joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002870
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov byte [ebp - 0x14], 0x1d
mov byte [ebp - 0x13], 0
mov byte [ebp - 0x12], 0
mov byte [ebp - 0x11], 0
mov byte [ebp - 0x10], 0
mov byte [ebp - 0xf], 0
mov byte [ebp - 0xe], 0
mov byte [ebp - 0xd], 0
mov byte [ebp - 0xc], 9
mov byte [ebp - 0xb], 0x5f
mov byte [ebp - 0xa], 0x30
mov byte [ebp - 9], 0x41
mov byte [ebp - 8], 0x30
mov byte [ebp - 7], 0x30
mov byte [ebp - 6], 0x30
mov byte [ebp - 5], 0x30
mov byte [ebp - 4], 0x31
mov byte [ebp - 3], 0x41
mov al, byte [ebp + 0xc]
mov byte [ebp - 9], al
mov ecx, dword [ebp + 0x10]
push ecx
push 0x100192a8
lea edx, [ebp - 8]
push edx
call fcn.1000ea2d
add esp, 0xc
mov byte [ebp - 3], 0x41
push 1
mov eax, dword [ebp + 8]
push eax
call sym.libnodave.dll__daveInitPDUheader
push 0x12
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call sym.libnodave.dll__daveAddParam
mov eax, dword [0x1001cb00]
and eax, 0x400
je 0x1000290c
mov ecx, dword [ebp + 8]
push ecx
call sym.libnodave.dll__daveDumpPDU
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10003170
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov byte [ebp - 0x2c], 0
mov byte [ebp - 0x2b], 1
mov byte [ebp - 0x2a], 0x12
mov byte [ebp - 0x29], 4
mov byte [ebp - 0x28], 0x11
mov byte [ebp - 0x27], 0x43
mov byte [ebp - 0x26], 3
mov byte [ebp - 0x25], 0
mov byte [ebp - 0x34], 0x30
mov byte [ebp - 0x33], 0
mov byte [ebp - 0x32], 0x30
mov byte [ebp - 0x31], 0x30
mov byte [ebp - 0x30], 0x30
mov byte [ebp - 0x2f], 0x31
mov byte [ebp - 0x2e], 0x30
mov byte [ebp - 0x2d], 0x41
mov eax, dword [ebp + 0x14]
push eax
push str._05d
lea ecx, [ebp - 0x32]
push ecx
call fcn.1000ea2d
add esp, 0xc
mov dl, byte [ebp + 0x10]
mov byte [ebp - 0x33], dl
mov byte [ebp - 0x2d], 0x41
push 8
lea eax, [ebp - 0x34]
push eax
push 8
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x24]
push edx
mov eax, dword [ebp + 8]
push eax
call sym.libnodave.dll_daveBuildAndSendPDU
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0
je 0x10003239
cmp dword [ebp - 8], 0x4e
jne 0x10003239
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.1000e580
add esp, 0xc
mov ecx, dword [ebp + 0xc]
mov dx, word [ecx + 0xc]
push edx
call sym.libnodave.dll_daveSwapIed_16
mov ecx, dword [ebp + 0xc]
mov word [ecx + 0xc], ax
mov edx, dword [ebp + 0xc]
mov ax, word [edx + 0x28]
push eax
call sym.libnodave.dll_daveSwapIed_16
mov ecx, dword [ebp + 0xc]
mov word [ecx + 0x28], ax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10004c00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x10004c27
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.10004939
cmp byte [ebp - 0x6a], ch
inc ebp
lea eax, [ebp - 0x40]
push eax
invalid
inc ebp
into
jl 0x10004c31
inc ebp
iretd

Function at 0x10004d20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.10004949
push eax
push esi
push dword [ebp + 8]
call fcn.100048fe
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
inc ebp
salc
aam 0x88
pop ebp
xlatb

Function at 0x10004d60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
salc
aam 0x88
pop ebp
xlatb
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.10004949
push eax
push esi
push dword [ebp + 8]
call fcn.100048fe
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.10004939
dec eax
mov edi, 0x9d88d8de
jl 0x10004dbe
invalid
invalid

