joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101a82b0
Capabilities:
Get socket status

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x18]
xor eax, eax
cmp ebx, eax
je 0x101a82c2
cmp dword [ebx], eax
jne 0x101a82f1
mov ecx, dword [esp + 0x1c]
cmp ecx, eax
je 0x101a82ce
cmp dword [ecx], eax
jne 0x101a82f5
mov edx, dword [esp + 0x20]
cmp edx, eax
je 0x101a82da
cmp dword [edx], eax
jne 0x101a82f9
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push ecx
push edx
call fcn.101a8260
add esp, 8
pop ebx
add esp, 0xc
ret
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
push esi
lea esi, [esp + 0xc]
mov dword [esp + 8], esi
mov esi, dword [esp + 0x2c]
push edi
mov edi, dword [esp + 0x2c]
cmp esi, eax
jg 0x101a8325
jl 0x101a8315
cmp edi, eax
jae 0x101a831b
mov dword [esp + 0xc], eax
jmp 0x101a8397
cmp esi, eax
jl 0x101a838f
jg 0x101a8325
cmp edi, eax
jbe 0x101a838f
push ebp
push eax
push 0x3e8
push esi
push edi
call fcn.101cf460
push 0
push 0x3e8
push edx
push eax
mov ebp, eax
mov ebx, edx
call fcn.101cf330
push 0
sub edi, eax
push 0x3e8
sbb esi, edx
push esi
push edi
call fcn.101cf330
mov dword [esp + 0x18], edx
test ebx, ebx
jl 0x101a8376
jg 0x101a8369
cmp ebp, 0x7fffffff
jbe 0x101a8376
mov ebp, Ordinal_1
mov dword [esp + 0x18], 0
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], eax
xor eax, eax
pop ebp
jmp 0x101a8397
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
cmp edx, eax
je 0x101a839f
cmp dword [edx], eax
jne 0x101a83a1
xor edx, edx
cmp ecx, eax
je 0x101a83a9
cmp dword [ecx], eax
jne 0x101a83ab
xor ecx, ecx
cmp ebx, eax
je 0x101a83b5
cmp dword [ebx], eax
je 0x101a83b5
mov eax, ebx
mov esi, dword [esp + 0xc]
push esi
push edx
push ecx
push eax
mov eax, dword [esp + 0x2c]
inc eax
push eax
call dword [sym.imp.WS2_32.dll_select]
pop edi
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x101afc40
Capabilities:
Move file

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
call fcn.10189620
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov esi, dword [eax]
mov edi, dword [eax + 4]
mov ebx, dword [eax + 8]
mov ebp, dword [eax + 0xc]
add esp, 4
push 1
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x101afcdd
lea eax, [esp + 0x10]
push eax
call fcn.10189620
mov edx, dword [eax]
sub esp, 0xc
mov ecx, esp
mov dword [ecx], esi
mov dword [ecx + 4], edi
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], ebp
sub esp, 0x10
mov ecx, esp
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], eax
call fcn.101896c0
add esp, 0x20
test edx, edx
ja 0x101afce7
jb 0x101afcbf
cmp eax, 0x3e8
ja 0x101afce7
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x101afc75
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x10
ret

Function at 0x101b3d00
Capabilities:
Get hostname

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push esi
mov byte [esi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [esi + edi - 1], 0
test eax, eax
jne 0x101b3d33
push 0x2e
push esi
call dword [sym.imp.MSVCR100.dll_strchr]
add esp, 8
test eax, eax
je 0x101b3d31
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
ret
Function at 0x101b7b80
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea eax, [ecx + eax*2 + 0xc]
push edi
push eax
call dword [0x10263bac]
mov edi, eax
add esp, 4
test edi, edi
jne 0x101b7ba5
pop edi
pop esi
pop ecx
ret
lea eax, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], eax
mov edx, dword [esi + 0xc]
push ebx
add edx, eax
push ebp
mov ebp, dword [esp + 0x20]
mov dword [edi + 8], edx
cmp ebp, dword [esi + 0x10]
jbe 0x101b7bec
push eax
mov eax, dword [esi]
call eax
mov ecx, dword [esp + 0x20]
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push ebp
push ecx
push edx
call eax
mov ebx, dword [edi + 8]
mov ecx, dword [edi + 4]
add ebx, dword [esi + 0xc]
mov edx, dword [esi + 8]
push ecx
push ebx
call edx
mov ebp, dword [esi + 0x14]
add esp, 0x18
jmp 0x101b7bf0
mov ebx, dword [esp + 0x1c]
mov eax, dword [edi + 4]
mov ecx, dword [esi]
push eax
call ecx
mov edx, dword [edi + 8]
mov eax, dword [esi]
push edx
call eax
add esp, 8
mov dword [esp + 0x10], 0
test ebp, ebp
je 0x101b7c4c
mov dword [esp + 0x10], ebp
mov cl, byte [ebx]
xor cl, 0x36
mov byte [esp + 0x18], cl
mov eax, dword [edi + 4]
mov ecx, dword [esi + 4]
push 1
lea edx, [esp + 0x1c]
push edx
push eax
call ecx
mov dl, byte [ebx]
xor dl, 0x5c
mov byte [esp + 0x24], dl
mov ecx, dword [edi + 8]
mov edx, dword [esi + 4]
push 1
lea eax, [esp + 0x28]
push eax
push ecx
inc ebx
call edx
add esp, 0x18
dec ebp
jne 0x101b7c13
mov eax, dword [esp + 0x10]
pop ebp
pop ebx
cmp eax, dword [esi + 0x10]
jae 0x101b7c88
mov ecx, dword [edi + 4]
mov edx, dword [esi + 4]
push 1
push 0x102432dc
push ecx
call edx
mov eax, dword [edi + 8]
mov ecx, dword [esi + 4]
push 1
push 0x102432dd
push eax
call ecx
mov eax, dword [esp + 0x20]
inc eax
add esp, 0x18
mov dword [esp + 8], eax
cmp eax, dword [esi + 0x10]
jb 0x101b7c57
mov eax, edi
pop edi
pop esi
pop ecx
ret

Function at 0x101b9cb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x101b9ccb
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x101b9d02
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x101b9cfe
jmp 0x101b9cf0
cmp esi, eax
jae 0x101b9d02
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x101b9cf0
cmp esi, eax
jb 0x101b9d09
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x101baf70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
mov eax, dword [edi + 4]
cmp esi, dword [eax]
jne 0x101baf9b
cmp dword [ebp + 0x10], eax
jne 0x101baf9b
call fcn.101baf00
mov eax, dword [edi + 4]
mov ecx, dword [eax]
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], ecx
pop esi
pop ebp
ret 0xc
cmp esi, dword [ebp + 0x10]
je 0x101bb089
push ebx
mov edx, dword [esi]
mov dword [ebp + 0xc], edx
mov ecx, dword [esi + 8]
mov eax, ecx
lea ebx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x101bafb2
sub eax, ebx
add eax, ecx
mov edx, 0x811c9dc5
cmp ecx, eax
je 0x101bafd6
movsx ebx, byte [ecx]
imul edx, edx, 0x1000193
inc ecx
xor edx, ebx
cmp ecx, eax
jne 0x101bafc6
mov ecx, dword [edi + 0x20]
mov eax, ecx
and eax, edx
cmp dword [edi + 0x24], eax
ja 0x101bafeb
shr ecx, 1
or edx, 0xffffffff
sub edx, ecx
add eax, edx
mov ecx, dword [edi + 0x10]
cmp dword [ecx + eax*8 + 4], esi
lea ecx, [ecx + eax*8]
jne 0x101bb014
cmp dword [ecx], esi
jne 0x101bb00c
mov edx, dword [edi + 4]
mov dword [ecx], edx
mov ecx, dword [edi + 0x10]
mov edx, dword [edi + 4]
mov dword [ecx + eax*8 + 4], edx
jmp 0x101bb01c
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
jmp 0x101bb01c
cmp dword [ecx], esi
jne 0x101bb01c
mov edx, dword [esi]
mov dword [ecx], edx
cmp esi, dword [edi + 4]
je 0x101bb07a
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov dword [eax], ecx
mov edx, dword [esi]
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 0xc]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x101bb04f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esi + 8]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x101bb06e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push esi
call sub.mfc100u.dll_delete
add esp, 4
dec dword [edi + 8]
mov ecx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
cmp esi, ecx
jne 0x101bafa5
pop ebx
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
pop ebp
ret 0xc
Function at 0x101bb440
Capabilities:
Get number of processors
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101d2fc2
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10263fdc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov dword [esi + 4], eax
lea eax, [ebp + 0xb]
mov dword [esi + 0x10], edx
push eax
lea edx, [ebp + 0xa]
xor edi, edi
mov dword [esi + 0xc], ecx
lea ecx, [esi + 0x38]
push edx
mov dword [esi], edi
mov dword [esi + 8], edi
call fcn.101b9aa0
lea eax, [ebp + 0xb]
push eax
lea edx, [ebp + 0xa]
lea ecx, [esi + 0x64]
push edx
mov dword [ebp - 4], edi
call fcn.101b9aa0
mov eax, dword [0x10263ff8]
mov edx, dword [eax + 0xc]
mov ecx, 0x10263ff8
mov byte [ebp - 4], 1
call edx
add eax, 0x10
mov dword [esi + 0x90], eax
mov eax, dword [0x10263ff8]
mov edx, dword [eax + 0xc]
mov ecx, 0x10263ff8
mov byte [ebp - 4], 2
call edx
add eax, 0x10
mov dword [esi + 0x94], eax
mov eax, dword [esi + 4]
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, 0xffff0001
add ecx, 0xffff
mov byte [ebp - 4], 3
mov word [esi + 0x98], cx
mov dword [esi + 0x9c], edi
mov dword [esi + 0xa0], edi
mov dword [esi + 0xa4], edi
mov dword [esi + 0xa8], edi
cmp eax, edi
je 0x101bb548
push 0x20
call sub.mfc100u.dll_new__
add esp, 4
cmp eax, edi
je 0x101bb56f
push 0x101b8dc0
push 0x101b8da0
push 7
lea ebx, [eax + 4]
push 4
push ebx
mov dword [eax], 7
call fcn.101cf0eb
jmp 0x101bb571
push 4
call sub.mfc100u.dll_new
mov ebx, eax
add esp, 4
cmp ebx, edi
je 0x101bb56f
mov edx, dword [0x10263ff8]
mov eax, dword [edx + 0xc]
mov ecx, 0x10263ff8
call eax
add eax, 0x10
mov dword [ebx], eax
jmp 0x101bb571
xor ebx, ebx
xor ecx, ecx
cmp dword [esi + 4], edi
lea edx, [esi + 0x18]
sete cl
mov dword [esi + 0x9c], ebx
push ecx
push edx
call fcn.101c5090
add esp, 8
mov dword [esi + 0x30], esi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x101befe0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, 0x574
call fcn.101cf170
mov eax, dword [0x10263fdc]
xor eax, esp
mov dword [esp + 0x570], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [esp + 0x40], esi
mov dword [esp + 0x3c], 0
test edi, edi
jne 0x101bf02e
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x570]
xor ecx, esp
call fcn.101ce9e2
mov esp, ebp
pop ebp
ret
push 0x101fe86c
push esi
call fcn.100ae1d0
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x101bf07c
push 0x62
push str.crypto_rand_randfile.c
push 0x79
push 0x6f
push 0x24
call fcn.1003c300
push esi
push str.Filename
push 2
call fcn.1003c880
add esp, 0x20
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x570]
xor ecx, esp
call fcn.101ce9e2
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x48]
push eax
push ebx
call sub.MSVCR100.dll__fileno
add esp, 4
push eax
call sub.MSVCR100.dll__fstat64i32
add esp, 8
test eax, eax
jns 0x101bf0d7
push 0x69
push str.crypto_rand_randfile.c
push 0x71
push 0x6f
push 0x24
call fcn.1003c300
push esi
push str.Filename
push 2
call fcn.1003c880
push ebx
call sub.MSVCR100.dll_fclose
add esp, 0x24
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x570]
xor ecx, esp
call fcn.101ce9e2
mov esp, ebp
pop ebp
ret
test edi, edi
jns 0x101bf0ee
test dword [esp + 0x4e], 0x8000
mov edi, dword [esp + 0x5c]
jne 0x101bf0ee
mov edi, 0x100
push 0
push ebx
call sub.MSVCR100.dll_setbuf
add esp, 8
test edi, edi
jle 0x101bf110
cmp edi, 0x500
jg 0x101bf109
mov eax, edi
jmp 0x101bf115
mov eax, 0x400
jmp 0x101bf115
mov eax, 0x500
push ebx
push eax
lea ecx, [esp + 0x80]
push 1
push ecx
call sub.MSVCR100.dll_fread
mov esi, eax
push ebx
mov dword [esp + 0x58], esi
call sub.MSVCR100.dll_ferror
add esp, 0x14
test eax, eax
je 0x101bf152
call sub.MSVCR100.dll__errno
cmp dword [eax], 4
jne 0x101bf152
push ebx
call sub.MSVCR100.dll_clearerr
add esp, 4
test esi, esi
je 0x101bf0f9
jmp 0x101bf156
test esi, esi
je 0x101bf18a
fild dword [esp + 0x44]
mov eax, 8
call fcn.101cf170
lea edx, [esp + 0x80]
fstp qword [esp]
push esi
push edx
call fcn.10058760
add dword [esp + 0x4c], esi
add esp, 0x10
test edi, edi
jle 0x101bf110
sub edi, esi
test edi, edi
jg 0x101bf0fd
lea eax, [esp + 0x78]
push 0x500
push eax
call fcn.10045ee0
push ebx
call sub.MSVCR100.dll_fclose
add esp, 0xc
call fcn.100587d0
test eax, eax
jne 0x101bf1ca
push 0xa6
push str.crypto_rand_randfile.c
push 0x76
push 0x6f
push 0x24
call fcn.1003c300
mov ecx, dword [esp + 0x54]
push ecx
jmp 0x101bf055
mov ecx, dword [esp + 0x57c]
mov eax, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.101ce9e2
mov esp, ebp
pop ebp
ret
Function at 0x101bf1f0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xc
call fcn.101cf170
mov eax, dword [0x10263fdc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push esi
push edi
push 0
push 0
mov edi, str.RANDFILE
push edi
mov dword [ebp - 0xc], 1
call ebx
mov esi, eax
test esi, esi
jne 0x101bf260
push eax
push eax
mov edi, str.HOME
push edi
mov dword [ebp - 0xc], eax
call ebx
mov esi, eax
test esi, esi
jne 0x101bf260
push eax
push eax
mov edi, str.USERPROFILE
push edi
call ebx
mov esi, eax
test esi, esi
jne 0x101bf260
push eax
push eax
mov edi, str.SYSTEMROOT
push edi
call ebx
mov esi, eax
test esi, esi
je 0x101bf382
lea eax, [esi + esi]
call fcn.101cf370
mov eax, esp
push esi
push eax
push edi
mov dword [ebp - 8], eax
call ebx
cmp eax, esi
jae 0x101bf382
mov eax, dword [ebp - 8]
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
call ebx
mov edi, eax
test edi, edi
je 0x101bf382
call fcn.101cf370
mov ecx, dword [ebp - 8]
mov esi, esp
push 0
push 0
push edi
push esi
push 0xffffffffffffffff
push ecx
push 0
push 0xfde9
call ebx
test eax, eax
je 0x101bf382
test esi, esi
je 0x101bf382
cmp byte [esi], 0
je 0x101bf382
mov eax, esi
lea edx, [eax + 1]
jmp 0x101bf2e0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x101bf2e0
sub eax, edx
cmp dword [ebp - 0xc], 0
je 0x101bf320
inc eax
cmp eax, dword [ebp + 0xc]
jae 0x101bf382
mov eax, dword [ebp + 8]
mov edi, eax
mov ecx, esi
sub edi, esi
mov dl, byte [ecx]
mov byte [edi + ecx], dl
inc ecx
test dl, dl
jne 0x101bf302
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101ce9e2
mov esp, ebp
pop ebp
ret
add eax, 6
cmp eax, dword [ebp + 0xc]
jae 0x101bf382
mov eax, dword [ebp + 8]
mov edi, eax
mov ecx, esi
sub edi, esi
mov dl, byte [ecx]
mov byte [edi + ecx], dl
inc ecx
test dl, dl
jne 0x101bf331
lea edi, [eax - 1]
mov edi, edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x101bf340
mov dx, word [0x1024d0ac]
mov word [edi], dx
lea ecx, [eax - 1]
mov dl, byte [ecx + 1]
inc ecx
test dl, dl
jne 0x101bf355
mov edx, dword [str..rnd]
mov dword [ecx], edx
mov dl, byte [0x102451f0]
mov byte [ecx + 4], dl
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101ce9e2
mov esp, ebp
pop ebp
ret
xor eax, eax
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101ce9e2
mov esp, ebp
pop ebp
ret
Function at 0x101bff40
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov dword [ebp - 8], 1
mov dword [ebp - 4], 0
test eax, eax
jne 0x101bff92
mov edi, dword [ebp + 8]
mov ebx, dword [sym.imp.WS2_32.dll_setsockopt]
push 4
lea eax, [ebp - 8]
push eax
push 0xfffffffffffffffb
push 0xffff
push edi
call ebx
push 4
lea ecx, [ebp - 4]
push ecx
push 4
push 0xffff
push edi
mov esi, eax
call ebx
pop edi
or eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 1
jne 0x101bffcb
mov edi, dword [ebp + 8]
mov ebx, dword [sym.imp.WS2_32.dll_setsockopt]
push 4
lea edx, [ebp - 4]
push edx
push 0xfffffffffffffffb
push 0xffff
push edi
call ebx
push 4
mov esi, eax
lea eax, [ebp - 4]
push eax
push 4
push 0xffff
push edi
call ebx
pop edi
or eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 2
jne 0x101c0004
mov edi, dword [ebp + 8]
mov ebx, dword [sym.imp.WS2_32.dll_setsockopt]
push 4
lea ecx, [ebp - 4]
push ecx
push 0xfffffffffffffffb
push 0xffff
push edi
call ebx
push 4
lea edx, [ebp - 8]
push edx
push 4
push 0xffff
push edi
mov esi, eax
call ebx
pop edi
or eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x101c02b0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [ebp - 4]
mov ebx, dword [ebp + 0xc]
xor ecx, ecx
mov dword [ebp - 8], eax
cmp edx, ecx
ja 0x101c02e8
jb 0x101c02de
cmp eax, ebx
jae 0x101c02e8
mov eax, ebx
mov edx, ecx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov ecx, dword [ebp + 0x18]
push 0
push eax
push edx
push ecx
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 8], eax
test eax, eax
jne 0x101c030e
call fcn.101b8ba0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov edx, dword [ebp + 0x10]
test ebx, ebx
jne 0x101c031f
mov ecx, dword [ebp - 8]
sub ecx, edx
mov dword [esi + 4], ecx
jmp 0x101c0322
mov dword [esi + 4], ebx
mov ecx, dword [ebp + 0x1c]
mov dword [esi + 0x10], edx
mov edx, dword [ebp + 0x14]
push 0
mov dword [esi + 0x14], edx
mov edx, dword [esi + 4]
push edx
mov edx, dword [esi + 0x10]
push edx
mov edx, dword [esi + 0x14]
push edx
push ecx
push eax
mov dword [esi + 0x18], ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
mov dword [esi], eax
test eax, eax
jne 0x101c0370
call fcn.101b8ba0
mov edi, eax
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
mov dword [esi + 8], 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x101c0510
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
xor eax, eax
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x24]
mov word [ebp - 0x24], ax
mov eax, dword [ebp + 8]
push edx
push eax
mov dword [ebp - 8], 0x1c
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x101c053f
xor eax, eax
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push ecx
push edx
push eax
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x24]
push edx
call fcn.101c03f0
add esp, 0x14
mov esp, ebp
pop ebp
ret

Function at 0x101c0560
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, dword [ebp + 0xc]
mov ecx, dword [edi + 4]
push 0
push 0x80
push 3
push 0
push 1
push Ordinal_1
test ecx, ecx
je 0x101c058e
mov eax, dword [ebp + 8]
push eax
call fcn.101c0180
jmp 0x101c0598
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x101c05fd
call fcn.101b8ba0
test eax, eax
js 0x101c0610
mov eax, dword [edi]
lea edx, [ebp - 4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x101c05c7
call fcn.101b8ba0
test eax, eax
js 0x101c0610
mov eax, dword [ebp - 8]
push esi
mov esi, dword [ebp - 4]
test esi, esi
jne 0x101c05d3
test eax, eax
je 0x101c0601
mov edx, dword [ebp + 0x14]
xor ecx, ecx
cmp esi, ecx
ja 0x101c0601
jb 0x101c05e2
cmp eax, edx
ja 0x101c0601
mov eax, dword [edi]
mov ecx, dword [ebp + 0x10]
push 4
push 2
push 0
push 0
push 0
push eax
call fcn.101c02b0
pop esi
pop edi
mov esp, ebp
pop ebp
ret
mov dword [edi], eax
jmp 0x101c05a6
or eax, esi
mov eax, 0x800703ee
je 0x101c060f
mov eax, 0x800700df
pop esi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x101c0780
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x10263fdc]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
xor eax, eax
push esi
mov esi, dword [ebp + 0x10]
mov dword [esi + 2], eax
mov dword [esi + 6], eax
mov dword [esi + 0xa], eax
mov dword [esi + 0xe], eax
mov dword [esi + 0x12], eax
push edi
mov dword [esi + 0x16], eax
mov dword [ebp - 0xa8], eax
mov word [esi + 0x1a], ax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], eax
movzx eax, word [esi]
push 3
lea edx, [ebp - 0x84]
push ecx
lea ecx, [ebp - 0x88]
mov dword [ebp - 0xac], 0x100
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x88], edx
call fcn.101c06b0
mov edx, dword [ebp - 0x88]
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0xac]
push ecx
push 0
push edx
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov edi, eax
mov eax, dword [ebp - 0x88]
lea ecx, [ebp - 0x84]
cmp eax, ecx
je 0x101c0849
push eax
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
test edi, edi
je 0x101c0866
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101ce9e2
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp - 0x8c]
xor edi, edi
mov eax, ebx
test ebx, ebx
je 0x101c08a1
mov ecx, dword [eax + 4]
cmp ecx, 2
je 0x101c088b
cmp ecx, 0x17
je 0x101c088b
mov eax, dword [eax + 0x1c]
test eax, eax
jne 0x101c0875
jmp 0x101c08a1
mov edx, dword [eax + 0x10]
mov eax, dword [eax + 0x18]
push edx
push eax
push esi
call sub.MSVCR100.dll_memcpy
add esp, 0xc
mov edi, 1
push ebx
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
pop ebx
test edi, edi
je 0x101c08cd
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.WS2_32.dll_htons]
mov word [esi + 2], ax
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101ce9e2
mov esp, ebp
pop ebp
ret
push 0x2af9
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.101ce9e2
mov esp, ebp
pop ebp
ret

Function at 0x101c0b20
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov al, byte [edx]
push esi
push edi
mov edi, ecx
mov esi, 0x811c9dc5
test al, al
je 0x101c0b53
lea ecx, [eax - 0x41]
inc edx
cmp cl, 0x19
ja 0x101c0b42
add al, 0x20
imul esi, esi, 0x1000193
movsx eax, al
xor esi, eax
mov al, byte [edx]
test al, al
jne 0x101c0b37
mov edx, dword [edi + 0x20]
mov eax, edx
and eax, esi
cmp dword [edi + 0x24], eax
pop edi
pop esi
ja 0x101c0b6a
shr edx, 1
or ecx, 0xffffffff
sub ecx, edx
add eax, ecx
pop ebp
ret 4