joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100769e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
mov eax, dword [0x10093034]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.10076e90
mov edi, eax
test edi, edi
je 0x10076a5e
lea eax, [esp + 0xc]
mov word [esp + 0xf], 0x7470
push eax
push edi
mov dword [esp + 0x23], 0x74786574
mov dword [esp + 0x1d], 0x43657269
mov dword [esp + 0x19], 0x75716341
mov word [esp + 0x21], 0x6e6f
mov word [esp + 0x14], 0x7243
mov byte [esp + 0x16], 0x79
mov word [esp + 0x27], 0x41
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10076a57
push 0xf0000000
push 0x18
push esi
push esi
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x24]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1004f6b2
add esp, 0x1c
ret

Function at 0x10076a80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x10093034]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.10076e90
mov edi, eax
test edi, edi
je 0x10076b03
lea eax, [esp + 0xc]
mov word [esp + 0x15], 0x7361
push eax
push edi
mov dword [esp + 0x16], 0x52747079
mov word [esp + 0x23], 0x6574
mov word [esp + 0x14], 0x7243
mov word [esp + 0x26], 0x74
mov word [esp + 0x20], 0x6f43
mov word [esp + 0x1a], 0x6c65
mov byte [esp + 0x25], 0x78
mov byte [esp + 0x1f], 0x65
mov byte [esp + 0x22], 0x6e
mov byte [esp + 0x1c], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10076afc
push esi
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1004f6b2
add esp, 0x18
ret

Function at 0x10076b20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x10093034]
xor eax, esp
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x20]
push ebx
push ebp
mov ebp, dword [esp + 0x24]
mov ebx, ecx
push esi
push edi
mov dword [esp + 0x10], eax
xor esi, esi
call fcn.10076e40
mov edi, eax
test edi, edi
je 0x10076b97
lea eax, [esp + 0x14]
mov dword [esp + 0x18], 0x79726575
push eax
push edi
mov dword [esp + 0x24], 0x756c6156
mov dword [esp + 0x1c], 0x51726556
mov word [esp + 0x28], 0x4165
mov byte [esp + 0x2a], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10076b90
push dword [esp + 0x10]
push ebp
push 0x1008aad8
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x24]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1004f6b2
add esp, 0x18
ret
Function at 0x10076c40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x10093034]
xor eax, esp
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x28]
push ebx
push ebp
mov ebp, dword [esp + 0x2c]
mov ebx, ecx
push esi
push edi
mov dword [esp + 0x10], eax
xor esi, esi
call fcn.10076e90
mov edi, eax
test edi, edi
je 0x10076cbb
lea eax, [esp + 0x14]
mov dword [esp + 0x18], 0x636e4574
push eax
push edi
mov word [esp + 0x1d], 0x7972
mov dword [esp + 0x25], 0x747079
mov byte [esp + 0x1c], 0x43
mov byte [esp + 0x24], 0x72
mov byte [esp + 0x1f], 0x70
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10076cb4
push dword [esp + 0x3c]
push dword [esp + 0x14]
push ebp
push esi
push esi
push esi
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x24]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1004f6b2
add esp, 0x18
ret

Function at 0x10076cd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x10093034]
xor eax, esp
mov dword [esp + 0x10], eax
lea eax, [esp]
mov dword [esp], 0x4c746547
push eax
mov dword [esp + 0xc], 0x726f7272
mov dword [esp + 8], 0x45747361
mov byte [esp + 0x10], 0
call fcn.10076ee0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10076d1f
call eax
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.1004f6b2
add esp, 0x14
ret
mov ecx, dword [esp + 0x10]
xor eax, eax
xor ecx, esp
call fcn.1004f6b2
add esp, 0x14
ret

Function at 0x10076d30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
mov eax, dword [0x10093034]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push ebp
push esi
push edi
mov ebp, edx
mov ebx, ecx
xor esi, esi
call fcn.10076e40
mov edi, eax
test edi, edi
je 0x10076db8
lea eax, [esp + 0x10]
mov dword [esp + 0x21], 0x7a69536f
push eax
push edi
mov word [esp + 0x1b], 0x6946
mov dword [esp + 0x1d], 0x6556656c
mov word [esp + 0x18], 0x6547
mov dword [esp + 0x22], 0x6e6f6973
mov byte [esp + 0x21], 0x72
mov byte [esp + 0x1a], 0x74
mov word [esp + 0x26], 0x6e49
mov word [esp + 0x2e], 0x41
mov byte [esp + 0x28], 0x66
mov byte [esp + 0x2d], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10076db1
push ebp
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x28]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1004f6b2
add esp, 0x1c
ret

Function at 0x10076dd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
mov eax, dword [0x10093034]
xor eax, esp
mov dword [esp + 0xc], eax
push esi
lea eax, [esp + 4]
mov dword [esp + 4], 0x61636f4c
push eax
mov esi, edx
mov dword [esp + 0xd], 0x6f6c6c41
mov word [esp + 0x11], 0x63
mov byte [esp + 0xc], 0x6c
call fcn.10076ee0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10076e27
push esi
push 0
call eax
pop esi
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.1004f6b2
add esp, 0x10
ret
mov ecx, dword [esp + 0x10]
xor eax, eax
pop esi
xor ecx, esp
call fcn.1004f6b2
add esp, 0x10
ret
Function at 0x10076e40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
mov eax, dword [0x10093034]
xor eax, esp
mov dword [esp + 0xc], eax
lea ecx, [esp]
mov dword [esp + 6], 0x6c642e6e
mov dword [esp + 2], 0x6f697372
mov word [esp], 0x6556
mov word [esp + 0xa], 0x6c
call fcn.10076560
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.1004f6b2
add esp, 0x10
ret

Function at 0x10076e90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x10093034]
xor eax, esp
mov dword [esp + 0x10], eax
lea ecx, [esp]
mov word [esp + 4], 0x6970
mov dword [esp + 9], 0x6c6c64
mov word [esp + 7], 0x2e32
mov dword [esp], 0x61766441
mov byte [esp + 6], 0x33
call fcn.10076560
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.1004f6b2
add esp, 0x14
ret

Function at 0x10076ee0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x10093034]
xor eax, esp
mov dword [esp + 0x10], eax
lea eax, [esp]
mov word [esp + 4], 0x6c65
push eax
mov dword [esp + 0xb], 0x6c642e32
mov byte [esp + 0xa], 0x33
mov word [esp + 0xf], 0x6c
mov dword [esp + 4], 0x6e72654b
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.1004f6b2
add esp, 0x14
ret
Function at 0x10076f30
Capabilities:
Parse credit card information

Disassembly:
sub esp, 0x18
mov eax, dword [0x10093034]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
mov bl, byte [ecx]
push ebp
xor ebp, ebp
mov dword [esp + 8], ecx
push edi
mov edi, edx
test bl, bl
je 0x10077072
mov al, bl
push esi
cmp al, 0x24
je 0x10076f92
cmp al, 0x26
je 0x10076f92
cmp al, 0x2b
je 0x10076f92
cmp al, 0x2c
je 0x10076f92
cmp al, 0x2f
je 0x10076f92
cmp al, 0x3a
je 0x10076f92
cmp al, 0x3b
je 0x10076f92
cmp al, 0x3d
je 0x10076f92
cmp al, 0x3f
je 0x10076f92
cmp al, 0x40
je 0x10076f92
cmp al, 0x23
je 0x10076f92
cmp al, 0x20
je 0x10076f92
mov byte [edi], bl
mov ecx, 1
jmp 0x10077039
movsx eax, al
push eax
lea eax, [esp + 0x20]
mov dword [esp + 0x23], 0x783230
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x24]
mov word [esp + 0x28], 0x2525
push 4
push eax
mov byte [esp + 0x32], 0x25
call fcn.10034e60
lea ecx, [esp + 0x2c]
add esp, 0x14
xor esi, esi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10076fd0
sub ecx, edx
je 0x1007700d
nop dword [eax + eax]
movsx eax, byte [esp + esi + 0x18]
push eax
call fcn.1005438c
mov byte [esp + esi + 0x1c], al
add esp, 4
lea eax, [esp + 0x18]
inc esi
lea edx, [eax + 1]
nop word [eax + eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10077000
sub eax, edx
cmp esi, eax
jb 0x10076fe0
push 0xffffffffffffffff
lea eax, [esp + 0x1c]
push eax
mov eax, 0x800
sub eax, ebp
push eax
push edi
call fcn.1005495c
lea ecx, [esp + 0x28]
add esp, 0x10
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10077030
sub ecx, edx
mov eax, ecx
add ebp, ecx
mov ecx, dword [esp + 0x10]
add edi, eax
inc ecx
mov dword [esp + 0x10], ecx
cmp ebp, 0x7ff
jae 0x1007705c
mov bl, byte [ecx]
mov al, bl
test bl, bl
jne 0x10076f56
pop esi
mov byte [edi], 0
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.1004f6b2
add esp, 0x18
ret
mov ecx, dword [esp + 0x20]
mov byte [edi], 0
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.1004f6b2
add esp, 0x18
ret
Function at 0x100010f0
Capabilities:
Terminate thread

