joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001000
Capabilities:
Create udp socket
Initialize winsock library
Send data
Send data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5b4
mov eax, dword [0x100a7914]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x5b0], 0xa1
mov byte [ebp - 0x199], 1
mov eax, 0x202
mov word [ebp - 0x1a8], ax
lea ecx, [ebp - 0x198]
push ecx
movzx edx, word [ebp - 0x1a8]
push edx
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [ebp - 0x5b4], eax
cmp dword [0x100a8fe0], 2
jne 0x10001067
push 0x11
push 2
push 0x17
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x100a9808], eax
jmp 0x10001078
push 0x11
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x100a9808], eax
cmp dword [0x100a9808], 0xffffffff
jne 0x10001087
call dword [sym.imp.WS2_32.dll_WSACleanup]
lea eax, [ebp - 0x5a8]
push eax
call fcn.10001370
add esp, 4
mov dword [ebp - 0x1a0], eax
push 1
lea ecx, [ebp - 0x199]
push ecx
push 0x20
push 0xffff
mov edx, dword [0x100a9808]
push edx
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp dword [0x100a8fe0], 2
jne 0x10001108
mov dword [ebp - 0x5ac], 0x1c
mov eax, 0x17
mov word [0x100a8ff4], ax
lea ecx, [ebp - 0x5ac]
push ecx
push 0x100a8ff4
push 0
push 0x17
push str.ff02::1
call dword [sym.imp.WS2_32.dll_WSAStringToAddressA]
movzx edx, word [ebp - 0x5b0]
push edx
call dword [sym.imp.WS2_32.dll_htons]
mov word [0x100a8ff6], ax
jmp 0x10001131
mov eax, 2
mov word [0x100a8fe4], ax
mov dword [0x100a8fe8], 0xffffffff
movzx ecx, word [ebp - 0x5b0]
push ecx
call dword [sym.imp.WS2_32.dll_htons]
mov word [0x100a8fe6], ax
push 1
push 0x49b
mov edx, dword [ebp + 8]
push edx
mov eax, dword [0x100a9808]
push eax
call dword [sym.imp.WS2_32.dll_WSAAsyncSelect]
cmp eax, 0xffffffff
jne 0x10001167
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x10001167
mov ecx, dword [0x100a9808]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
cmp dword [0x100a8fe0], 2
jne 0x100011a2
push 0x1c
push 0x100a8ff4
push 0
mov edx, dword [ebp - 0x1a0]
lea eax, [ebp - 0x5a8]
sub edx, eax
push edx
lea ecx, [ebp - 0x5a8]
push ecx
mov edx, dword [0x100a9808]
push edx
call dword [sym.imp.WS2_32.dll_sendto]
mov dword [ebp - 0x1a4], eax
cmp dword [0x100a8fe0], 0
jne 0x100011dc
push 0x10
push 0x100a8fe4
push 0
mov eax, dword [ebp - 0x1a0]
lea ecx, [ebp - 0x5a8]
sub eax, ecx
push eax
lea edx, [ebp - 0x5a8]
push edx
mov eax, dword [0x100a9808]
push eax
call dword [sym.imp.WS2_32.dll_sendto]
mov dword [ebp - 0x1a4], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10029d6b
mov esp, ebp
pop ebp
ret
Function at 0x100011f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x100a7914]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x20c], 0xffffffff
mov dword [ebp - 0x214], 0x10
mov al, byte [0x100513be]
mov byte [ebp - 0x208], al
push 0x1ff
push 0
lea ecx, [ebp - 0x207]
push ecx
call fcn.10029e70
add esp, 0xc
mov dword [ebp - 0x210], 0x1c
mov dword [ebp - 0x218], 0x100
cmp dword [0x100a8fe0], 0
jne 0x10001282
lea edx, [ebp - 0x214]
push edx
push 0x100a8fe4
push 0
push 0x200
lea eax, [ebp - 0x208]
push eax
mov ecx, dword [0x100a9808]
push ecx
call dword [sym.imp.WS2_32.dll_recvfrom]
mov dword [ebp - 0x20c], eax
cmp dword [0x100a8fe0], 2
jne 0x100012b8
lea edx, [ebp - 0x210]
push edx
push 0x100a8ff4
push 0
push 0x200
lea eax, [ebp - 0x208]
push eax
mov ecx, dword [0x100a9808]
push ecx
call dword [sym.imp.WS2_32.dll_recvfrom]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0xffffffff
jne 0x100012d4
mov edx, dword [0x100a9808]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x208]
push ecx
call fcn.10001900
add esp, 8
cmp eax, 1
jne 0x10001361
cmp dword [0x100a8fe0], 0
jne 0x1000130a
mov edx, dword [0x100a8fe8]
push edx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov dword [0x100a980c], eax
cmp dword [0x100a8fe0], 2
jne 0x10001361
lea eax, [ebp - 0x218]
push eax
push 0x100a9d10
push 0
mov ecx, dword [ebp - 0x210]
push ecx
push 0x100a8ff4
call dword [sym.imp.WS2_32.dll_WSAAddressToStringA]
push 0x100a9d11
push 0x100
push 0x100a9d10
call fcn.10029e06
