joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000f460
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword fs:[0x30]
mov dword [ebp - 4], ecx
mov eax, dword [edi + 0xc]
add eax, 0x14
mov esi, dword [eax]
cmp esi, eax
je 0x1000f4a3
mov ebx, dword [sym.imp.MSVCR120.dll_wcsstr]
test esi, esi
je 0x1000f4a3
push ecx
push dword [esi + 0x20]
call ebx
add esp, 8
test eax, eax
jne 0x1000f4ac
mov eax, dword [edi + 0xc]
mov esi, dword [esi]
add eax, 0x14
mov ecx, dword [ebp - 4]
cmp esi, eax
jne 0x1000f483
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000f4c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1003d01c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x100a8950]
mov edx, dword [0x100a8954]
cmp eax, edx
je 0x1000f4f5
nop
cmp dword [eax], ecx
je 0x1000f4ed
add eax, 0x14
cmp eax, edx
jne 0x1000f4e0
jmp 0x1000f4f5
cmp eax, edx
jne 0x1000f587
mov eax, dword fs:[0x30]
push esi
mov eax, dword [eax + 0xc]
add eax, 0xc
mov esi, dword [eax]
cmp esi, eax
je 0x1000f586
test esi, esi
je 0x1000f586
cmp dword [esi + 0x18], ecx
je 0x1000f526
mov esi, dword [esi]
cmp esi, eax
jne 0x1000f508
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002711f
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 4]
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x14], xmm0
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], esi
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x14]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
call fcn.1000f730
mov ecx, dword [esi]
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov ecx, dword [esi + 4]
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [esi + 0x10]
mov eax, dword [esi + 0x14]
mov dword [ecx + 4], eax
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x10]
mov dword [ecx], eax
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0xc]
mov dword [ecx + 4], eax
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 8]
mov dword [ecx], eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002711f
mov esp, ebp
pop ebp
ret
Function at 0x1000f9c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1003d01c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessId]
push eax
push 1
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ebx, eax
test ebx, ebx
je 0x1000fa55
push 0
push 1
lea eax, [ebp - 9]
mov byte [ebp - 9], 0xe9
push eax
push 0x527b19
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [ebp - 0x10]
mov dword [ebp - 8], 0x527b1a
push eax
push 0x40
push 4
push 0x527b1a
call edi
mov eax, dword [ebp - 8]
add eax, 0x527b1e
mov dword [0x100435f0], eax
mov eax, 0x1000f960
push 0
sub eax, 0x527b1e
push 4
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0x527b1a
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x527abe
call edi
lea eax, [ebp - 8]
mov dword [0x527abe], 0x1e8480
push eax
push dword [ebp - 8]
push 4
push 0x527abe
call edi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x52873a
call edi
lea eax, [ebp - 8]
mov byte [0x52873a], 0x55
push eax
push 0x40
push 1
push 0x527d4c
call edi
lea eax, [ebp - 8]
mov byte [0x527d4c], 0x50
push eax
push 0x40
push 1
push 0x527af2
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov byte [0x527af2], 0x52
pop ebx
call fcn.1002711f
mov esp, ebp
pop ebp
ret
Function at 0x100107b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x1003d01c]
xor eax, esp
mov dword [esp + 0x38], eax
push esi
call fcn.10025b30
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call esi
push eax
call fcn.10026000
