joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100023e0
Capabilities:
Create thread

Disassembly:
sub esp, 0xc
push esi
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esi]
call dword [eax + 0x10]
test eax, eax
mov dword [esp + 4], eax
jl 0x100024d9
push ebx
push ebp
push edi
mov edi, dword [esp + 0x20]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea ebp, [esi + 0x2ebc]
mov ebx, ecx
cmp ebx, 0xfffffffd
jbe 0x1000241e
call fcn.10011d8b
mov ecx, dword [ebp + 4]
xor edx, edx
cmp ecx, edx
je 0x10002446
mov al, byte [ecx - 1]
test al, al
je 0x10002446
cmp al, 0xff
je 0x10002446
cmp ebx, edx
jne 0x1000246a
dec al
mov byte [ecx - 1], al
mov dword [ebp + 4], edx
mov dword [ebp + 8], edx
mov dword [ebp + 0xc], edx
jmp 0x10002497
cmp ebx, edx
jne 0x10002455
push 1
mov ecx, ebp
call fcn.10001ba0
jmp 0x10002497
mov eax, dword [ebp + 0xc]
cmp eax, 0x1f
ja 0x10002461
cmp eax, ebx
jae 0x10002472
push 1
mov ecx, ebp
call fcn.10001ba0
push ebx
mov ecx, ebp
call fcn.100020a0
mov esi, dword [esp + 0x20]
mov edi, dword [ebp + 4]
mov ecx, ebx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 4]
mov esi, dword [esp + 0x14]
mov dword [ebp + 8], ebx
mov byte [eax + ebx], 0
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x18]
push edx
push 0
push esi
push 0x10002550
push 0
push 0
mov dword [esi + 0x2ecc], ecx
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop ebp
test eax, eax
mov dword [esi + 0x2eb8], eax
pop ebx
jne 0x100024d5
mov dword [esp + 4], 0xfffffff4
mov eax, dword [esp + 4]
pop esi
add esp, 0xc
ret 8
Function at 0x100038f0
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebx
push ebp
xor ecx, ecx
mov ebp, dword [eax + 4]
mov eax, dword [eax]
mov dword [esp + 8], 0
mov cx, word [eax + 0x14]
cmp word [eax + 6], 0
lea ebx, [ecx + eax + 0x18]
jbe 0x100039b1
push esi
push edi
add ebx, 0x10
cmp dword [ebx], 0
jne 0x1000395b
mov edx, dword [esp + 0x1c]
mov esi, dword [edx + 0x38]
test esi, esi
jle 0x1000398f
mov eax, dword [ebx - 4]
push 4
push 0x1000
add eax, ebp
push esi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, esi
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [ebx - 8], edi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
jmp 0x1000398f
mov ecx, dword [ebx - 4]
mov eax, dword [ebx]
push 4
push 0x1000
add ecx, ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [ebx]
mov esi, dword [ebx + 4]
mov edi, dword [esp + 0x18]
mov edx, ecx
add esi, edi
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebx - 8], eax
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
inc eax
add ebx, 0x28
mov edx, dword [ecx]
xor ecx, ecx
mov dword [esp + 0x10], eax
mov cx, word [edx + 6]
cmp eax, ecx
jl 0x1000391e
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x100039c0
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
xor ecx, ecx
push ebp
mov ebx, dword [eax]
xor ebp, ebp
push esi
push edi
mov cx, word [ebx + 0x14]
cmp word [ebx + 6], bp
lea eax, [ecx + ebx + 0x18]
jbe 0x10003a7b
lea edi, [eax + 0x24]
mov eax, dword [edi]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x10003a17
mov edx, dword [edi - 0x14]
mov eax, dword [edi - 0x1c]
push 0x4000
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x10003a63
lea ecx, [edx + ecx*2]
test eax, 0x4000000
