joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10037e00
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov ecx, 0x2b
test edi, edi
je 0x10037e8e
mov ebx, dword [ebp + 0xc]
mov edx, dword [0x1007fc34]
jmp 0x10037e20
mov esi, 4
cmp edi, esi
cmovb esi, edi
cmp byte [0x1007fc30], 0
jne 0x10037e5f
push 2
push 4
lea eax, [ebp + 0x10]
mov dword [ebp + 0x10], 0
push eax
push 0
call sub.bcrypt.dll_BCryptGenRandom
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, 2
jne 0x10037e8e
mov eax, dword [ebp + 0x10]
mov edx, dword [0x1007fc34]
jmp 0x10037e78
imul edx, edx, 0x41c64e6d
add edx, 0x3039
mov eax, edx
mov dword [0x1007fc34], edx
rol eax, 0x10
xor ecx, ecx
test esi, esi
je 0x10037e8a
lea esp, [esp]
mov byte [ebx], al
dec edi
inc ebx
shr eax, 8
dec esi
jne 0x10037e80
test edi, edi
jne 0x10037e20
pop edi
pop esi
mov eax, ecx
pop ebx
pop ebp
ret

Function at 0x10037ea0
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
dec edi
je 0x10037f1a
mov ecx, dword [0x1007fc34]
mov ebx, 0x3e
lea ebx, [ebx]
cmp byte [0x1007fc30], 0
jne 0x10037eee
push 2
push 4
lea eax, [ebp + 0x10]
mov dword [ebp + 0x10], 0
push eax
push 0
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
jne 0x10037f24
mov eax, dword [ebp + 0x10]
mov ecx, dword [0x1007fc34]
jmp 0x10037f05
imul ecx, ecx, 0x41c64e6d
add ecx, 0x3039
mov eax, ecx
mov dword [0x1007fc34], ecx
rol eax, 0x10
cmp eax, 0xfffffffc
jae 0x10037ec0
xor edx, edx
div ebx
mov al, byte [edx + 0x10071e38]
mov byte [esi], al
inc esi
dec edi
jne 0x10037ec0
pop edi
mov byte [esi], 0
xor eax, eax
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
mov eax, 2
pop ebx
pop ebp
ret

Function at 0x10037fc0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
lea eax, [ebp - 0x10]
push edi
push eax
call fcn.10047ce0
push dword [ebp + 8]
movdqu xmm0, xmmword [eax]
movdqu xmmword [ebp - 0x10], xmm0
call fcn.100698b9
push dword [ebp + 0xc]
mov edi, eax
call fcn.100698b9
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExA]
add esp, 0xc
mov esi, eax
push 1
push esi
push edi
call ebx
test eax, eax
jne 0x1003804d
lea eax, [ebp - 0x20]
push eax
call fcn.10047ce0
movdqu xmm0, xmmword [ebp - 0x10]
sub esp, 0xc
mov ecx, esp
sub esp, 0x10
movdqu xmmword [ecx], xmm0
mov ecx, esp
movdqu xmm0, xmmword [eax]
movdqu xmmword [ecx], xmm0
call fcn.10047d80
add esp, 0x20
test edx, edx
ja 0x10038070
jb 0x1003803b
cmp eax, 0x3e8
ja 0x10038070
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push esi
push edi
call ebx
test eax, eax
je 0x10038002
test edi, edi
je 0x1003805a
push edi
call fcn.10053240
add esp, 4
test esi, esi
je 0x10038067
push esi
call fcn.10053240
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x1003807d
push edi
call fcn.10053240
add esp, 4
test esi, esi
je 0x1003808a
push esi
call fcn.10053240
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003a0c0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x1003a0db
cmp dword [edi], 0
jne 0x1003a0ed
test esi, esi
je 0x1003a0e4
cmp dword [esi], 0
jne 0x1003a0ed
test ebx, ebx
je 0x1003a136
cmp dword [ebx], 0
je 0x1003a136
push dword [ebp + 0x1c]
lea eax, [ebp - 8]
push dword [ebp + 0x18]
push eax
call fcn.10047c10
add esp, 0xc
test ebx, ebx
je 0x1003a108
cmp dword [ebx], 0
jne 0x1003a10a
xor ebx, ebx
test esi, esi
je 0x1003a113
cmp dword [esi], 0
jne 0x1003a115
xor esi, esi
test edi, edi
je 0x1003a11e
cmp dword [edi], 0
jne 0x1003a120
xor edi, edi
push eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
inc eax
push eax
call dword [sym.imp.WS2_32.dll_select]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0x18]
mov eax, ecx
mov edx, dword [ebp + 0x1c]
or eax, edx
mov dword [ebp - 4], edx
je 0x1003a182
test edx, edx
jg 0x1003a16f
jl 0x1003a14f
test ecx, ecx
jae 0x1003a164
push 0x2726
call dword [sym.imp.WS2_32.dll_WSASetLastError]
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
test edx, edx
jl 0x1003a17b
jg 0x1003a16f
cmp ecx, 0xffffffff
jb 0x1003a17b
mov ecx, 0xfffffffe
mov dword [ebp - 4], 0
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003e860
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 8]
push 0xf0000040
push 0x18
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x1003e888
mov eax, 0x1b
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x800c
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x1003e8b5
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 2
mov esp, ebp
pop ebp
ret
push dword [ebp + 0x10]
call fcn.1004fdb0
add esp, 4
push 0
push eax
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 8]
call fcn.1003e800
add esp, 8
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100444e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
push str.kernel32
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 4], eax
test eax, eax
jne 0x10044500
pop edi
mov esp, ebp
pop ebp
ret
push ebx
push esi
push 0x10074e64
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [ebp + 8]
mov ebx, eax
push 0x10074e74
push esi
mov dword [ebp - 8], ebx
call fcn.100574de
add esp, 8
test eax, eax
je 0x1004454c
test ebx, ebx
je 0x1004453c
push 8
push 0
push esi
call ebx
pop esi
mov edi, eax
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop esi
mov edi, eax
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x10044575
push str.AddDllDirectory
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10044575
push 0x800
push 0
push esi
call ebx
pop esi
mov edi, eax
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, eax
mov dword [ebp - 4], edx
test edx, edx
je 0x10044620
mov ecx, esi
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10044591
sub ecx, ebx
lea eax, [edx + 1]
add eax, ecx
push eax
call dword [0x1007d2a0]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x10044616
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x10044616
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100445c2
sub ecx, edx
mov eax, 0x5c
mov word [ecx + ebx], ax
mov ecx, ebx
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100445e0
sub ecx, edx
add ecx, ebx
sub ecx, esi
lea ecx, [ecx]
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x100445f0
mov eax, dword [ebp - 8]
test eax, eax
je 0x1004460d
push 8
push 0
push ebx
call eax
jmp 0x10044614
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
push ebx
call dword [0x1007d2a4]
add esp, 4
pop esi
pop ebx
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10044690
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x1007e7e0]
xor eax, ebp
mov dword [ebp - 4], eax
test byte [ebp + 8], 2
je 0x100446e9
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x100446d6
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x100446d0
shr eax, 8
cmp al, 2
je 0x100446e9
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100526c8
mov esp, ebp
pop ebp
ret
push esi
push edi
push str.iphlpapi.dll
call fcn.100444e0
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 4
mov dword [0x1007fc48], eax
test eax, eax
je 0x10044720
push str.if_nametoindex
push eax
call edi
mov ecx, dword [0x1007fc38]
test eax, eax
cmovne ecx, eax
mov dword [0x1007fc38], ecx
push str.ws2_32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
je 0x10044758
push str.FreeAddrInfoExW
push esi
call edi
push str.GetAddrInfoExCancel
push esi
mov dword [0x1007fc3c], eax
call edi
push str.GetAddrInfoExW
push esi
mov dword [0x1007fc40], eax
call edi
mov dword [0x1007fc44], eax
push 3
push 2
push 0
push 0
push 6
call fcn.1004faf0
push 3
push 2
push 0
test al, al
push 2
push 6
setne byte [0x10080c31]
call fcn.1004faf0
add esp, 0x28
test al, al
setne byte [0x10080c30]
push 0x10080c38
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.100526c8
mov esp, ebp
pop ebp
ret

Function at 0x100458b0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push 0
mov byte [ebp + 0xa], cl
lea ecx, [ebp + 8]
push 3
mov eax, dword [esi + 0x18]
push ecx
mov byte [ebp + 8], 0xff
mov byte [ebp + 9], bl
push dword [eax + 0x1a0]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x100458f8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push esi
call fcn.10010ab0
add esp, 0xc
push dword [ebp + 0x10]
push ebx
push str.SENT
push esi
call fcn.100451c0
add esp, 0x10
pop esi
pop ebx
pop ebp
ret
Function at 0x10045a50
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 0xc], 0x1f
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x124]
mov ecx, dword [ebx + 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
jne 0x10045bac
push edi
lea ecx, [eax + 0x1cc4]
lea edi, [eax + 0x1ec4]
mov dword [edi], ecx
cmp ecx, edi
jae 0x10045a8b
mov byte [ecx], 0xff
inc dword [edi]
mov ecx, dword [edi]
cmp ecx, edi
jae 0x10045a96
mov byte [ecx], 0xfa
inc dword [edi]
mov ecx, dword [edi]
cmp ecx, edi
jae 0x10045aa1
mov byte [ecx], 0x1f
inc dword [edi]
movzx eax, word [eax + 0x1ca8]
push esi
mov esi, dword [sym.imp.WS2_32.dll_htons]
push eax
call esi
movzx eax, ax
mov dword [ebp + 8], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x1caa]
push eax
call esi
mov ecx, dword [ebp + 8]
movzx edx, ax
mov eax, dword [edi]
cmp eax, edi
jae 0x10045ad5
mov byte [eax], cl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x10045adf
mov byte [eax], ch
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x10045ae9
mov byte [eax], dl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x10045af3
mov byte [eax], dh
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x10045afe
mov byte [eax], 0xff
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x10045b09
mov byte [eax], 0xf0
inc dword [edi]
mov esi, dword [ebp - 4]
mov eax, dword [edi]
mov dword [esi + 0x1ec8], eax
lea ecx, [esi + 0x1cc4]
sub eax, ecx
mov dword [edi], ecx
sub eax, 2
push eax
lea eax, [esi + 0x1cc6]
push eax
push 0x3e
push ebx
call fcn.100452c0
add esp, 0x10
lea eax, [esi + 0x1cc4]
push 0
push 3
push eax
mov eax, dword [ebp - 8]
push dword [eax + 0x1a0]
call dword [sym.imp.WS2_32.dll_send]
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jns 0x10045b69
call edi
push eax
push str.Sending_data_failed___d_
push ebx
call fcn.10010ab0
add esp, 0xc
push 4
lea eax, [esi + 0x1cc7]
push eax
push ebx
call fcn.10045910
add esp, 0xc
lea eax, [esi + 0x1ccb]
push 0
push 2
push eax
mov eax, dword [ebp - 8]
push dword [eax + 0x1a0]
call dword [sym.imp.WS2_32.dll_send]
pop esi
test eax, eax
jns 0x10045bab
call edi
push eax
push str.Sending_data_failed___d_
push ebx
call fcn.10010ab0
add esp, 0xc
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10046b60
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x1007e7e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov dword [ebp - 0x90], esi
mov eax, dword [esi + 0x18]
mov edi, dword [eax + 0x2d0]
lea eax, [ebp - 0x88]
push eax
mov dword [ebp - 0x88], 0x80
lea eax, [ebp - 0x84]
push eax
mov eax, dword [edi + 0x13c]
push ebx
add eax, 4
push eax
push dword [edi + 0x148]
push dword [edi + 0x14]
call dword [sym.imp.WS2_32.dll_recvfrom]
mov dword [edi + 0x134], eax
cmp dword [edi + 0x130], ebx
jne 0x10046bf2
push dword [ebp - 0x88]
lea eax, [ebp - 0x84]
push eax
lea eax, [edi + 0xb0]
push eax
call fcn.100538f0
mov eax, dword [ebp - 0x88]
add esp, 0xc
mov dword [edi + 0x130], eax
cmp dword [edi + 0x134], 4
jge 0x10046c23
push str.Received_too_short_packet
push esi
call fcn.10010ab0
add esp, 8
mov dword [edi + 0xc], 7
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100526c8
mov esp, ebp
pop ebp
ret
mov ecx, dword [edi + 0x148]
movzx eax, byte [ecx]
shl ax, 8
movzx edx, ax
movzx eax, byte [ecx + 1]
or edx, eax
mov dword [edi + 0xc], edx
add edx, 0xfffffffd
cmp edx, 3
ja case.default.0x10046c48
jmp dword [edx*4 + 0x10046d8c]
cmp dword [edi + 0x134], 4
jle case.0x10046c48.4
movzx eax, byte [ecx + 2]
shl ax, 8
movzx edx, ax
movzx eax, byte [ecx + 3]
or edx, eax
movzx eax, word [edi + 0x144]
inc eax
and eax, 0xffff
cmp eax, edx
jne case.0x10046c48.4
mov eax, dword [edi + 0x134]
add eax, 0xfffffffc
push eax
lea eax, [ecx + 4]
push eax
push 1
push esi
call fcn.1003af70
mov ebx, eax
add esp, 0x10
test ebx, ebx
je case.0x10046c48.4
push 5
push edi
call fcn.100475f0
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100526c8
mov esp, ebp
pop ebp
ret
mov esi, dword [edi + 0x134]
lea eax, [ecx + 4]
mov edx, ecx
mov dword [ebp - 0x8c], eax
add esi, 0xfffffffc
push esi
push dword [ebp - 0x8c]
movzx eax, byte [edx + 2]
shl ax, 8
movzx ecx, ax
movzx eax, byte [edx + 3]
or ecx, eax
mov dword [edi + 8], ecx
call fcn.10047730
add esp, 8
cmp eax, esi
mov esi, dword [ebp - 0x90]
jae case.0x10046c48.4
push dword [ebp - 0x8c]
push str.TFTP_error:__s
push esi
call fcn.10010b70
jmp 0x10046d55
mov eax, dword [edi + 0x134]
add eax, 0xfffffffe
push eax
lea eax, [ecx + 2]
push eax
push edi
call fcn.10046910
mov ebx, eax
add esp, 0xc
test ebx, ebx
je case.0x10046c48.4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100526c8
mov esp, ebp
pop ebp
ret
push str.Internal_error:_Unexpected_packet
push 0x1006b2dc
push esi
call fcn.10010ab0
add esp, 0xc
push esi
call fcn.100370a0
add esp, 4
test eax, eax
je 0x10046c10
push 5
push edi
call fcn.100475f0
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
mov eax, 0x2a
pop edi
pop esi
pop ebx
call fcn.100526c8
mov esp, ebp
pop ebp
ret
Function at 0x100475f0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov ecx, dword [eax + 0x10]
cmp edx, 3
ja case.default.0x10047600
jmp dword [edx*4 + 0x10047654]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.100470c0
mov dword [ebp + 8], eax
pop ebp
jmp fcn.10046da0
mov dword [ebp + 8], eax
pop ebp
jmp fcn.10047860
push str.TFTP_finished
push 0x1006b2dc
push ecx
call fcn.10010b70
add esp, 0xc
xor eax, eax
pop ebp
ret
push str.Internal_state_machine_error
push 0x1006b2dc
push ecx
call fcn.10010ab0
add esp, 0xc
mov eax, 0x47
pop ebp
ret
Function at 0x1004ed60
Capabilities:
Convert ip address from string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x1007e7e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x50], eax
cmp esi, 4
jae 0x1004ed98
pop esi
mov eax, 0x16
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100526c8
mov esp, ebp
pop ebp
ret
push edi
inc ebx
sub esi, 2
push str.0123456789abcdefABCDEF:.
push ebx
call fcn.10053360
add esp, 8
cmp esi, eax
je 0x1004ee64
mov dword [ebp - 0x48], eax
add eax, ebx
mov dword [ebp - 0x4c], eax
cmp byte [eax], 0x25
jne 0x1004ee7d
push 2
lea esi, [eax + 1]
xor edi, edi
push 0x100764f8
push esi
call fcn.10054230
add esp, 0xc
test eax, eax
jne 0x1004eded
mov cl, byte [esi + 2]
lea eax, [esi + 2]
test cl, cl
je 0x1004eded
cmp cl, 0x5d
cmovne esi, eax
mov al, byte [esi]
test al, al
je 0x1004ee7d
lea ecx, [ebp - 0x14]
sub ecx, esi
lea esp, [esp]
cmp al, 0x5d
je 0x1004ee15
cmp edi, 0xf
jge 0x1004ee15
mov byte [ecx + esi], al
inc edi
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x1004ee00
test edi, edi
je 0x1004ee7d
cmp byte [esi], 0x5d
jne 0x1004ee7d
cmp edi, 0x10
jae 0x1004eeef
lea eax, [ebp - 0x14]
mov byte [ebp + edi - 0x14], 0
push eax
call dword [0x1007d2ac]
mov ecx, dword [ebp - 0x50]
add esp, 4
mov dword [ecx + 0x14], eax
test eax, eax
jne 0x1004ee59
pop edi
pop esi
mov eax, 7
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100526c8
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x4c]
mov esi, dword [ebp - 0x48]
mov word [eax], 0x5d
lea eax, [ebp - 0x14]
mov byte [esi + ebx], 0
push eax
push ebx
lea edi, [esi + ebx]
push 0x17
call dword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
je 0x1004ee93
pop edi
pop esi
mov eax, 0x16
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100526c8
mov esp, ebp
pop ebp
ret
push 0x2e
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x17
call sub.WS2_32.dll_inet_ntop
test eax, eax
je 0x1004eed9
lea edx, [ebp - 0x44]
lea ecx, [edx + 1]
mov edi, edi
mov al, byte [edx]
inc edx
test al, al
jne 0x1004eeb0
sub edx, ecx
cmp edx, esi
jae 0x1004eed9
lea ecx, [ebp - 0x44]
mov esi, ebx
mov eax, ecx
sub esi, eax
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [esi + ecx - 1], al
test al, al
jne 0x1004eec6
lea edi, [edx + ebx]
mov byte [edi + 1], al
mov ecx, dword [ebp - 4]
xor eax, eax
mov byte [edi], 0x5d
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.100526c8
mov esp, ebp
pop ebp
ret
call fcn.100530dc
int3

Function at 0x1004fd80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.1005f3d6
Function at 0x7a2058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.007a21a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x7a207e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7a206a
add dl, dl
jne 0x7a2089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7a20dc
xor eax, eax
add dl, dl
jne 0x7a2096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7a217d
add dl, dl
jne 0x7a20a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7a20b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7a20bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7a20c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x7a20d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x7a2075
mov eax, 1
add dl, dl
jne 0x7a20ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7a20f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7a20e1
sub eax, ebx
mov ebx, 1
jne 0x7a2128
mov ecx, 1
add dl, dl
jne 0x7a210e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7a2119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7a2105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7a2075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x7a213f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7a214a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7a2136
cmp eax, 0x7d00
jae 0x7a216d
cmp eax, 0x500
jb 0x7a2168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7a2075
cmp eax, 0x7f
ja 0x7a2170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7a2075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x7a219e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x7a2075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10011b10
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003aefd
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x1004b080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
push 4
lea ecx, [ebp - 0x14]
call fcn.10001aa0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.10012b00
add esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0x10012b60
mov edx, dword [ebp - 0x18]
add edx, 4
push edx
push 0
lea ecx, [ebp - 0x14]
call fcn.1000bc20
push eax
mov eax, dword [ebp - 0x1c]
push eax
push 0
push 0
call fcn.1001f9aa
add esp, 0x18
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
mov edx, dword [ebp - 0x18]
cmp dword [edx], 0
je 0x10011b9d
lea ecx, [ebp - 0x14]
call fcn.100125b0
nop
jmp 0x10011baf
mov eax, dword [ebp - 0x18]
mov dword [eax + 4], 0
push 6
call fcn.10017113
nop
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.100125e0
nop
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100198a3
mov esp, ebp
pop ebp
ret 4

Function at 0x100131f0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x270
jne 0x1001320f
mov ecx, dword [ebp - 8]
call fcn.10013290
nop
jmp 0x10013223
mov ecx, dword [ebp - 8]
cmp dword [ecx], 0x4e0
jb 0x10013223
mov ecx, dword [ebp - 8]
call fcn.10013320
nop
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4 + 4]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
add ecx, 1
mov edx, dword [ebp - 8]
mov dword [edx], ecx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
shr ecx, 0xb
mov edx, dword [ebp - 8]
and ecx, dword [edx + 0x1384]
xor ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
shl eax, 7
and eax, 0x9d2c5680
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
shr edx, 0x12
xor edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x10013290
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0x270
jmp 0x100132ab
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x4e0
jae 0x10013317
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx*4 - 0x9bc]
and eax, 0x80000000
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [edx + ecx*4 - 0x9b8]
and ecx, 0x7fffffff
or eax, ecx
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
and edx, 1
je 0x100132ef
mov dword [ebp - 0x10], 0x9908b0df
jmp 0x100132f6
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
shr eax, 1
xor eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
xor eax, dword [edx + ecx*4 - 0x388]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx + ecx*4 + 4], eax
jmp 0x100132a2
mov esp, ebp
pop ebp
ret