joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004fd0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1008ad1f
push eax
mov dword fs:[0], esp
mov edx, ecx
sub esp, 0x108
mov al, byte [edx + 0xc]
push ebx
push esi
test al, al
push edi
je 0x100050af
mov eax, dword [edx + 8]
test eax, eax
je 0x100050af
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x100050af
mov al, byte [esp + 0x124]
test al, al
jne 0x100050af
mov esi, dword [edx + 8]
test esi, esi
je 0x100050ab
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [esi + 8]
mov cl, byte [eax]
xor ebx, ebx
test cl, cl
setne bl
test esi, esi
push ebp
je 0x100050a3
mov ebp, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
push esi
call ebp
test eax, eax
jne 0x100050a3
mov edi, dword [esi + 8]
test edi, edi
mov dword [esp + 0x10], edi
je 0x10005089
lea ecx, [edi + 0x20]
mov dword [esp + 0x120], eax
call fcn.10005a30
push 1
lea ecx, [edi + 4]
mov dword [esp + 0x124], 0xffffffff
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
push edi
call fcn.10088e50
add esp, 4
lea eax, [esi + 4]
mov dword [esi + 8], 0
push eax
call ebp
test eax, eax
jne 0x100050a3
push esi
call fcn.10088e50
add esp, 4
mov eax, ebx
pop ebp
jmp 0x10005197
xor eax, eax
jmp 0x10005035
mov edi, str.UserSet
or ecx, 0xffffffff
xor eax, eax
mov esi, 0x102
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, str.VisitMs.ini
sub esi, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
sub esi, ecx
lea ecx, [esp + 0x10]
push esi
push ecx
mov ecx, edx
call fcn.100051c0
test eax, eax
jne 0x1000517a
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashA]
or ecx, 0xffffffff
mov edi, 0x100a3364
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebx, ecx
mov esi, edi
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x10]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x100a27e8
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x10]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.VisitMs.ini
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x10]
push eax
push 0
push str.Visit
push str.Mode
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
neg eax
sbb eax, eax
neg eax
mov ecx, dword [esp + 0x114]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x114
ret 4
Function at 0x10005690
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1008ad98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push esi
lea eax, [esp + 4]
push edi
push eax
push str.F:SCVICEIceServiceIceService.cpp
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xb7
call fcn.10038570
push str._ServiceFrame_Exit_
push 0
push eax
mov dword [esp + 0x44], 0
call fcn.100386d0
or edi, 0xffffffff
add esp, 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], edi
call fcn.100385c0
lea ecx, [esp + 8]
mov dword [esp + 8], 0xba
push ecx
push str.F:SCVICEIceServiceIceService.cpp
lea ecx, [esp + 0x18]
call fcn.10038570
push str._ServiceFrame_Exit_ICE
push 0
push eax
mov dword [esp + 0x44], 1
call fcn.100386d0
add esp, 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], edi
call fcn.100385c0
mov edx, dword [0x100abab4]
mov ecx, 0x100aba30
push edx
call fcn.10001840
lea eax, [esp + 8]
lea ecx, [esp + 0x10]
push eax
push str.F:SCVICEIceServiceIceService.cpp
mov dword [esp + 0x10], 0xbc
call fcn.10038570
push 0x100a3744
push 0
push eax
mov dword [esp + 0x44], 2
call fcn.100386d0
add esp, 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], edi
call fcn.100385c0
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov esi, eax
test esi, esi
je 0x100057cb
lea ecx, [esp + 8]
mov dword [esp + 8], 0xc2
push ecx
push str.F:SCVICEIceServiceIceService.cpp
lea ecx, [esp + 0x18]
call fcn.10038570
push esi
push str._ServiceFrame_Exit_WinSock
push 1
push eax
mov dword [esp + 0x48], 3
call fcn.100386d0
add esp, 0x10
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], edi
call fcn.100385c0
mov eax, dword [0x100abab0]
test eax, eax
je 0x100057db
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0xc]
lea ecx, [esp + 0x20]
push edx
push str.F:SCVICEIceServiceIceService.cpp
mov dword [0x100abab0], 0
mov dword [esp + 0x14], 0xca
call fcn.10038570
mov ecx, eax
mov dword [esp + 0x38], 4
call fcn.100386b0
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], edi
call fcn.100385c0
mov ecx, dword [esp + 0x30]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x34
ret
Function at 0x10005cb0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1008add8
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
xor ebx, ebx
call fcn.10005da0
mov eax, dword [esp + 0x28]
push eax
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp eax, ebx
mov dword [esi + 8], eax
je 0x10005d18
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov dword [esi + 4], edx
mov edx, dword [esp + 0x2c]
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], edx
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10
lea ecx, [esp + 0x28]
push edi
push ecx
push str.F:SCVICEIceServiceIceSvcData.cpp
lea ecx, [esp + 0x14]
mov dword [esp + 0x34], 0x56
call fcn.10038570
mov edi, eax
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x100a3814
push 1
push edi
call fcn.100386d0
add esp, 0x10
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call fcn.100385c0
mov ecx, esi
call fcn.10005da0
mov ecx, dword [esp + 0x1c]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10
Function at 0x100060a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1008ae23
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x20]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x2c]
push ecx
push edx
push eax
mov ecx, edi
mov dword [esp + 0x1c], edi
call fcn.10005e70
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov al, byte [esp + 0x34]
xor ebx, ebx
lea esi, [edi + 0x20]
mov dword [edi + 0x14], ecx
mov dword [edi + 0x18], edx
mov dword [edi + 0x1c], ebx
mov dword [esp + 0x18], ebx
mov byte [esi], al
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [edi + 8]
mov dword [edi + 0x2854], ebx
mov dword [edi + 0x2858], ebx
mov dword [edi + 0x285c], ebx
mov dword [edi], 0x100937a8
mov eax, dword [ecx]
cmp eax, 0x2800
mov byte [esp + 0x18], 1
jbe 0x100061c5
mov edx, dword [edi + 0xc]
mov eax, dword [esi + 4]
mov byte [esp + 0x34], bl
cmp eax, ebx
mov edx, dword [edx]
jne 0x10006144
xor ecx, ecx
jmp 0x10006149
mov ecx, dword [esi + 8]
sub ecx, eax
cmp ecx, edx
push ebp
jae 0x10006170
cmp eax, ebx
jne 0x10006156
xor ecx, ecx
jmp 0x1000615b
mov ecx, dword [esi + 8]
sub ecx, eax
lea eax, [esp + 0x38]
sub edx, ecx
mov ecx, dword [esi + 8]
push eax
push edx
push ecx
mov ecx, esi
call fcn.100604b0
jmp 0x1000619d
cmp eax, ebx
je 0x1000619d
mov ecx, dword [esi + 8]
mov ebp, ecx
sub ebp, eax
cmp edx, ebp
jae 0x1000619d
lea ebp, [eax + edx]
mov eax, ecx
cmp eax, ecx
je 0x10006193
mov dl, byte [eax]
mov byte [ebp], dl
inc ebp
inc eax
cmp eax, ecx
jne 0x10006188
mov eax, dword [esi + 8]
mov dword [esi + 8], ebp
mov dword [esp + 0x38], eax
mov ecx, dword [edi + 0x24]
pop ebp
mov dword [edi + 0x284c], ecx
mov eax, dword [esi + 4]
cmp eax, ebx
jne 0x100061b8
xor esi, esi
mov dword [edi + 0x2850], esi
jmp 0x100061d9
mov esi, dword [esi + 8]
sub esi, eax
mov dword [edi + 0x2850], esi
jmp 0x100061d9
mov eax, dword [edi + 0xc]
lea edx, [edi + 0x30]
mov dword [edi + 0x284c], edx
mov ecx, dword [eax]
mov dword [edi + 0x2850], ecx
mov ecx, dword [esp + 0x10]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x18

Function at 0x10006240
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, ecx
xor ebx, ebx
mov byte [edi], bl
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0x2850]
lea eax, [esi + 0x2854]
push ecx
mov ecx, dword [esi + 0x14]
push eax
mov dword [eax], ebx
mov eax, dword [esi + 0x284c]
mov dword [esi + 0x1c], ebx
push edx
mov edx, dword [ecx]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10006291
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x10006299
mov byte [edi], 1
mov eax, dword [esi + 0x18]
mov dword [esi + 0x1c], eax
pop edi
pop esi
mov al, 1
pop ebx
ret 4
pop edi
mov al, bl
pop esi
pop ebx
ret 4
Function at 0x10006890
Capabilities:
Create pipe

Disassembly:
sub esp, 0x2c
push esi
mov esi, ecx
cmp dword [esi + 0x24], 0xffffffff
je 0x100068a3
xor al, al
pop esi
add esp, 0x2c
ret
xor eax, eax
lea ecx, [esp + 4]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x100937b4
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call fcn.100069d0
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov dword [esp + 0x24], ecx
lea edx, [esp + 8]
mov dword [esp + 0x28], ecx
mov dword [esp + 4], 0x100937b0
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x24], 0xc
test eax, eax
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], ecx
je 0x10006944
xor eax, eax
mov dword [esp + 8], ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x28], eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x14], ecx
mov dword [esp + 4], 0x100937b4
test eax, eax
mov dword [esp + 0x18], ecx
je 0x1000693d
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor al, al
pop esi
add esp, 0x2c
ret
mov eax, dword [esi + 8]
mov dword [esp + 0x2c], 1
test eax, eax
jne 0x10006958
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
lea edx, [esp + 0x24]
push ebx
push edx
push 0x2710
push 0x400
push 0x400
push 0xff
push 6
push 0x40000003
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
cmp eax, 0xffffffff
mov dword [esi + 0x24], eax
setne bl
xor eax, eax
xor ecx, ecx
mov dword [esp + 0x28], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x14], ecx
mov dword [esp + 8], 0x100937b4
mov dword [esp + 0x18], ecx
test eax, eax
mov dword [esp + 0x1c], ecx
je 0x100069c4
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov al, bl
pop ebx
pop esi
add esp, 0x2c
ret
Function at 0x100069d0
Capabilities:
Check os version

Disassembly:
sub esp, 0x28
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov eax, dword [esi + 0x18]
cmp eax, ebx
je 0x100069e8
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [esi + 4]
push 1
push eax
mov dword [esi + 0x18], ebx
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x10006b4a
push 0x100
push 0x40
mov byte [esp + 0x20], 1
mov byte [esp + 0x21], 1
mov byte [esp + 0x22], bl
mov byte [esp + 0x23], bl
mov byte [esp + 0x24], bl
mov byte [esp + 0x25], bl
mov byte [esp + 0x26], bl
mov byte [esp + 0x27], 1
mov dword [esp + 0x28], ebx
mov byte [esp + 0x14], 1
mov byte [esp + 0x15], 1
mov byte [esp + 0x16], bl
mov byte [esp + 0x17], bl
mov byte [esp + 0x18], bl
mov byte [esp + 0x19], bl
mov byte [esp + 0x1a], bl
mov byte [esp + 0x1b], 5
mov dword [esp + 0x1c], 2
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp eax, ebx
mov dword [esi + 0x18], eax
je 0x10006b4a
mov byte [eax], 2
mov eax, dword [esi + 0x18]
lea ecx, [esp + 0xc]
mov word [eax + 2], 0x100
mov edx, dword [esi + 0x18]
push ecx
push 0x1f01ff
push 2
push edx
call dword [sym.imp.ADVAPI32.dll_AddAccessDeniedAce]
test eax, eax
je 0x10006b4a
mov ecx, dword [esi + 0x18]
mov edi, dword [sym.imp.ADVAPI32.dll_AddAccessAllowedAce]
lea eax, [esp + 0x18]
push eax
push 0x1f01ff
push 2
push ecx
call edi
test eax, eax
je 0x10006b4a
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, eax
and ecx, 0xff
cmp ecx, 6
jne 0x10006ad1
xor edx, edx
mov dl, ah
cmp dl, 2
jae 0x10006ad6
jmp 0x10006b22
cmp ecx, 7
jb 0x10006b22
xor eax, eax
mov edx, dword [esi + 0x18]
mov dword [esp + 0x25], eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x29], eax
push ecx
mov dword [esp + 0x31], eax
push 0x1f01ff
mov word [esp + 0x39], ax
push 2
mov byte [esp + 0x3f], al
push edx
mov byte [esp + 0x34], 1
mov byte [esp + 0x35], 2
mov byte [esp + 0x3b], 0xf
mov dword [esp + 0x3c], 2
mov dword [esp + 0x40], 1
call edi
test eax, eax
je 0x10006b4a
mov eax, dword [esi + 0x18]
push ebx
push eax
lea eax, [esi + 4]
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x10006b4a
mov ecx, ebx
mov dword [esi + 0x1c], ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
pop ebx
add esp, 0x28
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov dword [esi + 0x1c], eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
pop ebx
add esp, 0x28
ret
Function at 0x10006c60
Capabilities:
Connect pipe

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1008ae91
push eax
mov dword fs:[0], esp
push ebx
push ebp
push esi
mov esi, ecx
xor ebp, ebp
mov ecx, dword [esp + 0x1c]
push edi
cmp dword [ecx], ebp
jne 0x10006c8c
xor eax, eax
jmp 0x10006da2
mov eax, dword [esi + 0x24]
lea ebx, [esi + 0x24]
cmp eax, 0xffffffff
jne 0x10006c9e
xor eax, eax
jmp 0x10006da2
lea edi, [esi + 0x28]
mov dword [esi + 0x2c], ebp
mov dword [esi + 0x30], ebp
mov dword [esi + 0x34], ebp
mov dword [edi], ebp
mov ecx, dword [ecx]
push edi
push eax
mov dword [esi + 0x38], ecx
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x10006d64
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
jne 0x10006d25
push 0x2860
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x20], eax
test eax, eax
mov dword [esp + 0x18], 0
je 0x10006d15
lea edx, [esi + 0x20]
lea ecx, [esi + 0x1c]
push edx
push ecx
lea edx, [esi + 0x18]
lea ecx, [esi + 0x14]
push edx
push ecx
push edi
push ebx
mov ecx, eax
call fcn.100060a0
mov edx, dword [esi + 0x38]
mov ebp, eax
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x10006da0
mov edx, dword [esi + 0x38]
xor eax, eax
push edx
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x10006da0
cmp eax, 0x3e5
jne 0x10006da0
push 0x2860
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x20], eax
test eax, eax
mov dword [esp + 0x18], 1
je 0x10006d9c
lea ecx, [esi + 0x20]
lea edx, [esi + 0x1c]
push ecx
lea ecx, [esi + 0x18]
push edx
add esi, 0x14
push ecx
push esi
push edi
push ebx
mov ecx, eax
call fcn.100060a0
jmp 0x10006d9e
push 0x2860
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x20], eax
test eax, eax
mov dword [esp + 0x18], 2
je 0x10006d9c
lea edx, [esi + 0x20]
lea ecx, [esi + 0x1c]
push edx
lea edx, [esi + 0x18]
push ecx
add esi, 0x14
push edx
push esi
push edi
push ebx
mov ecx, eax
call fcn.100060a0
jmp 0x10006d9e
xor eax, eax
mov ebp, eax
mov eax, ebp
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 4
Function at 0x10008340
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, ecx
push edi
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
xor ebx, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x10], ebx
mov edi, ecx
mov eax, ebx
je 0x10008376
mov ecx, eax
and ecx, 3
lea edx, [esp + ecx + 0x10]
mov cl, byte [eax + ebp]
xor byte [edx], cl
inc eax
cmp eax, edi
jb 0x10008363
mov eax, dword [esi + 0xc]
xor edi, edi
cmp eax, ebx
jle 0x100083ad
mov edx, dword [esi + 8]
mov ecx, dword [esp + 0x10]
lea eax, [ebx + edx]
mov edx, dword [ebx + edx + 8]
cmp edx, ecx
jne 0x100083a2
mov eax, dword [eax]
push ebp
push eax
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 8
test eax, eax
je 0x100083b7
mov eax, dword [esi + 0xc]
inc edi
add ebx, 0xc
cmp edi, eax
jl 0x1000837f
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 4
mov eax, dword [esi + 8]
lea edx, [edi + edi*2]
push 0xa
push 0
mov ecx, dword [eax + edx*4 + 4]
push ecx
call dword [sym.imp.MSVCRT.dll_strtoul]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4

Function at 0x100083e0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 8], edx
mov edi, ecx
je 0x10008420
push ebx
mov ecx, eax
and ecx, 3
mov bl, byte [esp + ecx + 0xc]
lea edx, [esp + ecx + 0xc]
mov cl, byte [eax + esi]
xor bl, cl
inc eax
cmp eax, edi
mov byte [edx], bl
jb 0x100083fe
mov eax, dword [esp + 0xc]
pop ebx
pop edi
pop esi
pop ecx
ret
pop edi
mov eax, edx
pop esi
pop ecx
ret
Function at 0x10009210
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1008b240
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push esi
mov esi, dword [esp + 0x3c]
push edi
test esi, esi
mov ebx, ecx
jne 0x10009288
lea eax, [esp + 0x40]
lea ecx, [esp + 0x10]
push eax
push str.F:SCVICELIBIceProviderIceComObjectManager.cpp
mov dword [esp + 0x48], 0x225
call fcn.10038570
push 0x100a3b5c
push esi
push eax
mov dword [esp + 0x44], esi
call fcn.100386d0
add esp, 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], 0xffffffff
call fcn.100385c0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret 4
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x100092ee
lea ecx, [esp + 0x40]
mov dword [esp + 0x40], 0x229
push ecx
push str.F:SCVICELIBIceProviderIceComObjectManager.cpp
lea ecx, [esp + 0x18]
call fcn.10038570
push 0x100a3b48
push 0
push eax
mov dword [esp + 0x44], 1
call fcn.100386d0
add esp, 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], 0xffffffff
call fcn.100385c0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret 4
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x208
jb 0x1000935a
lea edx, [esp + 0x40]
lea ecx, [esp + 0x10]
push edx
push str.F:SCVICELIBIceProviderIceComObjectManager.cpp
mov dword [esp + 0x48], 0x22d
call fcn.10038570
push 0x100a3b2c
push 1
push eax
mov dword [esp + 0x44], 2
call fcn.100386d0
add esp, 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], 0xffffffff
call fcn.100385c0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret 4
lea eax, [esp + 0xc]
lea ecx, [esp + 0x20]
push eax
push str.F:SCVICELIBIceProviderIceComObjectManager.cpp
mov dword [esp + 0x14], 0x231
call fcn.10038570
push esi
push 0x100a3b18
push 0
push eax
mov dword [esp + 0x48], 3
call fcn.100386d0
add esp, 0x10
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], 0xffffffff
call fcn.100385c0
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebx + 0xc4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x30
ret 4

Function at 0x10009f80
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
push edi
mov ecx, 0x63
xor eax, eax
lea edi, [esp + 6]
mov word [esp + 4], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 4]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
pop edi
jne 0x10009fc2
mov ax, word [esp]
sub ax, 2
neg ax
sbb eax, eax
and eax, 0x276c
add esp, 0x190
ret
Function at 0x1000da80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1008b8a6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x94
push ebx
push ebp
push esi
mov ebp, ecx
push edi
mov ecx, 0x1b
xor eax, eax
lea edi, [esp + 0x38]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x98]
xor ebx, ebx
push eax
mov dword [esp + 0x98], 0xb4
call fcn.1003c200
mov esi, dword [esp + 0xbc]
add esp, 4
lea ecx, [esp + 0x38]
mov edx, dword [esi + 0xc]
push ecx
push edx
mov ecx, ebp
call fcn.10010cd0
mov ecx, eax
call fcn.10022920
or edi, 0xffffffff
test eax, eax
jne 0x1000db38
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push str.F:SCVICELIBIceProviderIceComObjectManager.cpp
mov dword [esp + 0x18], 0x9ce
call fcn.10038570
mov ecx, dword [esi + 0xc]
mov dword [esp + 0xac], ebx
push ecx
push 0x100a4c78
push 1
push eax
call fcn.100386d0
add esp, 0x10
lea ecx, [esp + 0x18]
mov dword [esp + 0xac], edi
call fcn.100385c0
jmp 0x1000db5a
mov edx, dword [esi + 0xc]
mov eax, dword [esp + 0x3c]
push 1
push edx
push eax
mov ecx, ebp
call fcn.10010cd0
mov ecx, eax
call fcn.10022000
test eax, eax
je 0x1000db5a
mov ebx, 1
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], 0x9dc
push ecx
push str.F:SCVICELIBIceProviderIceComObjectManager.cpp
lea ecx, [esp + 0x30]
call fcn.10038570
mov edx, dword [esi + 0x14]
mov ecx, dword [esi + 8]
push edx
mov edx, dword [esi + 0xc]
push ecx
mov ecx, dword [esp + 0xbc]
push edx
push ecx
push ebx
push str._____OnSendControlPacketDisconnect
push 0xb
push eax
mov dword [esp + 0xcc], 1
call fcn.100386d0
add esp, 0x20
lea ecx, [esp + 0x28]
mov dword [esp + 0xac], edi
call fcn.100385c0
mov ecx, dword [esp + 0xa4]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xa0
ret 8