joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10113b9a
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
xor ebx, ebx
jmp 0x10113bda
push 0
push 1
lea eax, [ebp + 0xb]
push eax
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jg 0x10113bd8
push eax
mov ecx, esi
call fcn.10113918
test al, al
je 0x10113be0
test ebx, ebx
jne 0x10113be0
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10113bda
add ebx, eax
mov al, byte [edi]
test al, al
jne 0x10113ba9
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x10114cfe
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x18
mov eax, 0x1018f5c4
call fcn.1015d13e
mov dword [ebp - 0x14], ecx
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 1
push accept
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x18], eax
je 0x10114dfd
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
je 0x10114de7
lea eax, [esi + 1]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
cmp edi, ebx
mov dword [ebp - 0x20], edi
je 0x10114de7
push ebx
lea eax, [ebp - 0x1c]
push eax
push esi
push edi
push dword [ebp - 0x18]
mov dword [ebp - 0x1c], ebx
mov byte [ebp + 0xb], bl
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10114df4
mov esi, dword [ebp - 0x14]
cmp dword [esi], ebx
mov dword [ebp - 4], ebx
je 0x10114ddd
push edi
lea ecx, [ebp - 0x14]
call fcn.1010ce99
push ecx
lea eax, [ebp - 0x14]
mov ecx, esp
mov dword [ebp - 0x24], esp
push eax
call fcn.10114069
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.10113ef7
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.101144d4
mov ecx, esi
call fcn.10114bb1
mov ecx, dword [ebp + 0xc]
push edi
mov byte [ebp + 0xb], 1
call fcn.1002cc90
mov ecx, dword [ebp - 0x14]
cmp ecx, ebx
je 0x10114ddd
call fcn.1010cfb4
jmp 0x10114ddd
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov bl, byte [ebp + 0xb]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
jmp 0x10114dff
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x10114de7
xor al, al
call fcn.1015d1e3
ret 8
Function at 0x10117a21
Capabilities:
Encode data using base64

Disassembly:
push 0x38
mov eax, 0x1018fd32
call fcn.1015d10b
mov edi, dword [ebp + 0x24]
lea eax, [ebp - 0x1c]
xor ebx, ebx
push eax
lea ecx, [ebp + 8]
mov dword [ebp - 4], ebx
call fcn.10030d40
jmp 0x10117b21
mov byte [ebp - 0x10], bl
mov byte [ebp - 0xf], bl
mov byte [ebp - 0xe], bl
xor esi, esi
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp + 8]
call fcn.10030d80
push eax
lea ecx, [ebp - 0x1c]
call fcn.100307b0
test al, al
jne 0x10117a92
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x20], eax
call fcn.10030770
lea ecx, [ebp - 0x24]
call fcn.10030990
mov al, byte [eax]
mov byte [ebp + esi - 0x10], al
inc esi
cmp esi, 3
jb 0x10117a51
movzx eax, byte [ebp - 0x10]
movzx ecx, al
shr ecx, 2
mov cl, byte [ecx + 0x1019d2a0]
mov byte [ebp - 0x14], cl
mov cl, byte [ebp - 0xf]
movzx edx, cl
and eax, 3
shl eax, 4
shr edx, 4
or edx, eax
mov al, byte [edx + 0x1019d2a0]
mov byte [ebp - 0x13], al
movzx eax, byte [ebp - 0xe]
movzx edx, al
and ecx, 0xf
shl ecx, 2
shr edx, 6
or edx, ecx
mov cl, byte [edx + 0x1019d2a0]
and eax, 0x3f
cmp esi, 3
mov al, byte [eax + 0x1019d2a0]
mov byte [ebp - 0x12], cl
mov byte [ebp - 0x11], al
jae 0x10117af8
cmp esi, 2
mov byte [ebp - 0x11], 0x3d
jae 0x10117af8
mov byte [ebp - 0x12], 0x3d
xor esi, esi
lea eax, [ebp - 0x3c]
push eax
mov ecx, edi
call fcn.10030d80
movzx ecx, byte [ebp + esi - 0x14]
push ecx
push dword [eax + 4]
mov ecx, edi
push dword [eax]
lea eax, [ebp - 0x44]
push eax
call fcn.10113cab
inc esi
cmp esi, 4
jb 0x10117afa
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp + 8]
