joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006eb0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x100ef0a4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
lea eax, [ebp - 0x210]
mov dword [ebp - 0x214], 0
push 0
push eax
mov esi, ecx
mov dword [ebp - 0x21c], 1
call fcn.1006d480
add esp, 0xc
mov dword [ebp - 0x218], 0x104
lea eax, [ebp - 0x214]
push eax
push 0x20119
push 0
push 0x100d9638
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10006f54
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0
push str.AdobeIPCBroker
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x214]
test eax, eax
je 0x10006f65
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10050cd5
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x210]
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10006f74
sub edx, ecx
lea eax, [ebp - 0x210]
sar edx, 1
mov ecx, esi
push edx
push eax
call fcn.100079f0
mov ecx, esi
call fcn.10006cc0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10050cd5
mov esp, ebp
pop ebp
ret

Function at 0x1000e640
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100be7a0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x100ef0a4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.10050cf9
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.1005366c
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100325f0
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x10032601
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x100325fc
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
add byte [ebp + 0x13], dh
add byte [ebp + 0x13], dh
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x100325ee
cmp edx, ebx
jne 0x1003273c
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x100325bd
add eax, dword [eax + 4]
jmp 0x100325aa
mov dword [ebp + 0xc], ebx
jmp 0x1003260c

Function at 0x10032650
Capabilities:
Inspect section memory permissions

Disassembly:
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x100326a0
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
loop 0x10032672
add byte [eax], al
and byte [ecx + 0x1065], al
invalid
invalid

Function at 0x10032670
Capabilities:
Inspect section memory permissions

Disassembly:
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x100326a0
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
loop 0x10032672
add byte [eax], al
and byte [ecx + 0x1065], al
invalid
invalid

Function at 0x10032690
Capabilities:
Inspect section memory permissions

Disassembly:
loop 0x10032672
add byte [eax], al
and byte [ecx + 0x1065], al
add byte [eax + 0x3b184d8b], al
sal dword [esp + eax - 0x80], cl
or al, 8
add dword [ecx], edi
pop ebp
or byte [esp + eax - 0x80], dh
or al, 8
add bh, byte [ecx]
cmp dword [ebp + 0x10], ebx
je 0x1003269a
add ecx, eax
or byte [ecx], 4

Function at 0x100351f0
Capabilities:
Connect pipe

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [ebp + 8]
push ebx
push esi
push edi
push 0
mov edi, ecx
shl eax, 0x13
push 0xffffffffffffffff
add eax, 0x40000003
push dword [edi + 0x10]
mov ecx, dword [edi + 8]
push dword [edi + 0xc]
push 0xff
push dword [edi + 0x14]
push eax
mov eax, dword [ecx]
call dword [eax + 0x24]
push eax
call fcn.10040220
add esp, 0x20
mov dword [edi + 0x20], eax
lea ecx, [edi + 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.NamedPipe_Created__
mov ebx, eax
call fcn.1003e8d0
add esp, 4
test esi, esi
jne 0x10035284
cmp ebx, 0x217
je 0x1003526c
cmp ebx, 0x3e5
jne 0x10035284
mov byte [edi + 0x1c], 0
pop edi
pop esi
pop ebx
pop ebp
ret 4
push str.Client_connected_to_NamedPipe
call fcn.1003e8d0
add esp, 4
mov byte [edi + 0x1c], 1
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x18]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x100c6dd8
call fcn.10041dd0
int3
Function at 0x10036c10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
mov esi, ecx
xorps xmm0, xmm0
mov eax, dword [esi + 0x1c]
lea ebx, [esi + 0x1c]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
movlpd qword [ebp - 0x28], xmm0
push eax
push dword [ebp + 0xc]
movlpd qword [ebp - 0x20], xmm0
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10036c86
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x10036c7d
push ebx
mov ecx, esi
call fcn.10036bb0
push 1
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x28]
push eax
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x10036c86
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe8
jne 0x10036cbf
jmp 0x10036c91
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x24]
push eax
push 9
push 0x100c6cb0
call fcn.10037fd0
add esp, 8
lea ecx, [ebp - 0x14]
push eax
call fcn.1003f910
push 0x100e5710
lea eax, [ebp - 0x14]
push eax
call fcn.1006c856
push eax
push 0x100c6cb0
call fcn.10041dd0
int3

Function at 0x10036d30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100ef0a4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x10036dd1
cmp byte [esi + 0x3d], 0
je 0x10036dd1
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10036d87
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x10036d99
sub eax, 1
je 0x10036d9d
sub eax, 2
je 0x10036dd1
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10050cd5
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10036dba
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.10093830
add esp, 0x10
cmp edi, eax
jne 0x10036d87
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10050cd5
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.10050cd5
mov esp, ebp
pop ebp
ret
Function at 0x10037100
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100ef0a4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x10037130
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10050cd5
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x1003716c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x1003716c
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10050cd5
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x10037251
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10037194
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x100371c7
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.10092dbb
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10050cd5
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x10037251
cmp eax, 1
jle 0x10037224
cmp eax, 3
jne 0x10037251
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.100343e0
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10050cd5
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10037241
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.10093830
add esp, 0x10
cmp edi, eax
jne 0x10037251
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x10037157
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10050cd5
mov esp, ebp
pop ebp
ret 4
Function at 0x10037d40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x10037d64
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1000d1b0
pop edi
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov eax, dword [eax]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], eax
test eax, eax
je 0x10037d85
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x10037d87
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test ebx, ebx
jl 0x10037e0f
jg 0x10037d9a
test esi, esi
je 0x10037e0f
test ecx, ecx
jl 0x10037ddc
jg 0x10037da4
test eax, eax
je 0x10037ddc
cmp ebx, ecx
jg 0x10037db6
jl 0x10037dae
cmp esi, eax
jae 0x10037db6
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], ebx
push eax
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.1006c980
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov eax, dword [edi + 0x2c]
add dword [ebp + 8], ecx
sub esi, ecx
sbb ebx, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x10037de2
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test ebx, ebx
jl 0x10037e0f
jg 0x10037dec
test esi, esi
je 0x10037e0f
cmp dword [edi + 0x4c], 0
je 0x10037e0f
mov ecx, edi
call fcn.10036ee0
push dword [edi + 0x4c]
push esi
push 1
push dword [ebp + 8]
call fcn.100930fa
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
pop esi
sbb edx, ebx
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10037e30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x10037e54
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1000d0d0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov eax, dword [eax]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], eax
test eax, eax
je 0x10037e75
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x10037e77
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test edi, edi
jl 0x10037ef4
jg 0x10037e8a
test esi, esi
je 0x10037ef4
test ecx, ecx
jl 0x10037ece
jg 0x10037e94
test eax, eax
je 0x10037ece
cmp edi, ecx
jg 0x10037ea6
jl 0x10037e9e
cmp esi, eax
jae 0x10037ea6
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], edi
push eax
push dword [ebp + 8]
push dword [ebp - 8]
call fcn.1006c980
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x10037ed1
mov edx, dword [ebp + 8]
test edi, edi
jl 0x10037ef4
jg 0x10037edb
test esi, esi
je 0x10037ef4
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x10037ef4
push eax
push esi
push 1
push edx
call fcn.10093830
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x100402a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x100402db
mov eax, dword [ebp + 8]
movups xmm0, xmmword [ebp - 0x10]
movups xmmword [eax], xmm0
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push str.CreateProcessW__S___S__failed
push eax
call fcn.10041be0
int3

Function at 0x10040880
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10040893
pop ebp
ret
push dword [ebp + 8]
push str.GetFileAttributesW__S__failed
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.10041be0
int3
Function at 0x10047460
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c2918
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x100ef0a4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x24], ebx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xd]
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
push esi
lea ecx, [ebp - 0x30]
call fcn.10046d00
lea eax, [esi - 1]
mov dword [ebp - 4], 0
mov esi, dword [ebx + 4]
lea edi, [ebx + 4]
mov dword [ebp - 0x18], eax
xor ecx, ecx
mov eax, dword [ebx + 8]
mov edx, eax
sub edx, esi
mov dword [ebp - 0x20], edi
add edx, 3
mov dword [ebp + 8], esi
xor ebx, ebx
shr edx, 2
cmp esi, eax
mov dword [ebp - 0x14], ecx
cmova edx, ebx
mov ebx, dword [ebp - 0x30]
mov dword [ebp - 0x1c], edx
test edx, edx
je 0x10047542
mov edi, dword [esi]
test edi, edi
je 0x10047531
mov esi, dword [ebp - 0x18]
nop dword [eax]
mov ecx, dword [edi + 4]
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, eax
shl ecx, 9
not ecx
add eax, ecx
mov ecx, eax
shr ecx, 0xe
xor ecx, eax
mov eax, ecx
shl eax, 4
add eax, ecx
mov ecx, dword [edi]
mov edx, eax
shr edx, 0xa
xor edx, eax
and edx, esi
mov eax, dword [ebx + edx*4]
mov dword [edi], eax
mov dword [ebx + edx*4], edi
mov edi, ecx
test ecx, ecx
jne 0x100474f0
mov esi, dword [ebp + 8]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x1c]
inc ecx
add esi, 4
mov dword [ebp + 8], esi
mov dword [ebp - 0x14], ecx
cmp ecx, edx
jne 0x100474e4
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x30]
cmp edi, eax
je 0x10047560
mov eax, dword [edi]
mov dword [edi], ebx
mov ebx, eax
mov eax, dword [ebp - 0x2c]
mov dword [edi + 4], eax
mov ecx, dword [edi + 8]
mov eax, dword [ebp - 0x28]
mov dword [edi + 8], eax
jmp 0x10047563
mov ecx, dword [ebp - 0x28]
mov eax, dword [edi + 4]
sub eax, dword [edi]
mov edx, dword [ebp - 0x24]
sar eax, 2
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [0x100c89c0]
cvttsd2si eax, xmm0
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 0x18]
mov dword [edx + 0x10], eax
test ebx, ebx
je 0x100475b8
sub ecx, ebx
mov eax, ebx
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x100475ae
mov ebx, dword [ebx - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100475cc
push ecx
push ebx
call fcn.10051247
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.100772ff
int3
Function at 0x1004dee0
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100ef0a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0xc], ebx
mov word [ebp - 8], 0x500
push esi
push edi
test eax, eax
jne 0x1004df23
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
mov dword [ebp - 0x18], esi
jmp 0x1004df36
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x18], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
jne 0x1004df5d
call edi
cmp eax, 5
jne 0x1004df5d
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10050cd5
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x14]
mov dword [ebp - 0x20], ebx
push eax
push 8
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1004e019
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
push 0
push 2
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x1004df98
call edi
cmp eax, 0x7a
jne 0x1004e019
push dword [ebp - 0x10]
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
push ebx
push 2
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x1004e019
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x1004e019
xor edi, edi
cmp dword [ebx], edi
jbe 0x1004e019
lea esi, [ebx + 8]
nop dword [eax]
push dword [esi - 4]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x1004e005
test byte [esi], 4
jne 0x1004e00f
inc edi
add esi, 8
cmp edi, dword [ebx]
jb 0x1004dff0
jmp 0x1004e016
mov dword [ebp - 0x20], 1
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1004e027
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
test ebx, ebx
je 0x1004e032
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1004e042
push eax
call edi
test esi, esi
je 0x1004e049
push esi
call edi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x20]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.10050cd5
mov esp, ebp
pop ebp
ret

Function at 0x1004fe50
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x1004fe69
pop ebp
ret
call sub.WS2_32.dll_WSAGetLastError
push eax
push str.connect
call fcn.100503c0
int3
Function at 0x10050190
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
movsd xmm0, qword [ebp + 0x14]
push esi
push ebx
push edi
sub esp, 8
movsd qword [esp], xmm0
call fcn.1003ffa0
mov edi, dword [ebp + 0x10]
add esp, 8
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push 4
push eax
push edi
push ebx
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x100501e3
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push edi
push ebx
mov esi, eax
call fcn.100506e0
add esp, 8
test eax, eax
je 0x100501f6
jmp 0x100501ea
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
push eax
push str.setsockopt___s___failed
push esi
call fcn.10041be0
push edi
push ebx
push str.setsockopt_level_d__opt_d__failed
push esi
call fcn.10041be0
int3

Function at 0x10050210
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
push dword [ebp + 0x18]
mov edi, dword [ebp + 0xc]
push dword [ebp + 0x14]
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x1005024a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push esi
push edi
mov ebx, eax
call fcn.100506e0
add esp, 8
test eax, eax
je 0x1005025b
jmp 0x1005024f
pop edi
pop esi
pop ebx
pop ebp
ret
push eax
push str.setsockopt___s___failed
push ebx
call fcn.10041be0
push esi
push edi
push str.setsockopt_level_d__opt_d__failed
push ebx
call fcn.10041be0
int3

Function at 0x100502a0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c37db
mov eax, dword fs:[0]
push eax
sub esp, 0x198
mov eax, dword [0x100ef0a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x100f4d10
lea ecx, [ebp - 0x1a4]
call fcn.100383a0
cmp byte [0x100f4d10], 0
mov dword [ebp - 4], 0
jne 0x10050312
lea eax, [ebp - 0x1a0]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x10050336
mov eax, dword [ebp - 0x1a0]
cmp al, 2
jne 0x10050347
shr eax, 8
cmp al, 2
jne 0x10050347
lea ecx, [ebp - 0x1a4]
call fcn.100383d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10050cd5
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.WSAStartup
call fcn.10041dd0
call dword [sym.imp.WS2_32.dll_WSACleanup]
push str.no_suitable_Winsock_version
call fcn.10033450
int3

Function at 0x100a622a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100a5e11

Function at 0x100ac5b0
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100abf72

Function at 0x100b9942
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100b9816