joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002867b
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x1013a420]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, ecx
mov dword [ebp - 0x8c], 0x80
push edi
mov dword [ebp - 0x90], eax
mov esi, dword [eax + 0x3f8]
mov edi, dword [eax]
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x88]
push eax
mov eax, dword [esi + 0x154]
push 0
add eax, 4
push eax
push dword [esi + 0x15c]
push dword [esi + 0x14]
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [esi + 0x148], 0
mov dword [esi + 0x14c], eax
jne 0x1002870b
push dword [ebp - 0x8c]
lea eax, [ebp - 0x88]
push eax
lea eax, [esi + 0xc8]
push eax
call fcn.1003da60
mov eax, dword [ebp - 0x8c]
add esp, 0xc
mov dword [esi + 0x148], eax
mov ebx, dword [esi + 0x14c]
cmp ebx, 4
jge 0x1002873d
push str.Received_too_short_packet
push edi
call fcn.10018208
pop ecx
pop ecx
mov dword [esi + 0xc], 7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003890f
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 0x15c]
movzx eax, byte [ecx]
shl ax, 8
movzx edx, ax
movzx eax, byte [ecx + 1]
or edx, eax
mov dword [esi + 0xc], edx
sub edx, 3
je 0x100287bd
dec edx
je 0x10028832
dec edx
je 0x10028793
dec edx
je 0x1002877a
push str.Internal_error:_Unexpected_packet
push 0x1012fdc0
push edi
call fcn.10018208
jmp 0x100287b8
lea eax, [ebx - 2]
lea edx, [ecx + 2]
mov ecx, esi
push eax
call fcn.10027902
pop ecx
test eax, eax
je 0x10028832
jmp 0x1002872c
mov edx, ecx
movzx eax, byte [edx + 2]
shl ax, 8
movzx ecx, ax
movzx eax, byte [edx + 3]
or ecx, eax
lea eax, [edx + 4]
push eax
push 0x1012fbd0
push edi
mov dword [esi + 8], ecx
call fcn.10018194
add esp, 0xc
jmp 0x10028832
cmp ebx, 4
jle 0x10028832
movzx eax, byte [ecx + 2]
shl ax, 8
movzx edx, ax
movzx eax, byte [ecx + 3]
or edx, eax
movzx eax, word [esi + 0x40]
inc eax
and eax, 0xffff
cmp eax, edx
jne 0x10028832
lea eax, [ebx - 4]
add ecx, 4
push eax
xor edx, edx
push ecx
mov ecx, dword [ebp - 0x90]
inc edx
call fcn.1001851e
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x10028810
push 5
pop edx
mov ecx, esi
call fcn.10028443
mov eax, ebx
jmp 0x1002872c
mov eax, dword [esi + 0x14c]
sub eax, 4
cdq
add dword [edi + 0x38], eax
mov eax, dword [edi + 0x38]
adc dword [edi + 0x3c], edx
mov dword [edi + 0x450], eax
mov eax, dword [edi + 0x3c]
mov dword [edi + 0x454], eax
mov ecx, dword [ebp - 0x90]
call fcn.1001fcac
test eax, eax
je 0x1002872a
push 5
pop edx
mov ecx, esi
call fcn.10028443
push 0x2a
pop eax
jmp 0x1002872c
Function at 0x10029c0e
Capabilities:
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1013a420]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x1c], 0x10
push edi
lea ecx, [ebp - 0x1c]
or edi, 0xffffffff
push ecx
mov eax, dword [esi + 0x134]
lea ecx, [ebp - 0x14]
mov ebx, dword [esi]
push ecx
push eax
mov dword [ebp - 0x18], eax
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x10029c65
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x10
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.WS2_32.dll_accept]
mov edi, eax
mov edx, dword [ebp - 0x18]
mov ecx, esi
call fcn.1001753e
cmp edi, 0xffffffff
jne 0x10029c86
push str.Error_accept__ing_server_connect
push ebx
call fcn.10018208
pop ecx
pop ecx
push 0x1e
pop eax
jmp 0x10029cea
push str.Connection_accepted_from_server_n
push ebx
call fcn.10018194
pop ecx
pop ecx
lea eax, [ebp - 0x18]
mov dword [esi + 0x134], edi
push eax
push 0x8004667e
push edi
mov dword [ebp - 0x18], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
xor ecx, ecx
inc ecx
mov dword [esi + 0x13c], ecx
mov eax, dword [ebx + 0x16c]
test eax, eax
je 0x10029ce8
push ecx
push edi
push dword [ebx + 0x170]
call eax
add esp, 0xc
test eax, eax
je 0x10029ce8
mov edx, edi
mov ecx, esi
call fcn.1001753e
or dword [esi + 0x134], 0xffffffff
push 0x2a
jmp 0x10029c83
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003890f
mov esp, ebp
pop ebp
ret
Function at 0x1002b7b4
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, edx
mov dword [ebp - 4], 0x64
mov eax, ebx
cdq
idiv dword [ebp - 4]
push esi
push edi
mov edi, ecx
xor esi, esi
mov ecx, dword [edi]
cmp eax, 2
je 0x1002b7e8
push str.Couldnt_set_desired_mode
push ecx
call fcn.10018208
pop ecx
pop ecx
push 0x11
pop eax
jmp 0x1002b83d
cmp ebx, 0xc8
je 0x1002b7ff
push ebx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push ecx
call fcn.10018194
add esp, 0xc
mov eax, dword [ebp + 8]
cmp eax, 0x13
jne 0x1002b810
mov ecx, edi
call fcn.1002aa82
jmp 0x1002b839
cmp eax, 0x14
jne 0x1002b81e
mov ecx, edi
call fcn.1002aac8
jmp 0x1002b839
cmp eax, 0x15
jne 0x1002b827
push 0xd
jmp 0x1002b82e
cmp eax, 0x16
jne 0x1002b83b
push 0xe
xor edx, edx
mov ecx, edi
inc edx
call fcn.1002ae87
pop ecx
mov esi, eax
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1002dc5e
Capabilities:
Parse pe header

Disassembly:
movsx eax, cl
add eax, 0xffffff9f
cmp eax, 0x19
ja case.default.0x1002dc69
jmp dword [eax*4 + 0x1002dcc2]
mov al, 0x41
ret
mov al, 0x42
ret
mov al, 0x43
ret
mov al, 0x44
ret
mov al, 0x45
ret
mov al, 0x46
ret
mov al, 0x47
ret
mov al, 0x48
ret
mov al, 0x49
ret
mov al, 0x4a
ret
mov al, 0x4b
ret
mov al, 0x4c
ret
mov al, 0x4d
ret
mov al, 0x4e
ret
mov al, 0x4f
ret
mov al, 0x50
ret
mov al, 0x51
ret
mov al, 0x52
ret
mov al, 0x53
ret
mov al, 0x54
ret
mov al, 0x55
ret
mov al, 0x56
ret
mov al, 0x57
ret
mov al, 0x58
ret
mov al, 0x59
ret
mov al, 0x5a
ret
mov al, cl
ret

Function at 0x1002ddda
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x19c
mov eax, dword [0x1013a420]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x198]
mov esi, ecx
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x1002de14
push eax
push str.WSAStartup_failed___d_
push esi
call fcn.10018208
add esp, 0xc
jmp 0x1002de3c
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [ebp - 0x198]
cmp al, 2
jne 0x1002de2f
shr eax, 8
test al, al
jne 0x1002de2f
xor eax, eax
jmp 0x1002de3f
push str.insufficient_winsock_version_to_support_telnet
push esi
call fcn.10018208
pop ecx
pop ecx
push 2
pop eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1003890f
mov esp, ebp
pop ebp
ret

Function at 0x1002e035
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0
mov esi, ecx
mov byte [ebp - 2], al
push 3
lea eax, [ebp - 4]
mov byte [ebp - 4], 0xff
push eax
push dword [esi + 0x130]
mov edi, dword [esi]
mov ebx, edx
mov byte [ebp - 3], bl
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x1002e07d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push edi
call fcn.10018208
add esp, 0xc
push dword [ebp + 8]
mov ecx, dword [esi]
mov edx, str.SENT
push ebx
call fcn.1002df4d
pop ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002e817
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x914
mov eax, dword [0x1013a420]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov eax, ecx
push esi
mov dword [ebp - 0x90c], eax
push edi
mov esi, dword [eax]
mov ecx, esi
mov dword [ebp - 0x910], esi
mov ebx, dword [esi + 0x8684]
mov eax, dword [ebx + 0x1eb4]
sub eax, dword [ebx + 0x1eb0]
add eax, 2
push eax
lea eax, [ebx + 0x1cb0]
push eax
push 0x3c
pop edx
call fcn.1002e319
mov eax, dword [ebx + 0x1eb0]
pop ecx
pop ecx
movzx ecx, byte [eax]
inc eax
mov dword [ebx + 0x1eb0], eax
cmp ecx, 0x18
je 0x1002e989
cmp ecx, 0x23
je 0x1002e965
cmp ecx, 0x27
jne 0x1002ea1b
push 0
push ecx
push 0xfa
push 0xff
push str._c_c_c_c
lea eax, [ebp - 0x908]
push 0x800
push eax
call fcn.1001ea20
mov ebx, dword [ebx + 0x1cac]
add esp, 0x1c
push 4
pop edi
test ebx, ebx
je 0x1002e938
mov ecx, dword [ebx]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002e8c9
sub ecx, edx
lea esi, [edi + 1]
add esi, ecx
cmp esi, 0x7fa
jae 0x1002e92b
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x108]
push eax
push str._127_____127s
push dword [ebx]
call fcn.1003b45c
lea eax, [ebp - 0x88]
push eax
push 1
lea eax, [ebp - 0x108]
push eax
push 0
mov eax, 0x800
sub eax, edi
push str._c_s_c_s
push eax
lea eax, [ebp - 0x908]
add eax, edi
push eax
call fcn.1001ea20
add esp, 0x2c
mov edi, esi
mov ebx, dword [ebx + 4]
test ebx, ebx
jne 0x1002e8c4
mov esi, dword [ebp - 0x910]
push 0xf0
push 0xff
mov eax, 0x800
sub eax, edi
push 0x10133c48
push eax
lea eax, [ebp - 0x908]
add eax, edi
push eax
call fcn.1001ea20
add esp, 0x14
add edi, 2
jmp 0x1002e9cf
add ebx, 0x1c28
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002e970
push 0xf0
mov eax, 0xff
push eax
push ebx
push 0
push 0x23
jmp 0x1002e9ab
add ebx, 0x1c08
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002e994
push 0xf0
mov eax, 0xff
push eax
push ebx
push 0
push 0x18
push 0xfa
push eax
push str._c_c_c_c_s_c_c
sub ecx, edx
lea eax, [ebp - 0x908]
push 0x800
push eax
lea edi, [ecx + 6]
call fcn.1001ea20
add esp, 0x28
push 0
push edi
lea eax, [ebp - 0x908]
push eax
mov eax, dword [ebp - 0x90c]
push dword [eax + 0x130]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x1002ea04
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push esi
call fcn.10018208
add esp, 0xc
lea eax, [edi - 2]
mov ecx, esi
push eax
lea eax, [ebp - 0x906]
push eax
push 0x3e
pop edx
call fcn.1002e319
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003890f
mov esp, ebp
pop ebp
ret
Function at 0x1002ea2c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, ecx
mov dword [ebp - 0xc], eax
push ebx
push esi
mov eax, dword [eax]
mov dword [ebp - 8], eax
push edi
mov ebx, dword [eax + 0x8684]
cmp edx, 0x1f
jne 0x1002eb78
lea eax, [ebx + 0x1cb0]
lea edi, [ebx + 0x1eb0]
mov dword [edi], eax
cmp eax, edi
jae 0x1002ea65
mov byte [eax], 0xff
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x1002ea70
mov byte [eax], 0xfa
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x1002ea7b
mov byte [eax], 0x1f
inc dword [edi]
movzx eax, word [ebx + 0x1ca8]
mov esi, dword [sym.imp.WS2_32.dll_htons]
push eax
call esi
movzx eax, ax
mov dword [ebp - 4], eax
movzx eax, word [ebx + 0x1caa]
push eax
call esi
mov ecx, dword [ebp - 4]
movzx edx, ax
mov eax, dword [edi]
cmp eax, edi
jae 0x1002eaab
mov byte [eax], cl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x1002eab5
mov byte [eax], ch
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x1002eabf
mov byte [eax], dl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x1002eac9
mov byte [eax], dh
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x1002ead4
mov byte [eax], 0xff
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x1002eadf
mov byte [eax], 0xf0
inc dword [edi]
mov eax, dword [edi]