call fcn.10030d80
push eax
lea ecx, [ebp - 0x1c]
call fcn.100307b0
test al, al
je 0x10117a46
push ebx
push 1
lea ecx, [ebp + 8]
call fcn.10001b20
call fcn.1015d1e3
ret 0x20
Function at 0x10119d34
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0x94
mov eax, 0x1019037e
call fcn.1015d174
mov eax, dword [ebp + 8]
push 0xf
pop edi
mov esi, ecx
xor ebx, ebx
push ebx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x14], edi
call fcn.10001ce0
push ebx
lea ecx, [ebp - 0x84]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x6c], edi
call fcn.10001ce0
mov ecx, dword [ebp - 0x54]
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x84]
push eax
mov byte [ebp - 4], 1
call fcn.10001a10
push ebx
push 1
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], bl
call fcn.10001b20
mov eax, dword [ebp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0x7530
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x4c], eax
call edi
mov dword [ebp - 0x58], eax
jmp 0x10119e78
cmp dword [ebp - 0x4c], ebx
jbe 0x10119e88
mov ecx, dword [esi + 0x2ec]
mov eax, dword [ecx]
push 0xa
call dword [eax + 0xc]
test al, al
je 0x10119e57
push dword [esi + 0x240]
mov ecx, dword [esi + 0x2ec]
lea eax, [ebp - 0x2c]
push eax
call fcn.10113cfe
call edi
cmp dword [ebp - 0x18], ebx
mov dword [ebp - 0x58], eax
je 0x10119e46
mov ecx, dword [ebp - 0x54]
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x2c]
push eax
call fcn.1000c960
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x10119e0e
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x50]
push ecx
push 0x1019d478
push eax
call fcn.10159f5b
add esp, 0xc
cmp eax, 1
jne 0x10119e46
mov eax, dword [ebp - 0x50]
add eax, 0xffffff9b
cmp ax, 0x382
ja 0x10119e46
cmp dword [ebp - 0x18], 3
jbe 0x10119e46
push 3
lea ecx, [ebp - 0x2c]
call fcn.10027aa0
cmp byte [eax], 0x2d
jne 0x10119e88
mov ecx, dword [esi + 0x2ec]
call fcn.10113b8a
test al, al
jne 0x10119e88
jmp 0x10119e78
cmp dword [ebp - 0x4c], 0xa
jb 0x10119e75
sub dword [ebp - 0x4c], 0xa
call edi
sub eax, dword [ebp - 0x58]
cmp eax, dword [ebp - 0x68]
ja 0x10119e75
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10119e78
mov dword [ebp - 0x4c], ebx
mov eax, dword [esi + 0x240]
mov al, byte [eax]
test al, al
jne 0x10119db6
push 0x10197d4c
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
call fcn.100019a0
push eax
push dword [ebp - 0x54]
lea eax, [ebp - 0x48]
push eax
mov byte [ebp - 4], 2
call fcn.1002cf90
add esp, 0xc
push ebx
push 1
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 4
call fcn.10001b20
mov ecx, dword [esi + 0x244]
cmp ecx, ebx
je 0x10119ef5
cmp dword [ebp - 0x34], ebx
je 0x10119ef5
cmp dword [ebp - 0x30], 0x10
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x60], ebx
jae 0x10119ee5
lea eax, [ebp - 0x44]
lea edx, [ebp - 0x64]
push edx
lea edx, [esi + 4]
mov dword [ebp - 0x5c], eax
mov eax, dword [ecx]
push edx
call dword [eax + 0x34]
movzx eax, word [ebp - 0x50]
push ebx
mov dword [esi + 0x2f4], eax
movzx esi, word [ebp - 0x50]
push 1
lea ecx, [ebp - 0x48]
call fcn.10001b20
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.10001b20
mov ax, si
call fcn.1015d1f7
ret 8
Function at 0x1012611d
Capabilities:
Print debug messages

Disassembly:
push 0x4c
mov eax, 0x10191f10
call fcn.1015d13e
mov esi, ecx
push dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
call fcn.1012d59f
test al, al
je 0x1012627b
push 0xffffffffffffffff
push edi
push dword [ebp + 0xc]
lea ecx, [esi + 0x294]
call fcn.10001a10
push 0xffffffffffffffff
push edi
push dword [ebp + 0x18]
lea ecx, [esi + 0x278]
call fcn.10001a10
lea eax, [esi + 0x3c]
push eax
lea eax, [esi + 0x2c]
push eax
lea ecx, [ebp - 0x20]
mov word [esi + 9], 1
call fcn.1000da00
mov dword [ebp + 8], eax
push dword [ebp + 0x10]
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 1
call fcn.10001970
push dword [ebp + 0xc]
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 2
call fcn.10001970
lea ebx, [esi + 0xa0]
mov eax, dword [ebx + 4]
cmp eax, edi
mov byte [ebp - 4], 3
je 0x101261af
mov edi, dword [ebx + 8]
sub edi, eax
mov ecx, dword [esi + 0x118]
lea eax, [esi + 4]
push eax
call fcn.10125e4c
push edi
mov ecx, eax
call fcn.100686f0
push ebx
mov ecx, eax
call fcn.100777e0
push dword [ebp + 0x14]
mov ecx, eax
call fcn.10068720
lea ecx, [ebp - 0x3c]
push ecx
push eax
call fcn.101260d8
pop ecx
pop ecx
lea ecx, [ebp - 0x58]
push ecx
push eax
call fcn.101260d8
pop ecx
pop ecx
push dword [ebp + 8]
mov ecx, eax
call fcn.100777e0
push dword [ebp + 0x1c]
mov ecx, eax
call fcn.10068720
lea ecx, [ebp + 0x20]
push ecx
mov ecx, dword [eax + 4]
call fcn.10044170
push 0
push 1
lea ecx, [ebp - 0x3c]
call fcn.10001b20
push 0
push 1
lea ecx, [ebp - 0x58]
call fcn.10001b20
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0
call fcn.1001db20
cmp word [esi + 9], 1
jne 0x10126263
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.gethash_:
call edi
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x18], 0x10
jb 0x10126256
mov eax, dword [eax + 4]
jmp 0x10126259
add eax, 4
push eax
call edi
push 0x10197d4c
call edi
mov ecx, esi
call fcn.1012d0f4
mov byte [esi + 0x203], 1
mov al, 1
jmp 0x1012627d
xor al, al
call fcn.1015d1e3
ret 0x1c
Function at 0x1012628b
Capabilities:
Encode data using xor

Disassembly:
push 0x88
mov eax, 0x10191f33
call fcn.1015d174
mov edi, dword [ebp + 0xc]
push 0x14
xor ebx, ebx
lea eax, [ebp - 0x24]
push ebx
push eax
mov esi, ecx
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], 1
call fcn.101580b0
add esp, 0xc
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x2c], ebx
call fcn.10125a36
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x80]
push eax
mov ecx, edi
call fcn.1000a670
mov ecx, eax
call fcn.1000a640
push eax
call fcn.10125f27
pop ecx
pop ecx
mov ecx, eax
call fcn.1000a670
mov ecx, eax
call fcn.1000a670
cmp byte [esi + 0x200], bl
mov byte [esi + 0x202], 1
je 0x1012631e
cmp byte [esi + 0x201], bl
je 0x1012631e
mov dword [ebp - 0x34], ebx
cmp dword [ebp - 0x2c], ebx
jne 0x10126351
push 0x14
lea eax, [ebp - 0x94]
push ebx
push eax
call fcn.101580b0
mov esi, dword [esi + 0x134]
mov eax, dword [esi]
add esp, 0xc
push ebx
lea ecx, [ebp - 0x94]
push ecx
push 0x15
mov ecx, esi
call dword [eax + 0x48]
jmp 0x1012645a
jbe 0x1012645a
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ebx
cmp dword [ebp - 0x2c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x30], ebx
jbe 0x1012643c
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x6c], ebx
call fcn.100463c0
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x68]
push eax
call fcn.1000a670
mov edi, eax
mov ecx, dword [edi + 4]
lea eax, [ebp - 0x25]
push eax
call fcn.10044380
mov ecx, dword [edi + 4]
lea eax, [ebp - 0x26]
push eax
call fcn.10044380
lea eax, [ebp - 0x52]
push eax
lea eax, [ebp - 0x56]
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x5e]
push eax
lea eax, [ebp - 0x62]
push eax
mov ecx, edi
call fcn.1000a670
mov ecx, eax
call fcn.1000a640
mov ecx, eax
call fcn.1000a670
mov ecx, eax
call fcn.1000a640
mov ecx, eax
call fcn.1000a670
mov ecx, eax
call fcn.1000a640
mov al, byte [ebp - 0x26]
mov ecx, dword [ebp - 0x38]
mov byte [ebp - 0x63], al
mov al, byte [ebp - 0x64]
xor al, byte [ebp - 0x25]
and al, 0x1f
xor byte [ebp - 0x64], al
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x49]
push eax
call fcn.1000a640
mov ecx, eax
call fcn.1000a670
mov ecx, eax
call fcn.1000a640
lea ecx, [ebp - 0x4a]
push ecx
mov ecx, dword [eax + 4]
call fcn.10044380
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x7c]
call fcn.1006a4e0
inc dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x2c]
jb 0x1012636f
mov esi, dword [esi + 0x134]
mov eax, dword [esi]
lea ecx, [ebp - 0x7c]
push ecx
lea ecx, [ebp - 0x24]
push ecx
push ebx
mov ecx, esi
call dword [eax + 0x48]
lea ecx, [ebp - 0x7c]
call fcn.1001db20
mov eax, dword [ebp - 0x34]
call fcn.1015d1f7
ret 8
Function at 0x10127bf6
Capabilities:
Print debug messages

Disassembly:
push 0x58
mov eax, 0x101921e5
call fcn.1015d1aa
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 4]
mov edi, dword [ebp + 0x10]
xor ebx, ebx
cmp ecx, ebx
mov dword [ebp - 4], ebx
je 0x10127cb4
mov eax, dword [esi + 8]
sub eax, ecx
cmp eax, 0x23
jbe 0x10127cb4
push ebx
mov ecx, esi
call fcn.10003510
push eax
call fcn.101259a5
test al, al
pop ecx
je 0x10127ca9
push edi
push dword [ebp + 0xc]
lea eax, [ebp - 0x30]
push eax
call fcn.10127030
add esp, 0xc
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 1
jae 0x10127c59
lea eax, [ebp - 0x2c]
push eax
call fcn.10031d60
pop ecx
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x5c]
call fcn.100f7361
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x64], 0x101975e0
mov dword [ebp - 0x60], eax
push esi
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 3
call fcn.10076f80
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 1
call fcn.100f6ea9
push ebx
push 1
lea ecx, [ebp - 0x30]
call fcn.10001b20
mov al, 1
jmp 0x10127cb6
push str.invalid_torrent_format_
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor al, al
call fcn.1015d206
ret

Function at 0x1012b1d0
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x101c6444]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
mov esi, ecx
call fcn.10024400
push 1
push eax
mov dword [esi + 0xc], eax
call fcn.10023d80
add esp, 0xc
test al, al
je 0x1012b242
mov eax, dword [ebp + 8]
mov cx, word [eax + 4]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
push 0x10
lea eax, [ebp - 0x14]
push eax
push dword [esi + 0xc]
mov word [ebp - 0x14], 2
mov word [ebp - 0x12], cx
call dword [sym.imp.WS2_32.dll_connect]
push esi
push dword [esi + 0xc]
mov ecx, esi
mov dword [esi + 0x10], 1
call fcn.1012ae87
push esi
push dword [esi + 0xc]
mov ecx, esi
call fcn.1012ae8f
mov al, 1
jmp 0x1012b257
mov eax, dword [esi + 0xc]
cmp eax, 0xffffffff
je 0x1012b251
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
or dword [esi + 0xc], 0xffffffff
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.101586e7
leave
ret 4
Function at 0x1012cd37
Capabilities:
Initialize winsock library

Disassembly:
push 0x198
mov eax, 0x101926f8
call fcn.1015d174
mov esi, ecx
lea ecx, [esi + 4]
mov dword [ebp - 0x1a4], esi
mov dword [esi], 0x1019dc88
call fcn.10003330
xor ebx, ebx
lea ecx, [esi + 0x20]
mov dword [ebp - 4], ebx
call fcn.1017955b
lea ecx, [esi + 0x2c]
mov byte [ebp - 4], 1
call fcn.1017955b
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 2
call fcn.1017955b
mov dword [esi + 0x350], ebx
mov byte [esi + 0x354], bl
lea eax, [esi + 0x358]
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
lea eax, [esi + 0x368]
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
lea eax, [esi + 0x378]
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
lea ecx, [esi + 0x388]
call fcn.10003330
lea ecx, [esi + 0x3a4]
mov byte [ebp - 4], 7
call fcn.100f422b
mov eax, dword [ebp + 8]
