joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101177a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov esi, esp
mov dword [esi + 0x20], ebp
mov dword [esi + 0x24], esp
mov dword [esi + 0x30], 0xffffffff
mov dword [esi + 0x2c], 0x10117930
lea eax, [esi + 0x28]
mov ecx, dword fs:[0]
mov dword [esi + 0x28], ecx
mov dword fs:[0], eax
push 1
push 0xa
call fcn.100985b0
add esp, 8
test eax, eax
je 0x10117873
mov dword [esi + 4], eax
lea eax, [esi + 0x10]
mov dword [esi + 8], 0xa
mov dword [esi + 0xc], 0
mov dword [esi + 0x30], 0
push eax
call fcn.1011b2c0
add esp, 4
mov eax, dword [ebp + 8]
movsd xmm0, qword [esi + 0x10]
movsd xmm1, qword [esi + 0x18]
mov ecx, dword [esi + 0xc]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
mov dword [eax + 0x20], ecx
movsd xmm1, qword [esi + 4]
mov ecx, dword [esi + 0x28]
movsd qword [eax + 0x18], xmm1
mov dword [eax + 0x50], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x24], 0
mov dword [eax + 0x30], 0
mov dword [eax + 0x3c], 0
mov dword [eax + 0x48], 0
mov byte [eax + 0x4c], 0
mov dword fs:[0], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0xa
push 1
call fcn.101aefe0
add esp, 8
ud2
Function at 0x1011b3a0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp esi, 0x80
jae 0x1011b3b5
push esi
push edx
push ecx
jmp 0x1011b576
movdqu xmm4, xmmword [edx]
not ecx
movdqu xmm3, xmmword [edx + 0x10]
movdqu xmm2, xmmword [edx + 0x20]
movdqu xmm1, xmmword [edx + 0x30]
movdqa xmm5, xmmword [0x101fd7c0]
add edx, 0x40
add esi, 0xffffffc0
movd xmm0, ecx
pxor xmm0, xmm4
movdqa xmm4, xmmword [0x101fd7b0]
nop dword [eax + eax]
movdqa xmm6, xmm0
movdqa xmm7, xmm0
movdqu xmm0, xmmword [edx]
add esi, 0xffffffc0
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm7, xmm5, 0x11
pxor xmm0, xmm6
movdqu xmm6, xmmword [edx + 0x10]
pxor xmm0, xmm7
movdqa xmm7, xmm3
pclmulqdq xmm3, xmm5, 0x11
pclmulqdq xmm7, xmm4, 0
pxor xmm7, xmm6
movdqu xmm6, xmmword [edx + 0x20]
pxor xmm3, xmm7
movdqa xmm7, xmm2
pclmulqdq xmm2, xmm5, 0x11
pclmulqdq xmm7, xmm4, 0
pxor xmm7, xmm6
movdqu xmm6, xmmword [edx + 0x30]
add edx, 0x40
cmp esi, 0x3f
pxor xmm2, xmm7
movdqa xmm7, xmm1
pclmulqdq xmm1, xmm5, 0x11
pclmulqdq xmm7, xmm4, 0
pxor xmm7, xmm6
pxor xmm1, xmm7
ja 0x1011b3f0
movdqa xmm4, xmmword [0x101fd7d0]
movdqa xmm5, xmmword [0x101fd7e0]
movdqa xmm6, xmm0
cmp esi, 0x10
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm6
pxor xmm0, xmm3
movdqa xmm3, xmm0
pclmulqdq xmm0, xmm5, 0x11
pclmulqdq xmm3, xmm4, 0
pxor xmm0, xmm3
pxor xmm0, xmm2
movdqa xmm2, xmm0
pclmulqdq xmm0, xmm5, 0x11
pclmulqdq xmm2, xmm4, 0
pxor xmm0, xmm2
pxor xmm0, xmm1
jb 0x1011b507
nop word cs:[eax + eax]
nop dword [eax]
movdqu xmm1, xmmword [edx]
movdqa xmm2, xmm0
add esi, 0xfffffff0
pclmulqdq xmm0, xmm5, 0x11
add edx, 0x10
pclmulqdq xmm2, xmm4, 0
cmp esi, 0xf
pxor xmm2, xmm1
pxor xmm0, xmm2
ja 0x1011b4e0
movdqa xmm1, xmmword [0x101fd7e0]
pxor xmm2, xmm2
test esi, esi
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pxor xmm1, xmm1
pblendw xmm2, xmm0, 3
psrldq xmm0, 4
pclmulqdq xmm2, xmmword [0x101fd7f0], 0
pxor xmm0, xmm2
pxor xmm2, xmm2
pblendw xmm2, xmm0, 3
pclmulqdq xmm2, xmmword [0x101fd800], 0x10
pblendw xmm2, xmm1, 0xfc
pclmulqdq xmm2, xmmword [0x101fd810], 0
pxor xmm2, xmm0
pextrd eax, xmm2, 1
not eax
je 0x1011b57e
push esi
push edx
push eax
call fcn.1011b580
add esp, 0xc
pop esi
ret
Function at 0x10140530
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
push esi
sub esp, 0x98
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
neg edx
imul edx, edx, 0x38
mov ecx, dword [ecx]
mov esi, dword [eax]
lea ecx, [ecx + edx - 0x38]
push ecx
call fcn.1016b2f0
add esp, 4
lea ecx, [esp + 0x44]
push edx
push eax
push ecx
call fcn.10164a30
add esp, 0xc
push esi
call fcn.1016b2f0
add esp, 4
lea ecx, [esp + 0x24]
push edx
push eax
push ecx
call fcn.10164a30
add esp, 0xc
mov edi, dword [esp + 0x48]
mov esi, dword [esp + 0x28]
movzx edx, byte [esp + 0x40]
mov ah, byte [esp + 0x41]
mov bh, byte [esp + 0x60]
mov ch, byte [esp + 0x61]
mov bl, byte [esp + 0x4c]
cmp edi, esi
mov byte [esp + 3], dl
mov byte [esp + 2], ah
jne 0x101405e5
cmp bh, dl
jne 0x101405e5
cmp ch, 2
jne 0x101405e5
cmp ah, 2
jne 0x101405e5
cmp bl, 3
setae al
cmp byte [esp + 0x2c], 3
setb cl
xor cl, al
je 0x101405e5
push edi
push dword [esp + 0x28]
push dword [esp + 0x4c]
mov byte [esp + 0xd], ch
call fcn.10193bb4
mov ch, byte [esp + 0xd]
add esp, 0xc
test eax, eax
je 0x101406f3
mov eax, dword [esp + 0x44]
cmp bl, 6
je 0x10140612
mov dl, ch
mov ecx, dword [esp + 0x5c]
movsd xmm0, qword [esp + 0x4d]
movsd xmm1, qword [esp + 0x55]
mov dword [esp + 0x13], ecx
mov ch, dl
movsd qword [esp + 0xc], xmm1
movsd qword [esp + 4], xmm0
movsd xmm0, qword [esp + 4]
movsd xmm1, qword [esp + 0xc]
mov edx, dword [esp + 0x13]
mov cl, byte [esp + 0x62]
movsd qword [esp + 0x89], xmm1
movsd qword [esp + 0x81], xmm0
mov dword [esp + 0x90], edx
mov dword [esp + 0x78], eax
movzx eax, byte [esp + 0x2c]
mov dword [esp + 0x7c], edi
mov byte [esp + 0x80], bl
mov byte [esp + 0x94], bh
mov byte [esp + 0x95], ch
mov byte [esp + 0x96], cl
mov ecx, dword [esp + 0x24]
cmp al, 6
je 0x10140690
mov edx, dword [esp + 0x3c]
movsd xmm0, qword [esp + 0x2d]
movsd xmm1, qword [esp + 0x35]
mov dword [esp + 0x73], edx
movsd qword [esp + 0x6c], xmm1
movsd qword [esp + 0x64], xmm0
movsd xmm0, qword [esp + 0x64]
movsd xmm1, qword [esp + 0x6c]
mov edi, dword [esp + 0x73]
movzx edx, byte [esp + 0x42]
movsd qword [esp + 0x15], xmm1
movsd qword [esp + 0xd], xmm0
mov dword [esp + 0x1c], edi
mov dword [esp + 4], ecx
mov dword [esp + 8], esi
mov byte [esp + 0xc], al
movzx eax, byte [esp + 3]
lea ecx, [esp + 0x78]
mov byte [esp + 0x20], al
movzx eax, byte [esp + 2]
mov byte [esp + 0x21], al
lea eax, [esp + 4]
mov byte [esp + 0x22], dl
push eax
push ecx
call fcn.10092fd0
add esp, 8
add esp, 0x98
pop esi
pop edi
pop ebx
ret
mov al, 1
jmp 0x101406e9
Function at 0x10152b60
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xf8
mov esi, esp
mov dword [esi + 0xe0], ebp
mov dword [esi + 0xe4], esp
mov dword [esi + 0xf0], 0xffffffff
mov dword [esi + 0xec], 0x101533f0
mov edi, ecx
lea eax, [esi + 0xe8]
mov ecx, dword fs:[0]
mov dword [esi + 0xe8], ecx
mov dword fs:[0], eax
mov eax, dword [edi + 0x68]
mov ecx, dword [edi + 4]
mov dword [esi + 0x20], eax
mov eax, dword [edi]
mov dword [esi + 8], eax
lea eax, [edi + 0x18]
mov dword [esi + 0xc], ecx
lea ecx, [esi + 0x8f]
push 0x50
push eax
push ecx
call fcn.10193640
add esp, 0xc
lea eax, [esi + 0x35]
mov dword [esi + 0x30], 0
mov byte [esi + 0x34], 0
lea ecx, [esi + 0x8c]
push 0x53
push ecx
push eax
call fcn.10193640
add esp, 0xc
mov dword [esi + 0x28], 1
mov dword [esi + 0x2c], 1
push 8
push 0x60
call fcn.100985b0
add esp, 8
test eax, eax
mov dword [esi + 0x18], edi
je 0x10152d09
mov ebx, eax
lea eax, [esi + 0x28]
push 0x60
push eax
push ebx
call fcn.10193640
add esp, 0xc
mov eax, dword [edi + 8]
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0xf0], 2
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x14], ecx
mov ecx, dword [edi + 0x14]
mov dword [esi + 0x8c], eax
mov dword [esi + 0x90], ecx
push 0
call fcn.1016f860
add esp, 4
test eax, eax
je 0x10152d21
mov ecx, dword [esi + 0x1c]
mov dword [esi + 0x60], ecx
mov dword [esi + 0x40], 0x102387d0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
movdqu xmm0, xmmword [eax]
movd edx, xmm0
pshufd xmm1, xmm0, 0x55
add edx, 1
movd ecx, xmm1
adc ecx, 0
mov dword [eax], edx
mov dword [eax + 4], ecx
mov byte [esi + 7], 0
mov dword [esi + 0xf0], 0
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
mov dword [esi + 0x28], eax
mov eax, dword [esi + 0x10]
mov dword [esi + 0x2c], ecx
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x30], eax
mov eax, dword [esi + 0x8c]
mov dword [esi + 0x34], ecx
mov ecx, dword [esi + 0x90]
mov dword [esi + 0x38], eax
mov eax, dword [esi + 0x20]
mov dword [esi + 0x3c], ecx
movdqu xmmword [esi + 0x50], xmm0
mov dword [esi + 0x64], eax
lea eax, [esi + 0x28]
push eax
call fcn.1013a470
add esp, 4
mov eax, dword [esi + 0xe8]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esi + 0xf0], 3
push 0x60
push 8
call fcn.101aefe0
add esp, 8
jmp 0x10152d3e
push 0x102387b8
push 0x102386b8
lea eax, [esi + 0x28]
push eax
push 0x46
push 0x10238720
call fcn.101af4e0
add esp, 0x14
ud2
Function at 0x1015b4b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
sub esp, 0x9c
mov eax, dword [esp + 0xa4]
xor ecx, ecx
mov edx, dword [eax]
mov eax, edx
sar eax, 0xd
mov dword [esp + 8], eax
mov eax, edx
and eax, 0x1fff
cmp eax, 0x16e7
ja 0x1015b4e8
mov ecx, eax
shr ecx, 3
movzx ecx, byte [ecx + 0x10239e28]
lea ecx, [eax + ecx*8]
mov eax, dword [esp + 0xa8]
mov esi, ecx
shr ecx, 4
shr esi, 9
and ecx, 0x1f
test edx, edx
js 0x1015b559
cmp edx, 0x4e20000
jae 0x1015b559
movaps xmm0, xmmword [0x101b10b0]
mov dword [esp + 4], ecx
lea ecx, [esp + 8]
mov dword [esp + 0x3c], 2
mov dword [esp], esi
mov dword [esp + 0x24], ecx
mov ecx, esp
mov dword [esp + 0x28], fcn.10186670
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 4]
mov dword [esp + 0x30], fcn.10186780
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], fcn.10186780
movups xmmword [esp + 0x44], xmm0
mov dword [esp + 0x54], 8
jmp 0x1015b5aa
movaps xmm0, xmmword [0x101b4600]
mov dword [esp + 4], ecx
lea ecx, [esp + 8]
mov dword [esp + 0x3c], 2
mov dword [esp], esi
mov dword [esp + 0x24], ecx
mov ecx, esp
mov dword [esp + 0x28], fcn.10186670
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 4]
mov dword [esp + 0x30], fcn.10186780
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], fcn.10186780
movups xmmword [esp + 0x44], xmm0
mov dword [esp + 0x54], 9
movaps xmm0, xmmword [0x10238a40]
movaps xmm1, xmmword [0x10238a50]
lea ecx, [esp + 0x3c]
mov dword [esp + 0xc], 0x1023a37c
mov dword [esp + 0x10], 3
mov byte [esp + 0x58], 3
mov dword [esp + 0x5c], 2
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0x24]
mov dword [esp + 0x20], 3
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], 3
movups xmmword [esp + 0x64], xmm0
mov dword [esp + 0x74], 8
mov byte [esp + 0x78], 3
mov dword [esp + 0x7c], 2
movups xmmword [esp + 0x84], xmm1
mov dword [esp + 0x94], 8
mov byte [esp + 0x98], 3
push ecx
push eax
call fcn.10181820
add esp, 8
add esp, 0x9c
pop esi
ret
Function at 0x1015f120
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x43c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x1016fa70
mov esi, 0x200
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x2c], 0
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov dword [ebp - 0x38], 2
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
cmp esi, 0x201
jae 0x1015f1b0
jmp 0x1015f19e
jbe 0x1015f244
cmp esi, 0x201
jae 0x1015f1b0
lea ebx, [ebp - 0x448]
mov dword [ebp - 0x28], 0x200
mov edi, esi
jmp 0x1015f1eb
mov edi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
sub esi, edi
sub eax, edi
cmp eax, esi
jae 0x1015f1dc
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x38]
mov edx, edi
push esi
call fcn.101ae010
add esp, 4
mov eax, dword [ebp - 0x38]
mov edi, dword [ebp - 0x34]
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], edi
push 0
call dword [sym.imp.kernel32.dll_SetLastError]
push ebx
push edi
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov esi, eax
test eax, eax
jne 0x1015f20f
call dword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x1015f2a7
cmp esi, edi
jne 0x1015f190
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1015f2c3
lea esi, [edi + edi]
test edi, edi
mov eax, 0xffffffff
cmovs esi, eax
cmp esi, 0x201
jb 0x1015f19e
jmp 0x1015f1b0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], 0
cmp esi, eax
ja 0x1015f2e0
lea eax, [ebp - 0x48]
push esi
push ebx
push eax
call fcn.10162180
add esp, 0xc
movsd xmm0, qword [ebp - 0x48]
mov esi, dword [ebp + 8]
movsd xmm1, qword [ebp - 0x40]
movsd qword [esi + 8], xmm1
movsd qword [esi], xmm0
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x1015f291
add eax, eax
push 2
push eax
push dword [ebp - 0x24]
call fcn.100985c0
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x43c
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, dword [ebp + 8]
mov byte [esi], 0
mov dword [esi + 4], eax
mov byte [esi + 0xc], 2
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x1015f281
jmp 0x1015f291
mov dword [ebp - 0x10], 0
push 0x1023c6d8
push 0x28
push str.internal_error:_entered_unreachable_codeassertion_failed:_self.is_char_boundary_new_len__rustc_2a8221dbdfd180a2d56d4b0089f4f3952d8c2bcdlibrary_alloc_src_string.rs
call fcn.101af1e0
add esp, 0xc
jmp 0x1015f2ef
push 0x1023c6e8
push eax
push esi
call fcn.101af5d0
add esp, 0xc
ud2
Function at 0x10161ca0
Capabilities:
Set socket configuration

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x20]
mov edi, dword [esp + 0x2c]
xor ebp, ebp
mov ecx, dword [eax]
cmp edi, 0x3b9aca00
je 0x10161cfe
mov eax, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
mov ebx, 0x3e8
mov dword [esp], ecx
mul ebx
mov ebp, eax
mov eax, esi
seto cl
mul ebx
mov ebx, edx
mov esi, eax
add ebx, ebp
mov ebp, 0xffffffff
setb al
or al, cl
jne 0x10161cfb
mov ecx, 0x431bde83
mov eax, edi
mul ecx
shr edx, 0x12
add esi, edx
adc ebx, 0
jae 0x10161d46
mov ecx, dword [esp]
mov dword [esp + 4], ebp
lea eax, [esp + 4]
push 4
push eax
push 0x1006
push 0xffff
push ecx
call dword [sym.imp.ws2_32.dll_setsockopt]
mov esi, dword [esp + 0x1c]
mov cl, 4
cmp eax, 0xffffffff
jne 0x10161d3a
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
xor ecx, ecx
mov byte [esi + 3], 0
mov word [esi + 1], 0
mov dword [esi + 4], eax
mov byte [esi], cl
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
imul eax, edx, 0xf4240
xor ecx, ecx
sub edi, eax
setne cl
add esi, ecx
mov ecx, dword [esp]
adc ebx, 0
jb 0x10161cfe
xor ebp, ebp
neg ebx
sbb ebp, ebp
or ebp, esi
jne 0x10161cfe
mov esi, dword [esp + 0x1c]
mov byte [esi], 2
mov dword [esi + 4], 0x1023c0d8
jmp 0x10161d3c

Function at 0x10161d80
Capabilities:
Set socket configuration

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x20]
mov edi, dword [esp + 0x2c]
xor ebp, ebp
mov ecx, dword [eax]
cmp edi, 0x3b9aca00
je 0x10161dde
mov eax, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
mov ebx, 0x3e8
mov dword [esp], ecx
mul ebx
mov ebp, eax
mov eax, esi
seto cl
mul ebx
mov ebx, edx
mov esi, eax
add ebx, ebp
mov ebp, 0xffffffff
setb al
or al, cl
jne 0x10161ddb
mov ecx, 0x431bde83
mov eax, edi
mul ecx
shr edx, 0x12
add esi, edx
adc ebx, 0
jae 0x10161e26
mov ecx, dword [esp]
mov dword [esp + 4], ebp
lea eax, [esp + 4]
push 4
push eax
push 0x1005
push 0xffff
push ecx
call dword [sym.imp.ws2_32.dll_setsockopt]
mov esi, dword [esp + 0x1c]
mov cl, 4
cmp eax, 0xffffffff
jne 0x10161e1a
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
xor ecx, ecx
mov byte [esi + 3], 0
mov word [esi + 1], 0
mov dword [esi + 4], eax
mov byte [esi], cl
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
imul eax, edx, 0xf4240
xor ecx, ecx
sub edi, eax
setne cl
add esi, ecx
mov ecx, dword [esp]
adc ebx, 0
jb 0x10161dde
xor ebp, ebp
neg ebx
sbb ebp, ebp
or ebp, esi
jne 0x10161dde
mov esi, dword [esp + 0x1c]
mov byte [esi], 2
mov dword [esi + 4], 0x1023c0d8
jmp 0x10161e1c

Function at 0x10161e60
Capabilities:
Receive data
Receive data on socket

Disassembly:
push esi
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, 0x7fffffff
cmp eax, 0x7fffffff
cmovb edx, eax
push 2
push edx
push dword [esp + 0x18]
push dword [ecx]
call dword [sym.imp.ws2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x10161ea0
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov ecx, eax
xor eax, eax
cmp ecx, 0x274a
jne 0x10161eaa
mov dword [esi + 4], eax
mov byte [esi], 4
mov eax, esi
pop esi
ret
mov byte [esi], 0
mov dword [esi + 4], ecx
mov eax, esi
pop esi
ret
Function at 0x10161ec0
Capabilities:
Set socket configuration

Disassembly:
push esi
push eax
mov eax, dword [esp + 0x10]
movzx ecx, byte [esp + 0x14]
mov esi, dword [esp + 0xc]
mov eax, dword [eax]
mov dword [esp], ecx
mov ecx, esp
push 4
push ecx
push 1
push 6
push eax
call dword [sym.imp.ws2_32.dll_setsockopt]
mov cl, 4
cmp eax, 0xffffffff
jne 0x10161f00
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
xor ecx, ecx
mov byte [esi + 3], 0
mov word [esi + 1], 0
mov dword [esi + 4], eax
mov byte [esi], cl
mov eax, esi
add esp, 4
pop esi
ret

Function at 0x10161f10
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push edi
push esi
mov edi, dword [esp + 0x18]
mov eax, dword [edi + 4]
mov ebx, dword [edi + 8]
mov ecx, eax
sub ecx, ebx
jb 0x10161f7e
cmp ecx, 0x7fffffff
mov edx, 0x7fffffff
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
cmovb edx, ecx
mov ecx, dword [edi]
add ecx, ebx
push 0
push edx
push ecx
push dword [eax]
call dword [sym.imp.ws2_32.dll_recv]
cmp eax, 0xffffffff
je 0x10161f60
add eax, ebx
mov dword [edi + 8], eax
mov ecx, dword [edi + 0xc]
cmp ecx, eax
cmova eax, ecx
mov dword [edi + 0xc], eax
jmp 0x10161f6d
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x274a
jne 0x10161f76
mov byte [esi], 4
mov eax, esi
pop esi
pop edi
pop ebx
ret
mov byte [esi], 0
mov dword [esi + 4], eax
jmp 0x10161f70
push 0x1023b1a4
push eax
push ebx
call fcn.101af560
add esp, 0xc
ud2

Function at 0x10162000
Capabilities:
Send data
Send data on socket

Disassembly:
push edi
push esi
push eax
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [esp], 0
mov edi, esp
mov ecx, dword [ecx]
push 0
push 0
push 0
push edi
push edx
push eax
push ecx
call dword [sym.imp.ws2_32.dll_WSASend]
cmp eax, 0xffffffff
je 0x1016203e
mov eax, dword [esp]
mov dword [esi + 4], eax
mov byte [esi], 4
jmp 0x1016204d
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov dword [esi + 4], eax
mov dword [esi], 0
mov eax, esi
add esp, 4
pop esi
pop edi
ret

Function at 0x10162070
Capabilities:
Set socket configuration

Disassembly:
push esi
push eax
mov eax, dword [esp + 0x10]
movzx ecx, byte [esp + 0x14]
mov esi, dword [esp + 0xc]
mov eax, dword [eax]
mov dword [esp], ecx
mov ecx, esp
push ecx
push 0x8004667e
push eax
call dword [sym.imp.ws2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
je 0x101620a2
mov byte [esi], 4
mov eax, esi
add esp, 4
pop esi
ret
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov dword [esi + 4], eax
mov dword [esi], 0
mov eax, esi
add esp, 4
pop esi
ret

Function at 0x101620c0
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, 0x7fffffff
cmp eax, 0x7fffffff
cmovb edx, eax
push 0
push edx
push dword [esp + 0x18]
push dword [ecx]
call dword [sym.imp.ws2_32.dll_send]
cmp eax, 0xffffffff
je 0x101620f8
mov dword [esi + 4], eax
mov byte [esi], 4
mov eax, esi
pop esi
ret
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov byte [esi], 0
mov byte [esi + 3], 0
mov word [esi + 1], 0
mov dword [esi + 4], eax
mov eax, esi
pop esi
ret
Function at 0x10162120
Capabilities:
Receive data
Receive data on socket

Disassembly:
push esi
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, 0x7fffffff
cmp eax, 0x7fffffff
cmovb edx, eax
push 0
push edx
push dword [esp + 0x18]
push dword [ecx]
call dword [sym.imp.ws2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x10162160
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov ecx, eax
xor eax, eax
cmp ecx, 0x274a
jne 0x1016216a
mov dword [esi + 4], eax
mov byte [esi], 4
mov eax, esi
pop esi
ret
mov byte [esi], 0
mov dword [esi + 4], ecx
mov eax, esi
pop esi
ret

Function at 0x10162a60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
movzx ebx, byte [edx + 0x1c]
mov dword [esp + 8], ecx
xor ecx, ecx
mov eax, 0
mov edi, edx
call 0x10162a7d
pop ebp
cmp bl, 1
setne dl
sbb eax, eax
or al, dl
movzx edx, al
cmp al, 0xff
je 0x10162a93
test edx, edx
jne 0x10162abc
mov byte [esp + 3], bl
movzx ebx, byte [edi + 0x1e]
cmp al, 0xff
mov esi, ebx
je 0x10162aa5
test edx, edx
jne 0x10162aaf
mov ecx, edi
call fcn.10162970
movzx ecx, al
movzx ebx, byte [esp + 3]
xor eax, eax
test bl, bl
jne 0x10162b18
jmp 0x10162ac4
xor esi, esi
xor eax, eax
test bl, bl
jne 0x10162b18
xor eax, eax
cmp byte [edi + 8], 6
lea edx, [edi + 8]
cmove edx, eax
je 0x10162b18
movzx ebx, byte [edx]
mov eax, 6
add ebp, dword [ebx*4 + 0x10162c24]
jmp ebp
add ecx, eax
mov eax, esi
movzx esi, al
mov eax, dword [edi + 4]
lea ebx, [ecx + esi]
cmp eax, ebx
jb 0x10162c0b
mov ebp, dword [edi]
cmp eax, ebx
lea edx, [ebp + ebx]
jne 0x10162b47
movzx ecx, byte [edi + 8]
mov byte [esp + 3], cl
xor ecx, ecx
sub eax, ebx
jne 0x10162bc2
jmp 0x10162ba7
mov dword [esp + 4], edx
mov dh, byte [edi + 8]
add ecx, esi
sub ecx, eax
cmp dh, 3
mov byte [esp + 3], dh
jae 0x10162b7b
mov edx, dword [esp + 4]
lea esi, [eax + ebp - 1]
nop word cs:[eax + eax]
nop dword [eax]
cmp byte [esi], 0x5c
je 0x10162bab
dec esi
inc ecx
jne 0x10162b70
jmp 0x10162ba1
mov edx, dword [esp + 4]
lea edi, [eax + ebp - 1]
nop word cs:[eax + eax]
nop dword [eax]
movzx esi, byte [edi]
cmp esi, 0x2f
je 0x10162bab
cmp esi, 0x5c
je 0x10162bab
dec edi
inc ecx
jne 0x10162b90
xor ecx, ecx
sub eax, ebx
jne 0x10162bc2
mov bl, 0xa
jmp 0x10162bf2
not ecx
lea ebx, [ebx + ecx + 1]
cmp eax, ebx
jb 0x10162c12
add ebp, ebx
mov ecx, 1
mov edx, ebp
sub eax, ebx
je 0x10162ba7
mov bl, 9
cmp eax, 2
je 0x10162be3
cmp eax, 1
jne 0x10162bf2
cmp byte [edx], 0x2e
jne 0x10162bf2
xor ebx, ebx
cmp byte [esp + 3], 3
setae bl
lea ebx, [ebx + ebx*2 + 7]
jmp 0x10162bf2
cmp byte [edx], 0x2e
jne 0x10162bf2
cmp byte [edx + 1], 0x2e
sete bl
xor bl, 9
mov esi, dword [esp + 8]
add ecx, eax
mov dword [esi], ecx
mov byte [esi + 4], bl
mov dword [esi + 8], edx
mov dword [esi + 0xc], eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x1023b44c
jmp 0x10162c17
push 0x1023b45c
push eax
push ebx
call fcn.101af560
add esp, 0xc
ud2
Function at 0x1016a710
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, ecx
mov ecx, dword [ebp + 0xc]
cmp dword [ebp + 0x10], 0
mov edi, edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x103
je 0x1016a754
mov eax, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0x18]
lea edx, [esp + 0x20]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], eax
xor eax, eax
mov ebx, 1
jmp 0x1016a75a
xor ebx, ebx
xor eax, eax
xor edx, edx
mov dword [esp + 0x1c], eax
lea eax, [esp + 8]
mov dword [esp + 0x18], ebx
push 0
push edx
push ecx
push dword [ebp + 8]
push eax
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x1016a78f
push 0xffffffffffffffff
push edi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [esp + 8]
cmp eax, 0xc0000011
jne 0x1016a79f
mov dword [esi + 4], 0
jmp 0x1016a7b1
cmp eax, 0x103
je 0x1016a7cb
test eax, eax
js 0x1016a7bc
mov eax, dword [esp + 0xc]
mov dword [esi + 4], eax
mov byte [esi], 4
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov byte [esi], 0
mov dword [esi + 4], eax
jmp 0x1016a7b4
lea eax, [esp + 4]
mov dword [esp + 0x18], 0x1023c07c
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 0
lea esi, [esp + 0x34]
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x24], 0
push eax
push ecx
push esi
call fcn.101612b0
add esp, 0xc
cmp byte [esp + 0x34], 4
je 0x1016a827
push esi
call fcn.1015d060
add esp, 4
mov ecx, 7
int 0x29
ud2