joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4efe2a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x52e028]
jne 0x4efe34
repz ret
jmp 0x4f03ce
aaa
sbb al, 0x40
add byte [esi - 1], bl
salc
nop
nop
nop
nop
mov dword [0x531bd0], eax
mov dword [0x531bcc], ecx
mov dword [0x531bc8], edx
mov dword [0x531bc4], ebx
mov dword [0x531bc0], esi
mov dword [0x531bbc], edi
mov word [0x531be8], ss
mov word [0x531bdc], cs
mov word [0x531bb8], ds
mov word [0x531bb4], es
mov word [0x531bb0], fs
mov word [0x531bac], gs
pushfd
pop dword [0x531be0]
mov eax, dword [ebp]
mov dword [0x531bd4], eax
mov eax, dword [ebp + 4]
mov dword [0x531bd8], eax
lea eax, [ebp + 8]
mov dword [0x531be4], eax
mov eax, dword [ebp - 0x320]
mov dword [0x531b20], 0x10001
mov eax, dword [0x531bd8]
mov dword [0x531ad4], eax
mov dword [0x531ac8], 0xc0000409
mov dword [0x531acc], 1
mov eax, dword [0x52e028]
mov dword [ebp - 0x328], eax
mov eax, dword [0x52e02c]
mov dword [ebp - 0x324], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x531b18], eax
push 1
call fcn.004f04fe
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x500074
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x531b18], 0
jne 0x4f04c0
push 1
call fcn.004f04fe
pop ecx
push 0xc0000409
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
leave
ret

Function at 0x4f03ce
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x52e028]
jne 0x4efe34
repz ret
jmp 0x4f03ce
aaa
sbb al, 0x40
add byte [esi - 1], bl
salc
nop
nop
nop
nop
mov dword [0x531bd0], eax
mov dword [0x531bcc], ecx
mov dword [0x531bc8], edx
mov dword [0x531bc4], ebx
mov dword [0x531bc0], esi
mov dword [0x531bbc], edi
mov word [0x531be8], ss
mov word [0x531bdc], cs
mov word [0x531bb8], ds
mov word [0x531bb4], es
mov word [0x531bb0], fs
mov word [0x531bac], gs
pushfd
pop dword [0x531be0]
mov eax, dword [ebp]
mov dword [0x531bd4], eax
mov eax, dword [ebp + 4]
mov dword [0x531bd8], eax
lea eax, [ebp + 8]
mov dword [0x531be4], eax
mov eax, dword [ebp - 0x320]
mov dword [0x531b20], 0x10001
mov eax, dword [0x531bd8]
mov dword [0x531ad4], eax
mov dword [0x531ac8], 0xc0000409
mov dword [0x531acc], 1
mov eax, dword [0x52e028]
mov dword [ebp - 0x328], eax
mov eax, dword [0x52e02c]
mov dword [ebp - 0x324], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x531b18], eax
push 1
call fcn.004f04fe
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x500074
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x531b18], 0
jne 0x4f04c0
push 1
call fcn.004f04fe
pop ecx
push 0xc0000409
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
leave
ret
Function at 0x1000a920
Capabilities:
Contain obfuscated stackstrings
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x1006b2c0]
xor eax, ebp
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x4c], ecx
push 0x10060eb4
mov eax, dword [ebp + 8]
push eax
call fcn.1003ae80
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x1000a954
xor eax, eax
jmp 0x1000aae5
push 2
push 0
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.1003c44f
add esp, 0xc
mov edx, dword [ebp - 0x10]
push edx
call fcn.1003c04a
add esp, 4
mov dword [ebp - 0xc], eax
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
call fcn.1003c44f
add esp, 0xc
cmp dword [ebp - 0xc], 0x2800
jle 0x1000a993
mov dword [ebp - 0xc], 0x2800
push 0x1006e240
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.1003b9b6
add esp, 8
mov dword [ebp - 0x44], eax
mov edx, dword [ebp - 0x44]
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0
jne 0x1000a9c6
mov eax, dword [ebp - 0x10]
push eax
call fcn.1003b0f2
add esp, 4
xor eax, eax
jmp 0x1000aae5
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0xc]
push edx
push 1
mov eax, dword [ebp - 8]
push eax
call fcn.1003be2f
add esp, 0x10
mov byte [ebp - 0x2c], 0x42
mov byte [ebp - 0x2b], 0x6f
mov byte [ebp - 0x2a], 0x74
mov byte [ebp - 0x29], 0x2e
mov byte [ebp - 0x28], 0x4c
mov byte [ebp - 0x27], 0x6f
mov byte [ebp - 0x26], 0x61
mov byte [ebp - 0x25], 0x64
mov byte [ebp - 0x24], 0x53
mov byte [ebp - 0x23], 0x65
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0x74
mov byte [ebp - 0x20], 0x69
mov byte [ebp - 0x1f], 0x6e
mov byte [ebp - 0x1e], 0x67
mov byte [ebp - 0x1d], 0x73
mov byte [ebp - 0x1c], 0
mov byte [ebp - 0x40], 0x53
mov byte [ebp - 0x3f], 0x74
mov byte [ebp - 0x3e], 0x61
mov byte [ebp - 0x3d], 0x72
mov byte [ebp - 0x3c], 0x74
mov byte [ebp - 0x3b], 0x69
mov byte [ebp - 0x3a], 0x6e
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x20
mov byte [ebp - 0x37], 0x41
mov byte [ebp - 0x36], 0x49
mov byte [ebp - 0x35], 0x54
mov byte [ebp - 0x34], 0x68
mov byte [ebp - 0x33], 0x72
mov byte [ebp - 0x32], 0x65
mov byte [ebp - 0x31], 0x61
mov byte [ebp - 0x30], 0x64
mov byte [ebp - 0x2f], 0
mov byte [ebp - 1], 0
lea eax, [ebp - 0x2c]
mov ecx, dword [ebp - 8]
call fcn.10008200
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x1000aa94
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ecx]
or edx, 0x400
mov eax, dword [ebp - 0x4c]
mov dword [eax], edx
mov byte [ebp - 1], 1
lea eax, [ebp - 0x40]
mov ecx, dword [ebp - 8]
call fcn.10008200
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x1000aabc
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ecx]
or edx, 0x800
mov eax, dword [ebp - 0x4c]
mov dword [eax], edx
mov byte [ebp - 1], 1
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x48], ecx
mov edx, dword [ebp - 0x48]
push edx
call fcn.1003ad90
add esp, 4
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0x10]
push eax
call fcn.1003b0f2
add esp, 4
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.1003ad81
mov esp, ebp
pop ebp
ret 4
Function at 0x10014750
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x34], ecx
push 0
push 0
push 3
push 0
push 1
push connect
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x10014782
xor al, al
jmp 0x100148ab
push 0
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x2800000
jb 0x100147ab
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x100148ab
push 0x1000
call fcn.1003ad06
add esp, 4
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100147ce
xor al, al
jmp 0x100148ab
mov dword [ebp - 0x1c], 0
push 0
lea ecx, [ebp - 0x1c]
push ecx
push 0x1000
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x10014800
cmp dword [ebp - 0x1c], 0x1000
je 0x10014819
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
push edx
call fcn.1003ad90
add esp, 4
xor al, al
jmp 0x100148ab
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x10014843
mov eax, dword [ebp - 4]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.1003ad90
add esp, 4
xor al, al
jmp 0x100148ab
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
cmp dword [ecx], 0x4550
je 0x10014870
mov edx, dword [ebp - 4]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
push eax
call fcn.1003ad90
add esp, 4
xor al, al
jmp 0x100148ab
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x34]
mov dword [ecx], eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x50]
mov dword [ecx], eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
push eax
call fcn.1003ad90
add esp, 4
mov dword [ebp - 4], 0
mov al, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100148c0
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x34], ecx
push 0
push 0
push 3
push 0
push 1
push connect
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x100148f2
xor al, al
jmp 0x10014a1b
push 0
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x2800000
jb 0x1001491b
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x10014a1b
push 0x1000
call fcn.1003ad06
add esp, 4
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1001493e
xor al, al
jmp 0x10014a1b
mov dword [ebp - 0x1c], 0
push 0
lea ecx, [ebp - 0x1c]
push ecx
push 0x1000
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x10014970
cmp dword [ebp - 0x1c], 0x1000
je 0x10014989
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
push edx
call fcn.1003ad90
add esp, 4
xor al, al
jmp 0x10014a1b
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x100149b3
mov eax, dword [ebp - 4]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.1003ad90
add esp, 4
xor al, al
jmp 0x10014a1b
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
cmp dword [ecx], 0x4550
je 0x100149e0
mov edx, dword [ebp - 4]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
push eax
call fcn.1003ad90
add esp, 4
xor al, al
jmp 0x10014a1b
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x34]
mov dword [ecx], eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x50]
mov dword [ecx], eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
push eax
call fcn.1003ad90
add esp, 4
mov dword [ebp - 4], 0
mov al, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1001e340
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1005e5a0
mov eax, dword fs:[0]
push eax
sub esp, 0x50
push ebx
push esi
push edi
mov eax, dword [0x1006b2c0]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov ecx, dword [ebx + 0x18]
mov eax, dword [ecx + 4]
cmp byte [eax + 0x31], 0
mov edi, ecx
jne 0x1001e396
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx]
cmp dword [eax + 0xc], ecx
jae 0x1001e38c
mov eax, dword [eax + 8]
jmp 0x1001e390
mov edi, eax
mov eax, dword [eax]
cmp byte [eax + 0x31], 0
je 0x1001e382
mov esi, dword [ebx]
mov edx, dword [ebx + 0x18]
mov dword [esp + 0x14], edx
test esi, esi
je 0x1001e3a7
cmp esi, esi
je 0x1001e3ac
call fcn.1003b9a6
cmp edi, dword [esp + 0x14]
je 0x1001e3bc
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
cmp ecx, dword [edi + 0xc]
jae 0x1001e422
lea edx, [esp + 0x18]
push edx
call fcn.1000e220
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x68], 0
mov ecx, dword [eax]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x40]
push eax
mov dword [esp + 0x40], ecx
call fcn.1001f1f0
push edi
push esi
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x1c]
push edx
mov eax, ebx
mov byte [esp + 0x78], 1
call fcn.1001e750
mov esi, dword [eax]
mov edi, dword [eax + 4]
lea ecx, [esp + 0x3c]
mov byte [esp + 0x68], 0
call fcn.1000bf30
lea ecx, [esp + 0x18]
mov dword [esp + 0x68], 0xffffffff
call fcn.1000bf30
test esi, esi
jne 0x1001e44d
call fcn.1003b9a6
cmp edi, dword [esi + 0x18]
jne 0x1001e435
call fcn.1003b9a6
lea eax, [edi + 0x10]
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov esi, dword [esi]
jmp 0x1001e42b

Function at 0x10020e80
Capabilities:
Encode data using xor

Disassembly:
xor ecx, ecx
push ebp
mov ebp, dword [esp + 8]
test edx, edx
jbe 0x10020eae
push esi
push edi
mov edi, eax
sub edi, ebp
mov al, cl
add al, 5
imul dl
add al, al
add al, al
lea esi, [ecx + ebp]
xor al, byte [edi + esi]
inc ecx
xor al, 0x10
not al
mov byte [esi], al
cmp ecx, edx
jb 0x10020e91
pop edi
pop esi
pop ebp
ret 4

Function at 0x10021db0
Capabilities:
List tcp connections and listeners

Disassembly:
mov byte [esp + 4], 0x7e
pushfd
lea esp, [esp + 0x10]
call sub.IPHLPAPI.DLL_GetExtendedTcpTable
jmp fcn.1023d854
Function at 0x10037be0
Capabilities:
Connect socket
Get socket status
Set socket configuration

Disassembly:
sub esp, 0x134
mov eax, dword [0x1006b2c0]
xor eax, esp
mov dword [esp + 0x130], eax
push ebx
push ebp
mov ebp, dword [sym.imp.WS2_32.dll_ioctlsocket]
push edi
lea eax, [esp + 0xc]
push eax
push 0x8004667e
push esi
mov edi, ecx
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x20], 4
xor bl, bl
call ebp
mov edx, dword [esp + 0x144]
xor eax, eax
mov ecx, 2
mov dword [esp + 0x12c], eax
push edx
mov dword [esp + 0x134], eax
mov dword [esp + 0x138], eax
mov dword [esp + 0x13c], eax
mov word [esp + 0x130], cx
call dword [sym.imp.WS2_32.dll_htons]
cmp dword [edi + 0x18], 0x10
mov word [esp + 0x12e], ax
jb 0x10037c72
mov edi, dword [edi + 4]
jmp 0x10037c75
add edi, 4
push edi
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [esp + 0x130], eax
push 0x10
lea eax, [esp + 0x130]
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x10037cf6
lea ecx, [esp + 0x18]
push ecx
push 0
lea edx, [esp + 0x28]
push edx
push 0
lea eax, [esi + 1]
push eax
mov dword [esp + 0x2c], 0x14
mov dword [esp + 0x30], 0
mov dword [esp + 0x38], esi
mov dword [esp + 0x34], 1
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jle 0x10037cf8
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
push 0x1007
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_getsockopt]
cmp dword [esp + 0x10], 0
sete bl
jmp 0x10037cf8
mov bl, 1
lea eax, [esp + 0xc]
push eax
push 0x8004667e
push esi
mov dword [esp + 0x18], 0
call ebp
test bl, bl
jne 0x10037d33
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
push str.cannot_connect_server___n
call fcn.1003ce81
add eax, 0x40
push eax
call fcn.1003d1b2
add esp, 8
or eax, 0xffffffff
jmp 0x10037d35
xor eax, eax
mov ecx, dword [esp + 0x13c]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.1003ad81
add esp, 0x134
ret 4
Function at 0x10037d50
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x22c
mov eax, dword [0x1006b2c0]
xor eax, esp
mov dword [esp + 0x228], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
mov edi, edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], ebx
cmp esi, 0xffffffff
jne 0x10037dba
push ebx
mov dword [edi + 0x18], 0xf
mov dword [edi + 0x14], ebx
push 0x10060ec5
mov ecx, edi
mov byte [edi + 4], bl
call fcn.100036f0
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x228]
xor ecx, esp
call fcn.1003ad81
mov esp, ebp
pop ebp
ret 4
push 0x103
lea ecx, [esp + 0x12d]
push ebx
push ecx
mov byte [esp + 0x134], bl
call fcn.1003d8e0
mov edi, dword [esp + 0x24]
add esp, 0xc
add edi, 0x60
call fcn.100386a0
push 0x104
lea edx, [esp + 0x12c]
push ebx
push edx
call fcn.1003d8e0
add esp, 0xc
mov eax, 1
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x10]
push eax
push ebx
push ebx
lea ecx, [esp + 0x2c]
push ecx
lea eax, [esi + 1]
push eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x38], esi
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jle 0x10037e70
push ebx
push 0x104
lea edx, [esp + 0x130]
push edx
push esi
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, ebx
jle 0x10037e70
lea eax, [esp + 0x128]
mov byte [esp + 0x22b], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10037e52
sub eax, edx
push eax
lea eax, [esp + 0x12c]
push eax
mov eax, edi
call fcn.100035e0
jmp 0x10037de3
mov esi, dword [esp + 0x1c]
push 0xffffffffffffffff
push ebx
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
push edi
mov ecx, esi
mov byte [esi + 4], bl
call fcn.10003400
mov ecx, dword [esp + 0x234]
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.1003ad81
mov esp, ebp
pop ebp
ret 4

Function at 0x10037eb0
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
sub esp, 0x114
push ebp
push esi
mov esi, eax
mov eax, dword [ecx + 0x98]
push edi
mov edi, dword [esp + 0x124]
cmp eax, 0x3e9
je 0x10037edf
cmp eax, 0x3ea
je 0x10037edf
cmp byte [ecx + 0x9c], 0
je 0x10037f53
mov eax, 1
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x10]
push eax
push 0
lea ecx, [esp + 0x20]
push ecx
push 0
lea edx, [ebx + 1]
push edx
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], ebx
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jle 0x10037f53
test esi, esi
jbe 0x10037f34
mov ebp, dword [sym.imp.WS2_32.dll_send]
mov edi, edi
push 0
push esi
push edi
push ebx
call ebp
cmp eax, 0xffffffff
je 0x10037f42
sub esi, eax
add edi, eax
test esi, esi
ja 0x10037f20
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x114
ret 4
mov eax, 0xfffffffe
pop edi
pop esi
pop ebp
add esp, 0x114
ret 4
pop edi
pop esi
or eax, 0xffffffff
pop ebp
add esp, 0x114
ret 4
Function at 0x10039be0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005dfcb
mov eax, dword fs:[0]
push eax
sub esp, 0x438
mov eax, dword [0x1006b2c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x434], ecx
jmp 0x10039c23
push 0x10060eb4
mov eax, dword [ebp + 8]
push eax
call fcn.1003ae80
add esp, 8
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0x420], 0
jne 0x10039c4a
xor eax, eax
jmp 0x10039e13
push 2
push 0
mov ecx, dword [ebp - 0x420]
push ecx
call fcn.1003c44f
add esp, 0xc
mov edx, dword [ebp - 0x420]
push edx
call fcn.1003c04a
add esp, 4
mov dword [ebp - 0x21c], eax
push 0
push 0
mov eax, dword [ebp - 0x420]
push eax
call fcn.1003c44f
add esp, 0xc
mov ecx, dword [ebp - 0x420]
push ecx
call fcn.1003b0f2
add esp, 4
cmp dword [ebp - 0x21c], 0x1f400000
jge 0x10039ca9
cmp dword [ebp - 0x21c], 0
jne 0x10039cb0
xor eax, eax
jmp 0x10039e13
mov byte [ebp - 0x41c], 0
push 0x1ff
push 0
lea edx, [ebp - 0x41b]
push edx
call fcn.1003d8e0
add esp, 0xc
mov byte [ebp - 0x214], 0
push 0x1ff
push 0
lea eax, [ebp - 0x213]
push eax
call fcn.1003d8e0
add esp, 0xc
lea ecx, [ebp - 0x41c]
push ecx
push 0x200
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea edx, [ebp - 0x41c]
push edx
jmp 0x100dc8bb
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003ad81
mov esp, ebp
pop ebp
ret 8

Function at 0x1003ad81
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1006b2c0]
jne 0x1003ad8b
repz ret
jmp fcn.10040615
Function at 0x1004b0a5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10043a03
and dword [ebp - 4], 0
cmp dword [0x1006ece0], 0
mov ebx, eax
jne 0x1004b156
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1004b207
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1004b207
push eax
call fcn.10043991
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1006ece0], eax
call esi
push eax
call fcn.10043991
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1006ece4], eax
call esi
push eax
call fcn.10043991
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x1006ece8], eax
call esi
push eax
call fcn.10043991
pop ecx
mov dword [0x1006ecf0], eax
test eax, eax
je 0x1004b156
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10043991
pop ecx
mov dword [0x1006ecec], eax
mov eax, dword [0x1006ecec]
cmp eax, ebx
je 0x1004b1ae
cmp dword [0x1006ecf0], ebx
je 0x1004b1ae
push eax
call fcn.10043a0c
push dword [0x1006ecf0]
mov esi, eax
call fcn.10043a0c
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1004b1ae
test edi, edi
je 0x1004b1ae
call esi
test eax, eax
je 0x1004b1a5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1004b1a5
test byte [ebp - 0xc], 1
jne 0x1004b1ae
or dword [ebp + 0x10], 0x200000
jmp 0x1004b1e7
mov eax, dword [0x1006ece4]
cmp eax, ebx
je 0x1004b1e7
push eax
call fcn.10043a0c
pop ecx
test eax, eax
je 0x1004b1e7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1004b1e7
mov eax, dword [0x1006ece8]
cmp eax, ebx
je 0x1004b1e7
push eax
call fcn.10043a0c
pop ecx
test eax, eax
je 0x1004b1e7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1006ece0]
call fcn.10043a0c
pop ecx
test eax, eax
je 0x1004b207
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1004b209
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10058f30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
jne 0x10058f3e
xor eax, eax
jmp 0x10058f74
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x10058f5e
xor eax, eax
jmp 0x10058f74
mov ecx, dword [ebp - 4]
and ecx, 0x10
je 0x10058f6f
mov eax, 2
jmp 0x10058f74
mov eax, 1
mov esp, ebp
pop ebp
ret