joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000a4b0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10055130]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
mov ebx, dword [esi + 0x194]
mov eax, dword [esi]
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x14]
push edx
push ebx
mov dword [ebp - 0x1c], eax
or edi, 0xffffffff
mov dword [ebp - 0x18], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x1000a505
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x14]
push ecx
push ebx
mov dword [ebp - 0x18], 0x10
call dword [sym.imp.WS2_32.dll_accept]
mov edi, eax
push ebx
push esi
call fcn.10002d00
add esp, 8
cmp edi, 0xffffffff
jne 0x1000a53b
mov edx, dword [ebp - 0x1c]
push str.Error_accept__ing_server_connect
push edx
call fcn.10023390
add esp, 8
pop edi
pop esi
mov eax, 0x1e
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10036a9a
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 0x1c]
push str.Connection_accepted_from_server_n
push ebx
call fcn.10023310
push 1
push edi
mov dword [esi + 0x298], 0
mov dword [esi + 0x194], edi
call fcn.1001e3a0
mov dword [esi + 0x1a4], 1
mov eax, dword [ebx + 0x1b0]
add esp, 0x10
test eax, eax
je 0x1000a5a6
mov ecx, dword [ebx + 0x1b4]
push 1
push edi
push ecx
call eax
add esp, 0xc
test eax, eax
je 0x1000a5a6
call fcn.1000a3e0
pop edi
pop esi
mov eax, 0x2a
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10036a9a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.10036a9a
mov esp, ebp
pop ebp
ret
Function at 0x1000dc20
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
push ebx
mov ebx, dword [edi]
shr eax, 0x1f
push esi
add eax, edx
xor esi, esi
cmp eax, 2
je 0x1000dc54
push str.Couldnt_set_desired_mode
push ebx
call fcn.10023390
add esp, 8
lea eax, [esi + 0x11]
pop esi
pop ebx
pop ebp
ret
cmp ecx, 0xc8
je 0x1000dc6b
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push ebx
call fcn.10023310
add esp, 0xc
mov eax, dword [ebp + 8]
cmp eax, 0x13
jne 0x1000dc82
push edi
call fcn.1000dbb0
add esp, 4
mov esi, eax
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x14
jne 0x1000dc96
push edi
call fcn.1000b060
add esp, 4
mov esi, eax
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x15
jne 0x1000dca8
mov eax, edi
call fcn.1000dc00
mov esi, eax
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x16
jne 0x1000dcb6
mov eax, edi
call fcn.1000dc10
mov esi, eax
mov eax, esi
pop esi
pop ebx
pop ebp
ret

Function at 0x1000fb30
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x10055130]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call fcn.10039dad
add esp, 4
mov byte [ebp - 0x108], 0
test eax, eax
je 0x1000fb94
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [ebp - 0x108], 0
je 0x1000fb94
lea edx, [ebp - 0x108]
push edx
call dword [0x100550e4]
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10036a9a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.10036a9a
mov esp, ebp
pop ebp
ret

Function at 0x1000fbb0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.1000fb30
Function at 0x100108a0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea eax, [ecx + eax*2 + 0xc]
push edi
push eax
call dword [0x100550d8]
mov edi, eax
add esp, 4
test edi, edi
jne 0x100108cb
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], eax
mov edx, dword [esi + 0xc]
add edx, eax
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], edx
cmp ebx, dword [esi + 0x10]
jbe 0x10010912
push eax
mov eax, dword [esi]
call eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push ebx
push ecx
push edx
call eax
mov ebx, dword [edi + 8]
mov ecx, dword [edi + 4]
add ebx, dword [esi + 0xc]
mov edx, dword [esi + 8]
push ecx
push ebx
call edx
mov eax, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], eax
jmp 0x10010915
mov ebx, dword [ebp + 0xc]
mov ecx, dword [edi + 4]
mov edx, dword [esi]
push ecx
call edx
mov eax, dword [edi + 8]
mov ecx, dword [esi]
push eax
call ecx
mov eax, dword [ebp + 0x10]
add esp, 8
mov dword [ebp - 4], 0
test eax, eax
je 0x10010976
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea esp, [esp]
mov dl, byte [ebx]
xor dl, 0x36
mov byte [ebp + 0xb], dl
mov ecx, dword [edi + 4]
mov edx, dword [esi + 4]
push 1
lea eax, [ebp + 0xb]
push eax
push ecx
call edx
mov al, byte [ebx]
xor al, 0x5c
mov byte [ebp + 0xb], al
mov edx, dword [edi + 8]
mov eax, dword [esi + 4]
push 1
lea ecx, [ebp + 0xb]
push ecx
push edx
inc ebx
call eax
add esp, 0x18
dec dword [ebp - 8]
jne 0x10010940
mov ecx, dword [ebp - 4]
pop ebx
cmp ecx, dword [esi + 0x10]
jae 0x100109af
nop
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push 1
push str.6_s:_d
push edx
call eax
mov ecx, dword [edi + 8]
mov edx, dword [esi + 4]
push 1
push 0x1004af73
push ecx
call edx
mov eax, dword [ebp - 4]
inc eax
add esp, 0x18
mov dword [ebp - 4], eax
cmp eax, dword [esi + 0x10]
jb 0x10010980
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10019420
Capabilities:
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0xf0000000
push 1
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x10019453
mov ecx, dword [esi]
lea eax, [esi + 4]
push eax
push 0
push 0
push 0x8003
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
pop esi
pop ebp
ret

Function at 0x10019600
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ebx, ecx
push 0x1004c550
mov dword [ebp - 4], ebx
call esi
mov eax, dword [ebx + 0x10]
cmp dword [eax + 0x78], 0
je 0x10019732
cmp dword [eax + 0x7c], 0
je 0x10019732
mov eax, dword [ebp + 8]
push eax
call esi
cmp dword [ebx], 0
jne 0x1001964d
push str.isLoadOk
call esi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebx + 0x10]
mov esi, dword [eax + 0x78]
mov ecx, dword [eax + 0x7c]
mov eax, dword [ebx + 8]
mov edx, dword [eax + esi + 0x14]
push edi
mov edi, dword [eax + esi + 0x24]
add edi, eax
mov dword [ebp - 0x18], edx
mov edx, dword [eax + esi + 0x1c]
mov dword [ebp - 0x10], edi
mov edi, dword [eax + esi + 0x20]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [eax + esi + 0x18]
add edx, eax
add edi, eax
test dword [ebp + 8], 0xffff0000
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x14], edx
jne 0x1001969a
mov ecx, 0xffff
sub ecx, dword [eax + esi + 0x10]
and ecx, dword [ebp + 8]
jmp 0x1001970b
xor ebx, ebx
test ecx, ecx
jle 0x100196ef
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov dword [ebp - 8], ecx
lea esp, [esp]
mov eax, dword [edi + ebx*4]
mov ecx, dword [ebp + 8]
add eax, dword [ebp - 8]
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100196e0
test dl, dl
je 0x100196dc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100196e0
add eax, 2
add ecx, 2
test dl, dl
jne 0x100196c0
xor eax, eax
jmp 0x100196e5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x100196fa
inc ebx
cmp ebx, dword [ebp - 0xc]
jl 0x100196b0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
test ebx, ebx
js 0x100196ef
mov edx, dword [ebp - 0x10]
movzx ecx, word [edx + ebx*2]
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
test ecx, ecx
js 0x100196ef
cmp ecx, dword [ebp - 0x18]
jge 0x100196ef
mov ecx, dword [edx + ecx*4]
cmp ecx, esi
jbe 0x10019724
mov eax, dword [ebp - 0x1c]
add eax, esi
cmp ecx, eax
jb 0x100196ef
mov eax, dword [ebx + 8]
pop edi
pop esi
add eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.NULL
call esi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100199a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
cmp edi, 0x40
jae 0x100199b3
xor eax, eax
pop edi
pop ebp
ret 8
mov eax, dword [ebp + 8]
mov edx, 0x5a4d
mov dword [ecx + 0xc], eax
cmp word [eax], dx
jne 0x100199ac
mov edx, dword [eax + 0x3c]
push esi
lea esi, [edx + 0xf8]
cmp edi, esi
jb 0x100199fa
add eax, edx
mov dword [ecx + 0x10], eax
cmp dword [eax], 0x4550
jne 0x100199fa
movzx edx, word [eax + 0x16]
test edx, 0x2000
je 0x100199fa
test dl, 2
je 0x100199fa
mov edx, 0xe0
cmp word [eax + 0x14], dx
je 0x10019a02
pop esi
xor eax, eax
pop edi
pop ebp
ret 8
push ebx
lea esi, [eax + 0xf8]
xor ebx, ebx
mov dword [ecx + 0x14], esi
xor edx, edx
cmp bx, word [eax + 6]
jae 0x10019a3b
xor eax, eax
jmp 0x10019a20
mov ebx, dword [eax + esi + 0x14]
add ebx, dword [eax + esi + 0x10]
cmp ebx, edi
ja 0x10019a47
mov ebx, dword [ecx + 0x10]
movzx ebx, word [ebx + 6]
inc edx
add eax, 0x28
cmp edx, ebx
jl 0x10019a20
pop ebx
pop esi
mov eax, 1
pop edi
pop ebp
ret 8
pop ebx
pop esi
xor eax, eax
pop edi
pop ebp
ret 8

Function at 0x10019b90
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
cmp dword [edi + 8], 0
je 0x10019ba3
xor eax, eax
pop edi
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
mov ecx, edi
call fcn.100199a0
test eax, eax
je 0x10019b9c
push ebx
call fcn.10019a70
mov ebx, eax
test ebx, ebx
jne 0x10019bc8
pop ebx
pop edi
pop ebp
ret 8
push esi
push 0x40
push 0x3000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
je 0x10019c75
mov edx, dword [ebp + 8]
push edx
push esi
mov ecx, edi
call fcn.10019af0
mov eax, dword [edi + 0x10]
cmp dword [eax + 0xa0], 0
jbe 0x10019c0c
cmp dword [eax + 0xa4], 0
jbe 0x10019c0c
push esi
mov ecx, edi
call fcn.10019750
push esi
mov ecx, edi
call fcn.100197c0
test eax, eax
jne 0x10019c2e
push 0x8000
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop esi
pop ebx
xor eax, eax
pop edi
pop ebp
ret 8
lea eax, [ebp + 8]
push eax
push 0x40
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [edi + 0x10]
mov dword [ecx + 0x34], esi
mov edx, dword [edi + 0x10]
mov eax, dword [edx + 0x28]
push 0
push 1
add eax, esi
push esi
mov dword [edi + 4], eax
call eax
test eax, eax
jne 0x10019c7e
mov ecx, dword [edi + 4]
push eax
push eax
push esi
call ecx
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [edi + 4], 0
pop esi
pop ebx
xor eax, eax
pop edi
pop ebp
ret 8
mov dword [edi + 8], esi
pop esi
pop ebx
mov dword [edi], 1
mov eax, 1
pop edi
pop ebp
ret 8
Function at 0x1001ddb0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
xor esi, esi
mov dword [ebp - 4], esi
call fcn.1002b830
mov ebx, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], edx
cmp dword [ebp + 8], esi
je 0x1001de09
mov eax, dword [ebp + 0x14]
push eax
push edi
call sym.libcurl.dll_curl_multi_perform
mov ebx, eax
add esp, 8
cmp ebx, 1
je 0x1001de01
mov esi, dword [edi + 4]
test esi, esi
je 0x1001de01
lea ebx, [ebx]
push edi
mov ecx, esi
call fcn.1001bd00
mov esi, dword [esi]
add esp, 4
test esi, esi
jne 0x1001ddf0
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
cmp eax, 0xffffffff
je 0x1001df43
push eax
lea ecx, [edi + 0x60]
call fcn.1001b1b0
add esp, 4
test eax, eax
je 0x1001ded6
mov esi, dword [eax]
cmp dword [esi + 0x4938], 0xc0dedbad
je 0x1001de42
pop esi
mov eax, 4
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 8]
mov edx, dword [ebp + 0x10]
test eax, eax
je 0x1001de70
test dl, 2
je 0x1001de5f
mov ecx, dword [eax + 0x354]
test ecx, ecx
je 0x1001de5f
mov esi, dword [ecx]
