joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405280
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
mov edi, dword [esp + 0x20]
push 0
lea eax, [esp + 0x24]
push eax
push 8
push edi
push ebx
call ebp
test eax, eax
je 0x405318
cmp dword [esp + 0x20], 8
jne 0x405318
push 0
lea ecx, [esp + 0x24]
push ecx
push 0x30
lea edx, [edi + 8]
push edx
push ebx
call ebp
test eax, eax
je 0x405318
cmp dword [esp + 0x20], 0x30
jne 0x405318
push esi
mov esi, dword [edi]
push 0
lea eax, [esp + 0x28]
push eax
sub esi, 0x38
push esi
add edi, 0x38
push edi
push ebx
call ebp
test eax, eax
je 0x40530f
cmp dword [esp + 0x24], esi
jne 0x40530f
mov ecx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
push 0
push 0
push ecx
push ebx
sar esi, 1
push esi
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov byte [esi + ebx], 0
pop esi
pop edi
pop ebp
mov eax, 1
pop ebx
ret 0x14
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
ret 0x14
pop edi
pop ebp
xor eax, eax
pop ebx
ret 0x14

Function at 0x4055e0
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
sub esp, 0x24c
mov eax, dword [0x4190cc]
xor eax, esp
mov dword [esp + 0x248], eax
mov eax, dword [esp + 0x254]
push ebp
mov ebp, dword [esp + 0x254]
push esi
push edi
push 0
push 0x20000000
push 3
push 0
push 7
push 0x80000000
push ebp
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40571d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x40570f
cmp byte [ebp], 0
mov esi, ebp
lea edi, [esp + 0x150]
je 0x40567a
jmp 0x405650
movsx ecx, byte [esi]
push ecx
call 0x409259
add esp, 4
test eax, eax
jne 0x40566f
mov al, byte [esi]
cmp al, 0x2d
je 0x40566f
cmp al, 0x2e
je 0x40566f
mov byte [edi], 0x3f
jmp 0x405673
mov dl, byte [esi]
mov byte [edi], dl
inc esi
inc edi
cmp byte [esi], 0
jne 0x405650
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x154]
push ecx
mov byte [edi], 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4056ca
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea edx, [esp + 0x14]
push edx
push esi
mov edi, 1
call ebx
cmp eax, edi
jne 0x4056be
nop
lea eax, [esp + 0x14]
push eax
push esi
inc edi
call ebx
cmp eax, 1
je 0x4056b0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebx
test edi, edi
jne 0x4056d8
mov dword [ebp + 0x210], 1
xor eax, eax
jmp 0x405739
cmp edi, 1
je 0x4056eb
mov dword [ebp + 0x210], 3
xor eax, eax
jmp 0x405739
push 0
push 0x8000000
push 3
push 0
push 7
push 0x80000000
lea ecx, [esp + 0x54]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40571d
mov dword [ebp + 0x210], 2
xor eax, eax
jmp 0x405739
mov edx, dword [esp + 0xc]
push edx
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [esp + 0x254]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00408b84
add esp, 0x24c
ret 8
Function at 0x408490
Capabilities:
Allocate thread local storage

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al

Function at 0x408560
Capabilities:
Allocate thread local storage

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
Function at 0x4085c0
Capabilities:
Allocate thread local storage

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
Function at 0x408b84
Capabilities:
Allocate thread local storage

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
Function at 0x36e2bdd
Capabilities:
Get number of processors

Disassembly:
jmp 0x36e9f67
pushal
mov dword [esp + 0x20], 0x8000
pushal
lea esp, [esp + 0x40]
jb 0x36eb70f
pushal
pushal
mov dword [esp + 0x3c], 0
pushfd
push dword [ebp - 0x90]
pop dword [esp + 0x3c]
pushfd
mov word [esp], di
call fcn.036ed65c

Function at 0x36e2cda
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x4d3a78db
lea esp, [esp + 0x30]
jne 0x36e7d88
pushfd
movsx ax, bl
push 0x617aa8ba
mov eax, dword [ebp - 0x100]
movzx cx, al
mov byte [esp + 4], bl
mov ecx, dword [eax + 0x18]
lea eax, [eax*2 + 0x63a171a]
pushfd
lahf
push 0x98a3081e
mov dword [ebp - 0xf8], ecx
rdtsc
rdtsc
mov edx, dword [ebp - 0x100]
jmp 0x36e4c91
jmp 0x36e521b
cwde
mov eax, dword [edx + 0x20]
mov byte [esp + 4], 0x60
pushfd
pushfd
pushal
mov dword [ebp - 0xf0], eax
pushfd
mov word [esp + 4], 0xdf47
mov byte [esp + 4], 0xde
pushfd
lea esp, [esp + 0x40]
jmp 0x36e5e6c

Function at 0x36e38d7
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
mov dword [ebp - 0xbc], eax
sal dh, cl
cmc
movzx dx, cl
mov edx, dword [ebp - 0xac]
shld ax, cx, cl
sbb bx, bx
clc
add edx, 0x10002253
aad 3
aas
stc
add edx, 1
rol eax, cl
aam 0xbc
mov ebx, dword [ebp - 0xcc]
jmp 0x36ec2eb
jmp 0x36e4939
cmp edx, 0x20
pushal
lea esp, [esp + 0x30]
jne 0x36ea158
call fcn.036e8ce1
jmp 0x36e1e03
push edx
push dword [esp]
pushal
lea esp, [esp + 0x28]
jmp 0x36e5270
add ebx, dword [ebp - 0xbc]
shrd di, di, 9
stc
ror ax, 7
sar edi, cl
mov dword [edx], ebx
cmp ch, 0x39
rcl cx, 0xd
aas
xor byte [edx - 1], 0x80
or dx, 0xa92c
shld cx, di, 0xa
dec cl
mov eax, dword [ebp - 0xac]
sar cx, cl
not dh
cmp cx, di
xadd dx, bx
add eax, 0x10002395
cmc
seto cl
rol ch, cl
mov dword [ebp - 0xb0], eax
cwde
popfd
add ax, 0xbbe8
popal
daa
mov eax, dword fs:[0x30]
pushfd
mov word [esp], si
clc
mov eax, dword [eax + 0xc]
pushfd
call fcn.036e746b
setns dl
not dl
jmp 0x36e77ae

Function at 0x36e746b
Capabilities:
Access peb ldr_data

Disassembly:
test eax, eax
pushfd
pushal
lea esp, [esp + 0x30]
je 0x36e7602
rcl eax, 0x11
lahf
mov eax, dword fs:[0x30]
ror cl, cl
mov eax, dword [eax + 0xc]
jmp 0x36e4216

Function at 0x36e9143
Capabilities:
Access peb ldr_data

Disassembly:
lea edx, [ecx*8 + 0x312980c8]
and cl, al
add esp, 0x34
popal
lahf
push esi
cmp dh, 0xdc
sar ax, 0xf
mov eax, dword fs:[0x30]
bt bp, ax
mov eax, dword [eax + 0xc]
pushfd
pushfd
test eax, eax
pushfd
push 0xd8eec066
jmp 0x36e5659

Function at 0x36edba6
Capabilities:
Access peb ldr_data

Disassembly:
pushfd
mov dword [esp + 0x1c], 0x36e7296
jmp 0x36e9292
pushal
mov dword [esp + 0x20], 4
mov byte [esp], al
mov word [esp], si
push dword [ebp - 0x7c]
pop dword [esp + 0x1c]
jmp 0x36e7a0f
Function at 0x10018110
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007a340
mov eax, dword fs:[0]
push eax
sub esp, 0x200
mov eax, dword [0x10096748]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1009c438], 1
jne 0x10018178
movzx eax, byte [0x1009c43d]
test eax, eax
je 0x10018159
mov eax, 1
jmp 0x1001833a
movzx ecx, byte [0x1009c45d]
test ecx, ecx
je 0x1001816e
mov eax, 2
jmp 0x1001833a
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1001813b
movzx edx, byte [0x1009c43d]
test edx, edx
je 0x1001818d
mov eax, 1
jmp 0x1001833a
movzx eax, byte [0x1009c45d]
test eax, eax
je 0x100181a2
mov eax, 2
jmp 0x1001833a
cmp dword [0x1009c438], 2
jne 0x100181cc
movzx ecx, byte [0x1009c43c]
test ecx, ecx
je 0x100181c2
mov eax, 0x96
jmp 0x1001833a
mov eax, dword [0x1009c440]
jmp 0x1001833a
mov dword [0x1009c438], 1
lea ecx, [ebp - 0x70]
call fcn.1000b050
mov dword [ebp - 4], 0
lea edx, [ebp - 0x200]
push edx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
lea eax, [ebp - 0x28]
push eax
call fcn.100376d0
add esp, 4
mov byte [ebp - 4], 1
call fcn.10040940
call fcn.10035350
mov dword [0x1009c584], 0x10017ad0
call fcn.1001fa60
mov ecx, dword [ebp + 8]
push ecx
call fcn.10016f30
add esp, 4
call fcn.1000bdf0
call fcn.1000f030
mov dword [ebp - 0x204], 0
cmp dword [0x1009c440], 0
jne 0x1001826d
mov edx, dword [ebp - 0x204]
add edx, 1
mov dword [ebp - 0x204], edx
cmp dword [ebp - 0x204], 0x64
jle 0x10018263
jmp 0x1001826d
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10018240
mov dword [ebp - 0x204], 0
cmp dword [0x1009c4d4], 0
jne 0x100182a4
mov eax, dword [ebp - 0x204]
add eax, 1
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 0x32
jle 0x1001829a
jmp 0x100182a4
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10018277
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [0x1009c438], 2
movzx ecx, byte [0x1009c43c]
test ecx, ecx
je 0x100182f0
mov dword [ebp - 0x20c], 0x96
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.10005610
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.1000d220
mov eax, dword [ebp - 0x20c]
jmp 0x1001833a
mov edx, dword [0x1009c440]
mov dword [ebp - 0x208], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.10005610
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.1000d220
mov eax, dword [ebp - 0x208]
jmp 0x1001833a
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004910b
mov esp, ebp
pop ebp
ret
Function at 0x10026840
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0xc], 0
cmp dword [ebp + 8], 0
jne 0x1002685a
xor eax, eax
jmp 0x10026949
mov eax, dword [ebp + 8]
push eax
call fcn.1004a680
add esp, 4
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x14]
mov cl, byte [eax]
mov byte [ebp - 1], cl
add dword [ebp - 0x14], 1
cmp byte [ebp - 1], 0
jne 0x10026878
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0xc], 0
jmp 0x100268ab
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 0x20]
jge 0x10026914
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0xc]
movsx ecx, byte [eax]
cmp ecx, 0x5c
je 0x100268cf
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0xc]
movsx eax, byte [edx]
cmp eax, 0x2f
jne 0x10026912
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0xc]
mov byte [ecx], 0
push 0
mov edx, dword [ebp - 8]
push edx
call fcn.1004a6d0
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x10026909
mov eax, dword [ebp - 8]
push eax
call fcn.1004a730
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x10026909
or eax, 0xffffffff
jmp 0x10026949
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0xc]
mov byte [ecx], 0x2f
jmp 0x100268a2
push 0
mov edx, dword [ebp - 8]
push edx
call fcn.1004a6d0
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x1002693a
mov eax, dword [ebp - 8]
push eax
call fcn.1004a730
add esp, 4
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.1004911a
add esp, 4
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x10026950
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x1002696b
xor al, al
jmp 0x10026979
mov ecx, dword [ebp - 4]
and ecx, 0x10
je 0x10026977
mov al, 1
jmp 0x10026979
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x10028b80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007b308
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x10096748]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0x40], 0
je 0x10028bc0
mov ecx, dword [ebp - 0x30]
movzx edx, byte [ecx + 0x45]
test edx, edx
jne 0x10028bcc
mov al, 1
jmp 0x10028d6f
mov dword [ebp - 0x54], 8
call fcn.10003ef0
push eax
mov eax, dword [ebp - 0x30]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x30]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x40], eax
call fcn.10003ef0
mov dword [ebp - 0x44], eax
lea ecx, [ebp - 0x40]
push ecx
lea edx, [ebp - 0x44]
push edx
call fcn.10003ec0
add esp, 8
movzx eax, al
test eax, eax
je 0x10028c0f
xor al, al
jmp 0x10028d6f
push 0
push 8
lea ecx, [ebp - 0x28]
call fcn.10005ff0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x58]
push edx
lea ecx, [ebp - 0x28]
call fcn.10010cc0
mov ecx, eax
call fcn.100088e0
mov esi, eax
lea ecx, [ebp - 0x28]
call fcn.10005ab0
add esi, eax
push esi
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x28]
call fcn.10010cc0
mov ecx, eax
call fcn.100088e0
push eax
mov ecx, dword [ebp - 0x30]
add ecx, 0x48
push ecx
mov edx, dword [ebp - 0x30]
mov ecx, dword [edx + 0x40]
call fcn.10029110
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
je 0x10028c8a
cmp dword [ebp - 0x3c], 1
je 0x10028c91
cmp dword [ebp - 0x3c], 3
je 0x10028d2b
jmp 0x10028d43
mov eax, dword [ebp - 0x30]
mov byte [eax + 0x45], 0
lea ecx, [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x28]
call fcn.10010cc0
mov ecx, eax
call fcn.100088e0
mov edx, dword [ebp - 0x2c]
sub edx, eax
mov dword [ebp - 0x38], edx
je 0x10028cf4
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0x50]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 1
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x28]
call fcn.10010cc0
mov ecx, eax
call fcn.100088e0
push eax
call fcn.1004aa41
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x10028cf4
mov byte [ebp - 0x34], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10005610
mov al, byte [ebp - 0x34]
jmp 0x10028d6f
mov ecx, dword [ebp - 0x30]
movzx edx, byte [ecx + 0x45]
test edx, edx
jne 0x10028d17
mov byte [ebp - 0x31], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10005610
mov al, byte [ebp - 0x31]
jmp 0x10028d6f
cmp dword [ebp - 0x38], 0
jne 0x10028d29
push 0
push 8
lea ecx, [ebp - 0x28]
call fcn.10025060
jmp 0x10028d5b
mov byte [ebp - 0x33], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10005610
mov al, byte [ebp - 0x33]
jmp 0x10028d6f
mov byte [ebp - 0x32], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10005610
mov al, byte [ebp - 0x32]
jmp 0x10028d6f
jmp 0x10028c22
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004910b
mov esp, ebp
pop ebp
ret
Function at 0x1002a7c0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007b3f0
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x10096748]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0x20]
call fcn.10022390
mov byte [ebp - 0x25], 0
lea ecx, [ebp + 8]
call fcn.10005690
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x1002a8ac
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x2c]
cmp dword [ecx + edx*4], 0
je 0x1002a8aa
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ecx + edx*4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov edx, dword [eax]
mov dword [ebp - 0x24], edx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x20], ecx
mov edx, dword [eax + 8]
mov dword [ebp - 0x1c], edx
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x18], ecx
mov edx, dword [eax + 0x10]
mov dword [ebp - 0x14], edx
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x48]
call fcn.10005580
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
push ecx
mov ecx, dword [ebp + 0x20]
call fcn.10022270
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.10005610
mov byte [ebp - 0x25], 1
xor edx, edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0x2c], eax
jmp 0x1002a81e
jmp 0x1002a8b0
mov byte [ebp - 0x25], 0
mov cl, byte [ebp - 0x25]
mov byte [ebp - 0x26], cl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.10005610
mov al, byte [ebp - 0x26]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004910b
mov esp, ebp
pop ebp
ret
Function at 0x1002cf70
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007b6d3
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x10096748]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 8], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x10
call fcn.10005550
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
mov byte [ecx + 0x2c], 0
mov edx, dword [ebp - 0x10]
mov dword [edx], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 8], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0xc], 0xffffffff
lea eax, [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x10
call fcn.10006030
mov ecx, dword [ebp - 0x10]
mov dx, word [ebp + 0x20]
mov word [ecx + 0x28], dx
mov eax, dword [ebp - 0x10]
mov cx, word [ebp + 0x24]
mov word [eax + 0x2a], cx
mov edx, dword [ebp - 0x10]
mov byte [edx + 0x2c], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x30], 0x1f40
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x34], 0x1f40
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x38], 0xf
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x3c], 0xf
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x40], 0x1388
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x44], 0x12c
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x48], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.10005610
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x20