joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002100
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 1
xor eax, eax
mov dl, byte [edi + eax + 0x3ed419b4]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0xb
jb 0x10002111
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x100021b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 9
xor eax, eax
mov dl, byte [edi + eax - 0x7bd60ae8]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x1a
jb 0x100021c1
pop edi
mov byte [esi + 0x1a], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x100021f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 9
xor eax, eax
mov dl, byte [edi + eax - 0x1abd646a]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x28
jb 0x10002201
pop edi
mov byte [esi + 0x28], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x100022c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x15
xor eax, eax
mov dl, byte [edi + eax + 0x43f2140e]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0xf
jb 0x100022d1
pop edi
mov byte [esi + 0xf], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10002300
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x19
xor eax, eax
mov dl, byte [edi + eax + 0x1bf4bbef]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x88
jb 0x10002311
pop edi
mov byte [esi + 0x88], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x100023d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x1b
xor eax, eax
mov dl, byte [edi + eax - 0x56714f1a]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x1b
jb 0x100023e1
pop edi
mov byte [esi + 0x1b], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x100024a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x1e
xor eax, eax
mov dl, byte [edi + eax - 0x69914085]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0xd
jb 0x100024b1
pop edi
mov byte [esi + 0xd], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10002560
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x2d
xor eax, eax
mov dl, byte [edi + eax + 0x5d9825a0]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x25
jb 0x10002571
pop edi
mov byte [esi + 0x25], 0
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x100025a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x34
xor eax, eax
mov dl, byte [edi + eax + 0x32593faf]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0xf
jb 0x100025b1
pop edi
mov byte [esi + 0xf], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x100025e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x36
xor eax, eax
mov dl, byte [edi + eax - 0x5023d40c]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x3b
jb 0x100025f1
pop edi
mov byte [esi + 0x3b], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10002620
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x37
xor eax, eax
mov dl, byte [edi + eax + 0x1ea2c6cb]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x1b
jb 0x10002631
pop edi
mov byte [esi + 0x1b], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10002660
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x3f
xor eax, eax
mov dl, byte [edi + eax - 0x4bcee95d]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0xe
jb 0x10002671
pop edi
mov byte [esi + 0xe], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10002820
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x50
xor eax, eax
mov dl, byte [edi + eax + 0x5abdd636]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0xb
jb 0x10002831
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x100028e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x68
xor eax, eax
mov dl, byte [edi + eax - 0x2cf13859]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0xe
jb 0x100028f1
pop edi
mov byte [esi + 0xe], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x100029a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x70
xor eax, eax
mov dl, byte [edi + eax - 0x2a0c3c7f]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x2c
jb 0x100029b1
pop edi
mov byte [esi + 0x2c], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x100029e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x77
xor eax, eax
mov dl, byte [edi + eax + 0x6648017d]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x1a
jb 0x100029f1
pop edi
mov byte [esi + 0x1a], 0
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x10002a90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0xab
xor eax, eax
mov dl, byte [edi + eax - 0x7b84b047]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x12
jb 0x10002aa1
pop edi
mov byte [esi + 0x12], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10002ad0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0xaf
xor eax, eax
mov dl, byte [edi + eax + 0x1f0ff0d2]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x23
jb 0x10002ae1
pop edi
mov byte [esi + 0x23], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10002b80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0xba
xor eax, eax
mov dl, byte [edi + eax - 0x5fdb605b]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0xf
jb 0x10002b91
pop edi
mov byte [esi + 0xf], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10002c30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0xc3
xor eax, eax
mov dl, byte [edi + eax + 0x575628d2]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0xe
jb 0x10002c41
pop edi
mov byte [esi + 0xe], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10002e50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0xd9
xor eax, eax
mov dl, byte [edi + eax - 0x1a2e1036]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0xd
jb 0x10002e61
pop edi
mov byte [esi + 0xd], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10002e90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0xe8
xor eax, eax
mov dl, byte [edi + eax + 0x3566316e]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x2a
jb 0x10002ea1
pop edi
mov byte [esi + 0x2a], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x100030b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0xf0
xor eax, eax
mov dl, byte [edi + eax + 0xab77782]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x17
jb 0x100030c1
pop edi
mov byte [esi + 0x17], 0
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x10004760
Capabilities:
Check if file exists
Create thread
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
movzx eax, byte [ecx + 4]
cmp eax, 5
ja case.default.0x10004773
jmp dword [eax*4 + 0x100047f8]
pop ebp
jmp fcn.100073c0
cmp dword [0x10049094], 0
jne case.default.0x10004773
mov dword [0x10049094], 1
push 0
push 0
push 0
push 0x10004f40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
cmp dword [0x10049094], 0
jne case.default.0x10004773
mov dword [0x10049094], 2
jmp 0x10004793
cmp dword [0x10049094], 0
jne case.default.0x10004773
mov dword [0x10049094], 3
jmp 0x10004793
cmp dword [0x10049094], 0
jne case.default.0x10004773
mov dword [0x10049094], 4
jmp 0x10004793
cmp byte [ecx + 0x10], 0
setne byte [0x10049384]
pop ebp
ret
Function at 0x10005db0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10039a08
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x10149be4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x10149780]
cmp eax, 0x927c0
jb 0x10005df5
call esi
mov dword [0x10149780], eax
cmp dword [edi + 4], 0
je 0x10005e89
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 1
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x28], 0
push eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
call sub.gdiplus.dll_GdiplusStartup
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
push dword [edi + 8]
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 0
push eax
mov ecx, edi
call fcn.10013080
mov esi, dword [ebp - 0x1c]
test al, al
je 0x10005e6e
cmp esi, dword [ebp - 0x18]
je 0x10005e6e
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.1000f9f0
mov esi, dword [ebp - 0x1c]
push dword [ebp - 0x10]
call sub.gdiplus.dll_GdiplusShutdown
test esi, esi
je 0x10005e89
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x1c]
sub eax, esi
push eax
push esi
call fcn.100126f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10005ea0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10149be4]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x10005f7f
push esi
push 0xc
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0
push eax
xorps xmm0, xmm0
push edi
movq qword [ebp - 0x1c], xmm0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call sub.PSAPI.DLL_GetModuleInformation
xor esi, esi
mov dword [ebp - 0x10], 0xff6aff6a
mov dword [ebp - 0xc], 0xffffffff
mov word [ebp - 8], 0xffff
mov byte [ebp - 6], 0xe8
cmp dword [ebp - 0x1c], esi
jbe 0x10005f7e
push ebx
xor eax, eax
mov dl, byte [ebp + eax - 0x10]
cmp dl, 0xff
je 0x10005f16
lea ecx, [eax + edi]
cmp byte [ecx + esi], dl
jne 0x10005f77
inc eax
cmp eax, 0xb
jl 0x10005f05
mov al, byte [edi + esi + 1]
test al, al
je 0x10005f28
cmp al, 1
jne 0x10005f77
mov al, byte [edi + esi + 3]
test al, al
je 0x10005f34
cmp al, 1
jne 0x10005f77
lea ebx, [edi + 0xa]
add ebx, esi
mov eax, dword [ebx + 1]
add eax, 5
add eax, ebx
cmp eax, 0x404d70
jne 0x10005f77
lea eax, [ebp - 0x14]
push eax
push 0x40
push 5
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x1000f630
mov byte [ebx], 0xe8
sub eax, ebx
sub eax, 5
mov dword [ebx + 1], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x14]
push 5
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
inc esi
cmp esi, dword [ebp - 0x1c]
jb 0x10005f03
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.1001bbbf
mov esp, ebp
pop ebp
ret
Function at 0x10005f90
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10149be4]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x1000605b
push esi
push 0xc
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0
push eax
xorps xmm0, xmm0
push edi
movq qword [ebp - 0x1c], xmm0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call sub.PSAPI.DLL_GetModuleInformation
xor esi, esi
mov dword [ebp - 0x10], 0xff6aff6a
mov dword [ebp - 0xc], 0xffffffff
mov word [ebp - 8], 0xffff
mov byte [ebp - 6], 0xff
cmp dword [ebp - 0x1c], esi
jbe 0x1000605a
push ebx
nop
xor eax, eax
mov dl, byte [ebp + eax - 0x10]
cmp dl, 0xff
je 0x10006003
lea ecx, [eax + edi]
cmp byte [ecx + esi], dl
jne 0x10006053
inc eax
cmp eax, 0xb
jl 0x10005ff2
mov al, byte [edi + esi + 1]
test al, al
je 0x10006015
cmp al, 1
jne 0x10006053
mov al, byte [edi + esi + 3]
test al, al
je 0x10006021
cmp al, 1
jne 0x10006053
lea ebx, [edi + 5]
add ebx, esi
cmp dword [ebx], 0x404d70
jne 0x10006053
lea eax, [ebp - 0x14]
push eax
push 0x40
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x14]
mov dword [ebx], 0x1000f630
push eax
push dword [ebp - 0x14]
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
inc esi
cmp esi, dword [ebp - 0x1c]
jb 0x10005ff0
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.1001bbbf
mov esp, ebp
pop ebp
ret

Function at 0x10006070
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x10006103
mov eax, dword [0x1014aedc]
xorps xmm0, xmm0
push edi
push 0xc
mov dword [ebp - 0x10], 0
mov dword [eax], 0xffffffff
lea eax, [ebp - 0x10]
push eax
push esi
movq qword [ebp - 0xc], xmm0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call sub.PSAPI.DLL_GetModuleInformation
mov edi, dword [ebp - 0xc]
mov dword [ebp + 8], 0xe61730
test edi, edi
je 0x10006102
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor eax, eax
mov cl, byte [esi + eax]
cmp cl, byte [ebp + eax + 8]
jne 0x100060fb
inc eax
cmp eax, 4
jl 0x100060c7
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push esi
call ebx
mov eax, dword [0x1014aedc]
mov dword [esi], eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 4
push esi
call ebx
mov dword [ebp - 4], 0
inc esi
sub edi, 1
jne 0x100060c5
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10006110
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x100061a3
push edi
push 0xc
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
xorps xmm0, xmm0
push esi
movq qword [ebp - 0xc], xmm0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call sub.PSAPI.DLL_GetModuleInformation
mov edi, dword [ebp - 0xc]
test edi, edi
jne 0x10006153
mov eax, dword [esi + 0x3c]
mov edi, dword [eax + esi + 0x1c]
mov dword [ebp + 8], 0x7bc4f04
test edi, edi
je 0x100061a2
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor eax, eax
mov cl, byte [esi + eax]
cmp cl, byte [ebp + eax + 8]
jne 0x1000619b
inc eax
cmp eax, 4
jl 0x10006167
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push esi
call ebx
mov eax, dword [0x1014aee0]
mov dword [esi], eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 4
push esi
call ebx
mov dword [ebp - 4], 0
inc esi
sub edi, 1
jne 0x10006165
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100063c0
Capabilities:
Connect socket
Create thread
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10149be4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
cmp dword [esi + 4], 0xffffffff
je 0x1000644b
push dword [ebp + 0xc]
mov eax, 2
mov word [ebp - 0x14], ax
call dword [sym.imp.WS2_32.dll_htons]
push edi
mov word [ebp - 0x12], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x10], eax
cmp eax, 0xffffffff
jne 0x10006423
push edi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x10006423
movsx ecx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
push ecx
push dword [eax]
lea eax, [ebp - 0x10]
push eax
call fcn.1001e260
add esp, 0xc
push 0x10
lea eax, [ebp - 0x14]
push eax
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x1000645f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x1000645f
mov ecx, esi
call fcn.10007380
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001bbbf
mov esp, ebp
pop ebp
ret 8
push 0x23
push dword [esi + 8]
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
jne 0x100064b8
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x10006488
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 4], 0xffffffff
mov eax, dword [esi + 8]
test eax, eax
je 0x1000649d
push eax
call dword [sym.imp.WS2_32.dll_WSACloseEvent]
mov dword [esi + 8], 0
pop edi
mov byte [esi + 0x100038], 0
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001bbbf
mov esp, ebp
pop ebp
ret 8
push 0x80000
lea eax, [esi + 0xc]
push 0
push eax
call fcn.1001e7e0
push 0x80000
lea eax, [esi + 0x80010]
mov dword [esi + 0x8000c], 0
push 0
push eax
call fcn.1001e7e0
add esp, 0x18
mov dword [esi + 0x100010], 0
push 0
push 0
push esi
push 0x10006230
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
mov byte [esi + 0x100038], 1
xor ecx, ebp
pop esi
call fcn.1001bbbf
mov esp, ebp
pop ebp
ret 8
Function at 0x10006ba0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100396a6
mov eax, dword fs:[0]
push eax
sub esp, 0x648
mov eax, dword [0x10149be4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x654], eax
mov eax, dword [0x1003c8d4]
mov dword [ebp - 0x18], eax
mov ax, word [0x1003c8d8]
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x620]
push eax
push 0x3ff
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x10006d04
lea esi, [ebp - 0x620]
nop dword [eax]
mov ax, word [esi]
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x220]
push 0x104
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x10006cf0
xor eax, eax
mov dword [ebp - 0x624], 7
mov dword [ebp - 0x628], 0
mov word [ebp - 0x638], ax
cmp word [ebx], ax
je 0x10006c6f
mov eax, ebx
lea edx, [eax + 2]
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10006c60
sub eax, edx
sar eax, 1
push eax
push ebx
lea ecx, [ebp - 0x638]
call fcn.10012430
cmp word [ebp - 0x220], 0
mov dword [ebp - 4], 0
jne 0x10006c91
xor ecx, ecx
jmp 0x10006caf
lea ecx, [ebp - 0x220]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10006ca0
sub ecx, edx
sar ecx, 1
push ecx
push 0
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x638]
call fcn.10012e70
mov edi, eax
cmp edi, 0xffffffff
jne 0x10006d22
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x624]
cmp eax, 8
jb 0x10006cf0
inc eax
lea ecx, [ebp - 0x638]
push eax
push dword [ebp - 0x638]
call fcn.100127b0
nop dword [eax]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10006cf0
cmp word [esi], ax
jne 0x10006c10
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001bbbf
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x650]
call fcn.100033e0
mov eax, dword [eax + 0x10]
lea ecx, [ebp - 0x638]
push esi
inc eax
mov byte [ebp - 4], 1
push eax
push edi
call fcn.10014710
mov eax, dword [ebp - 0x63c]
cmp eax, 8
jb 0x10006d68
inc eax
lea ecx, [ebp - 0x650]
push eax
push dword [ebp - 0x650]
call fcn.100127b0
cmp dword [ebp - 0x624], 8
lea eax, [ebp - 0x638]
cmovae eax, dword [ebp - 0x638]
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x654]
call fcn.1002104f
mov eax, dword [ebp - 0x624]
add esp, 0xc
cmp eax, 8
jb 0x10006dac
inc eax
lea ecx, [ebp - 0x638]
push eax
push dword [ebp - 0x638]
call fcn.100127b0
mov al, 1
jmp 0x10006d06
Function at 0x10006dc0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
mov edi, ecx
mov dword [ebp - 8], 0
push 0
mov eax, 0x80000
mov edx, dword [edi + 0x8000c]
sub eax, edx
push eax
lea eax, [edi + 0xc]
add eax, edx
push eax
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x10006e8a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x10006e0c
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 4]
cmp eax, 0xffffffff
je 0x10006e22
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [edi + 4], 0xffffffff
mov eax, dword [edi + 8]
test eax, eax
je 0x10006e37
push eax
call dword [sym.imp.WS2_32.dll_WSACloseEvent]
mov dword [edi + 8], 0
mov byte [edi + 0x100038], 0
cmp dword [0x1004973c], 0xffffffff
je 0x10006e50
cmp byte [0x10149770], 0
jne 0x10006e83
push 0x1000c570
mov ecx, 0x10049738
call fcn.1000d0e0
test al, al
je 0x10006e83
movzx eax, word [0x1004901c]
mov ecx, 0x10049738
push eax
push 0x1004903f
call fcn.100063c0
test al, al
je 0x10006e83
call fcn.10004810
xor al, al
pop edi
mov esp, ebp
pop ebp
ret
add dword [edi + 0x8000c], eax
cmp dword [edi + 0x8000c], 4
jl 0x10006e05
push esi
xor ecx, ecx
push ebx
lea esi, [edi + 0xc]
lea eax, [esi + ecx]
mov dword [ebp - 0xc], eax
mov al, byte [eax]
cmp al, 0xc1
jne 0x10006eb9
movzx ebx, byte [ecx + edi + 0xd]
mov dl, al
jmp 0x10006ed6
cmp al, 0xc2
jne 0x10006f83
mov dl, al
movzx eax, byte [ecx + edi + 0xd]
shl ax, 8
movzx ebx, ax
movzx eax, byte [ecx + edi + 0xe]
or ebx, eax
cmp ebx, 4
jl 0x10006f83
cmp ebx, 0x80000
jg 0x10006f83
cmp ebx, dword [edi + 0x8000c]
jg 0x10006f51
cmp dl, 0xc1
jne 0x10006f06
movzx eax, byte [ecx + edi + 0xe]
lea esi, [edi + 0xf]
push eax
lea eax, [ebx - 3]
jmp 0x10006f12
movzx eax, byte [ecx + edi + 0xf]
lea esi, [edi + 0x10]
push eax
lea eax, [ebx - 4]
push eax
add esi, ecx
push esi
call fcn.1000e8a0
mov al, byte [esi]
add esp, 0xc
mov byte [ebp - 4], al
mov eax, dword [edi + 0x100014]
push ebx
push dword [ebp - 0xc]
push dword [ebp - 4]
call eax
mov ecx, dword [ebp - 8]
add esp, 0xc
sub dword [edi + 0x8000c], ebx
add ecx, ebx
cmp dword [edi + 0x8000c], 0
mov dword [ebp - 8], ecx
jle 0x10006f7a
jmp 0x10006ea1
test ecx, ecx
jle 0x10006f7a
mov eax, dword [edi + 0x8000c]
test eax, eax
jle 0x10006f7a
mov edx, 0x80000
sub edx, ecx
cmp eax, edx
jg 0x10006f7a
push eax
lea eax, [edi + 0xc]
add eax, ecx
push eax
push esi
call fcn.1001d370
add esp, 0xc
pop ebx
pop esi
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret
mov ecx, edi
call fcn.10007380
pop ebx
pop esi
xor al, al
pop edi
mov esp, ebp
pop ebp
ret