joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10018040
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006fa50
mov eax, dword fs:[0]
push eax
sub esp, 0x200
mov eax, dword [0x1008a748]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movzx eax, byte [0x10090363]
test eax, eax
jne 0x1001808c
cmp dword [0x100903b8], 0x96
jne 0x1001808c
mov eax, dword [0x100903b8]
jmp 0x10018220
movzx ecx, byte [0x100903bc]
test ecx, ecx
je 0x100180a3
mov eax, 0x3e8
jmp 0x10018220
mov byte [0x100903bc], 1
lea ecx, [ebp - 0x70]
call fcn.1000ce30
mov dword [ebp - 4], 0
lea edx, [ebp - 0x200]
push edx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
lea eax, [ebp - 0x28]
push eax
call fcn.10033260
add esp, 4
mov byte [ebp - 4], 1
call fcn.1003a170
call fcn.10030ec0
mov dword [0x100904a0], 0x10017610
call fcn.1001b8e0
mov ecx, dword [ebp + 8]
push ecx
call fcn.10016a70
add esp, 4
call fcn.1000daf0
call fcn.10022f10
push 0x1e
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.10017e40
call fcn.10010620
mov dword [ebp - 0x204], 0
cmp dword [0x100903b8], 0
jne 0x10018153
mov edx, dword [ebp - 0x204]
add edx, 1
mov dword [ebp - 0x204], edx
cmp dword [ebp - 0x204], 0x64
jle 0x10018149
jmp 0x10018153
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10018126
mov dword [ebp - 0x204], 0
cmp dword [0x100903fc], 0
jne 0x1001818a
mov eax, dword [ebp - 0x204]
add eax, 1
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 0x32
jle 0x10018180
jmp 0x1001818a
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1001815d
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x100903b8], 0x96
jne 0x100181d6
cmp dword [0x100903b4], 1
je 0x100181d6
mov dword [ebp - 0x20c], 0x97
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.10005300
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.1000ed40
mov eax, dword [ebp - 0x20c]
jmp 0x10018220
mov ecx, dword [0x100903b8]
mov dword [ebp - 0x208], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.10005300
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.1000ed40
mov eax, dword [ebp - 0x208]
jmp 0x10018220
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003fec6
mov esp, ebp
pop ebp
ret
Function at 0x100237a0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10070443
mov eax, dword fs:[0]
push eax
sub esp, 0xb0
mov eax, dword [0x1008a748]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x7c], 0
lea ecx, [ebp - 0x6c]
call fcn.1000ce30
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 1
push 4
lea eax, [ebp - 0x18]
push eax
push 1
push 6
mov ecx, dword [0x1008b6d8]
push ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov dword [ebp - 0x20], 0x1388
mov dword [ebp - 0x1c], 0x12c
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x14], 0
push 0
push 0
lea edx, [ebp - 0x14]
push edx
push 0xc
lea eax, [ebp - 0x78]
push eax
push 0xc
lea ecx, [ebp - 0x24]
push ecx
push 0x98000004
mov edx, dword [0x1008b6d8]
push edx
call dword [sym.imp.WS2_32.dll_WSAIoctl]
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0xffffffff
jne 0x100238f1
mov byte [ebp - 0x6c], 0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.1000cd30
add esp, 8
mov dword [ebp - 0x8c], eax
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0x80], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x80]
push edx
push 0x1007e984
lea eax, [ebp - 0xa4]
push eax
call fcn.10013600
add esp, 0xc
mov dword [ebp - 0x88], eax
mov ecx, dword [ebp - 0x88]
push ecx
lea ecx, [ebp - 0x68]
call fcn.10011710
lea ecx, [ebp - 0xa4]
call fcn.10005300
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xbc]
call fcn.10005300
lea edx, [ebp - 0x6c]
push edx
mov ecx, dword [ebp + 8]
call fcn.1000fe90
mov eax, dword [ebp - 0x7c]
or eax, 1
mov dword [ebp - 0x7c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c]
call fcn.1000ed40
mov eax, dword [ebp + 8]
jmp 0x10023929
mov byte [ebp - 0x6c], 1
push 0x1007e226
lea ecx, [ebp - 0x68]
call fcn.100117c0
lea ecx, [ebp - 0x6c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.1000fe90
mov edx, dword [ebp - 0x7c]
or edx, 1
mov dword [ebp - 0x7c], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c]
call fcn.1000ed40
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003fec6
mov esp, ebp
pop ebp
ret
Function at 0x10024130
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0xc], 0
cmp dword [ebp + 8], 0
jne 0x1002414a
xor eax, eax
jmp 0x10024239
mov eax, dword [ebp + 8]
push eax
call fcn.10041482
add esp, 4
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x14]
mov cl, byte [eax]
mov byte [ebp - 1], cl
add dword [ebp - 0x14], 1
cmp byte [ebp - 1], 0
jne 0x10024168
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0xc], 0
jmp 0x1002419b
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 0x20]
jge 0x10024204
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0xc]
movsx ecx, byte [eax]
cmp ecx, 0x5c
je 0x100241bf
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0xc]
movsx eax, byte [edx]
cmp eax, 0x2f
jne 0x10024202
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0xc]
mov byte [ecx], 0
push 0
mov edx, dword [ebp - 8]
push edx
call fcn.100414d2
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x100241f9
mov eax, dword [ebp - 8]
push eax
call fcn.10041532
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x100241f9
or eax, 0xffffffff
jmp 0x10024239
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0xc]
mov byte [ecx], 0x2f
jmp 0x10024192
push 0
mov edx, dword [ebp - 8]
push edx
call fcn.100414d2
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x1002422a
mov eax, dword [ebp - 8]
push eax
call fcn.10041532
add esp, 4
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.1003fed5
add esp, 4
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x10024380
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x1002439b
xor al, al
jmp 0x100243a9
mov ecx, dword [ebp - 4]
and ecx, 0x10
je 0x100243a7
mov al, 1
jmp 0x100243a9
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x10026810
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10070958
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x1008a748]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0x40], 0
je 0x10026850
mov ecx, dword [ebp - 0x30]
movzx edx, byte [ecx + 0x45]
test edx, edx
jne 0x1002685c
mov al, 1
jmp 0x100269ff
mov dword [ebp - 0x54], 8
call fcn.10003bc0
push eax
mov eax, dword [ebp - 0x30]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x30]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x40], eax
call fcn.10003bc0
mov dword [ebp - 0x44], eax
lea ecx, [ebp - 0x40]
push ecx
lea edx, [ebp - 0x44]
push edx
call fcn.10003b90
add esp, 8
movzx eax, al
test eax, eax
je 0x1002689f
xor al, al
jmp 0x100269ff
push 0
push 8
lea ecx, [ebp - 0x28]
call fcn.10006a40
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x58]
push edx
lea ecx, [ebp - 0x28]
call fcn.10012230
mov ecx, eax
call fcn.1000a6c0
mov esi, eax
lea ecx, [ebp - 0x28]
call fcn.100059d0
add esi, eax
push esi
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x28]
call fcn.10012230
mov ecx, eax
call fcn.1000a6c0
push eax
mov ecx, dword [ebp - 0x30]
add ecx, 0x48
push ecx
mov edx, dword [ebp - 0x30]
mov ecx, dword [edx + 0x40]
call fcn.10026da0
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
je 0x1002691a
cmp dword [ebp - 0x3c], 1
je 0x10026921
cmp dword [ebp - 0x3c], 3
je 0x100269bb
jmp 0x100269d3
mov eax, dword [ebp - 0x30]
mov byte [eax + 0x45], 0
lea ecx, [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x28]
call fcn.10012230
mov ecx, eax
call fcn.1000a6c0
mov edx, dword [ebp - 0x2c]
sub edx, eax
mov dword [ebp - 0x38], edx
je 0x10026984
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0x50]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 1
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x28]
call fcn.10012230
mov ecx, eax
call fcn.1000a6c0
push eax
call fcn.10041843
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x10026984
mov byte [ebp - 0x34], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10005300
mov al, byte [ebp - 0x34]
jmp 0x100269ff
mov ecx, dword [ebp - 0x30]
movzx edx, byte [ecx + 0x45]
test edx, edx
jne 0x100269a7
mov byte [ebp - 0x31], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10005300
mov al, byte [ebp - 0x31]
jmp 0x100269ff
cmp dword [ebp - 0x38], 0
jne 0x100269b9
push 0
push 8
lea ecx, [ebp - 0x28]
call fcn.100210e0
jmp 0x100269eb
mov byte [ebp - 0x33], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10005300
mov al, byte [ebp - 0x33]
jmp 0x100269ff
mov byte [ebp - 0x32], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10005300
mov al, byte [ebp - 0x32]
jmp 0x100269ff
jmp 0x100268b2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003fec6
mov esp, ebp
pop ebp
ret
Function at 0x10029570
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10070bb0
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x1008a748]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0x20]
call fcn.1001e410
mov byte [ebp - 0x25], 0
lea ecx, [ebp + 8]
call fcn.10005380
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x1002965c
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x2c]
cmp dword [ecx + edx*4], 0
je 0x1002965a
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ecx + edx*4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov edx, dword [eax]
mov dword [ebp - 0x24], edx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x20], ecx
mov edx, dword [eax + 8]
mov dword [ebp - 0x1c], edx
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x18], ecx
mov edx, dword [eax + 0x10]
mov dword [ebp - 0x14], edx
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x48]
call fcn.10005270
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
push ecx
mov ecx, dword [ebp + 0x20]
call fcn.1001e2f0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.10005300
mov byte [ebp - 0x25], 1
xor edx, edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0x2c], eax
jmp 0x100295ce
jmp 0x10029660
mov byte [ebp - 0x25], 0
mov cl, byte [ebp - 0x25]
mov byte [ebp - 0x26], cl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.10005300
mov al, byte [ebp - 0x26]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003fec6
mov esp, ebp
pop ebp
ret
Function at 0x1002bc70
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10070f23
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1008a748]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 8], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x10
call fcn.10005240
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
mov byte [ecx + 0x2a], 0
mov edx, dword [ebp - 0x10]
mov dword [edx], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 8], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0xc], 0xffffffff
lea eax, [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x10
call fcn.10006a80
mov ecx, dword [ebp - 0x10]
mov dx, word [ebp + 0x20]
mov word [ecx + 0x28], dx
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x2a], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x2c], 0x1f40
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x30], 0x1f40
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x34], 0xf
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x38], 0xf
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x3c], 0x1388
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x40], 0x12c
mov ecx, dword [ebp - 0x10]
mov byte [ecx + 0x44], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.10005300
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x1002c2d0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10070fd3
mov eax, dword fs:[0]
push eax
sub esp, 0xb8
mov eax, dword [0x1008a748]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x80], 0
lea ecx, [ebp - 0x6c]
call fcn.1000ce30
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x7c]
movzx ecx, byte [eax + 0x2a]
test ecx, ecx
je 0x1002c32b
mov dword [ebp - 0x84], 1
jmp 0x1002c335
mov dword [ebp - 0x84], 0
mov edx, dword [ebp - 0x84]
mov dword [ebp - 0x20], edx
push 4
lea eax, [ebp - 0x20]
push eax
push 1
push 6
mov ecx, dword [ebp - 0x7c]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov eax, dword [ebp - 0x7c]
cmp dword [eax + 0x3c], 0
je 0x1002c379
mov ecx, dword [ebp - 0x7c]
mov edx, dword [ecx + 0x3c]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x7c]
mov ecx, dword [eax + 0x40]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x1c], 1
jmp 0x1002c38e
mov dword [ebp - 0x18], 0x124f80
mov dword [ebp - 0x14], 0x7d0
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x24], 0
push 0
push 0
lea edx, [ebp - 0x24]
push edx
push 0xc
lea eax, [ebp - 0x78]
push eax
push 0xc
lea ecx, [ebp - 0x1c]
push ecx
push 0x98000004
mov edx, dword [ebp - 0x7c]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_WSAIoctl]
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0xffffffff
jne 0x1002c471
mov byte [ebp - 0x6c], 0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
lea ecx, [ebp - 0xc4]
push ecx
call fcn.1000cd30
add esp, 8
mov dword [ebp - 0x88], eax
mov edx, dword [ebp - 0x88]
mov dword [ebp - 0x8c], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x8c]
push eax
push 0x1007f228
lea ecx, [ebp - 0xac]
push ecx
call fcn.10013600
add esp, 0xc
mov dword [ebp - 0x90], eax
mov edx, dword [ebp - 0x90]
push edx
lea ecx, [ebp - 0x68]
call fcn.10011710
lea ecx, [ebp - 0xac]
call fcn.10005300
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc4]
call fcn.10005300
lea eax, [ebp - 0x6c]
push eax
mov ecx, dword [ebp + 8]
call fcn.1000fe90
mov ecx, dword [ebp - 0x80]
or ecx, 1
mov dword [ebp - 0x80], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c]
call fcn.1000ed40
mov eax, dword [ebp + 8]
jmp 0x1002c4a9
mov byte [ebp - 0x6c], 1
push 0x1007e37f
lea ecx, [ebp - 0x68]
call fcn.100117c0
lea edx, [ebp - 0x6c]
push edx
mov ecx, dword [ebp + 8]
call fcn.1000fe90
mov eax, dword [ebp - 0x80]
or eax, 1
mov dword [ebp - 0x80], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c]
call fcn.1000ed40
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003fec6
mov esp, ebp
pop ebp
ret 4
Function at 0x1002c4d0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10071008
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x1008a748]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x60], 0
lea ecx, [ebp - 0x5c]
call fcn.1000ce30
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x64]
movzx ecx, byte [eax + 0x2a]
test ecx, ecx
je 0x1002c525
mov dword [ebp - 0x68], 1
jmp 0x1002c52c
mov dword [ebp - 0x68], 0
mov edx, dword [ebp - 0x68]
mov dword [ebp - 0x14], edx
push 4
lea eax, [ebp - 0x14]
push eax
push 1
push 6
mov ecx, dword [ebp - 0x64]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov byte [ebp - 0x5c], 1
push 0x1007e391
lea ecx, [ebp - 0x58]
call fcn.100117c0
lea eax, [ebp - 0x5c]
push eax
mov ecx, dword [ebp + 8]
call fcn.1000fe90
mov ecx, dword [ebp - 0x60]
or ecx, 1
mov dword [ebp - 0x60], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
call fcn.1000ed40
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003fec6
mov esp, ebp
pop ebp
ret 4
Function at 0x1002e540
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov byte [eax], 0
mov ecx, 4
imul edx, ecx, 0
mov eax, dword [ebp - 4]
mov dword [eax + edx + 0x44], 0
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx + 0x44], 0
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx + 0x4c], 0x67452301
mov eax, 4
shl eax, 0
mov ecx, dword [ebp - 4]
mov dword [ecx + eax + 0x4c], 0xefcdab89
mov edx, 4
shl edx, 1
mov eax, dword [ebp - 4]
mov dword [eax + edx + 0x4c], 0x98badcfe
mov ecx, 4
imul edx, ecx, 3
mov eax, dword [ebp - 4]
mov dword [eax + edx + 0x4c], 0x10325476
mov esp, ebp
pop ebp
ret

Function at 0x100331d0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x1008a748]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x228], 0
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x1007fc04
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 0x22c], eax
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x224]
push edx
call fcn.1001ced0
add esp, 8
lea eax, [ebp - 0x224]
push eax
mov ecx, dword [ebp + 8]
call fcn.100052b0
mov ecx, dword [ebp - 0x228]
or ecx, 1
mov dword [ebp - 0x228], ecx
lea ecx, [ebp - 0x224]
call fcn.10005300
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003fec6
mov esp, ebp
pop ebp
ret

Function at 0x10033370
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10071718
mov eax, dword fs:[0]
push eax
sub esp, 0x258
mov eax, dword [0x1008a748]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x260], esp
lea eax, [ebp + 8]
push eax
call fcn.100051e0
mov dword [ebp - 0x25c], eax
call fcn.10024240
add esp, 0x18
mov byte [ebp - 0x255], al
movzx ecx, byte [ebp - 0x255]
test ecx, ecx
jne 0x100333e9
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.10005300
jmp 0x1003347f
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp + 8]
call fcn.10005380
push eax
call fcn.1001ce30
add esp, 8
mov dword [ebp - 0x254], 0x3c
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x24c], 0
mov dword [ebp - 0x248], 0
lea eax, [ebp - 0x218]
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x23c], 0
mov dword [ebp - 0x238], 5
mov dword [ebp - 0x234], 0
lea ecx, [ebp - 0x254]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [ebp - 0x264], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.10005300
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003fec6
mov esp, ebp
pop ebp
ret
Function at 0x10038ca0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10071008
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x1008a748]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x60], 0
lea ecx, [ebp - 0x5c]
call fcn.1000ce30
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x64]
movzx ecx, byte [eax + 0x4e]
test ecx, ecx
je 0x10038cf5
mov dword [ebp - 0x68], 1
jmp 0x10038cfc
mov dword [ebp - 0x68], 0
mov edx, dword [ebp - 0x68]
mov dword [ebp - 0x14], edx
push 4
lea eax, [ebp - 0x14]
push eax
push 1
push 6
mov ecx, dword [ebp - 0x64]
mov edx, dword [ecx + 0x30]
push edx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov byte [ebp - 0x5c], 1
push 0x1007e472
lea ecx, [ebp - 0x58]
call fcn.100117c0
lea eax, [ebp - 0x5c]
push eax
mov ecx, dword [ebp + 8]
call fcn.1000fe90
mov ecx, dword [ebp - 0x60]
or ecx, 1
mov dword [ebp - 0x60], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
call fcn.1000ed40
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003fec6
mov esp, ebp
pop ebp
ret 4
Function at 0x1004724c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x401410
Capabilities:
Resolve dns

Disassembly:
sub esp, 0xb0
mov eax, dword [0x43e008]
xor eax, esp
mov dword [esp + 0xac], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0xc0]
mov ebp, ecx
push edi
push 0x10
xor edi, edi
call fcn.004147f5
mov ebx, eax
add esp, 4
mov dword [ebx], edi
mov dword [ebx + 4], edi
mov dword [ebx + 8], edi
mov dword [ebx + 0xc], edi
test esi, esi
je 0x40159e
push esi
push 0x4167fc
lea eax, [esp + 0x40]
push 0x80
push eax
call fcn.004011d0
add esp, 0x10
mov byte [esp + 0xb7], 0
lea eax, [esp + 0x14]
mov dword [esp + 0x14], edi
xorps xmm0, xmm0
mov dword [esp + 0x1c], edi
movlpd qword [esp + 0x28], xmm0
push eax
lea eax, [esp + 0x1c]
movlpd qword [esp + 0x34], xmm0
push eax
push edi
lea eax, [esp + 0x44]
mov dword [esp + 0x2c], 2
push eax
mov dword [esp + 0x34], 0x11
mov dword [esp + 0x28], 5
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x40150f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
test byte [0x43f278], 2
je 0x4014f3
cmp dword [str._CInstance::FAddInstanceEntryERR__getaddrinfo:__ls_n], edi
je 0x4014f3
mov eax, dword [str._CInstance::FAddInstanceEntryERR__getaddrinfo:__ls_n]
push esi
push eax
mov eax, dword [str.sql_ntdbms_browser_sqlbrowser_brwscore.cpp]
push 0x5dc00
push eax
call fcn.00405110
add esp, 0x10
push dword [esp + 0x14]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
push 0x10
push ebx
call fcn.0041482a
add esp, 8
xor eax, eax
jmp 0x4015d2
mov esi, dword [esp + 0x14]
mov edi, 2
test esi, esi
je 0x401545
nop dword [eax]
cmp dword [esi + 4], 0x17
jne 0x401535
call fcn.00406e20
test eax, eax
mov eax, 0x17
cmovne edi, eax
mov esi, dword [esi + 0x1c]
test esi, esi
jne 0x401520
mov esi, dword [esp + 0x14]
cmp edi, 2
jne 0x401551
test byte [ebp + 0xcc], 0x10
je 0x401551
push esi
jmp 0x4014f7
mov eax, dword [ebp + 0xcc]
xor ecx, ecx
cmp edi, 2
mov edx, 0x10
cmove ecx, edx
or ecx, eax
xor ecx, eax
and ecx, edx
xor ecx, eax
mov dword [ebp + 0xcc], ecx
cmp edi, 0x17
jne 0x40157c
test cl, 0x20
jne 0x40154e
xor eax, eax
mov edx, 0x20
cmp edi, 0x17
push esi
cmove eax, edx
or eax, ecx
xor eax, ecx
and eax, edx
xor eax, ecx
mov dword [ebp + 0xcc], eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov eax, dword [esp + 0xc8]
mov dword [ebx + 4], eax
mov eax, dword [esp + 0xcc]
mov dword [ebx + 8], eax
mov dword [ebx], edi
mov eax, dword [ebp + 0xbc]
mov dword [eax], ebx
mov eax, dword [ebp + 0xbc]
mov eax, dword [eax]
add eax, 0xc
mov dword [ebp + 0xbc], eax
mov eax, 1
mov ecx, dword [esp + 0xbc]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004145b4
add esp, 0xb0
ret 0xc