joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10080c70
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x102b5040]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x40
push 0
lea eax, [ebp - 0x44]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x40
push 0x36
lea ecx, [ebp - 0xc4]
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x40
push 0x5c
lea edx, [ebp - 0x104]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [ebp + 0xc], 0x40
jbe 0x10080cd7
push 0x40
lea eax, [ebp - 0x44]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10080e80
add esp, 0x10
jmp 0x10080ceb
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x44]
push edx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [ebp - 0x108], 0
jmp 0x10080d06
mov eax, dword [ebp - 0x108]
add eax, 1
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0x40
jge 0x10080d61
mov ecx, dword [ebp - 0x108]
movzx edx, byte [ebp + ecx - 0x44]
mov eax, dword [ebp - 0x108]
movzx ecx, byte [ebp + eax - 0xc4]
xor ecx, edx
mov edx, dword [ebp - 0x108]
mov byte [ebp + edx - 0xc4], cl
mov eax, dword [ebp - 0x108]
movzx ecx, byte [ebp + eax - 0x44]
mov edx, dword [ebp - 0x108]
movzx eax, byte [ebp + edx - 0x104]
xor eax, ecx
mov ecx, dword [ebp - 0x108]
mov byte [ebp + ecx - 0x104], al
jmp 0x10080cf7
push 0x20
lea edx, [ebp - 0x64]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 0x40
lea edx, [ebp - 0xc4]
push edx
call fcn.10080e00
add esp, 0x18
push 0x20
lea eax, [ebp - 0x84]
push eax
push 0x20
lea ecx, [ebp - 0x64]
push ecx
push 0x40
lea edx, [ebp - 0x104]
push edx
call fcn.10080e00
add esp, 0x18
cmp dword [ebp + 0x1c], 0x20
jbe 0x10080db2
mov dword [ebp - 0x10c], 0x20
jmp 0x10080dbb
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10c], eax
mov ecx, dword [ebp - 0x10c]
mov dword [ebp - 0x110], ecx
mov edx, dword [ebp - 0x110]
push edx
lea eax, [ebp - 0x84]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0x110]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101412b5
mov esp, ebp
pop ebp
ret
Function at 0x10081430
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 0x28], 0
mov ecx, dword [ebp + 8]
xor edx, edx
xor eax, eax
mov dword [ecx], edx
mov dword [ecx + 4], eax
mov ecx, 4
imul edx, ecx, 0
mov eax, dword [ebp + 8]
mov dword [eax + edx + 8], 0x6a09e667
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 8], 0xbb67ae85
mov eax, 4
shl eax, 1
mov ecx, dword [ebp + 8]
mov dword [ecx + eax + 8], 0x3c6ef372
mov edx, 4
imul eax, edx, 3
mov ecx, dword [ebp + 8]
mov dword [ecx + eax + 8], 0xa54ff53a
mov edx, 4
shl edx, 2
mov eax, dword [ebp + 8]
mov dword [eax + edx + 8], 0x510e527f
mov ecx, 4
imul edx, ecx, 5
mov eax, dword [ebp + 8]
mov dword [eax + edx + 8], 0x9b05688c
mov ecx, 4
imul edx, ecx, 6
mov eax, dword [ebp + 8]
mov dword [eax + edx + 8], 0x1f83d9ab
mov ecx, 4
imul edx, ecx, 7
mov eax, dword [ebp + 8]
mov dword [eax + edx + 8], 0x5be0cd19
pop ebp
ret
Function at 0x10084e40
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x6ff410
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [0x6ff410], 0xc3
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 4]
push edx
push 1
push 0x6ff410
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 8], 0x8d5038
mov eax, dword [ebp - 8]
movss xmm0, dword [ebp + 8]
movss dword [eax], xmm0
mov esp, ebp
pop ebp
ret 4
Function at 0x1008f710
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x10]
not eax
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], 0x10287538
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 0xc]
sub eax, 1
mov dword [ebp + 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x1008f771
mov ecx, dword [ebp - 4]
shr ecx, 8
mov edx, dword [ebp - 4]
and edx, 0xff
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
xor edx, eax
mov eax, dword [ebp - 0x10]
xor ecx, dword [eax + edx*4]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x14]
mov dword [ebp - 4], edx
jmp 0x1008f72b
mov eax, dword [ebp - 4]
not eax
mov esp, ebp
pop ebp
ret

Function at 0x1008f780
