joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44ac10
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x46e49e
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x490018]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esi + 0x68]
call fcn.00461d90
mov dword [esp + 0x30], 0
mov ebx, dword [eax + 4]
lea edi, [esi + 0x78]
test ebx, ebx
je 0x44ac85
cmp dword [edi + 4], 0
je 0x44ac79
mov edx, dword [edi]
mov eax, dword [edx + 0x10]
mov ecx, edi
call eax
mov edx, dword [edi]
mov eax, dword [edx + 0x18]
mov ecx, edi
call eax
mov edx, dword [edi]
mov eax, dword [edx + 0xc]
mov ecx, edi
mov dword [edi + 4], ebx
call eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 0xffffffff
call fcn.004491f0
lea ecx, [esp + 0x14]
push ecx
mov ecx, edi
call fcn.004494a0
mov dword [esp + 0x30], 1
mov ebx, dword [eax + 4]
lea edi, [esi + 0x70]
test ebx, ebx
je 0x44acd8
cmp dword [edi + 4], 0
je 0x44accc
mov edx, dword [edi]
mov eax, dword [edx + 0x10]
mov ecx, edi
call eax
mov edx, dword [edi]
mov eax, dword [edx + 0x18]
mov ecx, edi
call eax
mov edx, dword [edi]
mov eax, dword [edx + 0xc]
mov ecx, edi
mov dword [edi + 4], ebx
call eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 0xffffffff
call fcn.00460ce0
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [esp + 0x20]
push edx
mov edx, edi
call fcn.00460da0
mov dword [esp + 0x30], 2
mov eax, dword [eax + 4]
lea ebx, [esi + 0x80]
mov dword [esp + 0x14], eax
test eax, eax
je 0x44ad3a
cmp dword [ebx + 4], 0
je 0x44ad2e
mov eax, dword [ebx]
mov edx, dword [eax + 0x10]
mov ecx, ebx
call edx
mov eax, dword [ebx]
mov edx, dword [eax + 0x18]
mov ecx, ebx
call edx
mov eax, dword [esp + 0x14]
mov dword [ebx + 4], eax
mov eax, dword [ebx]
mov edx, dword [eax + 0xc]
mov ecx, ebx
call edx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 0xffffffff
call fcn.00460ac0
push 4
xor edx, edx
mov ecx, ebx
call fcn.00423940
mov dword [esi + 0xd8], eax
xor eax, eax
mov dword [esi + 0xf8], eax
mov dword [esi + 0xfc], eax
mov edi, dword [edi + 4]
cmp edi, eax
je 0x44ad76
lea ecx, [edi - 8]
jmp 0x44ad78
xor ecx, ecx
mov edx, dword [ecx + 0x18]
sub edx, dword [ecx + 0x14]
push eax
sar edx, 2
mov dword [esi + 0x98], edx
mov dword [esi + 0xe8], eax
mov dword [esi + 0xec], eax
push eax
mov dword [esi + 0xf0], eax
push eax
mov ecx, ebx
mov dword [esi + 0xf4], eax
call fcn.004239e0
mov dword [esi + 0x100], eax
mov dword [esi + 0x104], edx
mov eax, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x44d7b0
Capabilities:
Link many functions at runtime

Disassembly:
push ecx
push ebp
xor ebp, ebp
cmp dword [esi + 4], ebp
je 0x44d7c3
mov eax, 0x101
pop ebp
pop ecx
ret 4
mov eax, dword [esp + 0xc]
push ebx
push edi
push eax
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
cmp edi, ebp
je 0x44d856
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CreateObject
push edi
call ebx
push str.GetMethodProperty
push edi
mov dword [esi + 8], eax
call ebx
push str.GetNumberOfFormats
push edi
mov dword [esi + 0xc], eax
call ebx
push str.GetNumberOfMethods
push edi
mov dword [esi + 0x14], eax
call ebx
push str.GetHandlerProperty2
push edi
mov dword [esi + 0x10], eax
call ebx
mov dword [esi + 0x18], eax
cmp dword [esi + 8], ebp
je 0x44d83e
cmp dword [esi + 0xc], ebp
je 0x44d83e
cmp eax, ebp
je 0x44d83e
cmp dword [esi + 0x10], ebp
je 0x44d83e
cmp dword [esi + 0x14], ebp
je 0x44d83e
mov ebx, 1
mov dword [esi + 4], edi
pop edi
mov eax, ebx
pop ebx
pop ebp
pop ecx
ret 4
push edi
mov dword [esi + 8], ebp
mov dword [esi + 0xc], ebp
mov dword [esi + 0x10], ebp
mov dword [esi + 0x14], ebp
mov dword [esi + 0x18], ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ebx, ebp
pop edi
mov eax, ebx
pop ebx
pop ebp
pop ecx
ret 4
Function at 0x45c210
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x104
mov eax, dword [0x490018]
xor eax, esp
mov dword [esp + 0x100], eax
push esi
push 0x7f
lea eax, [esp + 8]
push eax
push 0x1004
push 0x800
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.MSVCR90.dll__wtoi]
or eax, 0x80000000
mov dword [esi + 0x25c], eax
xor eax, eax
add esp, 4
mov dword [esi + 0x1c4], eax
mov dword [esi + 0x1c8], eax
mov dword [esi + 0x1cc], eax
call fcn.0045c070
mov ecx, dword [esp + 0x104]
pop esi
xor ecx, esp
call fcn.00428cb4
add esp, 0x104
ret

Function at 0x45c530
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push 0xffffffffffffffff
push 0x46dda4
mov eax, dword fs:[0]
push eax
push ebp
push esi
push edi
mov eax, dword [0x490018]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, dword [esp + 0x20]
mov dword [edi], vtable.srnd::EventIntfOrigin.0
mov dword [edi + 0x28], 1
xor ebp, ebp
mov dword [esp + 0x18], ebp
mov dword [edi], vtable.srnd::WorkSpace.0
mov eax, vtable.Common::Helper::ArchiveInfo.0
mov dword [edi + 0x38], ebp
mov dword [edi + 0x34], eax
mov byte [esp + 0x18], 1
mov dword [edi + 0x40], ebp
mov dword [edi + 0x3c], eax
mov byte [esp + 0x18], 2
mov eax, vtable.Common::Format::Object.0
mov dword [edi + 0x48], ebp
mov dword [edi + 0x4c], ebp
mov dword [edi + 0x44], eax
mov dword [edi + 0x54], ebp
mov dword [edi + 0x50], vtable.Common::Helper::FormatInfo.0
mov byte [esp + 0x18], 3
mov dword [edi + 0x5c], ebp
mov dword [edi + 0x60], ebp
mov dword [edi + 0x58], eax
mov dword [edi + 0x68], ebp
mov dword [edi + 0x64], vtable.Common::Helper::FormatInfo.0
push 0x30
lea eax, [edi + 0x70]
push ebp
mov byte [esp + 0x20], 4
mov esi, vtable.Common::DeviceHelper.0
push eax
mov dword [edi + 0x6c], esi
call sub.MSVCR90.dll_memset
push 0x30
lea ecx, [edi + 0xa4]
push ebp
mov byte [esp + 0x2c], 5
push ecx
mov dword [edi + 0xa0], esi
call sub.MSVCR90.dll_memset
add esp, 0x18
lea esi, [edi + 0xd4]
mov byte [esp + 0x18], 6
call fcn.00449040
mov dword [esi], vtable.Common::FileDeviceForTest.0
mov byte [esp + 0x18], 7
mov dword [edi + 0x10c], ebp
mov dword [edi + 0x110], ebp
mov dword [edi + 0x114], ebp
mov dword [edi + 0x118], ebp
mov dword [edi + 0x11c], ebp
mov dword [edi + 0x120], ebp
mov dword [edi + 0x124], ebp
lea edx, [edi + 0x1d4]
or esi, 0xffffffff
mov dword [edi + 0x128], esi
push edx
mov dword [edi + 0x130], ebp
mov dword [edi + 0x138], ebp
mov dword [edi + 0x13c], ebp
mov dword [edi + 0x140], ebp
mov dword [edi + 0x144], ebp
mov dword [edi + 0x148], 1
call fcn.00406430
lea eax, [edi + 0x20c]
push eax
mov byte [esp + 0x1c], 8
call fcn.00406430
lea ecx, [edi + 0x264]
push ecx
mov byte [esp + 0x1c], 9
call fcn.0040ec40
mov byte [esp + 0x18], 0xa
mov dword [edi + 0x274], ebp
mov dword [edi + method.Common::Helper::FormatInfo.virtual_0], vtable.Common::Helper::FormatInfo.0
mov ecx, edi
mov byte [esp + 0x18], 0xb
call fcn.0045c210
mov edx, dword [esp + 0x24]
mov dword [edi + 0x30], edx
mov dword [esp + 0x18], esi
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0xc
ret 8
Function at 0x462500
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x46e425
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
mov eax, dword [0x490018]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov dword [esp + 0xc], vtable.Common::Variant::ObjectBase.0
xor ebx, ebx
mov dword [esp + 0xc], vtable.Common::Variant::PropertyArray.0
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], vtable.Common::Helper::FileSkipList.0
push 0x2f
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x30], ebx
call fcn.00440ae0
mov byte [esp + 0x28], 1
mov esi, dword [eax + 4]
cmp esi, ebx
je 0x46259a
cmp dword [esp + 0x10], ebx
je 0x462585
mov edx, dword [esp + 0xc]
mov eax, dword [edx + 0x10]
lea ecx, [esp + 0xc]
call eax
mov edx, dword [esp + 0xc]
mov eax, dword [edx + 0x18]
lea ecx, [esp + 0xc]
call eax
mov edx, dword [esp + 0xc]
mov eax, dword [edx + 0xc]
mov dword [esp + 0x10], ebx
lea ecx, [esp + 0xc]
mov dword [esp + 0x10], esi
call eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], bl
call fcn.0043f890
mov ecx, dword [ebp + 8]
push ecx
lea edx, [esp + 0x10]
push edx
call fcn.00467130
lea ecx, [esp + 0xc]
mov esi, eax
mov dword [esp + 0x28], 0xffffffff
call fcn.004670a0
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x462df0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46f048
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x490018]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
mov ecx, vtable.Common::Variant::ObjectBase.0
mov eax, vtable.Common::Variant::Property.0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], vtable.Common::ModuleObject.0
mov dword [esp + 0x34], eax
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], vtable.Common::Helper::ArchiveInfo.0
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x28], vtable.Common::Format::Object.0
mov dword [esp + 0x38], ebx
mov dword [esp + 0x34], vtable.Common::Helper::FormatInfo.0
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x58], ebx
mov eax, dword [edi + 0x38]
lea ebp, [edi + 0xc]
push ebp
lea esi, [esp + 0x2c]
mov dword [esp + 0x4c], eax
call fcn.00444320
mov ebp, dword [ebp + 0x10]
cmp ebp, ebx
je 0x462ecd
cmp dword [esp + 0x38], ebx
je 0x462eb8
mov edx, dword [esp + 0x34]
mov eax, dword [edx + 0x10]
lea ecx, [esp + 0x34]
call eax
mov edx, dword [esp + 0x34]
mov eax, dword [edx + 0x18]
lea ecx, [esp + 0x34]
call eax
mov edx, dword [esp + 0x34]
mov eax, dword [edx + 0xc]
mov dword [esp + 0x38], ebx
lea ecx, [esp + 0x34]
mov dword [esp + 0x38], ebp
call eax
mov esi, dword [edi + 8]
mov ecx, dword [edi + 0x20]
mov dword [esp + 0x3c], ecx
cmp esi, ebx
je 0x462f10
cmp dword [esp + 0x24], ebx
je 0x462efb
mov edx, dword [esp + 0x20]
mov eax, dword [edx + 0x10]
lea ecx, [esp + 0x20]
call eax
mov edx, dword [esp + 0x20]
mov eax, dword [edx + 0x18]
lea ecx, [esp + 0x20]
call eax
mov edx, dword [esp + 0x20]
mov eax, dword [edx + 0xc]
mov dword [esp + 0x24], ebx
lea ecx, [esp + 0x20]
mov dword [esp + 0x24], esi
call eax
mov ecx, dword [esp + 0x60]
push ecx
lea edx, [esp + 0x1c]
push edx
lea edx, [edi + 0x4c]
call fcn.00460da0
mov byte [esp + 0x58], 1
mov ebp, dword [eax + 4]
lea esi, [edi + 0x54]
cmp ebp, ebx
je 0x462f54
cmp dword [esi + 4], ebx
je 0x462f48
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x18]