mov dword [esi + 0x3b0], eax
mov eax, dword [eax + 0x10]
add eax, 2
push eax
lea ecx, [esi + 0x3b4]
mov byte [ebp - 4], 8
call fcn.10129328
mov eax, 0x1012cc53
push eax
lea edi, [esi + 0x3cc]
push esi
mov ecx, edi
mov byte [esi + 0x3c8], bl
call fcn.100ff9aa
lea eax, [esi + 0x3ec]
mov dword [esi + 0x3e8], ebx
lea ecx, [esi + 0x3fc]
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
call fcn.10003330
lea eax, [ebp - 0x1a0]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
push ebx
mov ecx, edi
mov dword [esi + 0x44], ebx
mov dword [esi + 0x148], ebx
mov dword [esi + 0x24c], ebx
call fcn.100f76d6
mov eax, esi
call fcn.1015d1f7
ret 4
Function at 0x1012d398
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
sub esp, 0x4a0
lea ebp, [esp - 4]
mov eax, dword [0x101c6444]
xor eax, ebp
mov dword [ebp + 0x4a0], eax
push 8
mov eax, 0x10192888
call fcn.1015d10b
xor esi, esi
push 0x384
lea eax, [ebp + 0x1c]
push esi
push eax
mov dword [ebp - 0x10], esi
call fcn.101580b0
add esp, 0xc
push 0xff
lea eax, [ebp + 0x3a0]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
lea eax, [ebp + 0x3a0]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
cmp eax, esi
mov dword [ebp - 0x14], eax
je 0x1012d49b
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0x10]
lea eax, [eax + ecx*4]
cmp dword [eax], 0
je 0x1012d489
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov ebx, eax
test ebx, ebx
je 0x1012d489
push ebx
lea ecx, [ebp]
call fcn.100019a0
and dword [ebp - 4], 0
push str.127.0.0.1
lea ecx, [ebp]
call fcn.10037150
push ebx
call fcn.1015d080
cmp eax, 0x1e
pop ecx
jae 0x1012d44f
push ebx
call fcn.1015d080
pop ecx
mov edi, eax
jmp 0x1012d452
push 0x1d
pop edi
push edi
lea eax, [ebp + esi + 0x1c]
push ebx
push eax
call fcn.10159070
or dword [ebp - 4], 0xffffffff
add esp, 0xc
inc dword [ebp - 0x10]
lea eax, [esi + edi]
push 0
push 1
lea ecx, [ebp]
mov byte [ebp + eax + 0x1c], 0
add esi, 0x1e
call fcn.10001b20
cmp dword [ebp - 0x10], 0x1e
jl 0x1012d3fd
cmp dword [ebp - 0x10], 0
jle 0x1012d49b
lea eax, [ebp + 0x1c]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
jmp 0x1012d49d
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x4a0]
xor ecx, ebp
call fcn.101586e7
add ebp, 0x4a4
leave
ret

Function at 0x1013d4a1
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
xor eax, eax
cmp dword [esi + 8], eax
jne 0x1013d4c6
lea ecx, [esi + 0xc]
push ecx
push eax
push esi
push 0x1013d45e
push eax
push eax
mov byte [esi + 0x11], al
call fcn.10158ba9
add esp, 0x18
mov dword [esi + 8], eax
pop esi
ret

Function at 0x101503bc
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
xor eax, eax
cmp dword [esi + 8], eax
jne 0x101503e1
lea ecx, [esi + 0xc]
push ecx
push eax
push esi
push 0x101503a2
push eax
push eax
mov byte [esi + 0x11], al
call fcn.10158ba9
add esp, 0x18
mov dword [esi + 8], eax
pop esi
ret
Function at 0x101586e7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x101c6444]
jne 0x101586f1
repz ret
jmp fcn.10163e3c
Function at 0x10165d72
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x101c6a40]
je 0x10165d8d
inc edi
cmp edi, 0x17
jb 0x10165d7e
cmp edi, 0x17
jae 0x10165f0d
push ebp
push 3
call fcn.101702af
cmp eax, 1
pop ecx
je 0x10165ed9
push 3
call fcn.101702af
test eax, eax
pop ecx
jne 0x10165dc1
cmp dword [0x101c8468], 1
je 0x10165ed9
cmp ebx, 0xfc
je 0x10165f0c
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x101c8988
push ebp
call fcn.1015b556
add esp, 0xc
test eax, eax
je 0x10165df7
push esi
push esi
push esi
push esi
push esi
call fcn.1015816d
add esp, 0x14
push 0x104
mov esi, 0x101c89a1
push esi
push 0
