joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100113c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push esi
push edi
mov edi, eax
call fcn.10014ab0
mov esi, eax
test esi, esi
je 0x10011448
mov al, 0x61
mov byte [esp + 0x15], al
mov byte [esp + 9], al
mov al, 0x65
mov cl, 0x46
mov byte [esp + 0x17], al
mov byte [esp + 0x13], al
lea eax, [esp + 8]
mov byte [esp + 0xc], cl
mov byte [esp + 0x10], cl
mov cl, 0x69
push eax
push esi
mov byte [esp + 0x12], 0x74
mov byte [esp + 0x19], cl
mov byte [esp + 0x1e], 0x6d
mov byte [esp + 0x17], 0x64
mov byte [esp + 0x16], 0x6e
mov byte [esp + 0x1c], 0x4e
mov byte [esp + 0x10], 0x50
mov byte [esp + 0x15], cl
mov byte [esp + 0x1a], 0x6c
mov byte [esp + 0x13], 0x68
mov byte [esp + 0x21], 0
mov byte [esp + 0x20], 0x41
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10011441
push edi
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
pop edi
pop esi
add esp, 0x14
ret
Function at 0x10012870
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0xc
push esi
lea eax, [esp + 4]
push eax
xor esi, esi
mov byte [esp + 0xf], 0x73
mov byte [esp + 0x11], 0
mov byte [esp + 8], 0x46
mov byte [esp + 0x10], 0x65
mov byte [esp + 0xd], 0x6c
mov byte [esp + 0xc], 0x43
mov byte [esp + 0xb], 0x64
mov byte [esp + 0xa], 0x6e
mov byte [esp + 0xe], 0x6f
mov byte [esp + 9], 0x69
call fcn.10013200
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100128c9
mov ecx, dword [esp + 0x14]
push ecx
call eax
pop esi
add esp, 0xc
ret
mov eax, esi
pop esi
add esp, 0xc
ret

Function at 0x10012960
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x1001465c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x70]
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov ecx, 1
mov dword [esp + 0x68], ecx
mov eax, 0xf
lea ebp, [edi + 4]
mov dword [edi + 0x18], eax
mov dword [edi + 0x14], ebx
mov byte [ebp], bl
cmp dword [esp + 0x88], ebx
mov dword [esp + 0x14], ecx
jle 0x10012a9f
push 0xffffffffffffffff
mov dword [esp + 0x44], eax
push ebx
lea eax, [esp + 0x7c]
push eax
lea ecx, [esp + 0x34]
mov dword [esp + 0x48], ebx
mov byte [esp + 0x38], bl
call fcn.10002800
mov byte [esp + 0x68], 2
mov eax, dword [esp + 0x3c]
cmp eax, ebx
mov dword [esp + 0x1c], eax
jle 0x10012a8b
push ebx
lea esi, [esp + 0x48]
lea ecx, [esp + 0x2c]
call fcn.10001ac0
mov byte [esp + 0x68], 3
cmp dword [esp + 0x5c], 0x10
mov eax, dword [esp + 0x48]
jae 0x10012a05
lea eax, [esp + 0x48]
push eax
call fcn.100128d0
mov edx, dword [edi + 0x18]
add esp, 4
mov byte [esp + 0x18], al
cmp edx, 0x10
jb 0x10012a1f
mov eax, dword [ebp]
jmp 0x10012a21
mov eax, ebp
mov ecx, dword [edi + 0x14]
lea esi, [ecx + eax]
test esi, esi
je 0x10012a4d
cmp edx, 0x10
jb 0x10012a35
mov eax, dword [ebp]
jmp 0x10012a37
mov eax, ebp
cmp eax, esi
ja 0x10012a4d
cmp edx, 0x10
jb 0x10012a45
mov eax, dword [ebp]
jmp 0x10012a47
mov eax, ebp
add ecx, eax
cmp esi, ecx
jbe 0x10012a52
call fcn.10004fea
mov ecx, dword [esp + 0x18]
push esi
push edi
push ecx
lea edx, [esp + 0x2c]
push edx
mov eax, edi
call fcn.10002910
mov byte [esp + 0x68], 2
cmp dword [esp + 0x5c], 0x10
jb 0x10012a7e
mov eax, dword [esp + 0x48]
push eax
call fcn.10004a40
add esp, 4
add ebx, 2
cmp ebx, dword [esp + 0x1c]
jl 0x100129e3
cmp dword [esp + 0x40], 0x10
jb 0x10012a9f
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.10004a40
add esp, 4
cmp dword [esp + 0x8c], 0x10
jb 0x10012ab6
mov edx, dword [esp + 0x78]
push edx
call fcn.10004a40
add esp, 4
mov ecx, dword [esp + 0x60]
mov eax, edi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x5c
ret 0x20
Function at 0x10012b20
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10014745
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, dword [esp + 0x1c]
push 4
call fcn.100050ee
xor edx, edx
add esp, 4
cmp eax, edx
je 0x10012b51
mov dword [eax], esi
jmp 0x10012b53
xor eax, eax
mov dword [esi], eax
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], edx
mov dword [esi + 0x14], edx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x24], esp
mov dword [esp + 0x30], 1
push edx
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], edx
push 0x100174a8
mov byte [ecx + 4], dl
call fcn.10002cb0
mov ecx, esi
call fcn.10003750
mov ecx, dword [esp + 0xc]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0x14
ret 4
Function at 0x10012c10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x4c
mov al, 0x64
push ebp
mov byte [esp + 0x25], al
mov byte [esp + 0x1d], al
push esi
lea eax, [esp + 0x20]
push eax
mov byte [esp + 0x2f], 0x6c
mov byte [esp + 0x2e], 0x6c
mov byte [esp + 0x26], 0x76
mov byte [esp + 0x28], 0x70
mov byte [esp + 0x30], 0
mov byte [esp + 0x2a], 0x33
mov byte [esp + 0x24], 0x41
mov byte [esp + 0x29], 0x69
mov byte [esp + 0x2b], 0x32
mov byte [esp + 0x27], 0x61
mov byte [esp + 0x2c], 0x2e
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x10012d67
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [esp + 0x38]
mov bl, 0x65
push ecx
push esi
mov byte [esp + 0x42], 0x67
mov byte [esp + 0x45], bl
mov byte [esp + 0x4d], 0
mov byte [esp + 0x46], 0x6e
mov byte [esp + 0x43], 0x4f
mov byte [esp + 0x4c], 0x41
mov byte [esp + 0x49], 0x79
mov byte [esp + 0x48], bl
mov byte [esp + 0x40], 0x52
mov byte [esp + 0x47], 0x4b
mov byte [esp + 0x4a], 0x45
mov byte [esp + 0x4b], 0x78
mov byte [esp + 0x44], 0x70
mov byte [esp + 0x41], bl
call edi
lea edx, [esp + 0x48]
mov dword [esp + 0x14], eax
mov al, 0x75
push edx
push esi
mov byte [esp + 0x59], 0x61
mov byte [esp + 0x58], 0x56
mov byte [esp + 0x56], 0x72
mov byte [esp + 0x5e], 0x78
mov byte [esp + 0x53], 0x51
mov byte [esp + 0x5c], bl
mov byte [esp + 0x55], bl
mov byte [esp + 0x52], 0x67
mov byte [esp + 0x5a], 0x6c
mov byte [esp + 0x57], 0x79
mov byte [esp + 0x5f], 0x41
mov byte [esp + 0x60], 0
mov byte [esp + 0x5d], 0x45
mov byte [esp + 0x50], 0x52
mov byte [esp + 0x54], al
mov byte [esp + 0x51], bl
mov byte [esp + 0x5b], al
call edi
mov ebp, eax
lea eax, [esp + 0x1c]
push eax
push esi
mov byte [esp + 0x25], bl
mov byte [esp + 0x24], 0x52
mov byte [esp + 0x2c], 0x4b
mov byte [esp + 0x2b], bl
mov byte [esp + 0x28], 0x6c
mov byte [esp + 0x2a], 0x73
mov byte [esp + 0x2d], bl
mov byte [esp + 0x2e], 0x79
mov byte [esp + 0x27], 0x43
mov byte [esp + 0x29], 0x6f
mov byte [esp + 0x26], 0x67
mov byte [esp + 0x2f], 0
call edi
pop edi
mov esi, eax
pop ebx
jmp 0x10012d6f
mov ebp, dword [esp + 0xc]
mov esi, dword [esp + 0xc]
mov edx, dword [esp + 0x58]
lea ecx, [esp + 8]
push ecx
push 0xf013f
push 0
push edx
push 0x80000002
call dword [esp + 0x20]
test eax, eax
jne 0x10012db9
mov ecx, dword [esp + 0x60]
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0x60]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
push 0
push eax
push ecx
mov dword [esp + 0x24], 0x190
call ebp
mov edx, dword [esp + 8]
push edx
call esi
pop esi
mov al, 1
pop ebp
add esp, 0x4c
ret
Function at 0x10012dd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x10014621
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x70]
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov ecx, 1
mov dword [esp + 0x68], ecx
mov eax, 0xf
lea ebp, [edi + 4]
mov dword [edi + 0x18], eax
mov dword [edi + 0x14], ebx
mov byte [ebp], bl
cmp dword [esp + 0x88], ebx
mov dword [esp + 0x14], ecx
jle 0x10012f0f
push 0xffffffffffffffff
mov dword [esp + 0x44], eax
push ebx
lea eax, [esp + 0x7c]
push eax
lea ecx, [esp + 0x34]
mov dword [esp + 0x48], ebx
mov byte [esp + 0x38], bl
call fcn.10002800
mov byte [esp + 0x68], 2
mov eax, dword [esp + 0x3c]
cmp eax, ebx
mov dword [esp + 0x1c], eax
jle 0x10012efb
push ebx
lea esi, [esp + 0x48]
lea ecx, [esp + 0x2c]
call fcn.10001ac0
mov byte [esp + 0x68], 3
cmp dword [esp + 0x5c], 0x10
mov eax, dword [esp + 0x48]
jae 0x10012e75
lea eax, [esp + 0x48]
push eax
call fcn.100128d0
mov edx, dword [edi + 0x18]
add esp, 4
mov byte [esp + 0x18], al
cmp edx, 0x10
jb 0x10012e8f
mov eax, dword [ebp]
jmp 0x10012e91
mov eax, ebp
mov ecx, dword [edi + 0x14]
lea esi, [ecx + eax]
test esi, esi
je 0x10012ebd
cmp edx, 0x10
jb 0x10012ea5
mov eax, dword [ebp]
jmp 0x10012ea7
mov eax, ebp
cmp eax, esi
ja 0x10012ebd
cmp edx, 0x10
jb 0x10012eb5
mov eax, dword [ebp]
jmp 0x10012eb7
mov eax, ebp
add ecx, eax
cmp esi, ecx
jbe 0x10012ec2
call fcn.10004fea
mov ecx, dword [esp + 0x18]
push esi
push edi
push ecx
lea edx, [esp + 0x2c]
push edx
mov eax, edi
call fcn.10002910
mov byte [esp + 0x68], 2
cmp dword [esp + 0x5c], 0x10
jb 0x10012eee
mov eax, dword [esp + 0x48]
push eax
call fcn.10004a40
add esp, 4
add ebx, 2
cmp ebx, dword [esp + 0x1c]
jl 0x10012e53
cmp dword [esp + 0x40], 0x10
jb 0x10012f0f
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.10004a40
add esp, 4
cmp dword [esp + 0x8c], 0x10
jb 0x10012f26
mov edx, dword [esp + 0x78]
push edx
call fcn.10004a40
add esp, 4
mov ecx, dword [esp + 0x60]
mov eax, edi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x5c
ret
Function at 0x10012f40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x2c
push ebx
push ebp
mov bl, 0x73
lea eax, [esp + 0x1c]
push esi
push eax
xor ebp, ebp
mov byte [esp + 0x2b], 0x50
mov byte [esp + 0x31], bl
mov byte [esp + 0x2c], 0x72
mov byte [esp + 0x26], 0x32
mov byte [esp + 0x28], 0x6e
mov byte [esp + 0x39], 0
mov byte [esp + 0x30], bl
mov byte [esp + 0x2d], 0x6f
mov byte [esp + 0x2a], 0x6d
mov byte [esp + 0x32], 0x4d
mov byte [esp + 0x29], 0x75
mov byte [esp + 0x25], 0x33
mov byte [esp + 0x2e], 0x63
mov byte [esp + 0x36], 0x6c
mov byte [esp + 0x34], 0x64
mov byte [esp + 0x38], bl
mov byte [esp + 0x37], 0x65
mov byte [esp + 0x35], 0x75
mov byte [esp + 0x24], 0x4b
mov byte [esp + 0x33], 0x6f
mov byte [esp + 0x27], 0x45
mov byte [esp + 0x2f], 0x65
call fcn.10013200
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
test eax, eax
je 0x10012fe9
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
push ecx
mov ecx, dword [esp + 0x40]
push 0x400000
push edx
push ecx
call eax
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
push edi
call fcn.10012ad0
mov edi, eax
test edi, edi
je 0x10013080
lea edx, [esp + 0x10]
push edx
push edi
mov byte [esp + 0x18], 0x45
mov byte [esp + 0x1e], 0x6f
mov byte [esp + 0x25], 0x64
mov byte [esp + 0x22], bl
mov byte [esp + 0x29], bl
mov byte [esp + 0x21], bl
mov byte [esp + 0x27], 0x6c
mov byte [esp + 0x24], 0x6f
mov byte [esp + 0x1a], 0x75
mov byte [esp + 0x28], 0x65
mov byte [esp + 0x2a], 0
mov byte [esp + 0x19], 0x6e
mov byte [esp + 0x1b], 0x6d
mov byte [esp + 0x26], 0x75
mov byte [esp + 0x1d], 0x72
mov byte [esp + 0x1f], 0x63
mov byte [esp + 0x1c], 0x50
mov byte [esp + 0x20], 0x65
mov byte [esp + 0x23], 0x4d
call esi
test eax, eax
je 0x10013079
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x44]
push 0x400000
push edx
push ecx
call eax
mov ebp, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x2c
ret

Function at 0x10013260
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
mov al, 0x6f
mov byte [esp + 0x16], al
mov byte [esp + 8], al
mov byte [esp + 7], al
mov dl, 0x68
mov al, 0x6c
mov cl, 0x65
mov byte [esp + 9], al
mov byte [esp + 0xc], al
push esi
mov byte [esp + 0x19], dl
mov byte [esp + 0xe], dl
mov dl, 0x70
lea eax, [esp + 4]
push eax
or esi, 0xffffffff
mov byte [esp + 0x20], 0
mov byte [esp + 0x1c], 0x73
mov byte [esp + 0x17], 0x32
mov byte [esp + 0x1f], 0x74
mov byte [esp + 0xe], 0x54
mov byte [esp + 0xb], 0x61
mov byte [esp + 0xa], cl
mov byte [esp + 0x1a], 0x61
mov byte [esp + 9], 0x72
mov byte [esp + 0x16], 0x33
mov byte [esp + 8], 0x43
mov byte [esp + 0x13], cl
mov byte [esp + 0x18], 0x53
mov byte [esp + 0x1b], dl
mov byte [esp + 0xd], cl
mov byte [esp + 0x19], 0x6e
mov byte [esp + 0xc], 0x74
mov byte [esp + 0x15], dl
call fcn.10013200
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10013302
push 0
push 2
call eax
pop esi
add esp, 0x1c
ret
mov eax, esi
pop esi
add esp, 0x1c
ret
Function at 0x10013310
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov cl, 0x74
mov al, 0x65
mov byte [esp + 0xc], al
mov byte [esp + 1], al
mov byte [esp + 7], al
push esi
mov byte [esp + 0x12], cl
mov dl, 0x72
mov byte [esp + 0xa], cl
mov byte [esp + 6], cl
mov cl, 0x79
lea eax, [esp + 4]
push eax
xor esi, esi
mov byte [esp + 0x15], 0x63
mov byte [esp + 0x11], 0x44
mov byte [esp + 0x13], dl
mov byte [esp + 0x10], 0x6d
mov byte [esp + 0xc], cl
mov byte [esp + 0xb], 0x53
mov byte [esp + 0x18], dl
mov byte [esp + 8], 0x47
mov byte [esp + 0x1a], 0x41
mov byte [esp + 0x1b], 0
mov byte [esp + 0x12], 0x69
mov byte [esp + 0xd], 0x73
mov byte [esp + 0x17], 0x6f
mov byte [esp + 0x19], cl
call fcn.10013200
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001339e
mov ecx, dword [esp + 0x1c]
push 0x104
push ecx
call eax
pop esi
add esp, 0x14
ret
mov eax, esi
pop esi
add esp, 0x14
ret

Function at 0x10013600
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push esi
push edi
xor edi, edi
call fcn.10013800
mov esi, eax
test esi, esi
je 0x10013677
mov al, 0x65
mov byte [esp + 0x12], al
mov byte [esp + 9], al
mov byte [esp + 0xd], al
lea eax, [esp + 8]
push eax
push esi
mov byte [esp + 0x18], 0x61
mov byte [esp + 0x17], 0x4e
mov byte [esp + 0x1c], 0
mov byte [esp + 0x19], 0x6d
mov byte [esp + 0x14], 0x73
mov byte [esp + 0x12], 0x74
mov byte [esp + 0x16], 0x72
mov byte [esp + 0x10], 0x47
mov byte [esp + 0x1b], 0x41
mov byte [esp + 0x13], 0x55
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10013670
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
push ecx
push edx
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
pop edi
pop esi
add esp, 0x10
ret

Function at 0x100138c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov al, 0x65
mov byte [esp + 8], al
mov byte [esp + 0xc], al
mov byte [esp + 0x10], al
mov byte [esp + 1], al
push esi
mov cl, 0x6c
lea eax, [esp + 4]
push eax
xor esi, esi
mov byte [esp + 0x16], 0x61
mov byte [esp + 0xb], 0x4d
mov byte [esp + 0xf], cl
mov byte [esp + 0x11], 0x46
mov byte [esp + 0xe], 0x75
mov byte [esp + 0xd], 0x64
mov byte [esp + 0xc], 0x6f
mov byte [esp + 0x12], 0x69
mov byte [esp + 0x19], 0x41
mov byte [esp + 8], 0x47
mov byte [esp + 0x1a], 0
mov byte [esp + 0xa], 0x74
