joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43a334
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret

Function at 0x43f61c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x43f67e
call fcn.0043f5cc
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.0043a900
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.0043a900
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x43f6dc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x446e88], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x43f7b6
cmp dword [0x446e84], 0
jne 0x43f7b6
cmp dword [0x447078], 0
je 0x43f770
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.0043f520
add esp, 8
mov ebx, eax
test eax, eax
jne 0x43f756
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.0043f520
add esp, 8
mov ebx, eax
test eax, eax
jne 0x43f756
lea ebx, [ebp - 0x84]
jmp 0x43f757
inc ebx
call fcn.0043f698
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x43f7f1
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x446e8c
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.0043a900
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x446e8f
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x43f7f1
cmp dword [0x446e84], 0
je 0x43f7d0
cmp dword [0x446e84], 0xffffffff
je 0x43f7f1
push esi
call dword [0x446e84]
pop ecx
mov eax, dword [0x446e88]
test eax, eax
je 0x43f7f1
cmp dword [0x446e88], 0xffffffff
je 0x43f7f1
cmp byte [eax], 0
je 0x43f7f1
push esi
push eax
call fcn.0043f61c
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403ee7
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [esi], edi
je 0x403f16
cmp dword [esi + 4], edi
jbe 0x403f0f
mov eax, dword [esi]
mov eax, dword [eax + edi*8]
test eax, eax
je 0x403f09
push eax
call fcn.004301e8
inc edi
cmp edi, dword [esi + 4]
jb 0x403efa
push dword [esi]
call fcn.004324f6
push ebx
xor ebx, ebx
mov edi, 0xe0
cmp dword [esi + 8], ebx
je 0x403f48
cmp dword [esi + 0xc], ebx
jbe 0x403f40
mov dword [ebp + 8], ebx
mov eax, dword [esi + 8]
add eax, dword [ebp + 8]
push eax
call fcn.00403e14
add dword [ebp + 8], edi
inc ebx
cmp ebx, dword [esi + 0xc]
jb 0x403f2b
push dword [esi + 8]
call fcn.004324f6
xor ebx, ebx
cmp dword [esi + 0x10], ebx
je 0x403f74
cmp dword [esi + 0x14], ebx
jbe 0x403f6c
and dword [ebp + 8], ebx
mov eax, dword [esi + 0x10]
add eax, dword [ebp + 8]
push eax
call fcn.00403e14
add dword [ebp + 8], edi
inc ebx
cmp ebx, dword [esi + 0x14]
jb 0x403f57
push dword [esi + 0x10]
call fcn.004324f6
xor edi, edi
pop ebx
cmp dword [esi + 0x18], edi
je 0x403f9f
cmp dword [esi + 0x1c], edi
jbe 0x403f97
mov eax, dword [esi + 0x18]
mov eax, dword [eax + edi*8]
test dword [edi + 0x65], eax
je 0x403fb9
push ebp
outsb dx, byte [esi]
imul ebp, dword [esi + 0x73], 0x6c6c6174
push edx
imul esi, dword gs:[bp + di + 0x74], 0x654b7972
imul esi, dword [bp + di + 0x74], 0x654b7972
jns 0x403fcf
jo 0x404016
xor dword [eax], eax
add byte [eax], al
add byte [eax], al
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [ecx], al
add byte [ecx + 0x40], al
add byte [eax], al
add byte [esi + 0x2e000011], dh
adc dword [eax], eax
add byte [esi], ch
adc al, 0
add byte [0x516aede9], bl
cmp edi, dword [eax]
pop esp
add dword [edi - 0x7e818284], 0x383b8177
dec esi
dec esi
dec esi
cmp dword [ebx], 0x4e4e4e38
dec esi
adc byte [ebx - 0x6c685f5e], 0xa4
xchg ebx, eax
dec esi
mov al, byte [0xa1979593]
mov byte [0x994ea7a0], al
xchg ebx, eax
cmpsd dword [esi], dword es:[edi]
push esi
mov eax, dword [0x9d944e57]
mov al, byte [0xa1a7a14e]
mov byte [0x975b9b93], al
pushfd
mov eax, dword [0x9a9a8fa2]
xchg ebx, eax
xchg edx, eax
dec esi
invalid
invalid

Function at 0x404d1e
Capabilities:
Authenticate hmac

Disassembly:
xchg ebx, eax
lcall 0x907d, 0x5ba29193
cwde
xchg ebx, eax
xchg ecx, eax
mov byte [0xa6735b4e], al
sahf
invalid

Function at 0x405873
Capabilities:
Authenticate hmac

Disassembly:
dec esi
push esi
pop eax
push edi
push eax
cmp edi, dword [eax]
dec esi
dec esi
dec esi
dec esi
push edx
cdq
xchg ebx, eax
cmpsd dword [esi], dword es:[edi]
pop esp
sbb dword [edi + edx*4 - 0x705d5e64], 0xffffff9a
lcall 0x959c, 0x97a0a281
cmp edi, dword [eax]
cmp edi, dword [eax]
dec esi
dec esi
dec esi
dec esi
test byte [ebx - 0x62685e60], dl
pushfd
dec esi
wait
invalid
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x432072
nop
nop
nop
mov ebx, 0x40c7d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x3554477b
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x432060
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4320d2
nop
nop
mov ebx, 0x42f314
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x5f641fae
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
loop 0x4320c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43200c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x419a4c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x419a52
ret

Function at 0x430010
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
ret
Function at 0x44f874
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x48d768
mov eax, esi
mov edx, 8
test al, 1
je 0x44f890
shr eax, 1
xor eax, 0xedb88320
jmp 0x44f892
shr eax, 1
dec edx
jne 0x44f883
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x44f87c
pop esi
ret

Function at 0x44f8bf
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x48d764], 0
jne 0x44f8cb
call fcn.0044f874
push 1
push 0x48d764
call fcn.0040589c
mov eax, edi
test esi, esi
je 0x44f8f6
mov edx, ebx
and dx, 0xff
xor ecx, ecx
mov cl, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x48d768]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x44f8d1
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x1002812
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x101a258]
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 0xc]
inc esi
test eax, eax
mov dword [ebp + 0xc], eax
jne 0x1002836
xor esi, esi
jmp 0x1002896
xor eax, eax
cmp edi, eax
je 0x1002896
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 8]
push eax
push edi
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
test esi, esi
jne 0x1002884
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x1002880
push 1
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov esi, eax
test esi, esi
je 0x100288c
sub edi, dword [ebp + 8]
add ebx, dword [ebp + 8]
jmp 0x1002892
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
jne 0x1002836
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x1002958
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [0x101a258]
push ebx
push edi
xor edi, edi
xor ebx, ebx
cmp ecx, edi
je 0x1002a28
cmp dword [ebp + 0x10], edi
je 0x1002a31
mov eax, dword [0x101a25c]
cmp eax, edi
push esi
jne 0x10029e7
mov eax, dword [ebp + 0x18]
push 0x1011bd0
push 0x101a25c
push 0x640
push 0x1019c10
push ecx
mov dword [0x1011be0], eax
mov dword [0x1011bd8], edi
mov dword [0x1011bdc], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call esi
cmp eax, 0x3e5
jne 0x10029c8
xor edi, edi
jmp 0x1002a27
test edi, edi
jne 0x10029d6
call esi
and dword [0x101a25c], edi
jmp 0x1002a20
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [0x101a25c]
test eax, eax
je 0x1002a20
mov ebx, dword [ebp + 0xc]
cmp eax, ebx
jae 0x10029f0
mov ebx, eax
mov esi, dword [0x101a260]
mov edi, dword [ebp + 8]
mov ecx, ebx
mov eax, ecx
shr ecx, 2
lea esi, [esi + 0x1019c10]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
add dword [0x101a260], ebx
sub dword [0x101a25c], ebx
push 1
pop edi
jne 0x1002a27
and dword [0x101a260], 0
pop esi
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x1002a31
mov dword [eax], ebx
mov eax, edi
pop edi
pop ebx
pop ebp
ret 0x14
Function at 0x1002c14
Capabilities:
Create udp socket

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x908
mov eax, dword [0x10119e4]
mov dword [ebp - 4], eax
mov eax, dword [0x10119c0]
cmp eax, 0xffffffff
jne 0x1002c5b
push 0
push 2
push 2
call dword [sym.imp.WSOCK32.dll_socket]
cmp eax, 0xffffffff
mov dword [0x10119c0], eax
jne 0x1002c5b
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov eax, dword [0x10119c0]
cmp eax, 0xffffffff
je 0x1002d1a
and dword [ebp - 0x900], 0
lea ecx, [ebp - 0x904]
push ecx
lea ecx, [ebp - 0x900]
push ecx
push 0x2003
push 0xffff
push eax
mov dword [ebp - 0x904], 4
call dword [sym.imp.WSOCK32.dll_getsockopt]
mov eax, dword [ebp - 0x900]
mov ecx, 0x8000
cmp eax, ecx
jb 0x1002c9c
mov eax, ecx
shr eax, 2
shl eax, 2
cmp eax, 0x80
mov dword [ebp - 0x900], eax
jae 0x1002cb8
and dword [0x10119c4], 0
jmp 0x1002cc5
cmp eax, dword [0x10119c4]
jae 0x1002cc5
mov dword [0x10119c4], eax
lea eax, [ebp - 0x908]
push eax
push 0x8f8
lea eax, [ebp - 0x8fc]
push eax
push 6
push 0xffffffffffffffff
push 0
call sub.WINSTA.dll_WinStationQueryInformationW
test al, al
je 0x1002d14
cmp dword [ebp - 0x454], 2
movzx eax, byte [ebp - 0x458]
mov dword [0x10119c8], eax
jne 0x1002d1a
lea eax, [ebp - 0x450]
push eax
call fcn.010025a8
cmp eax, 0xffffffff
je 0x1002d1a
mov dword [0x101a2e0], eax
jmp 0x1002d1a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
call fcn.01006d28
leave
ret
Function at 0x1002ea4
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10119e4]
or dword [ebp - 0xc], 0xffffffff
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push eax
push 0x20019
xor edi, edi
push edi
push 0x1002d4e
push closesocket
mov dword [ebp - 0x10], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100304a
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 4
pop eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
push 0x1002de6
push dword [ebp - 0x10]
call esi
test eax, eax
jne 0x1002f13
mov eax, dword [ebp - 0xc]
mov dword [0x10119b4], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
push 0x1002e02
push dword [ebp - 0x10]
call esi
test eax, eax
jne 0x1002f36
mov eax, dword [ebp - 0xc]
mov dword [0x101a2ac], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
push 0x1002e1e
push dword [ebp - 0x10]
call esi
test eax, eax
jne 0x1002f59
mov eax, dword [ebp - 0xc]
mov dword [0x101a2b0], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
push 0x1002e3a
push dword [ebp - 0x10]
call esi
test eax, eax
jne 0x1002f7c
mov eax, dword [ebp - 0xc]
mov dword [0x101a2b4], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
push 0x1002e5a
push dword [ebp - 0x10]
call esi
test eax, eax
jne 0x1002fae
mov eax, dword [ebp - 0xc]
cmp eax, dword [0x10119c4]
jae 0x1002fae
cmp eax, 0x80
jb 0x1002fae
mov dword [0x10119c4], eax
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 0x14]
push eax
push edi
push 0x1002e6e
push dword [ebp - 0x10]
mov dword [ebp - 8], edi
call esi
cmp eax, 0xea
jne 0x1003049
cmp dword [ebp - 0x14], 3
jne 0x1003049
mov eax, dword [0x101a2b8]
cmp eax, edi
push ebx
mov ebx, dword [sym.imp.msvcrt.dll_free]
je 0x1002fe6
push eax
call ebx
pop ecx
mov eax, dword [ebp - 8]
add eax, 7
and eax, 0xfffffffc
push eax
call dword [sym.imp.msvcrt.dll_malloc]
cmp eax, edi
pop ecx
mov dword [0x101a2b8], eax
je 0x1003048
mov ecx, dword [ebp - 8]
add ecx, 3
shr ecx, 2
mov dword [eax + ecx*4], edi
lea eax, [ebp - 8]
push eax
push dword [0x101a2b8]
lea eax, [ebp - 0x14]
push eax
push edi
push 0x1002e86
push dword [ebp - 0x10]
call esi
test eax, eax
je 0x1003040
push dword [0x101a2b8]
call ebx
pop ecx
mov dword [0x101a2b8], edi
mov dword [0x101a2bc], edi
jmp 0x1003048
mov eax, dword [ebp - 8]
mov dword [0x101a2bc], eax
pop ebx
pop esi
cmp dword [ebp - 0x10], edi
pop edi
je 0x1003059
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
call fcn.01006d28
leave
ret
Function at 0x10038fc
Capabilities:
Send data
Send data on socket

Disassembly:
push 0x2c
push 0x10013d0
call fcn.0100704c
mov eax, dword [0x10119e4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
and dword [ebp - 0x38], 0
cmp dword [0x10119c8], 2
jb 0x1003944
push dword [ebp + 0x10]
mov ecx, dword [0x101a2e8]
shl ecx, 8
movzx edx, byte [ebp + 8]
add ecx, edx
push ecx
push eax
call fcn.010026c0
test eax, eax
je 0x1003a4e
and dword [ebp - 4], 0
mov eax, dword [0x10119c4]
add eax, 3
and eax, 0xfffffffc
call fcn.010070b0
mov dword [ebp - 0x18], esp
mov ebx, esp
mov dword [ebp - 0x3c], ebx
jmp 0x1003981
or dword [ebp - 4], 0xffffffff
test ebx, ebx
je 0x1003a4e
cmp dword [0x10119c8], 2
sbb al, al
and al, 0xf9
add al, 9
mov byte [ebx], al
mov ax, word [0x101a28c]
mov word [ebx + 6], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov word [ebx + 4], ax
mov eax, dword [0x101a2e8]
shl eax, 8
movzx ecx, byte [ebp + 8]
add eax, ecx
mov dword [ebx + 8], eax
mov word [ebp - 0x2c], 2
mov ax, word [0x101a2dc]
mov word [ebp - 0x2a], ax
mov eax, dword [0x101a2e0]
mov dword [ebp - 0x28], eax
jmp 0x1003a41
mov ecx, dword [ebp + 0x10]
lea edx, [ecx + 0xc]
mov eax, dword [0x10119c4]
cmp edx, eax
jae 0x10039f1
mov eax, ecx
mov dword [ebp - 0x34], eax
jmp 0x10039f7
add eax, 0xfffffff4
mov dword [ebp - 0x34], eax
lea ecx, [eax + 8]
mov word [ebx + 2], cx
mov ecx, eax
mov esi, dword [ebp - 0x30]
lea edi, [ebx + 0xc]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea esi, [eax + 0xc]
push 0x10
lea eax, [ebp - 0x2c]
push eax
push 0
push esi
push ebx
push dword [0x10119c0]
call dword [sym.imp.WSOCK32.dll_sendto]
cmp eax, 0xffffffff
je 0x1003a64
mov dword [0x101a2c8], esi
mov eax, dword [ebp - 0x34]
sub dword [ebp + 0x10], eax
add dword [ebp - 0x30], eax
cmp dword [ebp + 0x10], 0
jne 0x10039db
mov dword [ebp - 0x38], 1
mov eax, dword [ebp - 0x38]
lea esp, [ebp - 0x48]
mov ecx, dword [ebp - 0x1c]
call fcn.01006d28
call fcn.01007087
ret 0xc
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
jmp 0x1003a4e
Function at 0x1003a72
Capabilities:
Send data
Send data on socket

Disassembly:
push 0x44
push 0x10013e0
call fcn.0100704c
mov eax, dword [0x10119e4]
mov dword [ebp - 0x1c], eax
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x50], esi
and dword [ebp - 0x40], 0
and dword [ebp - 4], 0
mov eax, dword [0x10119c4]
add eax, 3
and eax, 0xfffffffc
call fcn.010070b0
mov dword [ebp - 0x18], esp
mov ebx, esp
mov dword [ebp - 0x54], ebx
or dword [ebp - 4], 0xffffffff
jmp 0x1003ad8
test ebx, ebx
je 0x1003c2e
mov edi, dword [0x10119c4]
add edi, 0xfffffff5
mov dword [ebp - 0x44], edi
mov ecx, dword [ebp + 0x10]
mov eax, ecx
xor edx, edx
div edi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], esi
add esi, ecx
mov dword [ebp - 0x4c], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x48], eax
mov word [ebp - 0x2c], 2
mov ax, word [0x101a2dc]
mov word [ebp - 0x2a], ax
mov eax, dword [0x101a2e0]
mov dword [ebp - 0x28], eax
xor edx, edx
cmp dword [ebp - 0x34], edx
je 0x1003ba6
mov byte [ebx], 0xa
mov al, byte [ebp + 8]
mov byte [ebx + 1], al
mov dword [ebp - 0x38], edx
jbe 0x1003ba6
jmp 0x1003b3e
mov edi, dword [ebp - 0x44]
mov edx, dword [ebp - 0x38]
lea eax, [ebx + 2]
lea ecx, [edi + 3]
mov dword [ebp - 0x3c], ecx
cmp edx, 0x80
jb 0x1003b5d
mov ecx, edx
shr ecx, 8
or cl, 0x80
mov byte [eax], cl
inc eax
inc dword [ebp - 0x3c]
mov byte [eax], dl
mov ecx, edi
mov esi, dword [ebp - 0x30]
lea edi, [eax + 1]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x10
lea eax, [ebp - 0x2c]
push eax
push 0
push dword [ebp - 0x3c]
push ebx
push dword [0x10119c0]
call dword [sym.imp.WSOCK32.dll_sendto]
cmp eax, 0xffffffff
je 0x1003c0d
mov eax, dword [ebp - 0x44]
add dword [ebp - 0x30], eax
inc dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x34]
jb 0x1003b38
mov esi, dword [ebp - 0x4c]
mov byte [ebx], 0xb
mov ax, word [ebp + 0x10]
mov word [ebx + 1], ax
mov ax, word [ebp - 0x48]
mov word [ebx + 3], ax
mov ax, word [0x101a28c]
mov word [ebx + 5], ax
mov eax, dword [0x101a2e8]
shl eax, 8
movzx ecx, byte [ebp + 8]
add eax, ecx
mov dword [ebx + 7], eax
sub esi, dword [ebp - 0x30]
mov eax, esi
mov ecx, eax
mov esi, dword [ebp - 0x30]
lea edi, [ebx + 0xb]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x10
lea ecx, [ebp - 0x2c]
push ecx
push 0
add eax, 0xb
push eax
push ebx
push dword [0x10119c0]
call dword [sym.imp.WSOCK32.dll_sendto]
cmp eax, 0xffffffff
jne 0x1003c15
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
jmp 0x1003c2e
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x34]
lea ecx, [ecx + eax*2]
lea eax, [eax + ecx + 0xb]
mov dword [0x101a2c8], eax
mov dword [ebp - 0x40], 1
mov eax, dword [ebp - 0x40]
lea esp, [ebp - 0x60]
mov ecx, dword [ebp - 0x1c]
call fcn.01006d28
call fcn.01007087
ret 0xc
Function at 0x1004132
Capabilities:
Send data
Send data on socket

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10119e4]
mov dword [ebp - 4], eax
mov byte [ebp - 0x1c], 6
mov word [ebp - 0x1a], 4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [0x10119c0]
and word [ebp - 0x16], 0
cmp edx, 0xffffffff
mov word [ebp - 0x18], ax
je 0x10041a8
mov ecx, dword [0x101a2dc]
test ecx, ecx
je 0x10041a8
mov eax, dword [0x101a2e0]
test eax, eax
je 0x10041a8
push 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 8
lea eax, [ebp - 0x1c]
push eax
push edx
mov word [ebp - 0x14], 2
mov word [ebp - 0x12], cx
call dword [sym.imp.WSOCK32.dll_sendto]
cmp eax, 0xffffffff
jne 0x10041bd
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
jmp 0x10041bd
push 8
lea eax, [ebp - 0x1c]
push eax
call fcn.01002812
test eax, eax
jne 0x10041bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
call fcn.01006d28
leave
ret

Function at 0x100459a
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
cmp dword [0x10119c0], 0xffffffff
je 0x100464d
push ebx
push esi
mov esi, 0x1011b38
mov ebx, 0x1011b50
push edi
xor eax, eax
mov edi, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
xor edi, edi
push edi
push esi
push edi
push edi
mov dword [0x1011b48], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 1
push 0x101a250
push dword [0x10119c0]
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [0x101a250], 0x80
mov dword [0x101a254], ebx
call dword [sym.imp.WS2_32.dll_WSARecvFrom]
cmp eax, edi
mov dword [ebp - 0xc], eax
jne 0x1004637
mov ecx, dword [ebp + 0xc]
cmp ecx, edi
je 0x1004619
mov eax, dword [ebp + 0x10]
cmp eax, edi
jne 0x1004643
cmp dword [ebp - 4], 4
jb 0x10045bc
mov eax, dword [0x1011b50]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x18], 0x1011b54
call fcn.010041cc
cmp dword [ebp - 0xc], 0xffffffff
jne 0x10045bc
jmp 0x100464a
mov dword [ecx], ebx
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
pop edi
pop esi
pop ebx
leave
ret 0xc