joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10019a36
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x130
push esi
mov esi, ecx
mov eax, dword [esi + 4]
mov ecx, dword [esp + 0x140]
lea edx, [esp + 4]
push edx
push 0
mov dword [esp + 0x3c], eax
push 0
lea eax, [esp + 0x3c]
push eax
push 0
mov dword [esp + 0x44], 1
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], 0
call sub.WS2_32.dll_select
test eax, eax
jne 0x10019ab9
mov dword [esp + 0xc], vtable.nsSocket::CBlockingSocketException.0
call sub.WS2_32.dll_WSAGetLastError
push 0xf
push str.Receive_timeout
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], eax
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], 0
mov byte [esp + 0x20], 0
call fcn.10004290
push 0x101542a4
lea ecx, [esp + 0x10]
push ecx
call fcn.100f8e2a
mov edx, dword [esp + 0x13c]
mov eax, dword [esp + 0x138]
mov ecx, dword [esi + 4]
push 0
push edx
push eax
push ecx
call sub.WS2_32.dll_recv
cmp eax, 0xffffffff
jne 0x10019af6
push edi
mov edi, str.Receive
lea esi, [esp + 0x10]
call fcn.100193b0
push 0x101542a4
mov edx, esi
push edx
call fcn.100f8e2a
pop edi
pop esi
add esp, 0x130
ret 0xc

Function at 0x10019d90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1011e8e9
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push edi
mov eax, dword [0x1015d2f0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
xor ebx, ebx
push ebx
push ebx
lea eax, [esp + 0x14]
push eax
push 0x400
push ecx
push ebx
mov dword [esp + 0x28], ebx
push 0x1300
mov dword [esp + 0x30], esi
mov dword [esp + 0x28], ebx
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
mov byte [esi + 4], bl
mov dword [esp + 0x20], ebx
mov edx, dword [esp + 0xc]
mov dword [esp + 0x10], 1
cmp edx, ebx
je 0x10019e1f
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10019e02
sub eax, edi
push eax
push edx
mov ecx, esi
call fcn.10004290
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x18
ret
Function at 0x1001a5b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1011f616
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1015d2f0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
mov eax, dword [esp + 0x2c]
xor ebx, ebx
mov dword [esp + 0x1c], ebx
mov dword [esi + 8], ecx
lea ecx, [esi + 0xc]
mov dword [esi], vtable.nsFTP::CFTPClient.0
mov dword [esi + 4], eax
push 2
mov edi, 0xf
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push 0x1013e210
mov byte [ecx + 4], bl
call fcn.10004290
mov edx, dword [esp + 0x34]
push 0xffffffffffffffff
lea ecx, [esi + 0x28]
mov byte [esp + 0x20], 1
push ebx
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push edx
mov byte [ecx + 4], bl
call fcn.100057a0
mov edi, dword [esp + 0x30]
lea eax, [esi + 0x44]
push eax
mov byte [esp + 0x20], 2
call fcn.1001f1a0
push 4
mov byte [esp + 0x20], 3
lea edi, [esi + 0x5c]
call fcn.100f4579
add esp, 4
cmp eax, ebx
je 0x1001a655
mov dword [eax], edi
jmp 0x1001a657
xor eax, eax
mov dword [edi], eax
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], ebx
mov dword [esi + 0x7c], ebx
mov eax, dword [esp + 0x28]
mov dword [esp + 0x28], ebx
mov dword [esi + 0x80], eax
push 0x18
mov byte [esp + 0x20], 6
call fcn.100f4579
add esp, 4
cmp eax, ebx
je 0x1001a692
mov edi, eax
call fcn.10023ee0
jmp 0x1001a694
xor eax, eax
mov dword [esi + 0x84], eax
mov byte [esp + 0x1c], 7
lea eax, [esi + 0x8c]
push eax
mov byte [esi + 0x88], bl
mov byte [esi + 0x89], bl
mov byte [esi + 0x8a], 1
call fcn.1001f840
lea ecx, [esi + 0xac]
push ecx
mov byte [esp + 0x20], 8
call fcn.100213d0
mov dword [esp + 0x1c], 0xffffffff
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x1001a6e7
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0x14
Function at 0x100215b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1011dcb3
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x1015d2f0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
xor ebx, ebx
mov dword [esp + 0x14], ebx
push 0xffffffffffffffff
lea ecx, [esi + 4]
mov dword [esi], vtable.nsFTP::CCommand::CExtendedInfo.0
push ebx
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push eax
mov byte [ecx + 4], bl
call fcn.100057a0
mov edx, dword [esp + 0x24]
push 0xffffffffffffffff
lea ecx, [esi + 0x20]
mov byte [esp + 0x18], 1
push ebx
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push edx
mov byte [ecx + 4], bl
call fcn.100057a0
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, dword [esp + 0x34]
mov dword [esi + 0x48], eax
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], edx
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 0x1c
Function at 0x10026400
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10121d7b
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebp
push esi
push edi
mov eax, dword [0x1015d2f0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, dword [esp + 0x30]
xor ebp, ebp
mov dword [esi + 0xc], ebp
mov dword [esp + 0x10], 6
mov dword [esi + 0x14], ebp
mov dword [esp + 0x28], 2
mov dword [esi], vtable.CryptoPP::BaseN_Decoder.0
mov dword [esi + 4], vtable.CryptoPP::BaseN_Decoder.1.0
mov dword [esi + 0x34], ebp
mov dword [esi + 0x38], ebp
mov byte [esp + 0x28], 4
mov ecx, dword [esi + 0xc]
cmp ecx, ebp
je 0x10026469
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x18]
push edx
mov ecx, str.DecodingLookupArray
mov dword [esi + 0xc], eax
call fcn.10028cb0
add esp, 8
mov byte [esp + 0x28], 5
movzx ecx, byte [eax + 8]
push ecx
lea edx, [esp + 0x14]
push edx
push str.Log2Base
mov edi, eax
call fcn.10028f20
push eax
mov ecx, esi
call fcn.10048fa0
mov byte [esp + 0x28], 4
mov ecx, dword [esp + 0x18]
cmp ecx, ebp
je 0x100264bf
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x1c
ret 0xc

Function at 0x10027d40
Capabilities:
Hash data with md5

Disassembly:
push 0xffffffffffffffff
push 0x10120990
mov eax, dword fs:[0]
push eax
mov eax, dword [0x1015d2f0]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0x58], 0x10
lea ecx, [eax + 0x10]
mov dword [ecx + 0x4c], ecx
mov dl, 1
mov byte [ecx + 0x41], dl
lea ecx, [eax + 0x60]
mov dword [ecx + 0x48], 0x10
mov byte [ecx + 0x41], dl
mov dword [ecx + 0x4c], ecx
mov ecx, dword [eax + 0xac]
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret 4

Function at 0x10028bb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10121c61
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x1015d2f0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x2c]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], vtable.CryptoPP::AlgorithmParameters.0
mov dword [esp + 0x14], 0
mov byte [esp + 0x18], 1
mov eax, dword [esp + 0x30]
push 1
push eax
push ecx
lea edi, [esp + 0x1c]
mov dword [esp + 0x30], 1
call fcn.10028e60
push eax
push esi
call fcn.1004a0c0
mov byte [esp + 0x24], 0
mov ecx, dword [esp + 0x14]
mov dword [esp + 0xc], 1
test ecx, ecx
je 0x10028c33
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret
Function at 0x10028cb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10121c61
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x1015d2f0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x2c]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], vtable.CryptoPP::AlgorithmParameters.0
mov dword [esp + 0x14], 0
mov byte [esp + 0x18], 1
mov eax, dword [esp + 0x30]
push eax
push ecx
lea edi, [esp + 0x18]
mov dword [esp + 0x2c], 1
call fcn.10029080
push eax
push esi
call fcn.1004a0c0
mov byte [esp + 0x24], 0
mov ecx, dword [esp + 0x14]
mov dword [esp + 0xc], 1
test ecx, ecx
je 0x10028d31
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret

Function at 0x1002a1c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1011d7e3
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x1015d2f0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor ebx, ebx
mov eax, 0xf
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], ebx
mov byte [esi + 4], bl
mov dword [esp + 0x14], ebx
mov dword [esi + 0x34], eax
mov dword [esi + 0x30], ebx
mov byte [esi + 0x20], bl
mov byte [esp + 0x14], 1
push 4
mov dword [esi + 0x5c], ebx
call fcn.100f4579
add esp, 4
cmp eax, ebx
je 0x1002a21d
mov dword [eax], ebx
jmp 0x1002a21f
xor eax, eax
push 0xc
mov dword [esi + 0x60], eax
call fcn.100f4579
add esp, 4
cmp eax, ebx
je 0x1002a23a
mov dword [eax + 8], ebx
mov dword [eax + 4], ebx
mov dword [eax], ebx
jmp 0x1002a23c
xor eax, eax
mov dword [esi + 0x64], eax
mov eax, dword [esp + 0x20]
push eax
mov ecx, esi
mov dword [esi + 0x58], ebx
call fcn.1002ded0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 8
Function at 0x1002c230
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov esi, eax
mov eax, dword [esi]
mov ecx, dword [esi + 8]
push eax
push 1
push ecx
push edi
call fcn.100f5473
mov ecx, dword [esi + 8]
add esp, 0x10
cmp eax, 1
mov eax, ecx
sete bl
cdq
idiv dword [esi + 0x18]
mov byte [esp + 0x12], bl
mov dword [esi + 0x1c], eax
test bl, bl
je 0x1002c3a9
add dword [esi + 0x14], ecx
cmp dword [esi + 0x54], 0x10
push 0xffffffffffffffff
push eax
push 0x18
push ecx
mov ecx, esp
jb 0x1002c283
mov eax, dword [esi + 0x40]
jmp 0x1002c286
lea eax, [esi + 0x40]
mov dword [ecx], eax
push ecx
mov eax, esp
mov dword [eax], str.read
lea eax, [esi + 0x20]
push eax
mov dword [esp + 0x2c], eax
call fcn.1002a3e0
mov ecx, dword [esi + 0x18]
mov ebx, dword [esi + 0x1c]
add esp, 0x18
xor ebp, ebp
xor eax, eax
cmp ecx, 1
sete byte [esp + 0x13]
test ebx, ebx
je 0x1002c344
xor edx, edx
dec ebx
cmp byte [esp + 0x13], dl
je 0x1002c2c8
cmp byte [edi], dl
jmp 0x1002c2cc
cmp word [edi], 0
sete dl
test edx, edx
je 0x1002c2f6
test eax, eax
je 0x1002c2ef
cmp edi, eax
je 0x1002c2ef
imul ecx, ebp
mov edx, edi
sub edx, eax
push edx
push eax
sub eax, ecx
push eax
call fcn.100f4a90
add esp, 0xc
mov ecx, dword [esi + 0x18]
lea eax, [ecx + edi]
inc ebp
add edi, ecx
test ebx, ebx
jne 0x1002c2bb
test eax, eax
je 0x1002c319
cmp edi, eax
je 0x1002c319
mov ecx, dword [esi + 0x18]
imul ecx, ebp
sub edi, eax
push edi
push eax
sub eax, ecx
push eax
call fcn.100f4a90
add esp, 0xc
test ebp, ebp
je 0x1002c344
mov edx, dword [esp + 0x14]
push 0xffffffffffffffff
push ebp
push 1
push ecx
mov eax, esp
push ecx
mov dword [eax], 0
mov eax, esp
push edx
mov dword [eax], str.nulls_removed
call fcn.1002a3e0
add esp, 0x18
sub dword [esi + 0x1c], ebp
cmp dword [esi + 0x18], 1
jle 0x1002c39b
test byte [esi + 4], 0x80
je 0x1002c39b
mov esi, dword [esi + 0x1c]
test esi, esi
je 0x1002c376
jmp 0x1002c360
mov ecx, dword [esp + 0x1c]
movzx eax, word [ecx + esi*2 - 2]
dec esi
rol ax, 8
mov word [ecx + esi*2], ax
test esi, esi
jne 0x1002c360
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push ecx
mov eax, esp
mov dword [eax], 0
push ecx
mov eax, esp
mov dword [eax], str.endian_swap
mov eax, dword [esp + 0x28]
push eax
call fcn.1002a3e0
add esp, 0x18
mov al, byte [esp + 0x12]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
push esi
call fcn.1002bd20
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 8
ret 4
Function at 0x1002cc70
Capabilities:
Write file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, eax
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
imul ecx, eax
push edi
mov dword [esi + 8], ecx
test ebp, ebp
jne 0x1002cc8c
mov ebp, edx
mov ecx, dword [esi + 4]
xor edi, edi
test cl, cl
jns 0x1002cd06
test edx, edx
jne 0x1002ccc5
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.100f2fca
mov edi, eax
mov eax, dword [esi + 0x1c]
add eax, eax
push eax
push ebp
push edi
call fcn.100f8ff0
add esp, 0x10
mov edx, edi
mov ebp, edi
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x1002cce2
lea esp, [esp]
movzx ecx, word [edx + eax*2 - 2]
dec eax
rol cx, 8
mov word [edx + eax*2], cx
test eax, eax
jne 0x1002ccd0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push ecx
mov eax, esp
push ecx
mov dword [eax], 0
mov eax, esp
lea ecx, [esi + 0x20]
push ecx
mov dword [eax], str.endian_swap
call fcn.1002a3e0
add esp, 0x18
mov edx, dword [esi]
mov eax, dword [esi + 8]
push edx
push 1
push eax
push ebp
call fcn.100f426f
add esp, 0x10
cmp eax, 1
sete bl
test edi, edi
je 0x1002cd2b
push edi
call fcn.100f407a
add esp, 4
test bl, bl
je 0x1002cd6e
mov edx, dword [esi + 0x1c]
mov ecx, dword [esi + 8]
add dword [esi + 0x14], ecx
cmp dword [esi + 0x54], 0x10
push 0xffffffffffffffff
push edx
push 0x18
push ecx
mov ecx, esp
jb 0x1002cd4b
mov eax, dword [esi + 0x40]
jmp 0x1002cd4e
lea eax, [esi + 0x40]
push ecx
mov dword [ecx], eax
mov eax, esp
add esi, 0x20
push esi
mov dword [eax], str.write
call fcn.1002a3e0
add esp, 0x18
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
ret 4
push esi
call fcn.1002bd20
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
ret 4
Function at 0x10031b60
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push 0x1013e254
xor esi, esi
push eax
mov dword [esp + 0x14], esi
call fcn.100f5169
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x10031b94
mov ecx, dword [esp + 0x1c]
mov dword [ecx], esi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret
push edi
push ebx
push 0x2000
push 1
push ebp
xor edi, edi
call fcn.100f5473
mov esi, eax
add esp, 0x10
cmp esi, 0x2000
jae 0x10031bd4
push ebx
call fcn.100f6247
add esp, 4
test eax, eax
jne 0x10031bd4
mov edx, dword [esp + 0x18]
push edx
push str.error_in_reading__s_n
call fcn.100f64b3
add esp, 8
or edi, 0xffffffff
test esi, esi
jbe 0x10031bf5
test ebp, ebp
jne 0x10031be2
mov dword [esp + 0x10], ebp
jmp 0x10031bf5
mov eax, dword [esp + 0x10]
push esi
mov ecx, ebp
call fcn.100529b0
add esp, 4
mov dword [esp + 0x10], eax
test edi, edi
jne 0x10031bfd
test esi, esi
ja 0x10031b95
push ebx
call fcn.100f44fd
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x24]
add esp, 4
mov dword [ecx], eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x10032120
Capabilities:
Get file size

Disassembly:
cmp dword [eax + 0x18], 0x10
jb 0x1003212b
mov eax, dword [eax + 4]
jmp 0x1003212e
add eax, 4
push esi
push 0
push 0
push 3
push 0
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
xor eax, eax
cmp esi, 0xffffffff
je 0x10032160
push edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
ret

Function at 0x10032460
Capabilities:
Parse pe header
Read file on windows

Disassembly:
sub esp, 0x10
cmp dword [eax + 0x18], 0x10
jb 0x1003246e
mov eax, dword [eax + 4]
jmp 0x10032471
add eax, 4
push esi
push 0
push 0x80
push 3
push 0
push 1
push accept
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10032499
xor al, al
pop esi
add esp, 0x10
ret
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push 0
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea eax, [esp + 0x14]
push eax
push 2
lea ecx, [esp + 0x18]
push ecx
push esi
call ebx
mov edx, 0x5a4d
cmp word [esp + 0xc], dx
jne 0x10032537
push 0
push 0
push 0x3c
push esi
call edi
push 0
lea eax, [esp + 0x14]
push eax
push 4
lea ecx, [esp + 0x20]
push ecx
push esi
call ebx
mov edx, dword [esp + 0x14]
push 0
push 0
push edx
push esi
call edi
push 0
lea eax, [esp + 0x14]
push eax
push 2
lea ecx, [esp + 0x18]
push ecx
push esi
call ebx
mov edx, 0x4550
cmp word [esp + 0xc], dx
jne 0x10032537
mov eax, dword [esp + 0x14]
push 0
push 0
add eax, 0x28
push eax
push esi
call edi
push 0
lea ecx, [esp + 0x14]
push ecx
push 4
lea edx, [esp + 0x24]
push edx
push esi
call ebx
cmp dword [esp + 0x18], 0
jne 0x10032547
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
xor al, al
pop esi
add esp, 0x10
ret
mov eax, dword [esp + 0x14]
push 0
push 0
add eax, 0x16
push eax
push esi
call edi
push 0
lea ecx, [esp + 0x14]
push ecx
push 2
lea edx, [esp + 0x18]
push edx
push esi
call ebx
test byte [esp + 0xc], 2
push esi
jne 0x10032538
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
mov al, 1
pop esi
add esp, 0x10
ret
Function at 0x10033060
Capabilities:
Create directory
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x1011f062
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x1015d2f0]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
push ebp
push edi
mov eax, dword [0x1015d2f0]
xor eax, esp
push eax
lea eax, [esp + 0x220]
mov dword fs:[0], eax
xor ebx, ebx
push 0x1ff
lea eax, [esp + 0x21]
push ebx
mov dword [esp + 0x1c], ebx
push eax
mov dword [esp + 0x24], esi
mov byte [esp + 0x28], bl
call fcn.100f8db0
add esp, 0xc
push 1
push 0x23
lea ecx, [esp + 0x24]
push ecx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea edi, [esi + 4]
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
mov byte [edi], bl
lea eax, [esp + 0x1c]
mov dword [esp + 0x228], ebx
mov dword [esp + 0x14], 1
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x100330f0
sub eax, ecx
push eax
lea edx, [esp + 0x20]
push edx
mov ecx, esi
call fcn.10004290
push 1
push 0x1013af20
mov ecx, esi
call fcn.10006400
push 0xffffffffffffffff
push ebx
push 0x1015f040
mov ecx, esi
call fcn.10006300
push esi
call fcn.10032350
mov ebp, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add esp, 4
test al, al
jne 0x10033146
cmp dword [esi + 0x18], 0x10
jb 0x10033140
mov eax, dword [edi]
jmp 0x10033142
mov eax, edi
push ebx
push eax
call ebp
push 1
push 0x1013af20
mov ecx, esi
call fcn.10006400
push 0xf
push str.ProductFeatures
mov ecx, esi
call fcn.10006400
push esi
call fcn.10032350
add esp, 4
test al, al
jne 0x1003317f
cmp dword [esi + 0x18], 0x10
jb 0x10033179
mov eax, dword [edi]
jmp 0x1003317b
mov eax, edi
push ebx
push eax
call ebp
push 1
push 0x1013af20
mov ecx, esi
call fcn.10006400
push 9
push str.LocalLogs
mov ecx, esi
call fcn.10006400
push esi
call fcn.10032350
add esp, 4
test al, al
jne 0x100331b4
cmp dword [esi + 0x18], 0x10
jb 0x100331b0
mov edi, dword [edi]
push ebx
push edi
call ebp
mov eax, esi
mov ecx, dword [esp + 0x220]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.100f30a6
add esp, 0x21c
ret
Function at 0x100331e0
Capabilities:
Create directory
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x1011f062
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x1015d2f0]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
push ebp
push edi
mov eax, dword [0x1015d2f0]
xor eax, esp
push eax
lea eax, [esp + 0x220]
mov dword fs:[0], eax
xor ebx, ebx
push 0x1ff
lea eax, [esp + 0x21]
push ebx
mov dword [esp + 0x1c], ebx
push eax
mov dword [esp + 0x24], esi
mov byte [esp + 0x28], bl
call fcn.100f8db0
add esp, 0xc
push 1
push 0x23
lea ecx, [esp + 0x24]
push ecx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea edi, [esi + 4]
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
mov byte [edi], bl
lea eax, [esp + 0x1c]
mov dword [esp + 0x228], ebx
mov dword [esp + 0x14], 1
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x10033270
sub eax, ecx
push eax
lea edx, [esp + 0x20]
push edx
mov ecx, esi
call fcn.10004290
push 1
push 0x1013af20
mov ecx, esi
call fcn.10006400
push 0xffffffffffffffff
push ebx
push 0x1015f040
mov ecx, esi
call fcn.10006300
push esi
call fcn.10032350
mov ebp, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add esp, 4
test al, al
jne 0x100332c6
cmp dword [esi + 0x18], 0x10
jb 0x100332c0
mov eax, dword [edi]
jmp 0x100332c2
mov eax, edi
push ebx
push eax
call ebp
push 1
push 0x1013af20
mov ecx, esi
call fcn.10006400
push 0xf
push str.ProductFeatures
mov ecx, esi
call fcn.10006400
push esi
call fcn.10032350
add esp, 4
test al, al
jne 0x100332ff
cmp dword [esi + 0x18], 0x10
jb 0x100332f9
mov eax, dword [edi]
jmp 0x100332fb
mov eax, edi
push ebx
push eax
call ebp
push 1
push 0x1013af20
mov ecx, esi
call fcn.10006400
push 0xa
push str.RemoteLogs
mov ecx, esi
call fcn.10006400
push esi
call fcn.10032350
add esp, 4
test al, al
jne 0x10033334
cmp dword [esi + 0x18], 0x10
jb 0x10033330
mov edi, dword [edi]
push ebx
push edi
call ebp
mov eax, esi
mov ecx, dword [esp + 0x220]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.100f30a6
add esp, 0x21c
ret

Function at 0x10035400
Capabilities:
Create thread

Disassembly:
cmp dword [esi], 0
jne 0x10035497
cmp dword [esi + 4], 0
jle 0x10035497
cmp dword [0x10163098], 0
je 0x10035497
cmp dword [0x1016309c], 0
je 0x10035497
mov eax, dword [0x10163088]
test eax, eax
je 0x10035497
call eax
test al, al
je 0x10035497
push edi
call dword [0x10163098]
push 0
mov edi, eax
call fcn.100f6578
add esp, 4
cmp eax, edi
jl 0x1003548f
mov ecx, dword [esi + 4]
imul ecx, ecx, 0x15180
add ecx, edi
cmp eax, ecx
jle 0x10035496
cmp dword [esi], 0
jne 0x10035496
lea edi, [esi + 8]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esi], 0
jne 0x10035486
push 0
push 0
push esi
push 0x100354a0
push 0
push 0
call fcn.100f3d5f
add esp, 0x18
mov dword [esi], eax
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
ret
push eax
call dword [0x1016309c]
pop edi
ret
Function at 0x10038c20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1011ef81
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
mov eax, dword [0x1015d2f0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0xc], ebx
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
mov dword [esp + 0x10], esi
mov byte [esi + 4], bl
push 1
push 0xffffffffffffffff
lea eax, [esp + 0x10]
mov dword [esp + 0x40], ebx
push eax
mov ecx, edi
mov dword [esp + 0x18], 1
mov byte [esp + 0x14], 0x2e
call fcn.100082e0
cmp eax, 0xffffffff
je 0x10038ccf
push 1
push 0xffffffffffffffff
lea ecx, [esp + 0x10]
push ecx
mov ecx, edi
mov byte [esp + 0x14], 0x2e
call fcn.100082e0
push eax
push ebx
lea edx, [esp + 0x1c]
push edx
mov ecx, edi
call fcn.100043c0
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
mov dword [esp + 0x44], 1
call fcn.100057a0
mov byte [esp + 0x38], bl
cmp dword [esp + 0x2c], 0x10
jb 0x10038ccf
mov eax, dword [esp + 0x18]
push eax
call fcn.100f4085
add esp, 4
push 4
push str..zip
mov ecx, esi
call fcn.10006400
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop ebx
add esp, 0x34
ret