joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005d360
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cf85d
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x40
push esi
push edi
mov eax, dword [0x100fd230]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebx + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
mov eax, dword [esi + 0x58]
cmp eax, 2
je 0x1005d3c1
cmp eax, 0x17
jne 0x1005d4ce
push 0x100d971e
push 0x58
call fcn.1008fb1b
mov edi, eax
add esp, 8
mov dword [ebp - 0x20], edi
mov byte [ebp - 4], 1
test edi, edi
je 0x1005d4ce
lea eax, [ebp - 0x50]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebx + 0x3c]
test ecx, ecx
je 0x1005d406
mov eax, dword [ecx]
lea edx, [ebp - 0x50]
push edx
mov eax, dword [eax]
call eax
mov dword [ebp - 0x2c], eax
lea ecx, [edi + 0x20]
mov dword [ecx + 0x24], 0
mov byte [ebp - 4], 4
lea eax, [ebp - 0x50]
xorps xmm0, xmm0
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
push eax
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 1
call fcn.10059b50
mov eax, dword [ebx + 0x10]
mov dword [edi + 0x50], eax
mov eax, dword [ebx + 0x14]
mov byte [edi + 0x48], 0
mov dword [edi + 0x4c], eax
mov dword [edi + 0x54], 0
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x1005d46e
mov edx, dword [ecx]
lea eax, [ebp - 0x50]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [ebp - 0x2c], 0
test edi, edi
je 0x1005d4ce
push 0
push edi
push dword [ebp - 0x18]
lea eax, [edi + 0x54]
push dword [ebp - 0x1c]
push eax
push 0
push 1
lea eax, [edi + 0x4c]
push eax
push dword [esi + 0xc]
call dword [sym.imp.WS2_32.dll_WSARecvFrom]
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp esi, 0xffffffff
jne 0x1005d504
cmp eax, 0x3e5
je 0x1005d504
mov ecx, dword [edi + 0x44]
lea esi, [edi + 0x20]
test ecx, ecx
je 0x1005d4c3
mov edx, dword [ecx]
cmp ecx, esi
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [esi + 0x24], 0
push 0x58
push edi
call fcn.1008f79d
add esp, 8
xor al, al
mov ecx, dword [ebx + 0x3c]
mov byte [ebp - 0x11], al
test ecx, ecx
je 0x1005d4ee
mov esi, dword [ecx]
lea eax, [ebx + 0x18]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov al, byte [ebp - 0x11]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x38
mov al, 1
jmp 0x1005d4d0
Function at 0x1005dc10
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cf995
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x100fd230]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10105564]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x101069c0]
cmp eax, dword [ecx + 4]
jle 0x1005dd47
push 0x101069c0
call fcn.1008f927
add esp, 4
cmp dword [0x101069c0], 0xffffffff
jne 0x1005dd47
mov dword [ebp - 4], 0
xor eax, eax
push 8
mov dword [0x101069c8], 0
mov word [0x101069cc], ax
mov dword [0x101069d0], eax
mov dword [0x101069d4], eax
mov dword [0x101069d8], eax
mov dword [0x101069dc], eax
mov dword [0x101069e0], eax
call fcn.1008f453
add esp, 4
mov dword [eax + 4], 0
mov dword [0x101069d0], eax
mov dword [eax], 0x101069d0
push 2
push 0x101069e4
call fcn.1008c6b6
mov byte [ebp - 4], 2
push 8
mov dword [0x10106a14], 0xffffffff
mov byte [0x10106a18], 0
call fcn.1008f453
add esp, 0xc
mov dword [ebp - 0x10], eax
mov dword [eax], 0x101069c8
mov dword [eax + 4], 0x1005dea0
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
push ecx
push 0
push eax
push 0x1005e800
push 0
push 0
call fcn.100a7074
add esp, 0x18
mov dword [ebp - 0x18], eax
test eax, eax
je 0x1005dd5b
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 4
call fcn.100583d0
cmp dword [ebp - 0x14], 0
jne 0x1005dd69
push 0x100d3eb0
call fcn.1008f788
add esp, 4
push 0x101069c0
call fcn.1008f8dd
add esp, 4
mov eax, 0x101069c8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 6
