joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a2ba0
Capabilities:
Resolve dns

Disassembly:
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0x2ac8], 0x10
push edi
jb 0x100a2bb6
mov eax, dword [esi + 0x2ab4]
jmp 0x100a2bbc
lea eax, [esi + 0x2ab4]
mov edi, dword [sym.imp.WS2_32.dll_gethostbyname]
push eax
call edi
test eax, eax
mov ebx, dword [sym.imp.WS2_32.dll_htons]
jne 0x100a2bdb
mov dword [esi + 0x2acc], 0
jmp 0x100a2bf6
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
push 0x1bb
mov dword [esi + 0x2acc], edx
call ebx
mov word [esi + 0x2ad0], ax
cmp dword [esi + 0x2b34], 0x10
jb 0x100a2c07
mov eax, dword [esi + 0x2b20]
jmp 0x100a2c0d
lea eax, [esi + 0x2b20]
push eax
call edi
test eax, eax
jne 0x100a2c1c
mov dword [esi + 0x2b38], eax
jmp 0x100a2c37
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
push 0x1bb
mov dword [esi + 0x2b38], edx
call ebx
mov word [esi + 0x2b3c], ax
mov ecx, dword [esi + 0x2a80]
test ecx, ecx
mov eax, dword [esp + 0x18]
mov dword [esi + 0x30dc], eax
jne 0x100a2c53
pop edi
pop esi
xor al, al
pop ebx
ret 0xc
lea edx, [esi + 0x2c]
push edx
mov edx, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x1c]
push eax
push edx
call fcn.10016de0
mov bl, al
test bl, bl
je 0x100a2c79
mov eax, dword [esi]
mov edx, dword [eax + 0x108]
mov ecx, esi
call edx
pop edi
pop esi
mov al, bl
pop ebx
ret 0xc

Function at 0x100a2ba1
Capabilities:
Resolve dns

Disassembly:
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0x2ac8], 0x10
push edi
jb 0x100a2bb6
mov eax, dword [esi + 0x2ab4]
jmp 0x100a2bbc
lea eax, [esi + 0x2ab4]
mov edi, dword [sym.imp.WS2_32.dll_gethostbyname]
push eax
call edi
test eax, eax
mov ebx, dword [sym.imp.WS2_32.dll_htons]
jne 0x100a2bdb
mov dword [esi + 0x2acc], 0
jmp 0x100a2bf6
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
push 0x1bb
mov dword [esi + 0x2acc], edx
call ebx
mov word [esi + 0x2ad0], ax
cmp dword [esi + 0x2b34], 0x10
jb 0x100a2c07
mov eax, dword [esi + 0x2b20]
jmp 0x100a2c0d
lea eax, [esi + 0x2b20]
push eax
call edi
test eax, eax
jne 0x100a2c1c
mov dword [esi + 0x2b38], eax
jmp 0x100a2c37
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
push 0x1bb
mov dword [esi + 0x2b38], edx
call ebx
mov word [esi + 0x2b3c], ax
mov ecx, dword [esi + 0x2a80]
test ecx, ecx
mov eax, dword [esp + 0x18]
mov dword [esi + 0x30dc], eax
jne 0x100a2c53
pop edi
pop esi
xor al, al
pop ebx
ret 0xc
lea edx, [esi + 0x2c]
push edx
mov edx, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x1c]
push eax
push edx
call fcn.10016de0
mov bl, al
test bl, bl
je 0x100a2c79
mov eax, dword [esi]
mov edx, dword [eax + 0x108]
mov ecx, esi
call edx
pop edi
pop esi
mov al, bl
pop ebx
ret 0xc
Function at 0x100a2c90
Capabilities:
Resolve dns

Disassembly:
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0x32b0], 0x10
push edi
jb 0x100a2ca6
mov eax, dword [esi + 0x329c]
jmp 0x100a2cac
lea eax, [esi + 0x329c]
mov edi, dword [sym.imp.WS2_32.dll_gethostbyname]
push eax
call edi
test eax, eax
mov ebx, dword [sym.imp.WS2_32.dll_htons]
jne 0x100a2ccb
mov dword [esi + 0x32b4], 0
jmp 0x100a2ce6
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
push 0x1f40
mov dword [esi + 0x32b4], edx
call ebx
mov word [esi + 0x32b8], ax
cmp dword [esi + 0x2b58], 0x10
jb 0x100a2cf7
mov eax, dword [esi + 0x2b44]
jmp 0x100a2cfd
lea eax, [esi + 0x2b44]
push eax
call edi
test eax, eax
jne 0x100a2d0c
mov dword [esi + 0x2b5c], eax
jmp 0x100a2d27
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
push 0x1bb
mov dword [esi + 0x2b5c], edx
call ebx
mov word [esi + 0x2b60], ax
lea edi, [esi + 0x32bc]
mov ecx, edi
call fcn.1002c090
mov bl, al
test bl, bl
je 0x100a2d45
add esi, 0x2c
push esi
mov ecx, edi
call fcn.1002b8d0
pop edi
pop esi
mov al, bl
pop ebx
ret

Function at 0x100a2c91
Capabilities:
Resolve dns

Disassembly:
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0x32b0], 0x10
push edi
jb 0x100a2ca6
mov eax, dword [esi + 0x329c]
jmp 0x100a2cac
lea eax, [esi + 0x329c]
mov edi, dword [sym.imp.WS2_32.dll_gethostbyname]
push eax
call edi
test eax, eax
mov ebx, dword [sym.imp.WS2_32.dll_htons]
jne 0x100a2ccb
mov dword [esi + 0x32b4], 0
jmp 0x100a2ce6
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
push 0x1f40
mov dword [esi + 0x32b4], edx
call ebx
mov word [esi + 0x32b8], ax
cmp dword [esi + 0x2b58], 0x10
jb 0x100a2cf7
mov eax, dword [esi + 0x2b44]
jmp 0x100a2cfd
lea eax, [esi + 0x2b44]
push eax
call edi
test eax, eax
jne 0x100a2d0c
mov dword [esi + 0x2b5c], eax
jmp 0x100a2d27
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
push 0x1bb
mov dword [esi + 0x2b5c], edx
call ebx
mov word [esi + 0x2b60], ax
lea edi, [esi + 0x32bc]
mov ecx, edi
call fcn.1002c090
mov bl, al
test bl, bl
je 0x100a2d45
add esi, 0x2c
push esi
mov ecx, edi
call fcn.1002b8d0
pop edi
pop esi
mov al, bl
pop ebx
ret
Function at 0x100a6270
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x101744b8
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101b01e4]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esi + 0x29fc]
xor ebx, ebx
cmp ecx, ebx
jne 0x100a62bb
xor eax, eax
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x70
ret
mov eax, dword [esi + 0x1734]
cmp eax, 3
ja case.0x100a62c6.0
jmp dword [eax*4 + 0x100a6454]
mov dword [esp + 0x14], 6
jmp 0x100a62f3
mov dword [esp + 0x14], 4
jmp 0x100a62f3
mov dword [esp + 0x14], 3
jmp 0x100a62f3
mov dword [esp + 0x14], 1
lea eax, [esi + 8]
push eax
call fcn.1011fb19
cmp eax, ebx
mov dword [esp + 0x18], eax
je 0x100a6439
lea edi, [esi + 0x275e]
mov eax, edi
mov dword [esp + 0x74], 0xf
mov dword [esp + 0x70], ebx
mov byte [esp + 0x60], bl
lea ebp, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x100a6323
sub eax, ebp
push eax
push edi
lea ecx, [esp + 0x64]
call fcn.10001fe0
lea ecx, [esi + 0x273e]
mov ebp, 0xf
mov eax, ecx
mov dword [esp + 0x80], ebx
mov dword [esp + 0x58], ebp
mov dword [esp + 0x54], ebx
mov byte [esp + 0x44], bl
lea edi, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
add eax, 1
cmp dl, bl
jne 0x100a6360
sub eax, edi
push eax
push ecx
lea ecx, [esp + 0x48]
call fcn.10001fe0
lea ecx, [esi + 0x1738]
mov eax, ecx
mov byte [esp + 0x80], 1
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
lea edi, [eax + 1]
mov dl, byte [eax]
add eax, 1
cmp dl, bl
jne 0x100a6395
sub eax, edi
push eax
push ecx
lea ecx, [esp + 0x2c]
call fcn.10001fe0
movzx eax, word [esi + 0x273c]
lea ecx, [esp + 0x5c]
push ecx
lea edx, [esp + 0x44]
push edx
push eax
lea ecx, [esp + 0x30]
push ecx
lea ecx, [esp + 0x2e]
mov byte [esp + 0x90], 2
call fcn.10007390
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
push eax
push edx
push ebp
call fcn.10124632
mov esi, 0x10
cmp dword [esp + 0x3c], esi
jb 0x100a63fb
mov eax, dword [esp + 0x28]
push eax
call fcn.10149646
add esp, 4
cmp dword [esp + 0x58], esi
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
jb 0x100a641a
mov ecx, dword [esp + 0x44]
push ecx
call fcn.10149646
add esp, 4
cmp dword [esp + 0x74], esi
mov dword [esp + 0x58], ebp
mov dword [esp + 0x54], ebx
mov byte [esp + 0x44], bl
jb 0x100a6439
mov edx, dword [esp + 0x60]
push edx
call fcn.10149646
add esp, 4
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x70
ret
Function at 0x100ab540
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x10174a0e
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101b01e4]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
xor ebx, ebx
lea ebp, [esi + 4]
mov dword [esi], ebx
mov dword [ebp + 4], ebx
mov dword [ebp + 8], ebx
mov dword [ebp + 0xc], ebx
lea edi, [esi + 0x14]
mov dword [esp + 0x30], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov eax, dword [esp + 0x14]
push eax
push 0x101af5e0
push 0x101af5a8
lea ecx, [esp + 0x24]
mov byte [esp + 0x3c], 1
call fcn.100254c0
lea ecx, [esp + 0x18]
push ecx
mov ecx, edi
mov byte [esp + 0x34], 2
call fcn.1001cdc0
mov eax, dword [esp + 0x1c]
cmp eax, ebx
mov byte [esp + 0x30], 1
je 0x100ab5d1
push eax
call fcn.10149646
add esp, 4
push edi
mov ecx, ebp
call fcn.1001cdc0
mov edx, dword [str.www.tencent.com.]
mov dword [esi + 0x24], edx
mov eax, dword [0x101871c8]
mov dword [esi + 0x28], eax
mov ecx, dword [0x101871cc]
mov dword [esi + 0x2c], ecx
mov edx, dword [0x101871d0]
mov dword [esi + 0x30], edx
mov eax, dword [esi + 0x24]
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x2c]
mov dword [esi + 0x34], eax
mov eax, dword [esi + 0x30]
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], edx
mov dword [esi + 0x40], eax
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret

Function at 0x100ab810
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x10174abb
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x101b01e4]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov eax, ecx
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
mov dword [eax + 0x34], ecx
mov dword [eax + 0x50], 0xf
mov dword [eax + 0x4c], ecx
mov byte [eax + 0x3c], cl
mov dword [eax + 0x58], ecx
mov dword [eax + 0x5c], ecx
mov dword [eax + 0x60], ecx
mov byte [eax + 0x64], cl
mov dword [eax + 0x6c], ecx
mov dword [eax + 0x70], ecx
mov dword [eax + 0x74], ecx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
add esp, 0x10
ret
Function at 0x100ac160
Capabilities:
Resolve dns

Disassembly:
push 0xffffffffffffffff
push 0x10174bcb
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101b01e4]
xor eax, esp
push eax
lea eax, [esp + 0x54]
mov dword fs:[0], eax
mov esi, ecx
mov ebp, dword [sym.imp.WS2_32.dll_gethostbyname]
lea eax, [esi + 0xe02]
push eax
call ebp
xor ebx, ebx
cmp eax, ebx
jne 0x100ac1a6
mov dword [esi + 0x2b69], ebx
jmp 0x100ac1b3
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
mov dword [esi + 0x2b69], eax
movzx eax, word [esi + 0xf02]
mov edi, dword [sym.imp.WS2_32.dll_htons]
push eax
call edi
movzx eax, ax
lea ecx, [esi + 0xf04]
push ecx
mov word [esi + 0x2b6d], ax
call ebp
cmp eax, ebx
jne 0x100ac1e2
mov dword [esi + 0x2b6f], ebx
jmp 0x100ac1ef
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov eax, dword [eax]
mov dword [esi + 0x2b6f], eax
movzx ecx, word [esi + 0x1004]
push ecx
call edi
movzx eax, ax
lea edx, [esi + 0xbcc]
push edx
mov ecx, esi
mov word [esi + 0x2b73], ax
call fcn.100a07c0
mov eax, dword [esi + 0x2b6f]
movzx ebp, word [esi + 0x2b73]
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.100e4d2a
mov eax, dword [esi + 0x2b69]
movzx edi, word [esi + 0x2b6d]
push eax
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0x6c], ebx
call fcn.100e4d2a
add esp, 0x10
cmp dword [esp + 0x34], 0x10
jb 0x100ac25c
mov edx, dword [esp + 0x20]
push edx
call fcn.10149646
add esp, 4
push edi
mov edi, dword [sym.imp.WS2_32.dll_ntohs]
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
call edi
cmp dword [esp + 0x50], 0x10
mov dword [esp + 0x5c], 0xffffffff
jb 0x100ac291
mov eax, dword [esp + 0x3c]
push eax
call fcn.10149646
add esp, 4
push ebp
mov dword [esp + 0x54], 0xf
mov dword [esp + 0x50], ebx
mov byte [esp + 0x40], bl
call edi
cmp dword [esi + 0x2b64], ebx
jne 0x100ac2e8
push 0x3c
call fcn.1014979e
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
mov dword [esp + 0x5c], 1
je 0x100ac2d8
movzx ecx, byte [esi + 0x1733]
push ecx
push esi
mov ecx, eax
call fcn.10071a70
jmp 0x100ac2da
xor eax, eax
mov dword [esp + 0x5c], 0xffffffff
mov dword [esi + 0x2b64], eax
call fcn.1002d580
lea ebp, [eax + 4]
push ebp
mov dword [esp + 0x18], 0x1018442c
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
lea edx, [esi + 0x29e6]
push edx
lea edi, [esi + 0x29da]
push edi
mov ecx, esi
mov dword [esp + 0x64], 2
call fcn.100a5b20
movzx eax, word [esi + 0x2b73]
mov ecx, dword [esi + 0x2b6f]
movzx edx, word [esi + 0x2b6d]
mov ebx, dword [esi + 0x2b69]
push 0
push eax
mov eax, dword [esi + 0x29d6]
push ecx
push edx
push ebx
push edi
push eax
mov ecx, esi
call fcn.100abbd0
test al, al
push ebp
je 0x100ac370
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
xor al, al
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov al, 1
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret
Function at 0x100baf40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10175da8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0x101b01e4]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov eax, ecx
mov edx, dword [eax + 8]
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [eax + 0xc]
add ecx, dword [eax]
mov dword [esp + 0x20], 0
call edx
mov bl, al
mov eax, dword [esp + 0x38]
push eax
lea ecx, [esp + 0x38]
push ecx
mov dword [esp + 0x38], 0x10186a04
mov edx, dword [eax]
push edx
mov esi, ecx
push esi
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x30], 0xffffffff
call fcn.1008fd80
mov ecx, dword [esp + 0x38]
push ecx
call fcn.10149646
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x14
ret 0x1c
Function at 0x100cfb10
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x10177b78
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101b01e4]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov dword [esp + 8], 0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
mov dword [esi], eax
mov eax, dword [esp + 0x2c]
mov dword [esi + 4], ecx
mov ecx, dword [esp + 0x30]
mov dword [esi + 8], edx
mov dword [esi + 0xc], eax
lea edx, [esp + 0x34]
mov dword [esi + 0x10], ecx
push edx
lea ecx, [esi + 0x14]
mov dword [esp + 0x18], 0
call fcn.100cf2f0
mov eax, dword [esp + 0x38]
test eax, eax
je 0x100cfb86
push eax
call fcn.10149646
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x100d1fc0
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
mov ecx, dword [esp + 0xc]
lea edx, [esp + 4]
push edx
push 0
lea eax, [esi + 8]
push eax
push 0x100d18e0
push 0
push 0
mov byte [esi + 0x20], 0
mov dword [eax], esi
mov dword [esi + 0xc], ecx
call fcn.1014a9cb
add esp, 0x18
cmp eax, 0xffffffff
mov dword [esi + 4], eax
jne 0x100d1ffc
mov dword [esi + 4], 0
cmp dword [esi + 4], 0
jne 0x100d200d
mov byte [esi + 0x20], 1
xor al, al
pop esi
pop ecx
ret 4
mov al, 1
pop esi
pop ecx
ret 4
Function at 0x100d76e0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x10178427
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101b01e4]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0x14], ebx
call fcn.10033b60
xor ebp, ebp
mov dword [esp + 0x20], ebp
mov dword [ebx + 4], 0x10185b24
lea eax, [ebx + 0xc]
mov dword [ebx], 0x10187898
mov dword [ebx + 4], 0x10187890
push eax
mov dword [ebx + 8], 0x1018458c
call dword [sym.imp.KERNEL32.DLL_InitializeCriticalSection]
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov dword [ebx + 0x24], ecx
push eax
lea ecx, [ebx + 0x2c]
mov byte [esp + 0x24], 2
mov dword [ebx + 0x28], edx
call fcn.10010a20
mov esi, dword [esp + 0x34]
lea edi, [ebx + 0x150]
mov ecx, 0x2da
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x38]
push 0x114a
push ecx
lea edx, [ebx + 0xcb8]
push edx
call fcn.1014a220
mov esi, dword [esp + 0x48]
lea edi, [ebx + 0x1e02]
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
mov esi, dword [sym.imp.KERNEL32.DLL_InitializeCriticalSection]
add esp, 0xc
lea eax, [ebx + 0x1e40]
mov dword [ebx + 0x1e38], 0x10186784
mov edi, 0x1018458c
push eax
mov dword [ebx + 0x1e3c], edi
call esi
mov dword [ebx + 0x1e58], 1
mov ecx, dword [esp + 0x40]
push ecx
lea ecx, [ebx + 0x1e5c]
mov byte [esp + 0x24], 4
call fcn.10042860
mov dl, byte [esp + 0x44]
mov eax, dword [esp + 0x48]
lea ecx, [ebx + 0x1f00]
mov byte [ebx + 0x1ef0], dl
mov dword [ebx + 0x1ef4], ebp
mov dword [ebx + 0x1ef8], eax
push ecx
mov dword [ebx + 0x1efc], edi
call esi
lea edi, [ebx + 0x1f18]
mov ecx, edi
call fcn.10005a20
lea edx, [ebx + 0x1fac]
mov dword [ebx + 0x1fa0], 0x10185b2c
push edx
mov dword [ebx + 0x1fa8], 0x1018458c
call esi
mov dword [ebx + 0x1fc8], ebp
mov dword [ebx + 0x1fcc], ebp
lea eax, [ebx + 0x1fdc]
mov dword [ebx + 0x1fd0], 0x10185b2c
push eax
mov dword [ebx + 0x1fd8], 0x1018458c
call esi
mov dword [ebx + 0x1ff8], ebp
mov dword [ebx + 0x1ffc], ebp
mov dword [ebx + 0x2004], ebp
mov dword [ebx + 0x2008], ebp
mov dword [ebx + 0x200c], ebp
push ebp
mov dword [ebx + 0x2010], ebp
mov dword [ebx + 0x2014], ebp
mov dword [ebx + 0x2018], ebp
call fcn.10149d08
mov dword [ebx + 0x2000], eax
add esp, 4
mov dword [edi], 7
mov eax, ebx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x24
Function at 0x100d8360
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x10178518
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101b01e4]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, dword [esp + 0x44]
lea eax, [esi + 0x10]
mov dword [esp + 0x24], eax
add eax, 4
push eax
mov dword [esp + 0x24], 0x1018442c
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov edi, dword [esp + 0x40]
lea eax, [esp + 0x44]
push eax
mov ecx, edi
mov dword [esp + 0x3c], 0
mov byte [esp + 0x48], 3
call fcn.10051c10
mov ecx, dword [esi + 0xc]
lea edx, [esp + 0x44]
mov dword [esp + 0x44], ecx
push edx
mov ecx, edi
call fcn.10002680
mov eax, dword [esi + 8]
mov ebx, dword [eax]
lea edi, [esi + 4]
mov esi, edi
mov ecx, eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], esi
mov dword [esp + 0x2c], ecx
test esi, esi
je 0x100d83f8
cmp esi, edi
je 0x100d83fd
call fcn.10149775
cmp ebx, dword [esp + 0x2c]
je 0x100d844b
test esi, esi
jne 0x100d840c
call fcn.10149775
cmp ebx, dword [esi + 4]
jne 0x100d8416
call fcn.10149775
cmp ebx, dword [esi + 4]
lea ebp, [ebx + 0xc]
jne 0x100d8423
call fcn.10149775
mov ecx, dword [esp + 0x40]
lea edx, [ebp + 0x14]
push edx
push ebp
call fcn.10002910
mov ecx, eax
call fcn.10002910
lea ecx, [esp + 0x18]
call fcn.100d7af0
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
jmp 0x100d83f0
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
Function at 0x100d8560
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10178548
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101b01e4]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esi + 0x10]
lea ebx, [eax + 4]
push ebx
mov dword [esp + 0x20], 0x1018442c
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov edi, dword [esp + 0x68]
push edi
lea eax, [esp + 0x18]
add esi, 4
push eax
mov ecx, esi
mov dword [esp + 0x68], 0
call fcn.100d7d60
mov ebp, dword [esp + 0x14]
test ebp, ebp
mov ecx, dword [esi + 4]
mov dword [esp + 0x28], ecx
je 0x100d85d1
cmp ebp, esi
je 0x100d85d6
call fcn.10149775
mov eax, dword [esp + 0x18]
cmp eax, dword [esp + 0x28]
je 0x100d85f5
cmp byte [esp + 0x70], 0
je 0x100d85f5
push eax
push ebp
lea edx, [esp + 0x2c]
push edx
mov ecx, esi
call fcn.100d7dd0
mov eax, dword [edi]
mov ecx, dword [edi + 4]
mov edx, dword [edi + 8]
mov dword [esp + 0x30], eax
mov eax, dword [edi + 0xc]
mov dword [esp + 0x34], ecx
mov ecx, dword [edi + 0x10]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x38], edx
mov edx, dword [eax]
mov dword [esp + 0x40], ecx
mov ecx, dword [eax + 4]
mov dword [esp + 0x44], edx
mov edx, dword [eax + 8]
mov dword [esp + 0x48], ecx
mov ecx, dword [eax + 0xc]
mov dword [esp + 0x4c], edx
mov edx, dword [eax + 0x10]
mov dword [esp + 0x50], ecx
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x28]
push ecx
mov ecx, esi
mov dword [esp + 0x5c], edx
call fcn.100d8470
push ebx
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret 0xc

Function at 0x100d8b00
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x101b01e4]
xor eax, esp
mov dword [esp + 0x190], eax
push esi
lea eax, [esp + 4]
push eax
mov esi, ecx
push 0x202
mov dword [esi], 0x10187940
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ecx, dword [esp + 0x194]
mov eax, esi
pop esi
xor ecx, esp
call fcn.10149c5e
add esp, 0x194
ret