joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100116e0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x1007c00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ebx, ecx
push edi
lea edi, [ebx + 0xcc]
push edi
push 1
push 0x1006e1f8
push 0x1006cd60
call esi
push edi
push 1
cmp eax, 1
push 0x1006e204
sete al
push 0x1006cd60
mov byte [ebx + 0x24], al
call esi
push edi
push 1
cmp eax, 1
push 0x1006e224
sete al
push 0x1006cd60
mov byte [ebx + 0x25], al
call esi
cmp eax, 1
push edi
sete al
push 0x104
mov byte [ebx + 0x26], al
lea eax, [ebp - 0x210]
push eax
push str.C8337AB7
push 0x1006dfd4
push 0x1006cd60
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebx + 0x2a]
push eax
lea eax, [ebx + 0x29]
push eax
lea eax, [ebx + 0x28]
push eax
lea eax, [ebx + 0x27]
push eax
lea eax, [ebp - 0x210]
push str._02hhX_02hhX_02hhX_02hhX
push eax
call fcn.100027e0
add esp, 0x18
push edi
push 3
push 0x1006e230
push 0x1006cd60
call esi
push edi
push 0
push 0x1006e23c
push 0x1006cd60
mov dword [ebx + 0x2c], eax
call esi
mov ecx, dword [ebp - 4]
cmp eax, 1
pop edi
sete al
xor ecx, ebp
pop esi
mov byte [ebx + 0x30], al
pop ebx
call fcn.10027b68
mov esp, ebp
pop ebp
ret

Function at 0x100118c0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [0x1007fa84]
test esi, esi
je 0x1001197a
cmp byte [0x1007fa78], 0
je 0x1001197a
cmp byte [0x1007fa79], 0
je 0x10011943
push 2
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x1001191c
mov eax, dword [ebp + 8]
push dword [eax + 4]
push dword [eax]
mov eax, dword [0x1007fa84]
push 0x403
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
xor al, al
pop esi
pop ebp
ret 4
mov eax, dword [0x1007fa84]
push 0
push 0
push 0x404
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov word [0x1007fa78], 0
xor al, al
pop esi
pop ebp
ret 4
mov eax, dword [ebp + 8]
push dword [eax + 4]
push dword [eax]
push dword [0x1007fa80]
push dword [0x1007fa7c]
call fcn.10011990
cmp eax, 0xa
jle 0x1001197a
push 0
push 0
push 0x402
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov byte [0x1007fa79], 1
xor al, al
pop esi
pop ebp
ret 4
Function at 0x10013510
Capabilities:
Log keystrokes via application hook
Set global application hook

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10061ca0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x1007c00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call edi
mov esi, dword [sym.imp.USER32.dll_SetWindowsHookExW]
push eax
push dword [0x1007fa2c]
push 0x10012ba0
push 7
call esi
mov dword [0x1007fa14], eax
call edi
push eax
push dword [0x1007fa2c]
push 0x100130a0
push 2
call esi
mov dword [0x1007fa3c], eax
call edi
push eax
push dword [0x1007fa2c]
push 0x100133f0
push 3
call esi
mov edx, 0x10011a30
mov dword [0x1007fa24], eax
lea ecx, [ebp - 0x10]
call fcn.1001f120
mov edx, eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.1001f150
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x100135b8
push 4
push eax
call fcn.10028411
add esp, 8
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x100135d3
push 1
call fcn.100292ff
mov eax, dword [ebp - 0x14]
add esp, 4
push eax
push dword [ebp - 0x18]
call fcn.100299e6
add esp, 8
test eax, eax
je 0x100135ec
push eax
call fcn.100292d2
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10013790
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10061d16
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x1007c00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 0xc]
lea ecx, [ebp - 0x210]
mov eax, dword [ebp + 8]
push edx
push 0x104
push ecx
push 0x1006bb50
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edx, [ebp - 0x210]
lea ecx, [ebp - 0x240]
call fcn.10006430
mov edi, eax
mov edx, esi
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x228]
call fcn.10006430
mov esi, eax
mov byte [ebp - 4], 1
cmp dword [edi + 0x14], 0x10
jb 0x10013815
mov edi, dword [edi]
cmp dword [esi + 0x14], 0x10
jb 0x1001381d
mov esi, dword [esi]
mov ecx, edi
call fcn.10002510
push eax
mov edx, esi
mov ecx, ebx
call fcn.10002460
mov eax, dword [ebp - 0x214]
add esp, 4
cmp eax, 0x10
jb 0x1001384f
inc eax
lea ecx, [ebp - 0x228]
push eax
push dword [ebp - 0x228]
call fcn.1001b490
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0x214], 0xf
mov dword [ebp - 0x218], 0
mov byte [ebp - 0x228], 0
cmp eax, 0x10
jb 0x10013888
inc eax
lea ecx, [ebp - 0x240]
push eax
push dword [ebp - 0x240]
call fcn.1001b490
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10027b68
mov esp, ebp
pop ebp
ret
Function at 0x10014df0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push ecx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
call fcn.10034310
mov esi, eax
lea ecx, [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
mov ecx, esi
call fcn.1001e850
push esi
call fcn.100335f6
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetVersion]
movzx ecx, al
cmp ecx, 6
ja 0x10014e50
jne 0x10014e3c
shr eax, 8
cmp al, 1
jae 0x10014e50
mov ecx, dword [ebp - 4]
movzx eax, word [ebp - 8]
shl eax, 0x10
movzx ecx, cx
or eax, ecx
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
movzx eax, word [ebp - 8]
or ecx, 0x4000
shl eax, 0x10
movzx ecx, cx
or eax, ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10015460
Capabilities:
Enumerate gui resources

Disassembly:
cmp byte [0x1007fa29], 0
jne 0x10015485
push 0
push 0x100153c0
call dword [sym.imp.USER32.dll_EnumWindows]
cmp byte [0x1007fa29], 0
sete byte [0x1007fa29]
ret
mov eax, dword [0x1007fa54]
push esi
mov esi, dword [0x1007fa58]
cmp esi, eax
je 0x100154b3
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
nop dword [eax]
add esi, 0xfffffffc
push 5
push dword [esi]
call edi
mov eax, dword [0x1007fa54]
cmp esi, eax
jne 0x100154a0
pop edi
cmp byte [0x1007fa29], 0
mov dword [0x1007fa58], eax
pop esi
sete byte [0x1007fa29]
ret

Function at 0x10015570
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10061f76
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x1007c00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push ecx
push 0x100
lea eax, [ebp - 0x210]
push eax
push 0x1006bb50
push 0x1006e3f0
push 0x1006cd80
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x210], 0
je 0x1001565c
lea ecx, [ebp - 0x210]
call fcn.10014df0
mov dword [ebp - 0x214], eax
lea ecx, [ebp - 0x218]
lea eax, [ebp - 0x214]
mov edx, 0x100154d0
push eax
call fcn.1001f300
add esp, 4
mov edx, eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x220]
call fcn.1001f400
mov eax, dword [ebp - 0x218]
test eax, eax
je 0x1001561f
push 8
push eax
call fcn.10028411
add esp, 8
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x21c]
test eax, eax
jne 0x10015640
push 1
call fcn.100292ff
mov eax, dword [ebp - 0x21c]
add esp, 4
push eax
push dword [ebp - 0x220]
call fcn.100299e6
add esp, 8
test eax, eax
je 0x1001565c
push eax
call fcn.100292d2
add esp, 4
xor eax, eax
cmp word [ebp - 0x210], ax
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10027b68
mov esp, ebp
pop ebp
ret
Function at 0x100163f0
Capabilities:
Read .ini file
Terminate process

Disassembly:
push edi
push ecx
push 1
push 0x1006e3f8
push 0x1006cd80
mov edi, edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 1
jne 0x10016444
mov eax, dword [edi + 4]
xor ecx, ecx
push ebx
push esi
mov esi, dword [edi]
mov ebx, eax
sub ebx, esi
xor edi, edi
add ebx, 3
shr ebx, 2
cmp esi, eax
cmova ebx, ecx
test ebx, ebx
je 0x10016442
nop dword [eax]
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
inc edi
lea esi, [esi + 4]
cmp edi, ebx
jne 0x10016430
pop esi
pop ebx
pop edi
ret
Function at 0x10016450
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100621d0
mov eax, dword fs:[0]
push eax
sub esp, 0x94
mov eax, dword [0x1007c00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], edx
mov ebx, ecx
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x44], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], esi
push 0x1006e670
push 1
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 0x48], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
sete al
mov byte [ebp - 0x29], al
test al, al
je 0x100164e3
mov edx, dword [ebp - 0x30]
mov ecx, ebx
call fcn.10015f00
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 0x3c]
push eax
mov ecx, ebx
call fcn.10015d00
mov esi, dword [ebp - 0x34]
add esp, 4
mov edi, dword [ebp - 0x3c]
push 0x40
lea eax, [ebp - 0x9c]
push 0
push eax
call fcn.1002c460
add esp, 0xc
mov dword [ebp - 0xa0], 0x44
xorps xmm0, xmm0
lea ecx, [ebp - 0x28]
mov edx, ebx
movups xmmword [ebp - 0x58], xmm0
push dword [ebp - 0x40]
push dword [ebp - 0x30]
call fcn.10015690
add esp, 8
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 1
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push ecx
cmovae eax, dword [ebp - 0x28]
lea ecx, [ebp - 0xa0]
push ecx
push 0
push 0
push 0x4000410
push 0
push 0
push 0
push eax
push dword [ebp - 0x44]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x10016593
cmp byte [ebp - 0x29], 0
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x10016581
push 0xffffffffffffffff
push dword [ebp - 0x58]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x48]
call esi
lea edx, [ebp - 0x3c]
mov ecx, ebx
call fcn.100163f0
mov edx, dword [ebp - 0x30]
mov ecx, ebx
call fcn.10016210
push dword [ebp - 0x58]
call esi
push dword [ebp - 0x54]
call esi
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateProcessW_failed:_d
call fcn.10004540
mov eax, dword [ebp - 0x14]
add esp, 8
cmp eax, 8
jb 0x100165bc
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.1001b3d0
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
test edi, edi
je 0x100165e0
sub esi, edi
sar esi, 2
push esi
push edi
call fcn.10019ea0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10027b68
mov esp, ebp
pop ebp
ret
Function at 0x10023170
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword [0x1007fb8c]
test eax, eax
je 0x1002318c
nop dword [eax]
cmp dword [eax + 4], 0
jne 0x100231e6
mov eax, dword [eax]
test eax, eax
jne 0x10023180
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, eax
test ecx, ecx
je 0x100231e4
push esi
lea edx, [ecx + 0x20]
mov dword [ecx + 4], 0
mov esi, edx
mov dword [ecx + 8], 0
sub esi, ecx
nop dword [eax]
mov eax, dword [ecx + 4]
add esi, 0x20
mov dword [edx], eax
mov dword [ecx + 4], edx
add edx, 0x20
cmp esi, 0xfe0
jbe 0x100231c0
mov eax, dword [0x1007fb8c]
mov dword [ecx], eax
mov dword [0x1007fb8c], ecx
pop esi
mov eax, ecx
ret
Function at 0x10023bf0
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1007c00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 4
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x10023cd8
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x10023cd1
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
nop word [eax + eax]
cmp dword [ebp - 0x20], 0x10
jb 0x10023cb6
call ebx
cmp dword [ebp - 0x14], eax
jne 0x10023cb6
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x10023cb6
mov ecx, dword [esi]
test ecx, ecx
jne 0x10023c7f
push 0x200
push ecx
push dword [0x1007fa48]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esi], eax
test eax, eax
je 0x10023cd0
jmp 0x10023ca8
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
jb 0x10023ca8
shl eax, 3
push eax
push ecx
push 0
push dword [0x1007fa48]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
test eax, eax
je 0x10023cd0
mov ecx, dword [esi + 4]
add ecx, ecx
mov dword [esi], eax
mov dword [esi + 4], ecx
mov edx, dword [esi + 8]
mov ecx, dword [esi]
mov eax, dword [ebp - 0x18]
mov dword [ecx + edx*4], eax
inc dword [esi + 8]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x10023c40
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10027b68
mov esp, ebp
pop ebp
ret

Function at 0x10023cf0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.10023bf0
cmp dword [edi], 0
je 0x10023d5c
push esi
xor esi, esi
cmp dword [edi + 8], esi
jbe 0x10023d5b
push ebx
mov eax, dword [edi]
push dword [eax + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x10023d54
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [ebp + 8]
mov edx, dword [ebp - 4]
mov ecx, ebx
call fcn.10023a80
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [edi + 8]
jb 0x10023d21
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x10023d70
Capabilities:
Resume thread

Disassembly:
push edi
mov edi, ecx
cmp dword [edi], 0
je 0x10023dbc
push esi
xor esi, esi
cmp dword [edi + 8], esi
jbe 0x10023dab
push ebx
mov eax, dword [edi]
push dword [eax + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x10023da4
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [edi + 8]
jb 0x10023d81
pop ebx
push dword [edi]
push 0
push dword [0x1007fa48]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop edi
ret
Function at 0x10023dc0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
imul esi, ecx, 0x2c
mov eax, 5
push edi
mov ebx, edx
mov dword [ebp - 4], eax
add esi, dword [0x1007fb80]
test byte [esi + 0x14], 1
mov edi, dword [esi]
je 0x10023dee
sub edi, eax
mov eax, 7
mov dword [ebp - 4], eax
lea ecx, [ebp - 8]
push ecx
push 0x40
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10023e0c
pop edi
pop esi
mov eax, 0xa
pop ebx
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x10023e2d
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x10023e4e
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x10023e4e
mov eax, dword [esi + 0xc]
test byte [esi + 0x14], 1
mov dword [edi], eax
je 0x10023e48
mov ax, word [esi + 0x10]
mov word [edi + 4], ax
mov al, byte [esi + 0x12]
mov byte [edi + 6], al
jmp 0x10023e4e
mov al, byte [esi + 0x10]
mov byte [edi + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov al, byte [esi + 0x14]
and bl, 1
mov cl, bl
and al, 0xfd
add cl, cl
shl bl, 2
or cl, al
and cl, 0xfb
or cl, bl
xor eax, eax
pop edi
mov byte [esi + 0x14], cl
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10023ea0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [0x1007fb88]
push ebx
push esi
push edi
xor edi, edi
xor esi, esi
mov dword [ebp - 4], edi
mov ebx, ecx
test edx, edx
je 0x10023f91
mov eax, dword [0x1007fb80]
add eax, 0x14
movzx ecx, byte [eax]
shr ecx, 1
and ecx, 1
cmp ecx, ebx
jne 0x10023ee5
inc esi
add eax, 0x2c
cmp esi, edx
jb 0x10023ec8
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 0xffffffff
je 0x10023f91
xor eax, eax
lea ecx, [ebp - 0x10]
test ebx, ebx
setne al
or edx, 0xffffffff
push eax
call fcn.10023cf0
mov ecx, dword [0x1007fb88]
add esp, 4
cmp esi, ecx
jae 0x10023f45
imul edi, esi, 0x2c
mov eax, dword [0x1007fb80]
movzx eax, byte [edi + eax + 0x14]
shr eax, 1
and eax, 1
cmp eax, ebx
je 0x10023f3a
mov edx, ebx
mov ecx, esi
call fcn.10023dc0
mov dword [ebp - 4], eax
test eax, eax
jne 0x10023f42
mov ecx, dword [0x1007fb88]
inc esi
add edi, 0x2c
cmp esi, ecx
jb 0x10023f11
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x10023f91
xor esi, esi
cmp dword [ebp - 8], esi
jbe 0x10023f82
mov edi, eax
push dword [edi + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x10023f76
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebp - 8]
jb 0x10023f55
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
push eax
push 0
push dword [0x1007fa48]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10024c60
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a8
mov eax, dword [0x1007c00c]
xor eax, esp
mov dword [esp + 0x1a4], eax
movq xmm0, qword [ebp + 8]
lea eax, [esp + 0x10]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, ecx
movq qword [esp + 8], xmm0
xorps xmm0, xmm0
push eax
push 0x202
movups xmmword [edi], xmm0
movq qword [edi + 0x10], xmm0
mov dword [edi + 0x18], 0
mov dword [edi + 0xc], 0xffffffff
mov dword [edi + 8], 0xffffffff
mov dword [edi + 0x10], edx
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ecx, dword [esp + 0xc]
test ecx, ecx
jne 0x10024cd1
mov ecx, 1
mov esi, 0x1007cd24
mov eax, dword [esp + 8]
test eax, eax
je 0x10024cdb
mov dword [esi], eax
lea eax, [ecx*4]
mov dword [edi + 0x14], ecx
push eax
call fcn.100335fb
push 0xc
mov dword [edi + 0x18], eax
mov esi, dword [esi]
push 1
call fcn.1003ae72
mov dword [eax], edi
mov dword [eax + 4], 0
mov dword [eax + 8], esi
mov ecx, dword [edi + 0x18]
mov dword [ecx], eax
mov eax, dword [edi + 0x18]
mov eax, dword [eax]
push eax
mov ecx, dword [eax + 8]
mov eax, dword [ecx]
call eax
mov ecx, dword [esp + 0x1bc]
add esp, 0x10
pop edi
pop esi
xor ecx, esp
call fcn.10027b68
mov esp, ebp
pop ebp
ret

Function at 0x10025b40
Capabilities:
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], 0x10
push 0
mov ebx, edx
mov dword [ebp - 8], 1
push ebx
movzx eax, word [edi]
push eax
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
je 0x10025be1
push 4
lea eax, [ebp - 8]
push eax
push 0xfffffffffffffffb
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x10025bd7
push dword [ebp - 4]
push edi
push esi
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
jne 0x10025bd7
cmp ebx, 2
je 0x10025bab
push accept
push esi
call dword [sym.imp.WS2_32.dll_listen]
test eax, eax
jne 0x10025bd7
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 1
push eax
push 0x8004667e
push esi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
lea eax, [ebp - 4]
push eax
push edi
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10025bf0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
test byte [esi + 0x7c], 2
je 0x10025c7d
push 0x10
lea eax, [esi + 0x18]
push eax
push 0
push dword [esi + 0x3c]
push dword [esi + 0x38]
push dword [esi + 0x10]
call dword [sym.imp.WS2_32.dll_sendto]
mov edi, eax
test edi, edi
jle 0x10025d30
mov eax, dword [esi + 0x3c]
cmp edi, eax
ja 0x10025c3f
mov ecx, dword [esi + 0x38]
sub eax, edi
push eax
lea eax, [ecx + edi]
push eax
push ecx
call fcn.1002a910
add esp, 0xc
sub dword [esi + 0x3c], edi
mov dword [ebp - 4], edi
mov edi, dword [esi + 0x58]
test edi, edi
jne 0x10025c54
mov edi, dword [esi + 0x64]
test edi, edi
je 0x10025d30
mov eax, dword [esi + 0x7c]
mov ebx, dword [esi + 0x30]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 4
push esi
call edi
sub ebx, dword [esi + 0x30]
add esp, 0xc
cmp edi, dword [esi + 0x64]
jne 0x10025d16
mov ecx, dword [ebp - 8]
jmp 0x10025d03
push 0
push dword [esi + 0x3c]
push dword [esi + 0x38]
push dword [esi + 0x10]
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
test edi, edi
jns 0x10025caf
mov ecx, edi
call fcn.10025700
test eax, eax
je 0x10025cad
or dword [esi + 0x7c], 0x800
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
jle 0x10025d30
test edi, edi
je 0x10025cd2
mov eax, dword [esi + 0x3c]
cmp edi, eax
ja 0x10025cd2
mov ecx, dword [esi + 0x38]
sub eax, edi
push eax
lea eax, [ecx + edi]
push eax
push ecx
call fcn.1002a910
add esp, 0xc
sub dword [esi + 0x3c], edi
mov dword [ebp - 8], edi
mov edi, dword [esi + 0x58]
test edi, edi
jne 0x10025ce3
mov edi, dword [esi + 0x64]
test edi, edi
je 0x10025d30
mov eax, dword [esi + 0x7c]
mov ebx, dword [esi + 0x30]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 4
push esi
call edi
sub ebx, dword [esi + 0x30]
add esp, 0xc
cmp edi, dword [esi + 0x64]
jne 0x10025d16
mov ecx, dword [ebp - 4]
mov eax, dword [esi + 0x7c]
cmp eax, ecx
je 0x10025d16
xor eax, ecx
and eax, 0x3f03d00
xor eax, ecx
mov dword [esi + 0x7c], eax
test ebx, ebx
je 0x10025d30
test byte [esi + 0x7c], 2
jne 0x10025d30
mov eax, dword [esi + 0x78]
push ebx
push esi
mov eax, dword [eax + 8]
mov eax, dword [eax + 0x2c]
call eax
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10025f80
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2008
call fcn.1005d4a0
mov eax, dword [0x1007c00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
mov edi, ecx
lea eax, [ebp - 0x2008]
push 0x2004
push eax
push dword [edi + 0xc]
call dword [sym.imp.WS2_32.dll_recv]
push 0
mov esi, eax
lea eax, [ebp - 0x2004]
push 1
push eax
push dword [edi + 0xc]
call dword [sym.imp.WS2_32.dll_send]
cmp esi, 4
jl 0x10026005
mov eax, dword [ebp - 0x2008]
test eax, eax
je 0x10026005
mov esi, dword [edi]
test esi, esi
je 0x10026005
nop dword [eax]
lea ecx, [ebp - 0x2004]
push ecx
push 0
push esi
call eax
add esp, 0xc
test esi, esi
jne 0x10025ff7
mov esi, dword [edi]
jmp 0x10025ff9
mov esi, dword [esi]
test esi, esi
je 0x10026005
mov eax, dword [ebp - 0x2008]
jmp 0x10025fe0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10027b68
mov esp, ebp
pop ebp
ret