joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b610
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42b3d4]
jne 0x40b61a
repz ret
jmp fcn.004127fc

Function at 0x4184ac
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42b3d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040fe30
and dword [ebp - 0x14], 0
cmp dword [0x44e314], 0
mov dword [ebp - 0x18], eax
jne 0x41855f
push 0x403854
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x418607
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403848
push ebx
call edi
test eax, eax
je 0x418607
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403838
push ebx
mov dword [0x44e314], eax
call edi
push eax
call esi
push 0x403824
push ebx
mov dword [0x44e318], eax
call edi
push eax
call esi
push 0x403808
push ebx
mov dword [0x44e31c], eax
call edi
push eax
call esi
mov dword [0x44e324], eax
test eax, eax
je 0x41855f
push 0x4037f0
push ebx
call edi
push eax
call esi
mov dword [0x44e320], eax
mov eax, dword [0x44e320]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4185b8
cmp dword [0x44e324], ecx
je 0x4185b8
push eax
call esi
push dword [0x44e324]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4185b8
test ebx, ebx
je 0x4185b8
call edi
test eax, eax
je 0x4185af
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4185af
test byte [ebp - 8], 1
jne 0x4185b8
or dword [ebp + 0x10], 0x200000
jmp 0x4185eb
mov eax, dword [0x44e318]
cmp eax, dword [ebp - 0x18]
je 0x4185eb
push eax
call esi
test eax, eax
je 0x4185eb
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4185eb
mov eax, dword [0x44e31c]
cmp eax, dword [ebp - 0x18]
je 0x4185eb
push eax
call esi
test eax, eax
je 0x4185eb
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x44e314]
call esi
test eax, eax
je 0x418607
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x418609
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b610
leave
ret
Function at 0x422b50
Capabilities:
Delete directory
Delete file
Get disk information
Read .ini file

Disassembly:
mov eax, 0x1404
call fcn.00421ea0
cmp dword [0x7ef098], 0x37
jne 0x422c01
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
push 0x4044d0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
lea eax, [esp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x4044f0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [esp + 0x404]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetTapePosition]
push 0
lea edx, [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleProcessList]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReadEventLogW]
push 0
lea eax, [esp + 0xc08]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
mov ecx, dword [0x7ef09c]
mov eax, dword [0x7eb508]
mov dl, byte [ecx + esi + 0x38d6]
mov byte [eax + esi], dl
add esp, 0x1404
ret
Function at 0x71ddf1
Capabilities:
Create thread

Disassembly:
lea eax, [esi + 0xaec]
push eax
xor eax, eax
push eax
push esi
push 0x4036d7
push eax
push eax
call fcn.0074d673
add esp, 0x18
mov dword [esi + 0xaf0], eax
ret

Function at 0x729089
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
call fcn.00729a59
lea edi, [esi + 0x80]
mov eax, dword [edi]
test eax, eax
je 0x7290b2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [edi], 0
lea edi, [esi + 0x90]
mov ebx, dword [edi + 0xc]
lea esi, [esp + 0x18]
call fcn.0072a451
mov eax, dword [esp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
mov ebx, dword [edi + 0x10]
lea esi, [esp + 0x18]
call fcn.0072a451
mov eax, dword [esp + 0x10]
xor ebx, ebx
cmp eax, ebx
je 0x7290f0
cmp eax, dword [esp + 0x18]
je 0x7290f5
call fcn.0074e8c0
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x1c]
jae 0x729117
lea esi, [esp + 0x10]
call fcn.0072a1a0
mov eax, dword [eax]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call fcn.0072a471
jmp 0x7290d4
mov eax, edi
call fcn.00729f94
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x60]
mov edi, dword [fcn.0045f0f0]
cmp eax, ebx
je 0x72914c
push dword [esi + 0x74]
push eax
call edi
push dword [esi + 0x60]
call dword [fcn.0045f0ec]
push dword [esi + 0x70]
call dword [fcn.0045f0e8]
mov dword [esi + 0x60], ebx
mov dword [esi + 0x70], ebx
mov eax, dword [esi + 0x64]
cmp eax, ebx
je 0x729171
push dword [esi + 0x6c]
push eax
call edi
push dword [esi + 0x64]
call dword [fcn.0045f0ec]
push dword [esi + 0x68]
call dword [fcn.0045f0e8]
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [esi + 0x24]
push eax
call dword [fcn.0045f51c]
pop edi
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x3c], 0xffffff
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x7291b9
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
xor edi, edi
cmp dword [esi + 0x5c], edi
je 0x7291f5
mov ecx, esi
call fcn.00729c69
test eax, eax
je 0x7291fa
lea eax, [ebp - 8]
push eax
push 4
push esi
push 0x40ef63
push edi
push edi
call fcn.0074d673
add esp, 0x18
mov dword [esi + 0x78], eax
cmp eax, edi
je 0x7291f5
push eax
call dword [fcn.0045f2b0]
xor eax, eax
pop edi
leave
ret
mov eax, dword [esi + 0x80]
cmp eax, edi
je 0x7291f5
mov ecx, dword [eax]
lea edx, [ebp - 8]
push edx
push eax
call dword [ecx + 0x18]
mov eax, dword [esi + 0x80]
mov ecx, dword [eax]
lea edx, [ebp - 4]
push edx
push eax
call dword [ecx + 0x1c]
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0x80]
push edi
mov ecx, dword [eax]
neg edx
push edx
push dword [ebp - 8]
push dword [ebp - 4]
push edi
push dword [esi + 0x38]
push dword [esi + 0x34]
push edi
push edi
push dword [esi + 0x60]
push eax
call dword [ecx + 0x20]
test eax, eax
jne 0x7291f5
push edi
push edi
push dword [esi + 4]
call dword [fcn.0045f4c0]
xor eax, eax
inc eax
jmp 0x7291f7
Function at 0x73742d
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20c
mov eax, dword [0x4710f0]
xor eax, esp
mov dword [esp + 0x208], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor ebx, ebx
push 0x103
mov esi, ecx
lea ecx, [esp + 0x10d]
push ebx
push ecx
mov dword [esp + 0x18], eax
mov byte [esp + 0x114], bl
call fcn.0074c56d
push 0x40
lea edx, [esp + 0x7c]
push ebx
push edx
mov dword [esp + 0x28], 0x469148
mov dword [esp + 0x40], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x2c], 0x67452301
mov dword [esp + 0x30], 0xefcdab89
mov dword [esp + 0x34], 0x98badcfe
mov dword [esp + 0x38], 0x10325476
call fcn.0074c56d
xor eax, eax
push esi
push 0x468b04
mov dword [esp + 0xd9], eax
mov dword [esp + 0xdd], eax
mov dword [esp + 0xe1], eax
mov word [esp + 0xe5], ax
mov byte [esp + 0xe7], al
lea eax, [esp + 0x128]
push 0x103
push eax
mov byte [esp + 0x94], 0x80
mov byte [esp + 0xe0], bl
call fcn.0074ff0a
lea eax, [esp + 0x130]
add esp, 0x28
lea ecx, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x73750d
sub eax, ecx
lea ecx, [esp + 0x108]
push ecx
lea edx, [esp + 0x14]
push edx
call fcn.00745e1d
lea ecx, [esp + 0xb8]
lea esi, [esp + 0x10]
call fcn.00745eed
push 0x40
lea eax, [esp + 0xcc]
push ebx
push eax
call fcn.0074c56d
add esp, 0xc
xor edi, edi
movzx ecx, byte [esp + edi + 0xb8]
push ecx
push 0x468b08
xor eax, eax
lea edx, [esp + 0xb8]
push 7
push edx
mov dword [esp + 0xc0], eax
mov dword [esp + 0xc4], eax
call fcn.0074ff0a
lea eax, [esp + 0xd8]
add esp, 0x10
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x73758d
sub eax, edx
mov ecx, 0x40
sub ecx, eax
lea eax, [esp + 0xb0]
lea esi, [eax + 1]
lea ebx, [ebx]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x7375ad
sub eax, esi
cmp ecx, eax
jge 0x7375be
mov eax, ecx
jmp 0x7375d6
lea eax, [esp + 0xb0]
lea edx, [eax + 1]
jmp 0x7375cd
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x7375cd
sub eax, edx
push eax
lea eax, [esp + 0xb4]
push eax
lea ecx, [esp + 0xd0]
push ecx
call fcn.0074ffdd
inc edi
add esp, 0xc
cmp edi, 0x10
jl 0x73754d
mov esi, dword [esp + 0xc]
cmp esi, ebx
je 0x73762e
push 0x103
push ebx
push esi
call fcn.0074c56d
lea edx, [esp + 0xd4]
push edx
push 0x468b04
push 0x102
push esi
call fcn.0074ff0a
push esi
call fcn.00750330
add esp, 0x20
mov ecx, dword [esp + 0x214]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.007494f7
mov esp, ebp
pop ebp
ret
Function at 0x737bcd
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1d4
mov eax, dword [0x4710f0]
xor eax, esp
mov dword [esp + 0x1d0], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x103
mov esi, ecx
xor ebx, ebx
lea ecx, [esp + 0xd5]
push ebx
push ecx
mov dword [esp + 0x18], eax
mov byte [esp + 0xdc], 0
call fcn.0074c56d
push esi
push 0x468b04
mov ecx, 0x104
lea edi, [esp + 0xe4]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x2c], 0x67452301
mov dword [esp + 0x30], 0xefcdab89
mov dword [esp + 0x34], 0x98badcfe
mov dword [esp + 0x38], 0x10325476
call fcn.0073792d
mov eax, edi
add esp, 0x14
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x737c5d
sub eax, edx
lea edx, [esp + 0xd0]
push edx
lea esi, [esp + 0x14]
call fcn.0074806d
mov eax, esi
call fcn.0074817d
mov eax, esi
call fcn.0074817d
mov ecx, dword [esp + 0x70]
mov eax, dword [esp + 0x6c]
mov edx, dword [esp + 0x74]
push 0x40
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0x7c]
lea ecx, [esp + 0x98]
push ebx
push ecx
mov dword [esp + 0x98], edx
mov dword [esp + 0x9c], eax
call fcn.0074c56d
add esp, 0x10
movzx edx, byte [esp + ebx + 0x80]
xor eax, eax
push edx
push 0x468b08
lea ecx, [eax + 8]
lea edi, [esp + 0x80]
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], eax
call fcn.0073792d
lea eax, [esp + 0x98]
add esp, 8
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x737cfe
sub eax, edx
mov ecx, 0x40
sub ecx, eax
lea eax, [esp + 0x78]
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x737d15
sub eax, esi
cmp ecx, eax
jge 0x737d26
mov eax, ecx
jmp 0x737d36
lea eax, [esp + 0x78]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x737d2d
sub eax, edx
push eax
lea eax, [esp + 0x7c]
push eax
lea ecx, [esp + 0x98]
push ecx
call fcn.0074ffdd
inc ebx
add esp, 0xc
cmp ebx, 0x10
jl 0x737cc4
mov edi, dword [esp + 0xc]
test edi, edi
je 0x737d88
mov esi, dword [ebp + 0xc]
push esi
push 0
push edi
call fcn.0074c56d
lea edx, [esp + 0x9c]
push edx
push 0x468b04
lea ecx, [esi - 1]
call fcn.0073792d
push edi
call fcn.00750330
add esp, 0x18
mov ecx, dword [esp + 0x1dc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.007494f7
mov esp, ebp
pop ebp
ret
Function at 0x745eed
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0xc
mov eax, dword [0x4710f0]
xor eax, esp
mov dword [esp + 8], eax
push ebp
push edi
mov edi, ecx
xor ecx, ecx
lea eax, [esi + 0x16]
jmp 0x745f0d
movzx edx, byte [eax - 2]
mov byte [esp + ecx + 8], dl
movzx edx, byte [eax - 1]
mov byte [esp + ecx + 9], dl
movzx edx, byte [eax]
mov byte [esp + ecx + 0xa], dl
movzx edx, byte [eax + 1]
mov byte [esp + ecx + 0xb], dl
add ecx, 4
add eax, 4
cmp ecx, 8
jb 0x745f0d
mov ecx, dword [esi + 0x14]
shr ecx, 3
and ecx, 0x3f
mov eax, 0x38
cmp ecx, 0x38
jb 0x745f4f
mov eax, 0x78
lea ebp, [esi + 0x5c]
push ebp
sub eax, ecx
push esi
call fcn.00745e1d
lea eax, [esp + 8]
push eax
push esi
mov eax, 8
call fcn.00745e1d
lea ecx, [edi + 1]
lea eax, [esi + 6]
mov edi, 4
lea esp, [esp]
movzx edx, byte [eax - 2]
mov byte [ecx - 1], dl
movzx edx, byte [eax - 1]
mov byte [ecx], dl
movzx edx, byte [eax]
mov byte [ecx + 1], dl
movzx edx, byte [eax + 1]
mov byte [ecx + 2], dl
add eax, 4
add ecx, 4
sub edi, 1
jne 0x745f7d
push 0x9c
push edi
push esi
call fcn.0074c56d
push 0x40
push edi
push ebp
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], edi
mov dword [esi + 4], 0x67452301
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
call fcn.0074c56d
mov ecx, dword [esp + 0x28]
add esp, 0x18
pop edi
mov byte [ebp], 0x80
pop ebp
xor ecx, esp
call fcn.007494f7
add esp, 0xc
ret

Function at 0x7486cd
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push esi
or eax, 0xffffffff
add ecx, 2
mov edx, 0x200
push edi
lea ecx, [ecx]
movzx esi, byte [ecx - 2]
mov edi, eax
and edi, 0xff
xor esi, edi
shr eax, 8
xor eax, dword [esi*4 + 0x4722d8]
movzx esi, byte [ecx - 1]
mov edi, eax
and edi, 0xff
xor esi, edi
movzx edi, byte [ecx]
shr eax, 8
xor eax, dword [esi*4 + 0x4722d8]
add ecx, 4
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
xor eax, dword [esi*4 + 0x4722d8]
movzx esi, byte [ecx - 3]
mov edi, eax
and edi, 0xff
xor esi, edi
shr eax, 8
xor eax, dword [esi*4 + 0x4722d8]
sub edx, 1
jne 0x7486dd
pop edi
not eax
pop esi
ret
Function at 0xdf1c7e
Capabilities:
Create thread

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [esp + 0x14]
mov esi, eax
mov ebx, esi
call fcn.00df3f00
xor edi, edi
mov dword [esp + 0x14], eax
cmp eax, edi
jne 0xdf1ca0
xor eax, eax
jmp 0xdf1df8
push 0x40
push edi
push edi
push 1
mov ebx, 0x80
push ebx
push dword [0x495bc8]
call dword [0x478470]
push 0x48895c
push dword [esi + 4]
mov dword [esi + 0xd4], eax
call dword [fcn.00478460]
push dword [esi + 0xd4]
mov ebp, dword [int.004784f8]
push 1
push ebx
push dword [esi + 4]
call ebp
push dword [esi + 0xd4]
push edi
push ebx
push dword [esi + 4]
call ebp
mov ebx, dword [fcn.00478170]
push edi
push edi
push edi
push edi
call ebx
push edi
push edi
push edi
push edi
mov dword [esi + 0xcc], eax
call ebx
push edi
push edi
push 1
push edi
mov dword [esi + 0xc8], eax
call ebx
mov dword [esi + 0xd0], eax
lea eax, [esi + 0xdc]
push eax
push edi
push esi
push 0x403b59
push edi
push edi
call fcn.00e364eb
add esp, 0x18
push 0x186a0
push dword [esi + 0xc8]
mov dword [esi + 0xe0], eax
call dword [fcn.00478244]
call fcn.00df9d9b
mov eax, dword [eax + 0x2c]
mov dword [esi + 0x100], eax
cmp eax, edi
jne 0xdf1d83
mov dword [esi + 0xd8], edi
call fcn.00df326f
mov ecx, esi
call fcn.00e1a1b5
cmp dword [0x497960], edi
je 0xdf1de9
push edi
push dword [esi + 4]
call dword [fcn.00478498]
push edi
push edi
push 0x65
jmp 0xdf1de0
push 3
pop ecx
cmp eax, ecx
jne 0xdf1db4
mov dword [esi + 0xd8], ecx
call fcn.00df326f
mov ecx, esi
call fcn.00e1a1b5
cmp dword [0x497960], edi
je 0xdf1de9
push edi
push dword [esi + 4]
call dword [fcn.00478498]
push edi
push edi
push 0x72
jmp 0xdf1de0
mov dword [esi + 0xd8], 2
call fcn.00df326f
mov ecx, esi
call fcn.00e1a1b5
cmp dword [0x497960], edi
je 0xdf1de9
push edi
push dword [esi + 4]
call dword [fcn.00478498]
push edi
push edi
push 0x71
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
jmp 0xdf1df4
push 5
push dword [esi + 4]
call dword [fcn.00478498]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0xdfdbef
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push dword [esp + 0xc]
push 0x40fc34
push eax
push eax
call fcn.00e364eb
add esp, 0x18
push eax
call dword [fcn.00478248]
ret

Function at 0xe02c51
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x414cae
push eax
push eax
call fcn.00e364eb
add esp, 0x18
push eax
call dword [fcn.00478248]
ret
Function at 0xe064a6
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [esi + 0xc], ebx
je 0xe064b9
xor eax, eax
jmp 0xe06543
push edi
mov edi, 0x48a2e8
lea eax, [esi + 0x5d550]
push edi
push eax
call fcn.00e36022
pop ecx
pop ecx
cmp eax, ebx
je 0xe064fa
xor ecx, ecx
mov word [eax], cx
mov ecx, edi
lea edx, [ecx + 2]
mov di, word [ecx]
inc ecx
inc ecx
cmp di, bx
jne 0xe064dc
sub ecx, edx
sar ecx, 1
lea eax, [eax + ecx*2]
push eax
call fcn.00e35e97
pop ecx
mov dword [esi + 0x2694], eax
mov ecx, esi
call fcn.00e0a779
pop edi
test eax, eax
je 0xe064b2
push ebx
push ebx
push 1
push ebx
call dword [fcn.00478170]
mov dword [esi + 0x2464], eax
cmp eax, ebx
je 0xe06540
lea eax, [ebp - 4]
push eax
push ebx
push esi
push 0x4188c9
push ebx
push ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x5d118], 8
call fcn.00e364eb
add esp, 0x18
mov dword [esi + 0xc], eax
xor eax, eax
inc eax
pop ebx
leave
ret

Function at 0xe10b9a
Capabilities:
Hash data with md5

Disassembly:
and dword [eax + 0x18], 0
and dword [eax + 0x14], 0
push esi
lea esi, [eax + 0x5c]
push 0x40
push esi
mov dword [eax + 4], 0x67452301
mov dword [eax + 8], 0xefcdab89
mov dword [eax + 0xc], 0x98badcfe
mov dword [eax + 0x10], 0x10325476
call fcn.00e11426
mov byte [esi], 0x80
pop esi
ret

Function at 0xe12801
Capabilities:
Hash data with md5

Disassembly:
and dword [eax + 4], 0
and dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
ret
Function at 0xe1d785
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x475db6
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x493260]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x18], esi
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi], 0x479768
lea ebx, [esi + 8]
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
lea ebp, [esi + 0x20]
lea edi, [esi + 0x40]
mov ecx, edi
mov dword [ebp], eax
mov dword [ebp + 4], eax
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], eax
call fcn.00e1c4b5
lea eax, [esp + 0x17]
push eax
lea edx, [esp + 0x1b]
lea ecx, [esi + 0x58]
push edx
mov dword [esp + 0x30], 0
call fcn.00e1bd75
lea ecx, [esi + 0x78]
mov byte [esp + 0x28], 1
call fcn.00e1c4b5
push ebx
call dword [fcn.0047848c]
xor ebx, ebx
push ebp
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], 0xffffffff
call dword [fcn.0047848c]
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x30], 0xff
mov dword [esi + 0x38], ebx
mov ebx, dword [edi + 0x10]
cmp dword [edi + 0xc], ebx
jbe 0xe1d842
call fcn.00e36a95
mov ebp, dword [edi + 0xc]
mov eax, dword [edi]
mov dword [esp + 0x18], eax
cmp ebp, dword [edi + 0x10]
jbe 0xe1d855
call fcn.00e36a95
mov ecx, dword [esp + 0x18]
mov eax, dword [edi]
push ebx
push ecx
push ebp
push eax
lea edx, [esp + 0x28]
push edx
mov ecx, edi
call fcn.00e1a5b5
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x10002aa0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp dword [eax + 0x70], 0
mov dword [eax + 0x4c], ecx
jne 0x10002ab3
mov dword [eax + 0x70], 1
mov dword [eax + 0x54], ecx
mov edx, ecx
sub edx, dword [eax + 0x54]
cmp edx, 0x2710
jge 0x10002ac8
cmp edx, 0xffffd8f0
jge 0x10002acd
mov dword [eax + 0x54], ecx
jmp 0x10002ad1
test edx, edx
js 0x10002aec
mov edx, dword [eax + 0x50]
add dword [eax + 0x54], edx
push esi
push edi
mov edi, ecx
sub edi, dword [eax + 0x54]
pop edi
pop esi
js 0x10002ae7
add edx, ecx
mov dword [eax + 0x54], edx
jmp fcn.100024b0
ret

Function at 0x10002c70
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x19c
mov eax, dword [0x100291b0]
xor eax, esp
mov dword [esp + 0x198], eax
push edi
xor edi, edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi], vtable.CTcpSocket.0
mov dword [esi + 0x38], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov eax, vtable.CBuffer.0
mov dword [esi + 0x2c], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x48], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x4c], eax
lea eax, [esp + 8]
push eax
push 0x202
mov dword [esi + 0x58], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
call dword [sym.imp.WS2_32.dll_WSAStartup]
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push edi
lea ecx, [esi + 0x18]
push ecx
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov ecx, dword [esp + 0x19c]
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x14], edi
pop edi
xor ecx, esp
mov dword [esi + 0x64], 0xffffffff
mov eax, esi
call fcn.1000e6f5
mov esp, ebp
pop ebp
ret
Function at 0x10003250
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov esi, eax
mov dword [ebp - 4], 0
cmp ebx, 0x40000
jl 0x100032ad
jmp 0x10003270
xor edi, edi
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x64]
push 0
push 0x40000
push esi
push ecx
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x10003291
inc edi
cmp edi, 0xf
jl 0x10003272
cmp edi, 0xf
je 0x100032de
add dword [ebp - 4], eax
sub ebx, 0x40000
add esi, 0x40000
cmp ebx, 0x40000
jge 0x10003270
test ebx, ebx
jle 0x100032d6
xor edi, edi
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x64]
push 0
push ebx
push esi
push eax
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x100032ce
inc edi
cmp edi, 0xf
jl 0x100032b3
cmp edi, 0xf
je 0x100032de
add dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
je 0x100032e1
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x10003500
Capabilities:
Create thread
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, eax
mov eax, dword [esi + 0x198]
xor ebx, ebx
cmp eax, ebx
jne 0x10003522
mov dword [esi + 0x1b8], 0x598
jmp 0x10003539
cmp eax, 0x598
jbe 0x10003533
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [esi + 0x1b8], eax
push edi
mov dword [esi + 0x64], ebx
call fcn.10003660
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, 1
push 0x100324c4
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], 5
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], eax
mov dword [ebp - 8], ebx
call edi
mov dword [esi + 0x48], eax
cmp eax, ebx
jne 0x10003578
push 0x100324c4
call edi
mov dword [esi + 0x48], eax
mov ecx, dword [esi + 0x40]
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
push 4
lea eax, [ebp - 4]
push eax
push 0x1001
push 0xffff
mov ebx, 0x40000
push ecx
mov dword [ebp - 4], ebx
call edi
mov eax, dword [esi + 0x40]
push 4
lea edx, [ebp - 4]
push edx
push 0x1002
push 0xffff
push eax
mov dword [ebp - 4], ebx
call edi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push ecx
push edx
call fcn.100036f0
test eax, eax
je 0x1000360d
lea eax, [esi + 0x58]
push eax
push 0
push esi
push 0x10003870
push 0
push 0
call fcn.1000f0fb
add esp, 0x18
mov dword [esi + 0x54], eax
test eax, eax
je 0x100035ff
mov ecx, dword [esi + 0x2c]
push ecx
mov edi, 1
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [esi + 0x5c], 8
push 0x65f
jmp 0x1000361b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x5c], 0xb
push eax
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
call ebx
xor eax, eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], 5
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, esi
call fcn.10003f60
push edi
call ebx
mov edi, dword [ebp - 8]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8