joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438d80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, dword [ecx + 8]
test esi, esi
je 0x438e70
xor eax, eax
cmp dword [ecx], 0
jne 0x438ebc
mov dword [esp + 4], 0x18
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x20], eax
mov dword [esp], 0x20272625
mov eax, 0x8bd5d989
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + eax + 0x742a2677]
lea edi, [eax + 0x742a2700]
and edi, ebx
mov ebp, edi
and ebp, 0xffffff8d
mov edx, edi
and edx, 2
mov esi, edi
or esi, 0xfffffffd
inc esi
imul esi, ebp
or edi, 2
imul edi, edx
lea ebp, [eax + ebx]
add esi, ebx
sub esi, edi
add esi, eax
mov edx, esi
and edx, 0x52
xor esi, 0x52
lea edx, [esi + edx*2]
and ebp, 1
xor edx, 1
lea edx, [edx + ebp*2]
mov byte [esp + eax + 0x742a2677], dl
inc eax
cmp eax, 0x8bd5d98d
jne 0x438df0
mov eax, dword [esp]
mov esi, dword [0x44ae04]
test esi, esi
je 0x438ebc
xor edi, edi
mov ebx, dword [0x44ae08]
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xef01f5a1
je 0x438ec6
inc edi
cmp esi, edi
jne 0x438e60
jmp 0x438ebc
mov dword [esp + 4], 0x53121118
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
xor edx, edx
mov al, 0xc5
mov ecx, 0xffffffff
nop
nop
nop
mov ah, dl
and ah, 0xfc
mov ebx, eax
sub bl, ah
mov ah, cl
or ah, 0xc4
add ah, bl
xor ah, byte [esp + edx + 4]
add ah, 0x2c
mov byte [esp + edx + 4], ah
lea esi, [edx + 1]
add al, 2
dec ecx
mov edx, esi
cmp esi, 7
jne 0x438e90
mov eax, dword [esp + 4]
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x438ebc
lea eax, [esp + 0x1c]
lea edx, [esp + 4]
push eax
push edx
push dword [esp + 0x40]
push ecx
push 4
push esi
push dword [0x44ae0c]
call fcn.0043bd80
add esp, 0x1c
jmp 0x438ebc

Function at 0x438f00
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x438fde
push ebp
push ebx
push edi
push esi
sub esp, 8
mov dword [esp + 4], eax
mov dword [esp], 0x20272625
mov edx, 0x8bd5d989
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + edx + 0x742a2677]
lea edi, [edx + 0x742a2700]
and edi, ebx
mov ebp, edi
and ebp, 0xffffff8d
mov eax, edi
and eax, 2
mov esi, edi
or esi, 0xfffffffd
inc esi
imul esi, ebp
or edi, 2
imul edi, eax
lea ebp, [edx + ebx]
add esi, ebx
sub esi, edi
add esi, edx
mov eax, esi
and eax, 0x52
xor esi, 0x52
lea eax, [esi + eax*2]
and ebp, 1
xor eax, 1
lea eax, [eax + ebp*2]
mov byte [esp + edx + 0x742a2677], al
inc edx
cmp edx, 0x8bd5d98d
jne 0x438f30
mov edx, dword [0x44ae04]
test edx, edx
je 0x438fd1
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44ae08]
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x438fb0
inc edi
cmp edx, edi
jne 0x438fa0
jmp 0x438fd1
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x438fd1
push dword [esp + 4]
push 1
push edx
push dword [0x44ae0c]
mov esi, ecx
call fcn.0043bd80
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x439250
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov ebx, dword [esp + 0x28]
mov eax, dword [ecx + 4]
test eax, eax
jne 0x4392dc
push 0xbbf966b4
push dword [0x44adf8]
call fcn.0043eac0
add esp, 8
test eax, eax
je 0x4392a1
mov ecx, dword [esi]
test ecx, ecx
je 0x4392d9
mov dword [esp], 0
mov edx, esp
push edx
push ecx
call eax
test eax, eax
je 0x4392b5
cmp dword [esp], 0
je 0x4392b5
mov dword [esi + 4], 3
jmp 0x4392d9
mov ecx, ebx
mov dword [esi + 4], 1
mov eax, dword [esi]
mov dword [esp + 4], eax
jmp 0x439387
lea eax, [esp + 8]
push eax
call fcn.0043f2c0
add esp, 4
test al, al
je 0x4392d9
mov eax, dword [esp + 8]
mov ecx, 2
cmp eax, 3
je 0x4392d6
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov dword [esp + 4], ecx
mov ecx, ebx
cmp eax, 2
jne 0x439387
mov dword [esp], 0x20272625
mov eax, 0x8bd5d989
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + eax + 0x742a2677]
lea esi, [eax + 0x742a2700]
and esi, ebx
mov ebp, esi
and ebp, 0xffffff8d
mov edi, esi
and edi, 2
mov edx, esi
or edx, 0xfffffffd
inc edx
imul edx, ebp
or esi, 2
imul esi, edi
lea ebp, [eax + ebx]
add edx, ebx
sub edx, esi
add edx, eax
mov esi, edx
and esi, 0x52
xor edx, 0x52
lea edx, [edx + esi*2]
and ebp, 1
xor edx, 1
lea edx, [edx + ebp*2]
mov byte [esp + eax + 0x742a2677], dl
inc eax
cmp eax, 0x8bd5d98d
jne 0x439300
mov eax, dword [esp]
mov edx, dword [0x44ae04]
test edx, edx
je 0x43944a
xor esi, esi
mov ebx, dword [0x44ae08]
nop
nop
cmp dword [ebx + esi*8], 0xc3cdc4a6
je 0x439420
inc esi
cmp edx, esi
jne 0x439370
jmp 0x43944a
mov dword [esp], 0x20272625
mov eax, 0x8bd5d989
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + eax + 0x742a2677]
lea esi, [eax + 0x742a2700]
and esi, ebx
mov edi, esi
and edi, 0xffffff8d
mov ebp, esi
and ebp, 2
mov edx, esi
or edx, 0xfffffffd
inc edx
imul edx, edi
or esi, 2
imul esi, ebp
lea ebp, [eax + ebx]
add edx, ebx
sub edx, esi
add edx, eax
mov esi, edx
and esi, 0x52
xor edx, 0x52
lea edx, [edx + esi*2]
and ebp, 1
xor edx, 1
lea edx, [edx + ebp*2]
mov byte [esp + eax + 0x742a2677], dl
inc eax
cmp eax, 0x8bd5d98d
jne 0x4393a0
mov eax, dword [esp]
mov edx, dword [0x44ae04]
test edx, edx
je 0x43944a
xor esi, esi
mov ebx, dword [0x44ae08]
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0xae6e2b0b
je 0x439420
inc esi
cmp edx, esi
jne 0x439410
jmp 0x43944a
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x43944a
push dword [esp + 0x2c]
push ecx
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x14]
push 5
push edx
push dword [0x44ae0c]
call fcn.0043bd80
add esp, 0x20
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x439880
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov esi, ecx
mov edi, dword [ebp + 0x1c]
test edi, edi
jne 0x439899
lea edi, [esp + 0x10]
mov eax, dword [esi + 4]
test eax, eax
je 0x4398aa
cmp eax, 2
je 0x439920
jmp 0x43994d
push 0xbbf966b4
push dword [0x44adf8]
call fcn.0043eac0
add esp, 8
test eax, eax
je 0x4398eb
mov ecx, dword [esi]
test ecx, ecx
je 0x439918
mov dword [esp + 4], 0
lea edx, [esp + 4]
push edx
push ecx
call eax
test eax, eax
je 0x4398f4
cmp dword [esp + 4], 0
je 0x4398f4
mov dword [esi + 4], 3
jmp 0x439918
mov dword [esi + 4], 1
jmp 0x43994d
lea eax, [esp + 0xc]
push eax
call fcn.0043f2c0
add esp, 4
test al, al
je 0x439918
mov eax, dword [esp + 0xc]
mov ecx, 2
cmp eax, 3
je 0x439915
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
cmp eax, 2
jne 0x43994d
mov ebx, dword [ebp + 0x18]
push 0x732f71fd
push dword [0x452e20]
call fcn.0043eac0
add esp, 8
push edi
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call eax
jmp 0x439a07
mov eax, dword [esi]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x20272625
mov eax, 0x8bd5d989
movzx edx, byte [esp + eax + 0x742a267b]
lea ebx, [eax + 0x742a2700]
and ebx, edx
mov ecx, ebx
and ecx, 0xffffff8d
mov esi, ebx
or esi, 0xfffffffd
inc esi
imul esi, ecx
mov ecx, ebx
and ecx, 2
or ebx, 2
imul ebx, ecx
add esi, edx
sub esi, ebx
add esi, eax
mov ecx, esi
and ecx, 0x52
xor esi, 0x52
lea ecx, [esi + ecx*2]
add edx, eax
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
mov byte [esp + eax + 0x742a267b], cl
inc eax
cmp eax, 0x8bd5d98d
jne 0x439960
mov eax, dword [esp + 4]
mov edx, dword [0x44ae04]
test edx, edx
je 0x439a07
xor esi, esi
mov ebx, dword [0x44ae08]
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0xfd743ac4
je 0x4399e0
inc esi
cmp edx, esi
jne 0x4399d0
jmp 0x439a07
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x439a07
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
push dword [esp + 0x18]
push 5
push edx
push dword [0x44ae0c]
call fcn.0043bd80
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x43bc90
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
xor edx, edx
test eax, eax
sete dl
jmp dword [edx*4 + 0x448e30]

Function at 0x43d060
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edx, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x2c]
mov ecx, ebx
add ecx, ebp
adc edx, 0
xor eax, eax
mov esi, 0xfffffffe
cmp esi, ecx
mov ecx, 0
sbb ecx, edx
mov esi, dword [esp + 0x28]
jb 0x43d0d0
mov ecx, ebx
shr ecx, 2
mov eax, ebp
mov edi, esi
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
mov edx, ebx
and edx, 0xfffffffc
add esi, edx
add edx, ebp
mov ecx, ebx
shr ecx, 1
and ecx, 1
mov eax, edx
mov edi, esi
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
xor eax, eax
test bl, 1
je 0x43d22e
and ebx, 2
movzx ecx, byte [edx + ebx]
mov byte [esi + ebx], cl
jmp 0x43d22e
mov dword [esp], 0x20272625
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax]
lea edx, [eax + 0x89]
mov edi, 0x76
sub edi, eax
or edx, ecx
not ecx
or ecx, edi
and ecx, edx
add cl, 0x53
mov byte [esp + eax], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 4
jb 0x43d0e0
mov eax, dword [esp]
mov ecx, dword [0x44ae04]
test ecx, ecx
je 0x43d16a
xor edx, edx
mov edi, dword [0x44ae08]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x89c57e52
je 0x43d140
inc edx
cmp ecx, edx
jne 0x43d130
jmp 0x43d16a
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x43d16a
lea eax, [esp + 8]
push 2
push 0
push 0
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 7
push ecx
push dword [0x44ae0c]
call fcn.0043bd80
add esp, 0x28
test eax, eax
mov edi, dword [esp + 0x24]
js 0x43d22e
push 0x732f71fd
push dword [0x452e20]
call fcn.0043eac0
add esp, 8
push 0
push 0
push ebx
push esi
push edi
push ebp
push dword [esp + 0x20]
call eax
mov ecx, dword [esp + 8]
mov dword [esp + 4], 0x20272625
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + edx + 4]
lea esi, [edx + 0x89]
mov edi, 0x76
sub edi, edx
or esi, ebx
not ebx
or ebx, edi
and ebx, esi
add bl, 0x53
mov byte [esp + edx + 4], bl
mov esi, edx
and esi, 1
xor edx, 1
lea edx, [edx + esi*2]
cmp edx, 4
jb 0x43d1b0
mov edx, dword [0x44ae04]
test edx, edx
je 0x43d22e
mov esi, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x44ae08]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x43d210
inc edi
cmp edx, edi
jne 0x43d200
jmp 0x43d22e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43d22e
push ecx
push 1
push edx
push dword [0x44ae0c]
mov esi, eax
call fcn.0043bd80
mov eax, esi
add esp, 0x10
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43f6a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + ecx], 0
lea ecx, [ecx + 2]
jne 0x43f6c0
lea edx, [esi + ecx]
add edx, 0xfffffffe
mov eax, esi
not eax
and eax, edx
add ecx, esi
mov edx, 1
sub edx, ecx
and edx, esi
sub eax, edx
mov ebx, eax
sar ebx, 1
cmp ebx, 0xfffffffb
jge 0x43f6f3
mov eax, 0xffffffff
jmp 0x43f6f6
add eax, 0xa
push eax
call fcn.0040c860
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x43f741
add esi, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x43f730
mov word [ecx], 0
lea ecx, [ebx*2 + 8]
mov word [esp], cx
and ebx, 1
xor ecx, 2
lea ecx, [ecx + ebx*4]
mov word [esp + 2], cx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0x40
mov ecx, esp
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0x585b5a45
mov word [esp + 0x24], 0
mov byte [esp + 0x26], 0
mov ecx, 0xadfebc0f
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x52014411]
mov ebx, edx
and ebx, ecx
add bl, bl
sub dl, bl
movzx edx, dl
add edx, ecx
add dl, 0xb5
mov byte [esp + ecx + 0x52014411], dl
inc ecx
cmp ecx, 0xadfebc16
jne 0x43f7b0
mov esi, dword [esp + 0x20]
mov ecx, dword [0x44ae04]
test ecx, ecx
je 0x43f829
xor edx, edx
mov ebx, dword [0x44ae08]
nop
nop
cmp dword [ebx + edx*8], 0x50dc24c7
je 0x43f800
inc edx
cmp ecx, edx
jne 0x43f7f0
jmp 0x43f829
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x43f829
lea edx, [esp + 0x20]
lea esi, [esp + 8]
push edx
push esi
push 2
push ecx
push dword [0x44ae0c]
mov ebx, eax
call fcn.0043bd80
add esp, 0x14
mov esi, eax
mov eax, ebx
push eax
call fcn.0040c870
add esp, 4
test edi, edi
je 0x43f83c
mov eax, dword [esp + 0x40]
mov dword [edi], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1000113d
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, eax
xor ebx, ebx
push ebx
push dword [edi + 0x12]
push dword [edi + 0xe]
push dword [edi + 0xa]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x10001188
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push dword [edi + 0xa]
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [ebp + 8]
or dword [edi + 0xa], 0xffffffff
push 2
mov dword [edi + 0x12], ebx
call fcn.10001040
pop ecx
xor ecx, ecx
test eax, eax
setns cl
lea eax, [ecx - 1]
jmp 0x100011dd
sub dword [edi + 0x12], eax
mov ecx, dword [edi + 0x12]
push esi
mov esi, dword [edi + 0xe]
lea edx, [esi + eax]
mov eax, esi
call fcn.10011277
mov al, byte [edi + 0x20]
test al, 0x20
je 0x100011c5
mov ecx, dword [edi + 0x16]
shr ecx, 2
cmp dword [edi + 0x12], ecx
ja 0x100011c5
mov esi, dword [ebp + 8]
push ebx
push ebx
push dword [edi + 6]
and al, 0xdf
push 7
mov byte [edi + 0x20], al
call fcn.10001286
add esp, 0x10
test byte [edi + 0x20], 4
pop esi
je 0x100011db
cmp dword [edi + 0x12], ebx
jne 0x100011db
mov eax, dword [ebp + 8]
push ebx
call fcn.10001040
pop ecx
xor eax, eax
pop edi
pop ebx
pop ebp
ret

Function at 0x100011e1
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, eax
mov eax, dword [0x1002cbcc]
xor ebx, ebx
mov dword [ebp - 4], eax
cmp dword [edi + 6], ebx
jne 0x100011fd
or eax, 0xffffffff
jmp 0x10001262
push esi
cmp dword [ebp + 8], ebx
je 0x1000124a
push ebx
push 0x1000
lea esi, [edi + 0x2b]
push esi
push dword [edi + 0xa]
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, ebx
je 0x1000126a
cmp eax, 0xffffffff
jne 0x10001266
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
je 0x10001233
cmp eax, 0x2733
jne 0x1000126a
xor eax, eax
add dword [edi + 0x21], eax
push eax
push esi
push dword [edi + 6]
mov esi, dword [ebp - 4]
push 4
call fcn.10001286
add esp, 0x10
cmp dword [ebp + 0xc], ebx
je 0x1000125f
cmp dword [edi + 0x12], ebx
jbe 0x1000125f
push dword [ebp - 4]
mov eax, edi
call fcn.1000113d
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
leave
ret
cmp eax, ebx
jge 0x10001235
push dword [edi + 0xa]
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [ebp - 4]
or dword [edi + 0xa], 0xffffffff
push 2
mov dword [edi + 0x12], ebx
call fcn.10001040
jmp 0x1000125e
Function at 0x10001345
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [0x1002cbcc]
push ebx
push esi
lea esi, [ecx + 0x2464]
mov edx, dword [esi]
push edi
xor eax, eax
xor edi, edi
mov dword [ebp - 4], ecx
mov ebx, 0x20000
cmp edx, 0x1fff6
ja 0x100013bd
mov edi, ebx
sub edi, edx
mov eax, 0x100a
cmp edi, eax
ja 0x1000137d
mov eax, edi
push 0
push eax
mov eax, dword [ecx + 0x2460]
add eax, edx
push eax
push dword [ecx + 4]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jne 0x1000139e
or eax, 0xffffffff
jmp 0x1000141e
cmp eax, 0xffffffff
jne 0x100013bb
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
je 0x100013b7
cmp eax, 0x2733
jne 0x10001396
xor eax, eax
jmp 0x1000141e
mov edi, eax
mov ecx, dword [esi]
lea edx, [ecx + edi]
cmp edx, ebx
jbe 0x100013ce
mov dword [esi], 4
jmp 0x100013d2
add ecx, eax
mov dword [esi], ecx
mov ecx, dword [esi]
mov ebx, dword [ebp - 4]
mov edi, dword [ebx + 0x2460]
cmp ecx, 0xa
jb 0x1000141b
mov eax, dword [edi + 6]
test eax, eax
je 0x10001423
cmp eax, 0x100a
ja 0x10001427
cmp ecx, eax
jb 0x1000141b
push ebx
call fcn.1000194b
pop ecx
test eax, eax
js 0x1000142c
mov eax, dword [edi + 6]
sub dword [esi], eax
mov eax, dword [ebx + 0x2460]
mov edx, dword [edi + 6]
mov ecx, dword [esi]
add edx, eax
call fcn.10011277
cmp dword [esi], 0
ja 0x100013d2
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
push 0xfffffffffffffff9
jmp 0x10001429
push 0xfffffffffffffff8
pop eax
jmp 0x1000141e
push 0xfffffffffffffffd
jmp 0x10001429

Function at 0x100023c9
Capabilities:
Terminate thread

Disassembly:
cmp dword [0x1002dcd4], 0
je 0x10002419
mov eax, dword [0x1002cbc8]
test eax, eax
je 0x10002419
push eax
mov dword [0x1002dcd0], 1
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [0x1002dcd4]
push 0x4e20
push dword [eax]
call dword [0x1002df1c]
test eax, eax
je 0x10002419
mov eax, dword [0x1002dcd4]
push 1
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [0x1002dcd4]
and dword [eax], 0
ret
Function at 0x100027af
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [edi + 0xa]
mov dword [ebp - 4], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
lea eax, [ebp - 0x7c]
push 4
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x80], 0x1000005
call fcn.10011255
lea eax, [ebp - 0x78]
push 2
push eax
lea eax, [ebp - 0x12]
call fcn.10011255
push 0xa
lea eax, [ebp - 0x80]
push eax
push dword [edi + 6]
push 4
call fcn.10001286
add esp, 0x20
mov byte [edi + 0x20], 2
xor eax, eax
leave
ret

Function at 0x10002cca
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
push edi
lea esi, [ebp - 0x18]
mov dword [ebp - 4], 0xffffffe1
call fcn.10011475
lea esi, [ebp - 0x10]
call fcn.10011475
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, esi
push 1
mov dword [ebp - 0x1c], eax
push 0x10
lea eax, [ebp - 0x28]
push eax
push dword [ebp + 8]
call fcn.10007370
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x10002d1e
push 0xffffffffffffffe0
pop eax
jmp 0x10002d96
push 0x3e8
push dword [edi]
call dword [0x1002df1c]
test eax, eax
je 0x10002d59
cmp eax, 0xffffffff
je 0x10002d72
lea esi, [ebp - 0x18]
call fcn.10011475
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
add ecx, 0xf0
adc eax, 0
cmp dword [ebp - 0x14], eax
jg 0x10002d79
jl 0x10002d1e
cmp dword [ebp - 0x18], ecx
jae 0x10002d79
jmp 0x10002d1e
lea eax, [ebp - 4]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
jne 0x10002d79
mov dword [ebp - 4], 0xffffffdf
jmp 0x10002d79
mov dword [ebp - 4], 0xffffffde
cmp dword [ebp - 4], 0xffffffe1
jne 0x10002d89
push 0
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 1
mov eax, edi
call fcn.100072cb
mov eax, dword [ebp - 4]
pop ecx
pop edi
pop esi
leave
ret
Function at 0x10002f80
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
push edi
xor ebx, ebx
jmp 0x10002fde
lea esi, [esp + 0x10]
call fcn.10011475
mov ecx, dword [0x1002cc00]
mov eax, dword [0x1002cc04]
add ecx, 0x3840
adc eax, ebx
cmp eax, dword [esp + 0x14]
jg 0x100030c7
jl 0x10002fc2
cmp ecx, dword [esp + 0x10]
jae 0x100030c7
push ebx
push dword [0x1002cbf4]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x10002ff0
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push dword [0x1002cbdc]
call fcn.100134d3
pop ecx
pop ecx
test eax, eax
js 0x10002f90
mov esi, 0x1002cc00
call fcn.10011475
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
push ebx
push ebx
push 0x1002cbf4
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor eax, eax
lea edi, [esp + 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [0x1002cc08]
push 0x31
mov dword [esp + 0x1c], eax
call fcn.10011e02
pop ecx
test eax, eax
jne 0x10003044
call fcn.10013f8c
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
push 0x10002a44
push eax
call fcn.10002d9a
mov esi, eax
pop ecx
pop ecx
cmp esi, ebx
jl 0x1000308f
push dword [0x1002cc90]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
push 0x27
call fcn.10011deb
push 0x1002dfe4
push ebx
call fcn.10011fff
add esp, 0x10
cmp dword [0x1002dd0c], ebx
je 0x1000308f
mov dword [0x1002dd00], 1
cmp dword [esp + 0x1c], ebx
je 0x100030a0
lea eax, [esp + 0x1c]
push eax
call fcn.100140fe
pop ecx
push dword [0x1002cbf4]
call dword [0x1002dddc]
push dword [0x1002cbdc]
mov dword [0x1002cbf4], ebx
call fcn.100134f7
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
jmp 0x100030c0