joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4521f8
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x45220f
add esp, 0xfffffff0
call fcn.004035d8
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004198e4
mov eax, dword [0x48c938]
cmp word [eax + 2], 0
jne 0x452237
mov eax, dword [0x48c938]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004538e8
mov eax, dword [0x48c9e8]
cmp word [eax + 2], 0
jne 0x452251
mov eax, dword [0x48c9e8]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00453ae0
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x411b24]
call fcn.00403284
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x411b24]
call fcn.00403284
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41be38]
call fcn.004236f0
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x4523d8
mov eax, dword [0x48c860]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00423ac0
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x454080
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x48c860]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040c58c
test eax, eax
je 0x452346
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408808
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040c5b4
test eax, eax
je 0x45235a
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404318
mov eax, dword [0x48c740]
cmp byte [eax], 0
jne 0x45238e
mov eax, ebx
call fcn.00452500
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0045425c
mov eax, ebx
call fcn.00454c20
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4523ce
call fcn.00403630
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x452780
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x48dbdc]
cmp dword [eax + 0x30], 0
je 0x45282a
cmp dword [ebx + 0x94], 0
jne 0x452824
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x452710
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x452824
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4527ea
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x452824
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00413efc
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4527f9
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45338c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x4533c1
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404198
jmp 0x4533ce
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004040fc
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x454438
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x454479
mov eax, esi
call fcn.0043ac20
test al, al
je 0x454479
mov eax, dword [ebx + 0x84]
call fcn.0043a91c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x454479
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043a91c
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x457b40
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x457b6e
mov eax, ebx
call fcn.004585f4
cmp dword [ebx + 0x40], 0
je 0x457b67
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x457bdf
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x457bd1
cmp dword [ebx + 8], 0
je 0x457b90
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x457ba2
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x457bd1
cmp dword [ebx + 8], 0
je 0x457b83
cmp eax, 3
je 0x457bb5
dec eax
jne 0x457b83
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x457b83
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x457b83
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x457bfd
cmp dword [ebx + 0x14], 0xcc
je 0x457bfd
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00457c08
pop ebx
ret
Function at 0x471b0c
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
add eax, 0x11
mov edx, 0xe38e38e4
mul edx
shr edx, 5
mov eax, edx
or eax, eax
je 0x471baf
mov ecx, dword [esp + 4]
add ecx, 0x484
nop
fld dword [ecx - 0x400]
xor byte [ecx - 0x2fd], 0x80
fld dword [ecx - 0x200]
fxch st(1)
fchs
fxch st(1)
fchs
fstp dword [ecx - 0x200]
fstp dword [ecx - 0x400]
fld dword [ecx - 0x100]
xor byte [ecx + 3], 0x80
fld dword [ecx + 0x100]
fxch st(1)
fchs
fxch st(1)
fchs
fstp dword [ecx + 0x100]
fstp dword [ecx - 0x100]
fld dword [ecx + 0x200]
xor byte [ecx + 0x303], 0x80
fld dword [ecx + 0x400]
fxch st(1)
fchs
fxch st(1)
fchs
fstp dword [ecx + 0x400]
fstp dword [ecx + 0x200]
add ecx, 8
dec eax
jne 0x471b34
ret

Function at 0x479ec8
Capabilities:
Resume thread

Disassembly:
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_ResumeThread
ret
Function at 0x71a11a8e
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
inc ebx
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp._Cntl.DLL_RtlGetNtProductType]
test al, al
je 0x71a1267e
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp._CKERNEL.DLL_GetSystemInfo]
mov eax, ebx
cmp eax, dword [ebp - 0x24]
sbb eax, eax
and eax, 0x7d0
mov dword [0x71a15080], eax
mov eax, dword [ebp - 4]
dec eax
neg eax
sbb eax, eax
and eax, 0x18
add eax, 8
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
push eax
push ebx
push 0
push 0x71a11bbc
push 0x80000002
call dword [sym.imp._CADVAPI.DLL_RegOpenKeyExA]
test eax, eax
jne 0x71a11b48
push esi
mov esi, dword [sym.imp._CADVAPI.DLL_RegQueryValueExA]
push edi
push 4
pop edi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x71a11ba4
push dword [ebp - 0xc]
mov dword [ebp - 8], edi
call esi
cmp dword [ebp - 0x24], ebx
jbe 0x71a11b3d
lea eax, [ebp - 8]
push eax
push 0x71a15080
lea eax, [ebp - 0x14]
push eax
push 0
push 0x71a11b94
push dword [ebp - 0xc]
mov dword [ebp - 8], edi
call esi
push dword [ebp - 0xc]
call dword [sym.imp._CADVAPI.DLL_RegCloseKey]
pop edi
pop esi
mov edx, dword [ebp - 0x10]
mov eax, 0x100
test eax, edx
mov ecx, eax
jne 0x71a11b5c
shr ecx, 1
test edx, ecx
je 0x71a11b56
cmp dword [ebp - 4], ebx
pop ebx
jne 0x71a1268a
cmp ecx, 0x20
ja 0x71a1269e
cmp ecx, 8
jb 0x71a12686
mov eax, 0x1f40
cmp dword [0x71a15080], eax
ja 0x71a126a6
dec ecx
mov dword [0x71a15084], ecx
leave
ret
mov dword [ebp - 4], ebx
jmp 0x71a11aaf
push 8
jmp 0x71a126a0
cmp ecx, eax
jbe 0x71a12695
mov ecx, eax
jmp 0x71a11b78
cmp ecx, 0x20
jae 0x71a11b78
push 0x20
pop ecx
jmp 0x71a11b78
mov dword [0x71a15080], eax
jmp 0x71a11b89
Function at 0x71a12ee1
Capabilities:
Install driver
Query service status
Start service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
push 2
call dword [sym.imp._Cntl.DLL_RtlImpersonateSelf]
test eax, eax
jl 0x71a12f4d
mov esi, dword [sym.imp._Cntl.DLL_RtlAdjustPrivilege]
lea eax, [ebp - 1]
push eax
xor edi, edi
inc edi
push edi
push edi
push 0xa
call esi
mov ebx, eax
test ebx, ebx
jl 0x71a12f3c
push 0x71a13028
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp._Cntl.DLL_RtlInitUnicodeString]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp._Cntl.DLL_NtLoadDriver]
cmp byte [ebp - 1], 0
mov ebx, eax
jne 0x71a12f3c
lea eax, [ebp - 1]
push eax
push edi
push edi
push 0xa
call esi
call dword [sym.imp._CADVAPI.DLL_RevertToSelf]
test ebx, ebx
jl 0x71a12f4d
xor eax, eax
jmp 0x71a13023
push 5
push 0x71a12a2c
xor esi, esi
push esi
call dword [sym.imp._CADVAPI.DLL_OpenSCManagerA]
cmp eax, esi
mov dword [ebp - 8], eax
je 0x71a12ff7
push 0x14
push 0x71a12a24
push eax
call dword [sym.imp._CADVAPI.DLL_OpenServiceA]
mov ebx, dword [sym.imp._CADVAPI.DLL_CloseServiceHandle]
mov edi, eax
cmp edi, esi
je 0x71a12fe8
push esi
push esi
push edi
call dword [sym.imp._CADVAPI.DLL_StartServiceA]
test eax, eax
jne 0x71a12fa1
call dword [sym.imp._CKERNEL.DLL_GetLastError]
mov esi, eax
cmp esi, 0x420
je 0x71a12fda
jmp 0x71a12fe3
mov esi, dword [sym.imp._CADVAPI.DLL_QueryServiceStatus]
jmp 0x71a12fc1
cmp dword [ebp - 0x24], 2
jne 0x71a12fd4
call dword [sym.imp._CKERNEL.DLL_SwitchToThread]
test eax, eax
jne 0x71a12fc1
push 0xa
call dword [sym.imp._CKERNEL.DLL_Sleep]
lea eax, [ebp - 0x28]
push eax
push edi
call esi
test eax, eax
jne 0x71a12fa9
call dword [sym.imp._CKERNEL.DLL_GetLastError]
jmp 0x71a12fda
cmp dword [ebp - 0x24], 4
jne 0x71a12fde
xor esi, esi
jmp 0x71a12fe3
mov esi, 0x2742
push edi
call ebx
jmp 0x71a12ff0
call dword [sym.imp._CKERNEL.DLL_GetLastError]
mov esi, eax
push dword [ebp - 8]
call ebx
jmp 0x71a12fff
call dword [sym.imp._CKERNEL.DLL_GetLastError]
mov esi, eax
test esi, esi
je 0x71a13021
cmp esi, 5
je 0x71a1301c
cmp esi, 8
je 0x71a13021
cmp esi, 0x2742
je 0x71a13021
mov esi, 0x276b
jmp 0x71a13021
mov esi, 0x271d
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x71a13343
Capabilities:
Create service
Modify service

Disassembly:
push 0x118
push 0x71a13530
call fcn.71a115e7
mov eax, dword [0x71a15078]
mov dword [ebp - 0x1c], eax
xor ebx, ebx
cmp dword [0x71a15040], ebx
je 0x71a13368
xor eax, eax
jmp 0x71a1336d
call fcn.71a11a57
cmp eax, ebx
jne 0x71a134e9
mov dword [ebp - 4], ebx
push 0x100
lea eax, [ebp - 0x11c]
push eax
push 1
push dword [0x71a15044]
call dword [sym.imp.USER32.dll_LoadStringA]
mov dword [ebp - 0x120], eax
jmp 0x71a133af
or dword [ebp - 4], 0xffffffff
cmp eax, ebx
jne 0x71a133cd
call dword [sym.imp._CKERNEL.DLL_GetLastError]
cmp eax, ebx
jne 0x71a134e9
push 8
pop eax
jmp 0x71a134e9
mov dword [ebp - 0x120], ebx
push 2
push 0x71a12a2c
push ebx
call dword [sym.imp._CADVAPI.DLL_OpenSCManagerA]
mov dword [ebp - 0x124], eax
cmp eax, ebx
jne 0x71a133f6
call dword [sym.imp._CKERNEL.DLL_GetLastError]
jmp 0x71a134e9
push ebx
push ebx
push ebx
push ebx
push 0x71a13524
push 0x71a134f8
push 1
push 1
push 1
mov edi, 0xf01ff
push edi
lea ecx, [ebp - 0x11c]
push ecx
mov esi, 0x71a12a24
push esi
push eax
call dword [sym.imp._CADVAPI.DLL_CreateServiceA]
mov dword [ebp - 0x128], eax
cmp eax, ebx
jne 0x71a134ba
call dword [sym.imp._CKERNEL.DLL_GetLastError]
mov dword [ebp - 0x120], eax
cmp eax, 0x431
je 0x71a13456
push dword [ebp - 0x124]
call dword [sym.imp._CADVAPI.DLL_CloseServiceHandle]
jmp 0x71a134e3
mov dword [ebp - 0x120], ebx
push edi
push esi
push dword [ebp - 0x124]
call dword [sym.imp._CADVAPI.DLL_OpenServiceA]
mov dword [ebp - 0x128], eax
cmp eax, ebx
jne 0x71a1348c
call dword [sym.imp._CKERNEL.DLL_GetLastError]
mov esi, eax
push dword [ebp - 0x124]
call dword [sym.imp._CADVAPI.DLL_CloseServiceHandle]
mov eax, esi
jmp 0x71a134e9
lea ecx, [ebp - 0x11c]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x71a134f8
push 1
push 1
push 1
push eax
call dword [sym.imp._CADVAPI.DLL_ChangeServiceConfigA]
test eax, eax
jne 0x71a134ba
call dword [sym.imp._CKERNEL.DLL_GetLastError]
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], ebx
jne 0x71a134cd
call fcn.71a12ee1
mov dword [ebp - 0x120], eax
push dword [ebp - 0x128]
mov esi, dword [sym.imp._CADVAPI.DLL_CloseServiceHandle]
call esi
push dword [ebp - 0x124]
call esi
mov eax, dword [ebp - 0x120]
mov ecx, dword [ebp - 0x1c]
call fcn.71a122ab
call fcn.71a11622
ret
Function at 0x71a13541
Capabilities:
Modify service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
cmp dword [0x71a15040], esi
jne 0x71a1355f
call fcn.71a11a57
cmp eax, esi
jne 0x71a135e0
push ebx
push 2
push 0x71a12a2c
push esi
call dword [sym.imp._CADVAPI.DLL_OpenSCManagerA]
mov ebx, eax
cmp ebx, esi
mov dword [ebp - 4], ebx
jne 0x71a1357f
call dword [sym.imp._CKERNEL.DLL_GetLastError]
jmp 0x71a135df
push edi
push 0xf01ff
push 0x71a12a24
push ebx
call dword [sym.imp._CADVAPI.DLL_OpenServiceA]
mov edi, eax
cmp edi, esi
jne 0x71a135aa
call dword [sym.imp._CKERNEL.DLL_GetLastError]
push ebx
mov esi, eax
call dword [sym.imp._CADVAPI.DLL_CloseServiceHandle]
mov eax, esi
jmp 0x71a135de
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push 4
push 0xffffffffffffffff
push edi
call dword [sym.imp._CADVAPI.DLL_ChangeServiceConfigA]
test eax, eax
je 0x71a135c6
xor ebx, ebx
jmp 0x71a135ce
call dword [sym.imp._CKERNEL.DLL_GetLastError]
mov ebx, eax
mov esi, dword [sym.imp._CADVAPI.DLL_CloseServiceHandle]
push edi
call esi
push dword [ebp - 4]
call esi
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x71a13cde
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x474
mov eax, dword [0x71a15078]
push esi
mov dword [ebp - 4], eax
call dword [sym.imp._CKERNEL.DLL_GetCurrentProcessId]
xor esi, esi
cmp dword [0x71a15040], esi
jne 0x71a13d0f
call fcn.71a11a57
cmp eax, esi
jne 0x71a13ea5
cmp dword [ebp + 8], esi
je 0x71a13d1d
cmp dword [ebp + 8], 0x56442020
je 0x71a13d25
push 0x57
pop eax
jmp 0x71a13ea5
push edi
mov edi, dword [sym.imp._Cntl.DLL_RtlInitUnicodeString]
push 0x71a13f28
lea eax, [ebp - 0x46c]
push eax
call edi
push 0x4021
lea eax, [ebp - 0x46c]
mov dword [ebp - 0x43c], eax
push 3
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x444]
push eax
push 0x100001
lea eax, [ebp - 0x420]
push eax
mov dword [ebp - 0x444], 0x18
mov dword [ebp - 0x440], esi
mov dword [ebp - 0x438], 0x40
mov dword [ebp - 0x434], esi
mov dword [ebp - 0x430], esi
call dword [sym.imp._Cntl.DLL_NtOpenFile]
test eax, eax
jl 0x71a13ea2
push ebx
push 0x71a13ee0
lea eax, [ebp - 0x464]
push eax
call edi
mov ebx, dword [sym.imp._Cntl.DLL_NtQueryDirectoryFile]
push 1
lea eax, [ebp - 0x464]
push eax
jmp 0x71a13e6b
mov eax, dword [ebp - 0x414]
shr eax, 1
mov word [ebp + eax*2 - 0x410], si
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x20c]
push 0x71a13eb4
push eax
call dword [sym.imp._Cntl.DLL_swprintf]
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x474]
push eax
call edi
push esi
push esi
push esi
push 3
push 1
push 0x80
lea eax, [ebp - 0x474]
mov dword [ebp - 0x454], eax
push esi
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x45c]
push eax
push 0x40100000
lea eax, [ebp - 0x42c]
push eax
mov dword [ebp - 0x45c], 0x18
mov dword [ebp - 0x458], esi
mov dword [ebp - 0x450], 0x40
mov dword [ebp - 0x44c], esi
mov dword [ebp - 0x448], esi
call dword [sym.imp._Cntl.DLL_NtCreateFile]
test eax, eax
jl 0x71a13e69
push dword [ebp - 0x42c]
call dword [sym.imp._Cntl.DLL_NtClose]
push esi
push esi
push 1
push 0xc
push 0x210
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x428]
push eax
push esi
push esi
push esi
push dword [ebp - 0x420]
call ebx
test eax, eax
je 0x71a13dbe
push dword [ebp - 0x420]
call dword [sym.imp._Cntl.DLL_NtClose]
pop ebx
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
pop esi
call fcn.71a122ab
leave
ret 4
Function at 0x10003099
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x10047eaa
call fcn.10046b78
push ecx
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x14], edi
push 0x48
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
call fcn.1001ae6f
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [edi + 4], eax
lea ecx, [edi + 0x10]
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ecx
and dword [ebp - 0x10], ebx
push eax
call fcn.10005746
mov byte [ebp - 4], 1
lea esi, [edi + 0x30]
mov dword [ebp - 0x10], esi
and dword [esi], ebx
push 0x1c
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call fcn.1001ae6f
pop ecx
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 4], eax
lea ecx, [esi + 0xc]
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
mov byte [ebp - 4], 3
mov dword [esi + 0x18], 7
mov dword [esi + 0x1c], 8
mov dword [esi], 0x3f800000
push dword [esi + 4]
push 0x10
call fcn.1000589f
lea ecx, [edi + 0x50]
mov byte [ebp - 4], 4
push ecx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ecx
and dword [ebp - 0x10], ebx
push eax
call fcn.10005442
mov ecx, edi
mov byte [ebp - 4], 5
call fcn.1000319c
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x100032b2
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 4]
test edx, edx
jne 0x100032d0
mov edx, dword [edi + 0xc]
lea eax, [edx + 1]
mov dword [edi + 0xc], eax
mov dword [ecx + 4], edx
xor ecx, ecx
mov dword [ebp + 0xc], edx
mov ebx, 0x811c9dc5
mov esi, ecx
movzx eax, byte [ebp + esi + 0xc]
xor eax, ebx
imul ebx, eax, 0x1000193
inc esi
cmp esi, 4
jb 0x100032dc
mov esi, dword [edi + 0x28]
and esi, ebx
mov ebx, dword [edi + 0x1c]
mov eax, dword [ebx + esi*8 + 4]
cmp eax, dword [edi + 0x14]
je 0x10003313
mov esi, dword [ebx + esi*8]
jmp 0x1000330c
cmp eax, esi
je 0x10003313
mov eax, dword [eax + 4]
cmp edx, dword [eax + 8]
jne 0x10003305
jmp 0x10003315
mov eax, ecx
test eax, eax
cmove eax, dword [edi + 0x14]
cmp eax, dword [edi + 0x14]
pop edi
pop esi
pop ebx
je 0x1000332d
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov cl, 1
mov al, cl
pop ebp
ret 8

Function at 0x1000697c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x10]
mov ebx, ecx
push eax
push 0x40
push 5
mov ebp, dword [ebx]
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [esp + 0x10]
call fcn.10008172
mov esi, dword [ebx + 0xc]
mov edi, eax
sub esi, dword [ebx + 8]
push esi
push dword [ebx + 8]
push dword [ebx]
call fcn.1001c690
push edi
push 5
pop edx
mov ecx, ebp
call fcn.10007b0c
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x100069c5
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x10]
mov esi, ecx
push eax
push 0x40
push 5
mov edi, dword [esi]
pop ebp
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [esp + 0x10]
call fcn.10008172
mov ecx, dword [esi + 0x14]
mov ebx, eax
mov byte [esp + 0x14], 0xe9
lea eax, [esp + 0x14]
push ebp
push eax
mov ecx, dword [ecx + 0x1c]
sub ecx, dword [esi]
push dword [esi]
sub ecx, ebp
mov dword [esp + 0x21], ecx
call fcn.1001c690
mov ecx, dword [esi + 0xc]
add esp, 0xc
sub ecx, dword [esi + 8]
cmp ecx, ebp
jbe 0x10006a32
mov eax, dword [esi]
lea esi, [eax + 5]
sub eax, esi
add eax, ecx
push eax
push 0x90
push esi
call fcn.1001cc20
add esp, 0xc
push ebx
mov edx, ebp
mov ecx, edi
call fcn.10007b0c
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x1000993a
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a4
lea eax, [esp + 0x14]
push esi
mov esi, ecx
push eax
push 0x202
mov byte [esi], 0
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ecx, eax
test ecx, ecx
jne 0x1000999a
mov eax, dword [esp + 0x18]
cmp al, 2
jne 0x1000997b
shr eax, 8
cmp al, 2
jne 0x1000997b
mov byte [esi], 1
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
push str.Invalid_WinSock_version
lea ecx, [esp + 8]
call fcn.100097fb
push 0x1005e2e8
lea eax, [esp + 8]
jmp 0x100099b8
push str.WSAStartup_failed
call fcn.1000991e
push eax
push ecx
lea ecx, [esp + 0x10]
call fcn.100021c6
push 0x1005e294
lea eax, [esp + 8]
push eax
call fcn.1001c622
int3

Function at 0x10009a4d
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push esi
mov esi, ecx
mov cl, byte [ebp + 8]
push 6
push 1
call fcn.100099d1
push eax
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x10009ac8
lea ecx, [esp + 8]
mov dword [esp + 8], 1
push ecx
push 0x8004667e
push eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x10009abf
mov ecx, esi
call fcn.10009e01
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push str.Failed_to_get_socket_flags
mov ecx, eax
call fcn.1000991e
push eax
push ecx
lea ecx, [esp + 0x18]
call fcn.100021c6
push 0x1005e294
lea eax, [esp + 0x10]
jmp 0x10009aed
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
call sub.WS2_32.dll_WSAGetLastError
push str.Failed_to_create_socket
mov ecx, eax
call fcn.1000991e
push eax
push ecx
lea ecx, [esp + 0x18]
call fcn.100021c6
push 0x1005e294
lea eax, [esp + 0x10]
push eax
call fcn.1001c622
int3