joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10026970
Capabilities:
Initialize winsock library

Disassembly:
jmp 0x10027530
jmp 0x10026970
sub esp, 0x194
mov eax, dword [0x100a0000]
xor eax, esp
mov dword [esp + 0x190], eax
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [esp + 0x1a4]
lea eax, [esp + 8]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x100269c1
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.10052ab4
add esp, 0x194
ret
mov ecx, 0x100a1520
call fcn.100032a6
push esi
mov ecx, 0x100a1530
call fcn.100024b9
push edi
call fcn.10002a59
mov ecx, eax
call fcn.100031f2
xor ecx, ecx
test al, al
setne cl
pop edi
pop esi
mov eax, ecx
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.10052ab4
add esp, 0x194
ret
push esi
mov esi, dword [esp + 8]
push edi
mov ecx, 0x10
mov edi, 0x1009f31c
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword [esp + 4], 0x1009f318
jmp 0x10001dfc
Function at 0x10030e00
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
jmp 0x10030e00
push 0xffffffffffffffff
push 0x1007f603
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x100a0000]
xor eax, esp
mov dword [esp + 0x220], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100a0000]
xor eax, esp
push eax
lea eax, [esp + 0x238]
mov dword fs:[0], eax
mov ebp, ecx
mov esi, dword [esp + 0x248]
mov edi, ebp
mov edx, esi
sub edi, esi
lea ebx, [ebx]
movzx eax, word [edx]
mov word [edi + edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x10030e50
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push esi
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, 0xffffffff
je 0x10030e77
test al, 0x10
jne 0x10030e87
push 0
push esi
call edi
test eax, eax
jne 0x10030e87
xor al, al
jmp 0x10030f2e
lea ecx, [esp + 0x2c]
sub ecx, esi
lea ecx, [ecx]
movzx eax, word [esi]
mov word [ecx + esi], ax
lea esi, [esi + 2]
test ax, ax
jne 0x10030e90
lea ecx, [esp + 0x2c]
add ecx, 0xfffffffe
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x10030ea6
mov eax, dword [str._SSL]
mov dword [ecx], eax
mov eax, dword [0x100888f4]
mov dword [ecx + 4], eax
mov ax, word [0x100888f8]
mov word [ecx + 8], ax
lea eax, [esp + 0x2c]
push eax
call ebx
cmp eax, 0xffffffff
je 0x10030edb
test al, 0x10
jne 0x10030ee8
push 0
lea eax, [esp + 0x30]
push eax
call edi
test eax, eax
je 0x10030e80
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x18]
call fcn.10003085
lea eax, [esp + 0x14]
push eax
lea ecx, [ebp + 0x208]
mov dword [esp + 0x244], 0
call fcn.1000180c
test al, al
sete bl
cmp dword [esp + 0x28], 8
jb 0x10030f29
push dword [esp + 0x14]
call fcn.10052462
add esp, 4
test bl, bl
sete al
mov ecx, dword [esp + 0x238]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.10052ab4
add esp, 0x230
ret 4
Function at 0x100310c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
jmp 0x100310c0
push 0xffffffffffffffff
push 0x1007f66e
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x100a0000]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov word [esi + 4], 0x100
mov eax, dword [esp + 0x28]
mov dword [esi + 8], eax
mov eax, dword [esp + 0x2c]
lea ecx, [esi + 0x14]
mov dword [esp + 0x20], 0
mov dword [esi], vtable.ProtocolFilters::SMTPFilter.0
mov dword [esi + 0xc], eax
call fcn.100022d4
push 1
push 1
push 0x190
lea ecx, [esi + 0x38]
mov byte [esp + 0x2c], 1
call fcn.10001582
mov ecx, dword [esi + 8]
lea eax, [esi + 0x4c]
push eax
mov byte [esp + 0x24], 2
call fcn.10001055
xorps xmm0, xmm0
lea eax, [esp + 8]
push eax
mov dword [esi + 0x10], 0
movlpd qword [esp + 0xc], xmm0
movlpd qword [esp + 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call fcn.10057070
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], edx
mov byte [esi + 5], 0
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x1c
ret 8
Function at 0x10041740
Capabilities:
Read file on windows
Write file on windows

Disassembly:
jmp 0x10041740
push 0xffffffffffffffff
push 0x10080818
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x100a0000]
xor eax, esp
mov dword [esp + 0x34], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100a0000]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x5c]
lea ebp, [edi + 0x14]
push ebp
mov dword [esp + 0x1c], vtable.ProtocolFilters::AutoLock.0
mov dword [esp + 0x20], ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
lea eax, [esp + 0x24]
push eax
mov ecx, edi
mov dword [esp + 0x5c], 0
call fcn.1000253b
lea eax, [esp + 0x20]
push eax
mov ecx, edi
mov byte [esp + 0x58], 1
call fcn.10003896
mov esi, eax
cmp esi, dword [edi]
je 0x100417e3
cmp dword [esi + 0x24], 0x10
mov ecx, dword [esi + 0x20]
lea eax, [esi + 0x10]
jb 0x100417c8
mov eax, dword [eax]
push ecx
push eax
push dword [esp + 0x38]
lea ecx, [esp + 0x2c]
push 0
call fcn.10003eef
test eax, eax
js 0x100417e3
mov dword [esp + 0x14], esi
jmp 0x100417e9
mov eax, dword [edi]
mov dword [esp + 0x14], eax
lea esi, [esp + 0x14]
mov esi, dword [esi]
cmp esi, dword [edi]
je 0x10041893
push 0
push dword [esi + 0x28]
push dword [edi + 0x10]
call fcn.100542e8
push dword [edi + 0x10]
lea eax, [esp + 0x48]
push 0x10
push 1
push eax
call fcn.100541ad
add esp, 0x1c
cmp eax, 0x10
jne 0x10041893
push 0
push dword [esi + 0x28]
push dword [edi + 0x10]
call fcn.100542e8
push dword [edi + 0x10]
xor eax, eax
push 0x10
mov word [esp + 0x4e], ax
lea eax, [esp + 0x4c]
push 1
push eax
call fcn.1005487f
add esp, 0x1c
cmp eax, 0x10
jne 0x10041893
mov ebx, dword [esi + 0x40]
test ebx, ebx
je 0x10041877
mov dword [esp + 0x14], ebx
lea ecx, [ebx + 0x18]
mov byte [esp + 0x54], 2
call fcn.100034ef
mov ecx, ebx
mov byte [esp + 0x54], 1
call fcn.100034ef
push ebx
call fcn.10052462
add esp, 4
push esi
lea eax, [esp + 0x18]
push eax
mov ecx, edi
call fcn.10003c60
push dword [edi + 0x10]
call fcn.10054dde
add esp, 4
mov bl, 1
jmp 0x10041895
xor bl, bl
cmp dword [esp + 0x34], 0x10
jb 0x100418a8
push dword [esp + 0x20]
call fcn.10052462
add esp, 4
push ebp
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], 0
mov byte [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.10052ab4
add esp, 0x44
ret 4
Function at 0x10041950
Capabilities:
Access peb ldr_data

Disassembly:
jmp 0x10041950
push 0xffffffffffffffff
push 0x10080858
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100a0000]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebx, ecx
xorps xmm0, xmm0
lea eax, [esp + 0x20]
push eax
movlpd qword [esp + 0x24], xmm0
movlpd qword [esp + 0x2c], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x34]
push dword [esp + 0x34]
call fcn.10057070
mov ebp, eax
mov esi, ebp
sub esi, dword [ebx + 8]
mov ecx, edx
sbb ecx, dword [ebx + 0xc]
mov dword [esp + 0x14], edx
mov dword [esp + 0x1c], ecx
jne 0x100419d5
cmp esi, 0x258
jb 0x10041a8a
mov eax, dword [ebx]
mov dword [ebx + 8], ebp
mov dword [ebx + 0xc], edx
mov esi, dword [eax]
cmp esi, eax
je 0x10041a8a
mov edi, dword [esi + 0x40]
test edi, edi
je 0x10041a3d
mov ecx, ebp
sub ecx, dword [esi + 0x30]
mov eax, edx
sbb eax, dword [esi + 0x34]
mov dword [esp + 0x1c], eax
jne 0x10041a06
cmp ecx, 0x258
jbe 0x10041a3d
mov dword [esp + 0x18], edi
lea ecx, [edi + 0x18]
mov dword [esp + 0x38], 0
call fcn.100034ef
mov ecx, edi
mov dword [esp + 0x38], 0xffffffff
call fcn.100034ef
push edi
call fcn.10052462
mov edx, dword [esp + 0x18]
add esp, 4
mov dword [esi + 0x40], 0
cmp byte [esi + 0xd], 0
jne 0x10041a82
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x10041a62
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
jne 0x10041a82
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
je 0x10041a56
jmp 0x10041a82
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x10041a80
jmp 0x10041a70
cmp esi, dword [eax + 8]
jne 0x10041a80
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x10041a70
mov esi, eax
cmp esi, dword [ebx]
jne 0x100419e7
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
Function at 0x10043630
Capabilities:
Delete file

Disassembly:
jmp 0x10043630
push 0xffffffffffffffff
push 0x10080978
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100a0000]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, ecx
lea ebp, [edi + 0x14]
push ebp
mov dword [esp + 0x18], vtable.ProtocolFilters::AutoLock.0
mov dword [esp + 0x1c], ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, edi
mov dword [esp + 0x24], 0
call fcn.10002419
mov esi, dword [esp + 0x2c]
cmp dword [esi + 0x14], 8
jb 0x1004368c
mov eax, dword [esi]
jmp 0x1004368e
mov eax, esi
push 0x10089254
push eax
call fcn.100548fd
add esp, 8
mov dword [edi + 0x10], eax
test eax, eax
jne 0x100436c4
cmp dword [esi + 0x14], 8
jb 0x100436ad
mov eax, dword [esi]
jmp 0x100436af
mov eax, esi
push 0x10089260
push eax
call fcn.100548fd
add esp, 8
mov dword [edi + 0x10], eax
test eax, eax
je 0x10043718
mov ecx, edi
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
call fcn.100026df
test al, al
jne 0x1004371c
push dword [edi + 0x10]
call fcn.10053f58
add esp, 4
cmp dword [esi + 0x14], 8
jb 0x100436f2
mov eax, dword [esi]
jmp 0x100436f4
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esi + 0x14], 8
jb 0x10043703
mov esi, dword [esi]
push 0x10089260
push esi
call fcn.100548fd
add esp, 8
mov dword [edi + 0x10], eax
test eax, eax
jne 0x1004371c
xor bl, bl
jmp 0x1004371e
mov bl, 1
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
Function at 0x10043b60
Capabilities:
Read file on windows

Disassembly:
jmp 0x10043b60
push 0xffffffffffffffff
push 0x10080a78
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x100a0000]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push esi
push edi
mov eax, dword [0x100a0000]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], 0
mov byte [esp + 0x1c], 0
cmp dword [edi + 0x1c], 8
lea eax, [edi + 8]
mov dword [esp + 0x40], 0
mov bl, 1
jb 0x10043bbd
mov eax, dword [eax]
push 0x10089254
push eax
call fcn.100548fd
mov esi, eax
add esp, 8
test esi, esi
jne 0x10043bd8
xor bl, bl
jmp 0x10043cba
push esi
push 4
lea eax, [esp + 0x18]
push 1
push eax
call fcn.100541ad
add esp, 0x10
cmp eax, 4
jne 0x10043cb1
jmp 0x10043c00
mov ecx, dword [esp + 0x10]
cmp ecx, 0x7d0
ja 0x10043caf
mov eax, dword [esp + 0x2c]
cmp ecx, eax
ja 0x10043c30
cmp dword [esp + 0x30], 0x10
lea eax, [esp + 0x1c]
cmovae eax, dword [esp + 0x1c]
mov dword [esp + 0x2c], ecx
mov byte [eax + ecx], 0
jmp 0x10043c3e
sub ecx, eax
push 0
push ecx
lea ecx, [esp + 0x24]
call fcn.10002720
push esi
push 8
lea eax, [esp + 0x1c]
push 1
push eax
call fcn.100541ad
add esp, 0x10
cmp eax, 8
jne 0x10043caf
cmp dword [esp + 0x30], 0x10
push esi
push dword [esp + 0x14]
lea eax, [esp + 0x24]
cmovae eax, dword [esp + 0x24]
push 1
push eax
call fcn.100541ad
add esp, 0x10
cmp eax, dword [esp + 0x10]
jne 0x10043caf
lea eax, [esp + 0x1c]
push eax
mov ecx, edi
call fcn.1000277a
mov ecx, dword [esp + 0x14]
mov dword [eax], ecx
mov ecx, dword [esp + 0x18]
push esi
push 4
mov dword [eax + 4], ecx
lea eax, [esp + 0x18]
push 1
push eax
call fcn.100541ad
add esp, 0x10
cmp eax, 4
je 0x10043c00
jmp 0x10043cb1
xor bl, bl
push esi
call fcn.10053f58
add esp, 4
cmp dword [esp + 0x30], 0x10
jb 0x10043ccd
push dword [esp + 0x1c]
call fcn.10052462
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.10052ab4
add esp, 0x34
ret
Function at 0x10043d50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10080ab8
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x100a0000]
xor eax, esp
mov dword [esp + 0x50], eax
push ebx
push esi
push edi
mov eax, dword [0x100a0000]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x4c], 0xf
mov dword [esp + 0x48], 0
mov byte [esp + 0x38], 0
xor ebx, ebx
push ebx
mov dword [esp + 0x74], 0
push ebx
push dword [edi + 0x10]
call fcn.100542e8
add esp, 0xc
push dword [edi + 0x10]
lea eax, [esp + 0x54]
push 0x10
push 1
push eax
call fcn.100541ad
add esp, 0x10
cmp eax, 0x10
jne 0x10043ea6
mov ax, word [esp + 0x52]
test ax, ax
je 0x10043ea2
mov ecx, dword [esp + 0x48]
movzx eax, ax
cmp eax, ecx
ja 0x10043e03
cmp dword [esp + 0x4c], 0x10
lea ecx, [esp + 0x38]
cmovae ecx, dword [esp + 0x38]
mov dword [esp + 0x48], eax
mov byte [ecx + eax], 0
jmp 0x10043e11
sub eax, ecx
push 0
push eax
lea ecx, [esp + 0x40]
call fcn.10002720
push dword [edi + 0x10]
movzx esi, word [esp + 0x56]
cmp dword [esp + 0x50], 0x10
push esi
lea eax, [esp + 0x40]
cmovae eax, dword [esp + 0x40]
push 1
push eax
call fcn.100541ad
add esp, 0x10
cmp eax, esi
jne 0x10043ea2
mov eax, dword [esp + 0x58]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x38]
xorps xmm0, xmm0
push eax
mov ecx, edi
mov dword [esp + 0x18], ebx
movlpd qword [esp + 0x20], xmm0
mov dword [esp + 0x30], 0
call fcn.10002207
movq xmm0, qword [esp + 0x14]
movq qword [eax], xmm0
movq xmm0, qword [esp + 0x1c]
movq qword [eax + 8], xmm0
movq xmm0, qword [esp + 0x24]
movq qword [eax + 0x10], xmm0
movq xmm0, qword [esp + 0x2c]
movq qword [eax + 0x18], xmm0
movzx eax, word [esp + 0x50]
add ebx, eax
push 0
push ebx
jmp 0x10043daa
xor bl, bl
jmp 0x10043ea8
mov bl, 1
cmp dword [esp + 0x4c], 0x10
jb 0x10043ebb
push dword [esp + 0x38]
call fcn.10052462
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.10052ab4
mov esp, ebp
pop ebp
ret
Function at 0x100444e0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
jmp 0x100444e0
push 0xffffffffffffffff
push 0x10080b58
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x100a0000]
xor eax, esp
mov dword [esp + 0x4c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100a0000]
xor eax, esp
push eax
lea eax, [esp + 0x64]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x74]
lea eax, [edi + 0x14]
push eax
mov dword [esp + 0x1c], vtable.ProtocolFilters::AutoLock.0
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea ecx, [esp + 0x20]
mov dword [esp + 0x6c], 0
call fcn.100022d4
push esi
lea eax, [esp + 0x4c]
push eax
mov ecx, edi
mov byte [esp + 0x74], 1
call fcn.1000253b
mov ebx, eax
push ebx
mov ecx, edi
mov byte [esp + 0x70], 2
call fcn.10003896
mov esi, eax
cmp esi, dword [edi]
je 0x1004458c
cmp dword [esi + 0x24], 0x10
mov ecx, dword [esi + 0x20]
lea eax, [esi + 0x10]
jb 0x10044574
mov eax, dword [eax]
push ecx
push eax
push dword [ebx + 0x10]
mov ecx, ebx
push 0
call fcn.10003eef
test eax, eax
js 0x1004458c
mov dword [esp + 0x14], esi
jmp 0x10044592
mov eax, dword [edi]
mov dword [esp + 0x14], eax
cmp dword [esp + 0x5c], 0x10
lea esi, [esp + 0x14]
mov esi, dword [esi]
jb 0x100445ab
push dword [esp + 0x48]
call fcn.10052462
add esp, 4
mov dword [esp + 0x5c], 0xf
mov dword [esp + 0x58], 0
mov byte [esp + 0x48], 0
cmp esi, dword [edi]
je 0x10044635
mov ebx, dword [esp + 0x78]
mov ebp, dword [esp + 0x7c]
push 0
push dword [esi + 0x28]
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebp
push dword [edi + 0x10]
call fcn.100542e8
push dword [edi + 0x10]
lea eax, [esp + 0x48]
push 0x10
push 1
push eax
call fcn.100541ad
add esp, 0x1c
cmp eax, 0x10
jne 0x10044635
push 0
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebp
push dword [esi + 0x28]
push dword [edi + 0x10]
call fcn.100542e8
push dword [edi + 0x10]
lea eax, [esp + 0x48]
push 0x10
push 1
push eax
call fcn.1005487f
add esp, 0x1c
cmp eax, 0x10
jne 0x10044635
push dword [edi + 0x10]
call fcn.10054dde
add esp, 4
mov bl, 1
jmp 0x10044637
xor bl, bl
lea ecx, [esp + 0x20]
mov byte [esp + 0x6c], 0
call fcn.100034ef
lea eax, [edi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.10052ab4
add esp, 0x5c
ret 0xc
Function at 0x100487d0
Capabilities:
Access peb ldr_data

Disassembly:
jmp 0x100487d0
push 0xffffffffffffffff
push 0x10080f99
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x100a0000]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
mov eax, dword [0x100a0000]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esi + 8]
lea eax, [esp + 0xc]
push eax
call fcn.1000324c
lea eax, [esi + 0x150]
push eax
lea eax, [esp + 0x28]
push 0x1008a064
push eax
mov dword [esp + 0x54], 0
call fcn.10001c44
add esp, 0xc
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x54], 1
call fcn.10003c8d
cmp dword [esp + 0x38], 0x10
mov byte [esp + 0x48], 0
jb 0x1004885b
push dword [esp + 0x24]
call fcn.10052462
add esp, 4
cmp dword [esp + 0x20], 0x10
lea eax, [esp + 0xc]
cmovae eax, dword [esp + 0xc]
push eax
call fcn.10002a59
mov ecx, eax
call fcn.10002ec3
mov ecx, eax
call fcn.10002865
cmp dword [esp + 0x20], 0x10
mov bl, al
jb 0x10048892
push dword [esp + 0xc]
call fcn.10052462
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.10052ab4
add esp, 0x40
ret

Function at 0x1004d950
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
jmp 0x1004d950
push 0xffffffffffffffff
push 0x100812b0
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x100a0000]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov word [edi + 4], 0x100
mov esi, dword [esp + 0x24]
mov eax, esi
shr eax, 3
and al, 1
movzx eax, al
push eax
push 0x44c
lea ecx, [edi + 8]
mov dword [esp + 0x20], 0
mov dword [edi], vtable.ProtocolFilters::XMPPFilter.0
call fcn.10003391
mov eax, esi
shr eax, 2
and al, 1
movzx eax, al
push eax
push 0x44d
lea ecx, [edi + 0x30]
mov byte [esp + 0x20], 1
call fcn.10003391
mov eax, dword [esp + 0x20]
lea ecx, [edi + 0x64]
mov byte [esp + 0x18], 2
mov byte [edi + 0x58], 1
mov dword [edi + 0x5c], eax
mov dword [edi + 0x60], esi
call fcn.10002455
lea ecx, [edi + 0xa0]
mov byte [esp + 0x18], 3
call fcn.10002455
mov byte [edi + 5], 0
mov byte [edi + 0xdc], 0
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 8
Function at 0x1004da20
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
jmp 0x1004da20
push 0xffffffffffffffff
push 0x1008130a
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x100a0000]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov dword [edi], vtable.ProtocolFilters::XMPPFilter.0
lea ecx, [edi + 0xa0]
mov dword [esp + 0x1c], 3
call fcn.1000101e
lea ecx, [edi + 0x64]
mov byte [esp + 0x1c], 2
call fcn.1000101e
lea esi, [edi + 0x30]
mov dword [esp + 0x10], esi
mov ecx, dword [esi]
mov byte [esp + 0x1c], 4
test ecx, ecx
je 0x1004da89
mov eax, dword [ecx]
push 1
call dword [eax]
cmp dword [esi + 0x20], 0x10
jb 0x1004da9a
push dword [esi + 0xc]
call fcn.10052462
add esp, 4
mov dword [esi + 0x20], 0xf
mov dword [esi + 0x1c], 0
mov byte [esi + 0xc], 0
lea esi, [edi + 8]
mov dword [esp + 0x10], esi
mov ecx, dword [esi]
mov byte [esp + 0x1c], 5
test ecx, ecx
je 0x1004dac4
mov eax, dword [ecx]
push 1
call dword [eax]
cmp dword [esi + 0x20], 0x10
jb 0x1004dad5
push dword [esi + 0xc]
call fcn.10052462
add esp, 4
mov dword [esi + 0x20], 0xf
mov dword [esi + 0x1c], 0
mov byte [esi + 0xc], 0
mov dword [edi], vtable.ProtocolFilters::IFilterBase.0
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret
Function at 0x10067679
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.1005867f
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x100676b1
xor eax, eax
jmp 0x100676dd
cmp esi, dword [ebp - 4]
je 0x100676da
cmp dword [ebp + 0xc], 0
je 0x100676da
push dword [edi + 0x9c]
call fcn.10067287
push dword [edi + 0x9c]
mov esi, eax
call fcn.100667bb
pop ecx
pop ecx
cmp esi, eax
je 0x100676ad
xor eax, eax
inc eax
pop edi
pop esi
leave
ret