joyce8/EMBER2024-capa huggingface dataset:
Function at 0x470ce5
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x4aa880]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x470d28
cmp word [esi], dx
jne 0x470d28
or byte [edi + eax + 0x28], 4
jmp 0x470d2d
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x470e80
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x470e60
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x470d6f
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x470da5
cmp eax, edx
jae 0x470db1
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x470d47
jmp 0x470e80
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x470e5c
cmp dword [ebp - 0x14], 0
je 0x470e5c
mov eax, dword [ebx*4 + 0x4aa880]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x470e34
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x470dfd
mov word [esi], cx
jmp 0x470e30
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x4aa880]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x4aa880]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x4aa880]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x470e80
pop ebx
cmp word [ebp - 4], bx
jne 0x470e45
cmp esi, dword [ebp + 0xc]
jne 0x470e45
mov word [esi], bx
jmp 0x470e7d
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00471a2e
add esp, 0x10
cmp word [ebp - 4], bx
je 0x470e80
push 0xd
jmp 0x470e79
mov ecx, dword [ebx*4 + 0x4aa880]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x470e77
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x470e80
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10001110
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
push ebx
push esi
xor edx, edx
push edi
lea esi, [edx + 0x20]
mov edi, ecx
shr edi, 5
add edi, dword [0x100190dc]
mov ebx, ecx
shl ebx, 4
add ebx, dword [0x100190d8]
sub edx, 0x61c88647
xor edi, ebx
lea ebx, [edx + ecx]
xor edi, ebx
add eax, edi
mov edi, eax
shr edi, 5
add edi, dword [0x100190e4]
mov ebx, eax
shl ebx, 4
add ebx, dword [0x100190e0]
xor edi, ebx
lea ebx, [edx + eax]
xor edi, ebx
add ecx, edi
sub esi, 1
jne 0x10001121
mov edx, dword [esp + 0x10]
pop edi
mov dword [edx], eax
lea eax, [esi + 1]
pop esi
mov dword [edx + 4], ecx
pop ebx
ret

Function at 0x10001180
Capabilities:
Decrypt data using tea
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
push ebx
push esi
push edi
mov edx, 0xc6ef3720
mov esi, 0x20
jmp 0x100011a0
mov edi, ecx
shr edi, 5
add edi, dword [0x100190e4]
mov ebx, ecx
shl ebx, 4
add ebx, dword [0x100190e0]
xor edi, ebx
lea ebx, [edx + ecx]
xor edi, ebx
sub eax, edi
mov edi, eax
shr edi, 5
add edi, dword [0x100190dc]
mov ebx, eax
shl ebx, 4
add ebx, dword [0x100190d8]
xor edi, ebx
lea ebx, [edx + eax]
xor edi, ebx
sub ecx, edi
add edx, 0x61c88647
sub esi, 1
jne 0x100011a0
mov edx, dword [esp + 0x10]
pop edi
mov dword [edx + 4], eax
lea eax, [esi + 1]
pop esi
mov dword [edx], ecx
pop ebx
ret
Function at 0x10001320
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
mov edi, eax
mov esi, ecx
mov ecx, dword [esp + 0x10]
cmp edi, 3
jb 0x100013aa
mov eax, 0xaaaaaaab
mul edi
push ebp
mov ebp, edx
shr ebp, 1
lea esp, [esp]
mov al, byte [esi]
movzx edx, al
shr edx, 2
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
mov bl, byte [esi + 1]
and al, 3
inc esi
shl al, 4
movzx edx, bl
shr edx, 4
movzx eax, al
or edx, eax
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], dl
mov al, byte [esi + 1]
inc ecx
inc esi
and bl, 0xf
add bl, bl
movzx eax, al
add bl, bl
mov edx, eax
shr edx, 6
movzx ebx, bl
or edx, ebx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], dl
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc esi
inc ecx
sub edi, 3
sub ebp, 1
jne 0x10001340
pop ebp
test edi, edi
je 0x10001414
sub edi, 1
mov al, byte [esi]
je 0x100013ba
mov dl, byte [esi + 1]
jmp 0x100013bc
xor dl, dl
movzx esi, al
shr esi, 2
mov bl, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
and al, 3
shl al, 4
movzx esi, dl
movzx eax, al
shr esi, 4
mov byte [ecx], bl
or esi, eax
mov al, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc ecx
test edi, edi
je 0x1000140c
and dl, 0xf
add dl, dl
add dl, dl
movzx edx, dl
mov al, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
inc ecx
mov byte [ecx], 0x3d
inc ecx
pop edi
mov eax, ecx
sub eax, dword [esp + 0xc]
pop esi
mov byte [ecx], 0
pop ebx
ret
mov byte [ecx], 0x3d
inc ecx
mov byte [ecx], 0x3d
inc ecx
pop edi
mov eax, ecx
sub eax, dword [esp + 0xc]
pop esi
mov byte [ecx], 0
pop ebx
ret

Function at 0x100015a0
Capabilities:
Create directory
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x10018090]
xor eax, esp
mov dword [esp + 0x208], eax
push ebp
mov ebp, dword [esp + 0x214]
push esi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x12]
push ecx
mov word [esp + 0x14], ax
call fcn.1000c1f0
add esp, 0xc
lea edx, [esp + 8]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x208
call fcn.10004eae
push 0x104
mov esi, eax
push 0
push esi
call fcn.1000c1f0
add esp, 0x10
mov edx, esi
test edi, edi
je 0x10001642
push edi
lea eax, [esp + 0xc]
push eax
push 0x1001611c
call fcn.10001000
add esp, 0xc
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1000162f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
push esi
push str._s_s
mov edx, ebp
call fcn.10001000
add esp, 0xc
jmp 0x10001662
lea ecx, [esp + 8]
push ecx
push 0x10016134
call fcn.10001000
push ebx
push esi
push 0x1001611c
mov edx, ebp
call fcn.10001000
add esp, 0x14
push esi
call fcn.10005a96
mov ecx, dword [esp + 0x214]
add esp, 4
pop esi
pop ebp
xor ecx, esp
mov eax, 1
call fcn.10004eb9
add esp, 0x20c
ret
Function at 0x10001720
Capabilities:
Delete file
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x238
mov eax, dword [0x10018090]
xor eax, esp
mov dword [esp + 0x234], eax
push ebx
push ebp
push esi
push edi
xor eax, eax
mov esi, ecx
push 0x206
push eax
lea ecx, [esp + 0x42]
push ecx
mov dword [esp + 0x28], esi
mov word [esp + 0x44], ax
call fcn.1000c1f0
lea edx, [esp + 0x44]
push edx
mov ebx, 0x1001613c
mov edi, str.WINSUPDATE
call fcn.100015a0
lea eax, [esp + 0x48]
push 0x1001615c
push eax
call fcn.10005625
mov edi, eax
add esp, 0x18
test edi, edi
je 0x10001935
push 2
push 0
push edi
call fcn.10006314
push edi
call fcn.1000621c
push edi
mov ebx, eax
call fcn.10005310
add esp, 0x14
cmp ebx, 0x100000
jle 0x100017d0
push edi
call fcn.1000650c
add esp, 4
lea ecx, [esp + 0x38]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea edx, [esp + 0x38]
push 0x10016164
push edx
call fcn.10005625
add esp, 8
mov edi, eax
test edi, edi
je 0x10001935
mov eax, esi
lea esi, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100017e0
sub eax, esi
lea ebp, [eax + ebx + 0x104]
push ebp
call fcn.10004eae
push ebp
mov esi, eax
push 0
push esi
mov dword [esp + 0x24], esi
call fcn.1000c1f0
push edi
push ebx
push 1
push esi
call fcn.10005d41
push edi
mov dword [esp + 0x48], eax
call fcn.1000650c
lea eax, [esp + 0x5c]
push 0x10016164
push eax
call fcn.10005625
push ebp
mov dword [esp + 0x50], eax
call fcn.10004eae
push ebp
mov ebx, eax
push 0
push ebx
mov dword [esp + 0x54], ebx
call fcn.1000c1f0
mov eax, dword [esp + 0x60]
add esp, 0x3c
test eax, eax
jle 0x10001860
push ebp
push esi
lea edi, [esp + 0x20]
mov ebx, eax
call fcn.100012c0
mov ebx, dword [esp + 0x20]
add esp, 8
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edx, dword [esp + 0x24c]
movzx ecx, word [esp + 0x34]
mov eax, dword [esp + 0x1c]
push edx
movzx edx, word [esp + 0x36]
push eax
movzx eax, word [esp + 0x38]
push ecx
movzx ecx, word [esp + 0x3a]
push edx
movzx edx, word [esp + 0x3a]
push eax
movzx eax, word [esp + 0x3c]
push ecx
push edx
push eax
push str._d__d__d__d:_d:_d__s_err:_d_n
push esi
call fcn.10005150
add esp, 0x28
mov eax, esi
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100018b0
mov edi, ebx
sub eax, esi
dec edi
lea esp, [esp]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x100018c0
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push ebp
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x18]
push 0
push ecx
call fcn.1000c1f0
mov eax, ebx
add esp, 0xc
lea esi, [eax + 1]
jmp 0x100018f0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100018f0
push ebp
lea edx, [esp + 0x18]
push edx
sub eax, esi
push ebx
call fcn.10001200
mov edi, dword [esp + 0x2c]
mov esi, dword [esp + 0x20]
push edi
push eax
push 1
push esi
call fcn.10005ffd
add esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
call fcn.1000650c
push esi
call fcn.10005a96
push ebx
call fcn.10005a96
add esp, 0xc
mov ecx, dword [esp + 0x244]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.10004eb9
add esp, 0x238
ret
Function at 0x100019d0
Capabilities:
Prepare http request

Disassembly:
mov ecx, dword [0x10019ca4]
push esi
push 0
push 0
push 0
push 0
push eax
push 0x1001618c
push ecx
mov esi, 1
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov dword [0x10019ca0], eax
test eax, eax
jne 0x100019ff
or eax, 0xffffffff
pop esi
ret
push 0x1001618c
push 0x1001618c
call fcn.100050bd
add esp, 8
test eax, eax
jne 0x10001a46
cmp dword [esp + 8], esi
jne 0x10001a20
call fcn.10001960
mov edx, dword [0x10019ca0]
push 0
push 0
push 0
push 0
push 0
push 0
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
jne 0x10001a46
call dword [sym.imp.KERNEL32.dll_GetLastError]
or esi, 0xffffffff
mov eax, esi
pop esi
ret

Function at 0x10001a50
Capabilities:
Initialize winhttp library
Prepare http request

Disassembly:
mov eax, dword [0x10019ca0]
push ebx
mov ebx, dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
push esi
push edi
xor edi, edi
cmp eax, edi
je 0x10001a6d
push eax
call ebx
mov dword [0x10019ca0], edi
mov eax, dword [0x10019ca4]
cmp eax, edi
je 0x10001a7f
push eax
call ebx
mov dword [0x10019ca4], edi
mov eax, dword [0x10019ca8]
cmp eax, edi
je 0x10001a91
push eax
call ebx
mov dword [0x10019ca8], edi
push edi
push edi
push edi
push edi
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov ecx, eax
mov dword [0x10019ca8], ecx
cmp ecx, edi
je 0x10001b3a
mov eax, dword [0x10019ca4]
cmp eax, edi
jne 0x10001acd
push edi
push 0x50
push str.www.google.co.in
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov dword [0x10019ca4], eax
cmp eax, edi
je 0x10001b3a
push edi
push edi
push edi
push edi
push 0x10016194
push 0x1001618c
push eax
mov esi, 1
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov dword [0x10019ca0], eax
cmp eax, edi
je 0x10001b3a
push 0x1001618c
push 0x1001618c
call fcn.100050bd
add esp, 8
test eax, eax
jne 0x10001b25
mov eax, dword [0x10019ca0]
push edi
push edi
push edi
push edi
push edi
push edi
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
jne 0x10001b25
call dword [sym.imp.KERNEL32.dll_GetLastError]
or esi, 0xffffffff
cmp esi, edi
jle 0x10001b3d
mov ecx, dword [0x10019ca0]
push ecx
call ebx
mov dword [0x100190d0], edi
jmp 0x10001b49
or esi, 0xffffffff
mov eax, dword [0x10019ca0]
cmp eax, edi
je 0x10001b4f
push eax
call ebx
mov dword [0x10019ca0], edi
mov eax, dword [0x10019ca4]
cmp eax, edi
je 0x10001b61
push eax
call ebx
mov dword [0x10019ca4], edi
mov eax, dword [0x10019ca8]
cmp eax, edi
je 0x10001b73
push eax
call ebx
mov dword [0x10019ca8], edi
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x10001b80
Capabilities:
Check http status code
Initialize winhttp library
Read http header
Receive http response

Disassembly:
sub esp, 0x10c
mov eax, dword [0x10018090]
xor eax, esp
mov dword [esp + 0x108], eax
mov eax, dword [0x10019ca0]
push ebx
mov ebx, dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
push esi
push edi
xor edi, edi
mov esi, ecx
cmp eax, edi
je 0x10001bb3
push eax
call ebx
mov dword [0x10019ca0], edi
mov eax, dword [0x10019ca4]
cmp eax, edi
je 0x10001bc5
push eax
call ebx
mov dword [0x10019ca4], edi
mov eax, dword [0x10019ca8]
cmp eax, edi
je 0x10001bd7
push eax
call ebx
mov dword [0x10019ca8], edi
push 0xfe
lea ecx, [esp + 0x1a]
xor eax, eax
push edi
push ecx
mov word [esp + 0x20], ax
call fcn.1000c1f0
mov ecx, 8
add esp, 0xc
cmp dword [esi + 0x34], ecx
jb 0x10001c00
mov eax, dword [esi + 0x20]
jmp 0x10001c03
lea eax, [esi + 0x20]
cmp dword [esi + 0x18], ecx
jb 0x10001c0d
mov esi, dword [esi + 4]
jmp 0x10001c10
add esi, 4
push eax
push esi
push 0x10016198
lea edx, [esp + 0x20]
call fcn.10001000
add esp, 0xc
push edi
push str._local_
lea edx, [esp + 0x1c]
push edx
push 3
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov dword [0x10019ca8], eax
cmp eax, edi
je 0x10001cd1
push edi
push 0x50
push str.www.google.co.in
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov dword [0x10019ca4], eax
cmp eax, edi
je 0x10001cd1
push 1
mov eax, 0x10016194
call fcn.100019d0
mov esi, eax
add esp, 4
cmp esi, edi
jle 0x10001cd4
mov eax, dword [0x10019ca0]
push edi
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
jle 0x10001cbe
mov eax, dword [0x10019ca0]
push edi
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
push edi
push 0x20000013
push eax
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], 4
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x10001cd4
cmp dword [esp + 0xc], 0xc8
jne 0x10001cd1
mov esi, 1
mov ecx, dword [0x10019ca0]
mov dword [0x100190d0], 1
push ecx
jmp 0x10001cde
or esi, 0xffffffff
mov eax, dword [0x10019ca0]
cmp eax, edi
je 0x10001ce6
push eax
call ebx
mov dword [0x10019ca0], edi
mov ecx, dword [esp + 0x114]
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.10004eb9
add esp, 0x10c
ret
Function at 0x10001fe0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov esi, eax
mov eax, dword [0x10019cb0]
push 0x10016200
push eax
call fcn.10005625
mov ebp, 8
add esp, 8
mov edi, eax
mov dword [esp + 0x18], edi
cmp dword [esi + 0x18], ebp
jb 0x10002015
mov ecx, dword [esi + 4]
mov dword [esp + 0x10], ecx
jmp 0x1000201c
lea edx, [esi + 4]
mov dword [esp + 0x10], edx
cmp dword [esi + 0x34], ebp
jb 0x10002026
mov eax, dword [esi + 0x20]
jmp 0x10002029
lea eax, [esi + 0x20]
push eax
call fcn.10005305
movzx eax, ax
add esp, 4
mov dword [esp + 0x14], eax
cmp dword [esi + 0x50], ebp
jb 0x10002043
mov ebx, dword [esi + 0x3c]
jmp 0x10002046
lea ebx, [esi + 0x3c]
cmp dword [esi + 0x6c], ebp
jb 0x10002050
mov ebp, dword [esi + 0x58]
jmp 0x10002053
lea ebp, [esi + 0x58]
test edi, edi
jne 0x10002062
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0xc
ret
mov eax, dword [esp + 0x10]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10002070
sub eax, edx
sar eax, 1
mov edi, eax
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10002086
sub eax, edx
sar eax, 1
mov ecx, eax
mov eax, ebp
lea edx, [eax + 2]
lea esp, [esp]
mov si, word [eax]
add eax, 2
test si, si
jne 0x100020a0
sub eax, edx
sar eax, 1
add ecx, eax
add ecx, edi
lea edi, [ecx + ecx + 0xc0]
xor ecx, ecx
mov eax, edi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10004eae
push edi
mov esi, eax
push 0
push esi
call fcn.1000c1f0
movzx eax, word [esp + 0x24]
mov ecx, dword [esp + 0x20]
push ebp
push ebx
push eax
push ecx
push str._s_r_d_r_s_r_s
mov edx, esi
call fcn.10001000
xor ecx, ecx
mov eax, edi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10004eae
mov dword [esp + 0x38], eax
mov eax, esi
add esp, 0x28
lea ecx, [eax + 2]
lea ebx, [ebx]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x10002120
sub eax, ecx
push edi
lea ecx, [esp + 0x14]
sar eax, 1
push ecx
add eax, eax
push esi
call fcn.10001200
mov ebx, dword [esp + 0x24]
mov edi, dword [esp + 0x1c]
push ebx
push eax
push 1
push edi
call fcn.10005ffd
push ebx
call fcn.1000650c
push esi
call fcn.10005a96
push edi
call fcn.10005a96
add esp, 0x28
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret
Function at 0x10002180
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x120
mov eax, dword [0x10018090]
xor eax, esp
mov dword [esp + 0x11c], eax
mov eax, dword [0x10019cb0]
push ebx
push ebp
mov ebp, dword [esp + 0x12c]
push esi
push edi
push 0x10016220
push eax
call fcn.10005625
mov edi, eax
add esp, 8
mov dword [esp + 0x1c], edi
test edi, edi
jne 0x100021c4
or eax, 0xffffffff
jmp 0x100023a0
push pe_nt_image_headers32
call fcn.10004eae
add esp, 4
push pe_nt_image_headers32
mov esi, eax
push 0
push esi
mov dword [esp + 0x24], esi
call fcn.1000c1f0
add esp, 0xc
push edi
push pe_nt_image_headers32
push 1
push esi
call fcn.10005d41
push pe_nt_image_headers32
mov ebx, eax
call fcn.10004eae
add esp, 0x14
push pe_nt_image_headers32
push 0
push eax
mov dword [esp + 0x20], eax
call fcn.1000c1f0
add esp, 0xc
push pe_nt_image_headers32
push esi
lea edi, [esp + 0x1c]
call fcn.100012c0
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push edx
mov dword [esp + 0x20], 0xd
call fcn.10006399
mov ecx, eax
add esp, 0x10
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x10002246
sub ecx, esi
sar ecx, 1
push ecx
mov esi, ebp
call fcn.10004430
lea eax, [esp + 0x10]
push eax
push 0
call fcn.10006399
mov ecx, eax
add esp, 8
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x10002271
sub ecx, esi
sar ecx, 1
lea ebx, [ebp + 0x1c]
push ecx
mov esi, ebx
call fcn.10004430
lea ecx, [esp + 0x10]
push ecx
push 0
call fcn.10006399
add esp, 8
test eax, eax
je 0x100022b5
mov ecx, eax
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x100022a3
sub ecx, esi
sar ecx, 1
push ecx
jmp 0x100022bc
push 0
mov eax, 0x100161b4
lea edi, [ebp + 0x38]
mov esi, edi
call fcn.10004430
lea edx, [esp + 0x10]
push edx
push 0
call fcn.10006399
add esp, 8
test eax, eax
je 0x100022f2
mov ecx, eax
lea esi, [ecx + 2]
mov edi, edi
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x100022e0
sub ecx, esi
sar ecx, 1
push ecx
jmp 0x100022f9
push 0
mov eax, 0x100161b4
lea esi, [ebp + 0x54]
call fcn.10004430
push 0x103
lea eax, [esp + 0x25]
push 0
push eax
mov byte [esp + 0x2c], 0
call fcn.1000c1f0
mov eax, 8
add esp, 0xc
cmp dword [esi + 0x18], eax
jb 0x10002329
mov esi, dword [esi + 4]
jmp 0x1000232c
add esi, 4
cmp dword [edi + 0x18], eax
jb 0x10002336
mov edi, dword [edi + 4]
jmp 0x10002339
add edi, 4
cmp dword [ebx + 0x18], eax
jb 0x10002343
mov ecx, dword [ebx + 4]
jmp 0x10002346
lea ecx, [ebx + 4]
cmp dword [ebp + 0x18], eax
jb 0x10002350
mov eax, dword [ebp + 4]
jmp 0x10002353
lea eax, [ebp + 4]
push esi
push edi
push ecx
push eax
lea ecx, [esp + 0x30]
push str.proxy_info_is__S__S__S__S
push ecx
call fcn.10005150
push 0
lea ecx, [esp + 0x3c]
call fcn.10001720
mov edx, dword [esp + 0x34]
add esp, 0x1c
push edx
call fcn.10005a96
mov eax, dword [esp + 0x18]
add esp, 4
push eax
call fcn.10005a96
mov ecx, dword [esp + 0x20]
add esp, 4
push ecx
call fcn.1000650c
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x12c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10004eb9
add esp, 0x120
ret
Function at 0x100023c0
Capabilities:
Create raw socket
Get hostname
Initialize winsock library
Receive data
Receive data on socket
Resolve dns
Set socket configuration

Disassembly:
sub esp, 0x2e8
mov eax, dword [0x10018090]
xor eax, esp
mov dword [esp + 0x2e4], eax
mov eax, dword [esp + 0x2ec]
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x60]
push ecx
push 0x202
mov dword [esp + 0x20], eax
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x100023ff
or eax, 0xffffffff
jmp 0x10002575
xor ebx, ebx
push ebx
push 3
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, dword [sym.imp.WS2_32.dll_setsockopt]
push 4
lea edx, [esp + 0x20]
push edx
push 2
mov ebp, eax
push ebx
mov edi, 1
push ebp
mov dword [esp + 0x30], edi
call esi
test eax, eax
jne 0x10002500
push 4
lea eax, [esp + 0x24]
push eax
push 0x1006
push 0xffff
push ebp
mov dword [esp + 0x34], 0x7d0
call esi
test eax, eax
jne 0x10002500
push 0xff
lea ecx, [esp + 0x1f5]
push ebx
push ecx
mov byte [esp + 0x1fc], bl
call fcn.1000c1f0
add esp, 0xc
push pe_nt_image_headers32
lea edx, [esp + 0x1f4]
push edx
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x10002500
lea eax, [esp + 0x1f0]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
cmp eax, ebx
je 0x10002500
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
mov ecx, 2
push 0x328
mov dword [esp + 0x58], eax
mov word [esp + 0x54], cx
call dword [sym.imp.WS2_32.dll_htons]
push 0x10
lea edx, [esp + 0x54]
push edx
push ebp
mov word [esp + 0x5e], ax
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
jne 0x10002500
push ebx
push ebx
lea eax, [esp + 0x2c]
push eax
push 0x28
lea ecx, [esp + 0x38]
push ecx
push 4
lea edx, [esp + 0x2c]
push edx
push 0x98000001
push ebp
mov dword [esp + 0x38], edi
mov dword [esp + 0x48], ebx
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x10002505
or edi, 0xffffffff
jmp 0x1000256d
push 0xffff
call fcn.10004eae
mov dword [esp + 0x14], ebx
mov ebx, dword [sym.imp.WS2_32.dll_recv]
add esp, 4
mov esi, eax
push 0xffff
push 0
push esi
call fcn.1000c1f0
add esp, 0xc
push 0
push 0xffff
push esi
push ebp
call ebx
mov edi, eax
test edi, edi
jle 0x1000255c
cmp byte [esi + 9], 6
jne 0x1000255c
mov eax, dword [esp + 0x18]
push eax
mov ecx, esi
call fcn.10002590
add esp, 4
test eax, eax
jg 0x10002568
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x3e8
jb 0x1000251e
jmp 0x1000256d
mov edi, 1
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, edi
mov ecx, dword [esp + 0x2f4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10004eb9
add esp, 0x2e8
ret