joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4025bb
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor ecx, ecx
push 8
mov eax, ecx
pop edx
mov esi, eax
and esi, 1
dec esi
not esi
and esi, 0xedb88320
shr eax, 1
xor eax, esi
dec edx
jne 0x4025c3
mov dword [ecx*4 + 0x49eea0], eax
inc ecx
cmp ecx, 0x100
jb 0x4025be
mov edx, 0x800
jmp 0x402610
mov eax, dword [ecx*4 + 0x49eaa0]
mov esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x49eea0]
inc ecx
mov dword [ecx*4 + 0x49ee9c], eax
cmp ecx, edx
jb 0x4025ef
mov dword [0x49d3b8], 0x402633
call fcn.004149b9
test eax, eax
jne 0x402631
mov dword [0x49d3b8], 0x4026cf
pop esi
ret

Function at 0x4143bf
Capabilities:
Encode data using xor

Disassembly:
pop ebx
retf 0x8483
movsd dword es:[edi], dword [esi]
test byte [esi + edi + 0x1c23df9a], bl
sub al, 0xc8
mov dh, 0x4d
mov bh, 0x9c
cwde
enter 0x3411, 0xffffffffffffffd7
pop esi
dec esp
js 0x414329
sub esi, ebp
xor dword [edi + eax*2 + 0x2d45b026], esp
wait
xchg esi, eax
or al, 0xc2
inc ebx
pop ds
xor al, 0x99
invalid
loope 0x4143e1
jp 0x41442d
add eax, 0x11f885f0
sar dword [ebp + 0x36758747], 0x2a
mov cl, 0x3f
lodsb al, byte [esi]
add bl, byte [esi]
inc ebx
jl 0x4143de
loope 0x414379
adc byte [ecx - 0x31c29b87], dh
into
mov ch, 0x34
retf 0xea67
sbb ecx, dword [ebx + 0x27]
fmul qword [eax + edi*2 + 0x5d5a714d]
mov ds, word [eax - 0x6d526b8c]
or edi, edx
mov eax, dword [edi + 0x571a0de6]
inc ebx
fidiv dword [esi]
ror edx, 0x6e
hlt

Function at 0x434892
Capabilities:
Encode data using xor

Disassembly:
test al, 0xe0
test al, 0x80
test eax, 0xa990a988
cwde
test eax, 0xa9a8a9a0
mov al, 0xa9
mov eax, 0xc8a9c0a9
test eax, 0xa9d8a9d0
add byte [ebx - 0x54ef54f8], ch
sbb byte [ebx - 0x54d754e0], ch
xor byte [ebx - 0x54bf54c8], ch
dec eax
stosd dword es:[edi], eax
push eax
stosd dword es:[edi], eax
pop eax
stosd dword es:[edi], eax
pushal
stosd dword es:[edi], eax
push 0x78ab70ab
stosd dword es:[edi], eax
sub byte [ebx - 0x53175478], 0xf8
lodsb al, byte [esi]
clc
lodsb al, byte [esi]
or byte [ebp - 0x52d752e8], ch
cmp byte [ebp - 0x509750a0], ch
jo 0x434819
js 0x43481b
sub byte [edi - 0x505f5070], 0
add byte [eax], al
mov al, 0x12
add byte [ecx + eax], ah
add byte [eax], al
adc byte [eax - 0x5faf5fe0], ah
mov al, byte [0xb0a0a8a0]
loopne 0x434834
call 0xf8e43939
mov al, byte [0xa108a100]
adc byte [ecx - 0x5edf5ee8], ah
sub byte [ecx - 0x5ec75ed0], ah
inc eax
mov eax, dword [0xa150a148]
pop eax
mov eax, dword [0xa168a160]
jo 0x434859
js 0x43485b
and byte [ecx - 0x5e6f5e78], 0x98
mov eax, dword [0xa1a8a1a0]
invalid
Function at 0x44b920
Capabilities:
Encode data using xor

Disassembly:
inc eax
out dx, eax
aaa
aas
push edi
neg al
cmp byte [edi], 0x26
cmp eax, 0x8624024d
add ah, byte [esi + eax*4]
add cl, byte [edi + edx*4]
cmc
add eax, 0x1b57c9c2
outsb dx, byte [esi]
insb byte es:[edi], dx
das
in eax, dx
sub eax, 0x7a207666
sub eax, 0x7a207666
mov eax, 0x4bc9b2d3
sub bl, byte [ecx + eax*8]
push esp
push ss
or eax, 0x18dfe419
push eax
or byte [eax - 0x6e5e89b2], ch
sbb byte [ebx - 0x76], cl
cmpsb byte [esi], byte es:[edi]
jbe 0x44b85e
sti
ret 0xdc52
jae 0x44b86a
popfd
call 0x2515b9aa
jo 0x44b87b
rol dword [edx + eax*2 + 0x73], cl
mov dword [eax - 0x12dcf9a5], esp
adc byte [ebx], bh
mov esi, 0x9886defd
push esp
fsubp st(7)
movsd dword es:[edi], dword [esi]
mov eax, dword [0x9e1776a6]
pop ecx
xor byte [edx + 0xb], dh
push ss
jg 0x44b8e1
pop ebp
clc
mov bh, 0x6d
out 0x17, eax
shr byte [edx], 0xf9
xchg edi, eax
scasb al, byte es:[edi]
inc esi
invalid
fnstcw word [eax - 0x792f2460]
jg 0x44b8c5
mov eax, 0x2e2a8c1b
invalid

Function at 0x7c6058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x7c61a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x7c607e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7c606a
add dl, dl
jne 0x7c6089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7c60dc
xor eax, eax
add dl, dl
jne 0x7c6096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7c617d
add dl, dl
jne 0x7c60a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7c60b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7c60bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7c60c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x7c60d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x7c6075
mov eax, 1
add dl, dl
jne 0x7c60ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7c60f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7c60e1
sub eax, ebx
mov ebx, 1
jne 0x7c6128
mov ecx, 1
add dl, dl
jne 0x7c610e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7c6119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7c6105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7c6075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x7c613f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7c614a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7c6136
cmp eax, 0x7d00
jae 0x7c616d
cmp eax, 0x500
jb 0x7c6168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7c6075
cmp eax, 0x7f
ja 0x7c6170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7c6075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x7c619e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x7c6075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x1001e8e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], ecx
cmp dword [ebp + 0x10], 0
jg 0x1001e900
jl 0x1001e8f7
cmp dword [ebp + 0xc], 0
ja 0x1001e900
xor eax, eax
xor edx, edx
jmp 0x1001ea37
mov eax, dword [ebp - 8]
cmp dword [eax + 0x38], 0
je 0x1001e922
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
call fcn.10006e20
jmp 0x1001ea37
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 8]
call fcn.10007f70
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jbe 0x1001e991
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 4]
push edx
call fcn.100097d0
add esp, 8
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 8]
call fcn.100080d0
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.10008a20
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 8]
call fcn.10008050
mov eax, dword [ebp - 8]
cmp dword [eax + 0x4c], 0
je 0x1001ea28
mov ecx, dword [ebp - 8]
call fcn.1001dd70
mov dword [ebp - 0x18], 0xfff
cmp dword [ebp - 4], 0xfff
jbe 0x1001ea01
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x4c]
push edx
push 0xfff
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.10050122
add esp, 0x10
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x10]
mov dword [ebp + 8], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 4], edx
cmp dword [ebp - 0x10], 0xfff
je 0x1001e9ff
xor eax, eax
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x1c]
sbb edx, eax
mov eax, ecx
jmp 0x1001ea37
jmp 0x1001e9ad
cmp dword [ebp - 4], 0
jbe 0x1001ea28
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.10050122
add esp, 0x10
mov ecx, dword [ebp - 4]
sub ecx, eax
mov dword [ebp - 4], ecx
xor edx, edx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
sbb ecx, edx
mov edx, ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1001f530
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 2
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x1001f563
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1001f5d2
push 0x22c
push 0
lea ecx, [ebp - 0x238]
push ecx
call fcn.10049500
add esp, 0xc
mov dword [ebp - 0x238], 0x22c
lea edx, [ebp - 0x238]
push edx
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1001f5bc
lea ecx, [ebp - 0x238]
push ecx
mov ecx, dword [ebp + 8]
call fcn.100235d0
lea edx, [ebp - 0x238]
push edx
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1001f597
jmp 0x1001f5c5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x10023b10
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], SysFreeString
mov dword [ebp - 0x12c], 0x11c
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jge 0x10023b46
mov eax, dword [ebp - 8]
jmp 0x10023c46
push 0x11c
lea ecx, [ebp - 0x12c]
push ecx
lea edx, [ebp - 0x248]
push edx
call fcn.10048f80
add esp, 0xc
mov eax, dword [ebp - 0x128]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x124]
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 4], 5
jne 0x10023b7f
cmp dword [ebp - 0xc], 1
jb 0x10023b85
cmp dword [ebp - 4], 5
jae 0x10023b91
mov dword [ebp - 8], 0
jmp 0x10023c43
cmp dword [ebp - 4], 5
jne 0x10023ba9
cmp dword [ebp - 0xc], 1
jne 0x10023ba9
mov dword [ebp - 8], 0x33
jmp 0x10023c43
cmp dword [ebp - 4], 5
jne 0x10023bc1
cmp dword [ebp - 0xc], 2
jne 0x10023bc1
mov dword [ebp - 8], 0x34
jmp 0x10023c43
cmp dword [ebp - 4], 6
jne 0x10023bd6
cmp dword [ebp - 0xc], 0
jne 0x10023bd6
mov dword [ebp - 8], 0x3c
jmp 0x10023c43
cmp dword [ebp - 4], 6
jne 0x10023beb
cmp dword [ebp - 0xc], 1
jne 0x10023beb
mov dword [ebp - 8], 0x3d
jmp 0x10023c43
cmp dword [ebp - 4], 6
jne 0x10023c00
cmp dword [ebp - 0xc], 2
jne 0x10023c00
mov dword [ebp - 8], 0x3e
jmp 0x10023c43
cmp dword [ebp - 4], 6
jne 0x10023c15
cmp dword [ebp - 0xc], 3
jne 0x10023c15
mov dword [ebp - 8], 0x3f
jmp 0x10023c43
cmp dword [ebp - 4], 0xa
jne 0x10023c2a
cmp dword [ebp - 0xc], 0
jne 0x10023c2a
mov dword [ebp - 8], 0x64
jmp 0x10023c43
cmp dword [ebp - 4], 0xa
jne 0x10023c36
cmp dword [ebp - 0xc], 0
ja 0x10023c3c
cmp dword [ebp - 4], 0xa
jbe 0x10023c43
mov dword [ebp - 8], SysFreeString
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x10025130
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0xc]
push eax
call fcn.10008510
add esp, 4
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10008510
add esp, 4
push eax
lea edx, [ebp - 0xc]
push edx
call fcn.10025430
add esp, 0xc
push eax
lea ecx, [ebp - 8]
call fcn.10024bf0
lea ecx, [ebp - 0xc]
call fcn.10025970
mov dword [ebp - 0x10], 0x10025080
mov eax, dword [ebp - 4]
add eax, 4
push eax
push 0
lea ecx, [ebp - 8]
call fcn.100018f0
push eax
mov ecx, dword [ebp - 0x10]
push ecx
push 0
push 0
call fcn.100512dc
add esp, 0x18
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x100251b0
lea ecx, [ebp - 8]
call fcn.1000a7d0
jmp 0x100251c1
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], 0
push 6
call fcn.10034d95
lea ecx, [ebp - 8]
call fcn.10025970
mov esp, ebp
pop ebp
ret 8

Function at 0x10026450
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x134
call fcn.10028f00
call fcn.10030050
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0xa
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 8]
call fcn.10029e20
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov esp, ebp
pop ebp
ret 8

Function at 0x10026b40
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 0x14], ecx
mov eax, dword [0x100aa85c]
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
mov eax, dword [0x100a5150]
cmp eax, dword [edx + 4]
jle 0x10026ba4
push 0x100a5150
call fcn.10047e7d
add esp, 4
cmp dword [0x100a5150], 0xffffffff
jne 0x10026ba4
push 0x1008ff84
mov ecx, 0x100a5138
call fcn.1001ad10
push 0x1006faa0
call fcn.10047e0e
add esp, 4
push 0x100a5150
call fcn.10047e2c
add esp, 4
mov ecx, dword [ebp + 8]
call fcn.1001c1d0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x10026c0d
push 0xffffffffffffffff
push 0x100a5138
mov ecx, dword [ebp + 8]
call fcn.10029ad0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x10026bf7
mov ecx, dword [ebp - 0xc]
push ecx
push 0
lea edx, [ebp - 0x30]
push edx
mov ecx, dword [ebp + 8]
call fcn.10026230
push eax
mov ecx, dword [ebp - 0x14]
call fcn.10026b40
lea ecx, [ebp - 0x30]
call fcn.1001af10
push 0
mov ecx, dword [ebp + 8]
call fcn.1001c1d0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 0x18], eax
jmp 0x10026c36
mov eax, dword [ebp - 8]
and eax, 0x10
jne 0x10026c29
mov ecx, dword [ebp - 8]
and ecx, 0x400
jne 0x10026c29
mov dword [ebp - 0x10], 0
jmp 0x10026c30
mov dword [ebp - 0x10], 1
mov dl, byte [ebp - 0x10]
mov byte [ebp - 1], dl
mov esp, ebp
pop ebp
ret 4
Function at 0x1002fd80
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
push 0xf003f
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.1002ff40
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1002fe02
mov ecx, dword [ebp + 0x14]
call fcn.10007740
shl eax, 1
push eax
mov ecx, dword [ebp + 0x14]
call fcn.1001c1d0
push eax
push 1
push 0
mov ecx, dword [ebp + 0x10]
call fcn.1001c1d0
push eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1002fdf6
push 0x1001aa40
push 0x10090410
push 0x100aa3c8
call fcn.10019d70
add esp, 8
mov ecx, eax
call fcn.1001b2d0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1002fe20
push 0x1001aa40
push 0x10090470
push 0x100aa3c8
call fcn.10019d70
add esp, 8
mov ecx, eax
call fcn.1001b2d0
push 0xf013f
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.1002ff40
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1002fe97
mov ecx, dword [ebp + 0x14]
call fcn.10007740
shl eax, 1
push eax
mov ecx, dword [ebp + 0x14]
call fcn.1001c1d0
push eax
push 1
push 0
mov ecx, dword [ebp + 0x10]
call fcn.1001c1d0
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1002fe8b
push 0x1001aa40
push 0x100904d0
push 0x100aa3c8
call fcn.10019d70
add esp, 8
mov ecx, eax
call fcn.1001b2d0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1002feb5
push 0x1001aa40
push str.APPMOND_:_setting_registry_whitelist_failed
push 0x100aa3c8
call fcn.10019d70
add esp, 8
mov ecx, eax
call fcn.1001b2d0
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x10032c90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
add eax, 8
push eax
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x10032dc0
push 0
push 0
call fcn.100512dc
add esp, 0x18
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esp, ebp
pop ebp
ret
Function at 0x10032df0
Capabilities:
Connect pipe
Create pipe
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xa060
call fcn.100481a0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 8], 0
mov dword [ebp - 0x1c], str..pipeAppMonD_DataWindow
push 1
mov ecx, 0x100aa29c
call fcn.10033290
mov ecx, 0x100aa29c
call fcn.10033400
cmp eax, 1
jne 0x10032fe4
push 0
lea eax, [ebp - 0x18]
push eax
push 1
push str.S:_ML__NW___LW_D:_A__0x12019f___WD_
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorA
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 0xc
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], 1
lea edx, [ebp - 0x2c]
push edx
push 0
push 0x200c
push 0x200c
push 0xff
push 6
push 3
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x10032ee9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x48]
push ecx
call fcn.10033220
add esp, 8
mov ecx, eax
call fcn.1001c1d0
push eax
push str.CreateNamedPipe_failed:__s
lea edx, [ebp - 0x5060]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0x48]
call fcn.1001af10
lea eax, [ebp - 0x5060]
push eax
push 0xfffffffffffffff5
call fcn.10030050
mov ecx, eax
call fcn.1002fab0
or eax, 0xffffffff
jmp 0x10032ff2
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
je 0x10032f02
mov dword [ebp - 0x10], 1
jmp 0x10032f25
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
jne 0x10032f18
mov dword [ebp - 0xc], 1
jmp 0x10032f1f
mov dword [ebp - 0xc], 0
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x10032fd5
mov ecx, 0x100aa29c
call fcn.10033400
cmp eax, 1
je 0x10032f53
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10032fe4
lea edx, [ebp - 0x20]
push edx
push 0
mov eax, dword [ebp - 4]
push eax
push 0x10033000
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10032fc9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x60]
push ecx
call fcn.10033220
add esp, 8
mov ecx, eax
call fcn.1001c1d0
push eax
push str.CreateThread_failed:__s
lea edx, [ebp - 0xa060]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0x60]
call fcn.1001af10
lea eax, [ebp - 0xa060]
push eax
push 0xfffffffffffffff4
call fcn.10030050
mov ecx, eax
call fcn.1002fab0
or eax, 0xffffffff
jmp 0x10032ff2
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10032fdf
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10032e2c
push 3
mov ecx, 0x100aa29c
call fcn.10033290
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10033620
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], ecx
mov byte [ebp - 1], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x24], 0
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x28], 0
mov edx, dword [ebp - 8]
add edx, 0x28
push edx
push 0
mov eax, dword [ebp - 8]
push eax
push 0x100336c0
push 0
push 0
call fcn.100512dc
add esp, 0x18
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x24], eax
mov edx, dword [ebp - 8]
cmp dword [edx + 0x24], 0
je 0x100336ae
mov eax, dword [ebp - 8]
cmp dword [eax + 0x28], 0
je 0x100336ae
mov dword [ebp - 0xc], 0
jmp 0x10033689
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0xa
jae 0x100336ae
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 8]
call fcn.10033830
mov byte [ebp - 1], al
movzx edx, byte [ebp - 1]
test edx, edx
je 0x100336ac
jmp 0x100336ae
jmp 0x10033680
movzx eax, byte [ebp - 1]
mov esp, ebp
pop ebp
ret

Function at 0x10047590
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
call fcn.10057a62
push 2
lea ecx, [ebp - 4]
push ecx
mov eax, dword [eax + 0x14]
push 0x22
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx eax, word [ebp - 4]
sub eax, 0x30
je 0x100475cf
sub eax, 1
je 0x100475ca
sub eax, 1
je 0x100475c6
xor eax, eax
leave
ret
push 3
jmp 0x100475d1
xor eax, eax
inc eax
leave
ret
push 2
pop eax
leave
ret

Function at 0x10058a65
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10058aa4
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10058aa4
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10058aa4
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10058aa4
cmp dword [ecx + 0x74], 0xe
jbe 0x10058aa4
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x1005e33b
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10095adc
push 0x10095ad4
push str.FlsAlloc
push 0x1f
call fcn.1005e166
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1005e36f
push dword [ebp + 8]
mov ecx, esi
call dword [0x1008f394]
call esi
jmp 0x1005e375
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1005e3b9
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10095aec
push 0x10095ae4
push str.FlsGetValue
push 0x21
call fcn.1005e166
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1005e3f0
push dword [ebp + 8]
mov ecx, esi
call dword [0x1008f394]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1005e3f8
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10095af4
push 0x10095aec
push str.FlsSetValue
push 0x22
call fcn.1005e166
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1005e432
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1008f394]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]