joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10012c10
Capabilities:
Get keyboard layout

Disassembly:
mov eax, dword [0x10077fb0]
mov ecx, dword [eax + 0x10]
push esi
push edi
push ecx
call sub.imm32.dll_ImmGetContext
push 0
mov edi, eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov edx, dword [0x1007e6bc]
push 0x100578bc
add edx, 0x1600
push edx
mov esi, eax
call dword [sym.imp.kernel32.dll_lstrcpy]
mov eax, dword [0x1007e6bc]
push esi
mov byte [eax + 0x180b], 2
call sub.imm32.dll_ImmIsIME
test eax, eax
je 0x10012c7f
mov ecx, dword [0x1007e6bc]
push 0x200
add ecx, 0x1600
push ecx
push esi
call sub.imm32.dll_ImmGetDescriptionA
mov edx, dword [0x1007e6bc]
mov byte [edx + 0x180b], 1
mov eax, dword [0x10077fb0]
mov ecx, dword [eax + 0x10]
push edi
push ecx
call sub.imm32.dll_ImmReleaseContext
pop edi
mov eax, 1
pop esi
ret

Function at 0x10013bc0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push 0x2660
push 0
push 0x1007eae8
mov dword [0x1007e6bc], 0x1007eae8
call fcn.1003ae80
add esp, 0xc
call fcn.10012490
test eax, eax
jne 0x10013c0a
push 0x8de
call fcn.1000a040
push eax
push 0x10
call fcn.10010b30
add esp, 0xc
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 1
push 6
call fcn.10011930
mov ecx, dword [0x10077fb0]
add esp, 0xc
cmp eax, 1
sete al
mov byte [ecx + 0x24e6], al
call fcn.100119c0
pushfd
pop eax
mov dword [ebp - 4], eax
xor eax, 0x200000
push eax
popfd
pushfd
pop eax
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 4]
jne 0x10013c4c
xor eax, eax
jmp 0x10013c5f
mov eax, 1
cpuid
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
shr eax, 0x19
and eax, 1
mov ecx, dword [0x10077fb0]
mov dword [ecx + 0x44], eax
mov edx, dword [0x1007e6bc]
lea eax, [ebp - 0x10]
push eax
push 0
mov dword [edx + 0x265c], 1
mov ecx, dword [0x10077fb0]
push ecx
push 0x10013700
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
mov edx, dword [0x10077fb0]
mov dword [edx + 0xa5c], eax
mov eax, dword [0x10077fb0]
cmp dword [eax + 0xa5c], 0
jne 0x10013cb8
push 0x8df
jmp 0x10013bf3
call fcn.10013960
call fcn.10012aa0
mov ecx, dword [0x1007e6bc]
mov eax, dword [ecx + 0x265c]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10014040
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 4], ebx
push edi
mov edi, dword [ebp - 4]
nop
movzx esi, byte [ebp - 4]
mov eax, dword [ebp + 8]
shl esi, 5
add esi, 0x10081174
sub eax, 0
je 0x10014070
dec eax
je 0x1001406b
dec eax
jne 0x10014079
mov edi, dword [ebp + 0xc]
jmp 0x10014079
call fcn.10004bd0
lea edi, [eax + ebx + 8]
xor eax, eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.ws2_32.dll_htons]
mov ecx, 2
push edi
mov word [esi], ax
mov word [esi + 0xa], ax
mov word [esi + 8], cx
call dword [sym.imp.ws2_32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x100140c2
push edi
call dword [sym.imp.ws2_32.dll_gethostbyname]
mov dword [esi + 4], eax
test eax, eax
je 0x100140e6
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov eax, dword [eax]
mov dword [esi + 0xc], eax
mov eax, 1
add dword [ebp - 4], eax
add ebx, 0x410
cmp ebx, 0x820
jl 0x10014050
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100140f0
Capabilities:
Connect socket

Disassembly:
call fcn.10004bd0
movzx eax, byte [eax + 0x29ec]
shl eax, 5
add eax, 0x10081174
mov edx, dword [eax + 0x18]
push 0x10
lea ecx, [eax + 8]
push ecx
push edx
call dword [sym.imp.ws2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x1001412c
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
xor ecx, ecx
cmp eax, 0x2733
sete cl
mov eax, ecx
ret
mov eax, 1
ret

Function at 0x100141c0
Capabilities:
Create tcp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
call fcn.10004bd0
movzx esi, byte [eax + 0x29ec]
push 6
push 1
shl esi, 5
push 2
add esi, 0x10081174
mov dword [ebp - 8], 1
call dword [sym.imp.ws2_32.dll_socket]
mov dword [esi + 0x18], eax
cmp eax, 0xffffffff
jne 0x100141fe
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
push edi
mov edi, dword [sym.imp.ws2_32.dll_setsockopt]
push 4
lea ecx, [ebp - 4]
push ecx
shr edx, 1
push 0x1001
add edx, 0x3f
push 0xffff
and edx, 0xffffffc0
push eax
mov dword [ebp - 4], edx
call edi
mov eax, dword [esi + 0x18]
push 4
lea edx, [ebp - 4]
push edx
push 0x1002
push 0xffff
push eax
call edi
mov edx, dword [esi + 0x18]
push 4
lea ecx, [ebp - 8]
push ecx
push 4
push 0xffff
push edx
call edi
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10014300
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0
mov dword [ebp - 4], 1
je 0x100143bb
push ebx
push esi
push edi
mov edi, dword [sym.imp.ws2_32.dll_ioctlsocket]
xor ebx, ebx
movzx esi, bl
lea ecx, [ebp - 4]
shl esi, 5
push ecx
add esi, 0x10081174
mov edx, dword [esi + 0x18]
push 0x8004667e
push edx
call edi
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x1001434e
push eax
call dword [sym.imp.ws2_32.dll_WSACloseEvent]
mov eax, dword [esi + 0x18]
mov dword [esi + 0x1c], 0
cmp eax, 0xffffffff
je 0x10014386
lea ecx, [ebp - 8]
push ecx
push 0x8004667e
push eax
mov dword [ebp - 8], 1
call edi
mov edx, dword [esi + 0x18]
push 1
push edx
call dword [sym.imp.ws2_32.dll_shutdown]
mov eax, dword [esi + 0x18]
push eax
call dword [sym.imp.ws2_32.dll_closesocket]
inc ebx
mov dword [esi + 0x18], 0xffffffff
cmp ebx, 2
jl 0x10014325
mov esi, dword [ebp + 8]
mov eax, dword [esi]
test eax, eax
je 0x100143ab
push eax
call fcn.1003bb4e
add esp, 4
mov dword [esi], 0
push 0x4c
push 0
push esi
call fcn.1003ae80
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100143c0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x1006b5d8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x190
lea eax, [ebp - 0x194]
push 0
push eax
call fcn.1003ae80
add esp, 0xc
lea ecx, [ebp - 0x194]
push ecx
push 0x202
call dword [sym.imp.ws2_32.dll_WSAStartup]
mov edx, dword [sym.imp.ws2_32.dll_WSACleanup]
push edx
mov esi, eax
call fcn.1003baa3
add esp, 4
test eax, eax
je 0x1001441e
push 0x1005913c
call fcn.1000b850
add esp, 4
test esi, esi
pop esi
je 0x1001444a
push 0x8f2
call fcn.1000a040
push eax
push 0
push 2
call fcn.10009dd0
add esp, 0x10
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003b1fb
mov esp, ebp
pop ebp
ret
push 0x8000
call fcn.1003e09b
add eax, 0x20
push eax
call fcn.1003e075
add esp, 4
push eax
call fcn.1003df8a
mov ax, word [ebp - 0x192]
mov ecx, 0x202
add esp, 8
cmp ax, cx
movzx eax, ax
jae 0x100144c2
mov edx, eax
and edx, 0xff
push edx
shr eax, 8
push eax
push 0x10059124
push 0
push 2
call fcn.10009dd0
push 0x8f3
call fcn.1000a040
push eax
push 0
push 0xb
call fcn.10009dd0
add esp, 0x24
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003b1fb
mov esp, ebp
pop ebp
ret
mov ecx, eax
and ecx, 0xff
push ecx
shr eax, 8
push eax
push 0x10059124
push 0
push 4
call fcn.10009dd0
mov ecx, dword [ebp - 4]
xor ecx, ebp
add esp, 0x14
mov eax, 1
call fcn.1003b1fb
mov esp, ebp
pop ebp
ret

Function at 0x10015440
Capabilities:
Get memory capacity

Disassembly:
mov ecx, dword [0x100811b4]
call fcn.10014bc0
mov ecx, dword [0x100811b4]
call fcn.10014740
mov ecx, dword [0x100811b4]
call fcn.10014c90
mov ecx, dword [0x100811bc]
jmp fcn.10015f60
Function at 0x10015f60
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1006b5d8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
mov esi, ecx
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov edi, eax
push 0xc
push edi
call ebx
push 0xe
push edi
mov dword [ebp - 0x28], eax
call ebx
push edi
push 0
mov ebx, eax
call dword [sym.imp.USER32.dll_ReleaseDC]
imul ebx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
push eax
mov dword [esi], ebx
mov dword [ebp - 0x24], 0x20
call dword [sym.imp.kernel32.dll_GlobalMemoryStatus]
mov ecx, dword [ebp - 0x1c]
lea edx, [esi + 0x4c]
push edx
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
push eax
mov ecx, esi
call fcn.100155a0
push 0
push 0
lea ecx, [esi + 0x8c]
push ecx
mov ecx, esi
mov dword [esi + 8], eax
call fcn.10015940
push 0
push 1
lea edx, [esi + 0xcc]
push edx
mov ecx, esi
call fcn.10015940
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003b1fb
mov esp, ebp
pop ebp
ret

Function at 0x10016150
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x30], 0xffffffff
jne 0x10016178
push 0
push 1
push 2
call dword [sym.imp.ws2_32.dll_socket]
mov dword [esi + 0x30], eax
cmp eax, 0xffffffff
jne 0x10016178
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 0x30]
lea eax, [ebp - 4]
push eax
push 0x8004667e
push ecx
mov dword [ebp - 4], 1
call dword [sym.imp.ws2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
setne al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100161a0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005296b
mov eax, dword fs:[0]
push eax
sub esp, 0x10c
mov eax, dword [0x1006b5d8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov esi, ecx
mov byte [ebp - 0x14], bl
push 0x100597f0
lea ecx, [ebp - 0x114]
mov dword [ebp - 4], ebx
call fcn.1001c9d0
cmp dword [esi + 0x30], 0xffffffff
jne 0x10016200
push ebx
push 1
push 2
call dword [sym.imp.ws2_32.dll_socket]
mov dword [esi + 0x30], eax
cmp eax, 0xffffffff
je 0x10016225
mov ecx, dword [esi + 0x30]
lea eax, [ebp - 0x118]
push eax
push 0x8004667e
push ecx
mov dword [ebp - 0x118], 1
call dword [sym.imp.ws2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x1001623f
lea ecx, [ebp - 0x114]
mov dword [ebp - 4], 0xffffffff
call fcn.1001c5a0
or eax, 0xffffffff
jmp 0x100162cf
cmp byte [ebp + 8], bl
jne 0x1001624d
push esi
lea ecx, [esi + 8]
call fcn.1001d440
xor edx, edx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x90], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
mov dword [esi + 0xa8], 3
mov dword [esi + 0xb0], 4
mov byte [esi + 0x60], bl
mov dword [esi + 0x62], edx
lea ecx, [ebp - 0x114]
mov byte [esi + 0x66], bl
mov byte [esi + 0xbc], bl
mov dword [esi + 0x18], 1
mov dword [ebp - 4], 0xffffffff
call fcn.1001c5a0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003b1fb
mov esp, ebp
pop ebp
ret 4
Function at 0x100162f0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100526db
mov eax, dword fs:[0]
push eax
sub esp, 0x41c
mov eax, dword [0x1006b5d8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov esi, ecx
mov byte [ebp - 0x14], bl
push 0x10059804
lea ecx, [ebp - 0x114]
mov dword [ebp - 4], ebx
call fcn.1001c9d0
mov eax, dword [esi + 0x30]
cmp eax, 0xffffffff
je 0x10016455
lea ecx, [ebp - 0x428]
push ecx
lea edx, [ebp - 0x420]
push edx
lea ecx, [ebp - 0x31c]
push ecx
lea edx, [ebp - 0x218]
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x318], eax
mov dword [ebp - 0x41c], eax
mov edi, 1
push edx
inc eax
push eax
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], ebx
mov dword [ebp - 0x218], edi
mov dword [ebp - 0x31c], edi
mov dword [ebp - 0x420], edi
call dword [sym.imp.ws2_32.dll_select]
test eax, eax
jle 0x10016455
mov ecx, dword [esi + 0x30]
lea eax, [ebp - 0x218]
push eax
push ecx
call sub.ws2_32.dll___WSAFDIsSet
test eax, eax
je 0x100163bd
or dword [esi + 0x5c], 3
mov eax, dword [esi + 0x30]
lea edx, [ebp - 0x31c]
push edx
push eax
call sub.ws2_32.dll___WSAFDIsSet
test eax, eax
je 0x100163d5
or dword [esi + 0x5c], 5
mov eax, dword [esi + 0x1c]
cmp eax, edi
je 0x10016455
cmp eax, 2
je 0x10016455
cmp eax, 5
je 0x10016455
mov eax, dword [esi + 0x20]
cmp eax, edi
je 0x10016455
cmp eax, 2
je 0x10016455
mov edx, dword [esi + 0x30]
lea ecx, [ebp - 0x420]
push ecx
push edx
call sub.ws2_32.dll___WSAFDIsSet
test eax, eax
je 0x10016455
mov dword [esi + 0x62], edi
mov eax, dword [esi + 0x78]
cmp eax, ebx
je 0x10016420
mov ecx, dword [esi + 0x8c]
push ecx
push esi
call eax
add esp, 8
mov dword [esi + 0x78], ebx
mov eax, dword [esi + 0x30]
cmp eax, 0xffffffff
je 0x10016442
push 2
push eax
call dword [sym.imp.ws2_32.dll_shutdown]
mov edx, dword [esi + 0x30]
push edx
call dword [sym.imp.ws2_32.dll_closesocket]
mov dword [esi + 0x30], 0xffffffff
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x1c], ebx
mov byte [esi + 0x60], 1
lea ecx, [ebp - 0x114]
mov dword [ebp - 4], 0xffffffff
call fcn.1001c5a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003b1fb
mov esp, ebp
pop ebp
ret
Function at 0x10016570
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10052f4b
mov eax, dword fs:[0]
push eax
sub esp, 0x108
mov eax, dword [0x1006b5d8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov byte [ebp - 0x14], 0
push 0x10059834
lea ecx, [ebp - 0x114]
mov dword [ebp - 4], 0
call fcn.1001c9d0
mov eax, dword [esi + 0x44]
mov ecx, dword [esi + 0x54]
mov edx, dword [esi + 0x30]
and dword [esi + 0x5c], 0xfffffffb
push 0
push eax
push ecx
push edx
call dword [sym.imp.ws2_32.dll_send]
mov edi, eax
cmp edi, 0xffffffff
jne 0x100165f5
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov ecx, 2
mov word [esi + 0x62], cx
mov word [esi + 0x64], ax
mov dword [esi + 0x24], 4
jmp 0x1001662e
push edi
mov ecx, 0x10081228
call fcn.1001c650
mov eax, dword [esi + 0x44]
cmp eax, edi
jb 0x100165ec
sub eax, edi
mov dword [esi + 0x44], eax
jne 0x1001662b
mov eax, dword [esi + 0x70]
mov dword [esi + 0x24], 3
test eax, eax
je 0x1001662e
mov edx, dword [esi + 0x84]
push edx
push esi
call eax
add esp, 8
jmp 0x1001662e
add dword [esi + 0x54], edi
lea ecx, [ebp - 0x114]
mov dword [ebp - 4], 0xffffffff
call fcn.1001c5a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003b1fb
mov esp, ebp
pop ebp
ret
Function at 0x10016860
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10052f4b
mov eax, dword fs:[0]
push eax
sub esp, 0x108
mov eax, dword [0x1006b5d8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov byte [ebp - 0x14], 0
push 0x10059894
lea ecx, [ebp - 0x114]
mov dword [ebp - 4], 0
call fcn.1001c9d0
mov eax, dword [esi + 0x4c]
test eax, eax
jne 0x100168b4
mov eax, dword [esi + 0x50]
sub eax, dword [esi + 0x48]
mov ecx, dword [esi + 0x30]
and dword [esi + 0x5c], 0xfffffffd
push 0
push eax
mov eax, dword [esi + 0x58]
push eax
push ecx
call dword [sym.imp.ws2_32.dll_recv]
mov edi, eax
cmp edi, 0xffffffff
je 0x10016933
test edi, edi
je 0x1001690e
push edi
mov ecx, 0x10081228
call fcn.1001c690
add dword [esi + 0x48], edi
mov eax, dword [esi + 0x4c]
add dword [esi + 0x58], edi
mov ecx, dword [esi + 0x48]
test eax, eax
je 0x100168fd
cmp ecx, eax
jb 0x100168fd
mov ecx, esi
call fcn.100167d0
mov edx, dword [esi + 0x48]
cmp edx, dword [esi + 0x50]
jbe 0x10016961
mov dword [esi + 0x62], 5
jmp 0x1001695a
mov eax, dword [esi + 0x4c]
test eax, eax
jne 0x1001691e
mov ecx, esi
call fcn.100167d0
jmp 0x10016961
cmp dword [esi + 0x48], eax
jb 0x1001692a
mov ecx, esi
call fcn.100167d0
mov dword [esi + 0x62], 4
jmp 0x1001695a
mov edi, dword [sym.imp.ws2_32.dll_WSAGetLastError]
call edi
cmp eax, 0x2734
je 0x10016961
call edi
cmp eax, 0x2733
je 0x10016961
call edi
mov ecx, 3
mov word [esi + 0x62], cx
mov word [esi + 0x64], ax
mov dword [esi + 0x20], 4
lea ecx, [ebp - 0x114]
mov dword [ebp - 4], 0xffffffff
call fcn.1001c5a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003b1fb
mov esp, ebp
pop ebp
ret
Function at 0x10017b10
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x1006b5d8]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x190
lea eax, [ebp - 0x194]
push 0
push eax
call fcn.1003ae80
add esp, 0xc
lea ecx, [ebp - 0x194]
push ecx
push 2
call dword [sym.imp.ws2_32.dll_WSAStartup]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003b1fb
mov esp, ebp
pop ebp
ret

Function at 0x10019c50
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100529eb
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1006b5d8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], 0x10059b94
call fcn.1003aa63
push 4
mov dword [ebp - 4], 0
call fcn.1003d60d
mov edi, eax
add esp, 4
test edi, edi
je 0x10019cd0
call fcn.1003a721
mov dword [edi], eax
call fcn.1003a4e0
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.1003a415
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x10019cc6
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.1003a43d
jmp 0x10019cd2
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001a0f0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10052af6
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1006b5d8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
xor edi, edi
mov dword [esi], 0x10059b10
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], eax
or eax, ecx
mov dword [ebp - 4], edi
mov dword [esi + 0x14], ecx
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
je 0x1001a15d
push edi
call fcn.1003bc16
mov ecx, dword [esi + 0x10]
add esp, 4
add ecx, eax
mov eax, dword [esi + 0x14]
adc eax, edx
mov dword [esi + 0x18], ecx
mov dword [esi + 0x1c], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov dword [esi + 0x20], eax
or eax, ecx
mov dword [esi + 0x24], ecx
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
je 0x1001a18c
push edi
call fcn.1003bc16
mov ecx, dword [esi + 0x20]
add esp, 4
add ecx, eax
mov eax, dword [esi + 0x24]
adc eax, edx
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], eax
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0xc4], edi
push 0x1f4
mov dword [esi + 0xc8], 0x10059a68
mov dword [esi + 0xcc], 0x1f4
call fcn.1003a243
mov ecx, dword [esi + 0xcc]
push ecx
push edi
push eax
mov dword [esi + 0xd0], eax
call fcn.1003ae80
mov dword [esi + 0xd4], edi
mov eax, dword [ebp + 0x18]
push eax
mov byte [ebp - 4], 1
mov dword [esi + 0xd8], 0x10059a68
mov dword [esi + 0xdc], eax
call fcn.1003a243
mov edx, dword [esi + 0xdc]
push edx
push edi
push eax
mov dword [esi + 0xe0], eax
call fcn.1003ae80
push 0x64
lea eax, [esi + 0x60]
push edi
push eax
mov dword [esi + 0xe4], edi
call fcn.1003ae80
add esp, 0x2c
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x1001ca80
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x1006b5d8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
lea esi, [ebp - 0x104]
xor edx, edx
sub esi, eax
mov cl, byte [eax]
mov byte [esi + eax], cl
test cl, cl
je 0x1001cac6
inc edx
inc eax
cmp edx, 0x100
jb 0x1001caa1
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003b1fb
mov esp, ebp
pop ebp
ret
xor ecx, ecx
jmp 0x1001cad0
mov al, byte [ebp + ecx - 0x104]
test al, al
je 0x1001caee
cmp al, 0x20
jl 0x1001cb06
test al, al
js 0x1001cb06
inc ecx
cmp ecx, 0x100
jb 0x1001cad0
jmp 0x1001cb06
lea eax, [ebp - 0x104]
push 0x3a
push eax
call fcn.1003e9e0
add esp, 8
test eax, eax
je 0x1001cb06
mov byte [eax], 0
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.ws2_32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x1001cb42
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.ws2_32.dll_gethostbyname]
test eax, eax
je 0x1001cab4
cmp word [eax + 8], 2
jne 0x1001cab4
cmp word [eax + 0xa], 4
jne 0x1001cab4
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov eax, dword [ecx]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1003b1fb
mov esp, ebp
pop ebp
ret

Function at 0x1001d4f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx edx, byte [ebp + 0x14]
push ebx
push esi
inc edx
imul edx, dword [ebp + 0xc]
xor eax, eax
push edi
xor ebx, ebx
xor edi, edi
xor esi, esi
mov dword [ebp - 0x10], ecx
mov cl, 1
mov dword [ebp - 4], eax
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], edi
cmp dword [ebp + 0xc], eax
jbe 0x1001d582
mov edi, dword [ebp + 8]
mov bl, byte [edi]
movzx ecx, cl
mov al, bl
movzx edi, al
imul edi, ecx
add dword [ebp - 4], edi
mov dword [ebp + 0x14], ecx
mov ecx, edx
shr ecx, 0xa
xor al, cl
mov ecx, dword [ebp - 0x10]
movzx eax, al
add dword [ebp - 8], eax
mov al, byte [eax + ecx + 0x2c]
mov ecx, esi
and ecx, 7
movzx edi, al
shl edi, cl
mov ecx, dword [ebp + 0x14]
inc edx
inc esi
imul edx, edx, 0x4fd
add dword [ebp - 0xc], edi
mov edi, dword [ebp - 0x10]
xor al, byte [ecx + edi + 0x22c]
mov edi, dword [ebp + 8]
mov byte [edi], al
inc edi
mov cl, bl
mov dword [ebp + 8], edi
cmp esi, dword [ebp + 0xc]
jb 0x1001d520
mov eax, dword [ebp - 4]
mov ebx, dword [ebp - 8]
mov edi, dword [ebp - 0xc]
mov ecx, dword [ebp + 0x10]
mov edx, eax
shr edx, 0x10
xor edx, eax
mov word [ecx + 6], dx
mov edx, ebx
shr edx, 0x10
xor edx, ebx
mov word [ecx + 4], dx
mov edx, edi
shr edx, 0x10
xor edx, edi
shr edi, 1
add edi, ebx
shr eax, 2
add eax, edi
pop edi
pop esi
mov word [ecx + 2], dx
mov word [ecx], ax
pop ebx
mov esp, ebp
pop ebp
ret 0x10