joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000305a
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push 0xffffffffffffffff
pop dword [ebp - 4]
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x20c], 0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x108]
shl ecx, 2
mov dword ss:[ecx + ebp - 0x104], eax
inc dword [ebp - 0x108]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x20c]
shl ecx, 2
mov dword ss:[ecx + ebp - 0x208], eax
inc dword [ebp - 0x20c]
push dword [ebp + 0x18]
pop dword [ebp - 0x214]
push 0
pop dword [ebp - 0x210]
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
lea eax, [ebp - 0x108]
push eax
push 0
call sub.ws2_32.dll_select
or eax, eax
je 0x10003122
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 8]
call sub.ws2_32.dll___WSAFDIsSet
or eax, eax
je 0x1000310a
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.ws2_32.dll_recv
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 8]
call sub.ws2_32.dll___WSAFDIsSet
or eax, eax
je 0x10003122
push 0xffffffffffffffff
pop dword [ebp - 4]
mov eax, dword [ebp - 4]
leave
ret 0x14

Function at 0x10003129
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push 0xffffffffffffffff
pop dword [ebp - 4]
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x20c], 0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x108]
shl ecx, 2
mov dword ss:[ecx + ebp - 0x104], eax
inc dword [ebp - 0x108]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x20c]
shl ecx, 2
mov dword ss:[ecx + ebp - 0x208], eax
inc dword [ebp - 0x20c]
push dword [ebp + 0x18]
pop dword [ebp - 0x214]
push 0
pop dword [ebp - 0x210]
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
push 0
push 0
call sub.ws2_32.dll_select
or eax, eax
je 0x100031f1
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 8]
call sub.ws2_32.dll___WSAFDIsSet
or eax, eax
je 0x100031d9
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.ws2_32.dll_send
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 8]
call sub.ws2_32.dll___WSAFDIsSet
or eax, eax
je 0x100031f1
push 0xffffffffffffffff
pop dword [ebp - 4]
mov eax, dword [ebp - 4]
leave
ret 0x14
Function at 0x100031f8
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push 0xffffffffffffffff
pop dword [ebp - 4]
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x20c], 0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x108]
shl ecx, 2
mov dword ss:[ecx + ebp - 0x104], eax
inc dword [ebp - 0x108]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x20c]
shl ecx, 2
mov dword ss:[ecx + ebp - 0x208], eax
inc dword [ebp - 0x20c]
cmp dword [ebp + 0xc], 0
jne 0x1000326f
push 0
lea eax, [ebp - 0x20c]
push eax
push 0
lea eax, [ebp - 0x108]
push eax
push 0
call sub.ws2_32.dll_select
jmp 0x1000329e
push dword [ebp + 0xc]
pop dword [ebp - 0x214]
push 0
pop dword [ebp - 0x210]
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
lea eax, [ebp - 0x108]
push eax
push 0
call sub.ws2_32.dll_select
or eax, eax
je 0x100032d4
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 8]
call sub.ws2_32.dll___WSAFDIsSet
or eax, eax