Function at 0x10004e70
Capabilities:
Inspect section memory permissions

Disassembly:
push es
mov dword [ebp + 0xc], ebx
jbe 0x10004ea9
movzx eax, word [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
lea eax, [eax + eax*4]
push dword [ecx + eax*8 + 0x10]
lea eax, [ecx + eax*8]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add ecx, dword [ebp + 0x10]
add eax, esi
push ecx
push eax
call fcn.100048aa
add esp, 0xc
inc dword [ebp + 0xc]
mov ax, word [ebp + 0xc]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jb 0x10004e76
call fcn.10004939
sub al, 0x78
frstor dword [eax - 0x75]
jle 0x10004ef1
add edi, esi
mov dword [ebp - 0x88], edi
mov eax, dword [edi + 0x80]
cmp eax, ebx
je 0x10005128
add eax, esi
mov dword [ebp - 0x44], eax
cmp dword [eax + 4], ebx
jne 0x10004ede
cmp dword [eax + 0xc], ebx
je 0x10004f81
invalid
invalid

Function at 0x10005190
Capabilities:
Contain obfuscated stackstrings

Disassembly:
dec dword [edx - 0x3a]
test dword [esi + 0x46fffffc], esi
mov byte [ebp - 0x349], 0x40
Function at 0x100051a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
invalid
invalid

Function at 0x10007f50
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x124], 0
jmp 0x10007f7e
mov eax, dword [ebp - 0x124]
add eax, 1
mov dword [ebp - 0x124], eax
mov ecx, dword [ebp - 0x124]
cmp ecx, dword [ebp - 0x110]
jae 0x10007fa5
mov edx, dword [ebp - 0x124]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + edx*4 - 0x10c]
cmp ecx, dword [eax + 4]
jne 0x10007fa3
jmp 0x10007fa5
jmp 0x10007f6f
mov edx, dword [ebp - 0x124]
cmp edx, dword [ebp - 0x110]
jne 0x10007fde
cmp dword [ebp - 0x110], 0x40
jae 0x10007fde
mov eax, dword [ebp - 0x124]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov dword [ebp + eax*4 - 0x10c], edx
mov eax, dword [ebp - 0x110]
add eax, 1
mov dword [ebp - 0x110], eax
xor ecx, ecx
jne 0x10007f63
mov edx, dword [ebp + 8]
mov eax, dword [edx]
cdq
mov ecx, 0xf4240
idiv ecx
mov dword [ebp - 0x120], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx]
cdq
mov ecx, 0xf4240
idiv ecx
mov dword [ebp - 0x11c], edx
lea edx, [ebp - 0x120]
push edx
push 0
push 0
lea eax, [ebp - 0x110]
push eax
push 1
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jg 0x1000804d
mov ecx, dword [0x1001cb00]
and ecx, 0x80
je 0x10008046
push 0x1001a928
push 0x1001c0d0
call fcn.1000e8bd
add esp, 8
xor eax, eax
jmp 0x1000816a
push 0
push 4
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 0x118], eax
mov edx, dword [ebp - 0x118]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
jg 0x1000809c
mov eax, dword [0x1001cb00]
and eax, 0x80
je 0x10008095
push str.timeout_in_ReadISOPacket._n
push 0x1001c0d0
call fcn.1000e8bd
add esp, 8
xor eax, eax
jmp 0x1000816a
cmp dword [ebp - 4], 4
jge 0x100080df
mov ecx, dword [0x1001cb00]
and ecx, 0x80
je 0x100080d8
mov edx, dword [ebp - 4]
push edx
push 0x1001a960
push 0x1001c0d0
call fcn.1000e8bd
add esp, 0xc
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0x1001a968
call sym.libnodave.dll__daveDump
xor eax, eax
jmp 0x1000816a
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx + 3]
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx + 2]
shl edx, 8
add eax, edx
mov dword [ebp - 0x114], eax
push 0
mov eax, dword [ebp - 0x114]
sub eax, 4
push eax
mov ecx, dword [ebp + 0xc]
add ecx, 4
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 0x118], eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x118]
mov dword [ebp - 4], ecx
mov edx, dword [0x1001cb00]
and edx, 0x80
je 0x10008167
mov eax, dword [ebp - 0x114]
push eax
mov ecx, dword [ebp - 4]
push ecx
push str.readISOpacket:__d_bytes_read___d_needed_n
push 0x1001c0d0
call fcn.1000e8bd
add esp, 0x10
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
push str.readISOpacket:_packet
call sym.libnodave.dll__daveDump
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x10008170
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x120], 0
jmp 0x1000819e
mov eax, dword [ebp - 0x120]
add eax, 1
mov dword [ebp - 0x120], eax
mov ecx, dword [ebp - 0x120]
cmp ecx, dword [ebp - 0x110]
jae 0x100081c5
mov edx, dword [ebp - 0x120]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + edx*4 - 0x10c]
cmp ecx, dword [eax + 4]
jne 0x100081c3
jmp 0x100081c5
jmp 0x1000818f
mov edx, dword [ebp - 0x120]
cmp edx, dword [ebp - 0x110]
jne 0x100081fe
cmp dword [ebp - 0x110], 0x40
jae 0x100081fe
mov eax, dword [ebp - 0x120]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov dword [ebp + eax*4 - 0x10c], edx
mov eax, dword [ebp - 0x110]
add eax, 1
mov dword [ebp - 0x110], eax
xor ecx, ecx
jne 0x10008183
mov edx, dword [ebp + 8]
mov eax, dword [edx]
cdq
mov ecx, 0xf4240
idiv ecx
mov dword [ebp - 0x11c], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx]
cdq
mov ecx, 0xf4240
idiv ecx
mov dword [ebp - 0x118], edx
lea edx, [ebp - 0x11c]
push edx
push 0
push 0
lea eax, [ebp - 0x110]
push eax
push 1
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jg 0x1000826d
mov ecx, dword [0x1001cb00]
and ecx, 0x80
je 0x10008266
push str.timeout_in_ReadIBHPacket._n
push 0x1001c0d0
call fcn.1000e8bd
add esp, 8
xor eax, eax
jmp 0x10008339
push 0
push 3
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 3
jge 0x100082c5
mov edx, dword [0x1001cb00]
and edx, 0x80
je 0x100082c1
mov eax, dword [ebp - 4]
push eax
push 0x1001a9e4
push 0x1001c0d0
call fcn.1000e8bd
add esp, 0xc
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push str.readIBHpacket:_short_packet
call sym.libnodave.dll__daveDump
xor eax, eax
jmp 0x10008339
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax + 2]
add ecx, 8
mov dword [ebp - 0x114], ecx
push 0
mov edx, dword [ebp - 0x114]
sub edx, 3
push edx
mov eax, dword [ebp + 0xc]
add eax, 3
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.WS2_32.dll_recv]
add eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov eax, dword [0x1001cb00]
and eax, 0x80
je 0x10008336
mov ecx, dword [ebp - 0x114]
push ecx
mov edx, dword [ebp - 4]
push edx
push str.readIBHpacket:__d_bytes_read___d_needed_n
push 0x1001c0d0
call fcn.1000e8bd
add esp, 0x10
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push str.readIBHpacket:_packet
call sym.libnodave.dll__daveDump
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x10008340
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
add eax, 4
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
and ecx, 0x800000ff
jns 0x10008360
dec ecx
or ecx, 0xffffff00
inc ecx
mov edx, dword [ebp + 8]
mov byte [edx + 0x827], cl
mov eax, dword [ebp + 0xc]
cdq
and edx, 0xff
add eax, edx
sar eax, 8
mov ecx, dword [ebp + 8]
mov byte [ecx + 0x826], al
mov edx, dword [ebp + 8]
mov byte [edx + 0x825], 0
mov eax, dword [ebp + 8]
mov byte [eax + 0x824], 3
mov ecx, dword [0x1001cb00]
