joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44b234
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x44b24b
add esp, 0xfffffff0
call fcn.00403530
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00419064
mov eax, dword [0x44ff34]
cmp word [eax + 2], 0
jne 0x44b273
mov eax, dword [0x44ff34]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0044c90c
mov eax, dword [0x44ffe0]
cmp word [eax + 2], 0
jne 0x44b28d
mov eax, dword [0x44ffe0]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0044cb04
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x41135c]
call fcn.004031f4
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x41135c]
call fcn.004031f4
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41b238]
call fcn.00420e80
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x44b414
mov eax, dword [0x44fe5c]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00421250
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x44d0a4
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x44fe5c]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040bf44
test eax, eax
je 0x44b382
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.004082fc
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040bf6c
test eax, eax
je 0x44b396
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004041cc
mov eax, dword [0x44fd60]
cmp byte [eax], 0
jne 0x44b3ca
mov eax, ebx
call fcn.0044b53c
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0044d280
mov eax, ebx
call fcn.0044dc44
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x44b40a
call fcn.00403588
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44b7bc
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x451bb0]
cmp dword [eax + 0x30], 0
je 0x44b866
cmp dword [ebx + 0x94], 0
jne 0x44b860
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x44b74c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x44b860
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x44b826
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x44b860
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.004136c4
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x44b835
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x44c3c8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x44c3fd
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040404c
jmp 0x44c40a
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00403fb0
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x44d45c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x44d49d
mov eax, esi
call fcn.00433e28
test al, al
je 0x44d49d
mov eax, dword [ebx + 0x84]
call fcn.00433b50
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x44d49d
push 0
mov eax, dword [ebx + 0x84]
call fcn.00433b50
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x401c66
pop dword [ebp - 0x50]
mov eax, 0x26637b5d
add eax, 0xd9dca109
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xbfad4c87
add dword [ebp - 0x60], 0x8ea4f8c4
mov dword [ebp - 0x5c], 0x5b3cc540
sub dword [ebp - 0x5c], 0x290978fb
mov dword [ebp - 0x58], 0x19aa93da
add dword [ebp - 0x58], 0x32a1b054
mov dword [ebp - 0x54], 0x945ec62
add dword [ebp - 0x54], 0xf6ba139e
lea eax, [ebp - 0x60]
push eax
mov eax, 0x6c72a6fe
add eax, 0x93cd8956
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x648be151
sub dword [ebp - 0x60], 0xf01977fb
mov dword [ebp - 0x5c], 0xf6343f34
add dword [ebp - 0x5c], 0x4b382241
mov dword [ebp - 0x58], 0xecec5656
sub dword [ebp - 0x58], 0x897ce9ea
mov dword [ebp - 0x54], 0x7e6fd602
add dword [ebp - 0x54], 0x819029fe
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0xc780e050
sub eax, 0xc740b024
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x349de
push 0
call eax
mov ecx, 0xbcd0d017
add ecx, 0x432f7074
xor edx, edx
add edx, eax
mov ebx, 0x407000
add ebx, dword [ebp - 0x50]
mov esi, 0xa399bc85
add esi, 0x2a3ec83f
sub dword [ebp - 0x28], ecx
mov edi, dword [ebx]
xor dword [ebp - 0x14], esi
add edi, esi
mov dword [ebp - 0x40], 0x26562819
mov dword [edx], edi
add dword [ebp - 0x38], ebx
add edx, 0x34ce3205
sub edx, 0x34ce3201
add ebx, 0x3b6175ff
sub ebx, 0x3b6175fb
loop 0x401d84
add eax, 0xf4ff
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x448590
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x62c330]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp + 0x18]
mov esi, ecx
mov dword [ebp - 0x218], eax
test edi, edi
je 0x4486b2
lea eax, [ebp - 0x210]
push eax
push 0x5faa74
push 1
push 0
push 0x5fad64
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x4486b2
mov eax, dword [ebp - 0x210]
lea edx, [ebp - 0x214]
push edx
push 0x5fadc4
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
js 0x4486a6
mov eax, dword [ebp - 0x210]
mov ecx, dword [eax]
test esi, esi
jne 0x44861d
push dword [0x638f5c]
jmp 0x44861e
push esi
push eax
call dword [ecx + 0x50]
mov edx, dword [ebp - 0x218]
test edx, edx
je 0x448639
mov eax, dword [ebp - 0x210]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x210]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov edx, dword [ebp - 0x21c]
test edx, edx
je 0x448660
mov eax, dword [ebp - 0x210]
push 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x44]
test ebx, ebx
je 0x44867f
push ebx
push edi
lea eax, [ebp - 0x20c]
push str._s_s
push eax
call fcn.00577e35
add esp, 0x10
jmp 0x44870b
push 0x5c
test esi, esi
je 0x448688
push esi
jmp 0x44868e
push dword [0x638f5c]
call fcn.00577bc1
add esp, 8
test eax, eax
jne 0x4486c5
mov eax, dword [ebp - 0x214]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x210]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005745ae
mov esp, ebp
pop ebp
ret
push eax
push edi
lea eax, [ebp - 0x20c]
push str._s_s
push eax
call fcn.00577e35
lea ecx, [ebp - 0x20c]
add esp, 0x10
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4486e4
sub ecx, edx
mov eax, 0x6b
sar ecx, 1
mov dword [ebp + ecx*2 - 0x212], 0x6e006c
mov word [ebp + ecx*2 - 0x20e], ax
mov eax, dword [ebp - 0x214]
lea edx, [ebp - 0x20c]
push 1
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov ecx, dword [ebp - 0x214]
mov esi, eax
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
mov ecx, dword [ebp - 0x210]
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
mov ecx, dword [ebp - 4]
xor eax, eax
test esi, esi
pop edi
setns al
xor ecx, ebp
pop esi
pop ebx
call fcn.005745ae
mov esp, ebp
pop ebp
ret
Function at 0x59c688
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x4373ce
Capabilities:
Encode data using xor

Disassembly:
aam 0x8e
xchg esi, eax
push 0xffffffffffffff97
xchg edi, eax
jp 0x4373ef
xor eax, 0xbad82ff6
add al, 0
xchg esi, eax
jge 0x4373d2
xchg byte [ebx], ch
fiadd word [0xb884458e]
mov byte [esi - 0x6a], ah
inc ecx
dec esi
fld xword [eax + 0x2f99e8a1]
int 0xcf
call 0xd010a38d
mov eax, 0x5e4e4d4b
dec ebx
shr dword [ebp - 9], cl
invalid

Function at 0x464c6e
Capabilities:
Encode data using xor

Disassembly:
sub al, 0xfc
sbb eax, 0x3fbcfe90
pop ss
jmp 0xc8287c4c
jg 0x464b4d
and dword [0x538155e0], edi
pushal
sub ch, dh
sahf
movsb byte es:[edi], byte [esi]
fsubr dword [edi]
cmc
adc edx, ebp
and byte [edi], ch
xor byte [esp + ebx*8 + 0x43], ch
dec ecx
aaa
push ebx
sbb eax, 0xc84f4f9a
imul eax, dword fs:[ecx - 0x79417c78], 0x67
enter 0xffffffffffffe4d2, 0x69
test byte [esi - 0x3da71008], bh
dec esi
lea edx, [ecx]
and al, 0x42
test byte [esi - 0x7a], ah
inc edi
fbstp tbyte [ecx + 0x746e1e71]
mov esi, 0xfe8d4ea0
sbb byte [edi - 0x2d0fb230], 0xf0
je 0x464baf
mov al, byte [0x80fe8d4e]
lahf
ror byte [ebp - 0x10], 1
sal al, cl
mov ebx, 0x7a2b19fc
and ch, byte [esi + 0x72850ed5]
sub ecx, dword [eax + edx*2 + 0x1f]
jb 0x464c59
push ds
sbb ebp, dword [0xd18cf93f]
movsb byte es:[edi], byte [esi]
pop dword [ecx + 0x5d]
inc eax
xchg esi, eax
or ecx, edi
arpl word [ebp + eax*8 + 0x2a2f39c8], ax
and eax, 0x1e71c01b
inc ebx
bound eax, qword [ebp + 0x17]
je 0x464bef
mov dh, 0x51
test eax, 0x8bae88b5
popal
stosb byte es:[edi], al
js 0x464cb8
loop 0x464bbf
hlt
invalid
test byte [esi], bl
clc
invalid
jg 0x464cc8
popfd
jne 0x464c39
loop 0x464c9d
xchg ebx, eax
push es
cmpsb byte ss:[esi], byte es:[edi]
insd dword es:[edi], dx
aam 0xf1
jnp 0x464c53
jae 0x464d30
sbb ah, byte [ebp - 0x3a44df72]
scasb al, byte es:[edi]
sbb byte [eax + esi + 0x49], dh
sbb byte [esi - 0xd], ch
jbe 0x464d0d

Function at 0x48b5be
Capabilities:
Encode data using xor

Disassembly:
adc ebx, dword [ebp + 0x4669eaae]
stc
mov al, ch
scasd eax, dword es:[edi]
bound ecx, qword gs:[ecx]
js 0x48b629
cmp ch, byte [ebx + 0x12]
xchg edi, eax
aas
push 0xffffffffffffffdd
pop esi
inc ebx
or dword [ebx + 0x49], edi
cwde
test dh, bl
mov ecx, 0x87538254
invalid
jb 0x48b69e
cld
add eax, 0x98c07683
salc
pop ebx
sahf
xchg ebp, eax
div edx
out 0xa3, al
outsb dx, byte [esi]
ljmp 0x7d43
nop
and al, 0x9b
push eax
test al, 0x39
stosd dword es:[edi], eax
cmp cl, bl
invalid
Function at 0x4bacbd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c43b8
cmp edx, dword [eax]
je 0x4bacdf
add eax, 8
inc ecx
cmp eax, 0x4c4448
jl 0x4bacd0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c43b8]
jne 0x4bae0d
mov eax, dword [0x4c8d3c]
cmp eax, 1
je 0x4bade7
test eax, eax
jne 0x4bad10
cmp dword [0x4c42e0], 1
je 0x4bade7
cmp edx, 0xfc
je 0x4bae0d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bad47
lea eax, [ebp - 0x1a4]
push 0x4bfd20
push eax
call fcn.004bb6a0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bbb30
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bad8a
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bbb30
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bfd1c
push edi
call fcn.004bda00
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4bfd00
push eax
call fcn.004bb6a0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bb6b0
lea eax, [ebp - 0xa0]
push 0x4bfcfc
push eax
call fcn.004bb6b0
push dword [esi + 0x4c43bc]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bb6b0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4bfcd4
push eax
call fcn.004bd974
add esp, 0x2c
pop edi
jmp 0x4bae0d
lea eax, [ebp + 8]
lea esi, [esi + 0x4c43bc]
push 0
push eax
push dword [esi]
call fcn.004bbb30
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4019bc
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
lea eax, [0x4031e2]
push eax
push esp
mov eax, esp
push eax
push 0x40
push 0x9a0
push 0x40300a
call fcn.00401c40
pop edx
pop eax
mov ebx, 0x40340a
mov dword [eax - 0x34], ebx
lea esi, [ebx + 0x118]
mov ebx, 0x401021
mov edx, 0x5a0
add ebx, 4
mov edi, dword [ebx - 4]
mov dword [esi - 0x118], edi
add esi, 4
sub dword [esi - 0x11c], 0x78973532
xor dword [esi - 0x11c], 0x29375ea2
sub edx, 4
cmp edx, 0
jne 0x4019f5
push eax
push 0
call fcn.00401bf8
pop eax
pop ebp
ret 0x10
Function at 0x10001000
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x198
mov eax, dword [0x100122cc]
xor eax, esp
mov dword [esp + 0x194], eax
cmp dword [ebp + 0xc], 1
mov eax, dword [ebp + 8]
jne 0x10001065
push eax
mov dword [0x10013c54], eax
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0x100144e0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor eax, eax
push 0x18e
push eax
mov word [esp + 8], ax
lea eax, [esp + 0xa]
push eax
call fcn.10009fc0
add esp, 0xc
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
jmp 0x1000108c
cmp dword [ebp + 0xc], 0
jne 0x1000108c
push 0x100144e0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push closesocket
push 0
push 0
push 0
call sym.ProcMgr.dll_StopRoutineW
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x194]
xor eax, eax
xor ecx, esp
inc eax
call fcn.100042df
mov esp, ebp
pop ebp
ret 0xc

Function at 0x100010a3
Capabilities:
Create tcp socket

Disassembly:
push 0xc
push 0x10010780
call fcn.10006044
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], ebx
cmp dword [0x10013dd4], ebx
je 0x10001165
mov eax, dword [0x10013dd8]
cmp eax, ebx
je 0x10001165
mov dword [ebp - 0x1c], eax
push 0x48
pop ecx
mov esi, eax
mov edi, 0x10013c90
rep movsd dword es:[edi], dword [esi]
lea esi, [eax + 0x120]
mov edi, 0x10013c58
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea esi, [ebp - 0x1c]
call fcn.10002726
call fcn.100023d1
push 1
push ebx
push ebx
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_WSASocketW]
mov dword [0x10013164], eax
cmp eax, 0xffffffff
je 0x10001146
mov esi, 0x10013c6c
call fcn.1000260b
test eax, eax
je 0x10001146
cmp dword [ebp + 0x14], 0x7fffffff
je 0x10001146
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0xffffffffffffffff
push dword [0x10013c70]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], 0xfffffffe
call fcn.100011a8
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.10006089
ret 0x10
push str.Global1B4BAB0F_4544_4c13_90E9_622E2EE1411B
push 0x1000
push ebx
push 0x8000004
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [0x10013dd4], eax
cmp eax, ebx
je 0x100011a3
push ebx
push ebx
push ebx
push 0xf001f
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x10013dd8], eax
cmp eax, ebx
jne 0x100010d0
mov dword [ebp - 0x1c], ebx
jmp 0x10001146
Function at 0x1000232a
Capabilities:
Acquire debug privileges

Disassembly:
push 0x20
push 0x100106e0
call fcn.10006044
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x30], ebx
xor eax, eax
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x1c]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1000236c
mov dword [ebp - 0x20], 1
jmp 0x100023a6
mov dword [ebp - 0x24], 2
xor esi, esi
inc esi
mov dword [ebp - 0x30], esi
lea eax, [ebp - 0x2c]
push eax
push str.SeDebugPrivilege
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x100023a3
push ebx
push ebx
push 0x10
lea eax, [ebp - 0x30]
push eax
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x100023a6
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], 0xfffffffe
call fcn.100023c2
xor eax, eax
cmp dword [ebp - 0x20], ebx
sete al
call fcn.10006089
ret

Function at 0x10002466
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x10]
xor esi, esi
jmp 0x1000248c
mov eax, dword [ebp + 0xc]
push 0
push edi
add eax, esi
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x10002490
add esi, eax
sub edi, eax
test edi, edi
jg 0x10002472
xor eax, eax
cmp esi, dword [ebp + 0x10]
pop edi
sete al
pop esi
pop ebp
ret

Function at 0x1000249c
Capabilities:
Receive data
Receive data on socket

Disassembly:
push esi
xor esi, esi
push edi
mov edi, dword [0x10013164]
test ebx, ebx
jle 0x100024c9
push 0
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [esp + 0x14]
add eax, esi
push eax
push edi
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x100024d3
add esi, eax
cmp esi, ebx
jl 0x100024aa
xor eax, eax
cmp ebx, esi
sete al
pop edi
pop esi
ret
xor eax, eax
jmp 0x100024d0
Function at 0x100024d7
Capabilities:
Print debug messages
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
lea ebp, [esp - 0x40bc]
mov eax, 0x413c
call fcn.1000d0d0
mov eax, dword [0x100122cc]
xor eax, ebp
mov dword [ebp + 0x40b8], eax
mov eax, dword [0x10013164]
push ebx
push esi
push edi
lea ecx, [ebp - 0x54]
push ecx
push 0x8004667e
xor ebx, ebx
push eax
mov esi, eax
mov dword [ebp - 0x54], ebx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
push 0x20
mov edi, eax
push edi
push esi
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
push 1
push esi
call dword [sym.imp.WS2_32.dll_shutdown]
push 0x2710
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, ebx
jne 0x1000258d
lea eax, [ebp - 0x80]
push eax
push edi
push esi
call dword [sym.imp.WS2_32.dll_WSAEnumNetworkEvents]
test byte [ebp - 0x80], 0x20
je 0x1000258d
mov dword [ebp - 0x50], ebx
push 0x3fff
lea eax, [ebp - 0x4b]
push ebx
push eax
mov byte [ebp - 0x4c], bl
call fcn.10009fc0
add esp, 0xc
push ebx
push 0x4000
lea eax, [ebp - 0x4c]
push eax
push esi
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, ebx
je 0x100025b5
cmp eax, 0xffffffff
je 0x100025b5
inc dword [ebp - 0x50]
cmp dword [ebp - 0x50], 0x20
jl 0x10002555
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
push edi
call dword [sym.imp.WS2_32.dll_WSACloseEvent]
xor eax, eax
mov ecx, dword [ebp + 0x40b8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100042df
add ebp, 0x40bc
leave
ret
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
push edi
call dword [sym.imp.WS2_32.dll_WSACloseEvent]
push 0x103
lea eax, [ebp + 0x3fb5]
push ebx
push eax
mov byte [ebp + 0x3fb4], bl
call fcn.10009fc0
add esp, 0xc
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
lea eax, [ebp + 0x3fb4]
push str.SocketLibs_PerfectClose___d
push eax
call fcn.10004495
add esp, 0xc
lea eax, [ebp + 0x3fb4]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
inc eax
jmp 0x1000259d

Function at 0x1000260b
Capabilities:
Create thread

Disassembly:
push ebx
xor ebx, ebx
push edi
cmp esi, ebx
je 0x10002641
mov edi, 0x100011ec
mov eax, edi
test eax, eax
je 0x10002641
push 1
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push ebx
push ebx
push ebx
push edi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
cmp eax, ebx
setne cl
mov dword [esi + 4], eax
mov eax, ecx
jmp 0x10002643
xor eax, eax
pop edi
pop ebx
ret

Function at 0x10002646
Capabilities:
Terminate thread

Disassembly:
push edi
mov edi, eax
xor eax, eax
cmp edi, eax
jne 0x10002651
pop edi
ret
cmp dword [edi], eax
je 0x1000269a
cmp dword [edi + 4], eax
je 0x1000269a
push eax
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x2710
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1000268a
push 1
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 8
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
xor eax, eax
inc eax
pop edi
ret