joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003e9d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 4
mov eax, 0x1001a2ef
call fcn.1000e0f8
mov esi, ecx
and dword [ebp - 0x10], 0
and dword [ebp - 4], 0
call fcn.10002c86
push dword [ebp + 0xc]
mov ecx, esi
call fcn.100039c7
test eax, eax
jne 0x10003eeb
push 2
push 0x1001c2f4
mov ecx, esi
call fcn.100016b4
push 8
mov ecx, esi
call fcn.10001e51
mov dword [esi + 0x2c], 1
xor eax, eax
jmp 0x10003fcb
mov eax, dword [esi + 0xb4]
test eax, eax
je 0x10003efe
cmp byte [eax], 0
mov byte [ebp + 0xf], 1
jne 0x10003f02
mov byte [ebp + 0xf], 0
push dword [esi + 0x98]
lea ecx, [esi + 0x30c]
call fcn.10001567
mov ecx, esi
call fcn.100017a8
push dword [esi + 0x98]
call fcn.100099b5
pop ecx
test eax, eax
je 0x10003f80
push dword [esi + 0x98]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
call edi
cmp eax, 0xffffffff
je 0x10003f9e
push 1
mov eax, dword [esi + 0xac]
push eax
mov ecx, esi
call fcn.10002985
test eax, eax
je 0x10003f80
cmp eax, 0xffffffff
je 0x10003ee4
xor eax, eax
cmp dword [ebp + 8], eax
je 0x10003fc4
push eax
push 0x80
push 4
push eax
push 1
push accept
push dword [esi + 0x98]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10003fb5
push 0
mov ecx, esi
call fcn.1000190b
push 8
mov ecx, esi
mov dword [esi + 0x2c], 1
call fcn.10001e51
jmp 0x10003ee4
cmp byte [ebp + 0xf], 0
je 0x10003f56
push dword [esi + 0x30c]
call edi
cmp eax, 0xffffffff
je 0x10003f56
push 0
jmp 0x10003f3f
push edi
mov ecx, esi
call fcn.10001b2c
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi + 0xc], 0xfffffffe
xor eax, eax
inc eax
call fcn.1000e197
ret 8
Function at 0x10004588
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2718
call fcn.1000e2f0
mov eax, dword [0x100213d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
call fcn.10001958
mov ecx, esi
call fcn.10001a8f
push dword [esi + 0x98]
call sub.MSVCR100.dll_strlen
push dword [esi + 0xb4]
mov edi, eax
call sub.MSVCR100.dll_strlen
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x100046ab
lea eax, [edi - 1]
cmp ebx, eax
jge 0x100046ab
mov eax, edi
push ebx
push dword [esi + 0xb4]
sub eax, ebx
add eax, dword [esi + 0x98]
push eax
call fcn.10009685
add esp, 0xc
test eax, eax
jne 0x100046ab
push dword [esi + 0x98]
lea eax, [ebp - 0x2714]
push eax
call sub.MSVCR100.dll_strcpy
mov eax, dword [esi + 0x98]
sub edi, ebx
pop ecx
mov byte [edi + eax - 1], 0
test byte [esi + 0xb8], 8
pop ecx
je 0x10004634
push 0
mov ecx, esi
call fcn.100042b2
mov ecx, esi
call fcn.10002bf6
push dword [esi + 0x98]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x10004658
push dword [esi + 0x98]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [esi + 0x98]
lea eax, [ebp - 0x2714]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x100046bd
mov ecx, esi
call fcn.1000197d
push 2
push 0x1001c2f4
mov dword [ebp - 0x2718], eax
call fcn.100016b4
lea eax, [ebp - 0x2718]
push eax
mov ecx, esi
call fcn.1000190b
lea eax, [ebp - 0x2714]
push eax
push dword [esi + 0x98]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x100046bd
test byte [esi + 0xb8], 8
je 0x100046bd
push 1
mov ecx, esi
call fcn.100042b2
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000dd44
leave
ret
Function at 0x100052a3
Capabilities:
Parse credit card information

Disassembly:
push 0xc
mov eax, 0x1001a431
call fcn.1000e0f8
lea esi, [ecx + 0x88]
mov eax, dword [esi]
xor edi, edi
mov dword [ebp - 0x18], esi
cmp eax, edi
je 0x100052c9
push eax
call sub.MSVCR100.dll_strlen
pop ecx
jmp 0x100052cb
xor eax, eax
cmp eax, 0xd
jl 0x1000540e
mov eax, dword [esi]
push 8
push str._UTF_8_
push eax
call dword [sym.imp.MSVCR100.dll__strnicmp]
add esp, 0xc
test eax, eax
jne 0x1000540e
mov eax, dword [esi]
mov cl, byte [eax + 8]
cmp cl, 0x42
je 0x10005302
cmp cl, 0x62
jne 0x1000540e
cmp byte [eax + 9], 0x3f
jne 0x1000540e
add eax, 0xa
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], edi
jmp 0x10005338
mov dl, byte [eax]
cmp dl, 0x3f
jne 0x10005323
cmp cl, 0x3d
je 0x10005341
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 0x10], dl
mov byte [ebp - 0xf], 0
call fcn.100015ac
mov eax, esi
lea esi, [eax + 1]
mov cl, byte [esi]
test cl, cl
jne 0x10005317
cmp byte [eax], 0x3f
jne 0x10005400
cmp byte [eax + 1], 0x3d
jne 0x10005400
cmp dword [ebp - 0x14], edi
je 0x10005364
push dword [ebp - 0x14]
call sub.MSVCR100.dll_strlen
pop ecx
jmp 0x10005366
xor eax, eax
push eax
call sub.MSVCR100.dll_void____cdecl_operator_new___unsigned_int_
mov ebx, eax
push ebx
push dword [ebp - 0x14]
call fcn.1000fd00
mov edi, eax
add esp, 0xc
test edi, edi
jg 0x1000538d
push ebx
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
cmp dword [ebp - 0x14], 0
pop ecx
jmp 0x10005403
xor ecx, ecx
push 2
pop edx
lea eax, [edi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.MSVCR100.dll_void____cdecl_operator_new___unsigned_int_
pop ecx
push edi
mov esi, eax
push esi
push edi
push ebx
xor edi, edi
push edi
xor eax, eax
push 0xfde9
mov word [esi], ax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, edi
jle 0x100053c8
xor ecx, ecx
mov word [esi + eax*2], cx
cmp dword [ebp - 0x14], edi
je 0x100053d8
push dword [ebp - 0x14]
call sub.MSVCR100.dll_strlen
pop ecx
jmp 0x100053da
xor eax, eax
push edi
push edi
push eax
push ebx
push 0xffffffffffffffff
push esi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [ebp - 0x18]
push ebx
call fcn.10001567
push ebx
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
push esi
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
pop ecx
pop ecx
cmp dword [ebp - 0x14], edi
je 0x1000540e
push dword [ebp - 0x14]
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
pop ecx
call fcn.1000e197
ret
Function at 0x10008711
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x1e0], edi
jle 0x1000873f
push edi
lea ecx, [esi + 0x1d0]
call fcn.100054f9
cmp dword [eax + 0x20], 6
je 0x10008747
inc edi
cmp edi, dword [esi + 0x1e0]
jl 0x10008724
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
push edi
lea ecx, [esi + 0x1d0]
call fcn.100054f9
and dword [eax + 0x1c], 0
inc dword [esi + 0x140]
inc dword [esi + 0x144]
push edi
push 6
mov ecx, esi
call fcn.10004e46
push edi
lea ecx, [esi + 0x1d0]
call fcn.100054f9
lea ecx, [ebp - 4]
push ecx
xor ecx, ecx
push ecx
push eax
push 0x1000788a
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x10008742

Function at 0x10008799
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
xor ebx, ebx
neg eax
push esi
sbb eax, eax
add eax, 6
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x30], esi
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ebx
mov dword [edi + 0x20], eax
mov eax, dword [esi + 0x1e0]
mov dword [edi + 0x2c], eax
cmp eax, ebx
jne 0x100087e4
cmp dword [ebp + 0xc], ebx
je 0x100087e4
push ebx
push 0xc
call fcn.10004e46
test eax, eax
jne 0x100087e4
xor eax, eax
jmp 0x10008894
sub esp, 0x58
mov ecx, esp
push edi
call fcn.10004dd3
lea ecx, [esi + 0x1d0]
call fcn.100058d6
mov eax, dword [esi + 0x1e0]
dec eax
push eax
lea ecx, [esi + 0x1d0]
call fcn.100054f9
mov dword [ebp + 8], eax
cmp dword [edi + 0x2c], ebx
jne 0x10008828
cmp dword [ebp + 0xc], ebx
je 0x10008891
push ebx
push 0xd
mov ecx, esi
call fcn.10004e46
test eax, eax
je 0x100087dd
