joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10c6620
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x104bb80
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x10c664c
mov ecx, dword [esi + 0x1c8]
push eax
call ecx
push esi
call fcn.010c6530
movzx edx, word [esi + 0x8804]
push edx
push esi
call fcn.0102ffa0
push esi
call fcn.010c65a0
pop esi
pop ebp
ret 4

Function at 0x10c7b40
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
cmp byte [eax + 0x135ac], 0
lea ecx, [eax + 0x135ac]
je 0x10c7c40
push edi
push ecx
push eax
call fcn.010bc4a0
mov eax, dword [esi]
push 0x1018770
add eax, 0x135ac
push eax
push 0x1018728
call fcn.01085230
mov edi, eax
test edi, edi
je 0x10c7bad
mov ecx, dword [esi]
push 0
push 0
push 0
push edi
push connect
push ecx
call fcn.010bb690
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov eax, dword [esi]
cmp dword [eax + 0x8b88], 0
pop edi
je 0x10c7bc9
mov eax, dword [eax + 0x5b8]
lea edx, [ebp + 8]
push edx
call eax
test eax, eax
je 0x10c7c28
push 0x20a
lea ecx, [ebp - 0x20c]
push 0
push ecx
call sub.msvcrt.dll_memset
mov eax, dword [esi]
lea edx, [eax + 0x135ac]
push edx
add eax, 0x7fbc
push eax
push 0x10173b8
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.0102d9e0
add esp, 0x20
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov eax, dword [esi]
cmp dword [eax + 0x8b88], 0
je 0x10c7c28
mov edx, dword [ebp + 8]
mov eax, dword [eax + 0x5b4]
push edx
call eax
mov ecx, dword [esi]
push 0x82
add ecx, 0x135ac
push 0
push ecx
call sub.msvcrt.dll_memset
add esp, 0xc
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10c8470
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
mov ecx, dword [eax + 0x1740]
mov edx, dword [eax + 0x380]
push 3
push 0
push 0
push ecx
call edx
mov ecx, dword [edi]
mov dword [ecx + 0x173c], eax
mov edx, dword [edi]
cmp dword [edx + 0x173c], 0
je 0x10c85bb
push ebx
push esi
xor ebx, ebx
mov edi, edi
mov eax, dword [edi]
lea ecx, [ebp - 4]
push ecx
push 0
add eax, 0x640
push eax
push 0x10c8300
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [ebp + ebx*4 - 0x10], eax
test eax, eax
je 0x10c853b
mov dword [ebp + 8], 5
lea esp, [esp]
push 0xc29
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x10c8535
mov eax, dword [edi]
mov edx, dword [eax + 0x1780]
mov dword [eax + edx*4 + 0x1744], esi
mov eax, dword [edi]
add eax, 0x1780
push eax
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
mov eax, dword [edi]
mov edx, dword [eax + 0x1740]
mov eax, dword [eax + 0x384]
lea ecx, [esi + 0xc10]
push ecx
push 0xc10
push esi
push edx
call eax
sub dword [ebp + 8], 1
jne 0x10c84e0
inc ebx
cmp ebx, 3
jb 0x10c84b0
mov ecx, dword [edi]
mov eax, dword [ecx + 0x490]
push 0xffffffffffffffff
push 1
lea edx, [ebp - 0x10]
push edx
push ebx
call eax
mov ecx, dword [edi]
xor esi, esi
mov dword [ebp + 8], ecx
test ebx, ebx
jle 0x10c857c
mov eax, dword [ebp + esi*4 - 0x10]
test eax, eax
je 0x10c8577
mov edx, dword [ebp + 8]
push eax
mov eax, dword [edx + 0x1c8]
call eax
inc esi
cmp esi, ebx
jl 0x10c8563
mov esi, 0x1744
mov ecx, dword [edi]
cmp dword [esi + ecx], 0
lea eax, [esi + ecx]
je 0x10c85a2
mov eax, dword [eax]
test eax, eax
je 0x10c85a2
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
add esi, 4
cmp esi, 0x1780
jb 0x10c8581
mov edx, dword [edi]
pop esi
mov dword [edx + 0x1780], 0
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x10c8eb0
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
push 0x8000
xor ebx, ebx
call fcn.0102b240
mov edi, dword [ebp + 8]
lea eax, [edi + eax*4 + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
push ebx
push 1
push 0x8000
push edi
call fcn.010b96d0
push 0xa00003
push ebx
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
mov dword [ebp - 4], esi
test esi, esi
je 0x10c900f
push 0xa00002
push ebx
push esi
call sub.msvcrt.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x44]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetSystemInfo]
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x38]
jae 0x10c8feb
jmp 0x10c8f30
cmp ebx, 0xa00000
jae 0x10c8fe7
mov ecx, dword [edi + 0x42c]
push 0x1c
lea edx, [ebp - 0x20]
push edx
push eax
mov eax, dword [ebp + 0xc]
push eax
call ecx
test eax, eax
je 0x10c8fe7
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x10c8fe7
cmp dword [ebp - 0x10], 0x1000
jne 0x10c8fd3
cmp dword [ebp - 8], 0x20000
jne 0x10c8fd3
mov ecx, dword [ebp - 0xc]
test cl, 0x74
je 0x10c8fd3
test ecx, 0x100
jne 0x10c8fd3
mov edi, 0xa00000
sub edi, ebx
cmp eax, edi
jae 0x10c8f91
mov edi, eax
mov esi, dword [ebp - 0x20]
test edi, edi
je 0x10c8fd3
mov edx, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
push 0
push 0x400
lea eax, [ebx + edx]
mov edx, dword [ebp + 8]
push eax
mov eax, dword [edx + 0x484]
push esi
push ecx
call eax
test eax, eax
je 0x10c8fd0
sub edi, 0x400
add ebx, 0x400
add esi, 0x400
test edi, edi
jne 0x10c8f98
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x20]
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
add eax, ecx
cmp eax, dword [ebp - 0x38]
jb 0x10c8f30
test ebx, ebx
jne 0x10c9002
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov dword [ebp - 4], 0
add edi, 0x44
push edi
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
mov esi, dword [ebp - 4]
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x10c9018
mov dword [eax], ebx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10c94e0
Capabilities:
Resume thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + 4]
push edi
push eax
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
mov ecx, dword [esi]
push 0x258
push ecx
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov edi, dword [ebp + 8]
push esi
push edi
call fcn.010c9440
test eax, eax
jne 0x10c9571
mov edx, dword [edi]
push esi
push edx
call fcn.010c93b0
mov eax, dword [edi]
mov ecx, dword [eax + 0x134]
push 0x64
call ecx
push esi
push edi
call fcn.010c9440
test eax, eax
jne 0x10c9571
push ebx
lea ebx, [eax + 4]
mov edx, dword [edi + 8]
mov eax, dword [esi]
mov ecx, dword [edx + 0x258]
push 0x320
push eax
call ecx
cmp eax, 0x102
jne 0x10c9562
mov edx, dword [edi]
push esi
push edx
call fcn.010c93b0
push esi
push edi
call fcn.010c9440
test eax, eax
jne 0x10c9570
sub ebx, 1
jne 0x10c9534
mov eax, dword [edi]
push esi
push eax
call fcn.010c93b0
pop ebx
mov ecx, dword [edi]
mov edx, dword [esi]
mov eax, dword [ecx + 0x174]
push 0
push edx
call eax
pop edi
pop esi
pop ebp
ret 8

Function at 0x10cb0f0
Capabilities:
Persist via run registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
cmp dword [eax + 0x8bb8], 0
jne 0x10cb184
push 0x20a
lea ecx, [ebp - 0x20c]
push 0
push ecx
call sub.msvcrt.dll_memset
mov edx, dword [ebp + 0xc]
push 0x1001d74
push edx
push 0x100bf80
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.0102d9e0
add esp, 0x20
cmp word [ebp - 0x20c], 0
lea eax, [ebp - 0x20c]
je 0x10cb159
nop
add eax, 2
cmp word [eax], 0
jne 0x10cb150
lea ecx, [ebp - 0x20c]
sub eax, ecx
sar eax, 1
lea edx, [eax + eax + 2]
push edx
mov eax, ecx
mov ecx, dword [esi]
push eax
push 1
push 0x1019014
push 0x1018fb8
push connect
push ecx
call fcn.010bae20
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x10cb370
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push edi
mov dword [ebp - 4], esi
call fcn.010cb2c0
test eax, eax
je 0x10cb437
mov esi, dword [edi]
push ebx
push 0x2000
call fcn.0102b240
lea ebx, [eax*4 + 8]
lea eax, [ebx + esi]
push eax
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
push 0
push 1
push 0x2000
push esi
call fcn.010b96d0
push 0x20a
lea ecx, [ebp - 0x210]
push 0
push ecx
call sub.msvcrt.dll_memset
mov edx, dword [edi + 8]
mov ecx, dword [edx + 0x228]
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 1
push 0
push 0x26
push 0
call ecx
lea edx, [ebp - 0x210]
push edx
call fcn.0102d5e0
test eax, eax
je 0x10cb428
push 0x10190d8
mov eax, edx
push eax
call fcn.0102d4b0
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10cb428
mov esi, 1
test al, 0x10
jne 0x10cb42b
mov esi, dword [ebp - 4]
mov edx, dword [edi]
add edx, ebx
push edx
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
pop ebx
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10cb450
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push edi
mov dword [ebp - 4], esi
call fcn.010cb2c0
test eax, eax
je 0x10cb517
mov esi, dword [edi]
push ebx
push 0x2000
call fcn.0102b240
lea ebx, [eax*4 + 8]
lea eax, [ebx + esi]
push eax
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
push 0
push 1
push 0x2000
push esi
call fcn.010b96d0
push 0x20a
lea ecx, [ebp - 0x210]
push 0
push ecx
call sub.msvcrt.dll_memset
mov edx, dword [edi + 8]
mov ecx, dword [edx + 0x228]
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 1
push 0
push 0x26
push 0
call ecx
lea edx, [ebp - 0x210]
push edx
call fcn.0102d5e0
test eax, eax
je 0x10cb508
push 0x1019128
mov eax, edx
push eax
call fcn.0102d4b0
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10cb508
mov esi, 1
test al, 0x10
jne 0x10cb50b
mov esi, dword [ebp - 4]
mov edx, dword [edi]
add edx, ebx
push edx
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
pop ebx
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10cb530
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push edi
mov dword [ebp - 4], esi
call fcn.010cb2c0
test eax, eax
je 0x10cb5f7
mov esi, dword [edi]
push ebx
push 0x2000
call fcn.0102b240
lea ebx, [eax*4 + 8]
lea eax, [ebx + esi]
push eax
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
push 0
push 1
push 0x2000
push esi
call fcn.010b96d0
push 0x20a
lea ecx, [ebp - 0x210]
push 0
push ecx
call sub.msvcrt.dll_memset
mov edx, dword [edi + 8]
mov ecx, dword [edx + 0x228]
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 1
push 0
push 0x26
push 0
call ecx
lea edx, [ebp - 0x210]
push edx
call fcn.0102d5e0
test eax, eax
je 0x10cb5e8
push 0x1019178
mov eax, edx
push eax
call fcn.0102d4b0
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10cb5e8
mov esi, 1
test al, 0x10
jne 0x10cb5eb
mov esi, dword [ebp - 4]
mov edx, dword [edi]
add edx, ebx
push edx
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
pop ebx
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10cb8f0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov dword [ebp - 4], 0
test eax, eax
jne 0x10cb910
xor ebx, ebx
jmp 0x10cb91e
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10cb913
sub eax, edx
mov ebx, eax
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov edi, dword [ebp + 0x10]
mov edx, dword [eax + 0x498]
push 4
push 0x3000
lea ecx, [ebx + 2]
push ecx
push 0
push edi
call edx
mov dword [ebp + 0x10], eax
test eax, eax
je 0x10cba8f
mov ecx, dword [esi]
lea edx, [ebp - 8]
push edx
mov edx, dword [ebp + 0xc]
push ebx
push edx
push eax
mov eax, dword [ecx + 0x430]
push edi
call eax
test eax, eax
je 0x10cba8f
push 0x20a
lea ecx, [ebp - 0x214]
push 0
push ecx
call sub.msvcrt.dll_memset
mov ebx, dword [esi]
add esp, 0xc
push 0x8000
call fcn.0102b240
lea eax, [eax*4 + 8]
mov dword [ebp + 0xc], eax
add eax, ebx
push eax
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
push 0
push 1
push 0x8000
push ebx
call fcn.010b96d0
mov ebx, dword [esi + 8]
push 0x103
lea edx, [ebp - 0x214]
push edx
push 0x100bf00
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
mov eax, dword [ebx + 0x220]
push edi
call eax
test eax, eax
je 0x10cba75
push 0x1019444
lea ecx, [ebp - 0x214]
push ecx
call fcn.0102d810
test eax, eax
je 0x10cba75
mov edx, dword [esi]
cmp dword [edx + 0x8aec], 6
push 0
push 0
jb 0x10cba30
mov ecx, dword [ebp + 0x10]
mov edx, dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov eax, dword [esi + 8]
push 0
push 0
push 0
push ecx
push edx
push edi
push 0
push 0x1fffff
lea ecx, [ebp + 8]
mov dword [ebp + 8], 0
mov edx, dword [eax + 0x98]
push ecx
call edx
mov eax, dword [ebp + 8]
jmp 0x10cba49
mov eax, dword [ebp + 0x10]
mov ecx, dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
push eax
push ecx
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.DLL_CreateRemoteThread]
mov dword [ebp + 8], eax
test eax, eax
je 0x10cba75
mov edx, dword [esi + 8]
push eax
mov eax, dword [edx + 0x1c4]
mov edi, 1
call eax
mov ecx, dword [esi]
add ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [esi]
add ecx, dword [ebp + 0xc]
mov edi, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10cbbb0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push 0x15
push 8
xor ebx, ebx
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x10cbc31
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 8]
mov dword [esi + 8], ecx
lea ecx, [ebp + 8]
push ecx
push ebx
push esi
push 0x10cbb60
mov dword [esi + 4], eax
mov eax, dword [ebp + 0x18]
push ebx
push ebx
mov dword [esi], edi
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x10cbc18
mov edx, dword [edi + 0x1c8]
push eax
call edx
pop edi
pop esi
lea eax, [ebx + 1]
pop ebx
pop ebp
ret 0x14
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 0x14
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 0x14
Function at 0x10d3140
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
push 0x19
push 8
xor edi, edi
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x10d31d1
mov eax, dword [ebp + 0x18]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [eax], edi
push ebx
mov ebx, dword [ebp + 0x14]
mov dword [esi + 4], edx
lea edx, [ebp + 0x18]
push edx
push edi
push esi
push 0x10d30c0
mov dword [esi], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 0x10]
push edi
push edi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], eax
mov dword [esi + 0x14], ecx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov edi, eax
test edi, edi
je 0x10d31c0
cmp edi, 0xffffffff
je 0x10d31c0
mov eax, dword [ebx]
test eax, eax
je 0x10d31af
cmp eax, 0xffffffff
jne 0x10d31d0
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x134]
push 0x14
call edx
jmp 0x10d31a4
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop ebx
mov eax, edi
pop edi
pop esi
pop ebp
ret 0x18

Function at 0x10d6120
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.01059740
mov eax, dword [esi]
mov edi, dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
push 1
add eax, 0x16164
push eax
call edi
test eax, eax
jne 0x10d616e
mov eax, dword [esi]
mov ecx, dword [eax + 0x1615c]
push 4
lea edx, [ebp + 8]
push edx
push 4
push 0x1019ed4
push 0x1015b3c
push connect
push eax
mov dword [ebp + 8], ecx
call fcn.010bae20
mov eax, dword [esi]
push eax
call fcn.01046710
mov ecx, dword [esi]
mov dword [ecx + 0x132ac], 1
mov edx, dword [esi]
mov dword [edx + 0x132b8], 1
mov eax, dword [esi]
push 1
add eax, 0x132b4
push eax
call edi
push esi
call fcn.0104f3c0
push esi
call fcn.0104cf80
mov edi, dword [esi]
lea ecx, [ebp + 8]
push ecx
push 0
push esi
push 0x109ba60
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x10d61cb
mov edx, dword [edi + 0x1c8]
push eax
call edx
pop edi
xor eax, eax
pop esi
pop ebp
ret 4
Function at 0x10d9450
Capabilities:
Hash data with md5

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6c
mov edx, dword [ebp + 0xc]
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x6c], 0x67452301
mov dword [ebp - 0x68], 0xefcdab89
mov dword [ebp - 0x64], 0x98badcfe
mov dword [ebp - 0x60], 0x10325476
cmp edx, ebx
jne 0x10d948a
xor edi, edi
jmp 0x10d949b
mov eax, edx
lea esi, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10d9490
sub eax, esi
mov edi, eax
xor esi, esi
cmp edi, ebx
jbe 0x10d94d4
mov ebx, dword [sym.imp.msvcrt.dll_tolower]
jmp 0x10d94b3
mov edx, dword [ebp + 0xc]
movsx eax, byte [esi + edx]
push eax
call ebx
add esp, 4
push 1
lea ecx, [ebp - 1]
push ecx
lea edx, [ebp - 0x6c]
push edx
mov byte [ebp - 1], al
call fcn.010bd7a0
inc esi
cmp esi, edi
jb 0x10d94b0
lea eax, [ebp - 0x6c]
push eax
call fcn.010bd870
mov ecx, dword [ebp + 8]
mov eax, 0x10
add ecx, 0x58
lea edx, [ebp - 0x14]
jmp 0x10d94f0
mov esi, dword [edx]
cmp esi, dword [ecx]
jne 0x10d9518
sub eax, 4
add ecx, 4
add edx, 4
cmp eax, 4
jae 0x10d94f0
xor eax, eax
xor edx, edx
test eax, eax
sete dl
pop edi
pop esi
pop ebx
mov eax, edx
mov esp, ebp
pop ebp
ret 8
movzx eax, byte [edx]
movzx esi, byte [ecx]
sub eax, esi
jne 0x10d9544
movzx eax, byte [edx + 1]
movzx esi, byte [ecx + 1]
sub eax, esi
jne 0x10d9544
movzx eax, byte [edx + 2]
movzx esi, byte [ecx + 2]
sub eax, esi
jne 0x10d9544
movzx eax, byte [edx + 3]
movzx ecx, byte [ecx + 3]
sub eax, ecx
sar eax, 0x1f
or eax, 1
xor edx, edx
test eax, eax
sete dl
pop edi
pop esi
pop ebx
mov eax, edx
mov esp, ebp
pop ebp
ret 8

Function at 0x10d9570
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
push edi
xor edi, edi
cmp dword [ebp + 8], edi
je 0x10d961e
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push esi
push 0x403
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x10d9613
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x10d95b9
mov eax, dword [eax + 0x1c]
push 0x1ff
push esi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x41
lea ecx, [ebp - 0x44]
push 0
push ecx
call sub.msvcrt.dll_memset
add esp, 0xc
mov eax, esi
cmp word [esi], di
je 0x10d95d8
add eax, 2
cmp word [eax], di
jne 0x10d95d0
push 0
push 0
push 0x3f
sub eax, esi
lea edx, [ebp - 0x44]
push edx
sar eax, 1
push eax
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x44]
push eax
add ecx, 0x20
push ecx
call fcn.010d9450
push esi
push 0
mov edi, eax
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop esi
pop ebx
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 0xc
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10d9630
Capabilities:
Hash data with md5

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x1c]
sub esp, 8
push ebx
push esi
push eax
call dword [sym.imp.msvcrt.dll_srand]
mov esi, dword [ebp + 0x20]
xor ebx, ebx
add esp, 4
cmp esi, ebx
je 0x10d9671
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push 1
push 7
push ecx
mov ecx, dword [ebp + 8]
push edx
push eax
push ecx
call fcn.01060ef0
mov eax, 0x1019fa4
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10d9692
sub eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
cmp eax, ebx
jle 0x10d973f
mov dword [ebp - 4], eax
push edi
lea ecx, [ecx]
call dword [sym.imp.msvcrt.dll_rand]
xor edx, edx
div dword [ebp - 8]
xor edi, edi
mov byte [ebp + 0x19], 0
mov dword [ebp + 0x1c], edx
mov dl, byte [edx + 0x1019fa4]
mov byte [ebp + 0x18], dl
call fcn.01060d20
mov esi, eax
test esi, esi
je 0x10d9706
mov edi, dword [ebp + 8]
push esi
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push eax
push ecx
lea eax, [ebx + edx + 0x14]
push eax
lea ecx, [ebp + 0x18]
push ecx
push edi
call fcn.01060e20
push esi
mov edi, eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov esi, dword [ebp + 0x20]
test esi, esi
je 0x10d9730
mov edx, dword [ebp + 0x1c]
movsx eax, byte [edx + 0x1019fa4]
push eax
call dword [sym.imp.msvcrt.dll_tolower]
add esp, 4
push 1
lea ecx, [ebp + 0x1f]
push ecx
push esi
mov byte [ebp + 0x1f], al
call fcn.010bd7a0
sub dword [ebp - 4], 1
lea ebx, [ebx + edi + 0x14]
jne 0x10d96b0
pop edi
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push 0
push 0
push edx
mov edx, dword [ebp + 8]
push eax
push ecx
push edx
call fcn.01060ef0
test esi, esi
je 0x10d9762
push esi
call fcn.010bd870
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x10da8f0
Capabilities:
Open clipboard

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0xc]
test byte [edi + 0x1104], 1
je 0x10da920
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x10da920
call dword [sym.imp.USER32.dll_EmptyClipboard]
call dword [sym.imp.USER32.dll_CloseClipboard]
test byte [edi + 0x1104], 2
mov esi, dword [ebp + 8]
je 0x10da978
mov edi, dword [esi]
push ebx
push 0x2000
call fcn.0102b240
lea ebx, [eax*4 + 8]
lea eax, [ebx + edi]
push eax
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
push 0
push 1
push 0x2000
push edi
call fcn.010b96d0
mov ecx, dword [esi]
mov edx, dword [ecx + 0x598]
push 7
push 0
push 0
call edx
mov eax, dword [esi]
add eax, ebx
push eax
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
mov edi, dword [ebp + 0xc]
pop ebx
test byte [edi + 0x1104], 4
je 0x10da988
push edi
push esi
call fcn.010da800
pop edi
pop esi
pop ebp
ret 8