mov byte [0x101c8aa5], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10165e3b
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.1015b556
add esp, 0xc
test eax, eax
je 0x10165e3b
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.1015816d
add esp, 0x14
push esi
call fcn.1015d080
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x10165e80
push esi
call fcn.1015d080
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x101c8c9c
push 0x1019f75c
sub ecx, eax
push ecx
push eax
call fcn.10159a02
add esp, 0x14
test eax, eax
je 0x10165e80
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.1015816d
add esp, 0x14
jmp 0x10165e82
xor esi, esi
push 0x1019f758
push ebx
push ebp
call fcn.1015b684
add esp, 0xc
test eax, eax
je 0x10165ea2
push esi
push esi
push esi
push esi
push esi
call fcn.1015816d
add esp, 0x14
push dword [edi*8 + 0x101c6a44]
push ebx
push ebp
call fcn.1015b684
add esp, 0xc
test eax, eax
je 0x10165ec4
push esi
push esi
push esi
push esi
push esi
call fcn.1015816d
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.101700f2
add esp, 0xc
jmp 0x10165f0c
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x10165f0c
cmp ebp, 0xffffffff
je 0x10165f0c
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x101c6a44]
push dword [esi]
call fcn.1015d080
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x101700f2
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.101637a4
xor ebx, ebx
cmp dword [0x101c8f00], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x101701c8
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x101702a8
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x101702a8
push eax
call fcn.10163736
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x101c8f00], eax
call esi
push eax
call fcn.10163736
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x101c8f04], eax
call esi
push eax
call fcn.10163736
mov dword [0x101c8f08], eax
lea eax, [ebp - 0xc]
push eax
call fcn.10161fc8
test eax, eax
pop ecx
pop ecx
je 0x10170196
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.1015816d
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x101701c8
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.10163736
cmp eax, ebx
pop ecx
mov dword [0x101c8f10], eax
je 0x101701c8
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10163736
pop ecx
mov dword [0x101c8f0c], eax
mov eax, dword [0x101c8f0c]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x1017024d
cmp dword [0x101c8f10], ecx
je 0x1017024d
push eax
call fcn.101637ad
push dword [0x101c8f10]
mov esi, eax
call fcn.101637ad
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x1017024d
cmp edi, ebx
je 0x1017024d
call esi
cmp eax, ebx
je 0x1017021a
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1017021a
test byte [ebp - 0x18], 1
jne 0x1017024d
lea eax, [ebp - 0x10]
push eax
call fcn.10161fff
test eax, eax
pop ecx
je 0x10170235
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.1015816d
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x10170244
or dword [ebp + 0x10], 0x200000
jmp 0x10170288
or dword [ebp + 0x10], 0x40000
jmp 0x10170288
mov eax, dword [0x101c8f04]
cmp eax, dword [ebp - 8]
je 0x10170288
push eax
call fcn.101637ad
cmp eax, ebx
pop ecx
je 0x10170288
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x10170288
mov eax, dword [0x101c8f08]
cmp eax, dword [ebp - 8]
je 0x10170288
push eax
call fcn.101637ad
cmp eax, ebx
pop ecx
je 0x10170288
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x101c8f00]
call fcn.101637ad
cmp eax, ebx
pop ecx
je 0x101702a8
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x101702aa
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret