joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002e359
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x100d85d1
call fcn.100ac440
sub esp, 0x224
mov eax, dword [0x1011c710]
and word [ebp - 0x218], 0
push esi
push edi
xor eax, ebp
mov dword [ebp - 0x10], eax
push 0x40
mov esi, ecx
pop ecx
xor eax, eax
lea edi, [ebp - 0x216]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x218]
push str.CLSIDD27CDB6E_AE6D_11cf_96B8_444553540000InprocServer32
push eax
call fcn.100acf5b
pop ecx
pop ecx
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x1002e494
and word [ebp - 0x114], ax
push 0x40
pop ecx
lea edi, [ebp - 0x112]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x224]
push eax
push 0
push 0x100e2d52
push dword [ebp - 0x21c]
mov dword [ebp - 0x224], 1
mov dword [ebp - 0x228], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
push dword [ebp - 0x21c]
je 0x1002e424
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1002e494
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x230]
call fcn.1001e5ef
and dword [ebp - 4], 0
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x230]
call fcn.1001e60d
test eax, eax
je 0x1002e485
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x230]
call fcn.1002d792
lea eax, [ebp - 0x220]
lea ecx, [esi + 0x220]
push eax
mov byte [ebp - 4], 1
call fcn.10001eb6
mov ecx, dword [ebp - 0x220]
add ecx, 0xfffffff0
call fcn.10001199
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.1001e6bd
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop edi
xor ecx, ebp
pop esi
call fcn.100ac33f
leave
ret
Function at 0x1002e565
Capabilities:
Delete file

Disassembly:
mov eax, 0x100d8605
call fcn.100ac440
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
xor ebx, ebx
cmp dword [ebp + 8], ebx
lea edi, [esi + 0x200]
mov eax, dword [edi]
je 0x1002e6a4
cmp dword [eax - 0xc], ebx
je 0x1002e5b5
lea eax, [esi + 0x1f8]
push edi
push eax
call fcn.10008590
test al, al
pop ecx
pop ecx
je 0x1002e5b5
push dword [edi]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [esi + 0x1fc]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esi + 0x1f8]
push edi
push eax
mov dword [ebp + 8], eax
call fcn.10008590
test al, al
pop ecx
pop ecx
je 0x1002e6d6
lea ecx, [esi + 0x1fc]
add esi, 0x1f4
push esi
call fcn.10001eb6
push dword [ebp + 8]
mov ecx, edi
call fcn.10001eb6
call fcn.100c6d12
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp + 8], eax
push 0x5c
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.10003e18
mov ecx, dword [edi]
mov ecx, dword [ecx - 0xc]
sub ecx, eax
dec ecx
push ecx
lea eax, [ebp - 0x10]
push eax
mov ecx, edi
call fcn.10008b05
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call fcn.10001eb6
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], bl
call fcn.10001199
push 0x2e
lea ecx, [ebp + 8]
call fcn.10003e18
add eax, 0xfffffffc
push eax
push 4
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp + 8]
call fcn.10003ff3
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 2
call fcn.10001eb6
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], bl
call fcn.10001199
push 0x100e3ab4
push ebx
lea ecx, [ebp + 8]
call fcn.1000192d
push eax
push str.tickName
push str.PPSADV
call fcn.10002987
push 0xffffffffffffffff
lea ecx, [ebp + 8]
call fcn.1000170f
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.10001199
jmp 0x1002e6d6
cmp dword [eax - 0xc], ebx
je 0x1002e6d6
lea ebx, [esi + 0x1f8]
push edi
push ebx
call fcn.10008590
test al, al
pop ecx
pop ecx
je 0x1002e6d6
lea eax, [esi + 0x1fc]
push eax
lea ecx, [esi + 0x1f4]
call fcn.10001eb6
push edi
mov ecx, ebx
call fcn.10001eb6
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x10032d3f
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x100d8589
call fcn.100ac440
sub esp, 0xc
push esi
xor esi, esi
cmp dword [ecx + 0x7c], esi
mov dword [ebp - 0x18], ecx
je 0x10032e07
push ebx
push edi
push 0x100e2d52
lea ecx, [ebp - 0x10]
call fcn.1000223a
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], esi
call ebx
push eax
lea eax, [ebp - 0x10]
push 0x100e2dcc
push eax
call fcn.10001d75
add esp, 0xc
mov edi, 0x100e3ab4
push edi
push esi
lea ecx, [ebp - 0x10]
call fcn.1000192d
push eax
push str.AdEndTick
mov esi, str.Player
push esi
call fcn.10002987
push edi
push 0
push str.AdStartTick
push esi
call fcn.100027f5
test eax, eax
mov dword [ebp - 0x14], eax
jbe 0x10032dfa
call ebx
sub eax, dword [ebp - 0x14]
xor edx, edx
mov ecx, 0x3e8
div ecx
push eax
lea eax, [ebp - 0x10]
push 0x100e2dcc
push eax
call fcn.10001d75
add esp, 0xc
push edi
push 0
lea ecx, [ebp - 0x10]
call fcn.1000192d
push eax
push str.AllAdFileDLTime
push esi
call fcn.10002987
mov eax, dword [ebp - 0x18]
and dword [eax + 0x7c], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.10001199
pop edi
pop ebx
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x1003e6b8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x94]
sub esp, 0x114
mov eax, dword [0x1011c710]
xor eax, ebp
mov dword [ebp + 0x90], eax
mov eax, dword [ebp + 0x9c]
push edi
mov edi, dword [ebp + 0xa0]
push eax
lea eax, [ebp - 0x74]
push str.CLSID_sInprocServer32
push eax
call fcn.100acf5b
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x1003e70d
xor eax, eax
jmp 0x1003e746
push esi
lea eax, [ebp - 0x7c]
push eax
push edi
lea eax, [ebp - 0x80]
push eax
push 0
push 0x100e2d52
push dword [ebp - 0x78]
xor esi, esi
inc esi
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x7c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x1003e73a
xor esi, esi
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov ecx, dword [ebp + 0x90]
xor ecx, ebp
pop edi
call fcn.100ac33f
add ebp, 0x94
leave
ret 8

Function at 0x1003e954
Capabilities:
Delete file
Move file
Set file attributes

Disassembly:
mov eax, 0x100d9a69
call fcn.100ac440
sub esp, 0x18
push ebx
mov ebx, ecx
cmp dword [ebp + 0x10], 0
mov dword [ebp - 4], 1
jne 0x1003e98c
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.10001199
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.10001199
jmp 0x1003eaa0
push esi
push edi
call fcn.100c6d12
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 2
call fcn.100c7273
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push dword [ebp + 0xc]
mov byte [ebp - 4], 3
push 0x100e2db4
push eax
call fcn.10001d75
add esp, 0x10
push 0
lea ecx, [ebp + 0xc]
call fcn.1000192d
mov ecx, dword [ebx + 0x7c]
mov edi, 0x10000000
push edi
mov esi, str.everyone
push esi
push eax
call fcn.1006df5a
push 0
lea ecx, [ebp - 0x10]
call fcn.1000192d
mov ecx, dword [ebx + 0x7c]
push edi
push esi
push eax
call fcn.1006df5a
mov edi, dword [ebp - 0x10]
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
mov esi, 0x9041
push esi
push edi
lea ecx, [ebp - 0x24]
call fcn.100c751b
test eax, eax
jne 0x1003ea5e
push str..bak
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10001e18
mov eax, dword [eax]
add esp, 0xc
push 1
push eax
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.10001199
push 0
push esi
push edi
lea ecx, [ebp - 0x24]
call fcn.100c751b
push dword [ebp + 0x14]
lea ecx, [ebp - 0x24]
push dword [ebp + 0x10]
call fcn.100c6fc1
lea ecx, [ebp - 0x24]
call fcn.100c7211
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 2
call fcn.100c72b2
lea ecx, [edi - 0x10]
call fcn.10001199
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.10001199
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.10001199
pop edi
pop esi
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10
Function at 0x1003ed27
Capabilities:
Delete file

Disassembly:
mov eax, 0x100d9ad7
call fcn.100ac440
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
xor ebx, ebx
cmp dword [ebp + 8], ebx
lea edi, [esi + 0xe0]
mov eax, dword [edi]
je 0x1003ee66
cmp dword [eax - 0xc], ebx
je 0x1003ed77
lea eax, [esi + 0xd4]
push edi
push eax
call fcn.10008590
test al, al
pop ecx
pop ecx
je 0x1003ed77
push dword [esi + 0xdc]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esi + 0xd4]
push edi
push eax
mov dword [ebp + 8], eax
call fcn.10008590
test al, al
pop ecx
pop ecx
je 0x1003ee98
lea ecx, [esi + 0xdc]
add esi, 0xc0
push esi
call fcn.10001eb6
push dword [ebp + 8]
mov ecx, edi
call fcn.10001eb6
call fcn.100c6d12
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp + 8], eax
push 0x5c
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.10003e18
mov ecx, dword [edi]
mov ecx, dword [ecx - 0xc]
sub ecx, eax
dec ecx
push ecx
lea eax, [ebp - 0x10]
push eax
mov ecx, edi
call fcn.10008b05
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call fcn.10001eb6
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], bl
call fcn.10001199
push 0x2e
lea ecx, [ebp + 8]
call fcn.10003e18
add eax, 0xfffffffd
push eax
push 3
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp + 8]
call fcn.10003ff3
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 2
call fcn.10001eb6
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], bl
call fcn.10001199
push 0x100e3ab4
push ebx
lea ecx, [ebp + 8]
call fcn.1000192d
push eax
push str.BrName
push str.PPSADV
call fcn.10002987
push 0xffffffffffffffff
lea ecx, [ebp + 8]
call fcn.1000170f
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.10001199
jmp 0x1003ee98
cmp dword [eax - 0xc], ebx
je 0x1003ee98
lea ebx, [esi + 0xd4]
push edi
push ebx
call fcn.10008590
test al, al
pop ecx
pop ecx
je 0x1003ee98
lea eax, [esi + 0xdc]
push eax
lea ecx, [esi + 0xc0]
call fcn.10001eb6
push edi
mov ecx, ebx
call fcn.10001eb6
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x1004481f
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x18]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x1c]
and dword [edi], 0
push dword [ebp + 8]
mov byte [eax], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebx, eax
test ebx, ebx
je 0x10044898
cmp word [ebx + 8], 2
jne 0x10044875
cmp word [ebx + 0xa], 4
jne 0x10044875
mov esi, dword [ebx + 0xc]
jmp 0x1004486f
push dword [eax]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.100447bc
test eax, eax
mov dword [edi], eax
je 0x10044893
lea edi, [eax + 0x1c]
add esi, 4
mov eax, dword [esi]
test eax, eax
jne 0x10044853
mov esi, dword [ebp + 0x18]
push 0x400
push dword [ebx]
push esi
call fcn.100ae2d0
add esp, 0xc
mov byte [esi + 0x400], 0
xor eax, eax
jmp 0x100448be
push 8
pop eax
jmp 0x100448be
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
mov eax, 0x2af9
sub ecx, eax
je 0x100448be
dec ecx
je 0x100448b9
dec ecx
je 0x100448b2
dec ecx
jmp 0x100448be
mov eax, 0x2afb
jmp 0x100448be
mov eax, 0x2afa
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
Function at 0x10044e9f
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x1b0]
sub esp, 0x230
mov eax, dword [0x1011c710]
xor eax, ebp
cmp dword [0x10125054], 0
mov dword [ebp + 0x1ac], eax
mov dword [ebp - 0x80], str.getaddrinfo
mov dword [ebp - 0x7c], 0x10044a77
mov dword [ebp - 0x78], str.getnameinfo
mov dword [ebp - 0x74], 0x10044cf1
mov dword [ebp - 0x70], str.freeaddrinfo
mov dword [ebp - 0x6c], fcn.10044a3e
jne 0x10044ff6
push 0x104
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x10044fec
push ebx
push esi
push edi
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp + 0xa0]
push eax
call fcn.100ac900
lea eax, [ebp + 0xa0]
push str.ws2_32
push eax
call fcn.100ac910
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 0x10
lea eax, [ebp + 0xa0]
push eax
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x10044f63
push str.getaddrinfo
push esi
call edi
test eax, eax
jne 0x10044f5f
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor esi, esi
test esi, esi
jne 0x10044faf
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp + 0xa0]
push eax
call fcn.100ac900
lea eax, [ebp + 0xa0]
push str.wship6
push eax
call fcn.100ac910
add esp, 0x10
lea eax, [ebp + 0xa0]
push eax
call ebx
mov esi, eax
test esi, esi
je 0x10044fe9
push str.getaddrinfo
push esi
call edi
test eax, eax
jne 0x10044fab
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor esi, esi
test esi, esi
je 0x10044fe9
xor ebx, ebx
push dword [ebp + ebx*8 - 0x80]
push esi
call edi
test eax, eax
mov dword [ebp + ebx*8 - 0x7c], eax
je 0x10044fc8
inc ebx
cmp ebx, 3
jl 0x10044fb1
jmp 0x10044fd1
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor esi, esi
test esi, esi
je 0x10044fe9
xor eax, eax
mov ecx, dword [ebp + eax - 0x7c]
mov dword [eax + 0x1011a474], ecx
add eax, 8
cmp eax, 0x18
jl 0x10044fd7
pop edi
pop esi
pop ebx
mov dword [0x10125054], 1
movzx eax, word [ebp + 0x1b8]
mov ecx, dword [ebp + 0x1ac]
mov eax, dword [eax*8 + 0x1011a474]
xor ecx, ebp
call fcn.100ac33f
add ebp, 0x1b0
leave
ret 4

Function at 0x100458b5
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
mov esi, ecx
cmp byte [esi + 0x44], 0
je 0x100458c8
mov al, 1
jmp 0x1004593e
mov eax, dword [esi + 0x40]
cmp eax, 0xffffffff
push ebx
mov bl, 1
jne 0x100458d7
xor al, al
jmp 0x1004593d
push edi
xor edi, edi
push edi
push edi
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_WSAConnect]
test eax, eax
je 0x10045937
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x10045932
push 0x2710
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x10045935
push 0x2c
lea eax, [ebp - 0x2c]
push edi
push eax
call fcn.100ab720
add esp, 0xc
lea eax, [ebp - 0x2c]
push eax
push edi
push dword [esi + 0x40]
call dword [sym.imp.WS2_32.dll_WSAEnumNetworkEvents]
mov eax, dword [ebp - 0x18]
cmp eax, edi
je 0x10045937
mov dword [esi + 0x48], eax
xor bl, bl
mov byte [esi + 0x44], bl
mov al, bl
pop edi
pop ebx
pop esi
leave
ret 8
Function at 0x10045943
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, ecx
push dword [esi + 0x4c]
push dword [esi + 0xc]
call edi
test eax, eax
je 0x1004596d
mov dword [esi + 0x48], 0x2749
xor al, al
jmp 0x10045a14
push ebx
xor ebx, ebx
push ebx
push dword [esi + 8]
call edi
cmp eax, 0x102
jne 0x1004598b
mov dword [esi + 0x48], 0x2734
xor al, al
jmp 0x10045a13
mov eax, dword [ebp + 0x10]
mov dword [eax], ebx
lea eax, [esi + 0x28]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 8]
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.WS2_32.dll_WSAResetEvent]
push ebx
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x40]
call dword [sym.imp.WS2_32.dll_WSASend]
test eax, eax
je 0x100459d3
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
jne 0x10045a05
push dword [esi + 0x4c]
push dword [esi + 8]
call edi
test eax, eax
jne 0x10045a08
lea eax, [ebp + 0xc]
push eax
push ebx
push dword [ebp + 0x10]
lea eax, [ebp - 0x18]
push eax
push dword [esi + 0x40]
mov dword [ebp + 0xc], ebx
call dword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
test eax, eax
je 0x100459ff
mov bl, 1
jmp 0x10045a08
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x48], eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
pop ebx
pop edi
pop esi
leave
ret 0xc
Function at 0x10045a3d
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, ecx
push dword [esi + 0x4c]
push dword [esi + 0xc]
call edi
test eax, eax
je 0x10045a67
mov dword [esi + 0x48], 0x2749
xor al, al
jmp 0x10045b2e
push ebx
xor ebx, ebx
push ebx
push dword [esi + 4]
call edi
cmp eax, 0x80
jne 0x10045a85
mov dword [esi + 0x48], 0x2734
xor al, al
jmp 0x10045b2d
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [edi]
push 0x14
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x20]
push ebx
push eax
mov dword [edi], ebx
mov dword [ebp - 4], ebx
call fcn.100ab720
lea eax, [esi + 0x10]
add esp, 0xc
push eax
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 4]
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.WS2_32.dll_WSAResetEvent]
push ebx
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 4]
push eax
push edi
push 1
lea eax, [ebp - 0xc]
push eax
push dword [esi + 0x40]
call dword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
je 0x10045aeb
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
jne 0x10045b1f
push dword [esi + 0x4c]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x10045b22
lea eax, [ebp - 4]
push eax
push ebx
push edi
lea eax, [ebp - 0x20]
push eax
push dword [esi + 0x40]
mov dword [ebp - 4], ebx
call dword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
test eax, eax
je 0x10045b19
mov bl, 1
jmp 0x10045b22
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x48], eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
pop ebx
pop edi
pop esi
leave
ret 8

Function at 0x10046a37
Capabilities:
Initialize winsock library

Disassembly:
push esi
lea esi, [ecx + 0x190]
cmp dword [esi], 0
je 0x10046a4e
push ecx
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [esi], eax
xor eax, eax
cmp dword [esi], eax
pop esi
sete al
ret
Function at 0x1004cc4e
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x100daa9d
call fcn.100ac440
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], 0x100e9488
mov ecx, dword [esi + 0x19c]
push 0x10
pop edi
sub ecx, edi
mov dword [ebp - 4], 0x17
call fcn.10001199
lea ecx, [esi + 0x170]
call fcn.100508bc
lea ecx, [esi + 0x144]
mov byte [ebp - 4], 0x16
call fcn.100508bc
xor ebx, ebx
push 0
inc ebx
push ebx
lea ecx, [esi + 0x128]
call fcn.100017d0
push 0
push ebx
lea ecx, [esi + 0x10c]
call fcn.100017d0
push 0
push ebx
lea ecx, [esi + 0xf0]
call fcn.100017d0
push 0
push ebx
lea ecx, [esi + 0xd4]
call fcn.100017d0
push 0
push ebx
lea ecx, [esi + 0xb8]
call fcn.100017d0
push 0
push ebx
lea ecx, [esi + 0x9c]
call fcn.100017d0
lea ecx, [esi + 0x6c]
mov byte [ebp - 4], 0xf
call fcn.100508bc
lea ecx, [esi + 0x40]
mov byte [ebp - 4], 0xe
call fcn.100508bc
mov ecx, dword [esi + 0x3c]
sub ecx, edi
call fcn.10001199
mov ecx, dword [esi + 0x38]
sub ecx, edi
call fcn.10001199
mov ecx, dword [esi + 0x34]
sub ecx, edi
call fcn.10001199
mov ecx, dword [esi + 0x30]
sub ecx, edi
call fcn.10001199
mov ecx, dword [esi + 0x2c]
sub ecx, edi
call fcn.10001199
mov ecx, dword [esi + 0x28]
sub ecx, edi
call fcn.10001199
mov ecx, dword [esi + 0x24]
sub ecx, edi
call fcn.10001199
mov ecx, dword [esi + 0x20]
sub ecx, edi
call fcn.10001199
mov ecx, dword [esi + 0x1c]
sub ecx, edi
call fcn.10001199
mov ecx, dword [esi + 0x18]
sub ecx, edi
call fcn.10001199
mov ecx, dword [esi + 0x14]
sub ecx, edi
call fcn.10001199
mov ecx, dword [esi + 0x10]
sub ecx, edi
call fcn.10001199
mov ecx, dword [esi + 0xc]
sub ecx, edi
call fcn.10001199
mov ecx, dword [esi + 8]
sub ecx, edi
call fcn.10001199
mov ecx, dword [esi + 4]
sub ecx, edi
call fcn.10001199
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x1004cc5a
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x100daa9d
call fcn.100ac440
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], 0x100e9488
mov ecx, dword [esi + 0x19c]
push 0x10
pop edi
sub ecx, edi
mov dword [ebp - 4], 0x17
call fcn.10001199
lea ecx, [esi + 0x170]
call fcn.100508bc
lea ecx, [esi + 0x144]
mov byte [ebp - 4], 0x16
call fcn.100508bc
xor ebx, ebx
push 0
inc ebx
push ebx
lea ecx, [esi + 0x128]
call fcn.100017d0
push 0
push ebx
lea ecx, [esi + 0x10c]
call fcn.100017d0
push 0
push ebx
lea ecx, [esi + 0xf0]
call fcn.100017d0
push 0
push ebx
lea ecx, [esi + 0xd4]
call fcn.100017d0
push 0
push ebx
lea ecx, [esi + 0xb8]
call fcn.100017d0
push 0
push ebx
lea ecx, [esi + 0x9c]
call fcn.100017d0
lea ecx, [esi + 0x6c]
mov byte [ebp - 4], 0xf
call fcn.100508bc
lea ecx, [esi + 0x40]
mov byte [ebp - 4], 0xe
call fcn.100508bc
mov ecx, dword [esi + 0x3c]
sub ecx, edi
call fcn.10001199
mov ecx, dword [esi + 0x38]
sub ecx, edi
call fcn.10001199
mov ecx, dword [esi + 0x34]
sub ecx, edi
call fcn.10001199
mov ecx, dword [esi + 0x30]
sub ecx, edi
call fcn.10001199
mov ecx, dword [esi + 0x2c]
sub ecx, edi
call fcn.10001199
mov ecx, dword [esi + 0x28]
sub ecx, edi
call fcn.10001199
mov ecx, dword [esi + 0x24]
sub ecx, edi
call fcn.10001199
mov ecx, dword [esi + 0x20]
sub ecx, edi
call fcn.10001199
mov ecx, dword [esi + 0x1c]
sub ecx, edi
call fcn.10001199
mov ecx, dword [esi + 0x18]
sub ecx, edi
call fcn.10001199
mov ecx, dword [esi + 0x14]
sub ecx, edi
call fcn.10001199
mov ecx, dword [esi + 0x10]
sub ecx, edi
call fcn.10001199
mov ecx, dword [esi + 0xc]
sub ecx, edi
call fcn.10001199
mov ecx, dword [esi + 8]
sub ecx, edi
call fcn.10001199
mov ecx, dword [esi + 4]
sub ecx, edi
call fcn.10001199
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x1004d72f
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0x100dac5c
call fcn.100ac440
push ecx
push esi
mov esi, ecx
push edi
lea ecx, [esi + 4]
mov dword [ebp - 0x10], esi
mov dword [esi], 0x100e9488
call fcn.1000190f
xor edi, edi
lea ecx, [esi + 8]
mov dword [ebp - 4], edi
call fcn.1000190f
lea ecx, [esi + 0xc]
call fcn.1000190f
lea ecx, [esi + 0x10]
call fcn.1000190f
lea ecx, [esi + 0x14]
call fcn.1000190f
lea ecx, [esi + 0x18]
call fcn.1000190f
lea ecx, [esi + 0x1c]
call fcn.1000190f
lea ecx, [esi + 0x20]
call fcn.1000190f
lea ecx, [esi + 0x24]
call fcn.1000190f
lea ecx, [esi + 0x28]
call fcn.1000190f
lea ecx, [esi + 0x2c]
call fcn.1000190f
lea ecx, [esi + 0x30]
call fcn.1000190f
lea ecx, [esi + 0x34]
call fcn.1000190f
lea ecx, [esi + 0x38]
call fcn.1000190f
lea ecx, [esi + 0x3c]
call fcn.1000190f
push edi
lea ecx, [esi + 0x40]
mov byte [ebp - 4], 0xe
call fcn.10050861
push edi
lea ecx, [esi + 0x6c]
mov byte [ebp - 4], 0xf
call fcn.10050861
lea ecx, [esi + 0x9c]
call fcn.10002e95
lea ecx, [esi + 0xb8]
call fcn.10002e95
lea ecx, [esi + 0xd4]
call fcn.10002e95
lea ecx, [esi + 0xf0]
call fcn.10002e95
lea ecx, [esi + 0x10c]
call fcn.10002e95
lea ecx, [esi + 0x128]
call fcn.10002e95
mov byte [ebp - 4], 0x16
push edi
lea ecx, [esi + 0x144]
call fcn.10050861
push edi
lea ecx, [esi + 0x170]
mov byte [ebp - 4], 0x17
call fcn.10050861
lea ecx, [esi + 0x19c]
call fcn.1000190f
mov ecx, esi
mov byte [ebp - 4], 0x19
call fcn.1004cf74
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x98], edi
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret