joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006fd2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xdc
xor eax, eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x14], 0x4b507543
mov ecx, 0x3d090c
mov dword [esp + 0x18], 0x764d7654
mov dword [esp + 0x1c], 0x74674575
mov dword [esp + 0x20], 0x79784e38
mov dword [esp + 0x24], 0x4a616838
mov byte [esp + 0x28], 0
mov dword [esp + 0x40], 0x65006b
mov dword [esp + 0x44], 0x6e0072
add bh, al
inc esp
and al, 0x48
add byte gs:[eax + eax - 0x39], ch
add byte [eax + eax - 0x39], ch
inc esp
and al, 0x4c
xor eax, dword [eax]
xor al, byte [eax]
mov dword [esp + 0x50], 0x64002e
mov dword [esp + 0x54], 0x6c006c
mov word [esp + 0x58], ax
xor eax, eax
mov byte [esp + eax + 0x70], al
inc eax
cmp eax, 0x6a
jb 0x10006f84
dec ecx
jne 0x10006f82
cmp byte [esp + 0xa0], 0x30
push ebx
push ebp
push esi
push edi
jne 0x10006fac
lea ecx, [esp + 0x50]
call fcn.1000754f
mov esi, eax
jmp 0x10006fb0
mov esi, dword [esp + 0x44]
mov edx, 0xe3142
mov ecx, esi
call fcn.1000758f
mov ebp, eax
mov edx, 0xd5786
mov ecx, esi
mov dword [esp + 0x48], ebp
call fcn.1000758f
mov edx, 0x348bfa
mov dword [esp + 0x78], eax
mov ecx, esi
call fcn.1000758f
push 4
push 0x3000
push 0x76400
push 0
mov dword [esp + 0x28], eax
call ebp
movsx esi, byte [esp + 0x80]
mov ebp, eax
mov eax, 0x92f11385
mov dword [esp + 0x14], ebp
imul esi
movsx eax, byte [esp + 0xa3]
xor edi, edi
add edx, esi
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
imul ecx, eax
lea eax, [ecx*8]
sub eax, ecx
imul ecx, esi, 0x156
add eax, eax
mov dword [esp + 0x1c], eax
mov eax, 0x66666667
imul ecx
mov eax, 0x66666667
sar edx, 1
mov ecx, edx
invalid

Function at 0x10007090
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, 0xca8bfad1
shr ecx, 0x1f
add ecx, edx
imul ecx
imul eax, esi, 0xd7c
add edx, ecx
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
add ebp, ecx
mov esi, dword [esp + 0x1c]
add ebp, eax

Function at 0x100070d3
Capabilities:
Enumerate pe sections

Disassembly:
jmp 0x10006fcc
add byte [eax], al
mov eax, 0x86186187
mov ecx, edi
mul edi
mov eax, edi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 4
imul eax, eax, 0x15
sub ecx, eax
sub ecx, esi
mov al, byte [esp + ecx + 0x24]
or al, 0x24
xor al, byte [edi + resource.1]
mov byte [edi + ebp], al
inc edi
cmp edi, 0x76400
jb 0x100070b6
mov edi, dword [esp + 0x14]
mov ecx, edi
call fcn.1000742f
movsx ecx, byte [esp + 0x88]
shl ecx, 3
push ecx
push 0x3000
push eax
push 0
call dword [esp + 0x58]
mov ebp, eax
mov dword [esp + 0x74], ebp
test ebp, ebp
je 0x10007355
mov esi, dword [edi + 0x3c]
mov edx, edi
add esi, edi
Function at 0x1000711f
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, ebp
mov dword [esp + 0x3c], esi
movzx eax, word [esi + 0x14]
push dword [esi + 0x54]
add eax, 0x18
add eax, esi
mov dword [esp + 0x80], eax
mov eax, ebp
sub eax, dword [esi + 0x34]
mov dword [esp + 0x74], eax
mov dword [esi + 0x34], ebp
call fcn.1000744f
mov eax, dword [esi + 0xa4]
add esp, 4
mov edx, dword [esi + 0xa0]
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 0x80]
mov dword [esp + 0x6c], eax
mov eax, dword [esi + 0x84]
mov dword [esp + 0x4c], eax
xor eax, eax
mov dword [esp + 0x40], edx
mov dword [esp + 0x20], eax
and al, 0x20
mov dword [esp + 0x48], eax
mov dword [esp + 0x10], eax
cmp ax, word [esi + 6]
jae 0x10007355
mov esi, dword [esp + 0x7c]
mov ebx, dword [esp + 0x3c]
add esi, 0xc
mov ecx, dword [esi]
cmp edx, ecx
jb 0x100071ad
mov eax, dword [esi - 4]
add eax, ecx
cmp edx, eax
jae 0x100071ad
lea eax, [esi - 0xc]
mov dword [esp + 0x20], eax
mov edx, dword [esp + 0x6c]
cmp edx, ecx
jb 0x100071c5
mov eax, dword [esi - 4]
add eax, ecx
cmp edx, eax
jae 0x100071c5
lea eax, [esi - 0xc]
mov dword [esp + 0x48], eax
mov edx, dword [esi + 8]
add ecx, ebp
push dword [esi + 4]
add edx, edi
call fcn.1000744f
mov edx, dword [esp + 0x14]
add esp, 4
movzx eax, word [ebx + 6]
inc edx
add esi, 0x28
mov dword [esp + 0x10], edx
cmp edx, eax
mov edx, dword [esp + 0x40]
jl 0x10007197
mov eax, dword [esp + 0x48]
mov ebx, dword [esp + 0x18]
test eax, eax
je 0x10007355
xor edi, edi
cmp dword [esp + 0x1c], edi
jbe 0x10007293
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x14]
add ecx, edi
add edi, 8
add ecx, edx
mov dword [esp + 0x40], ecx
mov ebx, dword [ecx + 4]
sub ebx, 8
shr ebx, 1
je 0x10007289
lea esp, [esp]
mov eax, dword [eax + 0x14]
add eax, edi
add edi, 2
movzx esi, word [eax + edx]
test esi, 0xf000
je 0x10007282
and esi, 0xfff
mov dword [esp + 0x10], 0
add esi, dword [ecx]
lea ecx, [esp + 0x10]
add esi, ebp
push 4
mov edx, esi
call fcn.1000744f
mov eax, dword [esp + 0x74]
lea edx, [esp + 0x14]
add dword [esp + 0x14], eax
mov ecx, esi
push 4
call fcn.1000744f
mov ecx, dword [esp + 0x48]
add esp, 8
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
dec ebx
jne 0x1000722f
cmp edi, dword [esp + 0x1c]
jb 0x10007213
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x3c]
mov esi, dword [edi + 0x80]
add esi, ebp
je 0x10007355
add esi, 0xc
mov dword [esp + 0x18], esi
cmp dword [esi], 0
je 0x10007301
Function at 0x10007178
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, ebp
mov dword [esp + 0x3c], esi
movzx eax, word [esi + 0x14]
push dword [esi + 0x54]
add eax, 0x18
add eax, esi
mov dword [esp + 0x80], eax
mov eax, ebp
sub eax, dword [esi + 0x34]
mov dword [esp + 0x74], eax
mov dword [esi + 0x34], ebp
call fcn.1000744f
mov eax, dword [esi + 0xa4]
add esp, 4
mov edx, dword [esi + 0xa0]
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 0x80]
mov dword [esp + 0x6c], eax
mov eax, dword [esi + 0x84]
mov dword [esp + 0x4c], eax
xor eax, eax
mov dword [esp + 0x40], edx
mov dword [esp + 0x20], eax
and al, 0x20
mov dword [esp + 0x48], eax
mov dword [esp + 0x10], eax
cmp ax, word [esi + 6]
jae 0x10007355
mov esi, dword [esp + 0x7c]
mov ebx, dword [esp + 0x3c]
add esi, 0xc
mov ecx, dword [esi]
cmp edx, ecx
jb 0x100071ad
mov eax, dword [esi - 4]
add eax, ecx
cmp edx, eax
jae 0x100071ad
lea eax, [esi - 0xc]
mov dword [esp + 0x20], eax
mov edx, dword [esp + 0x6c]
cmp edx, ecx
jb 0x100071c5
mov eax, dword [esi - 4]
add eax, ecx
cmp edx, eax
jae 0x100071c5
lea eax, [esi - 0xc]
mov dword [esp + 0x48], eax
mov edx, dword [esi + 8]
add ecx, ebp
push dword [esi + 4]
add edx, edi
call fcn.1000744f
mov edx, dword [esp + 0x14]
add esp, 4
movzx eax, word [ebx + 6]
inc edx
add esi, 0x28
mov dword [esp + 0x10], edx
cmp edx, eax
mov edx, dword [esp + 0x40]
jl 0x10007197
mov eax, dword [esp + 0x48]
mov ebx, dword [esp + 0x18]
test eax, eax
je 0x10007355
xor edi, edi
cmp dword [esp + 0x1c], edi
jbe 0x10007293
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x14]
add ecx, edi
add edi, 8
add ecx, edx
mov dword [esp + 0x40], ecx
mov ebx, dword [ecx + 4]
sub ebx, 8
shr ebx, 1
je 0x10007289
lea esp, [esp]
mov eax, dword [eax + 0x14]
add eax, edi
add edi, 2
movzx esi, word [eax + edx]
test esi, 0xf000
je 0x10007282
and esi, 0xfff
mov dword [esp + 0x10], 0
add esi, dword [ecx]
lea ecx, [esp + 0x10]
add esi, ebp
push 4
mov edx, esi
call fcn.1000744f
mov eax, dword [esp + 0x74]
lea edx, [esp + 0x14]
add dword [esp + 0x14], eax
mov ecx, esi
push 4
call fcn.1000744f
mov ecx, dword [esp + 0x48]
add esp, 8
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
dec ebx
jne 0x1000722f
cmp edi, dword [esp + 0x1c]
jb 0x10007213
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x3c]
mov esi, dword [edi + 0x80]
add esi, ebp
je 0x10007355
add esi, 0xc
mov dword [esp + 0x18], esi
cmp dword [esi], 0
je 0x10007301
Function at 0x1000758f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], edx
xor esi, esi
mov eax, dword [edi + 0x3c]
mov eax, dword [eax + edi + 0x78]
add eax, edi
mov ecx, dword [eax + 0x1c]
mov ebp, dword [eax + 0x20]
add ecx, edi
mov ebx, dword [eax + 0x18]
add ebp, edi
mov dword [esp + 0x18], ecx
mov ecx, dword [eax + 0x24]
add ecx, edi
mov dword [esp + 0x14], ecx
test ebx, ebx
je 0x100075e5
jmp 0x100075cf
mov ecx, dword [ebp + esi*4]
add ecx, edi
call fcn.1000751f
cmp eax, dword [esp + 0x10]
je 0x100075ef
inc esi
cmp esi, ebx
jb 0x100075cf
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
movzx eax, word [eax + esi*2]
mov eax, dword [ecx + eax*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x10007f45
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x1008d4d4
call fcn.10006db8
sub esp, 0x9c
and dword [ebp - 0x14], 0
push ebx
push esi
push edi
lea eax, [ebp - 0xa8]
mov dword [ebp - 0x10], esp
push eax
call fcn.1004143f
mov dword [esp], 0x100af2d4
push dword [ebp + 0xc]
call dword [sym.imp.MSVCRT.dll_fopen]
pop ecx
mov dword [ebp - 0x14], eax
test eax, eax
pop ecx
je 0x10008053
and dword [ebp - 4], 0
mov esi, 0x4000
push esi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edi, dword [sym.imp.MSVCRT.dll_fread]
pop ecx
push dword [ebp - 0x14]
mov ebx, eax
mov byte [ebp - 4], 1
push esi
push 1
push ebx
call edi
add esp, 0x10
test eax, eax
je 0x10007fd0
push eax
lea eax, [ebp - 0xa8]
push ebx
push eax
call fcn.1004108d
push dword [ebp - 0x14]
push esi
push 1
push ebx
call edi
add esp, 0x1c
jmp 0x10007fb0
push ebx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [ebp - 0x14]
call dword [sym.imp.MSVCRT.dll_fclose]
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.10041322
add esp, 0x10
xor esi, esi
movzx eax, byte [ebp + esi - 0x28]
push eax
lea eax, [ebp + esi*2 - 0x4c]
push str._02X
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
inc esi
cmp esi, 0x10
jl 0x10007ff4
and byte [ebp - 0x2c], 0
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xf]
push eax
lea eax, [ebp - 0x4c]
push eax
mov dword [ebp - 4], 4
call fcn.100067e5
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
push dword [ebp + 0xc]
push str.cannot_open_file__s_for_reading
call fcn.10008619
pop ecx
mov dword [ebp - 0x18], eax
pop ecx
lea eax, [ebp - 0x18]
push 0x100a96f8
push eax
call sub.MSVCRT.dll__CxxThrowException
Function at 0x10009597
Capabilities:
Delete file
Move file

Disassembly:
mov eax, 0x1008d74c
call fcn.10006db8
sub esp, 0x10
push esi
and dword [ebp - 4], 0
lea eax, [ebp - 0xe]
push eax
lea ecx, [ebp - 0x1c]
push dword [ebp + 8]
call fcn.100067e5
mov esi, str..bad
mov byte [ebp - 4], 2
push esi
call sub.MSVCRT.dll_strlen
pop ecx
add eax, esi
mov cl, byte [ebp + 0xb]
mov byte [ebp - 0xd], cl
lea ecx, [ebp - 0xd]
push ecx
push eax
push esi
lea ecx, [ebp - 0x1c]
call fcn.10008ad5
push dword [ebp - 0x1c]
call dword [sym.imp.MSVCRT.dll_remove]
push dword [ebp - 0x1c]
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll_rename]
add esp, 0xc
cmp dword [ebp - 0x1c], 0
pop esi
je 0x10009606
push dword [ebp - 0x1c]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret

Function at 0x10011f28
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
xor bl, bl
mov eax, dword [esi + 0x10]
test eax, eax
je 0x10011f92
mov ecx, dword [esi + 0x14]
cmp ecx, 0xffffffff
jne 0x10011f7d
push 0x100b034c
lea eax, [ebp - 0xc]
push dword [esi + 4]
push eax
call fcn.100114f8
add esp, 0xc
push dword [esi + 0x10]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esi + 0x14], eax
setne bl
cmp dword [ebp - 0xc], 0
je 0x10011f8e
push dword [ebp - 0xc]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
jmp 0x10011f8e
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov ebx, eax
dec ebx
neg ebx
sbb bl, bl
inc bl
test bl, bl
jne 0x10011f99
mov ecx, esi
call fcn.10011e93
mov al, bl
pop esi
pop ebx
leave
ret
Function at 0x100135a9
Capabilities:
Terminate process

Disassembly:
mov eax, 0x1008eb58
call fcn.10006db8
sub esp, 0x24
push ebx
push esi
xor ebx, ebx
push edi
cmp dword [ebp + 0xc], ebx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], ebx
je 0x10013714
push str.UTF_8
call fcn.10013de5
mov esi, eax
pop ecx
cmp esi, ebx
mov dword [ebp - 0x1c], esi
je 0x100136ac
push 0x10013455
push 0x10013422
push esi
mov dword [ebp - 4], ebx
call fcn.1001472f
push 0x10013531
push esi
call fcn.1001475a
push esi
call fcn.1001466a
push dword [ebp + 8]
push esi
call fcn.100146ba
push dword [ebp + 0xc]
call sub.MSVCRT.dll_strlen
push 1
pop edi
push edi
push eax
push dword [ebp + 0xc]
push esi
call fcn.100148f0
add esp, 0x34
test eax, eax
jne 0x10013696
push 0x28
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp + 8], eax
cmp eax, ebx
je 0x1001366a
mov dword [ebp - 0x14], edi
lea eax, [ebp + 0xf]
lea ecx, [ebp - 0x30]
push eax
push str.cannot_parse_XML_string
mov byte [ebp - 4], 2
call fcn.100067e5
push 3
pop eax
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x30]
push eax
call fcn.1000f2e3
jmp 0x1001366c
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push 0x100a9868
push eax
mov dword [ebp - 4], 5
call sub.MSVCRT.dll__CxxThrowException
push dword [ebp - 0x1c]
call fcn.10014522
pop ecx
xor ebx, ebx
push ebx
push ebx
call sub.MSVCRT.dll__CxxThrowException
push esi
call fcn.10014522
pop ecx
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
push 0x28
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp + 8], eax
cmp eax, ebx
mov dword [ebp - 4], 8
je 0x100136fa
mov dword [ebp - 0x14], 4
lea eax, [ebp + 0xf]
lea ecx, [ebp - 0x30]
push eax
push str.cannot_create_XML_parser
mov byte [ebp - 4], 9
call fcn.100067e5
mov dword [ebp - 0x14], 0xc
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 4], 0xa
call fcn.1000f2e3
jmp 0x100136fc
xor eax, eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push 0x100a9868
push eax
mov dword [ebp - 4], 0xc
call sub.MSVCRT.dll__CxxThrowException
call fcn.1000fc0d
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push 0x100a9ce0
push eax
call sub.MSVCRT.dll__CxxThrowException
Function at 0x10023de6
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
lea eax, [ebp - 0x190]
push eax
push 0x101
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
jne 0x10023e22
cmp byte [ebp - 0x190], 1
jne 0x10023e1c
mov al, byte [ebp - 0x18f]
cmp al, 1
jne 0x10023e1c
xor eax, eax
leave
ret
call dword [sym.imp.WSOCK32.dll_WSACleanup]
push 2
pop eax
leave
ret

Function at 0x10025077
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push 0x83b0
push 1
xor edi, edi
pop ebx
push ebx
call dword [0x100b0be0]
mov esi, eax
pop ecx
test esi, esi
pop ecx
jne 0x1002509b
push 0x1b
pop eax
jmp 0x100251da
push 0x100
call dword [0x100b0bd0]
test eax, eax
pop ecx
mov dword [esi + 0x2e4], eax
je 0x100251b6
mov dword [esi + 0x2e8], 0x100
mov eax, dword [sym.imp.MSVCRT.dll__iob]
add eax, 0x20
push 5
mov dword [esi + 0x24], eax
mov eax, dword [sym.imp.MSVCRT.dll__iob]
mov dword [esi + 0x28], eax
mov eax, dword [sym.imp.MSVCRT.dll__iob]
add eax, 0x40
or dword [esi + 0x210], 0x10
mov dword [esi + 0x10], eax
mov eax, dword [sym.imp.MSVCRT.dll_fwrite]
mov dword [esi + 0x78], eax
mov eax, dword [sym.imp.MSVCRT.dll_fread]
mov dword [esi + 0x80], eax
and dword [esi + 0x158], 0
or eax, 0xffffffff
mov dword [esi + 0x114], ebx
mov dword [esi + 0xa8], eax
mov dword [esi + 0x68], eax
mov dword [esi + 0x82f0], eax
mov dword [esi + 0xac], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x82f4], eax
pop eax
mov byte [esi + 0x1a1], bl
push 0x14
mov byte [esi + 0x1a2], bl
mov byte [esi + 0x1a3], bl
mov dword [esi + 0x15c], 0x3c
mov byte [esi + 0x188], bl
mov dword [esi + 0x14c], eax
mov dword [esi + 0x20], 0x438
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x2e0], eax
call dword [0x100b0bd0]
test eax, eax
pop ecx
mov dword [esi + 0x2dc], eax
jne 0x1002517b
push 0x1b
pop edi
jmp 0x10025190
mov ecx, dword [esi + 0x2e0]
shl ecx, 2
push ecx
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push str.CURL_CA_BUNDLE
mov dword [esi + 0x130], ebx
mov dword [esi + 0x134], 2
call dword [sym.imp.MSVCRT.dll_getenv]
test edi, edi
pop ecx
mov dword [esi + 0x13c], eax
je 0x100251d2
mov eax, dword [esi + 0x2e4]
test eax, eax
je 0x100251c8
push eax
call dword [0x100b0bd4]
pop ecx
push esi
call dword [0x100b0bd4]
pop ecx
xor esi, esi
mov eax, dword [esp + 0x10]
mov dword [eax], esi
xor eax, eax
pop edi
pop esi
pop ebx
ret
Function at 0x1002a679
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [esp + 8]
lea edx, [ecx + eax]
mov eax, 0x1505
cmp ecx, edx
jae 0x1002a69c
push esi
movsx esi, byte [ecx]
imul eax, eax, 0x21
xor eax, esi
inc ecx
cmp ecx, edx
jb 0x1002a68e
pop esi
ret

Function at 0x1002cd1a
Capabilities:
Terminate thread

Disassembly:
push ecx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi]
mov esi, dword [edi + 0x334]
mov dword [esp + 0x14], eax
mov ebp, dword [eax + 0x9c]
test ebp, ebp
jne 0x1002cd49
mov eax, dword [eax + 0x98]
test eax, eax
mov ebp, eax
jne 0x1002cd49
mov ebp, 0x12c
push ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
imul ebp, ebp, 0x3e8
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebp
push dword [esi + 0x18]
call ebx
push dword [esi + 0x14]
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [esi + 0x14]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebp
push dword [esi + 0x18]
and dword [esi + 0x14], 0
call ebp
xor ebp, ebp
cmp dword [esp + 0x10], ebp
mov dword [esi + 0x18], ebp
jne 0x1002cda7
push 0x1388
push dword [esi]
call ebx
cmp eax, 0x102
jne 0x1002cdf8
push ebp
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
lea ebp, [esi + 8]
mov byte [edi + 0x32c], 1
or dword [ebp], 0xffffffff
mov eax, dword [esp + 0x1c]
pop ebx
test eax, eax
je 0x1002cdc6
mov ecx, dword [edi + 0x328]
mov dword [eax], ecx
xor esi, esi
cmp dword [edi + 0x328], esi
jne 0x1002ce64
mov ebp, dword [ebp]
push 0x1b
pop esi
cmp ebp, esi
jne 0x1002ce12
push esi
call fcn.10024230
push eax
push str.Could_not_resolve_host:__s
push dword [esp + 0x20]
call fcn.1002da56
add esp, 0x10
jmp 0x1002ce64
push dword [edi + 0x330]
call dword [sym.imp.WSOCK32.dll_WSASetLastError]
lea ebp, [esi + 8]
push ebp
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
jmp 0x1002cdb5
cmp ebp, 0xffffffff
je 0x1002ce4d
mov eax, dword [edi + 0x330]
cmp eax, 0x2afc
je 0x1002ce4d
cmp byte [edi + 0x32c], 0
je 0x1002ce61
push eax
push edi
call fcn.1002459e
push eax
push dword [edi + 0x34]
push str.Could_not_resolve_host:__s___s
push dword [esp + 0x28]
call fcn.1002da56
add esp, 0x18
push 6
jmp 0x1002ce63
push dword [edi + 0x34]
push 0x100b2a98
push dword [esp + 0x1c]
call fcn.1002da56
add esp, 0xc
push 0x1c
pop esi
lea eax, [edi + 0x320]
push eax
call fcn.1002cc61
cmp dword [edi + 0x328], 0
pop ecx
jne 0x1002ce81
mov byte [edi + 0xe4], 1
mov eax, esi
pop edi
pop esi
pop ebp
pop ecx
ret
Function at 0x1002cf13
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [esi]
and dword [eax], 0
push edi
call dword [sym.imp.WSOCK32.dll_inet_addr]
cmp eax, 0xffffffff
je 0x1002cf42
push dword [ebp + 0x10]
push edi
push eax
call fcn.1002ca33
add esp, 0xc
jmp 0x1002cfb7
push 0
push dword [ebp + 0x10]
push edi
push esi
call fcn.1002cfbc
add esp, 0x10
test al, al
je 0x1002cf60
mov eax, dword [ebp + 0x14]
mov dword [eax], 1
jmp 0x1002cfa8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
call fcn.1002459e
push eax
push edi
push str.init_resolve_thread___failed_for__s___s_n
push ebx
call fcn.1002d9fc
add esp, 0x18
push edi
call dword [sym.imp.WSOCK32.dll_gethostbyname]
test eax, eax
jne 0x1002cfac
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
push esi
call fcn.1002459e
push eax
push dword [ebp + 0x10]
push edi
push str.gethostbyname_2__failed_for__s:_d___s_n
push ebx
call fcn.1002d9fc
add esp, 0x1c
xor eax, eax
jmp 0x1002cfb7
push dword [ebp + 0x10]
push eax
call fcn.1002ca89
pop ecx
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1002cfbc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 1
push 0x28
call dword [0x100b0be0]
mov esi, eax
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 4]
mov dword [ebp - 8], ebx
cmp esi, ebx
pop ecx
stosd dword es:[edi], eax
jne 0x1002cfee
push 0xc
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1002d0ed
mov edi, dword [ebp + 8]
push dword [edi + 0x320]
lea eax, [edi + 0x320]
mov dword [ebp + 8], eax
call fcn.10024eff
push dword [ebp + 0xc]
call dword [0x100b0bdc]
pop ecx
cmp eax, ebx
pop ecx
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
jne 0x1002d023
push esi
call dword [0x100b0bd4]
pop ecx
jmp 0x1002cfe1
mov eax, dword [ebp + 0x10]
push ebx
push 1
mov dword [edi + 0x324], eax
mov byte [edi + 0x32c], bl
mov dword [edi + 0x330], ebx
mov dword [edi + 0x328], ebx
mov dword [edi + 0x334], esi
or dword [esi + 0xc], 0xffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, ebx
mov dword [esi + 0x14], eax
je 0x1002d09f
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
cmp eax, ebx
mov dword [esi + 0x18], eax
je 0x1002d09f
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, ebx
mov dword [esi + 0x20], eax
je 0x1002d09f
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
cmp eax, ebx
mov dword [esi + 0x24], eax
je 0x1002d09f
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
cmp eax, ebx
mov dword [esi + 0x1c], eax
jne 0x1002d0af
push dword [ebp + 8]
call fcn.1002cc61
pop ecx
push 0xb
jmp 0x1002cfe3
mov eax, dword [sym.imp.MSVCRT.dll__iob]
add eax, 0x40
mov dword [esi + 0x10], eax
lea eax, [esi + 4]
push eax
push ebx
push edi
push 0x1002d11e
push ebx
push ebx
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
cmp eax, ebx
mov dword [esi], eax
jne 0x1002d0f1
call dword [sym.imp.MSVCRT.dll__errno]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp + 8]
call fcn.1002cc61
pop ecx
xor al, al
jmp 0x1002d119
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x1c]
mov dword [ebp - 4], eax
push 0xffffffffffffffff
lea eax, [ebp - 8]
push ebx
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push ebx
push 2
push 2
call dword [sym.imp.WSOCK32.dll_socket]
mov dword [esi + 0xc], eax
mov al, 1
pop edi
pop esi
pop ebx
leave
ret