joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10024a60
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1018b06c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1018c580]
push esi
mov esi, dword [0x1018c584]
push edi
movsd xmm0, qword [eax]
lea eax, [ebp - 8]
subsd xmm0, qword [0x1017e728]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 8
andps xmm0, xmmword [0x1017f270]
mulsd xmm0, qword [0x1017e438]
push esi
addsd xmm0, qword [0x1017e988]
movsd qword [ebp - 0x10], xmm0
call edi
movsd xmm0, qword [ebp - 0x10]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
movsd qword [esi], xmm0
push 8
push esi
call edi
mov eax, dword [0x1018c580]
mov esi, dword [0x1018c588]
movsd xmm0, qword [eax]
lea eax, [ebp - 8]
subsd xmm0, qword [0x1017e728]
push eax
push 0x40
push 8
push esi
andps xmm0, xmmword [0x1017f270]
mulsd xmm0, qword [0x1017e438]
addsd xmm0, qword [0x1017e988]
movsd qword [ebp - 0x10], xmm0
call edi
movsd xmm0, qword [ebp - 0x10]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
movsd qword [esi], xmm0
push 8
push esi
call edi
mov eax, dword [0x1018c580]
mov esi, dword [0x1018c58c]
movsd xmm0, qword [eax]
lea eax, [ebp - 8]
subsd xmm0, qword [0x1017e728]
push eax
push 0x40
push 4
push esi
andps xmm0, xmmword [0x1017f270]
cvtpd2ps xmm0, xmm0
mulss xmm0, dword [0x1017e598]
addss xmm0, dword [0x1017ee70]
movss dword [ebp - 0xc], xmm0
call edi
movss xmm0, dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
movss dword [esi], xmm0
push 4
push esi
call edi
mov eax, dword [0x1018c580]
mov esi, dword [0x1018c590]
movsd xmm0, qword [eax]
lea eax, [ebp - 8]
subsd xmm0, qword [0x1017e728]
push eax
andps xmm0, xmmword [0x1017f270]
cvtpd2ps xmm0, xmm0
mulss xmm0, dword [0x1017e598]
addss xmm0, dword [0x1017ee70]
movss dword [ebp - 0xc], xmm0
push 0x40
push 4
push esi
call edi
movss xmm0, dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
movss dword [esi], xmm0
push 4
push esi
call edi
mov eax, dword [0x1018c580]
mov esi, dword [0x1018c594]
movsd xmm0, qword [eax]
lea eax, [ebp - 8]
subsd xmm0, qword [0x1017e728]
push eax
push 0x40
push 4
push esi
andps xmm0, xmmword [0x1017f270]
cvtpd2ps xmm0, xmm0
mulss xmm0, dword [0x1017e598]
addss xmm0, dword [0x1017ee64]
movss dword [ebp - 0xc], xmm0
call edi
movss xmm0, dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
movss dword [esi], xmm0
push 4
push esi
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100d52b0
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x10024c50
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [0x1018b06c]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x58], 0
je 0x10024e44
movss xmm0, dword [ebx + 0x5c]
lea eax, [esp + 0x18]
mov esi, dword [ebx + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 4
push esi
movss dword [esp + 0x20], xmm0
call edi
movss xmm0, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x1c]
movss dword [esi], xmm0
push 4
push esi
call edi
movss xmm0, dword [ebx + 0x60]
lea eax, [esp + 0x18]
mov esi, dword [ebx + 0x10]
push eax
push 0x40
push 4
push esi
movss dword [esp + 0x20], xmm0
call edi
movss xmm0, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x1c]
movss dword [esi], xmm0
push 4
push esi
call edi
movss xmm0, dword [ebx + 0x64]
lea eax, [esp + 0x18]
mov esi, dword [ebx + 0x14]
push eax
push 0x40
push 4
push esi
movss dword [esp + 0x20], xmm0
call edi
movss xmm0, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x1c]
movss dword [esi], xmm0
push 4
push esi
call edi
movsd xmm0, qword [ebx + 0x68]
lea eax, [esp + 0x18]
mov esi, dword [ebx + 0x18]
push eax
push 0x40
push 8
push esi
movsd qword [esp + 0x20], xmm0
call edi
movsd xmm0, qword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x1c]
movsd qword [esi], xmm0
push 8
push esi
call edi
movsd xmm0, qword [ebx + 0x70]
lea eax, [esp + 0x18]
mov esi, dword [ebx + 0x1c]
push eax
push 0x40
push 8
push esi
movsd qword [esp + 0x20], xmm0
call edi
movsd xmm0, qword [esp + 0x10]
lea eax, [esp + 0x18]
movsd qword [esi], xmm0
push eax
push dword [esp + 0x1c]
push 8
push esi
call edi
movsd xmm0, qword [ebx + 0x78]
lea eax, [esp + 0x18]
mov esi, dword [ebx + 0x20]
push eax
push 0x40
push 8
push esi
movsd qword [esp + 0x20], xmm0
call edi
movsd xmm0, qword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x1c]
movsd qword [esi], xmm0
push 8
push esi
call edi
movss xmm0, dword [ebx + 0x80]
lea eax, [esp + 0x18]
mov esi, dword [ebx + 0x24]
push eax
push 0x40
push 4
push esi
movss dword [esp + 0x20], xmm0
call edi
movss xmm0, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x1c]
movss dword [esi], xmm0
push 4
push esi
call edi
movss xmm0, dword [ebx + 0x84]
lea eax, [esp + 0x18]
mov esi, dword [ebx + 0x28]
push eax
push 0x40
push 4
push esi
movss dword [esp + 0x20], xmm0
call edi
movss xmm0, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x1c]
movss dword [esi], xmm0
push 4
push esi
call edi
movss xmm0, dword [ebx + 0x88]
lea eax, [esp + 0x18]
mov esi, dword [ebx + 0x2c]
push eax
push 0x40
push 4
push esi
movss dword [esp + 0x20], xmm0
call edi
movss xmm0, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x1c]
movss dword [esi], xmm0
push 4
push esi
call edi
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100d52b0
mov esp, ebp
pop ebp
ret
Function at 0x100266c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1018b06c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push 0x576ddb
call esi
mov eax, 0x576ddb
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 5
push 0x576ddb
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push 0x5883f4
call esi
mov eax, 0x5883f4
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 5
push 0x5883f4
call esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100d52b0
mov esp, ebp
pop ebp
ret

Function at 0x10026780
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1018b06c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push 0x588661
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x588661
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 5
push 0x588661
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100d52b0
mov esp, ebp
pop ebp
ret

Function at 0x10026860
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1018b06c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x54a270
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
mov byte [0x54a270], 0xc3
push eax
push dword [ebp - 8]
push 1
push 0x54a270
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100d52b0
mov esp, ebp
pop ebp
ret

Function at 0x100268b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1018b06c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x54a270
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
mov byte [0x54a270], 0x55
push eax
push dword [ebp - 8]
push 1
push 0x54a270
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100d52b0
mov esp, ebp
pop ebp
ret

Function at 0x10026900
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1018b06c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x59af55
call esi
lea eax, [ebp - 8]
mov byte [0x59af55], 0
push eax
push dword [ebp - 8]
push 1
push 0x59af55
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x59b24a
call esi
lea eax, [ebp - 8]
mov byte [0x59b24a], 0
push eax
push dword [ebp - 8]
push 1
push 0x59b24a
call esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100d52b0
mov esp, ebp
pop ebp
ret
Function at 0x10026980
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1018b06c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x59af55
call esi
lea eax, [ebp - 8]
mov byte [0x59af55], 1
push eax
push dword [ebp - 8]
push 1
push 0x59af55
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x59b24a
call esi
lea eax, [ebp - 8]
mov byte [0x59b24a], 1
push eax
push dword [ebp - 8]
push 1
push 0x59b24a
call esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100d52b0
mov esp, ebp
pop ebp
ret

Function at 0x10027eb0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1018b06c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push 0x785b44
call esi
mov eax, 0x785b44
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 5
push 0x785b44
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push 0x787630
call esi
mov eax, 0x787630
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 5
push 0x787630
call esi
push 0x10027e90
push 0x78adcc
push 0xe8
call fcn.100b1680
push 0x10027e90
push 0x78ae15
push 0xe8
call fcn.100b1680
push 0x10027e90
push 0x78ae5e
push 0xe8
call fcn.100b1680
push 0x10026d50
push 0x78b09a
push 0xe8
call fcn.100b1680
push 0x10026f60
push 0x78b0cf
push 0xe8
call fcn.100b1680
push 0x10027a40
push 0x787620
push 0xe8
call fcn.100b1680
add esp, 0x48
push 0x10027100
push 0x787628
push 0xe8
call fcn.100b1680
push 0x10027e40
push 0x787748
push 0xe8
call fcn.100b1680
push 0x10027d30
push 0x7864b3
push 0xe8
call fcn.100b1680
push 0x10027d30
push 0x78641e
push 0xe8
call fcn.100b1680
push 0x10027d30
push 0x7863a8
push 0xe8
call fcn.100b1680
push 0x10027d30
push 0x786347
push 0xe8
call fcn.100b1680
add esp, 0x48
push 0x10027d30
push 0x7862e2
push 0xe8
call fcn.100b1680
push 0x10027d30
push 0x78628e
push 0xe8
call fcn.100b1680
mov ecx, dword [ebp - 4]
add esp, 0x18
xor ecx, ebp
pop esi
call fcn.100d52b0
mov esp, ebp
pop ebp
ret
Function at 0x10028090
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], 0
lea edi, [edx - 0xf]
push 1
mov esi, ecx
movd xmm1, edi
push 1
sub esp, 0x20
mov ebx, 0x637c60
cvtdq2ps xmm1, xmm1
lea eax, [esi - 8]
mov dword [esp + 0x1c], 0x3e2bedf6
mov dword [esp + 0x18], 0x3f400000
mov dword [esp + 0x14], 0
movd xmm0, eax
mov dword [esp + 0x10], 0
cvtdq2ps xmm0, xmm0
mov dword [esp + 0xc], 0x41700000
mov dword [esp + 8], 0x42ac0000
movss dword [esp + 4], xmm1
movss dword [esp], xmm0
push 0xf069
call ebx
add esp, 0x30
add esi, 0x42
cmp dword [0x102fba9c], 0
mov eax, 0x790b10
push 0xb
push 0xb
push edi
push esi
jne 0x10028219
call eax
add esp, 0x10
test al, al
je 0x100281e5
push 1
mov eax, 0x791070
call eax
add esp, 4
test eax, eax
je 0x100281e5
cmp byte [0x8793386], 0
je 0x100281e5
mov eax, 0x83c080
call eax
push ecx
mov dword [esp], 0
push 1
push 1
sub esp, 0x20
movd xmm0, edi
cvtdq2ps xmm0, xmm0
mov dword [esp + 0x1c], 0x3dc84620
mov dword [esp + 0x18], 0x3ddf6fce
mov dword [esp + 0x14], 0x3ed38c54
mov dword [esp + 0x10], 0x3f19999a
mov dword [esp + 0xc], 0x41300000
mov dword [esp + 8], 0x41300000
movss dword [esp + 4], xmm0
movd xmm0, esi
cvtdq2ps xmm0, xmm0
movss dword [esp], xmm0
push 0xf069
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 0x30
call esi
mov ecx, dword [0x102fbaa0]
add ecx, 0xc8
cmp eax, ecx
jb 0x1002833f
mov dword [0x102fba9c], 1
call esi
pop edi
pop esi
mov dword [0x102fbaa0], eax
pop ebx
ret
push ecx
mov dword [esp], 0
push 1
push 1
sub esp, 0x20
mov dword [esp + 0x1c], 0x3dc84620
mov dword [esp + 0x18], 0x3ddf6fce
mov dword [esp + 0x14], 0x3ed38c54
mov dword [esp + 0x10], 0x3ef74bc6
jmp 0x1002830c
call eax
add esp, 0x10
test al, al
je 0x100282dd
push 1
mov eax, 0x791070
call eax
add esp, 4
test eax, eax
je 0x100282dd
cmp byte [0x8793386], 0
je 0x100282dd
mov eax, 0x83c080
call eax
push ecx
mov dword [esp], 0
push 1
push 1
sub esp, 0x20
movd xmm0, edi
cvtdq2ps xmm0, xmm0
mov dword [esp + 0x1c], 0x3dc84620
mov dword [esp + 0x18], 0x3ddf6fce
mov dword [esp + 0x14], 0x3ed38c54
mov dword [esp + 0x10], 0x3e041892
mov dword [esp + 0xc], 0x41300000
mov dword [esp + 8], 0x41300000
movss dword [esp + 4], xmm0
movd xmm0, esi
cvtdq2ps xmm0, xmm0
movss dword [esp], xmm0
push 0xf069
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 0x30
call esi
mov ecx, dword [0x102fbaa0]
add ecx, 0xc8
cmp eax, ecx
jb 0x1002833f
mov dword [0x102fba9c], 0
call esi
pop edi
pop esi
mov dword [0x102fbaa0], eax
pop ebx
ret
push ecx
mov dword [esp], 0
push 1
push 1
sub esp, 0x20
mov dword [esp + 0x1c], 0x3dc84620
mov dword [esp + 0x18], 0x3ddf6fce
mov dword [esp + 0x14], 0x3ed38c54
mov dword [esp + 0x10], 0x3c54fdf3
movd xmm0, edi
cvtdq2ps xmm0, xmm0
mov dword [esp + 0xc], 0x41300000
mov dword [esp + 8], 0x41300000
movss dword [esp + 4], xmm0
movd xmm0, esi
cvtdq2ps xmm0, xmm0
movss dword [esp], xmm0
push 0xf069
call ebx
add esp, 0x30
pop edi
pop esi
pop ebx
ret
Function at 0x1002b370
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015f450
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x1018b06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0xc
push str.ContinenteMu
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0xf
mov byte [ebp - 0x48], 0
call fcn.1000bb40
mov edx, 0x1033a5a4
mov dword [ebp - 4], 0
lea ecx, [edx + 1]
nop dword [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x1002b3d0
mov edi, dword [ebp - 0x48]
sub edx, ecx
cmp dword [ebp - 0x34], 0x10
lea ecx, [ebp - 0x48]
push edx
mov edx, dword [ebp - 0x38]
cmovae ecx, edi
push 0x1033a5a4
call fcn.1002b570
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 8
test al, al
je 0x1002b42a
lea eax, [ebp - 0x14]
push eax
push 0x40
push 4
push 0xd27b1c
call ebx
lea eax, [ebp - 0x14]
mov dword [0xd27b1c], 0x447a0000
push eax
push dword [ebp - 0x14]
push 4
push 0xd27b1c
call ebx
push 5
push str.N1cko
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0xf
mov byte [ebp - 0x30], 0
call fcn.1000bb40
mov edx, 0x1033a5a4
mov byte [ebp - 4], 1
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x1002b457
mov esi, dword [ebp - 0x30]
sub edx, ecx
cmp dword [ebp - 0x1c], 0x10
lea ecx, [ebp - 0x30]
push edx
mov edx, dword [ebp - 0x20]
cmovae ecx, esi
push 0x1033a5a4
call fcn.1002b570
add esp, 8
test al, al
je 0x1002b4cb
lea eax, [ebp - 0x14]
mov byte [ebp - 0x49], 0xff
push eax
push 0x40
push 1
push 0x7d3d57
mov dword [ebp - 0x14], 0
call ebx
test eax, eax
je 0x1002b4c5
mov cl, byte [ebp - 0x49]
mov eax, 0x7d3d57
mov byte [eax], cl
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 0
push 1
push 0x7d3d57
call ebx
test eax, eax
jne 0x1002b4cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x1033a5c4], 0
jle 0x1002b4d9
call fcn.10018200
call fcn.100978c0
mov eax, dword [ebp - 0x1c]
cmp eax, 0x10
jb 0x1002b50d
lea ecx, [eax + 1]
mov eax, esi
cmp ecx, 0x1000
jb 0x1002b503
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002b558
push ecx
push esi
call fcn.100d5624
add esp, 8
mov eax, dword [ebp - 0x34]
cmp eax, 0x10
jb 0x1002b53c
lea ecx, [eax + 1]
mov eax, edi
cmp ecx, 0x1000
jb 0x1002b532
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002b55d
push ecx
push edi
call fcn.100d5624
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100d52b0
mov esp, ebp
pop ebp
ret
call fcn.1012c43c
call fcn.1012c43c
int3
Function at 0x1002eac0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1018b06c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x1002ea50
push 0x7d2b3d
push 0xe8
call fcn.100b1680
push 0x1002ea00
push 0x789099
push 0xe9
call fcn.100b1680
push 0x1002e9b0
push 0x7890e2
push 0xe9
call fcn.100b1680
push 0x1002e4f0
push 0x78b0cf
push 0xe8
call fcn.100b1680
push 0x1002e330
push 0x78b09a
push 0xe8
call fcn.100b1680
push 0x1002e200
push 0x787620
push 0xe8
call fcn.100b1680
add esp, 0x48
push method.std::codecvt_char__char__struct__Mbstatet_.virtual_12
push 0x787628
push 0xe8
call fcn.100b1680
push 0x1002e2e0
push 0x787748
push 0xe8
call fcn.100b1680
push 0x7867b3
push 0x7867a5
push 0xe9
call fcn.100b1680
add esp, 0x24
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push 0x787c7d
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x787c7d
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 5
push 0x787c7d
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x1002e180
push 0x7864b3
push 0xe8
call fcn.100b1680
push 0x1002e180
push 0x78641e
push 0xe8
call fcn.100b1680
push 0x1002e180
push 0x7863a8
push 0xe8
call fcn.100b1680
push 0x1002e180
push 0x786347
push 0xe8
call fcn.100b1680
push 0x1002e180
push 0x7862e2
push 0xe8
call fcn.100b1680
push method.std::codecvt_wchar_t__char__struct__Mbstatet_.virtual_12
push 0x78628e
push 0xe8
call fcn.100b1680
mov ecx, dword [ebp - 4]
add esp, 0x48
xor ecx, ebp
call fcn.100d52b0
mov esp, ebp
pop ebp
ret
Function at 0x10031f00
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x4034]
test eax, eax
je 0x10031f2c
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0x4034]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x4034], 0
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x10031f42
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 4], 0xffffffff
mov eax, dword [esi + 8]
test eax, eax
je 0x10031f57
push eax
call dword [sym.imp.WS2_32.dll_WSACloseEvent]
mov dword [esi + 8], 0
mov byte [esi + 0x4038], 0
pop esi
ret

Function at 0x10031f60
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2008
call fcn.100d6670
mov eax, dword [0x1018b06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [ebp + 8]
push 0x10190884
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x1018c86c]
cmp ebx, 0xffffffff
je 0x10032091
cmp byte [0x101908a0], 0
je 0x10032091
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x2004]
push esi
push edi
push eax
call fcn.101231c0
mov ecx, dword [0x10190878]
add esp, 0xc
test ecx, ecx
jle 0x10031fda
lea eax, [ecx + esi]
cmp eax, 0x2000
jg 0x10032067
push esi
lea eax, [ebp - 0x2004]
push eax
jmp 0x10032032
xor edi, edi
test esi, esi
jle 0x10032047
push 0
lea eax, [ebp - 0x2004]
add eax, edi
push esi
push eax
push ebx
mov dword [ebp - 0x2008], eax
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x1003200e
sub esi, eax
add edi, eax
test esi, esi
jle 0x10032047
mov ebx, dword [0x1018c86c]
jmp 0x10031fe0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x10032067
mov ecx, dword [0x10190878]
lea eax, [ecx + esi]
cmp eax, 0x2000
jg 0x10032067
push esi
push dword [ebp - 0x2008]
lea eax, [ecx + 0x1018e878]
push eax
call fcn.101231c0
add esp, 0xc
add dword [0x10190878], esi
push 0x10190884
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop edi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100d52b0
mov esp, ebp
pop ebp
ret 8
mov ecx, 0x1018c868
call fcn.10031f00
push 0x10190884
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop edi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100d52b0
mov esp, ebp
pop ebp
ret 8
push 0x10190884
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop ebx
call fcn.100d52b0
mov esp, ebp
pop ebp
ret 8
Function at 0x10038920
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x101d5d00]
cmp eax, 0x5dc
jb 0x100389bf
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp byte [0x101d5d05], 1
mov dword [0x101d5d00], eax
jne 0x1003895a
mov byte [0x101d5d05], 0
mov esp, ebp
pop ebp
ret
mov eax, 0x1033d074
nop
mov dword [eax], 0xffffffff
add eax, 8
cmp eax, 0x1033d1c4
jl 0x10038960
mov edx, 4
mov dword [0x1033c934], 0
lea ecx, [ebp - 4]
mov dword [0x1033c92c], 0
mov dword [ebp - 4], 0xe8f304c1
call fcn.100acac0
cmp dword [0x101ee984], 2
jne 0x100389ae
mov eax, dword [0x1054caa0]
mov byte [eax + 0x29], 1
mov esp, ebp
pop ebp
ret
mov byte [0x101d5d05], 1
mov dword [0x101c6400], 1
mov esp, ebp
pop ebp
ret

Function at 0x1003af80
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x101d5d00]
cmp eax, 0x5dc
jb 0x1003b02d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp byte [0x101d5d05], 1
mov dword [0x101d5d00], eax
jne 0x1003afbc
mov byte [0x101d5d05], 0
mov esp, ebp
pop ebp
ret
mov ecx, 0x1033d1d0
call fcn.1003a940
mov edx, 4
mov dword [0x1033d1d8], 0
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0xe7f304c1
call fcn.100acac0
mov edx, 5
mov dword [ebp - 8], 0xe6f305c1
lea ecx, [ebp - 8]
mov dword [0x1033d1d0], 0
mov byte [ebp - 4], 0
call fcn.100acac0
cmp dword [0x101ee984], 2
jne 0x1003b01c
mov eax, dword [0x1054caac]
mov byte [eax + 0x29], 1
mov esp, ebp
pop ebp
ret
mov byte [0x101d5d05], 1
mov dword [0x101c6400], 3
mov esp, ebp
pop ebp
ret