joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001570
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x14], edi
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
mov esi, dword [edi + 0xf0]
lea esi, [esi + esi - 2]
lea esi, [edi + esi*8]
mov dword [esp + 0x18], esi
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 3]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, edx
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8]
movzx edi, ch
xor esi, dword [ebp + edi*8 + 3]
mov edi, edx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, eax
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8]
movzx edi, dh
xor esi, dword [ebp + edi*8 + 3]
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 1]
mov edi, dword [esp + 0x14]
mov edx, dword [ebp + edx*8]
movzx eax, ah
xor edx, dword [ebp + eax*8 + 3]
mov eax, dword [esp + 4]
and ebx, 0xff
xor edx, dword [ebp + ebx*8 + 2]
mov ebx, dword [esp + 8]
xor edx, dword [ebp + ecx*8 + 1]
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
cmp edi, dword [esp + 0x18]
mov dword [esp + 0x14], edi
jb 0x10001590
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, bh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, ecx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, edx
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, ch
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, edx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, eax
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, dh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
movzx edi, bh
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov edi, dword [esp + 0x14]
and edx, 0xff
mov edx, dword [ebp + edx*8 + 2]
and edx, 0xff
movzx eax, ah
mov eax, dword [ebp + eax*8]
and eax, 0xff00
xor edx, eax
mov eax, dword [esp + 4]
and ebx, 0xff
mov ebx, dword [ebp + ebx*8]
and ebx, 0xff0000
xor edx, ebx
mov ebx, dword [esp + 8]
mov ecx, dword [ebp + ecx*8 + 2]
and ecx, 0xff000000
xor edx, ecx
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
ret
Function at 0x10003af0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ecx, dword [esp + 0x1c]
cmp ecx, 0
je 0x10003cd5
call fcn.10003b06

Function at 0x10005b40
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x2c]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
push ebx
cmp ecx, 0
je 0x10005c24
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x10005bbf
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.100056e0
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x10005b8d
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x10005cdd
call fcn.10005bd1
and ebp, 0xfffffff8
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
je 0x10005c7c
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.10005810
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x10005c35
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x10005cdd
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.10005810
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x10005cd8
jmp 0x10005cdd
mov ecx, dword [esp + 0x4c]
add esp, 0x20
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x10007620
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x1000763e
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
ret
Function at 0x10007680
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x1000769e
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
ret

Function at 0x100076e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x10007702
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
ret

Function at 0x10007760
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x10007782
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
ret

Function at 0x100077e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x1000780a
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
ret
Function at 0x10007870
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x1000789a
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
ret

Function at 0x10007900
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesenc xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesenc xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesenc xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x1000795f

Function at 0x100079e0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesdec xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x10007a3f
Function at 0x100093c0
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
push ebx
test eax, eax
je 0x100098e0
test edx, edx
je 0x100098e0
call fcn.100093d7
mov eax, 0xffffffff
pop ebx
pop ebp
ret

Function at 0x10009920
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.100093c0
mov edx, dword [esp + 0xc]
shl ecx, 4
test eax, eax
jne 0x10009991
lea eax, [edx + ecx + 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
movups xmmword [eax], xmm0
movups xmmword [edx], xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmmword [edx - 0x10], xmm1
cmp eax, edx
ja 0x10009956
movups xmm0, xmmword [edx]
aesimc xmm0, xmm0
movups xmmword [edx], xmm0
pxor xmm0, xmm0
pxor xmm1, xmm1
xor eax, eax
ret

Function at 0x100191d0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x10108760]
xor eax, ebp
mov dword [ebp - 4], eax
movdqu xmm0, xmmword [ebp + 8]
sub esp, 0x18
mov eax, esp
push str.CLSID_sInprocServer32
movdqu xmmword [eax], xmm0
movq xmm0, qword [ebp + 0x18]
movq qword [eax + 0x10], xmm0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x20
lea eax, [ebp - 0x20c]
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
movdqu xmm0, xmmword [ebp + 8]
sub esp, 0x18
mov eax, esp
push str.CLSID_s
movdqu xmmword [eax], xmm0
movq xmm0, qword [ebp + 0x18]
movq qword [eax + 0x10], xmm0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x20
lea eax, [ebp - 0x20c]
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp dword [ebp + 0x1c], 8
jb 0x10019272
push dword [ebp + 8]
call fcn.1005aad8
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
call fcn.1005aadd
mov esp, ebp
pop ebp
ret

Function at 0x1001ab90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
call fcn.1001aca0
test eax, eax
je 0x1001abc7
push 0
push 0
push dword [ebp + 8]
push 0x1001a9f0
push 0
push 0
call fcn.1005bd41
add esp, 0x18
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 8]
call fcn.1001a9d0
int3
Function at 0x1001d2d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10108760]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
test ecx, ecx
je 0x1001d38b
test edx, edx
je 0x1001d38b
test esi, esi
je 0x1001d38b
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x1001d32d
mov esi, 0x80070005
jmp 0x1001d364
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001d332
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edi
push 1
push 0
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
neg esi
sbb esi, esi
and esi, 0x8000ffff
mov eax, dword [ebp - 8]
test eax, eax
je 0x1001d379
push eax
mov dword [ebp - 8], 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005aadd
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0x80004003
pop edi
xor ecx, ebp
pop esi
call fcn.1005aadd
mov esp, ebp
pop ebp
ret

Function at 0x1001dd80
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x10108760]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x228
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x230], 0
push 0
push eax
call fcn.10060770
add esp, 0xc
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x1001de44
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1001de44
mov edi, dword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x1001ddf0
lea eax, [ebp - 0x20c]
test eax, eax
je 0x1001de36
cmp word [ebp - 0x20c], 0x5a
jne 0x1001de36
cmp word [ebp - 0x20a], 0x68
jne 0x1001de36
cmp word [ebp - 0x208], 0x75
jne 0x1001de36
cmp word [ebp - 0x206], 0x44
jne 0x1001de36
cmp word [ebp - 0x204], 0x6f
jne 0x1001de36
cmp word [ebp - 0x202], 0x6e
je 0x1001de5d
lea eax, [ebp - 0x230]
push eax
push esi
call edi
test eax, eax
jne 0x1001ddf0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005aadd
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop esi
call fcn.1005aadd
mov esp, ebp
pop ebp
ret
Function at 0x1001e510
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x10108760]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push ecx
push 0
push 0x410
mov edi, edx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0x208
mov esi, eax
call fcn.1005a361
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.10060770
add esp, 0x10
lea eax, [ebp - 0x210]
push 0x104
push eax
push 0
push esi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
push 0x104
lea eax, [ebp - 0x210]
push eax
push esi
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
cmp word [ebp - 0x210], 0
jne 0x1001e595
xor eax, eax
jmp 0x1001e5af
lea eax, [ebp - 0x210]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1001e5a0
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x210]
mov ecx, edi
push eax
call fcn.1001a1f0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1005aadd
mov esp, ebp
pop ebp
ret
Function at 0x1001ea90
Capabilities:
Get routing table

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10108760]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [0x1010a518]
mov ebx, eax
test edi, edi
je 0x1001ead6
mov ecx, ebx
sub ecx, dword [0x1010da3c]
cmp ecx, 0x3e8
jae 0x1001ead6
mov eax, edi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005aadd
mov esp, ebp
pop ebp
ret
push esi
push 0x3c
mov dword [ebp - 8], 0
call fcn.1005bf6e
mov esi, eax
add esp, 4
test esi, esi
jne 0x1001eb01
pop esi
mov eax, edi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005aadd
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.IPHLPAPI.DLL_GetIpForwardTable]
lea eax, [ebp - 8]
push 0
push eax
push esi
call edi
cmp eax, 0x7a
jne 0x1001eb56
push esi
call fcn.1005b134
mov eax, dword [ebp - 8]
add esp, 4
cmp eax, 0xb2c
ja 0x1001eb63
push eax
call fcn.1005bf6e
mov esi, eax
add esp, 4
test esi, esi
jne 0x1001eb4d
mov eax, dword [0x1010a518]
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005aadd
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 8]
push eax
push esi
call edi
test eax, eax
je 0x1001eb74
push esi
call fcn.1005b134
add esp, 4
mov dword [0x1010a518], 1
mov eax, 1
jmp 0x1001eba8
mov edx, dword [esi]
xor ecx, ecx
test edx, edx
je 0x1001eb93
lea eax, [esi + 4]
nop
cmp dword [eax], 0
jne 0x1001eb8b
cmp dword [eax + 4], 0
je 0x1001eb5a
inc ecx
add eax, 0x38
cmp ecx, edx
jb 0x1001eb80
push esi
call fcn.1005b134
add esp, 4
mov dword [0x1010a518], 0
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
pop edi
mov dword [0x1010da3c], ebx
xor ecx, ebp
pop ebx
call fcn.1005aadd
mov esp, ebp
pop ebp
ret
Function at 0x1001f480
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, ecx
mov ecx, 0x5a4d
mov dword [ebp - 4], eax
cmp word [eax], cx
je 0x1001f4a6
push 0xc1
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [eax + 0x3c]
add ebx, eax
cmp dword [ebx], 0x4550
je 0x1001f4c6
push 0xc1
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 4
push 0x3000
push dword [ebx + 0x50]
push dword [ebx + 0x34]
call edi
mov esi, eax
mov dword [ebp - 8], esi
test esi, esi
jne 0x1001f50d
push 4
push 0x3000
push dword [ebx + 0x50]
push eax
call edi
mov esi, eax
mov dword [ebp - 8], eax
test esi, esi
jne 0x1001f50d
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push 0x24
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x1001f542
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x8000
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push 4
push 0x1000
mov dword [edi + 4], esi
mov dword [edi + 0xc], 0
mov dword [edi + 8], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0x1001f440
mov dword [edi + 0x18], 0x1001f450
mov dword [edi + 0x1c], 0x1001f470
mov dword [edi + 0x20], 0
push dword [ebx + 0x54]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [ebx + 0x54]
mov esi, eax
mov eax, dword [ebp - 4]
add ecx, dword [eax + 0x3c]
push ecx
push eax
push esi
call fcn.10060800
mov ecx, dword [ebp - 4]
mov edx, ebx
push edi
mov eax, dword [ecx + 0x3c]
add eax, esi
mov esi, dword [ebp - 8]
mov dword [edi], eax
mov dword [eax + 0x34], esi
call fcn.1001f090
mov edx, esi
add esp, 0x10
sub edx, dword [ebx + 0x34]
je 0x1001f5c3
mov ecx, edi
call fcn.1001f220
mov ecx, edi
call fcn.1001f2c0
test eax, eax
je 0x1001f5f6
mov ecx, edi
call fcn.1001f140
mov eax, dword [edi]
mov eax, dword [eax + 0x28]
test eax, eax
je 0x1001f60d
push 0
push 1
add eax, esi
push esi
call eax
test eax, eax
jne 0x1001f606
push 0x45a
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, edi
call fcn.1001f6d0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [edi + 0x10], 1
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10021290
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x10108760]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x198]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x100212e0
mov eax, dword [ebp - 0x198]
cmp al, 2
jne 0x100212da
shr eax, 8
cmp al, 2
jne 0x100212da
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005aadd
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [ebp - 4]
mov eax, 2
xor ecx, ebp
call fcn.1005aadd
mov esp, ebp
pop ebp
ret

Function at 0x100215e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x10108760]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x1010d95c], 0
jne 0x10021667
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.10060770
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.winhttp.dll
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor ecx, ecx
mov dword [0x1010d95c], eax
test eax, eax
setne cl
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005aadd
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
call fcn.1005aadd
mov esp, ebp
pop ebp
ret

Function at 0x10024900
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d01ca
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x10108760]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x18], esi
call fcn.1005a6ae
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x100249a6
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], str.bad_locale_name
push eax
lea ecx, [ebp - 0x24]
call fcn.1005d878
push 0x10106240
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], vtable.std::runtime_error.0
push eax
call fcn.10060edb
push edi
push esi
call fcn.1005a581
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005aadd
mov esp, ebp
pop ebp
ret 4
Function at 0x1002ec50
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10108760]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
xor eax, eax
push edi
push 4
mov edi, edx
cmp byte [esi + 0x3dc], al
setne al
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 8
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x1002ecab
push edi
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
push esi
call fcn.100317f0
add esp, 0xc
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005aadd
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 0x3e0]
mov dword [ebp - 0x14], 1
call fcn.1003bba0
mov ecx, dword [esi + 0x3e4]
imul eax, eax, 0x3e8
mov dword [ebp - 0x10], eax
call fcn.1003bba0
imul eax, eax, 0x3e8
push 0
push 0
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0xc
lea eax, [ebp - 0x14]
push eax
push 0x98000004
push edi
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x1002ed15
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
push esi
call fcn.100317f0
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1005aadd
mov esp, ebp
pop ebp
ret