lea edx, [esi + ecx*2]
mov esi, dword [edx*4 + 0x1002432c]
je 0x10003a31
or esi, 0x200
mov edx, dword [edi - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x10003a4c
test al, 0x40
je 0x10003a43
mov ecx, dword [ebx + 0x20]
jmp 0x10003a4a
test al, 0x80
je 0x10003a63
mov ecx, dword [ebx + 0x24]
test ecx, ecx
jbe 0x10003a63
mov ecx, dword [edi - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10003a7b
mov edx, dword [esp + 0x18]
xor eax, eax
inc ebp
add edi, 0x28
mov ebx, dword [edx]
mov ax, word [ebx + 6]
cmp ebp, eax
jl 0x100039e4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x10004370
Capabilities:
Copy file
Delete file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1001dc18
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov eax, dword [esi + 0x2f04]
cmp eax, ebx
je 0x10004499
push eax
call fcn.1001219a
mov eax, dword [esi + 0x2f18]
add esp, 4
cmp eax, 1
mov dword [esi + 0x2f04], ebx
jne 0x10004499
mov edx, dword [0x1001f2c8]
mov cl, byte [esi + 0x2ee4]
lea eax, [esi + 0x2ee4]
push edx
mov byte [esp + 0xc], cl
push ebx
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
call fcn.10004ba0
mov eax, dword [esp + 0xc]
mov dword [esp + 0x20], ebx
cmp eax, ebx
mov ecx, 0x1001f2c4
je 0x100043fb
mov ecx, eax
mov eax, dword [esi + 0x2ef8]
cmp eax, ebx
jne 0x1000440a
mov eax, 0x1001f2c4
push ebx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov eax, dword [esi + 0x2ef8]
cmp eax, ebx
jne 0x10004422
mov eax, 0x1001f2c4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp byte [esi + 0x2f14], bl
je 0x10004462
cmp byte [esi + 0x2f15], bl
jne 0x10004449
lea eax, [esp + 8]
push ebx
push eax
call fcn.1000fdd0
add esp, 8
jmp 0x10004462
mov eax, dword [esp + 0xc]
cmp eax, ebx
jne 0x10004456
mov eax, 0x1001f2c4
push ebx
push eax
mov ecx, 0x10055ae0
call fcn.100082e0
mov ecx, dword [esp + 0xc]
cmp ecx, ebx
je 0x10004499
mov al, byte [ecx - 1]
cmp al, bl
je 0x1000448d
cmp al, 0xff
je 0x1000448d
dec al
pop esi
mov byte [ecx - 1], al
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret
add ecx, 0xfffffffe
push ecx
call fcn.10011d80
add esp, 4
mov ecx, dword [esp + 0x18]
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x10004fb0
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, dword [esi + 0x2f00]
cmp eax, edi
je 0x10004fdf
lea ecx, [esp + 8]
mov dword [esp + 8], edi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x10004fdf
cmp dword [esp + 8], 0x103
je 0x10005018
mov eax, dword [esi + 0x2f00]
cmp eax, edi
je 0x10004ff6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x2f00], edi
lea edx, [esp + 8]
mov dword [esp + 8], edi
push edx
push edi
push esi
push 0x10005030
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
mov dword [esi + 0x2f00], eax
je 0x1000501d
mov edi, 1
mov eax, edi
pop edi
dec eax
pop esi
neg eax
sbb eax, eax
pop ecx
ret
Function at 0x10009200
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
not esi
call fcn.10009250
mov eax, dword [esp + 0x10]
mov ecx, eax
dec eax
test ecx, ecx
je 0x1000923e
lea ecx, [eax + 1]
mov eax, dword [esp + 0xc]
push ebx
mov edx, esi
xor ebx, ebx
mov bl, byte [eax]
and edx, 0xff
xor edx, ebx
shr esi, 8
mov edx, dword [edx*4 + 0x10055b08]
xor esi, edx
inc eax
dec ecx
jne 0x1000921f
pop ebx
mov eax, esi
pop esi
not eax
ret

