joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003968
Capabilities:
Query environment variable

Disassembly:
jmp 0x1018e802
mov edi, edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x1018e816
xor edi, edi
jmp 0x1018e85a
push ebx
push esi
call fcn.1018e6fb
push 0x40
mov ebx, eax
push str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
sub ebx, esi
and ebx, 0xfffffffe
push 2
push ebx
call fcn.100059c5
mov edi, eax
add esp, 0x14
test edi, edi
je 0x1018e847
push ebx
push esi
push edi
call fcn.10005c09
add esp, 0xc
push 2
push 0
call fcn.100052f4
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
pop ebx
mov eax, edi
pop edi
pop esi
ret

Function at 0x10005461
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x101a1640
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x40
cmp dword [0x103acc6c], 1
jge 0x101a16af
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
je 0x101a1685
mov edx, dword [ebx + 8]
movzx eax, word [edx]
movzx ecx, word [ebx + 0xc]
cmp eax, ecx
je 0x101a1685
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x101a1662
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x101a169b
mov eax, dword [ebx + 8]
mov dword [ebp - 4], eax
jmp 0x101a16a2
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
jmp 0x101a179f
movzx ecx, word [ebx + 0xc]
movd xmm0, ecx
movaps xmmword [ebp - 0x30], xmm0
pshuflw xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
pshufd xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
mov edx, dword [ebx + 8]
and edx, 0xfff
cmp edx, 0xff0
ja 0x101a1770
mov eax, dword [ebx + 8]
movups xmm0, xmmword [eax]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pxor xmm0, xmmword [ebp - 0x20]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pcmpeqw xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x40]
pcmpeqw xmm0, xmmword [ebp - 0x30]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
por xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pmovmskb ecx, xmm0
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x101a1765
bsf edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebx + 8]
mov dword [ebx + 8], eax
mov ecx, dword [ebx + 8]
movzx edx, word [ecx]
movzx eax, word [ebx + 0xc]
cmp edx, eax
jne 0x101a1759
mov ecx, dword [ebx + 8]
mov dword [ebp - 0xc], ecx
jmp 0x101a1760
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
jmp 0x101a179f
mov edx, dword [ebx + 8]
add edx, 0x10
mov dword [ebx + 8], edx
jmp 0x101a179a
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x101a1783
mov eax, dword [ebx + 8]
jmp 0x101a179f
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x101a1791
xor eax, eax
jmp 0x101a179f
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x101a16cf
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x10005d58
Capabilities:
Link many functions at runtime

Disassembly:
jmp 0x100a7320
push ebx
push esi
mov ecx, 0x103b3012
call fcn.1000602d
push str._INF__LoadSSH__Load_Library_Start
xor bl, bl
call fcn.100021df
add esp, 4
push str.libssh2.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
jne 0x100a7364
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str._ERR__LoadSSH__LoadLibrary_Error_
call fcn.100021df
add esp, 4
jmp 0x100a74fd
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.libssh2_init
push esi
call edi
mov dword [0x10224a28], eax
test eax, eax
je 0x100a74fc
push str.libssh2_session_init_ex
push esi
call edi
mov dword [0x10224a2c], eax
test eax, eax
je 0x100a74fc
push str.libssh2_session_set_blocking
push esi
call edi
mov dword [0x10224a30], eax
test eax, eax
je 0x100a74fc
push str.libssh2_session_handshake
push esi
call edi
mov dword [0x10224a34], eax
test eax, eax
je 0x100a74fc
push str.libssh2_userauth_password_ex
push esi
call edi
mov dword [0x10224a38], eax
test eax, eax
je 0x100a74fc
push str.libssh2_session_disconnect_ex
push esi
call edi
mov dword [0x10224a3c], eax
test eax, eax
je 0x100a74fc
push str.libssh2_session_free
push esi
call edi
mov dword [0x10224a40], eax
test eax, eax
je 0x100a74fc
push str.libssh2_sftp_init
push esi
call edi
mov dword [0x10224a44], eax
test eax, eax
je 0x100a74fc
push str.libssh2_sftp_open_ex
push esi
call edi
mov dword [0x10224a48], eax
test eax, eax
je 0x100a74fc
push str.libssh2_sftp_stat_ex
push esi
call edi
mov dword [0x10224a4c], eax
test eax, eax
je 0x100a74fc
push str.libssh2_sftp_unlink_ex
push esi
call edi
mov dword [0x10224a50], eax
test eax, eax
je 0x100a74fc
push str.libssh2_sftp_seek64
push esi
call edi
mov dword [0x10224a54], eax
test eax, eax
je 0x100a74fc
push str.libssh2_sftp_close_handle
push esi
call edi
mov dword [0x10224a58], eax
test eax, eax
je 0x100a74fc
push str.libssh2_sftp_shutdown
push esi
call edi
mov dword [0x10224a5c], eax
test eax, eax
je 0x100a74fc
push str.libssh2_sftp_readdir_ex
push esi
call edi
mov dword [0x10224a64], eax
test eax, eax
je 0x100a74fc
push str.libssh2_sftp_read
push esi
call edi
mov dword [0x10224a60], eax
test eax, eax
je 0x100a74fc
push str.libssh2_sftp_write
push esi
call edi
mov dword [0x10224a68], eax
test eax, eax
je 0x100a74fc
push str.libssh2_session_get_timeout
push esi
call edi
mov dword [0x10224a6c], eax
test eax, eax
je 0x100a74fc
push str.libssh2_session_set_timeout
push esi
call edi
mov dword [0x10224a70], eax
test eax, eax
je 0x100a74fc
push str.libssh2_sftp_last_error
push esi
call edi
test eax, eax
movzx ebx, bl
mov ecx, 1
mov dword [0x10224a74], eax
cmovne ebx, ecx
pop edi
movzx ecx, bl
push ecx
push str._INF__LoadSSH__End__bRet__d
call fcn.100021df
add esp, 8
mov al, bl
pop esi
pop ebx
ret
Function at 0x10006159
Capabilities:
Encode data using xor
Hash data using crc32b

Disassembly:
jmp 0x10011f00
jmp 0x10013100
mov ecx, 0x103b1098
call fcn.1000602d
cmp byte [0x1020dc44], 0
mov dword [0x1020dc40], 0xffffffff
jne 0x10011fca
push esi
mov byte [0x1020dc44], 1
xor esi, esi
nop dword [eax + eax]
mov ecx, esi
shl ecx, 0x18
lea eax, [ecx + ecx]
mov edx, eax
xor edx, 0x4c11db7
test ecx, ecx
cmovns edx, eax
lea eax, [edx + edx]
mov ecx, eax
xor ecx, 0x4c11db7
test edx, edx
cmovns ecx, eax
lea eax, [ecx + ecx]
mov edx, eax
xor edx, 0x4c11db7
test ecx, ecx
cmovns edx, eax
lea eax, [edx + edx]
mov ecx, eax
xor ecx, 0x4c11db7
test edx, edx
cmovns ecx, eax
lea eax, [ecx + ecx]
mov edx, eax
xor edx, 0x4c11db7
test ecx, ecx
cmovns edx, eax
lea eax, [edx + edx]
mov ecx, eax
xor ecx, 0x4c11db7
test edx, edx
cmovns ecx, eax
lea eax, [ecx + ecx]
mov edx, eax
xor edx, 0x4c11db7
test ecx, ecx
cmovns edx, eax
lea eax, [edx + edx]
mov ecx, eax
xor ecx, 0x4c11db7
test edx, edx
cmovns ecx, eax
mov dword [esi*4 + 0x1020dc48], ecx
inc esi
cmp esi, 0x100
jl 0x10011f30
pop esi
ret
push esi
mov esi, ecx
mov ecx, 0x103b119b
call fcn.1000602d
push dword [esi]
push str._INF__MD5Init__nMode__d
call fcn.100021df
mov eax, dword [esi]
add esp, 8
cmp eax, 1
jne 0x10013161
mov dword [0x1020e12c], 0
mov dword [0x1020e128], 0
mov dword [0x1020e118], 0x67452301
mov dword [0x1020e11c], 0xefcdab89
mov dword [0x1020e120], 0x98badcfe
mov dword [0x1020e124], 0x10325476
pop esi
ret
cmp eax, 2
jne 0x1001316c
pop esi
jmp 0x100022fc
cmp eax, 5
jne 0x1001317e
push dword [esi + 4]
call fcn.10004408
add esp, 4
pop esi
ret
cmp eax, 6
jne 0x10013193
push 0
lea eax, [esi + 8]
push 0
push eax
call fcn.10004e26
add esp, 0xc
pop esi
ret

Function at 0x10011fd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov ecx, 0x103b1098
call fcn.1000602d
mov esi, dword [ebp + 0xc]
test esi, esi
jle 0x10012012
mov edx, dword [ebp + 8]
mov eax, dword [0x1020dc40]
nop dword [eax]
mov ecx, eax
lea edx, [edx + 1]
shr ecx, 0x18
xor cl, byte [edx - 1]
movzx ecx, cl
shl eax, 8
xor eax, dword [ecx*4 + 0x1020dc48]
mov dword [0x1020dc40], eax
sub esi, 1
jne 0x10011ff0
pop esi
pop ebp
ret
Function at 0x100174e0
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov ecx, 0x103b1212
call fcn.1000602d
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
lea esi, [edx + eax]
mov dword [ebp - 8], esi
cmp eax, 0x10
jb 0x10017597
push ebx
push edi
mov edi, dword [ebp + 0x10]
lea eax, [esi - 0x10]
mov dword [ebp - 4], eax
lea ebx, [edi + 0x24234428]
lea esi, [edi - 0x7a143589]
lea eax, [edi + 0x61c8864f]
nop dword [eax]
nop word [eax + eax]
imul ecx, dword [edx], 0x7a143589
sub ebx, ecx
imul ecx, dword [edx + 4], 0x7a143589
rol ebx, 0xd
imul ebx, ebx, 0x9e3779b1
sub esi, ecx
imul ecx, dword [edx + 8], 0x7a143589
rol esi, 0xd
imul esi, esi, 0x9e3779b1
sub edi, ecx
imul ecx, dword [edx + 0xc], 0x7a143589
rol edi, 0xd
add edx, 0x10
imul edi, edi, 0x9e3779b1
sub eax, ecx
rol eax, 0xd
imul eax, eax, 0x9e3779b1
cmp edx, dword [ebp - 4]
jbe 0x10017530
rol eax, 0x12
rol edi, 0xc
add eax, edi
rol esi, 7
add eax, esi
rol ebx, 1
mov esi, dword [ebp - 8]
add eax, ebx
pop edi
pop ebx
jmp 0x1001759f
mov eax, dword [ebp + 0x10]
add eax, 0x165667b1
add eax, dword [ebp + 0xc]
lea ecx, [edx + 4]
cmp ecx, esi
ja 0x100175cb
nop dword [eax]
imul ecx, dword [edx], 0x3d4d51c3
add edx, 4
sub eax, ecx
lea ecx, [edx + 4]
rol eax, 0x11
imul eax, eax, 0x27d4eb2f
cmp ecx, esi
jbe 0x100175b0
cmp edx, esi
jae 0x100175e9
nop
movzx ecx, byte [edx]
inc edx
imul ecx, ecx, 0x165667b1
add ecx, eax
rol ecx, 0xb
imul eax, ecx, 0x9e3779b1
cmp edx, esi
jb 0x100175d0
mov ecx, eax
shr ecx, 0xf
xor ecx, eax
imul ecx, ecx, 0x85ebca77
pop esi
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae3d
mov eax, ecx
shr eax, 0x10
xor eax, ecx
mov esp, ebp
pop ebp
ret

Function at 0x10017d50
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
mov ecx, 0x103b1212
push edi
call fcn.1000602d
mov eax, dword [esi + 4]
lea edi, [esi + 0x1c]
add edi, dword [esi + 0x2c]
lea edx, [esi + 0x1c]
mov dword [ebp - 4], eax
test eax, eax
jne 0x10017d87
cmp dword [esi], 0x10
jae 0x10017d87
mov eax, dword [esi + 8]
add eax, 0x165667b1
jmp 0x10017da4
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x14]
rol ecx, 0xc
rol eax, 0x12
add eax, ecx
mov ecx, dword [esi + 0x10]
rol ecx, 7
add eax, ecx
mov ecx, dword [esi + 0xc]
rol ecx, 1
add eax, ecx
add eax, dword [esi]
lea ecx, [esi + 0x20]
cmp ecx, edi
ja 0x10017dcb
add esi, 0x20
imul ecx, dword [edx], 0x3d4d51c3
add esi, 4
add edx, 4
sub eax, ecx
rol eax, 0x11
imul eax, eax, 0x27d4eb2f
cmp esi, edi
jbe 0x10017db0
cmp edx, edi
jae 0x10017de9
nop
movzx ecx, byte [edx]
inc edx
imul ecx, ecx, 0x165667b1
add ecx, eax
rol ecx, 0xb
imul eax, ecx, 0x9e3779b1
cmp edx, edi
jb 0x10017dd0
mov ecx, eax
shr ecx, 0xf
xor ecx, eax
imul ecx, ecx, 0x85ebca77
pop edi
pop esi
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae3d
mov eax, ecx
shr eax, 0x10
xor eax, ecx
mov esp, ebp
pop ebp
ret
Function at 0x1002fba0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov ecx, 0x103b15e1
call fcn.1000602d
mov ecx, dword [ebp + 0xc]
or esi, 0xffffffff
mov eax, dword [ebp + 8]
mov edx, 8
mov dword [ebp + 0xc], ecx
lea ecx, [ebp + 8]
mov dword [ebp + 8], eax
movzx eax, byte [ecx]
lea ecx, [ecx + 1]
xor eax, esi
shr esi, 8
movzx eax, al
xor esi, dword [eax*4 + 0x101b3a70]
sub edx, 1
jne 0x1002fbc6
mov ecx, dword [ebp + 0x14]
lea edx, [ebp + 8]
mov eax, dword [ebp + 0x10]
mov edi, 8
mov dword [ebp + 0xc], ecx
or ecx, 0xffffffff
mov dword [ebp + 8], eax
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x101b3a70]
sub edi, 1
jne 0x1002fbf7
mov edx, dword [ebp + 0x1c]
mov edi, 8
mov eax, dword [ebp + 0x18]
mov dword [ebp + 0xc], edx
lea edx, [ebp + 8]
mov dword [ebp + 8], eax
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x101b3a70]
sub edi, 1
jne 0x1002fc25
xor edx, edx
shld edx, esi, 0x1f
shl esi, 0x1f
xor esi, ecx
xor edx, edi
pop edi
mov eax, esi
pop esi
pop ebp
ret
Function at 0x100578f0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x1020c6f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov ecx, 0x103b202b
push edi
mov edi, dword [ebp + 0xc]
call fcn.1000602d
mov ecx, dword [edi + 8]
lea edx, [ebp - 0x128]
mov eax, dword [esi + 8]
cmp ecx, eax
push edx
push 0
mov dword [ebp - 0x110], eax
lea edx, [ebp - 0x118]
push 0
cmovge eax, ecx
mov dword [ebp - 0x114], ecx
push edx
inc eax
mov dword [ebp - 0x118], 2
push eax
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x128], 0x258
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x1005798b
call fcn.10003c29
push 0x400
push dword [eax]
call fcn.10002c89
add esp, 4
push eax
lea eax, [edi + 0x44]
push eax
call fcn.10005641
add esp, 0xc
jmp 0x100579ad
test eax, eax
jne 0x100579ce
movups xmm0, xmmword [str.timed_out_waiting_for_connection]
movups xmmword [edi + 0x44], xmm0
movups xmm0, xmmword [0x1020b770]
movups xmmword [edi + 0x54], xmm0
mov al, byte [0x1020b780]
mov byte [edi + 0x64], al
push dword [esi + 8]
call sub.WS2_32.dll_closesocket
mov dword [esi + 8], 0
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003260
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x118]
push eax
push dword [esi + 8]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x10057a6f
push ebx
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], 0x10
push eax
lea eax, [ebp - 0x14]
push eax
push dword [esi + 8]
call sub.WS2_32.dll_accept
mov ebx, eax
call fcn.10003c29
push dword [esi + 8]
mov eax, dword [eax]
mov dword [ebp - 0x11c], eax
call sub.WS2_32.dll_closesocket
test ebx, ebx
jle 0x10057a37
mov dword [esi + 8], ebx
mov eax, 1
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003260
mov esp, ebp
pop ebp
ret
push 0x400
push dword [ebp - 0x11c]
call fcn.10002c89
add esp, 4
push eax
lea eax, [edi + 0x44]
push eax
call fcn.10005641
add esp, 0xc
xor eax, eax
xor ebx, ebx
mov dword [esi + 8], ebx
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003260
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x118]
push eax
push dword [edi + 8]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x10057ac3
push dword [esi + 8]
call sub.WS2_32.dll_closesocket
push edi
push 0x32
mov dword [esi + 8], 0
call fcn.10058560
add esp, 8
test eax, eax
je 0x100579bc
push str._ERR__FtpAcceptConnection__readresp_Error.1
call fcn.10003837
add esp, 4
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003260
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x11c]
xor ecx, ebp
pop edi
pop esi
call fcn.10003260
mov esp, ebp
pop ebp
ret
Function at 0x10058370
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov ecx, 0x103b202b
call fcn.1000602d
mov eax, dword [esi + 0x18]
xor ecx, ecx
mov ebx, dword [ebp + 8]
xor edx, edx
mov dword [ebp + 0x10], ecx
mov dword [ebp - 4], edx
test eax, eax
je 0x100583a5
cmp eax, 1
je 0x100583a5
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x100583b2
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [esi + 0xc]
test edi, edi
jle 0x100583fc
dec eax
cmp dword [ebp + 0xc], edi
cmovl edi, eax
push edi
push 0xa
push dword [esi + 4]
push ebx
call fcn.10005df8
mov edx, eax
add esp, 0x10
test edx, edx
je 0x100583da
mov edi, edx
sub edi, ebx
mov ecx, dword [ebp + 0x10]
add ebx, edi
mov eax, dword [ebp + 0xc]
add ecx, edi
sub eax, edi
mov dword [ebp + 0x10], ecx
mov dword [ebp + 0xc], eax
mov byte [ebx], 0
add dword [esi + 4], edi
sub dword [esi + 0xc], edi
test edx, edx
jne 0x10058472
mov edx, dword [ebp - 4]
lea edi, [esi + 0x10]
cmp eax, 1
je 0x100584e8
mov eax, dword [esi]
cmp eax, dword [esi + 4]
jne 0x10058424
mov eax, dword [esi + 0x14]
mov dword [esi + 4], eax
mov dword [esi], eax
mov dword [esi + 0xc], 0
mov dword [edi], 0x2000
test edx, edx
jne 0x100584da
push esi
call fcn.10058710
add esp, 4
test eax, eax
je 0x100584ee
push 0
push dword [edi]
push dword [esi]
push dword [esi + 8]
call sub.WS2_32.dll_recv
cmp eax, 0xffffffff
je 0x100584ba
mov edx, dword [ebp - 4]
test eax, eax
mov ecx, 1
cmove edx, ecx
sub dword [edi], eax
add dword [esi + 0xc], eax
add dword [esi], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], edx
jmp 0x100583b3
mov ecx, 0x1020b294
lea eax, [ebx - 2]
nop word [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100584a0
test dl, dl
je 0x1005849c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100584a0
add eax, 2
add ecx, 2
test dl, dl
jne 0x10058480
xor eax, eax
jmp 0x100584a5
sbb eax, eax
or eax, 1
test eax, eax
mov eax, dword [ebp + 0x10]
jne 0x100584f1
pop edi
pop esi
mov word [ebx - 2], 0xa
dec eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [sym.Restore.dll_ftplib_debug], 0
je 0x100584d0
push str.read
call fcn.1000270c
add esp, 4
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
test ecx, ecx
jne 0x100584ee
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
mov byte [eax], 0
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10058710
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x1020c6f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov ecx, 0x103b202b
call fcn.1000602d
mov eax, dword [esi + 0x18]
test eax, eax
je 0x1005882b
cmp dword [esi + 0x30], 0
je 0x1005882b
xor ecx, ecx
lea edx, [ebp - 0x108]
push ebx
cmp eax, 2
mov dword [ebp - 0x108], ecx
lea ebx, [ebp - 0x108]
cmovne ebx, ecx
cmp eax, 2
push edi
cmove edx, ecx
mov dword [ebp - 0x10c], edx
nop
cmp ecx, 0x40
jae 0x10058785
mov eax, dword [esi + 8]
mov dword [ebp + ecx*4 - 0x104], eax
inc dword [ebp - 0x108]
mov eax, dword [esi + 0x28]
mov ecx, dword [esi + 0x2c]
mov dword [ebp - 0x114], eax
lea eax, [ebp - 0x114]
push eax
mov eax, dword [esi + 8]
push 0
push ebx
push edx
inc eax
mov dword [ebp - 0x110], ecx
push eax
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
je 0x100587f2
test eax, eax
jg 0x100587da
push dword [esi + 0x34]
mov eax, dword [esi + 0x30]
push 0
push dword [esi + 0x38]
push esi
call eax
mov edi, eax
add esp, 0x10
test edi, edi
je 0x10058818
mov ecx, dword [ebp - 0x108]
mov edx, dword [ebp - 0x10c]
jmp 0x10058770
mov edi, 1
mov eax, edi
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003260
mov esp, ebp
pop ebp
ret
xor edi, edi
call fcn.10003c29
push 0x400
push dword [eax]
call fcn.10002c89
add esp, 4
push eax
mov eax, dword [esi + 0x1c]
add eax, 0x44
push eax
call fcn.10005641
add esp, 0xc
mov eax, edi
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003260
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop esi
call fcn.10003260
mov esp, ebp
pop ebp
ret
Function at 0x42e420
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x42e42f
pop dword [ebp - 0x48]
mov eax, 0xe772b4f0
add eax, 0x18d02f3f
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xf1c36cee
sub dword [ebp - 0x58], 0xa37127a3
mov dword [ebp - 0x54], 0xeca8544f
add dword [ebp - 0x54], 0x458af7f6
mov dword [ebp - 0x50], 0x79c79d06
sub dword [ebp - 0x50], 0x2d7b58d8
mov dword [ebp - 0x4c], 0x25440c69
sub dword [ebp - 0x4c], 0x25440c69
lea eax, [ebp - 0x58]
push eax
mov eax, 0x988819dd
sub eax, 0x9844b929
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x7bc56620
sub dword [ebp - 0x58], 0x752fcca
mov dword [ebp - 0x54], 0xbfa19637
add dword [ebp - 0x54], 0x81cacb3e
mov dword [ebp - 0x50], 0x70a12828
add dword [ebp - 0x50], 0xf2ce4444
mov dword [ebp - 0x4c], 0xda152b24
add dword [ebp - 0x4c], 0x25ead4dc
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0xd567aab8