mov dword [ebp - 0x14], 0
call fcn.1008c15a
call fcn.100a3c47
int3
Function at 0x1005eac0
Capabilities:
Convert ip address from string
Create udp socket
Encode data using xor
Receive data
Receive data on socket
Send data
Send data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x78
mov eax, dword [0x100fd230]
xor eax, esp
mov dword [esp + 0x74], eax
mov eax, dword [ebp + 8]
push esi
push edi
push 0
push 2
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 0xc]
push 2
mov dword [esp + 0x20], edx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x24], eax
mov byte [esp + 0x14], 0
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
cmp edi, 0xffffffff
je 0x1005ec06
xorps xmm0, xmm0
mov eax, 2
movaps xmmword [esp + 0x20], xmm0
push 0x35
mov word [esp + 0x24], ax
call dword [sym.imp.WS2_32.dll_htons]
movaps xmm0, xmmword [0x100e8b20]
xor ecx, ecx
mov word [esp + 0x22], ax
movups xmmword [esp + 0x3c], xmm0
mov byte [esp + 0x4c], 0
nop word [eax + eax]
mov al, byte [esp + ecx + 0x3d]
xor al, byte [esp + 0x3c]
mov byte [esp + ecx + 0x4d], al
inc ecx
cmp ecx, 0xf
jb 0x1005eb40
lea eax, [esp + 0x24]
mov byte [esp + 0x5c], 0
push eax
lea eax, [esp + 0x51]
push eax
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
mov esi, dword [sym.imp.WS2_32.dll_setsockopt]
lea eax, [esp + 0x10]
push 4
push eax
push 0x1006
push 0xffff
push edi
mov dword [esp + 0x24], 0x3e8
call esi
push 4
lea eax, [esp + 0x14]
push eax
push 0x1005
push 0xffff
push edi
call esi
push 0x10
lea eax, [esp + 0x24]
push eax
push 0
push dword [esp + 0x20]
push dword [esp + 0x1c]
push edi
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
jle 0x1005ebff
mov esi, dword [esp + 0x18]
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x64]
mov dword [esp + 0x10], 0x10
push eax
push 0
push dword [esi]
xorps xmm0, xmm0
push dword [esp + 0x2c]
movaps xmmword [esp + 0x74], xmm0
push edi
call dword [sym.imp.WS2_32.dll_recvfrom]
mov ecx, dword [esp + 8]
test eax, eax
movzx ecx, cl
mov edx, 1
cmovg ecx, edx
mov dword [esi], eax
mov dword [esp + 8], ecx
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [esp + 0x7c]
mov al, byte [esp + 8]
pop edi
pop esi
xor ecx, esp
call fcn.1008f445
mov esp, ebp
pop ebp
ret
Function at 0x1005fcc0
Capabilities:
Convert ip address from string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
cmp dword [eax + 0x14], 0x10
mov esi, ecx
jb 0x1005fcdf
mov eax, dword [eax]
lea ecx, [ebp - 8]
push ecx
push eax
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
je 0x1005fdb9
test byte [esi + 8], 1
je 0x1005fdc2
mov edx, dword [esi + 0x28]
xor ebx, ebx
mov edi, dword [sym.imp.WS2_32.dll_ntohl]
nop dword [eax]
cmp edx, dword [esi + 0x14]
jg 0x1005fd42
mov al, bl
mov ecx, 7
and al, 7
sub cl, al
mov eax, ebx
sar eax, 3
movzx eax, byte [ebp + eax - 8]
shr eax, cl
and eax, 1
lea ecx, [eax + edx*2]
mov eax, dword [esi + 0x34]
push dword [eax + ecx*4]
call edi
inc ebx
mov edx, eax
cmp ebx, 0x20
jl 0x1005fd10
mov eax, dword [esi + 0x14]
cmp edx, eax
jle 0x1005fdb0
lea edi, [eax*8]
sub edi, eax
add edi, edx
cmp edi, dword [esi + 0x2c]
jge 0x1005fdd7
mov edx, dword [esi + 0x34]
add edx, edi
movzx ecx, byte [edx]
movzx eax, byte [edx + 1]
shl ecx, 8
or eax, ecx
add eax, 2
add eax, edi
cmp eax, dword [esi + 0x30]
jg 0x1005fdd7
mov ebx, dword [ebp - 4]
add edx, 2
mov ecx, edx
xorps xmm0, xmm0
movups xmmword [ebx], xmm0
mov dword [ebx + 0x10], 0
lea esi, [ecx + 1]
mov dword [ebx + 0x14], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1005fd93
sub ecx, esi
push ecx
push edx
mov ecx, ebx
call fcn.1000ab60
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [ebp - 4], str.data_is_not_exists
jmp 0x1005fdde
mov dword [ebp - 4], str.Query_IP_Format_error.
jmp 0x1005fdde
push 0x100fa418
lea eax, [ebp - 4]
mov dword [ebp - 4], str.IPv4_not_support
push eax
call fcn.10091d34
mov dword [ebp - 4], str.database_error
push 0x100fa418
lea eax, [ebp - 4]
push eax
call fcn.10091d34
int3
Function at 0x10069ad0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d0bf8
mov eax, dword fs:[0]
push eax
sub esp, 0x100
mov eax, dword [0x100fd230]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov eax, dword [0x101060bc]
xor ebx, ebx
mov dword [ebp - 0x30], eax
lea eax, [esi + 0x10]
mov dword [ebp - 0x34], eax
cmp dword [eax], ebx
je 0x10069c96
cmp dword [ebp + 8], ebx
je 0x10069c96
push str.ntdll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
test edi, edi
je 0x10069c96
cmp dword [esi + 0x14], 0x10
jb 0x10069b3e
mov esi, dword [esi]
mov eax, dword [ebp + 8]
push str.LdrGetProcedureAddress
mov dword [ebp - 0x5c], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
mov dword [ebp - 0x58], eax
call esi
push str.NtAllocateVirtualMemory
push edi
mov dword [ebp - 0x54], eax
call esi
push str.LdrLoadDll
push edi
mov dword [ebp - 0x50], eax
call esi
push str.RtlInitAnsiString
push edi
mov dword [ebp - 0x4c], eax
call esi
push str.RtlAnsiStringToUnicodeString
push edi
mov dword [ebp - 0x48], eax
call esi
push str.RtlFreeUnicodeString
push edi
mov dword [ebp - 0x44], eax
call esi
push 0x40
mov dword [ebp - 0x40], eax
call fcn.1008f9fd
add esp, 4
mov esi, eax
mov dword [ebp - 0x3c], esi
push 0x40
push 0
push esi
call fcn.10091da0
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x5c]
add esp, 0xc
mov dword [ebp - 0x38], eax
call fcn.10069270
mov ecx, eax
mov eax, dword [0x101060b8]
test ecx, ecx
cmovne eax, esi
xor ebx, ebx
mov dword [0x101060b8], eax
test ecx, ecx
mov eax, dword [ebp - 0x34]
setne bl
cmp dword [eax], 0
jbe 0x10069c96
test ebx, ebx
jne 0x10069c96
push ecx
lea ecx, [ebp - 0x10c]
call fcn.100043e0
mov edx, str.Load_RemoteDll_Version
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0xfc]
call fcn.10006590
mov edx, 0x100e6914
mov ecx, eax
call fcn.10006590
mov edx, str._Error:
mov ecx, eax
call fcn.10006590
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call fcn.1001c750
call fcn.100035c0
mov esi, eax
lea ecx, [ebp - 0x10c]
lea eax, [ebp - 0x2c]
push eax
call fcn.100042f0
mov byte [ebp - 4], 1
cmp dword [eax + 0x14], 0x10
jb 0x10069c4e
mov eax, dword [eax]
sub esp, 8
mov ecx, esi
push eax
push 4
call fcn.10003d10
mov ecx, dword [ebp - 0x18]
cmp ecx, 0x10
jb 0x10069c8b
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10069c81
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10069cb4
push ecx
push edx
call fcn.1008f79d
add esp, 8
lea ecx, [ebp - 0x10c]
call fcn.10004220
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1008f445
mov esp, ebp
pop ebp
ret
call fcn.1009b8bf
int3
Function at 0x10086130
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100fd230]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x100861ca
push esi
lea eax, [ebp - 0x18]
push eax
push 0x20
push edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x100861c6
lea eax, [ebp - 0x20]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x100861bb
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
push 0
push 0
push 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp - 0x18]
mov dword [ebp - 0x14], 1
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x100861c1
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x18]
call esi
push edi
call esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.1008f445
mov esp, ebp
pop ebp
ret
Function at 0x100878b0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d2081
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x100fd230]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.nfapi::EventQueue_class_nfapi::NFEvent_.0
push 0x18
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.1008f453
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [edi + 4], eax
lea esi, [edi + 0xc]
mov dword [ebp - 4], 0
push 0x20
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.1008f453
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea esi, [edi + 0x14]
mov byte [ebp - 4], 1
push 0x20
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.1008f453
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea esi, [edi + 0x1c]
mov byte [ebp - 4], 2
push 0x18
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.1008f453
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea esi, [edi + 0x24]
mov byte [ebp - 4], 3
push 0x18
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.1008f453
add esp, 0x14
mov dword [eax], eax
push 0
push 0
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
push 0
mov dword [esi], eax
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
mov dword [edi + 0x2c], 0xffffffff
call esi
push 0
push 0
mov dword [edi + 0x2c], eax
push 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
push 0
mov dword [edi + 0x44], 0xffffffff
call esi
mov dword [edi + 0x44], eax
mov dword [edi + 0x48], 0xffffffff
push 0
push 0
push 1
push 0
call esi
lea ecx, [edi + 0x50]
mov dword [edi + 0x48], eax
xorps xmm0, xmm0
mov dword [edi + 0x34], 0
movups xmmword [ecx], xmm0
movq qword [ecx + 0x10], xmm0
call fcn.100880e0
mov dword [edi + 0x4c], 1
mov eax, edi
mov byte [edi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10087a50
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d2081
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x100fd230]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.nfapi::EventQueue_class_nfapi::NFEventOut_.0
push 0x18
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.1008f453
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [edi + 4], eax
lea esi, [edi + 0xc]
mov dword [ebp - 4], 0
push 0x20
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.1008f453
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea esi, [edi + 0x14]
mov byte [ebp - 4], 1
push 0x20
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.1008f453
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea esi, [edi + 0x1c]
mov byte [ebp - 4], 2
push 0x18
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.1008f453
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea esi, [edi + 0x24]
mov byte [ebp - 4], 3
push 0x18
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.1008f453
add esp, 0x14
mov dword [eax], eax
push 0
push 0
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
push 0
mov dword [esi], eax
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
mov dword [edi + 0x2c], 0xffffffff
call esi
push 0
push 0
mov dword [edi + 0x2c], eax
push 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
push 0
mov dword [edi + 0x44], 0xffffffff
call esi
mov dword [edi + 0x44], eax
mov dword [edi + 0x48], 0xffffffff
push 0
push 0
push 1
push 0
call esi
lea ecx, [edi + 0x50]
mov dword [edi + 0x48], eax
xorps xmm0, xmm0
mov dword [edi + 0x34], 0
movups xmmword [ecx], xmm0
movq qword [ecx + 0x10], xmm0
call fcn.100880e0
mov dword [edi + 0x4c], 1
mov eax, edi
mov byte [edi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100899b0
Capabilities:
Create thread
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
push edi
mov edi, ecx
push dword [edi + 0x14]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [edi], eax
test esi, esi
jg 0x100899f0
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, dword [ebp - 0x14]
test esi, esi
jne 0x100899e7
mov esi, 1
jmp 0x100899f0
jle 0x10089a36
nop dword [eax]
lea eax, [ebp - 4]
push eax
push 0
push edi
push 0x100887a0
push 0
push 0
call fcn.100a7074
add esp, 0x18
mov dword [ebp + 0xc], eax
test eax, eax
je 0x10089a31
cmp eax, 0xffffffff
je 0x10089a31
mov edx, dword [edi + 8]
lea ecx, [edi + 4]
cmp edx, dword [ecx + 8]
je 0x10089a27
mov dword [edx], eax
add dword [ecx + 4], 4
jmp 0x10089a31
lea eax, [ebp + 0xc]
push eax
push edx
call fcn.100873a0
sub esi, 1
jne 0x100899f0
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x10089ca0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100fd08c]
push esi
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [0x100fd088]
mov dword [ebp - 4], 0
test byte [esi + 0x12], 1
mov dword [ebp - 0x10], eax
je 0x10089cce
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ecx, ecx
mov dword [ebp - 8], ecx
lea ebx, [edi + 0x16]
lea eax, [ebx + 0x10]
mov dword [ebp - 0xc], eax
cmp ecx, dword [0x10105040]
jb 0x10089cff
ja 0x10089cf3
cmp eax, dword [0x1010503c]
jbe 0x10089cff
pop edi
pop ebx
mov eax, 0xfffffffc
pop esi
mov esp, ebp
pop ebp
ret
cmp byte [0x10104fd8], cl
je 0x10089e4c
cmp dword [0x100fd094], 0xffffffff
je 0x10089e4c
mov eax, dword [0x10105034]
or eax, dword [0x10105038]
je 0x10089e4c
push 0x10104ebc
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [0x10105034]
mov eax, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
mov dword [ecx], eax
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], ebx
movups xmm0, xmmword [esi]
movups xmmword [ecx + 0x10], xmm0
mov eax, dword [esi + 0x10]
mov dword [ecx + 0x20], eax
mov ax, word [esi + 0x14]
mov word [ecx + 0x24], ax
lea eax, [ecx + 0x26]
push eax
call fcn.100917c0
mov eax, dword [0x100fd08c]
add esp, 0xc
mov dword [ebp - 0x18], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x28]
movlpd qword [ebp - 0x28], xmm0
movlpd qword [ebp - 0x20], xmm0
push eax
push 0
push 8
lea eax, [ebp - 0xc]
push eax
push dword [0x100fd094]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10089dcc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x10089dcc
push 0x10104ebc
mov esi, 0xfffffffc
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop ebx
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x14]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
jne 0x10089df1
push eax
push dword [0x100fd088]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x10089e14
push dword [0x100fd094]
call dword [sym.imp.KERNEL32.dll_CancelIo]
push 0x10104ebc
or esi, 0xffffffff
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop ebx
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x28]
push eax
push dword [0x100fd094]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x10089dfd
mov esi, dword [ebp - 4]
neg esi
push 0x10104ebc
sbb esi, esi
neg esi
dec esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop ebx
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
pop ebx
mov eax, 0xfffffffd
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10089e60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100fd08c]
xor ecx, ecx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [0x100fd088]
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0xc]
add eax, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ecx
cmp ecx, dword [0x10105040]
jb 0x10089eab
ja 0x10089ea1
cmp eax, dword [0x1010503c]
jbe 0x10089eab
mov eax, 0xfffffffc
pop esi
mov esp, ebp
pop ebp
ret
cmp byte [0x10104fd8], cl
je 0x10089fc3
cmp dword [0x100fd094], 0xffffffff
je 0x10089fc3
mov eax, dword [0x10105034]
or eax, dword [0x10105038]
je 0x10089fc3
push 0x10104ebc
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [ebp - 0xc]
push esi
push dword [0x10105034]
call fcn.100917c0
mov eax, dword [0x100fd08c]
add esp, 0xc
mov dword [ebp - 0x18], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x28]
movlpd qword [ebp - 0x28], xmm0
movlpd qword [ebp - 0x20], xmm0
push eax
push 0
push 8
lea eax, [ebp - 0xc]
push eax
push dword [0x100fd094]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10089f47
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x10089f47
push 0x10104ebc
mov esi, 0xfffffffc
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x14]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
jne 0x10089f6c
push eax
push dword [0x100fd088]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x10089f8d
push dword [0x100fd094]
call dword [sym.imp.KERNEL32.dll_CancelIo]
push 0x10104ebc
or esi, 0xffffffff
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x28]
push eax
push dword [0x100fd094]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x10089f78
mov esi, dword [ebp - 4]
neg esi
push 0x10104ebc
sbb esi, esi
neg esi
dec esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0xfffffffd
pop esi
mov esp, ebp
pop ebp
ret