joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43ad70
Capabilities:
Resume thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 8], ebx
je 0x43aed7
jmp 0x43ad90
mov edi, dword [esi]
test edi, edi
je 0x43af2c
cmp dword [0x441604], ebx
je 0x43adb6
push dword [edi + 8]
push 0x42e198
push 7
push 0xfffffffffffffff4
call fcn.004357e0
add esp, 0x10
push dword [edi + 0xc]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x43ae6d
push dword [edi + 0xc]
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test eax, eax
je 0x43ae13
mov ecx, dword [esi]
test ecx, ecx
je 0x43af2c
mov eax, dword [ecx]
mov dword [esi], eax
test eax, eax
je 0x43adec
mov dword [eax + 4], ebx
jmp 0x43adef
mov dword [esi + 4], ebx
mov eax, dword [esi + 0x10]
mov dword [ecx], eax
add dword [esi + 8], 0xffffffff
mov eax, dword [esi + 8]
mov dword [esi + 0x10], ecx
jne 0x43ae0a
mov ecx, esi
call fcn.00437b30
mov eax, dword [esi + 8]
test eax, eax
jne 0x43ad90
jmp 0x43aed7
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x43ae28
movzx ebx, bx
or ebx, 0x80070000
lea edx, [ebp - 4]
mov dword [ebp - 4], 0
mov ecx, ebx
call fcn.00435760
cmp dword [0x441604], 0
je 0x43aed7
push 0x42e1e8
push dword [ebp - 4]
push ebx
push 0x42b728
push 7
push 0xfffffffffffffff4
call fcn.004357e0
add esp, 0x18
cmp dword [0x441604], 0
je 0x43aed7
push 0x76
jmp 0x43aec1
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x43ae82
movzx ebx, bx
or ebx, 0x80070000
lea edx, [ebp - 4]
mov dword [ebp - 4], 0
mov ecx, ebx
call fcn.00435760
cmp dword [0x441604], 0
je 0x43aed7
push 0x42e1b8
push dword [ebp - 4]
push ebx
push 0x42b728
push 7
push 0xfffffffffffffff4
call fcn.004357e0
add esp, 0x18
cmp dword [0x441604], 0
je 0x43aed7
push 0x75
push 0x42e0f4
push 0x42b77c
push 7
push 0xfffffffffffffff4
call fcn.004357e0
add esp, 0x14
cmp dword [esi + 8], 0
je 0x43af23
lea ecx, [ecx]
mov ecx, dword [esi]
test ecx, ecx
je 0x43af2c
mov eax, dword [ecx]
mov edi, dword [ecx + 0xc]
mov dword [esi], eax
test eax, eax
je 0x43aefa
mov dword [eax + 4], 0
jmp 0x43af01
mov dword [esi + 4], 0
mov eax, dword [esi + 0x10]
mov dword [ecx], eax
add dword [esi + 8], 0xffffffff
mov dword [esi + 0x10], ecx
jne 0x43af16
mov ecx, esi
call fcn.00437b30
push edi
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
cmp dword [esi + 8], 0
jne 0x43aee0
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 0x80004005
call fcn.00435870
int3
Function at 0x43c9b0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1b8
mov eax, dword [0x441004]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [0x441180]
push ebx
push esi
push edi
mov esi, dword [eax + 0xc]
mov edi, ecx
mov ecx, esi
mov dword [ebp - 0x1b4], edi
xor ebx, ebx
call dword [0x4422c4]
mov ecx, 0x441180
call esi
add eax, 0x10
mov dword [ebp - 0x1b0], eax
cmp dword [0x441604], ebx
je 0x43ca10
push 0x42da90
push 0x42eecc
push 7
push 0xfffffffffffffff4
call fcn.004357e0
add esp, 0x10
push 0x1a0
lea eax, [ebp - 0x1ac]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x198], 0x10000100
lea ecx, [ebp - 0x1b0]
mov dword [ebp - 0x1c], 0x43ccf0
mov dword [ebp - 0x14], edi
push 0xf
push 0x42da90
call fcn.00435250
mov esi, dword [ebp - 0x1b0]
cmp dword [esi - 4], 1
jle 0x43ca6c
push dword [esi - 0xc]
lea ecx, [ebp - 0x1b0]
call fcn.004350f0
mov esi, dword [ebp - 0x1b0]
lea eax, [ebp - 0x1ac]
mov dword [ebp - 0x1a8], esi
push eax
call dword [sym.imp.api_ms_win_eventing_consumer_l1_1_0.dll_OpenTraceW]
mov edi, eax
mov dword [ebp - 0x1b0], edx
cmp edi, 0xffffffff
jne 0x43cb5a
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x43caa7
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
jns 0x43cb5a
lea edx, [ebp - 0x1b4]
mov dword [ebp - 0x1b4], 0
mov ecx, ebx
call fcn.00435760
cmp dword [0x441604], 0
je 0x43cb0e
push 0x42ee58
push dword [ebp - 0x1b4]
push ebx
push 0x42b728
push 7
push 0xfffffffffffffff4
call fcn.004357e0
add esp, 0x18
cmp dword [0x441604], 0
je 0x43cb0e
push 0xf6
push 0x42ed48
push 0x42b77c
push 7
push 0xfffffffffffffff4
call fcn.004357e0
add esp, 0x14
mov eax, dword [ebp - 0x1b0]
cmp edi, 0xffffffff
je 0x43cb21
push eax
push edi
call dword [sym.imp.api_ms_win_eventing_consumer_l1_1_0.dll_CloseTrace]
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x43cb45
mov edi, dword [esi]
push esi
mov edx, dword [edi]
mov esi, dword [edx + 4]
mov ecx, esi
call dword [0x4422c4]
mov ecx, edi
call esi
mov ecx, dword [ebp - 8]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043ffc0
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0x1b4]
mov ecx, dword [ebp - 0x1b0]
push 0
push 0
push eax
push 0x43cc10
push 0
push 0
mov dword [eax + 0x58], edi
mov dword [eax + 0x5c], ecx
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov ecx, dword [ebp - 0x1b4]
mov dword [ecx + 0x60], eax
test eax, eax
jne 0x43cbfa
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x43cba2
movzx ebx, bx
or ebx, 0x80070000
lea edx, [ebp - 0x1b4]
mov dword [ebp - 0x1b4], 0
mov ecx, ebx
call fcn.00435760
cmp dword [0x441604], 0
je 0x43cb0e
push 0x42ee80
push dword [ebp - 0x1b4]
push ebx
push 0x42b728
push 7
push 0xfffffffffffffff4
call fcn.004357e0
add esp, 0x18
cmp dword [0x441604], 0
je 0x43cb0e
push 0xfc
jmp 0x43caf8
or edi, 0xffffffff
xor eax, eax
jmp 0x43cb14
Function at 0x43eeff
Capabilities:
Parse pe header

Disassembly:
push 0x7c
push 0x440a40
call fcn.0044079c
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x70], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x68], eax
test edx, edx
mov ebx, 0x10000
je 0x43ef26
lea ebx, [edx + 0x10000]
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x8c]
rep stosd dword es:[edi], eax
push 0xfffffffffffffffe
pop esi
mov edi, dword [ebp - 0x6c]
push 0x1c
lea eax, [ebp - 0x8c]
push eax
push ebx
push edi
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_VirtualQueryEx]
test eax, eax
je 0x43f023
mov ecx, dword [ebp - 0x80]
mov eax, ecx
and eax, 0xfff
cmp eax, 0xfff
je 0x43f023
mov eax, dword [ebp - 0x8c]
add eax, ecx
cmp eax, ebx
jb 0x43f023
cmp dword [ebp - 0x7c], 0x1000
jne 0x43f015
cmp byte [ebp - 0x78], 1
je 0x43f015
test dword [ebp - 0x78], 0x100
jne 0x43f015
and dword [ebp - 4], 0
push 0
push 0x40
lea eax, [ebp - 0x64]
push eax
push ebx
push edi
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_ReadProcessMemory]
test eax, eax
jne 0x43efb4
mov dword [ebp - 4], esi
jmp 0x43f015
mov eax, 0x5a4d
cmp word [ebp - 0x64], ax
jne 0x43efaf
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x80]
ja 0x43efaf
cmp eax, 0x40
jb 0x43efaf
push 0
push 0xf8
push dword [ebp - 0x68]
add eax, ebx
push eax
push edi
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_ReadProcessMemory]
test eax, eax
je 0x43efaf
mov eax, dword [ebp - 0x68]
cmp dword [eax], 0x4550
jne 0x43efaf
mov dword [ebp - 4], esi
mov eax, ebx
jmp 0x43f025
mov ebx, dword [ebp - 0x80]
add ebx, dword [ebp - 0x8c]
jmp 0x43ef39
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x43fb90
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push 0x14
push 0x440a60
call fcn.00440438
mov dword [ebp - 0x20], edx
mov edi, ecx
xor esi, esi
test edi, edi
jne 0x43fbb0
push esi
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleW]
mov edi, eax
mov dword [ebp - 4], esi
mov eax, 0x5a4d
cmp word [edi], ax
je 0x43fbc7
push 0xc1
jmp 0x43fc62
mov ecx, dword [edi + 0x3c]
cmp dword [ecx + edi], 0x4550
je 0x43fbdd
push 0xbf
jmp 0x43fc62
cmp word [ecx + edi + 0x14], si
je 0x43fc5d
mov ecx, dword [ecx + edi + 0x78]
lea eax, [ecx + edi]
neg ecx
sbb ecx, ecx
and ecx, eax
je 0x43fc5d
mov ebx, dword [ecx + 0x24]
lea eax, [ebx + edi]
neg ebx
sbb ebx, ebx
and ebx, eax
mov edi, esi
mov dword [ebp - 0x24], edi
cmp edi, dword [ecx + 0x14]
jae 0x43fc34
mov edx, esi
mov dword [ebp - 0x1c], edx
cmp edx, dword [ecx + 0x18]
jae 0x43fc1e
movzx eax, word [ebx + edx*2]
cmp eax, edi
je 0x43fc1e
inc edx
jmp 0x43fc0b
mov eax, dword [ecx + 0x10]
add eax, edi
cmp eax, 1
jne 0x43fc31
mov eax, dword [ebp - 0x20]
mov dword [eax], 1
inc edi
jmp 0x43fc01
push esi
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
inc eax
jmp 0x43fc71
push 0xc0
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x43ffb0
Capabilities:
Terminate process

Disassembly:
push 0xc
push 0x440a80
call fcn.00440438
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, ebx
mov edx, 0x441630
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x43fdd8
cmp eax, esi
jne 0x43fdcb
xor esi, esi
inc esi
mov edi, esi
jmp 0x43fddb
push 0x3e8
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x43fdaf
xor esi, esi
inc esi
cmp dword [0x441634], esi
jne 0x43fded
push 0x1f
call fcn.004d6000
pop ecx
jmp 0x43fe27
cmp dword [0x441634], ebx
jne 0x43fe21
mov dword [0x441634], esi
push 0x40104c
push 0x401040
call fcn.0043ff0c
pop ecx
pop ecx
test eax, eax
je 0x43fe27
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x43fefc
mov dword [0x441244], esi
cmp dword [0x441634], esi
jne 0x43fe4a
push 0x40103c
push section..text
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x441634], 2
test edi, edi
jne 0x43fe57
xor eax, eax
mov ecx, 0x441630
xchg dword [ecx], eax
cmp dword [0x441640], 0
je 0x43fe83
push 0x441640
call fcn.00440290
pop ecx
test eax, eax
je 0x43fe83
push ebx
push 2
push ebx
mov esi, dword [0x441640]
mov ecx, esi
call dword [0x4422c4]
call esi
push dword [0x441250]
push dword [0x44124c]
push dword [0x441248]
call fcn.004326a0
add esp, 0xc
mov dword [0x441240], eax
cmp dword [0x441258], 0
jne 0x43fee1
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
push ecx
push eax
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x441244], 0
jne 0x43fef5
call dword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x441240]
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
call fcn.00440385
jmp 0x43fd93

Function at 0x440174
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x440ac0
call fcn.00440438
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x4401d4
cmp eax, 0xffffffff
je 0x4401d4
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x4401cd
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x4401cd
cmp edx, 0x10000000
jae 0x4401cd
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x4401ca
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x440240
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x44027e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x440276
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x440280
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x440266
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x440350
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x440381
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x440381
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x440381
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x100360d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
push edi
lea edi, [ebp - 0x18]
mov ecx, 6
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x100cb0a0
call fcn.10031982
mov eax, dword [0x100c8e38]
mov dword [ebp - 8], eax
jmp 0x10036107
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x10036120
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
je 0x1003611e
mov eax, dword [ebp - 8]
jmp 0x100361a3
jmp 0x100360ff
mov esi, esp
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp esi, esp
call fcn.100311ee
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100361a0
mov eax, dword [ebp - 8]
add eax, 0x20
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov dword [eax + 4], 0
mov eax, dword [ebp - 8]
mov dword [eax + 8], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
mov dword [eax], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 0x14]
add eax, 0x20
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 8]
cmp eax, 0xfe0
jbe 0x10036163
mov eax, dword [ebp - 8]
mov ecx, dword [0x100c8e38]
mov dword [eax], ecx
mov eax, dword [ebp - 8]
mov dword [0x100c8e38], eax
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
add esp, 0xd8
cmp ebp, esp
call fcn.100311ee
mov esp, ebp
pop ebp
ret
Function at 0x10037ca0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
lea edi, [ebp - 0x4c]
mov ecx, 0x13
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x100c8280]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0x100cb228
call fcn.10031982
imul eax, dword [ebp + 8], 0x2c
add eax, dword [0x100c8e20]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x24], 5
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0xc]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x10037d0d
mov eax, dword [ebp - 0x30]
sub eax, 5
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
add eax, 2
mov dword [ebp - 0x24], eax
mov esi, esp
lea eax, [ebp - 0x18]
push eax
push 0x40
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.100311ee
test eax, eax
jne 0x10037d38
mov eax, 0xa
jmp 0x10037e3a
cmp dword [ebp + 0xc], 0
je 0x10037d85
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov byte [eax], 0xe9
mov eax, dword [ebp - 0x30]
add eax, 5
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 4]
sub edx, eax
mov eax, dword [ebp - 0x3c]
mov dword [eax + 1], edx
mov eax, dword [ebp - 0xc]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x10037d83
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
mov byte [eax], 0xeb
mov eax, dword [ebp - 0x48]
mov byte [eax + 1], 0xf9
jmp 0x10037dc1
mov eax, dword [ebp - 0xc]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x10037dac
push 7
mov eax, dword [ebp - 0xc]
add eax, 0xc
push eax
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.10031815
add esp, 0xc
jmp 0x10037dc1
push 5
mov eax, dword [ebp - 0xc]
add eax, 0xc
push eax
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.10031815
add esp, 0xc
mov esi, esp
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.100311ee
mov esi, esp
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x30]
push ecx
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp edi, esp
call fcn.100311ee
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
cmp esi, esp
call fcn.100311ee
mov al, byte [ebp + 0xc]
and al, 1
shl al, 1
mov ecx, dword [ebp - 0xc]
mov dl, byte [ecx + 0x14]
and dl, 0xfd
or dl, al
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x14], dl
mov al, byte [ebp + 0xc]
and al, 1
shl al, 2
mov ecx, dword [ebp - 0xc]
mov dl, byte [ecx + 0x14]
and dl, 0xfb
or dl, al
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x14], dl
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x10037e6c]
call fcn.10030ed8
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10030acd
add esp, 0x10c
cmp ebp, esp
call fcn.100311ee
mov esp, ebp
pop ebp
ret
Function at 0x100384b0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
push ebx
push esi
push edi
lea edi, [ebp - 0x24]
mov ecx, 9
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x100cb228
call fcn.10031982
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0
mov eax, dword [ebp + 8]
push eax
call fcn.10037fc0
add esp, 4
test eax, eax
jne 0x10038515
mov dword [ebp - 8], 9
jmp 0x100385a2
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x100385a2
mov dword [ebp - 0x14], 0
jmp 0x10038533
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [eax + 8]
jae 0x100385a2
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov esi, esp
mov edx, dword [ebp - 0x14]
mov eax, dword [ecx + edx*4]
push eax
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp esi, esp
call fcn.100311ee
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x100385a0
mov esi, esp
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp esi, esp
call fcn.100311ee
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x20]
push edx
call fcn.100392c0
add esp, 0xc
mov esi, esp
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.100311ee
jmp 0x1003852a
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
add esp, 0xe4
cmp ebp, esp
call fcn.100311ee
mov esp, ebp
pop ebp
ret

Function at 0x10039670
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
push edi
lea edi, [ebp - 0x18]
mov ecx, 6
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x100cb228
call fcn.10031982
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x1003972c
mov dword [ebp - 8], 0
jmp 0x100396b3
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 8]
jae 0x1003970e
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov esi, esp
mov edx, dword [ebp - 8]
mov eax, dword [ecx + edx*4]
push eax
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp esi, esp
call fcn.100311ee
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x1003970c
mov esi, esp
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp esi, esp
call fcn.100311ee
mov esi, esp
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.100311ee
jmp 0x100396aa
mov esi, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push 0
mov edx, dword [0x100c88f4]
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp esi, esp
call fcn.100311ee
pop edi
pop esi
pop ebx
add esp, 0xd8
cmp ebp, esp
call fcn.100311ee
mov esp, ebp
pop ebp
ret
Function at 0x10039e60
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
lea edi, [ebp - 0xc]
mov ecx, 3
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x100cb2fc
call fcn.10031982
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
test eax, eax
je 0x10039ec8
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
cmp eax, 0x90
je 0x10039ec8
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
cmp eax, 0xcc
je 0x10039ec8
xor eax, eax
jmp 0x10039f09
mov dword [ebp - 8], 1
jmp 0x10039eda
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
jae 0x10039f04
mov eax, dword [ebp + 8]
add eax, dword [ebp - 8]
movzx ecx, byte [eax]
mov edx, 1
imul eax, edx, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + eax]
cmp ecx, eax
je 0x10039f02
xor eax, eax
jmp 0x10039f09
jmp 0x10039ed1
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.100311ee
mov esp, ebp
pop ebp
ret
Function at 0x401e40
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
lea ecx, [esp]
push esi
mov esi, dword [esp + 0x114]
xor eax, eax
push ecx
push eax
lea edx, [esp + 0x14]
push eax
push edx
push 0x41
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], 1
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x401e86
xor al, al
pop esi
add esp, 0x10c
ret
lea eax, [esp + 0xc]
push eax
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
setne al
pop esi
add esp, 0x10c
ret

Function at 0x401ea0
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
lea ecx, [esp]
push esi
mov esi, dword [esp + 0x114]
xor eax, eax
push ecx
lea edx, [esp + 0x10]
push eax
push edx
push eax
push 0x41
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], 1
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x401ee6
xor al, al
pop esi
add esp, 0x10c
ret
lea eax, [esp + 0xc]
push eax
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
setne al
pop esi
add esp, 0x10c
ret

Function at 0x402300
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x3e8
mov edx, dword [esp + 0x3f4]
push ebx
mov eax, edx
push esi
mov esi, dword [esp + 0x3f8]
and eax, 0xffff
mov ecx, eax
push edi
mov ebx, ecx
lea edi, [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
and ebx, 0x800000ff
rep movsb byte es:[edi], byte [esi]
mov cl, 0xbb
mov byte [esp + 0xc], cl
jns 0x402348
dec ebx
or ebx, 0xffffff00
inc ebx
mov esi, dword [esp + 0x3f8]
mov byte [esp + 0xd], bl
xor ebx, ebx
mov byte [esp + 0xf], cl
mov ecx, dword [esp + 0x404]
mov bl, dh
add eax, 4
push ecx
lea edx, [esp + 0x10]
push eax
push edx
push esi
mov byte [esp + 0x1e], bl
call sub.WS2_32.dll_send
cmp eax, 0xffffffff
jne 0x402384
push esi
call fcn.00402390
add esp, 4
pop edi
pop esi
pop ebx
add esp, 0x3e8
ret
Function at 0x4025e0
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
sub esp, 0x10
call sub.util.dll_sockets_init
test al, al
jne 0x4025ff
push 0x40c2e4
call fcn.0040328b
add esp, 4
xor al, al
add esp, 0x10
ret
push 0
push 1
push 2
call sub.WS2_32.dll_socket
cmp eax, 0xffffffff
mov dword [0x412ec4], eax
jne 0x40262c
push 0x40c2cc
call fcn.0040328b
add esp, 4
call sub.util.dll_sockets_uninit
xor al, al
add esp, 0x10
ret
push 0x1ffe
call sub.WS2_32.dll_htons
push 0
mov word [esp + 6], ax
mov word [esp + 4], 2
call sub.WS2_32.dll_htonl
mov ecx, dword [0x412ec4]
mov dword [esp + 4], eax
lea eax, [esp]
push 0x10
push eax
push ecx
call sub.WS2_32.dll_bind
cmp eax, 0xffffffff
jne 0x402689
push 0x40c2b8
call fcn.0040328b
mov edx, dword [0x412ec4]
add esp, 4
push edx
call sub.WS2_32.dll_closesocket
call sub.util.dll_sockets_uninit
xor al, al
add esp, 0x10
ret
mov eax, dword [0x412ec4]
push 5
push eax
call sub.WS2_32.dll_listen
cmp eax, 0xffffffff
jne 0x4026ba
push 0x40c2a0
call fcn.0040328b
mov ecx, dword [0x412ec4]
add esp, 4
push ecx
call sub.WS2_32.dll_closesocket
xor al, al
add esp, 0x10
ret
push edi
mov ecx, 0xec9
xor eax, eax
mov edi, 0x40f3a0
rep stosd dword es:[edi], eax
mov eax, 0x40f3a0
pop edi
mov dword [eax], 0xffffffff
add eax, 0xbd4
cmp eax, 0x412ec4
jl 0x4026cf
mov al, 1
add esp, 0x10
ret