joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4086c0
Capabilities:
Set environment variable

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
test ebp, ebp
push edi
je 0x40887a
push 0x3d
push ebp
call fcn.00408b70
mov esi, eax
add esp, 8
test esi, esi
je 0x40887a
cmp ebp, esi
je 0x40887a
xor eax, eax
mov ecx, dword [0x40dd7c]
cmp word [esi + 2], ax
sete al
mov edi, eax
mov eax, dword [0x40dd78]
cmp eax, ecx
mov dword [esp + 0x10], edi
jne 0x40871a
push eax
call fcn.00408950
add esp, 4
mov dword [0x40dd78], eax
test eax, eax
jne 0x40879a
mov ecx, dword [esp + 0x1c]
test ecx, ecx
mov ecx, dword [0x40dd70]
je 0x408742
test ecx, ecx
je 0x408742
call fcn.00408af0
test eax, eax
je 0x408795
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
test edi, edi
je 0x40874e
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
test ecx, ecx
jne 0x408774
push 4
call fcn.00403560
add esp, 4
mov dword [0x40dd70], eax
test eax, eax
je 0x40887a
mov dword [eax], 0
mov eax, dword [0x40dd78]
test eax, eax
jne 0x40879a
push 4
call fcn.00403560
add esp, 4
mov dword [0x40dd78], eax
test eax, eax
je 0x40887a
mov dword [eax], 0
mov eax, dword [0x40dd78]
mov ecx, dword [esp + 0x18]
sub esi, ebp
mov ebp, esi
mov ebx, eax
sar ebp, 1
push ebp
push ecx
call fcn.004088d0
mov esi, eax
add esp, 8
test esi, esi
jl 0x40888c
cmp dword [ebx], 0
je 0x40888c
test edi, edi
je 0x408883
mov edx, dword [ebx + esi*4]
lea edi, [ebx + esi*4]
push edx
call fcn.00402900
mov eax, dword [edi]
add esp, 4
test eax, eax
je 0x4087f3
mov eax, edi
mov ecx, dword [eax + 4]
add eax, 4
mov dword [edi], ecx
inc esi
mov ecx, dword [eax]
mov edi, eax
test ecx, ecx
jne 0x4087e2
lea edx, [esi*4]
push edx
push ebx
call fcn.00407f80
add esp, 8
test eax, eax
je 0x40880d
mov dword [0x40dd78], eax
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x408872
mov eax, dword [esp + 0x18]
push eax
call fcn.004078b0
add esp, 4
lea ecx, [eax + eax + 4]
push ecx
call fcn.00403560
mov esi, eax
add esp, 4
test esi, esi
je 0x408872
mov edx, dword [esp + 0x18]
push edx
push esi
call fcn.00408ac0
add esp, 8
lea eax, [esi + ebp*2 + 2]
neg edi
sbb edi, edi
mov word [esi + ebp*2], 0
not edi
and edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push esi
call fcn.00402900
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret
mov eax, dword [esp + 0x18]
mov dword [ebx + esi*4], eax
jmp 0x408811
test edi, edi
jne 0x408872
test esi, esi
jge 0x408896
neg esi
lea ecx, [esi*4 + 8]
push ecx
push ebx
call fcn.00407f80
add esp, 8
test eax, eax
je 0x40887a
mov edx, dword [esp + 0x18]
mov dword [eax + esi*4], edx
mov dword [eax + esi*4 + 4], 0
mov dword [0x40dd78], eax
jmp 0x408811
Function at 0x409300
Capabilities:
Get geographical location

Disassembly:
mov eax, dword [0x40e034]
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push edi
test eax, eax
jne 0x409348
push 0
push 0
push 1
push 0
call esi
test eax, eax
je 0x409328
mov eax, 1
jmp 0x409343
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x409419
mov eax, 2
mov dword [0x40e034], eax
cmp eax, 1
jne 0x409368
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push ecx
push edx
push eax
call esi
pop edi
pop esi
pop ebp
pop ebx
ret
cmp eax, 2
jne 0x40942b
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x409383
mov ecx, dword [0x40e018]
mov dword [esp + 0x24], ecx
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
push 0
push 0
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov esi, eax
test esi, esi
jne 0x4093a2
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
call fcn.00403560
mov edi, eax
add esp, 4
test edi, edi
jne 0x4093b6
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
push edi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x409410
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x4093f4
mov edx, dword [esp + 0x24]
push eax
push eax
push 0xffffffffffffffff
push edi
push 1
push edx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
test esi, esi
je 0x409410
push edi
call fcn.00402900
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [esp + 0x24]
push eax
mov eax, dword [esp + 0x20]
push eax
push 0xffffffffffffffff
push edi
push 1
push ecx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
test esi, esi
jne 0x409420
push edi
call fcn.00402900
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
push edi
call fcn.00402900
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x548bd0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xf0000]
push edi
or ebp, 0xffffffff
jmp 0x548bf2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x548bf9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x548be8
mov eax, 1
add ebx, ebx
jne 0x548c0b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x548c00
jne 0x548c1c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x548c00
xor ecx, ecx
sub eax, 3
jb 0x548c30
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x548ca2
mov ebp, eax
add ebx, ebx
jne 0x548c3b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x548c48
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x548c6c
inc ecx
add ebx, ebx
jne 0x548c58
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x548c4d
jne 0x548c69
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x548c4d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x548c8c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x548c7d
jmp 0x548bee
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x548c8c
add edi, ecx
jmp 0x548bee
pop esi
mov edi, esi
mov ecx, 0x1cd6
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x548caa
cmp byte [edi], 0xc
jne 0x548caa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x548caf
lea edi, [esi + 0x146000]
mov eax, dword [edi]
or eax, eax
je 0x548d27
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x14dbb8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x14dbf4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x548cdc
mov ecx, edi
jns 0x548d0b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x14dbf8]
or eax, eax
je 0x548d21
mov dword [ebx], eax
add ebx, 4
jmp 0x548cf9
call dword [esi + 0x14dc08]
mov ebp, dword [esi + 0x14dbfc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1e7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x548d5b
sub esp, 0xffffff80
jmp 0x4069f0
Function at 0x1000f203
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1000f242
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000f242
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000f242
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1000f242
cmp dword [ecx + 0x74], 0xe
jbe 0x1000f242
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10011ebf
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10011f5c
push ebx
push esi
call fcn.10011e88
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10011e1c
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10011f09
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10011f5b
push edi
push eax
call fcn.10012e7a
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10011f29
call fcn.10010964
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10011f5a
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10011e1c
add esp, 0x20
test eax, eax
jne 0x10011f48
push edi
call fcn.10010964
jmp 0x10011f50
push ebx
call fcn.10010964
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x100121c9
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10019888
push 0x10019880
push str.FlsAlloc
push 0x1f
call fcn.100120e5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100121fd
push dword [ebp + 8]
mov ecx, esi
call dword [0x10018150]
call esi
jmp 0x10012203
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10012247
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10019898
push 0x10019890
push str.FlsGetValue
push 0x21
call fcn.100120e5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001227e
push dword [ebp + 8]
mov ecx, esi
call dword [0x10018150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10012286
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100198a0
push 0x10019898
push str.FlsSetValue
push 0x22
call fcn.100120e5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100122c0
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10018150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10017940
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001796d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001796d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10001f00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 1
xor eax, eax
mov dl, byte [edi + eax + 0x3ed419b4]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0xb
jb 0x10001f11
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10001f40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 9
xor eax, eax
mov dl, byte [edi + eax - 0x7bd60ae8]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x1a
jb 0x10001f51
pop edi
mov byte [esi + 0x1a], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10001f80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x19
xor eax, eax
mov dl, byte [edi + eax + 0x1bf4bbef]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x88
jb 0x10001f91
pop edi
mov byte [esi + 0x88], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10002150
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x50
xor eax, eax
mov dl, byte [edi + eax + 0x5abdd636]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0xb
jb 0x10002161
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10002190
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x5b
xor eax, eax
mov dl, byte [edi + eax - 0x416a29a2]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x25
jb 0x100021a1
pop edi
mov byte [esi + 0x25], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x100022d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x70
xor eax, eax
mov dl, byte [edi + eax - 0x2a0c3c7f]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x2c
jb 0x100022e1
pop edi
mov byte [esi + 0x2c], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10002310
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x84
xor eax, eax
mov dl, byte [edi + eax - 0x49ba47c2]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x1e
jb 0x10002321
pop edi
mov byte [esi + 0x1e], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10002350
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x89
xor eax, eax
mov dl, byte [edi + eax + 0x1af98a5a]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0xf
jb 0x10002361
pop edi
mov byte [esi + 0xf], 0
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x10002390
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x8c
xor eax, eax
mov dl, byte [edi + eax + 0x57243b52]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x10
jb 0x100023a1
pop edi
mov byte [esi + 0x10], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x100024b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0xbe
xor eax, eax
mov dl, byte [edi + eax + 0x6e0053c7]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x11
jb 0x100024c1
pop edi
mov byte [esi + 0x11], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x100025d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0xe8
xor eax, eax
mov dl, byte [edi + eax + 0x3566316e]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x2a
jb 0x100025e1
pop edi
mov byte [esi + 0x2a], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10002610
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0xeb
xor eax, eax
mov dl, byte [edi + eax - 0x7b6b46e5]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x20
jb 0x10002621
pop edi
mov byte [esi + 0x20], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10002770
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0xf0
xor eax, eax
mov dl, byte [edi + eax + 0xab77782]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x17
jb 0x10002781
pop edi
mov byte [esi + 0x17], 0
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x10004630
Capabilities:
Connect socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10139bc4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
cmp dword [esi + 4], 0xffffffff
je 0x100046bb
push dword [ebp + 0xc]
mov eax, 2
mov word [ebp - 0x14], ax
call dword [sym.imp.WS2_32.dll_htons]
push edi
mov word [ebp - 0x12], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x10], eax
cmp eax, 0xffffffff
jne 0x10004693
push edi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x10004693
movsx ecx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
push ecx
push dword [eax]
lea eax, [ebp - 0x10]
push eax
call fcn.10012020
add esp, 0xc
push 0x10
lea eax, [ebp - 0x14]
push eax
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x100046cf
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x100046cf
mov ecx, esi
call fcn.10004cd0
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000fa46
mov esp, ebp
pop ebp
ret 8
push 0x23
push dword [esi + 8]
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
jne 0x10004728
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x100046f8
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 4], 0xffffffff
mov eax, dword [esi + 8]
test eax, eax
je 0x1000470d
push eax
call dword [sym.imp.WS2_32.dll_WSACloseEvent]
mov dword [esi + 8], 0
pop edi
mov byte [esi + 0x100038], 0
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000fa46
mov esp, ebp
pop ebp
ret 8
push 0x80000
lea eax, [esi + 0xc]
push 0
push eax
call fcn.100125a0
push 0x80000
lea eax, [esi + 0x80010]
mov dword [esi + 0x8000c], 0
push 0
push eax
call fcn.100125a0
mov ecx, dword [ebp - 4]
add esp, 0x18
mov dword [esi + 0x100010], 0
xor ecx, ebp
mov byte [esi + 0x100038], 1
mov al, 1
pop edi
pop esi
call fcn.1000fa46
mov esp, ebp
pop ebp
ret 8
Function at 0x100047e0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002ad66
mov eax, dword fs:[0]
push eax
sub esp, 0x648
mov eax, dword [0x10139bc4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x654], eax
mov eax, dword [0x1002d864]
mov dword [ebp - 0x18], eax
mov ax, word [0x1002d868]
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x620]
push eax
push 0x3ff
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x10004944
lea esi, [ebp - 0x620]
nop dword [eax]
mov ax, word [esi]
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x220]
push 0x104
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x10004930
xor eax, eax
mov dword [ebp - 0x624], 7
mov dword [ebp - 0x628], 0
mov word [ebp - 0x638], ax
cmp word [ebx], ax
je 0x100048af
mov eax, ebx
lea edx, [eax + 2]
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100048a0
sub eax, edx
sar eax, 1
push eax
push ebx
lea ecx, [ebp - 0x638]
call fcn.10009320
cmp word [ebp - 0x220], 0
mov dword [ebp - 4], 0
jne 0x100048d1
xor ecx, ecx
jmp 0x100048ef
lea ecx, [ebp - 0x220]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100048e0
sub ecx, edx
sar ecx, 1
push ecx
push 0
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x638]
call fcn.10009ca0
mov edi, eax
cmp edi, 0xffffffff
jne 0x10004962
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x624]
cmp eax, 8
jb 0x10004930
inc eax
lea ecx, [ebp - 0x638]
push eax
push dword [ebp - 0x638]
call fcn.10009640
nop dword [eax]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10004930
cmp word [esi], ax
jne 0x10004850
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000fa46
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x650]
call fcn.10002ac0
mov eax, dword [eax + 0x10]
lea ecx, [ebp - 0x638]
push esi
inc eax
mov byte [ebp - 4], 1
push eax
push edi
call fcn.1000b370
mov eax, dword [ebp - 0x63c]
cmp eax, 8
jb 0x100049a8
inc eax
lea ecx, [ebp - 0x650]
push eax
push dword [ebp - 0x650]
call fcn.10009640
cmp dword [ebp - 0x624], 8
lea eax, [ebp - 0x638]
cmovae eax, dword [ebp - 0x638]
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x654]
call fcn.10014dfd
mov eax, dword [ebp - 0x624]
add esp, 0xc
cmp eax, 8
jb 0x100049ec
inc eax
lea ecx, [ebp - 0x638]
push eax
push dword [ebp - 0x638]
call fcn.10009640
mov al, 1
jmp 0x10004946
Function at 0x10004a00
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8000c
call fcn.1000fa60
mov eax, dword [0x10139bc4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push edi
mov edi, ecx
mov dword [ebp - 0x80008], eax
lea ebx, [edi + 0x10001c]
push ebx
mov dword [ebp - 0x8000c], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [edi + 4], 0xffffffff
je 0x10004bc3
cmp byte [edi + 0x100038], 0
je 0x10004bc3
push esi
push 0x80000
lea eax, [ebp - 0x80004]
push 0
push eax
call fcn.100125a0
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x80004]
push esi
push dword [ebp - 0x80008]
push eax
call fcn.10012020
add esp, 0x18
cmp byte [ebp - 0x80004], 0xc1
jne 0x10004a96
push dword [ebp - 0x80002]
lea eax, [esi - 3]
push eax
lea eax, [ebp - 0x80001]
jmp 0x10004aa6
push dword [ebp - 0x80001]
lea eax, [esi - 4]
push eax
lea eax, [ebp - 0x80000]
push eax
call fcn.10006e30
mov ecx, dword [edi + 0x100010]
add esp, 0xc
test ecx, ecx
jle 0x10004b08
lea eax, [ecx + esi]
cmp eax, 0x80000
jle 0x10004ae6
mov ecx, edi
call fcn.10004cd0
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop edi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000fa46
mov esp, ebp
pop ebp
ret 8
push esi
lea eax, [ebp - 0x80004]
push eax
lea eax, [edi + 0x80010]
add eax, ecx
push eax
call fcn.10012020
add esp, 0xc
add dword [edi + 0x100010], esi
push ebx
jmp 0x10004b39
xor ebx, ebx
test esi, esi
jle 0x10004b32
nop
push 0
push esi
lea eax, [ebp - 0x80004]
add eax, ebx
push eax
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x10004b54
sub esi, eax
add ebx, eax
test esi, esi
jg 0x10004b10
mov eax, dword [ebp - 0x8000c]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop edi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000fa46
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x10004b9a
mov ecx, dword [edi + 0x100010]
lea eax, [ecx + esi]
cmp eax, 0x80000
jg 0x10004b9a
lea eax, [ebp - 0x80004]
add eax, ebx
push esi
push eax
lea eax, [edi + 0x80010]
add eax, ecx
push eax
call fcn.10012020
add esp, 0xc
lea eax, [edi + 0x10001c]
add dword [edi + 0x100010], esi
jmp 0x10004b38
mov ecx, edi
call fcn.10004cd0
lea eax, [edi + 0x10001c]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop edi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000fa46
mov esp, ebp
pop ebp
ret 8
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop ebx
call fcn.1000fa46
mov esp, ebp
pop ebp
ret 8