joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4020e0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, ecx
push 0x412078
lea eax, [edi + 0xf8]
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x402234
mov eax, dword [edi + 0xd4]
test eax, eax
jne 0x40212c
push 0x3e800
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov dword [edi + 0xd4], eax
test eax, eax
je 0x402234
mov ecx, dword [edi + 0xf4]
push 0
push ecx
push ebp
call dword [sym.imp.MSVCRT.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x402234
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push ebp
lea esi, [edi + 0xc4]
push 1
push 4
push esi
call ebx
add esp, 0x10
cmp byte [esi], 0x53
jne 0x40217e
cmp byte [edi + 0xc5], 0x4d
jne 0x40217e
cmp byte [edi + 0xc6], 0x4f
jne 0x40217e
cmp byte [edi + 0xc7], 0x56
je 0x402193
push ebp
push 1
push 4
push esi
call ebx
add esp, 0x10
test eax, eax
je 0x402234
jmp 0x40215e
push ebp
lea esi, [edi + 0xc8]
push 1
push 0xc
push esi
call ebx
add esp, 0x10
test eax, eax
je 0x402234
mov esi, dword [esi]
mov eax, 0x10624dd3
mul esi
mov dword [esp + 0x10], esi
mov eax, 0x10624dd3
mov esi, edx
mul dword [edi + 0xc8]
shr edx, 0xa
push ebp
push edx
mov edx, dword [edi + 0xd4]
push 0x3e80
push edx
shr esi, 0xa
call ebx
add esp, 0x10
cmp eax, esi
jne 0x402234
lea eax, [esi + esi*4]
xor edx, edx
mov esi, 0x3e80
push ebp
lea eax, [eax + eax*4]
push 1
lea ecx, [eax + eax*4]
mov eax, dword [esp + 0x18]
div esi
mov eax, dword [edi + 0xd4]
shl ecx, 7
add eax, ecx
push edx
push eax
call ebx
add esp, 0x10
test eax, eax
je 0x402234
push ebp
call dword [sym.imp.MSVCRT.dll_ftell]
push ebp
mov dword [edi + 0xf4], eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret

Function at 0x4054f0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x100
mov ecx, dword [esp + 0x104]
push ebx
push esi
push edi
mov al, byte [ecx]
mov byte [esp + 0xc], al
mov eax, 1
mov dl, byte [eax + ecx]
mov bl, byte [esp + eax + 0xb]
xor dl, bl
mov byte [esp + eax + 0xc], dl
inc eax
cmp eax, 0x10
jl 0x40550b
lea esi, [ecx + 0x10]
lea ecx, [esp + 0xc]
mov edi, 0xf
xor eax, eax
test eax, eax
jne 0x40553b
mov dl, byte [esi]
mov bl, byte [ecx]
xor dl, bl
mov byte [ecx + 0x10], dl
jmp 0x405553
mov dl, byte [ecx + eax - 1]
mov bl, byte [ecx + eax + 0xf]
xor dl, bl
mov bl, byte [ecx + eax]
xor dl, bl
mov bl, byte [esi + eax]
xor dl, bl
mov byte [ecx + eax + 0x10], dl
inc eax
cmp eax, 0x10
jl 0x40552c
add esi, 0x10
add ecx, 0x10
dec edi
jne 0x40552a
mov ecx, dword [esp + 0x114]
lea esi, [esp + 0xc]
mov edi, 0x10
xor edx, edx
mov al, byte [esi + edx]
add ecx, 3
not al
mov byte [ecx - 3], al
mov byte [ecx - 2], al
mov byte [ecx - 1], al
inc edx
cmp edx, 0x10
jl 0x405574
add esi, 0x10
dec edi
jne 0x405572
pop edi
pop esi
pop ebx
add esp, 0x100
ret 8
Function at 0x1e83ac9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov si, sp
pop esi
xchg bx, di
pushal
pushfd
mov byte [esp + 4], 0x33
mov edi, dword [esp + 0x24]
bswap cx
mov ebx, dword [esp + 0x28]
mov cl, byte [esp + 0x14]
lea ecx, [ecx*4 + 0x7ca3fb36]
mov ecx, dword [esp + 0x2c]
call fcn.011d8498
push ebx
clc
shr ecx, 1
pushal
pushfd
pushfd
call fcn.011da572
push 0x70233d6a
out 0x95, al
sub dh, bh
pop es
wait
cmp eax, 0xfcd69a4
mov eax, 0xf632bc18
dec edx
cmc
aas
pop eax
xchg esi, eax
sbb dword [ebp - 0x1fb8f57], eax
out 0x8c, al
pop ds
adc ebx, eax
sub ch, byte [0x4d6a1964]
salc
int 0xad
pushal
std
popfd
invalid
push edx
test ah, ah
sub eax, ecx
