joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004a03b
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x1004a048
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.1004a06d

Function at 0x1004d479
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 8]
and dword [esi], 0
mov eax, ebx
sub eax, dword [esi]
push eax
mov eax, dword [ebp + 0xc]
add eax, dword [esi]
push eax
push dword [edi + 0x14]
call fcn.101c4262
add esp, 0xc
test eax, eax
jle 0x1004d4ad
add dword [esi], eax
cmp dword [esi], ebx
jb 0x1004d48b
test eax, eax
jns 0x1004d4cc
call fcn.101ba41b
push dword [eax]
call fcn.101be821
push eax
push 0xffffffffffffffff
push edi
call fcn.1004cd4b
add esp, 0x10
or eax, 0xffffffff
jmp 0x1004d4d9
test eax, eax
jne 0x1004d4d7
mov dword [edi + 0x40], 1
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x10050f8b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
push dword [0x1042bd9c]
push str._s:__s_n
call fcn.101bdd08
add eax, 0x40
push eax
call fcn.101be493
add esp, 0x10
push 1
call fcn.101c1d85
int3

Function at 0x10050fb5
Capabilities:
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4004
call fcn.101c26e0
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 0x4000
push edi
jmp 0x10050fea
test edi, edi
je 0x1005100b
push edi
lea eax, [ebp - 0x4004]
push eax
push dword [ebp + 0xc]
call fcn.1004d8ca
add esp, 0xc
cmp eax, edi
jne 0x1005103f
push esi
push ebx
lea eax, [ebp - 0x4004]
push 1
push eax
call fcn.101b846c
push esi
mov edi, eax
call fcn.101b8281
add esp, 0x14
test eax, eax
je 0x10050fcf
jmp 0x1005102d
push esi
call fcn.101be343
push dword [ebp + 0xc]
call fcn.1004c8f1
pop ecx
pop ecx
test eax, eax
je 0x10051026
push str.failed_gzclose
jmp 0x1005104e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.fread
call fcn.101c547f
pop ecx
push 1
call fcn.101c1d85
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
call fcn.1004ca12
pop ecx
pop ecx
push eax
call fcn.10050f8b
int3

Function at 0x10051054
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4004
call fcn.101c26e0
push ebx
push esi
mov ebx, 0x4000
jmp 0x10051087
push dword [ebp + 0xc]
test esi, esi
je 0x100510b1
push esi
lea eax, [ebp - 0x4004]
push 1
push eax
call fcn.101b8671
add esp, 0x10
cmp eax, esi
jne 0x100510dc
push ebx
lea eax, [ebp - 0x4004]
push eax
push dword [ebp + 8]
call fcn.1004d064
mov esi, eax
add esp, 0xc
test esi, esi
jns 0x1005106a
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.1004ca12
pop ecx
pop ecx
push eax
jmp 0x100510e1
call fcn.101be343
pop ecx
test eax, eax
je 0x100510c2
push str.failed_fclose
jmp 0x100510e1
push dword [ebp + 8]
call fcn.1004c8f1
pop ecx
pop esi
pop ebx
test eax, eax
je 0x100510d8
push str.failed_gzclose
jmp 0x100510e1
mov esp, ebp
pop ebp
ret
push str.failed_fwrite
call fcn.10050f8b
int3
Function at 0x100510e7
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.101baf90
mov ebx, 0x10296470
mov esi, eax
push ebx
call fcn.101baf90
add esi, eax
mov eax, 0x400
pop ecx
pop ecx
cmp esi, eax
jae 0x1005119c
push ebx
push edi
push 0x1029648c
push eax
lea eax, [ebp - 0x400]
push eax
call fcn.101c3b12
push 0x1028eba4
push edi
call fcn.101be47e
mov esi, eax
add esp, 0x1c
test esi, esi
jne 0x1005114b
push edi
call fcn.101c547f
pop ecx
jmp 0x100511b8
push dword [ebp + 0xc]
lea eax, [ebp - 0x400]
push eax
call fcn.1004ca91
pop ecx
pop ecx
test eax, eax
jne 0x10051185
lea eax, [ebp - 0x400]
push eax
push dword [0x1042bd9c]
push str._s:_cant_gzopen__s_n
call fcn.101bdd08
add eax, 0x40
push eax
call fcn.101be493
add esp, 0x10
jmp 0x100511b8
push eax
push esi
call fcn.10050fb5
push edi
call fcn.101c550e
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [0x1042bd9c]
push str._s:_filename_too_long_n
call fcn.101bdd08
add eax, 0x40
push eax
call fcn.101be493
add esp, 0xc
push 1
call fcn.101c1d85
int3

Function at 0x100511c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.101baf90
mov ebx, 0x10296470
mov edi, eax
push ebx
call fcn.101baf90
pop ecx
pop ecx
add eax, edi
mov ecx, 0x400
cmp eax, ecx
jae 0x100512c2
push esi
push 0x10294ef0
push ecx
lea eax, [ebp - 0x404]
push eax
call fcn.101c3b12
add esp, 0x10
cmp edi, 3
jbe 0x10051235
lea eax, [esi - 3]
add eax, edi
push ebx
push eax
call fcn.101ba150
pop ecx
pop ecx
test eax, eax
jne 0x10051235
lea eax, [ebp - 0x404]
mov byte [ebp + edi - 0x407], 0
mov ebx, esi
mov dword [ebp - 4], eax
jmp 0x1005125d
push 0x10296470
mov eax, 0x400
mov dword [ebp - 4], esi
sub eax, edi
lea ebx, [ebp - 0x404]
push 0x10294ef0
push eax
mov eax, ebx
add eax, edi
push eax
call fcn.101c3b12
add esp, 0x10
push 0x1028eba4
push ebx
call fcn.1004ca91
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x1005128f
push ebx
push dword [0x1042bd9c]
push str._s:_cant_gzopen__s_n
call fcn.101bdd08
add eax, 0x40
push eax
call fcn.101be493
add esp, 0x10
jmp 0x100512de
push 0x1028eba8
push dword [ebp - 4]
call fcn.101be47e
pop ecx
pop ecx
test eax, eax
jne 0x100512ab
push esi
call fcn.101c547f
pop ecx
jmp 0x100512de
push eax
push edi
call fcn.10051054
push ebx
call fcn.101c550e
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [0x1042bd9c]
push str._s:_filename_too_long_n
call fcn.101bdd08
add eax, 0x40
push eax
call fcn.101be493
add esp, 0xc
push 1
call fcn.101c1d85
int3
Function at 0x1005bd97
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x10422d10]
sub esp, 0x24
test eax, eax
jne 0x1005bdb8
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x20]
mov dword [0x10422d10], eax
push esi
push edi
push 0x1c
pop edi
xor edx, edx
div edi
push 0x40
mov esi, eax
imul ecx, esi, 0x1c
push 0x1000
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x1005bdf3
test esi, esi
jle 0x1005bdf3
mov ecx, dword [0x10422d0c]
mov dword [eax], ecx
mov ecx, eax
add eax, edi
dec esi
jne 0x1005bde4
mov dword [0x10422d0c], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1006478d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1f0
push dword [ebp + 0x1c]
mov dword [ebp - 8], 1
call fcn.1010fac0
mov dword [ebp - 0x10], eax
pop ecx
test eax, eax
jns 0x100647b4
xor eax, eax
jmp 0x10064982
push ebx
lea eax, [ebp - 0x1f0]
push edi
push eax
call fcn.10110e50
lea eax, [ebp - 0x120]
push eax
call fcn.10110e50
mov ebx, dword [ebp + 0x24]
lea eax, [ebp - 0x1f0]
mov edi, dword [ebp + 0x20]
push 0
push dword [ebp + 0x1c]
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call fcn.10110f90
