joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10014c20
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
mov eax, 1
xor ebx, ebx
test byte [0x1003c790], al
jne 0x10014c7b
or dword [0x1003c790], eax
push 0x1003c76c
mov dword [0x1003c75c], ebx
mov dword [0x1003c760], ebx
mov dword [0x1003c764], ebx
mov dword [0x1003c768], ebx
call dword [sym.imp.KERNEL32.DLL_InitializeCriticalSection]
push 0x100300b0
mov dword [0x1003c788], ebx
mov dword [0x1003c784], ebx
call fcn.1001e315
add esp, 4
cmp dword [0x1003c788], ebx
jne 0x10014cbd
cmp dword [0x1003c784], ebx
jne 0x10014c9e
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateEventA]
cmp eax, ebx
mov dword [0x1003c784], eax
je 0x10014cbd
push ebx
push ebx
push 0x1003c758
push 0x10014d10
push ebx
push ebx
mov byte [0x1003c78c], bl
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [0x1003c788], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push 0x1003c76c
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
lea edx, [esp + 8]
push edx
mov eax, 0x1003c758
call fcn.10015940
push 0x1003c76c
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov eax, dword [0x1003c784]
push eax
call dword [sym.imp.KERNEL32.DLL_SetEvent]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10018700
Capabilities:
Hash data with md5
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x1002dffb
mov eax, dword fs:[0]
push eax
sub esp, 0x98
mov eax, dword [0x1003a1c0]
xor eax, esp
mov dword [esp + 0x90], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1003a1c0]
xor eax, esp
push eax
lea eax, [esp + 0xac]
mov dword fs:[0], eax
mov eax, dword [esp + 0xbc]
push 0x10035610
push eax
mov dword [esp + 0x1c], ecx
call fcn.1001f8c1
mov esi, eax
xor ebx, ebx
add esp, 8
cmp esi, ebx
jne 0x10018763
xor al, al
jmp 0x10018828
push 2
push ebx
push esi
call fcn.1001f778
push esi
call fcn.1001f683
push ebx
push ebx
push esi
mov edi, eax
call fcn.1001f778
add esp, 0x1c
xor ebp, ebp
cmp edi, ebx
je 0x1001879a
push edi
call fcn.1001d552
push esi
push edi
mov ebp, eax
push 1
push ebp
call fcn.1001f4d0
add esp, 0x14
push esi
call fcn.1001f946
add esp, 4
mov eax, edi
mov ecx, ebp
lea esi, [esp + 0x34]
mov dword [esp + 0x48], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x34], 0x67452301
mov dword [esp + 0x38], 0xefcdab89
mov dword [esp + 0x3c], 0x98badcfe
mov dword [esp + 0x40], 0x10325476
mov dword [esp + 0x8c], ebx
mov byte [esp + 0x90], bl
call fcn.10019230
lea eax, [esp + 0x18]
mov ecx, esi
call fcn.10019270
mov ecx, dword [esp + 0x14]
push 0xffffffffffffffff
push ebx
push eax
mov dword [esp + 0xc0], ebx
call fcn.10006680
cmp dword [esp + 0x30], 0x10
jb 0x10018819
mov edx, dword [esp + 0x1c]
push edx
call fcn.1001dad4
add esp, 4
cmp ebp, ebx
je 0x10018826
push ebp
call fcn.1001dedd
add esp, 4
mov al, 1
mov ecx, dword [esp + 0xac]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x90]
xor ecx, esp
call fcn.1001e327
add esp, 0xa4
ret

Function at 0x10018850
Capabilities:
Hash data with md5

Disassembly:
push 0xffffffffffffffff
push 0x1002dfbb
mov eax, dword fs:[0]
push eax
sub esp, 0x94
mov eax, dword [0x1003a1c0]
xor eax, esp
mov dword [esp + 0x90], eax
push ebx
push esi
mov eax, dword [0x1003a1c0]
xor eax, esp
push eax
lea eax, [esp + 0xa0]
mov dword fs:[0], eax
xor ebx, ebx
mov eax, ecx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x2c], 0x67452301
mov dword [esp + 0x30], 0xefcdab89
mov dword [esp + 0x34], 0x98badcfe
mov dword [esp + 0x38], 0x10325476
mov dword [esp + 0x84], ebx
mov byte [esp + 0x88], bl
lea esi, [eax + 1]
mov dl, byte [eax]
add eax, 1
cmp dl, bl
jne 0x100188c6
sub eax, esi
lea esi, [esp + 0x2c]
call fcn.10019230
lea eax, [esp + 0x10]
mov ecx, esi
call fcn.10019270
push 0xffffffffffffffff
push ebx
push eax
mov ecx, edi
mov dword [esp + 0xb4], ebx
call fcn.10006680
cmp dword [esp + 0x28], 0x10
jb 0x1001890b
mov eax, dword [esp + 0x14]
push eax
call fcn.1001dad4
add esp, 4
mov ecx, dword [esp + 0xa0]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x90]
xor ecx, esp
call fcn.1001e327
add esp, 0xa0
ret
Function at 0x100190b0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0xc
mov eax, dword [0x1003a1c0]
xor eax, esp
mov dword [esp + 8], eax
push esi
mov esi, ecx
cmp byte [esi + 0x5c], 0
jne 0x1001921d
mov ecx, dword [esi + 0x58]
lea eax, [ecx*8]
add dword [esi + 0x10], eax
mov eax, dword [esi + 0x10]
add ecx, ecx
push ebx
add ecx, ecx
add ecx, ecx
cmp eax, ecx
push ebp
push edi
mov ebx, 1
jae 0x100190f0
add dword [esi + 0x14], ebx
movzx ecx, byte [esi + 0x11]
movzx edx, al
mov byte [esp + 0x11], cl
movzx ecx, byte [esi + 0x13]
mov byte [esp + 0x10], dl
movzx edx, byte [esi + 0x12]
mov byte [esp + 0x13], cl
movzx ecx, byte [esi + 0x15]
mov byte [esp + 0x12], dl
movzx edx, byte [esi + 0x14]
mov byte [esp + 0x15], cl
movzx ecx, byte [esi + 0x17]
shr eax, 3
and eax, 0x3f
mov byte [esp + 0x14], dl
movzx edx, byte [esi + 0x16]
mov byte [esp + 0x17], cl
mov ecx, eax
cmp ecx, 0x38
mov byte [esp + 0x16], dl
mov eax, 0x38
jb 0x10019146
mov eax, 0x78
sub eax, ecx
test eax, eax
je 0x10019156
mov ecx, 0x1003b760
call fcn.10019230
mov ebp, 8
lea edi, [esp + 0x10]
nop
mov al, byte [edi]
mov edx, dword [esi + 0x58]
mov byte [esi + edx + 0x18], al
add dword [esi + 0x58], ebx
mov eax, dword [esi + 0x58]
sub ebp, ebx
add edi, ebx
cmp eax, 0x40
jb 0x1001917e
push esi
call fcn.10018940
test ebp, ebp
jne 0x10019160
movzx ecx, byte [esi]
movzx eax, byte [esi + 2]
movzx edx, byte [esi + 1]
mov byte [esi + 0x5d], cl
movzx ecx, byte [esi + 3]
mov byte [esi + 0x5f], al
movzx eax, byte [esi + 5]
mov byte [esi + 0x5e], dl
movzx edx, byte [esi + 4]
mov byte [esi + 0x60], cl
movzx ecx, byte [esi + 6]
mov byte [esi + 0x62], al
movzx eax, byte [esi + 8]
mov byte [esi + 0x61], dl
movzx edx, byte [esi + 7]
mov byte [esi + 0x63], cl
movzx ecx, byte [esi + 9]
mov byte [esi + 0x65], al
movzx eax, byte [esi + 0xb]
mov byte [esi + 0x64], dl
movzx edx, byte [esi + 0xa]
mov byte [esi + 0x66], cl
movzx ecx, byte [esi + 0xc]
mov byte [esi + 0x68], al
movzx eax, byte [esi + 0xe]
mov byte [esi + 0x67], dl
movzx edx, byte [esi + 0xd]
mov byte [esi + 0x69], cl
movzx ecx, byte [esi + 0xf]
mov byte [esi + 0x6b], al
mov byte [esi + 0x6a], dl
mov byte [esi + 0x6c], cl
pop edi
xor eax, eax
pop ebp
mov byte [esi + 0x5c], bl
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], eax
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x58], eax
pop ebx
mov ecx, dword [esp + 0xc]
pop esi
xor ecx, esp
call fcn.1001e327
add esp, 0xc
ret
Function at 0x10019330
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1002fb58
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebp
push esi
mov eax, dword [0x1003a1c0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov bp, word [esp + 0x38]
mov ecx, str.down
lea esi, [esp + 0xc]
call fcn.10013380
push 0xffffffffffffffff
push 0
push eax
mov ecx, 0x1003b638
mov dword [esp + 0x3c], 0
call fcn.10006680
mov dword [esp + 0x30], 0xffffffff
cmp dword [esp + 0x24], 0x10
jb 0x1001939b
mov eax, dword [esp + 0x10]
push eax
call fcn.1001dad4
add esp, 4
push 1
push 0x10032dc0