and ecx, 0x80
je 0x100083ba
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
add eax, 0x824
push eax
push str.send_packet:
call sym.libnodave.dll__daveDump
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
add edx, 0x824
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.WS2_32.dll_send]
xor eax, eax
mov esp, ebp
pop ebp
ret 8

Function at 0x1000d190
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0
push 2
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jg 0x1000d1e4
mov ecx, dword [0x1001cb00]
and ecx, 0x80
je 0x1000d1da
push str.timeout_in_ReadMPINLpro._n
push 0x1001c0d0
call fcn.1000e8bd
add esp, 8
mov eax, 0xfffffbff
jmp 0x1000d29d
cmp dword [ebp - 4], 2
jge 0x1000d227
mov edx, dword [0x1001cb00]
and edx, 0x80
je 0x1000d220
mov eax, dword [ebp - 4]
push eax
push str.res__d
push 0x1001c0d0
call fcn.1000e8bd
add esp, 0xc
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push str.readISOpacket:_short_packet
call sym.libnodave.dll__daveDump
mov eax, 0xfffffc00
jmp 0x1000d29d
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax + 1]
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
shl eax, 8
add ecx, eax
mov dword [ebp - 8], ecx
push 0
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 0xc]
add edx, 2
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0xc]
mov dword [ebp - 4], edx
mov eax, dword [0x1001cb00]
and eax, 0x80
je 0x1000d29a
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
push str.readMPINLpro:__d_bytes_read___d_needed_n
push 0x1001c0d0
call fcn.1000e8bd
add esp, 0x10
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push str.readMPIpro:_packet
call sym.libnodave.dll__daveDump
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x1000d3c0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov dword [ebp - 4], 2
mov eax, dword [ebp + 0x10]
cdq
and edx, 0xff
add eax, edx
sar eax, 8
mov byte [ebp - 0x808], al
mov eax, dword [ebp + 0x10]
and eax, 0x800000ff
jns 0x1000d3f6
dec eax
or eax, 0xffffff00
inc eax
mov byte [ebp - 0x807], al
mov dword [ebp - 8], 0
jmp 0x1000d40e
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp edx, dword [ebp + 0x10]
jge 0x1000d433
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dl, byte [eax]
mov byte [ebp + ecx - 0x808], dl
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
jmp 0x1000d405
push 0
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x808]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.WS2_32.dll_send]
mov edx, dword [0x1001cb00]
and edx, 0x40
je 0x1000d46d
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x808]
push ecx
push str._daveSendWithCRCNLpro
call sym.libnodave.dll__daveDump
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000e180
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push str.S7onlinx.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 8], eax
mov eax, dword [0x1001cb00]
and eax, 0x10000
je 0x1000e1b6
mov ecx, dword [ebp - 8]
push ecx
push str.LoadLibrary_S7onlinx.dll__returned__p__n
push 0x1001c0d0
call fcn.1000e8bd
add esp, 0xc
push str.SCP_open
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1001cda0], eax
mov eax, dword [0x1001cb00]
and eax, 0x10000
je 0x1000e1ef
mov ecx, dword [0x1001cda0]
push ecx
push 0x1001bf90
push 0x1001c0d0
call fcn.1000e8bd
add esp, 0xc
push str.SCP_close
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1001cd98], eax
mov eax, dword [0x1001cb00]
and eax, 0x10000
je 0x1000e228
mov ecx, dword [0x1001cd98]
push ecx
push 0x1001bfbc
push 0x1001c0d0
call fcn.1000e8bd
add esp, 0xc
push str.SCP_get_errno
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1001cda8], eax
mov eax, dword [0x1001cb00]
and eax, 0x10000
je 0x1000e261
mov ecx, dword [0x1001cda8]
push ecx
push 0x1001bfec
push 0x1001c0d0
call fcn.1000e8bd
add esp, 0xc
push str.SCP_send
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1001cda4], eax
mov eax, dword [0x1001cb00]
and eax, 0x10000
je 0x1000e29a
mov ecx, dword [0x1001cda4]
push ecx
push 0x1001c018
push 0x1001c0d0
call fcn.1000e8bd
add esp, 0xc
push str.SCP_receive
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1001cdac], eax
mov eax, dword [0x1001cb00]
and eax, 0x10000
je 0x1000e2d3
mov ecx, dword [0x1001cdac]
push ecx
push 0x1001c044
push 0x1001c0d0
call fcn.1000e8bd
add esp, 0xc
push str.SetSinecHWnd
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x10], eax
mov eax, dword [0x1001cb00]
and eax, 0x10000
je 0x1000e307
mov ecx, dword [ebp - 0x10]
push ecx
push str.GetProcAddress_returned__p__n
push 0x1001c0d0
call fcn.1000e8bd
add esp, 0xc
call dword [0x1001cda8]
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push edx
call dword [0x1001cda0]
mov dword [ebp - 0xc], eax
call dword [0x1001cda8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
push str.handle:__d__error:_d_n
push 0x1001c0d0
call fcn.1000e8bd
add esp, 0x10
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 8
Function at 0x1000eec3
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
inc esi
cmp dword [0x1001cb64], esi
push edi
jne 0x1000eee3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [ebp + 0xc], 0
mov al, byte [ebp + 0x10]
mov dword [0x1001cb60], esi
mov byte [0x1001cb5c], al
jne 0x1000ef49
mov ecx, dword [0x1001d134]
test ecx, ecx
je 0x1000ef2a
mov eax, dword [0x1001d130]
sub eax, 4
cmp eax, ecx
jmp 0x1000ef23
mov eax, dword [eax]
test eax, eax
je 0x1000ef15
call eax
mov eax, dword [0x1001d130]
sub eax, 4
cmp eax, dword [0x1001d134]
mov dword [0x1001d130], eax
jae 0x1000ef0d
mov eax, 0x10019020
mov esi, 0x10019028
cmp eax, esi
mov edi, eax
jae 0x1000ef49
mov eax, dword [edi]
test eax, eax
je 0x1000ef42
call eax
add edi, 4
cmp edi, esi
jb 0x1000ef3a
mov eax, 0x1001902c
mov esi, 0x10019030
cmp eax, esi
mov edi, eax
jae 0x1000ef68
mov eax, dword [edi]
test eax, eax
je 0x1000ef61
call eax
add edi, 4
cmp edi, esi
jb 0x1000ef59
cmp dword [ebp + 0x10], 0
pop edi
pop esi
jne 0x1000ef82
push dword [ebp + 8]
mov dword [0x1001cb64], 1
call fcn.1000ee29
pop ebp
ret

Function at 0x1000efd0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
push esi
jne 0x1000f0ad
mov eax, 0x94
call fcn.1000ecd0
mov esi, esp
push esi
mov dword [esi], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x1000f074
mov ecx, dword [esi + 0x10]
mov dword [0x1001cb24], ecx
mov eax, dword [esi + 4]
mov dword [0x1001cb30], eax
mov edx, dword [esi + 8]
mov dword [0x1001cb34], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
cmp ecx, 2
mov dword [0x1001cb28], esi
je 0x1000f035
or esi, 0x8000
mov dword [0x1001cb28], esi
shl eax, 8
add eax, edx
xor esi, esi
push esi
mov dword [0x1001cb2c], eax
call fcn.1000f227
test eax, eax
pop ecx
je 0x1000f074
call fcn.1001163b
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x1001d124], eax
call fcn.10011a9d
mov dword [0x1001cb94], eax
call fcn.10010766
test eax, eax
jge 0x1000f078
call fcn.1000f278
xor eax, eax
jmp 0x1000f09e
call fcn.100119fb
test eax, eax
jl 0x1000f0a6
call fcn.100117c8
test eax, eax
jl 0x1000f0a6
push esi
call fcn.1000ee59
test eax, eax
pop ecx
jne 0x1000f0a6
inc dword [0x1001cb90]
xor eax, eax
inc eax
lea esp, [ebp - 4]
pop esi
pop ebp
ret 0xc
call fcn.10010911
jmp 0x1000f06f
xor esi, esi
cmp dword [ebp + 0xc], esi
jne 0x1000f09b
cmp dword [0x1001cb90], esi
jle 0x1000f074
dec dword [0x1001cb90]
cmp dword [0x1001cb60], esi
jne 0x1000f0cf
call fcn.1000ef95
call fcn.10010911
call fcn.1000f278
jmp 0x1000f09b
Function at 0x10010aa2
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x39c]
sub esp, 0x41c
mov ecx, dword [ebp + 0x3a4]
cmp ecx, dword [0x1001cfe0]
mov eax, dword [0x1001c580]
push ebx
push esi
mov dword [ebp + 0x398], eax
push edi
jae 0x10010c68
mov eax, ecx
sar eax, 5
lea ebx, [eax*4 + 0x1001d000]
mov eax, dword [ebx]
mov esi, ecx
and esi, 0x1f
shl esi, 3
mov al, byte [eax + esi + 4]
test al, 1
mov dword [ebp - 0x80], ebx
je 0x10010c68
xor edi, edi
cmp dword [ebp + 0x3ac], edi
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x7c], edi
jne 0x10010b0c
xor eax, eax
jmp 0x10010c7c
test al, 0x20
je 0x10010b1d
push 2
push edi
push edi
push ecx
call fcn.1001273a
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x10010bf2
cmp dword [ebp + 0x3ac], edi
mov eax, dword [ebp + 0x3a8]
mov dword [ebp - 0x70], eax
mov dword [ebp + 0x3a4], edi
jbe 0x10010c39
mov ecx, dword [ebp - 0x70]
sub ecx, dword [ebp + 0x3a8]
lea eax, [ebp - 0x6c]
cmp ecx, dword [ebp + 0x3ac]
jae 0x10010b7f
mov edx, dword [ebp - 0x70]
inc dword [ebp - 0x70]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x10010b70
inc dword [ebp - 0x7c]
mov byte [eax], 0xd
inc eax
inc edi
mov ebx, dword [ebp - 0x80]
mov byte [eax], dl
inc eax
inc edi
cmp edi, 0x400
jl 0x10010b52
mov edi, eax
lea eax, [ebp - 0x6c]
sub edi, eax
push 0
lea eax, [ebp - 0x78]
push eax
push edi
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10010bbf
mov eax, dword [ebp - 0x78]
add dword [ebp - 0x74], eax
cmp eax, edi
jl 0x10010bcb
mov eax, dword [ebp - 0x70]
sub eax, dword [ebp + 0x3a8]
xor edi, edi
cmp eax, dword [ebp + 0x3ac]
jb 0x10010b46
jmp 0x10010bcd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x3a4], eax
xor edi, edi
mov eax, dword [ebp - 0x74]
cmp eax, edi
jne 0x10010c63
cmp dword [ebp + 0x3a4], edi
je 0x10010c39
push 5
pop eax
cmp dword [ebp + 0x3a4], eax
jne 0x10010c2b
mov dword [0x1001cb1c], eax
jmp 0x10010c6f
push edi
lea ecx, [ebp - 0x78]
push ecx
push dword [ebp + 0x3ac]
push dword [ebp + 0x3a8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10010c1d
mov eax, dword [ebp - 0x78]
mov dword [ebp + 0x3a4], edi
mov dword [ebp - 0x74], eax
jmp 0x10010bcd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x3a4], eax
jmp 0x10010bcd
push dword [ebp + 0x3a4]
call fcn.100126db
pop ecx
jmp 0x10010c79
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x10010c51
mov eax, dword [ebp + 0x3a8]
cmp byte [eax], 0x1a
je 0x10010b05
mov dword [0x1001cb18], 0x1c
mov dword [0x1001cb1c], edi
jmp 0x10010c79
sub eax, dword [ebp - 0x7c]
jmp 0x10010c7c
and dword [0x1001cb1c], 0
mov dword [0x1001cb18], 9
or eax, 0xffffffff
mov ecx, dword [ebp + 0x398]
pop edi
pop esi
pop ebx
call fcn.10012512
add ebp, 0x39c
leave
ret