joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003420
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009938d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x100b5004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 4], 0
push 0
mov dword [edi], vtable.CXPacketEncoder.0
call fcn.10081cfc
push eax
call fcn.1007f17e
mov al, byte [0x100a9df4]
movq xmm0, qword [0x100a9dec]
mov byte [ebp - 0x18], al
xor eax, eax
push 0x14c
movq qword [ebp - 0x20], xmm0
mov dword [ebp - 0x17], eax
mov word [ebp - 0x13], ax
mov byte [ebp - 0x11], al
call fcn.1007bcba
mov esi, eax
lea edx, [ebp - 0x11]
mov dword [ebp - 0x24], esi
xorps xmm0, xmm0
add esp, 0xc
xor ecx, ecx
mov dword [esi], vtable.CXTinyAes.0
movups xmmword [esi + 4], xmm0
movups xmmword [esi + 0x14], xmm0
movups xmmword [esi + 0x24], xmm0
movups xmm0, xmmword [ebp - 0x20]
movups xmmword [esi + 4], xmm0
mov al, byte [ebp + ecx - 0x20]
lea edx, [edx - 1]
xor al, byte [edx + 1]
mov byte [esi + ecx + 0x24], al
inc ecx
cmp ecx, 8
jb 0x100034c1
lea ecx, [esi + 0x134]
push ecx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [edi + 4], esi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1007bc9e
mov esp, ebp
pop ebp
ret

Function at 0x100035c0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x198
mov eax, dword [0x100b5004]
xor eax, esp
mov dword [esp + 0x194], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 4], eax
lea eax, [esp + 8]
push eax
push 0x202
mov dword [edi], vtable.CXTcpSocketClient.0
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 1
push 0
call esi
push 0
push 0
push 1
push 0
mov dword [edi + 0x2c], eax
mov dword [edi + 0x24], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x1c], 0
call esi
push 0
push 0
push 1
push 0
mov dword [edi + 0x18], eax
mov dword [edi + 0x10], 0
mov dword [edi + 0xc], 0
mov dword [edi + 8], 0
call esi
mov ecx, dword [esp + 0x19c]
mov dword [edi + 0x30], eax
mov eax, edi
mov dword [edi + 0x34], 0
pop edi
pop esi
xor ecx, esp
call fcn.1007bc9e
mov esp, ebp
pop ebp
ret 4
Function at 0x100037e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009940f
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x100b5004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], 0
mov dword [ebx], vtable.CXTcpServer.0
mov dword [ebx + 0x54], 0
mov byte [ebp - 4], 2
lea eax, [ebx + 0x24]
mov edx, dword [esi]
mov ecx, esi
push eax
push 5
call dword [edx + 0x1c]
push 0x200034
mov dword [ebx + 0x20], esi
call fcn.1007bcba
mov edx, eax
add esp, 4
mov dword [ebp - 0x10], edx
lea eax, [edx + 0xc]
mov dword [edx + 8], 0
mov dword [edx], eax
mov dword [edx + 4], eax
lea eax, [ebx + 4]
push eax
mov dword [ebx + 0x28], edx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebx + 0x30]
call fcn.100063a0
push 8
call fcn.1007bcba
add esp, 4
mov dword [ebp - 0x10], eax
xorps xmm0, xmm0
mov byte [ebp - 4], 3
mov ecx, eax
movq qword [eax], xmm0
call fcn.10003420
mov ecx, dword [ebp + 0x30]
mov dword [ebx + 0x1c], eax
mov dword [ebx + 0x58], 0
test ecx, ecx
je 0x100038b6
mov esi, dword [ecx]
lea eax, [ebp + 0xc]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x2c
Function at 0x100039b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10099486
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x100b5004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
sub esp, 0x28
mov dword [ebp - 4], 0
mov esi, esp
mov dword [ebp - 0x10], esi
mov dword [esi + 0x24], 0
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 0x30]
test ecx, ecx
je 0x10003a08
mov eax, dword [ecx]
push esi
call dword [eax]
mov dword [esi + 0x24], eax
push dword [ebp + 8]
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.100037e0
mov byte [ebp - 4], 2
mov dword [edi], vtable.CXHttpServer.0
push 0xc
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
call fcn.1007bcba
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [edi + 0x60], eax
mov byte [ebp - 4], 3
push 0x10
mov dword [edi + 0x84], 0
mov dword [edi + 0x88], 0
call fcn.1007bcba
add esp, 8
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [edi + 0x84], eax
lea eax, [edi + 0x68]
mov byte [ebp - 4], 4
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push eax
call esi
lea eax, [edi + 0x8c]
push eax
call esi
lea eax, [edi + 0xa4]
push eax
call esi
push 0
push 0xa00000
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0
push 0
push 1
push 0
mov dword [edi + 0x80], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0x204028
mov dword [edi + 0xbc], eax
mov dword [edi + 0xc0], 0
call fcn.1008dfec
add esp, 4
mov dword [edi + 0xc4], eax
mov dword [edi + 0xc8], 0
mov dword [edi + 0xcc], 0x7530
mov dword [edi + 0xd0], 0x7530
push 0
push 0
push edi
push 0x1000cae0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp + 0x30]
mov dword [edi + 0xc0], eax
test ecx, ecx
je 0x10003b24
mov esi, dword [ecx]
lea eax, [ebp + 0xc]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x2c
Function at 0x10003dc0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009940f
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x100b5004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], 0
mov dword [ebx], vtable.CXVTcpServer.0
mov dword [ebx + 0x54], 0
mov byte [ebp - 4], 2
lea eax, [ebx + 0x24]
mov edx, dword [esi]
mov ecx, esi
push eax
push 5
call dword [edx + 0x1c]
push 0x200034
mov dword [ebx + 0x20], esi
call fcn.1007bcba
mov edx, eax
add esp, 4
mov dword [ebp - 0x10], edx
lea eax, [edx + 0xc]
mov dword [edx + 8], 0
mov dword [edx], eax
mov dword [edx + 4], eax
lea eax, [ebx + 4]
push eax
mov dword [ebx + 0x28], edx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebx + 0x30]
call fcn.100063a0
push 8
call fcn.1007bcba
add esp, 4
mov dword [ebp - 0x10], eax
xorps xmm0, xmm0
mov byte [ebp - 4], 3
mov ecx, eax
movq qword [eax], xmm0
call fcn.10003420
mov ecx, dword [ebp + 0x30]
mov dword [ebx + 0x1c], eax
mov dword [ebx + 0x58], 0
test ecx, ecx
je 0x10003e96
mov esi, dword [ecx]
lea eax, [ebp + 0xc]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x2c
Function at 0x10005cf0
Capabilities:
Read file on windows
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100b5004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x1002c
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], esi
call fcn.1007bcba
mov edi, eax
xorps xmm0, xmm0
mov dword [ebp - 0xc], edi
add esp, 4
mov dword [edi + 0x14], 1
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov eax, dword [edi + 0x14]
test eax, eax
je 0x10005d49
cmp eax, 1
je 0x10005d49
lea ebx, [edi + 0x2c]
mov dword [ebx], 0
jmp 0x10005d56
lea ebx, [edi + 0x2c]
mov dword [edi + 0x1c], 0x10000
mov dword [edi + 0x20], ebx
mov eax, dword [ebp - 0x10]
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x18], esi
mov al, byte [eax + 0x46]
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
cmp al, 2
jne 0x10005e3c
mov eax, dword [edi + 0x1c]
mov esi, dword [0x100df518]
mov dword [ebp - 0x18], eax
mov eax, dword [edi + 0x20]
push esi
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [0x100df520]
jae 0x10005e2e
mov eax, dword [0x100df51c]
cmp dword [eax + ecx*8], 0
je 0x10005e2e
mov eax, dword [eax + ecx*8 + 4]
push esi
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx + 0x458]
sub eax, 0x66
je 0x10005df0
sub eax, 0x62
je 0x10005df0
sub eax, 1
je 0x10005de6
mov esi, 0x54f
jmp 0x10005e99
mov esi, 0x32
jmp 0x10005e99
push ecx
push edi
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp - 0x18]
push dword [ebp - 0x10]
call fcn.10016588
mov esi, eax
test esi, esi
je 0x10005ec2
cmp esi, 0x3e5
jne 0x10005e99
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007bc9e
mov esp, ebp
pop ebp
ret 4
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, 6
jmp 0x10005e99
cmp al, 7
jne 0x10005e68
push edi
lea eax, [ebp - 8]
push eax
push dword [edi + 0x1c]
push dword [edi + 0x20]
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10005e19
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x3e5
jne 0x10005e95
jmp 0x10005e19
push 0
push edi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 1
lea eax, [edi + 0x1c]
push eax
push esi
call dword [sym.imp.WS2_32.dll_WSARecv]
cmp eax, 0xffffffff
jne 0x10005e19
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x3e5
je 0x10005e19
test esi, esi
je 0x10005ec2
cmp dword [edi + 0x14], 2
jne 0x10005eb4
mov eax, dword [ebx]
test eax, eax
je 0x10005eb4
push eax
call fcn.1007bd0d
add esp, 4
mov dword [ebx], 0
push 0x1002c
push edi
call fcn.1007bcac
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1007bc9e
mov esp, ebp
pop ebp
ret 4
Function at 0x10006700
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x198
mov eax, dword [0x100b5004]
xor eax, esp
mov dword [esp + 0x194], eax
push esi
push edi
mov edi, ecx
lea eax, [esp + 8]
push eax
push 0x202
mov dword [edi], vtable.CXTcpSocketClient.0
mov dword [edi + 4], 0xffffffff
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 1
push 0
call esi
push 0
push 0
push 1
push 0
mov dword [edi + 0x2c], eax
mov dword [edi + 0x24], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x1c], 0
call esi
push 0
push 0
push 1
push 0
mov dword [edi + 0x18], eax
mov dword [edi + 0x10], 0
mov dword [edi + 0xc], 0
mov dword [edi + 8], 0
call esi
mov ecx, dword [esp + 0x19c]
mov dword [edi + 0x30], eax
mov eax, edi
mov dword [edi + 0x34], 0
pop edi
pop esi
xor ecx, esp
call fcn.1007bc9e
mov esp, ebp
pop ebp
ret

Function at 0x10006870
Capabilities:
Access peb ldr_data
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100997e4
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x100b5004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push 8
mov dword [edi], vtable.CXTcpClient.0
mov dword [edi + 0x1c], eax
call fcn.1007bcba
add esp, 4
mov dword [ebp + 8], eax
xorps xmm0, xmm0
mov byte [ebp - 4], 1
mov ecx, eax
movq qword [eax], xmm0
call fcn.10003420
mov byte [ebp - 4], 0
push 0x200034
mov dword [edi + 0x20], eax
call fcn.1007bcba
mov dword [ebp + 8], eax
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea ecx, [eax + 0xc]
mov dword [eax + 8], 0
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [edi + 0x24], eax
lea eax, [edi + 4]
push eax
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0xea60
call esi
lea eax, [edi + 0x30]
mov dword [ebp - 4], 2
push eax
mov dword [edi], vtable.CXHttpClient.0
mov dword [edi + 0x80], 0
call esi
lea eax, [edi + 0x48]
push eax
call esi
push 0
push 0xa00000
push 1
push 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0x204028
mov dword [edi + 0x68], eax
mov dword [edi + 0x6c], 0
call fcn.1008dfec
add esp, 4
mov dword [edi + 0x78], eax
mov dword [edi + 0x7c], 0
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
push edi
push 0x10012690
push 0
push 0
mov dword [edi + 0x74], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x70], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10006d10
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
cmp dword [esi], 0
je 0x10006d48
push edi
mov edi, dword [ebx + 0x80]
mov ecx, 0x3d9
push 0
push 0
push ebx
push 0x10006dc0
push 0
rep movsd dword es:[edi], dword [esi]
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebx + 0x84], eax
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 4
Function at 0x10007a70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100b5004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, ecx
push edi
mov dword [ebp - 0x10], eax
mov edi, dword [esi + 0x10]
test edi, edi
je 0x10007aed
push edi
call fcn.1008e73e
push eax
mov dword [ebp - 8], eax
call fcn.1008dfec
push dword [esi + 0x10]
lea ebx, [esi + 0x14]
mov dword [ebp - 0xc], eax
push ebx
lea ecx, [ebp - 8]
push ecx
push eax
call fcn.1008e66f
add esp, 0x18
test eax, eax
jne 0x10007ada
mov edi, dword [ebp - 8]
cmp edi, dword [esi + 0x10]
jae 0x10007ada
push edi
push dword [ebp - 0xc]
push ebx
call fcn.1007e990
mov eax, dword [esi + 0x10]
add esp, 0xc
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], edi
push dword [ebp - 0xc]
call fcn.1007bd0d
mov edi, dword [esi + 0x10]
add esp, 4
mov eax, dword [ebp - 0x10]
jmp 0x10007af0
lea ebx, [esi + 0x14]
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x10007b01
mov eax, dword [ecx]
push edi
push ebx
call dword [eax + 4]
mov edi, dword [esi + 0x10]
mov eax, dword [esi + 0xc]
mov dl, 0xf7
mov dword [ebp - 0x10], eax
mov bl, 0x5d
movzx eax, word [esi]
mov dh, 0x1c
mov dword [ebp - 0xc], eax
xor ecx, ecx
mov ah, 0x36
mov al, dh
xor dh, 0x88
add al, ah
xor ah, 0x66
add al, bl
xor bl, 0x44
add al, dl
xor dl, 0x22
xor byte [ecx + esi], al
inc ecx
cmp ecx, 0x14
jb 0x10007b17
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov dword [esi + 0xc], eax
xor ecx, ebp
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x10], edi
pop edi
mov word [esi], ax
mov al, 1
pop esi
pop ebx
call fcn.1007bc9e
mov esp, ebp
pop ebp
ret 4
Function at 0x10007b60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100b5004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov dl, 0xf7
push edi
mov dword [ebp - 0x10], ecx
mov bl, 0x5d
mov dh, 0x1c
xor ecx, ecx
mov eax, dword [esi + 0xc]
mov edi, dword [esi + 0x10]
mov dword [ebp - 8], eax
movzx eax, word [esi]
mov dword [ebp - 0xc], eax
mov ah, 0x36
mov dword [ebp - 0x14], edi
mov al, dh
xor dh, 0x88
add al, ah
xor ah, 0x66
add al, bl
xor bl, 0x44
add al, dl
xor dl, 0x22
xor byte [ecx + esi], al
inc ecx
cmp ecx, 0x14
jb 0x10007b95
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov word [esi], cx
mov ecx, dword [ebp - 0x10]
mov dword [esi + 0x10], edi
lea edi, [esi + 0x14]
mov dword [esi + 0xc], eax
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x10007bda
push dword [ebp - 0x14]
mov eax, dword [ecx]
push edi
call dword [eax + 8]
mov eax, dword [esi + 0xc]
test eax, eax
je 0x10007c25
push eax
mov dword [ebp - 8], eax
call fcn.1008dfec
push dword [esi + 0x10]
mov ebx, eax
lea eax, [ebp - 8]
push edi
push eax
push ebx
call fcn.1008e75c
add esp, 0x14
test eax, eax
jne 0x10007c3a
mov edi, dword [ebp - 8]
cmp edi, dword [esi + 0xc]
jne 0x10007c3a
cmp edi, 0x100000
ja 0x10007c3a
push edi
lea eax, [esi + 0x14]
push ebx
push eax
call fcn.1007e990
push ebx
mov dword [esi + 0x10], edi
call fcn.1007bd0d
add esp, 0x10
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007bc9e
mov esp, ebp
pop ebp
ret 4
push ebx
call fcn.1007bd0d
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
xor al, al
pop edi
pop esi
pop ebx
call fcn.1007bc9e
mov esp, ebp
pop ebp
ret 4
Function at 0x10009450
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10099a9d
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x100b5004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea esi, [edi + 8]
mov dword [ebp - 4], 0
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp + 8]
push eax
lea ecx, [edi + 0x20]
call fcn.100063a0
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp byte [0x100e573c], 0
jne 0x100094dc
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push edi
push 0x1000b2b0
push 0
push 0
call esi
push 0
push 0
push edi
push 0x1000b430
push 0
push 0
mov dword [edi + 0x8c], eax
call esi
mov dword [edi + 0xb8], eax
mov byte [0x100e573c], 1
mov ecx, dword [ebp + 0x2c]
test ecx, ecx
je 0x100094f4
mov edx, dword [ecx]
lea eax, [ebp + 8]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x28
Function at 0x1000a460
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10099bbd
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x100b5004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x100014
call fcn.1007bcba
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
movq qword [ebp - 0x1c], xmm0
add esp, 4
mov edi, eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
mov esi, dword [esi + 0x48]
lea eax, [esi + 4]
push eax
mov dword [ebp - 0x24], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0x1c]
lea ecx, [ebp - 0x1c]
add eax, 0x30
cmp ecx, eax
je 0x1000a521
mov esi, dword [eax + 4]
mov eax, dword [eax]
sub esi, eax
mov ebx, dword [ebp - 0x1c]
mov ecx, esi
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
sub eax, ebx
sar ecx, 2
sar eax, 2
cmp ecx, eax
jbe 0x1000a50e
push ecx
lea ecx, [ebp - 0x1c]
call fcn.1000bfe0
mov ebx, dword [ebp - 0x1c]
push esi
push dword [ebp - 0x20]
push ebx
call fcn.1007e990
lea eax, [esi + ebx]
add esp, 0xc
mov dword [ebp - 0x18], eax
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [ebp - 0x1c]
cmp esi, dword [ebp - 0x18]
je 0x1000a587
mov ebx, 0x2a
nop word [eax + eax]
mov word [edi + 2], bx
mov dword [edi + 8], 0
mov dword [edi + 4], 0
call fcn.1007f15d
cdq
mov ecx, 0x64
idiv ecx
mov dword [edi + 0x10], 0
inc edx
mov dword [edi + 0xc], 0
imul eax, edx, 0x34
push edi
mov word [edi], ax
mov eax, dword [esi]
mov ecx, dword [eax + 8]
mov eax, dword [ecx]
call dword [eax + 8]
add esi, 4
cmp esi, dword [ebp - 0x18]
jne 0x1000a540
push 0x100014
push edi
call fcn.1007bcac
mov edx, dword [ebp - 0x1c]
add esp, 8
test edx, edx
je 0x1000a5c8
mov ecx, dword [ebp - 0x14]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x1000a5be
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000a5e6
push ecx
push edx
call fcn.1007bcac
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1007bc9e
mov esp, ebp
pop ebp
ret
call fcn.1007f10c
int3
Function at 0x1000c2a0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x100b5004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
dec eax
cmp eax, 7
ja case.0x1000c2c0.5
jmp dword [eax*4 + 0x1000c36c]
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x10
push eax
push edx
push dword [ecx + 0x24]
call dword [sym.imp.WS2_32.dll_getsockname]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007bc9e
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x10
push eax
push edx
push dword [ecx + 0x24]
call dword [sym.imp.WS2_32.dll_getpeername]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007bc9e
mov esp, ebp
pop ebp
ret 8
mov byte [edx], 1
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007bc9e
mov esp, ebp
pop ebp
ret 8
mov dword [edx], 1
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007bc9e
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ecx + 0x58]
mov dword [edx], eax
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007bc9e
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov eax, 0x32
xor ecx, ebp
call fcn.1007bc9e
mov esp, ebp
pop ebp
ret 8

Function at 0x1000c840
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp eax, 4
je 0x1000c854
mov dword [ebp + 8], eax
pop ebp
jmp fcn.1000c2a0
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov dword [ecx], 3
pop ebp
ret 8

Function at 0x1000d580
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, edx
sub eax, 4
je 0x1000d5ac
sub eax, 2
je 0x1000d59b
mov dword [ebp + 8], edx
pop ebp
jmp fcn.1000c2a0
mov dl, byte [ecx + 0x84]
xor eax, eax
mov ecx, dword [ebp + 0xc]
mov byte [ecx], dl
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
mov dword [eax], 4
xor eax, eax
pop ebp
ret 8

Function at 0x1000d8b0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, edx
sub eax, 4
je 0x1000d8d9
sub eax, 2
je 0x1000d8cb
mov dword [ebp + 8], edx
pop ebp
jmp fcn.1000c2a0
mov dl, byte [ecx + 0x60]
xor eax, eax
mov ecx, dword [ebp + 0xc]
mov byte [ecx], dl
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
mov dword [eax], 8
xor eax, eax
pop ebp
ret 8