joyce8/EMBER2024-capa huggingface dataset:
Function at 0x628f72
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, edx
mov edi, ecx
mov ebx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [0x803100]
xor eax, ebp
mov dword [ebp - 0x10], eax
test ebx, ebx
je 0x628fed
mov dword [ebp - 0x1c], ecx
xor eax, eax
lea ecx, [ebp - 0x14]
mov dword [ecx], eax
lea edx, [ebp - 0x18]
mov dword [edx], 4
push edx
push ecx
push eax
push 0x10
push esi
push eax
push edi
call dword [sym.imp.advapi32.dll_RegGetValueW]
test eax, eax
je 0x629007
mov ecx, edi
mov edx, esi
push dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
push esi
call fcn.00629031
add esp, 8
test al, al
je 0x629017
mov eax, dword [esi]
test eax, eax
je 0x62902d
push 0xa
push 0
push eax
call sub.api_ms_win_crt_convert_l1_1_0.dll_wcstol
add esp, 0xc
cmp eax, 1
jmp 0x62900b
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00649c68
mov ecx, edi
mov edx, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.00629031
cmp dword [ebp - 0x14], 1
sete al
movzx eax, al
mov dword [ebx], eax
mov bl, 1
jmp 0x629019
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00649c68
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
jmp 0x62900e

Function at 0x629031
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x214
mov edi, edx
mov dword [ebp - 0x220], ecx
mov eax, dword [0x803100]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor ebx, ebx
lea esi, [ebp - 0x218]
push 0x208
push ebx
push esi
call fcn.0064ad90
add esp, 0xc
lea eax, [ebp - 0x21c]
mov dword [eax], 0x104
push eax
push esi
push ebx
push 2
push edi
push ebx
push dword [ebp - 0x220]
call dword [sym.imp.advapi32.dll_RegGetValueW]
mov esi, eax
test eax, eax
jne 0x6290a8
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov ecx, edi
lea eax, [ebp - 0x218]
push eax
call fcn.0062888a
mov ecx, edi
call fcn.00628a2e
mov dword [ebx], eax
test esi, esi
sete bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00649c68
mov eax, ebx
add esp, 0x214
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x629150
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [0x803100]
xor eax, ebp
mov dword [ebp - 0x10], eax
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_LoadLibraryW]
test eax, eax
je 0x6291ae
mov edi, eax
push str.CreateWebViewEnvironmentWithOptionsInternal
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x629224
mov ecx, eax
mov esi, dword [ebp + 0x1c]
mov bl, byte [ebp + 0xc]
call dword [0x6615ac]
movzx eax, bl
push esi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call ecx
mov esi, eax
mov dword [ebp - 0x14], eax
jmp 0x629293
call dword [sym.imp.kernel32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
lea ebx, [ebp - 0x14]
mov dword [ebx], esi
pcmpeqd xmm0, xmm0
lea edi, [ebp - 0x20]
movq qword [edi], xmm0
mov dword [edi + 8], 0xffffffff
mov ecx, edi
call fcn.0062879c
push edi
push 1
push 4
push ebx
call fcn.006290c4
add esp, 0x10
mov ebx, dword [sym.imp.kernel32.dll_OutputDebugStringW]
push str.WebView2:_CoreWebView2Environment_failed_when_trying_to_LoadLibrary:_hr0x
call ebx
mov ecx, edi
call fcn.00628a2e
push eax
call ebx
push str._path
call ebx
push dword [ebp + 8]
call ebx
push 0x7fb2ba
call ebx
mov ecx, edi
call fcn.006287b0
jmp 0x6292aa
call dword [sym.imp.kernel32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
lea eax, [ebp - 0x14]
mov dword [eax], esi
pcmpeqd xmm0, xmm0
lea ebx, [ebp - 0x20]
movq qword [ebx], xmm0
mov dword [ebx + 8], 0xffffffff
mov ecx, ebx
call fcn.0062879c
push ebx
push 1
push 4
lea eax, [ebp - 0x14]
push eax
call fcn.006290c4
add esp, 0x10
push str.WebView2:_CoreWebView2Environment_failed_when_trying_to_call_into_EmbeddedBrowserWebView.dll._hr0x
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov ecx, ebx
call fcn.00628a2e
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov eax, dword [sym.imp.kernel32.dll_OutputDebugStringW]
push 0x7fb2ba
call eax
mov ecx, ebx
call fcn.006287b0
push str.DllCanUnloadNow
push edi
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x6292aa
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00649c68
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6294e8
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x1c]
and esi, 0x1f
push edi
mov edi, dword [esp + 0x1c]
cmp esi, 8
jb 0x62957c
mov eax, esi
shr eax, 3
mov dword [esp + 0x20], eax
cmp dword [esp + 0x24], 1
jne 0x62952e
push 8
lea eax, [esp + 0x18]
push edi
push eax
call fcn.0064a810
mov eax, dword [esp + 0x20]
add esp, 0xc
mov ecx, dword [esp + 0x18]
jmp 0x629533
mov eax, dword [edi]
mov ecx, dword [edi + 4]
push ecx
push eax
push 0
push 0
call fcn.006296b4
push 0x1b
xor edx, ebx
xor eax, ebp
push edx
push eax
add edi, 8
call sub.api_ms_win_crt_utility_l1_1_0.dll__rotl64
add esp, 0x1c
push 0x9e3779b1
push 0x85ebca87
push edx
push eax
call fcn.00649c80
mov ebp, eax
mov ebx, edx
add ebp, 0xc2b2ae63
adc ebx, 0x85ebca77
sub esi, 8
sub dword [esp + 0x20], 1
jne 0x62950d
cmp esi, 4
jb 0x6295ef
cmp dword [esp + 0x24], 1
jne 0x62959e
push 4
lea eax, [esp + 0x24]
push edi
push eax
call fcn.0064a810
mov ecx, dword [esp + 0x2c]
add esp, 0xc
jmp 0x6295a0
mov ecx, dword [edi]
mov eax, 0x9e3779b1
mov dword [esp + 0x20], ecx
mul ecx
push 0x17
mov ecx, eax
add edi, 4
mov eax, 0x85ebca87
mul dword [esp + 0x24]
add ecx, edx
xor eax, ebp
xor ecx, ebx
push ecx
push eax
call sub.api_ms_win_crt_utility_l1_1_0.dll__rotl64
add esp, 0xc
push 0xc2b2ae3d
push 0x27d4eb4f
push edx
push eax
call fcn.00649c80
mov ebp, eax
mov ebx, edx
add ebp, 0x9e3779f9
adc ebx, 0x165667b1
sub esi, 4
test esi, esi
je 0x629633
movzx eax, byte [edi]
push 0x27d4eb2f
cdq
push 0x165667c5
push edx
push eax
call fcn.00649c80
xor ebx, edx
xor ebp, eax
push 0xb
push ebx
push ebp
inc edi
call sub.api_ms_win_crt_utility_l1_1_0.dll__rotl64
add esp, 0xc
push 0x9e3779b1
push 0x85ebca87
push edx
push eax
call fcn.00649c80
mov ebp, eax
mov ebx, edx
sub esi, 1
jne 0x6295f3
push 0xc2b2ae3d
xor ecx, ecx
mov esi, ebx
push 0x27d4eb4f
xor ecx, ebx
shr esi, 1
push ecx
xor esi, ebp
push esi
call fcn.00649c80
mov esi, eax
mov ecx, edx
shrd esi, ecx, 0x1d
push 0x165667b1
shr ecx, 0x1d
xor esi, eax
push 0x9e3779f9
xor ecx, edx
push ecx
push esi
call fcn.00649c80
xor esi, esi
mov ecx, edx
pop edi
xor edx, esi
xor eax, ecx
pop esi
pop ebp
pop ebx
ret
Function at 0x637560
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x70
mov eax, dword [0x803100]
xor eax, esp
mov dword [esp + 0x6c], eax
mov edx, dword [esp + 0x84]
mov eax, dword [esp + 0x74]
mov ecx, dword [esp + 0x7c]
push ebx
mov ebx, dword [esp + 0x84]
push ebp
mov ebp, dword [esp + 0x80]
add ecx, ebp
push esi
push edi
mov edi, dword [esp + 0x98]
lea esi, [edx + ebx]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x9c]
mov dword [esp + 0x14], ebx
mov ebx, ebp
mov dword [esp + 0x38], ebp
push edx
lea ebp, [eax + edi]
mov dword [esp + 0x2c], esi
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], edi
lea esi, [eax + 0x1004]
mov dword [esp + 0x30], esi
lea edx, [eax + 0x1004]
mov esi, dword [eax + 0x2810]
lea ecx, [eax + 0x1808]
mov dword [esp + 0x38], esi
mov esi, dword [esp + 0x18]
push esi
push edx
push ecx
push eax
lea eax, [esp + 0x38]
mov dword [esp + 0x44], ecx
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x30]
push eax
call fcn.00637a2e
add esp, 0x20
cmp eax, 0xffffff88
ja 0x637746
push 0xc
add esi, eax
lea eax, [esp + 0x74]
push 0