je 0x100032ba
push 1
pop dword [ebp - 4]
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 8]
call sub.ws2_32.dll___WSAFDIsSet
or eax, eax
je 0x100032d9
push 0xffffffffffffffff
pop dword [ebp - 4]
jmp 0x100032d9
push 2
pop dword [ebp - 4]
mov eax, dword [ebp - 4]
leave
ret 8
Function at 0x100033f9
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd0
push ebx
push edx
push ecx
push edi
push esi
mov al, 0
mov byte [ebp - 0x21], al
push 0
pop dword [ebp - 0x42c]
push 0
pop dword [ebp - 0x428]
push 0
pop dword [ebp - 0x430]
cmp dword [ebp + 8], 0
je 0x10003587
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 8]
call fcn.100032e0
or eax, eax
je 0x10003587
mov dword [ebp - 4], eax
lea eax, [ebp - 0x21]
cmp dword [ebp - 8], 0
jne 0x1000345b
mov dword [ebp - 8], eax
cmp dword [ebp - 0xc], 0
jne 0x10003464
mov dword [ebp - 0xc], eax
push dword [ebp - 8]
call sub.kernel32.dll_lstrlenA
add eax, 0x148
mov dword [ebp - 0x20], eax
push dword [ebp - 0xc]
call sub.kernel32.dll_lstrlenA
add eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
push dword [ebp - 0x20]
push 0x40
call sub.kernel32.dll_GlobalAlloc
or eax, eax
je 0x1000357f
mov dword [ebp - 0x1c], eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push 0x1000a36b
push dword [ebp - 0x1c]
call sub.user32.dll_wsprintfA
add esp, 0x10
push dword [ebp - 0x1c]
call fcn.10001a3e
mov dword [ebp - 0x20], eax
push dword [ebp - 0x10]
push dword [ebp - 8]
call fcn.10002d66
cmp eax, 0xffffffff
je 0x10003577
mov dword [ebp - 0x14], eax
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push dword [ebp - 0x14]
call fcn.10002e2d
cmp eax, dword [ebp - 0x20]
jne 0x1000356e
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x18], eax
push dword [ebp + 0xc]
push 0
push 0x400
lea eax, [ebp - 0x421]
push eax
push dword [ebp - 0x14]
call fcn.1000305a
or eax, eax
je 0x10003511
cmp eax, 0xffffffff
jne 0x10003513
jmp 0x10003528
add dword [ebp - 0x42c], eax
call sub.kernel32.dll_GetTickCount
sub eax, dword [ebp - 0x18]
cmp eax, dword [ebp + 0xc]
jae 0x10003528
jmp 0x100034ef
call sub.kernel32.dll_GetTickCount
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 0
je 0x1000356e
mov eax, dword [ebp - 0x42c]
shr eax, 0xa
mov edx, 0x3e8
mul edx
xor edx, edx
div dword [ebp - 0x428]
mov dword [ebp - 0x430], eax
mov eax, edx
mov edx, 0x64
mul edx
xor edx, edx
div dword [ebp - 0x428]
lea eax, [ebp - 0x14]
push eax
call fcn.10002ecb
push dword [ebp - 0x1c]
call sub.kernel32.dll_GlobalFree
push dword [ebp - 4]
call sub.kernel32.dll_GlobalFree
mov eax, dword [ebp - 0x430]
pop esi
pop edi
pop ecx
pop edx
pop ebx
leave
ret 8
Function at 0x1000402e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push 0
push dword [ebp + 8]
call fcn.100031f8
cmp eax, 2
je 0x10004034
push 0
pop dword [ebp - 4]
push 0
pop dword [ebp - 8]
cmp eax, 1
jne 0x10004132
push dword [ebp + 8]
call fcn.10003878
cmp ebx, 0
jbe 0x10004132
push eax
push ebx
push eax
lea eax, [ebp - 4]
push eax
call fcn.1000224b
call sub.kernel32.dll_GlobalFree
push 0
pop dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
call fcn.10003776
cmp al, byte [0x1000a4b4]
jne 0x100040c7
mov al, byte [0x1000a4b5]
push eax
lea eax, [ebp - 8]
push eax
call fcn.100036cc
lea eax, [ebp - 8]
push eax
call fcn.1000232b
push eax
push edx
push dword [ebp + 8]
call fcn.1000382d
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
call fcn.1000381e
lea eax, [ebp - 4]
push eax
call fcn.100027d4
jmp 0x10004126
cmp al, byte [0x1000a4b8]
jne 0x1000411d
mov al, byte [0x1000a4b3]
push eax
lea eax, [ebp - 8]
push eax
call fcn.100036cc
lea eax, [ebp - 8]
push eax
call fcn.1000232b
push eax
push edx
push dword [ebp + 8]
call fcn.1000382d
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
call fcn.1000381e
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push 0
push dword [ebp - 4]
push 0x100057ae
push 0
push 0
call sub.kernel32.dll_CreateThread
jmp 0x10004126
lea eax, [ebp - 4]
push eax
call fcn.100027d4
mov eax, dword [ebp - 0xc]
cmp eax, 0
jne 0x10004034
leave
ret 4
Function at 0x10004c82
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffeecc
push 0
pop dword [ebp - 0x1c]
push 0
pop dword [ebp - 0x18]
push dword [ebp + 8]
call fcn.10004bcc
mov dword [ebp - 4], eax
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], edx
cmp dword [ebp - 4], 0
je 0x10004cb2
cmp dword [ebp - 8], 0
jne 0x10004cb7
jmp 0x10004e99
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10004b39
or eax, eax
je 0x10004cda
push 0
push 0
push 0x5d
push dword [ebp + 8]
call fcn.10004c40
jne 0x10004eab
cmp dword [ebp - 0xc], 1
jne 0x10004d0d
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.10004f19
cmp eax, 0xffffffff
je 0x10004e99
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
call fcn.10002f15
push ebx
push eax
push 0x5a
push dword [ebp + 8]
call fcn.10004c40
jmp 0x10004d84
cmp dword [ebp - 0xc], 2
jne 0x10004d7f
push 0
call fcn.10004eaf
cmp eax, 0xffffffff
je 0x10004e99
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x1c]
call fcn.10002f3d
push ebx
push dword [ebp + 8]
call fcn.10002f3d
pop ebx
push ebx
push eax
push 0x5a
push dword [ebp + 8]
call fcn.10004c40
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x1c]
call sub.ws2_32.dll_accept
cmp eax, 0xffffffff
jne 0x10004d67
lea eax, [ebp - 0x1c]
push eax
call fcn.10002ecb
jmp 0x10004e99
mov dword [ebp - 0x18], eax
push 0
push word [ebp - 0x2a]
push dword [ebp - 0x28]
push 0x5a
push dword [ebp + 8]
call fcn.10004c40
jmp 0x10004d84
jmp 0x10004e99
mov dword [ebp - 0x134], 0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x134]
shl ecx, 2
mov dword ss:[ecx + ebp - 0x130], eax
inc dword [ebp - 0x134]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x134]
shl ecx, 2
mov dword ss:[ecx + ebp - 0x130], eax
inc dword [ebp - 0x134]
push 0
push 0
push 0
lea eax, [ebp - 0x134]
push eax
push 0
call sub.ws2_32.dll_select
cmp eax, 0
ja 0x10004de0
jmp 0x10004e7d
lea eax, [ebp - 0x134]
push eax
push dword [ebp + 8]
call sub.ws2_32.dll___WSAFDIsSet
or eax, eax
je 0x10004e2c
push dword [0x1000a35e]
push 0
push 0x1000
lea eax, [ebp - 0x1134]
push eax
push dword [ebp + 8]
call fcn.1000305a
or eax, eax
je 0x10004e2a
cmp eax, 0xffffffff
je 0x10004e2a
push eax
lea eax, [ebp - 0x1134]
push eax
push dword [ebp - 0x18]
call fcn.10002e2d
jmp 0x10004e2c
jmp 0x10004e7d
lea eax, [ebp - 0x134]
push eax
push dword [ebp - 0x18]
call sub.ws2_32.dll___WSAFDIsSet
or eax, eax
je 0x10004e78
push dword [0x1000a35e]
push 0
push 0x1000
lea eax, [ebp - 0x1134]
push eax
push dword [ebp - 0x18]
call fcn.1000305a
or eax, eax
je 0x10004e76
cmp eax, 0xffffffff
je 0x10004e76
push eax
lea eax, [ebp - 0x1134]
push eax
push dword [ebp + 8]
call fcn.10002e2d
jmp 0x10004e78
jmp 0x10004e7d
jmp 0x10004d84
lea eax, [ebp - 0x18]
push eax
call fcn.10002ecb
cmp dword [ebp - 0x1c], 0
je 0x10004e95
lea eax, [ebp - 0x1c]
push eax
call fcn.10002ecb
leave
ret 8
push 0
push 0
push 0x5b
push dword [ebp + 8]
call fcn.10004c40
leave
ret 8
leave
ret 8
Function at 0x10004eaf
Capabilities:
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push 6
push 1
push 2
call sub.ws2_32.dll_socket
cmp eax, 0xffffffff
je 0x10004efd
mov dword [ebp - 4], eax
mov word [ebp - 0x14], 2
push dword [ebp + 8]
call sub.ws2_32.dll_htons
mov word [ebp - 0x12], ax
mov dword [ebp - 0x10], 0
push 0x10
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call sub.ws2_32.dll_bind
test eax, eax
jne 0x10004f04
push 5
push dword [ebp - 4]
call sub.ws2_32.dll_listen
mov eax, dword [ebp - 4]
leave
ret 4
push dword [ebp - 4]
call sub.ws2_32.dll_closesocket
mov eax, 0xffffffff
leave
ret 4

Function at 0x10004f19
Capabilities:
Create tcp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push 0xffffffffffffffff
pop dword [ebp - 0x14]
push 6
push 1
push 2
call sub.ws2_32.dll_socket
cmp eax, 0xffffffff
je 0x10004f95
mov dword [ebp - 0x14], eax
push 1
pop dword [ebp - 0x18]
lea eax, [ebp - 0x18]
push eax
push 0x8004667e
push dword [ebp - 0x14]
call sub.ws2_32.dll_ioctlsocket
push 0x10
lea eax, [ebp - 0x10]
push eax
call fcn.10001940
mov word [ebp - 0x10], 2
mov eax, dword [ebp + 0xc]
mov word [ebp - 0xe], ax
push dword [ebp + 8]
pop dword [ebp - 0xc]
push dword [0x1000a35a]
push 0x10
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
call fcn.10002f65
cmp eax, 0xffffffff
jne 0x10004f95
push dword [ebp - 0x14]
call sub.ws2_32.dll_closesocket
mov eax, 0xffffffff
leave
ret 8
mov eax, dword [ebp - 0x14]
leave
ret 8
Function at 0x100051b7
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffebc
push 0
pop dword [ebp - 4]
push 0
pop dword [ebp - 8]
push 0
pop dword [ebp - 0xc]
push 5
pop dword [ebp - 0x10]
push 4
lea eax, [ebp - 0x144]
push eax
push dword [ebp + 8]
call fcn.10002e7b
cmp eax, 4
jne 0x1000530b
cmp byte [ebp - 0x144], 5
jne 0x1000530b
movzx eax, byte [ebp - 0x143]
mov dword [ebp - 4], eax
movzx eax, byte [ebp - 0x141]
cmp eax, 1
jne 0x10005239
push 4
lea eax, [ebp - 0x144]
push eax
push dword [ebp + 8]
call fcn.10002e7b
cmp eax, 4
jne 0x1000530b
mov eax, dword [ebp - 0x144]
mov dword [ebp - 8], eax
jmp 0x100052d4
cmp eax, 3
jne 0x100052c9
push 1
lea eax, [ebp - 0x144]
push eax
push dword [ebp + 8]
call fcn.10002e7b
cmp eax, 1
jne 0x1000530b
movzx eax, byte [ebp - 0x144]
cmp eax, 0
je 0x1000530b
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
lea eax, [ebp - 0x144]
push eax
push dword [ebp + 8]
call fcn.10002e7b
cmp eax, dword [ebp - 0x18]
jne 0x1000530b
push dword [ebp - 0x18]
lea eax, [ebp - 0x144]
push eax
call fcn.1000197d
cmp eax, 0
je 0x1000530b
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
call sub.ws2_32.dll_gethostbyname
push eax
push dword [ebp - 0x14]
call sub.kernel32.dll_GlobalFree
pop eax
cmp eax, 0
je 0x10005306
mov eax, dword [eax + 0xc]
cmp eax, 0
je 0x1000530b
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x100052d4
cmp eax, 4
jne 0x100052d2
jmp 0x1000530b
jmp 0x1000530b
push 2
lea eax, [ebp - 0x144]
push eax
push dword [ebp + 8]
call fcn.10002e7b
cmp eax, 2
jne 0x1000530b
movzx eax, word [ebp - 0x144]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov ecx, 0
leave
ret 4
push 4
pop dword [ebp - 0x10]
mov eax, 0
mov ebx, 0
mov edx, 0
mov ecx, dword [ebp - 0x10]
leave
ret 4
Function at 0x1000536b
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffeec8
push 0
pop dword [ebp - 0x20]
push 0
pop dword [ebp - 0x1c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.100050d4
cmp eax, 0
jne 0x100055c3
push dword [ebp + 8]
call fcn.100051b7
mov dword [ebp - 4], eax
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 4], 0
je 0x100053bb
cmp dword [ebp - 8], 0
je 0x100053bb
cmp dword [ebp - 0xc], 0
jne 0x100053cf
push 0
push 0
push dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.10005321
jmp 0x100055c3
cmp dword [ebp - 0xc], 1
jne 0x10005405
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.10005631
cmp eax, 0xffffffff
je 0x1000559f
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x1c]
call fcn.10002f15
push ebx
push eax
push 0
push dword [ebp + 8]
call fcn.10005321
jmp 0x1000548a
cmp dword [ebp - 0xc], 2
jne 0x10005477
push 0
call fcn.100055c7
cmp eax, 0xffffffff
je 0x100055b1
mov dword [ebp - 0x20], eax
push dword [ebp - 0x20]
call fcn.10002f3d
push ebx
push dword [ebp + 8]
call fcn.10002f3d
pop ebx
push ebx
push eax
push 0
push dword [ebp + 8]
call fcn.10005321
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x20]
call sub.ws2_32.dll_accept
cmp eax, 0xffffffff
jne 0x1000545f
lea eax, [ebp - 0x20]
push eax
call fcn.10002ecb
jmp 0x100055b1
mov dword [ebp - 0x1c], eax
push 0
push word [ebp - 0x2e]
push dword [ebp - 0x2c]
push 0
push dword [ebp + 8]
call fcn.10005321
jmp 0x1000548a
push 0
push 0
push 7
push dword [ebp + 8]
call fcn.10005321
jmp 0x100055c3
mov dword [ebp - 0x138], 0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x138]
shl ecx, 2
mov dword ss:[ecx + ebp - 0x134], eax
inc dword [ebp - 0x138]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x138]
shl ecx, 2
mov dword ss:[ecx + ebp - 0x134], eax
inc dword [ebp - 0x138]
push 0
push 0
push 0
lea eax, [ebp - 0x138]
push eax
push 0
call sub.ws2_32.dll_select
cmp eax, 0
ja 0x100054e6
jmp 0x10005583
lea eax, [ebp - 0x138]
push eax
push dword [ebp + 8]
call sub.ws2_32.dll___WSAFDIsSet
or eax, eax
je 0x10005532
push dword [0x1000a35e]
push 0
push 0x1000
lea eax, [ebp - 0x1138]
push eax
push dword [ebp + 8]
call fcn.1000305a
or eax, eax
je 0x10005530
cmp eax, 0xffffffff
je 0x10005530
push eax
lea eax, [ebp - 0x1138]
push eax
push dword [ebp - 0x1c]
call fcn.10002e2d
jmp 0x10005532
jmp 0x10005583
lea eax, [ebp - 0x138]
push eax
push dword [ebp - 0x1c]
call sub.ws2_32.dll___WSAFDIsSet
or eax, eax
je 0x1000557e
push dword [0x1000a35e]
push 0
push 0x1000
lea eax, [ebp - 0x1138]
push eax
push dword [ebp - 0x1c]
call fcn.1000305a
or eax, eax
je 0x1000557c
cmp eax, 0xffffffff
je 0x1000557c
push eax
lea eax, [ebp - 0x1138]
push eax
push dword [ebp + 8]
call fcn.10002e2d
jmp 0x1000557e
jmp 0x10005583
jmp 0x1000548a
lea eax, [ebp - 0x1c]
push eax
call fcn.10002ecb
cmp dword [ebp - 0x20], 0
je 0x1000559b
lea eax, [ebp - 0x20]
push eax
call fcn.10002ecb
leave
ret 0xc
push 0
push 0
push 4
push dword [ebp + 8]
call fcn.10005321
leave
ret 0xc
push 0
push 0
push 4
push dword [ebp + 8]
call fcn.10005321
leave
ret 0xc
leave
ret 0xc
Function at 0x100055c7
Capabilities:
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push 6
push 1
push 2
call sub.ws2_32.dll_socket
cmp eax, 0xffffffff
je 0x10005615
mov dword [ebp - 4], eax
mov word [ebp - 0x14], 2
push dword [ebp + 8]
call sub.ws2_32.dll_htons
mov word [ebp - 0x12], ax
mov dword [ebp - 0x10], 0
push 0x10
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call sub.ws2_32.dll_bind
test eax, eax
jne 0x1000561c
push 5
push dword [ebp - 4]
call sub.ws2_32.dll_listen
mov eax, dword [ebp - 4]
leave
ret 4
push dword [ebp - 4]
call sub.ws2_32.dll_closesocket
mov eax, 0xffffffff
leave
ret 4

Function at 0x10005631
Capabilities:
Create tcp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push 0xffffffffffffffff
pop dword [ebp - 0x14]
push 6
push 1
push 2
call sub.ws2_32.dll_socket
cmp eax, 0xffffffff
je 0x100056ad
mov dword [ebp - 0x14], eax
push 1
pop dword [ebp - 0x18]
lea eax, [ebp - 0x18]
push eax
push 0x8004667e
push dword [ebp - 0x14]
call sub.ws2_32.dll_ioctlsocket
push 0x10
lea eax, [ebp - 0x10]
push eax
call fcn.10001940
mov word [ebp - 0x10], 2
mov eax, dword [ebp + 0xc]
mov word [ebp - 0xe], ax
push dword [ebp + 8]
pop dword [ebp - 0xc]
push dword [0x1000a35a]
push 0x10
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
call fcn.10002f65
cmp eax, 0xffffffff
jne 0x100056ad
push dword [ebp - 0x14]
call sub.ws2_32.dll_closesocket
mov eax, 0xffffffff
leave
ret 8
mov eax, dword [ebp - 0x14]
leave
ret 8

Function at 0x10005de8
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
mov edi, dword [ebp + 8]
push 0x40
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.100059e5
cmp eax, 1
jne 0x10005e54
cmp word [edi], 0x5a4d
jne 0x10005e54
add edi, dword [edi + 0x3c]
push 0xf8
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.100059e5
cmp eax, 1
jne 0x10005e54
cmp dword [edi], 0x4550
jne 0x10005e54
cmp word [edi + 4], 0x14c
jne 0x10005e54
cmp word [edi + 0x18], 0x10b
jne 0x10005e54
cmp dword [edi + 0xe8], 0
jne 0x10005e54
cmp dword [edi + 0x98], 0
jne 0x10005e54
mov eax, 1
jmp 0x10005e59
mov eax, 0
pop ebx
pop edi
leave
ret 8

Function at 0x100061d6
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbec
push esi
push 0
pop dword [ebp - 4]
push dword [ebp + 8]
lea eax, [ebp - 0x404]
push eax
call sub.kernel32.dll_lstrcpyA
lea eax, [ebp - 0x404]
push eax
call fcn.100061ad
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x404]
push eax
call sub.kernel32.dll_GetDiskFreeSpaceExA
or eax, eax
je 0x10006242
mov edx, dword [ebp - 0x410]
mov eax, dword [ebp - 0x414]
or edx, edx
jne 0x1000623d
cmp eax, dword [0x1000b04e]
jb 0x10006242
push 1
pop dword [ebp - 4]
mov eax, dword [ebp - 4]
pop esi
leave
ret 4
Function at 0x10006377
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffab8
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x546]
push eax
call sub.kernel32.dll_lstrcpyA
lea eax, [ebp - 0x546]
push eax
call fcn.100061ad
lea eax, [ebp - 0x546]
push eax
call sub.kernel32.dll_lstrlenA
mov dword [ebp - 8], eax
push 0x1000a828
lea eax, [ebp - 0x546]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [ebp - 0x146]
push eax
lea eax, [ebp - 0x546]
push eax
call sub.kernel32.dll_FindFirstFileA
cmp eax, 0xffffffff
je 0x1000647d
mov dword [ebp - 4], eax
push 2
call sub.kernel32.dll_Sleep
lea eax, [ebp - 0x11a]
push eax
call fcn.10006283
or eax, eax
jne 0x1000645d
lea esi, [ebp - 0x546]
add esi, dword [ebp - 8]
mov al, 0
mov byte [esi], 0
lea eax, [ebp - 0x11a]
push eax
lea eax, [ebp - 0x546]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [ebp - 0x146]
and eax, 0x10
cmp eax, 0x10
jne 0x1000644e
lea eax, [ebp - 0x546]
push eax
call fcn.100061ad
lea eax, [ebp - 0x546]
push eax
call fcn.1000624a
or eax, eax
jne 0x1000645d
push dword [ebp + 0xc]
lea eax, [ebp - 0x546]
push eax
call fcn.10006377
jmp 0x1000645d
push dword [ebp + 0xc]
lea eax, [ebp - 0x546]
push eax
call fcn.1000630c
lea eax, [ebp - 0x146]
push eax
push dword [ebp - 4]
call sub.kernel32.dll_FindNextFileA
cmp eax, 0
jne 0x100063db
push dword [ebp - 4]
call sub.kernel32.dll_FindClose
pop esi
leave
ret 8

Function at 0x10006482
Capabilities:
Get common file path

Disassembly:
push 0x400
push str.C:WINDOWS_system32_
call sub.kernel32.dll_GetSystemDirectoryA
push 0x400
push str.C:WINDOWS_
call sub.kernel32.dll_GetWindowsDirectoryA
push str.C:WINDOWS_system32_
call sub.kernel32.dll_lstrlenA
lea esi, str.C:WINDOWS_system32_
add esi, eax
mov bl, 0
mov byte [esi], bl
push str.C:WINDOWS_
call sub.kernel32.dll_lstrlenA
lea esi, str.C:WINDOWS_
add esi, eax
mov bl, 0
mov byte [esi], bl
push str.C:WINDOWS_system32_
call fcn.100061ad
push str.C:WINDOWS_
call fcn.100061ad
ret

Function at 0x100064e1
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push esi
call fcn.10006482
lea eax, [ebp - 0x200]
push eax
push 0x200
call sub.kernel32.dll_GetLogicalDriveStringsA
lea esi, [ebp - 0x200]
cmp byte [esi], 0
je 0x1000653b
push esi
call fcn.100061d6
cmp eax, 1
jne 0x10006530
push esi
push esi
call sub.kernel32.dll_GetDriveTypeA
pop esi
cmp eax, 3
je 0x10006529
cmp eax, 2
jne 0x10006530
push esi
push esi
call fcn.10006377
push esi
call fcn.10001a3e
add esi, eax
inc esi
jmp 0x10006507
pop esi
leave
ret