mov byte [esp + 0x17], 0x6d
mov byte [esp + 0x13], cl
mov byte [esp + 0x15], 0x4e
call fcn.10013200
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001394e
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
push 0x104
push ecx
push edx
call eax
pop esi
add esp, 0x14
ret
mov eax, esi
pop esi
add esp, 0x14
ret
Function at 0x100822f
Capabilities:
Set socket configuration

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
cmp eax, 0xc0000120
je 0x100835e
cmp dword [edi + 0x20], ecx
jne 0x100835e
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebx + 8]
cmp eax, ecx
je 0x10082bd
cmp eax, 0x3e3
je 0x1008343
cmp eax, 0x2775
je 0x10082a4
cmp eax, 0x2746
je 0x10082a4
cmp eax, 0x274c
je 0x10082a4
cmp eax, 0x2742
je 0x10082a4
cmp eax, 0x2736
je 0x10082a4
cmp eax, 0x274a
je 0x10082a4
cmp eax, 0x2745
jne 0x1008343
cmp esi, 0xffffffff
je 0x10082b0
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, edi
call fcn.01008410
push ebx
jmp 0x1008376
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
add ebx, 0x50
push ebx
mov ecx, edi
call fcn.01007f65
test eax, eax
jl 0x1008331
xor ebx, ebx
cmp dword [ebp - 4], ebx
je 0x1008331
push 4
lea eax, [edi + 0xc]
push eax
push 0x700b
push pe_overlay
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
push 0x6c
call fcn.01006dea
pop ecx
cmp eax, ebx
je 0x100830b
mov ecx, eax
call fcn.01008f00
mov ebx, eax
test ebx, ebx
je 0x1008331
push dword [ebp + 8]
mov ecx, ebx
push dword [ebp - 8]
push dword [ebp - 4]
push esi
call fcn.0100958c
test eax, eax
jl 0x100833d
push ebx
mov ecx, 0x100d6e0
call fcn.01008769
jmp 0x100833d
cmp esi, 0xffffffff
je 0x100833d
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
mov ebx, dword [ebp + 0x10]
or esi, 0xffffffff
push 0
push edi
push 0x1008387
push ebx
push esi
push dword [edi + 0xc]
call fcn.01009bf2
test eax, eax
je 0x100837b
jmp 0x10082a4
mov eax, dword [edi + 0x18]
cmp eax, ecx
je 0x100836c
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, edi
call fcn.0100816e
push dword [ebp + 0x10]
call fcn.01008962
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x1009762
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp byte [0x100d6da], bl
je 0x100977c
mov eax, 0x3eb
jmp 0x1009802
mov ecx, dword [ebp + 0xc]
push esi
test ecx, ecx
jne 0x100979b
push dword [ebp + 0x10]
xor esi, esi
call fcn.010088d2
mov ebx, eax
mov ecx, ebx
test ebx, ebx
jne 0x100979e
push 8
pop eax
jmp 0x1009801
mov esi, dword [ebp + 0x14]
push edi
lea edx, [ecx + 0x18]
xor eax, eax
mov edi, edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp + 0x18]
mov eax, dword [ebp + 8]
and dword [ecx + 0x2c], 0
mov dword [ecx + 0xc], edi
mov edi, dword [ebp + 0x1c]
push edx
mov dword [ecx + 0x10], edi
mov edi, dword [ebp + 0x20]
push 0x100d760
push dword [ebp + 0x10]
mov dword [ecx + 8], eax
mov dword [ecx + 0x14], edi
lea ecx, [ecx + esi + 0x50]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
pop edi
test eax, eax
jne 0x10097fd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x3e5
je 0x10097fd
test ebx, ebx
je 0x10097ff
push ebx
call fcn.01008962
jmp 0x10097ff
xor esi, esi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0x1c
Function at 0x100980c
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp byte [0x100d6da], 0
je 0x1009821
mov eax, 0x3eb
jmp 0x1009877
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x18]
push edi
lea edx, [ecx + 0x18]
xor eax, eax
mov edi, edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov dword [ecx + 0xc], esi
mov esi, dword [ebp + 0x1c]
push edx
mov edx, dword [ebp + 0x14]
mov dword [ecx + 0x10], esi
mov esi, dword [ebp + 0x20]
push 0x100d760
push dword [ebp + 0x10]
mov dword [ecx + 8], eax
mov dword [ecx + 0x14], esi
lea ecx, [ecx + edx + 0x50]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
test eax, eax
jne 0x1009875
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x1009877
xor eax, eax
pop ebp
ret 0x1c

Function at 0x10098e8
Capabilities:
Create tcp socket
Set socket configuration

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x100d258]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
push dword [ebp + 0xc]
mov dword [ebp - 0x90], eax
call dword [sym.imp.WS2_32.dll_ntohs]
xor eax, eax
push 0x7e
mov word [ebp - 0x84], ax
xor esi, esi
lea eax, [ebp - 0x82]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 1
push esi
push esi
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_WSASocketW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x1009952
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
jmp 0x10099e8
push edi
push esi
push 0x100973c
push ebx
call dword [sym.imp.KERNEL32.dll_BindIoCompletionCallback]
push 4
lea eax, [ebp - 0x88]
push eax
push 0x1001
mov edi, pe_overlay
push edi
mov dword [ebp - 0x88], esi
mov esi, dword [sym.imp.WS2_32.dll_setsockopt]
push ebx
call esi
and dword [ebp - 0x88], 0
push 4
lea eax, [ebp - 0x88]
push eax
push 0x1002
push edi
push ebx
call esi
mov eax, dword [ebp + 8]
pop edi
cmp eax, 0xffffffff
je 0x10099ec
push dword [ebp + 0xc]
mov dword [ebp - 0x8c], eax
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.01009880
push 0x80
lea eax, [ebp - 0x84]
push eax
push ebx
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x10099ec
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push ebx
mov esi, eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, esi
jmp 0x10099f6
mov eax, dword [ebp - 0x90]
mov dword [eax], ebx
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0100736d
leave
ret 0xc
Function at 0x4245a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b1bc5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push 0x1c
call fcn.0048de18
add esp, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0
je 0x4245e6
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.00424ef0
mov dword [ebp - 0x20], eax
jmp 0x4245ed
mov dword [ebp - 0x20], 0
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x10], edx
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
push 0x4244a0
push 0
push 0
call fcn.0048f50f
add esp, 0x18
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x424630
mov ecx, dword [ebp - 0x14]
push ecx
call dword [0x4ba020]
mov al, 1
jmp 0x424632
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x480190
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x270
jne 0x4801ae
mov ecx, dword [ebp - 8]
call fcn.00480e10
jmp 0x4801c1
mov ecx, dword [ebp - 8]
cmp dword [ecx], 0x4e0
jb 0x4801c1
mov ecx, dword [ebp - 8]
call fcn.00480cc0
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4 + 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
add ecx, 1
mov edx, dword [ebp - 8]
mov dword [edx], ecx
mov eax, dword [ebp - 4]
shr eax, 0xb
mov ecx, dword [ebp - 8]
and eax, dword [ecx + 0x1384]
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
shl edx, 7
and edx, 0x9d2c5680
xor edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
shl eax, 0xf
and eax, 0xefc60000
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
shr ecx, 0x12
xor ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret