joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002e140
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x10c
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x120]
mov dword [esp + 0x14], ebx
mov ebp, 0x28
mov dword [esp + 0x10], 5
mov dword [esp + 0x14], ebx
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push 0
push 0
push ecx
push 0
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], 1
call dword [sym.imp.WS2_32.dll_select]
mov esi, eax
cmp esi, 0xffffffff
je 0x1002e1fa
test esi, esi
je 0x1002e236
jle 0x1002e1e3
lea edx, [esp + 0x18]
push edx
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x1002e1e1
mov eax, dword [esp + 0x124]
push 0
push ebp
lea ecx, [ebx + eax]
push ecx
push edi
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
cmp esi, 0xffffffff
je 0x1002e267
test esi, esi
je 0x1002e29f
add ebx, esi
sub ebp, esi
cmp ebx, 0x28
jl 0x1002e175
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x10c
ret 8
mov eax, dword [0x1030ceb0]
test eax, eax
je 0x1002e2c2
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.CTaskDispatch::RecvHookInfo:_Recv_HookInfo_failed._select___called_failed__errno:__d__r_n
push str.CTaskDispatch
push 4
push 0x1030c61c
call fcn.100a65e0
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 8
mov eax, dword [0x1030ceb0]
test eax, eax
je 0x1002e258
push str.CTaskDispatch::RecvHookInfo:_TMGateway:_Recv_HookInfo_timeout.
push str.CTaskDispatch
push 4
push 0x1030c61c
call fcn.100a65e0
add esp, 0x10
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10c
ret 8
mov eax, dword [0x1030ceb0]
test eax, eax
je 0x1002e2c2
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.CTaskDispatch::RecvHookInfo:_Recv_HookInfo_failed__errno:__d__r_n
push str.CTaskDispatch
push 4
push 0x1030c61c
call fcn.100a65e0
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 8
mov eax, dword [0x1030ceb0]
test eax, eax
je 0x1002e2c2
push edi
push str.CTaskDispatch::RecvHookInfo:_The_connection_SOCKET:_d__has_been_closed__r_n
push str.CTaskDispatch
push 4
push 0x1030c61c
call fcn.100a65e0
add esp, 0x14
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10c
ret 8
Function at 0x10033020
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1025d1a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.100a21c0
xor edi, edi
lea ecx, [esi + 0x4c]
mov dword [esp + 0x14], edi
call fcn.1009e960
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov dx, word [esp + 0x24]
mov dword [esi + 0x6c], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x74], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x30], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esi + 0x28], eax
mov eax, dword [esp + 0x28]
mov word [esi + 0x34], dx
mov edx, dword [esp + 0x30]
mov dword [esi + 0x38], ecx
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x3c], eax
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x7c], edi
mov dword [esi], 0x1026be48
mov dword [esi + 0x2c], 0xffffffff
mov dword [esi + 0x40], edx
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x18

Function at 0x100330c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1025d1c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.100a21c0
xor edi, edi
lea ecx, [esi + 0x4c]
mov dword [esp + 0x14], edi
call fcn.1009e960
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
push edi
push edi
push edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x74], edi
mov dword [esi + 0x70], edi
push edi
mov dword [esi], 0x1026be48
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x30], edi
mov word [esi + 0x34], di
mov dword [esi + 0x3c], edi
mov dword [esi + 0x38], edx
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], 1
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x48], eax
mov dword [esi + 0x7c], edi
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
Function at 0x10033240
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1025d218
push eax
mov dword fs:[0], esp
mov ecx, dword [ecx + 0x28]
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x18]
mov eax, dword [esi]
push 0
push eax
push edi
push ecx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
mov dword [esi], eax
jne 0x100332ac
mov eax, dword [0x1030ceb0]
test eax, eax
je 0x10033297
push str.CTransfer::RecvFromClient:_The_connection_has_been_closed_by_the_client__r_n
push str.CTransfer
push 4
push 0x1030c61c
call fcn.100a65e0
add esp, 0x10
xor eax, eax
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0xc
ret 8
jge 0x100332ec
mov eax, dword [0x1030ceb0]
test eax, eax
je 0x100332d7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.CTransfer::RecvFromClient:_Receive_data_from_client_failed__errno:__d__r_n
push str.CTransfer
push 4
push 0x1030c61c
call fcn.100a65e0
add esp, 0x14
xor eax, eax
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0xc
ret 8
mov ecx, dword [0x1030ceb0]
cmp eax, 0x64
jge 0x1003333d
test ecx, ecx
je 0x1003335b
push eax
push edi
lea ecx, [esp + 0x24]
call fcn.100906a0
mov edx, dword [eax]
mov dword [esp + 0x10], 0
push edx
push str.CTransfer::RecvFromClient:_C__T:__s__r_n
push str.CTransfer
push 4
push 0x1030c61c
call fcn.100a65e0
add esp, 0x14
lea ecx, [esp + 0x1c]
mov dword [esp + 0x10], 0xffffffff
call fcn.10090bf0
jmp 0x1003335b
test ecx, ecx
je 0x1003335b
push eax
push str.CTransfer::RecvFromClient:_C__T:_Len:_d__r_n
push str.CTransfer
push 4
push 0x1030c61c
call fcn.100a65e0
add esp, 0x14
mov ecx, dword [esp + 8]
pop edi
mov eax, 1
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 8
Function at 0x10033380
Capabilities:
Receive data
Receive data on socket

Disassembly:
push 0xffffffffffffffff
push 0x1025d238
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
push edi
mov edi, dword [esp + 0x24]
mov esi, ecx
mov ecx, dword [esp + 0x20]
push 0
mov eax, dword [edi]
mov edx, dword [esi + 0x2c]
push eax
push ecx
push edx
mov dword [esp + 0x18], 0
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
mov dword [esp + 8], eax
jne 0x100333fb
mov eax, dword [0x1030ceb0]
test eax, eax
je 0x100333e6
push str.CTransfer::RecvFromServer:_The_connection_has_been_closed_by_the_server__r_n
push str.CTransfer
push 4
push 0x1030c61c
call fcn.100a65e0
add esp, 0x10
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret 8
cmp eax, 0xffffffff
jne 0x1003343e
mov eax, dword [0x1030ceb0]
test eax, eax
je 0x10033429
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.CTransfer::RecvFromServer:_Receive_data_from_server_failed__errno:__d__r_n
push str.CTransfer
push 4
push 0x1030c61c
call fcn.100a65e0
add esp, 0x14
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret 8
lea eax, [esp + 0x24]
push 0
lea ecx, [esp + 0xc]
push eax
mov eax, dword [esi + 0x2c]
lea edx, [esp + 0x28]
push ecx
push edx
push eax
mov dword [esp + 0x38], 0
call fcn.10004cb0
add esp, 0x14
test eax, eax
jne 0x1003347a
pop edi
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret 8
mov ecx, dword [edi]
mov edx, dword [esp + 0x20]
mov byte [ecx + edx], 0
mov eax, dword [esp + 8]
mov ecx, dword [0x1030ceb0]
cmp eax, 0x64
jge 0x100334dd
test ecx, ecx
je 0x100334ff
push eax
mov eax, dword [esp + 0x24]
push eax
lea ecx, [esp + 0x14]
call fcn.100906a0
mov ecx, dword [eax]
mov dword [esp + 0x18], 0
push ecx
push str.CTransfer::RecvFromServer:_S__T:__s__r_n
push str.CTransfer
push 4
push 0x1030c61c
call fcn.100a65e0
add esp, 0x14
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], 0xffffffff
call fcn.10090bf0
jmp 0x100334fb
test ecx, ecx
je 0x100334ff
push eax
push str.CTransfer::RecvFromServer:_C__T:_Len:_d__r_n
push str.CTransfer
push 4
push 0x1030c61c
call fcn.100a65e0
add esp, 0x14
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x10]
mov dword [edi], eax
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 8

Function at 0x10033520
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [ecx + 0x44]
push esi
or esi, 0xffffffff
push edi
test eax, eax
jne 0x10033548
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_send]
pop edi
pop esi
ret 0xc
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push edi
push eax
push ecx
mov ecx, 0x10309cf0
call fcn.100646d0
test eax, eax
mov eax, edi
jne 0x10033569
mov eax, esi
pop edi
pop esi
ret 0xc
Function at 0x10033aa0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
mov eax, dword [0x1030ceb0]
sub esp, 0x10
test eax, eax
push esi
mov esi, ecx
je 0x10033ac8
push str.CTransfer::ConnectServer
push str.CTransfer
push 4
push 0x1030c61c
call fcn.100a65e0
add esp, 0x10
mov eax, dword [esi + 0x30]
mov word [esp + 4], 2
push eax
call dword [sym.imp.WS2_32.dll_htonl]
mov cx, word [esi + 0x34]
mov dword [esp + 8], eax
push ecx
call dword [sym.imp.WS2_32.dll_htons]
xor edx, edx
push 6
mov dword [esp + 0x10], edx
push 1
push 2
mov word [esp + 0x12], ax
mov dword [esp + 0x1c], edx
call dword [sym.imp.WS2_32.dll_socket]
lea ecx, [esp + 4]
push 0x10
push ecx
push eax
mov dword [esi + 0x2c], eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x10033b5e
mov eax, dword [0x1030ceb0]
test eax, eax
je 0x10033b57
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, dword [esp + 6]
push eax
push edx
call dword [sym.imp.WS2_32.dll_ntohs]
and eax, 0xffff
push eax
mov eax, dword [esi + 0x30]
push eax
push str.CTransfer::ConnectServer:_Connect_to_server__d___d__failed__errno__d__r_n
push str.CTransfer
push 4
push 0x1030c61c
call fcn.100a65e0
add esp, 0x1c
xor eax, eax
pop esi
add esp, 0x10
ret
mov ecx, dword [esi + 0x2c]
mov edx, dword [esi + 0x28]
push ecx
push edx
mov ecx, 0x102f5d78
call fcn.10001d90
mov eax, dword [0x1030ceb0]
test eax, eax
je 0x10033b92
push str.CTransfer::ConnectServer:_Connect_to_the__server_successfully__r_n
push str.CTransfer
push 4
push 0x1030c61c
call fcn.100a65e0
add esp, 0x10
mov eax, 1
pop esi
add esp, 0x10
ret
Function at 0x100348c0
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [esp + 0x110]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
jne 0x1003490f
xor eax, eax
add esp, 0x10c
ret 8
mov edx, dword [esp + 0x114]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 8
Function at 0x10036af0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x1025d500
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
push edi
push 1
push 0x102fb400
lea ecx, [esp + 0x24]
call fcn.1009ee90
mov edx, dword [0x102fb3f4]
mov ebx, dword [esp + 0x38]
xor eax, eax
cmp edx, eax
mov dword [esp + 0x30], eax
jle 0x10036b79
mov edi, dword [0x102fb3f0]
lea ecx, [edi + 4]
cmp dword [ecx], ebx
je 0x10036b47
inc eax
add ecx, 0xc
cmp eax, edx
jge 0x10036b79
jmp 0x10036b39
mov ecx, edx
lea esi, [eax + eax*2]
sub ecx, eax
dec ecx
lea esi, [edi + esi*4]
je 0x10036b72
lea ecx, [ecx + ecx*2]
lea edx, [eax + eax*2 + 3]
shl ecx, 2
lea eax, [edi + edx*4]
push ecx
push eax
push esi
call fcn.100797d0
mov edx, dword [0x102fb3f4]
add esp, 0xc
dec edx
mov dword [0x102fb3f4], edx
xor ecx, ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [0x102fb3f4]
mov ebp, dword [esp + 0x3c]
cmp esi, esi
mov edi, eax
jl 0x10036ba9
lea edx, [esi + 1]
push 0xffffffffffffffff
push edx
mov ecx, 0x102fb3f0
call fcn.10036de0
mov ecx, dword [0x102fb3f0]
lea eax, [esi + esi*2]
lea edx, [ecx + eax*4]
mov dword [ecx + eax*4], edi
mov dword [edx + 4], ebx
mov dword [edx + 8], ebp
mov eax, dword [0x102fb3f4]
cmp eax, 0x32
jle 0x10036bef
add eax, 0xfffffff6
test eax, eax
je 0x10036be8
lea eax, [eax + eax*2]
shl eax, 2
push eax
mov eax, dword [0x102fb3f0]
lea ecx, [eax + 0x78]
push ecx
push eax
call fcn.100797d0
add esp, 0xc
sub dword [0x102fb3f4], 0xa
mov eax, dword [0x1030ceb0]
test eax, eax
je 0x10036c39
lea edx, [esp + 0x38]
push ebx
push edx
call fcn.101a2ce0
add esp, 8
mov eax, dword [eax]
push ebp
push ebx
push eax
push 1
push str.CTSCDTVPNGatewayMgr::AddConnectFail__Add:_d___s__08x_:_d_
push str.SCDTVpnGW
push 0xffffffffffffffff
push 0x1030c61c
mov byte [esp + 0x50], 1
call fcn.100a65e0
add esp, 0x20
lea ecx, [esp + 0x38]
mov byte [esp + 0x30], 0
call fcn.10090bf0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 0xffffffff
call fcn.1009eef0
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret

Function at 0x10036f90
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, 0x102fb490
jmp 0x10036fc0

Function at 0x10037050
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1025d583
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov edi, ecx
mov dword [esp + 8], edi
mov dword [edi], 0x1026bebc
mov esi, dword [edi + 0x50]
mov dword [esp + 0x14], 1
test esi, esi
je 0x100370ab
mov eax, dword [edi + 0x54]
mov ecx, eax
dec eax
test ecx, ecx
je 0x1003709f
push ebx
lea ebx, [eax + 1]
mov ecx, esi
call fcn.1000fe30
add esi, 0x68
dec ebx
jne 0x10037091
pop ebx
mov eax, dword [edi + 0x50]
push eax
call fcn.1024cbfa
add esp, 4
lea ecx, [edi + 0x30]
mov byte [esp + 0x14], 0
call fcn.1009e9b0
mov ecx, edi
mov dword [esp + 0x14], 0xffffffff
call fcn.100a22e0
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x10039240
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1025d868
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push esi
mov esi, ecx
push 0xffffffffffffffff
push 0x1388
lea eax, [esi + 0x10]
lea ecx, [esi + 4]
push 0
push eax
mov dword [eax], ecx
push 0
push 2
lea ecx, [esp + 0x1c]
mov dword [esi + 8], esi
mov dword [esi + 0x14], 0x1000a740
call fcn.10041280
lea edx, [esp + 4]
mov ecx, 0x102fb6b8
push edx
mov dword [esp + 0x4c], 0
call fcn.10042440
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
mov dword [esi + 0x2c], eax
mov eax, dword [esp + 0x18]
mov dword [esi + 0x30], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0x38], edx
mov edx, dword [esp + 0x20]
mov dword [esi + 0x3c], eax
mov eax, dword [esp + 0x24]
mov dword [esi + 0x40], ecx
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x44], edx
mov edx, dword [esp + 0x2c]
mov dword [esi + 0x48], eax
mov eax, dword [esp + 0x30]
mov dword [esi + 0x4c], ecx
mov ecx, dword [esp + 0x34]
mov dword [esi + 0x50], edx
mov edx, dword [esp + 0x38]
mov dword [esi + 0x54], eax
mov eax, dword [esp + 0x3c]
mov dword [esi + 0x58], ecx
lea ecx, [esp + 4]
mov dword [esi + 0x5c], edx
mov dword [esi + 0x60], eax
mov dword [esp + 0x48], 0xffffffff
call fcn.10041300
mov ecx, dword [esp + 0x40]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x48
ret
Function at 0x10039d70
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x1025d913
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [0x1026e87c]
push esi
mov esi, ecx
push edi
mov dword [esp + 0x18], esi
lea edi, [esi + 4]
mov dword [edi], eax
mov dword [esi], 0x1026bee0
mov eax, dword [0x1026e87c]
mov dword [esp + 0x24], 0
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov byte [esp + 0x24], 4
test eax, eax
je 0x10039de2
call fcn.101a8cd0
push eax
lea ecx, [esp + 0x18]
push str.__lu
push ecx
call fcn.10093b70
add esp, 0xc
mov eax, dword [esp + 0x34]
test eax, eax
je 0x10039e03
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea edx, [esp + 0x14]
push str.__lu
push edx
call fcn.10093b70
add esp, 0xc
mov eax, dword [esp + 0x38]
test eax, eax
je 0x10039e24
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
lea eax, [esp + 0x10]
push str.__lu
push eax
call fcn.10093b70
add esp, 0xc
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x10039e45
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea ecx, [esp + 0xc]
push 0x102c78ac
push ecx
call fcn.10093b70
add esp, 0xc
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 0x30]
push edx
call fcn.10090450
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x38]
push edx
push eax
push ecx
push str._s_s_s_s_s
push edi
mov byte [esp + 0x40], 5
call fcn.10093b70
add esp, 0x1c
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], 4
call fcn.10090bf0
lea ecx, [esp + 8]
mov byte [esp + 0x24], 3
call fcn.10090bf0
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 2
call fcn.10090bf0
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 1
call fcn.10090bf0
lea ecx, [esp + 0x14]
mov byte [esp + 0x24], 0
call fcn.10090bf0
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 0x14
Function at 0x10039f10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1025d948
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [0x1026e87c]
push esi
mov esi, ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp + 4], eax
mov eax, dword [esp + 0x28]
mov byte [esp + 0x1c], 3
cmp eax, 0xffffffff
je 0x10039f69
push eax
lea eax, [esp + 0x14]
push str.__lu
push eax
call fcn.10093b70
add esp, 0xc
mov eax, dword [esp + 0x2c]
cmp eax, 0xffffffff
je 0x10039f85
push eax
lea ecx, [esp + 0x10]
push str.__lu
push ecx
call fcn.10093b70
add esp, 0xc
mov eax, dword [esp + 0x30]
cmp eax, 0xffffffff
je 0x10039fa1
push eax
lea edx, [esp + 0xc]
push str.__lu
push edx
call fcn.10093b70
add esp, 0xc
mov eax, dword [esp + 0x34]
cmp eax, 0xffffffff
je 0x10039fbd
push eax
lea eax, [esp + 8]
push 0x102c78ac
push eax
call fcn.10093b70
add esp, 0xc
mov ecx, dword [esp + 0x24]
push ecx
lea ecx, [esp + 0x2c]
call fcn.10090450
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push edx
mov edx, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x30]
push ecx
push edx
push eax
add esi, 4
push str._s_s_s_s_s
push esi
mov byte [esp + 0x38], 4
call fcn.10093b70
add esp, 0x1c
lea ecx, [esp + 0x28]
mov byte [esp + 0x1c], 3
call fcn.10090bf0
lea ecx, [esp + 4]
mov byte [esp + 0x1c], 2
call fcn.10090bf0
lea ecx, [esp + 8]
mov byte [esp + 0x1c], 1
call fcn.10090bf0
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 0
call fcn.10090bf0
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0xffffffff
call fcn.10090bf0
mov ecx, dword [esp + 0x14]
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x14

Function at 0x1003a0f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1025d9a7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov eax, dword [0x1026e87c]
push esi
mov esi, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 0x18], 1
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov byte [esp + 0x18], 2
test eax, eax
je 0x1003a13c
push 0x102c78e4
jmp 0x1003a141
push 0x102c78d4
lea ecx, [esp + 8]
call fcn.10090e70
mov eax, dword [esi + 4]
mov ecx, dword [esp + 4]
push eax
push ecx
lea edx, [esp + 0x10]
push 0x102b9dbc
push edx
call fcn.10093b70
mov esi, dword [esp + 0x30]
add esp, 0x10
lea eax, [esp + 8]
mov ecx, esi
push eax
call fcn.100901f0
mov dword [esp + 0xc], 1
lea ecx, [esp + 4]
mov byte [esp + 0x18], 1
call fcn.10090bf0
lea ecx, [esp + 8]
mov byte [esp + 0x18], 0
call fcn.10090bf0
mov ecx, dword [esp + 0x10]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret 8
Function at 0x1003c490
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1025de04
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.10039ce0
lea ecx, [esi + 8]
call fcn.1003c460
xor ebx, ebx
lea ecx, [esi + 0x20]
mov dword [esp + 0x1c], ebx
call fcn.10096510
mov eax, dword [0x1026e87c]
mov dword [esi + 0x30], eax
lea ecx, [esi + 0x3c]
mov byte [esp + 0x1c], 2
call fcn.100a4db0
mov edx, dword [0x1026e87c]
lea edi, [esi + 0x58]
mov dword [esp + 0x10], edi
lea ecx, [edi + 4]
mov dword [ecx], edx
push 0x102f684c
mov byte [esp + 0x20], 4
mov dword [edi], ebx
call fcn.10090e70
mov dword [edi + 8], ebx
add edi, 0xc
xor eax, eax
lea edx, [esi + 0x48]
mov dword [edi], eax
xor ecx, ecx
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [esi + 0x34], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [edx], ecx
mov eax, esi
pop edi
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x38], ebx
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x100415a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov ecx, 0x102fb6b8
jmp 0x10041600
push 0xffffffffffffffff
push 0x1025e5a2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebp
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [esp + 0xc], esi
mov dword [esi + 4], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0xc], edi
mov dword [esi + 8], edi
mov dword [esp + 0x1c], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], 0x1e
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x50], edi
lea ecx, [esi + 0x5c]
mov byte [esp + 0x1c], 4
call fcn.1009e960
lea ebp, [esi + 0x7c]
mov dword [esp + 0x10], ebp
mov dword [ebp], 0x1026bf24
mov dword [ebp + 4], edi
mov dword [ebp + 0x10], edi
mov dword [ebp + 0xc], edi
mov dword [ebp + 8], edi
lea ecx, [ebp + 0x14]
mov byte [esp + 0x1c], 6
call fcn.1009e960
push edi
push edi
push edi
push edi
push edi
push edi
lea ecx, [ebp + 0x34]
mov byte [esp + 0x34], 7
call fcn.10041560
push 0xffffffffffffffff
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
lea ecx, [ebp + 0x4c]
call fcn.10041280
mov dword [ebp], 0x1026bf1c
lea ecx, [esi + 0x104]
mov byte [esp + 0x1c], 8
call fcn.100434f0
lea ebp, [esi + 0x140]
mov dword [esp + 0x10], ebp
mov dword [ebp], 0x1026bf24
mov dword [ebp + 8], edi
mov dword [ebp + 0xc], 0x11
mov dword [ebp + 0x10], edi
mov dword [ebp + 0x14], edi
mov dword [ebp + 0x18], edi
mov eax, 0xa
mov dword [ebp + 0x1c], eax
lea ecx, [ebp + 0x20]
mov byte [esp + 0x1c], al
call fcn.1009e960
push edi
push edi
push edi
push edi
push edi
push edi
lea ecx, [ebp + 0x40]
mov byte [esp + 0x34], 0xb
call fcn.10041560
push 0xffffffffffffffff
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
lea ecx, [ebp + 0x58]
call fcn.10041280
push edi
push edi
push edi
push edi
push edi
push edi
lea ecx, [ebp + 0x94]
mov byte [esp + 0x34], 0xc
call fcn.10041560
push 0xffffffffffffffff
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
lea ecx, [ebp + 0xac]
call fcn.10041280
mov ecx, dword [esp + 0x14]
mov eax, 0x10
mov dword [ebp], 0x1026bf10
mov dword [esi + 0x248], eax
mov dword [esi + 0x24c], eax
mov dword [esi + 0x254], edi
mov dword [esi], 0x1026bf0c
mov dword [esi + 0x250], 4
mov dword [esi + 0x258], 0x7530
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x14
ret