jmp 0x1001de70
test dl, 1
je 0x1001de70
mov eax, dword [eax + 0x364]
test eax, eax
je 0x1001de70
mov esi, dword [eax]
mov eax, dword [esi + 8]
test eax, eax
je 0x1001de89
mov ecx, dword [eax + 0x310]
test byte [ecx + 0x40], 8
jne 0x1001de89
mov dword [eax + 0x580], edx
mov edx, dword [ebp - 0xc]
push edx
push ebx
push edi
call fcn.1001cd50
mov ecx, dword [esi + 8]
add esp, 0xc
mov dword [ebp - 4], eax
test ecx, ecx
je 0x1001deb7
mov edx, dword [ecx + 0x310]
test byte [edx + 0x40], 8
jne 0x1001deb7
mov dword [ecx + 0x580], 0
test eax, eax
jg 0x1001dec6
push edi
mov ecx, esi
call fcn.1001bd00
add esp, 4
xor esi, esi
call fcn.1002b830
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov ebx, dword [ebp - 0x10]
test esi, esi
je 0x1001defa
mov eax, dword [ebp - 0xc]
push eax
push ebx
push edi
call fcn.1001cd50
add esp, 0xc
mov dword [ebp - 4], eax
test eax, eax
jg 0x1001defa
push edi
mov ecx, esi
call fcn.1001bd00
add esp, 4
mov edx, dword [edi + 0x5c]
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 8]
push ecx
push edx
push eax
push ebx
call fcn.10027390
mov dword [edi + 0x5c], eax
mov eax, dword [ebp - 8]
add esp, 0x10
test eax, eax
je 0x1001df32
mov ecx, dword [ebp - 0xc]
mov esi, dword [eax + 0x18]
push edi
push ecx
push ebx
mov ebx, esi
call fcn.1001bfb0
add esp, 0xc
cmp dword [ebp - 8], 0
jne 0x1001ded3
mov eax, dword [ebp + 0x14]
mov edx, dword [edi + 0x10]
pop esi
mov dword [eax], edx
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [edi + 0xec], eax
mov dword [edi + 0xf0], eax
jmp 0x1001ded6
Function at 0x1001eb30
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2c]
push ebx
mov ebx, dword [ecx]
mov dword [ebp - 4], ecx
mov ecx, dword [ebx + 0x1ec]
push esi
push edi
mov esi, ecx
test ecx, ecx
jne 0x1001eb51
mov esi, dword [eax + 0x28]
mov ecx, dword [eax + 0x24]
mov edx, dword [eax + 0x20]
push ecx
push edx
call fcn.1002b830
push edx
push eax
call fcn.1002b860
mov ecx, eax
mov eax, esi
mov dword [ebp + 8], edx
cdq
add esp, 0x10
mov edi, eax
sub edi, ecx
mov esi, edx
sbb esi, dword [ebp + 8]
cmp dword [ebx + 0x1e0], 0
je 0x1001ebbd
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x184]
mov eax, dword [eax + 0x180]
push edx
push eax
call fcn.1002b830
push edx
push eax
call fcn.1002b860
mov ecx, eax
mov eax, dword [ebx + 0x1e0]
mov dword [ebp + 8], edx
cdq
add esp, 0x10
sub eax, ecx
sbb edx, dword [ebp + 8]
cmp esi, edx
jl 0x1001ebbd
jg 0x1001ebc1
cmp edi, eax
jae 0x1001ebc1
mov eax, edi
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10023050
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x10023083
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2733
neg eax
sbb eax, eax
and eax, 0xffffffe7
add eax, 0x51
pop ebp
ret
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
xor eax, eax
pop ebp
ret

Function at 0x100231d0
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esi + 0x1a8]
test ecx, ecx
je 0x100231eb
mov edx, dword [esi + 0x134]
push edx
push edi
push ebx
push eax
push esi
call ecx
add esp, 0x14
ret
test eax, eax
js 0x1002321f
cmp eax, 2
jg 0x1002321f
mov ecx, dword [esi + 0x130]
push ecx
push 1
lea edx, [eax + eax*2 + 0x1004d5e4]
push 2
push edx
call fcn.1003a9d2
mov eax, dword [esi + 0x130]
push eax
push 1
push edi
push ebx
call fcn.1003a9d2
add esp, 0x20
xor eax, eax
ret

Function at 0x10023780
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
mov ebx, dword [eax + ecx*4 + 0x190]
mov edx, ecx
add edx, edx
push esi
lea esi, [eax + edx*8 + 0x1b8]
mov edx, dword [eax + 0x310]
push edi
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [edx + 0x3c], 3
je 0x10023820
cmp dword [eax + ecx*4 + 0x1a8], 0x10023510
jne 0x10023820
cmp dword [esi], 0
je 0x100237bd
test edi, edi
je 0x10023820
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebx
call fcn.100226c0
add esp, 0x14
cmp eax, 0xffffffff
je 0x10023820
test al, 1
je 0x10023820
cmp dword [esi], 0
jne 0x10023802
push 0x8000
mov dword [esi + 4], 0x8000
call dword [0x100550d8]
mov edi, dword [esi + 4]
xor ecx, ecx
add esp, 4
mov dword [esi], eax
mov dword [esi + 8], ecx
mov dword [esi + 0xc], ecx
cmp eax, ecx
je 0x1002381d
mov eax, dword [esi]
add eax, dword [esi + 8]
push 0
push edi
push eax
push ebx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x10023820
add dword [esi + 8], eax
pop edi
pop esi
pop ebx
ret
mov dword [esi + 4], ecx
pop edi
pop esi
pop ebx
ret

Function at 0x10023830
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + ecx*4 + 0x190]
mov eax, esi
call fcn.10023780
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
push 0
push eax
push ecx
push edi
call dword [sym.imp.WS2_32.dll_send]
mov ebx, dword [ebp + 0x18]
mov edi, eax
mov dword [ebx], 0
cmp edi, 0xffffffff
jne 0x100238b3
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp + 8], eax
cmp eax, 0x2733
jne 0x10023888
pop edi
pop esi
mov dword [ebx], 0x51
xor eax, eax
pop ebx
pop ebp
ret
push eax
push esi
call fcn.10028200
mov edx, dword [esi]
push eax
push str.Send_failure:__s
push edx
call fcn.10023390
mov eax, dword [esi]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x4734], ecx
add esp, 0x14
mov dword [ebx], 0x37
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x100284e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push str.kernel32
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
jne 0x10028504
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push edi
push str.LoadLibraryExA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, dword [ebp + 8]
mov edi, eax
push 0x1004f4d4
push ebx
mov dword [ebp - 8], edi
call fcn.1003abb5
add esp, 8
test eax, eax
je 0x10028552
test edi, edi
je 0x10028541
push 8
push 0
push ebx
call edi
pop edi
pop ebx
mov dword [ebp - 4], eax
pop esi
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
pop ebx
mov dword [ebp - 4], eax
pop esi
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x1002857a
push str.AddDllDirectory
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1002857a
push 0x800
push 0
push ebx
call edi
pop edi
pop ebx
mov dword [ebp - 4], eax
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, eax
test edi, edi
je 0x10028616
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10028593
sub eax, edx
lea eax, [eax + edi + 1]
push eax
call dword [0x100550d8]
mov esi, eax
add esp, 4
test esi, esi
je 0x1002860c
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1002860c
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100285c1
sub eax, edx
mov ecx, 0x5c
mov word [eax + esi], cx
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100285d8
sub eax, edx
lea edx, [eax + esi]
mov ecx, ebx
sub edx, ebx
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x100285e8
mov eax, dword [ebp - 8]
test eax, eax
je 0x10028602
push 8
push 0
push esi
call eax
jmp 0x10028609
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 4], eax
push esi
call dword [0x100550dc]
add esp, 4
mov eax, dword [ebp - 4]
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10028620
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x10055130]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x194]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x10028668
push eax
push str.WSAStartup_failed___d_
push esi
call fcn.10023390
add esp, 0xc
mov eax, 2
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10036a9a
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x1002868f
shr eax, 8
test al, al
jne 0x1002868f
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10036a9a
mov esp, ebp
pop ebp
ret
push str.insufficient_winsock_version_to_support_telnet
push esi
call fcn.10023390
mov ecx, dword [ebp - 4]
xor ecx, ebp
add esp, 8
mov eax, 2
call fcn.10036a9a
mov esp, ebp
pop ebp
ret
Function at 0x10028820
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [edi + 0x190]
push ebx
push esi
mov esi, dword [edi]
push 0
push 3
lea ecx, [ebp - 4]
mov ebx, eax
mov al, byte [ebp + 8]
push ecx
push edx
mov byte [ebp - 4], 0xff
mov byte [ebp - 3], al
mov byte [ebp - 2], bl
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x10028865
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push esi
call fcn.10023390
add esp, 0xc
mov esi, dword [ebp + 8]
mov ecx, dword [edi]
mov eax, ebx
mov ebx, str.SENT
call fcn.10028720
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100295e0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0x1f
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push ebx
mov ebx, dword [eax + 0x128]
mov dword [ebp - 4], eax
jne 0x1002972e
push esi
push edi
lea edi, [ebx + 0x1cb0]
lea esi, [ebx + 0x1eb0]
mov dword [esi], edi
cmp edi, esi
jae 0x10029616
mov byte [edi], 0xff
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x10029621
mov byte [eax], 0xfa
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x1002962c
mov byte [eax], 0x1f
inc dword [esi]
movzx ecx, word [ebx + 0x1ca8]
push ecx
call dword [sym.imp.WS2_32.dll_htons]
movzx edx, ax
movzx eax, word [ebx + 0x1caa]
push eax
mov dword [ebp + 0xc], edx
call dword [sym.imp.WS2_32.dll_htons]
movzx ecx, ax
mov eax, dword [esi]
cmp eax, esi
jae 0x1002965e
mov dl, byte [ebp + 0xc]
mov byte [eax], dl
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x1002966b
mov dl, byte [ebp + 0xd]
mov byte [eax], dl
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x10029675
mov byte [eax], cl
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x1002967f
mov byte [eax], ch
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x1002968a
mov byte [eax], 0xff
inc dword [esi]
mov eax, dword [esi]
cmp eax, esi
jae 0x10029695
mov byte [eax], pe_nt_image_headers32
inc dword [esi]
mov eax, dword [esi]
mov dword [ebx + 0x1eb4], eax
sub eax, edi
sub eax, 2
push eax
mov dword [esi], edi
mov esi, dword [ebp - 4]
lea eax, [ebx + 0x1cb2]
push 0x3e
call fcn.10028b90
mov esi, dword [sym.imp.WS2_32.dll_send]
add esp, 8
push 0
push 3
push edi
mov edi, dword [ebp + 8]
mov edx, dword [edi + 0x190]
push edx
call esi
test eax, eax
jns 0x100296eb
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
mov eax, dword [ebp - 4]
push str.Sending_data_failed___d_
push eax
call fcn.10023390
add esp, 0xc
lea ecx, [ebx + 0x1cb3]
push 4
push ecx
call fcn.10029490
mov edx, dword [edi + 0x190]
add esp, 8
push 0
push 2
add ebx, 0x1cb7
push ebx
push edx
call esi
pop edi
pop esi
test eax, eax
jns 0x1002972e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
mov eax, dword [ebp - 4]
push str.Sending_data_failed___d_
push eax
call fcn.10023390
add esp, 0xc
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002b000
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [esi + 0x10]
mov ecx, dword [eax]
push str.Connected_for_receive
push 0x100498ec
push ecx
call fcn.10023310
add esp, 0xc
mov eax, esi
mov dword [esi], 1
call fcn.1002a110
test eax, eax
jne 0x1002b034
mov eax, esi
pop ebp
jmp fcn.1002a5a0
pop ebp
ret