joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003da80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
push eax
push ebx
cmp ecx, 0
je 0x1003db6a
and ebp, 0xfffffff8
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
je 0x1003dafd
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.1003d240
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x1003dac3
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x1003dc33
call fcn.1003db0f
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x1003dbca
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.1003d660
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x1003db7b
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x1003dc33
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.1003d660
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x1003dc2e
jmp 0x1003dc33
mov ecx, dword [esp + 0x3c]
add esp, 0x18
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x1003e960
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x1003e97e
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
ret
Function at 0x1003e9c0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x1003e9de
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
ret

Function at 0x1003ea20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x1003ea42
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
ret

Function at 0x1003eaa0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x1003eac2
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
ret

Function at 0x1003eb20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x1003eb4a
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
ret
Function at 0x1003ebb0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x1003ebda
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
ret

Function at 0x1003ec40
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesenc xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesenc xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesenc xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x1003ec9f

Function at 0x1003ecae
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x1003ec90
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
ret

Function at 0x1003ed20
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesdec xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x1003ed7f

Function at 0x1003ed8e
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x1003ed70
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
ret
Function at 0x10041400
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
push ebx
test eax, eax
je 0x10041920
test edx, edx
je 0x10041920
call fcn.10041417
mov eax, 0xffffffff
pop ebx
pop ebp
ret

Function at 0x10041960
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.10041400
mov edx, dword [esp + 0xc]
shl ecx, 4
test eax, eax
jne 0x100419d1
lea eax, [edx + ecx + 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
movups xmmword [eax], xmm0
movups xmmword [edx], xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmmword [edx - 0x10], xmm1
cmp eax, edx
ja 0x10041996
movups xmm0, xmmword [edx]
aesimc xmm0, xmm0
movups xmmword [edx], xmm0
pxor xmm0, xmm0
pxor xmm1, xmm1
xor eax, eax
ret

Function at 0x100422e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push esi
push edi
sub esp, 0x10
mov ebp, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
bswap eax
bswap ebx
bswap ecx
bswap edx
mov dword [edi], eax
mov dword [edi + 4], ebx
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
cmp ebp, 0x80
je 0x10042364
mov eax, dword [esi + 0x10]
mov ebx, dword [esi + 0x14]
cmp ebp, 0xc0
je 0x1004233c
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0x1c]
jmp 0x10042344
mov ecx, eax
mov edx, ebx
not ecx
not edx
bswap eax
bswap ebx
bswap ecx
bswap edx
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ecx
mov dword [edi + 0x2c], edx
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
nop
call fcn.10042369
Function at 0x10050a90
Capabilities:
Write file on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10297310
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x28
mov eax, dword [0x10343c80]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], 0
mov eax, closesocket
mov edx, dword [ebx + 0x18]
sub eax, edx
cmp eax, 1
jb 0x10050c01
cmp dword [ebx + 0x1c], 0xf
lea eax, [ebx + 8]
push 1
cmova eax, dword [ebx + 8]
push 0x1032f208
push edx
push eax
push ecx
push dword [ebp - 0x20]
lea ecx, [ebp - 0x38]
call fcn.10056510
mov ecx, dword [ebx + 0x1c]
cmp ecx, 0xf
jbe 0x10050b3f
mov edx, dword [ebx + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10050b35
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10050c06
push ecx
push edx
call fcn.1026afa8
add esp, 8
movups xmm1, xmmword [ebp - 0x38]
lea esi, [ebx + 8]
movq xmm0, qword [ebp - 0x28]
movq qword [ebx + 0x18], xmm0
mov edi, dword [ebx + 0x1c]
cmp edi, 0xf
movd edx, xmm1
movups xmmword [ebx + 8], xmm1
cmova esi, edx
mov ecx, esi
lea eax, [ecx + 1]
mov dword [ebp - 0x1c], eax
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10050b70
sub ecx, dword [ebp - 0x1c]
je 0x10050bb7
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10050b87
push 0
lea eax, [ebp - 0x18]
sub ecx, edx
push eax
push ecx
push esi
push dword [ebp - 0x20]
call edi
test eax, eax
jne 0x10050bb1
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10050ba6
sub eax, edx
jne 0x10050b82
mov edi, dword [ebx + 0x1c]
mov edx, dword [ebx + 8]
cmp edi, 0xf
jbe 0x10050be3
lea ecx, [edi + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x10050bd9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10050c06
push ecx
push edx
call fcn.1026afa8
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1026af9a
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.1004bc80
call fcn.1027083a
int3
Function at 0x100516f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x10051722
jl 0x10051715
test ecx, ecx
jne 0x10051722
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x100517e2
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, ebx
call fcn.10054320
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x1005178e
jg 0x1005174d
test esi, esi
je 0x1005178e
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jg 0x10051765
mov eax, dword [esp + 0x10]
jl 0x1005175f
cmp eax, esi
jae 0x10051765
mov esi, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.1026cc70
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub ecx, esi
sbb edx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x100517af
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x100517cb
mov ecx, dword [esp + 0x10]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
test edx, edx
jg 0x10051734
jl 0x100517cb
test ecx, ecx
jne 0x10051734
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0x10]
sbb ecx, edx
mov edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
lea esi, [ebx + 0x2c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x10051826
mov eax, dword [esi]
mov eax, dword [eax]
test eax, eax
je 0x10051826
mov edi, dword [esp + 0xc]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push edi
call fcn.1026cc70
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x18], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
lea esi, [ebx + 0x2c]
cmp dword [ebx + 0x4c], 0
je 0x10051897
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x1005184c
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
cmp edi, 0xfff
jbe 0x10051882
nop dword [eax + eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.10272027
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x10051897
cmp edi, eax
ja 0x10051860
test edi, edi
je 0x10051897
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.10272027
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10054e50
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10296dd0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x10343c80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.1026afd9
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.10255222
add esp, 8
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.10054900
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100570d0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x10343c80]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
push str.ITkrfSaV_4f7KwdfnC_Ds165XU4C_lH6R9pk1
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1005711e
test esi, esi
je 0x1005710e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x24]
pop esi
xor ecx, esp
call fcn.1026af9a
mov esp, ebp
pop ebp
ret
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10349474]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10349c5c]
cmp eax, dword [ecx + 4]
jle 0x10057177
push 0x10349c5c
call fcn.1026b08a
add esp, 4
cmp dword [0x10349c5c], 0xffffffff
jne 0x10057177
push 0x10349c60
call fcn.10056fe0
add esp, 4
push 0x1029bcd0
call fcn.1026b3f3
add esp, 4
push 0x10349c5c
call fcn.1026b039
add esp, 4
lea eax, [esp + 8]
mov ecx, 0x10349c60
push eax
call fcn.10053520
mov esi, eax
mov ecx, 0x10349c60
lea eax, [esp + 4]
push eax
call fcn.10053540
push ecx
push dword [esi]
lea ecx, [esp + 0x14]
push dword [eax]
call fcn.10055240
sub esp, 0x18
lea eax, [esp + 0x24]
mov ecx, esp
push eax
call fcn.10053400
call fcn.1004d5f0
int3
Function at 0x100598f0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10343c80]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xc], esi
cmp ebx, 0xffffffff
je 0x10059ab2
cmp byte [ebp + 8], 0
je 0x10059952
mov al, byte [edx]
test al, 8
je 0x10059952
or al, 8
xor ecx, ecx
push 4
mov byte [edx], al
lea eax, [ebp - 8]
push eax
push 0x80
push 0xffff
push ebx
mov dword [ebp - 8], ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
lea ecx, [ebp - 0x18]
setne dl
call fcn.10059870
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
mov ebx, eax
mov ecx, esi
test ebx, ebx
setne dl
call fcn.10059870
test ebx, ebx
je 0x10059aa0
mov esi, dword [0x103447d4]
push edi
mov edi, dword [0x103447d0]
cmp edi, 0x257edfd1
jne 0x1005998c
cmp esi, 0xb2ab117a
je 0x1005999c
cmp edi, 0x257edfd0
jne 0x100599a0
cmp esi, 0xb2ab117a
jne 0x100599a0
mov al, 1
jmp 0x100599c0
mov eax, dword [0x103447c8]
mov ecx, 0x103447c8
push 0x2733
mov eax, dword [eax + 0x18]
call eax
mov esi, dword [0x103447d4]
mov edi, dword [0x103447d0]
mov ecx, dword [ebp - 0xc]
lea edx, [ebp - 0x18]
movzx eax, al
add eax, 2
mov dword [ebp - 0x18], 0x2733
mov dword [ebp - 0x14], 0x103447c8
mov dword [ebp - 0x10], eax
call fcn.100580b0
test al, al
jne 0x10059a57
cmp edi, 0x257edfd1
jne 0x100599f6
cmp esi, 0xb2ab117a
je 0x10059a06
cmp edi, 0x257edfd0
jne 0x10059a0a
cmp esi, 0xb2ab117a
jne 0x10059a0a
mov al, 1
jmp 0x10059a1e
mov eax, dword [0x103447c8]
mov ecx, 0x103447c8
push 0x4d5
mov eax, dword [eax + 0x18]
call eax
mov ecx, dword [ebp - 0xc]
lea edx, [ebp - 0x18]
movzx eax, al
add eax, 2
mov dword [ebp - 0x18], 0x4d5
mov dword [ebp - 0x14], 0x103447c8
mov dword [ebp - 0x10], eax
call fcn.100580b0
test al, al
jne 0x10059a57
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1026af9a
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x1c]
lea eax, [ebp - 8]
push eax
push 0x8004667e
push esi
mov dword [ebp - 8], 0
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov eax, dword [ebp - 0x20]
push esi
and byte [eax], 0xfc
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [ebp - 0xc]
mov esi, eax
test esi, esi
setne dl
call fcn.10059870
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1026af9a
mov esp, ebp
pop ebp
ret
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1026af9a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.1026af9a
mov esp, ebp
pop ebp
ret
Function at 0x10059dc0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10343c80]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0xc]
push 0
push 0
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push dword [ebp + 8]
mov dword [ebp - 0xc], 0
push edx
push ecx
call dword [sym.imp.WS2_32.dll_WSARecv]
mov dword [ebp - 0x14], eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, dword [0x103447d0]
mov esi, eax
mov ecx, dword [0x103447d4]
cmp edx, 0x257edfd1
jne 0x10059e22
cmp ecx, 0xb2ab117a
je 0x10059e32
cmp edx, 0x257edfd0
jne 0x10059e39
cmp ecx, 0xb2ab117a
jne 0x10059e39
test esi, esi
setne al
jmp 0x10059e49
mov eax, dword [0x103447c8]
mov ecx, 0x103447c8
push esi
mov eax, dword [eax + 0x18]
call eax
movzx ecx, al
mov ebx, 0x1ffff7
mov dword [edi], esi
mov dword [edi + 4], 0x103447c8
mov dword [ebp - 0x10], ebx
lea eax, [ecx + 2]
mov dword [edi + 8], eax
cmp ecx, 0xffffffff
je 0x10059e71
mov eax, esi
mov ebx, 0x103447c8
jmp 0x10059e85
xor edx, edx
mov eax, 0x103447c8
div ebx
mov ebx, dword [edi + 4]
imul eax, edx, 0x3e8
add eax, esi
cmp eax, 0x40
jne 0x10059edc
mov ecx, dword [0x103447d0]
mov eax, dword [0x103447d4]
cmp ecx, 0x257edfd1
jne 0x10059ea4
cmp eax, 0xb2ab117a
je 0x10059eb3
cmp ecx, 0x257edfd0
jne 0x10059ec0
cmp eax, 0xb2ab117a
jne 0x10059ec0
mov al, 1
mov dword [edi], 0x2746
jmp 0x10059f42
mov eax, dword [0x103447c8]
mov ecx, 0x103447c8
push 0x2746
mov eax, dword [eax + 0x18]
call eax
mov dword [edi], 0x2746
jmp 0x10059f42
cmp ecx, 0xffffffff
je 0x10059ee5
mov eax, esi
jmp 0x10059ef4
xor edx, edx
mov eax, ebx
div dword [ebp - 0x10]
imul eax, edx, 0x3e8
add eax, esi
cmp eax, 0x4d2
jne 0x10059f54
mov ecx, dword [0x103447d0]
mov eax, dword [0x103447d4]
cmp ecx, 0x257edfd1
jne 0x10059f15
cmp eax, 0xb2ab117a
je 0x10059f24
cmp ecx, 0x257edfd0
jne 0x10059f28
cmp eax, 0xb2ab117a
jne 0x10059f28
mov al, 1
jmp 0x10059f3c
mov eax, dword [0x103447c8]
mov ecx, 0x103447c8
push 0x274d
mov eax, dword [eax + 0x18]
call eax
mov dword [edi], 0x274d
movzx eax, al
add eax, 2
mov dword [edi + 4], 0x103447c8
mov dword [edi + 8], eax
jmp 0x10059f93
cmp ecx, 0xffffffff
je 0x10059f5d
mov eax, esi
jmp 0x10059f6c
xor edx, edx
mov eax, ebx
div dword [ebp - 0x10]
imul eax, edx, 0x3e8
add eax, esi
cmp eax, 0x2738
je 0x10059fad
cmp ecx, 0xffffffff
jne 0x10059f8b
xor edx, edx
mov eax, ebx
mov ecx, 0x1ffff7
div ecx
imul eax, edx, 0x3e8
add esi, eax
cmp esi, 0xea
je 0x10059fad
cmp dword [ebp - 0x14], 0
je 0x10059fad
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1026af9a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xorps xmm0, xmm0
mov eax, dword [ebp - 8]
xor ecx, ebp
movq qword [edi], xmm0
mov dword [edi + 8], 0
pop edi
pop esi
pop ebx
call fcn.1026af9a
mov esp, ebp
pop ebp
ret