add eax, 0x2adbb694
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3a411
push 0
call eax
mov ecx, 0x68a498e6
add ecx, 0x975baa1c
xor esi, esi
add esi, eax
mov edi, 0x4cd5e2d7
sub edi, 0x4c9182d7
add edi, dword [ebp - 0x48]
mov ebx, 0x13a7ba2c
add ebx, 0x7bd9f538
sub dword [ebp - 8], esi
mov edx, dword [edi]
xor dword [ebp - 4], 0x933e489f
sub edx, ebx
sub dword [ebp - 0x10], eax
mov dword [esi], edx
mov dword [ebp - 0x40], 0xbe689a4b
add esi, 4
add edi, 0xe5650734
add edi, 0x1a9af8d0
loop 0x42e553
add eax, 0xbd456da6
add eax, 0x42bb9135
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x2f0a28fa
add ecx, 0xd135d706
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x43428d
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x43a7e0
call fcn.00434520
xor esi, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
call dword [sym.imp.MSVCR120.dll___crtGetShowWindowMode]
movzx ebx, ax
mov dword [ebp - 4], esi
mov eax, dword fs:[0x18]
mov edx, dword [eax + 4]
mov edi, esi
mov esi, 0x440c6c
mov ecx, edx
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
je 0x434127
cmp eax, edx
jne 0x434110
xor esi, esi
inc esi
mov edi, esi
jmp 0x43412a
xor esi, esi
inc esi
cmp dword [0x440c70], esi
jne 0x43413c
push 0x1f
call sub.MSVCR120.dll__amsg_exit
pop ecx
jmp 0x434177
cmp dword [0x440c70], 0
jne 0x434171
mov dword [0x440c70], esi
push 0x436450
push 0x436440
call sub.MSVCR120.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x434177
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x434287
mov dword [0x440bd8], esi
cmp dword [0x440c70], esi
jne 0x43419a
push 0x43643c
push 0x436408
call sub.MSVCR120.dll__initterm
pop ecx
pop ecx
mov dword [0x440c70], 2
test edi, edi
jne 0x4341a7
xor eax, eax
mov ecx, 0x440c6c
xchg dword [ecx], eax
cmp dword [0x440c74], 0
je 0x4341cb
push 0x440c74
call main
pop ecx
test eax, eax
je 0x4341cb
push 0
push 2
push 0
call dword [0x440c74]
mov eax, dword [sym.imp.MSVCR120.dll__wcmdln]
mov ecx, dword [eax]
mov dword [ebp - 0x1c], ecx
push 0x20
pop esi
mov edx, dword [ebp - 0x20]
movzx eax, word [ecx]
cmp ax, si
ja 0x434224
test ax, ax
je 0x4341ec
test edx, edx
jne 0x434224
movzx eax, word [ecx]
test ax, ax
je 0x434201
cmp ax, si
ja 0x434201
add ecx, 2
mov dword [ebp - 0x1c], ecx
jmp 0x4341ec
push ebx
push ecx
push 0
push 0x400000
call main
mov dword [0x440bdc], eax
cmp dword [0x440be0], 0
jne 0x43426c
push eax
call dword [sym.imp.MSVCR120.dll_exit]
cmp eax, 0x22
jne 0x434235
xor eax, eax
test edx, edx
sete al
mov edx, eax
mov dword [ebp - 0x20], edx
add ecx, 2
mov dword [ebp - 0x1c], ecx
jmp 0x4341db
cmp dword [0x440bd8], 0
jne 0x434280
call dword [sym.imp.MSVCR120.dll__cexit]
mov eax, dword [0x440bdc]
mov dword [ebp - 4], 0xfffffffe
call fcn.00434565
ret
call main
jmp 0x4340e0

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..pdata
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x3f3f57c3
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..pdata_1
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e3d0
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x45226955
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
jmp 0x401219