lea esi, [ebx + 0x1cb0]
mov dword [ebx + 0x1eb4], eax
sub eax, esi
sub eax, 2
mov dword [edi], esi
mov edi, dword [ebp - 8]
mov ecx, edi
push eax
lea eax, [ebx + 0x1cb2]
push eax
push 0x3e
pop edx
call fcn.1002e319
pop ecx
pop ecx
push 0
push 3
push esi
mov esi, dword [ebp - 0xc]
push dword [esi + 0x130]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x1002eb38
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push edi
call fcn.10018208
add esp, 0xc
push 4
lea edx, [ebx + 0x1cb3]
mov ecx, esi
call fcn.1002eeff
pop ecx
push 0
push 2
lea eax, [ebx + 0x1cb7]
push eax
push dword [esi + 0x130]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x1002eb78
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push edi
call fcn.10018208
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100304bd
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x320
mov eax, dword [0x1013a420]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
or ebx, 0xffffffff
push edi
test esi, esi
je 0x100304ed
xor edi, edi
xor ecx, ecx
mov eax, edi
inc ecx
cmp dword [esi + eax*8], ebx
jne 0x10030505
inc eax
cmp eax, ecx
jb 0x100304e3
mov ecx, ebx
call fcn.10030197
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003890f
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [ebp - 0x218], edi
mov word [esi + 6], ax
mov edx, ebx
mov eax, dword [esi]
mov dword [ebp - 0x110], edi
mov dword [ebp - 0x320], edi
cmp eax, ebx
je 0x10030568
movzx ecx, word [esi + 4]
test cl, 7
je 0x10030568
cmp eax, ebx
cmova edx, eax
xor ebx, ebx
inc ebx
test bl, cl
je 0x10030546
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x218], ebx
test cl, 4
je 0x10030557
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x110], ebx
test cl, 2
je 0x10030568
mov dword [ebp - 0x31c], eax
mov dword [ebp - 0x320], ebx
lea ebx, [edx + 1]
push edi
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
jne 0x100305a0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
je 0x1003056b
cmp eax, 0x2714
je 0x1003056b
jmp 0x100305a4
test eax, eax
jns 0x100305ac
or eax, 0xffffffff
jmp 0x100304f4
jne 0x100305b5
xor eax, eax
jmp 0x100304f4
xor eax, eax
cmp dword [esi], 0xffffffff
mov word [esi + 6], ax
je 0x1003060e
mov ebx, dword [sym.imp.WS2_32.dll___WSAFDIsSet]
lea eax, [ebp - 0x218]
push eax
push dword [esi]
call ebx
test eax, eax
je 0x100305dc
xor eax, eax
inc eax
or word [esi + 6], ax
lea eax, [ebp - 0x110]
push eax
push dword [esi]
call ebx
test eax, eax
je 0x100305f0
or word [esi + 6], 4
lea eax, [ebp - 0x320]
push eax
push dword [esi]
call ebx
test eax, eax
je 0x10030604
or word [esi + 6], 2
cmp word [esi + 6], di
push 1
pop eax
cmovne edi, eax
mov eax, edi
jmp 0x100304f4
Function at 0x10030fea
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push edi
xor edi, edi
and dword [ebp - 0xc], edi
and dword [eax], edi
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 4], edi
push edx
push ecx
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x1003114f
push esi
mov esi, dword [ebp - 8]
mov dword [ebp - 0x10], esi
test esi, esi
je 0x1003113b
push ebx
cmp dword [esi + 4], 2
jne 0x100310db
cmp dword [esi + 0x18], 0
je 0x100310db
cmp dword [esi + 0x10], 0
jbe 0x100310db
cmp dword [esi + 0x10], 0x10
jb 0x100310db
push 0x20
call dword [0x10145370]
mov ebx, eax
pop ecx
test ebx, ebx
je 0x1003112f
mov ecx, dword [esi]
mov dword [ebx], ecx
mov ecx, dword [esi + 4]
mov dword [ebx + 4], ecx
mov ecx, dword [esi + 8]
mov dword [ebx + 8], ecx
mov eax, dword [esi + 0xc]
and dword [ebx + 0x18], 0
