joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100053f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10159c55
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1024ed04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10254178], 0x10
jl 0x10005448
push 0x1025417c
call fcn.10031980
mov ecx, dword [0x10254174]
add esp, 4
test ecx, ecx
je 0x1000543a
mov eax, dword [ecx]
mov dword [0x10254174], eax
mov dword [0x1025417c], 1
test ecx, ecx
jne 0x1000545f
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x100054a6
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolRefObject.0
mov dword [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1013aa09
int3

Function at 0x100054b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015ad5d
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1024ed04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x10254178], 0x10
jl 0x1000550c
push 0x1025417c
call fcn.10031980
mov esi, dword [0x10254174]
add esp, 4
test esi, esi
je 0x100054fe
mov eax, dword [esi]
mov dword [0x10254174], eax
mov dword [0x1025417c], 1
test esi, esi
jne 0x10005523
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x1000559f
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi], vtable.CVolRefObject.0
mov dword [esi + 0xc], 0
mov byte [ebp - 4], 2
mov dword [esi], vtable.CVolRefObject.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov edi, dword [edi + 0xc]
test edi, edi
je 0x10005576
mov ecx, edi
call fcn.10018300
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x10005582
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0xc], edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1013aa09
int3
Function at 0x100059f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10159c55
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1024ed04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10254178], 0x1c
jl 0x10005a48
push 0x1025417c
call fcn.10031980
mov ecx, dword [0x10254174]
add esp, 4
test ecx, ecx
je 0x10005a3a
mov eax, dword [ecx]
mov dword [0x10254174], eax
mov dword [0x1025417c], 1
test ecx, ecx
jne 0x10005a5f
push 0x1c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10005abb
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolMem.0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x18], 0x40
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1013aa09
int3

Function at 0x10005b70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015a9dd
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1024ed04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x10254178], 0x1c
jl 0x10005bcb
push 0x1025417c
call fcn.10031980
mov ecx, dword [0x10254174]
add esp, 4
test ecx, ecx
je 0x10005bbd
mov eax, dword [ecx]
mov dword [0x10254174], eax
mov dword [0x1025417c], 1
test ecx, ecx
jne 0x10005be2
push 0x1c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10005c09
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
push esi
call fcn.10005ad0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1013aa09
int3

Function at 0x10006030
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10159d9d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1024ed04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10254178], 0xc
jl 0x10006088
push 0x1025417c
call fcn.10031980
mov ecx, dword [0x10254174]
add esp, 4
test ecx, ecx
je 0x1000607a
mov eax, dword [ecx]
mov dword [0x10254174], eax
mov dword [0x1025417c], 1
test ecx, ecx
jne 0x1000609f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x100060d5
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1013aa09
int3
Function at 0x100060e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015aeb5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1024ed04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x10254178], 0xc
jl 0x1000613b
push 0x1025417c
call fcn.10031980
mov ecx, dword [0x10254174]
add esp, 4
test ecx, ecx
je 0x1000612d
mov eax, dword [ecx]
mov dword [0x10254174], eax
mov dword [0x1025417c], 1
test ecx, ecx
jne 0x10006152
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1000619f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolObject.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1013aa09
int3
Function at 0x10006a20
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x1024ed04]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
push edi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
test esi, esi
jne 0x10006a55
pop edi
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.10134fc2
mov esp, ebp
pop ebp
ret
lea eax, [esp + 8]
push eax
push 0xf01ff
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10006abf
lea eax, [esp + 0xc]
push eax
push 0x1023c900
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
push 0
push 0
push 0x10
mov dword [esp + 0x24], eax
lea eax, [esp + 0x20]
push eax
push 0
push dword [esp + 0x1c]
mov dword [esp + 0x2c], 1
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [esp + 8]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x24]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.10134fc2
mov esp, ebp
pop ebp
ret

Function at 0x10006c00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10159d9d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1024ed04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10254178], 0xa8
jl 0x10006c5b
push 0x1025417c
call fcn.10031980
mov ecx, dword [0x10254174]
add esp, 4
test ecx, ecx
je 0x10006c4d
mov eax, dword [ecx]
mov dword [0x10254174], eax
mov dword [0x1025417c], 1
test ecx, ecx
jne 0x10006c75
push 0xa8
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10006c9a
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.1000a570
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1013aa09
int3
Function at 0x10006dc0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015b065
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1024ed04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x10254178], 0xa8
jl 0x10006e1f
push 0x1025417c
call fcn.10031980
mov esi, dword [0x10254174]
add esp, 4
test esi, esi
je 0x10006e11
mov eax, dword [esi]
mov dword [0x10254174], eax
mov dword [0x1025417c], 1
test esi, esi
jne 0x10006e39
push 0xa8
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x10006e76
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.1000a570
mov byte [ebp - 4], 1
mov ecx, esi
push edi
mov dword [esi], vtable.rg_HuoShan_ChengXu::rg_PIDDaiLi6.0
call fcn.10006f60
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1013aa09
int3

Function at 0x100071d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10159d9d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1024ed04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10254178], 0x4c
jl 0x10007228
push 0x1025417c
call fcn.10031980
mov ecx, dword [0x10254174]
add esp, 4
test ecx, ecx
je 0x1000721a
mov eax, dword [ecx]
mov dword [0x10254174], eax
mov dword [0x1025417c], 1
test ecx, ecx
jne 0x1000723f
push 0x4c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10007264
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.1000b8f0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1013aa09
int3

Function at 0x10007380
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015b185
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1024ed04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x10254178], 0x4c
jl 0x100073dc
push 0x1025417c
call fcn.10031980
mov esi, dword [0x10254174]
add esp, 4
test esi, esi
je 0x100073ce
mov eax, dword [esi]
mov dword [0x10254174], eax
mov dword [0x1025417c], 1
test esi, esi
jne 0x100073f3
push 0x4c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x10007430
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.1000b8f0
mov byte [ebp - 4], 1
mov ecx, esi
push edi
mov dword [esi], vtable.rg_HuoShan_ChengXu::rg_NF_EventHandler.0
call fcn.100074f0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1013aa09
int3
Function at 0x10007680
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10159d9d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1024ed04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10254178], 0x150
jl 0x100076db
push 0x1025417c
call fcn.10031980
mov ecx, dword [0x10254174]
add esp, 4
test ecx, ecx
je 0x100076cd
mov eax, dword [ecx]
mov dword [0x10254174], eax
mov dword [0x1025417c], 1
test ecx, ecx
jne 0x100076f5
push 0x150
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1000771a
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.1000a990
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1013aa09
int3

Function at 0x100079a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015b235
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1024ed04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x10254178], 0x150
jl 0x100079ff
push 0x1025417c
call fcn.10031980
mov esi, dword [0x10254174]
add esp, 4
test esi, esi
je 0x100079f1
mov eax, dword [esi]
mov dword [0x10254174], eax
mov dword [0x1025417c], 1
test esi, esi
jne 0x10007a19
push 0x150
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x10007a62
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.1000a990
mov byte [ebp - 4], 1
mov ecx, esi
mov dword [esi], vtable.rg_HuoShan_ChengXu::rg_SOCKS5LianJie15.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
push edi
mov dword [esi + 8], eax
call fcn.1000abf0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1013aa09
int3
Function at 0x10007d10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015b398
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1024ed04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10254178], 0x2c
jl 0x10007d68
push 0x1025417c
call fcn.10031980
mov edx, dword [0x10254174]
add esp, 4
test edx, edx
je 0x10007d5a
mov eax, dword [edx]
mov dword [0x10254174], eax
mov dword [0x1025417c], 1
test edx, edx
jne 0x10007d7f
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x10007dd2
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov dword [edx], vtable.CVolObject.0
mov dword [edx + 4], 0
mov dword [edx + 8], 0
mov byte [ebp - 4], 1
mov dword [edx], vtable.rg_HuoShan_JiBen::rg_KuoZhanDuiXiangLei.0
mov byte [ebp - 4], 2
push ecx
lea ecx, [edx + 0xc]
mov dword [edx], vtable.rg_HuoShan_JiBen::rg_WenBenShuZuLei.0
call fcn.1000f3e0
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1013aa09
int3

Function at 0x10007fc0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015a9dd
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1024ed04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x10254178], 0x2c
jl 0x1000801b
push 0x1025417c
call fcn.10031980
mov ecx, dword [0x10254174]
add esp, 4
test ecx, ecx
je 0x1000800d
mov eax, dword [ecx]
mov dword [0x10254174], eax
mov dword [0x1025417c], 1
test ecx, ecx
jne 0x10008032
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10008059
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
push esi
call fcn.10007df0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1013aa09
int3

Function at 0x1000e7e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10159d9d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1024ed04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10254178], 0x2c
jl 0x1000e838
push 0x1025417c
call fcn.10031980
mov ecx, dword [0x10254174]
add esp, 4
test ecx, ecx
je 0x1000e82a
mov eax, dword [ecx]
mov dword [0x10254174], eax
mov dword [0x1025417c], 1
test ecx, ecx
jne 0x1000e84f
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1000e874
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.1000ea50
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1013aa09
int3
Function at 0x1000e880
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015ac35
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1024ed04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [0x10254178], 0x2c
jl 0x1000e8dd
push 0x1025417c
call fcn.10031980
mov edi, dword [0x10254174]
add esp, 4
test edi, edi
je 0x1000e8cf
mov eax, dword [edi]
mov dword [0x10254174], eax
mov dword [0x1025417c], 1
test edi, edi
jne 0x1000e8f4
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x1000e951
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov ecx, edi
call fcn.1000ea50
mov byte [ebp - 4], 1
lea ecx, [edi + 0x10]
mov dword [edi], vtable.CU8String.0
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [edi + 0x10]
call dword [eax + 0x44]
lea eax, [ebx + 0x10]
push eax
lea ecx, [edi + 0x10]
call fcn.10005c60
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1013aa09
int3

Function at 0x1000ede0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015c5f5
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1024ed04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10254178], 0x2c
jl 0x1000ee38
push 0x1025417c
call fcn.10031980
mov edx, dword [0x10254174]
add esp, 4
test edx, edx
je 0x1000ee2a
mov eax, dword [edx]
mov dword [0x10254174], eax
mov dword [0x1025417c], 1
test edx, edx
jne 0x1000ee4f
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x1000ee82
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.10005200
mov byte [ebp - 4], 1
mov dword [edx], vtable.CWConstString.0
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1013aa09
int3
Function at 0x1000ee90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015c63d
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1024ed04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [0x10254178], 0x2c
jl 0x1000eeed
push 0x1025417c
call fcn.10031980
mov edi, dword [0x10254174]
add esp, 4
test edi, edi
je 0x1000eedf
mov eax, dword [edi]
mov dword [0x10254174], eax
mov dword [0x1025417c], 1
test edi, edi
jne 0x1000ef04
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x1000ef6b
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov ecx, edi
call fcn.10005200
mov byte [ebp - 4], 1
mov dword [edi], vtable.CWConstString.0
mov byte [ebp - 4], 2
lea ecx, [edi + 0x10]
mov dword [edi], vtable.CWConstString.0
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [edi + 0x10]
call dword [eax + 0x44]
lea eax, [ebx + 0x10]
push eax
lea ecx, [edi + 0x10]
call fcn.10005c60
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1013aa09
int3

Function at 0x1000f590
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10159d9d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1024ed04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10254178], 0x10
jl 0x1000f5e8
push 0x1025417c
call fcn.10031980
mov ecx, dword [0x10254174]
add esp, 4
test ecx, ecx
je 0x1000f5da
mov eax, dword [ecx]
mov dword [0x10254174], eax
mov dword [0x1025417c], 1
test ecx, ecx
jne 0x1000f5ff
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1000f624
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.10011040
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1013aa09
int3
Function at 0x1000f6b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015c7f5
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1024ed04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x10254178], 0x10
jl 0x1000f70c
push 0x1025417c
call fcn.10031980
mov esi, dword [0x10254174]
add esp, 4
test esi, esi
je 0x1000f6fe
mov eax, dword [esi]
mov dword [0x10254174], eax
mov dword [0x1025417c], 1
test esi, esi
jne 0x1000f723
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x1000f764
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.10011040
mov byte [ebp - 4], 1
mov dword [esi], vtable.rg_HuoShan_socks::rg_SOCKS5_TCP.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1013aa09
int3

Function at 0x1000fde0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015aeb5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1024ed04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10254178], 0x10
jl 0x1000fe39
push 0x1025417c
call fcn.10031980
mov esi, dword [0x10254174]
add esp, 4
test esi, esi
je 0x1000fe2b
mov eax, dword [esi]
mov dword [0x10254174], eax
mov dword [0x1025417c], 1
test esi, esi
jne 0x1000fe50
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x1000fe98
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 1
mov ecx, esi
mov dword [esi], vtable.rg_HuoShan_socks::rg_SOCKS5_UDP.0
call fcn.10010360
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1013aa09
int3