joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10027e20
Capabilities:
Print debug messages
Write file on windows

Disassembly:
sub esp, 0x20c
push ebx
mov ebx, ecx
test ebx, ebx
je 0x10027e38
mov eax, dword [ebx]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebp
mov edx, dword [esp + 0x220]
push esi
push edi
mov ecx, 0x4e2
xor eax, eax
mov edi, 0x10056dd4
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x22c]
push ecx
push edx
push 0x10056dd4
call dword [sym.imp.MSVCRT.dll_vsprintf]
lea esi, [ebx + 0x338]
mov ecx, 0x500
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov dword [0x10056dc0], eax
add esp, 0xc
mov dword [0x10056dc4], eax
mov dword [0x10056dc8], eax
push 0x10056dc0
mov dword [0x10056dcc], eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [esp + 0x224]
mov ecx, dword [esp + 0x220]
push 0x10056dd4
push ecx
mov ecx, dword [0x10056dcc]
lea edx, [eax + eax*2]
and ecx, 0xffff
lea eax, [edx*2 + 0x100497a8]
xor edx, edx
mov dx, word [0x10056dca]
push eax
mov eax, dword [0x10056dc8]
push ecx
push edx
xor ecx, ecx
mov cx, word [0x10056dc6]
and eax, 0xffff
xor edx, edx
push eax
mov dx, word [0x10056dc2]
push ecx
push edx
push str.__02u__02u__02u:_02u:_02u___s___s__s_r_n
push 0x1388
push esi
call fcn.1002a490
add esp, 0x2c
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x119]
mov byte [esp + 0x118], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 1
lea eax, [esp + 0x18]
push 0x104
push eax
call fcn.1003de90
lea ecx, [esp + 0x20]
lea edx, [esp + 0x124]
push ecx
push 0x1005226c
push 0x104
push edx
call fcn.1002a490
add esp, 0x1c
push 0
push 0x80
push 4
push 0
push 0
lea eax, [esp + 0x12c]
push 0x40000000
push eax
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x10027fde
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 2
push 0
push 0
push ebp
call edi
cmp eax, 0x500000
jbe 0x10027fbb
push 0
push 0
push 0
push ebp
call edi
push ebp
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
lea ecx, [esp + 0x10]
push 0
push ecx
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
test ebx, ebx
pop ebp
je 0x10027fee
mov edx, dword [ebx]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop ebx
add esp, 0x20c
ret 0x10
Function at 0x10028d00
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, ecx
push esi
push edi
lea esi, [ebp + 4]
mov ecx, 8
xor eax, eax
mov edi, esi
mov dword [ebp], 0
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x10]
push eax
push 0x10052340
push esi
call dword [sym.imp.MSVCRT.dll_sprintf]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x10028d70
mov edx, esi
mov ecx, 0x1505
mov al, byte [edx]
inc edx
test eax, eax
je 0x10028d5c
mov esi, ecx
shl esi, 5
add eax, esi
add ecx, eax
xor eax, eax
mov al, byte [edx]
inc edx
test eax, eax
jne 0x10028d4a
mov dword [ebp], ecx
mov ecx, dword [0x10052238]
pop edi
mov dword [ebp + 0x24], ecx
mov eax, ebp
pop esi
pop ebp
ret 4
mov edx, dword [0x10052238]
pop edi
mov dword [ebp + 0x24], edx
mov eax, ebp
pop esi
pop ebp
ret 4
Function at 0x1002a280
Capabilities:
Copy file
Delete file
Print debug messages
Write file on windows

Disassembly:
mov eax, 0x1114
call fcn.10047e80
mov eax, dword [0x10052574]
push ebp
push esi
mov esi, dword [esp + 0x1120]
cmp esi, eax
push edi
jb 0x1002a479
mov eax, dword [esp + 0x1128]
test eax, eax
je 0x1002a479
mov ecx, 0x200
xor eax, eax
lea edi, [esp + 0x20]
cmp esi, 8
rep stosd dword es:[edi], eax
mov ecx, 0x240
lea edi, [esp + 0x820]
rep stosd dword es:[edi], eax
jbe 0x1002a2d2
xor esi, esi
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x1a]
mov eax, dword [esp + 0x18]
push str.GWCLI
shl esi, 4
add esi, 0x1005257c
and ecx, 0xffff
push esi
and edx, 0xffff
push ecx
mov ecx, dword [esp + 0x22]
push edx
mov edx, dword [esp + 0x22]
and eax, 0xffff
and ecx, 0xffff
push eax
and edx, 0xffff
push ecx
push edx
push str.__02d__02d__02d:_02d:_02d___s___s_
lea eax, [esp + 0x40]
push 0x800
push eax
call fcn.1002a490
mov edx, dword [esp + 0x1150]
lea ecx, [esp + 0x1154]
push ecx
push edx
lea eax, [esp + 0x850]
push 0x800
push eax
call dword [sym.imp.MSVCRT.dll__vsnprintf]
mov esi, dword [sym.imp.MSVCRT.dll_strncat]
lea ecx, [esp + 0x858]
push 0x7ff
lea edx, [esp + 0x5c]
push ecx
push edx
call esi
add esp, 0x44
lea eax, [esp + 0x20]
mov byte [esp + 0x81f], 0
push 0x1005267c
push eax
call dword [sym.imp.SHLWAPI.dll_StrTrimA]
push 0x7ff
lea ecx, [esp + 0x24]
push 0x10052680
push ecx
call esi
mov al, byte [0x10052578]
add esp, 0xc
test al, 1
mov byte [esp + 0x81f], 0
je 0x1002a3be
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test byte [0x10052578], 2
je 0x1002a479
xor ebp, ebp
push ebp
push 0x80
push 4
push ebp
push ebp
push 0x40000000
push str.c:gwlog.txt
mov dword [esp + 0x28], ebp
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x1002a479
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 2
push ebp
push ebp
push esi
call edi
cmp eax, 0x400000
jbe 0x1002a40f
mov ebp, 1
push 2
push 0
push 0
push esi
call edi
cmp eax, 0x500000
jbe 0x1002a42f
push 0
push 0
push 0
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
lea eax, [esp + 0xc]
push 0
push eax
lea edi, [esp + 0x28]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, ebp
je 0x1002a479
push 0
push str.c:gwlogbk.txt
push str.c:gwlog.txt
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push str.c:gwlog.txt
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
pop ebp
add esp, 0x1114
ret
Function at 0x1002a6a0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x128
push ebx
push esi
push 0
push 0xa
xor bl, bl
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x1002a722
push ebp
lea eax, [esp + 0xc]
push edi
push eax
push esi
mov dword [esp + 0x18], 0x128
call sub.KERNEL32.dll_Process32First
cmp eax, 1
jne 0x1002a70e
mov edi, dword [esp + 0x140]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea ecx, [esp + 0x34]
push ecx
push edi
call ebp
test eax, eax
je 0x1002a6ff
lea edx, [esp + 0x10]
push edx
push esi
call sub.KERNEL32.dll_Process32Next
cmp eax, 1
jne 0x1002a70e
jmp 0x1002a6e1
mov eax, dword [esp + 0x13c]
mov ecx, dword [esp + 0x18]
mov bl, 1
mov dword [eax], ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebp
mov al, bl
pop esi
pop ebx
add esp, 0x128
ret
mov al, bl
pop esi
pop ebx
add esp, 0x128
ret
Function at 0x1002af30
Capabilities:
Query environment variable

Disassembly:
sub esp, 0xc80
push ebx
push esi
push edi
xor ebx, ebx
mov ecx, 0x1f
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x8d]
mov byte [esp + 0x8c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x48d]
mov byte [esp + 0x48c], bl
rep stosd dword es:[edi], eax
mov esi, dword [esp + 0xc98]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [sym.imp.MSVCRT.dll_sprintf]
push esi
lea eax, [esp + 0x10]
push str.___s__
push eax
call edi
add esp, 0xc
lea ecx, [esp + 0x8c]
lea edx, [esp + 0xc]
push 0x400
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [esp + 0x8c]
lea ecx, [esp + 0x48c]
push eax
push esi
push 0x100527e0
push ecx
call edi
mov esi, dword [esp + 0xca0]
mov eax, dword [esp + 0xca4]
add esp, 0x10
mov byte [esi + eax], bl
inc eax
xor ecx, ecx
mov dl, byte [esp + ecx + 0x48c]
cmp dl, bl
je 0x1002afff
mov byte [eax + esi], dl
inc eax
inc ecx
cmp ecx, 0x800
jl 0x1002afe7
mov byte [eax + esi + 1], bl
mov byte [eax + esi + 2], bl
pop edi
pop esi
pop ebx
add esp, 0xc80
ret
Function at 0x1002d7f0
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
test eax, eax
je 0x1002d80d
push str.Wow64Redirection::restore_____
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [esp + 8]
push eax
call dword [esi + 0xc]
pop esi
ret 4
Function at 0x1002dd30
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x90
push ebx
push esi
push edi
xor ebx, ebx
mov ecx, 0x21
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [esp + 0xa0]
lea eax, [esp + 0x14]
push 0x1001
push eax
push edi
call dword [sym.imp.KERNEL32.dll_OpenFile]
mov esi, eax
push ebx
cmp esi, ebx
jne 0x1002dda0
call fcn.1002f6e0
add esp, 4
lea ecx, [esp + 0xc]
push eax
push edi
push str._comm__write_file__s__OpenFile_failed:__s
push 0x10052e80
call fcn.10030b00
push eax
call fcn.10030b10
add esp, 0x10
mov al, bl
pop edi
pop esi
pop ebx
add esp, 0x90
ret
mov edx, dword [esp + 0xac]
mov eax, dword [esp + 0xa8]
lea ecx, [esp + 0x14]
push ecx
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1002ddfa
push ebx
call fcn.1002f6e0
add esp, 4
lea ecx, [esp + 0xc]
push eax
push edi
push str._comm__write_file__s__WriteFile_failed:__s
push 0x10052eb4
call fcn.10030b00
push eax
call fcn.10030b10
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov al, bl
pop esi
pop ebx
add esp, 0x90
ret
push esi
mov bl, 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov al, bl
pop esi
pop ebx
add esp, 0x90
ret
Function at 0x1002f1b0
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
xor al, al
ret

Function at 0x1002f350
Capabilities:
Identify system language via api

Disassembly:
mov eax, dword [esp + 4]
cmp eax, 1
jl 0x1002f35e
cmp eax, 3
jle 0x1002f37e
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
cmp ax, 0x804
jne 0x1002f370
mov eax, 2
ret
sub ax, 0x404
neg ax
sbb eax, eax
and al, 0xfe
add eax, 3
ret
Function at 0x1002f380
Capabilities:
Check os version
Get system information on windows

Disassembly:
mov al, byte [0x1005a992]
sub esp, 0xc4
test al, al
push esi
jne 0x1002f5c8
push edi
mov ecx, 0x26
xor eax, eax
lea edi, [esp + 0x34]
mov dword [esp + 0x30], 0
mov dword [esp + 0xc], eax
rep stosd dword es:[edi], eax
mov ecx, 8
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
push eax
mov dword [0x1005a9ac], eax
call fcn.1002cd90
xor eax, eax
add esp, 4
xor esi, esi
cmp eax, 0x10053210
je 0x1002f3f0
mov edi, 0x10053210
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x1002f3f0
push 0x10053210
call fcn.1002cc20
add esp, 4
mov esi, eax
push 0x10053220
push esi
call fcn.1002cd70
push esi
mov edi, eax
call fcn.1002cd90
add esp, 0xc
test edi, edi
je 0x1002f413
lea ecx, [esp + 0xc]
push ecx
call edi
jmp 0x1002f41e
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea eax, [esp + 0x30]
mov dword [esp + 0x30], 0x9c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
pop edi
je 0x1002f5a1
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
and edx, 0xffff
cmp ecx, 5
mov dword [0x1005a99c], ecx
mov dword [0x1005a9a0], eax
mov dword [0x1005a9a8], edx
jne 0x1002f52b
test eax, eax
jne 0x1002f483
mov dword [0x1005a998], 1
mov byte [0x1005a992], 1
pop esi
add esp, 0xc4
ret
cmp eax, 1
jne 0x1002f49f
mov dword [0x1005a998], 2
mov byte [0x1005a992], al
pop esi
add esp, 0xc4
ret
cmp eax, 2
jne 0x1002f5c8
cmp byte [esp + 0xc6], 1
jne 0x1002f4d3
cmp word [esp + 8], 9
jne 0x1002f4d3
mov dword [0x1005a998], 3
mov byte [0x1005a992], 1
pop esi
add esp, 0xc4
ret
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x59
call esi
test eax, eax
je 0x1002f512
cmp word [esp + 0xc4], 0x8000
je 0x1002f512
push 0x59
call esi
test eax, eax
je 0x1002f5c8
mov dword [0x1005a998], 5
mov byte [0x1005a992], 1
pop esi
add esp, 0xc4
ret
mov dword [0x1005a998], 4
mov byte [0x1005a992], 1
pop esi
add esp, 0xc4
ret
cmp ecx, 6
jne 0x1002f5c8
test eax, eax
jne 0x1002f55b
mov dl, byte [esp + 0xc6]
mov byte [0x1005a992], 1
cmp dl, 1
pop esi
setne al
add eax, ecx
mov dword [0x1005a998], eax
add esp, 0xc4
ret
cmp eax, 1
jne 0x1002f583
mov cl, byte [esp + 0xc6]
mov byte [0x1005a992], al
dec cl
pop esi
neg cl
sbb ecx, ecx
add ecx, 9
mov dword [0x1005a998], ecx
add esp, 0xc4
ret
cmp eax, 2
jne 0x1002f5c8
mov dword [0x1005a998], 0xa
mov byte [0x1005a992], 1
pop esi
add esp, 0xc4
ret
push 0
call fcn.1002f6e0
add esp, 4
lea ecx, [esp + 4]
push eax
push str._comm__detect_OS_type_failed:__s
push 0x10053234
call fcn.10030b00
push eax
call fcn.10030b10
add esp, 0xc
mov byte [0x1005a992], 1
pop esi
add esp, 0xc4
ret
Function at 0x10030b10
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x1c
push ebx
push esi
push edi
push 0
push 0
push 0x2801
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0
call fcn.10006370
mov esi, dword [esp + 0x14]
xor eax, eax
mov dword [esp + 0x1a], eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x1e], eax
push ecx
mov dword [esp + 0x26], eax
mov word [esp + 0x1c], 0
mov word [esp + 0x2a], ax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
mov ebx, dword [sym.imp.MSVCRT.dll_sprintf]
and ecx, 0xffff
mov eax, dword [edx]
mov edx, dword [esp + 0x22]
push eax
mov eax, dword [esp + 0x24]
and edx, 0xffff
push ecx
and eax, 0xffff
push edx
push eax
push str.__02u:_02u:_02u__s
push esi
call ebx
mov edx, dword [esp + 0x48]
mov edi, eax
lea ecx, [esp + 0x4c]
push ecx
lea eax, [edi + esi]
push edx
push eax
call dword [sym.imp.MSVCRT.dll_vsprintf]
add edi, eax
push 0x10053510
add edi, esi
push edi
call ebx
add esp, 0x2c
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
test eax, eax
je 0x10030bce
push eax
call fcn.10047cb0
add esp, 4
add esp, 0x1c
ret

Function at 0x10031140
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
lea eax, [esp]
lea edx, [esp + 0x10]
push eax
lea eax, [esp + 8]
push edx
mov edx, dword [esp + 0x18]
push eax
mov eax, dword [ecx]
push 0
push edx
push eax
mov dword [esp + 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10031178
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov dword [ecx], edx
add esp, 8
ret 8

Function at 0x10031180
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x2808
call fcn.10047e80
push ebp
push esi
mov edx, ecx
push edi
mov ecx, 0x9ff
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edx, dword [edx]
lea ecx, [esp + 0x14]
stosb byte es:[edi], al
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x2800
push eax
lea eax, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x2828]
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebp, eax
test ebp, ebp
jne 0x10031210
mov esi, dword [esp + 0x281c]
mov ecx, dword [esp + 0xc]
mov eax, dword [esi]
test eax, eax
jbe 0x100311e9
cmp eax, ecx
jbe 0x100311eb
mov dword [esi], ecx
mov eax, dword [esi]
test eax, eax
jbe 0x10031210
mov edi, dword [esp + 0x2818]
dec eax
push eax
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.MSVCRT.dll_strncpy]
mov ecx, dword [esi]
add esp, 0xc
mov byte [ecx + edi - 1], 0
pop edi
mov eax, ebp
pop esi
pop ebp
add esp, 0x2808
ret 0xc

Function at 0x10031240
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [ecx]
lea edx, [esp + 8]
push 4
mov dword [esp + 0xc], eax
mov eax, dword [esp + 8]
push edx
push 4
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8
Function at 0x10031270
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, dword [esp + 0xc]
mov edx, ecx
push edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
mov ecx, dword [edx]
push esi
push 1
push eax
mov eax, dword [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
ret 8

Function at 0x10031d40
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0xa4
push ebx
push ebp
push esi
mov ebp, ecx
push edi
xor ebx, ebx
mov ecx, 0x21
xor eax, eax
lea edi, [esp + 0x2d]
mov byte [esp + 0x2c], bl
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0xb8]
push ebx
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x30]
mov dword [esp + 0x14], ebx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_OpenFile]
mov esi, eax
cmp esi, 0xffffffff
je 0x10031e26
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, ebx
mov dword [esp + 0x10], eax
jbe 0x10031e1f
push ebx
push ebx
push eax
lea ecx, [esp + 0x2c]
mov dword [esp + 0x34], ebx
call fcn.10006370
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x28]
lea edx, [esp + 0x10]
push ebx
push edx
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10031e0e
push ebx
push ebx
push 1
lea ecx, [esp + 0x20]
mov dword [esp + 0x28], ebx
call fcn.10006370
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x28]
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.10031410
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x28]
add esp, 0xc
mov ecx, ebp
push edx
push eax
call fcn.10031e40
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x10031e0e
push eax
call fcn.10047cb0
add esp, 4
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0x10031e1f
push eax
call fcn.10047cb0
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa4
ret 4
Function at 0x100356d0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x14
push esi
mov esi, ecx
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x1003572a
xor ecx, ecx
lea edx, [esp + 4]
mov dword [esp + 0xa], ecx
push edx
mov dword [esp + 0x12], ecx
mov word [esp + 0xc], 0
mov dword [esp + 0x16], ecx
mov dword [esp + 8], 0x10
mov word [esp + 0x1a], cx
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x1003572a
mov edx, dword [esp + 0xa]
push edx
call dword [sym.imp.WS2_32.dll_htons]
and eax, 0xffff
mov dword [esi + 0x88], eax
pop esi
add esp, 0x14
ret

Function at 0x100358d0
Capabilities:
Connect socket

Disassembly:
sub esp, 0x20
push ebx
push esi
mov esi, ecx
xor bl, bl
cmp dword [esi], 0xffffffff
jne 0x100358ec
call fcn.10035630
cmp eax, 0xffffffff
je 0x10035992
push 0
mov ecx, esi
call fcn.100356a0
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.10037d20
mov eax, dword [esp + 0x24]
xor edx, edx
mov dword [esp + 0x12], edx
add esp, 8
mov dword [esp + 0xe], edx
mov word [esp + 8], 0
mov dword [esp + 0x12], edx
test eax, eax
mov word [esp + 0x16], dx
jne 0x1003592e
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
mov ecx, dword [esp + 0x30]
lea edx, [esp + 8]
push ecx
push eax
push edx
call fcn.10035550
mov ecx, dword [esi]
add esp, 0xc
lea eax, [esp + 8]
push 0x10
push eax
push ecx
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x10035960
mov ecx, esi
call fcn.100356d0
mov bl, 1
jmp 0x10035966
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x10035992
mov al, byte [ecx - 1]
test al, al
je 0x10035988
cmp al, 0xff
je 0x10035988
dec al
pop esi
mov byte [ecx - 1], al
mov al, bl
pop ebx
add esp, 0x20
ret 8
dec ecx
push ecx
call fcn.10047cb0
add esp, 4
mov al, bl
pop esi
pop ebx
add esp, 0x20
ret 8
Function at 0x100359a0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, ecx
cmp dword [ebp], 0xffffffff
jne 0x100359c4
mov eax, dword [ebp + 0x88]
add ebp, 5
push eax
push ebp
push str._comm__Socket__s:_d_::send_error:_Invalid_Socket.
push 0x10053758
lea ecx, [esp + 0x18]
jmp 0x100359e5
mov eax, dword [esp + 8]
test eax, eax
jne 0x100359fa
mov ecx, dword [ebp + 0x88]
add ebp, 5
push ecx
push ebp
push str._comm__Socket__s:_d_::send_error:_NULL_buffer.
push 0x10053794
lea ecx, [esp + 0x18]
call fcn.10030b00
push eax
call fcn.10030b10
add esp, 0x10
or eax, 0xffffffff
pop ebp
ret 8
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
xor ebx, ebx
xor esi, esi
test edi, edi
jbe 0x10035a6f
mov edx, dword [esp + 0x14]
mov ecx, dword [ebp]
push 0
push edi
lea eax, [ebx + edx]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_send]
mov esi, eax
cmp esi, 0xffffffff
je 0x10035a36
test esi, esi
je 0x10035a31
sub edi, esi
add ebx, esi
test edi, edi
ja 0x10035a09
cmp esi, 0xffffffff
jne 0x10035a6d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.1002f6e0
mov edx, dword [ebp + 0x88]
add esp, 4
add ebp, 5
lea ecx, [esp + 0x14]
push eax
push edx
push ebp
push str._comm__Socket__s:_d_::send_error:__s.
push 0x100537cc
call fcn.10030b00
push eax
call fcn.10030b10
add esp, 0x14
test edi, edi
mov eax, ebx
je 0x10035a75
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x10035d30
Capabilities:
Receive data
Receive data on socket

Disassembly:
push edi
mov edi, ecx
mov eax, dword [edi]
cmp eax, 0xffffffff
jne 0x10035d55
mov eax, dword [edi + 0x88]
add edi, 5
push eax
push edi
push str._comm__Socket__s:_d_::recv_error:_Invalid_Socket.
push 0x100538a4
lea ecx, [esp + 0x1c]
jmp 0x10035d76
mov edx, dword [esp + 8]
test edx, edx
jne 0x10035d8b
mov ecx, dword [edi + 0x88]
add edi, 5
push ecx
push edi
push str._comm__Socket__s:_d_::recv_error:_NULL_buffer.
push 0x100538e0
lea ecx, [esp + 0x1c]
call fcn.10030b00
push eax
call fcn.10030b10
add esp, 0x10
or eax, 0xffffffff
pop edi
ret 0xc
mov cl, byte [edi + 4]
push ebx
test cl, cl
push esi
je 0x10035db0
mov ebx, dword [esp + 0x14]
test ebx, ebx
mov ecx, ebx
jg 0x10035da3
mov ecx, 1
push 0
push ecx
push edx
push eax
call dword [sym.imp.WS2_32.dll_recv]
jmp 0x10035ddc
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x10], 0x10
test ebx, ebx
mov ecx, ebx
jg 0x10035dc7
mov ecx, 1
lea esi, [esp + 0x10]
push esi
mov esi, dword [esp + 0x1c]
push esi
push 0
push ecx
push edx
push eax
call dword [sym.imp.WS2_32.dll_recvfrom]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10035e22
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.1002f6e0
mov edx, dword [edi + 0x88]
add esp, 4
add edi, 5
lea ecx, [esp + 0x14]
push eax
push edx
push edi
push str._comm__Socket__s:_d_::recv_error:__s.
push 0x10053918
call fcn.10030b00
push eax
call fcn.10030b10
add esp, 0x14
mov eax, esi
pop esi
pop ebx
pop edi
ret 0xc
test esi, esi
jne 0x10035e51
test ebx, ebx
jle 0x10035e51
mov eax, dword [edi + 0x88]
add edi, 5
push eax
push edi
push str._comm__Socket__s:_d_::recv_info:_The_connection_has_been_gracefully_closed.
push 0x10053948
lea ecx, [esp + 0x24]
call fcn.10030b00
push eax
call fcn.10030b10
add esp, 0x10
mov eax, esi
pop esi
pop ebx
pop edi
ret 0xc