xc], eax
cmp edi, dword [ebp - 8]
jae 0x433780
mov al, byte [edi]
cmp al, 0x3d
je 0x4336f2
movzx eax, al
cmp byte [eax + 0x5edad8], 0xff
je 0x433780
mov edx, edi
xor esi, esi
xor eax, eax
lea ecx, [edx + 1]
mov dword [ebp - 0xc], ecx
nop
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x433700
sub edx, dword [ebp - 0xc]
cmp edx, 4
jb 0x43378d
xor edx, edx
mov cl, byte [edx + edi]
shl eax, 6
cmp cl, 0x3d
jne 0x43371f
inc esi
jmp 0x43372f
test esi, esi
jne 0x43378d
movzx ecx, cl
movsx ecx, byte [ecx + 0x5edad8]
add eax, ecx
inc edx
cmp edx, 4
jl 0x433711
cmp esi, 2
ja 0x43378d
cmp eax, 0xffffffff
je 0x43378d
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 0xc]
add ecx, esi
cmp edx, ecx
ja 0x43378d
mov ecx, eax
inc edx
shr ecx, 0x10
mov byte [ebx], cl
inc ebx
mov dword [ebp + 0xc], edx
cmp esi, 2
jae 0x433768
mov ecx, eax
shr ecx, 8
mov byte [ebx], cl
inc ebx
inc edx
mov dword [ebp + 0xc], edx
cmp esi, 1
jae 0x433774
mov byte [ebx], al
inc ebx
inc edx
mov dword [ebp + 0xc], edx
add edi, 4
cmp byte [edi], 0
jne 0x4336d3
mov ecx, dword [ebp - 4]
mov byte [ebx], 0
sub ebx, ecx
cmp ebx, 0xffffffff
jne 0x4337ae
mov ebx, dword [ebp + 8]
mov ecx, dword [ebx]
test ecx, ecx
je 0x4337a5
push ecx
call fcn.00541560
add esp, 4
mov dword [ebx], 0
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4337e0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
add edi, esi
cmp esi, edi
jae 0x4338c0
mov ecx, dword [ebp + 0x14]
mov edx, eax
add edx, 0xfffffffc
add ecx, edx
lea edx, [esi + 1]
mov dword [ebp - 4], ecx
lea ecx, [esi + 2]
mov dword [ebp + 0xc], ecx
mov dword [ebp + 8], edx
cmp edx, edi
jb 0x43381d
xor bh, bh
jmp 0x43381f
mov bh, byte [edx]
cmp ecx, edi
jb 0x433827
xor bl, bl
jmp 0x433829
mov bl, byte [ecx]
cmp eax, dword [ebp - 4]
jae 0x4338dd
movzx ecx, byte [esi]
shr ecx, 2
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], cl
movsx edx, byte [esi]
inc esi
and edx, 3
movzx ecx, bh
shr ecx, 4
shl edx, 4
or edx, ecx
movzx ecx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 1], cl
lea ecx, [eax + 3]
mov dword [ebp - 8], ecx
mov byte [ecx], 0x3d
mov byte [eax + 2], 0x3d
mov byte [eax + 4], 0
cmp esi, edi
je 0x4338cd
movsx edx, byte [esi]
inc esi
and edx, 0xf
movzx ecx, bl
shl edx, 2
shr ecx, 6
or edx, ecx
mov cl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov edx, dword [ebp - 8]
mov byte [eax + 2], cl
lea eax, [edx + 1]
cmp esi, edi
je 0x4338c0
movsx ecx, byte [esi]
inc esi
and ecx, 0x3f
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx], cl
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
add edx, 3
add ecx, 3
mov dword [ebp + 8], edx
mov dword [ebp + 0xc], ecx
cmp esi, edi
jb 0x433815
pop edi
pop esi
mov byte [eax], 0
sub eax, dword [ebp + 0x10]
pop ebx
mov esp, ebp
pop ebp
ret
add eax, 4
pop edi
pop esi
pop ebx
mov byte [eax], 0
sub eax, dword [ebp + 0x10]
mov esp, ebp
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x434120
Capabilities:
Connect pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x439210
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 4]
sub eax, 4
push eax
call fcn.00420810
add esp, 0xc
mov dword [ebp - 4], eax
push dword [0x5fde54]
call fcn.0053b9e0
push eax
push str..pipehola__d__d
push dword [ebp - 4]
call fcn.00421960
inc dword [0x5fde54]
mov ecx, 7
mov edi, dword [ebp + 0x10]
mov eax, 1
push 0
push 0xffffffffffffffff
push 0x1000
push 0x1000
test edi, edi
push 0xff
cmovne eax, ecx
push eax
mov eax, dword [ebp - 4]
push 0x40000003
push dword [eax]
call fcn.00443960
mov ebx, eax
add esp, 0x30
test ebx, ebx
je 0x43424b
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
cmp dword [ebp + 0xc], 1
mov ecx, 0xc0000000
push 0
push 0x40000000
push 3
push 0
mov eax, 0x40000000
cmove eax, ecx
push 0
push eax
mov eax, dword [ebp - 4]
push dword [eax]
call fcn.00443910
mov esi, eax
add esp, 0x1c
test esi, esi
je 0x43425a
mov eax, edi
neg eax
push 0
sbb eax, eax
and eax, 2
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
push eax
call fcn.0053b400
add esp, 4
test eax, eax
je 0x434269
cmp dword [ebp + 0x10], 0
mov eax, 0x44
mov edi, 0x24
cmovne edi, eax
lea eax, [ebp + 0x10]
push eax
push edi
push 0
push 0
push esi
call fcn.00433930
mov esi, dword [ebp + 8]
mov dword [esi + 4], eax
lea eax, [ebp + 0x10]
push eax
push edi
push 0
push 0
push ebx
call fcn.00433930
add esp, 0x28
mov dword [esi], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.CreateNamedPipe_failed:__m
push 0x360000
call fcn.00424790
push str.CreateFile_failed:__m
push 0x360000
call fcn.00424790
push str.SetNamedPipeHandleState_failed:__m
push 0x360000
call fcn.00424790
int3
Function at 0x434280
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x601894], 0
push ebx
mov ebx, dword fs:[0x2c]
push esi
push edi
mov edi, dword [ebp + 8]
je 0x4342e7
mov eax, dword [ebx]
cmp dword [eax + 0x21d0], 0
jne 0x4342e7
push 0x601860
call fcn.00429200
mov eax, dword [0x60188c]
push 0x601860
mov esi, dword [eax + edi*4]
call fcn.00429210
add esp, 8
test dword [esi + 0x58], 0x10000000
jne 0x4342e7
push 0
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.00434400
add esp, 0x18
pop edi
pop esi
pop ebx
pop ebp
ret
push 0x601860
call fcn.00429200
mov eax, dword [0x60188c]
push 0x601860
mov esi, dword [eax + edi*4]
call fcn.00429210
mov eax, dword [esi + 0x58]
add esp, 8
test al, 0x40
je 0x4343e2
cmp dword [esi + 0x3c], 0
je 0x434341
cmp dword [esi + 0xc], 2
jne 0x434341
cmp word [esi + 0x5c], 0
je 0x434341
push 0
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.0043a410
add esp, 0x18
mov esi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
test eax, reloc.WS2_32.dll_connect
je 0x434363
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.0043a210
add esp, 0x14
mov esi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
test al, 1
je 0x4343bc
push dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
push edi
push dword [ebp + 0xc]
push dword [esi + 0x60]
call dword [sym.imp.WS2_32.dll_recv]
push eax
call fcn.0053b400
mov esi, eax
add esp, 4
test esi, esi
jns 0x4343db
mov eax, dword [ebx]
mov eax, dword [eax + 0x28f0]
test eax, eax
jne 0x43439a
call fcn.00541542
cmp dword [eax], 0x2738
jne 0x4343db
push edi
push str.buf_to_small___d__for_packet_recv
push 0x360003
call fcn.00424230
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret
push eax
push str.invalid_type:__d
push 0x75c
push str.vsock_recv
push 0x360202
call fcn.004245a0
add esp, 0x14
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
push str.recv_from_non_packet_socket
push 0x360000
call fcn.00424790
int3
Function at 0x436bc0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
push ebx
push esi
push edi
push 0x439210
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 4]
sub eax, 4
push eax
call fcn.00420810
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov edi, dword [ebp + 0xc]
xorps xmm0, xmm0
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov dword [ebp - 0x38], 0x570a6c
mov dword [ebp - 0x34], 0x570a74
mov dword [ebp - 0x30], str.except
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], 0
movq qword [ebp - 0x40], xmm0
test edi, edi
je 0x436d35
xor esi, esi
mov eax, edi
mov dword [ebp - 0xc], esi
xor ebx, ebx
cmp dword [eax], ebx
jbe 0x436d20
xor ecx, ecx
lea edx, [ebp - 0x144]
cmp eax, dword [ebp + 0x14]
cmovne edx, ecx
cmp eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x144]
mov dword [ebp - 0x18], edx
cmovne ecx, ebx
cmp eax, edi
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x144]
cmovne ecx, ebx
add eax, 4
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], eax
mov edi, dword [eax]
lea eax, [ebp - 0x40]
push eax
push edx
push dword [ebp - 0x10]
mov dword [ebp - 0x140], edi
push dword [ebp - 0x14]
mov dword [ebp - 0x144], 1
push 1
call dword [sym.imp.WS2_32.dll_select]
push eax
call fcn.0053b400
add esp, 4
test eax, eax
jns 0x436d04
push 0x601860
call fcn.00429200
mov ecx, dword [0x60187c]
add esp, 4
mov edx, dword [0x60188c]
xor esi, esi
test ecx, ecx
jle 0x436cd3
mov eax, dword [edx + esi*4]
test eax, eax
je 0x436cd3
cmp dword [eax + 0x60], edi
je 0x436cd3
inc esi
cmp esi, ecx
jl 0x436cc2
cmp esi, ecx
je 0x436cdd
cmp dword [edx + esi*4], 0
jne 0x436ce0
or esi, 0xffffffff
push 0x601860
call fcn.00429210
push esi
mov esi, dword [ebp - 0xc]
push edi
push ebx
push dword [ebp + esi - 0x38]
push str._s__d__osfd_d_vfd_d_
push dword [ebp - 8]
call fcn.00421610
add esp, 0x1c
mov ecx, dword [ebp + esi - 0x28]
inc ebx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
add eax, 4
mov dword [ebp - 4], eax
cmp ebx, dword [ecx]
jb 0x436c71
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + esi - 0x24]
add esi, 4
mov dword [ebp - 0xc], esi
test eax, eax
jne 0x436c33
mov eax, dword [ebp - 8]
push 0x570a9c
push eax
call fcn.00421ec0
mov eax, dword [ebp - 8]
add esp, 8
push dword [eax]
push str.vsock_select__:_a_member_of_fd_set_was_invalid:__s
push 0x360000
call fcn.00424790
int3
Function at 0x436e20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x2c]
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [eax]
mov eax, dword [edi + 0x28f0]
test eax, eax
jne 0x436e40
call fcn.00541542
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0xe0]
lea ebx, [esi + 0xd4]
movups xmmword [eax], xmm0
mov dword [eax + 0x10], 0
mov eax, dword [esi + 0xe0]
mov dword [eax + 0x10], esi
lock inc dword [ebx]
push dword [esi + 0x6c]
or dword [esi + 0x58], 0x400
call fcn.00447ff0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push dword [esi + 0x6c]
call fcn.00447f50
push esi
call fcn.0043b230
add esp, 0x18
push 0x4353e0
push dword [esi + 0xe0]
push dword [ebp - 4]
push dword [ebp - 8]
push dword [esi + 0x60]
call dword [sym.imp.KERNEL32.dll_ReadFileEx]
push eax
call fcn.0053b400
add esp, 4
mov dword [ebp + 8], eax
test eax, eax
jne 0x436f99
mov eax, dword [edi + 0x28f0]
test eax, eax
jne 0x436ed6
call fcn.00541542
push 0x15
push 6
push 0xe8
push 1
push 4
push dword [eax]
call fcn.00433ba0
add esp, 0x18
test eax, eax
je 0x436fbc
push 0x601860
call fcn.00429200
mov ecx, dword [esi + 0xbc]
add esp, 4
cmp esi, dword [0x601838]
jne 0x436f18
mov dword [0x601838], ecx
jmp 0x436f2a
mov eax, dword [esi + 0xc0]
mov dword [eax + 0xbc], ecx
mov ecx, dword [0x601838]
mov edx, dword [esi + 0xbc]
test edx, edx
je 0x436f42
mov eax, dword [esi + 0xc0]
mov dword [edx + 0xc0], eax
jmp 0x436f52
test ecx, ecx
je 0x436f52
mov eax, dword [esi + 0xc0]
mov dword [ecx + 0xc0], eax
push 0x601860
mov dword [esi + 0xbc], 0
mov dword [esi + 0xc0], 0
call fcn.00429210
or dword [esi + 0x58], 0x4100000
push esi
call fcn.0043b2c0
and dword [esi + 0x58], 0xfffffbff
add esp, 8
or eax, 0xffffffff
lock xadd dword [ebx], eax
jne 0x436f99
push esi
call fcn.00434b80
add esp, 4
mov eax, dword [edi + 0x28f0]
pop edi
pop esi
pop ebx
test eax, eax
jne 0x436fab
call fcn.00541542
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
xor eax, eax
cmp dword [ebp + 8], eax
sete al
mov esp, ebp
pop ebp
ret
push str.cant_read_from_handle:__m
push 0x360000
call fcn.00424790
int3
Function at 0x436fd0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
push edi
mov eax, dword [esi + 0xe0]
lea ebx, [esi + 0xd4]
movups xmmword [eax], xmm0
mov dword [eax + 0x10], 0
mov eax, dword [esi + 0xe0]
mov dword [eax + 0x10], esi
lock inc dword [ebx]
or dword [esi + 0x58], 0x400
push esi
call fcn.0043b230
add esp, 4
lea eax, [esi + 0x100]
push 0x4353e0
push dword [esi + 0xe0]
push 1
push eax
push dword [esi + 0x60]
call dword [sym.imp.KERNEL32.dll_ReadFileEx]
mov edi, eax
push edi
call fcn.0053b400
add esp, 4
test eax, eax
jne 0x43706f
mov ecx, dword fs:[0x2c]
mov ecx, dword [ecx]
mov eax, dword [ecx + 0x28f0]
test eax, eax
jne 0x437052
call fcn.00541542
push 6
push 0x6d
push 0xe8
push 3
push dword [eax]
call fcn.00433ba0
add esp, 0x14
test eax, eax
je 0x437123
test edi, edi
jne 0x43711e
push 0x601860
call fcn.00429200
mov ecx, dword [esi + 0xbc]
add esp, 4
cmp esi, dword [0x601838]
jne 0x43709a
mov dword [0x601838], ecx
jmp 0x4370ac
mov eax, dword [esi + 0xc0]
mov dword [eax + 0xbc], ecx
mov ecx, dword [0x601838]
mov edx, dword [esi + 0xbc]
test edx, edx
je 0x4370c4
mov eax, dword [esi + 0xc0]
mov dword [edx + 0xc0], eax
jmp 0x4370d4
test ecx, ecx
je 0x4370d4
mov eax, dword [esi + 0xc0]
mov dword [ecx + 0xc0], eax
push 0x601860
mov dword [esi + 0xbc], 0
mov dword [esi + 0xc0], 0
call fcn.00429210
and dword [esi + 0x58], 0xfffffbff
add esp, 4
or eax, 0xffffffff
lock xadd dword [ebx], eax
jne 0x43710e
push esi
call fcn.00434b80
add esp, 4
or dword [esi + 0x58], 0x100000
push esi
call fcn.0043b2c0
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
ret
push str.cant_read_from_handle:__m
push 0x360000
call fcn.00424790
int3
Function at 0x4377c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
test dword [esi + 0x58], 0x2000
je 0x4377dd
call sub.ntdll.dll_NtTestAlert
pop esi
mov esp, ebp
pop ebp
ret
push ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push dword [esi + 0x70]
call fcn.00448340
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x43796b
mov eax, dword [esi + 0xe4]
xorps xmm0, xmm0
or dword [esi + 0x58], 0x2000
movups xmmword [eax], xmm0
mov dword [eax + 0x10], 0
mov eax, dword [esi + 0xe4]
mov dword [eax + 0x10], esi
lea eax, [esi + 0xd4]
lock inc dword [eax]
push esi
call fcn.0043b3a0
add esp, 4
push 0x4354f0
push dword [esi + 0xe4]
push dword [ebp - 4]
push dword [ebp - 8]
push dword [esi + 0x60]
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
push eax
call fcn.0053b400
mov ebx, dword fs:[0x2c]
add esp, 4
mov dword [ebp + 8], eax
test eax, eax
jne 0x437948
push edi
mov edi, dword [ebx]
mov eax, dword [edi + 0x28f0]
test eax, eax
jne 0x437877
call fcn.00541542
cmp dword [eax], 0xe8
jne 0x437980
mov eax, dword [edi + 0x28f0]
pop edi
test eax, eax
jne 0x437893
call fcn.00541542
cmp dword [eax], 0xe8
jne 0x437945
push 0x601860
call fcn.00429200
mov ecx, dword [esi + 0xb4]
add esp, 4
cmp esi, dword [0x60183c]
jne 0x4378c2
mov dword [0x60183c], ecx
jmp 0x4378d4
mov eax, dword [esi + 0xb8]
mov dword [eax + 0xb4], ecx
mov ecx, dword [0x60183c]
mov edx, dword [esi + 0xb4]
test edx, edx
je 0x4378ec
mov eax, dword [esi + 0xb8]
mov dword [edx + 0xb8], eax
jmp 0x4378fc
test ecx, ecx
je 0x4378fc
mov eax, dword [esi + 0xb8]
mov dword [ecx + 0xb8], eax
push 0x601860
mov dword [esi + 0xb4], 0
mov dword [esi + 0xb8], 0
call fcn.00429210
mov eax, dword [esi + 0x58]
lea ecx, [esi + 0xd4]
and eax, 0xffffdfff
add esp, 4
or eax, 0x4000000
mov dword [esi + 0x58], eax
or eax, 0xffffffff
lock xadd dword [ecx], eax
jne 0x437945
push esi
call fcn.00434b80
add esp, 4
mov eax, dword [ebp + 8]
cmp dword [ebp - 4], 0
je 0x43796b
test eax, eax
jne 0x43797a
mov eax, dword [ebx]
mov eax, dword [eax + 0x28f0]
test eax, eax
jne 0x437963
call fcn.00541542
cmp dword [eax], 0xe8
jne 0x43797a
mov eax, dword [esi + 0x58]
test al, 0x10
jne 0x43797a
and eax, 0xffffdfff
mov dword [esi + 0x58], eax
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
push str.WriteFileEx_failed:__m
push 0x360000
call fcn.00424790
int3