joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10da9a0
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x404
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x101a1ac
push 0x100c124
lea ebx, [esi + 0x3c86]
push ebx
call fcn.01085230
mov edi, eax
test edi, edi
je 0x10da9ea
cmp dword [ebp + 0xc], 0
jne 0x10da9da
push edi
push esi
call fcn.0104b820
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
push 0x101a190
push 0x100c124
push ebx
call fcn.01085230
mov edi, eax
test edi, edi
je 0x10daada
push 0x401
lea eax, [ebp - 0x404]
push 0
push eax
call sub.msvcrt.dll_memset
push 0x101a120
lea ecx, [ebp - 0x404]
push 0x3ff
push ecx
call fcn.0102c510
add esp, 0x18
cmp dword [ebp + 0xc], 0
jne 0x10daae3
push edi
push esi
call fcn.0104b820
push 0
push 0x1f4
lea ecx, [ebp - 0x404]
push ecx
push edi
push esi
call fcn.0102e5e0
push ebx
push esi
call fcn.0104b820
mov edx, dword [esi]
push 0x101a104
add edx, 0x69c
push edx
push esi
call fcn.010b9e60
mov eax, dword [esi]
push 0x101a0e0
add eax, 0x69c
push eax
push esi
call fcn.010b9e60
mov ecx, dword [esi]
push 0x101a0cc
add ecx, 0x69c
push ecx
push esi
call fcn.010b9e60
mov edx, dword [esi]
push 0x101a0b4
add edx, 0x69c
push edx
push esi
call fcn.010b9e60
mov eax, dword [esi]
push 0x101a0a0
add eax, 0x69c
push eax
push esi
call fcn.010b9e60
push 0
push 1
push edi
push esi
call fcn.01094f70
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp + 0x10]
neg edx
sbb edx, edx
push 0
and edx, 0xffffc568
add edx, 0x4e20
push edx
lea eax, [ebp - 0x404]
push eax
push edi
push esi
call fcn.0102e5e0
push edi
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
jmp 0x10daa56

Function at 0x10dae90
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
add edi, 0x3c86
mov dword [ebp + 8], edi
lea esp, [esp]
push 0x82
lea eax, [ebp - 0x84]
push 0
push eax
call sub.msvcrt.dll_memset
push 0x82
lea ecx, [ebp - 0x108]
push 0
push ecx
call sub.msvcrt.dll_memset
push ebx
push 0x101417c
push 0x101a4d4
lea edx, [ebp - 0x84]
push 0x3f
push edx
call fcn.0102d9e0
push ebx
push 0x101417c
push 0x101a4b4
lea eax, [ebp - 0x108]
push 0x3f
push eax
call fcn.0102d9e0
add esp, 0x40
lea ecx, [ebp - 0x84]
push ecx
push 0x100c124
push edi
call fcn.01085230
mov esi, eax
test esi, esi
je 0x10daf66
lea edx, [ebp - 0x108]
push edx
push 0x100c124
push edi
call fcn.01085230
mov edi, eax
test edi, edi
je 0x10daf53
push edi
push esi
call dword [sym.imp.KERNEL32.DLL_MoveFileW]
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov edi, dword [ebp + 8]
inc ebx
cmp ebx, 5
jl 0x10daeb0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10dece0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x240e0]
test esi, esi
je 0x10ded28
mov eax, dword [esi + 4]
push 0
push 0
push 0
push 0
push esi
push eax
call fcn.010d6910
mov esi, dword [esi]
mov eax, dword [esi + 0x2e728]
test eax, eax
je 0x10ded28
cmp eax, 0xffffffff
je 0x10ded28
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [esi + 0x2e728], 0
mov ecx, dword [edi + 8]
mov esi, dword [ecx]
lea edx, [ebp + 8]
push edx
push 0
push 0
push 0x1070cd0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x10ded51
push eax
mov eax, dword [esi + 0x1c8]
call eax
push edi
call fcn.01071bb0
push edi
call fcn.010dec70
mov ecx, dword [edi + 0x240e0]
push ecx
call fcn.010d6ff0
pop edi
xor eax, eax
pop esi
pop ebp
ret 4

Function at 0x10df6e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov esi, dword [ebp + 8]
push 0x1019014
push esi
mov dword [ebp - 4], eax
call fcn.010cada0
mov eax, dword [esi]
push 0x1388
push 0x1019014
push eax
call fcn.010bc600
test eax, eax
je 0x10df71d
mov eax, 1
jmp 0x10df73a
push 0x1019014
push esi
call fcn.010cada0
mov ecx, dword [esi]
push 0x1388
push 0x1019014
push ecx
call fcn.010bc600
mov ebx, dword [sym.imp.KERNEL32.DLL_Sleep]
mov edi, eax
test eax, eax
jne 0x10df75a
push 0x7d0
call ebx
push 0x1019014
push esi
call fcn.010d5f10
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, dword [ebp - 4]
cmp eax, 0xbb8
jbe 0x10df771
push 0x7d0
call ebx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10e0050
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x2b594]
mov ecx, dword [eax + 0x45c]
cmp dword [ecx + 0x10], 0
jne 0x10e01cd
mov edx, dword [edi + 8]
mov eax, dword [edx]
push ebx
push esi
push 0
lea ecx, [ebp + 8]
push ecx
lea edx, [ebp - 4]
push edx
push 0x101af14
push 0x101aee0
push connect
push eax
call fcn.010bb210
mov ebx, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
mov esi, eax
test esi, esi
jne 0x10e0132
push 0x106
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x10e01cb
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call sub.msvcrt.dll_memset
mov ecx, dword [edi + 8]
mov edx, dword [ecx]
add edx, 0x8898
push edx
push 0x101ae98
lea eax, [ebp - 0x210]
push 0x103
push eax
call fcn.0102d9e0
add esp, 0x1c
lea ecx, [ebp - 0x210]
push ecx
push 0x103
push esi
push 0x101059c
push 0x101af14
push 0x101ae84
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
test eax, eax
jne 0x10e0132
push esi
call fcn.0102add0
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 4
push esi
call fcn.0102d5e0
xor ecx, ecx
test eax, eax
jbe 0x10e014e
mov edi, edi
mov edx, 0xffe3
add word [esi + ecx*2], dx
inc ecx
cmp ecx, eax
jb 0x10e0140
test esi, esi
jne 0x10e0156
xor eax, eax
jmp 0x10e016d
cmp word [esi], 0
mov eax, esi
je 0x10e0169
mov edi, edi
add eax, 2
cmp word [eax], 0
jne 0x10e0160
sub eax, esi
sar eax, 1
push eax
push esi
call fcn.0102d0b0
mov ecx, dword [edi + 0x2b594]
mov edx, dword [ecx + 0x45c]
mov dword [edx + 0x10], eax
mov eax, dword [edi + 0x2b594]
mov ecx, dword [eax + 0x45c]
cmp dword [ecx + 0x10], 0
je 0x10e01bb
mov edx, eax
mov eax, dword [edx + 0x45c]
mov ecx, dword [eax + 0x10]
lea eax, [edi + 0x2e72c]
test eax, eax
je 0x10e01bb
test ecx, ecx
je 0x10e01bb
push 0x3f
push ecx
push eax
call dword [sym.imp.msvcrt.dll_strncpy]
add esp, 0xc
test esi, esi
je 0x10e01cb
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 4

Function at 0x10e0260
Capabilities:
Hash data with md5

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
xor edx, edx
cmp ecx, edx
jne 0x10e0272
xor eax, eax
jmp 0x10e028c
mov eax, ecx
cmp word [ecx], dx
je 0x10e0288
lea esp, [esp]
add eax, 2
cmp word [eax], dx
jne 0x10e0280
sub eax, ecx
sar eax, 1
push esi
mov esi, dword [ebp + 0x10]
add eax, eax
push eax
push ecx
push esi
mov dword [esi + 0x10], edx
mov dword [esi + 0x14], edx
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
call fcn.010bd7a0
push esi
call fcn.010bd870
pop esi
pop ebp
ret 0xc
Function at 0x10eec70
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x1000
call fcn.0102b240
mov esi, dword [ebp + 8]
lea eax, [esi + eax*4 + 8]
push eax
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
push 0
push 1
push 0x1000
push esi
call fcn.010b96d0
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x10eecc9
lea eax, [ebp + 0xc]
push eax
push edi
push esi
push 0x10eeb80
push edi
push edi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x10eecc9
mov ecx, dword [esi + 0x1c8]
push eax
call ecx
mov edx, dword [esi + 0x13c]
call edx
push eax
push esi
call fcn.010ba220
mov ebx, eax
test ebx, ebx
je 0x10eecfa
push 1
push 0x101581c
push ebx
push esi
call fcn.010ba2a0
push ebx
push esi
call fcn.010ba150
push ebx
push esi
call fcn.0102baa0
mov eax, dword [ebp + 0x10]
mov ecx, dword [esi + 0x370]
neg edi
sbb edi, edi
and edi, 7
add edi, 2
neg eax
sbb eax, eax
and eax, 4
push 0
or edi, eax
push edi
call ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x10ef100
Capabilities:
Get session user name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x298
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push ebx
push edi
mov dword [ebp - 4], ebx
call fcn.010bd660
mov esi, eax
mov dword [ebp - 8], esi
test esi, esi
je 0x10ef2e2
push 0x82
lea eax, [ebp - 0x8c]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
cmp dword [ebp + 0x18], ebx
mov ebx, dword [ebp + 0xc]
je 0x10ef1cd
push ebx
push 0x101bb88
push 0x3f
lea ecx, [ebp - 0x8c]
push ecx
call fcn.0102d9e0
add esp, 0x10
push 0xa
lea edx, [ebp - 0x8c]
push edx
push ebx
call dword [sym.imp.msvcrt.dll__itow]
add esp, 0xc
mov ecx, dword [ebp + 0x10]
lea eax, [ebp - 0x8c]
push eax
push 0x101bb84
push ecx
call fcn.01085230
mov ebx, eax
test ebx, ebx
je 0x10ef2b3
mov edx, dword [edi + 0x518]
push ebx
push 1
push esi
call edx
mov esi, eax
mov eax, dword [edi + 0x334]
call eax
test eax, eax
je 0x10ef28e
test esi, esi
je 0x10ef1c1
mov ecx, dword [edi + 0x1c8]
push esi
call ecx
xor esi, esi
mov dword [ebp - 4], 0
jmp 0x10ef295
cmp dword [edi + 0x8aec], 6
jb 0x10ef1ea
push ebx
push 0x101bb74
push 0x3f
lea edx, [ebp - 0x8c]
push edx
jmp 0x10ef15a
push 0x20a
lea eax, [ebp - 0x298]
push 0
push eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 0x1c]
add esp, 0xc
mov dword [ebp + 8], 0x103
test eax, eax
je 0x10ef222
push 0x103
push eax
lea ecx, [ebp - 0x298]
push ecx
call fcn.0102d520
jmp 0x10ef233
lea edx, [ebp + 8]
push edx
lea eax, [ebp - 0x298]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea ecx, [ebp - 0x298]
push ecx
call fcn.0102d5e0
test eax, eax
je 0x10ef162
cmp dword [ebp + 0x20], 0
jne 0x10ef26c
push 0x1019f58
lea edx, [ebp - 0x298]
push edx
call fcn.0102d300
test eax, eax
jne 0x10ef26c
push edi
call fcn.010ee850
test eax, eax
je 0x10ef2b3
lea eax, [ebp - 0x298]
push eax
push 0x101bb64
lea ecx, [ebp - 0x8c]
push 0x3f
push ecx
call fcn.0102d9e0
add esp, 0x10
jmp 0x10ef175
mov dword [ebp - 4], 1
mov edx, dword [ebp + 0x14]
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push 0
mov dword [edx], esi
call ebx
mov edi, dword [sym.imp.KERNEL32.DLL_HeapFree]
push eax
call edi
mov esi, dword [ebp - 8]
jmp 0x10ef2bf
mov ebx, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
mov edi, dword [sym.imp.KERNEL32.DLL_HeapFree]
mov eax, dword [esi + 4]
test eax, eax
je 0x10ef2ce
push eax
push 0
call ebx
push eax
call edi
push esi
push 0
call ebx
push eax
call edi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x10efb80
Capabilities:
Hash data with md5

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c8
xor eax, eax
push ebx
push esi
push edi
push 0x105
push eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], al
lea eax, [ebp - 0x1c8]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
mov ebx, eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x2b0]
mov edi, eax
mov dword [ebp - 0x1c], edi
call ecx
lea edx, [ebp - 0x24]
mov dword [ebp + 8], eax
mov eax, dword [esi + 0x538]
push edx
call eax
mov edx, dword [esi + 0x53c]
lea ecx, [ebp - 0x18]
push ecx
call edx
mov ecx, dword [esi + 0x304]
lea eax, [ebp - 0x58]
push eax
call ecx
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.DLL_SystemTimeToFileTime]
mov ecx, dword [ebp - 0x20]
rdtsc
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
test ecx, ecx
jne 0x10efc25
mov ecx, dword [ebp + 0xc]
push edx
mov edx, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push edx
mov edx, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push edx
mov edx, dword [ebp + 8]
push eax
push ecx
mov ecx, dword [ebp - 0x24]
push ecx
push edx
push edi
push ebx
push 0x101bbe4
lea eax, [ebp - 0x1c8]
push 0x103
push eax
call fcn.0102c510
lea eax, [ebp - 0x1c8]
add esp, 0x38
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10efc64
xor ecx, ecx
sub eax, esi
mov dword [ebp - 0xb0], ecx
mov dword [ebp - 0xac], ecx
push eax
lea ecx, [ebp - 0x1c8]
push ecx
lea edx, [ebp - 0xc0]
push edx
mov dword [ebp - 0xc0], 0x67452301
mov dword [ebp - 0xbc], 0xefcdab89
mov dword [ebp - 0xb8], 0x98badcfe
mov dword [ebp - 0xb4], 0x10325476
call fcn.010bd7a0
lea eax, [ebp - 0xc0]
push eax
call fcn.010bd870
lea ecx, [ebp - 0x48]
push ecx
push 0x10
lea edx, [ebp - 0x68]
push edx
call fcn.0102cf90
mov eax, dword [ebp - 4]
mov edi, dword [ebp - 0x68]
mov ecx, dword [ebp - 8]
push 0
push 0xffffff
push eax
mov esi, edi
xor esi, dword [ebp - 0x18]
push ecx
call fcn.011975f0
movzx edx, word [ebp - 0x52]
mov ecx, dword [ebp - 0x64]
xor ecx, dword [ebp - 4]
xor eax, edx
xor eax, dword [ebp - 0x10]
xor edi, dword [ebp - 8]
xor eax, dword [ebp - 0xc]
lea edx, [ebp - 0x48]
xor eax, dword [ebp - 0x1c]
xor eax, ebx
push eax
mov eax, esi
xor eax, dword [ebp - 0x14]
xor esi, ebx
xor eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0x10]
push esi
push ecx
mov ecx, dword [ebp + 0xc]
push edi
push edx
push 0x101bbd0
dec eax
push eax
push ecx
call fcn.0102c510
add esp, 0x24
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10f0c50
Capabilities:
Hash data with md5

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea ebx, [esi + 0xf5c8]
xor eax, eax
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x14], eax
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
mov eax, dword [ecx + 4]
push edi
push eax
mov dword [esi + 0xf630], eax
mov eax, dword [ecx]
push eax
push ebx
call fcn.010bd7a0
lea edi, [esi + 0xf53c]
mov ecx, 0x1a
mov esi, ebx
push ebx
rep movsd dword es:[edi], dword [esi]
call fcn.010bd870
mov eax, dword [ebp + 0xc]
add eax, 0xf53c
push eax
call fcn.010bd870
mov esi, dword [ebp + 0xc]
lea ecx, [esi + 0xf518]
push ecx
push 0x10
lea edx, [esi + 0xf594]
push edx
call fcn.0102cf90
lea eax, [esi + 0xf5a4]
push eax
push 0x10
lea ecx, [esi + 0xf620]
push ecx
call fcn.0102cf90
mov edx, dword [esi + 0xf630]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword [eax + 4], edx
pop ebx
pop ebp
ret 8

Function at 0x10f0ef0
Capabilities:
Hash data with md5

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov dword [ebx + 0xf630], eax
mov dword [ebx + 0xf690], eax
push edi
lea esi, [ebx + 0xf5c8]
push eax
mov eax, dword [ebp + 8]
push eax
xor edi, edi
push esi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
call fcn.010bd7a0
push esi
call fcn.010bd870
mov eax, dword [ebx + 0x1042c]
cmp eax, edi
je 0x10f0f62
lea esi, [eax + 0x151]
lea edi, [eax + 0x172]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea esi, [ebx + 0xf5a4]
push esi
push 0x10
lea ecx, [ebx + 0xf620]
push ecx
call fcn.0102cf90
lea edi, [ebx + 0xf518]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov eax, dword [esi + 0x148]
mov dword [ebx + 0xf670], eax
test eax, eax
jne 0x10f0fa7
cmp dword [esi + 0x10], eax
je 0x10f0fa7
mov dword [esi + 0x148], 0x23
cmp dword [esi + 4], 0x14
jbe 0x10f0fff
push ebx
push esi
call fcn.01088e00
mov ecx, dword [esi + 4]
lea edx, [ebx + 0xfeb4]
push edx
mov edx, dword [esi]
lea eax, [ebx + 0xf634]
push eax
mov eax, dword [ebx]
push ecx
push edx
push eax
call fcn.010bda00
push ebx
push esi
call fcn.010bde10
cmp dword [ebx + 0x1042c], 0
je 0x10f0fff
push 0
push ebx
push esi
call fcn.01035b50
push ebx
call fcn.010366c0
mov ecx, dword [ebx + 0x1042c]
mov edx, dword [esi + 0x14c]
mov dword [ecx + 0x20], edx
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x10f1170
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x10f1130
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [esi + 0x8bdc], eax
test eax, eax
je 0x10f11ba
mov ecx, dword [esi + 0x25c]
push 0x1388
push eax
call ecx
mov eax, dword [esi + 0x8bdc]
test eax, eax
je 0x10f11ba
mov edx, dword [esi + 0x1c8]
push eax
call edx
push esi
mov dword [esi + 0x8bdc], 0
call fcn.010be940
pop esi
pop ebp
ret 4
Function at 0x10f6b30
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push esi
push 9
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x10f6bb9
mov eax, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
lea ecx, [ebp + 8]
push ecx
push 0
push esi
push 0x10f6ab0
push 0
push 0
mov dword [esi], edi
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x10f6b88
mov edx, dword [edi]
push eax
mov eax, dword [edx + 0x1c8]
call eax
pop edi
pop esi
pop ebx
pop ebp
ret 8
mov eax, dword [esi + 4]
mov ecx, dword [edi]
shr eax, 2
cmp eax, dword [ecx + 0x644]
jae 0x10f6bac
mov edx, dword [ecx + 0x640]
mov ecx, dword [ecx]
push 0
lea eax, [edx + eax*4]
push eax
push ecx
call fcn.010f6700
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x10fb4a0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x101cf28
push esi
call fcn.010d41f0
xor ebx, ebx
test eax, eax
je 0x10fb4e5
mov eax, dword [esi]
mov ecx, dword [eax + 0x35b0]
mov dword [ecx + 0xe48], ebx
mov edx, dword [esi]
mov eax, dword [edx + 0x35b0]
push ebx
push 0x101cf28
push esi
mov dword [eax + 0xe40], ebx
call fcn.010d4270
push esi
call fcn.010d4ab0
mov ecx, dword [esi]
push 0x101cf24
push 0x1015ba4
push connect
push ecx
call fcn.010bb5e0
test eax, eax
je 0x10fb54a
mov eax, dword [esi]
push 4
lea edx, [ebp + 8]
push edx
push 4
push 0x101cf24
push 0x1015ba4
push connect
push eax
mov dword [ebp + 8], ebx
call fcn.010baf70
mov edi, dword [esi]
lea ecx, [ebp + 8]
push ecx
push ebx
push esi
push 0x104f3b0
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
cmp eax, ebx
je 0x10fb54a
mov edx, dword [edi + 0x1c8]
push eax
call edx
cmp dword [esi + 0xa44], ebx
je 0x10fb577
mov eax, dword [esi]
push 0x101cf1c
push 0x1015ba4
push connect
push eax
call fcn.010bb5e0
test eax, eax
je 0x10fb577
mov dword [esi + 0xa6c], 1
mov ecx, dword [esi]
push ecx
call fcn.010f51d0
mov eax, dword [esi]
push ebx
lea edx, [ebp + 8]
push edx
lea ecx, [ebp - 4]
push ecx
push 0x101cf14
push 0x1015b3c
push connect
push eax
call fcn.010bb210
cmp eax, ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_HeapFree]
je 0x10fb5d5
mov edi, dword [eax]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call ebx
test edi, edi
je 0x10fb5d5
cmp dword [esi + 0xa44], 0
je 0x10fb5d5
mov edx, dword [esi]
push 0
add edx, 0x1df1c
push edx
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
mov eax, dword [esi]
mov ecx, dword [eax + 0x35b0]
cmp dword [ecx + 0x194], 0
jne 0x10fb62b
push 0
lea edx, [ebp + 8]
push edx
lea ecx, [ebp - 4]
push ecx
push 0x101cf0c
push 0x1015b3c
push connect
push eax
call fcn.010bb210
test eax, eax
je 0x10fb62b
mov edi, dword [eax]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call ebx
cmp edi, 0x16
jne 0x10fb62b
push 1
add esi, 0xa70
push esi
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10fbff0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
mov dword [esi + 0xa8], eax
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x10fbe80
push 0
push 0
mov dword [esi + 0xa0], ecx
mov dword [esi + 0xa4], edx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [esi + 0xb8], eax
pop esi
pop ebp
ret 0x10
Function at 0x10fc390
Capabilities:
Delete file
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x460
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 4], ebx
test esi, esi
jne 0x10fc3ad
xor eax, eax
jmp 0x10fc3c0
mov eax, esi
cmp word [esi], bx
je 0x10fc3bc
add eax, 2
cmp word [eax], bx
jne 0x10fc3b4
sub eax, esi
sar eax, 1
push eax
push 0x5c
push esi
call fcn.0102d860
test eax, eax
je 0x10fc520
sub eax, esi
push edi
sar eax, 1
push eax
push esi
call fcn.0102da20
mov edi, eax
test edi, edi
je 0x10fc515
push 0x20a
lea eax, [ebp - 0x254]
push 0
push eax
call sub.msvcrt.dll_memset
mov edx, dword [ebp + 8]
mov eax, dword [edx]
add esp, 0xc
push 0x3f
lea ecx, [ebp - 0x48]
push ecx
push eax
call fcn.010efb80
lea ecx, [ebp - 0x48]
push ecx
push edi
push 0x1014164
lea edx, [ebp - 0x254]
push 0x103
push edx
call fcn.0102d9e0
mov ebx, dword [sym.imp.KERNEL32.DLL_MoveFileW]
add esp, 0x14
lea eax, [ebp - 0x254]
push eax
push esi
call ebx
test eax, eax
jne 0x10fc453
mov edx, dword [ebp + 8]
mov eax, dword [edx]
lea ecx, [ebp - 0x254]
push ecx
push esi
push eax
call fcn.01094e20
push 0x20a
lea ecx, [ebp - 0x460]
push 0
push ecx
call sub.msvcrt.dll_memset
add esp, 0xc
lea edx, [ebp - 0x48]
push edx
call fcn.01084da0
lea eax, [ebp - 0x48]
push eax
push edi
push 0x1014164
lea ecx, [ebp - 0x460]
push 0x103
push ecx
call fcn.0102d9e0
add esp, 0x14
lea edx, [ebp - 0x460]
push edx
lea eax, [ebp - 0x254]
push eax
call ebx
test eax, eax
jne 0x10fc4bd
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x460]
push ecx
mov ecx, dword [eax]
lea edx, [ebp - 0x254]
push edx
push ecx
call fcn.01094e20
mov ebx, dword [sym.imp.KERNEL32.DLL_DeleteFileW]
lea edx, [ebp - 0x460]
push edx
call ebx
test eax, eax
je 0x10fc4d7
mov dword [ebp - 4], 1
lea eax, [ebp - 0x254]
push eax
call ebx
test eax, eax
je 0x10fc4eb
mov dword [ebp - 4], 1
push esi
call ebx
test eax, eax
je 0x10fc4f9
mov dword [ebp - 4], 1
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8