joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004edc0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x101e601b
push eax
mov eax, dword [0x1028070c]
mov dword fs:[0], esp
sub esp, 0xe14
push ebx
xor ebx, ebx
cmp eax, ebx
push edi
jne 0x1004effa
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x61e]
mov word [esp + 0x61c], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x416]
mov word [esp + 0x414], bx
rep stosd dword es:[edi], eax
push str.OAgent.ini
mov dword [0x1028070c], 1
mov dword [esp + 0xc], ebx
stosw word es:[edi], ax
call fcn.100226f0
push eax
lea eax, [esp + 0x41c]
push 0x10236e60
push eax
call dword [sym.imp.MSVCRT.dll_swprintf]
add esp, 0x10
lea ecx, [esp + 0x414]
lea edx, [esp + 0x61c]
push ecx
push 0x400
push edx
push 0x102747b8
push 0x101faf44
push str.AgentConfig
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp eax, ebx
jbe 0x1004eebb
cmp word [esp + 0xe1a], bx
jne 0x1004eebb
lea eax, [esp + 0x14]
push 0x400
lea ecx, [esp + 0x620]
push eax
push ecx
call fcn.1012cb70
add esp, 0xc
mov dword [esp + 8], eax
jmp 0x1004eebf
mov eax, dword [esp + 8]
cmp eax, ebx
jne 0x1004efc4
lea ecx, [esp + 0xc]
call fcn.1012a110
push 0x20019
push str.SOFTWAREClassesCLSIDAFFAEF68_CDC5_4aad_9D3F_997C0D55927BProgID
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x18]
mov dword [esp + 0xe30], ebx
call fcn.1012a280
test eax, eax
je 0x1004ef3b
lea edx, [esp + 8]
lea ecx, [esp + 0xc]
push edx
push 0x101faf4c
call fcn.1012a6a0
cmp eax, ebx
je 0x1004ef3b
mov ecx, dword [esp + 8]
cmp ecx, 0x400
jae 0x1004ef2e
mov edx, ecx
push esi
mov esi, eax
lea edi, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1004ef32
mov dword [esp + 8], ebx
push eax
call sub.MFC42u.DLL_operatordelete
add esp, 4
lea ecx, [esp + 0xc]
call fcn.1012a2d0
lea ecx, [esp + 0xc]
mov dword [esp + 0xe24], 0xffffffff
call fcn.1012a200
mov eax, dword [esp + 8]
cmp eax, ebx
jne 0x1004efc4
mov ecx, 0x200
xor eax, eax
lea edi, [esp + 0x61c]
push 0x400
rep stosd dword es:[edi], eax
lea eax, [esp + 0x620]
push eax
push 0x102747b8
push 0x101faf4c
push str.ED30_8AC4_11D5_8930_A730
call dword [sym.imp.KERNEL32.dll_GetProfileStringW]
test eax, eax
jbe 0x1004efbc
cmp word [esp + 0xe1a], bx
jne 0x1004efbc
lea ecx, [esp + 0x14]
push 0x400
lea edx, [esp + 0x620]
push ecx
push edx
call fcn.1012cb70
add esp, 0xc
jmp 0x1004efc0
mov eax, dword [esp + 8]
cmp eax, ebx
je 0x1004effa
cmp eax, 4
jbe 0x1004effa
lea ecx, [esp + 0x14]
test ecx, ecx
je 0x1004effa
cmp dword [esp + 0x14], 1
je 0x1004effa
mov edx, dword [esp + 0x30]
and edx, 0xffff
lea ecx, [edx + edx + 0x22]
cmp ecx, ebx
je 0x1004effa
add eax, 0xfffffffc
cmp ecx, eax
ja 0x1004effa
mov eax, dword [esp + 0x1c]
mov dword [0x10280708], eax
mov ecx, dword [esp + 0xe1c]
pop edi
pop ebx
mov dword fs:[0], ecx
add esp, 0xe20
ret
Function at 0x10051970
Capabilities:
Start service

Disassembly:
push ebx
call fcn.100e0760
test eax, eax
jne 0x1005197c
pop ebx
ret
mov ebx, dword [esp + 8]
test ebx, ebx
jne 0x10051992
mov dword [0x10280720], 0x57
xor eax, eax
pop ebx
ret
push ebp
push esi
push edi
xor esi, esi
push 0xf003f
push esi
push esi
xor ebp, ebp
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x100519cf