and dword [ebx + 0x14], 0
and dword [ebx + 0x1c], 0
push 0x10
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], 0x10
call dword [0x10145370]
mov dword [ebx + 0x18], eax
pop ecx
test eax, eax
je 0x10031123
mov esi, dword [esi + 0x18]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x10]
cmp dword [esi + 0x14], 0
je 0x100310c3
push dword [esi + 0x14]
call dword [0x10145378]
mov dword [ebx + 0x14], eax
pop ecx
test eax, eax
je 0x1003110c
mov edi, dword [ebp - 4]
test edi, edi
mov eax, dword [ebp - 0xc]
cmove edi, ebx
mov dword [ebp - 4], edi
test eax, eax
je 0x100310d8
mov dword [eax + 0x1c], ebx
mov dword [ebp - 0xc], ebx
mov esi, dword [esi + 0x1c]
mov dword [ebp - 0x10], esi
test esi, esi
jne 0x10031028
mov esi, dword [ebp - 0x14]
cmp dword [ebp - 8], 0
pop ebx
je 0x100310fc
push dword [ebp - 8]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
test esi, esi
je 0x10031134
mov ecx, dword [ebp - 4]
call fcn.10030fae
xor edi, edi
jmp 0x10031147
push 8
pop esi
push dword [ebx + 0x18]
call dword [0x10145380]
push ebx
call dword [0x10145380]
pop ecx
pop ecx
jmp 0x100310ec
push 8
pop esi
push ebx
call dword [0x10145380]
jmp 0x10031120
push 8
pop esi
jmp 0x100310ec
mov edi, dword [ebp - 4]
test edi, edi
jne 0x10031147
mov esi, 0x2af9
push esi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
mov eax, esi
pop esi
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x1003562c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
mov ebx, dword [ecx + 0x2c]
push esi
push edi
mov edi, dword [ebx]
mov esi, dword [edi + 0x1a8]
test esi, esi
jne 0x10035641
mov esi, dword [ecx + 0x28]
push dword [ecx + 0x24]
push dword [ecx + 0x20]
call fcn.1002f4e0
push edx
push eax
call fcn.1002f4f6
add esp, 0x10
sub esi, eax
cmp dword [edi + 0x19c], 0
je 0x1003568b
push dword [ebx + 0x124]
push dword [ebx + 0x120]
call fcn.1002f4e0
push edx
push eax
call fcn.1002f4f6
mov ecx, dword [edi + 0x19c]
add esp, 0x10
sub ecx, eax
cmp esi, ecx
cmovl ecx, esi
mov esi, ecx
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x100363a3
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
mov edi, edx
mov eax, dword [esi]
cmp dword [eax + 4], 2
jne 0x100363cc
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x100363bf
xor eax, eax
jmp 0x1003641d
push dword [eax + 8]
push dword [ebp + 8]
push 1
push edi
call ecx
jmp 0x100363fb
cmp dword [esi + 8], 0
jne 0x100363ed
push 0x1012d074
push dword [eax + 8]
call fcn.100397e9
mov dword [esi + 8], eax
pop ecx
pop ecx
test eax, eax
jne 0x100363ed
or eax, 0xffffffff
jmp 0x1003641d
push dword [esi + 8]
push dword [ebp + 8]
push 1
push edi
call fcn.1003bd09
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x1003641b
cmp dword [esi + 8], eax
je 0x10036415
push dword [esi + 8]
call fcn.10039d78
and dword [esi + 8], edi
pop ecx
mov eax, dword [esi]
mov eax, dword [eax]
mov dword [esi], eax
mov eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x100377c8
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push 0xd4
mov dword [ebp - 8], edx
call dword [0x10145370]
mov esi, eax
pop ecx
test esi, esi
je 0x100378c3
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [esi + 0xc]
push edi
push 0x40
pop edi
mov dword [esi], fcn.100532d0
lea eax, [ecx + 0x5c]
mov dword [esi + 4], ecx
mov dword [esi + 8], eax
cmp ebx, edi
jbe 0x10037836
push ecx
call dword [0x1012ce00]
push ebx
push dword [ebp - 8]
push dword [esi + 4]
call dword [0x1012ce04]
mov eax, dword [esi + 8]
push dword [esi + 4]
add eax, 0x5c
push eax
mov dword [ebp - 8], eax
call dword [0x1012ce08]
add esp, 0x18
push 0x10
pop ebx
mov dword [ebp + 8], ebx
push dword [esi + 4]
call dword [0x1012ce00]
push dword [esi + 8]
call dword [0x1012ce00]
pop ecx
xor eax, eax
pop ecx
test ebx, ebx
je 0x10037897
mov edi, dword [ebp - 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov al, byte [edi]
xor al, 0x36
mov byte [ebp - 1], al
lea eax, [ebp - 1]
push 1
push eax
push dword [esi + 4]
call dword [0x1012ce04]
mov al, byte [edi]
xor al, 0x5c
inc edi
mov byte [ebp - 1], al
lea eax, [ebp - 1]
push 1
push eax
push dword [esi + 8]
call dword [0x1012ce04]
add esp, 0x18
dec ebx
jne 0x10037859
push 0x40
pop edi
cmp dword [ebp + 8], edi
jae 0x100378bf
mov eax, dword [ebp - 0x10]
sub edi, eax
push 1
push 0x1012c189
push dword [esi + 4]
call dword [0x1012ce04]
push 1
push 0x1012c18a
push dword [esi + 8]
call dword [0x1012ce04]
add esp, 0x18
dec edi
jne 0x10037899
pop edi
mov eax, esi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1004dcab
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1013a420]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.100432ba
mov dword [ebp - 0x14], eax
cmp dword [0x101463b8], esi
jne 0x1004dd9e
push 0x800
push esi
push 0x100f1c38
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x1004dd2b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1004de7e
push esi
push esi
push 0x100f1c38
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x1004de7e
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1004de7e
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x101463b8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x101463bc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x100f1c80
push edi
mov dword [0x101463c0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x101463c8], eax
test eax, eax
je 0x1004dd9b
push 0x100f1c9c
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x101463c4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1004ddc3
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1004ddb6
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x1004ddd8
push 4
pop eax
jmp 0x1004de80
cmp dword [ebp - 0x14], esi
je 0x1004ddd8
push dword [0x101463b8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x1004ddbd
mov eax, dword [0x101463c4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x1004de36
cmp dword [0x101463c8], edi
je 0x1004de36
push eax
call ebx
push dword [0x101463c8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1004de36
test eax, eax
je 0x1004de36
call ecx
test eax, eax
je 0x1004de2b
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1004de2b
test byte [ebp - 8], 1
jne 0x1004de36
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x1004de66
mov eax, dword [0x101463bc]
cmp eax, edi
je 0x1004de63
push eax
call ebx
test eax, eax
je 0x1004de63
call eax
mov esi, eax
test esi, esi
je 0x1004de63
mov eax, dword [0x101463c0]
cmp eax, edi
je 0x1004de63
push eax
call ebx
test eax, eax
je 0x1004de63
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x101463b8]
call ebx
test eax, eax
je 0x1004de7e
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1004de80
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003890f
mov esp, ebp
pop ebp
ret
Function at 0x100532d0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0x5c
push 0
push esi
call fcn.1003e9c0
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov eax, 1
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
pop esi
pop ebp
ret