joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100043c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100280c8
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x10038a48]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [ebp + 8], 0
jne 0x10004406
mov eax, 0x57
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ebx, dword [ebp + 0xc]
test ebx, ebx
jne 0x10004416
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, eax
lea esi, [edi + 4]
push esi
mov dword [ebp + 0xc], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
cmp byte [edi + 0x1c], 0
je 0x1000443a
mov ebx, 0x4df
jmp 0x1000451d
mov eax, dword [ebp + 8]
mov dword [edi + 0x20], ebx
mov dword [edi + 0x28], eax
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x10004458
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x3c], 0
push 0
push 0
push dword [edi + 0x40]
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10004493
call ebx
mov ebx, eax
test ebx, ebx
jne 0x1000451d
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [edi + 0x30], 0
je 0x10004498
mov ebx, 0xb7
jmp 0x1000451d
mov dword [edi + 0x3c], eax
jmp 0x10004483
lea eax, [edi + 0x34]
push eax
push 0
push edi
push 0x10006800
push 0
push 0
call fcn.10018e2d
add esp, 0x18
test eax, eax
jne 0x100044c5
call ebx
mov ebx, eax
mov dword [edi + 0x34], 0
test ebx, ebx
je 0x100044c8
jmp 0x1000451d
mov dword [edi + 0x30], eax
push 0x2710
push dword [edi + 0x3c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x100044e1
mov ebx, 0x5b4
jmp 0x1000451d
mov ebx, dword [edi + 0x44]
test ebx, ebx
je 0x10004514
cmp dword [edi + 0x30], 0
je 0x1000451a
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x3e8
push dword [edi + 0x30]
call esi
cmp eax, 0x102
je 0x100044f4
test eax, eax
jne 0x1000451a
mov eax, dword [edi + 0x2c]
lea ecx, [edi + 0x2c]
call dword [eax + 4]
jmp 0x1000451a
mov byte [edi + 0x1c], 1
xor ebx, ebx
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x100049d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
mov ebx, ecx
cmp edi, 1
je 0x100049ef
cmp edi, 2
je 0x100049ef
pop edi
mov eax, 0xb
pop ebx
pop ebp
ret 0xc
push dword [ebp + 0xc]
call fcn.10001e70
add esp, 4
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 0xc]
push edi
push 0
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x100063c0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x10038a48]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
cmp byte [edi + 0x483], 0
je 0x100063ea
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp byte [edi + 0x480], 0
je 0x10006484
push ebx
push esi
call fcn.10001e50
add esp, 4
lea edx, [edi + 0xc]
mov ebx, eax
nop word [eax + eax]
mov ecx, 0x200
lea eax, [ebp - 0x404]
cmp ebx, ecx
cmovb ecx, ebx
sub ebx, ecx
mov dword [ebp - 0x408], ebx
test ecx, ecx
je 0x10006467
nop dword [eax]
mov dl, byte [esi]
dec ecx
inc esi
cmp dl, 0xd
jne 0x1000643d
mov bl, 1
jmp 0x10006451
cmp dl, 0xa
jne 0x1000644f
cmp byte [edi + 0x230], 0
jne 0x1000644f
mov byte [eax], 0xd
inc eax
xor bl, bl
mov byte [edi + 0x230], bl
mov byte [eax], dl
inc eax
test ecx, ecx
jne 0x10006430
mov ebx, dword [ebp - 0x408]
lea edx, [edi + 0xc]
lea ecx, [ebp - 0x404]
sub eax, ecx
je 0x1000647c
mov edx, dword [edx]
push eax
mov eax, ecx
lea ecx, [edi + 0xc]
push eax
call dword [edx]
lea edx, [edi + 0xc]
test ebx, ebx
jne 0x10006410
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100112fa
mov esp, ebp
pop ebp
ret 4

Function at 0x100064a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
jne 0x100064b4
xor al, al
pop esi
pop ebp
ret 8
push edi
mov edi, dword [ebp + 0xc]
push eax
push edi
push 1
push dword [ebp + 8]
call fcn.10018c6a
add esp, 0x10
cmp eax, edi
je 0x100064d9
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
xor al, al
pop esi
pop ebp
ret 8
cmp byte [esi + 0x226], 0
je 0x100064ed
push dword [esi + 4]
call fcn.10018122
add esp, 4
mov eax, dword [esi + 0x21c]
mov ecx, dword [esi + 0x220]
add eax, edi
mov dword [esi + 0x21c], eax
test ecx, ecx
je 0x1000652e
cmp eax, ecx
jb 0x1000652e
mov eax, dword [esi + 4]
test eax, eax
je 0x10006520
push eax
call fcn.10017dd1
add esp, 4
mov dword [esi + 4], 0
mov ecx, esi
call fcn.10003430
mov ecx, esi
call fcn.100048c0
pop edi
mov al, 1
pop esi
pop ebp
ret 8
Function at 0x10007920
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100283b1
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x10038a48]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
call fcn.100022b0
mov dword [ebp - 4], 0
mov dword [edi], vtable.TUsbAudioDeviceInterface.0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 8
mov dword [edi + 0x30], 0
mov byte [ebp - 4], 1
lea esi, [edi + 0x44]
xorps xmm0, xmm0
mov dword [ebp - 0x14], esi
push esi
movups xmmword [edi + 0x34], xmm0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [ebp - 4], 2
lea ecx, [esi + 0x18]
call fcn.10007d10
mov byte [ebp - 4], 4
xorps xmm0, xmm0
mov dword [edi + 0x84], 0
movups xmmword [edi + 0x88], xmm0
movq qword [edi + 0x98], xmm0
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000d820
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10027ff8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x10038a48]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
push ebx
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
mov esi, dword [ebp + 8]
test esi, esi
jne 0x1000d86f
mov edi, 0xee000041
jmp 0x1000d941
push esi
call fcn.10001e70
add esp, 4
test eax, eax
je 0x1000d865
push 0x20
push 0x1002dcd0
push esi
call fcn.10017d4f
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x1000d89c
mov edi, 0xee000090
jmp 0x1000d941
push 2
push 0
push esi
call fcn.1001842b
add esp, 0xc
push esi
test eax, eax
jne 0x1000d8c7
call fcn.10018a46
push 0
push 0
push esi
mov edi, eax
call fcn.1001842b
add esp, 0x10
test eax, eax
je 0x1000d8d6
push esi
call fcn.10017dd1
add esp, 4
mov edi, 0xee000001
jmp 0x1000d941
test edi, edi
jne 0x1000d8ea
push esi
call fcn.10017dd1
add esp, 4
mov edi, 0xee000054
jmp 0x1000d941
push edi
call fcn.100116c6
push esi
push edi
mov ebx, eax
push 1
push ebx
call fcn.10019bd2
add esp, 0x14
cmp edi, eax
je 0x1000d919
push ebx
call fcn.100116cf
push esi
call fcn.10017dd1
add esp, 8
mov edi, 0xee000091
jmp 0x1000d93e
mov ecx, dword [ebp - 0x10]
push edi
push ebx
add ecx, 0x670
call fcn.1000d970
push ebx
mov edi, eax
call fcn.100116cf
push esi
call fcn.10017dd1
add esp, 8
test edi, edi
jne 0x1000d93e
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1001f864
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1001f6da
Function at 0x449d80
Capabilities:
Query environment variable

Disassembly:
push ebp
sub ecx, 1
push edi
mov ebp, edx
push esi
mov esi, 1
push ebx
mov ebx, 0x66666667
sub esp, 0x2c
mov dword [esp + 0x1c], eax
mov eax, ecx
mov edi, dword [esp + 0x40]
sar eax, 0x1f
mov dword [esp + 0x14], eax
mov eax, ecx
imul ebx
mov dword [esp + 0x10], ecx
sar ecx, 0x1f
sar edx, 2
mov ebx, edx
sub ebx, ecx
je 0x449dd3
mov ecx, 0x66666667
mov eax, ebx
add esi, 1
imul ecx
sar ebx, 0x1f
sar edx, 2
sub edx, ebx
mov ebx, edx
jne 0x449dc0
mov eax, dword [edi + 0x28]
cmp eax, 0xffffffff
je 0x449e48
mov edx, dword [edi + 8]
cmp eax, esi
cmovge esi, eax
lea eax, [esi + 2]
cmp edx, eax
jg 0x449e41
mov dword [edi + 8], 0xffffffff
mov eax, dword [esp + 0x1c]
mov ecx, 1
mov edx, ebp
mov dword [esp], edi
add esi, 1
call fcn.004496f0
mov eax, dword [edi + 0x28]
mov dword [edi + 0xc], eax
mov eax, dword [edi + 4]
mov edx, eax
and eax, 0x20
or edx, 0x1c0
or eax, 0x45
mov dword [edi + 4], edx
mov edx, edi
call fcn.00449340
mov eax, dword [esp + 0x10]
mov ecx, edi
add dword [edi + 8], esi
mov edx, dword [esp + 0x14]
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00449ac0
sub edx, eax
mov dword [edi + 8], edx
jmp 0x449df1
mov edx, dword [0x4b156c]
cmp edx, 0xffffffff
je 0x449e71
test edx, edx
mov eax, 2
jne 0x449e69
call fcn.0044ec60
and eax, 1
neg eax
add eax, 3
mov dword [edi + 0x28], eax
jmp 0x449ddb
mov dword [esp], str.PRINTF_EXPONENT_DIGITS
call sub.msvcrt.dll_getenv
test eax, eax
je 0x449e97
movsx eax, byte [eax]
xor edx, edx
sub eax, 0x30
cmp eax, 2
setbe dl
mov dword [0x4b156c], edx
jmp 0x449e53
xor edx, edx
jmp 0x449e8f

Function at 0x481e10
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
sub esp, 0x1c
mov esi, dword [esp + 0x30]
mov ebx, dword [esp + 0x34]
mov ecx, edi
call fcn.00481c90
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.msvcrt.dll__read
cmp eax, 0xffffffff
mov ebp, eax
je 0x481e50
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 4
je 0x481e21
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8

Function at 0x4ae3c0
Capabilities:
Query environment variable

Disassembly:
push esi
mov esi, edx
push ebx
mov ebx, eax
sub esp, 0x14
mov dword [esp], str.ANDROID_PRODUCT_OUT
call sub.msvcrt.dll_getenv
test eax, eax
je 0x4ae3de
cmp byte [eax], 0
jne 0x4ae3ea
mov dword [esp], str.ANDROID_PRODUCT_OUT_not_set
call fcn.0040a700
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp], ebx
mov dword [esp + 4], str._s__s
call fcn.0042aed0
add esp, 0x14
mov eax, ebx
pop ebx
pop esi
ret
Function at 0x401150
Capabilities:
Access peb ldr_data
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
call section..text
movzx eax, al
cmp eax, 1
jne 0x40116e
push 5
pop eax
jmp 0x40133d
and dword [ebp - 0x40], 0
and dword [ebp - 0xc], 0
and dword [ebp - 0x30], 0
and dword [ebp - 0x14], 0
and dword [ebp - 0x24], 0
and dword [ebp - 0x44], 0
and dword [ebp - 8], 0
and dword [ebp - 0x18], 0
and dword [ebp - 0x1c], 0
and dword [ebp - 0x20], 0
mov dword [ebp - 0x2c], 0x330
pushal
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov ebx, eax
add ebx, 0xc
mov eax, dword [eax + 0xc]
mov edi, dword [eax + 0x30]
mov ecx, 0x18
xor esi, esi
xor ebx, ebx
add bl, byte [edi + ecx - 1]
add esi, ebx
loop 0x4011b9
cmp esi, dword [ebp - 0x2c]
je 0x4011ce
mov eax, dword [eax]
cmp eax, ebx
jne 0x4011af
mov eax, dword [eax + 0x18]
mov dword [ebp - 8], eax
nop
popal
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc], eax
push 0x415744
push dword [0x415728]
push 0x41572c
push dword [0x415744]
push 0x415748
call fcn.0040102b
add esp, 0x14
push 0x415748
push dword [ebp - 8]
call dword [ebp - 0xc]
mov dword [ebp - 0x30], eax
push 0x415764
push dword [0x415728]
push 0x41572c
push dword [0x415764]
push 0x415768
call fcn.0040102b
add esp, 0x14
push 0x415768
push dword [ebp - 8]
call dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
push 0x415784
push dword [0x415728]
push 0x41572c
push dword [0x415784]
push 0x415788
call fcn.0040102b
add esp, 0x14
push 0x415788
push dword [ebp - 8]
call dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [0x403040]
mov dword [ebp - 0x10], eax
push 4
push 0x1000
mov eax, dword [ebp - 0x10]
inc eax
push eax
push 0
call dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], 0x403048
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x10]
push eax
push dword [section..data]
push 0x403004
push dword [ebp - 0x10]
push dword [ebp - 4]
call fcn.0040102b
add esp, 0x14
mov dword [ebp - 4], eax
and dword [ebp - 0x34], 0
lea eax, [ebp - 0x34]
push eax
push 0x20
push dword [0x403040]
push dword [ebp - 4]
call dword [ebp - 0x24]
push 0x403724
push dword [0x403044]
push 0x4036e8
push dword [0x403724]
push 0x403728
call fcn.0040102b
add esp, 0x14
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 4]
mov dword [0x4157cc], eax
and dword [ebp - 0x28], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx + eax]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 1
push dword [ebp - 0x28]
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
call dword [0x4157cc]
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10001738
Capabilities:
Capture microphone audio

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
lea eax, [ebp + 0xc]
mov esi, ecx
push eax
mov ecx, 0x10071d6c
mov edi, edx
call fcn.10001fe6
mov edx, dword [ebp + 8]
xor eax, eax
inc eax
movzx ebx, di
mov word [0x1006faa8], ax
shr ebx, 3
movzx eax, si
imul eax, ebx
movd xmm0, edx
cvtdq2pd xmm0, xmm0
mov dword [0x1006faac], edx
mov word [0x1006fab6], di
shr di, 3
movzx ecx, di
push 0x30008
imul eax, edx
shr edx, 0x1f
mov word [0x1006faaa], si
addsd xmm0, qword [edx*8 + 0x100691b0]
mov dword [0x1006fab0], eax
movzx eax, si
xor esi, esi
imul ecx, eax
xor eax, eax
mov word [0x1006fab8], ax
cvtpd2ps xmm0, xmm0
push esi
push 0x10001893
push 0x1006faa8
push 0xffffffffffffffff
push 0x1006fac8
mov word [0x1006fab4], cx
mulss xmm0, dword [0x10069154]
cvttss2si eax, xmm0
imul ebx, eax
mov dword [0x1006fabc], eax
mov dword [0x1006fa80], ebx
call dword [sym.imp.WINMM.dll_waveInOpen]
mov ecx, esi
call fcn.10001816
inc esi
cmp esi, 2
jb 0x100017f1
push dword [0x1006fac8]
call dword [sym.imp.WINMM.dll_waveInStart]
pop edi
pop esi
lea ecx, [ebp + 0xc]
pop ebx
pop ebp
jmp fcn.10002000

Function at 0x10001816
Capabilities:
Capture microphone audio

Disassembly:
push ebx
push esi
push edi
push dword [0x1006fa80]
mov esi, ecx
mov ecx, 0x10071d2c
push esi
call fcn.10001e82
mov ecx, eax
call fcn.10001fbd
mov edi, dword [0x10071d68]
mov ebx, esi
shl ebx, 5
mov ecx, 0x10071d2c
push esi
add edi, ebx
call fcn.10001e82
mov ecx, eax
call fcn.10001fce
mov dword [edi], eax
mov eax, dword [0x1006fa80]
mov dword [edi + 4], eax
xor eax, eax
push 0x20
push edi
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
push dword [0x1006fac8]
call dword [sym.imp.WINMM.dll_waveInPrepareHeader]
mov eax, dword [0x10071d68]
push 0x20
add eax, ebx
push eax
push dword [0x1006fac8]
call dword [sym.imp.WINMM.dll_waveInAddBuffer]
pop edi
pop esi
pop ebx
ret
Function at 0x10001a9d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
movzx esi, word [0x1006fab6]
mov ebx, edx
push edi
movzx edi, word [0x1006faaa]
imul esi, edi
mov dword [ebp - 0x10], 1
mov dword [ebp - 0xc], 0x10
mov eax, esi
imul eax, dword [0x1006faac]
shr eax, 3
mov dword [ebp - 0x14], eax
mov eax, esi
cdq
xor esi, esi
and edx, 7
add eax, edx
push esi
sar eax, 3
push 0x80
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 4]
push 2
imul eax, edi
push esi
push esi
push 0x40000000
push ecx
mov dword [ebp - 0x1c], eax
add eax, 0x24
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10001b19
xor al, al
jmp 0x10001bff
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 4]
push eax
push 4
push 0x100624b0
push edi
call esi
push 0
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp - 8]
push eax
push edi
call esi
push 0
lea eax, [ebp - 4]
push eax
push 4
push str.WAVE
push edi
call esi
push 0
lea eax, [ebp - 4]
push eax
push 4
push str.fmt
push edi
call esi
push 0
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push edi
call esi
push 0
lea eax, [ebp - 4]
push eax
push 2
lea eax, [ebp - 0x10]
push eax
push edi
call esi
push 0
lea eax, [ebp - 4]
push eax
push 2
push 0x1006faaa
push edi
call esi
push 0
lea eax, [ebp - 4]
push eax
push 4
push 0x1006faac
push edi
call esi
push 0
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp - 0x14]
push eax
push edi
call esi
push 0
lea eax, [ebp - 4]
push eax
push 2
lea eax, [ebp - 0x18]
push eax
push edi
call esi
push 0
lea eax, [ebp - 4]
push eax
push 2
push 0x1006fab6
push edi
call esi
push 0
lea eax, [ebp - 4]
push eax
push 4
push str.data
push edi
call esi
push 0
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp - 0x1c]
push eax
push edi
call esi
push 0
lea ecx, [ebp - 4]
push ecx
push dword [ebx + 4]
push dword [ebx]
push edi
call esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10004a0a
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1006fadc]
sub esp, 0x1c
push ebx
push edi
push dword [eax + 0x10]
mov edi, ecx
push dword [eax + 0x18]
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x10004b5d
cmp byte [edi + 1], al
je 0x10004b59
cmp byte [edi + 0x31], al
je 0x10004a68
sub esp, 0x18
lea eax, [edi + 0x34]
mov ecx, esp
mov edx, str.TLS_Handshake...______
push eax
call fcn.10005449
sub esp, 0x14
mov ecx, esp
push 0x10062674
call fcn.100020bd
call fcn.100197d0
add esp, 0x30
call fcn.1001ee4b
mov dword [edi + 0x4c], eax
test eax, eax
jne 0x10004a83
sub esp, 0x18
mov ecx, esp
push str.TLS_Error_1
jmp 0x10004bbd
mov edx, dword [edi + 4]
mov ecx, eax
call fcn.1001f06f
cmp eax, 1
je 0x10004ac9
sub esp, 0x18
mov ecx, esp
push str.TLS_Error_2
call fcn.100020bd
sub esp, 0x18
mov ecx, esp
push 0x100625d8
call fcn.100020bd
call fcn.100197d0
add esp, 0x30
mov ecx, dword [edi + 0x4c]
call fcn.1001ee91
and dword [edi + 0x4c], 0
jmp 0x10004bd9
mov ecx, dword [edi + 0x4c]
call fcn.1001fb4f
cmp eax, 1
je 0x10004b06
sub esp, 0x18
mov ecx, esp
push str.TLS_Authentication_Failed
call fcn.100020bd
sub esp, 0x18
mov ecx, esp
push 0x100625d8
call fcn.100020bd
call fcn.100197d0
mov ecx, dword [edi + 0x4c]
add esp, 0x30
call fcn.1001f298
jmp 0x10004ab8
mov ecx, dword [edi + 0x4c]
call fcn.1001efe6
mov dword [edi + 0x50], eax
test eax, eax
jne 0x10004b3b
sub esp, 0x18
mov ecx, esp
push str.TLS_Error_3
call fcn.100020bd
sub esp, 0x18
mov ecx, esp
push 0x100625d8
call fcn.100020bd
call fcn.100197d0
add esp, 0x30
xor ebx, ebx
push ebx
push 1
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebx
push 1
push ebx
push ebx
mov dword [edi + 0x70], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x6c], eax
mov al, 1
jmp 0x10004bdb
cmp byte [edi + 0x31], 0
je 0x10004bd9
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
sub ecx, 0x2736
je 0x10004bd9
sub ecx, 0x17
je 0x10004bb3
mov edx, eax
lea ecx, [ebp - 0x1c]
call fcn.1001ad10
sub esp, 0x18
mov edx, str.Connection_Failed:
mov ecx, esp
push eax
call fcn.10005425
sub esp, 0x14
mov ecx, esp
push 0x100625d8
call fcn.100020bd
call fcn.100197d0
add esp, 0x30
lea ecx, [ebp - 0x1c]
call fcn.10002000
jmp 0x10004bd9
sub esp, 0x18
mov ecx, esp
push str.Connection_Refused
call fcn.100020bd
sub esp, 0x18
mov ecx, esp
push 0x100625d8
call fcn.100020bd
call fcn.100197d0
add esp, 0x30
xor al, al
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10004be3
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [ebp + 0xc]
call fcn.100024c2
xor ebx, ebx
lea ecx, [ebp - 0x1c]
push ebx
push 0xc
lea esi, [eax + 4]
call fcn.10005330
push ebx
lea ecx, [ebp - 0x1c]
call fcn.10005302
mov ecx, dword [edi + 0x2c]
push 4
mov dword [eax], ecx
lea ecx, [ebp - 0x1c]
call fcn.10005302
push 8
lea ecx, [ebp - 0x1c]
mov dword [eax], esi
call fcn.10005302
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x1c]
call fcn.1000346f
cmp byte [edi + 1], bl
jne 0x10004c60
push ebx
lea ecx, [ebp - 0x1c]
call fcn.100024c2
push eax
lea ecx, [ebp - 0x1c]
call fcn.10001fce
push eax
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_send]
mov esi, eax
jmp 0x10004c9b
or ebx, 0xffffffff
push ebx
push dword [edi + 0x70]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.100024c2
push eax
lea ecx, [ebp - 0x1c]
call fcn.10001fce
mov ecx, dword [edi + 0x50]
mov edx, eax
call fcn.1001f220
pop ecx
mov esi, eax
pop ecx
push dword [edi + 0x70]
test esi, esi
cmove esi, ebx
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea ecx, [ebp - 0x1c]
call fcn.10002000
lea ecx, [ebp + 0xc]
call fcn.10002000
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x10004cb6
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
cmp byte [edi + 1], 0
je 0x10004cef
push 0xffffffffffffffff
push dword [edi + 0x6c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp + 8]
push ecx
push dword [ebp + 0xc]
mov ecx, dword [edi + 0x4c]
call fcn.1001f25c
pop ecx
pop ecx
push dword [edi + 0x6c]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, esi
jmp 0x10004d00
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_recv]
pop edi
pop esi
pop ecx
pop ebp
ret 0xc

Function at 0x10004d07
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [ecx + 8], eax
xor eax, eax
push eax
push eax
push ecx
push 0x10004d26
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret 4