mov eax, 0x1003b638
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], 0
mov byte [esp + 0x18], 0
call fcn.10007020
cmp byte [edi], 0
mov word [edi + 0x38], bp
jne 0x10019409
mov ecx, 0x1001a390
test ecx, ecx
je 0x10019409
test bp, bp
je 0x10019409
movzx edx, bp
mov ecx, edi
mov dword [edi + 0x34], 0x1001a390
mov dword [edi + 8], edx
mov byte [edi], 1
call fcn.100194a0
neg eax
sbb eax, eax
neg eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
add esp, 0x28
ret 4
xor eax, eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
add esp, 0x28
ret 4
Function at 0x100194a0
Capabilities:
Create tcp socket
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [0x1003a1c0]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
push esi
mov esi, ecx
cmp byte [esi + 0xc], 0
push edi
jne 0x100194f7
cmp byte [esi], 0
je 0x100194f7
xor ebx, ebx
push ebx
push ebx
push ebx
or edi, 0xffffffff
push edi
call dword [sym.imp.KERNEL32.DLL_CreateIoCompletionPort]
cmp eax, ebx
mov dword [esi + 0x1c], eax
je 0x100194f7
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, edi
mov dword [esi + 4], eax
jne 0x1001950b
mov eax, dword [esi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.1001e327
mov esp, ebp
pop ebp
ret
push ebx
mov word [esp + 0x10], 2
call dword [sym.imp.WS2_32.dll_htonl]
movzx ecx, word [esi + 8]
push ecx
mov dword [esp + 0x14], eax
call dword [sym.imp.WS2_32.dll_htons]
push 0x10
lea edx, [esp + 0x10]
mov word [esp + 0x12], ax
mov eax, dword [esi + 4]
push edx
push eax
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, edi
jne 0x10019570
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov edx, dword [esi + 0x1c]
push edx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [esi + 4], edi
mov dword [esi + 0x1c], ebx
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.1001e327
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 4]
push 5
push eax
call dword [sym.imp.WS2_32.dll_listen]
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
cmp eax, ebx
mov dword [esi + 0x18], eax
je 0x10019542
push 0x28
push eax
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, edi
je 0x100195c5
mov ebx, esi
call fcn.100199b0
test al, al
je 0x100195c5
push 0
push 0
push esi
push 0x10019bc0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
mov dword [esi + 0x20], eax
jne 0x100195fe
call fcn.10019a90
mov ecx, dword [esi + 0x18]
mov ebx, dword [sym.imp.KERNEL32.DLL_CloseHandle]
push ecx
call ebx
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [esi + 0x1c]
push eax
call ebx
xor eax, eax
mov dword [esi + 4], edi
mov dword [esi + 0x1c], eax
mov dword [esi + 0x18], eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.1001e327
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x1c]
mov eax, 1
pop edi
mov byte [esi + 0xc], al
pop esi
pop ebx
xor ecx, esp
call fcn.1001e327
mov esp, ebp
pop ebp
ret
Function at 0x10019620
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
mov esi, eax
xor ebx, ebx
cmp byte [esi + 0xc], bl
push edi
je 0x10019693
cmp dword [esi + 0x20], ebx
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
je 0x10019668
mov eax, dword [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.DLL_SetEvent]
mov ecx, dword [esi + 0x20]
push 0xc8
push ecx
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
test eax, eax
je 0x1001965f
mov edx, dword [esi + 0x20]
push ebx
push edx
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
mov eax, dword [esi + 0x20]
push eax
call edi
mov dword [esi + 0x20], ebx
call fcn.10019a90
mov ecx, dword [esi + 0x18]
