joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10007010
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x37c]
mov dword [esi + 0x374], 1
test ecx, ecx
je 0x1000702c
call fcn.1000bfd0
mov eax, dword [esi + 0x378]
cmp eax, 0xffffffff
je 0x1000706d
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10007056
mov eax, dword [esi + 0x378]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 0x378]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x378], 0xffffffff
mov eax, 1
pop esi
ret

Function at 0x100075c0
Capabilities:
Create thread

Disassembly:
mov edx, dword [esp + 4]
lea eax, [ecx + 0x384]
mov dword [ecx + 0x390], ecx
lea ecx, [esp + 4]
push ecx
push 0
push eax
push 0x10007510
push 0
push 0
mov dword [eax], edx
mov dword [esp + 0x1c], 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
cmp eax, 0xffffffff
je 0x10007600
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
ret 4

Function at 0x10007610
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x128
push ebx
push ebp
push esi
xor ebp, ebp
push edi
push ebp
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [esp + 0x10]
push eax
push esi
mov dword [esp + 0x18], 0x128
call sub.KERNEL32.dll_Process32First
mov edi, dword [esp + 0x13c]
mov ebx, dword [sym.imp.MSVCRT.dll__mbsicmp]
lea ecx, [esp + 0x34]
push edi
push ecx
call ebx
add esp, 8
test eax, eax
je 0x10007673
lea edx, [esp + 0x10]
push edx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x10007677
lea eax, [esp + 0x34]
push edi
push eax
call ebx
add esp, 8
test eax, eax
jne 0x10007655
mov ebp, dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x128
ret 4

Function at 0x10007780
Capabilities:
Set registry value

Disassembly:
mov edx, dword [ecx + 4]
test edx, edx
jne 0x1000778c
xor eax, eax
ret 8
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push esi
push 1
push eax
mov eax, dword [esp + 0x1c]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
ret 8

Function at 0x10007810
Capabilities:
Delete registry value

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
push ecx
push edx
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
neg eax
sbb eax, eax
inc eax
ret 0xc
Function at 0x10008680
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
sub esp, 0x1c
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x40]
test eax, eax
je 0x100087a7
call fcn.10008570
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 0x44], eax
je 0x100087a7
push 0
mov word [esp + 0x18], 2
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x40]
mov cx, word [eax + 0x50]
push ecx
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [esi + 0x44]
push 1
push 0x1001e4a8
push 4
push 0xffff
push edx
mov word [esp + 0x2a], ax
call dword [sym.imp.WS2_32.dll_setsockopt]
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0xffffffff
jne 0x10008725
mov dword [esp + 8], 0x1001e380
mov dword [esp + 0xc], 0xbc
mov dword [esp + 0x10], 0x100
call edi
push eax
lea eax, [esp + 0xc]
push str.CSocketManObverse::CreateListenSocket_Setsockopt_Failed._nErr___d
push eax
call fcn.10006230
add esp, 0xc
mov edx, dword [esi + 0x44]
lea ecx, [esp + 0x14]
push 0x10
push ecx
push edx
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x10008762
mov dword [esp + 8], 0x1001e380
mov dword [esp + 0xc], 0xc1
mov dword [esp + 0x10], 0x100
call edi
push eax
lea eax, [esp + 0xc]
push str.CSocketManObverse::CreateListenSocket_bind_Failed._nErr___d
push eax
jmp 0x10008798
mov ecx, dword [esi + 0x44]
push 0x24
push ecx
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
jne 0x100087af
mov dword [esp + 8], 0x1001e380
mov dword [esp + 0xc], 0xc8
mov dword [esp + 0x10], 0x100
call edi
push eax
lea edx, [esp + 0xc]
push str.CSocketManObverse::CreateListenSocket_listen_Failed._nErr___d
push edx
call fcn.10006230
add esp, 0xc
mov ecx, esi
call fcn.10008570
pop edi
xor eax, eax
pop esi
add esp, 0x1c
ret
pop edi
mov eax, 1
pop esi
add esp, 0x1c
ret

Function at 0x100087c0
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.10008800
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
push 0
push esi
push 0x10008840
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
xor ecx, ecx
cmp eax, 0xffffffff
mov dword [esi + 0x50], eax
setne cl
mov eax, ecx
pop esi
pop ecx
ret

Function at 0x10008800
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x50]
cmp eax, 0xffffffff
je 0x10008838
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10008827
mov eax, dword [esi + 0x50]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 0x50]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x50], 0xffffffff
pop esi
ret

Function at 0x10008910
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.10008950
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
push 0
push esi
push 0x10008990
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
xor ecx, ecx
cmp eax, 0xffffffff
mov dword [esi + 0x4c], eax
setne cl
mov eax, ecx
pop esi
pop ecx
ret
Function at 0x10008950
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x10008988
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10008977
mov eax, dword [esi + 0x4c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 0x4c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x4c], 0xffffffff
pop esi
ret

Function at 0x100089b0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10016440
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
mov ebx, ecx
push esi
push edi
mov eax, dword [ebx + 0x48]
mov dword [ebp - 0x10], esp
cmp eax, 0xffffffff
je 0x10008a87
mov eax, dword [ebp + 8]
xor esi, esi
cmp eax, esi
je 0x10008a87
mov edi, dword [ebp + 0xc]
cmp edi, esi
jle 0x10008a87
push 1
push 0xa
mov dword [ebp + 0xc], esi
mov dword [ebp - 4], esi
call fcn.10008b00
test eax, eax
jle 0x10008a87
cmp esi, edi
jge 0x10008a72
mov ecx, dword [ebp + 8]
mov eax, edi
sub eax, esi
push 0
push eax
mov eax, dword [ebx + 0x48]
lea edx, [esi + ecx]
push edx
push eax
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x10008a3f
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
add esi, eax
jmp 0x10008a0a
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x10008aa0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ecx
mov eax, dword [ecx + 0x48]
push ebx
push ebp
push esi
cmp eax, 0xffffffff
push edi
mov dword [esp + 0x10], ecx
je 0x10008af4
mov ebp, dword [esp + 0x18]
test ebp, ebp
je 0x10008af4
mov edi, dword [esp + 0x1c]
xor esi, esi
test edi, edi
jle 0x10008aea
mov ebx, dword [sym.imp.WS2_32.dll_recv]
jmp 0x10008acf
mov ecx, dword [esp + 0x10]
mov eax, edi
push 0
sub eax, esi
lea edx, [esi + ebp]
push eax
mov eax, dword [ecx + 0x48]
push edx
push eax
call ebx
test eax, eax
jle 0x10008af4
add esi, eax
cmp esi, edi
jl 0x10008acb
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 8
Function at 0x10008b00
Capabilities:
Get socket status

Disassembly:
sub esp, 0x118
push esi
push edi
mov edi, ecx
lea edx, [esp + 0x14]
mov ecx, dword [esp + 0x124]
push edx
mov eax, dword [edi + 0x48]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x12c]
mov dword [esp + 0x24], eax
test ecx, ecx
mov dword [esp + 0x20], 1
mov dword [esp + 0x1c], 0
push 0
je 0x10008b47
lea ecx, [esp + 0x24]
push ecx
push 0
jmp 0x10008b4e
lea ecx, [esp + 0x24]
push 0
push ecx
inc eax
push eax
call dword [sym.imp.WS2_32.dll_select]
mov esi, eax
test esi, esi
jne 0x10008b93
lea edx, [esp + 8]
push str.Select_Time_Out
push edx
mov dword [esp + 0x10], 0x1001e380
mov dword [esp + 0x14], 0x18b
mov dword [esp + 0x18], 0x100
call fcn.10006230
add esp, 8
xor eax, eax
pop edi
pop esi
add esp, 0x118
ret 8
jge 0x10008bd3
mov dword [esp + 8], 0x1001e380
mov dword [esp + 0xc], 0x191
mov dword [esp + 0x10], 0x100
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
lea eax, [esp + 0xc]
push str.Select_Select_Error___d
push eax
call fcn.10006230
add esp, 0xc
mov eax, esi
pop edi
pop esi
add esp, 0x118
ret 8
mov edx, dword [edi + 0x48]
lea ecx, [esp + 0x1c]
push ecx
push edx
call sub.WS2_32.dll___WSAFDIsSet
neg eax
sbb eax, eax
pop edi
and eax, esi
pop esi
add esp, 0x118
ret 8
Function at 0x1000bbc0
Capabilities:
Create thread

Disassembly:
mov edx, dword [esp + 4]
lea eax, [ecx + 0x70]
mov dword [ecx + 0x7c], ecx
mov dword [esp + 4], 0
mov dword [eax], edx
mov edx, dword [esp + 8]
mov dword [ecx + 0x74], edx
mov edx, dword [esp + 0xc]
mov dword [ecx + 0x78], edx
lea ecx, [esp + 4]
push ecx
push 0
push eax
push 0x1000bad0
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
cmp eax, 0xffffffff
je 0x1000bc08
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
ret 0xc

Function at 0x1000c150
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.1000c1a0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0x48], eax
lea eax, [esp + 4]
push eax
push 0
push esi
push 0x1000c200
push 0
push 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
xor ecx, ecx
cmp eax, 0xffffffff
mov dword [esi + 0x4c], eax
setne cl
mov eax, ecx
pop esi
pop ecx
ret

Function at 0x1000c1a0
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x48]
test eax, eax
je 0x1000c1c5
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi + 0x48]
push eax
call edi
mov dword [esi + 0x48], 0
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x1000c1f6
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1000c1e9
mov ecx, dword [esi + 0x4c]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [esi + 0x4c]
push edx
call edi
mov dword [esi + 0x4c], 0xffffffff
pop edi
pop esi
ret
Function at 0x1000c220
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10016760
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x103c
call fcn.10015a10
push ebx
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], ebx
mov dword [esi + 0x54], ebx
cmp dword [esi + 0x44], 0xffffffff
je 0x1000c364
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 0x54]
cmp eax, 0xea60
jbe 0x1000c256
mov ecx, 0x405
xor eax, eax
lea edi, [ebp - 0x104c]
push 0x1014
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x104c]
mov ecx, esi
push eax
mov dword [esi + 0x50], ebx
mov dword [ebp - 0x104c], 0x1e3992
mov dword [ebp - 0x1048], 5
call fcn.1000e280
cmp eax, 0x1014
je 0x1000c2ec
mov dword [ebp - 0x38], 0x1001e950
mov dword [ebp - 0x34], 0xf4
mov dword [ebp - 0x30], 0x100
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
lea ecx, [ebp - 0x38]
push str.Send_Heart_Protocol_Failed._Socket_Err___d
push ecx
call fcn.10006230
mov eax, dword [esi + 0x58]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add esp, 0xc
inc eax
mov dword [esi + 0x58], eax
jmp 0x1000c354
mov edx, dword [esi + 0x48]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x7530
push edx
call edi
test eax, eax
je 0x1000c364
cmp dword [esi + 0x50], ebx
jne 0x1000c33c
mov dword [ebp - 0x20], 0x1001e950
mov dword [ebp - 0x1c], 0x102
mov dword [ebp - 0x18], 0x100
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
lea eax, [ebp - 0x20]
push str.Receive_Heart_Protocol_Failed._Socket_Err___d
push eax
call fcn.10006230
mov eax, dword [esi + 0x58]
add esp, 0xc
inc eax
mov dword [esi + 0x58], eax
jmp 0x1000c354
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x48]
push 0x2bf20
push ecx
mov dword [esi + 0x54], eax
call edi
test eax, eax
je 0x1000c364
cmp dword [esi + 0x58], 1
jbe 0x1000c375
mov ecx, esi
mov dword [esi + 0x58], ebx
call fcn.10008570
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [esi + 0x48]
push 0x7530
push edx
call edi
test eax, eax
jne 0x1000c256
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000c750
Capabilities:
Get common file path

Disassembly:
sub esp, 0x22c
mov eax, dword [0x1001fd54]
mov dword [esp], str.getaddrinfo
test eax, eax
mov dword [esp + 4], 0x1000c970
mov dword [esp + 8], str.getnameinfo
mov dword [esp + 0xc], 0x1000d090
mov dword [esp + 0x10], str.freeaddrinfo
mov dword [esp + 0x14], 0x1000c920
je 0x1000c7ab
mov eax, dword [esp + 0x230]
and eax, 0xffff
mov eax, dword [eax*8 + 0x1001eb54]
add esp, 0x22c
ret 4
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x134]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1000c8f4
lea edi, [esp + 0x134]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x28]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x28]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.ws2_32
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
and ecx, 3
lea eax, [esp + 0x28]
rep movsb byte es:[edi], byte [esi]
push eax
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x1000c84c
push str.getaddrinfo
push esi
call ebp
test eax, eax
jne 0x1000c8c4
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea edi, [esp + 0x134]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x28]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x28]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.wship6
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x28]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call ebx
mov esi, eax
test esi, esi
je 0x1000c8f4
push str.getaddrinfo
push esi
call ebp
test eax, eax
jne 0x1000c8c4
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1000c8f4
xor ebx, ebx
lea edi, [esp + 0x14]
mov ecx, dword [edi - 4]
push ecx
push esi
call ebp
test eax, eax
mov dword [edi], eax
je 0x1000c8bb
inc ebx
add edi, 8
cmp ebx, 3
jl 0x1000c8ca
xor eax, eax
mov edx, dword [esp + eax + 0x14]
mov dword [eax + 0x1001eb54], edx
add eax, 8
cmp eax, 0x18
jl 0x1000c8e2
mov eax, dword [esp + 0x240]
pop edi
and eax, 0xffff
pop esi
pop ebp
mov dword [0x1001fd54], 1
mov eax, dword [eax*8 + 0x1001eb54]
pop ebx
add esp, 0x22c
ret 4
Function at 0x1000e280
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100168b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
mov dword [ebp - 0x10], esp
mov eax, dword [edi + 0x5c]
mov dword [ebp - 0x14], edi
cmp eax, esi
je 0x1000e2da
lea eax, [ebp - 0x24]
push str.CSocketManReverse::SendToClient_Sending_data_wait...
push eax
mov dword [ebp - 0x24], 0x1001e950
mov dword [ebp - 0x20], 0x355
mov dword [ebp - 0x1c], 0x10
call fcn.10006230
add esp, 8
jmp 0x1000e3df
mov eax, dword [edi + 0x44]
mov dword [ebp - 0x18], esi
cmp eax, 0xffffffff
mov dword [ebp - 4], esi
mov dword [edi + 0x5c], 1
je 0x1000e3dc
cmp dword [ebp + 8], esi
je 0x1000e3dc
mov ebx, dword [ebp + 0xc]
cmp ebx, esi
jle 0x1000e3dc
push 1
push 0xa
mov ecx, edi
call fcn.1000e470
test eax, eax
jg 0x1000e322
mov dword [edi + 0x5c], 0
jmp 0x1000e3df
cmp esi, ebx
jge 0x1000e362
mov edx, dword [ebp + 8]
mov ecx, ebx
sub ecx, esi
push 0
push ecx
mov ecx, dword [edi + 0x44]
lea eax, [esi + edx]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x1000e35e
mov dword [edi + 0x5c], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
add esi, eax
jmp 0x1000e322
mov dword [edi + 0x58], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [edi + 0x54], eax
mov dword [edi + 0x5c], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [edi + 0x5c], esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x1000e400
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
mov ebx, ecx
push ebp
push esi
mov eax, dword [ebx + 0x44]
push edi
cmp eax, 0xffffffff
je 0x1000e45e
mov eax, dword [esp + 0x14]
test eax, eax
je 0x1000e45e
mov edi, dword [esp + 0x18]
xor esi, esi
test edi, edi
jle 0x1000e445
mov ebp, dword [sym.imp.WS2_32.dll_recv]
mov ecx, dword [esp + 0x14]
mov eax, edi
sub eax, esi
push 0
push eax
mov eax, dword [ebx + 0x44]
lea edx, [esi + ecx]
push edx
push eax
call ebp
test eax, eax
jle 0x1000e45e
add esi, eax
cmp esi, edi
jl 0x1000e426
mov dword [ebx + 0x58], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebx + 0x54], eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8
Function at 0x1000e470
Capabilities:
Get socket status

