joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002190
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x1000f044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xc4
lea eax, [ebp - 0x228]
mov ebx, ecx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x228]
push 0x32
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
lea ecx, [ebp - 0x1f6]
call fcn.100023a0
push 0x31
lea eax, [ebp - 0x38]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea esi, [ebp - 0x34]
xor edi, edi
nop dword [eax]
lea ecx, [edi - 0x7ffffffe]
call fcn.10002370
mov eax, dword [0x1000f8c4]
lea esi, [esi + 0x10]
mov dword [esi - 0x14], eax
inc edi
mov eax, dword [0x1000f8c0]
mov dword [esi - 0x10], eax
mov eax, dword [0x1000f8bc]
mov dword [esi - 0xc], eax
mov eax, dword [0x1000f8b8]
mov dword [esi - 8], eax
cmp edi, 3
jb 0x100021f0
lea ecx, [ebp - 0x38]
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10002230
sub ecx, edx
lea eax, [ebp - 0x38]
push eax
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x1d8]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
add esp, 0xc
lea ecx, [ebp - 0x188]
call fcn.100024d0
mov edi, dword [sym.imp.AVICAP32.dll_capGetDriverDescriptionW]
xor ecx, ecx
xor esi, esi
test ecx, ecx
jne 0x1000228a
push 0x64
lea eax, [ebp - 0x9c]
push eax
push 0xc8
lea eax, [ebp - 0x164]
push eax
push esi
call edi
inc esi
mov ecx, eax
cmp esi, 0xa
jl 0x10002266
movups xmm0, xmmword [ebp - 0x228]
movzx eax, word [ebp - 0x1f8]
pop edi
movups xmmword [ebx], xmm0
pop esi
movups xmm0, xmmword [ebp - 0x218]
movups xmmword [ebx + 0x10], xmm0
movups xmm0, xmmword [ebp - 0x208]
movups xmmword [ebx + 0x20], xmm0
mov word [ebx + 0x30], ax
movups xmm0, xmmword [ebp - 0x1f6]
mov eax, dword [ebp - 0x1de]
movups xmmword [ebx + 0x32], xmm0
movq xmm0, qword [ebp - 0x1e6]
movq qword [ebx + 0x42], xmm0
movups xmm0, xmmword [ebp - 0x1d8]
mov dword [ebx + 0x4a], eax
movzx eax, word [ebp - 0x1da]
movups xmmword [ebx + 0x50], xmm0
mov word [ebx + 0x4e], ax
movups xmm0, xmmword [ebp - 0x1c8]
mov eax, dword [ebp - 0x170]
movups xmmword [ebx + 0x60], xmm0
movups xmm0, xmmword [ebp - 0x1b8]
movups xmmword [ebx + 0x70], xmm0
movups xmm0, xmmword [ebp - 0x1a8]
movups xmmword [ebx + 0x80], xmm0
movups xmm0, xmmword [ebp - 0x198]
movups xmmword [ebx + 0x90], xmm0
movups xmm0, xmmword [ebp - 0x188]
movups xmmword [ebx + 0xa0], xmm0
movq xmm0, qword [ebp - 0x178]
movq qword [ebx + 0xb0], xmm0
mov dword [ebx + 0xb8], eax
movzx eax, word [ebp - 0x16c]
mov word [ebx + 0xbc], ax
mov byte [ebx + 0xbe], cl
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1000908b
mov esp, ebp
pop ebp
ret
Function at 0x100023a0
Capabilities:
Check os version
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
pushal
mov ebx, dword fs:[0x18]
mov eax, dword fs:[0x30]
mov ebx, dword [eax + 0xa8]
mov eax, dword [eax + 0xa4]
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], eax
popal
mov eax, dword [ebp - 0xc]
cmp eax, 5
jne 0x10002428
mov eax, dword [ebp - 8]
test eax, eax
jne 0x100023f6
push str.Windows_2000
push 0xd
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 1
jne 0x10002405
push str.Windows_XP
jmp 0x100024bb
cmp eax, 2
jne 0x100024c9
push str.Windows_2003
push 0xd
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 6
jne 0x100024ab
mov eax, dword [ebp - 8]
test eax, eax
jne 0x1000244e
push str.Windows_Vista
push 0xe
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 1
jne 0x1000246d
push str.Windows_7
push 0xa
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 2
jne 0x1000248c
push str.Windows_8
push 0xa
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 3
jne 0x100024c9
push str.Windows_8.1
push 0xc
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 0xa
jne 0x100024c9
cmp dword [ebp - 8], 0
jne 0x100024c9
push str.Windows_10
push 0xb
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100024d0
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x74
mov eax, dword [0x1000f044]
xor eax, esp
mov dword [esp + 0x70], eax
push ebx
push esi
push edi
lea eax, [esp + 0x38]
mov dword [esp + 0x38], 0x40
push eax
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x100025ef
mov esi, dword [esp + 0x40]
xorps xmm0, xmm0
mov eax, dword [esp + 0x44]
mov ecx, esi
mov edi, dword [esp + 0x48]
xor edx, edx
shrd esi, eax, 0x1e
movsd qword [esp + 0x28], xmm0
shr eax, 0x1e
mov dword [esp + 0x1c], esi
mov esi, edi
mov dword [esp + 0x18], eax
and edi, 0x3fffffff
mov eax, dword [esp + 0x4c]
shrd esi, eax, 0x1e
movsd qword [esp + 0x30], xmm0
mov dword [esp + 0x24], esi
xor esi, esi
shr eax, 0x1e
mov dword [esp + 0x20], eax
and ecx, 0x3fffffff
je 0x10002571
shrd ecx, edx, 0x14
shr edx, 0x14
call fcn.1000a310
mulsd xmm0, qword [0x1000bf18]
movsd qword [esp + 0x28], xmm0
test edi, edi
je 0x10002593
shrd edi, esi, 0x14
shr esi, 0x14
mov ecx, edi
mov edx, esi
call fcn.1000a310
mulsd xmm0, qword [0x1000bf18]
movsd qword [esp + 0x30], xmm0
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
call fcn.1000a310
addsd xmm0, qword [esp + 0x28]
mov edx, dword [esp + 0x20]
sub esp, 8
mov ecx, dword [esp + 0x2c]
movsd qword [esp], xmm0
call fcn.1000a310
addsd xmm0, qword [esp + 0x38]
sub esp, 8
movsd qword [esp], xmm0
push str._.2fGB__.2fGB
push 0x1e
push ebx
call fcn.10002610
add esp, 0x1c
mov ecx, 0x1d
sub ecx, eax
inc eax
add eax, ebx
push ecx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov ecx, dword [esp + 0x7c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1000908b
mov esp, ebp
pop ebp
ret

Function at 0x10002650
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1390
call fcn.10009ac0
mov eax, dword [0x1000f044]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
call dword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [ebp - 0xc], 0xffffffff
mov edx, 1
mov dword [ebp - 0x138c], eax
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [ebp + edx*4 - 0x138c], eax
inc edx
cmp edx, 0x270
jb 0x10002683
mov dword [ebp - 0x1390], 0x270
xor esi, esi
nop
lea ecx, [ebp - 0x1390]
call fcn.100026f0
xor edx, edx
mov ecx, esi
nop
cmp ecx, 0x10
jae 0x100026da
mov byte [ecx + edi], al
inc edx
shr eax, 8
inc ecx
cmp edx, 4
jb 0x100026c0
add esi, 4
cmp esi, 0x10
jb 0x100026b0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1000908b
mov esp, ebp
pop ebp
ret
Function at 0x100026f0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
mov eax, dword [edi]
cmp eax, 0x270
jne 0x1000274e
lea edx, [edi + 8]
mov esi, eax
nop dword [eax]
mov ecx, dword [edx - 4]
lea edx, [edx + 4]
xor ecx, dword [edx - 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x10002710
mov eax, dword [edi]
jmp 0x10002839
cmp eax, 0x4e0
jb 0x10002839
mov eax, dword [edi + 0x9c4]
push ebx
lea ebx, [edi + 0x9c4]
mov edi, 0xe3
nop dword [eax + eax]
mov ecx, dword [ebx + 4]
lea edx, [ebx + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x10002770
mov ebx, dword [ebp - 4]
mov edi, 0x18c
add ebx, 0xd50
mov eax, dword [ebx]
nop dword [eax]
mov ecx, eax
lea edx, [ebx + 4]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx - 0xd4c]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x100027c0
mov edi, dword [ebp - 4]
pop ebx
mov ecx, dword [edi + 0x1380]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi + 0x9c0], eax
xor eax, eax
mov dword [edi], 0
mov edx, dword [edi + eax*4 + 4]
inc eax
mov dword [edi], eax
mov ecx, edx
mov eax, dword [edi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10002905
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000a3e4
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1000f044]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push 0x34
call fcn.100090cf
mov esi, eax
mov dword [ebp - 0x10], esi
push 0x34
push 0
push esi
mov dword [ebp - 4], 0
call sub.VCRUNTIME140.dll_memset
mov edi, dword [ebp + 8]
add esp, 0x10
mov ecx, esi
push edi
call fcn.10003d00
push 8
mov esi, eax
mov dword [ebp - 4], 0xffffffff
call fcn.100090cf
add esp, 4
mov dword [ebp + 8], eax
mov dword [eax], esi
mov dword [eax + 4], ebx
movzx ecx, word [edi + 0x10]
add ecx, 0xfffffff2
cmp ecx, 3
ja case.default.0x100028fe
jmp dword [ecx*4 + 0x100029a4]
push 0
push 0
push eax
push 0x100029c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push dword [ebx + 0x214]
call dword [sym.imp.KERNEL32.dll_SetEvent]
test esi, esi
je case.default.0x100028fe
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x10002954
push eax
call fcn.100090c5
add esp, 4
mov dword [esi + 0x1c], 0
mov eax, dword [esi + 0x24]
test eax, eax
je 0x1000296b
push eax
call fcn.100090c5
add esp, 4
mov dword [esi + 0x24], 0
mov eax, dword [esi + 0x28]
test eax, eax
je 0x10002982
push eax
call fcn.100090c5
add esp, 4
mov dword [esi + 0x28], 0
push 0x34
push esi
call fcn.100090ff
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10002d40
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000a424
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1000f044]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x34
call fcn.100090cf
mov esi, eax
mov dword [ebp - 0x10], esi
push 0x34
push 0
push esi
mov dword [ebp - 4], 0
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
mov ecx, esi
push dword [ebp + 8]
call fcn.10003d00
push 8
mov esi, eax
mov dword [ebp - 4], 0xffffffff
call fcn.100090cf
add esp, 4
mov dword [ebp + 8], eax
mov dword [eax], esi
mov dword [eax + 4], edi
movzx ecx, word [esi + 0x10]
add ecx, 0xfffffff7
cmp ecx, 3
ja case.default.0x10002dbc
jmp dword [ecx*4 + 0x10002e90]
push 0
push 0
push eax
push 0x10002ea0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0
push 0
push eax
push 0x10002fc0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [edi + 4]
push 0
push 0
push 0xc
call fcn.10004b30
push dword [edi + 0x238]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x10002e42
push eax
call fcn.100090c5
add esp, 4
mov dword [esi + 0x1c], 0
mov eax, dword [esi + 0x24]
test eax, eax
je 0x10002e59
push eax
call fcn.100090c5
add esp, 4
mov dword [esi + 0x24], 0
mov eax, dword [esi + 0x28]
test eax, eax
je 0x10002e70
push eax
call fcn.100090c5
add esp, 4
mov dword [esi + 0x28], 0
push 0x34
push esi
call fcn.100090ff
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10002dea
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000a424
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1000f044]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x34
call fcn.100090cf
mov esi, eax
mov dword [ebp - 0x10], esi
push 0x34
push 0
push esi
mov dword [ebp - 4], 0
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
mov ecx, esi
push dword [ebp + 8]
call fcn.10003d00
push 8
mov esi, eax
mov dword [ebp - 4], 0xffffffff
call fcn.100090cf
add esp, 4
mov dword [ebp + 8], eax
mov dword [eax], esi
mov dword [eax + 4], edi
movzx ecx, word [esi + 0x10]
add ecx, 0xfffffff7
cmp ecx, 3
ja case.default.0x10002dbc
jmp dword [ecx*4 + 0x10002e90]
push 0
push 0
push eax
push 0x10002ea0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0
push 0
push eax
push 0x10002fc0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [edi + 4]
push 0
push 0
push 0xc
call fcn.10004b30
push dword [edi + 0x238]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x10002e42
push eax
call fcn.100090c5
add esp, 4
mov dword [esi + 0x1c], 0
mov eax, dword [esi + 0x24]
test eax, eax
je 0x10002e59
push eax
call fcn.100090c5
add esp, 4
mov dword [esi + 0x24], 0
mov eax, dword [esi + 0x28]
test eax, eax
je 0x10002e70
push eax
call fcn.100090c5
add esp, 4
mov dword [esi + 0x28], 0
push 0x34
push esi
call fcn.100090ff
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x100030e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000a424
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1000f044]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x34
call fcn.100090cf
mov edi, eax
mov dword [ebp - 0x10], edi
push 0x34
push 0
push edi
mov dword [ebp - 4], 0
call sub.VCRUNTIME140.dll_memset
mov esi, dword [ebp + 8]
add esp, 0x10
mov ecx, edi
push esi
call fcn.10003d00
movzx ecx, word [esi + 0x10]
mov edx, ecx
cmp ecx, 3
je 0x10003172
cmp ecx, 8
je 0x10003166
cmp edx, 0xd
je 0x1000315a
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0
push 0
push eax
push 0x100036f0
jmp 0x1000317c
push 0
push 0
push eax
push 0x10003500
jmp 0x1000317c
push 0
push 0
push eax
push 0x100031a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10003870
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x1000f044]
xor eax, ebp
mov dword [ebp - 4], eax
movups xmm0, xmmword [str.127.0.0.1]
mov eax, dword [0x1000be54]
mov dword [ebp - 0x3c], eax
mov ax, word [0x1000be60]
movups xmmword [ebp - 0x4c], xmm0
mov dword [ebp - 0x28], 0
xorps xmm0, xmm0
mov word [ebp - 0x10], ax
movups xmmword [ebp - 0x38], xmm0
push esi
movq xmm0, qword [str.5555]
movq qword [ebp - 0x18], xmm0
xorps xmm0, xmm0
push 0x2a
movq qword [ebp - 0xe], xmm0
mov word [ebp - 6], 0
call fcn.100090cf
mov esi, eax
lea eax, [ebp - 0x4c]
push eax
push 0x14
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0x10
lea eax, [ebp - 0x24]
push 0
push 0
push 0xa
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x18]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
add esp, 4
mov word [esi + 0x28], ax
push 0
push 0
push esi
push 0x10003940
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1000908b
mov esp, ebp
pop ebp
ret

Function at 0x100041f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000a424
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1000f044]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x34
call fcn.100090cf
mov esi, eax
mov dword [ebp - 0x10], esi
push 0x34
push 0
push esi
mov dword [ebp - 4], 0
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
mov ecx, esi
push dword [ebp + 8]
call fcn.10003d00
mov esi, eax
mov dword [ebp - 4], 0xffffffff
movzx ecx, word [esi + 0x10]
mov eax, ecx
cmp ecx, 4
je 0x10004284
cmp eax, 7
jne 0x100042aa
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [edi + 4]
push 0
push 0
push 7
call fcn.10004b30
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 8
call fcn.100090cf
add esp, 4
mov dword [ebp + 8], eax
mov dword [eax], edi
push 0
push 0
push eax
push 0x10004510
push 0
push 0
mov dword [eax + 4], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10004e80
Capabilities:
Create thread

Disassembly:
push 0
push 0
push ecx
push 0x10004ea0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
ret 0x10
Function at 0x10006c50
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x1000f044]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.10006b10
add esp, 4
mov word [esi], ax
test ax, ax
je 0x10006c99
push esi
push dword [ebp + 0xc]
push edi
call fcn.10006be0
add esp, 0xc
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000908b
mov esp, ebp
pop ebp
ret
xorps xmm0, xmm0
mov dword [ebp - 0x8c], 0
movups xmmword [esi + 2], xmm0
lea ecx, [ebp - 0x88]
mov dword [ebp - 0xac], 0x100
movq qword [esi + 0x12], xmm0
mov word [esi + 0x1a], 0
movzx eax, word [esi]
push edi
movlpd qword [ebp - 0xa4], xmm0
movlpd qword [ebp - 0x9c], xmm0
movlpd qword [ebp - 0x94], xmm0
mov dword [ebp - 0xa8], eax
call fcn.10006a00
lea ecx, [ebp - 0x8c]
push ecx
lea ecx, [ebp - 0xac]
push ecx
push 0
push dword [eax]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov edi, eax
lea ecx, [ebp - 0x84]
mov eax, dword [ebp - 0x88]
cmp eax, ecx
je 0x10006d20
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
test edi, edi
je 0x10006d3f
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
xor edi, edi
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000908b
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x8c]
xor edi, edi
test eax, eax
je 0x10006d7a
nop dword [eax + eax]
mov ecx, dword [eax + 4]
cmp ecx, 2
je 0x10006d66
cmp ecx, 0x17
je 0x10006d66
mov eax, dword [eax + 0x1c]
test eax, eax
jne 0x10006d50
jmp 0x10006d7a
push dword [eax + 0x10]
push dword [eax + 0x18]
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov edi, 1
push dword [ebp - 0x8c]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
test edi, edi
je 0x10006da9
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_htons]
mov word [esi + 2], ax
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000908b
mov esp, ebp
pop ebp
ret
push 0x2af9
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.1000908b
mov esp, ebp
pop ebp
ret

Function at 0x10006f10
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
xor eax, eax
mov dword [ebp - 8], 0x1c
mov word [ebp - 0x24], ax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x10006f3e
xor eax, eax
mov esp, ebp
pop ebp
ret
push dword [ebp + 0x14]
lea eax, [ebp - 4]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.10007310
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x10007010
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, dword [edi + 4]
test esi, esi
je 0x10007075
cmp dword [esi], 0
je 0x1000706a
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x1000703b
or eax, 0xffffffff
jmp 0x10007090
push str.CreateFileTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10007070
push 0
push 0
push dword [esi]
push 0
push 0x80
push 3
push 0
push 1
push closesocket
push dword [ebp + 8]
call eax
jmp 0x10007090
cmp dword [esi + 4], 0
jne 0x10007075
or eax, 0xffffffff
jmp 0x10007090
push 0
push 0x80
push 3
push 0
push 1
push closesocket
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x100070a4
call fcn.10005a20
test eax, eax
jns 0x100070a6
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov dword [edi], eax
lea eax, [ebp - 4]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x100070ca
call fcn.10005a20
test eax, eax
js 0x1000718a
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
test ecx, ecx
jne 0x100070db
test eax, eax
je 0x1000717c
test ecx, ecx
ja 0x1000717c
jb 0x100070ec
cmp eax, dword [ebp + 0x14]
ja 0x1000717c
mov esi, dword [edi]
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push eax
push dword [ebp - 4]
mov dword [ebp - 8], eax
push 2
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edi, dword [ebp + 0x10]
mov ecx, eax
mov dword [edi + 8], ecx
test ecx, ecx
jne 0x10007124
call fcn.10005a20
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
push 0
push eax
push 0
push 0
push 4
push ecx
mov dword [edi + 4], eax
mov dword [edi + 0x18], 4
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
mov dword [edi], eax
test eax, eax
jne 0x10007174
call fcn.10005a20
push dword [edi + 8]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 8], 0
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
or eax, ecx
mov eax, 0x800703ee
je 0x1000718a
mov eax, 0x800700df
pop edi
pop esi
mov esp, ebp
pop ebp
ret