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x10]
not eax
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], 0x10287538
cmp dword [ebp + 0xc], 0
je 0x1008f839
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0xc]
sub ecx, 1
mov dword [ebp + 0xc], ecx
cmp dword [ebp - 0x14], 0
je 0x1008f837
mov edx, dword [ebp - 8]
mov al, byte [edx]
mov byte [ebp - 3], al
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov dl, byte [ebp - 3]
mov byte [ebp - 2], dl
movzx eax, byte [ebp - 2]
cmp eax, 0x23
jne 0x1008f814
cmp dword [ebp + 0xc], 2
jb 0x1008f814
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x23
jne 0x1008f814
mov edx, 1
shl edx, 0
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x23
jne 0x1008f814
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
shr eax, 8
mov ecx, dword [ebp - 0xc]
and ecx, 0xff
movzx edx, byte [ebp - 2]
xor ecx, edx
mov edx, dword [ebp - 0x10]
xor eax, dword [edx + ecx*4]
mov dword [ebp - 0xc], eax
jmp 0x1008f7ab
jmp 0x1008f8ae
mov eax, dword [ebp - 8]
mov cl, byte [eax]
mov byte [ebp - 4], cl
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov al, byte [ebp - 4]
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
test ecx, ecx
je 0x1008f8ae
movzx edx, byte [ebp - 1]
cmp edx, 0x23
jne 0x1008f88f
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp - 8]
movzx eax, byte [edx + ecx]
cmp eax, 0x23
jne 0x1008f88f
mov ecx, 1
shl ecx, 0
mov edx, dword [ebp - 8]
movzx eax, byte [edx + ecx]
cmp eax, 0x23
jne 0x1008f88f
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
shr edx, 8
mov eax, dword [ebp - 0xc]
and eax, 0xff
movzx ecx, byte [ebp - 1]
xor eax, ecx
mov ecx, dword [ebp - 0x10]
xor edx, dword [ecx + eax*4]
mov dword [ebp - 0xc], edx
jmp 0x1008f839
mov eax, dword [ebp - 0xc]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x1008fa60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
xor edx, edx
pop ebp
ret

Function at 0x1008fa80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
xor edx, edx
pop ebp
ret
Function at 0x100dec00
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101a0a9d
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x102b5040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
push eax
call fcn.10016f50
add esp, 4
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.100df760
add esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0x100df7d0
mov edx, dword [ebp - 0x10]
add edx, 4
push edx
push 0
lea ecx, [ebp - 0x14]
call fcn.1000aa20
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov edx, dword [ebp - 0x10]
cmp dword [edx], 0
je 0x100dec8a
lea ecx, [ebp - 0x14]
call fcn.10031cf0
nop
jmp 0x100dec9d
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0
push 6
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.100defe0
nop
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x100e06c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
call fcn.100e03d0
mov dword [ebp - 4], eax
lea ecx, [ebp - 4]
lea eax, [ebp - 8]
push eax
call fcn.100e0720
mov dword [ebp - 0x14], 4
mov esi, dword [eax]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 0xc]
mov esi, dword [esi]
test eax, eax
je 0x100e0719
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 4]
push eax
push ecx
push dword [ebp - 0x14]
mov dword [ebp - 4], ecx
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100e60b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 0x78]
test eax, eax
je 0x100e60d4
push dword [edi + 0x74]
call eax
add esp, 4
mov esi, dword [edi + 0x54]
test esi, esi
je 0x100e6139
nop dword [eax + eax]
mov ebx, dword [esi + 4]
xor edx, edx
mov eax, dword [ebx + 0x60]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x54]
test eax, eax
je 0x100e6132
mov ecx, dword [eax + 8]
cmp eax, esi
je 0x100e6106
mov edx, eax
mov eax, ecx
test eax, eax
jne 0x100e60f5
jmp 0x100e6132
test edx, edx
jne 0x100e610f
mov dword [ebx + 0x54], ecx
jmp 0x100e6112
mov dword [edx + 8], ecx
mov eax, dword [esi + 0x14]
test eax, eax
je 0x100e611f
push esi
call eax
add esp, 4
push esi
call fcn.100e65e0
mov eax, dword [ebp - 4]
push esi
push eax
mov eax, dword [eax + 8]
call eax
add esp, 0xc
mov esi, dword [edi + 0x54]
test esi, esi
jne 0x100e60e0
mov ebx, dword [ebp + 8]
lea eax, [edi + 0x6c]
mov dword [ebp - 8], eax
test eax, eax
je 0x100e61c4
test ebx, ebx
je 0x100e61c4
mov ebx, dword [eax]
test ebx, ebx
je 0x100e61b4
mov edi, dword [ebp + 8]
mov esi, dword [ebx + 8]
mov eax, dword [ebx + 4]
mov dword [ebp - 4], eax
mov eax, dword [esi + 8]
test eax, eax
je 0x100e6169
push esi
call eax
add esp, 4
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x3c]
test eax, eax
je 0x100e617c
push esi
call eax
add esp, 4
mov eax, dword [esi + 0x28]
test eax, eax
je 0x100e618d
push eax
mov eax, dword [edi + 8]
push edi
call eax
add esp, 8
mov dword [esi + 0x28], 0
mov eax, dword [edi + 8]
push esi
push edi
call eax
mov eax, dword [edi + 8]
push ebx
push edi
call eax
mov eax, dword [ebp - 4]
add esp, 0x10
mov ebx, eax
test eax, eax
jne 0x100e6153
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
mov ebx, dword [ebp + 8]
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [edi + 0x30]
mov dword [edi + 0x58], 0
test eax, eax
je 0x100e61d8
push edi
call eax
add esp, 4
push ebx
push edi
call fcn.100e6000
mov eax, dword [ebp - 0xc]
add esp, 8
mov eax, dword [eax + 0x34]
test eax, eax
je 0x100e61f2
push edi
call eax
add esp, 4
mov esi, dword [edi + 0x68]
mov eax, dword [edi + 8]
mov dword [ebp + 0xc], eax
test esi, esi
je 0x100e6228
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 0x1c]
mov dword [ebp + 0x10], eax
test ecx, ecx
je 0x100e6215
push esi
call ecx
mov eax, dword [ebp + 0x10]
add esp, 4
test dword [ebp + 0xc], 0x400
jne 0x100e6228
push esi
push eax
mov eax, dword [eax + 8]
call eax
add esp, 8
mov eax, dword [edi + 0x80]
mov dword [edi + 0x68], 0
test eax, eax
je 0x100e624d
push eax
mov eax, dword [ebx + 8]
push ebx
call eax
add esp, 8
mov dword [edi + 0x80], 0
mov eax, dword [ebx + 8]
push edi
push ebx
call eax
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1013bd50
Capabilities:
Get file size
Read file on windows
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x1013bd66
lea eax, [esi + 0x28]
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push 0
push 0x80
push 3
push 0
push 1
push connect
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x1013bd94
pop ebx
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
push edi
lea eax, [ebp - 0xc]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp + 8], eax
je 0x1013be8e
mov ecx, dword [ebp - 8]
test ecx, ecx
jg 0x1013be8e
mov eax, dword [ebp - 0xc]
jl 0x1013bdcb
cmp eax, 0x7fffffff
ja 0x1013be8e
or eax, ecx
je 0x1013be8e
push 0
push 0
push 0
push 2
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
test edi, edi
je 0x1013be8e
mov ecx, dword [ebp - 0xc]
push 0
push 0
push 0
push 4
push edi
mov dword [esi + 4], ecx
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push edi
mov dword [esi], eax
call dword [ebp + 8]
cmp dword [esi], 0
je 0x1013be1c
mov eax, 0x1013bef0
jmp 0x1013be5d
push dword [esi + 4]
mov eax, dword [esi + 0x1c]
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esi], eax
test eax, eax
je 0x1013be8e
xor edi, edi
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [esi + 4]
sub eax, edi
push eax
mov eax, dword [esi]
add eax, edi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1013be7f
add edi, dword [ebp - 4]
cmp edi, dword [esi + 4]
jne 0x1013be34
mov eax, 0x1013bec0
push ebx
mov dword [esi + 0x18], eax
call dword [ebp + 8]
mov eax, dword [esi]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0xc]
pop edi
mov dword [esi + 0x10], eax
xor eax, eax
pop ebx
mov dword [esi + 0x14], 0
pop esi
mov esp, ebp
pop ebp
ret
push dword [esi]
mov eax, dword [esi + 0x1c]
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push ebx
call dword [ebp + 8]
pop edi
pop ebx
mov dword [esi], 0
mov eax, 0x51
mov dword [esi + 4], 0
mov dword [esi + 8], 0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1013d4c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
