joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10159c90
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x28
mov eax, dword [0x101f1014]
xor eax, ebp
mov dword [ebp - 8], eax
lea esi, [ebp - 0x2c]
push esi
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov esi, dword [esi + 0x1c]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10157a00
mov eax, esi
add esp, 0x28
pop esi
pop ebp
ret
Function at 0x101670d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, edx
mov dword [ebp - 0x18], ecx
mov ebx, dword [ebp + 8]
mov ecx, edx
call fcn.10004f20
cmp eax, 0x10
je 0x101671ca
mov esi, eax
test eax, eax
jne 0x101671d1
mov dword [ebp - 0x14], ebx
xor esi, esi
xor ebx, ebx
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x120]
test eax, eax
jne 0x101671d1
mov eax, dword [edi + 0x74]
cmp byte [eax + 8], 0
je 0x1016718d
movzx ecx, word [eax + 0x18]
add ebx, ecx
adc dword [ebp - 0x10], 0
movsx ecx, byte [edi + 0x44]
test ecx, ecx
je 0x101671db
mov word [edi + 0x32], 0
and byte [edi + 1], 0xf9
movzx edx, word [edi + ecx*2 + 0x46]
mov word [edi + 0x46], dx
dec cl
mov byte [edi + 0x44], cl
movsx ecx, cl
mov ecx, dword [edi + ecx*4 + 0x78]
mov dword [edi + 0x74], ecx
mov ecx, dword [eax + 0x48]
call fcn.10157e40
movzx ecx, word [edi + 0x46]
mov eax, dword [edi + 0x74]
cmp cx, word [eax + 0x18]
jae 0x1016712d
inc ecx
mov word [edi + 0x46], cx
movzx ecx, word [edi + 0x46]
cmp cx, word [eax + 0x18]
jne 0x1016719f
mov ecx, dword [eax + 0x38]
movzx eax, byte [eax + 9]
add ecx, eax
add ecx, 8
jmp 0x101671b3
cmp byte [eax + 1], 0
jne 0x10167175
movzx ecx, word [eax + 0x18]
add ebx, ecx
adc dword [ebp - 0x10], 0
jmp 0x10167175
mov edx, dword [eax + 0x40]
movzx ecx, word [edx + ecx*2]
rol cx, 8
movzx edx, word [eax + 0x1a]
and ecx, edx
add ecx, dword [eax + 0x38]
mov edx, dword [ecx]
bswap edx
mov ecx, edi
call fcn.1000bcc0
test eax, eax
je 0x10167109
mov esi, eax
jmp 0x101671d1
xor esi, esi
mov dword [ebx + 4], esi
mov dword [ebx], esi
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x14]
mov dword [eax], ebx
mov ecx, dword [ebp - 0x10]
mov dword [eax + 4], ecx
mov ecx, edi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.10004f20
Function at 0x10168e40
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, edx
mov esi, ecx
mov dword [ecx], 0
mov ecx, 0x14
xor edx, edx
call fcn.10142fa0
test eax, eax
je 0x10168ef0
mov ebx, eax
cmp byte [0x101f1024], 0
je 0x10168ebe
mov ecx, dword [0x101f1120]
test ecx, ecx
je 0x10168e8d
call dword [section..00cfg]
push 0xc8
call ecx
add esp, 4
test eax, eax
jne 0x10168ebe
mov dword [ebx + 8], edi
mov eax, dword [ebp + 8]
mov dword [ebx + 0xc], eax
mov eax, ebx
add eax, 4
xor ecx, ecx
push eax
push ecx
push ebx
push 0x101692c0
push ecx
push ecx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [ebx], eax
test eax, eax
je 0x10168ebe
cmp dword [ebx + 8], 0
jne 0x10168ee7
jmp 0x10168ecb
xorps xmm0, xmm0
movups xmmword [ebx], xmm0
mov dword [ebx + 0x10], 0
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
mov dword [ebx + 4], eax
mov ecx, edi
call dword [section..00cfg]
push dword [ebp + 8]
call edi
add esp, 4
mov dword [ebx + 0x10], eax
mov dword [esi], ebx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, 7
jmp 0x10168eeb
Function at 0x1017be70
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, edx
mov esi, ecx
mov ebx, dword [ebp + 8]
mov byte [ecx + 0x10], 1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
push edx
push edx
push str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d___Q___d_NULL
push ecx
call fcn.10025a50
add esp, 0x1c
test ebx, ebx
jne 0x1017beb1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
push str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1___Q___d_NULL
push esi
call fcn.10025a50
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1019dc60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x101f1014]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor edi, edi
cmp byte [ecx + 0x20], 0
je 0x1019dc8f
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10157a00
mov eax, edi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, edx
mov ebx, ecx
mov ecx, dword [ebx + 0x1c]
mov eax, dword [esi]
xor ecx, dword [eax + 0x24]
mov edx, dword [ebx + 0x18]
xor edx, dword [eax + 0x20]
or edx, ecx
jne 0x1019dc7b
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x1019dcc6
mov edx, esi
call fcn.1019dc60
test eax, eax
jne 0x1019ddb5
mov ebx, dword [ebx + 0x10]
cmp byte [ebx + 0x20], 0
je 0x1019dc93
jmp 0x1019dc7b
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x20], eax
mov edi, dword [eax + 0x1c]
mov dword [ebp - 0x14], 0
cmp byte [esi + 0x18], 0x79
mov ecx, dword [esi + 4]
je 0x1019dcf2
lea eax, [ecx + 0x1f]
add ecx, 0x3e
test eax, eax
cmovns ecx, eax
sar ecx, 5
test edi, edi
je 0x1019dda4
imul ecx, dword [ebx + 0x24]
mov dword [ebp - 0x18], ecx
xor ecx, ecx
mov dword [ebp - 0x1c], esi
movzx ebx, byte [edi]
xor eax, eax
cmp ebx, 2
jb 0x1019dd30
and ebx, 0x80
mov edx, ebx
shr edx, 7
xor edx, 1
add eax, edx
movzx esi, byte [edi + 1]
inc edi
mov edx, esi
and edx, 0xfffffffe
or edx, ebx
mov ebx, esi
jne 0x1019dd10
mov edx, dword [ebp - 0x20]
mov edx, dword [edx + 0x44]
mov esi, dword [ebp - 0x24]
cmp edx, dword [esi + 0x18]
mov esi, dword [ebp - 0x1c]
jge 0x1019dd62
cmp edx, ecx
je 0x1019dd62
cmp byte [edi], 1
jne 0x1019dda4
movzx ecx, byte [edi + 1]
inc edi
test cl, cl
js 0x1019dd95
mov dword [ebp - 0x14], ecx
xor eax, eax
inc eax
add edi, eax
cmp ecx, dword [esi + 4]
jl 0x1019dd06
jmp 0x1019ddab
cmp byte [esi + 0x18], 0x79
jne 0x1019dd73
mov edx, dword [esi + 0x1c]
add ecx, dword [ebp - 0x18]
mov dword [edx + ecx*4], eax
jmp 0x1019dd45
test eax, eax
je 0x1019dd45
xor eax, eax
inc eax
shl eax, cl
lea edx, [ecx + 1]
add ecx, 0x20
test edx, edx
cmovns ecx, edx
mov edx, dword [esi + 0x1c]
sar ecx, 5
add ecx, dword [ebp - 0x18]
or dword [edx + ecx*4], eax
jmp 0x1019dd45
mov ecx, edi
lea edx, [ebp - 0x14]
call fcn.10188be0
mov ecx, dword [ebp - 0x14]
jmp 0x1019dd59
xor edi, edi
jmp 0x1019dc7b
mov edi, 0x10b
jmp 0x1019dc7b
mov edi, eax
jmp 0x1019dc7b
Function at 0x101a12d0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 4]
mov edi, dword [eax + 0x18]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x10], 0
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push 0
push esi
push dword [ebp + 0xc]
push edi
call sub.wsock32.dll_sendto
cmp eax, 0xffffffff
jne 0x101a1342
call sub.wsock32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x101a132e
mov ecx, dword [ebx + 4]
cmp dword [ecx + 4], 0
jne 0x101a132e
mov ecx, edi
mov edx, 2
push dword [ebp + 0x20]
call fcn.101a0dc0
add esp, 4
test eax, eax
jns 0x101a12ea
jmp 0x101a1337
push eax
call fcn.101a77e0
add esp, 4
xor eax, eax
dec eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [ebp - 0x10]
add ecx, eax
mov eax, dword [ebx + 4]
cmp dword [eax + 4], 0
jne 0x101a1359
cmp ecx, esi
jge 0x101a1359
mov dword [ebp - 0x10], ecx
jmp 0x101a1316
mov eax, ecx
jmp 0x101a133a

