joyce8/EMBER2024-capa huggingface dataset:
Function at 0x572e68
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005a6358
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x572f8b
push ecx
lea ecx, [esi + 0x18]
call fcn.00592688
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x572fa2
push ecx
lea ecx, [esi + 0x24]
call fcn.00592598
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x5919c8
Capabilities:
Encode data using xor

Disassembly:
adc eax, 0x90f2d50e
mov edx, 0x75bb4a4f
jne 0x5919d7
add eax, dword [edx + 0x68]
pop ebx
inc edx
push 0x4c5d335b
xor ebx, dword [ebp + 0x4c]
pushal
pop ebx
aaa
or ecx, esi
push 0x7b
pop ebp
cld
jno 0x5919d3
popfd
or al, 0x99
retf
Function at 0x5c1f8e
Capabilities:
Authenticate hmac

Disassembly:
sti
dec esp
aad 0x8a
shl ebx, cl
jmp [ebp + 0x1d606fe5]
stosd dword es:[edi], eax
dec ecx
fcos
fstp qword [edi]
fcomp qword [0xd649e4c]
jecxz 0x5c1e5d
arpl word [eax + esi - 0x78], di
mov byte [ecx], al
dec esi
xor byte [edi + 0x35], dl
mov edi, 0xb59107dc
push ecx
sar byte [eax + 0x28], 0x9b
loopne 0x5c1eed
wait
push edi
and byte [esi + 0x5953f0f], ah
nop
pop ds
imul eax, dword [ebp + 8], 0x7565d2b
mov bh, 0x5c
sub esp, edx
mov ah, 0x6c
insb byte es:[edi], dx
sti
jno 0x5c1ef4
push esi
call 0x1e04f9cb
dec ebx
ja 0x5c1f1d
push edx
cmp ebp, edi
salc
jae 0x5c1ec3
pop eax
pop esi
outsb dx, byte [esi]
insb byte es:[edi], dx
int1
inc edx
mov ebp, dword [edx + 0x22bf395c]
je 0x5c1f3f
and al, 0x2f
daa
out dx, al
movsd dword es:[edi], dword [esi]
pop ebp
xor dh, ch
pop esp
add eax, 0xe8a60fca
jo 0x5c1f46
iretd
stc
je 0x5c1f93
adc dword [esi], edi
je 0x5c1ea3
pop ebp
dec edx
pushfd
hlt
push cs
loop 0x5c1fb6
adc al, 0x19
fadd qword [edx - 0x3a08506c]
aas
xchg ebx, eax
test byte [0x5eb66db6], ch
loop 0x5c1edc
scasd eax, dword es:[edi]
test ebp, 0x2d84933f
mov dh, 0x6d
mov dh, 0x5e
and al, byte [eax + esi - 0x3b]
lea ecx, [esi + ebp*2 + 0x17]
xor al, 0xc4
or dword [ecx + 0x77], esp
std
call 0x3d86df64
fld xword [edx - 7]
sub dword [ebx - 0x2a], edi
into
and al, bl
adc al, 0x5c
xchg edi, eax
leave
and al, 0xd1
aad 0x5d
adc byte [eax], 0x17
pop ss
cmp cl, byte [esi + 0x26]
add al, 0x66
adc al, 0xe4
add eax, 0xf4277314
dec edx
scasd eax, dword es:[edi]
test byte [eax + 0x14cc3631], al
adc al, 0xb2
jl 0x5c1f14
sub al, 0
and ah, 0xb0
adc al, 0xb2
jl 0x5c1f14
sub al, 0
and ah, 0xb0
add byte [eax + 0x1254b0e4], al
adc byte [eax], dh
adc ch, ah
sbb eax, dword ss:[0xf66eeee3]
push esp
adc dl, byte [eax]
xor byte [eax], dl
in eax, 0x36
sbb eax, dword [0xf66eeee3]
inc ebp
lodsd eax, dword [esi]
and dh, byte [ebp + ebx*4 - 0x1a]
jp 0x5c200c
mov al, 0x85
lahf
shl byte [ebp + 0x14003c0f], cl
or byte [eax + esi*2], cl
inc esp
pop eax
and al, 0xb9
sub al, 0x18
sub edi, ebx
inc esp
xchg esp, eax
aas
sbb al, 0xdc
cwde
popfd
test dword [esi + 0x7e7e9cd4], edi
scasd eax, dword es:[edi]
daa
das
dec edx
les ebp, [esp + edx - 0x46d3906b]
lodsb al, byte [esi]
adc al, 0x95
outsd dx, dword [esi]
sub al, 0xb9
into
in al, 0x7f
std
inc edi
cwde
xchg dword [edx - 0x9740b09], edi
add al, 0xac
add ecx, esi
dec esi
nop
push es
dec edi
call 0xd78b0e60
movsb byte es:[edi], byte [esi]
push edx
scasd eax, dword es:[edi]
aaa
aaa
cmp bl, 0xe8
jl 0x5c2002
jns 0x5c2030
sti
add al, 0xed
in eax, dx
enter 0xffffffffffff8498, 0x7c
mov esp, 0xb39cffac
pop ds
xor byte [eax], 0x9b
sub al, 0xbe
or eax, 0x5ea59166
je 0x5c1fd5
sub eax, 0xe2cd323c
push ds
js 0x5c1fd0
das
xchg edx, eax
movsb byte es:[edi], byte [esi]
int3
and byte [esi + 0x2df8941c], bh
dec ebp
push edx
jl 0x5c20a6
cdq
inc ecx
or al, 0x44
dec eax
psubusb mm2, qword [edx + edi*8 + 0x65]
lahf
invalid
mov dl, 0xd4
mov edx, 0x89a488a5
inc esp
or al, 0x84
sub edi, dword [edi]
mov esp, 0xbea8ff
dec ecx
inc ebp
and al, 0x59
push cs
add ebx, ebp
jo 0x5c20b9
and ch, ah
insb byte es:[edi], dx
in al, 0xc0
inc ebx
int3
Function at 0x6066a8
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00639b98
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x6067cb
push ecx
lea ecx, [esi + 0x18]
call fcn.00625ec8
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x6067e2
push ecx
lea ecx, [esi + 0x24]
call fcn.00625dd8
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x64d9fd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x656388
cmp edx, dword [eax]
je 0x64da1f
add eax, 8
inc ecx
cmp eax, 0x656418
jl 0x64da10
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x656388]
jne 0x64db4d
mov eax, dword [0xa59ce0]
cmp eax, 1
je 0x64db27
test eax, eax
jne 0x64da50
cmp dword [0x6562b4], 1
je 0x64db27
cmp edx, 0xfc
je 0x64db4d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x64da87
lea eax, [ebp + 8]
lea esi, [esi + 0x65638c]
push 0
push eax
push dword [esi]
call fcn.0064e870
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
Function at 0x10001000
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1000e1d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x20c], ebx
mov al, byte [esi]
mov word [ebp - 0x208], 5
cmp al, 5
je 0x10001043
pop esi
movzx eax, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003014
mov esp, ebp
pop ebp
ret
mov al, byte [esi + 2]
push edi
lea edi, [esi + 2]
test al, al
je 0x10001056
cmp al, 2
jne 0x100011dc
mov ecx, 0x1000ee08
lea edx, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10001060
sub ecx, edx
push 0
neg ecx
push 2
lea eax, [ebp - 0x208]
sbb cl, cl
push eax
push dword [ebx]
and cl, 2
mov byte [ebp - 0x207], cl
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x100011dc
cmp byte [ebp - 0x207], 2
jne 0x100011ef
push pe_nt_image_headers32
lea eax, [ebp - 0x104]
push 0
push eax
call fcn.100036b0
push pe_nt_image_headers32
lea eax, [ebp - 0x204]
push 0
push eax
call fcn.100036b0
add esp, 0x18
push 0
push 0x5000
push esi
push dword [ebx]
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x100011dc
test eax, eax
je 0x100011dc
cmp byte [esi], 1
jne 0x100011dc
mov bl, byte [esi + 1]
test bl, bl
je 0x10001114
movzx eax, bl
cmp eax, 0x100
jg 0x10001114
push eax
lea eax, [ebp - 0x104]
push edi
push eax
call fcn.10003060
add esp, 0xc
movzx ecx, bl
movsx eax, byte [ecx + esi + 2]
test eax, eax
je 0x1000113d
cmp eax, 0x100
jg 0x1000113d
push eax
lea eax, [esi + 3]
add eax, ecx
push eax
lea eax, [ebp - 0x204]
push eax
call fcn.10003060
add esp, 0xc
lea ecx, [ebp - 0x104]
mov eax, 0x1000ee08
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10001168
test dl, dl
je 0x10001164
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10001168
add eax, 2
add ecx, 2
test dl, dl
jne 0x10001148
xor eax, eax
jmp 0x1000116d
sbb eax, eax
or eax, 1
test eax, eax
jne 0x100011b3
lea ecx, [ebp - 0x204]
mov eax, 0x1000ef08
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100011a0
test dl, dl
je 0x1000119c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100011a0
add eax, 2
add ecx, 2
test dl, dl
jne 0x10001180
xor eax, eax
jmp 0x100011a5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x100011b3
mov byte [esi + 1], al
push str.Socks5_Authentication_Passed_n
jmp 0x100011bc
mov byte [esi + 1], 0xff
push str.Invalid_Password_n
call fcn.10002e81
mov eax, dword [ebp - 0x20c]
add esp, 4
push 0
push 2
push esi
push dword [eax]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x100011ef
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003014
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.10003014
mov esp, ebp
pop ebp
ret
Function at 0x100012b0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1000e1d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 8]
xorps xmm0, xmm0
mov eax, 2
movq qword [ebp - 0x14], xmm0
movq qword [ebp - 0xc], xmm0
mov word [ebp - 0x14], ax
call dword [sym.imp.WS2_32.dll_htons]
mov ebx, dword [sym.imp.WS2_32.dll_inet_addr]
push esi
mov word [ebp - 0x12], ax
call ebx
push esi
cmp eax, 0xffffffff
jne 0x10001333
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x10001391
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
test eax, eax
je 0x10001391
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x10001332
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
call ebx
push 6
push 1
push 2
mov dword [ebp - 0x10], eax
call dword [sym.imp.WS2_32.dll_socket]
mov dword [edi], eax
cmp eax, 0xffffffff
je 0x10001391
push 4
lea ecx, [ebp - 0x18]
push ecx
push 0x1006
push 0xffff
push eax
mov dword [ebp - 0x18], 0x2710
call dword [sym.imp.WS2_32.dll_setsockopt]
push 0x10
lea eax, [ebp - 0x14]
push eax
push dword [edi]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x100013a4
push str.Fail_To_Connect_To_Remote_Host_n
call fcn.10002e81
add esp, 4
push dword [edi]
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003014
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.10003014
mov esp, ebp
pop ebp
ret
Function at 0x100013c0
Capabilities:
Create udp socket
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x1000e1d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
push 0x11
xorps xmm0, xmm0
push 2
push 2
movq qword [ebp - 0x114], xmm0
movq qword [ebp - 0x10c], xmm0
mov dword [ebp - 0x128], 0x10
mov dword [ebp - 0x124], 2
mov dword [ebp - 0x120], 0
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10001440
push str.UDP_socket_create_failed._n
call fcn.10002e81
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003014
mov esp, ebp
pop ebp
ret
push 0x10
lea eax, [ebp - 0x124]
push eax
push esi
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x10001475
push str.UDP_socket_bind_failed._n
call fcn.10002e81
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003014
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x114]
push eax
push esi
mov dword [ebx], esi
call dword [sym.imp.WS2_32.dll_getsockname]
lea eax, [ebp - 0x104]
push eax
call fcn.10001740
add esp, 4
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
push dword [ebp - 0x112]
mov dword [edi + 4], eax
mov ax, word [ebp - 0x112]
mov word [edi + 8], ax
call dword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
push eax
lea eax, [ebp - 0x104]
push eax
push str.UDP_Bound_to__s:_d_r_n
call fcn.10002e81
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop edi
pop esi
mov eax, 1
pop ebx
call fcn.10003014
mov esp, ebp
pop ebp
ret

Function at 0x100014f0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x10001502
pop ebp
ret
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
pop ebp
ret
Function at 0x10001520
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push esi
push edi
cmp eax, 2
jne 0x1000159a
mov esi, dword [ebp + 8]
movzx eax, word [esi + 2]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
mov ecx, dword [ebp + 0x18]
mov edi, dword [sym.imp.WS2_32.dll_inet_ntoa]
mov word [ecx], ax
cmp byte [esi + 4], 0
je 0x10001552
mov esi, dword [esi + 4]
jmp 0x10001572
lea eax, [esi + 9]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x10001569
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
push dword [eax]
call edi
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov esi, eax
push esi
call edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10001578
sub eax, edx
push eax
push esi
call edi
push eax
push dword [ebp + 0x14]
call fcn.10003060
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebp
ret
mov edi, dword [ebp + 8]
push ebx
mov cl, byte [edi]
cmp cl, 5
jne 0x10001630
cmp eax, 1
jne 0x100015f4
mov esi, dword [edi + 4]
mov ebx, dword [sym.imp.WS2_32.dll_inet_ntoa]
push esi
call ebx
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100015c0
sub eax, edx
push eax
push esi
call ebx
push eax
push dword [ebp + 0x14]
call fcn.10003060
movzx eax, word [edi + 8]
add esp, 0xc
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
mov ecx, dword [ebp + 0x18]
pop ebx
pop edi
mov word [ecx], ax
mov eax, 1
pop esi
pop ebp
ret
cmp eax, 3
jne 0x10001630
movzx eax, byte [edi + 4]
push eax
lea eax, [edi + 5]
push eax
push dword [ebp + 0x14]
call fcn.10003060
movzx eax, byte [edi + 4]
mov esi, dword [ebp + 0x18]
movzx eax, word [eax + edi + 5]
add esp, 0xc
mov word [esi], ax
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
mov word [esi], ax
pop ebx
pop edi
mov eax, 1
pop esi
pop ebp
ret
test cl, cl
jne 0x100016cd
mov cl, byte [edi + 1]
test cl, cl
jne 0x100016cd
cmp eax, 1
jne 0x1000168b
mov esi, dword [edi + 4]
mov ebx, dword [sym.imp.WS2_32.dll_inet_ntoa]
push esi
call ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10001657
sub eax, edx
push eax
push esi
call ebx
push eax
push dword [ebp + 0x14]
call fcn.10003060
movzx eax, word [edi + 8]
add esp, 0xc
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
mov ecx, dword [ebp + 0x18]
pop ebx
pop edi
mov word [ecx], ax
mov eax, 0xa
pop esi
pop ebp
ret
test cl, cl
jne 0x100016cd
cmp eax, 3
jne 0x100016cd
movzx eax, byte [edi + 4]
push eax
lea eax, [edi + 5]
push eax
push dword [ebp + 0x14]
call fcn.10003060
movzx eax, byte [edi + 4]
mov esi, dword [ebp + 0x18]
movzx eax, word [eax + edi + 5]
add esp, 0xc
mov word [esi], ax
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
mov word [esi], ax
movzx eax, byte [edi + 4]
pop ebx
pop edi
add eax, 7
pop esi
pop ebp
ret
pop ebx
pop edi
xor eax, eax
pop esi
pop ebp
ret
Function at 0x10001740
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1000e1d0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
push 0x1000b216
mov dword [ebp - 0x1c], edi
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ecx, eax
mov dword [ebp - 0x20], ecx
test ecx, ecx
je 0x10001812
push ebx
xor edx, edx
push esi
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x18], edx
cmp dword [edx + eax], 0
je 0x10001810
xor eax, eax
mov byte [edi], 0
xor ebx, ebx
cmp ax, word [ecx + 0xa]
jge 0x10001808
test ebx, ebx
jle 0x100017ab
dec edi
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x10001795
mov ax, word [0x1000b218]
mov word [edi], ax
mov edi, dword [ebp - 0x1c]
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edx]
movzx eax, byte [eax + ebx]
push eax
lea eax, [ebp - 0x14]
push 0x1000b21c
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea edx, [ebp - 0x14]
add esp, 0xc
mov esi, edx
lea ecx, [ecx]
mov al, byte [edx]
inc edx
test al, al
jne 0x100017d0
sub edx, esi
dec edi
lea ebx, [ebx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x100017e0
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, dword [ebp - 0x18]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x20]
mov edi, dword [ebp - 0x1c]
movsx eax, word [ecx + 0xa]
inc ebx
cmp ebx, eax
jl 0x10001790
add edx, 4
jmp 0x10001773
pop esi
pop ebx
mov ecx, dword [ebp - 4]
mov eax, edi
xor ecx, ebp
pop edi
call fcn.10003014
mov esp, ebp
pop ebp
ret
Function at 0x10001ac0
Capabilities:
Create thread
Send data
Send data on socket
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x1000e1d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
push 0xff
mov dword [ebp - 0x110], eax
lea eax, [ebp - 0x103]
push 0
push eax
mov byte [ebp - 0x104], 0
call fcn.100036b0
add esp, 0xc
mov dword [ebp - 0x108], 0
push 0x1000f00c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [0x1000f024]
push 0x1000f00c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea eax, [ebp - 0x10c]
push eax
push edi
mov dword [ebp - 0x10c], 0
call fcn.10001210
add esp, 8
test eax, eax
jne 0x10001b55
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003014
mov esp, ebp
pop ebp
ret
push ebx
cmp eax, 1
je 0x10001be1
cmp eax, 2
je 0x10001be1
cmp eax, 3
je 0x10001be1
cmp eax, 4
jne 0x10001c65
mov ecx, dword [ebp - 0x10c]
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x104]
push eax
mov eax, dword [ebp + 0x14]
sub eax, ecx
push eax
lea eax, [edi + ecx]
push eax
call fcn.100016e0
push dword [ebp - 0x108]
lea eax, [ebp - 0x104]
push eax
lea eax, [esi + 4]
push eax
call fcn.100012b0
add esp, 0x1c
test eax, eax
je 0x10001cac
mov ecx, str.HTTP_1.0_200_OK_r_n_r_n
lea edx, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10001bc0
sub ecx, edx
push 0
lea eax, [ecx + 1]
push eax
push str.HTTP_1.0_200_OK_r_n_r_n
push dword [esi]
call dword [sym.imp.WS2_32.dll_send]
jmp 0x10001c65
push dword [ebp - 0x10c]
mov ebx, dword [ebp + 0x14]
push ebx
push edi
push dword [ebp - 0x110]
call fcn.10001830
add esp, 0x10
mov dword [ebp - 0x114], eax
test eax, eax
je 0x10001cac
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x104]
push eax
mov eax, dword [ebp - 0x10c]
sub ebx, eax
sub ebx, 7
add edi, 7
add eax, edi
push ebx
push eax
call fcn.100016e0
push dword [ebp - 0x108]
lea eax, [ebp - 0x104]
push eax
lea edi, [esi + 4]
push edi
call fcn.100012b0
add esp, 0x1c
test eax, eax
je 0x10001cac
push 0
push dword [ebp - 0x114]
push dword [ebp - 0x110]
push dword [edi]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x10001cac
cmp dword [esi], 0
je 0x10001cac
cmp dword [esi + 4], 0
je 0x10001cac
lea eax, [ebp - 0x118]
push eax
push 0
push esi
push 0x10001e50
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x10001c96
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop ebx
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003014
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop ebx
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.10003014
mov esp, ebp
pop ebp
ret
Function at 0x10001cc0
Capabilities:
Create tcp socket
Create thread
Initialize winsock library
Start tcp server

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a8
mov eax, dword [0x1000e1d0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1a4]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x10001cf9
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003014
mov esp, ebp
pop ebp
ret
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x1000ee00], eax
cmp eax, 0xffffffff
je 0x10001ce9
mov eax, 2
mov word [ebp - 0x14], ax
movzx eax, word [0x1000ee04]
xorps xmm0, xmm0
push eax
movq qword [ebp - 0x12], xmm0
mov dword [ebp - 0xa], 0
mov word [ebp - 6], 0
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
push 0x10
lea eax, [ebp - 0x14]
push eax
push dword [0x1000ee00]
mov dword [ebp - 0x10], 0
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x10001ce9
push 0x32
push dword [0x1000ee00]
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x10001ce9
push dword [0x1000ee04]
push str.Now_listening_on_port:__d_r_n
call fcn.10002e81
add esp, 8
cmp dword [0x1000f008], 0
je 0x10001e2d
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push 0
push 0
push dword [0x1000ee00]
call dword [sym.imp.WS2_32.dll_accept]
cmp dword [0x1000f008], 0
mov esi, eax
je 0x10001e2a
push str.Accepting_New_Requests_n
call fcn.10002e81
push 8
call fcn.10002f82
add esp, 8
test eax, eax
jne 0x10001de5
push str.Fail_To_Allocate_Ram_n
call fcn.10002e81
add esp, 4
jmp 0x10001e1d
lea ecx, [ebp - 0x1a8]
push ecx
push 0
push eax
push 0x10002770
push 0
push 0
mov dword [eax], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x10001e1a
push str.Fail_To_Create_Thread.Probably_Too_Many_Threads_Have_Been_Created_n
call fcn.10002e81
add esp, 4
push 0x3e8
call edi
jmp 0x10001e1d
push eax
call ebx
cmp dword [0x1000f008], 0
jne 0x10001da3
pop esi
pop edi
pop ebx
push 0x1000b35c
call fcn.10002e81
mov ecx, dword [ebp - 4]
xor ecx, ebp
add esp, 4
mov eax, 1
call fcn.10003014
mov esp, ebp
pop ebp
ret