joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10074aa0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101129cd
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x10163164]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
cmp byte [edi + 0x44], 0
jne 0x10074bea
cmp dword [ebp + 8], 0
je 0x10074c00
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
cmp eax, dword [ebx + 4]
je 0x10074c00
lea esi, [edi + 0x14]
push esi
mov dword [ebp - 0x14], esi
call fcn.100b723b
add esp, 4
test eax, eax
jne 0x10074c16
mov eax, dword [esi + 0x2c]
cmp eax, 0x7fffffff
je 0x10074c1d
mov dword [ebp - 4], 0
cmp byte [edi + 0x44], 0
jne 0x10074bdf
push edi
mov byte [edi + 0x44], 1
mov dword [ebp - 0x24], edi
call fcn.100b7367
add esp, 4
mov byte [ebp - 0x20], 1
mov esi, dword [ebp + 0xc]
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], 0xc8
mov ebx, dword [ebx + 4]
mov esi, dword [esi]
cmp esi, ebx
je 0x10074b78
lea eax, [edi + 4]
mov edi, eax
nop dword [eax + eax]
push esi
mov ecx, edi
call fcn.10074e60
add esi, 0x18
mov dword [eax], 0
cmp esi, ebx
jne 0x10074b60
mov edi, dword [ebp - 0x10]
push edi
mov byte [ebp - 4], 0
call fcn.100b7383
push 8
call fcn.100b887b
mov dword [ebp + 8], eax
mov dword [eax], 0x10074ce0
mov dword [eax + 4], edi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
push ecx
push 0
push eax
push 0x10020960
push 0
push 0
call fcn.100cba9a
mov ecx, eax
add esp, 0x20
mov dword [ebp - 0x1c], ecx
test ecx, ecx
je 0x10074c2d
cmp dword [edi + 0x4c], 0
jne 0x10074c28
mov eax, dword [ebp - 0x18]
mov dword [edi + 0x48], ecx
mov dword [edi + 0x4c], eax
cmp byte [edi + 0x45], 0
jne 0x10074bdf
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xa
call esi
cmp byte [edi + 0x45], 0
je 0x10074bd5
push dword [ebp - 0x14]
call fcn.100b7260
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 5
call fcn.100b6fbf
dec eax
push 6
mov dword [esi + 0x2c], eax
call fcn.100b6fbf
call fcn.100cbb2d
push 6
mov dword [ebp - 0x18], 0
call fcn.100b6fbf
int3
Function at 0x100767e0
Capabilities:
Get thread local storage value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10112b06
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xd0
mov eax, dword [0x10163164]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea esi, [edi + 8]
mov dword [ebp - 4], 0
cmp dword [esi + 0x10], 0
je 0x1007684e
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ecx + 4]
lea ecx, [ebp - 0x30]
push esi
push ecx
call eax
add esp, 8
jmp 0x10076863
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x18], eax
push edi
lea ecx, [ebp - 0x7c]
mov dword [ebp - 4], 1
call fcn.10076df0
mov byte [ebp - 4], 2
cmp dword [ebp - 0x20], 0
je 0x100769a6
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx + 0xc]
test eax, eax
je 0x100768a8
lea ecx, [ebp - 0x7c]
push ecx
lea ecx, [ebp - 0x30]
push 0x10076f30
push ecx
call eax
add esp, 0xc
jmp 0x10076965
mov edi, dword [ecx + 8]
lea eax, [ebp - 0x7c]
push eax
lea ecx, [ebp - 0xe0]
call fcn.10076df0
mov byte [ebp - 4], 3
lea eax, [ebp - 0x7d]
push dword [0x1017537c]
mov dword [ebp - 0x90], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x100768dc
mov ecx, dword [eax + 4]
jmp 0x100768de
xor ecx, ecx
push ecx
push dword [ebp - 0x84]
mov edx, 0x54
call fcn.1002b430
mov esi, eax
mov dword [ebp - 0x88], 0
add esp, 8
lea eax, [ebp - 0xe0]
lea ecx, [esi + 4]
push eax
call fcn.10076df0
mov dword [esi], 0x100772c0
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x84], esi
mov dword [ebp - 0x8c], 0
call fcn.10076eb0
lea ecx, [ebp - 0xe0]
call fcn.10075bf0
lea eax, [ebp - 0x84]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x30]
push eax
call edi
add esp, 8
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x84]
test eax, eax
je 0x10076965
mov ecx, dword [eax]
push 0
push eax
call ecx
add esp, 8
lea ecx, [ebp - 0x7c]
call fcn.10075bf0
mov dword [ebp - 4], 7
cmp dword [ebp - 0x20], 0
je 0x10076988
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
call eax
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100b8868
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
lea ecx, [ebp - 0x90]
call fcn.10027870
mov byte [ebp - 4], 6
call fcn.10029eb0
int3
Function at 0x100769c0
Capabilities:
Get thread local storage value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10111035
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x40
push esi
push edi
mov eax, dword [0x10163164]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x1c], esi
mov edx, dword [ebx + 8]
mov eax, dword [edx]
mov dword [ebp - 0x3c], eax
mov eax, dword [edx + 4]
mov dword [ebp - 0x38], eax
lea eax, [edx + 8]
push eax
lea eax, [ebp - 0x34]
mov dword [edx], 0
push eax
mov dword [edx + 4], 0
call fcn.100b7ca6
add esp, 8
mov dword [ebp - 4], 0
cmp dword [esi + 0x10], 0
je 0x10076bb4
mov ecx, dword [esi + 0x14]
or edi, 0xffffffff
mov eax, dword [ecx + 0xc]
test eax, eax
je 0x10076a5d
lea ecx, [ebp - 0x3c]
push ecx
push fcn.10076e80
push esi
call eax
add esp, 0xc
jmp 0x10076b6d
mov eax, dword [ecx + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x48]
mov dword [ebp - 0x3c], 0
push eax
mov dword [ebp - 0x38], 0
call fcn.100b7ca6
add esp, 8
mov byte [ebp - 4], 1
lea eax, [ebp - 0x11]
push dword [0x1017537c]
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x10076aac
mov ecx, dword [eax + 4]
jmp 0x10076aae
xor ecx, ecx
push ecx
push dword [ebp - 0x20]
mov edx, 0x18
call fcn.1002b430
mov esi, eax
mov dword [ebp - 0x24], 0
mov dword [esi + 4], 0
lea eax, [esi + 0xc]
mov dword [esi + 8], 0
mov ecx, dword [ebp - 0x50]
mov dword [esi + 4], ecx
mov ecx, dword [ebp - 0x4c]
mov dword [esi + 8], ecx
lea ecx, [ebp - 0x48]
push ecx
push eax
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
call fcn.100b7ca6
add esp, 0x10
mov dword [esi], 0x10077010
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x28], 0
call fcn.100579e0
lea eax, [ebp - 0x48]
push eax
call fcn.100b7dce
mov esi, dword [ebp - 0x4c]
add esp, 4
test esi, esi
je 0x10076b47
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x10076b47
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov eax, edi
lock xadd dword [esi + 8], eax
jne 0x10076b47
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 2
push eax
push dword [ebp - 0x1c]
call dword [ebp - 0x20]
add esp, 8
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x10076b6d
push 0
push eax
mov eax, dword [eax]
call eax
add esp, 8
lea eax, [ebp - 0x34]
push eax
call fcn.100b7dce
mov esi, dword [ebp - 0x38]
add esp, 4
test esi, esi
je 0x10076b9e
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x10076b9e
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x10076b9e
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0xc
lea ecx, [ebp - 0x2c]
call fcn.10027870
mov byte [ebp - 4], 4
call fcn.10029eb0
int3
Function at 0x10076bd0
Capabilities:
Get thread local storage value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10111035
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x40
push esi
push edi
mov eax, dword [0x10163164]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x1c], esi
mov edx, dword [ebx + 8]
mov eax, dword [edx]
mov dword [ebp - 0x3c], eax
mov eax, dword [edx + 4]
mov dword [ebp - 0x38], eax
lea eax, [edx + 8]
push eax
lea eax, [ebp - 0x34]
mov dword [edx], 0
push eax
mov dword [edx + 4], 0
call fcn.100b7ca6
add esp, 8
mov dword [ebp - 4], 0
cmp dword [esi + 0x10], 0
je 0x10076dc4
mov ecx, dword [esi + 0x14]
or edi, 0xffffffff
mov eax, dword [ecx + 0xc]
test eax, eax
je 0x10076c6d
lea ecx, [ebp - 0x3c]
push ecx
push fcn.10076e90
push esi
call eax
add esp, 0xc
jmp 0x10076d7d
mov eax, dword [ecx + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x48]
mov dword [ebp - 0x3c], 0
push eax
mov dword [ebp - 0x38], 0
call fcn.100b7ca6
add esp, 8
mov byte [ebp - 4], 1
lea eax, [ebp - 0x11]
push dword [0x1017537c]
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x10076cbc
mov ecx, dword [eax + 4]
jmp 0x10076cbe
xor ecx, ecx
push ecx
push dword [ebp - 0x20]
mov edx, 0x18
call fcn.1002b430
mov esi, eax
mov dword [ebp - 0x24], 0
mov dword [esi + 4], 0
lea eax, [esi + 0xc]
mov dword [esi + 8], 0
mov ecx, dword [ebp - 0x50]
mov dword [esi + 4], ecx
mov ecx, dword [ebp - 0x4c]
mov dword [esi + 8], ecx
lea ecx, [ebp - 0x48]
push ecx
push eax
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
call fcn.100b7ca6
add esp, 0x10
mov dword [esi], 0x100770f0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x28], 0
call fcn.100579e0
lea eax, [ebp - 0x48]
push eax
call fcn.100b7dce
mov esi, dword [ebp - 0x4c]
add esp, 4
test esi, esi
je 0x10076d57
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x10076d57
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov eax, edi
lock xadd dword [esi + 8], eax
jne 0x10076d57
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 2
push eax
push dword [ebp - 0x1c]
call dword [ebp - 0x20]
add esp, 8
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x10076d7d
push 0
push eax
mov eax, dword [eax]
call eax
add esp, 8
lea eax, [ebp - 0x34]
push eax
call fcn.100b7dce
mov esi, dword [ebp - 0x38]
add esp, 4
test esi, esi
je 0x10076dae
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x10076dae
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x10076dae
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0xc
lea ecx, [ebp - 0x2c]
call fcn.10027870
mov byte [ebp - 4], 4
call fcn.10029eb0
int3
Function at 0x10076eb0
Capabilities:
Get thread local storage value

Disassembly:
push ecx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 8]
test ecx, ecx
je 0x10076ecb
add ecx, 4
call fcn.10075bf0
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x10076f0f
push dword [0x1017537c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x10076eff
mov edx, dword [eax + 4]
test edx, edx
je 0x10076eff
mov eax, 4
nop
cmp dword [edx + eax*4], 0
lea ecx, [edx + eax*4]
je 0x10076f13
inc eax
cmp eax, 6
jl 0x10076ef0
push esi
call fcn.100b88ab
add esp, 4
mov dword [edi + 4], 0
pop edi
pop esi
pop ecx
ret
mov al, byte [esi + 0x54]
mov byte [esi], al
mov dword [ecx], esi
mov dword [edi + 4], 0
pop edi
pop esi
pop ecx
ret

Function at 0x10078640
Capabilities:
Get system information on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x101744dc]
xorps xmm0, xmm0
movaps xmmword [ebp - 0x30], xmm0
movaps xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x10], 0
test eax, eax
je 0x1007867c
lea ecx, [ebp - 0x30]
push ecx
call eax
jmp 0x10078686
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov cx, word [ebp - 0x30]
cmp cx, 9
je 0x100786a0
xor eax, eax
cmp cx, 6
sete al
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov eax, 1
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret

Function at 0x100787a0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0x34
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x100787c2
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebx, eax
test ebx, ebx
je 0x10078863
xor ecx, ecx
mov edx, 2
mul edx
push edi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.100b88be
add esp, 4
mov edi, eax
cmp dword [esi + 0x14], 8
jb 0x100787f9
mov esi, dword [esi]
push edi
push ebx
push 0
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x10078848
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x10149d98
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x10078848
mov edx, dword [ebp - 0xc]
movzx eax, word [edx + 0xa]
lea ecx, [eax + eax*4]
movzx eax, word [edx + 8]
lea eax, [eax + ecx*2]
lea ecx, [eax + eax*4]
movzx eax, word [edx + 0xe]
lea eax, [eax + ecx*2]
lea ecx, [eax + eax*4]
movzx eax, word [edx + 0xc]
lea eax, [eax + ecx*2]
mov dword [ebp - 4], eax
push edi
call fcn.100b8876
mov ecx, dword [ebp - 4]
add esp, 4
or eax, 0xffffffff
test ecx, ecx
cmovne eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10079870
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10112f0f
mov eax, dword fs:[0]
push eax
sub esp, 0x258
mov eax, dword [0x10163164]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x260], esi
mov dword [ebp - 0x264], esi
mov dword [ebp - 0x25c], 0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
push 0
mov dword [ebp - 4], 0
push 2
mov dword [ebp - 0x25c], 1
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x100799f9
push 0x228
lea eax, [ebp - 0x254]
push 0
push eax
call fcn.100c2fd0
add esp, 0xc
mov dword [ebp - 0x258], 0x22c
lea eax, [ebp - 0x258]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x100799f2
nop word [eax + eax]
mov eax, dword [ebp - 0x250]
xorps xmm0, xmm0
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x234]
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0
lea edx, [eax + 2]
mov dword [ebp - 0x14], 0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10079957
sub eax, edx
lea ecx, [ebp - 0x28]
sar eax, 1
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.10038830
mov dword [ebp - 4], 1
mov ecx, dword [esi + 4]
cmp ecx, dword [esi + 8]
je 0x100799c4
movups xmm0, xmmword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
mov dword [ecx], eax
xor eax, eax
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
movups xmmword [ecx + 4], xmm0
mov word [ebp - 0x28], ax
movq xmm0, qword [ebp - 0x18]
movq qword [ecx + 0x14], xmm0
add dword [esi + 4], 0x1c
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
jmp 0x100799d0
lea eax, [ebp - 0x2c]
push eax
push ecx
mov ecx, esi
call fcn.1007f790
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.10037f60
lea eax, [ebp - 0x258]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x10079930
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100b8868
mov esp, ebp
pop ebp
ret
Function at 0x10079a30
Capabilities:
Create process on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10112f50
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x2a0
mov eax, dword [0x10163164]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
test esi, esi
jne 0x10079a80
xor al, al
jmp 0x10079c45
xorps xmm0, xmm0
mov dword [ebp - 0x228], 0
movups xmmword [ebp - 0x238], xmm0
mov dword [ebp - 0x224], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10079aa1
sub ecx, edx
push ecx
push esi
lea ecx, [ebp - 0x238]
call fcn.10008320
lea edx, [ebp - 0x238]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x250]
call fcn.10079760
mov ecx, dword [ebp - 0x224]
cmp ecx, 0x10
jb 0x10079b09
mov edx, dword [ebp - 0x238]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10079aff
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10079c63
push ecx
push edx
call fcn.100b88b0
add esp, 8
cmp dword [ebp - 0x23c], 8
lea eax, [ebp - 0x250]
cmovae eax, dword [ebp - 0x250]
push eax
lea eax, [ebp - 0x220]
push 0x104
push eax
call fcn.100cd0af
add esp, 0xc
mov dword [ebp - 0x2b0], 0x44
lea eax, [ebp - 0x264]
xorps xmm0, xmm0
movlpd qword [ebp - 0x2ac], xmm0
movlpd qword [ebp - 0x2a4], xmm0
push eax
lea eax, [ebp - 0x2b0]
movlpd qword [ebp - 0x29c], xmm0
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
lea eax, [ebp - 0x220]
movlpd qword [ebp - 0x294], xmm0
push eax
push 0
movlpd qword [ebp - 0x28c], xmm0
movlpd qword [ebp - 0x284], xmm0
movlpd qword [ebp - 0x27c], xmm0
movlpd qword [ebp - 0x274], xmm0
movups xmmword [ebp - 0x264], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x10079bd5
push dword [ebp - 0x264]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x260]
call esi
mov byte [ebp - 0x251], 0
jmp 0x10079c03
test edi, edi
jle 0x10079be6
push edi
push dword [ebp - 0x264]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x264]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x260]
call esi
mov byte [ebp - 0x251], 1
mov ecx, dword [ebp - 0x23c]
cmp ecx, 8
jb 0x10079c3f
mov edx, dword [ebp - 0x250]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10079c35
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10079c68
push ecx
push edx
call fcn.100b88b0
add esp, 8
mov al, byte [ebp - 0x251]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100b8868
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.100c9aa4
call fcn.100c9aa4
int3
Function at 0x1007a2e0
Capabilities:
Connect socket
Get local ipv4 addresses
Get socket information
Get socket status
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10113000
mov eax, dword fs:[0]
push eax
sub esp, 0x250
mov eax, dword [0x10163164]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24c], edx
mov dword [ebp - 0x250], ecx
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x23c], 0
lea ecx, [ebp - 0x244]
mov dword [ebp - 4], 0
call fcn.1007a220
mov esi, dword [ebp - 0x244]
test al, al
je 0x1007a477
xor ebx, ebx
push ebx
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
test edi, edi
je 0x1007a477
lea eax, [ebp - 0x248]
mov dword [ebp - 0x248], 1
push eax
push 0x8004667e
push edi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
js 0x1007a463
push dword [ebp - 0x24c]
xorps xmm0, xmm0
mov eax, 2
movlpd qword [ebp - 0x18], xmm0
mov word [ebp - 0x20], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x1e], ax
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
push 0x10
push eax
push edi
call dword [sym.imp.WS2_32.dll_connect]
lea eax, [ebp - 0x25c]
mov dword [ebp - 0x25c], 1
push eax
push ebx
lea eax, [ebp - 0x134]
mov dword [ebp - 0x258], ebx
push eax
lea eax, [ebp - 0x238]
mov dword [ebp - 0x234], edi
push eax
push edi
mov dword [ebp - 0x238], 1
mov dword [ebp - 0x130], edi
mov dword [ebp - 0x134], 1
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
js 0x1007a463
lea eax, [ebp - 0x254]
mov dword [ebp - 0x254], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
push edi
call dword [sym.imp.WS2_32.dll_getsockname]
mov ebx, dword [ebp - 0x2c]
test eax, eax
je 0x1007a443
test ebx, ebx
je 0x1007a461
mov edx, dword [ebp - 0x240]
mov eax, esi
cmp eax, edx
je 0x1007a461
nop
mov ecx, dword [eax]
test ecx, ecx
je 0x1007a45a
cmp ecx, ebx
je 0x1007a46c
add eax, 4
cmp eax, edx
jne 0x1007a450
xor ebx, ebx
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
jmp 0x1007a479
push edi
mov ebx, ecx
call dword [sym.imp.WS2_32.dll_closesocket]
jmp 0x1007a479
xor ebx, ebx
test esi, esi
je 0x1007a4ac
mov ecx, dword [ebp - 0x23c]
mov eax, esi
sub ecx, esi
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x1007a4a2
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1007a4ca
push ecx
push esi
call fcn.100b88b0
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100b8868
mov esp, ebp
pop ebp
ret
call fcn.100c9aa4
int3
Function at 0x1007aa30
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101130f0
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x234
mov eax, dword [0x10163164]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x23c], esi
push 0
push 0x24
lea eax, [ebp - 0x220]
mov dword [ebp - 0x23c], esi
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xorps xmm0, xmm0
test eax, eax
jne 0x1007aab3
push eax
movups xmmword [esi], xmm0
push 0x1014a260
mov ecx, esi
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
call fcn.10038830
jmp 0x1007ab38
lea eax, [ebp - 0x220]
mov dword [ebp - 0x228], 0
movups xmmword [ebp - 0x238], xmm0
mov dword [ebp - 0x224], 0
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1007aad7
sub eax, edx
lea ecx, [ebp - 0x238]
sar eax, 1
push eax
lea eax, [ebp - 0x220]
push eax
call fcn.10038830
push 0x5c
lea ecx, [ebp - 0x238]
mov dword [ebp - 4], 0
call fcn.1007dfa0
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
movups xmm0, xmmword [ebp - 0x238]
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x228]
movq qword [esi + 0x10], xmm0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100b8868
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret

Function at 0x1007e580
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x1007e5b1
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x1007e5a0
pop edi
mov eax, edx
pop esi
pop ebp
ret 8