push 0x1000fe00
push 0x100a8994
call fcn.100255c0
call fcn.10025b90
test eax, eax
je 0x100107f8
push 0
call dword [sym.imp.MSVCR120.dll_exit]
call fcn.10025b30
call esi
push eax
call fcn.10026000
push 0x10010370
push 0x100a8990
call fcn.100255c0
call fcn.10025b90
test eax, eax
je 0x10010825
push 0
call dword [sym.imp.MSVCR120.dll_exit]
call fcn.10025b30
call esi
push eax
call fcn.10026000
push 0x100100a0
push 0x100a8968
call fcn.100255c0
call fcn.10025b90
test eax, eax
je 0x10010852
push 0
call dword [sym.imp.MSVCR120.dll_exit]
call fcn.10025b30
call esi
push eax
call fcn.10026000
push 0x10010580
push 0x100a896c
call fcn.100255c0
call fcn.10025b90
test eax, eax
je 0x1001087f
push 0
call dword [sym.imp.MSVCR120.dll_exit]
sub esp, 0x18
mov ecx, esp
push 0x1003131c
call fcn.10003820
lea ecx, [esp + 0x20]
call fcn.10019e50
add esp, 0x18
cmp dword [eax + 0x14], 0x10
jb 0x100108a2
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea ecx, [esp + 8]
mov esi, eax
call fcn.10003880
sub esp, 0x18
mov ecx, esp
push str.0G07xXwjxGw77kk29nEZ43Qy3Uw
call fcn.10003820
lea ecx, [esp + 0x38]
call fcn.10019e50
add esp, 0x18
cmp dword [eax + 0x14], 0x10
jb 0x100108d7
mov eax, dword [eax]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [esp + 0x20]
mov esi, eax
call fcn.10003880
push ecx
mov ecx, esi
call fcn.1000f3d0
add esp, 4
mov dword [0x100435f8], eax
lea ecx, [esp + 0x38]
mov dword [esp + 0x38], 0
push ecx
push 0x40
push 5
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [esp + 0x3c]
pop esi
xor ecx, esp
call fcn.1002711f
mov esp, ebp
pop ebp
ret
Function at 0x10010f60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10028d38
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x1003d01c]
xor eax, esp
mov dword [esp + 0xc], eax
push esi
push edi
mov eax, dword [0x1003d01c]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
lea eax, [esp + 0x10]
mov dword [esp + 0xc], 0
xorps xmm0, xmm0
push eax
movq qword [esp + 0x14], xmm0
call dword [sym.imp.MSVCR120.dll_void___cdecl___ExceptionPtrCreate_void__]
push 0x10039194
lea eax, [esp + 0x18]
mov dword [esp + 0x30], 0
push esi
push eax
call dword [sym.imp.MSVCR120.dll_void___cdecl___ExceptionPtrCopyException_void___void_const___void_const__]
lea eax, [esp + 0x20]
push eax
push edi
call dword [sym.imp.MSVCR120.dll_void___cdecl___ExceptionPtrCopy_void___void_const__]
lea eax, [esp + 0x28]
mov dword [esp + 0x40], 0xffffffff
push eax
call dword [sym.imp.MSVCR120.dll_void___cdecl___ExceptionPtrDestroy_void__]
add esp, 0x1c
mov eax, edi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.1002711f
mov esp, ebp
pop ebp
ret

Function at 0x10012800
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1003d01c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xf0000000
push 1
push 0
push 0
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
mov edi, edx
mov dword [ebp - 0x1c], 0
mov ebx, ecx
mov dword [ebp - 0x20], 0x10
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x100128e0
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push 0x8003
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x100128d5
test edi, edi
je 0x10012888
mov esi, 0x1000
cmp edi, esi
push 0
cmovb esi, edi
push esi
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x100128cc
add ebx, esi
sub edi, esi
jne 0x10012867
push 0
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
push 2
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push dword [ebp - 0x1c]
test eax, eax
je 0x100128cf
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push 0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002711f
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push 0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
xor edx, edx
pop ebx
call fcn.1002711f
mov esp, ebp
pop ebp
ret
Function at 0x10012900
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100291b6
mov eax, dword fs:[0]
push eax
sub esp, 0x3e4
mov eax, dword [0x1003d01c]
xor eax, esp
mov dword [esp + 0x3dc], eax
push esi
push edi
mov eax, dword [0x1003d01c]
xor eax, esp
push eax
lea eax, [esp + 0x3f0]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
mov edx, dword [esi + 4]
mov ecx, dword [esi]
call fcn.10012800
cmp dword [esi + 8], eax
jne 0x1001295b
cmp dword [esi + 0xc], edx
je 0x10012afc
jmp 0x1001296d
add esi, 0x10
cmp word [esi], 0
je 0x100129cd
push esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
sub esp, 0x18
mov ecx, esp
push 0x10031440
call fcn.10003820
lea ecx, [esp + 0x64]
call fcn.10019e50
add esp, 0x18
cmp dword [eax + 0x14], 0x10
jb 0x100129a1
mov eax, dword [eax]
push eax
lea eax, [esp + 0x68]
push eax
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 0x10
cmp dword [esp + 0x58], 0x10
jb 0x10012a90
push dword [esp + 0x44]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
jmp 0x10012a90
sub esp, 0x18
mov ecx, esp
push str.13c87HYg7Dka7X0i7nw
call fcn.10003820
lea ecx, [esp + 0x2c]
call fcn.10019e50
add esp, 0x18
mov dword [esp + 0x3f8], 0
cmp dword [eax + 0x14], 0x10
jb 0x100129fb
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
sub esp, 0x18
mov ecx, esp
push str.p30r_igr_jwk
call fcn.10003820
lea ecx, [esp + 0x4c]
call fcn.10019e50
add esp, 0x18
cmp dword [eax + 0x14], 0x10
jb 0x10012a26
mov eax, dword [eax]
push eax
lea eax, [esp + 0x68]
push eax
call dword [sym.imp.MSVCR120.dll_sprintf]
mov esi, dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 0x10
cmp dword [esp + 0x40], 0x10
jb 0x10012a4b
push dword [esp + 0x2c]
call esi
add esp, 4
mov dword [esp + 0x3f8], 0xffffffff
cmp dword [esp + 0x28], 0x10
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], 0
mov byte [esp + 0x2c], 0
jb 0x10012a7b
push dword [esp + 0x14]
call esi
add esp, 4
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], 0
mov byte [esp + 0x14], 0
push edi
mov dword [esp + 0x14], edi
call dword [sym.imp.MSVCP120.dll__Mtx_lock]
mov esi, dword [sym.imp.MSVCP120.dll_void___cdecl_std::_Throw_C_error_int_]
add esp, 4
test eax, eax
je 0x10012aae
push eax
call esi
add esp, 4
lea eax, [esp + 0x5c]
mov dword [esp + 0x3f8], 1
push eax
mov edx, 0x1c
call fcn.10007c80
add esp, 4
jmp 0x10012add
push edi
mov dword [esp + 0x3fc], 0xffffffff
call dword [sym.imp.MSVCP120.dll__Mtx_unlock]
add esp, 4
test eax, eax
je 0x10012afc
push eax
call esi
add esp, 4
mov ecx, dword [esp + 0x3f0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x3dc]
xor ecx, esp
call fcn.1002711f
mov esp, ebp
pop ebp
ret
Function at 0x10016710
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x1003d01c]
xor eax, ebp
mov dword [ebp - 4], eax
jmp 0x10016745
movdqu xmm0, xmmword [0x1003198c]
mov eax, dword [0x100319a4]
lea edx, [ebp - 0x50]
mov dword [ebp - 0x38], eax
mov ecx, str.Conquer.exe
movzx eax, byte [0x100319a8]
movdqu xmmword [ebp - 0x50], xmm0
mov byte [ebp - 0x34], al
movq xmm0, qword [0x1003199c]
mov eax, dword [0x100319d0]
movq qword [ebp - 0x40], xmm0
movdqu xmm0, xmmword [str.x____x____xxxxxxxxxxxxxx____]
mov dword [ebp - 0x18], eax
movzx eax, byte [0x100319d4]
mov byte [ebp - 0x14], al
lea eax, [ebp - 0x30]
movdqu xmmword [ebp - 0x30], xmm0
push eax
movq xmm0, qword [0x100319c8]
movq qword [ebp - 0x20], xmm0
call fcn.1000f670
add esp, 4
mov dword [0x1004364c], eax
mov dword [0x10043648], eax
call fcn.10025b30
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.10026000
push 0x100160d0
push 0x1004364c
call fcn.100255c0
call fcn.10025b90
test eax, eax
je 0x100167ec
push 0
call dword [sym.imp.MSVCR120.dll_exit]
jmp 0x100167fe
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002711f
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x10017690
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100299a8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x1003d01c]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov eax, dword [0x1003d01c]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x40], 0
je 0x100177ea
cmp byte [edi + 0x45], 0
je 0x100177ea
mov eax, dword [edi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x100176f0
xor al, al
jmp 0x100177ec
mov ecx, 0xf
mov byte [esp + 0x18], 0
xorps xmm0, xmm0
mov dword [esp + 0x2c], ecx
cmp ecx, 0x10
movq qword [esp + 0x18], xmm0
lea eax, [esp + 0x18]
mov dword [esp + 0x28], 8
cmovae eax, dword [esp + 0x18]
mov byte [eax + 8], 0
mov dword [esp + 0x40], 0
lea esi, [edi + 0x48]
lea ebx, [ebx]
mov ebx, dword [esp + 0x2c]
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0x1c]
cmp ebx, 0x10
lea ecx, [esp + 0x1c]
cmovae ecx, dword [esp + 0x1c]
cmovae edx, dword [esp + 0x1c]
add eax, edx
push eax
push ecx
mov ecx, dword [edi + 0x40]
push esi
call dword [sym.imp.MSVCP120.dll_public:_int___thiscall_std::codecvt_char__char__int_::unshift_int___char___char___char___const]
sub eax, 0
je 0x10017771
dec eax
je 0x10017775
sub eax, 2
je 0x100177d0
xor bl, bl
jmp 0x100177d2
mov byte [edi + 0x45], 0
mov ebx, dword [esp + 0x2c]
lea eax, [esp + 0x18]
mov ecx, dword [esp + 0x18]
cmp ebx, 0x10
mov esi, dword [esp + 0x14]
cmovae eax, ecx
sub esi, eax
je 0x100177ad
push dword [edi + 0x50]
cmp ebx, 0x10
lea eax, [esp + 0x1c]
push esi
cmovae eax, ecx
push 1
push eax
call dword [sym.imp.MSVCR120.dll_fwrite]
add esp, 0x10
cmp esi, eax
jne 0x1001776d
cmp byte [edi + 0x45], 0
je 0x100177d0
test esi, esi
lea esi, [edi + 0x48]
jne 0x10017730
push 0
push 8
lea ecx, [esp + 0x20]
call fcn.100081e0
jmp 0x10017727
mov bl, 1
cmp dword [esp + 0x2c], 0x10
jb 0x100177e6
push dword [esp + 0x18]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov al, bl
jmp 0x100177ec
mov al, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.1002711f
mov esp, ebp
pop ebp
ret
Function at 0x10018e60
Capabilities:
Move file
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x10032344
push 0
push str.HideEffect
push 0x100322d8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10018ea1
cmp dword [ebp - 4], 0
jle 0x10018e9f
push 0x100322cc
push str.c3effect
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov dword [ebp - 8], eax
jmp 0x10018eb1
push 0x100322ec
push str.c3_backup
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push str..config.ini
push 0
push 0x100323f0
push str.config
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0xc], eax
push 0x1003236c
push 0
push str.HpBar
push 0x100323a4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [0x100435f4], eax
push 0x10032388
push 0
push str.ShiftJump
push str.Character
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [0x10075bc4], eax
mov esp, ebp
pop ebp
ret

Function at 0x10019180
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, edx
mov dword [ebp - 8], ecx
push esi
mov esi, dword [ebp + 0xc]
and ebx, 0x1f
push edi
mov edi, dword [ebp + 8]
cmp ebx, 8
jb 0x10019229
mov eax, ebx
shr eax, 3
mov dword [ebp - 0xc], eax
jmp 0x100191b0
movq xmm0, qword [ecx]
push 0xc2b2ae3d
push 0x27d4eb4f
movq qword [ebp - 0x14], xmm0
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.10027d10
add dword [ebp - 8], 8
mov ecx, eax
push 0x9e3779b1
shld ecx, edx, 0x1f
shld edx, eax, 0x1f
push 0x85ebca87
push edx
push ecx
call fcn.10027d10
mov ecx, eax
xor edx, esi
xor ecx, edi
mov eax, ecx
push 0x9e3779b1
shld eax, edx, 0x1b
shld edx, ecx, 0x1b
push 0x85ebca87
push edx
push eax
call fcn.10027d10
mov ecx, dword [ebp - 8]
mov edi, eax
add edi, 0xc2b2ae63
mov esi, edx
adc esi, 0x85ebca77
sub ebx, 8
dec dword [ebp - 0xc]
jne 0x100191b0
cmp ebx, 4
jb 0x1001927c
mov eax, dword [ecx]
add ecx, 4
push 0x9e3779b1
push 0x85ebca87
push 0
push eax
mov dword [ebp - 8], ecx
call fcn.10027d10
mov ecx, eax
xor edx, esi
xor ecx, edi
mov eax, ecx
push 0xc2b2ae3d
shld eax, edx, 0x17
shld edx, ecx, 0x17
push 0x27d4eb4f
push edx
push eax
call fcn.10027d10
mov edi, eax
mov esi, edx
add edi, 0x9e3779f9
adc esi, 0x165667b1
sub ebx, 4
test ebx, ebx
je 0x100192c1
mov eax, dword [ebp - 8]
push 0x27d4eb2f
push 0x165667c5
movzx eax, byte [eax]
cdq
push edx
push eax
call fcn.10027d10
inc dword [ebp - 8]
xor edi, eax
xor esi, edx
mov eax, edi
push 0x9e3779b1
shld eax, esi, 0xb
push 0x85ebca87
shld esi, edi, 0xb
push esi
push eax
call fcn.10027d10
mov edi, eax
mov esi, edx
dec ebx
jne 0x10019280
push 0xc2b2ae3d
xor ecx, ecx
mov edx, esi
push 0x27d4eb4f
shr edx, 1
xor ecx, esi
xor edx, edi
push ecx
push edx
call fcn.10027d10
mov esi, eax
mov ecx, edx
shrd esi, ecx, 0x1d
push 0x165667b1
shr ecx, 0x1d
xor esi, eax
push 0x9e3779f9
xor ecx, edx
push ecx
push esi
call fcn.10027d10
mov ecx, edx
xor esi, esi
pop edi
xor eax, ecx
xor edx, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001d230
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1003d01c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.MSVCR120.dll_malloc]
push edi
push 0x12
mov dword [ebp - 8], 0x288
call esi
push 0x288
mov ebx, eax
call esi
mov edi, eax
add esp, 8
test edi, edi
jne 0x1001d28e
push 0x10032ab4
call dword [sym.imp.MSVCR120.dll_printf]
push ebx
call dword [sym.imp.MSVCR120.dll_free]
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002711f
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
push eax
push edi
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x1001d2dc
push edi
call dword [sym.imp.MSVCR120.dll_free]
push dword [ebp - 8]
call esi
mov edi, eax
add esp, 8
test edi, edi
jne 0x1001d2dc
push str.Error_allocating_memory_needed_to_call_GetAdaptersinfo_n
call dword [sym.imp.MSVCR120.dll_printf]
mov eax, dword [sym.imp.MSVCR120.dll_free]
push ebx
call eax
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002711f
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
push eax
push edi
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x1001d353
mov esi, edi
lea ecx, [ecx]
movzx eax, byte [esi + 0x199]
push eax
movzx eax, byte [esi + 0x198]
push eax
movzx eax, byte [esi + 0x197]
push eax
movzx eax, byte [esi + 0x196]
push eax
movzx eax, byte [esi + 0x195]
push eax
movzx eax, byte [esi + 0x194]
push eax
push str._02X_02X_02X_02X_02X_02X
push ebx
call dword [sym.imp.MSVCR120.dll_sprintf]
push ebx
lea eax, [esi + 0x1b0]
push eax
push str.Address:__s__mac:__s_n
call dword [sym.imp.MSVCR120.dll_printf]
push 0x10032a6c
call dword [sym.imp.MSVCR120.dll_printf]
mov esi, dword [esi]
add esp, 0x30
test esi, esi
jne 0x1001d2f0
mov eax, dword [sym.imp.MSVCR120.dll_free]
push edi
call eax
mov ecx, dword [ebp - 4]
add esp, 4
mov eax, ebx
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.1002711f
mov esp, ebp
pop ebp
ret
Function at 0x1001e150
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10029e98
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x1003d01c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x10043a94]
test eax, eax
jne 0x1001e291
push eax
xorps xmm0, xmm0
push 4
movq qword [ebp - 0x18], xmm0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
push dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
mov dword [ebp - 0x14], 0
call fcn.1001e360
mov dword [ebp - 4], 0
mov ebx, dword [ebp - 0x18]
cmp ebx, 0xffffffff
jne 0x1001e1ee
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 0x1002b939
push eax
lea ecx, [ebp - 0x44]
call dword [sym.imp.MSVCR120.dll_public:_void___thiscall_std::exception::constructor_char_const__const_const__]
push 0x100390f4
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], vtable.std::runtime_error.0
push eax
call sub.MSVCR120.dll__CxxThrowException
mov dword [ebp - 0x34], 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x34]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Thread32First]
mov edi, dword [0x10043a94]
test edi, edi
jne 0x1001e25c
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esp, [esp]
test eax, eax
je 0x1001e25c
call esi
cmp eax, 0x12
je 0x1001e256
mov ecx, dword [ebp - 0x38]
mov eax, dword [0x10043a94]
cmp dword [ebp - 0x28], ecx
cmove eax, dword [ebp - 0x2c]
mov dword [0x10043a94], eax
lea eax, [ebp - 0x34]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Thread32Next]
mov edi, dword [0x10043a94]
test edi, edi
je 0x1001e220
jmp 0x1001e25c
mov edi, dword [0x10043a94]
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x1001e28f
or ebx, 0xffffffff
lea ecx, [esi + 4]
mov eax, ebx
lock xadd dword [ecx], eax
jne 0x1001e28f
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
lock xadd dword [eax], ebx
dec ebx
jne 0x1001e28f
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002711f
mov esp, ebp
pop ebp
ret
Function at 0x1001e540
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1003d01c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
xor ecx, ecx
push esi
push edi
mov dword [ebp - 0x10], eax
mov edi, 0x400
mov eax, edi
mov dword [ebp - 8], edi
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call dword [sym.imp.MSVCR120.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x1001e600
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftUsers_
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1001e600
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 8]
push eax
push esi
push 0
push 0
push str.ShellIntegration
push dword [ebp - 0xc]
call ebx
cmp eax, 0xea
jne 0x1001e5f2
add edi, 0x400
push edi
push esi
call dword [sym.imp.MSVCR120.dll_realloc]
add esp, 8
mov dword [ebp - 8], edi
mov esi, eax
lea eax, [ebp - 8]
push eax
push esi
push 0
push 0
push str.ShellIntegration
push dword [ebp - 0xc]
call ebx
cmp eax, 0xea
je 0x1001e5c2
pop ebx
push dword [ebp - 0xc]
test eax, eax
je 0x1001e612
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002711f
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov dword [eax], esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop esi
call fcn.1002711f
mov esp, ebp
pop ebp
ret