joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001da20
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, 0xcccccccc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0xb0], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xac], 0
xor edx, edx
mov word [ebp - 8], dx
mov eax, dword [ebp - 4]
mov dword [eax + 0x30], 1
mov ecx, dword [ebp - 4]
push ecx
call fcn.10014da0
push eax
push 0x1001d270
call fcn.10036890
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x1001da91
mov edx, 0x19a
mov word [ebp - 8], dx
jmp 0x1001daba
mov eax, dword [ebp - 4]
push eax
call fcn.10014da0
push eax
push 0x1001d580
call fcn.10036890
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x1001daba
mov ecx, 0x19a
mov word [ebp - 8], cx
movzx edx, word [ebp - 8]
test edx, edx
je 0x1001daf0
mov eax, dword [ebp - 4]
mov dword [eax + 0x30], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xb0], 1
mov edx, dword [ebp - 4]
mov dword [edx + 0xac], 1
mov eax, dword [ebp - 4]
mov dword [eax + 0x44], 1
mov ax, word [ebp - 8]
add esp, 0x10
cmp ebp, esp
call fcn.1002a390
mov esp, ebp
pop ebp
ret

Function at 0x10020ac0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0xcccccccc
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
push 0x98
mov eax, dword [ebp + 8]
push eax
call fcn.10009ed0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10020aff
mov eax, 0x66
jmp 0x10020bf7
push 0x98
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.1002a420
add esp, 0xc
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 0x24], eax
mov ecx, dword [ebp - 4]
mov dword [ecx], 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0x10]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x28], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x2c], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x30], 1
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov ecx, dword [ebp - 4]
call fcn.1001eb00
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x20]
mov dword [eax + 0x50], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0x24]
mov dword [edx + 0x6c], eax
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x70], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x54], 0
mov ecx, dword [ebp - 4]
call fcn.1001dc60
mov eax, dword [ebp - 4]
push eax
call fcn.10014da0
push eax
push 0x10020720
call fcn.10036890
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x10020bf5
mov dword [ebp - 0xc], str.ERROR_begin_RSP_thread.
push 0x473
push 0x10139424
mov ecx, dword [ebp - 0xc]
push ecx
push 0x19a
push 0x40003
call fcn.10002bc0
add esp, 0x14
mov edx, dword [ebp - 0xc]
push edx
push 0x10139430
call fcn.10014db0
add esp, 8
mov eax, 0x19a
jmp 0x10020bf7
xor eax, eax
add esp, 0xc
cmp ebp, esp
call fcn.1002a390
mov esp, ebp
pop ebp
ret
Function at 0x10020c10
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x74], 0
jne 0x10020c5f
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x7c], 1
push 0x482
push 0x10139434
push str.MsgQueue_is_not_initialized
push 0xc
push 0x40003
call fcn.10002bc0
add esp, 0x14
mov eax, 0xc
jmp 0x10020ca6
mov edx, dword [ebp - 4]
mov dword [edx + 0x78], 1
mov eax, dword [ebp - 4]
mov dword [eax + 0x7c], 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.10014da0
push eax
push 0x1001f750
call fcn.10036890
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x10020ca4
mov edx, dword [ebp - 4]
mov dword [edx + 0x7c], 1
mov eax, 0x19a
jmp 0x10020ca6
xor eax, eax
add esp, 8
cmp ebp, esp
call fcn.1002a390
mov esp, ebp
pop ebp
ret

Function at 0x100214e0
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov dword [ebp - 4], 0xcccccccc
mov dword [ebp - 4], ecx
mov esi, esp
push 0
push 0
push 0
push 0
push str.Viewer
call dword [sym.imp.WININET.dll_InternetOpenA]
cmp esi, esp
call fcn.1002a390
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
cmp dword [edx], 0
jne 0x1002151f
mov eax, 0x19a
jmp 0x10021521
xor eax, eax
pop esi
add esp, 4
cmp ebp, esp
call fcn.1002a390
mov esp, ebp
pop ebp
ret
Function at 0x100236d0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push edi
push ecx
lea edi, [ebp - 0x28]
mov ecx, 0xa
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], 0
jne 0x100236fb
mov eax, 1
jmp 0x100238b3
mov eax, dword [ebp + 8]
push eax
call fcn.1002d6f0
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
xor edx, edx
mov ecx, 4
div ecx
test edx, edx
je 0x10023724
mov eax, 1
jmp 0x100238b3
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
jmp 0x10023745
mov ecx, dword [ebp - 0x10]
add ecx, 4
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 8]
jae 0x100238a9
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x18], 0
jmp 0x10023771
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jae 0x1002384b
mov ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 0x18]
mov edx, dword [ebp + 8]
mov al, byte [edx + ecx]
mov byte [ebp - 0x21], al
mov dword [ebp - 0x28], 0
movzx ecx, byte [ebp - 0x21]
cmp ecx, 0x41
jl 0x100237af
movzx edx, byte [ebp - 0x21]
cmp edx, 0x5a
jg 0x100237af
movzx eax, byte [ebp - 0x21]
sub eax, 0x41
mov dword [ebp - 0x28], eax
jmp 0x1002382d
movzx ecx, byte [ebp - 0x21]
cmp ecx, 0x61
jl 0x100237cd
movzx edx, byte [ebp - 0x21]
cmp edx, 0x7a
jg 0x100237cd
movzx eax, byte [ebp - 0x21]
sub eax, 0x47
mov dword [ebp - 0x28], eax
jmp 0x1002382d
movzx ecx, byte [ebp - 0x21]
cmp ecx, 0x30
jl 0x100237eb
movzx edx, byte [ebp - 0x21]
cmp edx, 0x39
jg 0x100237eb
movzx eax, byte [ebp - 0x21]
add eax, 4
mov dword [ebp - 0x28], eax
jmp 0x1002382d
movzx ecx, byte [ebp - 0x21]
cmp ecx, 0x2b
jne 0x100237fd
mov dword [ebp - 0x28], 0x3e
jmp 0x1002382d
movzx edx, byte [ebp - 0x21]
cmp edx, 0x2f
jne 0x1002380f
mov dword [ebp - 0x28], 0x3f
jmp 0x1002382d
movzx eax, byte [ebp - 0x21]
cmp eax, 0x3d
jne 0x10023823
mov ecx, dword [ebp - 0x20]
add ecx, 1
mov dword [ebp - 0x20], ecx
jmp 0x1002382d
mov eax, 1
jmp 0x100238b3
cmp dword [ebp - 0x20], 0
je 0x1002383a
mov dword [ebp - 0x28], 0
mov edx, dword [ebp - 0x1c]
shl edx, 6
or edx, dword [ebp - 0x28]
mov dword [ebp - 0x1c], edx
jmp 0x10023768
mov eax, dword [ebp - 0x14]
add eax, 3
sub eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0xc]
jbe 0x10023860
mov eax, 1
jmp 0x100238b3
mov dword [ebp - 0x18], 0
jmp 0x10023872
mov ecx, dword [ebp - 0x18]
add ecx, 1
mov dword [ebp - 0x18], ecx
mov edx, 3
sub edx, dword [ebp - 0x20]
cmp dword [ebp - 0x18], edx
jae 0x100238a4
mov eax, dword [ebp - 0x18]
shl eax, 3
mov ecx, 0x10
sub ecx, eax
mov edx, dword [ebp - 0x1c]
shr edx, cl
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 0x14]
mov byte [eax], dl
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
jmp 0x10023869
jmp 0x1002373c
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x14]
mov dword [edx], eax
xor eax, eax
pop edi
add esp, 0x28
cmp ebp, esp
call fcn.1002a390
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10026b50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1014f858
push 0x1002b1c0
mov eax, dword fs:[0]
push eax
add esp, 0xfffffb64
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x4ac]
mov ecx, 0x125
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x101a8cb0]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x20], ecx
mov byte [ebp - 0x128], 0
push 0x103
push 0
lea eax, [ebp - 0x127]
push eax
call fcn.1002a420
add esp, 0xc
mov dword [ebp - 0x130], 0x10139b00
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x150], 0
xor ecx, ecx
mov word [ebp - 0x168], cx
mov dword [ebp - 4], 0
push 0
call fcn.10026ee0
add esp, 4
mov dword [ebp - 0x138], eax
mov edx, dword [ebp - 0x138]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x130]
push ecx
push str._sDUMP__s._.8X.dat
push 0x104
lea edx, [ebp - 0x128]
push edx
call fcn.1002d690
add esp, 0x18
push 0x10139b18
lea eax, [ebp - 0x128]
push eax
lea ecx, [ebp - 0x150]
push ecx
call fcn.1002daa0
add esp, 0xc
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0
je 0x10026c5e
mov edx, 0xc9
mov word [ebp - 0x168], dx
jmp 0x10026cad
mov eax, dword [ebp - 0x150]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 1
mov edx, dword [ebp + 0xc]
push edx
call fcn.10032210
add esp, 0x10
mov dword [ebp - 0x15c], eax
mov eax, dword [ebp - 0x15c]
cmp eax, dword [ebp + 0x10]
je 0x10026c94
mov ecx, 0xcb
mov word [ebp - 0x168], cx
mov edx, dword [ebp - 0x150]
push edx
call fcn.1002ac50
add esp, 4
mov dword [ebp - 0x150], 0
mov dword [ebp - 4], 0xfffffffe
jmp 0x10026d78
mov byte [ebp - 0x25], 0
lea eax, [ebp - 0x128]
push eax
call fcn.1002d6f0
add esp, 4
add eax, 0x14
cmp eax, 0x104
jae 0x10026dd4
mov ecx, dword [ebp + 0x10]
push ecx
push str.__d_
lea edx, [ebp - 0x128]
push edx
call fcn.1002d6f0
add esp, 4
mov ecx, 0x104
sub ecx, eax
push ecx
lea edx, [ebp - 0x128]
push edx
call fcn.1002d6f0
add esp, 4
lea eax, [ebp + eax - 0x128]
push eax
call fcn.1002d690
add esp, 0x10
push 0x4f2
push str..wsSvrMessages.cpp
lea ecx, [ebp - 0x128]
push ecx
push 0
push 0x40003
call fcn.10002bc0
add esp, 0x14
mov ax, word [ebp - 0x168]
push edx
mov ecx, ebp
push eax
lea edx, [0x10026e38]
call fcn.1002a3c0
pop eax
pop edx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1002aab0
add esp, 0x4ac
cmp ebp, esp
call fcn.1002a390
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1002aab0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x101a8cb0]
jne 0x1002aaba
repz ret
jmp fcn.1003c530
Function at 0x10032e30
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x10032e4f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x10032e56
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x10032e6d
mov ecx, dword [ebp - 4]
push ecx
call fcn.1003e0d0
add esp, 4
or eax, 0xffffffff
jmp 0x10032e6f
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10033cb0
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x10033cd1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x10033cd8
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x10033cef
mov ecx, dword [ebp - 4]
push ecx
call fcn.1003e0d0
add esp, 4
or eax, 0xffffffff
jmp 0x10033cf1
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10034460
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x10034483
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x1003448a
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x100344a1
mov edx, dword [ebp - 4]
push edx
call fcn.1003e0d0
add esp, 4
or eax, 0xffffffff
jmp 0x100344a3
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100644c0
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x101a8cb0]
xor eax, ebp
mov dword [ebp - 8], eax
push 0
push 1
push 2
call dword [sym.imp.WSOCK32.dll_socket]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp + 8]
cmp dword [edx], 0xffffffff
jne 0x1006451d
call fcn.10063410
mov word [ebp - 0x1c], ax
push 0x28a
push 0x101aa394
movsx eax, word [ebp - 0x1c]
push eax
push 0x2c0
push 0x40003
call fcn.100030a0
add esp, 0x14
mov eax, 0x2c0
jmp 0x10064633
mov ecx, 2
mov word [ebp - 0x18], cx
mov dword [ebp - 0x14], 0
mov edx, dword [ebp + 8]
movzx eax, word [edx + 4]
push eax
call dword [sym.imp.WSOCK32.dll_htons]
mov word [ebp - 0x16], ax
push 0x10
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.WSOCK32.dll_bind]
test eax, eax
je 0x10064589
call fcn.10063410
mov word [ebp - 0x1c], ax
push 0x295
push 0x101aa3a0
movsx ecx, word [ebp - 0x1c]
push ecx
push 0x2d7
push 0x40003
call fcn.100030a0
add esp, 0x14
mov eax, 0x2d7
jmp 0x10064633
mov edx, 1
mov word [ebp - 4], dx
mov eax, 5
mov word [ebp - 2], ax
push 4
lea ecx, [ebp - 4]
push ecx
push 0x80
push 0xffff
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.WSOCK32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x100645ed
call fcn.10063410
mov word [ebp - 0x1c], ax
push 0x2a0
push 0x101aa3ac
movsx ecx, word [ebp - 0x1c]
push ecx
push 0x2d5
push 0x40003
call fcn.100030a0
add esp, 0x14
mov eax, 0x2d5
jmp 0x10064633
push 5
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.WSOCK32.dll_listen]
cmp eax, 0xffffffff
jne 0x10064631
call fcn.10063410
mov word [ebp - 0x1c], ax
push 0x2a7
push 0x101aa3b8
movsx ecx, word [ebp - 0x1c]
push ecx
push 0x2d8
push 0x40003
call fcn.100030a0
add esp, 0x14
mov eax, 0x2d8
jmp 0x10064633
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1002aab0
mov esp, ebp
pop ebp
ret
Function at 0x10064de0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x184
mov eax, dword [0x101a8cb0]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x180]
push eax
call fcn.10065dd0
add esp, 4
mov word [ebp - 8], ax
movzx ecx, word [ebp - 8]
test ecx, ecx
je 0x10064e18
mov eax, 0xffff
jmp 0x10064ec5
lea edx, [ebp - 0x180]
push edx
call dword [sym.imp.WSOCK32.dll_gethostbyname]
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 0
jne 0x10064e3e
mov eax, 0xffff
jmp 0x10064ec5
mov eax, dword [ebp - 0x184]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
movsx ax, byte [edx + 3]
mov word [ebp - 0xc], ax
mov ecx, dword [ebp - 0x184]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x184]
mov eax, dword [edx + 0xc]
mov edx, dword [eax]
movsx eax, byte [edx + 1]
add ecx, eax
mov edx, dword [ebp - 0x184]
mov eax, dword [edx + 0xc]
mov edx, dword [eax]
movsx eax, byte [edx + 2]
add ecx, eax
mov word [ebp - 4], cx
movzx ecx, word [ebp - 4]
and ecx, 0xf
movzx edx, word [ebp - 4]
shl edx, 4
and edx, 0xf00
or ecx, edx
mov word [ebp - 4], cx
movzx eax, word [ebp - 0xc]
shl eax, 4
and eax, 0xf0
mov word [ebp - 0xc], ax
movzx ecx, word [ebp - 0xc]
movzx edx, word [ebp - 4]
or ecx, edx
shl ecx, 8
mov word [ebp - 0xc], cx
mov ax, word [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002aab0
mov esp, ebp
pop ebp
ret

Function at 0x10064ee0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, 2
mov word [ebp - 0xc], ax
mov ecx, 2
mov word [ebp - 4], cx
movzx edx, word [ebp - 4]
shl edx, 8
movzx eax, word [ebp - 0xc]
add edx, eax
mov word [0x101cd83c], dx
push 0x18e
push 0
push 0x101cd840
call fcn.1002a420
add esp, 0xc
push 0x101cd840
movzx ecx, word [0x101cd83c]
push ecx
call dword [sym.imp.WSOCK32.dll_WSAStartup]
mov word [ebp - 8], ax
movzx edx, word [ebp - 8]
test edx, edx
je 0x10064f62
push 0x389
push 0x101aa4c4
push 0x2cc
push 0x40003
call fcn.10002e30
add esp, 0x10
mov eax, 0x2cc
jmp 0x10064f64
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10065030
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x101a8cb0]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
push 8
lea ecx, [ebp - 8]
push ecx
push 0x1006
push 0xffff
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.WSOCK32.dll_setsockopt]
push 2
push 1
lea ecx, [ebp - 0x2c]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.WSOCK32.dll_recv]
mov dword [ebp - 0x30], eax
mov dword [ebp - 8], 0xe10
mov dword [ebp - 4], 0
push 8
lea ecx, [ebp - 8]
push ecx
push 0x1006
push 0xffff
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.WSOCK32.dll_setsockopt]
cmp dword [ebp - 0x30], 0
jle 0x100650b4
xor eax, eax
jmp 0x100650b9
mov eax, 0x132
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1002aab0
mov esp, ebp
pop ebp
ret
Function at 0x10066290
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x178
mov eax, dword [0x101a8cb0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
push eax
call fcn.10034f20
add esp, 4
mov dword [ebp - 0x178], eax
mov ecx, dword [ebp - 0x178]
push ecx
lea edx, [ebp - 0x170]
push edx
call fcn.10066660
add esp, 8
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
jge 0x1006632c
mov ecx, dword [ebp + 0x10]
push ecx
push 1
push 1
lea edx, [ebp - 0x171]
push edx
call fcn.10032e00
add esp, 0x10
cmp eax, 1
je 0x100662fd
mov eax, 1
jmp 0x1006632e
lea eax, [ebp - 0x171]
push eax
lea ecx, [ebp - 0x170]
push ecx
call fcn.10066150
add esp, 8
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
mov al, byte [ebp - 0x171]
mov byte [edx], al
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
jmp 0x100662d2
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1002aab0
mov esp, ebp
pop ebp
ret
Function at 0x100666c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0
jne 0x100666e5
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x14a], 0
jne 0x100666e5
mov eax, 0xc
jmp 0x100668e3
movzx edx, word [ebp + 0x10]
test edx, edx
jne 0x100666fa
mov eax, dword [ebp + 0xc]
mov byte [eax], 0
xor eax, eax
jmp 0x100668e3
xor ecx, ecx
mov word [ebp - 8], cx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x14a]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x14e]
cmp eax, dword [edx + 0x152]
jae 0x100668c0
mov ecx, dword [ebp + 8]
cmp dword [ecx + 4], 0
je 0x1006674e
push 1
lea edx, [ebp - 0x11]
push edx
mov eax, dword [ebp + 8]
add eax, 0xc
push eax
call fcn.1000b880
add esp, 0xc
cmp eax, 1
je 0x1006674c
jmp 0x100668c0
jmp 0x1006677c
mov ecx, dword [ebp - 0xc]
push ecx
push 1
push 1
lea edx, [ebp - 0x11]
push edx
call fcn.10032e00
add esp, 0x10
cmp eax, 1
je 0x1006676c
jmp 0x100668c0
lea eax, [ebp - 0x11]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10066150
add esp, 8
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x14e]
add eax, 1
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x14e], eax
movzx edx, byte [ebp - 0x11]
cmp edx, 0xd
jne 0x10066882
mov eax, dword [ebp + 0xc]
mov byte [eax], 0xa
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
mov byte [edx], 0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 0x14e]
cmp edx, dword [ecx + 0x152]
jae 0x10066833
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0
je 0x100667eb
push 1
lea ecx, [ebp - 0x11]
push ecx
mov edx, dword [ebp + 8]
add edx, 0xc
push edx
call fcn.1000b880
add esp, 0xc
mov word [ebp - 0x10], ax
jmp 0x10066813
mov eax, dword [ebp - 0xc]
push eax
push 1
push 1
lea ecx, [ebp - 0x11]
push ecx
call fcn.10032e00
add esp, 0x10
mov word [ebp - 0x10], ax
lea edx, [ebp - 0x11]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.10066150
add esp, 8
movsx ecx, word [ebp - 0x10]
cmp ecx, 1
jne 0x10066831
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x14e]
add eax, 1
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x14e], eax
jmp 0x10066839
xor edx, edx
mov word [ebp - 0x10], dx
movsx eax, word [ebp - 0x10]
cmp eax, 1
je 0x1006684e
mov eax, 0xcc
jmp 0x100668e3
movzx ecx, byte [ebp - 0x11]
cmp ecx, 0xa
je 0x1006687c
push 0x215
push str..Dcmcfg.c
push 0xca
push 0x40003
call fcn.10002e30
add esp, 0x10
mov eax, 0xca
jmp 0x100668e3
xor eax, eax
jmp 0x100668e3
movzx edx, byte [ebp - 0x11]
cmp edx, 0xa
jne 0x10066890
jmp 0x1006670c
mov eax, dword [ebp + 0xc]
mov cl, byte [ebp - 0x11]
mov byte [eax], cl
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov ax, word [ebp - 8]
add ax, 1
mov word [ebp - 8], ax
movzx ecx, word [ebp - 8]
movzx edx, word [ebp + 0x10]
cmp ecx, edx
jne 0x100668bb
jmp 0x100668c0
jmp 0x1006670c
mov eax, dword [ebp + 0xc]
mov byte [eax], 0
movzx ecx, word [ebp - 8]
test ecx, ecx
jle 0x100668d6
xor edx, edx
mov word [ebp - 4], dx
jmp 0x100668df
mov eax, 0xcc
mov word [ebp - 4], ax
mov ax, word [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x10066f80
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov edx, dword [esp + 0x14]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x18]
sub edx, dword [ecx]
shr eax, 0x10
add eax, 4
cmp eax, edx
jbe 0x10066fcb
push 0x4a1
push str..pdu.c
push 0x68
push 0x40003
call fcn.10002e30
add esp, 0x10
mov eax, 0x68
add esp, 8
ret
movzx eax, word [esp + 2]
movzx edx, byte [esp + 3]
mov byte [esp + 3], al
movzx eax, word [esp + 4]
mov byte [esp + 2], dl
movzx edx, byte [esp + 5]
mov byte [esp + 5], al
movzx eax, word [esp + 6]
mov byte [esp + 4], dl
movzx edx, byte [esp + 7]
mov byte [esp + 7], al
mov eax, dword [esp + 0x10]
mov byte [esp + 6], dl
mov edx, dword [esp]
mov dword [eax], edx
mov edx, dword [esp + 4]
mov dword [eax + 4], edx
add dword [ecx], 8
xor eax, eax
add esp, 8
ret

Function at 0x100671d0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x10
mov eax, dword [0x101a8cb0]
xor eax, esp
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov dword [esp + 8], eax
mov eax, dword [eax]
mov cx, word [eax + 4]
push esi
mov esi, dword [esp + 0x2c]
sub edx, dword [esi]
push edi
mov edi, dword [eax]
mov al, byte [eax + 6]
mov dword [esp + 0x14], edi
shr edi, 0x10
mov byte [esp + 0x1a], al
lea eax, [edi + 4]
mov word [esp + 0x18], cx
movzx ebp, cx
cmp eax, edx
jbe 0x1006724e
push 0x505
push str..pdu.c
push 0x68
push 0x40003
call fcn.10002e30
add esp, 0x10
pop edi
pop esi
pop ebp
mov eax, 0x68
pop ebx
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.1002aab0
add esp, 0x10
ret
movzx eax, word [esp + 0x16]
mov dl, byte [esp + 0x17]
mov byte [esp + 0x17], al
movzx eax, cx
mov cl, byte [esp + 0x19]
mov byte [esp + 0x16], dl
mov edx, dword [esp + 0x14]
mov byte [esp + 0x19], al
mov dword [ebx], edx
mov edx, dword [esp + 0x10]
mov byte [esp + 0x18], cl
mov ax, word [esp + 0x18]
mov word [ebx + 4], ax
add dword [esi], 6
mov eax, dword [edx]
movsx ecx, bp
push ecx
add eax, 6
push eax
add ebx, 6
push ebx
call fcn.10031ea0
mov eax, dword [esp + 0x1c]
add dword [esi], ebp
mov ecx, edi
sub ecx, ebp
sub ecx, 2
movsx edx, cx
mov ecx, dword [eax + 4]
push edx
push ecx
add ebx, ebp
push ebx
call fcn.10031ea0
mov ecx, dword [esp + 0x34]
sub edi, ebp
add esp, 0x18
sub edi, 2
add dword [esi], edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.1002aab0
add esp, 0x10
ret