cmp dword [ebp + 0xc], ebx
je 0x10008891
push dword [edi + 0x2c]
mov ecx, esi
push 5
call fcn.10004e46
cmp dword [ebp + 0x10], ebx
je 0x1000885d
mov eax, dword [edi + 0x34]
cmp eax, 0xffffffff
jne 0x1000884e
dec dword [esi + 0x8c]
jmp 0x1000885d
push eax
lea ecx, [esi + 0x200]
call fcn.1000555e
dec dword [eax + 0x60]
inc dword [esi + 0x140]
inc dword [esi + 0x144]
push dword [edi + 0x2c]
mov ecx, esi
push 6
call fcn.10004e46
lea eax, [ebp + 0xc]
push eax
push ebx
push dword [ebp + 8]
push 0x1000788a
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x100099b5
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4e24
call fcn.1000e2f0
mov eax, dword [0x100213d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
lea ecx, [ebp - 0x2714]
push ecx
push eax
call fcn.100096ef
lea eax, [ebp - 0x2714]
push eax
call sub.MSVCR100.dll_strlen
mov edi, eax
add esp, 0xc
xor eax, eax
cmp byte [ebp - 0x2714], 0x5c
jne 0x10009a3f
cmp byte [ebp - 0x2713], 0x5c
jne 0x10009a3f
mov esi, dword [sym.imp.MSVCR100.dll_strchr]
lea eax, [ebp - 0x2712]
push 0x5c
push eax
call esi
pop ecx
pop ecx
test eax, eax
je 0x10009a29
inc eax
push 0x5c
push eax
call esi
pop ecx
pop ecx
test eax, eax
je 0x10009a29
inc eax
jne 0x10009a35
push 3
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x10009aa7
lea ecx, [ebp - 0x2714]
sub eax, ecx
jmp 0x10009a4b
cmp byte [ebp - 0x2713], 0x3a
jne 0x10009a4b
push 3
pop eax
mov esi, eax
cmp eax, edi
jge 0x10009aa4
mov al, byte [ebp + esi - 0x2714]
cmp al, 0x5c
je 0x10009a60
cmp al, 0x2f
jne 0x10009a9f
push esi
lea eax, [ebp - 0x2714]
push eax
lea eax, [ebp - 0x4e24]
push eax
call sub.MSVCR100.dll_memcpy
add esp, 0xc
push 0
lea eax, [ebp - 0x4e24]
push eax
mov byte [ebp + esi - 0x4e24], 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x10009a9f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x10009a31
inc esi
cmp esi, edi
jl 0x10009a51
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1000dd44
leave
ret

Function at 0x1000a6e8
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call sub.WS2_32.dll_gethostbyname
test eax, eax
jne 0x1000a6f9
pop ebp
ret
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
pop ebp
ret

Function at 0x1000abe1
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push edi
mov ebx, ecx
xor edi, edi
cmp dword [ebx + 4], edi
je 0x1000ac31
push esi
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
mov dword [ebp - 4], edi
push 0x32
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x1000ac49
inc dword [ebx + 8]
cmp dword [ebp - 4], 0xc8
jne 0x1000ac30
mov esi, dword [ebx + 4]
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push esi
mov dword [ebx + 4], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop edi
pop ebx
leave
ret
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push edi
push edi
push edi
lea eax, [ebp - 0x20]
push eax
call esi
test eax, eax
jne 0x1000ac35
inc dword [ebp - 4]
cmp dword [ebp - 4], 0xc8
jl 0x1000abfc
jmp 0x1000ac11
Function at 0x1000bb4e
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x100213d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x208], eax
lea eax, [ebp - 0x204]
push eax
push 0x101
mov esi, ecx
call sub.WS2_32.dll_WSAStartup
mov ecx, esi
call fcn.1000bb17
test eax, eax
jne 0x1000bb8e
or eax, 0xffffffff
jmp 0x1000bbbb
push edi
call dword [esi + 4]
mov edi, eax
test edi, edi
je 0x1000bbb7
cmp edi, 0xffffffff
je 0x1000bbb7
push dword [ebp - 0x208]
call fcn.1000a6e8
pop ecx
mov dword [ebp - 0x208], eax
test eax, eax
jne 0x1000bbca
push edi
call dword [esi + 8]
or eax, 0xffffffff
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1000dd44
leave
ret 4
or dword [ebp - 0x6c], 0xffffffff
push 0x20
lea eax, [ebp - 0x24]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x1388
push 0x4e
lea eax, [ebp - 0x74]
push eax
push 0
push 0x20
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x208]
push edi
call dword [esi + 0xc]
push edi
call dword [esi + 8]
cmp dword [ebp - 0x70], 0
jne 0x1000bbb7
mov eax, dword [ebp - 0x6c]
jmp 0x1000bbba

Function at 0x1000dd44
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100213d0]
jne 0x1000dd4e
repz ret
jmp fcn.1000e58e

Function at 0x1000ecb0
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
call fcn.1000ef10
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
je 0x1000ecde
cmp dword [ebp - 0x50], 1
je 0x1000ecf7
cmp dword [ebp - 0x50], 2
je 0x1000ed10
jmp 0x1000ed42
push 0x1001c2f4
mov ecx, dword [ebp - 4]
add ecx, 8
call fcn.10001567
mov dword [ebp - 8], 1
jmp 0x1000ed49
push str.Internet_Explorer
mov ecx, dword [ebp - 4]
add ecx, 8
call fcn.10001567
mov dword [ebp - 8], 0
jmp 0x1000ed49
mov dword [ebp - 8], 3
cmp dword [ebp + 0x10], 0
je 0x1000ed27
mov eax, dword [ebp + 0x10]
movsx ecx, byte [eax]
test ecx, ecx
jne 0x1000ed31
mov eax, 8
jmp 0x1000edb2
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
add ecx, 8
call fcn.10001567
jmp 0x1000ed49
mov eax, 8
jmp 0x1000edb2
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.10001567
push 0
xor eax, eax
cmp dword [ebp - 8], 3
setne al
sub eax, 1
and eax, str._local_
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x14], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x14], 0
jne 0x1000ed94
call fcn.10013fe0
jmp 0x1000edb2
mov dword [ebp - 0xc], 1
push 4
lea eax, [ebp - 0xc]
push eax
push 0x46
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.WININET.dll_InternetSetOptionA]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10011420
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 8]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 8], 4
je 0x10011468
mov eax, 0xd
jmp 0x1001146b
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x10011480
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor eax, eax
cmp dword [ebp + 0x10], 0
setne al
mov dword [ebp - 8], eax
xor eax, eax
jne 0x10011498
xor eax, eax
jne 0x10011498
cmp dword [ebp - 8], 0
jne 0x100114b0
push 0x80004005
call fcn.100115c0
xor eax, eax
jne 0x1001148c
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp + 8], 0
je 0x100115ad
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0
jbe 0x100115a7
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
jbe 0x10011598
cmp dword [ebp - 0x54], 2
jbe 0x10011513
cmp dword [ebp - 0x54], 7
je 0x10011545
jmp 0x10011598
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
xor edx, edx
mov ecx, 1
div ecx
test edx, edx
jne 0x10011536
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
movsx eax, byte [edx + ecx - 1]
test eax, eax
je 0x10011543
mov eax, dword [ebp + 8]
mov byte [eax], 0
mov eax, 0xd
jmp 0x100115b0
jmp 0x100115a5
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
xor edx, edx
mov ecx, 1
div ecx
test edx, edx
jne 0x10011589
mov eax, dword [ebp + 0x10]
cmp dword [eax], 1
jb 0x10011589
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
movsx eax, byte [edx + ecx - 1]
test eax, eax
jne 0x10011589
mov eax, dword [ebp + 0x10]
cmp dword [eax], 1
jbe 0x10011596
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
movsx eax, byte [edx + ecx - 2]
test eax, eax
je 0x10011596
mov eax, dword [ebp + 8]
mov byte [eax], 0
mov eax, 0xd
jmp 0x100115b0
jmp 0x100115a5
mov eax, dword [ebp + 8]
mov byte [eax], 0
mov eax, 0xd
jmp 0x100115b0
jmp 0x100115ad
mov eax, dword [ebp + 8]
mov byte [eax], 0
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10015210
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
push 0x35
push str.Out_of_memory
push str.Out_of_memory__Please_close_some_applications_and_press_Retry_or_Cancel_to_exit_without_saving_any_data
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 2
jne 0x1001523a
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100153b0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001b2a4
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
push ebx
push esi
push edi
mov eax, dword [0x100213d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x10]
mov eax, dword [edx + 0x20]
call eax
lea ecx, [ebp - 0x14]
call fcn.10001553
mov dword [ebp - 4], 0
push 0x1001c2f4
mov ecx, dword [ebp - 0x10]
add ecx, 0x48
call fcn.10015720
test eax, eax
je 0x1001542c
push 0x1001c82c
lea ecx, [ebp - 0x14]
call fcn.10001567
mov ecx, dword [ebp - 0x10]
add ecx, 0x48
call fcn.10001609
push eax
lea ecx, [ebp - 0x14]
call fcn.100015ac
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x14]
call fcn.100015ac
push 0
push 0
push 3
push 0
push 1
push accept
lea ecx, [ebp - 0x14]
call fcn.10001609
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x38], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x38], 0xffffffff
jne 0x10015484
call fcn.10013df0
mov dword [ebp - 0x68], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.10001559
mov eax, dword [ebp - 0x68]
jmp 0x10015512
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x38]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x18], eax
mov esi, dword [ebp - 0x18]
xor edi, edi
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov cl, 0x20
call fcn.10019fc0
or esi, eax
or edi, edx
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x30], esi
mov dword [eax + 0x34], edi
mov eax, dword [ebp + 0xc]
or eax, dword [ebp + 0x10]
je 0x100154f9
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x38]
push eax
call fcn.10015360
add esp, 0x10
movzx ecx, al
test ecx, ecx
jne 0x100154f9
mov dword [ebp - 0x64], 0xf
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.10001559
mov eax, dword [ebp - 0x64]
jmp 0x10015512
mov dword [ebp - 0x60], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.10001559
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100155e0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
push 0
push 0
push 3
push 0
push 1
push accept
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x10015615
call fcn.10013df0
jmp 0x10015650
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 0xc]
xor edi, edi
mov eax, dword [ebp - 0x10]
xor edx, edx
mov cl, 0x20
call fcn.10019fc0
or esi, eax
or edi, edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x30], esi
mov dword [eax + 0x34], edi
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x100158c0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001b31c
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x48
push ebx
push esi
push edi
mov eax, dword [0x100213d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x50], 0xffffffff
jne 0x100158ff
mov eax, 4
jmp 0x10015964
mov dword [ebp - 4], 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x50]
push eax
call sub.WS2_32.dll_recv
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
jmp 0x1001593d
mov dword [ebp - 4], 0xffffffff
jmp 0x1001594b
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0
je 0x1001595b
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0xffffffff
jne 0x10015962
call fcn.10014c80
jmp 0x10015964
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc