joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1006e120
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1016c0a8
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x101e0cf8]
xor eax, esp
mov dword [esp + 0x4c], eax
push ebx
push esi
push edi
mov eax, dword [0x101e0cf8]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
xor ebx, ebx
push 0x1d
mov esi, ecx
mov edi, 0xf
push str.izg::CIZPacketCreator::Unload
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.10003590
push 1
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x40]
mov dword [esp + 0x74], ebx
call fcn.100703f0
cmp dword [esp + 0x2c], 0x10
mov byte [esp + 0x68], 2
jb 0x1006e1ac
mov edx, dword [esp + 0x18]
push edx
call fcn.100bbe20
add esp, 4
mov dword [esp + 0x2c], edi
lea edi, [esi + 0xc]
mov ecx, edi
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
mov dword [esp + 0x30], edi
call fcn.100e9e20
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
push ecx
mov ecx, esi
mov byte [esp + 0x6c], 3
call fcn.1006cc10
mov eax, dword [esi + 4]
mov dword [eax + 4], eax
mov eax, dword [esi + 4]
mov dword [esi + 8], ebx
mov dword [eax], eax
mov esi, dword [esi + 4]
mov dword [esi + 8], esi
mov ecx, edi
mov dword [esp + 0x10], ebx
mov byte [esp + 0x68], 2
call fcn.100ea1a0
lea ecx, [esp + 0x34]
mov dword [esp + 0x68], 0xffffffff
call fcn.10070560
xor eax, eax
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.100bc9af
add esp, 0x5c
ret

Function at 0x10073ac0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1016ccaf
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101e0cf8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
push 0x4d
call fcn.1000d900
push 0x4d
lea ecx, [esi + 0x10]
mov dword [esp + 0x18], 0
call fcn.1000d900
push 0x4d
lea ecx, [esi + 0x20]
mov byte [esp + 0x18], 1
call fcn.1000d900
push 0x4d
lea ecx, [esi + 0x30]
mov byte [esp + 0x18], 2
call fcn.1000d900
push 0x4d
lea ecx, [esi + 0x40]
mov byte [esp + 0x18], 3
call fcn.1000d900
lea ecx, [esi + 0x50]
mov byte [esp + 0x14], 4
call fcn.100774f0
push 0x4d
lea ecx, [esi + 0x70]
mov byte [esp + 0x18], 5
call fcn.1000d900
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x10073b60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1016cd0f
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101e0cf8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
lea ecx, [esi + 0x70]
mov dword [esp + 0x14], 5
call fcn.1000d9b0
lea ecx, [esi + 0x50]
mov byte [esp + 0x14], 4
call fcn.10077540
lea ecx, [esi + 0x40]
mov byte [esp + 0x14], 3
call fcn.1000d9b0
lea ecx, [esi + 0x30]
mov byte [esp + 0x14], 2
call fcn.1000d9b0
lea ecx, [esi + 0x20]
mov byte [esp + 0x14], 1
call fcn.1000d9b0
lea ecx, [esi + 0x10]
mov byte [esp + 0x14], 0
call fcn.1000d9b0
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.1000d9b0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x10077550
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1016d678
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x101e0cf8]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 8]
mov ecx, eax
sub ecx, 0x13
je 0x100775dc
sub ecx, 1
jne 0x100775ee
lea ecx, [esp + 8]
call fcn.100774f0
mov eax, dword [esi]
mov edx, dword [eax + 0x60]
mov ecx, esi
mov dword [esp + 0x30], 0
call edx
mov edx, dword [eax]
mov edx, dword [edx + 0xc]
lea ecx, [esp + 8]
push ecx
mov ecx, eax
call edx
lea ecx, [esp + 8]
call fcn.10077550
lea ecx, [esp + 8]
mov esi, eax
mov dword [esp + 0x30], 0xffffffff
call fcn.10077540
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret
mov eax, dword [esi]
mov edx, dword [eax + 0x5c]
mov ecx, esi
call edx
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret
Function at 0x10077ae0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1016d728
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x101e0cf8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 8]
cmp eax, 0x14
jne 0x10077b22
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
mov edx, dword [esp + 0x40]
mov eax, dword [eax + 8]
push edx
jmp 0x10077bf8
cmp eax, 0x13
jne 0x10077b4e
mov ecx, dword [esi + 0x10]
mov edx, dword [ecx]
mov eax, dword [esp + 0x40]
mov edx, dword [edx + 0xd4]
push eax
call edx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x2c
ret 4
mov edi, dword [esp + 0x40]
mov eax, dword [edi + 8]
sub eax, 0x13
je 0x10077be4
sub eax, 1
je 0x10077b85
mov eax, dword [esi]
mov edx, dword [eax + 0xd0]
push 0
push edi
call edx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x2c
ret 4
lea ecx, [esp + 0x10]
call fcn.100774f0
mov eax, dword [edi]
mov edx, dword [eax + 0x60]
mov ecx, edi
mov dword [esp + 0x38], 0
call edx
mov edx, dword [eax]
mov edx, dword [edx + 0xc]
lea ecx, [esp + 0x10]
push ecx
mov ecx, eax
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0xd4]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call edx
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], 0xffffffff
call fcn.10077540
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x2c
ret 4
mov eax, dword [edi]
mov edx, dword [eax + 0x5c]
mov ebx, dword [esi]
mov ecx, edi
call edx
push eax
mov eax, dword [ebx + 0xd4]
mov ecx, esi
call eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x2c
ret 4
Function at 0x1007ff20
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1016e163
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101e0cf8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
push eax
push ecx
push edx
mov ecx, esi
call fcn.1009a280
xor eax, eax
push 0x4d
lea ecx, [esi + 0x30]
mov dword [esp + 0x18], eax
mov dword [esi], vtable.EENUnexpectedException.0
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
call fcn.1000d900
push esi
push 0x22
push 0x101841c0
push str.ENStd
mov byte [esp + 0x24], 1
call fcn.10080f60
add esp, 0x10
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0xc

Function at 0x1007ffb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1016e193
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101e0cf8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
push eax
push ecx
push edx
mov ecx, esi
call fcn.1009a280
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov eax, dword [esp + 0x28]
push 0x4d
push eax
lea ecx, [esi + 0x30]
mov dword [esi], vtable.EENUnexpectedException.0
call fcn.1000d930
push esi
push 0x2d
push 0x101841c0
push str.ENStd
mov byte [esp + 0x24], 1
call fcn.10080f60
add esp, 0x10
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x10

Function at 0x10080040
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1016e1c3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101e0cf8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
push eax
push ecx
push edx
mov ecx, esi
call fcn.1009a280
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esi + 0x28], eax
mov eax, dword [esp + 0x28]
push 0x4d
lea ecx, [esi + 0x30]
mov dword [esi], vtable.EENUnexpectedException.0
mov dword [esi + 0x2c], eax
call fcn.1000d900
push esi
push 0x37
push 0x101841c0
push str.ENStd
mov byte [esp + 0x24], 1
call fcn.10080f60
add esp, 0x10
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x10
Function at 0x100800d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1016e1f3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101e0cf8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
push eax
push ecx
push edx
mov ecx, esi
call fcn.1009a280
mov ecx, dword [esp + 0x28]
xor eax, eax
mov dword [esi + 0x28], ecx
push 0x4d
lea ecx, [esi + 0x30]
mov dword [esp + 0x18], eax
mov dword [esi], vtable.EENUnexpectedException.0
mov dword [esi + 0x2c], eax
call fcn.1000d900
push esi
push 0x41
push 0x101841c0
push str.ENStd
mov byte [esp + 0x24], 1
call fcn.10080f60
add esp, 0x10
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x10

Function at 0x10080160
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1016e218
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101e0cf8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.EENUnexpectedException.0
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], 0
call fcn.1000d9b0
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.1009a2f0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x10081450
Capabilities:
Create thread
Resume thread

Disassembly:
push 0xffffffffffffffff
push 0x1016e53b
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x101e0cf8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esp + 0xc]
push eax
push 4
push esi
push 0x10081390
push 0
push 0
call fcn.100c0edb
add esp, 0x18
test eax, eax
mov dword [esi + 0x18], eax
jne 0x100814e5
push 0x28
mov byte [esi + 0x16], al
call fcn.100bbdb6
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
mov dword [esp + 0x1c], 0
je 0x100814c8
push 0x6c
push str.ENThreadController.cpp
push str.ENStd
mov ecx, eax
call fcn.100b0fe0
jmp 0x100814ca
xor eax, eax
push 0x101ac2a8
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x10], eax
call fcn.100bcb39
mov eax, dword [esp + 0xc]
push eax
push str.CENThreadController::Start______08x
push 1
push 0x71
push str.ENThreadController.cpp
push str.ENStd
mov dword [esi + 0x1c], eax
call fcn.10081350
mov edx, dword [esi + 0x18]
add esp, 0x18
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x18
ret
Function at 0x100899c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1016f2c6
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x101e0cf8]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
push eax
push ecx
push edx
mov ecx, esi
call fcn.1009a280
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
mov eax, dword [esp + 0x3c]
push 0x4d
mov dword [esi + 0x2c], ecx
push edx
lea ecx, [esi + 0x30]
mov dword [esp + 0x30], 0
mov dword [esi], vtable.EENXmlException.0
mov dword [esi + 0x28], eax
call fcn.1000d930
lea edi, [esi + 0x40]
push 0x4d
mov ecx, edi
mov byte [esp + 0x2c], 1
call fcn.1000d900
mov ecx, dword [esp + 0x48]
test ecx, ecx
mov byte [esp + 0x28], 2
je 0x10089a75
mov eax, dword [ecx]
mov eax, dword [eax + 0x60]
push 0
lea edx, [esp + 0x14]
push edx
call eax
mov edx, dword [edi]
push eax
mov eax, dword [edx + 0x38]
mov ecx, edi
mov byte [esp + 0x2c], 3
call eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 2
call fcn.1000d9b0
push esi
push 0x2f
push str.ENXmlException.cpp
push str.ENStd
call fcn.10080f60
add esp, 0x10
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 0x1c

Function at 0x10089aa0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1016f303
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101e0cf8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.EENXmlException.0
lea ecx, [esi + 0x40]
mov dword [esp + 0x14], 1
call fcn.1000d9b0
lea ecx, [esi + 0x30]
mov byte [esp + 0x14], 0
call fcn.1000d9b0
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.1009a2f0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x10089e20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
cmp dword [ecx + 0x20], 1
mov eax, dword [esp + 0x10]
mov dword [esp], eax
mov dword [esp + 0x10], 0
jne 0x10089e95
mov eax, dword [esp + 8]
mov ecx, dword [ecx + 0x1c]
lea edx, [esp + 0x10]
push edx
push 0x20019
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10089e95
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
lea edx, [esp]
push edx
mov edx, dword [esp + 0x14]
push eax
push 0
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10089e8a
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop ecx
ret 0x10
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop ecx
ret 0x10
Function at 0x10089ea0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x14]
mov ecx, dword [ecx + 0x1c]
lea edx, [esp]
push edx
mov edx, dword [esp + 0x14]
push 0
push 0
push 0
mov dword [esp + 0x24], eax
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 0x20]
push edx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
neg eax
sbb eax, eax
add eax, 1
add esp, 8
ret 0xc

Function at 0x1008a0e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebp
mov ebp, ecx
cmp dword [ebp + 8], 0
jne 0x1008a0f3
mov eax, dword [esp + 0x10]
pop ebp
pop ecx
ret 8
xor ecx, ecx
mov eax, 0x100
mov dword [esp + 4], eax
mov edx, 2
mul edx
seto cl
push esi
push edi
neg ecx
or ecx, eax
push ecx
call fcn.100b9926
mov esi, eax
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.100b9926
mov ecx, dword [esp + 0x14]
mov edi, eax
mov eax, dword [esp + 0x20]
push eax
push ecx
push esi
call fcn.100c0fee
mov eax, dword [esp + 0x28]
mov ecx, dword [ebp + 4]
add esp, 0x14
lea edx, [esp + 0xc]
push edx
push edi
push 0
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1008a171
mov edx, dword [esp + 0xc]
push edi
push edx
push esi
call fcn.100c0fee
add esp, 0xc
push edi
call fcn.100bcb83
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebp
pop ecx
ret 8

Function at 0x1008a210
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
cmp dword [ecx + 8], 0
mov eax, dword [esp + 0xc]
je 0x1008a247
mov dword [esp + 0xc], eax
lea edx, [esp]
push edx
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push 0
push 0
push edx
push eax
mov dword [esp + 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [esp + 0xc]
pop ecx
ret 8

Function at 0x1008aae0
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x14]
mov ecx, edi
mov dword [esi], eax
call fcn.100b4690
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
test eax, eax
mov dword [esi + 4], eax
jne 0x1008ab1f
mov ecx, esi
call fcn.1008a800
mov ecx, edi
call fcn.100b4680
pop edi
or eax, 0xffffffff
pop esi
ret 4
lea ecx, [esi + 0xc]
push ecx
push 0
push esi
push 0x1008aad0
push 0
push 0
call fcn.100c0edb
add esp, 0x18
test eax, eax
mov dword [esi + 8], eax
je 0x1008ab09
mov edx, dword [esi + 4]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, esi
call fcn.1008a800
mov ecx, edi
call fcn.100b4680
mov eax, dword [esi + 0x10]
pop edi
pop esi
ret 4
Function at 0x1008e500
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x1016f730
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101e0cf8]
xor eax, esp
push eax
lea eax, [esp + 0x5c]
mov dword fs:[0], eax
mov edi, ecx
movzx eax, word [esp + 0x70]
mov ebx, dword [esp + 0x6c]
push 1
push 0
lea ecx, [esp + 0x78]
push ecx
mov ecx, ebx
mov dword [esp + 0x7c], eax
call fcn.100082f0
mov esi, eax
cmp esi, 0xffffffff
jne 0x1008e557
mov eax, reloc.WS2_32.dll_closesocket
jmp 0x1008e60f
push esi
push 0
lea edx, [esp + 0x2c]
push edx
mov ecx, ebx
call fcn.100095a0
push eax
lea eax, [esp + 0x18]
push eax
mov ecx, edi
mov dword [esp + 0x6c], 0
call fcn.1008e1d0
cmp dword [esp + 0x3c], 8
mov dword [esp + 0x64], 0xffffffff
jb 0x1008e597
mov ecx, dword [esp + 0x28]
push ecx
call fcn.100bbe20
add esp, 4
mov ebp, dword [esp + 0x14]
cmp edi, ebp
mov edx, dword [edi + 4]
mov dword [esp + 0x20], edx
je 0x1008e5ab
call fcn.100bcb20
mov edi, dword [esp + 0x18]
cmp dword [esp + 0x20], edi
je 0x1008e54d
test ebp, ebp
jne 0x1008e5be
call fcn.100bcb20
cmp edi, dword [ebp + 4]
jne 0x1008e5c8
call fcn.100bcb20
mov eax, dword [edi + 0x28]
mov ecx, dword [esp + 0x74]
push 0xffffffffffffffff
add esi, 1
push esi
lea edx, [esp + 0x48]
mov dword [ecx], eax
push edx
mov ecx, ebx
call fcn.100095a0
mov ecx, dword [esp + 0x78]
push 0xffffffffffffffff
push 0
push eax
mov dword [esp + 0x70], 1
call fcn.10003660
cmp dword [esp + 0x58], 8
jb 0x1008e60d
mov eax, dword [esp + 0x44]
push eax
call fcn.100bbe20
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x54
ret 0x10

Function at 0x1008e630
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1016f758
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x101e0cf8]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
push edi
mov eax, dword [0x101e0cf8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, dword [esp + 0x40]
xor edi, edi
mov dword [esp + 0xc], edi
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], edi
mov word [esp + 0x14], di
lea edx, [esp + 0x10]
push edx
lea edx, [esp + 0x10]
push edx
push 0x3a
push eax
mov dword [esp + 0x48], edi
call fcn.1008e500
mov esi, eax
cmp esi, edi
jne 0x1008e6ac
mov ecx, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
call fcn.1008e2c0
mov esi, eax
cmp dword [esp + 0x28], 8
jb 0x1008e6c0
mov eax, dword [esp + 0x14]
push eax
call fcn.100bbe20
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.100bc9af
add esp, 0x30
ret 8
Function at 0x10097020
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x10170966
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x101e0cf8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
lea edi, [esi + 0xc]
xor ebx, ebx
mov ecx, edi
mov dword [esi], vtable.CENMIMEEntity.0
mov dword [esi + 4], ebx
mov dword [esi + 8], 0xffffffff
call fcn.10092f30
mov dword [edi + 4], eax
mov byte [eax + 0x2d], 1
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov dword [edi + 8], ebx
lea ecx, [esi + 0x18]
mov dword [esp + 0x1c], ebx
call fcn.10069fd0
push str.CENMIMEEntity::CENMIMEEntity__void__
push 0x25
push str.ENMIMEEntity.cpp
push str.ENMIME
mov byte [esp + 0x2c], 1
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x30], bl
mov dword [esi + 0x34], ebx
call fcn.10080c00
push str.CENMIMEEntity::CENMIMEEntity__void__
push 0x27
push str.ENMIMEEntity.cpp
push str.ENMIME
mov dword [esp + 0x3c], 1
call fcn.10080d20
add esp, 0x20
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x1009a560
Capabilities:
Resolve dns

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x1c]
mov dword [esi], 0
push ecx
mov byte [eax], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ecx, eax
test ecx, ecx
mov dword [esp + 0x1c], ecx
je 0x1009a604
cmp word [ecx + 8], 2
push ebx
push ebp
push edi
jne 0x1009a5d5
cmp word [ecx + 0xa], 4
jne 0x1009a5d5
mov edi, dword [ecx + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x1009a5d5
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
lea esp, [esp]
mov edx, dword [eax]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebx
push ebp
call fcn.1009a4f0
test eax, eax
mov dword [esi], eax
je 0x1009a5f8
add edi, 4
lea esi, [eax + 0x1c]
mov eax, dword [edi]
test eax, eax
jne 0x1009a5b0
mov ecx, dword [esp + 0x28]
mov ecx, dword [ecx]
mov edx, dword [esp + 0x24]
push 0x400
push ecx
push 0x401
push edx
call fcn.100c135f
add esp, 0x10
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
ret 0x18
pop edi
pop ebp
pop ebx
mov eax, 8
pop esi
ret 0x18
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
add eax, 0xffffd507
cmp eax, 3
ja case.0x1009a614.11001
jmp dword [eax*4 + 0x1009a638]
mov eax, 0x2af9
pop esi
ret 0x18
mov eax, 0x2afa
pop esi
ret 0x18
mov eax, 0x2afb
pop esi
ret 0x18
Function at 0x1009ae70
Capabilities:
Get common file path

Disassembly:
sub esp, 0x230
mov eax, dword [0x101e0cf8]
xor eax, esp
mov dword [esp + 0x22c], eax
cmp dword [0x101e3fc0], 0
mov dword [esp], str.getaddrinfo
mov dword [esp + 4], 0x1009a8c0
mov dword [esp + 8], str.getnameinfo
mov dword [esp + 0xc], 0x1009abb0
mov dword [esp + 0x10], str.freeaddrinfo
mov dword [esp + 0x14], fcn.1009a870
je 0x1009aee2
movzx eax, word [esp + 0x234]
mov eax, dword [eax*8 + 0x101e0608]
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.100bc9af
add esp, 0x230
ret 4
push 0x104
lea ecx, [esp + 0x128]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1009afdf
push ebx
push ebp
push esi
push edi
lea edx, [esp + 0x134]
push edx
lea eax, [esp + 0x2c]
push 0x10c
push eax
call fcn.100c119d
push str.ws2_32
lea ecx, [esp + 0x38]
push 0x10c
push ecx
call fcn.100c1412
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 0x18
lea edx, [esp + 0x28]
push edx
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x1009af5d
push str.getaddrinfo
push esi
call ebx
test eax, eax
jne 0x1009afa4
push esi
call ebp
lea eax, [esp + 0x134]
push eax
lea ecx, [esp + 0x2c]
push 0x10c
push ecx
call fcn.100c119d
push str.wship6
lea edx, [esp + 0x38]
push 0x10c
push edx
call fcn.100c1412
add esp, 0x18
lea eax, [esp + 0x28]
push eax
call edi
mov esi, eax
test esi, esi
je 0x1009afdb
push str.getaddrinfo
push esi
call ebx
test eax, eax
je 0x1009b00f
xor edi, edi
mov ecx, dword [esp + edi*8 + 0x10]
push ecx
push esi
call ebx
test eax, eax
mov dword [esp + edi*8 + 0x14], eax
je 0x1009b00f
add edi, 1
cmp edi, 3
jl 0x1009afa6
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
mov dword [0x101e0608], edx
mov dword [0x101e0610], eax
mov dword [fcn.1009a870], ecx
pop edi
pop esi
pop ebp
pop ebx
movzx edx, word [esp + 0x234]
mov ecx, dword [esp + 0x22c]
mov eax, dword [edx*8 + 0x101e0608]
xor ecx, esp
mov dword [0x101e3fc0], 1
call fcn.100bc9af
add esp, 0x230
ret 4
push esi
call ebp
jmp 0x1009afdb