joyce8/EMBER2024-capa huggingface dataset:
Function at 0xeb19f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x94
mov eax, dword [0xf387a0]
xor eax, esp
mov dword [esp + 0x8c], eax
mov eax, dword [esp + 0xa0]
push ebx
mov ebx, dword [esp + 0xb0]
push ebp
push esi
mov esi, dword [esp + 0xb0]
push edi
xor ebp, ebp
push ecx
lea edi, [esp + 0x2c]
mov dword [esp + 0x18], eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x40], ebp
mov dword [esp + 0x3c], ebp
call fcn.00eb5370
add esp, 4
cmp eax, ebp
jne 0xeb1b85
mov edx, dword [esp + 0xb8]
mov edi, dword [esp + 0xa8]
mov eax, 1
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x70], ebp
mov dword [esp + 0x80], ebp
mov dword [esp + 0x54], ebp
mov dword [esp + 0x58], ebp
mov ebp, dword [esp + 0xac]
mov dword [esp + 0x3c], esi
mov dword [esp + 0x50], edx
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], eax
jmp 0xeb1a90
mov dword [esp + 0x1c], 0
mov dword [esp + 0x10], 0x40000
test ebp, ebp
ja 0xeb1ab2
jb 0xeb1aae
cmp edi, 0x40000
jae 0xeb1ab2
mov dword [esp + 0x10], edi
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x18]
mov edx, dword [eax]
lea ecx, [esp + 0x20]
push ecx
push eax
call edx
mov esi, eax
add esp, 0xc
test esi, esi
jne 0xeb1b71
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x4c]
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0xbc]
push 1
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x20]
push edx
push eax
push ecx
lea eax, [esp + 0x3c]
call fcn.00eb4fc0
mov esi, eax
mov eax, dword [esp + 0x2c]
sub dword [esp + 0x24], eax
add esp, 0x14
sub edi, eax
sbb ebp, 0
test esi, esi
jne 0xeb1b71
mov ecx, dword [esp + 0x20]
cmp ecx, 1
je 0xeb1b5b
mov edx, dword [esp + 0xb8]
cmp edx, dword [esp + 0x4c]
jne 0xeb1b37
mov edx, edi
or edx, ebp
jne 0xeb1b37
cmp ecx, 4
je 0xeb1b71
test eax, eax
jne 0xeb1b41
cmp ebx, dword [esp + 0x4c]
je 0xeb1b6c
push eax
mov eax, dword [esp + 0x18]
push eax
mov eax, dword [eax + 4]
call eax
mov esi, eax
add esp, 8
test esi, esi
je 0xeb1a90
jmp 0xeb1b71
mov ecx, dword [esp + 0xb8]
cmp ecx, dword [esp + 0x4c]
jne 0xeb1b6c
or edi, ebp
je 0xeb1b71
mov esi, 1
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x24]
push edx
push eax
mov eax, dword [eax + 4]
call eax
add esp, 8
mov eax, esi
mov ecx, dword [esp + 0x9c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00eb9637
add esp, 0x94
ret
Function at 0xeb30a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
mov ecx, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [ecx]
push edi
xor edi, edi
and esi, 7
cmp eax, 5
jae 0xeb30bf
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret
sub eax, 4
push ebp
lea ebp, [ebx + eax]
mov dword [esp + 0x10], ebp
lea ebx, [ebx]
lea edx, [edi + ebx]
cmp edx, ebp
jae 0xeb30e4
mov al, byte [edx]
and al, 0xfe
cmp al, 0xe8
je 0xeb30e4
inc edx
cmp edx, ebp
jb 0xeb30d7
mov ecx, edx
sub ecx, edi
mov eax, edx
sub eax, ebx
sub ecx, ebx
mov edi, eax
cmp edx, ebp
jae 0xeb31b4
cmp ecx, 2
jbe 0xeb3183
xor esi, esi
movzx ecx, byte [edx + 4]
lea eax, [ecx + 1]
test al, 0xfe
jne 0xeb31a9
movzx eax, byte [edx + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 1]
shl ecx, 8
or ecx, eax
add edi, 5
mov eax, ecx
sub eax, edi
test esi, esi
je 0xeb3161
and esi, 6
add esi, esi
add esi, esi
mov ebx, eax
mov ecx, esi
shr ebx, cl
inc ebx
test bl, 0xfe
jne 0xeb3157
mov ebx, 0x100
shl ebx, cl
dec ebx
xor eax, ebx
sub eax, edi
mov ebp, dword [esp + 0x10]
mov ebx, dword [esp + 0x18]
xor esi, esi
mov ecx, eax
shr ecx, 8
mov byte [edx + 1], al
mov byte [edx + 2], cl
mov ecx, eax
shr eax, 0x18
shr ecx, 0x10
and al, 1
neg al
mov byte [edx + 3], cl
mov byte [edx + 4], al
jmp 0xeb30d0
shr esi, cl
test esi, esi
je 0xeb3103
cmp esi, 4
ja 0xeb31a9
cmp esi, 3
je 0xeb31a9
mov ecx, esi
shr ecx, 1
movzx eax, byte [ecx + edx + 1]
inc eax
test al, 0xfe
jne 0xeb3103
