joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401940
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x824
mov eax, dword [0x40f004]
xor eax, esp
mov dword [esp + 0x820], eax
push ebx
push edi
push 0x26
lea edi, [esp + 0x214]
call fcn.00401340
push 0x4121e0
push str.CanonIJEREG
mov eax, edi
push eax
push str._s_s_s
mov ecx, 0x104
lea ebx, [esp + 0x1c]
call fcn.00401030
add esp, 0x14
test eax, eax
jge 0x4019a4
pop edi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x820]
xor ecx, esp
call fcn.00402e0d
add esp, 0x824
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea ecx, [esp + 0xc]
push ecx
call esi
cmp eax, 0xffffffff
je 0x401a00
push str.UNINST.EXE
lea edx, [esp + 0x10]
push edx
push 0x40d5bc
mov ecx, 0x104
lea ebx, [esp + 0x428]
call fcn.00401030
add esp, 0xc
test eax, eax
jl 0x401a00
mov eax, ebx
push eax
call esi
cmp eax, 0xffffffff
je 0x401a00
lea ecx, [esp + 0x624]
push ecx
lea edi, [esp + 0x10]
call fcn.00401140
add esp, 4
test eax, eax
jne 0x401a1a
pop esi
pop edi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x820]
xor ecx, esp
call fcn.00402e0d
add esp, 0x824
ret
lea edx, [esp + 0x624]
push edx
call esi
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
pop esi
pop edi
pop ebx
mov eax, ecx
mov ecx, dword [esp + 0x820]
xor ecx, esp
call fcn.00402e0d
add esp, 0x824
ret
Function at 0x401a50
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
sub esp, 0xc7c
mov eax, dword [0x40f004]
xor eax, esp
mov dword [esp + 0xc74], eax
push ebx
push ebp
push esi
push edi
push 0x26
lea edi, [esp + 0x27c]
mov dword [esp + 0x18], 0
call fcn.00401340
add esp, 4
test eax, eax
je 0x401bf2
push str.UNINST.EXE
push 0x4121e0
push str.CanonIJEREG
mov eax, edi
push eax
push str._s_s_s_s
mov ecx, 0x104
lea ebx, [esp + 0x84]
call fcn.00401030
add esp, 0x14
test eax, eax
jl 0x401bf2
mov ecx, ebx
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x401bf2
call fcn.004012d0
test eax, eax
je 0x401bf2
push str.IJRMF_DELETE_END_EVENT
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edx, ebx
push edx
push str.__s___S
mov ecx, 0x400
lea ebx, [esp + 0x488]
mov esi, eax
call fcn.00401030
add esp, 8
test eax, eax
jl 0x401be7
push 0x44
lea eax, [esp + 0x2c]
push 0
push eax
call fcn.00406760
add esp, 0xc
xor eax, eax
xor ecx, ecx
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
lea eax, [esp + 0x2c]
push eax
push ecx
push ecx
push 0x20
push 1
push ecx
push ecx
mov word [esp + 0x78], cx
mov ecx, ebx
push ecx
push 0
mov dword [esp + 0x50], 0x44
mov dword [esp + 0x7c], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x401be7
mov eax, dword [esp + 0x18]
mov ebp, dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x401ba7
push 0xffffffffffffffff
push eax
call ebx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
test eax, eax
je 0x401ba7
lea edx, [esp + 0x14]
push edx
push eax
call ebp
mov eax, dword [esp + 0x18]
push eax
call edi
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x401bb2
push eax
call edi
test dword [esp + 0x14], 0xffffff7f
jne 0x401bde
test esi, esi
je 0x401bd7
push 0x2710
push esi
call ebx
lea ecx, [esp + 0x14]
push ecx
push esi
mov dword [esp + 0x1c], eax
call ebp
push esi
call edi
mov eax, 1
jmp 0x401bf4
test esi, esi
je 0x401bf2
push esi
call edi
jmp 0x401bf2
test esi, esi
je 0x401bf2
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0xc84]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00402e0d
add esp, 0xc7c
ret
Function at 0x402c00
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x418
mov eax, dword [0x40f004]
xor eax, esp
mov dword [esp + 0x414], eax
push esi
push edi
mov edi, dword [ebp + 8]
push str.User_Registration_SETUP.EXE
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
test esi, esi
je 0x402c48
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x402c60
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x414]
xor ecx, esp
call fcn.00402e0d
mov esp, ebp
pop ebp
ret 0x10
call fcn.004014e0
test eax, eax
jne 0x402c8b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 2
pop edi
pop esi
mov ecx, dword [esp + 0x414]
xor ecx, esp
call fcn.00402e0d
mov esp, ebp
pop ebp
ret 0x10
push 0x104
lea eax, [esp + 0xc]
push eax
push edi
mov dword [0x4123e4], 0
mov dword [0x4123e0], edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea edx, [esp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
lea eax, [esp + 0x210]
push eax
lea edi, [esp + 0xc]
call fcn.00401140
add esp, 4
test eax, eax
jne 0x402cff
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x4123e4]
or eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x414]
xor ecx, esp
call fcn.00402e0d
mov esp, ebp
pop ebp
ret 0x10
push 2
push 0
lea ecx, [esp + 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [0x411db0], eax
test eax, eax
je 0x402cda
call fcn.00401940
test eax, eax
je 0x402d5e
call fcn.00401a50
test eax, eax
jne 0x402d5e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x411db0]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [0x4123e4]
or eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x414]
xor ecx, esp
call fcn.00402e0d
mov esp, ebp
pop ebp
ret 0x10
call fcn.00401c10
test eax, eax
jne 0x402d98
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x411db0]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [0x4123e4]
or eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x414]
xor ecx, esp
call fcn.00402e0d
mov esp, ebp
pop ebp
ret 0x10
call fcn.004023d0
test eax, eax
jne 0x402dd3
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x411db0]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [0x4123e4]
or eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x414]
xor ecx, esp
call fcn.00402e0d
mov esp, ebp
pop ebp
ret 0x10
call fcn.004026f0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x411db0]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [esp + 0x41c]
mov eax, dword [0x4123e4]
pop edi
pop esi
xor ecx, esp
call fcn.00402e0d
mov esp, ebp
pop ebp
ret 0x10

Function at 0x402e0d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40f004]
jne 0x402e17
repz ret
jmp fcn.004033cc
Function at 0x409023
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00403f4c
and dword [ebp - 4], 0
cmp dword [0x410880], 0
mov ebx, eax
jne 0x4090d4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x409185
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x409185
push eax
call fcn.00403eda
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x410880], eax
call esi
push eax
call fcn.00403eda
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x410884], eax
call esi
push eax
call fcn.00403eda
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x410888], eax
call esi
push eax
call fcn.00403eda
pop ecx
mov dword [0x410890], eax
test eax, eax
je 0x4090d4
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00403eda
pop ecx
mov dword [0x41088c], eax
mov eax, dword [0x41088c]
cmp eax, ebx
je 0x40912c
cmp dword [0x410890], ebx
je 0x40912c
push eax
call fcn.00403f55
push dword [0x410890]
mov esi, eax
call fcn.00403f55
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40912c
test edi, edi
je 0x40912c
call esi
test eax, eax
je 0x409123
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409123
test byte [ebp - 0xc], 1
jne 0x40912c
or dword [ebp + 0x10], 0x200000
jmp 0x409165
mov eax, dword [0x410884]
cmp eax, ebx
je 0x409165
push eax
call fcn.00403f55
pop ecx
test eax, eax
je 0x409165
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x409165
mov eax, dword [0x410888]
cmp eax, ebx
je 0x409165
push eax
call fcn.00403f55
pop ecx
test eax, eax
je 0x409165
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x410880]
call fcn.00403f55
pop ecx
test eax, eax
je 0x409185
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x409187
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41e7e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0
jmp 0x41e805
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0xc]
jae 0x41e878
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 8]
xor ecx, edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 8]
shr eax, 8
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
jmp 0x41e83a
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 8
jge 0x41e86d
mov edx, dword [ebp - 0x10]
and edx, 1
neg edx
sbb edx, edx
neg edx
mov byte [ebp - 0x15], dl
mov eax, dword [ebp - 0x10]
shr eax, 1
mov dword [ebp - 0x10], eax
movzx ecx, byte [ebp - 0x15]
test ecx, ecx
je 0x41e86b
mov edx, dword [ebp - 0x10]
xor edx, 0xedb88320
mov dword [ebp - 0x10], edx
jmp 0x41e831
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x41e7fc
mov eax, dword [ebp - 8]
not eax
mov esp, ebp
pop ebp
ret

Function at 0x43214c
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00432020

Function at 0x434d5d
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043471f

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x10001830
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
lea ecx, [eax + 0x18fc]
push esi
push edi
mov esi, eax
mov dword [ebp - 4], ecx
cmp eax, ecx
ja 0x10001871
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
nop
cmp esi, 0x7451
ja 0x100018b8
je 0x100018ad
mov eax, esi
sub eax, 0x5ee3
je 0x1000189b
sub eax, 0x4e
je 0x1000187b
sub eax, 0x4e
jne 0x100018f7
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
test eax, eax
js 0x100018a4
cmp eax, dword [edi + 0x28]
jge 0x100018a4
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x100018a4
mov ecx, dword [ecx + 4]
mov edx, dword [ecx + eax*4]
mov dword [ebp + 8], edx
jmp 0x100018f7
add eax, 0xc8f5133c
test edi, edi
jne 0x100018f7
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
jmp 0x100018f7
mov eax, esi
sub eax, 0x749f
je 0x100018f2
sub eax, 0x4e
je 0x100018cd
sub eax, 0x4e
je 0x10001871
jmp 0x100018f7
mov eax, dword [ebp + 0x10]
test byte [eax], 0x80
je 0x100018da
and ebx, 0xfffffffe
jmp 0x100018dd
or ebx, 1
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x1000190d
mov dword [ebp + 8], 0
jmp 0x100018f7
cmp ebx, 0xffffffff
je 0x1000190d
add esi, 0x4e
cmp esi, dword [ebp - 4]
jbe 0x10001850
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002150
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
push ebx
push esi
lea ecx, [eax + 0xa92]
push edi
mov edi, eax
mov dword [ebp - 8], edi
mov dword [ebp - 0x10], ecx
cmp eax, ecx
ja 0x100022c0
mov esi, dword [ebp + 8]
jmp 0x10002180
cmp edi, 0x6f74
ja 0x10002218
je 0x100021ff
mov eax, edi
sub eax, 0x9e8
je 0x100021ce
sub eax, 0x29
je 0x100021ad
sub eax, 0x29
jne 0x100022b1
mov dword [esi + 0x10], eax
jmp 0x100022b1
mov eax, dword [esi + 0x10]
push 0
push 0
push 0x1313
push eax
mov dword [esi + 4], 0
call fcn.10062ff0
add esp, 0x10
jmp 0x100022b1
mov ecx, dword [esi]
push 0
push 0
push 0x1313
push ecx
call fcn.10062ff0
mov edx, dword [esi + 4]
push 0
push 0
push 0x1313
push edx
mov dword [esi], 0
call fcn.10062ff0
add esp, 0x20
jmp 0x100022b1
lea eax, [esi + 0x94]
push eax
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
jmp 0x100022b1
mov eax, edi
sub eax, 0x6f9d
je 0x1000223c
sub eax, 0x29
je 0x10002234
sub eax, 0x29
je 0x100022c0
jmp 0x100022b1
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
jmp 0x100022b1
pop ss
fsub qword [ecx + ecx*8 + 0x707e835d]
add byte [ebx + 0x53756c5e], cl
test ebx, ebx
js 0x100022a4
mov edi, 0x2e9d
mov eax, edi
sub eax, 0x2e9d
je 0x10002277
sub eax, 0x3f
jne 0x1000228d
mov eax, 1
cmp dword [ebp + 0xc], eax
jne 0x1000228d
mov dword [esi + 0x70], eax
mov dword [ebp + 0xc], 0
jmp 0x1000228d
push 0
push 1
lea edx, [ebp + 0xf]
push edx
push ebx
mov byte [ebp + 0xf], 1
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp + 0xc], eax
add edi, 0x3f
cmp edi, 0x2edc
jbe 0x10002253
mov edi, dword [ebp - 8]
jmp 0x100022a4
lea eax, [esi + 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
add edi, 0x29
mov dword [ebp - 8], edi
cmp edi, dword [ebp - 0x10]
jbe 0x10002180
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100051f0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
lea edx, [edi + 0x1f1]
mov dword [ebp - 0xc], edx
cmp edi, edx
ja 0x100052c2
mov ebx, 0x28
cmp edi, 0x1b6c
ja 0x1000527b
je 0x10005291
mov ecx, edi
sub ecx, 0x7e5
je 0x10005234
sub ecx, 7
je 0x100052c2
jmp 0x10005283
push 0x2f77
lea eax, [ebp + 0x10]
push eax
push 0
push 0
mov dword [ebp + 0x10], ebx
call fcn.10066470
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10005274
lea ecx, [ebp - 4]
push ecx
push 0
push 0x252b
lea edx, [ebp - 8]
push edx
push esi
mov dword [ebp - 4], ebx
mov dword [ebp - 8], 0
call fcn.100654b0
add esp, 0x14
mov edx, dword [ebp - 0xc]
mov eax, esi
jmp 0x10005283
cmp edi, 0x3011
je 0x100052b4
add edi, 7
cmp edi, edx
jbe 0x10005215
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax]
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov edx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp + 0x14]
push eax
mov eax, dword [edx]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_send]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
mov edx, dword [ecx]
mov ecx, dword [eax + 0x60]
mov eax, dword [ecx + edx*4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10005520
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
mov esi, dword [ebp + 0x14]
lea eax, [esi + 0x3e]
mov dword [ebp + 0x14], eax
cmp esi, eax
mov eax, dword [ebp + 0x14]
push edi
ja 0x100055d9
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x14]
cmp esi, 0x46ed
ja 0x1000559c
je 0x10005590
mov ecx, esi
sub ecx, 0x3761
je 0x10005566
dec ecx
jne 0x100055c5
jae 0x100055c6
jo 0x1000559b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
lea eax, [ebp - 0x48]
push eax
push 0x10d8
call fcn.10069b40
add esp, 0xc
test eax, eax
jne 0x100055d6
mov ecx, dword [ebp - 0x48]
and ecx, 0xf000
cmp ecx, 0x4000
setne al
jmp 0x100055c5
cmp eax, 0xa323f0c8
mov edx, dword [ebp + 0x18]
mov edi, dword [edx]
jmp 0x100055c5
sub dword [ebx - 0x11167e32], ecx
inc esi
add byte [eax], al
mov ecx, esi
sub ecx, 0x46ee
je 0x100055ab
dec ecx
je 0x100055d9
jmp 0x100055c5
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push edi
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push edx
mov edx, dword [ebx]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_setsockopt]
inc esi
cmp esi, dword [ebp + 0x14]
jbe 0x10005543
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100091b0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [ebp + 0x18]
push ebx
push esi
lea ecx, [eax + 0x150]
mov esi, eax
push edi
mov dword [ebp + 0x18], esi
mov dword [ebp - 0x14], ecx
cmp eax, ecx
ja 0x1000926e
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x18]
cmp esi, 0x5f43
ja 0x10009242
je 0x10009370
mov eax, esi
sub eax, 0x5e9b
je 0x1000921f
sub eax, 0x54
jne 0x1000934d
cmp dword [ebp - 8], eax
jne 0x10009366
push eax
push eax
mov eax, dword [ebp + 8]
push 0x7a80
push eax
lea ecx, [ebp - 0x64]
push ecx
push 0
call fcn.10059b50
add esp, 0x18
jmp 0x1000934d
mov edx, dword [ebp + 0x20]
push edx
push 0
push 0x65a6
push 0
lea eax, [ebp - 0x64]
push eax
push 0
call fcn.100691e0
add esp, 0x18
mov dword [ebp - 8], eax
jmp 0x1000934d
mov eax, esi
sub eax, 0x6c44
je 0x100092b2
sub eax, 0x54
jne 0x1000934d
mov esi, 0x7f06
lea esp, [esp]
mov eax, esi
sub eax, 0x7f06
je 0x10009278
sub eax, 0x21
jne 0x100092a4
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0x14]
mov eax, dword [ecx]
test eax, eax
jle 0x10009283
mov ebx, eax
mov edx, dword [ebp + 0x1c]
mov eax, dword [edx]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0x20]
push ebx
push edi
push eax
mov eax, dword [ebp + 8]
push edx
mov edx, dword [ecx]
push eax
push edx
call dword [sym.imp.WS2_32.dll_sendto]
mov dword [ebp - 4], eax
add esi, 0x21
cmp esi, 0x7f27
jbe 0x10009260
mov esi, dword [ebp + 0x18]
mov eax, dword [ebp + 0x14]
cmp dword [eax], 0x18
mov ebx, 0x10
jne 0x1000934d
mov esi, 0x1eaf
jmp 0x100092d0
mov eax, esi
sub eax, 0x1eaf
je 0x10009311
sub eax, 9
je 0x100092e8
sub eax, 9
jne 0x1000933f
lea edi, [ebp - 0x34]
jmp 0x1000933f
movsb byte es:[edi], byte [esi]
fild qword [eax + 0x6a006a5a]
and cl, byte [ebp - 0x72ae0bb3]
push ebp
int3
jl 0x1000935c
add al, 0x87
push edi
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0x252b
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0xc], 0x1c
mov dword [ebp - 0x10], 0
call fcn.100654b0
add esp, 0x14
add esi, 9
cmp esi, 0x1ec1
jbe 0x100092d0
mov esi, dword [ebp + 0x18]
add esi, 0x54
mov dword [ebp + 0x18], esi
cmp esi, dword [ebp - 0x14]
jbe 0x100091d8
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002c9b0
Capabilities:
Compress data via zlib inflate or deflate

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
lea eax, [edi + 0x92]
mov dword [ebp - 4], eax
cmp edi, eax
ja 0x1002cae1
mov esi, dword [ebp + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp edi, 0x1575
ja 0x1002ca64
je 0x1002ca51
cmp edi, 0x8e2
ja 0x1002ca39
je 0x1002ca2d
cmp edi, 0x5ff
je 0x1002ca13
cmp edi, 0x8e0
jne 0x1002cad5
mov dword [esi + 0x4c], 0x10075779
mov dword [esi + 0x54], 9
jmp 0x1002cad5
push 0x179b
push 0
lea eax, [esi + 0x10]
push 0
push eax
call fcn.10021a00
add esp, 0x10
jmp 0x1002cad5
mov dword [esi + 0x50], 0x10075649
jmp 0x1002cad5
cmp edi, 0x8e4
jne 0x1002cad5
mov dword [esi + 0x58], 5
jmp 0x1002cad5
lea ecx, [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esi + 0x1c], 0
jmp 0x1002cad5
cmp edi, 0x35c5
ja 0x1002cacd
je 0x1002ca95
cmp edi, 0x1577
je 0x1002ca8d
cmp edi, 0x35c3
jne 0x1002cad5
lea edx, [esi + 0xb4]
push edx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
jmp 0x1002cad5
lea eax, [esi + 4]
push eax
call ebx
jmp 0x1002cad5
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ecx]
mov eax, dword [ebp + 0xc]
push 0x326a
push eax
mov eax, dword [ebp + 0x18]
lea ecx, [ebp + 0x14]
push ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp + 0x14], edx
mov edx, dword [ebp + 0x20]
push edx
push esi
push eax
push ecx
call fcn.1002bee0
add esp, 0x1c
lea edx, [esi + 0xb4]
push edx
mov dword [ebp + 0x14], eax
call ebx
jmp 0x1002cad5
cmp edi, 0x35c7
je 0x1002cae1
add edi, 2
cmp edi, dword [ebp - 4]
jbe 0x1002c9d4
mov eax, dword [ebp + 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100430a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
push ebx
lea ecx, [eax + 0xe70]
push esi
push edi
mov esi, eax
mov dword [ebp - 8], ecx
cmp eax, ecx
ja 0x100431d5
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
cmp esi, 0x6ba7
ja 0x10043145
je 0x100431b1
lea eax, [esi - 0x32f]
cmp eax, 0xe7
ja case.0x100430eb.816
movzx eax, byte [eax + 0x100431f4]
jmp dword [eax*4 + 0x100431e0]
mov ecx, dword [0x1007c49c]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
je 0x1004310e
cmp dword [edi + 0x60], 0x11223344
je case.0x100430eb.816
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [edi + 0x3c], 0
je 0x1004310e
mov dword [ebp + 0xc], edi
jmp case.0x100430eb.816
mov edx, dword [0x1007c498]
xor edi, edi
test edx, edx
jne case.0x100430eb.816
push edx
push edx
push 0x6bb9
push edx
push edx
call fcn.10042d30
add esp, 0x14
test eax, eax
jne 0x1004310e
jmp case.0x100430eb.816
mov eax, esi
sub eax, 0x7c15
je 0x10043160
sub eax, 0x4d
je 0x1004315a
sub eax, 0x4d
je 0x100431d5
jmp case.0x100430eb.816
mov byte [ebp + 0xc], 1
jmp case.0x100430eb.816
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x5f93
call fcn.1000aa10
add esp, 0x10
test al, al
je 0x100431d1
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push ecx
push eax
push ebx
call fcn.10001bf0
add esp, 0xc
add esi, 0x4d
cmp esi, dword [ebp - 8]
jbe 0x100430c5
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
add byte [ebp + edi*4 + 0x25], 0x90
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x100431c7
mov ecx, dword [ebp + 8]
mov eax, dword [ebx + 0x54]
mov edx, dword [ecx]
mov eax, dword [eax + edx*4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [ebp + 0xc], 0
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret