joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10036090
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1012e8d8
push eax
mov dword fs:[0], esp
sub esp, 0x2c
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jne 0x100360c6
call fcn.10035f30
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
add esp, 0x38
ret
push ebx
push esi
push edi
lea ecx, [esp + 0x28]
call fcn.1006cb70
mov dword [esp + 0x40], 0
mov dword [esp + 0x14], 8
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], str.SYSTEMCurrentControlSetControlWindows
mov byte [esp + 0x40], 1
push 0
push 0
lea eax, [esp + 0x20]
push eax
push connect
lea ecx, [esp + 0x38]
call fcn.1006cf60
mov byte [esp + 0x40], 0
mov eax, dword [esp + 0x18]
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
je 0x10036144
mov esi, dword [eax]
sub esi, 8
lea ecx, [esi + 4]
push ecx
mov ebx, eax
call edi
test eax, eax
jg 0x1003613b
push esi
call fcn.100569b3
add esp, 4
push ebx
call fcn.101209d7
add esp, 4
mov ecx, dword [esp + 0x34]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x24]
push eax
push 0
push 0
push str.ShutdownTime
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
test esi, esi
push 0
je 0x100361c9
lea ecx, [esp + 0x14]
call fcn.10001520
mov bl, 2
mov byte [esp + 0x40], bl
lea edx, [esp + 0x18]
push esi
push edx
call fcn.1006e5c0
add esp, 8
mov byte [esp + 0x40], 3
push eax
lea ecx, [esp + 0x14]
call fcn.10007e70
mov byte [esp + 0x40], bl
mov esi, dword [esp + 0x18]
add esi, 0xfffffff8
lea eax, [esi + 4]
push eax
call edi
test eax, eax
jg 0x100361b4
push esi
call fcn.100569b3
add esp, 4
mov byte [esp + 0x40], 0
mov esi, dword [esp + 0x10]
add esi, 0xfffffff8
lea ecx, [esi + 4]
push ecx
jmp 0x10036263
lea ecx, [esp + 0x10]
call fcn.10001520
mov byte [esp + 0x40], 4
lea edx, [esp + 0xc]
push edx
push str.LastActiveTime
call fcn.10012070
add esp, 8
test al, al
jne 0x100361fe
mov byte [esp + 0x40], al
mov esi, dword [esp + 0xc]
add esi, 0xfffffff8
lea eax, [esi + 4]
push eax
jmp 0x10036263
mov ecx, dword [esp + 0xc]
push ecx
call fcn.100172d0
mov esi, dword [esp + 0x28]
add esp, 4
cmp esi, edx
jl 0x10036253
mov ecx, dword [esp + 0x20]
jg 0x1003621d
cmp ecx, eax
jbe 0x10036253
sub ecx, eax
sbb esi, edx
cmp esi, 4
jl 0x10036253
jg 0x10036230
cmp ecx, 0x30e23400
jbe 0x10036253
push 0x10137b20
push str.CPM_stopped_more_than_30_minutes_before_system_shutdown
push 0x1013a658
call fcn.10018a30
push 0
push str.CPM_stopped_more_than_30_minutes_before_system_shutdown
call fcn.10010990
add esp, 0x14
mov byte [esp + 0x40], 0
mov esi, dword [esp + 0xc]
add esi, 0xfffffff8
lea edx, [esi + 4]
push edx
call edi
test eax, eax
jg 0x10036272
push esi
call fcn.100569b3
add esp, 4
mov dword [esp + 0x40], 0xffffffff
lea ecx, [esp + 0x28]
call fcn.1006ce30
mov ecx, dword [esp + 0x38]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret
Function at 0x100364d0
Capabilities:
Get hostname
Resolve dns

Disassembly:
push 0xffffffffffffffff
push 0x1012e95b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x110
mov eax, dword [0x10194180]
mov dword [esp + 0x10c], eax
push 0x100
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [esp + 8], eax
mov eax, dword [eax + 0xc]
cmp dword [eax], 0
je 0x1003662c
push ebx
mov ebx, dword [esp + 0x124]
push ebp
push esi
push edi
mov dword [esp + 0x14], 0
mov edx, dword [esp + 0x14]
mov eax, dword [edx + eax]
mov eax, dword [eax]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov esi, eax
xor ebp, ebp
test esi, esi
je 0x1003655c
mov ebp, esi
lea ecx, [ebp + 1]
mov al, byte [ebp]
inc ebp
test al, al
jne 0x10036552
sub ebp, ecx
push ebp
lea ecx, [esp + 0x14]
call fcn.10001520
mov eax, dword [esp + 0x10]
mov ecx, ebp
mov edx, ecx
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [eax + ebp], 0
mov dword [esp + 0x128], 0
mov eax, dword [ebx + 4]
test eax, eax
jne 0x10036596
xor edx, edx
jmp 0x1003659e
mov edx, dword [ebx + 8]
sub edx, eax
sar edx, 2
test eax, eax
je 0x100365cf
mov ecx, dword [ebx + 0xc]
sub ecx, eax
sar ecx, 2
cmp edx, ecx
jae 0x100365cf
mov eax, dword [esp + 0x18]
mov esi, dword [ebx + 8]
push eax
push ebx
lea ecx, [esp + 0x18]
push ecx
push 1
push esi
call fcn.1000f140
add esp, 0x14
add esi, 4
mov dword [ebx + 8], esi
jmp 0x100365e1
mov eax, dword [ebx + 8]
lea edx, [esp + 0x10]
push edx
push 1
push eax
mov ecx, ebx
call fcn.1000fa20
mov dword [esp + 0x128], 0xffffffff
mov esi, dword [esp + 0x10]
add esi, 0xfffffff8
lea eax, [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x1003660a
push esi
call fcn.100569b3
add esp, 4
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov eax, dword [edx + 0xc]
mov edx, dword [ecx + eax + 4]
add ecx, 4
test edx, edx
mov dword [esp + 0x14], ecx
jne 0x10036535
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x110]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x10c]
call fcn.100571c6
add esp, 0x11c
ret
Function at 0x10039f40
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x10039f4b
xor eax, eax
ret
push ebp
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x18]
cmp edi, 8
not esi
jb 0x1003a043
mov ebp, edi
shr ebp, 3
xor edx, edx
mov dl, byte [ecx]
mov eax, esi
shr eax, 8
sub edi, 8
xor edx, esi
and edx, 0xff
mov esi, dword [edx*4 + 0x1013d670]
xor edx, edx
mov dl, byte [ecx + 1]
xor eax, esi
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x1013d670]
xor edx, edx
mov dl, byte [ecx + 1]
shr eax, 8
xor eax, esi
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x1013d670]
xor edx, edx
mov dl, byte [ecx + 1]
shr eax, 8
xor eax, esi
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x1013d670]
xor edx, edx
mov dl, byte [ecx + 1]
shr eax, 8
xor eax, esi
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x1013d670]
shr eax, 8
xor eax, esi
xor edx, edx
mov dl, byte [ecx + 1]
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x1013d670]
shr eax, 8
xor eax, esi
xor edx, edx
mov dl, byte [ecx + 1]
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x1013d670]
shr eax, 8
xor eax, esi
xor edx, edx
mov dl, byte [ecx + 1]
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x1013d670]
shr eax, 8
xor eax, esi
inc ecx
dec ebp
mov esi, eax
jne 0x10039f66
test edi, edi
je 0x1003a062
xor eax, eax
mov al, byte [ecx]
xor eax, esi
and eax, 0xff
mov ebp, dword [eax*4 + 0x1013d670]
shr esi, 8
xor esi, ebp
inc ecx
dec edi
jne 0x1003a047
pop edi
mov eax, esi
pop esi
not eax
pop ebp
ret

Function at 0x1003a070
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov edx, dword [esp + 4]
mov ecx, dword [edx]
xor eax, eax
mov al, byte [esp + 8]
push esi
xor eax, ecx
and eax, 0xff
mov eax, dword [eax*4 + 0x1013d670]
shr ecx, 8
xor eax, ecx
mov ecx, dword [edx + 4]
mov dword [edx], eax
and eax, 0xff
add eax, ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
mov esi, dword [eax*4 + 0x1013d670]
shr ecx, 8
xor ecx, esi
mov dword [edx + 8], ecx
pop esi
ret

Function at 0x1003a0d0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov edx, dword [esp + 4]
mov ecx, dword [edx + 8]
push ebx
movsx ebx, byte [esp + 0xc]
push esi
push edi
mov edi, dword [edx]
mov eax, edi
xor eax, ebx
and eax, 0xff
mov eax, dword [eax*4 + 0x1013d670]
shr edi, 8
xor eax, edi
mov edi, dword [edx + 4]
mov dword [edx], eax
and eax, 0xff
add eax, edi
imul eax, eax, 0x8088405
mov esi, ecx
and esi, 0xfffd
or esi, 2
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
mov edi, dword [eax*4 + 0x1013d670]
mov eax, esi
xor eax, 1
imul eax, esi
shr ecx, 8
xor ecx, edi
pop edi
shr eax, 8
pop esi
xor eax, ebx
mov dword [edx + 8], ecx
pop ebx
ret
Function at 0x1003a290
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
sub esp, 0x48
push esi
mov esi, dword [esp + 0x50]
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x1003a2b2
mov eax, 0x200
pop esi
add esp, 0x48
ret
mov eax, dword [esp + 0x18]
push ebx
push ebp
mov edx, eax
xor ebp, ebp
and edx, 1
push edi
je 0x1003a2c7
mov ebp, 1
test al, 2
je 0x1003a2ce
or ebp, 2
test al, 4
je 0x1003a2d5
or ebp, 4
mov ecx, eax
and ecx, 0x10
je 0x1003a2df
or ebp, 0x10
test al, 0x20
je 0x1003a2e6
or ebp, 0x20
test ecx, ecx
je 0x1003a2f2
or ebp, 0x40000000
jmp 0x1003a2f8
or ebp, 0x80000000
or ebp, 0x1000000
test edx, edx
jne 0x1003a308
or ebp, 0x800000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x28
mov dword [esp + 0x14], eax
jbe 0x1003a3b5
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push 0
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea ecx, [esp + 0x1c]
push ecx
push 2
lea edx, [esp + 0x1c]
push edx
push esi
call ebx
push 0
push 0
push 0x24
push esi
call edi
push 0
lea eax, [esp + 0x1c]
push eax
push 4
lea ecx, [esp + 0x28]
push ecx
push esi
call ebx
cmp word [esp + 0x10], 0x54ad
jne 0x1003a3b5
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
lea edx, [eax + 0x34]
cmp ecx, edx
jbe 0x1003a3b5
push 0
push 0
push eax
push esi
call edi
push 0
lea eax, [esp + 0x1c]
push eax
push 4
lea ecx, [esp + 0x2c]
push ecx
push esi
call ebx
mov eax, dword [esp + 0x20]
cmp eax, 0x5a4d
je 0x1003a3af
cmp eax, 0x454e
je 0x1003a3af
cmp eax, 0x454c
je 0x1003a3af
cmp eax, 0x4550
jne 0x1003a3b5
or ebp, 0x400000
mov eax, dword [esp + 0x60]
test eax, eax
je 0x1003a3bf
mov dword [eax], ebp
mov eax, dword [esp + 0x64]
test eax, eax
je 0x1003a3cd
mov edx, dword [esp + 0x14]
mov dword [eax], edx
mov esi, dword [esp + 0x68]
test esi, esi
mov edi, dword [esp + 0x3c]
mov ebx, dword [esp + 0x38]
je 0x1003a44e
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
push 0
sub eax, 0xd53e8000
push 0x989680
sbb ecx, 0x19db1de
push ecx
push eax
call fcn.100593c0
mov dword [esi + 4], edx
mov dword [esi], eax
push 0
mov edx, ebx
sub edx, 0xd53e8000
mov eax, edi
push 0x989680
sbb eax, 0x19db1de
push eax
push edx
call fcn.100593c0
mov ecx, dword [esp + 0x28]
mov dword [esi + 0xc], edx
mov edx, dword [esp + 0x2c]
push 0
sub ecx, 0xd53e8000
push 0x989680
sbb edx, 0x19db1de
push edx
push ecx
mov dword [esi + 8], eax
call fcn.100593c0
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
mov esi, dword [esp + 0x6c]
test esi, esi
je 0x1003a47b
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
push edi
push ebx
call fcn.1003a220
movzx edx, word [esp + 0x20]
movzx eax, word [esp + 0x24]
shl edx, 0x10
add esp, 0x10
or edx, eax
mov dword [esi], edx
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
add esp, 0x48
ret
Function at 0x1003a660
Capabilities:
Write file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
mov ebx, ecx
mov al, byte [ebx + 0x2d]
test al, al
push esi
mov esi, dword [esp + 0x10]
push edi
je 0x1003a6e7
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x1003a691
cmp dword [ebx + 0x40], ebp
jae 0x1003a691
push eax
call fcn.101209d7
add esp, 4
mov dword [ebx + 0x3c], 0
mov eax, dword [ebx + 0x3c]
test eax, eax
jne 0x1003a6ab
lea eax, [ebp + ebp]
push eax
call fcn.101209d2
add esp, 4
mov dword [ebx + 0x3c], eax
mov dword [ebx + 0x40], ebp
mov edi, dword [ebx + 0x3c]
mov ecx, ebp
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor esi, esi
test ebp, ebp
jbe 0x1003a6e4
lea edi, [ebx + 0x30]
mov eax, dword [ebx + 0x3c]
xor ecx, ecx
mov cl, byte [esi + eax]
push ecx
push edi
call fcn.1003a0d0
mov edx, dword [ebx + 0x3c]
add esp, 8
mov byte [esi + edx], al
inc esi
cmp esi, ebp
jb 0x1003a6c7
mov esi, dword [ebx + 0x3c]
mov edx, dword [ebx + 0x20]
test edx, edx
je 0x1003a72f
mov eax, dword [ebx + 0x24]
mov edi, dword [ebx + 0x28]
lea ecx, [eax + ebp]
cmp ecx, edi
jb 0x1003a70b
pop edi
pop esi
pop ebp
mov dword [ebx + 0x14], 0x30000
xor eax, eax
pop ebx
ret 8
lea edi, [eax + edx]
mov ecx, ebp
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 0x24]
add eax, ebp
pop edi
mov dword [ebx + 0x24], eax
pop esi
mov eax, ebp
pop ebp
pop ebx
ret 8
mov eax, dword [ebx + 4]
test eax, eax
je 0x1003a751
push 0
lea ecx, [esp + 0x18]
push ecx
push ebp
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
ret 8
pop edi
pop esi
pop ebp
mov dword [ebx + 0x14], 0x1000000
xor eax, eax
pop ebx
ret 8
Function at 0x1003aae0
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, ecx
mov edx, dword [ebx + 0x84]
test edx, edx
push esi
push edi
je 0x1003ab5e
mov eax, dword [ebx + 0x8c]
push ebp
mov ebp, dword [ebx + 0x88]
cmp eax, ebp
jb 0x1003ab09
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
ret 8
mov ecx, dword [esp + 0x18]
sub ebp, eax
cmp ebp, ecx
jbe 0x1003ab15
mov ebp, ecx
lea esi, [eax + edx]
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov edx, ecx
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, dword [ebx + 0x8c]
mov ecx, dword [ebx + 0x74]
push ebp
push eax
mov eax, dword [ebx + 0x78]
add edx, ebp
add ecx, ebp
push eax
mov dword [ebx + 0x8c], edx
mov dword [ebx + 0x74], ecx
call fcn.10039f40
add esp, 0xc
mov dword [ebx + 0x78], eax
mov eax, ebp
pop ebp
pop edi
pop esi
pop ebx
ret 8
mov eax, dword [ebx + 0x7c]
test eax, eax
je 0x1003aba6
mov edx, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
push 0
lea ecx, [esp + 0x18]
push ecx
push edx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1003abad
mov esi, dword [esp + 0x14]
mov ecx, dword [ebx + 0x74]
mov eax, dword [ebx + 0x78]
push esi
add ecx, esi
push edi
push eax
mov dword [ebx + 0x74], ecx
call fcn.10039f40
add esp, 0xc
mov dword [ebx + 0x78], eax
pop edi
mov eax, esi
pop esi
pop ebx
ret 8
mov dword [ebx + 0x14], 0x1000000
pop edi
pop esi
xor eax, eax
pop ebx
ret 8
Function at 0x1003bd20
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi + 0x6af90]
push edi
xor ebx, ebx
xor edi, edi
test eax, eax
mov dword [esi + 0x6af80], 2
je 0x1003bf3e
cmp dword [esi + 0x6af90], 3
jb 0x1003bd97
mov ecx, dword [esi + 0x6af84]
movzx eax, byte [ecx + esi + 0x1af72]
mov edx, dword [esi + 0x6af7c]
shl edx, 5
xor eax, edx
and eax, 0x7fff
mov dword [esi + 0x6af7c], eax
mov ebx, dword [esi + eax*4 + 0x4af70]
and ecx, 0x7fff
mov dword [esi + ecx*4 + 0x2af70], ebx
mov eax, dword [esi + 0x6af7c]
mov ecx, dword [esi + 0x6af84]
mov dword [esi + eax*4 + 0x4af70], ecx
test ebx, ebx
je 0x1003bdd7
mov edx, dword [esi + 0x6af84]
sub edx, ebx
cmp edx, 0x7efa
ja 0x1003bdd7
mov eax, dword [esi + 0x6af90]
cmp dword [esi + 0x6afa0], eax
jbe 0x1003bdbf
mov dword [esi + 0x6afa0], eax
push ebx
push esi
call fcn.10039350
mov edi, eax
mov eax, dword [esi + 0x6af90]
add esp, 8
cmp edi, eax
jbe 0x1003bdd7
mov edi, eax
cmp edi, 3
jb 0x1003beb4
mov ecx, dword [esi + 0x6af84]
lea eax, [edi - 3]
push eax
sub ecx, dword [esi + 0x6af88]
push ecx
push esi
call fcn.10038d90
mov ecx, dword [esi + 0x6af90]
mov edx, dword [esi + 0x6af98]
sub ecx, edi
add esp, 0xc
cmp edi, edx
mov dword [esi + 0x6af90], ecx
ja 0x1003be7a
cmp ecx, 3
jb 0x1003be7a
dec edi
jmp 0x1003be20
mov ecx, dword [esi + 0x6af84]
mov ebx, dword [esi + 0x6af7c]
inc ecx
mov dword [esi + 0x6af84], ecx
mov edx, ecx
movzx ecx, byte [esi + edx + 0x1af72]
shl ebx, 5
xor ecx, ebx
and ecx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov ebx, dword [esi + ecx*4 + 0x4af70]
and edx, 0x7fff
dec edi
mov dword [esi + edx*4 + 0x2af70], ebx
mov edx, dword [esi + 0x6af7c]
mov ecx, dword [esi + 0x6af84]
mov dword [esi + edx*4 + 0x4af70], ecx
jne 0x1003be20
jmp 0x1003bedb
mov edx, dword [esi + 0x6af84]
add edx, edi
mov dword [esi + 0x6af84], edx
movzx ecx, byte [edx + esi + 0x1af70]
add edx, esi
mov dword [esi + 0x6af7c], ecx
movzx edx, byte [edx + 0x1af71]
shl ecx, 5
xor edx, ecx
xor edi, edi
and edx, 0x7fff
mov dword [esi + 0x6af7c], edx
jmp 0x1003bee1
mov eax, dword [esi + 0x6af84]
movzx ecx, byte [eax + esi + 0x1af70]
push ecx
push 0
push esi
call fcn.10038d90
mov edx, dword [esi + 0x6af90]
add esp, 0xc
dec edx
mov dword [esi + 0x6af90], edx
inc dword [esi + 0x6af84]
test eax, eax
je 0x1003bf1b
mov eax, dword [esi + 0x6af74]
test eax, eax
jl 0x1003bef8
lea ecx, [eax + esi + 0x1af70]
jmp 0x1003befa
xor ecx, ecx
mov edx, dword [esi + 0x6af84]
push 0
sub edx, eax
push edx
push ecx
push esi
call fcn.1003bb40
mov eax, dword [esi + 0x6af84]
add esp, 0x10
mov dword [esi + 0x6af74], eax
cmp dword [esi + 0x6af90], 0x106
jae 0x1003bf30
push esi
call fcn.100394f0
add esp, 4
mov eax, dword [esi + 0x6af90]
test eax, eax
jne 0x1003bd43
mov eax, dword [esi + 0x6af74]
test eax, eax
jl 0x1003bf51
lea ecx, [eax + esi + 0x1af70]
jmp 0x1003bf53
xor ecx, ecx
mov edx, dword [esi + 0x6af84]
push 1
sub edx, eax
push edx
push ecx
push esi
call fcn.1003bb40
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x1003d750
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov eax, 0x401c
call fcn.10057f70
mov eax, dword [0x10194180]
push ebx
push esi
mov esi, dword [esp + 0x4028]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push 0
push esi
mov dword [esp + 0x4034], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call edi
mov ebx, dword [esp + 0x4030]
push 0
push 0
push 0
push ebx
call edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea eax, [esp + 0x10]
push eax
push 0x4000
lea ecx, [esp + 0x20]
push ecx
push esi
call edi
test eax, eax
je 0x1003d832
lea ecx, [ecx]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x1003d80e
push 0
lea edx, [esp + 0x14]
push edx
push eax
lea eax, [esp + 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1003d830
push 0
lea ecx, [esp + 0x10]
push ecx
push 0x4000
lea edx, [esp + 0x20]
push edx
push esi
call edi
test eax, eax
jne 0x1003d7c0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x4018]
call fcn.100571c6
add esp, 0x401c
ret
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x4018]
call fcn.100571c6
add esp, 0x401c
ret
xor eax, eax
mov ecx, dword [esp + 0x4024]
pop edi
pop esi
pop ebx
call fcn.100571c6
add esp, 0x401c
ret
Function at 0x1003d850
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x10c
mov eax, dword [0x10194180]
push edi
mov edi, dword [esp + 0x114]
test edi, edi
mov dword [esp + 0x10c], eax
mov dword [esp + 4], 5
je 0x1003da3c
mov eax, dword [esp + 0x11c]
test eax, eax
je 0x1003da3c
mov eax, dword [esp + 0x120]
test eax, eax
je 0x1003da3c
push ebx
push ebp
mov ebp, dword [esp + 0x120]
test ebp, ebp
push esi
je 0x1003d93d
mov esi, ebp
mov eax, edi
mov edi, edi
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x1003d8d8
test cl, cl
je 0x1003d8d4
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x1003d8d8
add eax, 2
add esi, 2
test cl, cl
jne 0x1003d8b0
xor eax, eax
jmp 0x1003d8dd
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1003d93d
push 0
push 0x20
push 3
push 0
push 0
push accept
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x1003d924
push 0
push 0x20
push 2
push 0
push 0
push 0xc0000000
push ebp
call edi
mov edi, eax
cmp edi, 0xffffffff
jne 0x1003d9f6
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebp
pop ebx
xor eax, eax
pop edi
mov ecx, dword [esp + 0x108]
call fcn.100571c6
add esp, 0x10c
ret
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push 0x20
push 3
push 0
push 0
push 0xc0000000
push edi
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x1003d924
push 0
mov edi, esi
call fcn.100594c1
push eax
call fcn.1005946a
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
add esp, 8
dec dword [esp + 0x10]
call fcn.10059477
push eax
mov eax, dword [esp + 0x124]
push eax
lea ecx, [esp + 0x1c]
push str._sCSO__06d.tmp
push ecx
call fcn.100578f4
add esp, 0x10
lea edx, [esp + 0x14]
push edx
call ebp
cmp eax, 0xffffffff
jne 0x1003d9c4
push 0
push 0x4000020
push 1
push 0
push 0
push 0xc0000000
lea eax, [esp + 0x2c]
push eax
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x1003d9d7
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x1003d974
cmp esi, 0xffffffff
jne 0x1003d9d7
push edi
jmp 0x1003d91e
push esi
push edi
call fcn.1003d750
add esp, 8
test eax, eax
jne 0x1003d9f6
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
jmp 0x1003d924
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push 0
push esi
call ebx
push 0
push 0
push 0
push edi
call ebx
mov ecx, dword [esp + 0x128]
mov edx, dword [esp + 0x12c]
mov dword [ecx], esi
pop esi
pop ebp
pop ebx
mov dword [edx], edi
mov eax, 1
pop edi
mov ecx, dword [esp + 0x108]
call fcn.100571c6
add esp, 0x10c
ret
mov ecx, dword [esp + 0x10c]
xor eax, eax
pop edi
call fcn.100571c6
add esp, 0x10c
ret
Function at 0x1003e990
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x5c
push esi
mov esi, dword [esp + 0x6c]
xor eax, eax
cmp esi, eax
jne 0x1003e9a3
mov esi, 0x101a5f1c
mov ecx, dword [esp + 0x64]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x68]
push eax
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x10], 0x67452301
mov dword [esp + 0x14], 0xefcdab89
mov dword [esp + 0x18], 0x98badcfe
mov dword [esp + 0x1c], 0x10325476
call fcn.1003e580
add esp, 0xc
test eax, eax
jne 0x1003ea03
lea eax, [esp + 4]
push eax
push esi
call fcn.1003e830
add esp, 8
test eax, eax
jne 0x1003ea03
mov eax, esi
pop esi
add esp, 0x5c
ret
xor eax, eax
pop esi
add esp, 0x5c
ret

Function at 0x100402e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1012ecbe
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
or eax, 0xffffffff
xor ebx, ebx
mov dword [esi + 8], eax
mov dword [esi + 4], eax
push edi
mov dword [esp + 0x10], esi
mov dword [esi + 0xc], ebx
lea ecx, [esi + 0x14]
mov dword [esi], 0x1013dcc4
mov eax, 0xf
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x14], ebx
mov dword [esp + 0x1c], ebx
mov byte [ecx + 4], bl
lea edi, [esi + 0x30]
mov dword [edi + 0x18], eax
mov dword [edi + 0x14], ebx
mov byte [edi + 4], bl
mov ebp, dword [esp + 0x24]
mov eax, ebp
lea edx, [eax + 1]
mov byte [esp + 0x1c], 2
mov dword [esp + 0x24], edx
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x10040347
sub eax, dword [esp + 0x24]
push eax
push ebp
call fcn.100020c0
mov edx, dword [esp + 0x28]
mov eax, edx
lea ebp, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10040362
sub eax, ebp
push eax
push edx
mov ecx, edi
call fcn.100020c0
mov ecx, dword [esp + 0x14]
pop edi
mov dword [esi + 0x10], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x4c], ebx
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x10049dbf
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x10194180]
xor eax, ebp
push esi
xor esi, esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
inc esi
cmp dword [0x101a5f54], 0
mov dword [eax + 0x16160], esi
jne 0x10049e08
lea eax, [ebp - 0x194]
push eax
push 0x101
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x10049e02
or eax, 0xffffffff
jmp 0x10049e0a
mov dword [0x101a5f54], esi
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100571c6
leave
ret