push ecx
call edi
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [esi + 0x1c]
push eax
call edi
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x18], ebx
mov byte [esi + 0xc], bl
pop edi
pop esi
pop ebx
ret

Function at 0x100199b0
Capabilities:
Create thread
Get system information on windows

Disassembly:
sub esp, 0x38
xor eax, eax
push ebp
push esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
push edi
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemInfo]
mov eax, dword [esp + 0x30]
lea eax, [eax + eax*2]
test eax, eax
jbe 0x10019a6d
mov ebp, dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [esp + 0xc], eax
push 0
push 0
push ebx
push 0x10019bd0
push 0
push 0
call ebp
test eax, eax
mov dword [esp + 0x10], eax
je 0x10019a66
mov edx, dword [ebx + 0x28]
test edx, edx
lea esi, [ebx + 0x24]
jne 0x10019a22
xor edi, edi
jmp 0x10019a2a
mov edi, dword [esi + 8]
sub edi, edx
sar edi, 2
test edx, edx
je 0x10019a47
mov ecx, dword [esi + 0xc]
sub ecx, edx
sar ecx, 2
cmp edi, ecx
jae 0x10019a47
mov ecx, dword [esi + 8]
mov dword [ecx], eax
add ecx, 4
mov dword [esi + 8], ecx
jmp 0x10019a66
mov edi, dword [esi + 8]
cmp edx, edi
jbe 0x10019a53
call fcn.1001dd60
push edi
push esi
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push edx
mov eax, esi
call fcn.10019be0
sub dword [esp + 0xc], 1
jne 0x100199fc
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x10019a7e
mov ecx, dword [ebx + 0x2c]
sub ecx, eax
sar ecx, 2
jne 0x10019a87
xor al, al
pop edi
pop esi
pop ebp
add esp, 0x38
ret
pop edi
pop esi
mov al, 1
pop ebp
add esp, 0x38
ret
Function at 0x10019a90
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [esi + 0x28]
sub esp, 8
test eax, eax
push ebx
push edi
je 0x10019bac
mov ecx, dword [esi + 0x2c]
sub ecx, eax
sar ecx, 2
je 0x10019bac
mov ebx, dword [sym.imp.KERNEL32.DLL_PostQueuedCompletionStatus]
xor edi, edi
lea esp, [esp]
mov ecx, dword [esi + 0x28]
test ecx, ecx
je 0x10019ae4
mov eax, dword [esi + 0x2c]
sub eax, ecx
sar eax, 2
cmp edi, eax
jae 0x10019ae4
mov edx, dword [esi + 0x1c]
push 0
push 0
push 0
push edx
call ebx
add edi, 1
jmp 0x10019ac0
xor edi, edi
mov ecx, dword [esi + 0x28]
test ecx, ecx
je 0x10019b62
mov eax, dword [esi + 0x2c]
sub eax, ecx
sar eax, 2
cmp edi, eax
jae 0x10019b62
test ecx, ecx
je 0x10019b09
mov eax, dword [esi + 0x2c]
sub eax, ecx
sar eax, 2
cmp edi, eax
jb 0x10019b0e
call fcn.1001dd60
mov eax, dword [esi + 0x28]
lea ebx, [edi*4]
add eax, ebx
mov eax, dword [eax]
push 0xc8
push eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
test eax, eax
je 0x10019b53
mov ecx, dword [esi + 0x28]
test ecx, ecx
je 0x10019b3f
mov eax, dword [esi + 0x2c]
sub eax, ecx
sar eax, 2
cmp edi, eax
jb 0x10019b44
call fcn.1001dd60
mov ecx, dword [esi + 0x28]
mov edx, dword [ecx + ebx]
push 0
push edx
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
add edi, 1
jmp 0x10019ae6
mov ebx, dword [esi + 0x2c]
cmp ecx, ebx
jbe 0x10019b6e
call fcn.1001dd60
mov edi, dword [esi + 0x28]
cmp edi, dword [esi + 0x2c]
jbe 0x10019b7b
call fcn.1001dd60
cmp edi, ebx
je 0x10019bac
mov eax, dword [esi + 0x2c]
sub eax, ebx
sar eax, 2
test eax, eax
lea ecx, [eax*4]
lea edx, [ecx + edi]
mov dword [esp + 0xc], edx
jle 0x10019ba5
push ecx
push ebx
push ecx
push edi
call fcn.1001dd70
add esp, 0x10
mov eax, dword [esp + 0xc]
mov dword [esi + 0x2c], eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001a210
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1002e815
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x1003a1c0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x1c]
xor edi, edi
push 0x1000
mov dword [esi + 4], edi
mov dword [esi + 8], 0xffffffff
mov dword [esi], eax
call fcn.1001d552
push 0x1000
mov dword [esi + 0x18], eax
call fcn.1001d552
mov dword [esi + 0x1c], eax
xor eax, eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov ecx, dword [esi + 0x18]
mov dword [esi + 0x38], ecx
mov dword [esi + 0x34], 0x1000
mov dword [esi + 0x44], 5
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], eax
mov dword [esi + 0x5c], eax
mov dword [esi + 0x60], eax
mov dword [esi + 0x64], eax
mov dword [esi + 0x68], eax
mov dword [esi + 0x6c], eax
mov edx, dword [esi + 0x1c]
mov dword [esi + 0x60], edx
mov dword [esi + 0x5c], 0x1000
mov dword [esi + 0x6c], 6
mov dword [esi + 0x10], 0xffffffff
mov dword [esi + 0x88], edi
mov dword [esi + 0x8c], edi
mov dword [esi + 0xc], edi
add esp, 8
add esi, 0x70
cmp esi, edi
mov dword [esp + 0x14], edi
je 0x1001a30a
call fcn.10008950
mov dword [esi + 4], eax
mov byte [eax + 0x45], 1
mov eax, dword [esi + 4]
mov dword [eax + 4], eax
mov eax, dword [esi + 4]
mov dword [eax], eax
mov eax, dword [esi + 4]
mov dword [eax + 8], eax
mov dword [esi + 8], edi
mov al, 1
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4

Function at 0x1001a400
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push esi
push edi
mov esi, eax
lea edi, [esi + 4]
push edi
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
push 0
lea eax, [esi + 0x20]
push eax
lea ecx, [esi + 0x40]
push ecx
mov ecx, dword [esi + 8]
lea edx, [esi + 0x3c]
push edx
push 1
lea eax, [esi + 0x34]
push eax
push ecx
mov bl, 1
call dword [sym.imp.WS2_32.dll_WSARecv]
cmp eax, 0xffffffff
jne 0x1001a467
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
sete bl
test bl, bl
jne 0x1001a467
push edi
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
test eax, eax
jg 0x1001a467
call fcn.1001a320
lea eax, [esi + 0x70]
call fcn.10006e80
push esi
call fcn.1001dad4
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
ret
Function at 0x1001a470
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
push edi
mov esi, eax
lea edi, [esi + 4]
push edi
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
mov ecx, dword [esi + 0x68]
push 0
lea eax, [esi + 0x48]
push eax
push ecx
mov ecx, dword [esi + 8]
lea edx, [esi + 0x64]
push edx
push 1
lea eax, [esi + 0x5c]
push eax
push ecx
mov bl, 1
call dword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0xffffffff
jne 0x1001a4d7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
sete bl
test bl, bl
jne 0x1001a4d7
push edi
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
test eax, eax
jg 0x1001a4d7
call fcn.1001a320
lea eax, [esi + 0x70]
call fcn.10006e80
push esi
call fcn.1001dad4
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
ret

Function at 0x1001a800
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push edi
mov edi, dword [esi + 0x5c]
sub edi, dword [esp + 0x14]
mov ebp, 0
je 0x1001a82d
xor eax, eax
cmp edi, ebp
jbe 0x1001a82d
mov ecx, dword [esi + 0x1c]
mov edx, dword [esp + 0x14]
add ecx, eax
mov dl, byte [ecx + edx]
add eax, 1
cmp eax, edi
mov byte [ecx], dl
jb 0x1001a818
mov eax, dword [esi + 0x10]
cmp eax, 0xffffffff
je 0x1001a89f
cmp edi, 0x1000
jae 0x1001a89f
push ebp
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esi + 0x1c]
mov edx, 0x1000
sub edx, edi
push edx
add ecx, edi
push ecx
push eax
mov dword [esp + 0x28], ebp
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x1001a866
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov eax, dword [esp + 0x14]
sub dword [esi + 0x80], eax
sbb dword [esi + 0x84], ebp
add edi, eax
cmp dword [esi + 0x84], ebp
jl 0x1001a88e
jg 0x1001a88a
cmp dword [esi + 0x80], ebp
jbe 0x1001a88e
cmp eax, ebp
jne 0x1001a89f
mov edx, dword [esi + 0x10]
push edx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [esi + 0x10], 0xffffffff
mov eax, dword [esi + 0x88]
cmp eax, ebp
je 0x1001a939
cmp edi, 0x1000
jae 0x1001a939
mov edx, dword [esi + 0x84]
mov ebx, 0x1000
xor ecx, ecx
sub ebx, edi
cmp edx, ecx
mov dword [esp + 0x14], ebp
jg 0x1001a8e2
jl 0x1001a8dc
mov ecx, dword [esi + 0x80]
cmp ecx, ebx
jae 0x1001a8e2
mov ebx, dword [esi + 0x80]
sub eax, dword [esi + 0x80]
mov edx, dword [esi + 0x1c]
add eax, dword [esi + 0x8c]
push ebx
push eax
add edx, edi
push edx
call fcn.10022e90
add esp, 0xc
sub dword [esi + 0x80], ebx
sbb dword [esi + 0x84], ebp
add edi, ebx
cmp dword [esi + 0x84], ebp
jg 0x1001a939
jl 0x1001a91e
cmp dword [esi + 0x80], ebp
ja 0x1001a939
mov eax, dword [esi + 0x88]
push eax
call fcn.1001dedd
add esp, 4
mov dword [esi + 0x88], ebp
mov dword [esi + 0x8c], ebp
cmp edi, ebp
jbe 0x1001a94e
mov eax, esi
mov dword [esi + 0x5c], edi
call fcn.1001a470
pop edi
pop ebp
pop ebx
pop ecx
ret 4
mov eax, dword [esi + 8]
or edi, 0xffffffff
cmp eax, edi
je 0x1001a962
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 8], edi
mov eax, dword [esi + 0x10]
cmp eax, edi
je 0x1001a973
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [esi + 0x10], edi
pop edi
pop ebp
pop ebx
pop ecx
ret 4
Function at 0x1001c220
Capabilities:
Decrypt data using tea
Encode data using xor

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x18]
cmp byte [ebx + 4], 0
push ebp
mov ebp, dword [sym.imp.WS2_32.dll_ntohl]
push esi
mov esi, eax
push edi
mov edi, dword [esi]
je 0x1001c240
push edi
call ebp
mov edi, eax
cmp byte [ebx + 4], 0
mov esi, dword [esi + 4]
je 0x1001c24e
push esi
call ebp
mov esi, eax
cmp byte [ebx + 4], 0
mov eax, dword [ebx + 5]
je 0x1001c25a
push eax
call ebp
cmp byte [ebx + 4], 0
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 9]
je 0x1001c26a
push eax
call ebp
cmp byte [ebx + 4], 0
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 0xd]
je 0x1001c27a
push eax
call ebp
cmp byte [ebx + 4], 0
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 0x11]
je 0x1001c28a
push eax
call ebp
mov edx, dword [ebx]
cmp edx, 0x20
mov dword [esp + 0x10], eax
jne 0x1001c29c
mov ecx, 0xc6ef3720
jmp 0x1001c2b0
cmp edx, 0x10
jne 0x1001c2a8
mov ecx, 0xe3779b90
jmp 0x1001c2b0
mov ecx, edx
imul ecx, ecx, 0x9e3779b9
test edx, edx
je 0x1001c301
mov eax, edi
shr eax, 5
add eax, dword [esp + 0x10]
mov ebx, edi
shl ebx, 4
add ebx, dword [esp + 0x14]
sub edx, 1
xor eax, ebx
lea ebx, [ecx + edi]
xor eax, ebx
sub esi, eax
mov eax, esi
shr eax, 5
add eax, dword [esp + 0x18]
mov ebx, esi
shl ebx, 4
add ebx, dword [esp + 0x1c]
xor eax, ebx
lea ebx, [ecx + esi]
xor eax, ebx
sub edi, eax
add ecx, 0x61c88647
test edx, edx
jne 0x1001c2b4
mov ebx, dword [esp + 0x24]
mov ebp, dword [sym.imp.WS2_32.dll_ntohl]
cmp byte [ebx + 4], 0
je 0x1001c30c
push edi
call ebp
jmp 0x1001c30e
mov eax, edi
mov edi, dword [esp + 0x28]
mov dword [edi], eax
cmp byte [ebx + 4], 0
je 0x1001c32a
push esi
call ebp
mov dword [edi + 4], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
mov dword [edi + 4], esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8

Function at 0x1001e327
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1003a1c0]
jne 0x1001e331
repz ret
jmp fcn.1002336b