joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10036fb0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1008e628
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, ecx
push ebx
push ebp
mov ebp, dword [esp + 0x2c]
push esi
lea esi, [eax + 0x3c]
xor ebx, ebx
mov ecx, dword [ebp]
mov bx, word [esi]
add ebx, 8
cmp ebx, ecx
jbe 0x10037042
lea eax, [esp + 0x30]
lea ecx, [esp + 0xc]
push eax
push str.F:SCVICELIBIceProviderIceSendData.cpp
mov dword [esp + 0x38], 0x1d6
call fcn.10038570
mov ecx, dword [ebp]
mov dword [esp + 0x24], 0
push ecx
push ebx
push 0x100a7e24
push 1
push eax
call fcn.100386d0
add esp, 0x14
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call fcn.100385c0
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 8
mov ecx, ebx
push edi
mov edi, dword [esp + 0x30]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x20]
pop edi
mov dword [ebp], ebx
pop esi
mov dword [eax + 0x70], 0
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 8
Function at 0x10037120
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1008e648
push eax
mov eax, ecx
mov dword fs:[0], esp
mov ecx, dword [esp + 0x14]
mov edx, 0x1000
sub esp, 0x14
mov ecx, dword [ecx]
cmp ecx, edx
ja 0x1003714b
mov edx, ecx
push esi
lea esi, [eax + 0x3c]
push edi
mov di, word [esi + 2]
cmp di, 0x83
jne 0x10037162
mov ecx, 0x1c
jmp 0x1003717b
test di, di
jne 0x1003716e
mov ecx, 0x10
jmp 0x1003717b
xor ecx, ecx
cmp di, 0x10
setne cl
dec ecx
and ecx, 8
cmp edx, ecx
ja 0x100371d8
lea edx, [esp + 0x30]
lea ecx, [esp + 0xc]
push edx
push str.F:SCVICELIBIceProviderIceSendData.cpp
mov dword [esp + 0x38], 0x227
call fcn.10038570
push 0x100a7e3c
push 1
push eax
mov dword [esp + 0x30], 0
call fcn.100386d0
add esp, 0xc
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call fcn.100385c0
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 8
push ebx
mov ebx, dword [eax + 0x78]
push ebp
mov ebp, dword [eax + 0x74]
sub edx, ecx
mov edi, edx
mov edx, ebp
sub edx, ebx
and edi, 0xffff
cmp edi, edx
jae 0x100371f4
mov edx, edi
mov di, word [esi + 2]
and edx, 0xffff
cmp di, 0x83
lea ebx, [edx + ecx]
mov dword [esp + 0x10], ebx
jne 0x1003720f
mov dword [esi + 0x14], ebp
test di, di
jne 0x10037217
mov dword [esi + 8], ebp
add ebx, 0xfffffff8
mov ebp, ecx
mov word [esi], bx
mov ebx, dword [esp + 0x34]
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [eax + 0x6c]
mov ebp, dword [eax + 0x78]
mov cx, word [ebx + 2]
add esi, ebp
cmp cx, 0x83
jne 0x10037249
add ebx, 0x1c
jmp 0x10037260
test cx, cx
jne 0x10037253
add ebx, 0x10
jmp 0x10037260
cmp cx, 0x10
jne 0x1003725e
add ebx, 8
jmp 0x10037260
xor ebx, ebx
mov ecx, edx
mov edi, ebx
mov ebx, ecx
pop ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
pop ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [eax + 0x78]
add esi, edx
mov edx, dword [eax + 0x74]
mov ecx, esi
mov dword [eax + 0x78], esi
cmp edx, ecx
jne 0x1003728c
mov dword [eax + 0x70], 0
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 8]
pop edi
pop esi
mov dword [ecx], eax
mov ecx, dword [esp + 0x14]
mov eax, 1
mov dword fs:[0], ecx
add esp, 0x20
ret 8
Function at 0x10037500
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
test eax, eax
je 0x10037512
pop edi
xor eax, eax
pop esi
ret 8
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
push 0
push 0
call edi
test eax, eax
mov dword [esi + 0x10], eax
jne 0x10037539
mov eax, dword [esi]
push 0xffffffffffffffff
mov ecx, esi
call dword [eax + 4]
pop edi
xor eax, eax
pop esi
ret 8
push 0
push 0
push 1
push 0
call edi
test eax, eax
mov dword [esi + 0x14], eax
jne 0x1003755a
mov edx, dword [esi]
push 0xffffffffffffffff
mov ecx, esi
call dword [edx + 4]
pop edi
xor eax, eax
pop esi
ret 8
mov ecx, dword [esp + 0xc]
lea eax, [esi + 8]
push eax
push 0
push esi
push 0x10037650
push 0
push ecx
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 4], eax
test eax, eax
jne 0x1003758d
mov edx, dword [esi]
push 0xffffffffffffffff
mov ecx, esi
call dword [edx + 4]
pop edi
xor eax, eax
pop esi
ret 8
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 0x10]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, dword [esi + 0xc]
test edi, edi
je 0x100375ba
mov edx, dword [esi]
push 0xffffffffffffffff
mov ecx, esi
call dword [edx + 4]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
ret 8
pop edi
mov eax, 1
pop esi
ret 8

Function at 0x100375d0
Capabilities:
Terminate thread

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
xor ebp, ebp
push edi
cmp dword [esi + 4], ebp
je 0x10037611
mov eax, dword [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov edi, dword [esp + 0x14]
mov ecx, dword [esi + 4]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
push ecx
call ebx
cmp eax, 0x102
jne 0x10037611
mov edx, dword [esi + 4]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi + 4]
push edi
push eax
call ebx
mov eax, dword [esi + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, ebp
je 0x10037621
push eax
call edi
mov eax, dword [esi + 0x10]
cmp eax, ebp
je 0x1003762b
push eax
call edi
mov eax, dword [esi + 4]
cmp eax, ebp
je 0x10037635
push eax
call edi
mov dword [esi + 4], ebp
mov dword [esi + 8], ebp
mov dword [esi + 0xc], ebp
mov dword [esi + 0x10], ebp
mov dword [esi + 0x14], ebp
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x1003a610
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x104
push esi
push edi
mov esi, ecx
call dword [sym.imp.MSVCRT.dll__getpid]
push eax
push esi
lea eax, [esp + 0x10]
push str.NabeLogPathStringMutex__08X__08X
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea ecx, [esp + 8]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, eax
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 4]
test eax, eax
jne 0x1003a677
mov edx, dword [esp + 0x110]
push 0x104
lea eax, [esi + 8]
push edx
push eax
call dword [sym.imp.MSVCRT.dll__mbsnbcpy]
add esp, 0xc
mov dword [esi + 4], 1
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
add esp, 0x104
ret 4

Function at 0x1003b900
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x84
push ebx
mov ebx, dword [esp + 0x8c]
push esi
mov esi, dword [esp + 0x94]
test esi, esi
push edi
je 0x1003b9a6
mov ecx, 0x1f
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
push ecx
push ebx
mov dword [esp + 0x18], 0x80
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x1003b962
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
pop edi
pop esi
pop ebx
add esp, 0x84
ret
cmp word [esp + 0x10], 2
jne 0x1003b983
mov edx, dword [esp + 0x14]
mov ecx, esi
push edx
call fcn.1003a950
mov eax, dword [esp + 0xa0]
test eax, eax
je 0x1003b9a6
jmp 0x1003b99a
lea edx, [esp + 0x18]
mov ecx, esi
push edx
call fcn.1003a8d0
mov eax, dword [esp + 0xa0]
test eax, eax
je 0x1003b9a6
mov ecx, dword [esp + 0x12]
and ecx, 0xffff
mov dword [eax], ecx
mov esi, dword [esp + 0x9c]
test esi, esi
je 0x1003ba52
mov ecx, 0x1f
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0xc]
lea eax, [esp + 0x10]
push edx
push eax
push ebx
mov dword [esp + 0x18], 0x80
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x1003b9f8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
pop edi
pop esi
pop ebx
add esp, 0x84
ret
cmp word [esp + 0x10], 2
jne 0x1003ba2f
mov ecx, dword [esp + 0x14]
push ecx
mov ecx, esi
call fcn.1003a950
mov eax, dword [esp + 0xa4]
test eax, eax
je 0x1003ba52
mov edx, dword [esp + 0x12]
pop edi
and edx, 0xffff
pop esi
mov dword [eax], edx
xor eax, eax
pop ebx
add esp, 0x84
ret
lea eax, [esp + 0x18]
mov ecx, esi
push eax
call fcn.1003a8d0
mov eax, dword [esp + 0xa4]
test eax, eax
je 0x1003ba52
mov ecx, dword [esp + 0x12]
and ecx, 0xffff
mov dword [eax], ecx
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x84
ret
Function at 0x1003c5b0
Capabilities:
Create thread
Resume thread

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1008e8b8
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
mov eax, dword [esi + 0x14]
test eax, eax
je 0x1003c5f4
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_ResetEvent]
push eax
mov dword [esi + 0x14], 0
call edi
mov ecx, dword [esi + 0x28]
push ecx
call edi
pop edi
push 1
push 0x100ac2e0
lea ecx, [esp + 0xc]
call fcn.10041780
mov dword [esp + 0x14], 0
call fcn.1003c320
call fcn.1003c2e0
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.100417a0
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
lea edx, [esi + 0x18]
push edx
push 4
push esi
push 0x1003cb10
push eax
push ecx
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 0x14], eax
test eax, eax
je 0x1003c677
mov edx, dword [esi + 0x20]
mov ecx, esi
push edx
call fcn.1003c780
mov al, byte [esi + 0x24]
mov ecx, esi
push eax
call fcn.1003c7a0
mov ecx, dword [esi + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, dword [esi + 0x28]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x1003cc30
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008e961
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x10], esp
push esi
call fcn.10067490
add esp, 4
mov edi, eax
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x2c]
push eax
push str.F:SCVLibScvLIBLangBaseThread.cpp
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0x2ed
call fcn.10038570
push edi
push 0x100a8754
push 1
push eax
mov byte [ebp - 4], 1
call fcn.100386d0
add esp, 0x10
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.100385c0
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0x2ee
push ecx
push str.F:SCVLibScvLIBLangBaseThread.cpp
lea ecx, [ebp - 0x2c]
call fcn.10038570
push str.______
push 1
push eax
mov byte [ebp - 4], 2
call fcn.100386d0
add esp, 0xc
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.100385c0
push esi
call fcn.10066cd0
mov esi, eax
add esp, 4
test esi, esi
setne bl
mov byte [ebp - 0x24], bl
mov dword [ebp - 0x20], esi
push 1
mov ecx, esi
mov byte [ebp - 4], 3
call fcn.10067290
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x3c]
push edx
push str.F:SCVLibScvLIBLangBaseThread.cpp
mov dword [ebp - 0x18], 0x2f1
call fcn.10038570
push str._________
push 1
push eax
mov byte [ebp - 4], 4
call fcn.100386d0
add esp, 0xc
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 3
call fcn.100385c0
test bl, bl
mov byte [ebp - 4], 0
je 0x1003cddf
test esi, esi
je 0x1003cddf
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
jmp 0x1003cddf
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
or ebx, 0xffffffff
push eax
push ecx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov esi, eax
test esi, esi
je 0x1003ce31
lea edx, [ebp + 8]
lea ecx, [ebp - 0x3c]
push edx
push str.F:SCVLibScvLIBLangBaseThread.cpp
mov dword [ebp + 8], 0x2f8
call fcn.10038570
push edi
push 0x100a86cc
push 1
push eax
mov dword [ebp - 4], 8
call fcn.100386d0
add esp, 0x10
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x3c]
jmp 0x1003ce73
lea eax, [ebp + 0xc]
lea ecx, [ebp - 0x4c]
push eax
push str.F:SCVLibScvLIBLangBaseThread.cpp
mov dword [ebp + 0xc], 0x2fa
call fcn.10038570
mov edi, eax
mov dword [ebp - 4], 9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x14]
push eax
push ecx
push 0x100a8698
push 1
push edi
call fcn.100386d0
add esp, 0x14
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x4c]
call fcn.100385c0
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003d980
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x1008e978
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
xor ebx, ebx
push edi
push ebx
mov esi, ecx
push ebx
push ebx
mov dword [esp + 0x24], esi
call fcn.1003c450
mov al, byte [esp + 0x2c]
mov cl, byte [esp + 0x2c]
lea edi, [esi + 0x2c]
push 0x18
mov dword [esp + 0x28], ebx
mov byte [edi], al
mov byte [edi + 1], cl
mov byte [edi + 8], bl
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebp, eax
add esp, 4
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], ebp
mov dword [ebp + 4], ebx
mov dword [ebp + 0x14], 1
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::_Lockit::constructor_void_]
cmp dword [0x100ac30c], ebx
jne 0x1003da05
mov dword [0x100ac30c], ebp
mov dword [ebp], ebx
mov edx, dword [0x100ac30c]
mov dword [esp + 0x10], ebx
mov dword [edx + 8], ebx
mov edx, dword [0x100ac308]
lea ecx, [esp + 0x14]
inc edx
mov dword [0x100ac308], edx
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::_Lockit::destructor_void_]
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x1003da2d
push eax
call fcn.10088e50
add esp, 4
mov eax, dword [0x100ac30c]
push ebx
push eax
mov ecx, edi
call fcn.100164e0
mov cl, byte [esp + 0x2c]
mov dword [edi + 4], eax
mov dword [edi + 0xc], ebx
mov dword [eax], eax
mov edi, dword [edi + 4]
mov dword [edi + 8], edi
mov byte [esi + 0x3c], cl
lea ecx, [esi + 0x4c]
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
call fcn.10041720
mov dl, byte [esp + 0x2c]
lea edi, [esi + 0x6c]
push edi
mov byte [edi + 0x18], dl
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x20], ebx
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ebx
mov dword [edi + 0x2c], ebx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x34], ebx
mov dword [edi + 0x38], ebx
mov dword [edi + 0x3c], ebx
mov dword [edi + 0x40], ebx
mov dword [edi + 0x44], ebx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ebp, dword [sym.imp.KERNEL32.dll_CreateEventA]
push ebx
push ebx
push 1
push ebx
call ebp
push ebx
mov dword [edi + 0x48], eax
mov al, byte [esp + 0x30]
push ebx
push 1
push ebx
mov dword [esi + 0xb8], 0xffffffff
mov byte [esi + 0xc0], al
mov dword [esi + 0xc4], ebx
mov byte [esi + 0xc8], bl
mov byte [esi + 0xc9], bl
mov dword [esi], 0x10094314
call ebp
push ebx
push ebx
push ebx
push ebx
mov dword [esi + 0x68], eax
call ebp
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0xbc], eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 4
Function at 0x10042840
Capabilities:
Connect socket

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1008ec88
push eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
mov dword fs:[0], esp
sub esp, 0x28
push esi
push edi
push 0x10
push eax
push ecx
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
jne 0x100428d3
lea edx, [esp + 0x48]
lea ecx, [esp + 0x10]
push edx
push str.F:SCVLibScvLIBIPv6HappyEyeballsConnectHelper.cpp
mov dword [esp + 0x50], 0xff
call fcn.10038570
mov esi, eax
mov dword [esp + 0x38], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x100a8990
push 1
push esi
call fcn.100386d0
add esp, 0x10
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], 0xffffffff
call fcn.100385c0
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
add esp, 0x34
ret 0x10
push ebx
push ebp
mov dword [esp + 0x10], 0
mov ebx, dword [esp + 0x4c]
mov dword [esp + 0x40], 1
mov ecx, ebx
call fcn.1003a9f0
cmp eax, 2
jne 0x1004293e
push 0x10
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
add esp, 4
mov dword [esp + 0x18], esi
mov ecx, esi
xor eax, eax
mov edx, dword [esp + 0x50]
mov byte [esp + 0x40], 2
mov dword [ecx], eax
push edx
mov ebp, 0x10
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov word [esi], 2
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, ebx
mov word [esi + 2], ax
call fcn.1003a9d0
mov dword [esi + 4], eax
jmp 0x1004299d
push 0x1c
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
add esp, 4
mov dword [esp + 0x18], esi
mov ecx, 7
xor eax, eax
mov edi, esi
mov byte [esp + 0x40], 3
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x50]
mov ebp, 0x1c
push eax
mov word [esi], 0x17
call dword [sym.imp.WS2_32.dll_htons]
lea ecx, [esp + 0x28]
mov word [esi + 2], ax
push ecx
mov ecx, ebx
call fcn.1003a960
mov ecx, dword [eax]
lea edx, [esi + 8]
mov dword [esi + 8], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov dword [edx + 0xc], eax
mov ecx, dword [esp + 0x48]
push ebp
push esi
push ecx
mov dword [esp + 0x1c], esi
mov byte [esp + 0x4c], 1
call dword [sym.imp.WS2_32.dll_connect]
pop ebp
cmp eax, 0xffffffff
pop ebx
jne 0x10042a2b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 0x2733
je 0x10042a2b
lea edx, [esp + 0x40]
lea ecx, [esp + 0x20]
push edx
push str.F:SCVLibScvLIBIPv6HappyEyeballsConnectHelper.cpp
mov dword [esp + 0x48], 0x124
call fcn.10038570
push edi
push 0x100a896c
push 1
push eax
mov byte [esp + 0x48], 4
call fcn.100386d0
add esp, 0x10
lea ecx, [esp + 0x20]
mov byte [esp + 0x38], 1
call fcn.100385c0
test esi, esi
je 0x10042a16
push esi
call fcn.10088e50
add esp, 4
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
add esp, 0x34
ret 0x10
test esi, esi
je 0x10042a38
push esi
call fcn.10088e50
add esp, 4
mov ecx, dword [esp + 0x30]
pop edi
mov al, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x34
ret 0x10
Function at 0x10045520
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x1008edf8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push edi
lea ecx, [esp + 0xc]
call fcn.10089660
mov edi, dword [esp + 0x34]
mov dword [esp + 0x2c], 0
test edi, edi
mov dword [esp + 8], 0
je 0x10045616
mov eax, dword [esp + 0x38]
test eax, eax
je 0x10045616
mov ebx, dword [esp + 0x3c]
test ebx, ebx
jl 0x10045616
cmp ebx, 3
jge 0x10045616
push esi
lea ecx, [esp + 0x10]
mov esi, 1
call fcn.10089d80
test eax, eax
je 0x100455a8
cmp ebx, esi
jne 0x1004559e
mov esi, 0x101
jmp 0x100455a8
cmp ebx, 2
jne 0x100455a8
mov esi, 0x201
lea eax, [esp + 0xc]
push eax
push esi
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x100455f3
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x3c]
push ecx
push edi
push eax
push eax
push str.ProgramFilesDir
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
test esi, esi
jne 0x100455f3
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x100455f3
mov esi, 0xe8
mov eax, dword [esp + 0xc]
test eax, eax
je 0x10045602
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop edi
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret
mov ecx, dword [esp + 0x24]
pop edi
mov eax, 0x57
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x10045b70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1008ee46
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov al, byte [esp + 0x38]
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [esp + 8], esi
mov byte [esi + 4], al
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov cl, byte [esp + 0x40]
mov dword [esp + 0x30], edi
mov byte [esi + 0x14], cl
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
lea ecx, [esi + 0x24]
mov byte [esp + 0x30], 1
call fcn.1003a840
mov dl, byte [esp + 0x40]
mov dword [esi + 0x44], edi
mov byte [esi + 0x40], dl
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 3
call fcn.1003a840
mov eax, dword [esp + 0x40]
lea ecx, [esp + 0xc]
push eax
mov byte [esp + 0x34], 4
call fcn.1003a930
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0xc]
push ecx
push edx
push eax
mov ecx, esi
call fcn.10045cd0
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 3
call fcn.1003a860
mov ecx, dword [esp + 0x28]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 0xc
Function at 0x10055df0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1008fda8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push 0
lea eax, [esp + 0x20]
sub esp, 0x20
mov dword [esp + 0x30], 0
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.10055e60
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
push ecx
push edx
call fcn.10058c60
add esp, 0x2c
lea ecx, [esp + 0x1c]
mov dword [esp + 0xc], 0xffffffff
call fcn.10045f70
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x10059080
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x10090038
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
mov ebx, dword [esp + 0x30]
mov dword [esp + 0x20], 0
lea edi, [esi + esi]
cmp edi, eax
jg 0x10059198
mov ecx, dword [esp + 0x28]
shl esi, 4
mov dword [esp + 0x10], esi
jmp 0x100590cc
mov esi, dword [esp + 0x10]
sub esp, 0x20
lea edx, [esi + ecx]
mov eax, esp
add esi, edx
mov dword [esp + 0x48], esp
mov dword [eax + 4], 0x10093a38
mov dword [eax + 8], 0x10093a34
mov ebx, dword [esp + 0x68]
mov dword [eax + 0xc], ebx
mov ebp, dword [esp + 0x6c]
lea ebx, [eax + 0x10]
mov dword [eax + 0x10], ebp
mov ebp, dword [esp + 0x70]
mov dword [ebx + 4], ebp
mov ebp, dword [esp + 0x74]
mov dword [ebx + 8], ebp
mov ebp, dword [esp + 0x78]
mov dword [eax + 4], 0x10093a20
mov dword [eax + 8], 0x10093a1c
mov dword [ebx + 0xc], ebp
mov ebx, dword [esp + 0x50]
mov dword [eax], 0x100944e8
mov eax, dword [ebx]
push eax
push esi
push edx
push edx
push ecx
call fcn.10059330
mov dword [ebx], eax
mov eax, dword [esp + 0x6c]
sub eax, edi
add esp, 0x34
cmp eax, edi
mov ecx, esi
mov dword [esp + 0x38], eax
jge 0x100590c8
mov esi, dword [esp + 0x34]
cmp eax, esi
jg 0x1005919e
mov ebp, dword [esp + 0x2c]
mov ebx, dword [ebx]
cmp ecx, ebp
mov edi, ecx
je 0x10059207
lea esi, [ebx + 4]
mov ebx, 0x10094504
push edi
lea ecx, [esp + 0x14]
call fcn.1004e1e0
mov edx, dword [esi]
mov ecx, dword [eax + 4]
mov dword [eax + 4], edx
mov dword [esi], ecx
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x10], ebx
test ecx, ecx
je 0x1005918c
call fcn.10052e70
add edi, 0x10
add esi, 0x10
cmp edi, ebp
jne 0x10059167
jmp 0x10059207
mov ecx, dword [esp + 0x28]
jmp 0x1005914b
sub esp, 0x20
mov eax, esp
mov dword [esp + 0x58], esp
shl esi, 4
mov dword [eax + 4], 0x10093a38
mov dword [eax + 8], 0x10093a34
mov edx, dword [esp + 0x68]
add esi, ecx
mov dword [eax + 0xc], edx
mov edi, dword [esp + 0x6c]
lea edx, [eax + 0x10]
mov dword [eax + 0x10], edi
mov edi, dword [esp + 0x70]
mov dword [edx + 4], edi
mov edi, dword [esp + 0x74]
mov dword [edx + 8], edi
mov edi, dword [esp + 0x78]
mov dword [eax + 4], 0x10093a20
mov dword [eax + 8], 0x10093a1c
mov dword [edx + 0xc], edi
mov edx, dword [esp + 0x4c]
mov dword [eax], 0x100944e8
mov eax, dword [ebx]
push eax
push edx
push esi
push esi
push ecx
call fcn.10059330
add esp, 0x34
lea ecx, [esp + 0x3c]
mov dword [esp + 0x20], 0xffffffff
call fcn.10045f70
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x14
ret