push eax
call fcn.0064ad90
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
add eax, ecx
mov dword [esp + 0x74], ecx
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x34]
sub eax, esi
mov dword [esp + 0x70], 1
push eax
lea eax, [esp + 0x4c]
push esi
push eax
call fcn.00636902
add esp, 0x18
cmp eax, 0xfffffff8
ja 0x637743
mov eax, dword [esp + 0x10]
push eax
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x54]
push eax
call fcn.006368d4
push dword [esp + 0x38]
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x68]
push eax
call fcn.006368d4
push dword [esp + 0x48]
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x7c]
push eax
call fcn.006368d4
lea eax, [esp + 0x60]
push eax
call fcn.00636ca1
mov edx, dword [esp + 0x3c]
add esp, 0x28
cmp eax, 2
ja 0x637704
test edx, edx
jle 0x637700
lea eax, [esp + 0x3c]
dec edx
push eax
lea eax, [esp + 0x74]
mov dword [esp + 0x14], edx
push eax
call fcn.0063737a
pop ecx
pop ecx
push dword [esp + 0x1c]
lea eax, [esp + 0x1c]
push dword [esp + 0x38]
lea esi, [esp + 0x78]
push ebp
push eax
sub esp, 0xc
mov edi, esp
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00637759
add esp, 0x20
cmp eax, 0xffffff88
ja 0x637746
add ebx, eax
lea eax, [esp + 0x3c]
push eax
call fcn.00636ca1
mov edx, dword [esp + 0x14]
pop ecx
cmp eax, 2
jbe 0x6376a8
mov edi, dword [esp + 0x18]
lea eax, [esp + 0x3c]
push eax
call fcn.0062cb45
pop ecx
test eax, eax
je 0x637743
test edx, edx
js 0x637743
sub ebp, edi
lea esi, [ebx + ebp]
cmp esi, dword [esp + 0x1c]
jbe 0x637726
push 0xffffffffffffffba
jmp 0x637745
test ebp, ebp
je 0x63773b
cmp ebx, edi
je 0x637739
push ebp
push edi
push ebx
call fcn.0064a810
add esp, 0xc
mov ebx, esi
sub ebx, dword [esp + 0x38]
mov eax, ebx
jmp 0x637746
push 0xffffffffffffffec
pop eax
mov ecx, dword [esp + 0x7c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00649c68
add esp, 0x70
ret
Function at 0x63bccd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x68
mov eax, dword [0x803100]
xor eax, esp
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0x74]
mov ecx, dword [esp + 0x7c]
push ebx
push ebp
mov ebp, dword [esp + 0x74]
push esi
mov esi, dword [esp + 0x84]
push edi
mov edi, dword [esp + 0x80]
mov ebx, edi
add eax, edi
mov dword [esp + 0x30], edi
mov edi, dword [ebp + 0x2820]
lea edx, [ecx + esi]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x2824]
add eax, edi
mov dword [esp + 0x28], edx
push ecx
mov dword [esp + 0x1c], eax
lea edx, [ebp + 0x1004]
mov eax, dword [ebp + 0x2810]
push esi
mov dword [esp + 0x34], eax
lea eax, [ebp + 0x1808]
push edx
push eax
push ebp
lea eax, [esp + 0x38]
mov dword [esp + 0x24], edi
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x30]
push eax
call fcn.0063a7a2
add esp, 0x20
cmp eax, 0xffffff88
ja 0x63be9d
push 0xc
add esi, eax
lea eax, [esp + 0x6c]
push 0
push eax
call fcn.0064ad90
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
add eax, ecx
mov dword [esp + 0x6c], ecx
mov dword [esp + 0x70], eax
push 4
pop eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x34]
sub eax, esi
push eax
lea eax, [esp + 0x44]
push esi
push eax
call fcn.00638088
add esp, 0x18
cmp eax, 0xffffff88
ja 0x63be9a
push ebp
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x4c]
push eax
call fcn.0063875e
lea eax, [ebp + 0x1004]
push eax
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x60]
push eax
call fcn.0063875e
lea eax, [ebp + 0x1808]
push eax
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x74]
push eax
call fcn.0063875e
lea eax, [esp + 0x58]
push eax
call fcn.00636ca1
mov ebp, dword [esp + 0x3c]
add esp, 0x28
cmp eax, 2
jg 0x63be51
test ebp, ebp
jle 0x63be4d
lea eax, [esp + 0x34]
dec ebp
push eax
lea eax, [esp + 0x6c]
push eax
call fcn.0063b962
pop ecx
pop ecx
push dword [esp + 0x1c]
lea eax, [esp + 0x14]
push dword [esp + 0x30]
lea esi, [esp + 0x70]
push dword [esp + 0x20]
push eax
sub esp, 0xc
mov edi, esp
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0063beb0
add esp, 0x20
cmp eax, 0xffffff88
ja 0x63be9d
add ebx, eax
lea eax, [esp + 0x34]
push eax
call fcn.00636ca1
pop ecx
cmp eax, 2
jle 0x63bdfa
mov edi, dword [esp + 0x10]
lea eax, [esp + 0x34]
push eax
call fcn.0062cb45
pop ecx
test eax, eax
je 0x63be9a
test ebp, ebp
js 0x63be9a
mov eax, dword [esp + 0x18]
sub eax, edi
cmp edi, dword [esp + 0x18]
ja 0x63be9a
lea esi, [eax + ebx]
cmp esi, dword [esp + 0x1c]
jbe 0x63be7d
push 0xffffffffffffffba
jmp 0x63be9c
test eax, eax
je 0x63be92
cmp ebx, edi
je 0x63be90
push eax
push edi
push ebx
call fcn.0064a810
add esp, 0xc
mov ebx, esi
sub ebx, dword [esp + 0x30]
mov eax, ebx
jmp 0x63be9d
push 0xffffffffffffffec
pop eax
mov ecx, dword [esp + 0x74]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00649c68
add esp, 0x68
ret
Function at 0x64a380
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
test eax, eax
je 0x64a3bf
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x64a3bf
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x64a3bf
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x64a3bf
cmp dword [ecx + 0x74], 0xe
jbe 0x64a3bf
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x64e3f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x64e41d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x64e41d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x65543f
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
push str.api_ms_win_core_synch_l1_2_0.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
je 0x65547d
mov edi, eax
push str.WaitOnAddress
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x65547d
mov esi, eax
push str.WakeByAddressSingle
push edi
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x65547d
mov ebx, eax
xor edi, edi
jmp 0x6554e5
push 0x7f576c
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
je 0x65553f
mov esi, eax
push str.NtCreateKeyedEvent
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x65553f
mov ebx, eax
push str.NtReleaseKeyedEvent
push esi
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x65553f
mov edi, eax
push str.NtWaitForKeyedEvent
push esi
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x65553f
mov esi, eax
xor eax, eax
mov ecx, esp
push eax
push eax
push 0xc0000000
push ecx
call ebx
test eax, eax
jne 0x65553f
mov ebx, dword [esp]
mov al, byte [0x803894]
mov ecx, 0xc
mov edx, 4
call fcn.004889b0
test eax, eax
je 0x655558
mov dword [eax], edi
mov dword [eax + 4], esi
mov ebp, eax
mov dword [eax + 8], ebx
xor eax, eax
lock cmpxchg dword [0x803240], ebp
je 0x655535
cmp dword [ebp], 0
mov esi, eax
je 0x655524
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_CloseHandle]
push ebp
push 0
push dword [0x8032a8]
call dword [sym.imp.kernel32.dll_HeapFree]
mov ebp, esi
mov eax, ebp
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, str.parking_lot_requires_either_NT_Keyed_Events__WinXP__or_WaitOnAddress_WakeByAddress__Win8_C:UsersNop.cargo_registry_srcindex.crates.io_1cd66030c949c28dparking_lot_core_0.9.9_src_thread_parkerwindowsmod.rs
mov edx, 0x5b
push 0x766808
call fcn.00655569
add esp, 4
ud2
mov ecx, 4
mov edx, 0xc
call fcn.00651860
ud2
Function at 0x659cf0
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
cmp dword [ecx + 4], 0
mov esi, ecx
je 0x659d71
lea ebx, [esi + 0xc]
mov dword [esp + 4], 0
lea eax, [esp + 4]
push 0
push eax
push 0
push ebx
call dword [sym.imp.kernel32.dll_InitOnceBeginInitialize]
cmp eax, 1
mov dword [esp], eax
jne 0x659dac
cmp dword [esp + 4], 0
je 0x659d93
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x659dcf
mov edi, eax
inc eax
mov dword [esi], eax
mov eax, dword [0x8032c4]
nop word cs:[eax + eax]
nop
mov dword [esi + 8], eax
lock cmpxchg dword [0x8032c4], esi
jne 0x659d50
mov byte [0x8032c0], 1
push 0
push 0
push ebx
call dword [sym.imp.kernel32.dll_InitOnceComplete]
jmp 0x659da3
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esp], eax
je 0x659e12
mov ecx, eax
xor eax, eax
inc ecx
lock cmpxchg dword [esi], ecx
jne 0x659d97
mov edi, dword [esp]
jmp 0x659da3
mov edi, dword [esi]
jmp 0x659da2
mov edi, eax
push dword [esp]
call dword [sym.imp.kernel32.dll_TlsFree]
dec edi
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
ret
mov dword [esp + 8], 0
lea eax, [esp + 8]
mov ecx, esp
mov edx, 0x7c1480
push 0x7c14e0
push eax
call fcn.00659e50
add esp, 8
ud2
push 0
push 4
push ebx
call dword [sym.imp.kernel32.dll_InitOnceComplete]
lea ecx, [esp + 8]
mov edx, 0x7c14d0
mov dword [esp + 8], 0x7c1498
mov dword [esp + 0xc], 1
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], 0x7f59e0
mov dword [esp + 0x14], 0
call fcn.00652150
ud2
mov ecx, esp
lea edx, [esp + 8]
mov dword [esp + 8], 0x7c1498
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 0x7f59e0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call fcn.00659e90
ud2

Function at 0x65a200
Capabilities:
Resolve dns

Disassembly:
push ebx
push edi
push esi
sub esp, 0x34
mov esi, ecx
lea ecx, [esp + 4]
push dword [esp + 0x44]
call fcn.004989a0
add esp, 4
mov eax, dword [esp + 4]
test eax, eax
je 0x65a242
mov ecx, dword [0x7c0408]
mov edx, dword [0x7c040c]
cmp dword [esp + 8], 0
mov dword [esi + 8], edx
mov dword [esi + 4], ecx
mov dword [esi], 1
je 0x65a2be
push eax
jmp 0x65a2b0
mov edi, dword [esp + 8]
mov ebx, dword [esp + 0xc]
xorps xmm0, xmm0
mov eax, esp
mov dword [esp], 0
lea ecx, [esp + 0x14]
movups xmmword [esp + 0x14], xmm0
movups xmmword [esp + 0x24], xmm0
mov dword [esp + 0x1c], 1
push eax
push ecx
push 0
push edi
call dword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x65a292
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov eax, 1
jmp 0x65a2a6
mov ecx, dword [esp]
movzx eax, word [esp + 0x48]
mov dword [esi + 4], ecx
mov dword [esi + 8], ecx
mov word [esi + 0xc], ax
xor eax, eax
test ebx, ebx
mov dword [esi], eax
mov byte [edi], 0
je 0x65a2be
push edi
push 0
push dword [0x8032a8]
call dword [sym.imp.kernel32.dll_HeapFree]
add esp, 0x34
pop esi
pop edi
pop ebx
ret
Function at 0x10002a90
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x10
cmp eax, 1
jne 0x10002ad2
mov eax, dword [esp + 0x14]
lea ecx, [esp]
push ecx
mov dword [0x10016dd0], eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
cmp word [esp + 6], 0x1c
push 0
jmp 0x10002abf
push 0
push 0
push 0x10002a70
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add esp, 0x10
ret 0xc

Function at 0x100034f2
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 1
push esi
jne 0x100035e2
mov eax, 0x94
call fcn.100039c0
mov esi, esp
push esi
mov dword [esi], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x10003657
mov ecx, dword [esi + 0x10]
mov dword [0x1001729c], ecx
mov eax, dword [esi + 4]
mov dword [0x100172a8], eax
mov edx, dword [esi + 8]
mov dword [0x100172ac], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
cmp ecx, 2
mov dword [0x100172a0], esi
je 0x1000355d
or esi, 0x8000
mov dword [0x100172a0], esi
shl eax, 8
add eax, edx
push 1
mov dword [0x100172a4], eax
call fcn.100054d0
test eax, eax
pop ecx
je 0x10003657
call fcn.10003cc4
test eax, eax
jne 0x1000358a
call fcn.10005521
jmp 0x10003657
call fcn.1000542e
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x10017970], eax
call fcn.1000530c
mov dword [0x1001711c], eax
call fcn.10004ded
test eax, eax
jl 0x100035db
call fcn.1000526a
test eax, eax
jl 0x100035d6
call fcn.10005037
test eax, eax
jl 0x100035d6
push 0
call fcn.10004b6f
test eax, eax
pop ecx
jne 0x100035d6
inc dword [0x10017118]
jmp 0x10003668
call fcn.10004feb
call fcn.10003aad
jmp 0x10003580
test eax, eax
jne 0x10003612
cmp dword [0x10017118], eax
jle 0x10003657
dec dword [0x10017118]
cmp dword [0x100172d8], eax
jne 0x10003601
call fcn.10004cad
call fcn.10004feb
call fcn.10003aad
call fcn.10005521
jmp 0x10003668
cmp eax, 2
jne 0x1000365b
push 0x8c
push 1
call fcn.10004d32
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x10003657
push esi
push dword [0x10015f88]
call dword [0x1001713c]
test eax, eax
push esi
je 0x10003651
call fcn.10003aca
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
or dword [esi + 4], 0xffffffff
mov dword [esi], eax
jmp 0x10003668
call fcn.1000378a
pop ecx
xor eax, eax
jmp 0x1000366b
cmp eax, 3
jne 0x10003668
push 0
call fcn.10003c95
pop ecx
xor eax, eax
inc eax
lea esp, [ebp - 4]
pop esi
pop ebp
ret 0xc
Function at 0x10004bd9
Capabilities:
Terminate process

Disassembly:
push 8
push 0x100105f8
call fcn.10004890
push 8
call fcn.1000485f
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x100172dc], esi
jne 0x10004c0d
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x100172d8], esi
mov al, byte [ebp + 0x10]
mov byte [0x100172d4], al
cmp dword [ebp + 0xc], edi
jne 0x10004c57
cmp dword [0x10017968], edi
je 0x10004c47
mov eax, dword [0x10017964]
sub eax, 4
mov dword [0x10017964], eax
cmp eax, dword [0x10017968]
jb 0x10004c47
mov eax, dword [eax]
cmp eax, edi
je 0x10004c28
call eax
jmp 0x10004c28
push 0x1001302c
mov eax, 0x10013028
call fcn.10004b57
pop ecx
push 0x10013038
mov eax, 0x10013030
call fcn.10004b57
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x10004c88
cmp dword [ebp + 0x10], edi
jne 0x10004c96
mov dword [0x100172dc], esi
push dword [ebp + 8]
call fcn.10004b15
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x10004c95
push 8
call fcn.100047aa
pop ecx
ret
call fcn.100048cb
ret

Function at 0x1000571f
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x10015f90]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x10016170]
je 0x10005754
inc eax
cmp eax, 0x13
jb 0x10005745
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x10016170]
jne 0x1000587a
mov eax, dword [0x10017124]
cmp eax, 1
je 0x10005852
cmp eax, edx
jne 0x10005784
cmp dword [0x10017128], 1
je 0x10005852
cmp ecx, 0xfc
je 0x1000587a
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x100057ba
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call fcn.100079c0
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.10007ac0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x100057ee
mov eax, edi
push eax
call fcn.10007ac0
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x10010a30
push edi
call fcn.10007c50
add esp, 0x10
push edi
call fcn.10007ac0
push dword [esi + 0x10016174]
mov ebx, eax
call fcn.10007ac0
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.100039c0
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.100079c0
push edi
push ebx
call fcn.100079d0
push 0x10010a10
push ebx
call fcn.100079d0
push dword [esi + 0x10016174]
push ebx
call fcn.100079d0
push HeapDestroy
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.10007b4b
add esp, 0x2c
jmp 0x1000587a
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x10016174]
push dword [esi]
call fcn.10007ac0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.10007da5
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret