joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002390
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100b31b8
push 0x1009dce5
mov eax, dword fs:[0]
push eax
add esp, 0xffffffc0
mov eax, dword [0x100b9040]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x50], 0
xor eax, eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x40
push 0x3000
mov edx, dword [ebp - 0x44]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x10002425
xor al, al
jmp 0x100024ae
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
mov byte [ecx], 0xc3
lea edx, [ebp - 0x20]
push edx
push 0x140
mov eax, dword [ebp - 0x44]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10002450
xor al, al
jmp 0x100024ae
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x24]
push 0x1000249b
jmp eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1009dd14
mov esp, ebp
pop ebp
ret

Function at 0x10008890
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], ecx
push 0x400
push 0
mov eax, dword [ebp - 8]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 4], 0
jmp 0x100088be
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0xff
jg 0x10008958
push 8
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp - 8]
call fcn.10008960
shl eax, 0x18
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx + ecx*4], eax
mov dword [ebp - 0xc], 0
jmp 0x100088f7
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 8
jge 0x10008936
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx*4]
and eax, 0x80000000
je 0x10008916
mov dword [ebp - 0x10], 0x4c11db7
jmp 0x1000891d
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx*4]
shl eax, 1
xor eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx + ecx*4], eax
jmp 0x100088ee
push 0x20
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4]
push edx
mov ecx, dword [ebp - 8]
call fcn.10008960
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx + ecx*4], eax
jmp 0x100088b5
mov esp, ebp
pop ebp
ret
Function at 0x100089c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x100b9040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x418], ecx
mov dword [ebp - 0x408], 0xffffffff
mov dword [ebp - 0x40c], 0
mov dword [ebp - 0x410], 0
push 0x100a4d88
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x40c]
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
add esp, 0xc
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 0
jne 0x10008a28
cmp dword [ebp - 0x40c], 0
jne 0x10008a2d
or eax, 0xffffffff
jmp 0x10008a96
mov edx, dword [ebp - 0x40c]
push edx
push 0x400
push 1
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
mov dword [ebp - 0x410], eax
cmp dword [ebp - 0x410], 0
jbe 0x10008a7d
mov ecx, dword [ebp - 0x410]
push ecx
lea edx, [ebp - 0x404]
push edx
lea eax, [ebp - 0x408]
push eax
mov ecx, dword [ebp - 0x418]
call fcn.10008ab0
nop
jmp 0x10008a2d
mov ecx, dword [ebp - 0x40c]
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
mov eax, dword [ebp - 0x408]
xor eax, 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1009dd14
mov esp, ebp
pop ebp
ret 4

Function at 0x10016010
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call fcn.10004100
movzx eax, al
test eax, eax
je 0x10016030
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
jmp 0x100160dd
call fcn.1002faa0
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [0x100bb580], eax
mov dword [0x100bb584], edx
mov ecx, dword [0x100bb580]
mov edx, dword [0x100bb584]
mov dword [0x100bb588], ecx
mov dword [0x100bb58c], edx
push 0
push 0
push 0
push 0x10015b70
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10016087
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
jmp 0x100160dd
push 0
push 0
push 0
push 0x10015e60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x100160b0
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
jmp 0x100160dd
push 0x64
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x64
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov esp, ebp
pop ebp
ret
Function at 0x1001cb00
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100b9040]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x1001cb1f
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp + 8], eax
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
push eax
push 1
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x1001cb44
xor al, al
jmp 0x1001cbb1
mov dword [ebp - 8], 0
lea ecx, [ebp - 8]
push ecx
push 0x28
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1001cb63
xor al, al
jmp 0x1001cbb1
push 4
push str.SeSecurityPrivilege
mov eax, dword [ebp - 8]
push eax
call fcn.1001ca80
add esp, 0xc
movzx ecx, al
test ecx, ecx
je 0x1001cb97
push 4
push 0x100a5694
mov edx, dword [ebp - 8]
push edx
call fcn.1001ca80
add esp, 0xc
movzx eax, al
test eax, eax
jne 0x1001cb9b
xor al, al
jmp 0x1001cbb1
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1009dd14
mov esp, ebp
pop ebp
ret

Function at 0x1001cbc0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x100b9040]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20]
push eax
push 0xf01ff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1001cbf1
xor eax, eax
jmp 0x1001cc8d
lea ecx, [ebp - 0xc]
push ecx
movzx edx, byte [ebp - 0x21]
push edx
push str.SeDebugPrivilege
lea ecx, [ebp - 0x38]
call fcn.1001cca0
mov ecx, eax
call fcn.10009d10
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x1001cc29
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1001cc8d
mov dword [ebp - 0x1c], 1
mov ecx, 0xc
imul edx, ecx, 0
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov dword [ebp + edx - 0x18], eax
mov dword [ebp + edx - 0x14], ecx
mov edx, 0xc
imul eax, edx, 0
mov dword [ebp + eax - 0x10], 2
push 0
push 0
push 0x10
lea ecx, [ebp - 0x1c]
push ecx
push 0
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x1001cc7e
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1001cc8d
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1009dd14
mov esp, ebp
pop ebp
ret
Function at 0x10027bf0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x100b9040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x12c], 0x128
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x130], eax
lea eax, [ebp - 0x12c]
push eax
mov ecx, dword [ebp - 0x130]
push ecx
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x10027c6c
mov edx, dword [ebp - 0x124]
cmp edx, dword [ebp + 8]
jne 0x10027c54
mov eax, dword [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x10027c7b
lea ecx, [ebp - 0x12c]
push ecx
mov edx, dword [ebp - 0x130]
push edx
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x10027c35
mov eax, dword [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1009dd14
mov esp, ebp
pop ebp
ret

Function at 0x100281e0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x270
jne 0x100281ff
mov ecx, dword [ebp - 8]
call fcn.10028280
nop
jmp 0x10028213
mov ecx, dword [ebp - 8]
cmp dword [ecx], 0x4e0
jb 0x10028213
mov ecx, dword [ebp - 8]
call fcn.10028310
nop
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4 + 4]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
add ecx, 1
mov edx, dword [ebp - 8]
mov dword [edx], ecx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
shr ecx, 0xb
mov edx, dword [ebp - 8]
and ecx, dword [edx + 0x1384]
xor ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
shl eax, 7
and eax, 0x9d2c5680
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
shr edx, 0x12
xor edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x10028280
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0x270
jmp 0x1002829b
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x4e0
jae 0x10028307
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx*4 - 0x9bc]
and eax, 0x80000000
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [edx + ecx*4 - 0x9b8]
and ecx, 0x7fffffff
or eax, ecx
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
and edx, 1
je 0x100282df
mov dword [ebp - 0x10], 0x9908b0df
jmp 0x100282e6
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
shr eax, 1
xor eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
xor eax, dword [edx + ecx*4 - 0x388]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx + ecx*4 + 4], eax
jmp 0x10028292
mov esp, ebp
pop ebp
ret
Function at 0x10028310
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 4], ecx
mov dword [ebp - 0x28], 0x26f
mov dword [ebp - 0x2c], 0xe3
mov dword [ebp - 8], 0
jmp 0x10028339
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xe3
jae 0x100283a5
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [edx + ecx*4 + 0x9c4]
and eax, 0x80000000
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov ecx, dword [edx + ecx*4 + 0x9c8]
and ecx, 0x7fffffff
or eax, ecx
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
and edx, 1
je 0x1002837d
mov dword [ebp - 0x14], 0x9908b0df
jmp 0x10028384
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x10]
shr eax, 1
xor eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
xor eax, dword [edx + ecx*4 + 0xff8]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [edx + ecx*4 + 4], eax
jmp 0x10028330
mov dword [ebp - 0xc], 0xe3
jmp 0x100283b7
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x26f
jae 0x10028423
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [edx + ecx*4 + 0x9c4]
and eax, 0x80000000
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov ecx, dword [edx + ecx*4 + 0x9c8]
and ecx, 0x7fffffff
or eax, ecx
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
and edx, 1
je 0x100283fb
mov dword [ebp - 0x1c], 0x9908b0df
jmp 0x10028402
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x18]
shr eax, 1
xor eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
xor eax, dword [edx + ecx*4 - 0x388]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov dword [edx + ecx*4 + 4], eax
jmp 0x100283ae
mov dword [ebp - 0x30], 0x26f
mov eax, 4
imul ecx, eax, 0x4df
mov edx, dword [ebp - 4]
mov eax, dword [edx + ecx + 4]
and eax, 0x80000000
mov ecx, 4
imul edx, ecx, 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + edx + 4]
and edx, 0x7fffffff
or eax, edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
and eax, 1
je 0x1002846c
mov dword [ebp - 0x24], 0x9908b0df
jmp 0x10028473
mov dword [ebp - 0x24], 0
mov ecx, dword [ebp - 0x20]
shr ecx, 1
xor ecx, dword [ebp - 0x24]
mov edx, 4
imul eax, edx, 0x18c
mov edx, dword [ebp - 4]
xor ecx, dword [edx + eax + 4]
mov eax, 4
imul edx, eax, 0x26f
mov eax, dword [ebp - 4]
mov dword [eax + edx + 4], ecx
mov ecx, dword [ebp - 4]
mov dword [ecx], 0
mov esp, ebp
pop ebp
ret
Function at 0x1002a350
Capabilities:
Encrypt data using rc4 via winapi
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
push 0
push 1
movzx eax, byte [ebp - 1]
push eax
push 0x100a58f4
lea ecx, [ebp - 0x44]
call fcn.1002aa50
mov ecx, eax
call fcn.1002a510
push eax
push 0
push 0x100bb5d4
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x1002a41e
push 0x100bb5d0
push 0
push 0
push 0x8004
mov ecx, dword [0x100bb5d4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1002a41e
movzx edx, byte [ebp - 2]
push edx
push str._C_dq1DreamSoftPVFgVs1Aez_VS3R0hge_NvM_TJvblD4.af0h_r4bUzp_
lea ecx, [ebp - 0x84]
call fcn.1002afe0
mov ecx, eax
call fcn.1002a5a0
mov dword [ebp - 8], eax
mov eax, dword [0x100bb5d0]
mov dword [ebp - 0xc], eax
push 1
push 0x3c
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1002a41e
push 0x100bb5cc
push 0x800000
mov eax, dword [0x100bb5d0]
push eax
push 0x6801
mov ecx, dword [0x100bb5d4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x1002a41e
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x100bb5c8], eax
call fcn.1009c930
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.1009ce00
push 0x1002a290
push 0x100bb5c4
call fcn.1009c640
call fcn.1009c990
mov dword [ebp - 0x10], 0x60f6e0
push 4
push 0x60f6e0
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1002a496
mov dword [0x100bb5c4], 0x60f6e0
call fcn.1009c930
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.1009ce00
push 0x1002a290
push 0x100bb5c4
call fcn.1009c1b0
call fcn.1009c990
nop
call fcn.1009c930
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.1009ce00
push 0x1002a2c0
push 0x100bb5c0
call fcn.1009c640
call fcn.1009c990
mov dword [ebp - 0x14], 0x60eab0
push 4
push 0x60eab0
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1002a503
mov dword [0x100bb5c0], 0x60eab0
call fcn.1009c930
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.1009ce00
push 0x1002a2c0
push 0x100bb5c0
call fcn.1009c1b0
call fcn.1009c990
nop
mov esp, ebp
pop ebp
ret
Function at 0x1002fbc0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x100bb664]
push eax
call fcn.10037c50
add esp, 4
test eax, eax
je 0x1002fbde
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop ebp
ret

Function at 0x1002fbe0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp - 1]
push eax
push 0x100a5b5c
lea ecx, [ebp - 0x30]
call fcn.10033620
mov ecx, eax
call fcn.10009930
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1002fc1d
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
movzx ecx, byte [ebp - 2]
push ecx
push str.send
lea ecx, [ebp - 0x18]
call fcn.1002a680
mov ecx, eax
call fcn.10009280
push eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x1002fc61
mov eax, dword [ebp - 0xc]
push eax
call fcn.1002f370
add esp, 4
movzx ecx, al
cmp ecx, 0xe9
jne 0x1002fc6c
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
movzx edx, byte [ebp - 3]
push edx
push str.WSASend
lea ecx, [ebp - 0x24]
call fcn.10033770
mov ecx, eax
call fcn.10009430
push eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x1002fcb0
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.1002f370
add esp, 4
movzx edx, al
cmp edx, 0xe9
jne 0x1002fcb9
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esp, ebp
pop ebp
ret

Function at 0x1002fd20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp - 1]
push eax
push str.WS2_32.dll
lea ecx, [ebp - 0x30]
call fcn.10033870
mov ecx, eax
call fcn.10009930
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1002fd5d
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
movzx ecx, byte [ebp - 2]
push ecx
push str.recv
lea ecx, [ebp - 0x18]
call fcn.1002c4a0
mov ecx, eax
call fcn.10009280
push eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x1002fda1
mov eax, dword [ebp - 0xc]
push eax
call fcn.1002f370
add esp, 4
movzx ecx, al
cmp ecx, 0xe9
jne 0x1002fdac
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
movzx edx, byte [ebp - 3]
push edx
push str.WSARecv
lea ecx, [ebp - 0x24]
call fcn.10017fc0
mov ecx, eax
call fcn.10009430
push eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x1002fdf0
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.1002f370
add esp, 4
movzx edx, al
cmp edx, 0xe9
jne 0x1002fdf9
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esp, ebp
pop ebp
ret
Function at 0x10032030
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x100b9040]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x6d12c0
call fcn.1002f370
add esp, 4
movzx eax, al
cmp eax, 0xe9
jne 0x10032062
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 4
push 0x6d12c0
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x100320a3
mov dword [0x100bb5f4], 0x6d12c0
call fcn.1009c930
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.1009ce00
push 0x1002fe90
push 0x100bb5f4
call fcn.1009c1b0
call fcn.1009c990
nop
mov dword [ebp - 8], 0x6d141e
push 0x1002fe60
lea ecx, [ebp - 8]
push ecx
call fcn.10032e60
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1009dd14
mov esp, ebp
pop ebp
ret
Function at 0x100352a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
call fcn.1001c800
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
add ecx, 8
push ecx
mov ecx, dword [ebp - 0xc]
call fcn.1001c8a0
mov ecx, dword [ebp + 8]
call fcn.1001f060
mov edx, dword [ebp - 4]
add edx, 0x20
push edx
mov ecx, dword [ebp + 8]
call fcn.1001c8a0
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
add eax, 0x38
push eax
mov ecx, dword [ebp - 0x10]
call fcn.1001c940
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 4]
add ecx, 0x39
push ecx
mov ecx, dword [ebp - 0x14]
call fcn.1001c940
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 4]
add edx, 0x3e
push edx
mov ecx, dword [ebp - 0x18]
call fcn.1001c9e0
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
add eax, 0x3a
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.1001c940
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 4]
add ecx, 0x3b
push ecx
mov ecx, dword [ebp - 0x20]
call fcn.1001c940
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 4]
add edx, 0x3c
push edx
mov ecx, dword [ebp - 0x24]
call fcn.1001c940
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 4]
add eax, 0x68
push eax
mov ecx, dword [ebp - 0x28]
call fcn.1001c940
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 4]
add ecx, 0x69
push ecx
mov ecx, dword [ebp - 0x2c]
call fcn.1001c940
mov dword [ebp - 0x30], eax
mov edx, dword [ebp - 4]
add edx, 0x6a
push edx
mov ecx, dword [ebp - 0x30]
call fcn.1001c940
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x6b
push eax
mov ecx, dword [ebp - 0x34]
call fcn.1001c940
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 4]
add ecx, 0x6c
push ecx
mov ecx, dword [ebp - 0x38]
call fcn.1001c940
mov dword [ebp - 0x3c], eax
mov edx, dword [ebp - 4]
add edx, 0x4c
push edx
mov ecx, dword [ebp - 0x3c]
call fcn.1001c800
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 4]
add eax, 0x50
push eax
mov ecx, dword [ebp - 0x40]
call fcn.1001c800
mov byte [0x100bb5ec], 1
cmp dword [0x100bb578], 0
je 0x100353f3
mov ecx, dword [0x100bb578]
cmp dword [ecx + 0x20], 0
je 0x100353f3
mov edx, dword [0x100bb578]
mov ecx, dword [edx + 0x20]
call fcn.100403f0
nop
cmp dword [0x100bb574], 0
je 0x1003543f
mov eax, dword [0x100bb574]
movzx ecx, byte [eax]
test ecx, ecx
jne 0x1003543f
mov edx, dword [0x100bb574]
mov byte [edx], 1
push 0
push 0
mov eax, dword [0x100bb574]
push eax
push 0x10037d40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1003543f
mov ecx, dword [ebp - 8]
push ecx
call fcn.10037830
add esp, 4
mov esp, ebp
pop ebp
ret 4