joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401517
Capabilities:
Clear file content
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
push esi
xor esi, esi
cmp dword [0x245e95c], 0x400
push edi
jne 0x401575
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_DrawStateA]
push esi
push esi
call fcn.00402a66
push esi
push esi
call fcn.0040235d
push esi
call fcn.00402a01
push esi
push esi
call fcn.0040284c
push esi
call fcn.00402b64
push esi
push esi
call fcn.00402261
add esp, 0x28
xor edi, edi
cmp edi, 0x16cda
jge 0x40158d
push esi
lea eax, [ebp - 4]
push eax
push esi
push esi
push esi
call dword [sym.imp.GDI32.dll_GetCharABCWidthsI]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_LocalCompact]
cmp edi, 0x12e5bee
jg 0x4015b2
inc edi
cmp edi, 0x30053
jl 0x401577
mov eax, dword [0x44139c]
mov dword [0x245e95c], eax
call fcn.00401235
mov edi, 0x3078f
cmp dword [0x245e95c], 0x51f
jne 0x4015e0
push esi
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
dec edi
jne 0x4015c6
pop edi
xor eax, eax
pop esi
leave
ret 0x10

Function at 0x406e1e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4406d8]
jne 0x406e28
repz ret
jmp fcn.0040877a
Function at 0x40802d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4406d8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00405a6d
and dword [ebp - 0x14], 0
cmp dword [0x44bf20], 0
mov dword [ebp - 0x18], eax
jne 0x4080e0
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x408188
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x408188
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x44bf20], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x44bf24], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x44bf28], eax
call edi
push eax
call esi
mov dword [0x44bf30], eax
test eax, eax
je 0x4080e0
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x44bf2c], eax
mov eax, dword [0x44bf2c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x408139
cmp dword [0x44bf30], ecx
je 0x408139
push eax
call esi
push dword [0x44bf30]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x408139
test ebx, ebx
je 0x408139
call edi
test eax, eax
je 0x408130
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x408130
test byte [ebp - 8], 1
jne 0x408139
or dword [ebp + 0x10], 0x200000
jmp 0x40816c
mov eax, dword [0x44bf24]
cmp eax, dword [ebp - 0x18]
je 0x40816c
push eax
call esi
test eax, eax
je 0x40816c
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40816c
mov eax, dword [0x44bf28]
cmp eax, dword [ebp - 0x18]
je 0x40816c
push eax
call esi
test eax, eax
je 0x40816c
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x44bf20]
call esi
test eax, eax
je 0x408188
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40818a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406e1e
leave
ret
Function at 0x10001b50
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
movzx ecx, word [edx + 0x14]
lea edx, [eax + ecx + 0x18]
mov dword [ebp - 4], edx
mov dword [ebp - 0x10], 0
jmp 0x10001b8f
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
add ecx, 0x28
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
movzx ecx, word [eax + 6]
cmp dword [ebp - 0x10], ecx
jge 0x10001cab
mov edx, dword [ebp - 4]
cmp dword [edx + 0x10], 0
jne 0x10001c1c
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 0x38]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0
jle 0x10001c17
mov edx, dword [ebp + 0x14]
mov eax, dword [edx + 0x34]
push eax
push 4
push 0x1000
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + 0x1c]
call edx
add esp, 0x14
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10001bf0
xor eax, eax
jmp 0x10001cb0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0x14]
push ecx
push 0
mov edx, dword [ebp - 8]
push edx
call fcn.10001930
add esp, 0xc
jmp 0x10001b7d
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x14]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 0x10]
push ecx
mov eax, dword [ebp + 0xc]
push eax
call fcn.10001b30
add esp, 8
test eax, eax
jne 0x10001c3d
xor eax, eax
jmp 0x10001cb0
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + 0x34]
push edx
push 4
push 0x1000
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + 0x1c]
call edx
add esp, 0x14
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10001c74
xor eax, eax
jmp 0x10001cb0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x14]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.10001980
add esp, 0xc
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [ecx + 8], edx
jmp 0x10001b7d
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x10002720
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0x59a00
mov ecx, dword [ebp - 4]
push ecx
push 0x10004088
call fcn.10001000
add esp, 8
mov dword [ebp - 0xc], eax
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x495e30
Capabilities:
Accept command line arguments

Disassembly:
push esi
call fcn.0044b610
jmp fcn.00bcca80

Function at 0x605539
Capabilities:
Encode data using xor

Disassembly:
push esi
aaa
or eax, 0x7a49e0f7
jbe 0x605598
stosd dword es:[edi], eax
rcl byte [edi], 0x60
or dword [esi - 0x138bbe95], ecx
mov gs, word [ebx + 0x41]
je 0x60552a
mov gs, word [ebx + 0x41]
je 0x60552a
add al, 0xcd
or byte [ecx - 0x4a3df729], dl
aaa
int 8
xchg ecx, eax
xlatb
or dl, al
mov ch, 0x37
xchg edx, eax
out 0xd8, eax
push esp
sub dl, bl
rcr dword [edx + 0x3780e7a9], cl
add dword [esi - 0x6fe05da2], edi
add dword [edx], esi
outsd dx, dword [esi]
mov esp, 0xeac8675c
invalid
adc dword [esi + 0x19], 0xfffffffb
jae 0x605611
xor eax, 0x85c1a0c7
jg 0x60553f
sal dword [ebx - 0x49], 0xd7
xlatb
les edx, [eax + 0x7f19459]
adc bh, al
test dword [edx + 0x27], eax
xor ah, byte [eax - 0x3e]
test byte [ebx], dh
cmp byte [eax], 0x63
sbb eax, 0x314e1d6e
mov dword [0xac2e80a6], eax
dec esi
add bl, dl
rol ch, 1
mov dword [0xca4c7f81], eax
sti
in al, 0x2d
adc al, 0x3e
outsb dx, byte [esi]
adc esi, edx
cmp byte [eax + 0x130a73ea], bh
out 0xc, eax
cld
ljmp 0xb042
add byte [ecx], ah
add eax, 0x6372e042
sahf
push ss
nop
xor eax, 0xc730ef1e
lcall 0xa5e8, 0xc0fd3321
ja 0x60562a
loopne 0x605687
mov cl, 0x64
and byte [esi + 0x2c142101], bh
ljmp 0x5567
mov dword [ebx + ebp - 0x109ad0f3], ebp
jmp 0x6056db
push esi
shl dword [eax - 0x20866a4a], 0x83
mov dl, 1
cmpsb byte [esi], byte es:[edi]
xchg ebx, ebp
aam 0x33
sbb byte [esi], ah
mov dword [eax + 0x5f], edx
mov dh, 0x95
xchg ebp, eax
jns 0x60566d
xor dword [edx - 0x147859ff], 0xffffffd4
xor ebx, dword [eax]
mov dword es:[eax + 0x5f], edx
jl 0x60568a
inc edi
xchg edi, eax
pop ebp
xor eax, 0xfa8649c2
mov al, 0xbf
pushfd
xchg edi, eax
inc ecx
inc edx
mov esi, es
sbb dword [edi - 0x28da90af], eax
loopne 0x60568b
retf 0x3e24
push eax
sub byte [eax + edx + 0xa], bh
xchg byte [eax - 0xaa23], dl
inc esi
lodsb al, byte [esi]
std
aas
pop edi
cdq
cmc
in al, 0x60
pushal
je 0x60568a
cmp byte [ecx + 0x30], ah
dec edx
scasb al, byte es:[edi]
mov ecx, 0x6160d678
invalid
Function at 0x61a999
Capabilities:
Encode data using xor

Disassembly:
insd dword es:[edi], dx
cld
push esi
sbb dword gs:[ecx + 0x6313ad9b], 0xdcd0e642
sbb ah, 0x3a
das
mov dl, 0x35
jle 0x61a9a0
mov dl, 0xc0
mov byte [esi + edx*4 + 0x12a836fd], ah
xchg dword [edx - 0x2b], esp
xor byte [0xb45937b], cl
fst qword [esi + 0xbfe2ebb]
pop ebx
push ds
add bl, byte [0xaa5d8570]
rcl ch, cl
inc esi
mov word [ebp - 0x2a5784b3], ds
mov word [ecx], es
sbb ebp, 0xf
mov ebx, 0xc97c2d35
dec esp
and bh, byte [ecx + 0x7e]
jns 0x61aa09
retf
cmpsd dword [esi], dword es:[edi]
cmp byte [edi - 0x2e], 0xa3
loop 0x61a93d
mov al, byte [0xd174d369]
pop esp
adc dword [ecx], ecx
inc ebp
inc eax
cmp al, byte [edi - 0x185a340a]
pop eax
clc
popal
jnp 0x61a9bf
mov esp, 0xb42f177d
add esp, dword [edx - 0xaba778e]
movsb byte es:[edi], byte [esi]
mov byte [0xf5458872], al
inc ebp
cmc
adc ch, al
jbe 0x61a989
aam 0xc4
pop esi
mov ebp, 0x62297914
xor edi, esi
invalid
sub dword [ebp - 0x7cb06246], ebx
cmp eax, ebp
mov esp, 0x1d33e662
mov esp, 0x4cab04ad
lodsd eax, dword [esi]
loope 0x61a9bb
inc edx
dec ebx
inc ebx
pop ecx
sub ecx, dword [eax]
xor edx, dword [ebx + 0x3f3141c0]
push ebx
and eax, 0xd80c84a
imul esp, dword [edx], 0xffffffd6
ret
Function at 0x10001040
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push 0xf0000000
xor esi, esi
lea eax, [ebp - 8]
push 0x18
push esi
push esi
push eax
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x10001113
lea eax, [ebp - 4]
push eax
push esi
push esi
push 0x800c
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x10001108
mov edx, dword [ebp + 8]
mov ecx, edx
push edi
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10001092
push 0
sub ecx, edi
push ecx
push edx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
pop edi
test eax, eax
je 0x100010ff
lea eax, [ebp - 0xc]
push eax
push 1
push dword [ebp - 4]
push 0x6610
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x100010ff
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
push 0
push 1
push 0
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x100010f1
mov ecx, dword [ebp + 0x14]
mov esi, 1
mov eax, dword [ebp + 0x10]
mov dword [ecx], eax
jmp 0x100010f6
mov eax, dword [ebp + 0x14]
mov dword [eax], esi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10011ca0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x1007d820]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x108]
push 0x5c
push eax
call fcn.10063070
add esp, 8
mov byte [eax], 0
mov eax, str.0f40fc17.ppf
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10011ce4
lea edi, [ebp - 0x108]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10011cf4
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0
push 0x80
push 3
push 0
mov ecx, eax
lea eax, [ebp - 0x108]
push 0
and ecx, 3
push closesocket
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push eax
mov dword [0x1007ec08], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 4
push 0x3000
push eax
push 0
mov dword [0x1007ec10], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0
push 0x1007ec14
push dword [0x1007ec10]
mov dword [0x1007ec0c], eax
push eax
push dword [0x1007ec08]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [0x1007ec08]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x10c]
push eax
push dword [0x1007ec10]
push dword [0x1007ec0c]
push str.d144917f_7d6f_e476_a455_dc4dba1c0ea7
call fcn.10001040
mov ecx, dword [ebp - 4]
add esp, 0x10
xor ecx, ebp
pop edi
pop esi
call fcn.100631a7
mov esp, ebp
pop ebp
ret

Function at 0x10011ee0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, ecx
cmp esi, 0x40
jae 0x10011ef5
xor eax, eax
pop esi
pop ebp
ret 8
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
mov dword [edx + 0xc], ecx
cmp word [ecx], ax
jne 0x10011eee
push edi
mov edi, dword [ecx + 0x3c]
lea eax, [edi + 0xf8]
cmp esi, eax
jb 0x10011f3d
lea eax, [edi + ecx]
mov dword [edx + 0x10], eax
cmp dword [eax], 0x4550
jne 0x10011f3d
movzx ecx, word [eax + 0x16]
test ecx, 0x2000
je 0x10011f3d
test cl, 2
je 0x10011f3d
mov ecx, 0xe0
cmp word [eax + 0x14], cx
je 0x10011f45
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
push ebx
lea ebx, [eax + 0xf8]
xor ecx, ecx
mov dword [edx + 0x14], ebx
movzx edi, word [eax + 6]
test edi, edi
jle 0x10011f74
xor edx, edx
jmp 0x10011f60
mov eax, dword [edx + ebx + 0x14]
add eax, dword [edx + ebx + 0x10]
cmp eax, esi
ja 0x10011f80
inc ecx
add edx, 0x28
cmp ecx, edi
jl 0x10011f60
pop ebx
pop edi
mov eax, 1
pop esi
pop ebp
ret 8
pop ebx
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
Function at 0x10012390
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 8], 0
je 0x100123a3
xor eax, eax
pop esi
pop ebp
ret 8
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10011ee0
test eax, eax
je 0x1001239c
push ebx
mov ecx, esi
call fcn.10011e60
mov ebx, eax
test ebx, ebx
jne 0x100123c6
pop ebx
pop esi
pop ebp
ret 8
push edi
push 0x40
push 0x3000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
je 0x10012472
push dword [ebp + 8]
mov ecx, esi
push edi
call fcn.10011f90
mov eax, dword [esi + 0x10]
cmp dword [eax + 0xa0], 0
jbe 0x10012409
cmp dword [eax + 0xa4], 0
jbe 0x10012409
push edi
mov ecx, esi
call fcn.10012020
push edi
mov ecx, esi
call fcn.100120b0
test eax, eax
jne 0x1001242b
push 0x8000
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop edi
pop ebx
xor eax, eax
pop esi
pop ebp
ret 8
lea eax, [ebp + 8]
push eax
push 0x40
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [esi + 0x10]
push 0
push 1
push edi
mov dword [eax + 0x34], edi
mov eax, dword [esi + 0x10]
mov eax, dword [eax + 0x28]
add eax, edi
mov dword [esi + 4], eax
call eax
test eax, eax
jne 0x1001247b
push eax
push eax
mov eax, dword [esi + 4]
push edi
call eax
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [esi + 4], 0
pop edi
pop ebx
xor eax, eax
pop esi
pop ebp
ret 8
mov dword [esi + 8], edi
mov eax, 1
pop edi
pop ebx
mov dword [esi], 1
pop esi
pop ebp
ret 8
Function at 0x100131a0
Capabilities:
Convert ip address from string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x1007d820]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 0x1000112b
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x3c], 0x1000112b
push dword [esi + 0x1c]
mov dword [ebp - 0x40], 0x1000112b
push dword [esi + 0x18]
call fcn.10045360
add esp, 0xc
test eax, eax
jne 0x100132ce
push edi
mov edi, dword [sym.imp.WS2_32.dll_inet_pton]
lea eax, [ebp - 0x14]
push eax
push dword [esi + 0xc]
push 0x17
call edi
cmp eax, 1
jne 0x1001320d
mov dword [ebp - 0x3c], 0x1000115c
mov dword [ebp - 0x40], 0x10001160
lea eax, [ebp - 0x14]
push eax
push dword [esi]
push 0x17
call edi
cmp eax, 1
jne 0x10013228
mov ebx, 0x1000115c
mov edi, 0x10001160
jmp 0x1001322d
mov edi, 0x1000112b
mov eax, dword [esi + 0x14]
mov ecx, 0x1000112b
cmp eax, 8
je 0x10013255
cmp eax, 0x10
je 0x1001324e
cmp eax, 0x20
mov edx, ecx
mov eax, 0x10001128
cmove edx, eax
jmp 0x1001325a
mov edx, 0x10001124
jmp 0x1001325a
mov edx, 0x10001120
mov eax, dword [esi + 8]
cmp eax, 8
je 0x1001327b
cmp eax, 0x10
je 0x10013274
cmp eax, 0x20
mov eax, 0x10001128
cmove ecx, eax
jmp 0x10013280
mov ecx, 0x10001124
jmp 0x10013280
mov ecx, 0x10001120
push dword [esi + 0x24]
movzx eax, byte [esi + 0x20]
push eax
push dword [ebp - 0x38]
mov eax, dword [ebp - 0x28]
push dword [ebp - 0x34]
inc eax
push dword [ebp - 0x30]
push dword [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x24]
add eax, 0x76c
push eax
movzx eax, word [esi + 0x10]
push eax
push dword [ebp - 0x40]
movzx eax, word [esi + 4]
push dword [esi + 0xc]
push dword [ebp - 0x3c]
push edx
push eax
push edi
push dword [esi]
push ebx
push ecx
push 0x10001164
push dword [ebp - 0x44]
call sym.libcurl.dll_curl_mfprintf
add esp, 0x50
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.100631a7
mov esp, ebp
pop ebp
ret
Function at 0x10017880
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1007ec28]
mov dword [ebp - 8], 0x4020
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 4
test eax, eax
jne 0x100178d2
push 3
push 2
push eax
push eax
push 6
call fcn.10060340
add esp, 0x14
test al, al
je 0x100178c6
mov dword [0x1007ec28], 2
mov esp, ebp
pop ebp
ret
mov dword [0x1007ec28], 1
jmp 0x100178d7
cmp eax, 2
je 0x10017917
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0x1001
push 0xffff
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x100178fe
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jg 0x10017917
push 4
lea eax, [ebp - 8]
push eax
push 0x1001
push 0xffff
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
mov esp, ebp
pop ebp
ret
Function at 0x10018290
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebx + 8]
push dword [edi + 0x14]
lea eax, [edi + 0x18]
push eax
push dword [edi + 0x98]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x100182d0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
lea eax, [edi + 0xbc]
push eax
push dword [ebp + 0xc]
call fcn.10018780
add esp, 0xc
pop edi
pop ebx
pop ebp
ret
push dword [ebp + 0xc]
mov byte [edi + 0x156], 1
push ebx
call fcn.10018520
push dword [edi + 0x118]
cmp dword [edi], 5
lea eax, [edi + 0xbc]
push eax
push dword [edi + 0x11c]
lea eax, [edi + 0xea]
mov ecx, 0x100019f4
push eax
push dword [edi + 0x98]
mov eax, 0x10001ec4
cmovne eax, ecx
push eax
push 0x10001ecc
push ebx
push dword [ebp + 0xc]
call fcn.10021400
push 1
push dword [edi + 0x98]
call fcn.10044e50
add esp, 0x34
xor eax, eax
pop edi
pop ebx
pop ebp
ret

Function at 0x10018340
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1007d820]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x14]
mov eax, dword [ebx]
push 0
push dword [ebp + 0x10]
mov eax, dword [eax + 8]
push ecx
mov dword [edi], 0
mov dword [ebp - 0x108], eax
push dword [eax + 0x98]
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100183d6
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
jne 0x100183a1
mov dword [edi], 0x51
jmp 0x100183d3
push pe_nt_image_headers32
lea eax, [ebp - 0x104]
push eax
push esi
call fcn.10054020
push eax
push 0x10001ba0
push dword [ebx + 4]
call fcn.10021300
mov eax, dword [ebx + 4]
add esp, 0x18
mov dword [eax + 0x8a8], esi
mov dword [edi], 0x38
or esi, 0xffffffff
push dword [edi]
mov eax, dword [ebp - 0x108]
push esi
push dword [eax + 0x98]
push dword [ebp + 0x10]
push 0x10001bb4
push dword [ebx]
push dword [ebx + 4]
call fcn.10021400
mov ecx, dword [ebp - 4]
add esp, 0x1c
mov eax, esi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.100631a7
mov esp, ebp
pop ebp
ret
Function at 0x10018520
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x188
mov eax, dword [0x1007d820]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [eax + 8]
push edi
mov edi, dword [esi + 0x98]
cmp edi, 0xffffffff
je 0x1001864c
mov eax, dword [ebx + 0x18]
mov eax, dword [eax + 0x260]
test dword [eax + 0x48], 0x800
jne 0x1001864c
push 0x80
lea eax, [ebp - 0x184]
mov dword [ebp - 0x188], 0x80
push 0
push eax
call fcn.10064710
add esp, 0xc
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp - 0x184]
push eax
push edi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x100185dd
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
lea eax, [ebp - 0x104]
push pe_nt_image_headers32
push eax
push esi
call fcn.10054020
push eax
push esi
push 0x10001bf4
push ebx
call fcn.10021300
add esp, 0x1c
mov eax, 2
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100631a7
mov esp, ebp
pop ebp
ret
lea eax, [esi + 0x11c]
push eax
lea eax, [esi + 0xea]
push eax
push dword [ebp - 0x188]
lea eax, [ebp - 0x184]
push eax
call fcn.1001a890
add esp, 0x10
test al, al
jne 0x1001864c
call fcn.100648f7
mov esi, eax
call fcn.100648f7
mov edi, eax
lea eax, [ebp - 0x104]
push pe_nt_image_headers32
push eax
push dword [esi]
call fcn.10054020
push eax
push dword [edi]
push 0x10001c1c
push ebx
call fcn.10021300
add esp, 0x1c
mov eax, 2
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100631a7
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100631a7
mov esp, ebp
pop ebp
ret

Function at 0x100188a0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1007d820]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, dword [ebp + 0xc]
push 4
cmp byte [esi + 0x694], al
setne al
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 8
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x100188ed
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push 0x10001a20
jmp 0x10018954
push dword [esi + 0x630]
mov dword [ebp - 0x10], 1
call fcn.100605e0
push dword [esi + 0x634]
imul eax, eax, 0x3e8
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], eax
call fcn.100605e0
add esp, 8
imul eax, eax, 0x3e8
push 0
push 0
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0xc
lea eax, [ebp - 0x10]
push eax
push 0x98000004
push edi
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x1001895d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push 0x10001a50
push esi
call fcn.100213c0
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100631a7
mov esp, ebp
pop ebp
ret