push 0x10
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x100519cf
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push eax
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov ebp, eax
test ebp, ebp
mov dword [0x10280720], 0
jne 0x10051a0d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x10282758]
mov dword [0x10280720], eax
test ecx, ecx
je 0x10051a0d
push eax
push eax
push str.CTSDEncryptDrv:_StartService___failed__error_ld_0x_08x__n
push str.TSDEncryptDrv
push 4
push 0x10281ec4
call fcn.100de220
add esp, 0x18
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test esi, esi
je 0x10051a1a
push esi
call ebx
test edi, edi
je 0x10051a21
push edi
call ebx
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
ret
Function at 0x1005a310
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
xor eax, eax
test edi, edi
setl al
mov ebp, dword [esp + 0x14]
dec eax
and al, 0xfe
add eax, 2
push eax
push 0
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, eax
xor esi, esi
cmp ebx, 0xffffffff
je 0x1005a356
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push esi
push ecx
push edx
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
mov eax, dword [0x10282758]
test eax, eax
je 0x1005a37b
push esi
push ebx
push edi
push str.CSDGsDesTransformRequest::ReadData_lDistanceToMove__ld___dwFilePointer__ld___ret__lu_
push str.SDTransform
push 0xffffffffffffffff
push 0x10281ec4
call fcn.100de220
add esp, 0x1c
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x1005a390
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x101e6d04
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.10065620
xor edi, edi
lea ebx, [esi + 0x288]
push edi
mov ecx, ebx
mov dword [esp + 0x1c], edi
call sub.MFC42u.DLL_CSyncObject::CSyncObject
mov dword [ebx], 0x101f9dd8
add ebx, 8
push ebx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea ecx, [esi + 0x2ac]
mov byte [esp + 0x18], 1
call fcn.10070f36
push edi
push edi
push edi
push edi
push edi
push edi
lea ecx, [esi + 0x2d4]
mov byte [esp + 0x30], 2
mov dword [esi + 0x2cc], 0x101fb238
call fcn.10047740
push 0xffffffffffffffff
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
lea ecx, [esi + 0x2ec]
call fcn.10047440
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x330], 0x101fb224
mov dword [esi + 0x334], edi
mov dword [esi + 0x338], 0x11
mov dword [esi + 0x33c], edi
mov dword [esi + 0x340], edi
mov dword [esi + 0x344], edi
mov dword [esi + 0x348], 0xa
mov word [esi + 0x2a8], di
mov dword [esi + 0x32c], edi
mov dword [esi + 0x2c8], edi
mov dword [esi + 0x2c0], edi
mov dword [esi], 0x101fb20c
mov dword [esi + 0x2c4], 0xffffffff
mov dword [esi + 0x2d0], esi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x1005b0b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101e6e38
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
mov ebx, ecx
push ebp
push edi
lea eax, [ebx + 0x50]
push 1
push eax
lea ecx, [esp + 0x14]
call sub.MFC42u.DLL_CSingleLock::CSingleLock
lea ecx, [esp + 0x2c]
mov dword [esp + 0x48], 0
call sub.MFC42u.DLL_CPtrArray::CPtrArray
lea ecx, [esp + 0x18]
mov byte [esp + 0x48], 1
call sub.MFC42u.DLL_CPtrArray::CPtrArray