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov al, byte [esi + 0x44]
mov dword [esi], 0x100174c0
test al, al
je 0x1000114c
mov eax, dword [esi + 0x18]
push eax
call dword [sym.imp.WINMM.dll_waveInStop]
mov ecx, dword [esi + 0x18]
push ecx
call dword [sym.imp.WINMM.dll_waveInReset]
mov ebp, dword [sym.imp.WINMM.dll_waveInUnprepareHeader]
lea edi, [esi + 0x30]
mov ebx, 2
mov edx, dword [edi]
mov eax, dword [esi + 0x18]
push 0x20
push edx
push eax
call ebp
add edi, 4
dec ebx
jne 0x10001125
mov ecx, dword [esi + 0x18]
push ecx
call dword [sym.imp.WINMM.dll_waveInClose]
mov edx, dword [esi + 0x2c]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov al, byte [esi + 0x45]
test al, al
je 0x10001186
mov eax, dword [esi + 0x40]
push eax
call dword [sym.imp.WINMM.dll_waveOutReset]
mov ebp, dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
lea edi, [esi + 0x30]
mov ebx, 2
mov ecx, dword [edi]
mov edx, dword [esi + 0x40]
push 0x20
push ecx
push edx
call ebp
add edi, 4
dec ebx
jne 0x1000116b
mov eax, dword [esi + 0x40]
push eax
call dword [sym.imp.WINMM.dll_waveOutClose]
lea edi, [esi + 0x30]
mov ebx, 2
mov ecx, dword [edi - 0x28]
push ecx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov edx, dword [edi]
push edx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov eax, dword [edi - 0x20]
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov ecx, dword [edi + 8]
push ecx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 0x10
add edi, 4
dec ebx
jne 0x1000118e
mov edx, dword [esi + 0x24]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call edi
mov eax, dword [esi + 0x28]
push eax
call edi
mov ecx, dword [esi + 0x2c]
push ecx
call edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x100012c0
Capabilities:
Capture microphone audio
Create thread
Resume thread

