joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100072f0
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x100fc99b
mov eax, dword fs:[0]
push eax
push ebp
push edi
mov eax, dword [0x10143328]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x1c]
push 0x54
call fcn.1000f17a
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov dword [esp + 0x14], 0
je 0x10007338
push eax
call fcn.10006f60
jmp 0x1000733a
xor eax, eax
mov ecx, ebp
mov dword [esp + 0x14], 0xffffffff
mov dword [esi + 0x44], eax
lea edi, [ecx + 1]
lea ebx, [ebx]
mov dl, byte [ecx]
add ecx, 1
test dl, dl
jne 0x10007350
sub ecx, edi
push ecx
push ebp
lea ecx, [eax + 8]
call fcn.10002d00
mov eax, dword [esi + 0x44]
mov dword [eax + 4], 0
mov ecx, dword [esi + 0x44]
push 9
push str.GET_test1
add ecx, 0x34
call fcn.10002d00
lea ecx, [esi + 0x14]
push ecx
push 0
push esi
push 0x100073d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 0x18], eax
je 0x100073b6
cmp eax, 0xffffffff
je 0x100073b6
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esi + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
add esp, 0xc
ret 4

Function at 0x10008f10
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x100fbb9b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10143328]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.1000e2c3
push 4
mov dword [esp + 0x20], 0
call fcn.1000f17a
mov edi, eax
add esp, 4
test edi, edi
je 0x10008f90
call fcn.1000e693
mov dword [edi], eax
call fcn.1000e4c7
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.1000e8e3
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x10008f85
add eax, 1
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.1000e904
jmp 0x10008f92
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x1000af10
Capabilities:
Check if file exists
Delete file
Download url
Receive data

Disassembly:
push 0xffffffffffffffff
push 0x100fbe38
mov eax, dword fs:[0]
push eax
sub esp, 0x20c
mov eax, dword [0x10143328]
xor eax, esp
mov dword [esp + 0x208], eax
push ebp
push edi
mov eax, dword [0x10143328]
xor eax, esp
push eax
lea eax, [esp + 0x218]
mov dword fs:[0], eax
mov dword [esp + 0x220], 0
mov eax, dword [esp + 0x22c]
mov edi, 8
cmp dword [esp + 0x240], edi
jae 0x1000af70
lea eax, [esp + 0x22c]
mov ebp, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call ebp
test eax, eax
je 0x1000af9b
cmp dword [esp + 0x240], edi
mov eax, dword [esp + 0x22c]
jae 0x1000af94
lea eax, [esp + 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esp + 0x240], edi
mov eax, dword [esp + 0x22c]
jae 0x1000afb2
lea eax, [esp + 0x22c]
call fcn.10004030
push 0x206
lea eax, [esp + 0x12]
push 0
push eax
mov word [esp + 0x18], 0
call fcn.10015360
add esp, 0xc
test byte [0x101523ac], 1
jne 0x1000afea
or dword [0x101523ac], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x1000afef
mov eax, dword [0x101523a8]
imul eax, eax, 0x343fd
add eax, 0x269ec3
mov ecx, eax
sar eax, 0xf
xor eax, ecx
mov dword [0x101523a8], ecx
cdq
mov ecx, 0x895440
idiv ecx
add edx, 0xf4240
cmp dword [esi + 0x18], edi
jb 0x1000b01f
mov eax, dword [esi + 4]
jmp 0x1000b022
lea eax, [esi + 4]
push edx
push eax
lea edx, [esp + 0x14]
push str._s__d
push edx
call fcn.1000f0cb
mov eax, dword [esp + 0x23c]
add esp, 0x10
cmp dword [esp + 0x240], edi
jae 0x1000b04d
lea eax, [esp + 0x22c]
push 0
push 0
push eax
lea eax, [esp + 0x18]
push eax
push 0
call sub.urlmon.dll_URLDownloadToFileW
test eax, eax
jl 0x1000b09d
cmp dword [esp + 0x240], edi
mov eax, dword [esp + 0x22c]
jae 0x1000b079
lea eax, [esp + 0x22c]