Function at 0x101a1360
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 4]
mov esi, dword [eax + 0x18]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call sub.wsock32.dll_recvfrom
mov ebx, eax
cmp eax, 0xffffffff
jne 0x101a13be
call sub.wsock32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x101a13b5
mov ecx, dword [edi + 4]
cmp dword [ecx + 4], 0
jne 0x101a13b5
mov ecx, esi
xor edx, edx
inc edx
push dword [ebp + 0x20]
call fcn.101a0dc0
add esp, 4
test eax, eax
jns 0x101a136f
jmp 0x101a13be
push eax
call fcn.101a6af0
add esp, 4
mov eax, ebx
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x101a1b60
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x101f1014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [0x101f4f80], 0
jne 0x101a1b81
call fcn.1001b2e0
xor eax, eax
lea ecx, [ebp - 0x24]
mov dword [ecx + 4], eax
mov dword [ecx], 0xc
mov dword [ecx + 8], 1
lea edx, [ebp - 0x18]
lea esi, [ebp - 0x14]
push eax
push ecx
push edx
push esi
call dword [sym.imp.kernel32.dll_CreatePipe]
test eax, eax
je 0x101a1c0d
mov esi, dword [ebp + 8]
mov ebx, dword [ebp - 0x14]
call fcn.100024d0
test eax, eax
je 0x101a1c38
mov edi, dword [ebp + 0xc]
mov dword [eax], 0x101f3244
mov ecx, dword [eax + 4]
mov dword [ecx], 0xaaaaaaaa
mov ecx, dword [eax + 4]
mov dword [ecx + 0x18], ebx
mov dword [esi], eax
mov ebx, dword [ebp - 0x18]
call fcn.100024d0
test eax, eax
je 0x101a1c5c
mov dword [eax], 0x101f3244
mov ecx, dword [eax + 4]
mov dword [ecx], 0xaaaaaaaa
mov ecx, dword [eax + 4]
mov dword [ecx + 0x18], ebx
mov dword [edi], eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
xor ecx, ecx
inc ecx
mov dword [eax + 8], ecx
mov eax, dword [edi]
mov eax, dword [eax + 4]
mov dword [eax + 8], ecx
xor esi, esi
jmp 0x101a1c24
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push 0xffffe896
call sym.nss3.dll_PR_SetError
add esp, 8
xor esi, esi
dec esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10157a00
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
xor edi, edi
push edi
push 0xffffe890
call sym.nss3.dll_PR_SetError
add esp, 8
mov dword [esi], edi
mov esi, dword [sym.imp.kernel32.dll_CloseHandle]
push dword [ebp - 0x14]
call esi
push dword [ebp - 0x18]
call esi
jmp 0x101a1c21
xor ebx, ebx
push ebx
push 0xffffe890
call sym.nss3.dll_PR_SetError
add esp, 8
mov dword [edi], ebx
mov esi, dword [esi]
mov eax, dword [esi]
mov ecx, dword [eax + 4]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
push dword [ebp - 0x18]
call dword [sym.imp.kernel32.dll_CloseHandle]
jmp 0x101a1c21

Function at 0x101a26a0
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
cmp dword [0x101f4574], 0
je 0x101a2717
cmp dword [0x101f4570], 0
je 0x101a2717
mov eax, dword [0x101f4560]
add eax, 0x1c
push eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov ecx, dword [0x101f4578]
mov eax, dword [0x101f4574]
sub ecx, eax
jbe 0x101a2706
mov edx, dword [0x101f4570]
cmp edx, 0xfffffffe
je 0x101a271a
push edx
push ecx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
push dword [0x101f4570]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
add esp, 4
mov eax, dword [0x101f4574]
mov dword [0x101f4578], eax
mov eax, dword [0x101f4560]
add eax, 0x1c
push eax
call sym.nss3.dll__PR_MD_UNLOCK
add esp, 4
pop ebx
pop ebp
ret
mov bl, byte [eax + ecx]
mov byte [eax + ecx], 0
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov eax, dword [0x101f4574]
mov ecx, dword [0x101f4578]
mov byte [ecx], bl
jmp 0x101a2701
Function at 0x101a4a30
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
cmp dword [0x101f4f80], 0
jne 0x101a4a42
call fcn.1001b2e0
push dword [0x101f458c]
call sym.nss3.dll_PR_EnterMonitor
add esp, 4
mov eax, dword [0x101f4598]
test eax, eax
je 0x101a4a79
push eax
call dword [sym.imp.mozglue.dll_strdup]
add esp, 4
mov esi, eax
push dword [0x101f458c]
call sym.nss3.dll_PR_ExitMonitor
add esp, 4
test esi, esi
jne 0x101a4ac3
jmp 0x101a4ab2
push str.LD_LIBRARY_PATH
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
add esp, 4
test eax, eax
mov ecx, str.._lib
cmovne ecx, eax
push ecx
call dword [sym.imp.mozglue.dll_strdup]
add esp, 4
mov dword [0x101f4598], eax
test eax, eax
jne 0x101a4a59
push dword [0x101f458c]
call sym.nss3.dll_PR_ExitMonitor
add esp, 4
push 0
push 0xffffe890
call sym.nss3.dll_PR_SetError
add esp, 8
xor esi, esi
mov eax, esi
pop esi
pop ebp
ret

Function at 0x101a5ef0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x28
mov eax, dword [0x101f1014]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [0x101f45d0], 0
je 0x101a5f22
mov esi, dword [0x101f45cc]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10157a00
mov eax, esi
add esp, 0x28
pop esi
pop ebp
ret
lea esi, [ebp - 0x2c]
push esi
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [esi + 4]
mov dword [0x101f45d0], eax
lea ecx, [eax - 1]
bsr ecx, ecx
xor ecx, 0xffffffe0
add ecx, 0x21
xor esi, esi
cmp eax, 2
cmovae esi, ecx
mov dword [0x101f45cc], esi
jmp 0x101a5f10
Function at 0x101a6570
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.wsock32.dll_gethostname
test eax, eax
je 0x101a6595
call sub.wsock32.dll_WSAGetLastError
push eax
call fcn.10129ef0
add esp, 4
xor eax, eax
dec eax
pop ebp
ret
xor eax, eax
jmp 0x101a6593

Function at 0x101a6af0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.10129ef0

Function at 0x101a71e0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, eax
xor eax, eax
test ecx, ecx
jne 0x101a7206
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.10129ef0
add esp, 4
xor eax, eax
dec eax
pop ebp
ret

Function at 0x101a7460
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_MoveFileA]
mov ecx, eax
xor eax, eax
test ecx, ecx
jne 0x101a7489
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.10129ef0
add esp, 4
xor eax, eax
dec eax
pop ebp
ret

Function at 0x101a7520
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
mov ecx, eax
xor eax, eax
test ecx, ecx
jne 0x101a7548
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.10129ef0
add esp, 4
xor eax, eax
dec eax
pop ebp
ret

Function at 0x101a7550
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov eax, dword [0x101f1014]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
lea edi, [ebp - 0x20]
mov dword [edi], eax
lea ebx, [ebp - 0x24]
mov dword [ebx], eax
mov edx, 0x101f3530
push ebx
push edi
call fcn.101a66d0
add esp, 8
test eax, eax
je 0x101a75bf
push 0
push esi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
mov esi, eax
xor edi, edi
test esi, esi
jne 0x101a75ab
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.10129ef0
add esp, 4
xor edi, edi
dec edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10157a00
mov eax, edi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [ebp - 0x1c]
mov dword [eax], 0xc
mov edi, dword [ebp - 0x20]
mov dword [eax + 4], edi
mov dword [eax + 8], 0
push eax
push esi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
mov esi, eax
mov ebx, dword [ebp - 0x24]
test edi, edi
je 0x101a75f0
push edi
call dword [sym.imp.mozglue.dll_free]
add esp, 4
test ebx, ebx
je 0x101a7593
push ebx
call dword [sym.imp.mozglue.dll_free]
add esp, 4
jmp 0x101a7593

Function at 0x101a7600
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_RemoveDirectoryA]
mov ecx, eax
xor eax, eax
test ecx, ecx
jne 0x101a7626
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.10129ef0
add esp, 4
xor eax, eax
dec eax
pop ebp
ret
Function at 0x101a7630
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x14
mov eax, dword [ebp + 8]
movaps xmm0, xmmword [0x101b9c30]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LockFile]
sub esp, 0x14
xor esi, esi
test eax, eax
je 0x101a7662
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.kernel32.dll_GetLastError]
mov edi, eax
mov dword [esp], eax
call fcn.10129ef0
mov eax, dword [0x101f4f6c]
xor esi, esi
dec esi
cmp dword [eax + 4], 2
jl 0x101a7659
mov dword [esp + 4], edi
mov dword [esp], str._PR_MD_LOCKFILE___failed._Error:__d
call sym.nss3.dll_PR_LogPrint
jmp 0x101a7659

Function at 0x101a77a0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push dword [eax + 0x108]
call dword [sym.imp.kernel32.dll_SuspendThread]
pop ebp
ret

Function at 0x101a77c0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push dword [eax + 0x108]
call dword [sym.imp.kernel32.dll_ResumeThread]
pop ebp
ret

Function at 0x101a77e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0x2738
jne 0x101a7800
push 0x2738
push 0xffffe89d
call sym.nss3.dll_PR_SetError
add esp, 8
pop ebp
ret
pop ebp
jmp fcn.10129ef0

Function at 0x101a7810
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp eax, 0x273d
je 0x101a782b
cmp eax, 0x2726
jne 0x101a783c
mov ecx, 0xffffe8d5
jmp 0x101a7830
mov ecx, 0xffffe8b0
push eax
push ecx
call sym.nss3.dll_PR_SetError
add esp, 8
pop ebp
ret
pop ebp
jmp fcn.10129ef0

Function at 0x101a7850
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0x2726
jne 0x101a7870
push 0x2726
push 0xffffe8b1
call sym.nss3.dll_PR_SetError
add esp, 8
pop ebp
ret
pop ebp
jmp fcn.10129ef0

Function at 0x101a7880
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0x2726
jne 0x101a78a0
push 0x2726
push 0xffffe8d5
call sym.nss3.dll_PR_SetError
add esp, 8
pop ebp
ret
pop ebp
jmp fcn.10129ef0

Function at 0x101a78b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0x2736
jne 0x101a78d0
push 0x2736
push 0xffffe891
call sym.nss3.dll_PR_SetError
add esp, 8
pop ebp
ret
pop ebp
jmp fcn.10129ef0

Function at 0x101a9ed0
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.101a5f50

Function at 0x101a9f40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.101a6530
Function at 0x101aa0b0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push eax
mov esi, dword [ebp + 8]
mov eax, dword [0x101f1014]
xor eax, ebp
mov dword [ebp - 0xc], eax
cmp dword [0x101f4f80], 0
jne 0x101aa0d1
call fcn.1001b2f0
push esi
call sub.wsock32.dll_gethostbyname
test eax, eax
jne 0x101aa110
mov edi, 0xffffe8ab
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
call sym.nss3.dll_PR_GetCurrentThread
mov dword [eax + 0x28], edi
mov dword [eax + 0x2c], esi
mov dword [eax + 0x30], 0
xor esi, esi
dec esi
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.10157a00
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebp
ret
lea esi, [ebp + 0x10]
lea edx, [ebp + 0xc]
mov ecx, eax
push dword [ebp + 0x14]
push 0
push esi
call fcn.101aa140
add esp, 0xc
mov edi, 0xffffe8aa
xor esi, esi
test eax, eax
jne 0x101aa0e8
jmp 0x101aa0fd

Function at 0x101aa410
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
movzx esi, word [ebp + 0xc]
mov eax, dword [0x101f1014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [0x101f4f80], 0
jne 0x101aa433
call fcn.1001b2f0
cmp si, 0x17
je 0x101aa441
movzx eax, si
cmp eax, 2
jne 0x101aa483
push dword [ebp + 8]
call sub.wsock32.dll_gethostbyname
test eax, eax
jne 0x101aa48c
mov edi, 0xffffe8ab
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
call sym.nss3.dll_PR_GetCurrentThread
mov dword [eax + 0x28], edi
mov dword [eax + 0x2c], esi
mov dword [eax + 0x30], 0
xor esi, esi
dec esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10157a00
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
mov edi, 0xffffe89d
jmp 0x101aa45a
xor ebx, ebx
cmp si, 0x17
sete bl
lea esi, [ebp + 0x18]
lea edx, [ebp + 0x14]
mov ecx, eax
push dword [ebp + 0x1c]
push ebx
push esi
call fcn.101aa140
add esp, 0xc
mov edi, 0xffffe8aa
xor esi, esi
test eax, eax
jne 0x101aa45a
jmp 0x101aa46f

Function at 0x101ad4a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.10156040

Function at 0x101ad8f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x101f4f80], 0
jne 0x101ad901
call fcn.1001b2f0
pop ebp
jmp fcn.10156040
Function at 0x101ae1e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, dword [ebp + 8]
cmp dword [0x101f4f80], 0
jne 0x101ae1fa
call fcn.1001b2f0
test esi, esi
je 0x101ae26e
call sym.nss3.dll_PR_IntervalNow
mov dword [ebp - 0x18], eax
push dword [0x101f4f98]
call sym.nss3.dll_PR_NewCondVar
add esp, 4
mov dword [ebp - 0x14], eax
mov ebx, dword [0x101f4f98]
call fcn.10156040
mov edi, eax
lea eax, [ebx + 0x1c]
push eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov dword [ebx + 8], edi
xor eax, eax
dec eax
mov dword [ebp - 0x10], eax
call sym.nss3.dll_PR_IntervalNow
mov edi, eax
sub edi, dword [ebp - 0x18]
cmp edi, esi
ja 0x101ae296
call fcn.10156040
mov edx, dword [ebp - 0x14]
mov ebx, dword [edx]
cmp dword [ebx + 8], eax
jne 0x101ae29d
mov esi, dword [ebp + 8]
sub esi, edi
mov ecx, eax
push esi
mov esi, dword [ebp + 8]
push ebx
call fcn.101ad260
add esp, 8
test eax, eax
je 0x101ae237
jmp 0x101ae29d
cmp dword [0x101f4f80], 0
jne 0x101ae27c
call fcn.1001b2f0
call fcn.10156040
push dword [0x101f45c8]
call dword [sym.imp.kernel32.dll_TlsGetValue]
call fcn.101a7750
xor eax, eax
jmp 0x101ae2e3
mov dword [ebp - 0x10], 0
mov edi, dword [0x101f4f98]
call fcn.10156040
cmp dword [edi + 8], eax
jne 0x101ae2c0
mov dword [edi + 8], 0
add edi, 0x1c
push edi
call sym.nss3.dll__PR_MD_UNLOCK
add esp, 4
mov esi, dword [ebp - 0x14]
mov dword [esi + 0x74], 0xffffffff
mov eax, esi
add eax, 0xc
push eax
call dword [sym.imp.kernel32.dll_DeleteCriticalSection]
push esi
call dword [sym.imp.mozglue.dll_free]
add esp, 4
mov eax, dword [ebp - 0x10]
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x101ae6d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
call fcn.10156040
mov ecx, dword [0x101f4f9c]
mov dword [0x101f4ff4], ecx
call fcn.101ae650
pop ebp
jmp fcn.10156040
Function at 0x10023390
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x10059008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x410
lea eax, [ebp - 0x414]
mov edi, edx
push 0
push eax
mov esi, ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x418], 0
lea eax, [ebp - 0x418]
push eax
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x10023405
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x418]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
jne 0x10023417
mov eax, dword [ebp - 0x418]
test eax, eax
je 0x10023405
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003ea51
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x414]
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10023420
sub edx, esi
lea eax, [ebp - 0x414]
sar edx, 1
mov ecx, edi
push edx
push eax
call fcn.10003250
mov eax, dword [ebp - 0x418]
test eax, eax
je 0x1002344f
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.1003ea51
mov esp, ebp
pop ebp
ret