joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e665
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x24
mov eax, 0x43680b
call fcn.00422745
mov esi, ecx
mov dword [ebp - 0x20], esi
mov eax, dword [esi + 0x60]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x5c]
mov dword [ebp - 0x18], eax
call fcn.0040c86f
mov edi, dword [eax + 0xc]
xor ebx, ebx
cmp dword [esi + 0x58], ebx
je 0x40e6b0
call fcn.0040c86f
mov edi, dword [eax + 0xc]
push 5
push dword [esi + 0x58]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
je 0x40e6c1
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jne 0x40e6ce
or eax, 0xffffffff
jmp 0x40e82a
mov ecx, esi
call fcn.0040e1b7
mov dword [ebp - 0x14], eax
call fcn.004093ad
and dword [ebp - 0x28], ebx
cmp dword [ebp - 0x14], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], ebx
je 0x40e74c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp dword [ebp - 0x14], eax
je 0x40e74c
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x40e74c
push 0
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x2c], 1
call fcn.004049bb
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x24], ebx
je 0x40e74c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x120]
test eax, eax
je 0x40e74c
mov ecx, ebx
call fcn.00410489
test eax, eax
je 0x40e74c
push 0
mov ecx, ebx
call fcn.004104a4
mov dword [ebp - 0x28], 1
and dword [ebp - 4], 0
push esi
call fcn.0040ad60
push dword [ebp - 0x14]
call fcn.00409305
push edi
push eax
push dword [ebp - 0x1c]
mov ecx, esi
call fcn.0040e46d
xor edi, edi
cmp eax, edi
je 0x40e7a9
test byte [esi + 0x3c], 0x10
je 0x40e793
push 4
pop edi
mov ecx, esi
call fcn.00410370
test ax, 0x100
je 0x40e789
push 5
pop edi
push edi
mov ecx, esi
call fcn.00408e9b
xor edi, edi
cmp dword [esi + 0x20], edi
je 0x40e7a9
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.00410673
or dword [ebp - 4], 0xffffffff
jmp 0x40e7d4
cmp dword [ebp - 0x28], edi
je 0x40e7e2
push 1
mov ecx, ebx
call fcn.004104a4
cmp dword [ebp - 0x2c], edi
je 0x40e7f2
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x40e80b
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x20]
jne 0x40e80b
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x60]
mov ecx, esi
call fcn.0040e1f1
cmp dword [esi + 0x58], edi
je 0x40e827
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [esi + 0x44]
call fcn.004227ea
ret
Function at 0x41185e
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x41188c
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4118aa
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004117c8
jmp 0x4118aa
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4118aa
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.004117c8
test edi, edi
mov eax, edi
jne 0x411894
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x449504]
test ecx, ecx
je 0x41196d
jmp 0x41185d
ret 8

Function at 0x420360
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4466c0]
jne 0x42036a
repz ret
jmp fcn.0042627e

Function at 0x42aa49
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x447188]
je 0x42aa64
inc edi
cmp edi, 0x17
jb 0x42aa55
cmp edi, 0x17
jae 0x42abe4
push ebp
push 3
call fcn.00432117
cmp eax, 1
pop ecx
je 0x42abb0
push 3
call fcn.00432117
test eax, eax
pop ecx
jne 0x42aa98
cmp dword [0x446534], 1
je 0x42abb0
cmp ebx, 0xfc
je 0x42abe3
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x449e10
push ebp
call fcn.00420ad3
add esp, 0xc
test eax, eax
je 0x42aace
push esi
push esi
push esi
push esi
push esi
call fcn.00426edf
add esp, 0x14
push 0x104
mov esi, 0x449e29
push esi
push 0
mov byte [0x449f2d], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x42ab12
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.00420ad3
add esp, 0xc
test eax, eax
je 0x42ab12
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00426edf
add esp, 0x14
push esi
call fcn.00422ea0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x42ab57
push esi
call fcn.00422ea0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x44a124
push 0x43bdb4
sub ecx, eax
push ecx
push eax
call fcn.0042344c
add esp, 0x14
test eax, eax
je 0x42ab57
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00426edf
add esp, 0x14
jmp 0x42ab59
xor esi, esi
push 0x43bdb0
push ebx
push ebp
call fcn.004209ac
add esp, 0xc
test eax, eax
je 0x42ab79
push esi
push esi
push esi
push esi
push esi
call fcn.00426edf
add esp, 0x14
push dword [edi*8 + 0x44718c]
push ebx
push ebp
call fcn.004209ac
add esp, 0xc
test eax, eax
je 0x42ab9b
push esi
push esi
push esi
push esi
push esi
call fcn.00426edf
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.00431f5a
add esp, 0xc
jmp 0x42abe3
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x42abe3
cmp ebp, 0xffffffff
je 0x42abe3
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x44718c]
push dword [esi]
call fcn.00422ea0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x431f5a
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00426562
xor ebx, ebx
cmp dword [0x44a2b8], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x432030
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x432110
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x43ce48
push edi
call esi
cmp eax, ebx
je 0x432110
push eax
call fcn.004264f4
mov dword [esp], 0x43ce38
push edi
mov dword [0x44a2b8], eax
call esi
push eax
call fcn.004264f4
mov dword [esp], 0x43ce24
push edi
mov dword [0x44a2bc], eax
call esi
push eax
call fcn.004264f4
mov dword [0x44a2c0], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00422943
test eax, eax
pop ecx
pop ecx
je 0x431ffe
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00426edf
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x432030
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.004264f4
cmp eax, ebx
pop ecx
mov dword [0x44a2c8], eax
je 0x432030
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004264f4
pop ecx
mov dword [0x44a2c4], eax
mov eax, dword [0x44a2c4]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x4320b5
cmp dword [0x44a2c8], ecx
je 0x4320b5
push eax
call fcn.0042656b
push dword [0x44a2c8]
mov esi, eax
call fcn.0042656b
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x4320b5
cmp edi, ebx
je 0x4320b5
call esi
cmp eax, ebx
je 0x432082
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x432082
test byte [ebp - 0x18], 1
jne 0x4320b5
lea eax, [ebp - 0x10]
push eax
call fcn.0042297a
test eax, eax
pop ecx
je 0x43209d
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00426edf
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x4320ac
or dword [ebp + 0x10], 0x200000
jmp 0x4320f0
or dword [ebp + 0x10], 0x40000
jmp 0x4320f0
mov eax, dword [0x44a2bc]
cmp eax, dword [ebp - 8]
je 0x4320f0
push eax
call fcn.0042656b
cmp eax, ebx
pop ecx
je 0x4320f0
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4320f0
mov eax, dword [0x44a2c0]
cmp eax, dword [ebp - 8]
je 0x4320f0
push eax
call fcn.0042656b
cmp eax, ebx
pop ecx
je 0x4320f0
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44a2b8]
call fcn.0042656b
cmp eax, ebx
pop ecx
je 0x432110
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x432112
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x435eec
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x4466c0]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.00435e81
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.00422820
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x435f3b
cmp dword [ebp - 0x1c], 5
jb 0x435f53
jmp 0x435f4f
cmp dword [ebp - 0x10], 1
jne 0x435f53
cmp dword [ebp - 0x1c], 4
ja 0x435f4f
jne 0x435f53
cmp dword [ebp - 0x18], 0
jbe 0x435f53
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x43d65c
call fcn.00435d55
test eax, eax
jge 0x435f74
mov byte [0x44a351], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00420360
add ebp, 0x78
leave
ret
Function at 0x1000358d
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push 6
push 1
push dword [ebp + 8]
mov esi, ecx
call fcn.10009343
pop ecx
push eax
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x100035ed
lea ecx, [ebp + 8]
mov dword [ebp + 8], 1
push ecx
push 0x8004667e
push eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x100035e6
mov ecx, esi
call fcn.10007ece
push str.Failed_to_get_socket_flags
call fcn.1000b616
push eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x100035fd
mov eax, esi
pop esi
leave
ret 4
push str.Failed_to_create_socket
call fcn.1000b616
push eax
call sub.WS2_32.dll_WSAGetLastError
push eax
lea ecx, [ebp - 0x14]
call fcn.100039df
push 0x100b34e0
lea eax, [ebp - 0x14]
push eax
call fcn.100657bc
int3

Function at 0x10003615
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
lea eax, [ebp - 0x1a4]
push esi
push edi
mov esi, ecx
push eax
push 0x202
mov byte [esi], 0
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov edi, eax
test edi, edi
jne 0x10003674
mov eax, dword [ebp - 0x1a4]
cmp al, 2
jne 0x10003657
shr eax, 8
cmp al, 2
jne 0x10003657
pop edi
mov byte [esi], 1
mov eax, esi
pop esi
leave
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
push str.Invalid_WinSock_version
lea ecx, [ebp - 0xc]
call fcn.10003920
push 0x100b3580
lea eax, [ebp - 0xc]
jmp 0x10003690
push str.WSAStartup_failed
call fcn.1000b616
push eax
push edi
lea ecx, [ebp - 0x14]
call fcn.100039df
push 0x100b34e0
lea eax, [ebp - 0x14]
push eax
call fcn.100657bc
int3
Function at 0x100070c6
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [0x10163938]
push ebx
xor ebx, ebx
push esi
cmp byte [eax + 0xcf08], bl
je 0x10007187
push edi
push ebx
push 0xffffffffffffffff
call fcn.1002ddce
mov edi, eax
pop ecx
pop ecx
movzx ecx, byte [edi + 0x718]
imul edx, ecx, 0x1c
mov esi, dword [edx + edi + 0x5a0]
mov ecx, dword [edx + edi + 0x5ac]
mov dword [edx + edi + 0x5a8], ecx
cmp esi, 0x16
je 0x1000714d
cmp esi, 0x17
je 0x1000714d
cmp esi, 0x18
je 0x1000714d
cmp esi, 0x1a
je 0x1000714d
cmp esi, 0x1b
je 0x1000714d
cmp esi, 0x1c
je 0x1000714d
cmp esi, 0x1d
je 0x1000714d
cmp esi, 0x1e
je 0x1000714d
cmp esi, 0x1f
je 0x1000714d
cmp esi, 0x20
je 0x1000714d
cmp esi, 0x25
je 0x1000714d
cmp esi, 0x26
je 0x1000714d
cmp esi, 0x29
je 0x1000714d
cmp esi, 0x2a
jne 0x10007186
mov ecx, dword [0x1043c4cc]
mov eax, dword [ecx]
call dword [eax + 0x6c]
movzx ecx, byte [edi + 0x718]
mov esi, eax
imul ecx, ecx, 0x1c
cmp dword [ecx + edi + 0x5a8], 1
jne 0x10007186
mov ecx, dword [0x1043c4cc]
push ebx
mov edx, dword [ecx]
call dword [edx + 0x70]
mov ecx, dword [0x1043c4cc]
push esi
mov eax, dword [ecx]
call dword [eax + 0x70]
pop edi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x10129950]
cmp eax, 0x3e8
jbe 0x100071a9
inc dword [0x10129944]
call esi
mov dword [0x10129950], eax
cmp dword [0x10129944], 0x3b
mov eax, dword [0x10129948]
jle 0x100071c3
inc eax
mov dword [0x10129944], ebx
mov dword [0x10129948], eax
cmp eax, 0x3b
jle 0x100071d4
inc dword [0x1012994c]
mov dword [0x10129948], ebx
pop esi
pop ebx
ret

Function at 0x100073ea
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x38], ebx
je 0x10007437
cmp byte [esi + 0x3d], bl
je 0x10007437
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10007466
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, ebx
je 0x1000743e
sub eax, 1
je 0x10007441
dec eax
sub eax, 1
jne 0x10007466
mov byte [esi + 0x3d], bl
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
mov byte [esi + 0x3d], bl
mov edi, dword [ebp - 4]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1000745e
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.1006a777
add esp, 0x10
cmp edi, eax
jne 0x10007466
cmp byte [esi + 0x3d], bl
sete al
jmp 0x10007439
xor al, al
jmp 0x10007439
Function at 0x10008ea8
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push edi
push dword [ebp + 0xc]
mov edi, ecx
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x10008ee8
push esi
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
cmp eax, 0x2714
jne 0x10008eed
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x10008ecb
pop esi
pop edi
leave
ret 0x10
call esi
cmp eax, 0x2733
jne 0x10008f41
push dword [ebp + 0x14]
mov ecx, edi
push dword [ebp + 0x10]
push 1
call fcn.1000a1aa
lea eax, [ebp + 8]
mov dword [ebp + 8], 4
push eax
lea eax, [ebp + 0xc]
push eax
push 0x1007
push 0xffff
push dword [edi]
call dword [sym.imp.WS2_32.dll_getsockopt]
cmp eax, 0xffffffff
je 0x10008f48
cmp dword [ebp + 0xc], 0
je 0x10008ee7
push str.Failed_to_connect
call fcn.1000b616
push eax
push dword [ebp + 0xc]
jmp 0x10008f56
push str.Failed_to_connect
jmp 0x10008f4d
push str.Failed_to_get_socket_option
call fcn.1000b616
push eax
call esi
push eax
lea ecx, [ebp - 0x14]
call fcn.100039df
push 0x100b34e0
lea eax, [ebp - 0x14]
push eax
call fcn.100657bc
int3

Function at 0x10009848
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x28
push ebx
mov ebx, dword [esp + 0x30]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, edi
jne 0x10009862
xor eax, eax
jmp 0x10009932
mov eax, dword [esi + 0x20]
push ebp
mov ecx, dword [eax]
test ecx, ecx
je 0x10009890
mov edx, dword [esi + 0x30]
mov ebp, dword [edx]
lea eax, [ecx + ebp]
cmp ecx, eax
jae 0x10009890
lea ecx, [ebp - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
jmp 0x10009931
cmp dword [esi + 0x4c], 0
je 0x1000992f
mov ecx, esi
call fcn.100079ef
mov ecx, dword [esi + 0x38]
mov al, bl
test ecx, ecx
jne 0x100098bc
push dword [esi + 0x4c]
push eax
call fcn.1000214f
test al, al
pop ecx
pop ecx
cmovne edi, ebx
jmp 0x1000992f
mov byte [esp + 0x10], al
lea eax, [esp + 0x3c]
mov edx, dword [ecx]
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x21]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
sub eax, 0
je 0x10009900
sub eax, 1
je 0x10009900
dec eax
sub eax, 1
jne 0x1000992f
push dword [esi + 0x4c]
push dword [esp + 0x14]
jmp 0x100098ae
mov ebp, dword [esp + 0x3c]
lea eax, [esp + 0x18]
sub ebp, eax
je 0x1000991f
push dword [esi + 0x4c]
push ebp
push 1
push eax
call fcn.1006a777
add esp, 0x10
cmp ebp, eax
jne 0x1000992f
lea eax, [esp + 0x10]
mov byte [esi + 0x3d], 1
cmp dword [esp + 0x14], eax
mov eax, ebx
jne 0x10009931
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x28
ret 4
Function at 0x1000a1aa
Capabilities:
Get socket status

Disassembly:
sub esp, 0x124
mov eax, dword [ecx]
push ebx
push ebp
mov ebp, dword [esp + 0x138]
push esi
push edi
mov edi, dword [esp + 0x13c]
xor esi, esi
push esi
push 0x3e8
push ebp
push edi
mov dword [esp + 0x44], eax
mov dword [esp + 0x40], 1
call fcn.10062db0
mov dword [esp + 0x10], eax
imul eax, ecx, 0x3e8
mov dword [esp + 0x14], ebx
mov dword [esp + 0x14], edx
mov dword [esp + 0x14], eax
cmp ebp, esi
jl 0x1000a205
jg 0x1000a1ff
cmp edi, esi
jb 0x1000a205
lea eax, [esp + 0x10]
jmp 0x1000a207
mov eax, esi
xor ecx, ecx
lea ebx, [esp + 0x30]
cmp dword [esp + 0x138], 1
push eax
cmovne ebx, ecx
lea ecx, [esp + 0x34]
xor edx, edx
cmp dword [esp + 0x13c], edx
push esi
cmovne ecx, edx
push ebx
push ecx
push esi
mov dword [esp + 0x2c], ecx
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
jne 0x1000a272
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
cmp eax, 0x2714
jne 0x1000a29c
test ebp, ebp
jl 0x1000a25b
jg 0x1000a255
test edi, edi
jb 0x1000a25b
lea eax, [esp + 0x10]
jmp 0x1000a25d
xor eax, eax
push eax
push 0
push ebx
push dword [esp + 0x24]
push 0
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x1000a242
test eax, eax
je 0x1000a283
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x124
ret 0xc
push str.Request_timed_out
lea ecx, [esp + 0x20]
call fcn.1000356e
push 0x100b35f4
lea eax, [esp + 0x20]
jmp 0x1000a2bc
push str.Failed_to_select_socket
call fcn.1000b616
push eax
call esi
push eax
lea ecx, [esp + 0x28]
call fcn.100039df
push 0x100b34e0
lea eax, [esp + 0x20]
push eax
call fcn.100657bc
int3
Function at 0x1000b87f
Capabilities:
Read file on windows

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0x14]
mov ebp, ecx
push edi
mov edi, dword [esp + 0x14]
test esi, esi
jg 0x1000b89f
jl 0x1000b896
test edi, edi
jne 0x1000b89f
xor eax, eax
xor edx, edx
jmp 0x1000b966
cmp dword [ebp + 0x38], 0
je 0x1000b8b5
push esi
push edi
push dword [esp + 0x18]
call fcn.1000b970
jmp 0x1000b966
mov eax, dword [ebp + 0x1c]
push ebx
mov ebx, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x1000b8f9
mov eax, dword [ebp + 0x2c]
cmp dword [eax], 0
jbe 0x1000b8f9
cmp dword [eax], edi
mov esi, edi
mov ebx, dword [esp + 0x14]
cmovb esi, dword [eax]
push esi
push ecx
push ebx
call fcn.10064e80
mov eax, dword [ebp + 0x2c]
add ebx, esi
mov dword [esp + 0x20], ebx
add esp, 0xc
mov ebx, edi
sub ebx, esi
sub dword [eax], esi
mov eax, dword [ebp + 0x1c]
add dword [eax], esi
mov esi, dword [esp + 0x1c]
jmp 0x1000b901
mov eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
cmp dword [ebp + 0x4c], 0
mov ecx, ebx
je 0x1000b95c
mov ecx, ebp
call fcn.100079ef
mov edx, dword [esp + 0x14]
mov ecx, ebx
jmp 0x1000b93c
push dword [ebp + 0x4c]
push eax
push 1
push edx
call fcn.10069b09
mov edx, dword [esp + 0x24]
sub ebx, eax
add edx, eax
add esp, 0x10
mov dword [esp + 0x14], edx
mov ecx, ebx
cmp eax, 0xfff
jne 0x1000b96c
mov eax, 0xfff
cmp ebx, eax
ja 0x1000b918
test ecx, ecx
je 0x1000b95c
push dword [ebp + 0x4c]
push ebx
push 1
push edx
call fcn.10069b09
mov ecx, ebx
add esp, 0x10
sub ecx, eax
sub edi, ecx
sbb esi, 0
mov eax, edi
mov edx, esi
pop ebx
pop edi
pop esi
pop ebp
ret 0xc
sub edi, ebx
jmp 0x1000b95e

Function at 0x1000ba44
Capabilities:
Write file on windows

Disassembly:
push ecx
push ecx
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x1000ba65
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x18]
call fcn.1000bb1a
jmp 0x1000bb14
mov eax, dword [ebx + 0x20]
push ebp
push esi
mov esi, dword [esp + 0x1c]
mov ecx, dword [eax]
mov dword [esp + 0xc], esi
push edi
mov edi, dword [esp + 0x24]
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x1000ba88
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x1000ba8a
xor eax, eax
cdq
mov ebp, eax
mov eax, edx
mov dword [esp + 0x20], eax
test edi, edi
jl 0x1000bb05
jg 0x1000ba9d
test esi, esi
je 0x1000bb05
test eax, eax
jl 0x1000bae7
jg 0x1000baa7
test ebp, ebp
je 0x1000bae7
cmp edi, eax
jg 0x1000bab7
jl 0x1000bab1
cmp esi, ebp
jae 0x1000bab7
mov ebp, esi
mov dword [esp + 0x20], edi
push ebp
push dword [esp + 0x20]
push ecx
call fcn.10064e80
mov eax, dword [ebx + 0x30]
add esp, 0xc
sub esi, ebp
sbb edi, dword [esp + 0x20]
sub dword [eax], ebp
mov eax, dword [ebx + 0x20]
add dword [eax], ebp
mov eax, dword [esp + 0x1c]
add eax, ebp
test edi, edi
jl 0x1000bb05
jg 0x1000baeb
test esi, esi
je 0x1000bb05
jmp 0x1000baeb
mov eax, dword [esp + 0x1c]
cmp dword [ebx + 0x4c], 0
je 0x1000bb05
push dword [ebx + 0x4c]
push esi
push 1
push eax
call fcn.1006a777
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 0xc
Function at 0x100144ba
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x10087be6
call fcn.10062ce0
sub esp, 0x38
push ebx
push esi
push edi
mov eax, 0x40e4e0
mov esi, ecx
call eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x58]
movzx eax, ax
xor ebx, ebx
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
call fcn.10013c3a
pop ecx
mov dword [ebp - 0x24], eax
mov eax, ebx
mov dword [ebp - 4], ebx
mov edi, 0xb7d0b8
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], edi
mov ebx, dword [edi]
test ebx, ebx
je 0x100145ba
mov edi, dword [ebp - 0x10]
mov esi, dword [ebx]
mov dword [ebp - 0x1c], esi
mov eax, dword [esi]
cmp dword [eax + 0x20], 0x534030
je 0x10014566
mov eax, edi
mov dword [ebp - 0x1c], 0x78
cdq
sub eax, edx
sar eax, 1
cdq
idiv dword [ebp - 0x1c]
push eax
movzx eax, word [esi + 0x22]
push edx
push eax
push esi
lea eax, [ebp - 0x44]
push str.Entity_0x_08x__with_model__d__at_ARRAY_StreamSectors__d__d__is_invalid_n
push eax
call fcn.10013db6
add esp, 0x18
cmp dword [eax + 0x14], 0x10
jb 0x10014555
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [ebp - 0x44]
call fcn.10007b04
jmp 0x100145a7
mov ecx, dword [0x10129980]
movzx eax, word [esi + 0x22]
push eax
mov edx, dword [ecx]
call dword [edx + 0xa4]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x58]
cmp ax, word [ebp - 0x18]
jne 0x100145a7
test dword [esi + 0x1c], 0x2400
jne 0x100145a7
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx]
call dword [eax + 0x20]
lea eax, [esi + 0x22]
lea ecx, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.10013c51
mov eax, dword [ebx + 4]
mov ebx, eax
test eax, eax
jne 0x10014512
mov edi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
add edi, 4
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], edi
cmp edi, 0xb992b8
jl 0x10014505
mov edi, 0xb992c0
mov dword [ebp - 0x14], edi
mov esi, dword [edi]
test esi, esi
je 0x10014630
mov edi, dword [ebp - 0x18]
mov ebx, dword [esi]
mov ecx, dword [0x10129980]
mov dword [ebp - 0x1c], ebx
movzx eax, word [ebx + 0x22]
mov edx, dword [ecx]
push eax
call dword [edx + 0xa4]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x58]
cmp ax, di
jne 0x10014626
test dword [ebx + 0x1c], 0x2400
jne 0x10014626
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx]
call dword [eax + 0x20]
lea eax, [ebx + 0x22]
lea ecx, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.10013c51
mov esi, dword [esi + 4]
test esi, esi
jne 0x100145e1
mov edi, dword [ebp - 0x14]
add edi, 0xc
mov dword [ebp - 0x14], edi
cmp edi, 0xb99ec0
jl 0x100145d8
mov eax, dword [ebp - 0x24]
mov esi, dword [eax]
mov dword [ebp - 0x18], esi
cmp esi, eax
je 0x10014675
movzx eax, word [esi + 0xe]
push eax
mov eax, 0x4089a0
call eax
movzx eax, word [esi + 0xe]
imul eax, eax, 0x14
pop ecx
lea ecx, [ebp - 0x18]
mov byte [eax + 0x8e4cd0], 0
call fcn.10012289
mov esi, dword [ebp - 0x18]
cmp esi, dword [ebp - 0x24]
jne 0x1001464a
lea eax, [ebp - 0x24]
push eax
mov ecx, eax
call fcn.10013ce3
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret