joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10019e90
Capabilities:
Create process on windows
Create thread

Disassembly:
sub esp, 0x16c
mov eax, dword [0x101c1b88]
xor eax, esp
mov dword [esp + 0x168], eax
push ebp
mov ebp, dword [esp + 0x174]
push esi
mov esi, ecx
test esi, esi
push edi
mov edi, edx
je 0x1001a0ea
test edi, edi
je 0x1001a0ea
push ebp
push edi
push esi
push str.Execute___s__File:__s___Parameter__s_
push 0x687
push str.ExecFileName
push str..If_Tray.c
push 3
call fcn.1014edc0
push ebp
push edi
push esi
push str.Execute___s__File:__s___Parameter__s_
push 0x687
push str.ExecFileName
push str..If_Tray.c
push 3
call fcn.1014f750
add esp, 0x40
push str.LoadDll
push esi
call fcn.1011a86d
add esp, 8
test eax, eax
jne 0x10019f8f
push 0x68c
push str.ExecFileName
push str..If_Tray.c
push 0x208
call fcn.1014adb0
push edi
mov esi, eax
push 0x104
push esi
call fcn.1014e1e0
push ebp
lea eax, [esi + 0x104]
push 0x104
push eax
call fcn.1014e1e0
add esp, 0x28
push 0
push 0
push esi
push 0x10019c70
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x1001a0ea
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x168]
xor ecx, esp
call fcn.1011a380
add esp, 0x16c
ret
push str.CreateProcess
push esi
call fcn.1011a86d
add esp, 8
test eax, eax
jne 0x1001a06c
push 0x40
push eax
lea ecx, [esp + 0x2c]
push ecx
call fcn.1011e8d0
xor eax, eax
push 0x103
push eax
lea edx, [esp + 0x7d]
push edx
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov byte [esp + 0x80], al
call fcn.1011e8d0
push ebp
push edi
lea eax, [esp + 0x88]
push 0x101ad06c
push eax
mov dword [esp + 0x48], 0x44
mov dword [esp + 0x74], 1
mov word [esp + 0x78], 5
call fcn.1011a63e
add esp, 0x28
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x24]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x88]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1001a0ea
mov ecx, dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call esi
mov eax, 1
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x168]
xor ecx, esp
call fcn.1011a380
add esp, 0x16c
ret
push 5
push 0
push ebp
push edi
push esi
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call edi
push eax
push esi
push str.ShellExecute_:_hInstance___d_Error___d
push 0x6c1
push str.ExecFileName
push str..If_Tray.c
push 2
call fcn.1014edc0
add esp, 0x1c
call edi
push eax
push esi
push str.ShellExecute_:_hInstance___d_Error___d
push 0x6c1
push str.ExecFileName
push str..If_Tray.c
push 2
call fcn.1014f750
mov eax, 0x20
add esp, 0x1c
cmp eax, esi
sbb eax, eax
neg eax
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x168]
xor ecx, esp
call fcn.1011a380
add esp, 0x16c
ret
mov ecx, dword [esp + 0x174]
pop edi
pop esi
pop ebp
xor ecx, esp
xor eax, eax
call fcn.1011a380
add esp, 0x16c
ret
Function at 0x1001dc00
Capabilities:
Access the windows event log

Disassembly:
sub esp, 0x10
mov eax, dword [0x101c1b88]
xor eax, esp
mov dword [esp + 0xc], eax
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push str.System
push ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
xor ebp, ebp
call dword [sym.imp.ADVAPI32.dll_OpenEventLogA]
mov edi, eax
cmp edi, ebx
mov dword [esp + 0x18], edi
jne 0x1001dc4b
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.1011a380
add esp, 0x10
ret
push 0x23f
push str.GetBootSecsSinceWinLog
push str..If_UpdateAgentInfo.cpp
push 0x10000
call fcn.1014adb0
mov esi, eax
add esp, 0x10
cmp esi, ebx
jne 0x1001dc74
xor ebp, ebp
jmp 0x1001dd2d
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0x10000
push esi
push ebx
push 9
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_ReadEventLogA]
call edi
test eax, eax
jne 0x1001dceb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1001dce7
mov edx, dword [esp + 0x10]
push 0x251
push str.GetBootSecsSinceWinLog
push str..If_UpdateAgentInfo.cpp
push edx
push esi
call fcn.1014acf0
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x1001dcc8
xor ebx, ebx
xor ebp, ebp
jmp 0x1001dd29
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push edx
push esi
push 0
push 8
push eax
call edi
test eax, eax
jne 0x1001dceb
xor ebx, ebx
jmp 0x1001dd0f
mov ecx, dword [esp + 0x14]
add ecx, esi
cmp esi, ecx
mov eax, esi
jae 0x1001dd11
test eax, eax
je 0x1001dd11
movzx edx, word [eax + 0x14]
cmp edx, 0x1e
je 0x1001dd0c
add eax, dword [eax]
cmp eax, ecx
jb 0x1001dcf7
jmp 0x1001dd11
mov ebx, dword [eax + 0xc]
xor ebp, ebp
push 0x287
push str.GetBootSecsSinceWinLog
push str..If_UpdateAgentInfo.cpp
push esi
call fcn.1014acc0
add esp, 0x10
mov edi, dword [esp + 0x18]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
mov edx, ebp
pop ebp
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.1011a380
add esp, 0x10
ret
Function at 0x1001de10
Capabilities:
Check os version

Disassembly:
sub esp, 0xdc
mov eax, dword [0x101c1b88]
xor eax, esp
mov dword [esp + 0xd4], eax
push esi
push edi
push 0x98
lea eax, [esp + 0x20]
push 0
push eax
call fcn.1011e8d0
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x1c], 0x9c
call esi
test eax, eax
jne 0x1001de62
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x1c], 0x94
call esi
xor eax, eax
cmp dword [esp + 0x1c], 6
mov byte [esp + 0xbc], 0
mov dword [esp + 0xbd], eax
mov dword [esp + 0xc1], eax
mov dword [esp + 0xc5], eax
mov dword [esp + 0xc9], eax
mov dword [esp + 0xcd], eax
mov dword [esp + 0xd1], eax
mov dword [esp + 0xd5], eax
mov word [esp + 0xd9], ax
mov byte [esp + 0xdb], al
jb 0x1001df57
cmp dword [esp + 0x20], 2
jb 0x1001df57
push 0x101adfc8
push 0x2b9
push str.FillSysInfo_SysBootTime
push str..If_UpdateAgentInfo.cpp
push 2
call fcn.1014edc0
add esp, 0x14
push 0x101adfc8
push 0x2b9
push str.FillSysInfo_SysBootTime
push str..If_UpdateAgentInfo.cpp
push 2
call fcn.1014f750
add esp, 0x14
call fcn.1001dc00
mov esi, eax
push 0
lea eax, [esp + 0xc]
push esi
push eax
call fcn.1014a390
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov edi, dword [eax + 8]
movzx eax, word [eax + 0xc]
add esp, 0xc
push eax
mov eax, edi
shr eax, 0x10
push eax
movzx eax, di
push eax
shr ecx, 0x10
push ecx
mov ecx, edx
shr ecx, 0x10
push ecx
movzx edx, dx
push edx
lea eax, [esp + 0xd4]
push 0x101a89fc
push eax
call fcn.1011a63e
add esp, 0x20
test esi, esi
jne 0x1001dfe2
push 0x101ae010
push 0x2c4
push str.FillSysInfo_SysBootTime
push str..If_UpdateAgentInfo.cpp
push 2
call fcn.1014edc0
add esp, 0x14
push 0x101ae010
push 0x2c4
push str.FillSysInfo_SysBootTime
push str..If_UpdateAgentInfo.cpp
push 2
call fcn.1014f750
add esp, 0x14
call fcn.1001dd50
push 0
push eax
lea ecx, [esp + 0x10]
push ecx
call fcn.1014a390
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov esi, dword [eax + 8]
movzx eax, word [eax + 0xc]
add esp, 0xc
push eax
mov eax, esi
shr eax, 0x10
push eax
movzx eax, si
push eax
shr ecx, 0x10
push ecx
mov ecx, edx
shr ecx, 0x10
push ecx
movzx edx, dx
push edx
lea eax, [esp + 0xd4]
push 0x101a89fc
push eax
call fcn.1011a63e
add esp, 0x20
lea ecx, [esp + 0xbc]
push ecx
push 0x101ae034
push 0x2cc
push str.FillSysInfo_SysBootTime
push str..If_UpdateAgentInfo.cpp
push 2
call fcn.1014edc0
lea edx, [esp + 0xd4]
push edx
push 0x101ae034
push 0x2cc
push str.FillSysInfo_SysBootTime
push str..If_UpdateAgentInfo.cpp
push 2
call fcn.1014f750
push str.ASM_SysBootTime
lea eax, [esp + 0xf0]
push eax
push ebx
call fcn.1015b4a0
mov ecx, dword [esp + 0x118]
add esp, 0x3c
pop edi
pop esi
xor ecx, esp
call fcn.1011a380
add esp, 0xdc
ret
Function at 0x10020d20
Capabilities:
Get domain information

Disassembly:
sub esp, 8
push esi
lea eax, [esp + 4]
push eax
push 1
push 0
mov dword [esp + 0x10], 0
call sub.NETAPI32.dll_DsRoleGetPrimaryDomainInformation
mov esi, eax
test esi, esi
je 0x10020d82
push esi
push str._IsiIsInDomain__DsRoleGetPrimaryDomainInformation:__u
push 0x695
push 0x101aebac
push str..If_UpdateAgentInfo.cpp
push 2
call fcn.1014edc0
push esi
push str._IsiIsInDomain__DsRoleGetPrimaryDomainInformation:__u
push 0x695
push 0x101aebac
push str..If_UpdateAgentInfo.cpp
push 2
call fcn.1014f750
add esp, 0x30
xor eax, eax
pop esi
add esp, 8
ret
mov eax, dword [esp + 4]
cmp dword [eax + 0xc], 0
jne 0x10020dcc
push str._IsiIsInDomain__DomainNameDns_is_NULL
push 0x69b
push 0x101aebac
push str..If_UpdateAgentInfo.cpp
push 2
call fcn.1014edc0
push str._IsiIsInDomain__DomainNameDns_is_NULL
push 0x69b
push 0x101aebac
push str..If_UpdateAgentInfo.cpp
push 2
call fcn.1014f750
add esp, 0x28
xor eax, eax
pop esi
add esp, 8
ret
mov ecx, dword [eax + 8]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push edi
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ecx
push 0
push 0
call ebp
mov edi, eax
test edi, edi
jle 0x10020e92
push 0x6a5
push 0x101aebac
lea ebx, [edi + 1]
push str..If_UpdateAgentInfo.cpp
push ebx
call fcn.1014adb0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10020e92
mov edx, dword [esp + 0x10]
mov eax, dword [edx + 8]
push 0
push 0
push edi
push esi
push 0xffffffffffffffff
push eax
push 0
push 0
call ebp
push esi
mov esi, dword [esp + 0x20]
push ebx
push esi
call fcn.1014e1e0
mov eax, esi
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x10020e42
sub eax, edx
jne 0x10020e92
push str._IsiIsInDomain__DomainNameDns_is_NULL
push 0x6ac
push 0x101aebac
push str..If_UpdateAgentInfo.cpp
push 2
call fcn.1014edc0
push str._IsiIsInDomain__DomainNameDns_is_NULL
push 0x6ac
push 0x101aebac
push str..If_UpdateAgentInfo.cpp
push 2
call fcn.1014f750
add esp, 0x28
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
add esp, 8
ret
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
add esp, 8
ret
Function at 0x10022120
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
sub esp, 0x20c
mov eax, dword [0x101c1b88]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
push ebp
push edi
push 0x103
lea eax, [esp + 0x11]
push 0
push eax
mov byte [esp + 0x18], 0
call fcn.1011e8d0
push 0x103
lea ecx, [esp + 0x121]
push 0
push ecx
mov byte [esp + 0x128], 0
call fcn.1011e8d0
add esp, 0x18
xor edi, edi
cmp byte [esi + 1], 0x3a
jne 0x10022191
push 0x103
push esi
lea edx, [esp + 0x14]
push 0x104
push edx
call fcn.1011ab29
add esp, 0x10
jmp 0x10022272
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea ecx, [ecx]
test edi, edi
jne 0x100221b5
lea eax, [esp + 0x110]
push eax
push 0x104
call ebx
jmp 0x100221dd
cmp edi, 1
push 0x104
jne 0x100221cf
lea ecx, [esp + 0x114]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x100221dd
lea edx, [esp + 0x114]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x2e
push esi
call fcn.1011c8e8
add esp, 8
test eax, eax
push esi
je 0x10022206
lea eax, [esp + 0x114]
push eax
push 0x101a864c
push 0x104
lea ecx, [esp + 0x1c]
push ecx
jmp 0x1002221d
lea edx, [esp + 0x114]
push edx
push str._s_s.exe
push 0x104
lea eax, [esp + 0x1c]
push eax
call fcn.1011a6b9
add esp, 0x14
push esi
push str.IsFileExit__s
push 0x5a
push str.IsWin32Console
push str..If_WebCall.c
push 2
call fcn.1014edc0
push esi
push str.IsFileExit__s
push 0x5a
push str.IsWin32Console
push str..If_WebCall.c
push 2
call fcn.1014f750
add esp, 0x30
lea ecx, [esp + 0xc]
push ecx
call ebp
cmp eax, 0xffffffff
jne 0x10022272
add edi, 1
cmp edi, 3
jl 0x100221a0
lea edx, [esp + 0xc]
push edx
call fcn.10151ee0
xor ecx, ecx
add esp, 4
cmp eax, 3
sete cl
pop edi
pop ebp
pop ebx
mov eax, ecx
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.1011a380
add esp, 0x20c
ret
Function at 0x100243c0
Capabilities:
Create thread

Disassembly:
push 0x10024480
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
cmp dword [0x101d8f40], 0
jne 0x100243e8
call fcn.1014b3e0
mov dword [0x101d8f44], eax
mov dword [0x101d8f40], 1
cmp dword [0x101d8f44], 0
push 0
push 0
push 0
je 0x100243fe
push 0x100010b0
jmp 0x10024403
push 0x10001430
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
ret

Function at 0x10024420
Capabilities:
Terminate thread

Disassembly:
push str.SmpAgent_system_is_Cleanup...
push 0x191
push str.Cleanup_In_System
push str..AgentStart.c
push 3
call fcn.1014edc0
push str.SmpAgent_system_is_Cleanup...
push 0x191
push str.Cleanup_In_System
push str..AgentStart.c
push 3
call fcn.1014f750
add esp, 0x28
call fcn.10006750
call fcn.10028800
call fcn.10028b60
jmp 0x100279a0
push ecx
push str.SmpAgent_user_is_Cleanup...
push 0x2c0
push str.Cleanup_In_User
push str..AgentStart.c
push 3
call fcn.1014edc0
push str.SmpAgent_user_is_Cleanup...
push 0x2c0
push str.Cleanup_In_User
push str..AgentStart.c
push 3
call fcn.1014f750
mov eax, dword [0x101d8f38]
add esp, 0x28
test eax, eax
je 0x10001f12
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [0x101d8f38]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x101d8f38], 0
call fcn.10006750
lea ecx, [esp]
push ecx
push str.SetupMode
push 0x101a721a
mov dword [esp + 0xc], 0
call sym.IsaManage.dll_IsiReadDbEx_l
test eax, eax
jl 0x10001f56
cmp dword [esp], 0
jne 0x10001f56
push str.WidgetMode
push 0x101a721a
call sym.IsaManage.dll_IsiReadDb_l
add esp, 8
add esp, 4
jmp 0x100279a0
call fcn.100175d0
add esp, 4
jmp 0x100279a0
cmp dword [0x101d8f40], 0
jne 0x1002443d
call fcn.1014b3e0
mov dword [0x101d8f44], eax
mov dword [0x101d8f40], 1
cmp dword [0x101d8f44], 0
je 0x1002444b
jmp 0x100013e0
jmp 0x10001eb0
push 0x101b04cc
push 0x44
push str.D_CleanupVaMgr
push str..IsaVaMgr_Interface.c
push 3
call fcn.1014edc0
push 0x101b04cc
push 0x44
push str.D_CleanupVaMgr
push str..IsaVaMgr_Interface.c
push 3
call fcn.1014f750
mov eax, dword [0x101d984c]
add esp, 0x28
test eax, eax
je 0x10027a1f
push str.CleanupVaMgr
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x10027a03
mov eax, dword [0x101d984c]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x101d984c], 0
ret
call eax
mov eax, dword [0x101d984c]
test eax, eax
je 0x10027a1f
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x101d984c], 0
ret
Function at 0x100246a0
Capabilities:
Create thread

Disassembly:
sub esp, 0x128
mov eax, dword [0x101c1b88]
xor eax, esp
mov dword [esp + 0x124], eax
push esi
push 0x103
lea eax, [esp + 0x29]
push 0
push eax
mov byte [esp + 0x30], 0
call fcn.1011e8d0
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
add esp, 0xc
push 0x101daa80
call esi
push 0x101daa60
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea ecx, [esp + 0x28]
push str..pipeISA_SESSION__u
push ecx
call fcn.1011a63e
push 0xffffffffffffffff
lea edx, [esp + 0x34]
push 0x2800
push edx
call fcn.10145360
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x10024761
push str._Network__wait_for_pipe_connect_failed
push 0xa4
push str.InitNetwork
push str..IsaNetwork.c
push 1
call fcn.1014edc0
push str._Network__wait_for_pipe_connect_failed
push 0xa4
push str.InitNetwork
push str..IsaNetwork.c
push 1
call fcn.1014f750
add esp, 0x28
pop esi
mov ecx, dword [esp + 0x124]
xor ecx, esp
call fcn.1011a380
add esp, 0x128
ret
push str._Network__Network_Pipe_is_Connected
push 0xa8
push str.InitNetwork
push str..IsaNetwork.c
push 3
call fcn.1014edc0
push str._Network__Network_Pipe_is_Connected
push 0xa8
push str.InitNetwork
push str..IsaNetwork.c
push 3
call fcn.1014f750
add esp, 0x28
cmp dword [0x101d983c], 0
mov dword [0x101d9834], esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
jne 0x100247c5
push 0
push 0
push 0
push 0x10026080
push 0
push 0
call esi
mov dword [0x101d983c], eax
push 0
push 0
push 0
push 0x10025530
push 0
push 0
call esi
cmp dword [0x101d8f40], 0
jne 0x100247f3
call fcn.1014b3e0
mov dword [0x101d8f44], eax
mov dword [0x101d8f40], 1
cmp dword [0x101d8f44], 0
je 0x1002481b
cmp dword [0x101d9848], 0
jne 0x1002481b
push 0
push 0
push 0
push 0x10027380
push 0
push 0
call esi
mov dword [0x101d9848], eax
cmp dword [0x101d9844], 0
jne 0x10024873
push 1
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push str.GlobalSMP_Network_Changed_Event
push 0
push 1
lea eax, [esp + 0x10]
lea edx, [esp + 0x1c]
push eax
mov dword [esp + 0x14], 0xc
mov dword [esp + 0x1c], 1
mov dword [esp + 0x18], edx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x101d9844], eax
mov ecx, dword [esp + 0x128]
pop esi
xor ecx, esp
call fcn.1011a380
add esp, 0x128
ret
Function at 0x100260c0
Capabilities:
Get local ipv4 addresses

Disassembly:
sub esp, 0xc
mov eax, dword [0x101c1b88]
xor eax, esp
mov dword [esp + 8], eax
test edi, edi
mov dword [esp], 0
jne 0x10026121
push 0x101afe44
push 0x3f9
push str.GetAllIPInfo
push str..IsaNetwork.c
push 1
call fcn.1014edc0
push 0x101afe44
push 0x3f9
push str.GetAllIPInfo
push str..IsaNetwork.c
push 1
call fcn.1014f750
add esp, 0x28
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.1011a380
add esp, 0xc
ret
lea eax, [esp]
push eax
push 0
call sub.iphlpapi.dll_GetAdaptersInfo
cmp eax, 0x6f
jne 0x100261ca
mov ecx, dword [esp]
push ebx
push 0x401
push str.GetAllIPInfo
push str..IsaNetwork.c
push ecx
call fcn.1014adb0
add esp, 0x10
lea edx, [esp + 4]
mov ebx, eax
push edx
push ebx
call sub.iphlpapi.dll_GetAdaptersInfo
test ebx, ebx
je 0x100261c9
test eax, eax
jne 0x100261b1
push esi
mov esi, ebx
lea esp, [esp]
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x10026175
sub eax, edx
je 0x10026195
push 0x101afe78
push 0x200
push edi
call fcn.1014e0f0
add esp, 0xc
lea eax, [esi + 0x1b0]
push eax
push 0x200
push edi
call fcn.1014e0f0
mov esi, dword [esi]
add esp, 0xc
test esi, esi
jne 0x10026170
pop esi
push 0x413
push str.GetAllIPInfo
push str..IsaNetwork.c
push ebx
call fcn.1014acc0
add esp, 0x10
pop ebx
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.1011a380
add esp, 0xc
ret
Function at 0x10029030
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x101c1b88]
xor eax, esp
mov dword [esp + 0x190], eax
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x10029080
mov ax, word [esp]
cmp al, 2
jne 0x1002907a
cmp ah, al
jne 0x1002907a
xor eax, eax
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.1011a380
add esp, 0x194
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x190]
xor ecx, esp
mov eax, 2
call fcn.1011a380
add esp, 0x194
ret
Function at 0x100381f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x10038222
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2733
neg eax
sbb eax, eax
and eax, 0xffffffe7
add eax, 0x51
ret
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
xor eax, eax
ret

Function at 0x10038350
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
xor edi, edi
cmp dword [esi + 0x1e0], edi
je 0x10038399
push 1
push esi
call fcn.100361c0
mov eax, dword [esi + 0x16c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 0x1c]
push ecx
mov ecx, dword [esi + 0x1e0]
push edx
push eax
push esi
call ecx
push 0
push esi
mov edi, eax
call fcn.100361c0
add esp, 0x24
mov eax, edi
pop edi
pop esi
ret
mov eax, dword [esp + 0x10]
test eax, eax
jl 0x100383d9
cmp eax, 2
jg 0x100383d9
mov edx, dword [esi + 0x168]
push edx
push 1
lea eax, [eax + eax*2 + 0x1015f898]
push 2
push eax
call fcn.1011f045
mov ecx, dword [esi + 0x168]
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
push ecx
push 1
push edx
push eax
call fcn.1011f045
add esp, 0x20
mov eax, edi
pop edi
pop esi
ret

Function at 0x100388b0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov ecx, dword [ebx + 0x350]
push ebp
mov ebp, dword [ebx + eax*4 + 0x1a8]
push esi
lea esi, [eax + 0x1d]
shl esi, 4
add esi, ebx
push edi
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [ecx + 0x40], 3
je 0x1003894f
cmp dword [ebx + eax*4 + 0x1c0], 0x10038620
jne 0x1003894f
cmp dword [esi], 0
je 0x100388ea
test edi, edi
je 0x1003894f
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebp
call fcn.1002d0b0
add esp, 0x14
cmp eax, 0xffffffff
je 0x1003894f
test al, 1
je 0x1003894f
cmp dword [esi], 0
jne 0x10038931
mov edx, dword [ebx]
mov eax, dword [edx + 0x508]
add eax, eax
push eax
mov dword [esi + 4], eax
call dword [section..data]
mov edi, dword [esi + 4]
xor ecx, ecx
add esp, 4
cmp eax, ecx
mov dword [esi], eax
mov dword [esi + 8], ecx
mov dword [esi + 0xc], ecx
je 0x1003894c
mov eax, dword [esi]
add eax, dword [esi + 8]
push 0
push edi
push eax
push ebp
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x1003894f
add dword [esi + 8], eax
pop edi
pop esi
pop ebp
ret
mov dword [esi + 4], ecx
pop edi
pop esi
pop ebp
ret
Function at 0x10038960
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, dword [ebx + eax*4 + 0x1a8]
push edi
call fcn.100388b0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push 0
push eax
push ecx
push esi
call dword [sym.imp.WS2_32.dll_send]
mov edi, dword [esp + 0x20]
mov esi, eax
cmp esi, 0xffffffff
mov dword [edi], 0
jne 0x100389e2
push ebp
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebp, eax
cmp ebp, 0x2733
jne 0x100389b9
pop ebp
mov dword [edi], 0x51
pop edi
pop esi
xor eax, eax
pop ebx
ret
push ebp
push ebx
call fcn.10029aa0
mov edx, dword [ebx]
push eax
push str.Send_failure:__s
push edx
call fcn.10038470
mov eax, dword [ebx]
mov dword [eax + 0x4988], ebp
add esp, 0x14
mov dword [edi], 0x37
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x1003ad80
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 0xc]
push eax
call fcn.1003ad70
add esp, 4
mov dword [esp + 0xc], eax
jmp fcn.1012ab52

Function at 0x1003b140
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + eax]
cmp esi, edi
mov ebx, 0x1505
jae 0x1003b132
movzx eax, byte [esi]
push eax
call fcn.1003f500
mov edx, ebx
shl edx, 5
movsx ecx, al
add edx, ebx
xor ecx, edx
add esi, 1
add esp, 4
cmp esi, edi
mov ebx, ecx
jb 0x1003b111
pop edi
pop esi
movzx eax, bl
pop ebx
ret
push ecx
push esi
mov esi, eax
test esi, esi
je 0x1003b16f
mov ecx, esi
call fcn.1003af70
test eax, eax
jne 0x1003b16f
lea eax, [esp + 4]
push eax
call fcn.1003b090
add esp, 4
mov ecx, eax
mov eax, dword [esp + 4]
pop esi
add esp, 4
jmp 0x1003b100
xor eax, eax
pop esi
pop ecx
ret

Function at 0x1003ca20
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x14
xor eax, eax
cmp dword [esi + 0x6f8], eax
push 4
lea ecx, [esp + 4]
push ecx
setne al
push 8
push 0xffff
push edi
mov dword [esp + 0x14], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jge 0x1003ca5e
push edi
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
push esi
call fcn.100383e0
add esp, 0xc
add esp, 0x14
ret
mov edx, dword [esi + 0x6fc]
push edx
mov dword [esp + 0xc], 1
call fcn.1003ad60
imul eax, eax, 0x3e8
mov dword [esp + 4], eax
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x700]
push eax
call fcn.1003ad60
imul eax, eax, 0x3e8
add esp, 8
push 0
push 0
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 0xc
lea edx, [esp + 0x20]
push edx
push 0x98000004
push edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x34], eax
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x1003cad7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
push esi
call fcn.100383e0
add esp, 0x10
add esp, 0x14
ret