joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101712d
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push esi
mov esi, ecx
mov dword [ebp - 8], esi
cmp byte [esi + 0xc], 0
je 0x10171cc
lea eax, [ebp - 4]
push ebx
push eax
push 0xf003f
push 0
push dword [ebp + 8]
push dword [esi + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x10171c3
and byte [ebp - 0x110], 0
push edi
push 0x41
xor eax, eax
pop ecx
lea edi, [ebp - 0x10f]
rep stosd dword es:[edi], eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x104
lea eax, [ebp - 0x110]
push edi
push eax
push 0
push dword [ebp - 4]
call esi
test eax, eax
jne 0x10171b6
lea eax, [ebp - 0x110]
push eax
push dword [ebp - 4]
call ebx
lea eax, [ebp - 0x110]
push edi
push eax
push 0
push dword [ebp - 4]
jmp 0x1017195
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 8]
pop edi
push dword [ebp + 8]
push dword [esi + 8]
call ebx
pop ebx
pop esi
leave
ret 4

Function at 0x10171d1
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov edx, ecx
cmp byte [edx + 0xc], 0
je 0x1017227
and byte [ebp - 0x108], 0
push edi
push 0x41
xor eax, eax
pop ecx
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x108]
push 0x104
push eax
push dword [ebp + 8]
push dword [edx + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
pop edi
jne 0x1017227
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x108]
push eax
call fcn.01008a50
mov al, 1
jmp 0x1017229
xor al, al
leave
ret 8

Function at 0x101722d
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp byte [esi + 0xc], bl
je 0x10172cd
lea eax, [ebp - 8]
lea edi, [esi + 4]
push eax
push edi
push ebx
push 0x20019
push ebx
push ebx
push ebx
push dword [ebp + 8]
push dword [esi + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x10172cd
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
push ebx
push ebx
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov edi, dword [ebp + 0x14]
cmp dword [edi], ebx
jne 0x10172af
mov eax, dword [ebp - 4]
cmp eax, 8
ja 0x10172a1
push 8
pop eax
mov ecx, dword [ebp + 0x18]
push eax
mov dword [ecx], eax
call fcn.0105b249
pop ecx
mov dword [edi], eax
push dword [ebp + 0x1c]
mov eax, dword [ebp + 0x18]
mov dword [esi], ebx
mov ecx, esi
push dword [eax]
push dword [edi]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.010172d6
jmp 0x10172cf
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0x18
Function at 0x101735f
Capabilities:
Check os version

Disassembly:
mov eax, 0x1080fb0
call fcn.0105c800
sub esp, 0x98
push esi
mov esi, 0x94
push edi
push esi
lea eax, [ebp - 0xa4]
push 0
push eax
mov edi, 0x80004005
call fcn.0105bd40
add esp, 0xc
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa4], esi
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x1017542
mov eax, dword [ebp - 0x94]
sub eax, 0
je 0x101752a
dec eax
je 0x1017481
dec eax
jne 0x1017540
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0xa0]
mov ecx, dword [ebp - 0x9c]
mov edx, dword [ebp - 0x98]
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
mov dword [esi + 4], edx
mov edx, dword [0x1098824]
mov dword [ebp + 8], edx
push 5
mov dword [ebp - 4], 1
pop edx
cmp eax, edx
jae 0x1017403
mov dword [esi], edx
push str.Windows_NT
jmp 0x101742e
dec ecx
je 0x1017423
dec ecx
je 0x1017416
mov dword [esi], 6
push str.Windows_2000
jmp 0x101742e
mov dword [esi], 8
push str.Windows_Server_2003
jmp 0x101742e
mov dword [esi], 7
push str.Windows_XP
lea ecx, [ebp + 8]
call fcn.01008a50
lea eax, [ebp - 0x90]
push eax
call fcn.0105c0e0
test eax, eax
pop ecx
lea eax, [ebp - 0x90]
jne 0x1017452
mov eax, str.No_SPs
push eax
push dword [esi + 4]
add esi, 0x10
push dword [esi - 4]
push dword [esi - 8]
push dword [ebp + 8]
push str._s__d._d._d___s_
push esi
call fcn.01009314
add esp, 0x1c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.01001190
jmp 0x1017540
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0xa0]
movzx ecx, word [ebp - 0x98]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x9c]
mov dword [esi + 0xc], eax
mov dword [esi + 4], ecx
mov ecx, dword [0x1098824]
mov dword [ebp - 0x10], ecx
and dword [ebp - 4], 0
cmp eax, 0xa
je 0x10174d1
cmp eax, 0x5a
je 0x10174c4
mov dword [esi], 2
push str.Windows_95
jmp 0x10174dc
mov dword [esi], 3
push str.Windows_ME
jmp 0x10174dc
mov dword [esi], 3
push str.Windows_98
lea ecx, [ebp - 0x10]
call fcn.01008a50
lea eax, [ebp - 0x90]
push eax
call fcn.0105c0e0
test eax, eax
pop ecx
lea eax, [ebp - 0x90]
jne 0x1017500
mov eax, str.No_SPs
push eax
push dword [esi + 4]
add esi, 0x10
push dword [esi - 4]
push dword [esi - 8]
push dword [ebp - 0x10]
push str._s__d._d._d___s_
push esi
call fcn.01009314
add esp, 0x1c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
jmp 0x1017477
mov eax, dword [ebp + 8]
push str.Win32s
lea ecx, [eax + 0x10]
mov dword [eax], 1
call fcn.01008a50
xor edi, edi
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x1017c4d
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebx
push esi
push edi
xor edi, edi
push edi
push 1
mov esi, ecx
push edi
call fcn.0101805f
push dword [esp + 0x10]
lea ebx, [esi + 0xc]
mov ecx, ebx
call fcn.01008a50
mov ebx, dword [ebx]
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocStringLen
push ebx
mov dword [esi + 0x28], edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x1017c98
mov dword [esi], edi
xor al, al
pop edi
pop esi
pop ebx
ret 8
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
push edi
push edi
push 2
push edi
mov dword [esi + 0x18], eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, edi
mov dword [esi + 4], eax
je 0x1017c90
push edi
push edi
push edi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, edi
mov dword [esi + 8], eax
je 0x1017c90
mov ecx, esi
call fcn.01018189
jmp 0x1017c92

Function at 0x1017d0b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
lea eax, [ebp - 0xe4]
push esi
push eax
call fcn.01017dbc
lea eax, [ebp - 4]
push 0
push eax
mov esi, 0xe0
lea eax, [ebp - 0xe4]
push esi
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
cmp dword [ebp - 4], esi
pop esi
sete al
leave
ret 4

Function at 0x1017e2f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
mov ebx, ecx
push 2
call fcn.010180d0
mov dword [ebp - 0xc], eax
mov eax, dword [ebx + 8]
mov ecx, dword [eax + 0x3c]
lea eax, [ecx + eax + 0xf8]
mov ecx, ebx
mov dword [ebp - 4], eax
call fcn.010180c4
test eax, eax
jle 0x1017eb5
push esi
push edi
mov dword [ebp - 8], eax
mov eax, dword [ebx + 0x14]
mov esi, dword [ebp - 4]
push 0xa
lea edi, [ebp - 0x38]
pop ecx
test eax, eax
rep movsd dword es:[edi], dword [esi]
je 0x1017e95
mov ecx, dword [ebp - 0xc]
cmp dword [ebp - 4], ecx
jne 0x1017e87
mov ecx, dword [ebx + 0x10]
add dword [ebp - 0x28], ecx
add dword [ebp - 0x30], eax
jmp 0x1017e95
mov eax, dword [ebp - 0x24]
cmp eax, dword [ecx + 0x14]
jbe 0x1017e95
add eax, dword [ebx + 0x10]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x10]
push 0
push eax
lea eax, [ebp - 0x38]
push 0x28
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
add dword [ebp - 4], 0x28
dec dword [ebp - 8]
jne 0x1017e62
pop edi
pop esi
mov al, 1
pop ebx
leave
ret 4
Function at 0x1017ebc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 8], 0
push esi
mov esi, ecx
je 0x1017fac
push ebx
lea eax, [ebp - 4]
push edi
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.01017d4a
mov eax, dword [esi + 8]
mov edi, dword [ebp - 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [ebp - 8]
sub edi, eax
push 0
push ecx
push edi
push eax
push dword [ebp + 8]
call ebx
push dword [ebp + 8]
mov ecx, esi
call fcn.01017d0b
push dword [ebp + 8]
mov ecx, esi
call fcn.01017e2f
push 2
mov ecx, esi
call fcn.01018125
mov ecx, esi
mov dword [ebp - 0x10], eax
call fcn.010180c4
mov ecx, dword [esi + 8]
lea eax, [eax + eax*4]
lea edx, [ebp - 8]
push 0
lea eax, [edi + eax*8 + 0xe0]
mov edi, dword [ebp - 0x10]
push edx
mov edx, edi
sub edx, ecx
add ecx, eax
sub edx, eax
push edx
push ecx
push dword [ebp + 8]
call ebx
push dword [ebp + 8]
mov ecx, dword [esi + 0x24]
call fcn.0101cd85
lea ecx, [ebp - 8]
push 0
push ecx
mov ecx, dword [esi + 0x20]
sub ecx, eax
add eax, edi
push ecx
push eax
push dword [ebp + 8]
call ebx
mov eax, dword [esi + 8]
mov ecx, dword [ebp - 0xc]
sub edi, eax
push edi
push dword [ecx + 0x70]
mov ecx, dword [esi + 0x24]
push eax
push dword [ebp + 8]
call fcn.0101ce8e
cmp dword [ebp - 4], 0
je 0x1017fa6
cmp dword [ebp - 4], 0x10
jbe 0x1017f8d
push 0x10
pop esi
jmp 0x1017f90
mov esi, dword [ebp - 4]
lea eax, [ebp - 8]
push 0
push eax
push esi
push str.PADDINGPADDINGXX
push dword [ebp + 8]
call ebx
sub dword [ebp - 4], esi
jne 0x1017f82
pop edi
mov al, 1
pop ebx
jmp 0x1017fae
xor al, al
pop esi
leave
ret 8

Function at 0x1017fb3
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x10810d8
call fcn.0105c800
push ebx
xor ebx, ebx
cmp byte [ebp + 0xc], bl
push esi
push edi
mov edi, ecx
jne 0x1018040
push ebx
push 0x80
push 4
push ebx
push ebx
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1018027
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.OPEN_FAILED___
call esi
push 0xffffffffffffff9b
push str._with_error
lea ecx, [ebp + 0x10]
call fcn.010087b8
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp + 0x10]
call fcn.0100920b
push dword [ebp + 0x10]
call esi
lea ecx, [ebp + 0x10]
call fcn.01001190
xor al, al
jmp 0x101804e
push dword [ebp + 0x10]
mov ecx, edi
push ebx
push esi
call fcn.0101805f
push esi
mov bl, al
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
jmp 0x101804e
push dword [ebp + 0x10]
mov ecx, edi
push dword [ebp + 0xc]
push ebx
call fcn.0101805f
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x101966d
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0x10], 0
je 0x1019721
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
and byte [ebp + 0xa], 0
and byte [ebp + 9], 0
and byte [ebp + 8], 0
xor edx, edx
mov al, byte [ebx]
inc ebx
dec dword [ebp + 0x10]
je 0x10196a1
mov byte [ebp + edx + 8], al
inc edx
cmp edx, 3
jl 0x101968f
test edx, edx
jle 0x1019714
movzx eax, byte [ebp + 8]
mov ecx, eax
and eax, 3
shr ecx, 2
shl eax, 4
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [ebp - 4], cl
movzx ecx, byte [ebp + 9]
mov esi, ecx
and ecx, 0xf
shr esi, 4
or esi, eax
shl ecx, 2
mov al, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [ebp - 3], al
movzx eax, byte [ebp + 0xa]
mov esi, eax
and eax, 0x3f
shr esi, 6
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
or esi, ecx
mov byte [ebp - 1], al
mov eax, edx
mov cl, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
dec eax
mov byte [ebp - 2], cl
je 0x1019701
dec eax
je 0x1019705
jmp 0x1019709
mov byte [ebp - 2], 0x3d
mov byte [ebp - 1], 0x3d
mov edi, dword [ebp + 0xc]
add dword [ebp + 0xc], 4
lea esi, [ebp - 4]
movsd dword es:[edi], dword [esi]
cmp dword [ebp + 0x10], 0
jne 0x1019681
pop edi
pop esi
pop ebx
mov eax, dword [ebp + 0xc]
and byte [eax], 0
leave
ret

Function at 0x1019729
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 0xc]
call fcn.0105c0e0
mov edi, eax
lea eax, [edi + 4]
push eax
mov dword [ebp - 4], eax
call fcn.0105b249
mov ebx, eax
mov al, byte [ebp + 0x10]
push dword [ebp + 0xc]
lea esi, [ebx + 1]
mov byte [ebx], al
mov word [esi], di
inc esi
inc esi
push esi
call fcn.0105d010
mov al, byte [ebp + 0x10]
add esp, 0x10
xor byte [esi], al
push 1
pop eax
cmp edi, eax
jle 0x1019779
mov cl, byte [eax + esi - 1]
xor byte [eax + esi], cl
inc eax
cmp eax, edi
jl 0x101976d
lea eax, [edi*4 + 0xc]
push 3
cdq
pop ecx
idiv ecx
add eax, 4
push eax
call fcn.0105b249
push dword [ebp - 4]
mov ecx, dword [ebp + 8]
push eax
push ebx
mov dword [ecx], eax
call fcn.0101966d
push ebx
call fcn.0105ad60
add esp, 0x14
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x10197d4
Capabilities:
Check for time delay via gettickcount
Resolve dns
Set socket configuration

Disassembly:
mov eax, 0x108135c
call fcn.0105c800
sub esp, 0x104
test byte [0x10a42b4], 1
jne 0x1019809
mov eax, dword [0x1098824]
or byte [0x10a42b4], 1
push 0x10199c4
mov dword [0x10a42b0], eax
call fcn.0105b116
pop ecx
test byte [0x10a42b4], 2
jne 0x101982e
mov eax, dword [0x1098824]
or byte [0x10a42b4], 2
push 0x10199ba
mov dword [0x10a42ac], eax
call fcn.0105b116
pop ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push esi
call fcn.0105c0e0
pop ecx
mov ecx, 0xfe
cmp eax, ecx
jae 0x101984e
push esi
call fcn.0105c0e0
pop ecx
jmp 0x1019850
mov eax, ecx
push eax
lea eax, [ebp - 0x110]
push esi
push eax
call fcn.0105d100
push esi
call fcn.0105c0e0
mov ecx, 0xff
add esp, 0x10
cmp eax, ecx
jae 0x1019879
push esi
call fcn.0105c0e0
pop ecx
jmp 0x101987b
mov eax, ecx
mov byte [ebp + eax - 0x110], bl
lea eax, [ebp - 0x110]
push eax
call fcn.0107c751
lea eax, [ebp - 0x110]
push eax
push dword [0x10a42b0]
call fcn.0105d410
add esp, 0xc
cmp eax, ebx
jne 0x10198ce
mov eax, dword [0x10a42ac]
cmp dword [eax - 8], ebx
jne 0x10198ce
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x10a42d4]
cmp eax, 0x7530
jae 0x10198ce
mov eax, 0x2ee7
jmp 0x10199aa
lea eax, [ebp - 0x110]
push edi
push eax
call sub.WSOCK32.dll_inet_addr
cmp eax, 0xffffffff
je 0x10198fc
mov edi, dword [ebp + 0x10]
push dword [edi]
push esi
mov esi, dword [ebp + 0xc]
push esi
call fcn.0105d100
mov eax, dword [edi]
add esp, 0xc
mov byte [eax + esi - 1], bl
mov bl, 1
jmp 0x1019971
lea eax, [ebp - 0x110]
push eax
call sub.WSOCK32.dll_gethostbyname
cmp eax, ebx
je 0x101996c
mov eax, dword [eax + 0xc]
mov ecx, dword [0x1098824]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp + 8], ecx
mov dword [ebp - 0x10], eax
movzx ecx, byte [ebp - 0xd]
push ecx
mov dword [ebp - 4], ebx
movzx ecx, byte [ebp - 0xe]
push ecx
movzx ecx, ah
movzx eax, al
push ecx
push eax
lea eax, [ebp + 8]
push str._d._d._d._d
push eax
call fcn.01009314
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
push dword [edi]
push dword [ebp + 8]
push esi
call fcn.0105d100
mov eax, dword [edi]
or dword [ebp - 4], 0xffffffff
add esp, 0x24
lea ecx, [ebp + 8]
mov byte [eax + esi - 1], bl
mov bl, 1
call fcn.01001190
jmp 0x1019971
mov esi, dword [ebp + 0xc]
mov byte [esi], bl
lea eax, [ebp - 0x110]
mov ecx, 0x10a42b0
push eax
call fcn.01008a50
push esi
mov ecx, 0x10a42ac
call fcn.01008a50
call dword [sym.imp.KERNEL32.dll_GetTickCount]
neg bl
sbb ebx, ebx
mov dword [0x10a42d4], eax
and bx, 0xd119
pop edi
add ebx, 0x2ee7
mov eax, ebx
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x1019b8a
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [ebp + 8]
lea ecx, [esi + 0x38]
call fcn.01008a50
mov al, byte [ebp + 0xc]
mov byte [esi + 0x3c], al
lea eax, [ebp + 8]
push eax
push 4
push esi
push 0x1019bd8
push 0
push 0
call fcn.0105e167
add esp, 0x18
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, 1
pop esi
pop ebp
ret 8
Function at 0x101a101
Capabilities:
Delete file

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x18]
mov ecx, edi
call fcn.01009915
xor ebx, ebx
test al, al
je 0x101a129
cmp byte [esi + 0x24], bl
je 0x101a129
mov ecx, edi
call fcn.0100972d
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x10a40b8
mov ecx, edi
call fcn.01009887
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x101a143
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov byte [esi + 0x14], bl
mov byte [esi + 0x15], bl
pop edi
pop esi
mov al, 1
pop ebx
ret

Function at 0x101a1f4
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esi + 8], ebx
mov byte [esi + 0x10], bl
mov dword [esi], 0x10879ec
cmp dword [0x10a42ec], ebx
jne 0x101a22e
lea eax, [esp + 8]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
jne 0x101a22e
mov byte [0x10a42e8], 1
cmp dword [0x10a42f0], ebx
jne 0x101a248
push str.socketmutex
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x10a42f0], eax
mov eax, esi
pop esi
pop ebx
add esp, 0x190
ret

Function at 0x101a2ae
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor eax, eax
xor bl, bl
cmp byte [0x10a42e8], al
push esi
mov esi, ecx
je 0x101a336
cmp dword [ebp + 8], eax
je 0x101a336
push eax
push 1
push 2
mov dword [esi + 8], eax
call sub.WSOCK32.dll_socket
cmp eax, 0xffffffff
mov dword [esi + 4], eax
je 0x101a326
push dword [ebp + 0xc]
mov word [ebp - 0x10], 2
call sub.WSOCK32.dll_htons
push dword [ebp + 8]
mov ecx, esi
mov word [ebp - 0xe], ax
call fcn.0101a427
lea ecx, [esi + 0xc]
cmp eax, 0xffffffff
mov dword [ecx], eax
je 0x101a326
push 4
lea eax, [ebp - 0xc]
push ecx
push eax
call fcn.0105bda0
add esp, 0xc
lea eax, [ebp - 0x10]
push 0x10
push eax
push dword [esi + 4]
call sub.WSOCK32.dll_connect
cmp eax, 0xffffffff
jne 0x101a33e
call sub.WSOCK32.dll_WSAGetLastError
push dword [esi + 4]
mov dword [esi + 8], eax
call sub.WSOCK32.dll_closesocket
mov al, bl
pop esi
pop ebx
leave
ret 8
mov byte [esi + 0x10], 1
mov bl, 1
jmp 0x101a336
Function at 0x101a427
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.0105c0e0
pop ecx
mov ecx, 0xfe
cmp eax, ecx
jae 0x101a44d
push esi
call fcn.0105c0e0
pop ecx
jmp 0x101a44f
mov eax, ecx
push eax
lea eax, [ebp - 0x104]
push esi
push eax
call fcn.0105d100
push esi
call fcn.0105c0e0
mov ecx, 0xff
add esp, 0x10
cmp eax, ecx
jae 0x101a478
push esi
call fcn.0105c0e0
pop ecx
jmp 0x101a47a
mov eax, ecx
and byte [ebp + eax - 0x104], 0
lea eax, [ebp - 0x104]
push eax
call fcn.0107c751
pop ecx
lea eax, [ebp - 0x104]
push eax
call sub.WSOCK32.dll_inet_addr
or dword [ebp + 8], 0xffffffff
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
pop esi
je 0x101a4c1
push 2
lea eax, [ebp - 4]
push 4
push eax
call sub.WSOCK32.dll_gethostbyaddr
test eax, eax
push 4
jne 0x101a4d3
lea eax, [ebp - 4]
push eax
jmp 0x101a4d8
lea eax, [ebp - 0x104]
push eax
call sub.WSOCK32.dll_gethostbyname
test eax, eax
je 0x101a4e4
push 4
mov eax, dword [eax + 0xc]
push dword [eax]
lea eax, [ebp + 8]
push eax
call fcn.0105bda0
add esp, 0xc
mov eax, dword [ebp + 8]
leave
ret 4

Function at 0x101a63c
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
and byte [ebp - 1], 0
push ebx
mov ebx, dword [sym.imp.WINMM.dll_timeGetTime]
push esi
mov esi, ecx
push edi
mov byte [esi + 0x10], 1
call ebx
mov edi, eax
add edi, 0x3a98
cmp dword [esi + 4], 0
je 0x101a673
call ebx
cmp edi, eax
jb 0x101a673
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x101a65d
mov eax, dword [esi + 4]
test eax, eax
je 0x101a68e
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x101a692
mov byte [ebp - 1], 1
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x101ac7d
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x108150d
call fcn.0105c800
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov ecx, dword [0x1098824]
mov dword [esi + 0x10], ecx
mov ecx, dword [0x1098824]
mov dword [ebp - 4], eax
mov dword [esi + 0x14], ecx
mov ecx, dword [0x1098824]
mov dword [esi + 0x18], ecx
mov edx, dword [0x1098824]
lea ecx, [esi + 0x1c]
mov dword [ecx], edx
mov edx, dword [ebp + 0x10]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], edx
mov dl, byte [ebp + 0x14]
mov byte [esi + 0x28], dl
mov dl, byte [ebp + 0x17]
mov byte [esi + 0x2c], dl
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov byte [esi + 0x40], al
mov byte [esi + 0x41], al
mov edx, dword [0x1098824]
mov dword [esi + 0x50], edx
mov edx, dword [0x1098824]
mov dword [esi + 0x54], edx
push dword [ebp + 0xc]
mov dword [esi + 0x58], eax
mov dword [esi + 0x60], eax
mov dword [esi + 0x68], eax
mov byte [ebp - 4], 6
mov dword [esi + 0x5c], eax
mov dword [esi + 0x64], eax
mov dword [esi + 0x6c], eax
mov dword [esi], 0x1087b90
call fcn.01008a50
call fcn.01013f21
mov ecx, eax
mov dword [esi + 0xc], eax
call fcn.01015232
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 0x10

Function at 0x101ae43
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 0xc]
mov eax, dword [esi]
push dword [ebp + 8]
call dword [eax + 0x20]
xor ebx, ebx
mov byte [ebp + 0x13], al
cmp al, bl
je 0x101ae89
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], ebx
push eax
push ebx
push esi
push 0x101afd4
push ebx
push ebx
call fcn.0105e167
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x101ae90
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x4c]
mov al, byte [ebp + 0x13]
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x101cdb5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x28]
cmp eax, dword [ebp + 0xc]
jne 0x101ce10
lea eax, [ebp + 0xc]
push 0
push eax
lea eax, [esi + 4]
push 0x10
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp + 0xc], 0x10
jne 0x101ce6c
mov eax, dword [esi]
add dword [eax + 0x28], 0x10
xor edi, edi
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x101ce70
mov ecx, dword [esi + 0x20]
sub ecx, eax
sar ecx, 2
cmp edi, ecx
jae 0x101ce70
push dword [ebp + 8]
mov ecx, dword [eax + edi*4]
call fcn.0101f236
test al, al
je 0x101ce6c
inc edi
jmp 0x101cdeb
cmp eax, 2
jne 0x101ce42
cmp dword [ebp + 0xc], 3
jne 0x101ce42
xor edi, edi
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x101ce70
mov ecx, dword [esi + 0x20]
sub ecx, eax
sar ecx, 2
cmp edi, ecx
jae 0x101ce70
push dword [ebp + 8]
mov ecx, dword [eax + edi*4]
call fcn.0101f266
test al, al
je 0x101ce6c
inc edi
jmp 0x101ce1d
xor edi, edi
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x101ce70
mov ecx, dword [esi + 0x20]
sub ecx, eax
sar ecx, 2
cmp edi, ecx
jae 0x101ce70
push dword [ebp + 0xc]
mov ecx, dword [eax + edi*4]
push dword [ebp + 8]
call fcn.0101f211
test eax, eax
je 0x101ce6c
inc edi
jmp 0x101ce44
xor eax, eax
jmp 0x101ce75
mov eax, dword [esi]
mov eax, dword [eax + 0x28]
pop edi
pop esi
pop ebp
ret 8

Function at 0x101f236
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
lea eax, [ebp + 8]
push 0
mov esi, ecx
push eax
push 8
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp + 8], 8
je 0x101f258
xor al, al
jmp 0x101f261
mov eax, dword [esi + 0x14]
add dword [eax + 0x28], 8
mov al, 1
pop esi
pop ebp
ret 4

Function at 0x101f419
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp + 8]
push 0
push eax
add ecx, 0x10
push 0x10
push ecx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 8]
pop ebp
ret 4