joyce8/EMBER2024-capa huggingface dataset:
Function at 0xf0a8ff0
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1028
call fcn.0f0a92e0
lea eax, [ebp - 0x1020]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
cmp ecx, dword [0xf2075fc]
jae 0xf0a9037
mov edx, dword [ebp + 8]
sar edx, 5
mov eax, dword [ebp + 8]
and eax, 0x1f
mov ecx, dword [edx*4 + 0xf207600]
movsx edx, byte [ecx + eax*8 + 4]
and edx, 1
jne 0xf0a9049
mov dword [0xf0b615c], 9
or eax, 0xffffffff
jmp 0xf0a91c7
push 1
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.0f020850
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
je 0xf0a907b
push 2
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.0f020850
add esp, 0xc
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
jne 0xf0a9083
or eax, 0xffffffff
jmp 0xf0a91c7
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0
jle 0xf0a9162
push 0x1000
push 0
mov eax, dword [ebp - 0x18]
push eax
call fcn.0f09fe30
add esp, 0xc
push 0x8000
mov ecx, dword [ebp + 8]
push ecx
call fcn.0f0a91d0
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0xc], 0x1000
jl 0xf0a90d2
mov dword [ebp - 0x1024], 0x1000
jmp 0xf0a90db
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x1024], edx
mov eax, dword [ebp - 0x1024]
mov dword [ebp - 8], eax
cmp dword [ebp - 0xc], 0x1000
jl 0xf0a90f9
mov dword [ebp - 0x1028], 0x1000
jmp 0xf0a9102
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x1028], ecx
mov edx, dword [ebp - 0x1028]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0f020540
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0xf0a913d
cmp dword [0xf0b6160], 5
jne 0xf0a9135
mov dword [0xf0b615c], 0xd
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
jmp 0xf0a9150
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jg 0xf0a90bd
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0f0a91d0
add esp, 8
jmp 0xf0a91b2
cmp dword [ebp - 0xc], 0
jge 0xf0a91b2
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0f020850
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
call fcn.0f0211b0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
neg eax
sbb eax, eax
neg eax
dec eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0xf0a91b2
mov dword [0xf0b615c], 0xd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0xf0b6160], eax
push 0
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0f020850
add esp, 0xc
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x46db480c
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4330d2
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x537e072a
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219

Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..reloc
nop
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x432072
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x3024558b
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x432060
mov eax, section..rdata
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4320d2
mov ebx, 0x42f314
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x739842d0
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4320c0
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x100019a0
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x100019b5
xor eax, eax
jmp 0x10001a2a
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
add edx, 0x10000
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
jmp 0x100019e2
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x38d
jae 0x10001a25
mov edx, dword [ebp - 4]
imul edx, edx, 0x48
mov eax, dword [ebp - 8]
cmp dword [eax + edx + 0x40], 0
je 0x10001a23
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 0xc]
jb 0x10001a1f
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 0x10]
jb 0x10001a23
xor eax, eax
jmp 0x10001a2a
jmp 0x100019d9
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x10001bf0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10131a8c]
mov dword [ebp - 4], eax
jmp 0x10001c09
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x10001c26
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x10001c00
mov esp, ebp
pop ebp
ret
Function at 0x10002070
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x10131a9c], eax
je 0x1000208e
mov eax, 0x10dd
jmp 0x1000216f
mov eax, dword [0x10131aac]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000210c
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x100020ea
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x100020ea
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.10001710
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.1001a623
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x10002096
mov dword [0x10131aac], 0
call fcn.10001a30
mov ecx, dword [0x10131aa8]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x10002159
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.1001a623
add esp, 4
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x10002124
mov dword [0x10131aa8], 0
mov dword [0x10131a9c], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10002660
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x10131aa0], 0
je 0x10002679
mov eax, dword [0x10131aa0]
jmp 0x10002719
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x1000268b
xor eax, eax
jmp 0x10002719
push 8
call fcn.1001a993
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100026e1
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x100026ca
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.1001a623
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x10131aa0], eax
mov dword [0x10131aa4], 0
mov eax, dword [ebp - 8]
jmp 0x10002719
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x100026fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x100026ab
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x10131aa8]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x10131aa8], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x10003330
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov edx, 0x80
xor ecx, ecx
mov dword [ebp - 4], ecx
xor eax, eax
test cl, 1
cmovne eax, edx
shr ecx, 1
test cl, 1
je 0x10003356
bts eax, 6
shr ecx, 1
test cl, 1
je 0x10003361
bts eax, 5
shr ecx, 1
test cl, 1
je 0x1000336c
bts eax, 4
shr ecx, 1
test cl, 1
je 0x10003377
bts eax, 3
shr ecx, 1
test cl, 1
je 0x10003382
bts eax, 2
shr ecx, 1
test cl, 1
je 0x1000338d
bts eax, 1
test cl, 2
je 0x10003396
bts eax, 0
shl eax, 0x18
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
add eax, eax
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
and edx, 0x80000000
neg edx
lea eax, [ecx + ecx]
sbb edx, edx
and edx, 0x4c11db7
xor edx, eax
mov ecx, edx
and ecx, 0x80000000
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
and edx, 0x80000000
neg edx
lea eax, [ecx + ecx]
sbb edx, edx
and edx, 0x4c11db7
xor edx, eax
mov ecx, edx
and ecx, 0x80000000
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
and edx, 0x80000000
neg edx
lea eax, [ecx + ecx]
sbb edx, edx
and edx, 0x4c11db7
xor edx, eax
mov ecx, edx
and ecx, 0x80000000
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x4c11db7
xor ecx, eax
mov ebx, ecx
and ebx, 0x80000000
neg ebx
lea eax, [ecx + ecx]
sbb ebx, ebx
and ebx, 0x4c11db7
xor ebx, eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [edi + eax*4], ebx
lea esi, [edi + eax*4]
lea ecx, [edx + 1]
nop
test bl, 1
je 0x1000346f
mov eax, 0x20
sub eax, ecx
bts edx, eax
inc ecx
shr ebx, 1
cmp ecx, 0x21
jl 0x10003460
mov ecx, dword [ebp - 4]
inc ecx
mov dword [esi], edx
mov dword [ebp - 4], ecx
mov edx, 0x80
cmp ecx, 0xff
jle 0x10003343
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100034a0
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x1002700c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push 0x1001e7d8
push eax
lea eax, [ebp - 0x408]
mov dword [ebp - 0x40c], ecx
push eax
or ebx, 0xffffffff
mov dword [ebp - 0x408], 0
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen_s]
add esp, 0xc
test eax, eax
je 0x100034f8
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001a628
mov esp, ebp
pop ebp
ret 4
push esi
push edi
nop word [eax + eax]
push dword [ebp - 0x408]
lea eax, [ebp - 0x404]
push 0x400
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov edi, eax
lea esi, [ebp - 0x404]
add esp, 0x10
mov dword [ebp - 0x410], edi
mov edx, edi
test edi, edi
je 0x10003553
mov edi, dword [ebp - 0x40c]
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [edi + ecx*4]
sub edx, 1
jne 0x10003537
mov edi, dword [ebp - 0x410]
cmp edi, 0x400
je 0x10003500
push dword [ebp - 0x408]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov ecx, dword [ebp - 4]
add esp, 4
not ebx
xor ecx, ebp
mov eax, ebx
pop edi
pop esi
pop ebx
call fcn.1001a628
mov esp, ebp
pop ebp
ret 4

Function at 0x10003590
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push 0x1001e7e0
push dword [ebp + 8]
mov dword [ebp - 4], ecx
push eax
mov dword [edi], 0xffffffff
mov dword [ebp + 0xc], 0
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
add esp, 0xc
test eax, eax
je 0x100035ca
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 0xc
push ebx
push 0x400
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov ebx, eax
mov dword [ebp + 8], ebx
push dword [ebp + 0xc]
test ebx, ebx
jne 0x100035f8
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
xor al, al
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
push 0x400
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
test eax, eax
je 0x10003650
push esi
nop
mov esi, ebx
test eax, eax
je 0x10003637
mov ebx, dword [edi]
lea esi, [esi + 1]
movzx ecx, byte [esi - 1]
movzx edx, bl
xor edx, ecx
shr ebx, 8
mov ecx, dword [ebp - 4]
xor ebx, dword [ecx + edx*4]
mov dword [edi], ebx
sub eax, 1
jne 0x10003616
mov ebx, dword [ebp + 8]
push dword [ebp + 0xc]
push 0x400
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
test eax, eax
jne 0x10003610
pop esi
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
push dword [ebp + 0xc]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
not dword [edi]
add esp, 8
mov al, 1
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10003670
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push 0x1001e7d8
push dword [ebp + 8]
mov dword [ebp - 4], ecx
push eax
mov dword [edi], 0xffffffff
mov dword [ebp + 0xc], 0
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen_s]
add esp, 0xc
test eax, eax
je 0x100036aa
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 0xc
push ebx
push 0x400
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov ebx, eax
mov dword [ebp + 8], ebx
push dword [ebp + 0xc]
test ebx, ebx
jne 0x100036d8
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
xor al, al
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
push 0x400
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
test eax, eax
je 0x10003730
push esi
nop
mov esi, ebx
test eax, eax
je 0x10003717
mov ebx, dword [edi]
lea esi, [esi + 1]
movzx ecx, byte [esi - 1]
movzx edx, bl
xor edx, ecx
shr ebx, 8
mov ecx, dword [ebp - 4]
xor ebx, dword [ecx + edx*4]
mov dword [edi], ebx
sub eax, 1
jne 0x100036f6
mov ebx, dword [ebp + 8]
push dword [ebp + 0xc]
push 0x400
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
test eax, eax
jne 0x100036f0
pop esi
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
push dword [ebp + 0xc]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
not dword [edi]
add esp, 8
mov al, 1
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x100037d0
Capabilities:
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x198
mov eax, dword [0x1002700c]
xor eax, esp
mov dword [esp + 0x194], eax
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x10003813
xor al, al
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.1001a628
mov esp, ebp
pop ebp
ret 4
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x1002704c], eax
cmp eax, 0xffffffff
je 0x100037fd
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
mov dword [0x10027050], eax
test eax, eax
je 0x100037fd
mov ecx, dword [esp + 0x194]
mov al, 1
xor ecx, esp
mov dword [0x1012705c], 0x10004350
call fcn.1001a628
mov esp, ebp
pop ebp
ret 4
Function at 0x10003860
Capabilities:
Connect socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
mov eax, dword [0x1002700c]
xor eax, esp
mov dword [esp + 0x14], eax
cmp dword [0x1002704c], 0xffffffff
push esi
mov esi, dword [ebp + 8]
push edi
jne 0x100038b1
mov ecx, 1
call fcn.10018e80
push eax
push 0
push 0x10127210
call fcn.1000e6e0
add esp, 0xc
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.1001a628
mov esp, ebp
pop ebp
ret 8
push dword [ebp + 0xc]
mov edi, 2
mov word [esp + 0x10], di
call dword [sym.imp.WS2_32.dll_htons]
push esi
mov word [esp + 0x12], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
jne 0x100038fb
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x100038fb
movsx ecx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
push ecx
push dword [eax]
lea eax, [esp + 0x18]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push 0x10
lea eax, [esp + 0x10]
push eax
push dword [0x1002704c]
call dword [sym.imp.WS2_32.dll_connect]
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0xffffffff
jne 0x1000395b
call esi
cmp eax, 0x2733
je 0x1000395b
call esi
push eax
mov ecx, edi
call fcn.10018e80
push eax
push 0
push 0x10127210
call fcn.1000e6e0
add esp, 0x10
mov ecx, 0x10027048
call fcn.10003a50
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.1001a628
mov esp, ebp
pop ebp
ret 8
push 0x23
push dword [0x10027050]
push dword [0x1002704c]
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
jne 0x100039e2
call esi
push eax
mov ecx, 3
call fcn.10018e80
push eax
push 0
push 0x10127210
call fcn.1000e6e0
mov eax, dword [0x1002704c]
add esp, 0x10
cmp eax, 0xffffffff
je 0x100039ac
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [0x1002704c], 0xffffffff
mov eax, dword [0x10027050]
test eax, eax
je 0x100039c6
push eax
call dword [sym.imp.WS2_32.dll_WSACloseEvent]
mov dword [0x10027050], 0
mov byte [0x10127080], 0
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.1001a628
mov esp, ebp
pop ebp
ret 8
push 0x80000
push 0
push 0x10027054
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [0x100a7054], 0
push 0x80000
push 0
push 0x100a7058
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [0x10127058], 0
push 0
push ecx
push 0x10027048
push 0x10003fe0
call fcn.10019050
mov ecx, dword [esp + 0x1c]
mov al, 1
pop edi
pop esi
xor ecx, esp
mov byte [0x10127080], 1
call fcn.1001a628
mov esp, ebp
pop ebp
ret 8
Function at 0x10003cf0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x8000c
call fcn.1001b750
mov eax, dword [0x1002700c]
xor eax, esp
mov dword [esp + 0x80008], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x10127064
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x1002704c]
cmp ebx, 0xffffffff
je 0x10003dc5
cmp byte [0x10127080], 0
je 0x10003dc5
push 0x80000
lea eax, [esp + 0x14]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov esi, dword [ebp + 0xc]
lea eax, [esp + 0x1c]
add esp, 0xc
push esi
push edi
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
cmp byte [esp + 0x10], 0xc1
jne 0x10003d75
push dword [esp + 0x12]
lea edx, [esi - 3]
lea ecx, [esp + 0x17]
jmp 0x10003d80
push dword [esp + 0x13]
lea edx, [esi - 4]
lea ecx, [esp + 0x18]
call fcn.100172e0
mov eax, dword [0x10127058]
add esp, 4
test eax, eax
jle 0x10003e28
lea ecx, [eax + esi]
cmp ecx, 0x80000
jle 0x10003de9
push ecx
mov ecx, 7
call fcn.10018e80
push eax
push 0
push 0x10127210
call fcn.1000e6e0
add esp, 0x10
mov ecx, 0x10027048
call fcn.10003a50
push 0x10127064
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80008]
xor ecx, esp
call fcn.1001a628
mov esp, ebp
pop ebp
ret 8
push esi
lea ecx, [esp + 0x14]
push ecx
lea eax, [eax + 0x100a7058]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add dword [0x10127058], esi
push 0x10127064
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80008]
xor ecx, esp
call fcn.1001a628
mov esp, ebp
pop ebp
ret 8
xor edi, edi
test esi, esi
jle 0x10003e04
nop
push 0
push esi
lea eax, [esp + 0x18]
add eax, edi
push eax
push ebx
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x10003e56
sub esi, eax
add edi, eax
test esi, esi
jle 0x10003e04
mov ebx, dword [0x1002704c]
jmp 0x10003e30
mov ebx, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call ebx
cmp eax, 0x2733
jne 0x10003ec1
mov ecx, dword [0x10127058]
lea eax, [ecx + esi]
cmp eax, 0x80000
jle 0x10003e80
push eax
mov ecx, 8
jmp 0x10003da6
lea eax, [esp + 0x10]
add eax, edi
push esi
push eax
lea eax, [ecx + 0x100a7058]
push eax
call sub.VCRUNTIME140.dll_memcpy
add dword [0x10127058], esi
add esp, 0xc
push 0x10127064
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x80014]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1001a628
mov esp, ebp
pop ebp
ret 8
call ebx
push eax
mov ecx, 9
jmp 0x10003da6
Function at 0x10003ed0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x10001c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edi, edi
cmp dword [esi + 0x100010], edi
jle 0x10003f22
lea eax, [esi + 0x80010]
push 0
push dword [esi + 0x100010]
add eax, edi
push eax
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x10003f2f
sub dword [esi + 0x100010], eax
add edi, eax
cmp dword [esi + 0x100010], 0
lea eax, [esi + 0x80010]
jg 0x10003ef2
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
pop edi
pop esi
pop ebx
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x10003f68
push dword [esi + 0x100010]
lea eax, [esi + 0x80010]
add eax, edi
push eax
lea eax, [esi + 0x80010]
push eax
call dword [sym.imp.VCRUNTIME140.dll_memmove]
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
pop edi
pop esi
pop ebx
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
mov ecx, 0xa
call fcn.10018e80
push eax
push 0
push 0x10127210
call fcn.1000e6e0
mov eax, dword [esi + 4]
add esp, 0x10
cmp eax, 0xffffffff
je 0x10003f9f
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 4], 0xffffffff
mov eax, dword [esi + 8]
test eax, eax
je 0x10003fb4
push eax
call dword [sym.imp.WS2_32.dll_WSACloseEvent]
mov dword [esi + 8], 0
push ebx
mov byte [esi + 0x100038], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
xor al, al
pop ebx
ret