test edx, edx
jne 0x1013d4d3
xor eax, eax
pop esi
pop ebp
ret
mov eax, dword [ebp + 8]
not eax
cmp esi, 8
jb 0x1013d58e
push edi
mov edi, esi
shr edi, 3
movzx ecx, byte [edx]
sub esi, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x101bba20]
movzx ecx, byte [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x101bba20]
movzx ecx, byte [edx + 2]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x101bba20]
movzx ecx, byte [edx + 3]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x101bba20]
movzx ecx, byte [edx + 4]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x101bba20]
movzx ecx, byte [edx + 5]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x101bba20]
movzx ecx, byte [edx + 6]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x101bba20]
movzx ecx, byte [edx + 7]
add edx, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x101bba20]
sub edi, 1
jne 0x1013d4e7
pop edi
test esi, esi
je 0x1013d5ac
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x101bba20]
sub esi, 1
jne 0x1013d592
not eax
pop esi
pop ebp
ret
Function at 0x10140bb3
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x10140bda
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x10140bdd
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.10140b8f
pop esi
leave
ret 8
Function at 0x1014c3d0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x1014c47f
push esi
call fcn.101623a0
add esp, 4
test al, al
jne 0x1014c47f
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x1014c3f7
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.1016b520
add esp, 0xc
test eax, eax
je 0x1014c42b
sub eax, esi
push eax
push 0x2e
push esi
call fcn.1016b520
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x1014c42d
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
lea ebx, [esi + edi]
mov edi, 0x1505
cmp esi, ebx
jae 0x1014c45e
nop dword [eax]
mov al, byte [esi]
push eax
call fcn.1015ff70
movsx ecx, al
inc esi
mov eax, edi
add esp, 4
shl eax, 5
add eax, edi
xor ecx, eax
mov edi, ecx
cmp esi, ebx
jb 0x1014c440
mov eax, 0x4104105
mov esi, edi
mul edi
sub esi, edx
shr esi, 1
add esi, edx
shr esi, 5
mov ecx, esi
shl ecx, 6
sub ecx, esi
sub edi, ecx
mov eax, edi
pop edi
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x101592d0
Capabilities:
Write file on windows

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp byte [edi + 0x6bb], 0
je 0x1015936f
cmp dword [edi + 0x194], 0
je 0x10159327
push edi
call fcn.101470e0
push 1
push edi
mov byte [esp + 0x14], al
call fcn.10147580
push dword [edi + 0x144]
mov eax, dword [edi + 0x194]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push edi
call eax
push dword [esp + 0x28]
push edi
call fcn.10147580
add esp, 0x28
pop edi
ret
mov ecx, dword [esp + 0xc]
mov eax, ecx
sub eax, 0
je 0x1015933c
sub eax, 1
je 0x1015933c
sub eax, 1
jne 0x1015936f
push dword [edi + 0x140]
lea eax, [ecx*2 + 0x101bfad8]
push 1
add eax, ecx
push 2
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push dword [edi + 0x140]
push 1
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x20
pop edi
ret

Function at 0x1015cad0
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
push edi
push str.kernel32
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
test ebx, ebx
jne 0x1015caea
pop edi
pop ebx
pop ecx
ret
push ebp
push esi
push str.LoadLibraryExA
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [esp + 0x18]
mov ebp, eax
push 0x101c019c
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strpbrk]
add esp, 8
test eax, eax
je 0x1015cb33
test ebp, ebp
je 0x1015cb24
push 8
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
test ebp, ebp
je 0x1015cb59
push str.AddDllDirectory
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1015cb59
push 0x800
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, eax
mov dword [esp + 0x10], edx
test edx, edx
je 0x1015cc0f
mov ecx, esi
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1015cb76
sub ecx, ebx
lea eax, [ecx + 1]
add eax, edx
push eax
call dword [0x102b50b0]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x1015cc05
push dword [esp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1015cc05
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1015cba8
sub ecx, edx
mov eax, 0x5c
mov word [ecx + ebx], ax
mov ecx, ebx
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1015cbc0
sub ecx, edx
sub ecx, esi
add ecx, ebx
nop dword [eax]
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x1015cbd0
test ebp, ebp
je 0x1015cbfc
push 8
push 0
push ebx
call ebp
push ebx
mov edi, eax
call dword [0x102b50b4]
add esp, 4
mov eax, edi
pop esi
pop ebp
pop edi
pop ebx
pop ecx
ret
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
push ebx
call dword [0x102b50b4]
add esp, 4
pop esi
pop ebp
mov eax, edi
pop edi
pop ebx
pop ecx
ret
Function at 0x10162550
Capabilities:
Create udp socket

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x1016258e
mov eax, dword [esi + 0x7c]
cmp byte [eax + 0x114], 0
jne 0x1016257f
push 0
call fcn.10162550
add esp, 4
test al, al
mov eax, dword [esi + 0x7c]
setne cl
inc cl
mov byte [eax + 0x114], cl
mov eax, dword [esi + 0x7c]
pop esi
cmp byte [eax + 0x114], 2
sete al
ret
push 0
push 2
push 0x17
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
jne 0x101625a3
xor al, al
pop esi
ret
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov al, 1
pop esi
ret
Function at 0x10163300
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x6c
mov eax, dword [0x102b5040]
xor eax, esp
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x70]
push ebp
mov ebp, dword [esp + 0x78]
push edi
xor edi, edi
mov dword [esp + 8], eax
cmp byte [eax + 0x6bb], 0
je 0x101634e2
cmp byte [ebp + 0x18], 0
push ebx
lea ebx, [ebp + 0x18]
je 0x101634e1
lea eax, [esp + 0x30]
push eax
push ebx
push 2
call fcn.10170470
add esp, 0xc
test eax, eax
jg 0x101634e1
lea eax, [esp + 0x34]
push eax
push ebx
push 0x17
call fcn.10170470
add esp, 0xc
test eax, eax
jg 0x101634e1
cmp byte [ebx], 0
mov eax, 0x101c0c6c
push esi
push dword [ebp + 0x14]
mov esi, dword [ebp]
cmovne eax, ebx
mov ebp, dword [esp + 0x14]
push eax
push str.Host__s:_d_was_resolved.
push ebp
call fcn.10159450
lea eax, [esp + 0x24]
push 0x400
push eax
call fcn.10146ac0
lea eax, [esp + 0x3c]
push 0x400
push eax
call fcn.10146ac0
add esp, 0x20
test esi, esi
je 0x10163454
lea edx, [edi + 0x10]
mov ecx, dword [esi + 4]
cmp ecx, 0x17
je 0x101633c8
cmp ecx, 2
jne 0x10163449
xor eax, eax
mov byte [esp + 0x48], 0
cmp ecx, 2
lea ebx, [esp + 0x14]
cmovne eax, edx
add ebx, eax
sub ecx, 2
je 0x101633f7
sub ecx, 0x15
jne 0x1016340f
push 0x2e
lea eax, [esp + 0x4c]
push eax
mov eax, dword [esi + 0x18]
add eax, 8
push eax
push 0x17
jmp 0x10163407
push 0x2e
lea eax, [esp + 0x4c]
push eax
mov eax, dword [esi + 0x18]
add eax, 4
push eax
push 2
call fcn.1018cd70
add esp, 0x10
push ebx
call fcn.10146ae0
add esp, 4
test eax, eax
je 0x1016342e
push 2
push 0x102a6cb8
push ebx
call fcn.10146a80
add esp, 0xc
mov edi, eax
test edi, edi
jne 0x10163474
lea eax, [esp + 0x48]
push eax
push ebx
call fcn.10146a20
mov edi, eax
add esp, 8
test edi, edi
jne 0x10163474
lea edx, [eax + 0x10]
mov esi, dword [esi + 0x1c]
test esi, esi
jne 0x101633b7
lea eax, [esp + 0x24]
push eax
call fcn.10146ae0
add esp, 4
test eax, eax
je 0x10163484
lea eax, [esp + 0x24]
push eax
call fcn.10146af0
add esp, 4
jmp 0x10163489
push str.too_many_IP__cant_show
push ebp
call fcn.10159450
add esp, 8
jmp 0x101634c9
mov eax, 0x101c0c6c
push eax
push str.IPv6:__s
push ebp
call fcn.10159450
lea eax, [esp + 0x20]
push eax
call fcn.10146ae0
add esp, 0x10
test eax, eax
je 0x101634b5
lea eax, [esp + 0x14]
push eax
call fcn.10146af0
add esp, 4
jmp 0x101634ba
mov eax, 0x101c0c6c
push eax
push str.IPv4:__s
push ebp
call fcn.10159450
add esp, 0xc
lea eax, [esp + 0x14]
push eax
call fcn.10146a90
lea eax, [esp + 0x28]
push eax
call fcn.10146a90
add esp, 8
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
pop edi
pop ebp
xor ecx, esp
call fcn.101412b5
add esp, 0x6c
ret