bt esi, 1
sar ah, cl
mov eax, dword [ebp + 8]
clc
cmc
test eax, eax
pushal
lea esp, [esp + 0x20]
jns 0x1e7c554
jmp 0x11d5e7b
je 0x11df163
xchg dx, si
sub esi, esi
mov esi, dword [eax + 0x3c]
sbb dl, 0x14
bsr edx, ebx
bswap dx
cmp bl, bh
add esi, eax
bsf dx, cx
cmp ebx, 0x255cf04c
mov edx, dword [esi + 0x78]
stc
call fcn.0119373a
sub ecx, eax
mov al, 0xa5
pushfd
push edx
mov al, byte [ebp - 2]
call fcn.011dd94a
lea esp, [esp + 0xc]
je 0x1e83cd1
pushfd
not ax
lea eax, [ebx + edx*4]
pushfd
pushfd
pushfd
jmp 0x11dd668
call fcn.01e82905
shr byte [ecx + edx], cl
mov esp, 0xfab47116
cmp dword [edx], eax
sti
pop eax
mov ebp, 0x4aaf4324
jns 0x11dd6a5
retf 0xaefa
lea esp, [esp + 0x10]
call fcn.011d6070
push eax
adc dl, dl
call fcn.011932b5
mov dword [0xe0036bb8], eax
and byte [edx + edx - 0x6f773dea], cl
enter 0xfffffffffffffb14, 0xffffffffffffffbf
sti
inc eax
mov byte [0xf364e6a3], al
int 0xdb
pop esi
insb byte es:[edi], dx
jbe 0x11dd620
aad 0xbd
push ecx
cmpsd dword [esi], dword es:[edi]
xchg eax, ecx
test eax, 0x9030755
sahf
mov dh, 0x34
add dword [edx - 0x115dbd71], eax
fcmovnbe st(0), st(6)
xor al, 1
or byte [edi - 0x24115dbe], 0xd6
cmp al, byte [ebp + 0x1b]
pushfd
pop ebp
or dword [esi + 0x16], ecx
std
push 0xffffffffffffffad
fnstsw word [edx]
mov byte [edx + 0x2102df8f], ah
invalid
push 0x395c4b18
lea esp, [esp + 0x3c]
je 0x119304d
jmp 0x11d8add
pushfd
lea esp, [esp + 4]
je 0x11df163
sar edx, 9
lea edx, [esi - 0x54c0eb16]
adc esi, edx
mov esi, dword [eax + 0x3c]
dec dl
rcr dx, cl
add esi, eax
adc dl, dh
stc
mov edx, dword [esi + 0x78]
pushfd
pushal
cmc
cmc
test edx, edx
call fcn.01e7dcf5
xchg ebx, eax
xchg ebp, eax
push ebp
jl 0x1e7c5aa
push cs
pop eax
and ecx, esi
cmp al, 0xa
mov bh, 0xa3
mov eax, dword [0x808a96ac]
fisubr dword [esi - 0x592bb766]
xor ebp, edx
rcr dword [ecx], 0xff
pop edx
xor al, 0x60
rcl byte [esi - 0x21]
jo 0x1e7c540
xchg ebp, eax
inc ebp
aas
hlt
add ah, dl
sub al, 0xf1
jmp 0x1e878f4
push ebp
add ax, si
mov ebp, 0x3fdd8084
shl ax, cl
not bp
mov ebp, esp
rol ax, 9
lea eax, [ebp + 0x58396b93]
sub esp, 0x10
push 0xf80bf775
aad 0xc5
mov dword [esp], esi
mov ax, 0x7cdf
aad 0x3f
push edi
btr eax, eax
aas
push ebx
rcl ah, cl
jmp 0x11d52e6
Function at 0x10014e30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0x1c]
mov dword [esp + 0xc], ecx
push edi
test esi, esi
je 0x10014e4d
mov dword [esi], 0
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x10014f69
mov ebx, dword [ebp + 8]
cmp ebx, 0xffffffff
je 0x10014f74
cmp dword [ebp + 0x18], 0
je 0x10014f74
cmp dword [ebp + 0xc], 0
je 0x10014eb0
mov eax, dword [ebp + 0x10]
push 0
push 0x200
push dword [eax + 4]
push dword [eax]
call fcn.100a8300
or eax, edx
jne 0x10014e94
test edi, 0x1ff
je 0x10014eb0
mov eax, dword [ebp + 0x18]
mov ecx, dword [esp + 0x10]
push esi
push edi
push eax
push dword [ebp + 0x10]
push ebx
call fcn.10015160
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [ebp + 0x10]
push 0
push 0
push dword [eax + 4]
push dword [eax]
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x10014ed5
call fcn.10015440
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
mov eax, dword [ebp + 0x18]
push edi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10014f5f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6f8
je 0x10014f1d
cmp eax, 0x3e6
je 0x10014f1d
test eax, eax
jle 0x10014f79
movzx eax, ax
or eax, 0x80070000
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov ecx, dword [esp + 0x10]
push edi
call fcn.100150f0
test eax, eax
js 0x10014f79
cmp eax, 1
je 0x10014f79
push 0
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push edi
push dword [eax]
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10014ec7
mov eax, dword [esp + 0x10]
push edi
push dword [eax]
push dword [ebp + 0x18]
call fcn.1008bac0
add esp, 0xc
test esi, esi
je 0x10014f69
mov eax, dword [esp + 0x14]
mov dword [esi], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, 0x80070057
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x10014f90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0x1c]
mov dword [esp + 0xc], ecx
push edi
test esi, esi
je 0x10014fad
mov dword [esi], 0
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x1001505e
cmp dword [ebp + 0x18], 0
je 0x100150de
mov ebx, dword [ebp + 8]
cmp ebx, 0xffffffff
je 0x100150de
cmp dword [ebp + 0xc], 0
je 0x10015010
mov eax, dword [ebp + 0x10]
push 0
push 0x200
push dword [eax + 4]
push dword [eax]
call fcn.100a8300
or eax, edx
jne 0x10014ff4
test edi, 0x1ff
je 0x10015010
mov eax, dword [ebp + 0x18]
mov ecx, dword [esp + 0x10]
push esi
push edi
push eax
push dword [ebp + 0x10]
push ebx
call fcn.100152a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [ebp + 0x10]
push 0
push 0
push dword [eax + 4]
push dword [eax]
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x10015035
call fcn.10015440
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
mov eax, dword [ebp + 0x18]
push edi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10015069
test esi, esi
je 0x1001505e
mov eax, dword [esp + 0x14]
mov dword [esi], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6f8
je 0x10015092
cmp eax, 0x3e6
je 0x10015092
test eax, eax
jle 0x100150e3
movzx eax, ax
or eax, 0x80070000
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov ecx, dword [esp + 0x10]
push edi
call fcn.100150f0
test eax, eax
js 0x100150e3
cmp eax, 1
je 0x100150e3
mov eax, dword [esp + 0x10]
push edi
push dword [ebp + 0x18]
push dword [eax]
call fcn.1008bac0
add esp, 0xc
lea eax, [esp + 0x14]
push 0
push eax
mov eax, dword [esp + 0x18]
push edi
push dword [eax]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10015054
call fcn.10015440
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, 0x80070057
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x10015160
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x18]
mov dword [ebp - 4], ecx
push ebx
push esi
push edi
test eax, eax
je 0x10015179
mov dword [eax], 0
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x10015283
cmp dword [ebp + 0x10], 0
je 0x1001528e
cmp dword [ebp + 8], 0xffffffff
je 0x1001528e
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1001528e
mov edi, dword [eax + 4]
mov ebx, dword [eax]
push 0
push 0x200
push edi
push ebx
call fcn.100a8250
shld edx, eax, 9
xor ecx, ecx
shl eax, 9
sub esi, eax
mov dword [ebp - 8], edx
push 0
sbb ecx, edx
mov dword [ebp - 0xc], eax
add esi, ebx
push 0x200
adc ecx, edi
add esi, 0x1ff
adc ecx, 0
push ecx
push esi
call fcn.100a8250
mov ebx, dword [ebp - 4]
mov ecx, ebx
shl eax, 9
push eax
mov dword [ebp - 0x10], eax
call fcn.100150f0
test eax, eax
js 0x10015293
cmp eax, 1
je 0x10015293
mov edi, dword [ebp - 0xc]
mov esi, dword [ebp + 8]
push 0
push 0
push dword [ebp - 8]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x1001522d
call fcn.10015440
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push dword [ebp - 0x10]
push dword [ebx]
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1001521f
mov ecx, dword [ebp + 0xc]
mov esi, dword [ebp - 4]
mov ecx, dword [ecx]
sub ecx, edi
cmp esi, ecx
ja 0x1001525c
xor esi, esi
jmp 0x1001527a
sub esi, ecx
cmp dword [ebp + 0x14], esi
cmovb esi, dword [ebp + 0x14]
test esi, esi
je 0x1001527a
mov eax, dword [ebx]
push esi
add eax, ecx
push eax
push dword [ebp + 0x10]
call fcn.1008bac0
add esp, 0xc
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x10015283
mov dword [eax], esi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, 0x80070057
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x100152a0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], ecx
push ebx
push esi
push edi
test eax, eax
je 0x100152b9
mov dword [eax], 0
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x10015401
cmp dword [ebp + 0x10], 0
je 0x1001540c
cmp dword [ebp + 8], 0xffffffff
je 0x1001540c
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1001540c
mov edi, dword [eax + 4]
mov ebx, dword [eax]
push 0
push 0x200
push edi
push ebx
call fcn.100a8250
shld edx, eax, 9
xor ecx, ecx
shl eax, 9
sub esi, eax
mov dword [ebp - 0xc], edx
push 0
sbb ecx, edx
mov dword [ebp - 4], eax
add esi, ebx
push 0x200
adc ecx, edi
add esi, 0x1ff
adc ecx, 0
push ecx
push esi
call fcn.100a8250
mov esi, dword [ebp - 8]
mov edi, eax
shl edi, 9
mov ecx, esi
push edi
mov dword [ebp - 0x18], edi
call fcn.100150f0
test eax, eax
js 0x10015411
cmp eax, 1
je 0x10015411
mov ebx, dword [ebp + 8]
push 0
push 0
push dword [ebp - 0xc]
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x1001536e
call fcn.10015440
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push edi
push dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10015360
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
mov esi, dword [ebp + 0x14]
push esi
mov edi, dword [edi]
mov eax, dword [eax]
sub edi, dword [ebp - 4]
push dword [ebp + 0x10]
add eax, edi
push eax
call fcn.1008bac0
add esp, 0xc
push 0
push 0
push dword [ebp - 0xc]
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x10015360
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
mov eax, dword [ebp - 8]
push dword [ebp - 0x18]
push dword [eax]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10015360
mov ecx, dword [ebp + 0x18]
test ecx, ecx
je 0x10015401
mov eax, dword [ebp - 0x10]
cmp eax, edi
ja 0x100153f8
xor eax, eax
mov dword [ecx], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
sub eax, edi
cmp esi, eax
cmovb eax, esi
mov dword [ecx], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, 0x80070057
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x100154a0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x19c
mov eax, dword [0x100dc008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
lea eax, [ebp - 0x198]
push eax
push 0x202
mov dword [esi + 0x1c], 0xf
mov dword [esi + 0x18], 0
mov byte [esi + 8], 0
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0x100dd790
push 0x1f4
call fcn.1007bfcf
push 0x1f4
push 0
push eax
mov dword [esi + 0x20], eax
call fcn.1008b230
mov ecx, dword [ebp - 4]
add esp, 0x14
mov dword [esi], 0xffffffff
mov eax, esi
mov dword [esi + 4], 0xffffffff
xor ecx, ebp
mov dword [esi + 0x30], 0
mov dword [esi + 0x28], 0xffffffff
mov dword [esi + 0x2c], 0xffffffff
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x24], 0
pop esi
call fcn.1007bfb0
mov esp, ebp
pop ebp
ret

Function at 0x10015890
