joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100036f0
Capabilities:
Write file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov edi, eax
mov eax, dword [esp + 0x24]
mov esi, ecx
test eax, eax
je 0x1000370e
mov dword [eax], 0
test edi, edi
je 0x100037bc
cmp dword [esp + 0x20], 0
je 0x1000383a
cmp ebp, 0xffffffff
je 0x1000383a
cmp dword [esp + 0x18], 0
je 0x1000376a
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
push 0
push 0x200
push eax
push ecx
call fcn.1009f830
or eax, edx
jne 0x10003750
test edi, 0x1ff
je 0x1000376a
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
push edx
push edi
push eax
push ebx
push ebp
push esi
call fcn.100039f0
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
mov ecx, dword [ebx + 4]
mov edx, dword [ebx]
push 0
push 0
push ecx
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x1000378c
call fcn.10002c20
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
mov ecx, dword [esp + 0x20]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [esp + 0x20]
push eax
push edi
push ecx
push ebp
mov dword [esp + 0x30], 0
call ebx
test eax, eax
je 0x100037c5
mov eax, dword [esp + 0x24]
test eax, eax
je 0x100037bc
mov edx, dword [esp + 0x1c]
mov dword [eax], edx
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6f8
je 0x100037ee
cmp eax, 0x3e6
je 0x100037ee
test eax, eax
jle 0x1000383f
and eax, 0xffff
or eax, 0x80070000
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
call fcn.10003850
test eax, eax
jl 0x1000383f
cmp eax, 1
je 0x1000383f
mov eax, dword [esp + 0x20]
mov ecx, dword [esi]
push edi
push eax
push ecx
call fcn.10059a80
mov eax, dword [esi]
add esp, 0xc
push 0
lea edx, [esp + 0x20]
push edx
push edi
push eax
push ebp
call ebx
test eax, eax
je 0x10003780
mov eax, dword [esp + 0x24]
test eax, eax
je 0x10003831
mov ecx, dword [esp + 0x1c]
mov dword [eax], ecx
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
mov eax, 0x80070057
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
Function at 0x100038a0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 0x18]
sub esp, 8
push ebx
push ebp
push esi
push edi
test eax, eax
je 0x100038b5
mov dword [eax], 0
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x100039d1
cmp dword [esp + 0x28], 0
je 0x100039dd
cmp dword [esp + 0x20], 0xffffffff
je 0x100039dd
mov eax, dword [esp + 0x24]
test eax, eax
je 0x100039dd
mov ebx, dword [eax + 4]
mov edi, dword [eax]
push 0
push 0x200
push ebx
push edi
call fcn.1009f780
push 0
push 0x200
push edx
push eax
call fcn.10065760
mov ebp, eax
xor eax, eax
sub esi, ebp
sbb eax, edx
add esi, edi
adc eax, ebx
push 0
add esi, 0x1ff
push 0x200
adc eax, 0
push eax
push esi
mov dword [esp + 0x24], edx
call fcn.1009f780
mov esi, dword [esp + 0x1c]
mov edi, eax
shl edi, 9
call fcn.10003850
test eax, eax
jl 0x100039e2
cmp eax, 1
je 0x100039e2
mov ecx, dword [esp + 0x14]
mov ebx, dword [esp + 0x20]
push 0
push 0
push ecx
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x10003972
call fcn.10002c20
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0x18
mov eax, dword [esi]
push 0
lea edx, [esp + 0x20]
push edx
push edi
push eax
push ebx
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10003963
mov ecx, dword [esp + 0x24]
mov eax, dword [ecx]
mov ecx, dword [esp + 0x1c]
sub eax, ebp
cmp ecx, eax
ja 0x100039a4
xor edi, edi
jmp 0x100039c7
mov edi, dword [esp + 0x2c]
sub ecx, eax
cmp ecx, edi
jae 0x100039b0
mov edi, ecx
test edi, edi
jbe 0x100039c7
mov edx, dword [esi]
add edx, eax
mov eax, dword [esp + 0x28]
push edi
push edx
push eax
call fcn.10059a80
add esp, 0xc
mov eax, dword [esp + 0x30]
test eax, eax
je 0x100039d1
mov dword [eax], edi
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0x18
mov eax, 0x80070057
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0x18
Function at 0x100039f0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov eax, dword [esp + 0x18]
sub esp, 8
push ebx
push ebp
push esi
push edi
test eax, eax
je 0x10003a05
mov dword [eax], 0
cmp dword [esp + 0x2c], 0
je 0x10003b6a
cmp dword [esp + 0x28], 0
je 0x10003b76
cmp dword [esp + 0x20], 0xffffffff
je 0x10003b76
mov eax, dword [esp + 0x24]
test eax, eax
je 0x10003b76
mov edi, dword [eax + 4]
mov esi, dword [eax]
push 0
push 0x200
push edi
push esi
call fcn.1009f780
push 0
push 0x200
push edx
push eax
call fcn.10065760
mov ebx, eax
mov eax, dword [esp + 0x2c]
xor ecx, ecx
sub eax, ebx
mov ebp, edx
sbb ecx, ebp
add eax, esi
adc ecx, edi
push 0
add eax, 0x1ff
push 0x200
adc ecx, 0
push ecx
push eax
call fcn.1009f780
mov esi, dword [esp + 0x1c]
mov edi, eax
shl edi, 9
call fcn.10003850
test eax, eax
jl 0x10003b7b
cmp eax, 1
je 0x10003b7b
mov esi, dword [esp + 0x20]
push 0
push 0
push ebp
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x10003abe
call fcn.10002c20
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0x18
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
push 0
lea edx, [esp + 0x18]
push edx
push edi
push ecx
push esi
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10003aaf
mov edx, dword [esp + 0x24]
mov esi, dword [edx]
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x28]
push eax
mov eax, dword [edx]
sub esi, ebx
push ecx
add eax, esi
push eax
call fcn.10059a80
add esp, 0xc
push 0
push 0
push ebp
push ebx
mov ebx, dword [esp + 0x30]
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x10003aaf
mov edx, dword [esp + 0x1c]
mov eax, dword [edx]
push 0
lea ecx, [esp + 0x14]
push ecx
push edi
push eax
push ebx
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10003aaf
mov edx, dword [esp + 0x30]
test edx, edx
je 0x10003b6a
mov eax, dword [esp + 0x10]
cmp eax, esi
ja 0x10003b5c
xor eax, eax
mov dword [edx], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0x18
mov ecx, dword [esp + 0x2c]
sub eax, esi
cmp eax, ecx
jb 0x10003b68
mov eax, ecx
mov dword [edx], eax
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0x18
mov eax, 0x80070057
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0x18
Function at 0x10008880
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x1a0
mov eax, dword [0x100d1040]
xor eax, esp
mov dword [esp + 0x198], eax
push ebx
lea eax, [esp + 8]
xor ebx, ebx
push eax
mov dword [esi + 0x20], 0xf
mov dword [esi + 0x1c], ebx
push 0x202
mov byte [esi + 0xc], bl
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0x100d61b4
push 0x1f4
call fcn.10057582
push 0x1f4
push ebx
push eax
mov dword [esi + 0x24], eax
call fcn.10059a00
mov ecx, dword [esp + 0x1b0]
or eax, 0xffffffff
add esp, 0x14
mov dword [esi + 0x38], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x28], ebx
pop ebx
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
xor ecx, esp
mov eax, esi
call fcn.1005710f
add esp, 0x1a0
ret

Function at 0x10008cc0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push ebp
push esi
mov esi, eax
mov ebp, dword [esi + 0x40]
mov edx, dword [esi + 0x44]
mov eax, ebp
or eax, edx
push edi
jne 0x10008cde
mov eax, 0x80004005
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x10008e07
mov ebx, dword [esp + 0x18]
cmp ebx, edx
ja 0x10008e07
mov edi, dword [esp + 0x14]
jb 0x10008d04
cmp edi, ebp
jae 0x10008e07
xor eax, eax
add ecx, edi
adc eax, ebx
cmp eax, edx
jb 0x10008d1c
ja 0x10008d14
cmp ecx, ebp
jbe 0x10008d1c
sub ebp, edi
mov dword [esp + 0x1c], ebp
jmp 0x10008d20
mov ebp, dword [esp + 0x1c]
mov ecx, dword [esi + 0x30]
cmp ecx, edi
jne 0x10008d2e
mov edx, dword [esi + 0x34]
cmp edx, ebx
je 0x10008d93
mov ecx, esi
call fcn.10009480
test eax, eax
jl 0x10008e17
cmp eax, 1
je 0x10008e17
push ebx
push edi
call fcn.10009750
test eax, eax
jl 0x10008e17
cmp eax, 1
je 0x10008e17
mov ecx, esi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], ebx
call fcn.10009900
test eax, eax
jl 0x10008e17
cmp eax, 1
je 0x10008e17
push esi
call fcn.100095c0
test eax, eax
jl 0x10008e17
cmp eax, 1
je 0x10008e17
mov edi, ebp
test ebp, ebp
jbe 0x10008de9
mov ebp, dword [sym.imp.WS2_32.dll_recv]
nop
mov ecx, 0x1000
cmp edi, 0x1000
ja 0x10008daf
mov ecx, edi
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x10008cd2
push 0
push ecx
mov ecx, dword [esp + 0x24]
sub ecx, edi
add ecx, dword [esp + 0x28]
push ecx
push eax
call ebp
cmp eax, 0xffffffff
jne 0x10008dfc
xor ebx, ebx
call fcn.10002c20
test eax, eax
jl 0x10008e17
cmp eax, 1
je 0x10008e17
sub edi, ebx
jne 0x10008da0
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
test eax, eax
je 0x10008e15
mov dword [eax], ebp
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
add dword [esi + 0x30], eax
mov ebx, eax
adc dword [esi + 0x34], 0
jmp 0x10008de1
mov eax, dword [esp + 0x24]
test eax, eax
je 0x10008e15
mov dword [eax], 0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
Function at 0x10008e20
Capabilities:
Connect to http server
Create http request

Disassembly:
sub esp, 0x264
mov eax, dword [0x100d1040]
xor eax, esp
mov dword [esp + 0x25c], eax
mov eax, dword [esp + 0x268]
push ebx
mov ebx, dword [esp + 0x274]
push ebp
mov ebp, dword [esp + 0x274]
push esi
push edi
push 0
push 0
push 0
push 0
push 0x100c40a0
mov dword [esp + 0x24], eax
mov esi, edx
mov dword [esp + 0x28], ecx
call dword [sym.imp.WININET.dll_InternetOpenW]
mov edi, eax
mov eax, 8
cmp dword [esi + 0x18], eax
jb 0x10008e7b
mov esi, dword [esi + 4]
jmp 0x10008e7e
add esi, 4
cmp dword [ebx + 0x18], eax
jb 0x10008e88
mov ebx, dword [ebx + 4]
jmp 0x10008e8b
add ebx, 4
cmp dword [ebp + 0x18], eax
jb 0x10008e95
mov ebp, dword [ebp + 4]
jmp 0x10008e98
add ebp, 4
mov edx, dword [esp + 0x284]
push 0
push 0x8000000
push 1
push esi
push ebx
push edx
push ebp
push edi
call dword [sym.imp.WININET.dll_InternetConnectW]
mov esi, eax
test esi, esi
jne 0x10008efd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2eee
jne 0x10008edb
test edi, edi
je 0x10008ed1
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, 0xe0036003
jmp 0x10008f93
test eax, eax
jle 0x10008ee9
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test edi, edi
je 0x10008ef6
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, esi
jmp 0x10008f93
mov eax, dword [esp + 0x14]
cmp dword [eax + 0x18], 8
jb 0x10008f0c
mov eax, dword [eax + 4]
jmp 0x10008f0f
add eax, 4
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
push eax
push esi
call dword [sym.imp.WININET.dll_FtpFindFirstFileW]
test eax, eax
jne 0x10008f3f
call fcn.10002c20
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ebx, eax
call esi
test edi, edi
je 0x10008f3b
push edi
call esi
mov eax, ebx
jmp 0x10008f93
mov ecx, dword [esp + 0x38]
mov ebx, dword [esp + 0x34]
xor edx, edx
or edx, ecx
mov ecx, dword [esp + 0x10]
xor ebp, ebp
or ebx, ebp
mov dword [ecx + 0x40], edx
mov dword [ecx + 0x44], ebx
or edx, ebx
mov ebx, dword [sym.imp.WININET.dll_InternetCloseHandle]
push eax
jne 0x10008f77
call ebx
push esi
call ebx
test edi, edi
je 0x10008f70
push edi
call ebx
mov eax, 0xe0036006
jmp 0x10008f93
mov edx, dword [esp + 0x34]
mov dword [ecx + 0x4c], edx
mov edx, dword [esp + 0x30]
mov dword [ecx + 0x48], edx
call ebx
push esi
call ebx
test edi, edi
je 0x10008f91
push edi
call ebx
xor eax, eax
mov ecx, dword [esp + 0x26c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1005710f
add esp, 0x264
ret 0x10
Function at 0x10008fb0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns
Set socket configuration

Disassembly:
sub esp, 0x1c
mov eax, dword [0x100d1040]
xor eax, esp
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x24]
push ebx
push ebp
mov ebp, dword [esp + 0x28]
mov dword [esp + 8], eax
mov eax, dword [esi]
push edi
mov edi, ecx
cmp eax, 0xffffffff
je 0x10008fe3
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi], 0xffffffff
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x1000900f
call fcn.10002c20
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.1005710f
add esp, 0x1c
ret 0xc
push 4
lea ecx, [esp + 0x14]
push ecx
push 0x1006
push 0xffff
push eax
mov dword [esp + 0x24], 0x7530
call dword [sym.imp.WS2_32.dll_setsockopt]
xor eax, eax
cmp dword [edi + 0x18], 0x10
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
lea ebx, [edi + 4]
jb 0x1000904e
mov eax, dword [ebx]
jmp 0x10009050
mov eax, ebx
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x10009094
cmp dword [edi + 0x18], 0x10
jb 0x10009064
mov ebx, dword [ebx]
push ebx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov edi, eax
test edi, edi
je 0x10008ff6
movsx edx, word [edi + 0xa]
mov eax, dword [edi + 0xc]
mov ecx, dword [eax]
push edx
push ecx
lea edx, [esp + 0x20]
push edx
call fcn.10059a80
mov ax, word [edi + 8]
add esp, 0xc
mov word [esp + 0x14], ax
jmp 0x100090a2
mov ecx, 2
mov word [esp + 0x14], cx
mov dword [esp + 0x18], eax
mov edx, dword [esp + 0x34]
push edx
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [esi]
mov word [esp + 0x16], ax
push 0x10
lea eax, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x10008ff6
mov edx, dword [esp + 0xc]
push edx
push esi
mov ecx, ebp
call fcn.100090f0
mov ecx, dword [esp + 0x24]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.1005710f
add esp, 0x1c
ret 0xc
Function at 0x10009480
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
sub esp, 0x20
mov eax, dword [0x100d1040]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebp
push esi
push 9
mov esi, ecx
push str.TYPE_I__r_n
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], 0
mov byte [esp + 0x14], 0
call fcn.10002330
mov eax, dword [esp + 0xc]
mov ebp, 0x10
cmp dword [esp + 0x20], ebp
jae 0x100094ca
lea eax, [esp + 0xc]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esi]
push 0
push ecx
push eax
push edx
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x1000950d
call fcn.10002c20
mov esi, eax
cmp dword [esp + 0x20], ebp
jb 0x100094fa
mov eax, dword [esp + 0xc]
push eax
call fcn.10057104
add esp, 4
mov eax, esi
pop esi
pop ebp
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.1005710f
add esp, 0x20
ret
mov ecx, dword [esi + 0x24]
mov edx, dword [esi]
push edi
push 0
push 0x1f4
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x10009583
call fcn.10002c20
mov edi, eax
test edi, edi
jl 0x1000958c
cmp edi, 1
je 0x1000958c
mov eax, dword [esi + 0x24]
test eax, eax
je 0x1000955c
cmp byte [eax], 0
je 0x1000955c
push str._n226
push eax
call fcn.10057ae0
add esp, 8
test eax, eax
je 0x1000955c
mov dword [esi + 0x28], 1
cmp dword [esp + 0x24], ebp
jb 0x1000956f
mov edx, dword [esp + 0x10]
push edx
call fcn.10057104
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.1005710f
add esp, 0x20
ret
mov ecx, dword [esi + 0x24]
mov byte [eax + ecx], 0
jmp 0x10009537
cmp dword [esp + 0x24], ebp
jb 0x1000959f
mov eax, dword [esp + 0x10]
push eax
call fcn.10057104
add esp, 4
mov ecx, dword [esp + 0x28]
mov eax, edi
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.1005710f
add esp, 0x20
ret
Function at 0x100095c0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push 0xffffffffffffffff
push 0x100a10e8
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x100d1040]
xor eax, esp
mov dword [esp + 0x54], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100d1040]
xor eax, esp
push eax
lea eax, [esp + 0x6c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x7c]
lea eax, [ebp + 8]
push eax
mov ecx, str.RETR
lea edi, [esp + 0x18]
call fcn.1000a160
xor ebx, ebx
push eax
lea esi, [esp + 0x54]
mov dword [esp + 0x7c], ebx
call fcn.1000a210
add esp, 8
mov esi, 0x10
mov byte [esp + 0x74], 2
cmp dword [esp + 0x2c], esi
jb 0x10009638
mov ecx, dword [esp + 0x18]
push ecx
call fcn.10057104
add esp, 4
mov eax, dword [esp + 0x50]
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], 0
cmp dword [esp + 0x64], esi
jae 0x10009657
lea eax, [esp + 0x50]
mov edx, dword [esp + 0x60]
push ebx
push edx
push eax
mov eax, dword [ebp]
push eax
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x10009688
call fcn.10002c20
mov edi, eax
cmp dword [esp + 0x64], esi
jb 0x10009727
mov ecx, dword [esp + 0x50]
push ecx
jmp 0x1000971f
mov edx, dword [ebp + 0x24]
mov eax, dword [ebp]
push ebx
push 0x1f4
push edx
push eax
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x100096f5
call fcn.10002c20
mov edi, eax
cmp edi, ebx
jl 0x10009714
cmp edi, 1
je 0x10009714
push ebp
lea ecx, [esp + 0x34]
call fcn.10009ef0
mov ecx, 0x100c40e0
mov edi, eax
mov byte [esp + 0x74], 3
call fcn.1000a2c0
mov bl, al
cmp dword [esp + 0x48], esi
jb 0x100096e1
mov edx, dword [esp + 0x34]
push edx
call fcn.10057104
add esp, 4
test bl, bl
je 0x100096fe
lea ecx, [esp + 0x4c]
call fcn.10002150
mov eax, 1
jmp 0x10009729
mov ecx, dword [ebp + 0x24]
mov byte [eax + ecx], 0
jmp 0x100096b1
mov esi, ebp
call fcn.10009e90
lea ecx, [esp + 0x4c]
mov esi, eax
call fcn.10002150
mov eax, esi
jmp 0x10009729
cmp dword [esp + 0x64], esi
jb 0x10009727
mov eax, dword [esp + 0x50]
push eax
call fcn.10057104
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x6c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x54]
xor ecx, esp
call fcn.1005710f
add esp, 0x64
ret 4
Function at 0x10009750
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
sub esp, 0x38
mov eax, dword [0x100d1040]
xor eax, esp
mov dword [esp + 0x34], eax
push 0x31
lea eax, [esp + 5]
push 0
push eax
mov byte [esp + 0xc], 0
call fcn.10059a00
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x48]
push ecx
push edx
push str.REST__I64d__r_n
lea edx, [esp + 0x18]
call fcn.1000a320
lea eax, [esp + 0x18]
add esp, 0x18
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10009793
mov ecx, dword [esi]
sub eax, edx
push 0
inc eax
push eax
lea eax, [esp + 8]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x100097c9
call fcn.10002c20
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.1005710f
add esp, 0x38
ret 8
mov edx, dword [esi + 0x24]
mov eax, dword [esi]
push 0
push 0x1f4
push edx
push eax
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x10009828
call fcn.10002c20
test eax, eax
jl 0x10009817
cmp eax, 1
je 0x10009817
mov eax, dword [esi + 0x24]
test eax, eax
je 0x10009815
cmp byte [eax], 0
je 0x10009815
push str._n226
push eax
call fcn.10057ae0
add esp, 8
test eax, eax
je 0x10009815
mov dword [esi + 0x28], 1
xor eax, eax
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.1005710f
add esp, 0x38
ret 8
mov ecx, dword [esi + 0x24]
mov byte [eax + ecx], 0
jmp 0x100097f0
Function at 0x1000aac0
Capabilities:
Read data from internet
Receive data

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 0x70]
mov esi, eax
mov eax, dword [edi + 0x74]
mov edx, ecx
or edx, eax
jne 0x1000aae6
mov eax, 0x80004005
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov edx, dword [esp + 0x24]
xor ebp, ebp
cmp edx, ebp
je 0x1000aaf2
mov dword [edx], ebp
cmp esi, ebp
je 0x1000ab57
mov edx, dword [esp + 0x1c]
cmp edx, eax
ja 0x1000ab57
mov eax, dword [esp + 0x18]
jb 0x1000ab08
cmp eax, ecx
ja 0x1000ab57
push edx
push eax
call fcn.1000ab70
cmp eax, ebp
jl 0x1000ab59
cmp eax, 1
je 0x1000ab59
cmp esi, ebp
jbe 0x1000ab57
lea esp, [esp]
mov eax, dword [edi + 8]
lea ecx, [esp + 0x20]
push ecx
push esi
push ebx
push eax
mov dword [esp + 0x30], ebp
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x1000ab61
mov eax, dword [esp + 0x20]
cmp eax, ebp
je 0x1000ab57
mov ecx, dword [esp + 0x24]
cmp ecx, ebp
je 0x1000ab4b
add dword [ecx], eax
add dword [edi + 0x10], eax
adc dword [edi + 0x14], ebp
add ebx, eax
sub esi, eax
jne 0x1000ab20
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
call fcn.10002c20
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
Function at 0x1000b3a0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x100a09e8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push edi
mov eax, dword [0x100d1040]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor edi, edi
push 0xffffffffffffffff
xor eax, eax
push edi
mov word [esp + 0x18], ax
push ecx
lea eax, [esp + 0x18]
mov dword [esp + 0x14], edi
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], edi
call fcn.10002850
mov eax, str._r_nAccept:__r_nRange:_bytes0_0_r_n_r_n
mov dword [esp + 0x30], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x1000b3f6
sub eax, edx
sar eax, 1
push eax
push str._r_nAccept:__r_nRange:_bytes0_0_r_n_r_n
lea eax, [esp + 0x14]
call fcn.100024a0
push 0xffffffffffffffff
push edi
xor edx, edx
push eax
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
mov eax, esi
mov word [esi + 4], dx
call fcn.10002850
cmp dword [esp + 0x24], 8
jb 0x1000b443
mov eax, dword [esp + 0x10]
push eax
call fcn.10057104
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x2c
ret

Function at 0x1000b4e0
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes

Disassembly:
sub esp, 0x20c
mov eax, dword [0x100d1040]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [esp + 0xe]
push ecx
mov word [esp + 0x10], ax
call fcn.10059a00
add esp, 0xc
lea edx, [esp + 4]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x1000b53e
cmp eax, 0x104
ja 0x1000b53e
push str.WMCache_
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x1000b554
call fcn.10002c20
test eax, eax
jl 0x1000b600
cmp eax, 1
je 0x1000b600
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1000b590
push 0
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1000b590
call fcn.10002c20
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.1005710f
add esp, 0x20c
ret
push ebx
lea ebx, [edi + 8]
push ebx
push 0
push 0x100c4278
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x1000b5e1
mov dword [edi + 0x214], esi
neg esi
push 0
sbb esi, esi
and esi, 0x20000000
or esi, 0x4000000
push esi
push 2
push 0
push 0
push 0xc0000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [edi + 0x210], eax
cmp eax, 0xffffffff
jne 0x1000b5fd
call fcn.10002c20
pop ebx
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.1005710f
add esp, 0x20c
ret
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x20c]
pop esi
xor ecx, esp
call fcn.1005710f
add esp, 0x20c
ret