joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100577b8
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x18]
push ebp
mov ebp, dword [edx + 0x1050]
push edi
mov edi, dword [edx + 0x105c]
imul edi, ebp
mov dword [esp + 0xc], eax
mov eax, dword [edx + 0x18]
add edi, eax
cmp eax, edi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], edi
jae 0x100578fc
push ebx
push esi
mov esi, 0xff00
mov ebx, dword [esp + 0x14]
mov edx, dword [edx + 0x1058]
lea edx, [eax + edx*2]
mov dword [esp + 0x10], ebx
add ebp, eax
cmp eax, edx
mov ebx, eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x28], edx
jae 0x100578d6
movzx edx, word [ebx]
movzx edi, word [ebx + 2]
movzx eax, word [ebp + 2]
movzx ebp, word [ebp]
mov dword [esp + 0x18], edx
mov ebx, eax
mov ecx, 0xff
and bx, cx
and dx, cx
add ebx, edx
mov edx, ebp
and dx, cx
add ebx, edx
mov edx, edi
and dx, cx
mov ecx, eax
and cx, si
and eax, esi
lea edx, [ebx + edx + 2]
mov ebx, dword [esp + 0x18]
and bx, si
shr edx, 2
add ecx, ebx
mov ebx, ebp
and bx, si
and ebp, esi
add ecx, ebx
mov ebx, edi
and bx, si
and edi, esi
lea ecx, [ecx + ebx + 0x200]
mov ebx, dword [esp + 0x1c]
shr ecx, 2
xor dl, cl
mov ecx, dword [esp + 0x18]
and ecx, esi
add eax, ecx
add eax, ebp
mov ebp, dword [esp + 0x20]
lea eax, [eax + edi + 0x200]
shr eax, 2
and edx, 0xffff00ff
xor edx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 2
add ebx, 4
add ebp, 4
cmp ebx, dword [esp + 0x28]
mov word [eax], dx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
jb 0x10057821
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
mov edi, dword [esp + 0x30]
mov edx, dword [ecx + 4]
mov edx, dword [edx + 0x1050]
add dword [esp + 0x14], edx
mov edx, dword [ecx]
mov ebp, dword [edx + 0x1050]
lea eax, [eax + ebp*2]
cmp eax, edi
mov dword [esp + 0x24], eax
jb 0x100577f8
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x24
ret
Function at 0x10057904
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
push ebp
mov ebp, dword [eax + 0x18]
mov eax, dword [edx + 0x18]
push esi
mov esi, dword [edx + 0x105c]
push edi
mov edi, dword [edx + 0x1050]
imul esi, edi
add esi, eax
cmp eax, esi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], esi
jae 0x10057a3a
push ebx
mov edx, dword [edx + 0x1058]
add edx, eax
add edi, eax
cmp eax, edx
mov ebx, eax
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
mov dword [esp + 0x24], edx
jae 0x10057a15
movzx ebp, byte [ebx]
movzx esi, byte [ebx + 1]
movzx eax, byte [edi + 1]
movzx edi, byte [edi]
mov edx, eax
push 0xf
pop ecx
and edx, ecx
mov ebx, ebp
and ebx, ecx
add edx, ebx
mov ebx, edi
and ebx, ecx
add edx, ebx
mov ebx, esi
and ebx, ecx
lea edx, [edx + ebx + 2]
mov ecx, eax
and ecx, 0xffff00f0
mov ebx, ebp
and ebx, 0xffff00f0
add ecx, ebx
mov ebx, edi
and ebx, 0xffff00f0
add ecx, ebx
mov ebx, esi
and ebx, 0xffff00f0
shr edx, 2
lea ecx, [ecx + ebx + 0x20]
mov ebx, dword [esp + 0x14]
shr ecx, 2
xor dl, cl
mov ecx, 0xf0
and ax, cx
and bp, cx
and di, cx
and si, cx
and dl, 0xf
add eax, ebp
add eax, edi
mov edi, dword [esp + 0x18]
lea eax, [eax + esi + 0x20]
shr eax, 2
xor dl, al
mov eax, dword [esp + 0x10]
inc dword [esp + 0x10]
inc ebx
inc ebx
inc edi
inc edi
cmp ebx, dword [esp + 0x24]
mov byte [eax], dl
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
jb 0x10057963
mov ecx, dword [esp + 0x28]
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x2c]
mov edx, dword [ecx + 4]
add ebp, dword [edx + 0x1050]
mov edx, dword [ecx]
