joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001c500
Capabilities:
Print debug messages

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push str.UnZipFileThread_Start_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0
push 0
call dword [sym.imp.XecureMacuxCSM.dll_public:_static_class_XWClientSM____cdecl_XWClientSM::getInstance_char_const___unsigned_long_int_]
add esp, 8
mov ebx, eax
call dword [sym.imp.xwmfUI.dll_public:_static_class_XFClientUI____cdecl_XFClientUI::getInstance_void_]
mov esi, dword [esp + 0x18]
mov ebp, eax
mov eax, dword [sym.NativeMngUAC.dll_class_NativeFCMSWrapper__NativeFCMSWrapper::mNativeFCMSWrapper]
mov edi, 0x80000
mov dword [eax], 0xffffffff
test dword [esi + 0xc], edi
mov dword [esp + 0x10], 0
jne 0x1001c552
push 0
mov ecx, ebp
call dword [sym.imp.xwmfUI.dll_public:_void___thiscall_XFClientUI::setProgressIndex_int_]
mov ecx, dword [esi + 8]
mov edx, dword [esi]
push 0
push ecx
push edx
call fcn.10019a30
add esp, 0xc
test eax, eax
je 0x1001c592
test dword [esi + 0xc], edi
jne 0x1001c576
push 3
mov ecx, ebp
call dword [sym.imp.xwmfUI.dll_public:_int___thiscall_XFClientUI::setProgressStatus_unsigned_long_int_]
push 0x16e380c
mov ecx, ebx
mov dword [esp + 0x14], 1
mov edi, 2
call dword [sym.imp.XecureMacuxCSM.dll_public:_void___thiscall_XWClientSM::setError_int_]
jmp 0x1001c5cd
test dword [esi + 0xc], edi
jne 0x1001c5b8
mov eax, dword [esi + 4]
cdq
push 0
push edx
push eax
push edx
push eax
mov eax, dword [esi]
push eax
push 0
call sym.NativeMngUAC.dll_protected:_static_int___cdecl_NativeFCMSWrapper::ProgressCallback_void___char_const___long_long___int64___long_long___int64___int_
add esp, 0x1c
push 2
mov ecx, ebp
call dword [sym.imp.xwmfUI.dll_public:_int___thiscall_XFClientUI::setProgressStatus_unsigned_long_int_]
mov ecx, dword [esi + 8]
push ecx
mov ecx, dword [sym.NativeMngUAC.dll_class_NativeFCMSWrapper__NativeFCMSWrapper::mNativeFCMSWrapper]
add ecx, 4
call dword [0x100321b0]
xor edi, edi
mov edx, dword [sym.NativeMngUAC.dll_class_NativeFCMSWrapper__NativeFCMSWrapper::mNativeFCMSWrapper]
mov dword [edx], edi
mov esi, dword [esi + 0xc]
test esi, 0x200000
jne 0x1001c5ef
cmp dword [esp + 0x10], 0
jne 0x1001c5ff
test esi, 0x100000
je 0x1001c5ff
test esi, 0x80000
jne 0x1001c5ff
mov ecx, ebp
call dword [sym.imp.xwmfUI.dll_public:_void___thiscall_XFClientUI::endProgress_void_]
call dword [sym.imp.XecureMacuxCSM.dll_public:_static_void___cdecl_XWClientSM::removeInstance_void_]
push str.UnZipFileThread_End_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 4
Function at 0x1001ce10
Capabilities:
Print debug messages

Disassembly:
push ebx
push ebp
push esi
push edi
push str.VerifyFileThread_Start_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call dword [sym.imp.xwmfUI.dll_public:_static_class_XFClientUI____cdecl_XFClientUI::getInstance_void_]
push 0
push 0
mov ebp, eax
call dword [sym.imp.XecureMacuxCSM.dll_public:_static_class_XWClientSM____cdecl_XWClientSM::getInstance_char_const___unsigned_long_int_]
mov esi, dword [esp + 0x1c]
mov edi, eax
mov eax, dword [sym.NativeMngUAC.dll_class_NativeFCMSWrapper__NativeFCMSWrapper::mNativeFCMSWrapper]
add esp, 8
xor ebx, ebx
mov dword [eax], 0xffffffff
test dword [esi + 0x18], 0x80000
jne 0x1001ce59
push ebx
mov ecx, ebp
call dword [sym.imp.xwmfUI.dll_public:_void___thiscall_XFClientUI::setProgressIndex_int_]
mov eax, dword [esi + 0x18]
xor ecx, ecx
test al, 4
je 0x1001ce67
mov ecx, 4
test al, 0x10
je 0x1001ce71
or ecx, 0x1000
test al, 0x20
je 0x1001ce7b
or ecx, 0x4000
mov edx, dword [esi + 0x14]
and eax, 0x80000
neg eax
sbb eax, eax
not eax
and eax, sym.NativeMngUAC.dll_protected:_static_int___cdecl_NativeFCMSWrapper::ProgressCallback_void___char_const___long_long___int64___long_long___int64___int_
push eax
mov eax, dword [esi + 0x10]
push edx
mov edx, dword [esi + 0xc]
push eax
mov eax, dword [esi + 8]
push edx
mov edx, dword [esi + 4]
push eax
mov eax, dword [esi]
push edx
push ecx
push eax
push 1
push 0
mov ecx, edi
call dword [sym.imp.XecureMacuxCSM.dll_public:_int___thiscall_XWClientSM::verifyFile_int__int__unsigned_long_int__unsigned_long_int__char_const___char_const___char____char____char____int____cdecl___void___char_const___long_long___int64___long_long___int64___int__]
test eax, eax
jne 0x1001cef1
mov ecx, dword [esi + 0xc]
mov edx, dword [ecx]
cmp byte [edx], 0x30
jne 0x1001ceda
test dword [esi + 0x18], 0x80000
jne 0x1001ced1
push 3
mov ecx, ebp
call dword [sym.imp.xwmfUI.dll_public:_int___thiscall_XFClientUI::setProgressStatus_unsigned_long_int_]
mov ebx, 1
xor eax, eax
jmp 0x1001cf18
test dword [esi + 0x18], 0x80000
jne 0x1001ceed
push 2
mov ecx, ebp
call dword [sym.imp.xwmfUI.dll_public:_int___thiscall_XFClientUI::setProgressStatus_unsigned_long_int_]
xor eax, eax
jmp 0x1001cf18
cmp eax, 0xffffffff
jne 0x1001cefd
mov eax, 1
jmp 0x1001cf18
test dword [esi + 0x18], 0x80000
jne 0x1001cf10
push 3
mov ecx, ebp
call dword [sym.imp.xwmfUI.dll_public:_int___thiscall_XFClientUI::setProgressStatus_unsigned_long_int_]
mov eax, 2
lea ebx, [eax - 1]
mov ecx, dword [sym.NativeMngUAC.dll_class_NativeFCMSWrapper__NativeFCMSWrapper::mNativeFCMSWrapper]
mov dword [ecx], eax
mov esi, dword [esi + 0x18]
test esi, 0x200000
jne 0x1001cf37
test ebx, ebx
jne 0x1001cf47
test esi, 0x100000
je 0x1001cf47
test esi, 0x80000
jne 0x1001cf47
mov ecx, ebp
call dword [sym.imp.xwmfUI.dll_public:_void___thiscall_XFClientUI::endProgress_void_]
call dword [sym.imp.XecureMacuxCSM.dll_public:_static_void___cdecl_XWClientSM::removeInstance_void_]
push str.VerifyFileThread_End_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 4
Function at 0x10021ac0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1002f2ab
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1004a0b4]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], 0
call fcn.10021480
lea ecx, [esi + 0x20]
mov dword [esp + 0x14], 0xffffffff
call fcn.10021480
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x1002d3f0
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x1004a0b4]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.1002d385
mov eax, 0x10000000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x1002d43f
cmp dword [ebp - 0x1c], 5
jb 0x1002d457
jmp 0x1002d453
cmp dword [ebp - 0x10], 1
jne 0x1002d457
cmp dword [ebp - 0x1c], 4
ja 0x1002d453
jne 0x1002d457
cmp dword [ebp - 0x18], 0
jbe 0x1002d457
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x1003b948
call fcn.10001380
test eax, eax
jge 0x1002d478
mov byte [0x1004a0e8], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1002d777
add ebp, 0x78
leave
ret

Function at 0x1002d62a
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x1004ad6c], 0
push esi
jne 0x1002d59d
call fcn.1002d4c8
test eax, eax
je 0x1002d5e0
mov eax, dword [0x1004ad6c]
cmp eax, 1
jne 0x1002d5be
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x1002d5e0
pop esi
ret
push eax
call dword [0x1004ad74]
test eax, eax
jne 0x1002d628
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x1002d5e4
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x1004ad6c]
call dword [0x1004ad74]
mov edi, eax
test edi, edi
je 0x1002d60b
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x1002d627
lea edi, [esi + 0xff0]
push esi
push dword [0x1004ad6c]
call dword [0x1004ad70]
add esi, 0x10
cmp esi, edi
jb 0x1002d611
mov eax, esi
pop edi
pop esi
ret
jmp 0x1002d58a

Function at 0x1002d777
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1004a0b4]
jne 0x1002d781
repz ret
jmp fcn.1002dd26
Function at 0x1000125c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0xc], 0
call sub.KERNEL32.DLL_GetEnvironmentStringsA
mov ebx, eax
mov dword [ebp - 0x10], ebx
jmp 0x10001299
cmp byte [ebx], 0x3d
je 0x10001285
inc dword [ebp - 0xc]
mov edi, ebx
xor eax, eax
stc
sbb ecx, ecx
repne scasb al, byte es:[edi]
neg ecx
lea eax, [ecx - 2]
mov edi, eax
inc edi
lea ebx, [ebx + edi]
cmp byte [ebx], 0
jne 0x10001278
mov edi, dword [ebp - 0xc]
inc edi
lea edi, [edi*4]
mov dword [ebp - 0x14], edi
push dword [ebp - 0x14]
call sub.CRTDLL.DLL_malloc
pop ecx
mov dword [ebp - 8], eax
mov dword [0x10003010], eax
cmp dword [ebp - 8], 0
jne 0x100012cc
xor eax, eax
jmp 0x10001342
mov ebx, dword [ebp - 0x10]
jmp 0x10001325
mov edi, ebx
xor eax, eax
stc
sbb ecx, ecx
repne scasb al, byte es:[edi]
neg ecx
lea eax, [ecx - 2]
mov edi, eax
inc edi
mov dword [ebp - 4], edi
cmp byte [ebx], 0x3d
je 0x1000131f
push dword [ebp - 4]
call sub.CRTDLL.DLL_malloc
pop ecx
mov esi, dword [ebp - 8]
mov dword [esi], eax
or eax, eax
jne 0x10001308
jmp 0x10001342
push ebx
mov edi, dword [ebp - 8]
push dword [edi]
call sub.CRTDLL.DLL_strcpy
add esp, 8
add dword [ebp - 8], 4
mov edx, dword [ebp - 4]
lea ebx, [ebx + edx]
cmp byte [ebx], 0
jne 0x100012d1
mov edx, dword [ebp - 8]
mov dword [edx], 0
mov eax, 1
pop edi
pop esi
pop ebx
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, 0x7c9b34d6
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x3b401b20
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x9b44a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x65f00d
lea edi, [esi - 0x25e00d]
push edi
or ebp, 0xffffffff
jmp 0x9b44c2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x9b44c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x9b44b8
mov eax, 1
add ebx, ebx
jne 0x9b44db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x9b44d0
jne 0x9b44ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x9b44d0
xor ecx, ecx
sub eax, 3
jb 0x9b4500
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x9b4572
mov ebp, eax
add ebx, ebx
jne 0x9b450b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x9b4518
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x9b453c
inc ecx
add ebx, ebx
jne 0x9b4528
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x9b451d
jne 0x9b4539
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x9b451d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x9b455c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x9b454d
jmp 0x9b44be
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x9b455c
add edi, ecx
jmp 0x9b44be
pop esi
mov edi, esi
mov ecx, 0x184b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x9b457a
cmp byte [edi], 0x11
jne 0x9b457a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x9b457f
lea edi, [esi + 0x5b0000]
mov eax, dword [edi]
or eax, eax
je 0x9b45ee
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x5b6f9c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x5b6ff4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x9b45ac
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x5b6ffc]
or eax, eax
je 0x9b45e8
mov dword [ebx], eax
add ebx, 4
jmp 0x9b45c9
call dword [esi + 0x5b6ff8]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x9b461f
cmp al, 0xef
ja 0x9b4612
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x9b45f4
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x9b4601
mov ebp, dword [esi + 0x5b7000]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x197]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x9b4653
sub esp, 0xffffff80
jmp 0x40f16c
Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408ecc
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
mov esi, 0x75a26b8a
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x5eab07ff
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x41cb90
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x41cbbe
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x41cbdc
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0041cafa
jmp 0x41cbdc
mov eax, dword [esi + 0x14]
test eax, eax
je 0x41cbdc
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.0041cafa
test edi, edi
mov eax, edi
jne 0x41cbc6
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x42a8f4]
test ecx, ecx
je 0x41cc8f
jmp 0x41cb8f
ret 8

Function at 0xd36058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xd361a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xd3607e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd3606a
add dl, dl
jne 0xd36089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd360dc
xor eax, eax
add dl, dl
jne 0xd36096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd3617d
add dl, dl
jne 0xd360a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd360b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd360bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd360c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xd360d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xd36075
mov eax, 1
add dl, dl
jne 0xd360ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd360f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd360e1
sub eax, ebx
mov ebx, 1
jne 0xd36128
mov ecx, 1
add dl, dl
jne 0xd3610e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd36119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd36105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd36075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xd3613f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd3614a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd36136
cmp eax, 0x7d00
jae 0xd3616d
cmp eax, 0x500
jb 0xd36168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd36075
cmp eax, 0x7f
ja 0xd36170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd36075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xd3619e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xd36075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10001050
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x10091628]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebx + 8]
mov ecx, 0x10b
push edi
mov dword [ebp - 0x50], esi
mov eax, dword [esi + 0x3c]
cmp word [eax + esi + 0x18], cx
jne 0x1000119a
push esi
push dword [eax + esi + 0x78]
call fcn.10001550
add eax, esi
push esi
mov dword [ebp - 0x48], eax
push dword [eax + 0x20]
call fcn.10001550
push esi
lea edi, [esi + eax]
mov eax, dword [ebp - 0x48]
push dword [eax + 0x24]
call fcn.10001550
add eax, esi
add esp, 0x18
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x1000119a
nop dword [eax + eax]
push esi
push dword [edi]
dec eax
mov dword [ebp - 0x58], eax
call fcn.10001550
xorps xmm0, xmm0
mov dword [ebp - 0x40], 0x3c2c3719
mov dword [ebp - 0x3c], 0x40d2d30
add eax, esi
mov dword [ebp - 0x38], 0x9281508
add esp, 8
mov word [ebp - 0x34], 0x80b
mov byte [ebp - 0x32], 0x94
movq qword [ebp - 0x31], xmm0
mov dword [ebp - 0x44], 0
cmp dword [ebp - 0x44], 0x17
mov dword [ebp - 0x54], eax
jae 0x10001154
nop dword [eax + eax]
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
add ecx, 0xf4f0581b
mov al, byte [ebp + eax - 0x40]
movzx edx, al
mov eax, ecx
and eax, edx
add eax, eax
sub ecx, eax
mov eax, dword [ebp - 0x44]
add ecx, edx
add cl, 0x43
mov byte [ebp + eax - 0x40], cl
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0x17
jb 0x10001120
mov cl, byte [ebp - 0x40]
lea eax, [ebp - 0x14]
test cl, cl
je 0x10001172
mov esi, eax
lea edx, [ebp - 0x40]
sub edx, esi
mov esi, dword [ebp - 0x50]
mov byte [eax], cl
inc eax
mov cl, byte [edx + eax]
test cl, cl
jne 0x10001168
mov byte [eax], 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x54]
call sub.VCRUNTIME140.dll_strstr
add esp, 8
test eax, eax
jne 0x100011af
add dword [ebp - 0x4c], 2
add edi, 4
mov eax, dword [ebp - 0x58]
test eax, eax
jne 0x100010d0
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10075d21
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov eax, dword [ebp - 0x48]
push esi
push dword [eax + 0x1c]
call fcn.10001550
mov ecx, dword [ebp - 0x4c]
add eax, esi
push esi
movzx ecx, word [ecx]
push dword [eax + ecx*4]
call fcn.10001550
mov ecx, dword [ebp - 4]
add esp, 0x10
xor ecx, ebp
pop edi
pop esi
call fcn.10075d21
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x10001550
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov edx, dword [eax + 0x3c]
add edx, eax
movzx eax, word [edx + 0x14]
lea esi, [edx + 0x18]
add esi, eax
mov dword [ebp + 0xc], esi
cmp edi, dword [esi + 0x14]
jae 0x10001577
mov eax, edi
pop edi
pop esi
pop ebp
ret
push ebx
movzx ebx, word [edx + 6]
xor eax, eax
xor ecx, ecx
cmp ax, bx
jae 0x100015c1
movzx edx, cx
lea eax, [edx + edx*4]
mov esi, dword [esi + eax*8 + 0xc]
cmp edi, esi
jb 0x100015a3
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + eax*8 + 0x10]
mov edi, dword [ebp + 8]
add eax, esi
cmp edi, eax
jb 0x100015ae
inc ecx
cmp cx, bx
jae 0x100015c1
mov esi, dword [ebp + 0xc]
jmp 0x10001585
mov ecx, dword [ebp + 0xc]
lea eax, [edx + edx*4]
pop ebx
mov eax, dword [ecx + eax*8 + 0x14]
sub eax, esi
add eax, edi
pop edi
pop esi
pop ebp
ret
pop ebx
pop edi
xor eax, eax
pop esi
pop ebp
ret
Function at 0x100058c0
Capabilities:
Create thread
Initialize winsock library
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10077a7b
mov eax, dword fs:[0]
push eax
sub esp, 0x1b8
mov eax, dword [0x10091628]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x1b0]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x10005933
push eax
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 0x1b8], eax
cmp eax, 0xffffffff
jne 0x10005953
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Could_not_create_socket:__d
call fcn.1000b030
add esp, 8
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10075d21
mov esp, ebp
pop ebp
ret
push 1
lea ecx, [ebp - 0x1b1]
mov byte [ebp - 0x1b1], 1
push ecx
push 0x20
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x10005997
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.setsockopt_failed:___d
call fcn.1000b030
add esp, 8
push dword [ebp - 0x1b8]
call dword [sym.imp.WS2_32.dll_closesocket]
jmp 0x1000592d
mov eax, 2
mov dword [ebp - 0x1c], 0
push 0xeec2
mov word [ebp - 0x20], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x1e], ax
lea eax, [ebp - 0x20]
push 0x10
push eax
push dword [ebp - 0x1b8]
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x100059db
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Bind_failed_with_error_code:___d
jmp 0x10005981
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x1b8]
push 8
call fcn.10075d2f
add esp, 4
test eax, eax
je 0x100059f9
mov dword [eax], edi
mov dword [eax + 4], esi
jmp 0x100059fb
xor eax, eax
mov dword [ebp - 0x1c4], eax
lea ecx, [ebp - 0x1bc]
mov dword [ebp - 4], 0
push ecx
push 0
push eax
push 0x10002240
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [ebp - 0x1c0], eax
test eax, eax
je 0x10005a80
mov ecx, dword [ebp - 0x1bc]
mov dword [ebp - 4], 1
test ecx, ecx
je 0x10005a91
push ecx
push eax
call sub.MSVCP140.dll__Thrd_detach
add esp, 8
test eax, eax
jne 0x10005a98
xorps xmm0, xmm0
push 1
movlpd qword [ebp - 0x1c0], xmm0
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
add esp, 8
cmp dword [ebp - 0x1bc], 0
je 0x10005a79
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
xor eax, eax
jmp 0x10005938
push 6
mov dword [ebp - 0x1bc], 0
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
push 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
push eax
call sub.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_
int3