mov byte [esp + 0x48], 2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [ebx + 0x38]
mov ebp, eax
test edi, edi
je 0x1005b1a5
push esi
mov eax, edi
mov edi, dword [edi]
mov esi, dword [eax + 8]
test esi, esi
je 0x1005b19c
mov ecx, esi
call fcn.1006ca90
test eax, eax
je 0x1005b19c
mov eax, dword [esi + 0xf4]
test eax, eax
jne 0x1005b19c
mov eax, dword [esi + 0xf8]
test eax, eax
jne 0x1005b19c
mov eax, dword [esi + 0x100]
cmp eax, ebp
ja 0x1005b154
mov ecx, ebp
sub ecx, eax
cmp ecx, 0xea60
jbe 0x1005b19c
mov edx, dword [esp + 0x38]
push esi
push edx
lea ecx, [esp + 0x38]
call sub.MFC42u.DLL_CPtrArray::SetAtGrow
mov eax, dword [esp + 0x24]
push 0
push eax
lea ecx, [esp + 0x24]
call sub.MFC42u.DLL_CPtrArray::SetAtGrow
mov eax, dword [0x10282758]
test eax, eax
je 0x1005b19c
mov esi, dword [esi + 0xec]
push esi
push str.CSDTcpClient::CleanupIdleConnect_dwConnectID_0x_x_
push str.SDTransform
push 0xffffffffffffffff
push 0x10281ec4
call fcn.100de220
add esp, 0x14
test edi, edi
jne 0x1005b114
pop esi
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x30]
push ecx
push edx
mov ecx, ebx
call fcn.10068360
lea ecx, [esp + 0x18]
mov byte [esp + 0x48], 1
call fcn.1007101a
lea ecx, [esp + 0x2c]
mov byte [esp + 0x48], 0
call fcn.1007101a
lea ecx, [esp + 0xc]
mov dword [esp + 0x48], 0xffffffff
call sub.MFC42u.DLL_CSingleLock::Unlock
mov ecx, dword [esp + 0x40]
pop edi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x40
ret
Function at 0x1005c140
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101e70f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
lea ecx, [esp + 0x10]
call fcn.10077860
lea eax, [esp + 0x10]
xor ebx, ebx
push eax
mov dword [esp + 0x20], ebx
call fcn.1005b950
add esp, 4
call fcn.10022c90
push eax
lea ecx, [esp + 0x10]
call fcn.10077a80
mov esi, dword [esp + 0x24]
push str.SDTransformReader.dll
mov byte [esp + 0x20], 1
lea edi, [esi + 8]
mov dword [esi + 4], 0x2d
mov ecx, edi
call fcn.100785e0
mov ecx, dword [esp + 0xc]
push str.SDTransformReader.dll
push ecx
lea edx, [esi + 0xc]
push 0x10236e60
push edx
call fcn.1007b320
add esp, 0x10
lea eax, [esp + 0xc]
lea ecx, [esi + 0x10]
push eax
call fcn.100784b0
push str.baksdtransReader.sys
lea ecx, [esi + 0x14]
call fcn.100785e0
push str.WinSta0Default
lea ecx, [esi + 0x1c]
call fcn.100785e0
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], 1
mov dword [esi + 0x2c], 3
call fcn.1005c070
mov ecx, dword [edi]
mov edx, dword [esp + 0x10]
neg eax
sbb eax, eax
push ecx
neg eax
add eax, 3
push edx
mov dword [esi + 0x30], eax
lea eax, [esi + 0x44]
push str._s__s_RunSDTransformReader
push eax
mov dword [esi + 0x34], ebx
call fcn.1007b320
or edi, 0xffffffff
add esp, 0x10
lea ecx, [esp + 0xc]
mov dword [esi + 0x38], edi
mov dword [esi + 0x48], ebx
mov byte [esp + 0x1c], bl
call fcn.10078300
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], edi
call fcn.10078300
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x1005c560
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x101e71b7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea ebp, [esi + 0xc]
mov ecx, ebp
call fcn.10071e70
xor edi, edi
lea ecx, [esi + 0x18]
push edi
push edi
push edi
mov dword [esp + 0x28], edi
call fcn.10070f96
mov dword [esi + 0x20], 0x101fb4b4
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], 0x11
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], 0xa
push edi
push edi
lea ecx, [esi + 0x3c]
mov byte [esp + 0x24], 2
call fcn.10062240
push edi
push edi
push edi
push edi
push edi
push edi
lea ecx, [esi + 0x54]
mov byte [esp + 0x34], 3
mov dword [esi + 0x4c], 0x101fb4a4
call fcn.10047740
push 0xffffffffffffffff
push 0xffffffffffffffff
push edi
lea ebx, [esi + 0x6c]
push edi
push edi
push edi
mov ecx, ebx
call fcn.10047440
mov dword [ebx + 0x40], edi
mov dword [ebx + 0x44], edi
mov dword [ebx + 0x48], edi
push 0x102750fc
mov ecx, ebp
mov byte [esp + 0x20], 4
mov dword [esi], 0x101fb490
mov dword [esi + 4], edi
mov dword [esi + 8], edi
call fcn.10072be0
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x48], esi
mov dword [esi + 0x50], esi
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x10065f20
Capabilities:
Initialize winsock library

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x101e7a0b
push eax
mov dword fs:[0], esp
sub esp, 0x194
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x278]
test eax, eax
jne 0x100660b6
lea eax, [esp + 0xc]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov edi, eax
test edi, edi
je 0x10065fde
lea ecx, [esp + 8]
call sub.MFC42u.DLL_CString::CString_2
push edi
lea ecx, [esp + 0xc]
push str.CControlThread:_WSAStartup
push ecx
mov dword [esp + 0x1b0], 0
call sub.MFC42u.DLL_CString::Format
mov eax, dword [0x10282758]
add esp, 0xc
test eax, eax
je 0x10065fb1
mov edx, dword [esp + 8]
push edx
push str._IOCP___s
push 0x1025debc
push 0xffffffffffffffff
push 0x10281ec4
call fcn.100de220
add esp, 0x14
lea ecx, [esp + 8]
mov dword [esp + 0x1a4], 0xffffffff
call sub.MFC42u.DLL_CString::CString
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x194]
mov dword fs:[0], ecx
add esp, 0x1a0
ret
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, esi
mov dword [esi + 0x2c], eax
call fcn.100661a0
test eax, eax
mov eax, dword [0x10282758]
jne 0x1006600a
test eax, eax
je 0x1006606c
push 0x1025dea4
jmp 0x10066053
test eax, eax
je 0x1006602c
push 0x1025de8c
push str._IOCP___s
push 0x1025debc
push 0xffffffffffffffff
push 0x10281ec4
call fcn.100de220
add esp, 0x14
mov eax, dword [esi + 0x20]
test eax, eax
je 0x100660ac
mov ecx, esi
call fcn.10066550
test eax, eax
jne 0x10066085
mov ecx, esi
call fcn.10066be0
mov eax, dword [0x10282758]
test eax, eax
je 0x1006606c
push 0x1025de60
push str._IOCP___s
push 0x1025debc
push 0xffffffffffffffff
push 0x10281ec4
call fcn.100de220
add esp, 0x14
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x194]
mov dword fs:[0], ecx
add esp, 0x1a0
ret
mov eax, dword [0x10282758]
test eax, eax
je 0x100660ac
push 0x1025de34
push str._IOCP___s
push 0x1025debc
push 0xffffffffffffffff
push 0x10281ec4
call fcn.100de220
add esp, 0x14
mov dword [esi + 0x278], 1
mov ecx, dword [esp + 0x19c]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x1a0
ret

Function at 0x10066180
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x14]
add esp, 0x24
ret
