joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Hash data with crc32

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push edi
push 0x10000
push 2
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
mov dword [0x404370], eax
call edi
push 0x8040
push 2
mov dword [0x40436c], eax
call esi
push eax
mov dword [0x4043a8], eax
call edi
push 0x400
push 2
mov dword [0x404398], eax
call esi
push eax
mov dword [0x404388], eax
call edi
mov dword [0x404374], eax
and dword [eax], 0
push 1
pop eax
push 8
mov ecx, eax
pop edx
test cl, 1
je 0x40106a
shr ecx, 1
xor ecx, 0xedb88320
jmp 0x40106c
shr ecx, 1
dec edx
jne 0x40105b
mov edx, dword [0x404374]
mov dword [edx + eax*4], ecx
inc eax
cmp eax, 0x100
jl 0x401056
pop edi
pop esi
ret

Function at 0x4020b6
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
jne 0x4020c8
or eax, 0xffffffff
mov dword [section..data], eax
jmp 0x402101
mov edx, dword [esp + 8]
mov eax, dword [section..data]
push esi
mov esi, edx
dec edx
test esi, esi
je 0x4020fb
push edi
inc edx
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
mov edi, dword [0x404374]
shr eax, 8
mov esi, dword [edi + esi*4]
xor eax, esi
inc ecx
dec edx
jne 0x4020db
pop edi
mov dword [section..data], eax
pop esi
not eax
ret 8
Function at 0x8f5b73
Capabilities:
Encode data using xor

Disassembly:
push esi
xor eax, eax
push edi
mov edi, dword [esp + 0x10]
shr edi, 2
mov ecx, edi
dec edi
test ecx, ecx
je 0x8f5ba1
mov edx, dword [esp + 0xc]
mov esi, dword [esp + 0x14]
mov ecx, esi
mov esi, dword [edx]
add eax, esi
xor ecx, esi
mov dword [edx], ecx
add edx, 4
mov ecx, edi
dec edi
test ecx, ecx
jne 0x8f5b8d
pop edi
pop esi
ret
Function at 0x8f620e
Capabilities:
Terminate process

Disassembly:
sub esp, 4
push ebx
push esi
push edi
push ebp
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp dword [0x8e83f0], 0
mov dword [esp + 0x10], eax
jne 0x8f63c8
mov eax, dword [0x8f3e58]
inc dword [0x8e83f0]
test eax, eax
je 0x8f6244
push eax
call fcn.008f5ab2
add esp, 4
cmp dword [esp + 0x1c], 0
je 0x8f63c8
mov esi, 0x8e8424
mov edx, 0x8f3d50
mov edi, edx
mov ebx, 0xffffffff
mov ecx, ebx
sub eax, eax
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov edi, dword [0x8e81ac]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebp, ecx
mov esi, edi
mov ecx, ebx
mov edi, edx
sub eax, eax
repne scasb al, byte es:[edi]
add edi, ebx
mov ecx, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 0x8e842c
mov edi, edx
mov ecx, ebx
sub eax, eax
repne scasb al, byte es:[edi]
add edi, ebx
mov ecx, ebx
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x1c]
mov edi, dword [eax*4 + 0x8e83a4]
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebp, ecx
mov esi, edi
mov ecx, ebx
mov edi, edx
sub eax, eax
repne scasb al, byte es:[edi]
add edi, ebx
mov ecx, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x18]
test edi, edi
je 0x8f6301
mov ecx, ebx
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebp, ecx
mov esi, edi
mov ecx, ebx
mov edi, edx
sub eax, eax
repne scasb al, byte es:[edi]
add edi, ebx
mov ecx, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [esp + 0x10], 0
je 0x8f6361
mov esi, 0x8e8430
mov ebx, 0x8f3d50
mov edi, ebx
mov ebp, 0xffffffff
mov ecx, ebp
sub eax, eax
repne scasb al, byte es:[edi]
add edi, ebp
push 0
push 0xc8
mov ecx, ebp
movsd dword es:[edi], dword [esi]
mov edi, ebx
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0x8f3d4f
mov edi, ebx
push ecx
push 0x400
push dword [esp + 0x20]
push 0
push 0x1000
call dword [sym.imp.KERNEL32.DLL_FormatMessageA]
mov ecx, ebp
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
mov byte [ecx + 0x8f3d4d], 0
push 0x8f3d50
mov esi, str.SHRINKER.ERR
push esi
call fcn.008f5cf7
add esp, 8
push 0x10
push 0x8e8434
push esi
call fcn.008f5abf
add esp, 0xc
mov ebx, eax
test ebx, ebx
je 0x8f63c8
mov eax, dword [esp + 0x1c]
cmp eax, 0xd
jl 0x8f6398
mov eax, 0xd
mov esi, 0x8e8438
mov edx, 0x8f3d50
mov edi, edx
mov ecx, 0xffffffff
mov dword [esp + 0x1c], eax
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
push ebx
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push edx
call fcn.008f5b3b
add esp, 8
push ebx
call fcn.008f5ab2
add esp, 4
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
Function at 0x8f681d
Capabilities:
Inspect section memory permissions

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [0x8f3f74]
imul eax, eax, 0x28
mov ecx, dword [eax + ecx + 0x24]
test ecx, 0x20000000
je 0x8f6858
test ecx, 0x40000000
je 0x8f6851
mov eax, ecx
and eax, 0x80000000
cmp eax, 1
sbb eax, eax
and al, 0xe0
add eax, 0x40
jmp 0x8f6869
mov eax, 0x10
jmp 0x8f6869
mov eax, ecx
and eax, 0x80000000
cmp eax, 1
sbb eax, eax
and al, 0xfe
add eax, 4
test ecx, 0x4000000
je 0x8f6876
add eax, 0x200
ret

Function at 0x8f7624
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
mov ebx, dword [esp + 0xc]
push edi
push ebp
mov ebp, dword [esp + 0x18]
test ebp, ebp
je 0x8f7651
cmp byte [ebp + ebx - 1], 0x5c
je 0x8f7654
mov esi, 0x8e94e8
mov edi, ebx
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
inc ebp
movsw word es:[edi], word [esi]
jmp 0x8f7654
mov byte [ebx], 0
push ebx
push 0
push 0x8e94ec
push ebx
call dword [sym.imp.KERNEL32.DLL_GetTempFileNameA]
test eax, eax
mov eax, 0
je 0x8f76a2
lea edi, [ebp + ebx]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
mov edi, str.SHRINK33.LDR
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0x10
and ecx, 3
push 0x8e94f0
rep movsb byte es:[edi], byte [esi]
push ebx
call fcn.008f5abf
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x8f76a7
Capabilities:
Delete file
Get common file path
Query environment variable

Disassembly:
push ebp
mov eax, 0x4220
mov ebp, esp
call fcn.008f7bd0
push esi
push edi
push 0
call fcn.008f75af
add esp, 4
mov dword [0x8e94c8], eax
cmp eax, 0xffffffff
jne 0x8f77db
mov edi, 0x104
lea eax, [ebp - 0x11c]
push edi
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
push eax
lea ecx, [ebp - 0x11c]
push ecx
call fcn.008f7624
add esp, 8
mov esi, eax
test esi, esi
jne 0x8f776d
push edi
lea eax, [ebp - 0x220]
push eax
lea edi, [ebp - 0x220]
push str.PATH
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
mov al, byte [edi]
test al, al
je 0x8f775a
xor ecx, ecx
inc edi
mov byte [ebp - 0x11c], al
cmp al, cl
je 0x8f773c
cmp byte [ebp + ecx - 0x11c], 0x3b
je 0x8f773c
inc ecx
mov al, byte [edi]
inc edi
mov byte [ebp + ecx - 0x11c], al
test al, al
jne 0x8f7723
push ecx
lea eax, [ebp - 0x11c]
mov byte [ebp + ecx - 0x11c], 0
push eax
call fcn.008f7624
add esp, 8
mov esi, eax
test esi, esi
je 0x8f7710
test esi, esi
jne 0x8f776d
push 0xc
push str.12345
call fcn.008f620e
add esp, 8
lea eax, [ebp - 0x4220]
push eax
push 0x8e84bc
call fcn.008f547c
add esp, 8
test eax, eax
jne 0x8f7791
push 2
push 0
call fcn.008f620e
add esp, 8
lea edi, [ebp - 0x41e0]
xor eax, eax
mov ecx, 0x10
rep stosd dword es:[edi], eax
push esi
mov eax, dword [0x8e84b8]
push eax
lea ecx, [ebp - 0x4220]
push ecx
call fcn.008f5b12
add esp, 0xc
push esi
call fcn.008f5ab2
add esp, 4
push 0
call fcn.008f75af
add esp, 4
lea ecx, [ebp - 0x11c]
mov dword [0x8e94c8], eax
push ecx
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
cmp dword [0x8e94c8], 0xffffffff
jne 0x8f77f0
push 0xc
push 0x8e9500
jmp 0x8f7878
xor esi, esi
lea eax, [ebp - 8]
push esi
lea ecx, [ebp - 0x18]
push eax
push 0x10
push ecx
push esi
push esi
push 1
push dword [0x8e94c8]
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
test eax, eax
je 0x8f7871
cmp dword [ebp - 0x18], 0x31e
jne 0x8f7868
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 8]
push ecx
mov dword [ebp - 0x10], edx
push 4
lea edx, [ebp - 4]
push edx
mov dword [ebp - 0xc], eax
push 0x10
lea eax, [ebp - 0x18]
push eax
push 2
push dword [0x8e94c8]
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
test eax, eax
je 0x8f785f
mov eax, dword [ebp - 4]
mov dword [0x8e94cc], eax
jmp 0x8f7880
push 0xc
push 0x8e9504
jmp 0x8f7878
push 0xc
push 0x8e9508
jmp 0x8f7878
push 0xc
push 0x8e950c
call fcn.008f620e
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100206e
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push dword [0x1024d00]
xor esi, esi
inc esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x18]
push eax
push dword [0x102a45c]
mov dword [0x100f7c8], esi
mov word [ebp - 0x18], 0x10
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
push 0xffffffffffffffff
push dword [0x1024d00]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x100f7cc]
pop esi
leave
ret
Function at 0x1003647
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
xor ebx, ebx
push edi
lea eax, [ebp - 0x28]
push eax
push dword [0x1024d0c]
mov word [ebp - 4], bx
mov word [ebp - 2], bx
mov word [ebp - 8], bx
mov word [ebp - 6], bx
mov word [ebp - 0x10], bx
mov word [ebp - 0xe], bx
mov word [ebp - 0xc], bx
mov word [ebp - 0xa], bx
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x1003750
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
sub esi, dword [ebp - 0x1c]
lea ecx, [eax - 1]
inc esi
mov word [ebp - 4], ax
mov word [ebp - 0xc], cx
movsx eax, ax
movsx ecx, si
imul eax, ecx
shl eax, 2
push eax
mov word [ebp - 0xa], si
mov word [ebp - 2], si
call dword [sym.imp.msvcrt.dll_malloc]
mov edi, eax
cmp edi, ebx
pop ecx
je 0x1003750
movsx eax, word [ebp - 0x26]
dec eax
jmp 0x100371a
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
push edi
push dword [0x1024d0c]
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputW]
test eax, eax
je 0x1003722
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
push edi
push dword [0x1024d10]
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputW]
mov ecx, dword [ebp - 0x26]
add word [ebp - 0xa], si
add word [ebp - 0xe], si
movsx edx, word [ebp - 0xa]
movsx eax, cx
dec eax
cmp edx, eax
jle 0x100371a
dec ecx
mov word [ebp - 0xa], cx
movsx ecx, word [ebp - 0xe]
cmp ecx, eax
jle 0x10036cc
push edi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
lea eax, [ebp - 0x1e]
push eax
push 1
push dword [0x1024d10]
call dword [sym.imp.KERNEL32.dll_SetConsoleWindowInfo]
push dword [ebp - 0x24]
push dword [0x1024d10]
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
xor eax, eax
inc eax
jmp 0x1003752
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1003a69
Capabilities:
Set socket configuration

Disassembly:
mov ecx, dword [esp + 4]
mov al, byte [ecx]
push esi
xor esi, esi
test al, al
mov edx, ecx
je 0x1003a95
cmp al, 0x2e
jne 0x1003a7d
inc esi
inc edx
mov al, byte [edx]
test al, al
jne 0x1003a78
cmp esi, 3
jne 0x1003a95
push ecx
call dword [sym.imp.WSOCK32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x1003a99
xor eax, eax
jmp 0x1003aa2
mov ecx, dword [esp + 0xc]
mov dword [ecx], eax
xor eax, eax
inc eax
pop esi
ret 8
Function at 0x1003b0c
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x18]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x1c]
and dword [edi], 0
push dword [ebp + 8]
mov byte [eax], 0
call dword [sym.imp.WSOCK32.dll_gethostbyname]
mov ebx, eax
test ebx, ebx
je 0x1003b86
cmp word [ebx + 8], 2
jne 0x1003b62
cmp word [ebx + 0xa], 4
jne 0x1003b62
mov esi, dword [ebx + 0xc]
jmp 0x1003b5c
push dword [eax]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.01003aa6
test eax, eax
mov dword [edi], eax
je 0x1003b81
lea edi, [eax + 0x1c]
add esi, 4
mov eax, dword [esi]
test eax, eax
jne 0x1003b40
mov esi, dword [ebp + 0x18]
push 0x400
push dword [ebx]
push esi
call dword [sym.imp.msvcrt.dll_strncpy]
add esp, 0xc
mov byte [esi + 0x400], 0
xor eax, eax
jmp 0x1003bac
push 8
pop eax
jmp 0x1003bac
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov ecx, eax
mov eax, 0x2af9
sub ecx, eax
je 0x1003bac
dec ecx
je 0x1003ba7
dec ecx
je 0x1003ba0
dec ecx
jmp 0x1003bac
mov eax, 0x2afb
jmp 0x1003bac
mov eax, 0x2afa
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
Function at 0x10041b2
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x1b0]
sub esp, 0x230
cmp dword [0x100fc78], 0
mov eax, dword [0x100f6ec]
mov dword [ebp + 0x1ac], eax
mov dword [ebp - 0x80], 0x1001d28
mov dword [ebp - 0x7c], 0x1003d6d
mov dword [ebp - 0x78], 0x1001d1c
mov dword [ebp - 0x74], 0x1003fe8
mov dword [ebp - 0x70], 0x1001d0c
mov dword [ebp - 0x6c], fcn.01003d31
jne 0x1004315
push 0x104
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x100430b
xor eax, eax
mov cl, byte [ebp + eax - 0x68]
mov byte [ebp + eax + 0xa0], cl
inc eax
test cl, cl
jne 0x100421b
push edi
lea edi, [ebp + 0xa0]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1004233
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
mov esi, 0x1001d04
movsd dword es:[edi], dword [esi]
lea eax, [ebp + 0xa0]
push eax
movsd dword es:[edi], dword [esi]
call ebx
mov esi, eax
test esi, esi
je 0x1004276
push 0x1001d28
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x1004272
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor esi, esi
test esi, esi
jne 0x10042ca
xor eax, eax
mov cl, byte [ebp + eax - 0x68]
mov byte [ebp + eax + 0xa0], cl
inc eax
test cl, cl
jne 0x1004278
lea edi, [ebp + 0xa0]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x100428f
mov esi, 0x1001cfc
movsd dword es:[edi], dword [esi]
lea eax, [ebp + 0xa0]
push eax
movsd dword es:[edi], dword [esi]
call ebx
mov esi, eax
test esi, esi
je 0x1004308
push 0x1001d28
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x10042c6
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor esi, esi
test esi, esi
je 0x1004308
xor edi, edi
push dword [ebp + edi*8 - 0x80]
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [ebp + edi*8 - 0x7c], eax
je 0x10042e7
inc edi
cmp edi, 3
jl 0x10042cc
jmp 0x10042f0
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor esi, esi
test esi, esi
je 0x1004308
xor eax, eax
mov ecx, dword [ebp + eax - 0x7c]
mov dword [eax + 0x100e844], ecx
add eax, 8
cmp eax, 0x18
jl 0x10042f6
pop esi
pop ebx
pop edi
mov dword [0x100fc78], 1
movzx eax, word [ebp + 0x1b8]
mov ecx, dword [ebp + 0x1ac]
mov eax, dword [eax*8 + 0x100e844]
call fcn.0100c260
add ebp, 0x1b0
leave
ret 4

Function at 0x10043e6
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
or edi, 0xffffffff
xor ebx, ebx
cmp dword [esi + 0x104], edi
je 0x100442a
push 0
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push dword [esi + 0x104]
call dword [sym.imp.WSOCK32.dll_send]
mov edi, eax
inc ebx
cmp edi, 0xffffffff
jne 0x100442a
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x100442a
cmp ebx, 5
jl 0x10043fa
mov eax, edi
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x1004478
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov cl, byte [ebp + 0xc]
push 0
mov byte [ebp + 0xb], cl
push 2
lea ecx, [ebp + 0xa]
push ecx
mov byte [ebp + 0xa], 0xff
push dword [eax + 0x104]
call dword [sym.imp.WSOCK32.dll_send]
pop ebp
ret 8
Function at 0x10051dd
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov esi, eax
mov eax, dword [esi + 0x510]
push ebx
mov ecx, 0x1000
sub ecx, eax
push ecx
mov ecx, dword [esi + 0x514]
add ecx, eax
push ecx
push dword [esi + 0x104]
call dword [sym.imp.WSOCK32.dll_recv]
mov edi, eax
cmp edi, ebx
jl 0x10052d4
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
add edi, dword [esi + 0x510]
mov eax, dword [esi + 0x514]
mov dword [esi + 0x510], ebx
mov ebx, dword [esi + 0x528]
mov dword [ebp - 4], 0
je 0x10052d4
mov cl, byte [eax]
dec edi
cmp cl, 0xff
mov dword [ebp - 8], edi
jne 0x100528d
test edi, edi
je 0x100529a
inc eax
cmp byte [eax], cl
mov dword [ebp - 0xc], eax
jne 0x100526c
inc eax
mov byte [ebx], cl
inc ebx
dec edi
jmp 0x1005291
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.01005071
mov edi, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
jmp 0x1005294
mov byte [ebx], cl
inc ebx
inc eax
inc dword [ebp - 4]
test edi, edi
jne 0x100524e
jmp 0x10052ad
mov eax, dword [esi + 0x514]
mov byte [eax], 0xff
mov dword [esi + 0x510], 1
cmp dword [ebp - 4], 0
je 0x10052d4
cmp dword [0x100f744], 0
je 0x10052c5
cmp dword [0x100f754], 0
je 0x10052d4
push esi
push dword [esi + 0x528]
push dword [ebp - 4]
call fcn.01005145
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x10052db
Capabilities:
Receive data
Receive data on socket

Disassembly:
push esi
push 0
push dword [esp + 0xc]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push 1
push 0x1000
lea esi, [eax + 0x514]
push dword [esi]
push dword [eax + 0x104]
call dword [sym.imp.WSOCK32.dll_recv]
test eax, eax
jl 0x1005314
mov eax, dword [esi]
cmp byte [eax], 0xf2
jne 0x1005314
pop esi
jmp fcn.01004502
pop esi
ret 4
Function at 0x1005318
Capabilities:
Connect socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x188
mov eax, dword [0x100f6ec]
and dword [0x100f7e4], 0
push ebx
mov dword [ebp - 4], eax
mov eax, dword [0x100f7e0]
test eax, eax
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x188], 1
je 0x10054d1
push eax
push 0x1001d50
lea eax, [ebp - 0x184]
push 0xff
push eax
call dword [sym.imp.msvcrt.dll__snprintf]
push 0x100
push dword [ebp + 0xc]
push esi
call dword [sym.imp.msvcrt.dll_strncpy]
add esp, 0x1c
lea ebx, [esi + 0x50c]
push ebx
push 0
lea eax, [ebp - 0x184]
push eax
push dword [ebp + 0xc]
call fcn.01004338
test eax, eax
jne 0x10054d1
mov eax, dword [0x100f740]
mov edi, dword [ebx]
and eax, 0x10
and dword [0x100f740], 0xffffffef
mov dword [0x100f754], 1
mov dword [0x100f758], eax
jmp 0x1005499
push 0
push 1
push dword [edi + 4]
call dword [sym.imp.WSOCK32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 0x104], eax
je 0x1005496
push 0x80
lea eax, [ebp - 0x84]
push eax
call fcn.01002054
mov ax, word [edi + 4]
mov word [ebp - 0x84], ax
push 0x80
lea eax, [ebp - 0x84]
push eax
push dword [esi + 0x104]
call dword [sym.imp.WSOCK32.dll_bind]
test eax, eax
jl 0x1005483
xor eax, eax
inc eax
push 4
mov dword [ebp - 0x188], eax
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
push 0xffffff7f
push 0xffff
push dword [esi + 0x104]
call dword [sym.imp.WSOCK32.dll_setsockopt]
push 4
lea eax, [ebp - 0x188]
push eax
push 0x100
push 0xffff
push dword [esi + 0x104]
call dword [sym.imp.WSOCK32.dll_setsockopt]
test eax, eax
jl 0x10054e2
push dword [esi + 0x104]
call fcn.0100a8a3
test eax, eax
jl 0x10054e2
push dword [edi + 0x10]
push dword [edi + 0x18]
push dword [esi + 0x104]
call dword [sym.imp.WSOCK32.dll_connect]
test eax, eax
jge 0x10054a1
push dword [esi + 0x104]
call dword [sym.imp.WSOCK32.dll_closesocket]
or dword [esi + 0x104], 0xffffffff
mov edi, dword [edi + 0x1c]
test edi, edi
jne 0x10053bb
push dword [ebx]
call fcn.0100436e
and dword [ebx], 0
test edi, edi
jne 0x100550c
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
add esi, 0x104
mov dword [0x100f7e4], eax
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x10054ce
push eax
call dword [sym.imp.WSOCK32.dll_closesocket]
or dword [esi], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0100c260
leave
ret 8
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov dword [0x100f7e4], eax
push dword [esi + 0x104]
call dword [sym.imp.WSOCK32.dll_closesocket]
push dword [ebx]
or dword [esi + 0x104], 0xffffffff
call fcn.0100436e
and dword [ebx], 0
jmp 0x10054d1
mov eax, dword [ebp + 8]
push 0x27
xor edi, edi
push 0x5f4
inc edi
mov dword [esi + 0x100], edi
push dword [eax + 0x7b0]
push dword [esi + 0x104]
call dword [sym.imp.WSOCK32.dll_WSAAsyncSelect]
test eax, eax
jge 0x100555f
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov dword [0x100f7e4], eax
push dword [esi + 0x104]
call dword [sym.imp.WSOCK32.dll_closesocket]
or dword [esi + 0x104], 0xffffffff
or dword [esi + 0x100], 0xffffffff
jmp 0x10054d1
mov eax, edi
jmp 0x10054d3
Function at 0x1005cb3
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movsx eax, word [ebp + 0xe]
push ebx
xor ebx, ebx
cmp eax, ebx
mov dword [ebp - 0xc], ebx
jle 0x1005dcd
push esi
push edi
xor ecx, ecx
movsx eax, word [ebp + 0xc]
cmp eax, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
jle 0x1005d65
imul eax, ecx
mov dword [ebp - 0x14], eax
jmp 0x1005cef
mov eax, dword [ebp - 0x14]
movzx ecx, word [ebp - 4]
push ebx
push ebx
push ebx
add ecx, eax
mov eax, dword [ebp + 8]
push ebx
push 1
lea edi, [eax + ecx*4]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movzx esi, word [ebp - 8]
push ebx
push ebx
push eax
mov dword [ebp - 0x18], eax
mov eax, dword [0x100f7dc]
add eax, esi
push eax
push 1
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x1005d47
mov al, byte [edi]
mov ecx, dword [0x100f7dc]
inc dword [ebp - 8]
mov byte [esi + ecx], al
jmp 0x1005d56
mov eax, dword [ebp - 0x18]
add dword [ebp - 8], eax
test byte [edi + 3], 1
je 0x1005d56
inc dword [ebp - 4]
inc dword [ebp - 4]
movzx ecx, word [ebp - 4]
movsx eax, word [ebp + 0xc]
cmp ecx, eax
jl 0x1005cec
movsx ecx, word [ebp + 0xc]
mov eax, dword [0x100f7dc]
lea ecx, [ecx + eax - 1]
jmp 0x1005d7a
cmp byte [ecx], 0x20
jne 0x1005d7e
dec ecx
cmp ecx, eax
jne 0x1005d74
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
lea edx, [ebp - 0x10]
push edx
sub ecx, eax
inc ecx
push ecx
push eax
push dword [0x100f748]
call esi
mov edi, 0x100f6e8
mov eax, edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x1005da0
push ebx
sub eax, ecx
lea ecx, [ebp - 0x10]
push ecx
push eax
push edi
push dword [0x100f748]
call esi
inc dword [ebp - 0xc]
movzx ecx, word [ebp - 0xc]
movsx eax, word [ebp + 0xe]
cmp ecx, eax
jl 0x1005ccf
pop edi
pop esi
pop ebx
leave
ret 8