Disassembly:
sub esp, 0x118
push esi
push edi
mov edi, ecx
lea edx, [esp + 0x14]
mov ecx, dword [esp + 0x124]
push edx
mov eax, dword [edi + 0x44]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x12c]
mov dword [esp + 0x24], eax
test ecx, ecx
mov dword [esp + 0x20], 1
mov dword [esp + 0x1c], 0
push 0
je 0x1000e4b7
lea ecx, [esp + 0x24]
push ecx
push 0
jmp 0x1000e4be
lea ecx, [esp + 0x24]
push 0
push ecx
inc eax
push eax
call dword [sym.imp.WS2_32.dll_select]
mov esi, eax
test esi, esi
jne 0x1000e503
lea edx, [esp + 8]
push str.Select_Time_Out
push edx
mov dword [esp + 0x10], 0x1001e950
mov dword [esp + 0x14], 0x3b7
mov dword [esp + 0x18], 0x100
call fcn.10006230
add esp, 8
xor eax, eax
pop edi
pop esi
add esp, 0x118
ret 8
jge 0x1000e543
mov dword [esp + 8], 0x1001e950
mov dword [esp + 0xc], 0x3bd
mov dword [esp + 0x10], 0x100
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
lea eax, [esp + 0xc]
push str.Select_Select_Error___d
push eax
call fcn.10006230
add esp, 0xc
mov eax, esi
pop edi
pop esi
add esp, 0x118
ret 8
mov edx, dword [edi + 0x44]
lea ecx, [esp + 0x1c]
push ecx
push edx
call sub.WS2_32.dll___WSAFDIsSet
neg eax
sbb eax, eax
pop edi
and eax, esi
pop esi
add esp, 0x118
ret 8
Function at 0x100105b0
Capabilities:
Create thread

Disassembly:
mov edx, dword [esp + 4]
lea eax, [ecx + 0x80]
mov dword [ecx + 0x8c], ecx
mov dword [esp + 4], 0
mov dword [eax], edx
mov edx, dword [esp + 8]
mov dword [ecx + 0x84], edx
mov edx, dword [esp + 0xc]
mov dword [ecx + 0x88], edx
lea ecx, [esp + 4]
push ecx
push 0
push eax
push 0x100104c0
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
cmp eax, 0xffffffff
je 0x10010604
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
ret 0xc

Function at 0x10010770
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x1c
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1001078f
add esp, 0x1c
ret
lea ecx, [esp + 4]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x100107b6
mov edx, dword [esp]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add esp, 0x1c
ret
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
push 0
push 0
lea edx, [esp + 0x14]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 8]
push 0x10
push edx
push 0
push eax
mov dword [esp + 0x24], 1
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x10010803
mov ecx, dword [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add esp, 0x1c
ret
mov eax, 1
add esp, 0x1c
ret

Function at 0x10010810
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x14
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x10010831
add esp, 0x14
ret 4
lea ecx, [esp + 8]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x1001084d
add esp, 0x14
ret 4
mov eax, dword [esp]
push 0
push 0
lea edx, [esp + 0xc]
push 0
push edx
push 0
push eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x1001087f
add esp, 0x14
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x10010891
xor eax, eax
add esp, 0x14
ret 4
mov ecx, dword [esp + 0x18]
push 0
or ecx, 4
push ecx
call dword [sym.imp.USER32.dll_ExitWindowsEx]
neg eax
sbb eax, eax
neg eax
add esp, 0x14
ret 4