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0xc]
mov ecx, esi
mov dword [esi + 4], ebp
call edx
lea ecx, [esp + 0x18]
mov byte [esp + 0x58], bl
call fcn.00460ac0
lea esi, [edi + 0x98]
call fcn.0044e840
lea eax, [esp + 0x20]
lea edi, [esi + 8]
push eax
call fcn.00422780
mov eax, dword [esp + 0x6c]
mov ecx, dword [esp + 0x60]
mov edx, dword [esi]
mov edx, dword [edx + 0x24]
push eax
mov eax, dword [esp + 0x6c]
push ecx
mov ecx, dword [esp + 0x6c]
push eax
push ecx
mov ecx, esi
call edx
mov ebx, eax
test bl, 1
je 0x462fa7
mov dword [esi + 0x9c], 1
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x5c], 0xffffffff
call fcn.00421120
mov eax, ebx
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48
ret 0x10
Function at 0x46b6c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x224
mov eax, dword [0x490018]
xor eax, esp
mov dword [esp + 0x220], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 0xa0
mov esi, ecx
lea ecx, [esp + 0xc4]
push 0
push ecx
mov dword [esp + 0x28], eax
call sub.MSVCR90.dll_memset
mov edi, dword [ebp + 8]
push esi
lea esi, [esp + 0xd0]
call fcn.0043cfa0
mov edx, dword [ebp + 0x10]
push edx
mov ecx, 0x28
lea edi, [esp + 0x174]
push ebx
lea eax, [esp + 0x178]
rep movsd dword es:[edi], dword [esi]
call fcn.0043cee0
mov eax, dword [ebp + 0x18]
lea ecx, [eax - 1]
mov eax, 0xcccccccd
mul ecx
shr edx, 4
add esp, 0x18
add edx, 1
mov dword [esp + 0x18], edx
je 0x46b8bb
lea edx, [esp + 0x204]
mov dword [esp + 0x10], 0
mov ebx, 1
mov dword [esp + 0xc], edx
jmp 0x46b770
xor eax, eax
mov dword [esp + 0x204], eax
mov dword [esp + 0x208], eax
mov dword [esp + 0x20c], eax
mov dword [esp + 0x210], eax
mov dword [esp + 0x214], eax
mov ecx, 0x28
lea esi, [esp + 0x160]
lea edi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
mov eax, ebx
shr eax, 0x18
mov ecx, ebx
shr ecx, 0x10
mov edx, ebx
shr edx, 8
mov byte [esp + 0x218], al
mov byte [esp + 0x219], cl
mov byte [esp + 0x21a], dl
mov byte [esp + 0x21b], bl
mov eax, 4
mov dword [esp + 0x14], 0x3e8
nop
push eax
lea eax, [esp + 0x21c]
push eax
lea eax, [esp + 0x28]
call fcn.0043cee0
lea ecx, [esp + 0x220]
push 0x14
push ecx
lea edi, [esp + 0x30]
call fcn.0043d040
add esp, 0x10
xor eax, eax
lea ebx, [ebx]
movzx edx, byte [esp + eax + 0x218]
xor byte [esp + eax + 0x204], dl
movzx ecx, byte [esp + eax + 0x219]
movzx edx, byte [esp + eax + 0x21a]
xor byte [esp + eax + 0x205], cl
xor byte [esp + eax + 0x206], dl
movzx ecx, byte [esp + eax + 0x21b]
movzx edx, byte [esp + eax + 0x21c]
xor byte [esp + eax + 0x207], cl
xor byte [esp + eax + 0x208], dl
add eax, 5
cmp eax, 0x14
jb 0x46b810
sub dword [esp + 0x14], 1
mov ecx, 0x28
lea esi, [esp + 0xc0]
lea edi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
jne 0x46b7e0
mov eax, dword [esp + 0x10]
xor ecx, ecx
cmp eax, dword [ebp + 0x18]
jae 0x46b8a0
mov edx, dword [esp + 0xc]
mov dl, byte [edx + eax]
mov esi, dword [esp + 0x1c]
mov byte [eax + esi], dl
inc ecx
inc eax
cmp ecx, 0x14
jb 0x46b886
mov eax, 0x14
add dword [esp + 0x10], eax
sub dword [esp + 0xc], eax
inc ebx
lea eax, [ebx - 1]
cmp eax, dword [esp + 0x18]
jb 0x46b770
mov ecx, dword [esp + 0x22c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00428cb4
mov esp, ebp
pop ebp
ret
Function at 0x40c006
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ecx, 0xcbf
mov ebx, edx
xor word [eax], dx
lea edx, [ebx + edx]
xchg dh, dl
lea eax, [eax + 2]
loop 0x40c00e
pop ebx
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x53ef11e1
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x42e024
nop
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x42cd70
nop
mov ecx, 0xac926f3
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e06c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x1001db0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
push 0x1001304
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1001de1
push 0x10012e8
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
or eax, 0xffffffff
jmp 0x1001e22
push 0x10012d0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1001e09
push 0x10012b8
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
or eax, 0xffffffff
jmp 0x1001e22
push 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [ebp - 8]
push 0x1001290
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1001e60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001318
push 0x1002000
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push 1
call dword [sym.imp.MSVCRT.dll___set_app_type]
add esp, 4
mov dword [0x100e304], 0xffffffff
mov dword [0x100e308], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x100e124]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov edx, dword [0x100e120]
mov dword [eax], edx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov ecx, dword [eax]
mov dword [0x100e30c], ecx
call fcn.01001ff0
mov eax, dword [0x100e010]
test eax, eax
jne 0x1001ef1
push 0x1001fe0
call dword [sym.imp.MSVCRT.dll___setusermatherr]
add esp, 4
call fcn.01001fc0
push 0x100e00c
push 0x100e008
call sub.MSVCRT.dll__initterm
add esp, 8
mov edx, dword [0x100e11c]
mov dword [ebp - 0x28], edx
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [0x100e118]
push ecx
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x1c]
push ecx
call dword [sym.imp.MSVCRT.dll___getmainargs]
add esp, 0x14
push 0x100e004
push section..data
call sub.MSVCRT.dll__initterm
add esp, 8
call dword [sym.imp.MSVCRT.dll___p___initenv]
mov edx, dword [ebp - 0x20]
mov dword [eax], edx
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call fcn.01001e30
add esp, 0xc
mov dword [ebp - 0x24], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
jmp 0x1001f90
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002180
Capabilities:
Listen for remote procedure calls

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001370
push 0x1002000
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x20], 0
call fcn.0100b430
test eax, eax
jne 0x10021bb
jmp 0x10022b6
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x100e12c], eax
cmp dword [0x100e12c], 0
jne 0x10021dc
jmp 0x10022b6
push 0
push 0x1001358
push 0xa
push 0x1001350
call dword [sym.imp.RPCRT4.dll_RpcServerUseProtseqEpA]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x10021fe
jmp 0x10022b6
push 0
push 0
mov eax, dword [0x100e040]
push eax
call dword [sym.imp.RPCRT4.dll_RpcServerRegisterIf]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x100221c
jmp 0x10022b6
push 0x100e134
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.RPCRT4.dll_RpcServerInqBindings]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x100223c
jmp 0x10022b6
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.RPCRT4.dll_RpcBindingVectorFree]
cmp dword [ebp - 0x1c], 0
je 0x100224e
jmp 0x10022b6
call fcn.0100c3f0
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x100225e
jmp 0x10022b6
mov dword [ebp - 4], 0
push 1
push 0xa
push 1
call dword [sym.imp.RPCRT4.dll_RpcServerListen]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x1002283
mov dword [ebp - 4], 0xffffffff
jmp 0x10022b6
call dword [sym.imp.RPCRT4.dll_RpcSsDontSerializeContext]
mov dword [ebp - 4], 0xffffffff
jmp 0x10022b2
xor eax, eax
jmp 0x10022c0
call fcn.010022e0
mov eax, 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10024d0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 8], 0x10013a8
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0x10025a0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0x30]
push ecx
call dword [sym.imp.USER32.dll_RegisterClassA]
and eax, 0xffff
test eax, eax
jne 0x1002539
xor eax, eax
jmp 0x1002591
push 0
push 0
push 0
push 0
push bind
push bind
push bind
push bind
push 0xcf0000
push 0x10013a4
mov edx, dword [ebp - 8]
push edx
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1002578
xor eax, eax
jmp 0x1002591
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x1007f00
Capabilities:
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x100e210], eax
cmp dword [0x100e210], 0xffffffff
jne 0x1007f25
or eax, 0xffffffff
jmp 0x1007f7f
mov word [ebp - 0x10], 2
mov dword [ebp - 0xc], 0
push 0x1388
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0xe], ax
push 0x10
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [0x100e210]
push ecx
call dword [sym.imp.WS2_32.dll_bind]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x1007f6f
mov edx, dword [0x100e210]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
jmp 0x1007f7f
push 0x100e214
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [0x100e210]
mov esp, ebp
pop ebp
ret

Function at 0x100b430
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x100e2ac]
push eax
push 0x100e2ac
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x100b4f9
mov dword [0x100e280], 0
push 0x100e290
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x100e2b0], eax
cmp dword [0x100e2b0], 0
jne 0x100b485
xor eax, eax
jmp 0x100b54b
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x100e2b8], eax
cmp dword [0x100e2b8], 0
jne 0x100b4a6
jmp 0x100b549
push 0
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x100e2bc], eax
cmp dword [0x100e2bc], 0
jne 0x100b4c7
jmp 0x100b547
lea ecx, [ebp - 4]
push ecx
push 0
push 0
push 0x100b730
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x100e2b4], eax
cmp dword [0x100e2b4], 0
jne 0x100b4ee
jmp 0x100b545
push 0x100e2ac
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, 1
jmp 0x100b54b
cmp dword [0x100e2b0], 0
je 0x100b516
mov edx, dword [0x100e2b0]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x100e2b8], 0
je 0x100b52b
mov eax, dword [0x100e2b8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x100e2bc], 0
je 0x100b541
mov ecx, dword [0x100e2bc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x100b54b
jmp 0x100b500
jmp 0x100b500
jmp 0x100b500
mov esp, ebp
pop ebp
ret

Function at 0x100b6e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [0x100e28c]
push ecx
push 0x100b5d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100b722
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x100e28c]
add eax, 1
mov dword [0x100e28c], eax
mov esp, ebp
pop ebp
ret