add esp, 0x1c
test eax, eax
jne 0x10064806
lea eax, [ebp - 0x1f0]
push eax
call fcn.10110d50
pop ecx
xor eax, eax
jmp 0x10064980
push esi
test edi, edi
je 0x1006496f
mov ecx, dword [ebp - 8]
cmp edi, dword [ebp - 0x10]
mov esi, edi
mov eax, ecx
mov byte [ebp - 1], cl
cmovg esi, dword [ebp - 0x10]
shr eax, 0x18
mov byte [ebp - 4], al
mov eax, ecx
shr eax, 0x10
mov byte [ebp - 3], al
mov eax, ecx
shr eax, 8
mov byte [ebp - 2], al
lea eax, [ebp - 0x1f0]
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.10110d90
pop ecx
pop ecx
test eax, eax
je 0x100649a3
push dword [ebp + 0x14]
lea eax, [ebp - 0x120]
push dword [ebp + 0x10]
push eax
call fcn.101111c0
add esp, 0xc
test eax, eax
je 0x10064986
push 4
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.101111c0
add esp, 0xc
test eax, eax
je 0x10064986
push 0
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.10110ef0
add esp, 0xc
test eax, eax
je 0x10064986
lea eax, [ebp - 0x120]
push eax
call fcn.10110d50
push esi
lea eax, [ebp - 0x50]
push eax
push ebx
call fcn.101b8700
xor eax, eax
add esp, 0x10
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp + 0x18], eax
jle 0x10064959
lea eax, [ebp - 0x1f0]
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.10110d90
pop ecx
pop ecx
test eax, eax
je 0x100649a3
push dword [ebp - 0x10]
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.101111c0
add esp, 0xc
test eax, eax
je 0x10064986
push 0
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.10110ef0
add esp, 0xc
test eax, eax
je 0x10064986
lea eax, [ebp - 0x120]
push eax
call fcn.10110d50
pop ecx
test esi, esi
jle 0x10064949
lea edx, [ebp - 0x50]
mov ecx, ebx
sub edx, ebx
mov edi, esi
mov al, byte [edx + ecx]
xor byte [ecx], al
inc ecx
dec edi
jne 0x1006493d
mov edi, dword [ebp + 0x20]
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp eax, dword [ebp + 0x18]
jl 0x100648d3
mov ecx, dword [ebp - 8]
sub edi, esi
inc ecx
mov dword [ebp + 0x20], edi
add ebx, esi
mov dword [ebp - 8], ecx
test edi, edi
jne 0x10064812
lea ecx, [ebp - 0x1f0]
push ecx
call fcn.10110d50
xor eax, eax
inc eax
pop ecx
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1f0]
push eax
call fcn.10110d50
lea eax, [ebp - 0x120]
push eax
call fcn.10110d50
pop ecx
xor eax, eax
jmp 0x1006497e
lea eax, [ebp - 0x1f0]
push eax
call fcn.10110d50
jmp 0x1006499f
Function at 0x10065f21
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push dword [esi + 0x2814]
lea ebx, [esi + 0x14]
push dword [esi + 0x10]
push 1
push ebx
call fcn.101b8671
mov edi, eax
add esp, 0x10
mov eax, dword [esi + 0x10]
cmp edi, eax
jne 0x10065f69
and dword [esi + 0x10], 0
test edi, edi
je 0x10065f62
push dword [esi + 0x2814]
call fcn.101c5982
pop ecx
test eax, eax
jne 0x10065f82
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
sub eax, edi
push eax
lea eax, [esi + 0x14]
add eax, edi
push eax
push ebx
call fcn.101b8d50
sub dword [esi + 0x10], edi
add esp, 0xc
test edi, edi
jne 0x10065f52
push dword [esi + 0xc]
call sym.extension.dll_PyString_AsString
push eax
push dword [sym.extension.dll_PyExc_IOError]
call sym.extension.dll_PyErr_SetFromErrnoWithFilename
push esi
call fcn.10065ee1
add esp, 0x10
or eax, 0xffffffff
jmp 0x10065f64
Function at 0x1006b00c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp dword [esi + 8], ebx
jge 0x1006b027
call fcn.1006addf
jmp 0x1006b137
push dword [esi + 8]
call fcn.10030b51
pop ecx
test eax, eax
jne 0x1006b045
push dword [sym.extension.dll_PyExc_IOError]
call sym.extension.dll_PyErr_SetFromErrno
pop ecx
jmp 0x1006b137
push 0x2000
push 0
call sym.extension.dll_PyString_FromStringAndSize
mov dword [ebp - 4], eax
pop ecx
pop ecx
test eax, eax
je 0x1006b137
push edi
push 0
push esi
call fcn.1006afb2
mov edi, eax
mov eax, accept
cmp edi, eax
jmp 0x1006b108
test edi, edi
je 0x1006b110
mov eax, dword [ebp - 4]
cmp dword [eax + 8], edi
jge 0x1006b099
lea eax, [ebp - 4]
push edi
push eax
call sym.extension.dll__PyString_Resize
pop ecx
pop ecx
test eax, eax
js 0x1006b134
call sym.extension.dll_PyEval_SaveThread
mov esi, eax
call fcn.101ba41b
sub edi, ebx
and dword [eax], 0
mov eax, accept
cmp edi, eax
cmovg edi, eax
mov eax, dword [ebp - 4]
push edi
mov edi, dword [ebp + 8]
add eax, 0x14
add eax, ebx
push eax
push dword [edi + 8]
call fcn.101c4262
push esi
mov dword [ebp - 8], eax
call sym.extension.dll_PyEval_RestoreThread
mov eax, dword [ebp - 8]
add esp, 0x10
test eax, eax
je 0x1006b189
jns 0x1006b0f7
call fcn.101ba41b
cmp dword [eax], 4
jne 0x1006b13d
call sym.extension.dll_PyErr_CheckSignals
test eax, eax
jne 0x1006b122
jmp 0x1006b0f9
add ebx, eax
push ebx
push edi
call fcn.1006afb2
mov edi, eax
cmp edi, 0x7fffffff
pop ecx
pop ecx
jbe 0x1006b075
push str.unbounded_read_returned_more_bytes_than_a_Python_string_can_hold
push dword [sym.extension.dll_PyExc_OverflowError]
call sym.extension.dll_PyErr_SetString
pop ecx
pop ecx
mov eax, dword [ebp - 4]
dec dword [eax]
mov ecx, dword [ebp - 4]
jne 0x1006b134
mov eax, dword [ecx + 4]
push ecx
call dword [eax + 0x18]
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.101ba41b
cmp dword [eax], 0xb
jne 0x1006b16a
test ebx, ebx
jg 0x1006b189
mov eax, dword [ebp - 4]
dec dword [eax]
mov ecx, dword [ebp - 4]
jne 0x1006b15d
mov eax, dword [ecx + 4]
push ecx
call dword [eax + 0x18]
pop ecx
inc dword [sym.extension.dll__Py_NoneStruct]
mov eax, sym.extension.dll__Py_NoneStruct
jmp 0x1006b136
mov eax, dword [ebp - 4]
dec dword [eax]
mov ecx, dword [ebp - 4]
jne 0x1006b17c
mov eax, dword [ecx + 4]
push ecx
call dword [eax + 0x18]
pop ecx
push dword [sym.extension.dll_PyExc_IOError]
call sym.extension.dll_PyErr_SetFromErrno
jmp 0x1006b133
mov eax, dword [ebp - 4]
cmp dword [eax + 8], ebx
jle 0x1006b136
lea eax, [ebp - 4]
push ebx
push eax
call sym.extension.dll__PyString_Resize
pop ecx
pop ecx
test eax, eax
js 0x1006b134
mov eax, dword [ebp - 4]
jmp 0x1006b136
Function at 0x10075cec
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call sym.extension.dll_PyEval_SaveThread
mov ecx, dword [ebp + 8]
mov esi, eax
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ecx + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov edi, eax
call sym.extension.dll_PyEval_RestoreThread
pop ecx
test edi, edi
jne 0x10075d46
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x5aa
jne 0x10075d46
push dword [ebp + 0x10]
push str.Cannnot_send__d_bytes_over_connection
push dword [sym.extension.dll_PyExc_ValueError]
call sym.extension.dll_PyErr_Format
add esp, 0xc
or eax, 0xffffffff
jmp 0x10075d4e
xor eax, eax
test edi, edi
setne al
dec eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10075d54
Capabilities:
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0x14]
push ebx
push esi
push edi
and dword [eax], 0
call sym.extension.dll_PyEval_SaveThread
mov ebx, dword [ebp + 8]
mov edi, eax
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0x18]
mov ecx, eax
cmp dword [ebp + 0x10], eax
cmovb ecx, dword [ebp + 0x10]
push ecx
push dword [ebp + 0xc]
push dword [ebx + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
mov esi, eax
call sym.extension.dll_PyEval_RestoreThread
pop ecx
test esi, esi
je 0x10075da0
mov eax, dword [ebp - 4]
jmp 0x10075e53
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
cmp ecx, 0xea
je 0x10075dc3
or eax, 0xffffffff
mov edx, 0xfffffc16
cmp ecx, 0x6d
cmove eax, edx
jmp 0x10075e53
lea eax, [ebp - 8]
push eax
xor eax, eax
push eax
push eax
push eax
push eax
push dword [ebx + 8]
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x10075e50
mov ebx, dword [ebp - 8]
add ebx, dword [ebp - 4]
cmp ebx, dword [ebp + 0x18]
jbe 0x10075dec
mov eax, 0xfffffc14
jmp 0x10075e53
push ebx
call sym.extension.dll_PyMem_Malloc
mov esi, dword [ebp + 0x14]
pop ecx
mov dword [esi], eax
test eax, eax
jne 0x10075e03
mov eax, 0xfffffc17
jmp 0x10075e53
push dword [ebp - 4]
push dword [ebp + 0xc]
push eax
call fcn.101b8700
add esp, 0xc
call sym.extension.dll_PyEval_SaveThread
mov ecx, dword [esi]
mov edi, eax
add ecx, dword [ebp - 4]
lea eax, [ebp - 4]
push 0
push eax
push dword [ebp - 8]
mov eax, dword [ebp + 8]
push ecx
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
mov esi, eax
call sym.extension.dll_PyEval_RestoreThread
pop ecx
test esi, esi
je 0x10075e45
mov eax, ebx
jmp 0x10075e53
mov eax, dword [ebp + 0x14]
push dword [eax]
call sym.extension.dll_PyMem_Free
pop ecx
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10076bc8
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
jmp 0x10076c04
push 0
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x10076c00
call fcn.101ba41b
cmp dword [eax], 4
jne 0x10076c0e
call fcn.10076bac
test eax, eax
jns 0x10076c04
mov eax, 0xfffffc12
jmp 0x10076c0a
sub esi, eax
add edi, eax
test esi, esi
jne 0x10076bd5
xor eax, eax
pop edi
pop esi
pop ebp
ret
mov eax, 0xfffffc13
jmp 0x10076c0a

Function at 0x10076c15
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
jbe 0x10076c5f
mov eax, dword [ebp + 0xc]
push 0
push edi
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
test esi, esi
jns 0x10076c4f
call fcn.101ba41b
cmp dword [eax], 4
jne 0x10076c6c
call fcn.10076bac
test eax, eax
js 0x10076c65
mov eax, dword [ebp + 0xc]
jmp 0x10076c5b
je 0x10076c70
mov eax, dword [ebp + 0xc]
sub edi, esi
add eax, esi
mov dword [ebp + 0xc], eax
test edi, edi
jne 0x10076c24
xor eax, eax
pop edi
pop esi
pop ebp
ret
mov eax, 0xfffffc12
jmp 0x10076c61
mov eax, esi
jmp 0x10076c61
xor eax, eax
cmp edi, dword [ebp + 0x10]
sete al
add eax, 0xfffffc15
jmp 0x10076c61

Function at 0x10077b8f
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
cmp dword [edx + 0x9c8], 0x270
jl 0x10077c49
push ebx
push esi
push edi
xor esi, esi
mov ebx, accept
mov ecx, dword [edx + esi*4 + 0xc]
xor ecx, dword [edx + esi*4 + 8]
and ecx, ebx
xor ecx, dword [edx + esi*4 + 8]
mov eax, ecx
shr ecx, 1
and eax, 1
xor ecx, dword [eax*4 + 0x103e7734]
xor ecx, dword [edx + esi*4 + 0x63c]
mov dword [edx + esi*4 + 8], ecx
inc esi
cmp esi, 0xe3
jl 0x10077baf
mov edi, 0x26f
jmp 0x10077c0e
mov ecx, dword [edx + esi*4 + 0xc]
xor ecx, dword [edx + esi*4 + 8]
and ecx, ebx
xor ecx, dword [edx + esi*4 + 8]
mov eax, ecx
shr ecx, 1
and eax, 1
xor ecx, dword [eax*4 + 0x103e7734]
xor ecx, dword [edx + esi*4 - 0x384]
mov dword [edx + esi*4 + 8], ecx
inc esi
cmp esi, edi
jl 0x10077be6
mov ecx, dword [edx + 0x9c4]
xor ecx, dword [edx + 8]
and ecx, ebx
xor ecx, dword [edx + 0x9c4]
mov eax, ecx
shr ecx, 1
and eax, 1
pop edi
pop esi
pop ebx
mov eax, dword [eax*4 + 0x103e7734]
xor eax, dword [edx + 0x638]
xor eax, ecx
mov dword [edx + 0x9c4], eax
and dword [edx + 0x9c8], 0
mov eax, dword [edx + 0x9c8]
mov ecx, dword [edx + eax*4 + 8]
inc eax
mov dword [edx + 0x9c8], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop ebp
ret
Function at 0x10077ce9
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor ecx, ecx
push esi
mov esi, dword [ebp + 8]
inc ecx
lea edx, [esi + 8]
mov dword [edx], eax
mov eax, dword [edx]
shr eax, 0x1e
xor eax, dword [edx]
lea edx, [edx + 4]
imul eax, eax, 0x6c078965
add eax, ecx
inc ecx
mov dword [edx], eax
cmp ecx, 0x270
jl 0x10077cfb
mov dword [esi + 0x9c8], ecx
pop esi
pop ebp
ret

Function at 0x1007ecc9
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
xorps xmm0, xmm0
push esi
mov esi, dword [ebp + 8]
movsd xmm1, qword [esi + 0x20]
comisd xmm0, xmm1
jbe 0x1007ecec
xor eax, eax
inc eax
jmp 0x1007ed86
ucomisd xmm1, xmm0
lahf
test ah, 0x44
jp 0x1007ecfd
xor eax, eax
jmp 0x1007ed86
cvttsd2si eax, xmm1
push ebx
xor ebx, ebx
mov dword [ebp - 0x10c], 1
push edi
mov edi, ebx
mov dword [ebp - 8], eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
subsd xmm1, xmm0
mulsd xmm1, qword [0x102893c0]
cvttsd2si eax, xmm1
mov dword [ebp - 4], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0x108], eax
cmp dword [0x1042300c], ebx
jbe 0x1007ed47
call sym.extension.dll_PyEval_SaveThread
mov edi, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10c]
push ebx
cmp dword [ebp + 0xc], ebx
je 0x1007ed5b
push eax
push ebx
jmp 0x1007ed5d
push ebx
push eax
mov eax, dword [esi + 8]
inc eax
push eax
call dword [sym.imp.WS2_32.dll_select]
mov esi, eax
cmp dword [0x1042300c], ebx
jbe 0x1007ed79
push edi
call sym.extension.dll_PyEval_RestoreThread
pop ecx
push 5
pop eax
push 2
pop ecx
test esi, esi
pop edi
cmove eax, ecx
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1009c076
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 8]
test esi, esi
je 0x1009c17a
mov eax, sym.extension.dll_PyFile_Type
cmp dword [esi + 4], eax
je 0x1009c0a9
push eax
push dword [esi + 4]
call sym.extension.dll_PyType_IsSubtype
pop ecx
pop ecx
test eax, eax
je 0x1009c17a
cmp dword [esi + 0x30], 0
jne 0x1009c0c5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 1
push edi
call fcn.101b846c
add esp, 0x10
jmp 0x1009c187
mov eax, dword [esi + 0x38]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [esi + 0x34]
mov dword [ebp - 0xc], eax
jmp 0x1009c14c
push dword [ebp + 0x10]
mov dword [ebp - 8], edi
push eax
push 1
push edi
call fcn.101b846c
mov edx, eax
add esp, 0x10
test edx, edx
je 0x1009c169
mov eax, dword [ebp - 0xc]
mov esi, dword [ebp - 4]
sub eax, edx
push 0
pop ecx
setne cl
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 8]
dec edx
inc dword [ebp - 8]
mov cl, byte [ecx]
cmp cl, 0xd
jne 0x1009c117
mov byte [edi], 0xa
xor esi, esi
inc edi
inc esi
jmp 0x1009c13a
test esi, esi
je 0x1009c12d
cmp cl, 0xa
jne 0x1009c128
xor esi, esi
or ebx, 4
inc eax
jmp 0x1009c13a
or ebx, 1
jmp 0x1009c135
cmp cl, 0xa
jne 0x1009c135
or ebx, 2
mov byte [edi], cl
inc edi
xor esi, esi
test edx, edx
jne 0x1009c100
mov dword [ebp - 4], esi
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x10], edx
jne 0x1009c152
test eax, eax
jne 0x1009c0d7
jmp 0x1009c169
mov eax, dword [ebp - 4]
test eax, eax
je 0x1009c169
push dword [ebp + 0x10]
call fcn.101b825b
pop ecx
test eax, eax
je 0x1009c169
or ebx, 1
sub edi, dword [ebp + 8]
mov dword [esi + 0x34], ebx
mov eax, edi
mov ebx, dword [ebp - 4]
mov dword [esi + 0x38], ebx
pop ebx
jmp 0x1009c187
call fcn.101ba41b
mov dword [eax], 6
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1009edb6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x104234b0]
sub esp, 0x10
push esi
push edi
test eax, eax
jne 0x1009ee95
mov edx, dword [ebp + 8]
xor ecx, ecx
inc ecx
cmp dword [ebp + 0xc], eax
je 0x1009eddc
add edx, 3
or ecx, 0xffffffff
mov ah, byte [edx]
movzx esi, byte [edx]
add edx, ecx
shr ah, 7
and esi, 0x7f
mov byte [ebp - 1], ah
add esi, esi
movzx edi, byte [edx]
add edx, ecx
mov eax, edi
and edi, 0x7f
shr eax, 7
or esi, eax
shl edi, 0x10
cmp esi, 0xff
jne 0x1009ee25
push str.cant_unpack_IEEE_754_special_value_on_non_IEEE_platform
push dword [sym.extension.dll_PyExc_ValueError]
call sym.extension.dll_PyErr_SetString
fld qword [0x10286740]
pop ecx
pop ecx
jmp 0x1009eed8
movzx ecx, byte [ecx + edx]
movzx eax, byte [edx]
shl eax, 8
or ecx, eax
or ecx, edi
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
shr ecx, 0x1f
addsd xmm0, qword [ecx*8 + 0x1028a030]
mulsd xmm0, qword [0x102a9348]
test esi, esi
jne 0x1009ee58
push 0xffffffffffffff82
pop esi
jmp 0x1009ee63
addsd xmm0, qword [0x101e8248]
sub esi, 0x7f
push esi
push ecx
push ecx
movsd qword [esp], xmm0
call fcn.101bac98
add esp, 0xc
cmp byte [ebp - 1], 0
fst qword [ebp - 0x10]
je 0x1009eed8
movsd xmm0, qword [ebp - 0x10]
fstp st(0)
xorpd xmm0, xmmword [0x10286870]
movsd qword [ebp - 0x10], xmm0
fld qword [ebp - 0x10]
jmp 0x1009eed8
mov ecx, dword [ebp + 0xc]
cmp eax, 2
jne 0x1009eea1
test ecx, ecx
je 0x1009eeaa
cmp eax, 1
jne 0x1009eec4
test ecx, ecx
je 0x1009eec4
mov edx, dword [ebp + 8]
lea ecx, [ebp - 9]
push 4
pop esi
mov al, byte [edx]
mov byte [ecx], al
dec ecx
inc edx
dec esi
jne 0x1009eeb3
push 4
lea eax, [ebp - 0xc]
push eax
jmp 0x1009eec9
push 4
push dword [ebp + 8]
lea eax, [ebp - 8]
push eax
call fcn.101b8700
fld dword [ebp - 8]
add esp, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
ret