Disassembly:
push ecx
push ebx
push edi
mov edi, ecx
call dword [sym.imp.WINMM.dll_waveInGetNumDevs]
test eax, eax
jne 0x100012d5
pop edi
xor al, al
pop ebx
pop ecx
ret
lea eax, [esp + 8]
mov dword [esp + 8], 0
push eax
push 4
push edi
push 0x10001430
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esp + 8]
push 0x20000
push 0
lea edx, [edi + 0x46]
push ecx
lea ebx, [edi + 0x18]
push edx
push 0xffff
push ebx
mov dword [edi + 0x2c], eax
call dword [sym.imp.WINMM.dll_waveInOpen]
test eax, eax
je 0x10001320
pop edi
xor al, al
pop ebx
pop ecx
ret
push ebp
push esi
lea esi, [edi + 0x30]
mov ebp, 2
mov eax, dword [esi]
mov ecx, dword [esi - 0x28]
push 0x20
mov dword [eax], ecx
mov edx, dword [esi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
mov ecx, dword [esi]
xor eax, eax
mov dword [ecx + 0x10], eax
mov edx, dword [esi]
mov dword [edx + 0x14], eax
mov eax, dword [esi]
mov ecx, dword [ebx]
push eax
push ecx
call dword [sym.imp.WINMM.dll_waveInPrepareHeader]
add esi, 4
dec ebp
jne 0x1000132a
mov edx, dword [edi + 0x1c]
mov ecx, dword [ebx]
push 0x20
mov eax, dword [edi + edx*4 + 0x30]
push eax
push ecx
call dword [sym.imp.WINMM.dll_waveInAddBuffer]
mov edx, dword [edi + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [ebx]
push eax
call dword [sym.imp.WINMM.dll_waveInStart]
mov al, 1
pop esi
mov byte [edi + 0x44], al
pop ebp
pop edi
pop ebx
pop ecx
ret
Function at 0x10001dd0
Capabilities:
Enumerate devices by category

Disassembly:
push 0xffffffffffffffff
push 0x1001604b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x828
lea eax, [esp + 0x14]
mov dword [esp + 8], 0
push eax
push 0x1001838c
push 1
push 0
push 0x1001841c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
je 0x10001e2a
or eax, 0xffffffff
mov ecx, dword [esp + 0x828]
mov dword fs:[0], ecx
add esp, 0x834
ret 4
mov dword [esp], 0
mov eax, dword [esp + 0x14]
lea edx, [esp]
push 0
push edx
mov ecx, dword [eax]
push 0x1001840c
push eax
mov dword [esp + 0x840], 0
call dword [ecx + 0xc]
test eax, eax
je 0x10001e8a
mov eax, dword [esp]
mov dword [esp + 0x830], 0xffffffff
test eax, eax
je 0x10001e70
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or eax, 0xffffffff
mov ecx, dword [esp + 0x828]
mov dword fs:[0], ecx
add esp, 0x834
ret 4
mov eax, dword [esp]
push eax
mov edx, dword [eax]
call dword [edx + 0x14]
mov eax, dword [esp]
lea edx, [esp + 0x10]
push edx
lea edx, [esp + 8]
mov ecx, dword [eax]
push edx
push 1
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x10001f93
push ebx
mov ebx, dword [esp + 0x83c]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
push edi
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push edx
push 0x100175fc
mov ecx, dword [eax]
push 0
push 0
push eax
call dword [ecx + 0x24]
test eax, eax
jl 0x10001f67
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x28]
push 0
mov word [esp + 0x2c], 8
mov ecx, dword [eax]
push edx
push str.FriendlyName
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x10001f5d
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x30]
inc eax
push 0
mov dword [esp + 0x1c], eax
push 0
lea eax, [esp + 0x40]
push 0x800
push eax
push 0xffffffffffffffff
push ecx
push 0
push 0
call ebp
mov edx, ebx
lea edi, [esp + 0x38]
or ecx, 0xffffffff
xor eax, eax
add ebx, 0x104
lea esi, [esp + 0x38]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, edx
mov edx, ecx
mov eax, dword [esp + 0x30]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x1c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x14]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x20]
push edx
lea edx, [esp + 0x18]
mov ecx, dword [eax]
push edx
push 1
push eax
call dword [ecx + 0xc]
test eax, eax
je 0x10001ec3
pop edi
pop esi
pop ebp
pop ebx
mov eax, dword [esp]
mov dword [esp + 0x830], 0xffffffff
test eax, eax
je 0x10001fac
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [esp + 0x828]
mov eax, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x834
ret 4
Function at 0x10002280
Capabilities:
Enumerate devices by category

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10016090
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push edi
mov edi, dword [esp + 0x34]
xor ebx, ebx
cmp edi, ebx
jge 0x100022b9
pop edi
xor al, al
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 8
mov dword [esp + 8], ebx
lea eax, [esp + 8]
mov dword [esp + 0x2c], ebx
push eax
push 0x1001838c
push 1
push ebx
push 0x1001841c
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebx
je 0x10002308
mov eax, dword [esp + 8]
mov dword [esp + 0x2c], 0xffffffff
cmp eax, ebx
je 0x10002352
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop edi
xor al, al
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 8
mov dword [esp + 0x34], ebx
mov eax, dword [esp + 8]
lea ecx, [esp + 0x34]
push ebx
push ecx
mov edx, dword [eax]
push 0x1001840c
push eax
mov byte [esp + 0x3c], 1
call dword [edx + 0xc]
cmp eax, ebx
je 0x10002367
mov eax, dword [esp + 0x34]
mov byte [esp + 0x2c], bl
cmp eax, ebx
je 0x1000233c
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [esp + 8]
mov dword [esp + 0x2c], 0xffffffff
cmp eax, ebx
je 0x10002352
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop edi
xor al, al
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 8
mov eax, dword [esp + 0x34]
push esi
push eax
mov edx, dword [eax]
call dword [edx + 0x14]
mov eax, dword [esp + 0x38]
lea edx, [esp + 0x14]
push edx
lea edx, [esp + 0x14]
mov ecx, dword [eax]
push edx
push 1
push eax
xor esi, esi
call dword [ecx + 0xc]
cmp edi, ebx
jl 0x10002426
push ebp
mov ebp, dword [esp + 0x40]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x40]
push edx
push 0x100175fc
mov ecx, dword [eax]
push ebx
push ebx
push eax
call dword [ecx + 0x24]
cmp eax, ebx
jl 0x100023fc
mov eax, dword [esp + 0x40]
lea edx, [esp + 0x1c]
push ebx
mov word [esp + 0x20], 8
mov ecx, dword [eax]
push edx
push str.FriendlyName
push eax
call dword [ecx + 0xc]
cmp eax, ebx
jne 0x100023f2
cmp esi, edi
jne 0x100023e7
mov eax, dword [esp + 0x14]
push ebp
push 0x1001837c
push ebx
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x20]
mov edx, dword [esp + 0x24]
push edx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x40]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x14]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 0x3c]
lea edx, [esp + 0x18]
push edx
lea edx, [esp + 0x18]
mov ecx, dword [eax]
push edx
push 1
push eax
inc esi
call dword [ecx + 0xc]
cmp esi, edi
jle 0x10002397
pop ebp
mov eax, dword [esp + 0x38]
mov byte [esp + 0x30], bl
cmp eax, ebx
pop esi
je 0x10002439
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 8]
mov dword [esp + 0x2c], 0xffffffff
cmp eax, ebx
je 0x1000244f
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov ecx, dword [esp + 0x24]
pop edi
mov al, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 8
Function at 0x100028a0
Capabilities:
Initialize winsock library

Disassembly:
push 0xffffffffffffffff
push 0x100160ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x198
push esi
mov esi, ecx
mov dword [esp + 4], esi
lea ecx, [esi + 4]
call fcn.100017b0
lea ecx, [esi + 0x2c]
mov dword [esp + 0x1a4], 0
call fcn.100017b0
lea ecx, [esi + 0x54]
mov byte [esp + 0x1a4], 1
call fcn.100017b0
lea ecx, [esi + 0x7c]
mov byte [esp + 0x1a4], 2
call fcn.100017b0
lea eax, [esp + 0xc]
mov dword [esi], 0x100174f4
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov byte [esp + 4], 0x50
mov byte [esp + 5], 0x43
mov byte [esp + 6], 0x52
mov byte [esp + 7], 0x61
mov edx, dword [esp + 4]
lea ecx, [esi + 0xb0]
mov dword [esi + 0xac], eax
mov al, 0x74
mov dword [ecx], edx
mov byte [esi + 0xb5], 0
mov dword [esi + 0xa8], 0xffffffff
mov byte [ecx + 4], al
mov ecx, dword [esp + 0x19c]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x1a4
ret

Function at 0x10002a60
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns
Set socket configuration

Disassembly:
sub esp, 0x20
push esi
push edi
mov esi, ecx
call fcn.10002ed0
mov eax, dword [esi + 0xac]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 6
push 1
push 2
mov byte [esi + 0xb5], 0
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 0xa8], eax
jne 0x10002aa1
pop edi
xor al, al
pop esi
add esp, 0x20
ret 8
mov ecx, dword [esp + 0x2c]
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov edi, eax
test edi, edi
jne 0x10002abc
pop edi
xor al, al
pop esi
add esp, 0x20
ret 8
mov edx, dword [esp + 0x30]
mov word [esp + 0x18], 2
push edx
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x1a], ax
mov eax, dword [edi + 0xc]
push 0x10
mov ecx, dword [eax]
lea eax, [esp + 0x1c]
push eax
mov edx, dword [ecx]
mov ecx, dword [esi + 0xa8]
push ecx
mov dword [esp + 0x28], edx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x10002b01
pop edi
xor al, al
pop esi
add esp, 0x20
ret 8
mov eax, dword [esi + 0xa8]
lea edx, [esp + 0xb]
push 1
push edx
push 8
push 0xffff
push eax
mov byte [esp + 0x1f], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x10002b5f
push eax
lea ecx, [esp + 0xf]
push eax
push ecx
push eax
push eax
mov eax, dword [esi + 0xa8]
lea edx, [esp + 0x20]
push 0xc
push edx
push 0x98000004
push eax
mov dword [esp + 0x30], 1
mov dword [esp + 0x34], 0x2bf20
mov dword [esp + 0x38], 0x1388
call dword [sym.imp.WS2_32.dll_WSAIoctl]
push 1
push 0
push 0
push esi
push 0x10002b90
push 0
push 0
mov byte [esi + 0xb5], 1
call fcn.1000f6f0
add esp, 0x1c
mov dword [esi + 0xa4], eax
mov al, 1
pop edi
pop esi
add esp, 0x20
ret 8
Function at 0x100030d0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x14]
cmp ebx, esi
mov ebp, ecx
mov dword [esp + 0x14], 0
jb 0x1000313a
mov dword [esp + 0x1c], 0
mov eax, dword [ebp + 0xa8]
push 0
push esi
push edi
push eax
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x10003119
mov ecx, dword [esp + 0x1c]
inc ecx
cmp ecx, 0xf
mov dword [esp + 0x1c], ecx
jl 0x100030f6
cmp dword [esp + 0x1c], 0xf
je 0x10003170
mov ecx, dword [esp + 0x14]
push 0xa
add ecx, eax
add edi, esi
mov dword [esp + 0x18], ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
sub ebx, esi
cmp ebx, esi
jae 0x100030ee
test ebx, ebx
jle 0x10003164
xor esi, esi
mov ecx, dword [ebp + 0xa8]
push 0
push ebx
push edi
push ecx
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x1000315b
inc esi
cmp esi, 0xf
jl 0x10003140
cmp esi, 0xf
je 0x10003170
add dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
cmp eax, ecx
je 0x10003173
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
ret 0xc

Function at 0x10003450
Capabilities:
Get file size

Disassembly:
sub esp, 0xc
xor eax, eax
push ebx
mov ebx, ecx
push ebp
push esi
lea edx, [ebx + 0x20]
push edi
mov ebp, dword [esp + 0x20]
mov ecx, 0x41
mov edi, edx
push 0
rep stosd dword es:[edi], eax
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x80
mov eax, ecx
mov esi, edi
mov edi, edx
push 3
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
and ecx, 3
push 1
push closesocket
push ebp
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100034b4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret 4
lea ecx, [esp + 0x20]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x20]
xor edx, edx
mov dword [esp + 0x10], edx
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], edx
push 0xa
push ecx
mov word [esp + 0x20], dx
mov ecx, ebx
mov byte [esp + 0x18], 0x6a
mov dword [esp + 0x19], eax
mov dword [esp + 0x1d], edi
call fcn.10008550
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4