joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000131e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x10001326
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x10001317
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
faddp st(6)
inc ebp
mov cl, 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.100010d2
mov edx, 0x8d6cb83e
inc ebp
test al, 0x50
call fcn.100010e2
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.10001097
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x100013c0
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.100010d2
xchg ebp, eax
xchg esi, eax
xchg ecx, eax
add al, 0x8d
inc ebp
rcl byte [eax - 0x18], 0xc5
cld
invalid

Function at 0x1000148d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
xchg esp, eax
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
invalid
inc ebp

Function at 0x100014bb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lahf
adc esi, eax
inc ebp
mov al, byte [0xa145c633]
invalid

Function at 0x100014cf
Capabilities:
Contain obfuscated stackstrings

Disassembly:
movsb byte es:[edi], byte [esi]
and al, dh
inc ebp
movsd dword es:[edi], dword [esi]
xor eax, 0x41a645c6

Function at 0x100014d9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.100010e2
push eax
push esi
push dword [ebp + 8]
Function at 0x100014e3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.10001097
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.100010e2
push eax
push esi
push dword [ebp + 8]
call fcn.10001097
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.100010d2
add ah, byte [ebp + ecx*8 + 0x7c9d886b]
invalid

Function at 0x100025be
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
invalid
call dword [edx - 0x3a]
test edx, esp
clc
invalid
dec dword [ecx - 0x3a]
test ebx, esp
clc
invalid
call [eax - 0x3a]
test esp, esp
clc
invalid
call [esi - 0x3a]
test ebp, esp
clc
invalid
dec dword [ecx - 0x3a]
test esi, esp
clc
invalid
invalid
cmp eax, 0xffeb17e8
call esp
add ebp, dword [edx + esi*2]
jb 0x1000254d
test esp, edx
clc
invalid
call dword [eax - 0x18]
pop ss
jmp 0x100025c9
call [ecx + 0x50]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10001097
add esp, 0xc
mov dword [ebp - 0x6e4], eax
call fcn.100010d2
mov byte [edx], dh
mov bl, 0x40
lea eax, [ebp - 0x718]
push eax
push 0x40
push 5
push dword [ebp - 0x3a8]
call dword [ebp - 0x6e4]
jb 0x1000254d
test esp, edx
clc
invalid
Function at 0x100049f1
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
push ebx
push esi
push edi
je 0x10004a46
push dword [esp + 0x10]
push 0x10004970
call dword [sym.imp.USER32.DLL_EnumWindows]
mov esi, dword [0x1003fc14]
test esi, esi
je 0x10004a9f
xor edi, edi
mov ebx, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 8], eax
jne 0x10004a3e
cmp byte [esi + 0x10], 0
je 0x10004a3e
push 3
push edi
push edi
push edi
push edi
push 0xfffffffffffffffe
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
mov esi, ebx
test ebx, ebx
jne 0x10004a1a
jmp 0x10004a9f
mov esi, dword [0x1003fc14]
test esi, esi
je 0x10004a9f
xor edi, edi
push ebp
mov ebx, dword [esi]
lea ebp, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp], eax
jne 0x10004a98
cmp byte [esi + 0x11], 0
je 0x10004a74
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_EnableWindow]
cmp byte [esi + 0x10], 0
je 0x10004a8b
push 3
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
push ebp
push 0x1003fc14
call fcn.1000fa01
pop ecx
pop ecx
mov esi, ebx
test ebx, ebx
jne 0x10004a53
pop ebp
pop edi
pop esi
pop ebx
ret 4

Function at 0x10004bef
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
cmp dword [ebp + 8], edi
je 0x10004c79
cmp dword [ebp + 0xc], edi
je 0x10004c79
push esi
push 0x28
push 8
push dword [0x1003fab8]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push dword [ebp + 8]
mov esi, eax
or dword [esi + 4], 0xffffffff
mov dword [esi], edi
call sub.MSVCRT.dll__strdup
push dword [ebp + 0xc]
mov dword [esi + 8], eax
call sub.MSVCRT.dll__strdup
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x1c], eax
pop ecx
pop ecx
test al, 1
je 0x10004c68
lea eax, [ebp + 8]
push eax
push edi
push esi
push 0x10004d7d
push 0x2000
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x10004c60
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, esi
jmp 0x10004c78
push esi
call fcn.10004fbf
jmp 0x10004c77
push esi
call fcn.10004c92
push esi
mov edi, eax
call fcn.10004fbf
pop ecx
pop ecx
pop esi
mov eax, edi
pop edi
pop ebp
ret 0xc
Function at 0x10004c92
Capabilities:
Delete file

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
xor ebx, ebx
push edi
mov eax, dword [esi + 8]
mov ebp, dword [esi + 0xc]
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], ebp
call fcn.100104e0
mov edi, eax
test edi, edi
je 0x10004d62
push dword [esp + 0x18]
call fcn.10035780
push ebx
push pe_nt_image_headers32
push 2
push ebx
push 1
push 0xc0000000
push ebp
mov dword [esp + 0x34], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x10004d52
test byte [esi + 0x1c], 2
mov dword [esi + 0x10], ebp
jne 0x10004cfb
push 1
push 0x34
push edi
call fcn.10010570
add esp, 0xc
push dword [esp + 0x18]
push 0x2712
push edi
call fcn.10010570
push 0x10004d8c
push 0x4e2b
push edi
call fcn.10010570
push esi
push 0x2711
push edi
call fcn.10010570
push edi
call fcn.10010560
add esp, 0x28
test eax, eax
jne 0x10004d3d
xor ebx, ebx
mov dword [esi + 4], 0xfffffffe
inc ebx
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x10004d52
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [esp + 0x18]
call fcn.10035770
push edi
call fcn.100104c0
pop ecx
cmp dword [esi + 4], 0xfffffffe
je 0x10004d75
cmp dword [esi + 4], 0xfffffffc
je 0x10004d75
mov dword [esi + 4], 0xfffffffd
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
pop ecx
ret

Function at 0x10007993
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
call dword [sym.imp.USER32.DLL_GetFocus]
mov esi, dword [sym.imp.USER32.DLL_GetKeyState]
mov ebx, eax
test ebx, ebx
je 0x10007a0d
push 9
call esi
test al, al
jns 0x10007a0d
push 0x11
call esi
test al, al
js 0x10007a0d
push 0x10
call esi
test al, al
js 0x10007a0d
push 0x12
call esi
test al, al
js 0x10007a0d
push 5
lea eax, [ebp - 0xc]
push eax
push ebx
call dword [sym.imp.USER32.DLL_GetClassNameA]
push 4
lea eax, [ebp - 0xc]
push str.Rich
push eax
call sub.MSVCRT.dll_strncmp
add esp, 0xc
test eax, eax
jne 0x10007a0d
push eax
push eax
push 0x44e
push ebx
call dword [sym.imp.USER32.DLL_SendMessageA]
test eax, 0x800
jne 0x10007a0d
xor eax, eax
jmp 0x10007a8e
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x10007a35
push 0x11
call esi
test al, al
js 0x10007a2d
push 0x10
call esi
test al, al
js 0x10007a2d
push 0x12
call esi
test al, al
jns 0x10007a35
push 1
push edi
call fcn.10007a96
mov esi, dword [sym.imp.USER32.DLL_GetPropA]
test ebx, ebx
je 0x10007a4b
push str.PB_Hotkey
push ebx
call esi
test eax, eax
jne 0x10007a8b
push str.PB_WindowID
push edi
call esi
mov esi, eax
test esi, esi
je 0x10007a8b
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.USER32.DLL_GetWindowThreadProcessId]
test eax, eax
je 0x10007a8b
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 4], eax
jne 0x10007a8b
lea eax, [esi - 1]
push eax
push dword [0x10040124]
call fcn.1000f2b8
test eax, eax
je 0x10007a8b
mov eax, dword [eax + 8]
jmp 0x10007a8d
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10009710
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x10009742
push 0
lea ecx, [esp + 0x10]
push ecx
push esi
push dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1000973d
cmp dword [esp + 0xc], esi
je 0x10009759
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [edi + 4]
add eax, dword [edi + 8]
push esi
push dword [esp + 0x14]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add dword [edi + 8], esi
pop edi
mov eax, 1
pop esi
ret

