joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1015bcd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0xf4
mov eax, dword [0x10291440]
xor eax, esp
mov dword [esp + 0xf0], eax
push ebx
push ebp
push esi
push edi
push 0xd4
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x30001c
push eax
push 0
mov dword [esp + 0x20], 0x580110
mov dword [esp + 0x24], 0x1c0020
mov dword [esp + 0x28], 0x200010
mov dword [esp + 0x2c], 0x680008
mov dword [esp + 0x30], 0xb40080
mov dword [esp + 0x34], 0x380110
mov dword [esp + 0x38], 0x80084
mov dword [esp + 0x3c], 0xdc0084
mov dword [esp + 0x40], 0x100068
mov dword [esp + 0x44], 0x280170
mov dword [esp + 0x48], 0xb80020
mov dword [esp + 0x4c], 0x2e80040
mov dword [esp + 0x50], 0x80008
mov dword [esp + 0x54], 0x1400008
mov dword [esp + 0x58], 0x680018
mov dword [esp + 0x5c], 0x600024
mov dword [esp + 0x60], 0x3d80034
mov dword [esp + 0x64], 0x80010
mov dword [esp + 0x68], 0x8000c
mov dword [esp + 0x6c], 0x10003c
mov dword [esp + 0x70], 0xa00008
mov dword [esp + 0x74], 0xc003c
mov dword [esp + 0x78], 0x1c8001c
mov dword [esp + 0x7c], 0x34004c
mov dword [esp + 0x80], 0x380014
mov dword [esp + 0x84], 0x540018
mov dword [esp + 0x88], 0x260006
mov dword [esp + 0x8c], 0x5c0010
mov dword [esp + 0x90], 0x1c004c
mov dword [esp + 0x94], 0x1880098
mov dword [esp + 0x98], 0x4c0008
mov dword [esp + 0x9c], 0x380068
mov dword [esp + 0xa0], 0x300048
mov dword [esp + 0xa4], 0x480008
mov dword [esp + 0xa8], 0x340060
mov dword [esp + 0xac], 0x1c80010
mov dword [esp + 0xb0], 0x100018
mov dword [esp + 0xb4], 0x14001c
mov dword [esp + 0xb8], 0x2c0170
mov dword [esp + 0xbc], 0x3800a8
mov dword [esp + 0xc0], 0x8003c
mov dword [esp + 0xc4], 0x480038
mov dword [esp + 0xc8], 0x3c0034
mov dword [esp + 0xcc], 0x44001c
mov dword [esp + 0xd0], 0x100044
mov dword [esp + 0xd4], 0x700008
mov dword [esp + 0xd8], 0x80008
mov dword [esp + 0xdc], 0x140070
mov dword [esp + 0xe0], 0x3200030
mov dword [esp + 0xe4], 0x300118
mov dword [esp + 0xe8], 0x4400f8
mov dword [esp + 0xec], 0x800a8
call fcn.101076e0
mov ecx, dword [esp + 0x10c]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1021eb98
add esp, 0xf4
ret
Function at 0x10171bf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 8]
cmp byte [eax + 0x19], 2
jne 0x10171c14
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x14]
push eax
push dword [esp + 0x14]
call fcn.10171fe0
add esp, 0x14
ret
mov dword [esp + 8], eax
jmp fcn.10171c20
Function at 0x10175650
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x20
mov eax, dword [esp + 0x24]
push ebx
push ebp
push esi
mov ebp, dword [eax + 0x18]
mov ecx, dword [eax + 0x14]
push edi
mov dword [esp + 0x10], ecx
mov edi, dword [ebp + 0x40]
mov ebx, dword [ecx + 0x78]
cmp edi, 0xffffffff
jne 0x10175675
mov esi, dword [ebx + 4]
jmp 0x101756c4
mov eax, dword [ebx]
test eax, eax
je 0x1017568d
push eax
push ecx
call fcn.100dbf50
add esp, 8
test eax, eax
jne 0x101756b3
mov ecx, dword [esp + 0x10]
mov esi, dword [ebx + 8]
test esi, esi
je 0x1017569f
cmp edi, dword [esi + 8]
je 0x1017569f
mov esi, dword [esi]
test esi, esi
jne 0x10175694
mov eax, dword [ebx]
test eax, eax
je 0x101756c0
push eax
push ecx
call fcn.100dc5b0
add esp, 8
test eax, eax
je 0x101756c0
pop edi
pop esi
pop ebp
mov eax, 0xffff8702
pop ebx
add esp, 0x20
ret
mov ecx, dword [esp + 0x10]
test esi, esi
je 0x1017572c
cmp dword [ebp + 0x9c], 0
jne 0x101756d5
xor eax, eax
jmp 0x10175706
mov edx, dword [ebx + 0x18]
mov eax, dword [edx]
test byte [eax + 0x9c], 0x40
je 0x101756eb
mov eax, dword [ebp + 0xa0]
jmp 0x101756f4
mov eax, dword [edx + 0x14]
add eax, dword [ebp + 0xa0]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x9c]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x14]
mov ebx, dword [esp + 0x40]
test ebx, ebx
je 0x10175736
mov edx, dword [esi + 0xc]
test edx, edx
je 0x1017572c
mov esi, dword [esp + 0x38]
push eax
push dword [esp + 0x40]
push esi
push dword [ecx]
call edx
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x10175754
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret
mov edx, dword [esi + 0x10]
test edx, edx
je 0x1017572c
mov esi, dword [esp + 0x38]
push eax
push dword [esp + 0x40]
push esi
push dword [ecx]
call edx
mov edi, eax
add esp, 0x10
test edi, edi
je 0x1017572c
mov ecx, str.pgout
test ebx, ebx
mov eax, str.pgin
push esi
cmove eax, ecx
push eax
push dword [esp + 0x3c]
call fcn.100eef60
add esp, 4
push eax
push str._s:__s_failed_for_page__lu
push dword [esp + 0x20]
call fcn.100d0920
add esp, 0x14
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x10178790
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x3c
mov eax, dword [0x10291440]
xor eax, esp
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x40]
push ebx
push ebp
push esi
mov ebp, dword [eax + 0x80]
or ebx, 0xffffffff
push edi
mov dword [esp + 0x10], eax
mov esi, dword [ebp + 0xe8]
mov dword [ebp + 0xec], esi
test esi, esi
jne 0x1017885e
movzx edi, word [ebp + 0xe4]
lea eax, [esp + 0x3c]
mov esi, dword [ebp + 0xe0]
xorps xmm0, xmm0
push edi
push 0x102742a0
push 0xa
push eax
movlpd qword [esp + 0x38], xmm0
movlpd qword [esp + 0x40], xmm0
mov dword [esp + 0x48], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 1
mov dword [esp + 0x2c], 1
call fcn.100d11a0
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x54]
push eax
push edi
push esi
push dword [esp + 0x34]
call fcn.10181030
add esp, 0x28
test eax, eax
je 0x1017884e
pop edi
pop esi
pop ebp
mov eax, 0xffff8701
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.1021eb98
add esp, 0x3c
ret
mov esi, dword [esp + 0x14]
mov dword [ebp + 0xe8], esi
mov dword [ebp + 0xec], esi
mov edi, 0x10282d89
test esi, esi
je 0x1017893e
nop dword [eax + eax]
push dword [esi + 0xc]
push dword [esi + 8]
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_socket]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x1017888d
mov edi, str.cant_create_listen_socket
jmp 0x101788d2
push 4
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 1
push eax
push 4
push 0xffff
push ebx
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x10178939
push dword [esi + 0x10]
push dword [esi + 0x18]
push ebx
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
je 0x101788e7
push ebx
mov edi, str.cant_bind_socket_to_listening_address
call dword [sym.imp.WS2_32.dll_closesocket]
or ebx, 0xffffffff
mov eax, dword [ebp + 0xec]
mov esi, dword [eax + 0x1c]
mov dword [ebp + 0xec], esi
test esi, esi
jne 0x10178870
jmp 0x1017893e
push 5
push ebx
call dword [sym.imp.WS2_32.dll_listen]
test eax, eax
je 0x101788fb
mov edi, str.listen__
jmp 0x1017893e
push ebx
call fcn.1017a170
mov esi, eax
add esp, 4
test esi, esi
je 0x1017891e
push str.cant_unblock_listen_socket
push esi
push dword [esp + 0x18]
call fcn.100d0600
add esp, 0xc
jmp 0x10178959
pop edi
pop esi
mov dword [ebp + 0xdc], ebx
xor eax, eax
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.1021eb98
add esp, 0x3c
ret
mov edi, str.cant_set_REUSEADDR_socket_option
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push edi
push esi
push dword [esp + 0x18]
call fcn.100d0600
add esp, 0xc
cmp ebx, 0xffffffff
je 0x10178960
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [esp + 0x48]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1021eb98
add esp, 0x3c
ret
Function at 0x10178f10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x5c
mov eax, dword [0x10291440]
xor eax, esp
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x70]
push ebx
mov ebx, dword [esp + 0x70]
push ebp
mov ebp, dword [esp + 0x68]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x7c]
push esi
push edi
mov edi, dword [esp + 0x78]
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0x80]
mov dword [esp + 0x14], eax
add eax, 0xf0
push 1
push eax
push ebp
call fcn.1017d6b0
lea eax, [esp + 0x30]
push eax
call fcn.1012d330
mov eax, dword [esp + 0x84]
mov byte [esp + 0x68], al
lea eax, [esp + 0x68]
push 1
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.1012cdf0
add esp, 0x1c
test edi, edi
jne 0x10178f87
xor eax, eax
jmp 0x10178f8a
mov eax, dword [edi + 4]
push eax
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [esp + 0x5c], eax
lea eax, [esp + 0x5c]
push 4
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.1012cdf0
add esp, 0xc
test ebx, ebx
jne 0x10178fb1
xor esi, esi
jmp 0x10178fb4
mov esi, dword [ebx + 4]
push esi
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [esp + 0x60], eax
lea eax, [esp + 0x60]
push 4
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.1012cdf0
add esp, 0xc
cmp dword [edi + 4], 0
jbe 0x10178fe7
lea eax, [esp + 0x24]
push edi
push eax
call fcn.1012ce10
add esp, 8
test esi, esi
je 0x10178ff9
lea eax, [esp + 0x24]
push ebx
push eax
call fcn.1012ce10
add esp, 8
mov eax, dword [esp + 0x14]
xor ecx, ecx
xor edx, edx
mov dword [esp + 0x64], 0
xor edi, edi
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], ecx
cmp dword [eax + 0xb4], ecx
jbe 0x101790c3
xor ebx, ebx
mov eax, dword [ebp + 0x80]
mov ecx, dword [eax + 0xb0]
add ecx, ebx
cmp dword [ecx + 0x3c], 2
jne 0x101790a7
mov eax, dword [ecx + 0x30]
cmp dword [eax + 0x1c], 7
jne 0x101790a7
test ecx, ecx
je 0x101790a7
mov ecx, dword [esp + 0x74]
mov esi, eax
mov eax, dword [esi + 0x14]
cmp ecx, dword [eax*4 + 0x102740f8]
ja 0x101790a7
push 0
lea eax, [esp + 0x28]
push eax
push esi
push ebp
call fcn.101790f0
add esp, 0x10
test eax, eax
jne 0x10179092
mov eax, dword [esi + 8]
mov esi, dword [esp + 0x10]
inc dword [esp + 0x18]
lea ecx, [eax + eax*8]
mov eax, dword [esp + 0x14]
lea edx, [esi + 1]
mov eax, dword [eax + 0xb0]
cmp dword [eax + ecx*8 + 0x18], 0
cmovbe edx, esi
mov dword [esp + 0x10], edx
jmp 0x101790ab
cmp eax, 0xffff8701
jne 0x101790d1
push esi
push ebp
call fcn.101781a0
add esp, 8
test eax, eax
jne 0x101790d1
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
inc edi
add ebx, 0x48
cmp edi, dword [eax + 0xb4]
jb 0x10179021
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov dword [eax], ecx
mov eax, dword [esp + 0x20]
mov dword [eax], edx
xor eax, eax
mov ecx, dword [esp + 0x68]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1021eb98
add esp, 0x5c
ret
Function at 0x10179ca0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x19c
mov eax, dword [0x10291440]
xor eax, esp
mov dword [esp + 0x198], eax
push ebx
mov ebx, dword [esp + 0x1a4]
lea eax, [esp + 0xc]
push esi
push edi
push eax
mov esi, dword [ebx + 0x80]
push 0x202
mov dword [esp + 0x14], 0
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov edi, eax
test edi, edi
je 0x10179d0b
push str.unable_to_initialize_Windows_networking
push edi
push ebx
call fcn.100d0600
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x198]
xor ecx, esp
call fcn.1021eb98
add esp, 0x19c
ret
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 0
push 0
call ebp
mov dword [esi + 0xac], eax
test eax, eax
je 0x10179dc3
push 0
push 0
push 1
push 0
call ebp
mov dword [esi + 0xa0], eax
lea edi, [esi + 0xa0]
test eax, eax
je 0x10179dc3
push 0
push 0
push 0
push 0
call ebp
mov dword [esi + 0xa4], eax
lea ebp, [esi + 0xa4]
test eax, eax
je 0x10179dc3
lea eax, [esp + 0x10]
push eax
push 0x10
push 1
push ebx
call fcn.100dc7a0
add esp, 0x10
mov dword [esp + 0x14], eax
test eax, eax
jne 0x10179dd9
push dword [esp + 0x10]
push 0xc
push 5
push ebx
call fcn.100dc7a0
add esp, 0x10
mov dword [esp + 0x14], eax
test eax, eax
jne 0x10179dd9
mov eax, dword [esp + 0x10]
mov dword [eax + 4], 5
mov eax, dword [esp + 0x10]
mov dword [eax + 0xc], 0xffffffff
mov eax, dword [esp + 0x10]
mov dword [eax + 8], 0
mov eax, dword [esp + 0x10]
mov dword [esi + 0xa8], eax
xor eax, eax
jmp 0x10179e44
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
lea ebp, [esi + 0xa4]
lea edi, [esi + 0xa0]
mov ecx, dword [ebp]
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
test ecx, ecx
je 0x10179ded
push ecx
call eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [edi]
test ecx, ecx
je 0x10179df6
push ecx
call eax
mov eax, dword [esi + 0xac]
test eax, eax
je 0x10179e07
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x10179e19
push eax
push ebx
call fcn.100dc7e0
add esp, 8
mov dword [ebp], 0
mov dword [edi], 0
mov dword [esi + 0xac], 0
mov dword [esi + 0xa8], 0
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x1a8]
pop ebp
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1021eb98
add esp, 0x19c
ret

Function at 0x10179e80
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 8
push 0
push 0
lea eax, [esp + 8]
mov dword [esp + 8], 0
push eax
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
call dword [sym.imp.WS2_32.dll_WSARecv]
cmp eax, 0xffffffff
jne 0x10179eba
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
add esp, 8
ret
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 4]
mov dword [ecx], eax
xor eax, eax
add esp, 8
ret
Function at 0x1017a1e0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push 0
push 0
push dword [esp + 0x10]
mov dword [esi + 0xc], 0
push dword [esi + 8]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x1017a20c
pop esi
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 4], eax
xor eax, eax
pop esi
ret

Function at 0x1017a2f0
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
push 0
push 0
push 0
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
call dword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0xffffffff
jne 0x1017a31b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
pop ecx
ret
mov ecx, dword [esp + 0x14]
mov eax, dword [esp]
mov dword [ecx], eax
xor eax, eax
pop ecx
ret
Function at 0x1017b4e0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
mov esi, dword [edi + 0x20]
lea ebp, [edi + 0x20]
lea edx, [edi + 0xc]
test esi, esi
je 0x1017b5ee
mov ebx, dword [esi + 4]
mov ecx, dword [esi + 8]
push 0
mov eax, dword [ebx]
sub eax, ecx
push eax
lea eax, [ecx + 8]
add eax, ebx
push eax
push dword [edx]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x1017b5aa
nop dword [eax]
add dword [esi + 8], eax
mov eax, dword [esi + 8]
cmp eax, dword [ebx]
jb 0x1017b57e
mov eax, dword [ebp]
mov eax, dword [eax]
mov dword [ebp], eax
test eax, eax
jne 0x1017b539
mov dword [edi + 0x24], ebp
push esi
mov esi, dword [esp + 0x18]
push esi
call fcn.100dc7e0
dec dword [edi + 0x28]
add esp, 8
dec dword [ebx + 4]
cmp dword [ebx + 4], 0
jg 0x1017b55d
push ebx
push esi
call fcn.100dc7e0
add esp, 8
cmp dword [edi + 0x30], 0
mov dword [edi + 0x1c], 7
jle 0x1017b57e
lea eax, [edi + 0x2c]
push eax
call fcn.1017a1a0
add esp, 4
test eax, eax
jne 0x1017b624
mov esi, dword [ebp]
test esi, esi
je 0x1017b5eb
mov ebx, dword [esi + 4]
mov ecx, dword [esi + 8]
push 0
mov eax, dword [ebx]
sub eax, ecx
push eax
lea eax, [ecx + 8]
add eax, ebx
push eax
push dword [edi + 0xc]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x1017b520
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x1017b622
mov edi, dword [esp + 0x14]
push str.writing_data
push eax
push edi
call fcn.100d0600
mov eax, dword [edi + 0x80]
add esp, 0xc
mov eax, dword [eax + 0x5c]
pop edi
pop esi
pop ebp
add dword [eax + 0x308], 1
pop ebx
adc dword [eax + 0x30c], 0
mov eax, 0xffff8701
ret
lea edx, [edi + 0xc]
push 0x21
push dword [edi + 0x10]
push dword [edx]
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
jne 0x1017b622
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, dword [esp + 0x14]
mov esi, eax
push str.cant_remove_FD_WRITE_event_bit
push esi
push edi
call fcn.100d0600
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x1017c1e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x68
mov eax, dword [0x10291440]
xor eax, esp
mov dword [esp + 0x64], eax
mov edx, dword [esp + 0x74]
mov ecx, dword [esp + 0x78]
push ebx
push ebp
mov ebp, dword [esp + 0x74]
push esi
mov esi, dword [esp + 0x7c]
mov dword [esp + 0x14], esi
mov eax, dword [ebp + 0x80]
push edi
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], ecx
mov ebx, dword [eax + 0x5c]
mov dword [esp + 0x10], ebx
xor ebx, ebx
cmp dword [esi + 0x14], 2
mov esi, dword [eax + 0xe0]
setne bl
mov dword [esp + 0x14], eax
lea edi, [esi + 1]
lea ebx, [ebx*4 + 6]
mov al, byte [esi]
inc esi
test al, al
jne 0x1017c238
lea eax, [esp + 0x1c]
sub esi, edi
push eax
mov eax, ecx
xor ecx, ecx
test edx, edx
cmove eax, ecx
inc eax
add eax, esi
add eax, ebx
push eax
push ebp
call fcn.100dc800
add esp, 0xc
test eax, eax
jne 0x1017c340
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x4c], edi
cmp dword [edx + 0x14], 2
movzx eax, word [ecx + 0xe4]
push edi
jne 0x1017c2a1
mov word [esp + 0x2c], ax
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0x38]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x2c]
push eax
push ebp
call fcn.101aefd0
jmp 0x1017c2cc
mov word [esp + 0x6c], ax
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0x38]
mov dword [esp + 0x70], eax
xor eax, eax
cmp dword [ecx + 0xdc], 0xffffffff
sete al
mov dword [esp + 0x74], eax
lea eax, [esp + 0x6c]
push eax
push ebp
call fcn.101aee80
mov ecx, dword [esp + 0x20]
add esp, 0xc
add edi, ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x30], edi
mov edx, edi
mov ecx, dword [ecx + 0xe0]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx], al
lea edx, [edx + 1]
test al, al
jne 0x1017c2e5
mov eax, dword [esp + 0x20]
inc esi
add esi, edi
test eax, eax
je 0x1017c30f
mov edi, dword [esp + 0x24]
push edi
push eax
push esi
call fcn.102207f0
add esp, 0xc
add esi, edi
sub esi, dword [esp + 0x30]
lea eax, [esp + 0x30]
push 0
push eax
lea eax, [esp + 0x54]
mov dword [esp + 0x3c], esi
push eax
push 2
push dword [esp + 0x28]
push ebp
call fcn.10179410
push dword [esp + 0x34]
mov esi, eax
push ebp
call fcn.100dc7e0
add esp, 0x20
mov eax, esi
mov ecx, dword [esp + 0x74]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1021eb98
add esp, 0x68
ret
Function at 0x10180590
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x14]
add esp, 0x24
ret
Function at 0x10181030
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x18
mov eax, dword [0x10291440]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
mov ebx, dword [esp + 0x20]
xorps xmm0, xmm0
push ebp
mov ebp, dword [esp + 0x38]
mov eax, 2
push esi
push edi
mov edi, dword [esp + 0x30]
movups xmmword [esp + 0x14], xmm0
mov word [esp + 0x14], ax
test edi, edi
je 0x101810cf
cmp byte [edi], 0
je 0x101810cf
push edi
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x101810d7
push edi
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ecx, eax
test ecx, ecx
jne 0x101810b6
call fcn.100f37f0
push dword [esp + 0x34]
mov esi, eax
push edi
push str._s__u_:_host_lookup_failed
push esi
push ebx
call fcn.100d0ec0
push esi
call fcn.100f3830
add esp, 0x18
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.1021eb98
add esp, 0x18
ret
movsx eax, word [ecx + 0xa]
push eax
mov eax, dword [ecx + 0xc]
push dword [eax]
lea eax, [esp + 0x20]
push eax
call fcn.102207f0
add esp, 0xc
jmp 0x101810db
push 0
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [esp + 0x18], eax
push dword [esp + 0x34]
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x16], ax
lea eax, [esp + 0x10]
push eax
push 0x20
push 1
push ebx
call fcn.100dc7a0
add esp, 0x10
test eax, eax
jne 0x1018117f
mov eax, dword [esp + 0x10]
add eax, 0x18
push eax
push 0x10
push ebx
call fcn.100dc800
mov esi, eax
add esp, 0xc
test esi, esi
je 0x1018113b
push dword [esp + 0x10]
push ebx
call fcn.100dc7e0
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.1021eb98
add esp, 0x18
ret
mov eax, dword [esp + 0x10]
movups xmm0, xmmword [esp + 0x14]
mov dword [eax + 4], 2
mov eax, dword [esp + 0x10]
mov dword [eax + 0xc], 6
mov eax, dword [esp + 0x10]
mov dword [eax + 8], 1
mov eax, dword [esp + 0x10]
mov dword [eax + 0x10], 0x10
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0x18]
movups xmmword [eax], xmm0
mov eax, dword [esp + 0x10]
mov dword [ebp], eax
xor eax, eax
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1021eb98
add esp, 0x18
ret
Function at 0x101a16f0
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push esi
call fcn.1013cac0
lea eax, [esi + 0x48]
add esp, 4
mov ch, byte [eax]
mov esi, 0x20
mov bl, byte [eax + 1]
mov dl, byte [eax + 2]
mov cl, byte [eax + 3]
mov byte [eax], cl
mov cl, byte [eax + 7]
mov byte [eax + 1], dl
mov dl, byte [eax + 6]
mov byte [eax + 2], bl
mov bl, byte [eax + 5]
mov byte [eax + 3], ch
mov ch, byte [eax + 4]
mov byte [eax + 4], cl
mov cl, byte [eax + 0xb]
mov byte [eax + 5], dl
mov dl, byte [eax + 0xa]
mov byte [eax + 6], bl
mov bl, byte [eax + 9]
mov byte [eax + 7], ch
mov ch, byte [eax + 8]
mov byte [eax + 8], cl
mov cl, byte [eax + 0xf]
mov byte [eax + 9], dl
mov dl, byte [eax + 0xe]
mov byte [eax + 0xa], bl
mov bl, byte [eax + 0xd]
mov byte [eax + 0xb], ch
mov ch, byte [eax + 0xc]
mov byte [eax + 0xc], cl
mov cl, byte [eax + 0x13]
mov byte [eax + 0xd], dl
mov dl, byte [eax + 0x12]
mov byte [eax + 0xe], bl
mov bl, byte [eax + 0x11]
mov byte [eax + 0xf], ch
mov ch, byte [eax + 0x10]
mov byte [eax + 0x10], cl
mov cl, byte [eax + 0x17]
mov byte [eax + 0x11], dl
mov dl, byte [eax + 0x16]
mov byte [eax + 0x12], bl
mov bl, byte [eax + 0x15]
mov byte [eax + 0x13], ch
mov ch, byte [eax + 0x14]
mov byte [eax + 0x14], cl
mov byte [eax + 0x15], dl
mov byte [eax + 0x16], bl
mov byte [eax + 0x17], ch
add eax, 0x18
mov ch, byte [eax]
mov bl, byte [eax + 1]
mov dl, byte [eax + 2]
mov cl, byte [eax + 3]
mov byte [eax], cl
mov byte [eax + 1], dl
mov byte [eax + 2], bl
mov byte [eax + 3], ch
add eax, 4
sub esi, 1
jne 0x101a1798
mov bl, byte [eax + 0xed]
add eax, 0xec
pop esi
mov ch, byte [eax]
mov dl, byte [eax + 2]
mov cl, byte [eax + 3]
mov byte [eax + 2], bl
mov byte [eax], cl
mov byte [eax + 1], dl
mov byte [eax + 3], ch
xor eax, eax
pop ebx
ret
Function at 0x101a9880
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x18], 0
mov dword [eax + 0x14], 0
ret