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
mov edx, dword [esi + 0x38]
mov eax, edx
mov edi, dword [esi + 0x3c]
or eax, edi
jne 0x100158b0
mov eax, 0x80004005
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x100159ce
mov ecx, dword [ebp + 0xc]
cmp ecx, edi
ja 0x100159ce
mov edi, dword [ebp + 8]
jb 0x100158d3
cmp edi, edx
jae 0x100159ce
xor eax, eax
mov dword [ebp + 0x10], ebx
add dword [ebp + 0x10], edi
adc eax, ecx
cmp eax, dword [esi + 0x3c]
jb 0x100158ed
ja 0x100158e9
cmp dword [ebp + 0x10], edx
jbe 0x100158ed
mov ebx, edx
sub ebx, edi
cmp dword [esi + 0x28], edi
jne 0x100158f7
cmp dword [esi + 0x2c], ecx
je 0x10015960
mov ecx, esi
call fcn.10015f50
test eax, eax
js 0x100159dd
cmp eax, 1
je 0x100159dd
push dword [ebp + 0xc]
mov ecx, esi
push edi
call fcn.10016170
test eax, eax
js 0x100159dd
cmp eax, 1
je 0x100159dd
mov eax, dword [ebp + 0xc]
mov ecx, esi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], eax
call fcn.10016320
test eax, eax
js 0x100159dd
cmp eax, 1
je 0x100159dd
mov ecx, esi
call fcn.10016030
test eax, eax
js 0x100159dd
cmp eax, 1
je 0x100159dd
mov edi, ebx
test ebx, ebx
je 0x100159ae
mov ecx, dword [esi + 4]
cmp ecx, 0xffffffff
je 0x100159c0
mov eax, 0x1000
cmp edi, eax
push 0
cmovb eax, edi
push eax
mov eax, ebx
sub eax, edi
add eax, dword [ebp + 0x14]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x100159a3
call fcn.10015440
mov ecx, eax
xor eax, eax
test ecx, ecx
js 0x100159c5
cmp ecx, 1
je 0x100159c5
jmp 0x100159aa
add dword [esi + 0x28], eax
adc dword [esi + 0x2c], 0
sub edi, eax
jne 0x10015966
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x100159db
mov dword [eax], ebx
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
mov ecx, 0x80004005
mov eax, ecx
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x100159db
mov dword [eax], 0
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x100159f0
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
mov eax, dword [0x100dc008]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x18]
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push 0
mov dword [ebp - 0x264], eax
mov eax, dword [ebp + 0x10]
push 0
mov dword [ebp - 0x260], eax
movzx eax, word [ebp + 0x14]
push 0
push 0x100b6d40
mov dword [ebp - 0x26c], ecx
mov dword [ebp - 0x268], eax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov ecx, dword [ebp - 0x260]
mov esi, eax
mov dword [ebp - 0x270], esi
cmp dword [ecx + 0x14], 8
jb 0x10015a57
mov ecx, dword [ecx]
mov eax, dword [ebp - 0x264]
cmp dword [eax + 0x14], 8
jb 0x10015a65
mov eax, dword [eax]
cmp dword [edi + 0x14], 8
jb 0x10015a6d
mov edi, dword [edi]
push 0
push 0x8000000
push 1
push ecx
push eax
push dword [ebp - 0x268]
push edi
push esi
call dword [sym.imp.WININET.dll_InternetConnectW]
mov edi, eax
test edi, edi
jne 0x10015ac1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 0x2eee
jne 0x10015aac
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ebx, 0xe0036003
jmp 0x10015b3e
test ebx, ebx
jle 0x10015ab9
movzx ebx, bx
or ebx, 0x80070000
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x10015b3e
cmp dword [ebx + 0x14], 8
jb 0x10015ac9
mov ebx, dword [ebx]
push 0
push 0
lea eax, [ebp - 0x25c]
push eax
push ebx
push edi
call dword [sym.imp.WININET.dll_FtpFindFirstFileW]
mov esi, eax
test esi, esi
jne 0x10015aeb
call fcn.10015440
mov ebx, eax
jmp 0x10015b24
mov edx, dword [ebp - 0x26c]
xor eax, eax
or eax, dword [ebp - 0x23c]
mov ecx, dword [ebp - 0x240]
mov dword [edx + 0x38], eax
or eax, ecx
mov dword [edx + 0x3c], ecx
jne 0x10015b10
mov ebx, 0xe0036006
jmp 0x10015b24
mov eax, dword [ebp - 0x244]
xor ebx, ebx
mov dword [edx + 0x44], eax
mov eax, dword [ebp - 0x248]
mov dword [edx + 0x40], eax
test esi, esi
je 0x10015b2f
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push edi
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call edi
mov esi, dword [ebp - 0x270]
test esi, esi
je 0x10015b45
push esi
call edi
mov ecx, dword [ebp - 8]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1007bfb0
mov esp, ebp
pop ebp
ret 0x14
Function at 0x10015b60
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100dc008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [edi]
cmp eax, 0xffffffff
je 0x10015b95
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [edi], 0xffffffff
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [edi], eax
cmp eax, 0xffffffff
jne 0x10015bc0
call fcn.10015440
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007bfb0
mov esp, ebp
pop ebp
ret 0x10
push 4
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0x7530
push ecx
push 0x1006
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp dword [esi + 0x14], 0x10
xorps xmm0, xmm0
movups xmmword [ebp - 0x14], xmm0
jb 0x10015bef
mov eax, dword [esi]
jmp 0x10015bf1
mov eax, esi
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x10015c32
cmp dword [esi + 0x14], 0x10
jb 0x10015c05
mov esi, dword [esi]
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
test esi, esi
je 0x10015ba8
movsx eax, word [esi + 0xa]
push eax
mov eax, dword [esi + 0xc]
push dword [eax]
lea eax, [ebp - 0x10]
push eax
call fcn.1008bac0
mov ax, word [esi + 8]
add esp, 0xc
mov word [ebp - 0x14], ax
jmp 0x10015c3e
mov ecx, 2
mov dword [ebp - 0x10], eax
mov word [ebp - 0x14], cx
push dword [ebp + 0x14]
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x14]
push 0x10
push eax
push dword [edi]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x10015ba8
push dword [ebp - 0x1c]
mov ecx, edi
push ebx
call fcn.10015c80
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1007bfb0
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10015f50
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100dc008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 9
mov edi, ecx
mov dword [ebp - 8], 0xf
push str.TYPE_I__r_n
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0xc], 0
mov byte [ebp - 0x1c], 0
call fcn.10017920
cmp dword [ebp - 8], 0x10
lea eax, [ebp - 0x1c]
push 0
push dword [ebp - 0xc]
cmovae eax, dword [ebp - 0x1c]
push eax
push dword [edi]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x10015fac
call fcn.10015440
mov esi, eax
jmp 0x10016005
push 0
push 0x1f4
push dword [edi + 0x20]
push dword [edi]
call dword [sym.imp.WS2_32.dll_recv]
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x10015fd7
call fcn.10015440
mov esi, eax
test esi, esi
js 0x10016005
cmp esi, 1
jne 0x10015fde
jmp 0x10016005
mov eax, dword [edi + 0x20]
mov byte [ecx + eax], 0
mov eax, dword [edi + 0x20]
test eax, eax
je 0x10016003
cmp byte [eax], 0
je 0x10016003
push str._n226
push eax
call fcn.1008adc0
add esp, 8
test eax, eax
je 0x10016003
mov dword [edi + 0x24], 1
xor esi, esi
mov ecx, dword [ebp - 8]
cmp ecx, 0x10
jb 0x10016017
inc ecx
push ecx
push dword [ebp - 0x1c]
call fcn.10017be0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.1007bfb0
mov esp, ebp
pop ebp
ret