joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004cf10
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10244c40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10248410]
lea edx, [ebp - 8]
push ebx
push esi
push edi
mov edi, dword [eax + 0x1bac]
mov esi, 4
mov eax, dword [ebp + 8]
add edi, 0xcc
mov dword [ebp - 8], eax
mov eax, dword [edi]
mov ebx, dword [edi + 8]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
nop dword [eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x102176a0]
sub esi, 1
jne 0x1004cf50
mov esi, dword [edi + 4]
not ebx
mov ecx, dword [edi]
cmp ecx, esi
jne 0x1004cf97
inc ecx
test esi, esi
je 0x1004cf85
mov eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, esi
jmp 0x1004cf8a
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.10052b30
mov ecx, dword [edi]
mov eax, dword [edi + 8]
mov dword [eax + ecx*4], ebx
inc dword [edi]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100ef5dc
mov esp, ebp
pop ebp
ret

Function at 0x1004f8b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x10248410]
push esi
mov esi, dword [ebp + 8]
mov dword [eax + 0x2eac], 0
test esi, esi
je 0x1004f909
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push edi
push eax
call fcn.1004f910
push 0x10217db0
push esi
mov edi, eax
call fcn.10046550
mov esi, eax
add esp, 0xc
test esi, esi
je 0x1004f908
push esi
push dword [ebp + 8]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
pop edi
pop esi
pop ebp
ret
Function at 0x10051570
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, dword [0x10248410]
cmp byte [edi + 0x2ea9], 0
lea eax, [edi + 0x20]
jne 0x10051695
mov ecx, dword [eax]
push ebx
test ecx, ecx
je 0x1005168d
push esi
push 0x10217dac
push ecx
call fcn.10046550
mov esi, eax
add esp, 8
test esi, esi
je 0x10051689
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call ebx
add esp, 4
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x1005167f
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x1005167f
push esi
call ebx
mov ebx, eax
add esp, 4
mov dword [ebp - 4], ebx
cmp ebx, 0xffffffff
je 0x1005167f
push 0
push dword [ebp - 8]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x1005167f
mov eax, dword [0x10248410]
test eax, eax
je 0x10051615
inc dword [eax + 0x370]
push dword [0x1024851c]
push ebx
call dword [0x10242c08]
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x1005167f
push esi
push dword [ebp - 4]
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, dword [ebp - 4]
je 0x1005166b
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
mov eax, dword [0x10248410]
test eax, eax
je 0x10051659
dec dword [eax + 0x370]
push dword [0x1024851c]
push ebx
call dword [0x10242c0c]
add esp, 8
jmp 0x10051689
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
push dword [ebp - 4]
push ebx
call fcn.10048260
add esp, 0xc
jmp 0x1005164a
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
lea eax, [edi + 0x20]
pop esi
mov byte [edi + 0x2ea9], 1
pop ebx
movss xmm0, dword [edi + 0x2eac]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x100516e6
subss xmm0, dword [edi + 0x18]
comiss xmm1, xmm0
movss dword [edi + 0x2eac], xmm0
jb 0x100516e6
mov eax, dword [eax]
test eax, eax
je 0x100516d5
push eax
call fcn.1004f8b0
add esp, 4
mov dword [edi + 0x2eac], 0
pop edi
mov esp, ebp
pop ebp
ret
mov byte [edi + 0x358], 1
mov dword [edi + 0x2eac], 0
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x1005a620
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
je 0x1005a647
push eax
mov dword [esi + 4], 0
mov dword [esi], 0
call fcn.100487f0
add esp, 4
mov dword [esi + 8], 0
mov eax, dword [esi + 0x14]
test eax, eax
je 0x1005a66c
push eax
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
call fcn.100487f0
add esp, 4
mov dword [esi + 0x14], 0
mov eax, dword [esi + 0x20]
test eax, eax
je 0x1005a691
push eax
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
call fcn.100487f0
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov eax, dword [esi + 0x44]
test eax, eax
je 0x1005a6d2
push eax
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
call fcn.100487f0
add esp, 4
mov dword [esi + 0x44], 0
mov eax, dword [esi + 0x50]
test eax, eax
je 0x1005a6f7
push eax
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
call fcn.100487f0
add esp, 4
mov dword [esi + 0x50], 0
mov eax, dword [esi + 0x5c]
test eax, eax
je 0x1005a71c
push eax
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
call fcn.100487f0
add esp, 4
mov dword [esi + 0x5c], 0
lea ecx, [esi + 0x78]
pop esi
jmp fcn.10055dc0
Function at 0x10063660
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x10244c40]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call fcn.10045be0
mov edi, eax
xorps xmm0, xmm0
lea eax, [ebp - 0x2c]
push eax
push dword [0x10248570]
movups xmmword [ebp - 0x2c], xmm0
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x2c]
movd xmm0, eax
lea eax, [ebp - 0x14]
cvtdq2ps xmm0, xmm0
push eax
movd xmm1, ecx
cvtdq2ps xmm1, xmm1
movss dword [edi + 0xc], xmm0
xorps xmm0, xmm0
movss dword [edi + 8], xmm1
movlpd qword [ebp - 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 0x14]
sub ecx, dword [0x10248578]
mov edx, dword [ebp - 0x10]
sbb edx, dword [0x1024857c]
call fcn.100eff00
mov edx, dword [0x10248584]
mov ecx, dword [0x10248580]
cvtsd2ss xmm0, xmm0
movss dword [ebp - 8], xmm0
call fcn.100eff00
movss xmm1, dword [ebp - 8]
cvtsd2ss xmm0, xmm0
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
divss xmm1, xmm0
movss dword [edi + 0x10], xmm1
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov dword [0x10248578], eax
mov dword [0x1024857c], ecx
call esi
shr eax, 0xf
and al, 1
push 0x10
mov byte [edi + 0xf4], al
call esi
shr eax, 0xf
and al, 1
push 0x12
mov byte [edi + 0xf5], al
call esi
shr eax, 0xf
and al, 1
mov byte [edi + 0xf7], 0
mov byte [edi + 0xf6], al
call fcn.10045be0
mov esi, eax
cmp byte [esi + 0x34f], 0
je 0x1006379a
cvttss2si ecx, dword [esi + 0xdc]
lea eax, [ebp - 0xc]
push eax
push dword [0x10248570]
mov dword [ebp - 0xc], ecx
cvttss2si ecx, dword [esi + 0xe0]
mov dword [ebp - 8], ecx
call dword [sym.imp.USER32.dll_ClientToScreen]
test eax, eax
je 0x1006379a
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_SetCursorPos]
mov dword [esi + 0xdc], 0xff7fffff
mov dword [esi + 0xe0], 0xff7fffff
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x10063810
mov ecx, dword [0x10248570]
cmp eax, ecx
je 0x100637ce
push ecx
push eax
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x10063810
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x10063810
lea eax, [ebp - 0x1c]
push eax
push dword [0x10248570]
call dword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x10063810
movd xmm0, dword [ebp - 0x1c]
movd xmm1, dword [ebp - 0x18]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [esi + 0xdc], xmm0
movss dword [esi + 0xe0], xmm1
cmp byte [edi + 0xa8], 0
pop edi
pop esi
je 0x10063820
or eax, 0xffffffff
jmp 0x10063825
call fcn.10045cc0
cmp dword [0x10242dc8], eax
je 0x10063837
mov dword [0x10242dc8], eax
call fcn.10063b10
call fcn.10063850
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ef5dc
mov esp, ebp
pop ebp
ret
Function at 0x100745b0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f439d
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x10244c40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
xorps xmm0, xmm0
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
push 0
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 0
push ecx
push eax
mov dword [ebp - 0x34], 0x42a00000
mov dword [ebp - 0x30], 0x41b00000
call fcn.1006ea60
add esp, 0xc
test al, al
je 0x1007462f
mov eax, dword [edi]
mov dword [eax], 1
mov eax, dword [edi]
cmp dword [eax], 0
je 0x10074672
mov esi, 0x1021c688
nop dword [eax + eax]
push dword [esi]
call dword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns 0x10074664
mov ecx, dword [ebp - 0x2c]
mov eax, dword [esi]
mov dword [ecx], eax
mov eax, dword [edi]
mov dword [eax + 4], 1
mov eax, dword [edi]
mov dword [eax], 0
add esi, 4
cmp esi, 0x1021c920
jne 0x10074640
mov esi, dword [ebp - 0x2c]
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x1007468e
cmp dword [eax], 0
je 0x1007468e
push 0x1021cab4
lea ecx, [ebp - 0x28]
call fcn.1006d590
jmp 0x100746a8
mov eax, dword [esi]
lea ecx, [ebp - 0x28]
push dword [eax*4 + 0x10242dd0]
call fcn.1006d590
mov eax, dword [edi]
mov dword [eax + 4], 0
sub esp, 8
mov dword [esp + 4], 0xbf800000
mov dword [esp], 0
call fcn.1004f7f0
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
cmova eax, dword [ebp - 0x28]
push eax
call fcn.1007c0d0
mov ecx, dword [ebp - 0x14]
add esp, 0xc
cmp ecx, 0xf
jbe 0x10074709
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100746ff
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100746ff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100ef2b4
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100ef5dc
mov esp, ebp
pop ebp
ret
Function at 0x1007f6d0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x10244c40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x130], eax
push esi
push 2
xor ebx, ebx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x1007f715
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ef5dc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x12c], 0x128
push eax
push edi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x1007f76d
push dword [ebp - 0x130]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
jne 0x1007f75c
mov eax, dword [ebp - 0x118]
cmp eax, esi
jbe 0x1007f75c
mov ebx, dword [ebp - 0x124]
mov esi, eax
lea eax, [ebp - 0x12c]
push eax
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x1007f730
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100ef5dc
mov esp, ebp
pop ebp
ret

Function at 0x10087350
Capabilities:
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
cmp byte [0x10249cc8], 0
jne 0x1008735e
call fcn.10099610
cmp byte [0x10249cd1], 0
je 0x1008737c
push 0
push 0x40
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.100999a0
add esp, 0x10
ret
jmp fcn.10085700
Function at 0x100a5e10
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x100a5e9c
push esi
call fcn.100b9120
add esp, 4
test al, al
jne 0x100a5e9c
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x100a5e33
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.100c2530
add esp, 0xc
test eax, eax
je 0x100a5e67
sub eax, esi
push eax
push 0x2e
push esi
call fcn.100c2530
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x100a5e69
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
mov ebx, 0x1505
add edi, esi
cmp esi, edi
jae 0x100a5e95
mov al, byte [esi]
push eax
call fcn.100b4440
movsx ecx, al
inc esi
mov eax, ebx
add esp, 4
shl eax, 5
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp esi, edi
jb 0x100a5e77
pop edi
movzx eax, bl
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x100afd10
Capabilities:
Write file on windows

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp byte [edi + 0x6f9], 0
je 0x100afda7
cmp dword [edi + 0x1a8], 0
je 0x100afd61
push esi
push 1
push edi
call fcn.100a0f80
push dword [edi + 0x14c]
mov eax, dword [edi + 0x1a8]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push edi
call eax
push 0
push edi
mov esi, eax
call fcn.100a0f80
add esp, 0x24
mov eax, esi
pop esi
pop edi
ret
mov edx, dword [esp + 0xc]
mov ecx, edx
sub ecx, 0
je 0x100afd76
sub ecx, 1
je 0x100afd76
sub ecx, 1
jne 0x100afda7
push dword [edi + 0x148]
lea eax, [edx*2 + 0x10221aa4]
push 1
add eax, edx
push 2
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
push dword [edi + 0x148]
push 1
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x20
xor eax, eax
pop edi
ret

Function at 0x100b0350
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
sub esp, 0x10c
mov eax, dword [0x10244c40]
xor eax, esp
mov dword [esp + 0x108], eax
mov eax, dword [esp + 0x118]
push ebx
mov ebx, dword [esp + 0x114]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x124]
mov dword [esp + 4], eax
xor eax, eax
mov ecx, dword [ebx + 0xc]
push ebp
push esi
mov esi, 0x178
mov edx, dword [ecx + 0x154]
cmp dword [esp + 0x120], edx
push edi
sete al
lea eax, [eax*4 + 0x150]
mov ebp, dword [eax + ecx]
mov eax, 0x188
cmove esi, eax
mov eax, dword [ecx + 0x2a8]
add esi, ecx
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [eax + 0x44], 3
je 0x100b0453
xor eax, eax
cmp dword [esp + 0x124], edx
sete al
lea eax, [eax*4 + 0x168]
cmp dword [eax + ecx], 0x100b0010
jne 0x100b0453
cmp dword [esi], 0
je 0x100b03ee
test edi, edi
je 0x100b0453
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebp
call fcn.100c0db0
add esp, 0x14
cmp eax, 0xffffffff
je 0x100b0453
test al, 1
je 0x100b0453
mov ecx, dword [esi]
test ecx, ecx
jne 0x100b043c
mov eax, dword [ebx + 0x4c8]
add eax, eax
push eax
mov dword [esi + 4], eax
call dword [0x102448a8]
mov ecx, eax
add esp, 4
mov dword [esi], ecx
test ecx, ecx
je 0x100b0487
mov edi, dword [esi + 4]
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov eax, dword [esi + 8]
push 0
push edi
add eax, ecx
push eax
push ebp
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x100b0453
add dword [esi + 8], eax
push 0
push dword [esp + 0x130]
push dword [esp + 0x1c]
push ebp
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
jne 0x100b04c2
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
jne 0x100b0498
xor edi, edi
lea eax, [edi + 0x51]
jmp 0x100b04c2
mov ecx, dword [esp + 0x10]
mov eax, 0x1b
mov dword [ecx], 0xffffffff
jmp 0x100b04c8
push 0x100
lea eax, [esp + 0x1c]
push eax
push esi
call fcn.1009b380
push eax
push str.Send_failure:__s
push ebx
call fcn.100afdb0
add esp, 0x18
mov dword [ebx + 0x948], esi
mov eax, 0x37
mov ecx, dword [esp + 0x10]
mov dword [ecx], edi
mov ecx, dword [esp + 0x118]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100ef5dc
add esp, 0x10c
ret
Function at 0x100b0920
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 4]
cmp byte [eax + 0x1a4], 0
je 0x100b093d
push eax
call fcn.100aa310
add esp, 4
test eax, eax
je 0x100b095e
mov al, 1
ret
mov eax, dword [eax + 0x150]
cmp eax, 0xffffffff
je 0x100b095e
push 2
push 1
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
setne al
ret
xor al, al
ret

Function at 0x100b0bb0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x188
mov eax, dword [0x10244c40]
xor eax, esp
mov dword [esp + 0x184], eax
push ebx
mov ebx, dword [esp + 0x190]
lea eax, [esp + 8]
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [esp + 0x1a4]
push 0x80
push 0
push eax
mov dword [esp + 0x18], 0x80
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x1a4]
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x100b0c37
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
lea eax, [esp + 0x90]
push 0x100
push eax
push esi
call fcn.1009b380
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
jmp 0x100b0c77
push edi
push esi
push dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
call fcn.100b07a0
add esp, 0x10
test al, al
jne 0x100b0c80
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov esi, dword [eax]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov edi, eax
lea eax, [esp + 0x90]
push 0x100
push eax
push esi
call fcn.1009b380
push eax
push dword [edi]
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.100afdb0
add esp, 0x1c
mov ecx, dword [esp + 0x190]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100ef5dc
add esp, 0x188
ret

Function at 0x100b1400
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0xc
mov eax, dword [0x10249dbc]
mov dword [esp + 4], 0x4020
mov dword [esp], 0
mov dword [esp + 8], 4
test eax, eax
jne 0x100b1451
push 3
push 2
push eax
push eax
push 6
call fcn.100db680
add esp, 0x14
test al, al
je 0x100b1445
mov dword [0x10249dbc], 2
add esp, 0xc
ret
mov dword [0x10249dbc], 1
jmp 0x100b1456
cmp eax, 2
je 0x100b149c
lea eax, [esp + 8]
push eax
lea eax, [esp + 4]
push eax
push 0x1001
push 0xffff
push dword [esp + 0x20]
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x100b1481
mov eax, dword [esp]
cmp eax, dword [esp + 4]
jg 0x100b149c
push 4
lea eax, [esp + 8]
push eax
push 0x1001
push 0xffff
push dword [esp + 0x20]
call dword [sym.imp.WS2_32.dll_setsockopt]
add esp, 0xc
ret
Function at 0x100b28b0
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
push edi
push str.kernel32
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
test ebx, ebx
jne 0x100b28ca
pop edi
pop ebx
pop ecx
ret
push ebp
push esi
push str.LoadLibraryExA
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [esp + 0x18]
mov ebp, eax
push 0x10221f20
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strpbrk
add esp, 8
test eax, eax
je 0x100b2912
test ebp, ebp
je 0x100b2903
push 8
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
test ebp, ebp
je 0x100b2938
push str.AddDllDirectory
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100b2938
push 0x800
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, eax
mov dword [esp + 0x10], edx
test edx, edx
je 0x100b29ef
mov ecx, esi
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100b2955
sub ecx, ebx
lea eax, [ecx + 1]
add eax, edx
push eax
call dword [0x102448a8]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x100b29e5
push dword [esp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x100b29e5
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100b2987
sub ecx, edx
mov eax, 0x5c
mov word [ecx + ebx], ax
mov ecx, ebx
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100b29a0
sub ecx, edx
sub ecx, esi
add ecx, ebx
nop dword [eax]
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x100b29b0
test ebp, ebp
je 0x100b29dc
push 8
push 0
push ebx
call ebp
push ebx
mov edi, eax
call dword [0x102448ac]
add esp, 4
mov eax, edi
pop esi
pop ebp
pop edi
pop ebx
pop ecx
ret
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
push ebx
call dword [0x102448ac]
add esp, 4
pop esi
pop ebp
mov eax, edi
pop edi
pop ebx
pop ecx
ret
Function at 0x100b9120
Capabilities:
Convert ip address from string

Disassembly:
sub esp, 0x18
mov eax, dword [0x10244c40]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
mov esi, dword [esp + 0x20]
lea eax, [esp + 4]
push eax
push esi
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jg 0x100b9168
lea eax, [esp + 8]
push eax
push esi
push 0x17
call dword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
pop esi
setg al
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.100ef5dc
add esp, 0x18
ret
mov ecx, dword [esp + 0x18]
mov al, 1
pop esi
xor ecx, esp
call fcn.100ef5dc
add esp, 0x18
ret

Function at 0x100b9280
Capabilities:
Create udp socket

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x100b9292
mov eax, dword [eax + 0x70]
mov al, byte [eax + 0xe3]
ret
push 0
push 2
push 0x17
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
jne 0x100b92a6
xor al, al
ret
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov al, 1
ret
Function at 0x100c2bf0
Capabilities:
Move file

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
call fcn.100b8660
push dword [esp + 0x38]
movups xmm0, xmmword [eax]
movups xmmword [esp + 0x18], xmm0
call sub.api_ms_win_crt_string_l1_1_0.dll__strdup
push dword [esp + 0x40]
mov edi, eax
call sub.api_ms_win_crt_string_l1_1_0.dll__strdup
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExA]
add esp, 0xc
mov esi, eax
push 1
push esi
push edi
call ebx
test eax, eax
jne 0x100c2c85
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
nop dword [eax + eax]
lea eax, [esp + 0x20]
push eax
call fcn.100b8660
movups xmm0, xmmword [esp + 0x14]
sub esp, 0xc
mov ecx, esp
sub esp, 0x10
movups xmmword [ecx], xmm0
mov ecx, esp
movups xmm0, xmmword [eax]
movups xmmword [ecx], xmm0
call fcn.100b8710
add esp, 0x20
test edx, edx
ja 0x100c2ca9
jb 0x100c2c77
cmp eax, 0x3e8
ja 0x100c2ca9
push 1
call ebp
push 1
push esi
push edi
call ebx
test eax, eax
je 0x100c2c40
test edi, edi
je 0x100c2c92
push edi
call fcn.100f1284
add esp, 4
test esi, esi
je 0x100c2c9f
push esi
call fcn.100f1284
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
test edi, edi
je 0x100c2cb6
push edi
call fcn.100f1284
add esp, 4
test esi, esi
je 0x100c2cc3
push esi
call fcn.100f1284
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x20
ret