joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10032290
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [edi], 0
cmp dword [0x1013df98], 0
je 0x100322e7
mov eax, dword [0x10140040]
test eax, eax
je 0x100322c0
push eax
call dword [0x1013dff4]
add esp, 4
lea edx, [ebp - 4]
mov ecx, 0x14
call fcn.1002f5d0
mov eax, dword [0x10140040]
test eax, eax
je 0x100322e2
push eax
call dword [0x1013dffc]
mov esi, dword [ebp - 4]
jmp 0x100322f1
mov esi, dword [ebp - 4]
jmp 0x100322f4
push 0x14
call dword [0x1013dfc4]
mov esi, eax
add esp, 4
test esi, esi
jne 0x10032302
lea eax, [esi + 7]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x1013df9c], 0
mov ebx, dword [ebp + 8]
je 0x1003234c
mov eax, dword [0x1013e09c]
test eax, eax
je 0x10032325
push 0xc8
call eax
add esp, 4
test eax, eax
jne 0x1003234c
mov eax, dword [ebp - 8]
mov dword [esi + 8], eax
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x10032260
push 0
push 0
mov dword [esi + 0xc], ebx
call fcn.100f68d6
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x10032359
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
cmp dword [esi + 8], 0
jne 0x10032372
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push ebx
mov dword [esi + 4], eax
call dword [ebp - 8]
add esp, 4
mov dword [esi + 0x10], eax
mov dword [edi], esi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1003c860
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, ecx
mov dword [esp + 4], edx
push esi
push edi
mov esi, dword [ebx + 0x88]
test esi, esi
je 0x1003c89b
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
mov dword [eax], esi
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x88], eax
mov eax, dword [esi + 8]
mov dword [esi + 0x10], 0
movq qword [eax], xmm0
jmp 0x1003c915
movzx eax, word [ebx + 0x8c]
cdq
mov edi, eax
add edi, 0x28
adc edx, 0
push edx
push edi
call fcn.1002f6c0
mov esi, eax
add esp, 8
test esi, esi
je 0x1003c8c7
push edi
push 0
push esi
call fcn.100e5e30
add esp, 0xc
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
test esi, esi
jne 0x1003c905
push dword [ebp + 8]
mov ecx, dword [esp + 0x10]
mov eax, dword [ebx + 0x98]
dec ecx
mov esi, dword [ebx + 0x3c]
push 0
cdq
push ecx
mov edi, dword [esi]
push edx
push eax
call fcn.100af620
push edx
push eax
mov eax, dword [edi + 0x48]
push esi
call eax
add esp, 0x10
mov eax, 7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esi + 0x28]
mov dword [esi + 0x1c], 0x10020
mov dword [esi + 8], eax
mov dword [esi + 0x14], ebx
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esi + 4], eax
pop edi
mov dword [esi + 0x18], ecx
inc dword [ebx + 0x78]
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003e900
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
test byte [esi + 0x1c], 4
mov ecx, dword [esi + 0x14]
je 0x1003e931
mov eax, dword [ecx + 0x18]
cmp eax, dword [esi + 0x18]
jb 0x1003e931
cmp dword [ecx + 0x60], 0
je 0x1003e92d
mov ecx, esi
call fcn.1003a2b0
test eax, eax
je 0x1003e92d
mov ecx, esi
pop esi
jmp fcn.1003cf10
xor eax, eax
pop esi
ret
mov eax, dword [ecx + 0x28]
test eax, eax
jne 0x1003e92f
mov eax, dword [ecx + 0x94]
cmp eax, dword [ecx + 0x98]
mov ecx, esi
jbe 0x1003e94e
pop esi
jmp fcn.1003e620
pop esi
jmp fcn.1003e540

Function at 0x100426d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
mov al, byte [esi + 0x44]
test al, al
js 0x100427ca
xor ebx, ebx
test al, al
jle 0x10042767
lea ecx, [esi + 0x78]
mov dword [esp + 0x10], ecx
nop word [eax + eax]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x48]
test byte [ecx + 0x1c], 0x20
je 0x1004274e
mov eax, dword [ecx + 0x14]
dec dword [eax + 0x78]
mov edx, dword [eax + 0x88]
mov dword [ecx + 0x10], edx
mov esi, dword [eax + 0x3c]
mov dword [eax + 0x88], ecx
push dword [ecx + 4]
mov eax, dword [eax + 0x98]
mov ecx, dword [ecx + 0x18]
mov edi, dword [esi]
dec ecx
cdq
push edx
push eax
push 0
push ecx
call fcn.100af620
push edx
push eax
mov eax, dword [edi + 0x48]
push esi
call eax
mov esi, dword [esp + 0x24]
add esp, 0x10
jmp 0x10042753
call fcn.10038a10
mov ecx, dword [esp + 0x10]
inc ebx
movsx eax, byte [esi + 0x44]
add ecx, 4
mov dword [esp + 0x10], ecx
cmp ebx, eax
jl 0x10042700
mov eax, dword [esi + 0x74]
mov edx, dword [eax + 0x48]
test byte [edx + 0x1c], 0x20
je 0x100427bf
mov eax, dword [edx + 0x14]
dec dword [eax + 0x78]
mov ecx, dword [eax + 0x88]
mov dword [edx + 0x10], ecx
mov esi, dword [eax + 0x3c]
mov dword [eax + 0x88], edx
push dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov eax, dword [eax + 0x98]
dec ecx
mov edi, dword [esi]
cdq
push edx
push eax
push 0
push ecx
call fcn.100af620
push edx
push eax
mov eax, dword [edi + 0x48]
push esi
call eax
mov esi, dword [esp + 0x24]
add esp, 0x10
mov byte [esi + 0x44], 0xff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edx
call fcn.10038a10
mov byte [esi + 0x44], 0xff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10046c70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], 0
push edi
mov al, byte [esi + 0x44]
test al, al
js 0x10046d06
je 0x10046d80
mov ecx, dword [esi + 0x74]
call fcn.100440a0
sub byte [esi + 0x44], 1
je 0x10046cfb
nop
movsx eax, byte [esi + 0x44]
mov eax, dword [esi + eax*4 + 0x78]
mov ecx, dword [eax + 0x48]
test byte [ecx + 0x1c], 0x20
je 0x10046cf0
mov edx, dword [ecx + 0x14]
dec dword [edx + 0x78]
mov eax, dword [edx + 0x88]
mov dword [ecx + 0x10], eax
mov edi, dword [edx + 0x3c]
mov eax, dword [edx + 0x98]
mov dword [edx + 0x88], ecx
push dword [ecx + 4]
mov ecx, dword [ecx + 0x18]
mov ebx, dword [edi]
dec ecx
cdq
push edx
push eax
push 0
push ecx
call fcn.100af620
push edx
push eax
mov eax, dword [ebx + 0x48]
push edi
call eax
add esp, 0x10
jmp 0x10046cf5
call fcn.10038a10
sub byte [esi + 0x44], 1
jne 0x10046ca0
mov eax, dword [esi + 0x78]
mov dword [esi + 0x74], eax
jmp 0x10046d98
cmp dword [esi + 0x40], 0
jne 0x10046d1b
mov byte [esi], 1
mov eax, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [esi]
cmp al, 3
jb 0x10046d44
cmp al, 4
jne 0x10046d2f
mov eax, dword [esi + 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [esi + 0x10]
call fcn.1002f800
add esp, 4
mov dword [esi + 0x10], 0
mov byte [esi], 1
movzx eax, byte [esi + 2]
lea edi, [esi + 0x74]
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0x40]
push eax
push 0
mov ecx, dword [ecx + 4]
push edi
call fcn.10043f70
mov ecx, eax
add esp, 0xc
mov dword [esp + 0xc], ecx
test ecx, ecx
je 0x10046d74
mov byte [esi], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi]
mov byte [esi + 0x44], 0
mov al, byte [eax + 2]
mov byte [esi + 0x45], al
mov eax, dword [esi + 0x74]
cmp byte [eax], 0
je 0x10046dfd
movzx eax, byte [eax + 2]
xor ecx, ecx
cmp dword [esi + 0x70], ecx
sete cl
cmp ecx, eax
jne 0x10046dfd
and byte [esi + 1], 0xf1
xor eax, eax
mov word [esi + 0x46], ax
mov word [esi + 0x32], ax
mov eax, dword [esi + 0x74]
cmp word [eax + 0x16], 0
jbe 0x10046dbe
mov byte [esi], 0
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [eax + 8], 0
jne 0x10046d0c
cmp dword [eax + 4], 1
je 0x10046ddf
mov ecx, 0x1063a
call fcn.100acc00
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx ecx, byte [eax + 9]
mov eax, dword [eax + 0x38]
mov edx, dword [ecx + eax + 8]
mov ecx, esi
bswap edx
mov byte [esi], 0
call fcn.10046b50
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1013747c
push 0x1062d
push str.database_corruption
push str._s_at_line__d_of___.10s_
push 0xb
call fcn.10032090
add esp, 0x14
mov eax, 0xb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10048090
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov edi, edx
push esi
mov eax, dword [ebx + 0x50]
push edi
push ebx
call eax
movzx eax, word [esi + 0x10]
add esp, 0xc
mov edx, dword [esi + 0xc]
mov dword [esp + 0x14], eax
cmp eax, edx
je 0x1004825f
movzx eax, word [esi + 0x12]
add edi, eax
cmp edi, dword [ebx + 0x3c]
jbe 0x100480f6
push 0x1013747c
push 0x10aac
push str.database_corruption
push str._s_at_line__d_of___.10s_
push 0xb
call fcn.10032090
add esp, 0x14
mov eax, 0xb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebx + 0x34]
sub edx, dword [esp + 0x14]
mov edi, dword [edi - 4]
bswap edi
mov ecx, dword [esi + 0x24]
sub ecx, 4
mov dword [esp + 0xc], esi
lea eax, [edx - 1]
xor edx, edx
add eax, ecx
div ecx
mov ebx, eax
test ebx, ebx
je 0x1004825f
nop
dec ebx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
cmp edi, 2
jb 0x10048235
cmp edi, dword [esi + 0x2c]
ja 0x10048235
test ebx, ebx
je 0x10048171
lea eax, [esp + 0x14]
mov edx, edi
push eax
lea eax, [esp + 0x14]
mov ecx, esi
push eax
call fcn.100465a0
add esp, 8
test eax, eax
jne 0x10048261
mov esi, dword [esp + 0x10]
test esi, esi
jne 0x10048180
mov esi, dword [esp + 0xc]
mov edx, edi
mov ecx, esi
call fcn.10043ef0
mov esi, eax
test esi, esi
je 0x100481b2
mov ecx, dword [esi + 0x48]
cmp word [ecx + 0x1e], 1
je 0x100481b2
push 0x1013747c
push 0x10ad1
push str.database_corruption
push str._s_at_line__d_of___.10s_
push 0xb
call fcn.10032090
add esp, 0x14
mov dword [esp + 0x10], 0xb
jmp 0x100481c5
mov ecx, dword [esp + 0xc]
mov edx, esi
push edi
call fcn.10047db0
add esp, 4
mov dword [esp + 0x10], eax
test esi, esi
je 0x1004821c
mov edx, dword [esi + 0x48]
test edx, edx
je 0x1004821c
test byte [edx + 0x1c], 0x20
je 0x10048215
mov eax, dword [edx + 0x14]
dec dword [eax + 0x78]
mov ecx, dword [eax + 0x88]
mov dword [edx + 0x10], ecx
mov esi, dword [eax + 0x3c]
mov dword [eax + 0x88], edx
push dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov eax, dword [eax + 0x98]
dec ecx
mov edi, dword [esi]
cdq
push edx
push eax
push 0
push ecx
call fcn.100af620
push edx
push eax
mov eax, dword [edi + 0x48]
push esi
call eax
add esp, 0x10
jmp 0x1004821c
mov ecx, edx
call fcn.10038a10
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x10048261
mov edi, dword [esp + 0x14]
test ebx, ebx
je 0x1004825f
mov esi, dword [esp + 0xc]
jmp 0x10048120
push 0x1013747c
push 0x10abd
push str.database_corruption
push str._s_at_line__d_of___.10s_
push 0xb
call fcn.10032090
add esp, 0x14
mov eax, 0xb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1004bbb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov ebx, edx
xorps xmm0, xmm0
push edi
mov dword [esp + 0x1c], ebx
mov esi, ecx
movlpd qword [esp + 0x10], xmm0
call fcn.10046c70
cmp eax, 0x10
jne 0x1004bbed
mov dword [ebx], 0
xor eax, eax
mov dword [ebx + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test eax, eax
jne 0x1004bd2b
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], eax
mov edi, dword [esi + 0x74]
mov cl, byte [edi + 8]
test cl, cl
jne 0x1004bc14
cmp byte [edi + 2], cl
jne 0x1004bc23
movzx eax, word [edi + 0x16]
cdq
add dword [esp + 0x10], eax
adc ebx, edx
mov dword [esp + 0x18], ebx
test cl, cl
je 0x1004bcc8
nop dword [eax + eax]
mov cl, byte [esi + 0x44]
test cl, cl
je 0x1004bd13
and byte [esi + 1], 0xf9
xor eax, eax
mov word [esi + 0x32], ax
movsx eax, cl
dec cl
mov ax, word [esi + eax*2 + 0x46]
mov word [esi + 0x46], ax
movsx eax, cl
mov byte [esi + 0x44], cl
mov eax, dword [esi + eax*4 + 0x78]
mov dword [esi + 0x74], eax
mov edx, dword [edi + 0x48]
test byte [edx + 0x1c], 0x20
je 0x1004bca8
mov eax, dword [edx + 0x14]
dec dword [eax + 0x78]
mov ecx, dword [eax + 0x88]
mov dword [edx + 0x10], ecx
mov edi, dword [eax + 0x3c]
mov dword [eax + 0x88], edx
push dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov eax, dword [eax + 0x98]
dec ecx
mov ebx, dword [edi]
cdq
push edx
push eax
push 0
push ecx
call fcn.100af620
push edx
push eax
mov eax, dword [ebx + 0x48]
push edi
call eax
add esp, 0x10
jmp 0x1004bcaf
mov ecx, edx
call fcn.10038a10
mov edi, dword [esi + 0x74]
mov ax, word [esi + 0x46]
cmp ax, word [edi + 0x16]
jae 0x1004bc30
inc word [esi + 0x46]
mov ebx, dword [esp + 0x18]
movzx ecx, word [esi + 0x46]
movzx eax, word [edi + 0x16]
cmp ecx, eax
jne 0x1004bce1
movzx ecx, byte [edi + 9]
mov eax, dword [edi + 0x38]
mov edx, dword [ecx + eax + 8]
jmp 0x1004bcfb
mov eax, dword [edi + 0x40]
mov ax, word [eax + ecx*2]
mov ch, al
mov cl, ah
movzx eax, word [edi + 0x18]
movzx edx, cx
and edx, eax
mov eax, dword [edi + 0x38]
mov edx, dword [edx + eax]
bswap edx
mov ecx, esi
call fcn.10046b50
test eax, eax
je 0x1004bc05
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
mov dword [ecx], eax
mov eax, dword [esp + 0x18]
mov dword [ecx + 4], eax
mov ecx, esi
call fcn.10046c70
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100703c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, edx
push edi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ecx
xor edi, edi
cmp dword [ecx + 0x14], edi
jle 0x1007045a
nop dword [eax + eax]
mov eax, edi
mov ecx, edi
xor eax, 1
cmp edi, 2
cmovl ecx, eax
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x100704a6
mov bl, byte [esi]
mov edx, ecx
mov ecx, dword [ebp - 4]
add edx, edx
mov eax, esi
mov ecx, dword [ecx + 0x10]
mov edx, dword [ecx + edx*8]
movzx ecx, bl
movzx esi, byte [ecx + 0x1012d740]
movzx ecx, byte [edx]
movzx ecx, byte [ecx + 0x1012d740]
sub esi, ecx
jne 0x1007044b
sub edx, dword [ebp + 8]
mov dword [ebp - 0xc], edx
test bl, bl
je 0x1007049c
movzx ecx, byte [edx + eax + 1]
inc eax
movzx edx, byte [ecx + 0x1012d740]
mov bl, byte [eax]
movzx ecx, bl
movzx esi, byte [ecx + 0x1012d740]
sub esi, edx
mov edx, dword [ebp - 0xc]
je 0x10070427
mov ebx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
inc edi
mov esi, dword [ebp + 8]
cmp edi, dword [ecx + 0x14]
jl 0x100703e0
mov dl, byte [ebx]
movzx eax, dl
movzx eax, byte [eax + 0x1012d740]
sub eax, 0x73
jne 0x10070493
mov esi, str.sqlite_master
sub esi, ebx
test dl, dl
je 0x100704ca
movzx eax, byte [esi + ebx + 1]
inc ebx
movzx ecx, byte [eax + 0x1012d740]
mov dl, byte [ebx]
movzx eax, dl
movzx eax, byte [eax + 0x1012d740]
sub eax, ecx
je 0x10070472
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
jne 0x1007044b
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ebp - 8]
mov eax, dword [ebp - 4]
add ecx, ecx
push 0
mov edx, ebx
mov eax, dword [eax + 0x10]
mov ecx, dword [eax + ecx*8 + 0xc]
add ecx, 8
call fcn.10034500
add esp, 4
mov eax, dword [eax + 8]
test eax, eax
jne 0x10070495
jmp 0x1007044e
mov ecx, dword [ebp - 4]
mov esi, dword [ebp + 8]
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + 0x10]
test esi, esi
jne 0x100704e0
neg eax
sbb eax, eax
jmp 0x100704f0
test eax, eax
je 0x10070493
mov edx, eax
mov ecx, esi
call fcn.10032ee0
mov ecx, dword [ebp - 4]
test eax, eax
jne 0x10070493
mov ebx, str.sqlite_temp_master
mov dword [ebp - 8], ebx
jmp 0x100703d4
Function at 0x100706c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], edx
xor edx, edx
mov dword [ebp - 8], ebx
push edi
xor edi, edi
mov dword [ebp - 4], edx
cmp dword [ebx + 0x14], edx
jle 0x1007077e
push esi
mov eax, edi
mov ecx, edi
xor eax, 1
cmp edi, 2
cmovl ecx, eax
mov eax, dword [ebx + 0x10]
add ecx, ecx
mov edx, dword [eax + ecx*8 + 0xc]
mov dword [ebp - 0xc], edx
mov edx, dword [ebp + 8]
test edx, edx
je 0x1007075f
mov ebx, dword [eax + ecx*8]
mov esi, edx
mov al, byte [edx]
movzx ecx, byte [ebx]
movzx edx, byte [ecx + 0x1012d740]
movzx ecx, al
movzx ecx, byte [ecx + 0x1012d740]
sub ecx, edx
jne 0x10070743
sub ebx, esi
test al, al
je 0x10070758
movzx ecx, byte [ebx + esi + 1]
inc esi
movzx edx, byte [ecx + 0x1012d740]
mov al, byte [esi]
movzx ecx, al
movzx ecx, byte [ecx + 0x1012d740]
sub ecx, edx
je 0x10070722
mov edx, dword [ebp - 4]
mov ebx, dword [ebp - 8]
inc edi
cmp edi, dword [ebx + 0x14]
jl 0x100706e1
pop esi
pop edi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
test ecx, ecx
jne 0x10070743
mov ebx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
add ecx, 0x18
push 0
call fcn.10034500
add esp, 4
mov edx, dword [eax + 8]
mov dword [ebp - 4], edx
test edx, edx
jne 0x1007074f
jmp 0x10070749
pop edi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100b0040
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x1013d070]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x100b0093
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x100b008d
shr eax, 8
cmp al, 2
jne 0x100b008d
call fcn.100b3d70
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ae9aa
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [ebp - 4]
mov eax, 2
xor ecx, ebp
call fcn.100ae9aa
mov esp, ebp
pop ebp
ret

Function at 0x100b4700
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x100b471e
cmp dword [esi + 0x48], 0
je 0x100b471e
push 2
push 3
push esi
call fcn.100c8040
add esp, 0xc
push dword [ebp + 0xc]
call fcn.100be4d0
add esp, 4
test esi, esi
je 0x100b473e
cmp dword [esi + 0x48], 0
je 0x100b473e
push 3
push esi
call fcn.100c8080
add esp, 8
pop esi
pop ebp
ret
Function at 0x100bc920
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push ebx
push edi
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ecx + eax*4 + 0x154]
call dword [sym.imp.WS2_32.dll_send]
mov ebx, dword [ebp + 0x18]
mov edi, eax
mov dword [ebx], 0
cmp edi, 0xffffffff
jne 0x100bc99e
push esi
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
jne 0x100bc96e
pop esi
pop edi
mov dword [ebx], 0x51
xor eax, eax
pop ebx
pop ebp
ret
push esi
push dword [ebp + 8]
call fcn.100c8dd0
push eax
mov eax, dword [ebp + 8]
push str.Send_failure:__s
push dword [eax]
call fcn.100bc610
mov eax, dword [ebp + 8]
add esp, 0x14
mov eax, dword [eax]
mov dword [eax + 0x8594], esi
mov eax, edi
mov dword [ebx], 0x37
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x100bcb80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x190]
test eax, eax
je 0x100bcba9
push dword [esi + 0x11c]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call eax
add esp, 0x14
pop esi
pop ebp
ret
mov eax, dword [ebp + 0xc]
cmp eax, 2
ja 0x100bcbdf
push dword [esi + 0x118]
lea eax, [eax + eax*2]
push 1
add eax, 0x10119a78
push 2
push eax
call fcn.100ebe72
push dword [esi + 0x118]
push 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.100ebe72
add esp, 0x20
xor eax, eax
pop esi
pop ebp
ret

Function at 0x100bcd50
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x558]
test esi, esi
je 0x100bcda4
mov eax, dword [edi + 0x44]
test eax, eax
jne 0x100bcd71
cmp dword [edi + 0x40], eax
je 0x100bcda4
mov dword [ebp - 8], esi
mov byte [ebp - 4], 0
test eax, eax
jne 0x100bcd7f
mov eax, dword [edi + 0x40]
push 0x100bdbf0
lea ecx, [ebp - 8]
add eax, 0x68
push ecx
push eax
call fcn.100c2f00
add esp, 0xc
cmp byte [ebp - 4], 0
jne 0x100bcdad
mov dword [edi + 0x558], 0
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x100bcdb6
mov dword [eax], esi
cmp byte [esi + 0x178], 0
mov edi, dword [esi + 0x154]
je 0x100bcddb
push esi
call fcn.10019dc0
add esp, 4
test eax, eax
jne 0x100bcdf3
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
cmp edi, 0xffffffff
je 0x100bcdf3
push 2
push 1
lea eax, [ebp + 0xb]
push eax
push edi
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x100bcda4
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100bd220
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x1013d070]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1013f824]
mov dword [ebp - 0xa8], 0x4020
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0xac], 4
push esi
test eax, eax
jne 0x100bd2ea
push 0x9c
push eax
lea eax, [ebp - 0xa0]
push eax
call fcn.100e5e30
mov esi, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
add esp, 0xc
mov dword [ebp - 0xa0], 0x9c
mov dword [ebp - 0x9c], 6
push 3
push 2
push 0
push 0
call esi
push 3
push 1
push edx
push eax
call esi
push 3
push 0x20
push edx
push eax
call esi
push 3
push 0x10
push edx
push eax
call esi
push edx
push eax
push 0x33
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
test eax, eax
je 0x100bd2de
mov dword [0x1013f824], 2
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ae9aa
mov esp, ebp
pop ebp
ret
mov dword [0x1013f824], 1
jmp 0x100bd2ef
cmp eax, 2
je 0x100bd33d
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xac]
push eax
lea eax, [ebp - 0xa4]
push eax
push 0x1001
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x100bd323
mov eax, dword [ebp - 0xa4]
cmp eax, dword [ebp - 0xa8]
jg 0x100bd33d
push 4
lea eax, [ebp - 0xa8]
push eax
push 0x1001
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100ae9aa
mov esp, ebp
pop ebp
ret

Function at 0x100bd410
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp + 8]
push 4
push eax
push 1
mov esi, dword [edi]
push 6
push dword [ebp + 0xc]
mov dword [ebp + 8], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x100bd458
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
call fcn.100c8dd0
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.100bc6b0
add esp, 0x14
pop edi
pop esi
pop ebp
ret
push str.TCP_NODELAY_set_n
push esi
call fcn.100bc6b0
add esp, 8
pop edi
pop esi
pop ebp
ret