or esi, 8
shr esi, 1
inc edi
jmp 0xeb30d0
pop ebp
cmp ecx, 2
jbe 0xeb31c9
mov edx, dword [esp + 0x18]
xor esi, esi
mov eax, edi
pop edi
mov dword [edx], esi
pop esi
pop ebx
pop ecx
ret
mov edx, dword [esp + 0x18]
shr esi, cl
mov eax, edi
pop edi
mov dword [edx], esi
pop esi
pop ebx
pop ecx
ret
Function at 0xeb71c2
Capabilities:
Write file on windows

Disassembly:
push 0x48
mov eax, 0xf0dd28
call fcn.00ebf2c6
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x3c], ebx
je 0xeb72d4
cmp byte [esi + 0x42], bl
je 0xeb72d4
mov eax, dword [esi]
mov edi, 0xffff
push edi
call dword [eax + 4]
movzx eax, ax
cmp di, ax
jne 0xeb71fe
xor al, al
jmp 0xeb72d6
push ebx
push 8
lea ecx, [ebp - 0x2c]
call fcn.00e61c30
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00e7cf20
mov ecx, eax
call fcn.00e6aa60
mov edi, dword [ebp - 0x18]
mov ebx, eax
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00e7cf20
mov ecx, eax
call fcn.00e6aa60
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x30]
push eax
add edi, ebx
push edi
push dword [ebp - 0x34]
lea eax, [esi + 0x44]
push eax
call dword [edx + 0x18]
sub eax, 0
je 0xeb726e
dec eax
je 0xeb7272
dec eax
dec eax
je 0xeb72d0
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00e517c0
mov al, bl
jmp 0xeb72d6
mov byte [esi + 0x42], 0
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00e7cf20
mov ecx, eax
call fcn.00e6aa60
mov edi, dword [ebp - 0x30]
sub edi, eax
je 0xeb72b2
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00e7cf20
mov ecx, eax
call fcn.00e6aa60
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00ebb234
add esp, 0x10
cmp edi, eax
jne 0xeb725c
cmp byte [esi + 0x42], 0
je 0xeb72d0
test edi, edi
jne 0xeb720c
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.00e52d50
jmp 0xeb720c
mov bl, 1
jmp 0xeb725e
mov al, 1
call fcn.00ebf310
ret
Function at 0xeb737d
Capabilities:
Write file on windows

Disassembly:
push 0x54
mov eax, 0xf0dd96
call fcn.00ebf2c6
mov edi, dword [ebp + 8]
mov eax, 0xffff
mov esi, ecx
cmp ax, di
jne 0xeb73a7
lea eax, [ebp + 8]
push eax
call fcn.00e9ae80
pop ecx
jmp 0xeb7522
mov eax, dword [esi + 0x24]
mov ecx, dword [eax]
xor ebx, ebx
cmp ecx, ebx
je 0xeb73d5
mov eax, dword [esi + 0x34]
mov edx, dword [eax]
lea edx, [ecx + edx*2]
cmp ecx, edx
jae 0xeb73d5
dec dword [eax]
mov esi, dword [esi + 0x24]
mov eax, dword [esi]
lea ecx, [eax + 2]
mov dword [esi], ecx
mov word [eax], di
mov ax, di
jmp 0xeb7522
mov eax, dword [esi + 0x4c]
cmp eax, ebx
je 0xeb751d
cmp dword [esi + 0x3c], ebx
jne 0xeb73fe
push eax
push edi
call fcn.00eb6b3e
pop ecx
test al, al
pop ecx
movzx eax, di
jne 0xeb7522
jmp 0xeb751d
movzx eax, di
push ebx
push 8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x30], eax
call fcn.00e61c30
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], ebx
call fcn.00e7cf20
mov ecx, eax
call fcn.00e6aa60
mov edi, dword [ebp - 0x18]
mov ebx, eax
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00e7cf20
mov ecx, eax
call fcn.00e6aa60
lea edx, [ebp - 0x38]
add edi, ebx
push edx
lea ebx, [esi + 0x44]
jmp 0xeb74ef
cmp eax, 1
jg 0xeb752a
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00e7cf20
mov ecx, eax
call fcn.00e6aa60
mov edi, dword [ebp - 0x38]
sub edi, eax
je 0xeb7494
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00e7cf20
mov ecx, eax
call fcn.00e6aa60
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00ebb234
add esp, 0x10
cmp edi, eax
jne 0xeb7511
lea eax, [ebp - 0x30]
mov byte [esi + 0x42], 1
cmp dword [ebp - 0x3c], eax
jne 0xeb755a
test edi, edi
ja 0xeb74ba
cmp dword [ebp - 0x18], 0x20
push 0
lea ecx, [ebp - 0x2c]
jae 0xeb7516
push 8
call fcn.00e52d50
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00e7cf20
mov ecx, eax
call fcn.00e6aa60
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00e7cf20
mov ecx, eax
call fcn.00e6aa60
lea edx, [ebp - 0x38]
push edx
mov edx, dword [ebp - 0x40]
add edi, edx
mov ecx, dword [esi + 0x3c]
push edi
push eax
lea edx, [ebp - 0x3c]
push edx
lea edx, [ebp - 0x2e]
push edx
lea edx, [ebp - 0x30]
push edx
mov dword [ebp - 0x34], eax
mov eax, dword [ecx]
push ebx
call dword [eax + 0x14]
test eax, eax
jge 0xeb744b
push 0
lea ecx, [ebp - 0x2c]
push 1
call fcn.00e517c0
mov eax, 0xffff
call fcn.00ebf310
ret 4
cmp eax, 3
jne 0xeb7511
push dword [esi + 0x4c]
push dword [ebp - 0x30]
call fcn.00eb6b3e
movzx esi, word [ebp + 8]
pop ecx
pop ecx
test al, al
jne 0xeb7549
mov esi, 0xffff
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00e517c0
mov ax, si
jmp 0xeb7522
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00e517c0
mov ax, word [ebp + 8]
jmp 0xeb7522
Function at 0xeb7ba0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0xf3aa8c]
mov dword [ebp - 4], eax
jmp 0xeb7bb9
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0xeb7bd6
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0xeb7bb0
mov esp, ebp
pop ebp
ret

Function at 0xeb7be0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0xf3aa9c], eax
je 0xeb7bfe
mov eax, 0x10dd
jmp 0xeb7cdf
mov eax, dword [0xf3aaac]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0xeb7c7c
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0xeb7c5a
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0xeb7c5a
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.00eb7d50
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.00eb98f8
add esp, 4
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0xeb7c06
mov dword [0xf3aaac], 0
call fcn.00eb7cf0
mov ecx, dword [0xf3aaa8]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0
je 0xeb7cc9
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.00eb98f8
add esp, 4
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
jmp 0xeb7c94
mov dword [0xf3aaa8], 0
mov dword [0xf3aa9c], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0xeb8250
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0xeb8265
xor eax, eax
jmp 0xeb82da
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0x10000
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
jmp 0xeb8292
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x38d
jae 0xeb82d5
mov edx, dword [ebp - 0x10]
imul edx, edx, 0x48
mov eax, dword [ebp - 0xc]
cmp dword [eax + edx + 0x40], 0
je 0xeb82d3
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 4]
jb 0xeb82cf
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 8]
jb 0xeb82d3
xor eax, eax
jmp 0xeb82da
jmp 0xeb8289
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0xeb8380
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0xf3aaa0], 0
je 0xeb8399
mov eax, dword [0xf3aaa0]
jmp 0xeb8439
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0xeb83ab
xor eax, eax
jmp 0xeb8439
push 8
call fcn.00eb9980
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0xeb8401
mov dword [ebp - 4], 8
cmp dword [ebp - 8], 0
je 0xeb83ea
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.00eb98f8
add esp, 4
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
mov dword [0xf3aaa0], eax
mov dword [0xf3aaa4], 0
mov eax, dword [ebp - 4]
jmp 0xeb8439
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0xeb841b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0xeb83cb
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 8]
mov edx, dword [0xf3aaa8]
mov dword [ecx], edx
mov eax, dword [ebp - 8]
mov dword [0xf3aaa8], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0xeb8c50
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.00eb8d20
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0xeb8d0c
cmp dword [ebp - 4], 0x50000000
jb 0xeb8c8c
cmp dword [ebp - 4], 0x80000000
ja 0xeb8c8c
mov dword [ebp - 4], 0x80010000
jmp 0xeb8c65
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.00ec1460
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0xeb8cb2
jmp 0xeb8d0c
cmp dword [ebp - 0x10], 0x10000
jne 0xeb8cf5
cmp dword [ebp - 0x14], 0x10000
jb 0xeb8cf5
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0xeb8ce8
mov eax, dword [ebp - 0x24]
jmp 0xeb8d0e
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0xeb8d07
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x14]
push ecx
call fcn.00eb8d20
add esp, 4
mov dword [ebp - 4], eax
jmp 0xeb8c65
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0xeb8d50
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.00eb8e20
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0xeb8e14
cmp dword [ebp - 4], 0x50000000
jb 0xeb8d91
cmp dword [ebp - 4], 0x80000000
ja 0xeb8d91
mov dword [ebp - 4], 0x4fff0000
jmp 0xeb8d6a
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.00ec1460
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0xeb8db7
jmp 0xeb8e14
cmp dword [ebp - 0x10], 0x10000
jne 0xeb8dfa
cmp dword [ebp - 0x14], 0x10000
jb 0xeb8dfa
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0xeb8ded
mov eax, dword [ebp - 0x24]
jmp 0xeb8e16
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0xeb8e0f
mov ecx, dword [ebp - 0x1c]
sub ecx, 0x10000
push ecx
call fcn.00eb8e20
add esp, 4
mov dword [ebp - 4], eax
jmp 0xeb8d6a
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0xeb9637
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0xf387a0]
jne 0xeb9641
repz ret
jmp fcn.00ec3900
Function at 0xed344b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00ec4e57
and dword [ebp - 4], 0
cmp dword [0xf3b65c], 0
mov ebx, eax
jne 0xed34fc
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0xed35ad
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0xed35ad
push eax
call fcn.00ec4de5
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0xf3b65c], eax
call esi
push eax
call fcn.00ec4de5
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0xf3b660], eax
call esi
push eax
call fcn.00ec4de5
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0xf3b664], eax
call esi
push eax
call fcn.00ec4de5
pop ecx
mov dword [0xf3b66c], eax
test eax, eax
je 0xed34fc
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00ec4de5
pop ecx
mov dword [0xf3b668], eax
mov eax, dword [0xf3b668]
cmp eax, ebx
je 0xed3554
cmp dword [0xf3b66c], ebx
je 0xed3554
push eax
call fcn.00ec4e60
push dword [0xf3b66c]
mov esi, eax
call fcn.00ec4e60
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0xed3554
test edi, edi
je 0xed3554
call esi
test eax, eax
je 0xed354b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0xed354b
test byte [ebp - 0xc], 1
jne 0xed3554
or dword [ebp + 0x10], 0x200000
jmp 0xed358d
mov eax, dword [0xf3b660]
cmp eax, ebx
je 0xed358d
push eax
call fcn.00ec4e60
pop ecx
test eax, eax
je 0xed358d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0xed358d
mov eax, dword [0xf3b664]
cmp eax, ebx
je 0xed358d
push eax
call fcn.00ec4e60
pop ecx
test eax, eax
je 0xed358d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0xf3b65c]
call fcn.00ec4e60
pop ecx
test eax, eax
je 0xed35ad
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0xed35af
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0xed6360
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0xf387a0]
xor eax, esp
mov dword [esp + 0x190], eax
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0xed63b5
mov eax, dword [esp]
cmp al, 2
jne 0xed63af
shr eax, 8
cmp al, 2
jne 0xed63af
call fcn.00ed6850
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.00eb9637
add esp, 0x194
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x190]
xor ecx, esp
mov eax, 2
call fcn.00eb9637
add esp, 0x194
ret
Function at 0xee1aa0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0xee1ad2
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2733
neg eax
sbb eax, eax
and eax, 0xffffffe7
add eax, 0x51
ret
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
xor eax, eax
ret

Function at 0xee1c30
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xa4
mov eax, dword [0xf387a0]
xor eax, esp
mov dword [esp + 0xa0], eax
mov eax, dword [esp + 0xb8]
push ebx
mov ebx, dword [esp + 0xb0]
push ebp
mov ebp, dword [esp + 0xb8]
push esi
mov esi, dword [esp + 0xb4]
cmp dword [esi + 0x2e8], 0
push edi
je case.default.0xee1c90
test eax, eax
je case.default.0xee1c90
mov eax, dword [eax + 0x9c]
test eax, eax
je case.default.0xee1c90
lea edx, [ebx - 1]
mov ecx, str.Data
cmp edx, 3
ja case.default.0xee1c90
jmp dword [edx*4 + 0xee1dac]
mov ecx, str.Header
mov edx, str.from
jmp 0xee1cad
mov ecx, str.Header
mov edx, 0xf1bc64
push eax
push edx
push ecx
push str.__s__s__s_
lea eax, [esp + 0x20]
push 0xa0
push eax
call fcn.00ee5bb0
lea eax, [esp + 0x28]
add esp, 0x18
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xee1cd0
sub eax, edx
mov edi, eax
mov eax, dword [esi + 0x1a8]
test eax, eax
je 0xee1d25
mov ecx, dword [esi + 0x134]
push ecx
push edi
lea edx, [esp + 0x18]
push edx
push 0
push esi
call eax
add esp, 0x14
test eax, eax
jne 0xee1d90
mov eax, dword [esi + 0x1a8]
test eax, eax
je 0xee1d53
mov ecx, dword [esi + 0x134]
mov edx, dword [esp + 0xc4]
push ecx
push edx
push ebp
push ebx
push esi
call eax
add esp, 0x14
jmp 0xee1d90
mov eax, dword [esi + 0x130]
push eax
push 1
push 2
push 0xf1bc40
call fcn.00ebb234
mov ecx, dword [esi + 0x130]
push ecx
push 1
lea edx, [esp + 0x28]
push edi
push edx
call fcn.00ebb234
add esp, 0x20
jmp case.default.0xee1c90
test ebx, ebx
jl 0xee1d8e
cmp ebx, 2
jg 0xee1d8e
mov eax, dword [esi + 0x130]
push eax
push 1
lea ecx, [ebx + ebx*2 + 0xf1bc40]
push 2
push ecx
call fcn.00ebb234
mov edx, dword [esi + 0x130]
mov eax, dword [esp + 0xd4]
push edx
push 1
push eax
push ebp
call fcn.00ebb234
add esp, 0x20
xor eax, eax
mov ecx, dword [esp + 0xb0]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00eb9637
add esp, 0xa4
ret
Function at 0xee1fd0
Capabilities:
Send data
Send data on socket

Disassembly:
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi + eax*4 + 0x154]
push edi
push 0
push ecx
push edx
push eax
call dword [sym.imp.WS2_32.dll_send]
mov ebx, dword [esp + 0x20]
mov edi, eax
mov dword [ebx], 0
cmp edi, 0xffffffff
jne 0xee204d
push ebp
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebp, eax
cmp ebp, 0x2733
jne 0xee2024
pop ebp
pop edi
pop esi
mov dword [ebx], 0x51
xor eax, eax
pop ebx
ret
push ebp
push esi
call fcn.00ee70f0
push eax
mov eax, dword [esi]
push str.Send_failure:__s
push eax
call fcn.00ee1e50
mov ecx, dword [esi]
add esp, 0x14
mov dword [ecx + 0x8634], ebp
mov dword [ebx], 0x37
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0xee3970
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x14
xor eax, eax
cmp dword [esi + 0x484], eax
push 4
lea ecx, [esp + 4]
push ecx
setne al
push 8
push 0xffff
push edi
mov dword [esp + 0x14], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jge 0xee39ae
push edi
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
push esi
call fcn.00ee1dc0
add esp, 0xc
add esp, 0x14
ret
mov edx, dword [esi + 0x488]
push edx
mov dword [esp + 0xc], 1
call fcn.00ee4ea0
imul eax, eax, 0x3e8
mov dword [esp + 4], eax
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x48c]
push eax
call fcn.00ee4ea0
imul eax, eax, 0x3e8
add esp, 8
push 0
push 0
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 0xc
lea edx, [esp + 0x20]
push edx
push 0x98000004
push edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x34], eax
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0xee3a27
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
push esi
call fcn.00ee1dc0
add esp, 0x10
add esp, 0x14
ret