Function at 0x10009250
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor edx, edx
mov ecx, 0x10055b08
mov eax, edx
mov esi, 8
test al, 1
je 0x1000926c
shr eax, 1
xor eax, 0xedb88320
jmp 0x1000926e
shr eax, 1
dec esi
jne 0x1000925f
mov dword [ecx], eax
add ecx, 4
inc edx
cmp ecx, 0x10055f08
jl 0x10009258
pop esi
ret

Function at 0x100092f0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x104
xor eax, eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x114]
push edi
mov byte [eax + esi], al
inc eax
cmp eax, 0x100
jl 0x10009303
mov edi, dword [esp + 0x120]
mov ebx, dword [esp + 0x11c]
xor ecx, ecx
mov eax, ecx
cdq
idiv edi
inc ecx
cmp ecx, 0x100
mov al, byte [edx + ebx]
mov byte [esp + ecx + 0x13], al
jl 0x1000931e
lea edi, [esp + 0x14]
xor eax, eax
mov ecx, esi
sub edi, esi
mov dword [esp + 0x10], 0x100
mov dl, byte [ecx]
xor ebx, ebx
mov bl, byte [edi + ecx]
mov ebp, edx
and ebp, 0xff
add eax, ebx
add eax, ebp
and eax, 0x800000ff
jns 0x10009366
dec eax
or eax, 0xffffff00
inc eax
mov bl, byte [eax + esi]
inc eax
mov byte [ecx], bl
mov byte [eax + esi - 1], dl
mov edx, dword [esp + 0x10]
inc ecx
dec edx
mov dword [esp + 0x10], edx
jne 0x10009345
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret 0xc

Function at 0x10009390
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [esp + 8]
push edi
lea edi, [ecx + 4]
xor eax, eax
xor ecx, ecx
test edx, edx
jle 0x1000942a
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x18], edx
sub ebp, esi
inc eax
and eax, 0x800000ff
jns 0x100093c4
dec eax
or eax, 0xffffff00
inc eax
mov dl, byte [eax + edi]
mov ebx, edx
and ebx, 0xff
add ecx, ebx
and ecx, 0x800000ff
jns 0x100093e1
dec ecx
or ecx, 0xffffff00
inc ecx
mov bl, byte [ecx + edi]
mov byte [esp + 0x1c], dl
mov byte [eax + edi], bl
mov byte [ecx + edi], dl
mov edx, dword [esp + 0x1c]
xor ebx, ebx
mov bl, byte [eax + edi]
and edx, 0xff
add edx, ebx
and edx, 0x800000ff
jns 0x1000940f
dec edx
or edx, 0xffffff00
inc edx
mov dl, byte [edx + edi]
mov bl, byte [esi + ebp]
xor dl, bl
inc eax
mov byte [esi], dl
mov edx, dword [esp + 0x18]
inc ecx
inc esi
dec edx
mov dword [esp + 0x18], edx
jne 0x100093b5
pop esi
pop ebp
pop ebx
mov ecx, 0x40
xor eax, eax
rep stosd dword es:[edi], eax
pop edi
ret 0xc
Function at 0x1000a3b0
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create thread
Create two anonymous pipes
Execute shell command and capture output

Disassembly:
sub esp, 0x26c
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CreatePipe]
push esi
xor eax, eax
mov esi, ecx
mov dword [esp + 0x10], eax
push edi
lea ecx, [esp + 0x10]
lea edi, [esi + 0x2ec0]
push eax
push ecx
lea edx, [esi + 0x2ec4]
push edi
mov dword [esp + 0x24], eax
push edx
mov dword [esp + 0x28], 1
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], 0xc
call ebp
test eax, eax
je 0x1000a4fa
lea eax, [esp + 0x10]
push 0
lea ecx, [esi + 0x2eb8]
lea ebx, [esi + 0x2ebc]
push eax
push ecx
push ebx
call ebp
test eax, eax
je 0x1000a4fa
lea edx, [esp + 0x1c]
xor ebp, ebp
push edx
push ebp
push esi
push 0x1000a590
push ebp
push ebp
mov dword [esp + 0x34], ebp
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x2ecc], eax
xor eax, eax
mov dword [esp + 0x20], eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x24], eax
push ecx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov eax, dword [edi]
mov edx, dword [ebx]
mov ecx, dword [0x10052770]
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov eax, dword [str.cmd.exe]
mov dword [esp + 0x74], eax
mov eax, dword [0x10052778]
mov dword [esp + 0x68], edx
mov edx, dword [0x10052774]
mov dword [esp + 0x78], ecx
mov dword [esp + 0x80], eax
mov ecx, 0x7e
xor eax, eax
lea edi, [esp + 0x84]
mov dword [esp + 0x7c], edx
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x20]
lea edx, [esp + 0x30]
push ecx
push edx
push ebp
push ebp
push 0x20
push 1
push ebp
lea eax, [esp + 0x90]
push ebp
push eax
push ebp
mov dword [esp + 0x58], 0x44
mov dword [esp + 0x84], 0x101
mov word [esp + 0x88], bp
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1000a513
mov ecx, dword [esp + 0x20]
pop edi
mov dword [esi + 0x2ec8], ecx
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x26c
ret
mov ecx, esi
mov edi, 0xfffffff9
call fcn.1000a720
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x26c
ret
mov ecx, esi
mov edi, 0xfffffff8
call fcn.1000a720
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x26c
ret
Function at 0x1000a720
Capabilities:
Terminate process
Terminate thread

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov eax, dword [esi + 0x2ec8]
cmp eax, ebx
je 0x1000a73f
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [esi + 0x2ec8], ebx
mov eax, dword [esi + 0x2ecc]
cmp eax, ebx
je 0x1000a757
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [esi + 0x2ecc], ebx
mov eax, dword [esi + 0x2eb8]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, ebx
je 0x1000a770
push eax
call edi
mov dword [esi + 0x2eb8], ebx
mov eax, dword [esi + 0x2ebc]
cmp eax, ebx
je 0x1000a783
push eax
call edi
mov dword [esi + 0x2ebc], ebx
mov eax, dword [esi + 0x2ec0]
cmp eax, ebx
je 0x1000a796
push eax
call edi
mov dword [esi + 0x2ec0], ebx
mov eax, dword [esi + 0x2ec4]
cmp eax, ebx
je 0x1000a7a9
push eax
call edi
mov dword [esi + 0x2ec4], ebx
pop edi
pop esi
xor eax, eax
pop ebx
ret

Function at 0x1000a7c0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x414
push ebx
mov ebx, ecx
mov eax, dword [ebx + 0x2eb8]
test eax, eax
je 0x1000a8e0
mov ecx, dword [esp + 0x41c]
test ecx, ecx
je 0x1000a8e0
mov eax, dword [esp + 0x420]
test eax, eax
jle 0x1000a8e0
push ebp
push esi
push edi
push eax
lea eax, [esp + 0x14]
push ecx
push eax
call fcn.10011c10
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x31]
mov byte [esp + 0x30], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x20]
add esp, 0xc
test eax, eax
jne 0x1000a829
mov eax, 0x1001f2c0
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x24]
push ecx
push eax
push edx
call fcn.100138e0
mov edi, 0x100245e4
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x24]
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
push eax
and ecx, 3
lea eax, [esp + 0x24]
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x1c]
push eax
mov eax, dword [ebx + 0x2eb8]
add ecx, 2
lea edx, [esp + 0x2c]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x14]
mov esi, eax
test ecx, ecx
je 0x1000a8c7
mov al, byte [ecx - 1]
test al, al
je 0x1000a8bd
cmp al, 0xff
je 0x1000a8bd
dec al
pop edi
mov byte [ecx - 1], al
mov eax, esi
neg eax
sbb eax, eax
pop esi
and eax, 9
pop ebp
add eax, 0xfffffff7
pop ebx
add esp, 0x414
ret 8
dec ecx
push ecx
call fcn.10011d80
add esp, 4
mov eax, esi
pop edi
neg eax
sbb eax, eax
pop esi
and eax, 9
pop ebp
add eax, 0xfffffff7
pop ebx
add esp, 0x414
ret 8
or eax, 0xffffffff
pop ebx
add esp, 0x414
ret 8
Function at 0x1000b210
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], 0
mov eax, dword [esi + 0x1d1fc]
lea ecx, [esi + 0x1d1f4]
push eax
push ecx
mov ecx, dword [esi + 0x14]
call fcn.1000c350
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
lea edx, [esp + 8]
push edx
push 0
push esi
push 0x1000b830
push 0
push 0
call edi
mov dword [esi + 0x18], eax
lea eax, [esp + 8]
push eax
push 0
push esi
push 0x1000bbc0
push 0
push 0
call edi
mov dword [esi + 0x1c], eax
pop edi
pop esi
pop ecx
ret
Function at 0x1000c110
Capabilities:
Create udp socket

Disassembly:
sub esp, 0x10
xor eax, eax
push esi
mov dword [esp + 4], eax
mov word [esp + 4], 2
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
push eax
mov dword [esp + 0x14], eax
call dword [sym.imp.WS2_32.dll_htonl]
mov ecx, dword [esp + 0x18]
mov dword [esp + 8], eax
push ecx
call dword [sym.imp.WS2_32.dll_htons]
push 0x11
push 2
push 2
mov word [esp + 0x12], ax
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000c17c
lea edx, [esp + 4]
push 0x10
push edx
push esi
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x1000c17c
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
pop esi
add esp, 0x10
ret
test esi, esi
je 0x1000c175
push 0x1c
call fcn.10012c7e
add esp, 4
test eax, eax
je 0x1000c175
push esi
mov ecx, eax
call fcn.1000c0c0
pop esi
add esp, 0x10
ret

Function at 0x1000c1a0
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
sub esp, 0x11c
push esi
mov esi, ecx
push edi
lea edx, [esp + 0x18]
mov eax, dword [esi + 4]
mov ecx, 0x3f
mov dword [esp + 0x24], eax
xor eax, eax
lea edi, [esp + 0x28]
mov dword [esp + 0x20], 1
push edx
mov dword [esp + 0x20], eax
rep stosd dword es:[edi], eax
mov ecx, dword [esi + 8]
push eax
lea eax, [esp + 0x28]
mov dword [esp + 0x20], ecx
push eax
push 0
push 0
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jne 0x1000c1f8
pop edi
or eax, 0xffffffff
pop esi
add esp, 0x11c
ret 8
xor ecx, ecx
mov edx, dword [esi + 0x14]
mov ax, word [esi + 0x10]
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x12c]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
lea ecx, [esp + 8]
push 0x10
mov word [esp + 0xe], ax
mov eax, dword [esp + 0x12c]
push ecx
mov ecx, dword [esi + 4]
push 0
push edx
push eax
push ecx
mov word [esp + 0x20], 2
call dword [sym.imp.WS2_32.dll_sendto]
pop edi
pop esi
add esp, 0x11c
ret 8

Function at 0x1000c250
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x120
push ebx
mov ebx, ecx
push edi
mov ecx, 0x3f
mov eax, dword [ebx + 4]
lea edi, [esp + 0x2c]
mov dword [esp + 0x28], eax
xor eax, eax
mov dword [esp + 0x24], 1
rep stosd dword es:[edi], eax
mov eax, dword [ebx + 0xc]
test eax, eax
jl 0x1000c299
lea ecx, [esp + 0xc]
lea edx, [esp + 0x24]
push ecx
push 0
push 0
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], 0
push edx
jmp 0x1000c2a4
push 0
push 0
lea eax, [esp + 0x2c]
push 0
push eax
push 0
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jne 0x1000c2be
pop edi
or eax, 0xffffffff
pop ebx
add esp, 0x120
ret 8
mov edi, dword [esp + 0x130]
push ebp
mov ebp, dword [esp + 0x130]
push esi
mov dword [esp + 0x10], 0x10
mov eax, dword [ebx + 4]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0
push edi
push ebp
push eax
call dword [sym.imp.WS2_32.dll_recvfrom]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1000c302
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2746
je 0x1000c2d6
mov eax, esi
pop esi
pop ebp
pop edi
pop ebx
add esp, 0x120
ret 8
Function at 0x1000c7c0
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x1001e038
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
mov eax, dword [esi]
call dword [eax + 0x10]
test eax, eax
mov dword [esp + 0x10], eax
jl 0x1000c9b5
mov ecx, dword [esp + 0x5c]
mov edi, dword [esp + 0x60]
mov dword [esi + 0x2efc], ecx
or ecx, 0xffffffff
xor eax, eax
lea ebp, [esi + 0x2ec8]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
mov ebx, ecx
mov ecx, ebp
push ebx
call fcn.10001e50
test al, al
je 0x1000c847
mov edi, dword [ebp + 4]
mov esi, dword [esp + 0x60]
mov ecx, ebx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 4]
mov esi, dword [esp + 0x14]
add eax, ebx
mov dword [ebp + 8], ebx
mov byte [eax], 0
lea eax, [esp + 0x18]
push ebp
push eax
call fcn.10011950
add esp, 8
mov eax, dword [esp + 0x1c]
xor ebx, ebx
cmp eax, ebx
mov dword [esp + 0x54], ebx
jne 0x1000c868
mov eax, 0x1001f2c4
lea ecx, [esp + 0x28]
push ecx
push eax
call fcn.10013b02
add esp, 8
test eax, eax
jne 0x1000c90f
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x44]
lea ecx, [esi + 0x2ee8]
push 0x10
push ecx
push ebp
mov dword [esi + 0x2ebc], edx
mov dword [esi + 0x2ed8], eax
call fcn.1000fe70
add esp, 0xc
test al, al
jne 0x1000c8e0
mov ecx, dword [esp + 0x1c]
cmp ecx, ebx
je 0x1000c8d6
mov al, byte [ecx - 1]
test al, al
je 0x1000c8ca
cmp al, 0xff
je 0x1000c8ca
dec al
mov byte [ecx - 1], al
mov eax, 0xfffffffd
jmp 0x1000c9b5
add ecx, 0xfffffffe
push ecx
call fcn.10011d80
add esp, 4
mov eax, 0xfffffffd
jmp 0x1000c9b5
mov eax, dword [esp + 0x1c]
cmp eax, ebx
jne 0x1000c8ed
mov eax, 0x1001f2c4
push 0x100526f8
push eax
call fcn.100125a4
add esp, 8
cmp eax, ebx
mov dword [esi + 0x2ec4], eax
jne 0x1000c919
mov dword [esp + 0x10], 0xfffffff6
jmp 0x1000c91f
mov dword [esp + 0x10], 0xffffffff
jmp 0x1000c91f
cmp dword [esp + 0x10], ebx
je 0x1000c94f
mov ecx, dword [esp + 0x1c]
cmp ecx, ebx
je 0x1000c949
mov al, byte [ecx - 1]
test al, al
je 0x1000c93d
cmp al, 0xff
je 0x1000c93d
dec al
mov byte [ecx - 1], al
mov eax, dword [esp + 0x10]
jmp 0x1000c9b5
add ecx, 0xfffffffe
push ecx
call fcn.10011d80
add esp, 4
mov eax, dword [esp + 0x10]
jmp 0x1000c9b5
mov ecx, esi
call fcn.1000c9d0
mov edi, eax
cmp edi, ebx
jne 0x1000c98d
mov al, byte [esp + 0x64]
test al, al
jne 0x1000c984
lea edx, [esp + 0x64]
mov dword [esp + 0x64], ebx
push edx
push ebx
push esi
push 0x1000c7b0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x2ee4], eax
jmp 0x1000c98d
mov ecx, esi
call fcn.1000cb30
mov edi, eax
mov ecx, dword [esp + 0x1c]
cmp ecx, ebx
je 0x1000c9b3
mov al, byte [ecx - 1]
test al, al
je 0x1000c9a7
cmp al, 0xff
je 0x1000c9a7
dec al
mov byte [ecx - 1], al
jmp 0x1000c9b3
add ecx, 0xfffffffe
push ecx
call fcn.10011d80
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x48
ret 0xc
Function at 0x1000d550
Capabilities:
Check os version

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
mov ebp, ecx
push edi
mov ecx, 0x27
xor eax, eax
mov edi, esi
push esi
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dword [esi], 0x9c
mov byte [esp + 0x18], 1
call edi
mov ecx, dword [esp + 0x20]
xor ebx, ebx
cmp eax, ebx
mov dword [ecx], eax
jne 0x1000d5ac
push esi
mov dword [esi], 0x94
call edi
test eax, eax
jne 0x1000d5ac
mov byte [esp + 0x14], bl
pop edi
mov eax, dword [esp + 0x10]
pop esi
pop ebp
and eax, 0xff
pop ebx
add esp, 8
ret 8
cmp dword [esi + 4], 6
jne 0x1000d627
cmp dword [esi + 8], 2
jne 0x1000d627
lea edx, [esp + 0x20]
lea eax, [esp + 0x1c]
push edx
lea ecx, [esp + 0x14]
push eax
push ecx
mov ecx, ebp
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
call fcn.1000d640
test eax, eax
je 0x1000d627
mov eax, dword [esp + 0x10]
cmp eax, 6
jne 0x1000d611
mov ecx, dword [esp + 0x1c]
mov eax, 3
cmp ecx, eax
jne 0x1000d627
mov edx, dword [esp + 0x20]
mov dword [esi + 8], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 0xc], edx
pop edi
pop esi
pop ebp
and eax, 0xff
pop ebx
add esp, 8
ret 8
cmp eax, 0xa
jne 0x1000d627
mov ecx, dword [esp + 0x20]
mov dword [esi + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [esi + 0xc], ecx
mov dword [esi + 8], eax
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
and eax, 0xff
pop ebx
add esp, 8
ret 8