push eax
call ebp
test eax, eax
je 0x1000b09d
cmp dword [esp + 0x240], edi
jb 0x1000b099
mov ecx, dword [esp + 0x22c]
push ecx
call fcn.1000f3a5
add esp, 4
mov al, 1
jmp 0x1000b0b8
cmp dword [esp + 0x240], edi
jb 0x1000b0b6
mov edx, dword [esp + 0x22c]
push edx
call fcn.1000f3a5
add esp, 4
xor al, al
mov ecx, dword [esp + 0x218]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.1000efa1
add esp, 0x218
ret 0x1c
Function at 0x1000b5b0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x100fc6f2
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x10143328]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, dword [esp + 0x28]
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [edi], 0x1013e478
mov dword [edi + 0x58], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
lea esi, [edi + 8]
push esi
mov dword [esp + 0x24], ebx
push edi
mov dword [esp + 0x1c], 1
call fcn.1000c390
mov dword [esp + 0x20], 1
mov eax, dword [edi]
mov ecx, dword [eax + 4]
push esi
mov dword [edi + ecx], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
call fcn.10008f10
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x48], bl
mov byte [esi + 0x41], bl
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ebx
mov eax, dword [esi + 0x24]
mov dword [eax], ebx
mov ecx, dword [esi + 0x34]
mov dword [ecx], ebx
mov edx, dword [esi + 0x10]
mov dword [edx], ebx
mov eax, dword [esi + 0x20]
mov edx, dword [0x101523b0]
mov dword [eax], ebx
mov ecx, dword [esi + 0x30]
mov dword [ecx], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x44], edx
mov dword [esi + 0x3c], ebx
mov eax, dword [esp + 0x2c]
push eax
mov byte [esp + 0x24], 2
call fcn.1000c550
test eax, eax
jne 0x1000b6b1
mov ecx, dword [edi]
mov ecx, dword [ecx + 4]
mov eax, dword [ecx + edi + 8]
add ecx, edi
or eax, 2
cmp dword [ecx + 0x28], ebx
jne 0x1000b6a0
or eax, 4
and eax, 0x17
test dword [ecx + 0xc], eax
mov dword [ecx + 8], eax
je 0x1000b6b1
push ebx
call fcn.10007d00
mov eax, edi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 8
Function at 0x1000dbb0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [0x10143328]
xor eax, esp
mov dword [esp + 8], eax
push ebp
mov ebp, dword [esp + 0x14]
test ebp, ebp
push esi
push edi
mov esi, ecx
mov edi, edx
jle 0x1000dca2
add ebp, 0xffffffff
shr ebp, 3
add ebp, 1
lea ebx, [ebx]
movzx eax, byte [esi]
mov byte [edi], al
movzx ecx, byte [esi + 1]
mov byte [edi + 1], cl
movzx edx, byte [esi + 2]
mov byte [edi + 2], dl
movzx eax, byte [esi + 3]
mov byte [edi + 3], al
movzx ecx, byte [esi + 4]
mov byte [edi + 4], cl
movzx edx, byte [esi + 5]
mov byte [edi + 5], dl
movzx eax, byte [esi + 6]
mov byte [edi + 6], al
movzx ecx, byte [esi + 7]
mov byte [edi + 7], cl
mov eax, dword [esi + 4]
mov edx, dword [esi]
mov dword [esp + 0x10], eax
mov ecx, edi
lea eax, [ebx + 0x80]
mov dword [esp + 0xc], edx
call fcn.1000d240
movzx ecx, byte [ebx + 0x100]
xor byte [edi], cl
movzx edx, byte [ebx + 0x101]
xor byte [edi + 1], dl
movzx eax, byte [ebx + 0x102]
xor byte [edi + 2], al
movzx ecx, byte [ebx + 0x103]
xor byte [edi + 3], cl
movzx edx, byte [ebx + 0x104]
xor byte [edi + 4], dl
movzx eax, byte [ebx + 0x105]
xor byte [edi + 5], al
movzx ecx, byte [ebx + 0x106]
xor byte [edi + 6], cl
movzx edx, byte [ebx + 0x107]
xor byte [edi + 7], dl
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
add esi, 8
add edi, 8
sub ebp, 1
mov dword [ebx + 0x100], eax
mov dword [ebx + 0x104], ecx
jne 0x1000dbe0
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.1000efa1
add esp, 0xc
ret

Function at 0x1000dcc0
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebx
mov ebx, dword [eax + 4]
mov eax, dword [eax]
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
push esi
lea esi, [ecx + eax + 0x18]
mov dword [esp + 8], 0
jbe 0x1000dd68
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
add esi, 0x10
mov eax, dword [esi]
test eax, eax
jne 0x1000dd21
mov edx, dword [esp + 0x1c]
mov edi, dword [edx + 0x38]
test edi, edi
jle 0x1000dd4a
mov eax, dword [esi - 4]
push 4
push 0x1000
push edi
add eax, ebx
push eax
call ebp
push edi
push 0
push eax
mov dword [esi - 8], eax
call fcn.10015360
jmp 0x1000dd47
mov ecx, dword [esi - 4]
push 4
push 0x1000
push eax
add ecx, ebx
push ecx
call ebp
mov edx, dword [esi]
mov edi, eax
mov eax, dword [esi + 4]
add eax, dword [esp + 0x18]
push edx
push eax
push edi
call fcn.100139c0
mov dword [esi - 8], edi
add esp, 0xc
mov ecx, dword [esp + 0x20]
mov edx, dword [ecx]
mov eax, dword [esp + 0x10]
movzx ecx, word [edx + 6]
add eax, 1
add esi, 0x28
cmp eax, ecx
mov dword [esp + 0x10], eax
jl 0x1000dcf2
pop edi
pop ebp
pop esi
pop ebx
pop ecx
ret
Function at 0x1000dd70
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [eax]
movzx ecx, word [ebx + 0x14]
push ebp
xor ebp, ebp
cmp word [ebx + 6], bp
lea eax, [ecx + ebx + 0x18]
jbe 0x1000de27
push esi
push edi
lea edi, [eax + 0x24]
mov eax, dword [edi]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x1000ddc5
mov edx, dword [edi - 0x14]
mov eax, dword [edi - 0x1c]
push 0x4000
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x1000de0d
test eax, 0x4000000
lea ecx, [edx + ecx*2]
lea edx, [esi + ecx*2]
mov esi, dword [edx*4 + 0x1014ceb4]
je 0x1000dddf
or esi, 0x200
mov edx, dword [edi - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x1000ddfa
test al, 0x40
je 0x1000ddf1
mov ecx, dword [ebx + 0x20]
jmp 0x1000ddf8
test al, al
jns 0x1000de0d
mov ecx, dword [ebx + 0x24]
test ecx, ecx
jbe 0x1000de0d
mov ecx, dword [edi - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [esp + 0x18]
mov ebx, dword [edx]
movzx eax, word [ebx + 6]
add ebp, 1
add edi, 0x28
cmp ebp, eax
jl 0x1000dd92
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x1000dfd0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, dword [esp + 8]
cmp word [ebp], 0x5a4d
je 0x1000dfe1
xor eax, eax
pop ebp
ret
push ebx
mov ebx, dword [ebp + 0x3c]
add ebx, ebp
cmp dword [ebx], 0x4550
je 0x1000dff4
pop ebx
xor eax, eax
pop ebp
ret
mov eax, dword [ebx + 0x50]
mov ecx, dword [ebx + 0x34]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 4
push 0x2000
push eax
push ecx
call esi
mov edi, eax
test edi, edi
jne 0x1000e02b
mov edx, dword [ebx + 0x50]
push 4
push 0x2000
push edx
push eax
call esi
mov edi, eax
test edi, edi
je 0x1000e0e0
push 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
xor eax, eax
push 4
mov dword [esi + 4], edi
mov dword [esi + 0xc], eax
mov dword [esi + 8], eax
mov dword [esi + 0x10], eax
mov eax, dword [ebx + 0x50]
push 0x1000
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [ebx + 0x54]
push 4
push 0x1000
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, dword [ebx + 0x54]
add edx, dword [ebp + 0x3c]
mov dword [esp + 0x14], eax
push edx
push ebp
push eax
call fcn.100139c0
mov eax, dword [ebp + 0x3c]
mov ecx, dword [esp + 0x20]
push esi
add eax, ecx
push ebx
mov dword [esi], eax
push ebp
mov dword [eax + 0x34], edi
call fcn.1000dcc0
mov eax, edi
add esp, 0x18
sub eax, dword [ebx + 0x34]
je 0x1000e0ad
push eax
mov eax, esi
call fcn.1000de30
add esp, 4
push esi
call fcn.1000deb0
add esp, 4
test eax, eax
je 0x1000e0db
push esi
call fcn.1000dd70
mov edx, dword [esi]
mov eax, dword [edx + 0x28]
add esp, 4
test eax, eax
je 0x1000e0ee
add eax, edi
je 0x1000e0db
push 0
push 1
push edi
call eax
test eax, eax
jne 0x1000e0e7
call fcn.1000e1a0
pop edi
pop esi
pop ebx
xor eax, eax
pop ebp
ret
mov dword [esi + 0x10], 1
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
Function at 0x1000efa1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10143328]
jne 0x1000efab
repz ret
jmp fcn.10015ad2
Function at 0x1001fb29
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x10143f10]
je 0x1001fb44
inc edi
cmp edi, 0x17
jb 0x1001fb35
cmp edi, 0x17
jae 0x1001fcc4
push ebp
push 3
call fcn.10025457
cmp eax, 1
pop ecx
je 0x1001fc90
push 3
call fcn.10025457
test eax, eax
pop ecx
jne 0x1001fb78
cmp dword [0x1014d44c], 1
je 0x1001fc90
cmp ebx, 0xfc
je 0x1001fcc3
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x1014da48
push ebp
call fcn.1001540c
add esp, 0xc
test eax, eax
je 0x1001fbae
push esi
push esi
push esi
push esi
push esi
call fcn.1000ee71
add esp, 0x14
push 0x104
mov esi, 0x1014da61
push esi
push 0
mov byte [0x1014db65], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1001fbf2
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.1001540c
add esp, 0xc
test eax, eax
je 0x1001fbf2
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.1000ee71
add esp, 0x14
push esi
call fcn.10012cb0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x1001fc37
push esi
call fcn.10012cb0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x1014dd5c
push 0x100fee2c
sub ecx, eax
push ecx
push eax
call fcn.1001c664
add esp, 0x14
test eax, eax
je 0x1001fc37
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.1000ee71
add esp, 0x14
jmp 0x1001fc39
xor esi, esi
push 0x100fee28
push ebx
push ebp
call fcn.1001c5f3
add esp, 0xc
test eax, eax
je 0x1001fc59
push esi
push esi
push esi
push esi
push esi
call fcn.1000ee71
add esp, 0x14
push dword [edi*8 + 0x10143f14]
push ebx
push ebp
call fcn.1001c5f3
add esp, 0xc
test eax, eax
je 0x1001fc7b
push esi
push esi
push esi
push esi
push esi
call fcn.1000ee71
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.1002529a
add esp, 0xc
jmp 0x1001fcc3
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x1001fcc3
cmp ebp, 0xffffffff
je 0x1001fcc3
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x10143f14]
push dword [esi]
call fcn.10012cb0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x1002529a
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.10015553
xor ebx, ebx
cmp dword [0x1014dedc], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x10025370
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x10025450
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x100ff70c
push edi
call esi
cmp eax, ebx
je 0x10025450
push eax
call fcn.100154e5
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1014dedc], eax
call esi
push eax
call fcn.100154e5
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1014dee0], eax
call esi
push eax
call fcn.100154e5
mov dword [0x1014dee4], eax
lea eax, [ebp - 0xc]
push eax
call fcn.10014cd1
test eax, eax
pop ecx
pop ecx
je 0x1002533e
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.1000ee71
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x10025370
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.100154e5
cmp eax, ebx
pop ecx
mov dword [0x1014deec], eax
je 0x10025370
push 0x100ff6b4
push edi
call esi
push eax
call fcn.100154e5
pop ecx
mov dword [0x1014dee8], eax
mov eax, dword [0x1014dee8]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x100253f5
cmp dword [0x1014deec], ecx
je 0x100253f5
push eax
call fcn.1001555c
push dword [0x1014deec]
mov esi, eax
call fcn.1001555c
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x100253f5
cmp edi, ebx
je 0x100253f5
call esi
cmp eax, ebx
je 0x100253c2
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x100253c2
test byte [ebp - 0x18], 1
jne 0x100253f5
lea eax, [ebp - 0x10]
push eax
call fcn.10014d08
test eax, eax
pop ecx
je 0x100253dd
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.1000ee71
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x100253ec
or dword [ebp + 0x10], 0x200000
jmp 0x10025430
or dword [ebp + 0x10], 0x40000
jmp 0x10025430
mov eax, dword [0x1014dee0]
cmp eax, dword [ebp - 8]
je 0x10025430
push eax
call fcn.1001555c
cmp eax, ebx
pop ecx
je 0x10025430
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x10025430
mov eax, dword [0x1014dee4]
cmp eax, dword [ebp - 8]
je 0x10025430
push eax
call fcn.1001555c
cmp eax, ebx
pop ecx
je 0x10025430
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1014dedc]
call fcn.1001555c
cmp eax, ebx
pop ecx
je 0x10025450
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10025452
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1002aea0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x10143328]
xor eax, esp
mov dword [esp + 0x190], eax
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1002aef2
mov eax, dword [esp]
cmp al, 2
jne 0x1002aeec
shr eax, 8
cmp al, 2
jne 0x1002aeec
xor eax, eax
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.1000efa1
add esp, 0x194
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x190]
xor ecx, esp
mov eax, 2
call fcn.1000efa1
add esp, 0x194
ret

Function at 0x1002c1f0
Capabilities:
Read file on windows

Disassembly:
push edi
mov edi, eax
mov eax, dword [esi]
cmp dword [eax + 4], 2
jne 0x1002c212
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x1002c206
xor eax, eax
pop edi
ret
mov eax, dword [eax + 8]
push eax
push edi
push 1
push ebx
call ecx
jmp 0x1002c242
cmp dword [esi + 8], 0
jne 0x1002c235
mov ecx, dword [eax + 8]
push 0x100ff848
push ecx
call fcn.10014c15
add esp, 8
mov dword [esi + 8], eax
test eax, eax
jne 0x1002c235
or eax, 0xffffffff
pop edi
ret
mov edx, dword [esi + 8]
push edx
push edi
push 1
push ebx
call fcn.100e3b51
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x1002c264
mov eax, dword [esi + 8]
test eax, eax
je 0x1002c25e
push eax
call fcn.1000f8ee
add esp, 4
mov dword [esi + 8], edi
mov eax, dword [esi]
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, edi
pop edi
ret

Function at 0x10037a20
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esi + 0x164]
test ecx, ecx
je 0x10037a3b
mov edx, dword [esi + 0xf4]
push edx
push edi
push ebx
push eax
push esi
call ecx
add esp, 0x14
ret
test eax, eax
jl 0x10037a6f
cmp eax, 2
jg 0x10037a6f
mov ecx, dword [esi + 0xf0]
push ecx
push 1
lea edx, [eax + eax*2 + 0x101008d4]
push 2
push edx
call fcn.1000f7fa
mov eax, dword [esi + 0xf0]
push eax
push 1
push edi
push ebx
call fcn.1000f7fa
add esp, 0x20
xor eax, eax
ret

Function at 0x10037d80
Capabilities:
Send data
Send data on socket

Disassembly:
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi + eax*4 + 0x130]
push edi
push 0
push ecx
push edx
push eax
call dword [sym.imp.WS2_32.dll_send]
mov ebx, dword [esp + 0x20]
mov edi, eax
mov dword [ebx], 0
cmp edi, 0xffffffff
jne 0x10037dfd
push ebp
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebp, eax
cmp ebp, 0x2733
jne 0x10037dd4
pop ebp
pop edi
pop esi
mov dword [ebx], 0x51
xor eax, eax
pop ebx
ret
push ebp
push esi
call fcn.1003c090
push eax
mov eax, dword [esi]
push 0x10100914
push eax
call fcn.10037c00
mov ecx, dword [esi]
add esp, 0x14
mov dword [ecx + 0x856c], ebp
mov dword [ebx], 0x37
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x10046c20
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, dword [esi + 0x10]
mov ebx, dword [eax]
mov eax, dword [esp + 0xc]
add eax, 0xfffffffd
push edi
cmp eax, 4
ja case.0x10046c3a.4
jmp dword [eax*4 + 0x10046e68]
lea eax, [esi + 0x15c]
call fcn.10046940
movzx ecx, ax
movzx eax, word [esi + 0x40]
inc eax
and eax, 0xffff
cmp eax, ecx
je 0x10046c73
push eax
push ecx
push 0x10103c30
push ebx
call fcn.10037b70
add esp, 0x10
pop edi
pop esi
xor eax, eax
pop ebx
ret
mov word [esi + 0x40], cx
lea edi, [esi + 0x160]
mov eax, 4
mov ecx, edi
mov dword [esi + 0x18], 0
call fcn.100468f0
mov ax, word [esi + 0x40]
mov ecx, edi
call fcn.10046910
mov ecx, dword [esi + 0x148]
mov eax, dword [edi]
push ecx
mov ecx, dword [esi + 0x14]
lea edx, [esi + 0xc8]
push edx
push 0
push 4
push eax
push ecx
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
jl 0x10046dd9
mov eax, dword [esi + 0x154]
xor ecx, ecx
add eax, 4
cmp dword [esi + 0x14c], eax
setl cl
add esi, 0x38
push esi
lea ecx, [ecx + ecx + 1]
mov dword [esi - 0x38], ecx
call fcn.1000f3da
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
ret
xor edx, edx
lea edi, [esi + 0x160]
lea eax, [edx + 4]
mov ecx, edi
mov word [esi + 0x40], dx
mov dword [esi + 0x18], edx
call fcn.100468f0
mov ax, word [esi + 0x40]
mov ecx, edi
call fcn.10046910
mov eax, dword [esi + 0x148]
mov edx, dword [edi]
push eax
mov eax, dword [esi + 0x14]
lea ecx, [esi + 0xc8]
push ecx
push 0
push 4
push edx
push eax
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
jge 0x10046d5e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, dword [esi + 0x10]
push eax
push ecx
call fcn.1003c090
push eax
push 0x1013de88
push ebx
call fcn.10037c00
add esp, 0x14
pop edi
pop esi
mov eax, 0x37
pop ebx
ret
mov dword [esi], 1
add esi, 0x38
push esi
call fcn.1000f3da
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
ret
movzx edx, word [esi + 0x40]
inc dword [esi + 0x18]
mov eax, dword [esi + 0x18]
push eax
inc edx
and edx, 0xffff
push edx
push 0x10103bfc
push ebx
call fcn.10037b70
mov eax, dword [esi + 0x18]
add esp, 0x10
cmp eax, dword [esi + 0x20]
jle 0x10046db2
pop edi
mov dword [esi + 8], 0xffffff9d
mov dword [esi], 3
pop esi
xor eax, eax
pop ebx
ret
mov ecx, dword [esi + 0x148]
mov eax, dword [esi + 0x160]
push ecx
mov ecx, dword [esi + 0x14]
lea edx, [esi + 0xc8]
push edx
push 0
push 4
push eax
push ecx
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
jge 0x10046e43
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, dword [esi + 0x10]
push eax
push edx
call fcn.1003c090
push eax
push 0x1013de88
push ebx
call fcn.10037c00
add esp, 0x14
pop edi
pop esi
mov eax, 0x37
pop ebx
ret
lea edi, [esi + 0x160]
mov eax, 5
mov ecx, edi
call fcn.100468f0
mov ax, word [esi + 0x40]
mov ecx, edi
call fcn.10046910
mov eax, dword [esi + 0x148]
mov edx, dword [edi]
push eax
mov eax, dword [esi + 0x14]
lea ecx, [esi + 0xc8]
push ecx
push 0
push 4
push edx
push eax
call dword [sym.imp.WS2_32.dll_sendto]
mov dword [esi], 3
pop edi
pop esi
xor eax, eax
pop ebx
ret
push 0x10103be4
push 0x1013de88
push ebx
call fcn.10037c00
add esp, 0xc
pop edi
pop esi
mov eax, 0x47
pop ebx
ret