Function at 0x10067ec0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101e7c68
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
mov ebx, ecx
push ebp
push esi
push edi
lea eax, [ebx + 0x238]
push 1
push eax
lea ecx, [esp + 0x1c]
call sub.MFC42u.DLL_CSingleLock::CSingleLock
mov eax, dword [ebx + 0x274]
mov dword [esp + 0x28], 0
inc eax
mov dword [ebx + 0x274], eax
jne 0x10067f11
mov dword [ebx + 0x274], 1
mov edi, dword [ebx + 0x274]
mov ecx, dword [ebx + 0x260]
lea esi, [ebx + 0x258]
mov eax, edi
shr eax, 4
xor edx, edx
mov dword [esp + 0x10], ecx
div ecx
mov ecx, dword [esi + 4]
test ecx, ecx
mov ebp, edx
je 0x10067f55
mov eax, dword [ecx + ebp*4]
test eax, eax
je 0x10067f51
cmp dword [eax + 8], edi
je 0x10067f4d
mov eax, dword [eax]
test eax, eax
jne 0x10067f40
jmp 0x10067f51
test eax, eax
jne 0x10067faa
test ecx, ecx
jne 0x10067f89
mov ecx, dword [esp + 0x10]
lea edi, [ecx*4]
push edi
call sub.MFC42u.DLL_operatornew
mov edx, eax
mov ecx, edi
mov dword [esi + 4], edx
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
add esp, 4
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x10]
mov dword [esi + 8], eax
mov ecx, esi
call fcn.10068900
mov dword [eax + 4], ebp
mov ecx, dword [ebx + 0x274]
mov dword [eax + 8], ecx
mov edx, dword [esi + 4]
mov ecx, dword [edx + ebp*4]
mov dword [eax], ecx
mov edx, dword [esi + 4]
mov dword [edx + ebp*4], eax
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x28], 0xffffffff
mov dword [eax + 0xc], ecx
mov ebx, dword [ebx + 0x274]
lea ecx, [esp + 0x14]
call sub.MFC42u.DLL_CSingleLock::Unlock
mov ecx, dword [esp + 0x20]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 4
Function at 0x10068a30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101e7d86
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
mov dword [esi], 0x101fb548
lea ebp, [esi + 0x50]
push 1
push ebp
lea ecx, [esp + 0x20]
mov dword [esp + 0x34], 1
call sub.MFC42u.DLL_CSingleLock::CSingleLock
mov ecx, dword [esi + 0x74]
add esi, 0x70
xor edi, edi
mov byte [esp + 0x2c], 2
cmp ecx, edi
je 0x10068a9d
mov eax, dword [esi + 8]
cmp eax, edi
jbe 0x10068a9d
mov edx, ecx
mov ebx, eax
mov eax, dword [edx]
cmp eax, edi
je 0x10068a97
mov eax, dword [eax]
cmp eax, edi
jne 0x10068a91
add edx, 4
dec ebx
jne 0x10068a8b
push ecx
call sub.MFC42u.DLL_operatordelete
mov ecx, dword [esi + 0x14]
add esp, 4
mov dword [esi + 4], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
call sub.MFC42u.DLL_CPlex::FreeDataChain
lea ecx, [esp + 0x18]
mov dword [esi + 0x14], edi
mov byte [esp + 0x2c], 1
call sub.MFC42u.DLL_CSingleLock::Unlock
mov dword [esp + 0x14], esi
mov dword [esi], 0x101fb54c
mov edx, dword [esi + 4]
mov byte [esp + 0x2c], 3
cmp edx, edi
je 0x10068afb
mov eax, dword [esi + 8]
cmp eax, edi
jbe 0x10068afb
mov ecx, edx
mov ebx, eax
mov eax, dword [ecx]
cmp eax, edi
je 0x10068af5
mov eax, dword [eax]
cmp eax, edi
jne 0x10068aef
add ecx, 4
dec ebx
jne 0x10068ae9
push edx
call sub.MFC42u.DLL_operatordelete
mov ecx, dword [esi + 0x14]
add esp, 4
mov dword [esi + 4], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
call sub.MFC42u.DLL_CPlex::FreeDataChain
lea eax, [ebp + 8]
mov dword [esi + 0x14], edi
mov dword [esi], 0x101f9bdc
push eax
mov dword [esp + 0x30], 0xffffffff
mov dword [ebp], 0x101f9dd8
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov ecx, ebp
call fcn.10070f78
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x1006a8c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101e7f68
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
push 1
lea eax, [esi + 0x50]
lea ecx, [esp + 0x14]
push eax
call sub.MFC42u.DLL_CSingleLock::CSingleLock
mov edi, dword [esp + 0x2c]
mov ebx, dword [esi + 0x78]
add esi, 0x70
mov eax, edi
shr eax, 4
xor edx, edx
mov ecx, dword [esi + 4]
div ebx
test ecx, ecx
mov dword [esp + 0x24], 0
mov ebp, edx
je 0x1006a92d
mov eax, dword [ecx + ebp*4]
test eax, eax
je 0x1006a929
cmp dword [eax + 8], edi
je 0x1006a925
mov eax, dword [eax]
test eax, eax
jne 0x1006a918
jmp 0x1006a929
test eax, eax
jne 0x1006a978
test ecx, ecx
jne 0x1006a95d
lea edi, [ebx*4]
push edi
call sub.MFC42u.DLL_operatornew
mov edx, eax
mov ecx, edi
mov dword [esi + 4], edx
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
add esp, 4
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [esp + 0x2c]
mov dword [esi + 8], ebx
mov ecx, esi
call fcn.1006b040
mov dword [eax + 4], ebp
mov dword [eax + 8], edi
mov ecx, dword [esi + 4]
mov edx, dword [ecx + ebp*4]
mov dword [eax], edx
mov ecx, dword [esi + 4]
mov dword [ecx + ebp*4], eax
add eax, 0xc
lea ecx, [esp + 0x10]
mov edx, eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x24], 0xffffffff
mov dword [edx], edi
mov dword [edx + 4], eax
mov eax, dword [esp + 0x34]
mov dword [edx + 8], eax
call sub.MFC42u.DLL_CSingleLock::Unlock
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 0xc
Function at 0x1006a9e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x101e7f90
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x10]
call sub.MFC42u.DLL_CString::CString_2
mov ebx, dword [esp + 0x44]
mov ebp, dword [esp + 0x40]
mov edi, dword [esp + 0x3c]
mov eax, dword [esi + 0x90]
mov ecx, dword [esi + 0x8c]
push ebx
push ebp
push edi
push eax
push ecx
lea edx, [esp + 0x24]
push str.CDispatch::Dispose_m_bServer__lu__m_pfnIOCPSvrCallback_0x_x__dwID__lu__lpHeader_0x_x__lpBuf_0x_x__r_n
push edx
mov dword [esp + 0x50], 0
call sub.MFC42u.DLL_CString::Format
mov eax, dword [0x10282758]
add esp, 0x1c
test eax, eax
je 0x1006aa65
mov eax, dword [esp + 0x10]
push eax
push str._IOCP___s
push str.IOCPCallback
push 0xffffffffffffffff
push 0x10281ec4
call fcn.100de220
add esp, 0x14
mov eax, dword [esi + 0x8c]
test eax, eax
je 0x1006aa98
mov eax, dword [esi + 0x90]
test eax, eax
je 0x1006aa89
mov ecx, dword [esi + 0x94]
push 0
push ecx
push ebx
push ebp
push edi
call eax
jmp 0x1006aaea
test ebp, ebp
je 0x1006aaea
push ebp
call sub.MFC42u.DLL_operatordelete
add esp, 4
jmp 0x1006aaea
lea edx, [esi + 0x50]
push 1
push edx
lea ecx, [esp + 0x1c]
call sub.MFC42u.DLL_CSingleLock::CSingleLock
mov eax, edi
xor edx, edx
shr eax, 4
div dword [esi + 0x78]
mov esi, dword [esi + 0x74]
mov byte [esp + 0x34], 1
test esi, esi
je 0x1006aacf
mov eax, dword [esi + edx*4]
test eax, eax
je 0x1006aacf
cmp dword [eax + 8], edi
je 0x1006ab10
mov eax, dword [eax]
test eax, eax
jne 0x1006aac4
test ebp, ebp
je 0x1006aadc
push ebp
call sub.MFC42u.DLL_operatordelete
add esp, 4
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 0
call sub.MFC42u.DLL_CSingleLock::Unlock
lea ecx, [esp + 0x10]
mov dword [esp + 0x34], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 0xc
test eax, eax
je 0x1006aacf
add eax, 0xc
mov ecx, eax
mov edx, dword [ecx]
mov dword [esp + 0x20], edx
mov eax, dword [ecx + 4]
test eax, eax
mov ecx, dword [ecx + 8]
je 0x1006ab30
push edi
push ebx
push ebp
call eax
jmp 0x1006aadc
test ebp, ebp
je 0x1006aadc
jmp 0x1006aad3
Function at 0x1006c230
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101e810d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor edi, edi
lea ebp, [esi + 0x7c]
push edi
mov ecx, ebp
mov dword [esp + 0x14], esi
call sub.MFC42u.DLL_CSyncObject::CSyncObject
lea eax, [ebp + 8]
mov dword [ebp], 0x101f9dd8
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esp + 0x28], edi
mov dword [esi + 0x9c], 0x101fb5a8
mov dword [esi + 0xa0], edi
mov dword [esi + 0xac], edi
mov dword [esi + 0xa8], edi
mov dword [esi + 0xa4], edi
lea ebx, [esi + 0xb0]
push edi
mov ecx, ebx
mov byte [esp + 0x2c], 1
call sub.MFC42u.DLL_CSyncObject::CSyncObject
mov dword [ebx], 0x101f9dd8
add ebx, 8
push ebx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esi + 0xd0], 0x101fb594
mov dword [esi + 0xd4], edi
mov dword [esi + 0xd8], 0x11
mov dword [esi + 0xdc], edi
mov dword [esi + 0xe0], edi
mov dword [esi + 0xe4], edi
mov dword [esi + 0xe8], 0xa
mov ebx, 3
push 1
push ebp
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], bl
mov dword [esi], 0x101fb588
call sub.MFC42u.DLL_CSingleLock::CSingleLock
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x40]
mov edx, dword [esp + 0x34]
mov dword [esi + 0x18], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esi + 0x50], eax
mov dword [esi + 0x4c], ecx
mov dword [esi + 0x58], ecx
mov dword [esi + 0x54], eax
mov dword [esi + 0x5c], eax
mov dword [esi + 0x60], eax
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x30]
or ebp, 0xffffffff
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], edi
push ecx
mov byte [esp + 0x2c], 4
mov dword [esi + 0x14], ebp
mov dword [esi + 0x1c], edx
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x28], eax
call fcn.1019c4a0
mov edx, dword [eax]
add esp, 4
mov eax, edx
mov dword [esi + 0x40], edx
mov dword [esi + 0x44], eax
mov ecx, dword [esi + 0x40]
lea eax, [esi + 0x6c]
mov dword [esi + 0x48], ecx
xor edx, edx
mov dword [esi + 0x64], ebx
mov dword [esi + 8], edi
mov dword [esi + 0x68], edi
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
mov dword [esi + 0xec], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0xf4], edi
mov dword [esi + 0xf8], edi
mov dword [esi + 0xfc], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [esp + 0x14]
mov dword [esi + 0x100], eax
mov dword [esi + 0x104], edi
mov word [esi + 0x108], di
mov dword [esi + 0x10c], edi
mov dword [esi + 0x110], edi
mov dword [esi + 0x114], ebp
mov dword [esi + 0x118], ebp
mov dword [esi + 0xf0], edi
mov byte [esp + 0x28], bl
call sub.MFC42u.DLL_CSingleLock::Unlock
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x14