mov edi, dword [edx + 0x1050]
lea eax, [eax + edi*2]
cmp eax, esi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], eax
jb 0x1005793f
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20
ret
Function at 0x1005fd7c
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [eax], 0x20000000
mov dword [ebp - 4], edi
jne 0x1005fec3
push ebx
push esi
push 4
pop esi
add eax, esi
mov ecx, dword [eax]
cmp ecx, 0x40020000
jne 0x1005fe22
add eax, esi
mov ecx, dword [eax]
xor edx, edx
cmp ecx, 0x40000001
je 0x1005fdcc
cmp ecx, 0x40010001
je 0x1005fdcc
cmp ecx, 0x40020001
je 0x1005fdcc
cmp ecx, 0x40030001
jne 0x1005fdd7
shr ecx, 0x10
and ecx, 0xf
inc ecx
mov edx, ecx
add eax, esi
cmp dword [eax], 0x40050002
jne 0x1005fde9
inc edx
mov dword [ebp - 4], 0x1000
add eax, esi
mov ecx, edx
sub ecx, edi
je 0x1005fe1c
dec ecx
je 0x1005fe16
dec ecx
je 0x1005fe10
dec ecx
je 0x1005fe0a
dec ecx
je 0x1005fe04
dec ecx
jne 0x1005fe2f
or dword [ebp - 4], 0xe
jmp 0x1005fe2f
or dword [ebp - 4], 0xc
jmp 0x1005fe2f
or dword [ebp - 4], 0xa
jmp 0x1005fe2f
or dword [ebp - 4], 8
jmp 0x1005fe2f
or dword [ebp - 4], 6
jmp 0x1005fe2f
or dword [ebp - 4], 2
jmp 0x1005fe2f
cmp ecx, 0x40030000
jne 0x1005fe2f
mov dword [ebp - 4], esi
add eax, esi
cmp dword [eax], 0x40020003
push 0x10
pop ecx
jne 0x1005fe3f
or dword [ebp - 4], ecx
add eax, esi
cmp dword [eax], 0x40000004
jne 0x1005fe4d
or dword [ebp - 4], 0x20
add eax, esi
cmp dword [eax], 0x40040005
jne 0x1005fe5b
or dword [ebp - 4], 0x40
add eax, esi
cmp dword [eax], 0x40040006
jne 0x1005fe69
or byte [ebp - 4], 0x80
add eax, esi
push 7
pop esi
mov edx, dword [eax]
mov ebx, esi
or ebx, 0x40000000
cmp ebx, edx
jne 0x1005fe7e
push 3
jmp 0x1005fea9
mov ebx, esi
or ebx, 0x40010000
cmp ebx, edx
je 0x1005feaf
mov ebx, esi
or ebx, 0x40020000
cmp ebx, edx
jne 0x1005fe9b
xor edx, edx
inc edx
jmp 0x1005feaa
mov ebx, esi
or ebx, 0x40030000
cmp ebx, edx
jne 0x1005febb
push 2
pop edx
shl edx, cl
or dword [ebp - 4], edx
add eax, 4
inc edi
inc ecx
inc ecx
inc esi
cmp ecx, 0x20
jb 0x1005fe6c
shl edi, 8
or dword [ebp - 4], edi
pop esi
pop ebx
cmp dword [eax], 0xffffffff
pop edi
je 0x1005fed0
mov eax, 0x8876086c
jmp 0x1005feda
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
xor eax, eax
leave
ret 8

Function at 0x1007f486
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push reloc.XINPUT1_3.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyA]
test eax, eax
jne 0x1007f4de
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
test esi, esi
pop esi
jne 0x1007f4de
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x1007f4de
xor eax, eax
inc eax
leave
ret
xor eax, eax
leave
ret
Function at 0x1007f507
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push reloc.XINPUT1_3.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x1007f575
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push str.DisableMMX
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExA]
test eax, eax
jne 0x1007f56c
cmp dword [ebp - 0xc], 4
jne 0x1007f56c
cmp dword [ebp - 0x10], edi
je 0x1007f56c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
mov dword [0x102168d0], edi
xor eax, eax
jmp 0x1007f59d
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
cmp dword [0x102168d0], edi
jge 0x1007f598
mov dword [0x102168d0], edi
call fcn.1007f4e2
test eax, eax
je 0x1007f598
emms
mov dword [0x102168d0], 1
mov eax, dword [0x102168d0]
pop edi
leave
ret

Function at 0x1007f67d
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x98
push ebx
push edi
push 0x25
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
xor bl, bl
and byte [ebp + 0x73], bl
push eax
mov dword [ebp - 0x24], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x1007f6b4
inc bl
mov byte [ebp + 0x73], 1
cmp dword [ebp - 0x14], 1
jne 0x1007f6d6
cmp dword [ebp - 0x20], 4
ja 0x1007f6e0
jne 0x1007f6d0
cmp dword [ebp - 0x1c], 0xa
jb 0x1007f6d0
cmp word [ebp - 0x18], 0x55d
jae 0x1007f6e0
mov byte [ebp + 0x73], 1
jmp 0x1007f6e0
cmp dword [ebp - 0x14], 2
jne 0x1007f6f6
test bl, bl
je 0x1007f711
mov eax, dword [ebp + 0x7c]
sub eax, 6
je 0x1007f701
dec eax
je 0x1007f6fa
sub eax, 3
jne 0x1007f6f6
cmp byte [ebp + 0x73], 0
je 0x1007f722
xor eax, eax
jmp 0x1007f72a
call fcn.1007f5a0
jmp 0x1007f72a
cmp byte [ebp + 0x73], 0
jne 0x1007f6f6
call fcn.1007f5d8
and eax, 4
jmp 0x1007f72a
cmp dword [ebp + 0x7c], 0xa
je 0x1007f722
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
jmp 0x1007f72a
call fcn.1007f5d8
and eax, 8
pop edi
pop ebx
add ebp, 0x74
leave
ret
Function at 0x10082288
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x100822b5
push esi
call fcn.1008965f
cmp byte [esi + 0x40], 0
pop ecx
je 0x100822ae
mov dword [esi + 0x10], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x10082324
mov eax, dword [esi + 0x18c]
cmp byte [eax + 0x10], 0
je 0x10082319
mov eax, dword [esi + 8]
test eax, eax
je 0x100822d6
push esi
call dword [eax]
pop ecx
mov eax, dword [esi + 0x18c]
push esi
call dword [eax]
test eax, eax
pop ecx
je 0x10082315
cmp eax, 2
je 0x10082319
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x100822cb
cmp eax, 3
je 0x100822fa
cmp eax, 1
jne 0x100822cb
inc dword [ecx + 4]
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
cmp dword [eax + 4], ecx
jl 0x100822cb
mov edx, dword [esi + 0x118]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x100822cb
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
mov dword [esi + 0x84], eax
jmp 0x10082342
cmp eax, 0xcc
je 0x10082342
mov eax, dword [esi]
mov dword [eax + 0x14], 0x12
mov eax, dword [esi]
mov ecx, dword [esi + 0x10]
mov dword [eax + 0x18], ecx
mov eax, dword [esi]
push esi
call dword [eax]
pop ecx
call fcn.1008215b
pop esi
ret

Function at 0x10089781
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x1008978f
xor eax, eax
pop ebp
ret
cmp dword [ebp + 0x10], 8
push esi
mov esi, dword [ebp + 8]
not esi
mov ecx, 0xff
jb 0x10089863
mov eax, dword [ebp + 0x10]
push ebx
shr eax, 3
push edi
xor ebx, ebx
mov bl, byte [edx]
mov edi, esi
shr edi, 8
sub dword [ebp + 0x10], 8
xor ebx, esi
and ebx, ecx
mov esi, dword [ebx*4 + 0x101f18c0]
xor ebx, ebx
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x101f18c0]
xor ebx, ebx
shr esi, 8
xor edi, esi
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x101f18c0]
xor ebx, ebx
shr edi, 8
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x101f18c0]
xor ebx, ebx
shr esi, 8
xor edi, esi
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x101f18c0]
xor ebx, ebx
shr edi, 8
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x101f18c0]
shr esi, 8
xor edi, esi
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x101f18c0]
shr edi, 8
xor esi, edi
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x101f18c0]
shr esi, 8
xor esi, edi
inc edx
dec eax
jne 0x100897ac
pop edi
pop ebx
cmp dword [ebp + 0x10], 0
je 0x10089883
xor eax, eax
mov al, byte [edx]
xor eax, esi
and eax, ecx
mov eax, dword [eax*4 + 0x101f18c0]
shr esi, 8
xor esi, eax
inc edx
dec dword [ebp + 0x10]
jne 0x10089869
mov eax, esi
not eax
pop esi
pop ebp
ret
Function at 0x100a0061
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x1021c568], 0
push ebx
push esi
mov esi, 0x1021c570
jne 0x100a008d
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x1021c588], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x1021c568], 1
push dword [0x1021c588]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x100a012a
push 0x14
push 8
push dword [0x1021bd34]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x100a0154
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x1021c56c]
test eax, eax
je 0x100a00cf
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x1021c56c], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x100a0159
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x1021c588]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x1021bd34]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x100a0154
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8
Function at 0x100a3267
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
push ebx
push esi
push edi
je 0x100a32bc
push dword [esp + 0x10]
push 0x100a31e6
call dword [sym.imp.USER32.DLL_EnumWindows]
mov esi, dword [0x1021c7e0]
test esi, esi
je 0x100a3315
xor edi, edi
mov ebx, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 8], eax
jne 0x100a32b4
cmp byte [esi + 0x10], 0
je 0x100a32b4
push 3
push edi
push edi
push edi
push edi
push 0xfffffffffffffffe
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
mov esi, ebx
test ebx, ebx
jne 0x100a3290
jmp 0x100a3315
mov esi, dword [0x1021c7e0]
test esi, esi
je 0x100a3315
xor edi, edi
push ebp
mov ebx, dword [esi]
lea ebp, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp], eax
jne 0x100a330e
cmp byte [esi + 0x11], 0
je 0x100a32ea
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_EnableWindow]
cmp byte [esi + 0x10], 0
je 0x100a3301
push 3
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
push ebp
push 0x1021c7e0
call fcn.100b8d81
pop ecx
pop ecx
mov esi, ebx
test ebx, ebx
jne 0x100a32c9
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x100a39cd
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [0x1021e4b4]
call fcn.100b8443
mov edi, dword [eax + 0x24]
test edi, edi
je 0x100a3a8b
cmp dword [edi + 8], 1
je 0x100a3a8b
mov edi, dword [edi + 0xc]
test edi, edi
je 0x100a3a8b
mov al, byte [edi]
cmp al, 0x20
je 0x100a3a06
cmp al, 9
jne 0x100a3a09
inc edi
jmp 0x100a39fc
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor eax, eax
push eax
push eax
push 0xffffffffffffffff
push edi
push eax
push 0xfde9
call esi
push dword [esp + 0x14]
mov ebx, eax
lea ecx, [ebx - 1]
push ecx
call fcn.100b93b0
push ebx
mov ebp, eax
push ebp
push 0xffffffffffffffff
push edi
push 0
push 0xfde9
call esi
test ebx, ebx
jle 0x100a3a5a
push 9
pop edx
lea eax, [ebp - 2]
lea eax, [eax + ebx*2]
movzx ecx, word [eax]
push 0x20
pop esi
cmp cx, si
je 0x100a3a76
cmp cx, dx
je 0x100a3a76
pop edi
pop esi
pop ebp
pop ebx
ret 4
movzx ecx, word [eax]
cmp cx, si
je 0x100a3a6e
cmp cx, dx
jne 0x100a3a7a
xor ecx, ecx
mov word [eax], cx
sub eax, 2
cmp eax, ebp
jae 0x100a3a61
push ebp
call sub.MSVCRT.dll_wcslen
pop ecx
sub ebx, eax
push ebx
call fcn.100b9490
jmp 0x100a3a5a
pop edi
pop esi
pop ebp
pop ebx
jmp fcn.100b9690
Function at 0x100a452e
Capabilities:
Delete file

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
xor edi, edi
test esi, esi
je 0x100a458d
cmp word [esi], di
je 0x100a458d
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.100df930
push dword [esp + 0x1c]
mov ebx, eax
push ebx
call dword [esp + 0x20]
push esi
push ebx
call fcn.100dfbe0
add esp, 0x10
test eax, eax
jne 0x100a458c
push 0x24
push 8
push dword [0x1021bd34]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
mov eax, dword [esp + 0x10]
mov dword [ecx + 0x14], edi
mov edi, ecx
mov dword [ecx], ebx
mov dword [ecx + 8], 1
mov dword [eax + 4], ecx
pop ebx
mov eax, edi
pop edi
pop esi
ret 0x10

Function at 0x100a759d
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
cmp word [0x1021cc94], 0
jne 0x100a765f
push edi
lea eax, [esp + 4]
push eax
push 0x101
call dword [sym.imp.WSOCK32.DLL_WSAStartup]
xor edi, edi
inc edi
test eax, eax
jne 0x100a75d2
mov word [0x1021cc94], di
jmp 0x100a75da
xor eax, eax
mov word [0x1021cc94], ax
push str.ws2_32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x1021ccb0], eax
test eax, eax
je 0x100a765e
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.getaddrinfo
push eax
call esi
push str.freeaddrinfo
push dword [0x1021ccb0]
mov dword [0x1021cca0], eax
call esi
push str.getnameinfo
push dword [0x1021ccb0]
mov dword [0x1021cca4], eax
call esi
push str.WSAStringToAddressA
push dword [0x1021ccb0]
mov dword [0x1021cca8], eax
call esi
cmp dword [0x1021cca0], 0
mov dword [0x1021ccac], eax
pop esi
je 0x100a765e
cmp dword [0x1021cca4], 0
je 0x100a765e
cmp dword [0x1021cca8], 0
je 0x100a765e
test eax, eax
je 0x100a765e
mov dword [0x1021cc98], edi
pop edi
movsx eax, word [0x1021cc94]
add esp, 0x190
ret
Function at 0x100a7e41
Capabilities:
Get socket status
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x920
xor eax, eax
inc eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov esi, ebx
cmp dword [edi], eax
jne 0x100a7ec4
mov esi, dword [edi + 8]
mov dword [ebp - 0x120], eax
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
lea eax, [ebp - 0x120]
mov dword [ebp - 0x11c], esi
push eax
lea eax, [esi + 1]
mov dword [ebp - 0xc], ebx
push eax
mov dword [ebp - 8], ebx
call dword [sym.imp.WSOCK32.DLL_select]
test eax, eax
js 0x100a7ebb
je 0x100a7ec0
lea eax, [ebp - 0x120]
push eax
push esi
call sub.WSOCK32.DLL___WSAFDIsSet
test eax, eax
je 0x100a7ec0
lea eax, [ebp + 8]
push eax
push 0x4004667f
push esi
call dword [sym.imp.WSOCK32.DLL_ioctlsocket]
test eax, eax
jne 0x100a7ebb
cmp dword [ebp + 8], ebx
je 0x100a7ebb
push 2
jmp 0x100a7ebd
push 4
pop esi
jmp 0x100a7f1e
mov esi, ebx
jmp 0x100a7f1e
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x10
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push 0x800
lea eax, [ebp - 0x920]
push eax
push dword [edi + 0x28]
call dword [sym.imp.WSOCK32.DLL_recvfrom]
mov dword [ebp + 8], eax
test eax, eax
jle 0x100a7f1e
push 2
pop esi
push eax
push ebx
push dword [0x1021bd34]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 8]
push ecx
mov dword [edi + 0x30], ecx
lea ecx, [ebp - 0x920]
push ecx
push eax
mov dword [edi + 0x2c], eax
mov dword [edi + 0x34], eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x100a7f29
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, ebx
cmp dword [esi], 1
jne 0x100a7f4f
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi + 8]
call dword [sym.imp.WSOCK32.DLL_recv]
mov edi, eax
jmp 0x100a7f8c
cmp dword [esi + 0x2c], ebx
je 0x100a7f8c
mov edi, dword [ebp + 0x10]
cmp edi, dword [esi + 0x30]
jle 0x100a7f5f
mov edi, dword [esi + 0x30]
push edi
push dword [esi + 0x34]
push dword [ebp + 0xc]
call sub.MSVCRT.dll_memcpy
sub dword [esi + 0x30], edi
add esp, 0xc
add dword [esi + 0x34], edi
cmp dword [esi + 0x30], ebx
jne 0x100a7f8c
push dword [esi + 0x2c]
push ebx
push dword [0x1021bd34]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi + 0x2c], ebx
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x100a7f95
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x840
push ebx
push ebp
push esi
push edi
push dword [0x1021e5a0]
xor esi, esi
mov dword [esp + 0x14], esi
call fcn.100b8443
mov ebp, dword [esp + 0x854]
xor edi, edi
inc edi
mov ebx, eax
mov dword [esp + 0x20], ebx
cmp word [ebp + 0x20], di
jne 0x100a8004
push esi
push esi
push dword [ebp]
call dword [sym.imp.WSOCK32.DLL_accept]
mov esi, eax
cmp esi, 0xffffffff
je 0x100a8160
lea eax, [ebp + 0x28]
push 0x18
push eax
call fcn.100b8dc1
pop ecx
pop ecx
mov ecx, eax
mov dword [esp + 0x10], edi
mov dword [ecx], edi
mov dword [ecx + 8], esi
mov dword [ecx + 0xc], ebp
mov eax, dword [ebp + 0x24]
mov dword [ebx + 4], eax
mov dword [ebx], ecx
jmp 0x100a8160
cmp word [ebp + 0x22], si
je 0x100a8038
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x1c
push eax
lea eax, [esp + 0x38]
push eax
push esi
push 0x800
lea eax, [esp + 0x60]
push eax
push dword [ebp]
call dword [sym.imp.WSOCK32.DLL_recvfrom]
mov edi, eax
mov dword [esp + 0x14], edi
jmp 0x100a8064
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x10
push eax
lea eax, [esp + 0x28]
push eax
push esi
push 0x800
lea eax, [esp + 0x60]
push eax
push dword [ebp]
call dword [sym.imp.WSOCK32.DLL_recvfrom]
mov edi, eax
mov dword [esp + 0x14], eax
test edi, edi
jle 0x100a8160
lea ebx, [ebp + 0x28]
mov dword [esp + 0x10], 2
mov esi, dword [ebx]
jmp 0x100a80a8
xor eax, eax
cmp word [ebp + 0x22], ax
je 0x100a808d
push dword [esp + 0x1c]
lea eax, [esp + 0x38]
jmp 0x100a8095
push dword [esp + 0x18]
lea eax, [esp + 0x28]
push eax
lea eax, [esi + 0xc]
push eax
call sub.MSVCRT.dll_memcmp
add esp, 0xc
test eax, eax
je 0x100a80ae
mov esi, dword [esi]
test esi, esi
jne 0x100a807b
jmp 0x100a80b8
lea ebx, [esi + 8]
test esi, esi
jne 0x100a80f1
lea ebx, [ebp + 0x28]
push 0x40
push ebx
call fcn.100b8dc1
mov ebx, eax
mov eax, dword [esp + 0x18]
pop ecx
pop ecx
mov dword [ebx], eax
lea edi, [ebx + 4]
xor eax, eax
mov dword [ebx + 0x24], ebp
cmp word [ebp + 0x22], ax
je 0x100a80e7
push 7
pop ecx
lea esi, [esp + 0x34]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x14]
jmp 0x100a80f3
lea esi, [esp + 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x100a80e1
xor eax, eax
cmp dword [ebx + 0x2c], 0
jne 0x100a8121
push edi
push eax
push dword [0x1021bd34]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push edi
lea ecx, [esp + 0x54]
mov dword [ebx + 0x2c], eax
push ecx
push eax
mov dword [ebx + 0x30], edi
mov dword [ebx + 0x34], eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
jmp 0x100a8154
mov eax, dword [ebx + 0x30]
add eax, edi
push eax
push dword [ebx + 0x2c]
push 8
push dword [0x1021bd34]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, eax
lea eax, [esp + 0x50]
push edi
push eax
mov eax, dword [ebx + 0x30]
add eax, ecx
mov dword [ebx + 0x2c], ecx
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add dword [ebx + 0x30], edi
mov eax, dword [esp + 0x20]
mov dword [eax], ebx
mov ecx, dword [ebp + 0x24]
mov dword [eax + 4], ecx
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x840
ret