add esp, 0xc
push 0x100a9d10
push 0x100513b8
push 0x100a9d10
call fcn.10029de4
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10029d6b
mov esp, ebp
pop ebp
ret
Function at 0x10001f70
Capabilities:
Create udp socket
Initialize winsock library
Send data
Send data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5b4
mov eax, dword [0x100a7914]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x5b0], 0xa1
mov byte [ebp - 0x199], 1
mov eax, 0x202
mov word [ebp - 0x1a8], ax
lea ecx, [ebp - 0x198]
push ecx
movzx edx, word [ebp - 0x1a8]
push edx
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [ebp - 0x5b4], eax
cmp dword [ebp + 8], 2
jne 0x10001fd4
push 0x11
push 2
push 0x17
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x100a9808], eax
jmp 0x10001fe5
push 0x11
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x100a9808], eax
cmp dword [0x100a9808], 0xffffffff
jne 0x10001ff4
call dword [sym.imp.WS2_32.dll_WSACleanup]
lea eax, [ebp - 0x5a8]
push eax
call fcn.10001370
add esp, 4
mov dword [ebp - 0x1a0], eax
push 1
lea ecx, [ebp - 0x199]
push ecx
push 0x20
push 0xffff
mov edx, dword [0x100a9808]
push edx
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp dword [ebp + 8], 2
jne 0x10002072
mov dword [ebp - 0x5ac], 0x1c
mov eax, 0x17
mov word [0x100a8ff4], ax
lea ecx, [ebp - 0x5ac]
push ecx
push 0x100a8ff4
push 0
push 0x17
push str.ff02::1
call dword [sym.imp.WS2_32.dll_WSAStringToAddressA]
movzx edx, word [ebp - 0x5b0]
push edx
call dword [sym.imp.WS2_32.dll_htons]
mov word [0x100a8ff6], ax
jmp 0x1000209b
mov eax, 2
mov word [0x100a8fe4], ax
mov dword [0x100a8fe8], 0xffffffff
movzx ecx, word [ebp - 0x5b0]
push ecx
call dword [sym.imp.WS2_32.dll_htons]
mov word [0x100a8fe6], ax
cmp dword [ebp + 8], 2
jne 0x100020d3
push 0x1c
push 0x100a8ff4
push 0
mov edx, dword [ebp - 0x1a0]
lea eax, [ebp - 0x5a8]
sub edx, eax
push edx
lea ecx, [ebp - 0x5a8]
push ecx
mov edx, dword [0x100a9808]
push edx
call dword [sym.imp.WS2_32.dll_sendto]
mov dword [ebp - 0x1a4], eax
cmp dword [ebp + 8], 0
jne 0x1000210a
push 0x10
push 0x100a8fe4
push 0
mov eax, dword [ebp - 0x1a0]
lea ecx, [ebp - 0x5a8]
sub eax, ecx
push eax
lea edx, [ebp - 0x5a8]
push edx
mov eax, dword [0x100a9808]
push eax
call dword [sym.imp.WS2_32.dll_sendto]
mov dword [ebp - 0x1a4], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10029d6b
mov esp, ebp
pop ebp
ret
Function at 0x1000a8c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.10015900
mov dword [ebp - 4], eax
push 1
push 0x10006200
push 0
push 0x9e5
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 5
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esp, ebp
pop ebp
ret

Function at 0x1000aa30
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.10015900
mov dword [ebp - 4], eax
push 0
push 0x1000c640
mov eax, dword [ebp + 8]
push eax
push 0x64
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.USER32.dll_CreateDialogParamA]
push 5
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esp, ebp
pop ebp
ret

Function at 0x1000aac0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.10015900
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x1000aad7
jmp 0x1000aafd
push 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov edx, dword [ebp - 4]
mov dword [edx + 4], 0
mov esp, ebp
pop ebp
ret

Function at 0x1000ab10
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.10015900
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x1000ab27
jmp 0x1000ab54
push 5
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov esp, ebp
pop ebp
ret

Function at 0x1000ab60
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.10015900
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x1000ab77
jmp 0x1000ab86
push 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov esp, ebp
pop ebp
ret
Function at 0x1000c520
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x100a7914]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x1000c540
xor eax, eax
jmp 0x1000c622
call fcn.10015900
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
je 0x1000c601
cmp dword [ebp - 0x118], 1
je 0x1000c56f
jmp 0x1000c61d
mov dword [ebp - 0x114], 8
mov dword [ebp - 0x110], 0xa2f
lea ecx, [ebp - 0x114]
push ecx
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
call fcn.1000a860
mov edx, dword [ebp + 8]
push edx
call fcn.1000a3e0
add esp, 4
push 0
push 0x23
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push str.eSSu.ini
lea ecx, [ebp - 0x108]
push ecx
push 0x10051900
mov edx, dword [ebp - 0x10c]
add edx, 0x12b4
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0
mov eax, dword [ebp - 0x10c]
add eax, 0x12b4
push eax
call fcn.10008640
add esp, 8
call fcn.100065e0
call fcn.10006cc0
jmp 0x1000c61d
mov ecx, dword [ebp - 0x10c]
mov edx, dword [ebp + 8]
cmp edx, dword [ecx]
je 0x1000c61d
mov eax, dword [ebp - 0x10c]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10029d6b
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100134f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push 2
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret
Function at 0x10015650
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
call fcn.10015900
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
imul eax, eax, 0xc
mov ecx, dword [ebp - 8]
cmp dword [ecx + eax + 8], 0
jbe 0x100156ad
push 0
mov edx, dword [ebp - 0xc]
imul edx, edx, 0xc
mov eax, dword [ebp - 8]
mov ecx, dword [eax + edx + 8]
push ecx
call dword [sym.imp.USER32.dll_EnableWindow]
push 0
mov edx, dword [ebp - 0xc]
imul edx, edx, 0xc
mov eax, dword [ebp - 8]
mov ecx, dword [eax + edx + 8]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
jmp 0x10015666
push 0x3ff
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 0x10], eax
push 0
push 0
push 0x1309
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x48
push 0
mov eax, dword [ebp - 8]
add eax, 8
push eax
call fcn.10029e70
add esp, 0xc
call fcn.100154b0
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp - 0xc]
shl ecx, 4
mov edx, dword [ebp - 4]
cmp dword [edx + ecx], 0
jle 0x1001577c
mov eax, dword [ebp - 0xc]
shl eax, 4
mov ecx, dword [ebp - 0xc]
imul ecx, ecx, 0xc
mov edx, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov eax, dword [esi + eax]
mov dword [edx + ecx + 0xc], eax
mov ecx, dword [ebp - 0xc]
shl ecx, 4
add ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.100155a0
add esp, 8
mov ecx, dword [ebp - 0xc]
imul ecx, ecx, 0xc
mov edx, dword [ebp - 8]
mov dword [edx + ecx + 8], eax
push 0
mov eax, dword [ebp - 0xc]
imul eax, eax, 0xc
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax + 8]
push edx
call dword [sym.imp.USER32.dll_EnableWindow]
push 0
mov eax, dword [ebp - 0xc]
imul eax, eax, 0xc
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax + 8]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
jmp 0x100156f7
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x614]
cmp edx, dword [ebp - 0xc]
jl 0x100157ca
push 0
push 0
push 0x130c
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push 1
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.USER32.dll_EnableWindow]
push 5
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [ebp - 8]
mov dword [edx + 0x614], 0
jmp 0x1001581d
push 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x614]
push ecx
push 0x130c
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
push 1
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x614]
imul ecx, ecx, 0xc
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 8]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 5
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x614]
imul edx, edx, 0xc
mov eax, dword [ebp - 8]
mov ecx, dword [eax + edx + 8]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10015830
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call fcn.10015900
mov dword [ebp - 4], eax
push 0
mov eax, dword [ebp + 8]
push eax
push 0x130c
push 0x3ff
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
imul eax, eax, 0xc
mov ecx, dword [ebp - 4]
cmp dword [ecx + eax + 8], 0
jbe 0x100158b0
push 0
mov edx, dword [ebp - 8]
imul edx, edx, 0xc
mov eax, dword [ebp - 4]
mov ecx, dword [eax + edx + 8]
push ecx
call dword [sym.imp.USER32.dll_EnableWindow]
push 0
mov edx, dword [ebp - 8]
imul edx, edx, 0xc
mov eax, dword [ebp - 4]
mov ecx, dword [eax + edx + 8]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
jmp 0x10015869
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 8]
jge 0x100158e4
push 1
mov ecx, dword [ebp + 8]
imul ecx, ecx, 0xc
mov edx, dword [ebp - 4]
mov eax, dword [edx + ecx + 8]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 5
mov ecx, dword [ebp + 8]
imul ecx, ecx, 0xc
mov edx, dword [ebp - 4]
mov eax, dword [edx + ecx + 8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov dword [ecx + 0x614], edx
mov esp, ebp
pop ebp
ret
Function at 0x1001a110
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x14]
push ebx
movzx ebx, byte [eax + 2]
push ebp
movzx ebp, byte [eax]
push esi
push edi
movzx edi, byte [eax + 1]
cmp edi, ebx
mov dword [esp + 0x18], ebp
mov eax, edi
jl 0x1001a132
mov eax, ebx
cmp ebp, eax
jge 0x1001a13c
mov dword [esp + 0x24], ebp
jmp 0x1001a148
cmp edi, ebx
mov dword [esp + 0x24], edi
jl 0x1001a14e
mov dword [esp + 0x24], ebx
cmp edi, ebx
mov eax, edi
jg 0x1001a150
mov eax, ebx
cmp ebp, eax
jle 0x1001a15a
mov dword [esp + 0x10], ebp
jmp 0x1001a166
cmp edi, ebx
mov dword [esp + 0x10], edi
jg 0x1001a166
mov dword [esp + 0x10], ebx
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
mov ecx, esi
add esi, eax
mov dword [esp + 0x14], esi
imul esi, esi, 0x2710
sub ecx, eax
mov eax, 0x80808081
imul esi
add edx, esi
mov esi, dword [esp + 0x20]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esi + 8], eax
test ecx, ecx
je 0x1001a2c3
test eax, eax
je 0x1001a2c3
jle 0x1001a1c0
cmp eax, 0x1388
jg 0x1001a1c7
mov eax, ecx
imul eax, eax, 0x2710
cdq
idiv dword [esp + 0x14]
jmp 0x1001a1df
cmp eax, 0x1388
jle 0x1001a1e2
mov eax, ecx
imul eax, eax, 0x2710
mov ebp, 0x1fe
sub ebp, dword [esp + 0x14]
cdq
idiv ebp
mov ebp, dword [esp + 0x18]
mov dword [esi + 4], eax
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
cmp edx, ebp
jne 0x1001a20c
cmp eax, ebx
jne 0x1001a20c
sub edi, ebx
mov eax, edi
shl eax, 4
sub eax, edi
add eax, eax
add eax, eax
cdq
idiv ecx
pop edi
mov dword [esi], eax
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
cmp edx, edi
jne 0x1001a252
cmp eax, ebx
jne 0x1001a231
sub edi, ebp
mov eax, edi
shl eax, 4
sub eax, edi
add eax, eax
add eax, eax
cdq
idiv ecx
pop edi
add eax, 0x3c
mov dword [esi], eax
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
cmp eax, ebp
jne 0x1001a252
sub ebx, ebp
mov eax, ebx
shl eax, 4
sub eax, ebx
add eax, eax
add eax, eax
cdq
idiv ecx
pop edi
add eax, 0x78
mov dword [esi], eax
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
cmp edx, ebx
jne 0x1001a29c
cmp eax, ebp
jne 0x1001a279
sub ebx, edi
mov eax, ebx
shl eax, 4
sub eax, ebx
add eax, eax
add eax, eax
cdq
idiv ecx
pop edi
add eax, 0xb4
mov dword [esi], eax
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
cmp eax, edi
jne 0x1001a29c
sub ebp, edi
mov eax, ebp
shl eax, 4
sub eax, ebp
add eax, eax
add eax, eax
cdq
idiv ecx
pop edi
add eax, 0xf0
mov dword [esi], eax
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
cmp edx, ebp
jne 0x1001a2d0
cmp eax, edi
jne 0x1001a2d0
sub ebp, ebx
mov eax, ebp
shl eax, 4
sub eax, ebp
add eax, eax
add eax, eax
cdq
idiv ecx
pop edi
add eax, 0x12c
mov dword [esi], eax
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov dword [esi], 0
mov dword [esi + 4], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x1001a570
Capabilities:
Print debug messages

Disassembly:
mov eax, 0xa004
call fcn.1002abc0
mov eax, dword [0x100a7914]
xor eax, esp
mov dword [esp + 0xa000], eax
mov ecx, dword [esp + 0xa008]
lea eax, [esp + 0xa00c]
push eax
push ecx
lea edx, [esp + 8]
push edx
call dword [sym.imp.USER32.dll_wvsprintfA]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0xa000]
xor ecx, esp
call fcn.10029d6b
add esp, 0xa004
ret
Function at 0x10022a90
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x18]
push edi
xor edi, edi
mov ecx, dword [esp + 0x14]
push ebx
push esi
lea eax, [edi + ebp]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10022ace
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x10022aa2
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
test esi, esi
je 0x10022ac7
add edi, esi
mov esi, dword [esp + 0x1c]
cmp edi, esi
je 0x10022ae0
sub esi, edi
jmp 0x10022aa2
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret

Function at 0x10022af0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x18]
push edi
xor edi, edi
mov ecx, dword [esp + 0x14]
push ebx
push esi
lea eax, [edi + ebp]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_send]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10022b2e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x10022b02
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
test esi, esi
je 0x10022b27
add edi, esi
mov esi, dword [esp + 0x1c]
cmp edi, esi
je 0x10022b40
sub esi, edi
jmp 0x10022b02
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret

Function at 0x10022d30
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esp + 8]
cmp ecx, 0x40000000
jne 0x10022d43
mov eax, 2
jmp 0x10022d4a
cmp ecx, 4
jne 0x10022d95
mov eax, ecx
push esi
push 0
push 0x80
push eax
mov eax, dword [esp + 0x14]
push 0
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10022d6e
xor eax, eax
pop esi
ret
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push edi
push 0
lea ecx, [esp + 0x14]
push ecx
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
ret
xor eax, eax
ret
Function at 0x100232f0
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 8
push ebx
push esi
call fcn.10022ba0
push 0
push 0x80
push 3
push 0
push 0
mov esi, eax
mov eax, dword [esp + 0x28]
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x10023328
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
push ebp
push edi
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0xe00]
inc eax
lea eax, [eax + eax*2]
cdq
and edx, 3
add eax, edx
mov edi, eax
sar edi, 2
imul edi, dword [esi + 0xe04]
add edi, edi
add edi, edi
lea ebp, [edi + edi + 0x800]
push ebp
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
mov dword [esi + 0x248], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push ebp
lea edi, [eax + edi + 0x800]
push 0xff
push eax
mov dword [esi + 0xdf4], eax
mov dword [esi + 0xdfc], edi
mov dword [esi + 0x4ec], eax
mov dword [esi + 0x4f4], edi
call fcn.10029e70
mov ecx, dword [esi + 0xe04]
mov edx, dword [esi + 0xe00]
mov eax, dword [esi + 0xdf4]
push ecx
push edx
push eax
mov edi, 1
push esi
mov dword [esi + 0x494], edi
mov dword [esi + 0x4dc], 3
call fcn.10022e80
mov ecx, dword [esi + 0xdf4]
add esp, 0x1c
add eax, ecx
mov ecx, dword [esi + 0xdfc]
push 0
lea edx, [esp + 0x18]
push edx
mov dword [esi + 0xdf8], eax
mov dword [esi + 0x4f0], eax
mov eax, dword [esp + 0x18]
push eax
push ecx
push ebx
mov dword [esi + 0x494], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
mov dword [esi + 0x9c4], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop ebp
pop esi
pop ebx
add esp, 8
ret
Function at 0x10025520
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
push 0
push 0
push 0
push 0
mov dword [esi + 0x4d8], eax
mov dword [esi + 0x9ac], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 1
mov dword [esi + 0x9a8], eax
call fcn.10023b00
add esp, 4
test eax, eax
je 0x10025574
mov ecx, dword [esi + 0x9a8]
push ecx
mov dword [esi + 0x9ac], 4
call dword [sym.imp.KERNEL32.dll_SetEvent]
pop esi
ret
call fcn.10024b70
test eax, eax
je 0x1002559b
call fcn.100231a0
mov edx, dword [esi + 0x9a8]
push edx
mov dword [esi + 0x9ac], 4
call dword [sym.imp.KERNEL32.dll_SetEvent]
pop esi
ret
cmp dword [esi + 0x4dc], 3
jne 0x100255d1
push 0x100bd074
push 0x100bd06c
push 1
push 0
mov dword [0x100bd06c], 1
call fcn.10027b30
test eax, eax
je 0x100255d1
mov dword [esi + 0x9ac], 4
pop esi
ret
cmp dword [esi + 0x494], 0
jne 0x100255df
call fcn.1000ab60
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x1000a910
push 0
push 0
mov dword [esi + 0x99c], 0
call edi
lea ecx, [esp + 0xc]
push ecx
push 0
push esi
push 0x10024cf0
push 0
push 0
call edi
pop edi
pop esi
ret