Function at 0x1000bbd7
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 0xc], esi
je 0x1000bc80
cmp dword [ebp + 0x10], esi
je 0x1000bc80
push edi
push dword [ebp + 8]
push dword [0x1004024c]
call fcn.1000f2b8
mov edi, eax
test edi, edi
je 0x1000bc7f
or dword [edi + 0x28], 0xffffffff
or dword [edi + 0x2c], 0xffffffff
cmp dword [ebp + 0x14], esi
je 0x1000bc6e
push 0xc
push esi
push dword [0x1003fab8]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push dword [ebp + 0x10]
mov dword [ebp + 8], eax
mov dword [eax], edi
add eax, 4
push eax
call fcn.100100d0
mov edi, dword [ebp + 8]
push dword [ebp + 0xc]
lea eax, [edi + 8]
push eax
call fcn.100100d0
lea eax, [ebp + 0x10]
push eax
push esi
push edi
push 0x1000be34
push 0x10000
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x1000bc65
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
jmp 0x1000bc7f
push edi
call fcn.1000bbb1
pop ecx
jmp 0x1000bc7f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.1000bc9d
add esp, 0xc
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebp
ret 0x10
Function at 0x1000bc9d
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x1048
call fcn.100041a0
push ebx
push ebp
push esi
push edi
push dword [esp + 0x1060]
xor edi, edi
mov ebx, edi
call fcn.10035780
mov esi, dword [esp + 0x105c]
mov ebp, eax
push 0x10036390
push str.TYPE
push esi
mov dword [esp + 0x1c], ebp
call fcn.1000cd35
test eax, eax
je 0x1000be09
push 0x1003639c
push esi
call fcn.1000cc34
test eax, eax
je 0x1000be09
lea eax, [esp + 0x20]
push eax
push esi
call fcn.1000ce53
test eax, eax
je 0x1000be09
push ebp
push str.RETR
push esi
call fcn.1000cd35
test eax, eax
je 0x1000bdf4
push str.125_150
push esi
call fcn.1000cc34
test eax, eax
je 0x1000bdf4
cmp dword [esi + 0x1c], edi
jne 0x1000bd45
lea eax, [esp + 0x20]
push eax
push esi
call fcn.1000cdfd
test eax, eax
je 0x1000bdf4
lea eax, [esp + 0x20]
xor ebx, ebx
push eax
inc ebx
push esi
mov dword [esp + 0x1c], ebx
call fcn.1000cfd9
test eax, eax
je 0x1000bdf4
push edi
push pe_nt_image_headers32
push 2
push edi
push ebx
push 0xc0000000
push dword [esp + 0x107c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
test ebp, ebp
je 0x1000bdf0
push 0x1000
lea eax, [esp + 0x5c]
mov dword [esi + 0x28], edi
push eax
lea eax, [esp + 0x28]
mov dword [esi + 0x2c], edi
push eax
mov dword [esi + 0x30], edi
call fcn.1000cc48
mov dword [esp + 0x18], eax
test eax, eax
je 0x1000bde7
mov ebx, eax
cmp dword [esi + 0x30], edi
jne 0x1000bde3
push edi
lea eax, [esp + 0x20]
push eax
push ebx
lea eax, [esp + 0x64]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, ebx
cdq
add dword [esi + 0x28], eax
lea eax, [esp + 0x58]
push 0x1000
adc dword [esi + 0x2c], edx
push eax
lea eax, [esp + 0x28]
push eax
call fcn.1000cc48
mov ebx, eax
test ebx, ebx
jne 0x1000bda8
mov ebx, dword [esp + 0x14]
push ebp
mov edi, ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebp, dword [esp + 0x10]
lea eax, [esp + 0x20]
push eax
push esi
call fcn.1000cfb7
test ebx, ebx
je 0x1000be09
push esi
call fcn.1000cd06
push ebp
call fcn.10035770
or dword [esi + 0x2c], 0xffffffff
test edi, edi
je 0x1000be20
mov dword [esi + 0x28], 0xfffffffd
jmp 0x1000be27
mov dword [esi + 0x28], 0xfffffffe
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1048
ret
Function at 0x1000bf23
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x1000bfcc
cmp dword [ebp + 0xc], esi
je 0x1000bfcc
push edi
push dword [ebp + 8]
push dword [0x1004024c]
call fcn.1000f2b8
mov edi, eax
test edi, edi
je 0x1000bfcb
or dword [edi + 0x28], 0xffffffff
or dword [edi + 0x2c], 0xffffffff
cmp dword [ebp + 0x14], esi
je 0x1000bfba
push 0xc
push esi
push dword [0x1003fab8]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push dword [ebp + 0xc]
mov dword [ebp + 8], eax
mov dword [eax], edi
add eax, 4
push eax
call fcn.100100d0
mov edi, dword [ebp + 8]
push dword [ebp + 0x10]
lea eax, [edi + 8]
push eax
call fcn.100100d0
lea eax, [ebp + 0x10]
push eax
push esi
push edi
push 0x1000c161
push 0x4000
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x1000bfb1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
jmp 0x1000bfcb
push edi
call fcn.1000befd
pop ecx
jmp 0x1000bfcb
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.1000bfe9
add esp, 0xc
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebp
ret 0x10
Function at 0x1000bfe9
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x1040
call fcn.100041a0
push ebx
push ebp
push esi
push edi
push dword [esp + 0x105c]
xor edi, edi
mov dword [esp + 0x18], edi
call fcn.10035780
push edi
push pe_nt_image_headers32
push 3
push edi
push 1
push 0x80000000
push dword [esp + 0x1070]
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, dword [esp + 0x1054]
mov ebx, eax
test ebx, ebx
je 0x1000c136
push 0x10036390
push str.TYPE
push esi
call fcn.1000cd35
test eax, eax
je 0x1000c12f
push 0x1003639c
push esi
call fcn.1000cc34
test eax, eax
je 0x1000c12f
lea eax, [esp + 0x18]
push eax
push esi
call fcn.1000ce53
test eax, eax
je 0x1000c12f
push ebp
push str.STOR
push esi
call fcn.1000cd35
test eax, eax
je 0x1000c117
push str.125_150
push esi
call fcn.1000cc34
test eax, eax
je 0x1000c117
cmp dword [esi + 0x1c], edi
jne 0x1000c0ae
lea eax, [esp + 0x18]
push eax
push esi
call fcn.1000cdfd
test eax, eax
je 0x1000c117
lea eax, [esp + 0x18]
mov dword [esp + 0x14], 1
push eax
push esi
call fcn.1000cfd9
test eax, eax
je 0x1000c117
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
push edi
lea eax, [esp + 0x14]
push eax
push 0x1000
lea eax, [esp + 0x5c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0x10], edi
jle 0x1000c114
push dword [esp + 0x10]
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.1000cd72
test eax, eax
je 0x1000c117
mov eax, dword [esp + 0x10]
cdq
add dword [esi + 0x28], eax
adc dword [esi + 0x2c], edx
cmp dword [esi + 0x30], edi
je 0x1000c0ce
jmp 0x1000c117
xor edi, edi
inc edi
lea eax, [esp + 0x18]
push eax
push esi
call fcn.1000cfb7
cmp dword [esp + 0x14], 0
je 0x1000c12f
push esi
call fcn.1000cd06
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call fcn.10035770
or dword [esi + 0x2c], 0xffffffff
test edi, edi
je 0x1000c14d
mov dword [esi + 0x28], 0xfffffffd
jmp 0x1000c154
mov dword [esi + 0x28], 0xfffffffe
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1040
ret
Function at 0x1000ce53
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, ebx
cmp dword [esi + 0x1c], ebx
je 0x1000cf34
push section..rdata
push str.PASV
push esi
call fcn.1000cd35
push 0x400
lea eax, [ebp - 0x428]
push eax
push 0x10036478
push esi
call fcn.1000cc5e
test eax, eax
je 0x1000cfac
lea esi, [ebp - 0x425]
cmp byte [ebp - 0x425], bl
je 0x1000cfac
mov al, byte [esi]
cmp al, 0x30
jl 0x1000ceda
cmp al, 0x39
jg 0x1000ceda
mov ecx, esi
cmp al, 0x39
jg 0x1000cec7
inc esi
mov al, byte [esi]
cmp al, 0x30
jge 0x1000cebc
push ecx
mov byte [esi], bl
call sub.MSVCRT.dll_atoi
mov dword [ebp + edi*4 - 0x18], eax
inc edi
pop ecx
cmp edi, 6
je 0x1000cee8
inc esi
cmp byte [esi], bl
jne 0x1000ceb0
cmp edi, 6
jne 0x1000cfac
push dword [ebp - 0xc]
lea eax, [ebp - 0x428]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push str._d._d._d._d
push eax
call sub.MSVCRT.dll_sprintf
mov eax, dword [ebp - 8]
add esp, 0x18
shl eax, 8
add eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x428]
push eax
call fcn.1000da20
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
test eax, eax
je 0x1000cfac
mov dword [ecx + 0x20], 5
jmp 0x1000cfa9
push ebx
push 0xffffffffffffffff
call fcn.1000df74
mov dword [esi + 8], eax
test eax, eax
je 0x1000cfac
lea ecx, [ebp + 8]
mov dword [ebp + 8], 0x10
push ecx
lea ecx, [ebp - 0x28]
push ecx
push dword [eax]
call dword [sym.imp.WSOCK32.DLL_getsockname]
push dword [ebp - 0x26]
call dword [sym.imp.WSOCK32.DLL_ntohs]
movzx ecx, ax
movzx eax, cl
push eax
sar ecx, 8
lea eax, [ebp - 0x428]
and ecx, 0xff
push ecx
push str.127_0_0_1__d__d
push eax
call sub.MSVCRT.dll_sprintf
add esp, 0x10
lea eax, [ebp - 0x428]
push eax
push str.PORT
push esi
call fcn.1000cd35
push 0x1003639c
push esi
call fcn.1000cc34
test eax, eax
je 0x1000cfac
xor ebx, ebx
inc ebx
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1000da57
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, ebx
cmp dword [esi], 1
jne 0x1000da7d
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi + 8]
call dword [sym.imp.WSOCK32.DLL_recv]
mov edi, eax
jmp 0x1000daba
cmp dword [esi + 0x14], ebx
je 0x1000daba
mov edi, dword [ebp + 0x10]
cmp edi, dword [esi + 0x18]
jle 0x1000da8d
mov edi, dword [esi + 0x18]
push edi
push dword [esi + 0x1c]
push dword [ebp + 0xc]
call sub.MSVCRT.dll_memcpy
sub dword [esi + 0x18], edi
add esp, 0xc
add dword [esi + 0x1c], edi
cmp dword [esi + 0x18], ebx
jne 0x1000daba
push dword [esi + 0x14]
push ebx
push dword [0x1003fab8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi + 0x14], ebx
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x1000dac3
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [ebp + 8]
cmp dword [esi], 1
jne 0x1000dae5
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi + 8]
call dword [sym.imp.WSOCK32.DLL_send]
jmp 0x1000db24
push 2
pop eax
mov word [ebp - 0x10], ax
mov eax, dword [esi + 4]
mov dword [ebp - 0xc], eax
movzx eax, word [esi + 8]
push eax
call dword [sym.imp.WSOCK32.DLL_htons]
mov word [ebp - 0xe], ax
mov eax, dword [esi + 0xc]
test eax, eax
je 0x1000db0c
mov eax, dword [eax]
jmp 0x1000db0f
mov eax, dword [esi + 0x10]
push 0x10
lea ecx, [ebp - 0x10]
push ecx
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call dword [sym.imp.WSOCK32.DLL_sendto]
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000db2b
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x814
xor ecx, ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x828]
xor ebx, ebx
inc ebx
mov ebp, ecx
cmp word [edi + 0x20], bx
jne 0x1000db8a
push ecx
push ecx
push dword [edi]
call dword [sym.imp.WSOCK32.DLL_accept]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000dc85
lea eax, [edi + 0x28]
push 0x18
push eax
call fcn.1000fa41
pop ecx
pop ecx
mov ecx, eax
mov ebp, ebx
mov dword [ecx], ebx
mov dword [ecx + 8], esi
mov dword [ecx + 0xc], edi
mov eax, dword [edi + 0x24]
mov dword [0x10040258], eax
mov dword [0x10040254], ecx
jmp 0x1000dc85
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x10
push eax
lea eax, [esp + 0x18]
push eax
push ecx
push 0x800
lea eax, [esp + 0x34]
push eax
push dword [edi]
call dword [sym.imp.WSOCK32.DLL_recvfrom]
mov ebx, eax
test ebx, ebx
jle 0x1000dc85
mov esi, dword [edi + 0x28]
push 2
pop ebp
push dword [esp + 0x16]
call dword [sym.imp.WSOCK32.DLL_ntohs]
movzx ecx, ax
test esi, esi
je 0x1000dbe4
mov eax, dword [esp + 0x18]
cmp dword [esi + 0x10], ecx
jne 0x1000dbde
cmp dword [esi + 0xc], eax
je 0x1000dc3e
mov esi, dword [esi]
test esi, esi
jne 0x1000dbd4
lea eax, [edi + 0x28]
push 0x28
push eax
call fcn.1000fa41
mov esi, eax
pop ecx
pop ecx
mov dword [esi], ebp
push dword [esp + 0x16]
call dword [sym.imp.WSOCK32.DLL_ntohs]
movzx eax, ax
mov dword [esi + 8], eax
mov eax, dword [esp + 0x18]
mov dword [esi + 4], eax
mov dword [esi + 0xc], edi
cmp dword [esi + 0x14], 0
jne 0x1000dc43
push ebx
push 0
push dword [0x1003fab8]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push ebx
lea ecx, [esp + 0x28]
mov dword [esi + 0x14], eax
push ecx
push eax
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
jmp 0x1000dc76
add esi, 8
jmp 0x1000dc0f
mov eax, dword [esi + 0x18]
add eax, ebx
push eax
push dword [esi + 0x14]
push 8
push dword [0x1003fab8]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, eax
lea eax, [esp + 0x24]
push ebx
push eax
mov eax, dword [esi + 0x18]
add eax, ecx
mov dword [esi + 0x14], ecx
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add dword [esi + 0x18], ebx
mov dword [0x10040254], esi
mov ecx, dword [edi + 0x24]
mov dword [0x10040258], ecx
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x814
ret