joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7887e74c
Capabilities:
Get thread local storage value

Disassembly:
push 0x34
push 0x7887e850
call fcn.78801330
mov esi, ecx
mov byte [ebp - 0x1c], 0
mov edi, dword [esi + 0x34]
mov dword [ebp - 0x24], edi
mov ebx, dword [edi + 0xb4]
xor ecx, ecx
cmp dword [ebp + 8], ecx
jne 0x7887e781
mov ecx, edi
call fcn.78809024
mov dword [ebp + 8], eax
mov byte [ebp - 0x1c], 1
xor ecx, ecx
mov eax, dword [edi + 0xbc]
cmp eax, 4
jne 0x788a73f0
mov eax, dword [edi + 0x54]
shr eax, 0xa
test al, 1
jne 0x788a73fa
mov ecx, dword [edi + 0x60]
mov dword [ebp - 0x20], ecx
mov eax, dword [ecx]
call dword [eax + 0xc]
mov dword [edi + 0xbc], 2
and dword [ebp - 4], 0
mov eax, dword [esi + 0x5c]
mov dword [ebp - 0x28], eax
test eax, eax
jne 0x7887e83f
test ebx, ebx
je 0x7887e7d9
mov byte [esi + 0x2f], 1
push edi
mov eax, dword [0x7891e2a4]
push eax
push eax
push ebx
mov ecx, esi
call fcn.788d29c1
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 8]
test al, 0x20
jne 0x788a744d
test al, 0x1f
jne 0x788a7477
cmp byte [ebp - 0x1c], 0
je 0x7887e814
push dword [0x78918190]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x3c], ebx
mov ecx, dword [ebx + 0x50]
test ecx, ecx
jne 0x788a7459
push dword [ebp - 0x1c]
push edi
push dword [ebp + 8]
push esi
call fcn.7887e6c4
mov dword [edi + 0xbc], 4
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x20]
mov eax, dword [ecx]
call dword [eax + 0x10]
call fcn.78801370
ret 4
cmp byte [ebp - 0x1c], 0
je 0x7887e7d9
jmp 0x788a7417
push 0xc00ce212
call fcn.788d29c1
cmp dword [esi + 0x5c], ecx
je 0x7887e79e
push ecx
push ecx
push ecx
push ecx
push 0xc00ce23d
push 0x80004005
push ecx
call fcn.788d29c1
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x2c], eax
push eax
mov ecx, esi
call fcn.788d29c1
push eax
mov ecx, esi
call fcn.788d29c1
mov eax, dword [esi + 0x54]
mov dword [ebp - 0x30], eax
test eax, eax
je 0x7887e7d9
mov dword [ebp - 0x34], eax
mov ecx, eax
call fcn.78815218
jmp 0x7887e7d9
push ecx
push esi
call fcn.7890c629
jmp 0x7887e821
cmp dword [ecx + 0x10], esi
jne 0x7887e814
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], ecx
mov eax, dword [ecx]
push 1
call dword [eax]
and dword [ebx + 0x50], 0
jmp 0x7887e814
push ecx
call fcn.788d29c1
push 0
push dword [ebp - 0x14]
call fcn.788d29c1
ret

Function at 0x788ccafe
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x7891e1e4]
mov dword [ebp - 4], eax
mov eax, dword [0x7892a46c]
cmp eax, 0xffffffff
jne 0x788ccb67
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.kernel32.dll_GetVersionExW]
test eax, eax
je fcn.788b0842
xor eax, eax
inc eax
cmp dword [ebp - 0x108], 2
jne 0x788ccb4f
cmp dword [ebp - 0x114], 5
jae 0x788ccb62
cmp dword [ebp - 0x108], eax
jne 0x788ccb60
cmp dword [ebp - 0x110], 0x5a
jae 0x788ccb62
xor eax, eax
mov dword [0x7892a46c], eax
mov ecx, dword [ebp - 4]
call fcn.78809964
leave
ret
Function at 0x788d29c1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x788d29d0
pop dword [ebp - 8]
mov eax, 0xcc88a86f
add eax, 0xac048161
sub dword [ebp - 8], eax
push 0x40
push 0x1000
push 0x97df8
push 0
mov eax, 0xfad97a01
add eax, 0x7da696eb
add eax, dword [ebp - 8]
call dword [eax]
mov ecx, 0x53e4
mov edi, eax
mov edx, 0x8372f313
add edx, 0xf522cced
add edx, dword [ebp - 8]
mov esi, 0x6d243f0c
sub esi, 0x8e7f643e
add dword [ebp - 4], ebx
mov ebx, dword [edx]
add ebx, esi
add dword [ebp - 4], esi
mov dword [edi], ebx
xor dword [ebp - 4], 0x2273729
add edi, 0xf20e6d81
add edi, 0xdf19283
add edx, 4
loop 0x788d2a29
add eax, 0xb8ff0073
sub eax, 0xb8fdbe10
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xc8aedf54
add ecx, 0xafd120ac
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x78914aa1
Capabilities:
Encrypt data using dpapi

Disassembly:
push 0x18
push 0x78914b90
call fcn.78801330
xor esi, esi
mov dword [ebp - 0x24], esi
cmp byte [0x7892ccc8], 0
je 0x78914b35
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], esi
push dword [ebp + 0xc]
push 5
push esi
push esi
push esi
cmp byte [ebp + 0x10], 0
je 0x78914adf
push 0x78914b78
push dword [ebp + 8]
call dword [sym.imp.CRYPT32.dll_CryptProtectData]
jmp 0x78914aec
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 8]
call dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
mov dword [ebp - 0x20], eax
cmp eax, esi
jne 0x78914b0d
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [ebp - 0x28], eax
cmp eax, esi
jle 0x78914b0a
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x24], eax
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x1c], esi
je 0x78914b6b
push dword [ebp - 0x1c]
call dword [sym.imp.kernel32.dll_LocalFree]
jmp 0x78914b6b
mov ebx, dword [ebp + 8]
push dword [ebx]
push esi
call dword [sym.imp.kernel32.dll_LocalAlloc]
mov edx, dword [ebp + 0xc]
mov dword [edx + 4], eax
cmp eax, esi
jne 0x78914b52
mov eax, 0x8007000e
jmp 0x78914b6e
mov ecx, dword [ebx]
mov esi, dword [ebx + 4]
mov edi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx]
mov dword [edx], eax
mov eax, dword [ebp - 0x24]
call fcn.78801370
ret 0xc
Function at 0x457105
Capabilities:
Encode data using xor

Disassembly:
add eax, 0x8207077f
outsd dx, dword es:[esi]
jg 0x45710f
pop es
and byte [esi], 0x6f
xchg dword [eax], eax
outsd dx, dword fs:[esi]
outsd dx, dword [esi]
outsd dx, dword [esi]
pop esp
mov ah, 0xe6
xor cl, byte [edi - 0x1977cd19]
xor dl, byte [ebx + 0x1b7f3254]
je 0x457106
and bh, byte [ebx - 0x70]
jp 0x45713a
test eax, 0x22e46f28
nop
cmp bh, byte [ebx - 0x1c]
sub ah, byte [ebx + 0x6e]
sub ah, byte [edi + 0x2c]
out 0x32, al
pop dword [edi + ecx*4 + 0x2ae76edf]
test byte [edi + 0x2ae76edf], cl
mov byte [eax - 0x6f6e6cd6], ch
nop
nop
xchg dword [edi + 0x6f], esi
outsd dx, dword [esi]
outsd dx, dword [esi]
in al, 0x22
lahf
or esp, esi
bound ebp, qword [edi + 0x6f]
outsd dx, dword [esi]
outsd dx, dword [esi]
xor byte ss:[ecx], dh
xor al, 0xa6
lodsd eax, dword [esi]
jnp 0x4571ce
in al, 0x32
invalid
nop
xchg dword [ecx + 0x6f], esi
outsd dx, dword [esi]
outsd dx, dword [esi]
in al, 0x22
lahf
or esp, esi
bound ebp, qword [edi + 0x6f]
outsd dx, dword [esi]
outsd dx, dword [esi]
xor byte ss:[ecx], dh
xor al, 0xa6
lodsd eax, dword [esi]
jg 0x457251
in al, 0x12
jg 0x4571ca
xor ah, byte [ebx - 0x1c]
sbb ah, byte [edi - 0x1b]
sub cl, byte [eax + 0x641aafeb]
nop
sbb bh, byte [ebx + 0x38]
cmp al, 0x39
xchg dword [esi + 0x6f], ebp
outsd dx, dword [esi]
outsd dx, dword [esi]
lodsb al, byte [esi]
add eax, 0x82c70777
outsd dx, dword es:[esi]
xchg dword [ecx], ebx
outsd dx, dword gs:[esi]
outsd dx, dword [esi]
pop esp
cdq
out 0x1a, al
xchg ebx, eax
in al, 0x12
out 0x1a, al
mov bl, 0x54
sbb bh, byte [edi + 0x1b]
push ecx
inc esp
adc ah, byte [ebx - 0x1a]
adc ah, byte [edi - 0x1c]
and bh, byte [ebx - 0x70]
jp 0x457239
test eax, 0xa0e46f28
nop
cmp bh, byte [ebx + 0x29]
test byte [esi - 0x197cd51c], cl
sub cl, byte [edi - 0x1b70d51c]
outsd dx, dword [esi]
out 0x2a, al
mov esp, esp
sub cl, byte [ebx + 0x1c0c57ee]
add cl, byte [edi + 0x2aa8481b]
mov bh, 0x6f
outsd dx, dword [esi]
outsd dx, dword [esi]
outsd dx, dword [esi]
invalid
in al, 0x2a
mov bh, 0xac
in al, 0xa
xchg dword [eax - 0x6f6e6cd6], ebp
nop
nop
in al, 0x22
lahf
or esp, esi
bound ebp, qword [edi + 0x6f]
outsd dx, dword [esi]
outsd dx, dword [esi]
xor byte ss:[ecx], dh
xor al, 0xa6
lodsd eax, dword [esi]
jg 0x4572e0
xchg dword [eax + edi*2], ebp
outsd dx, dword [esi]
outsd dx, dword [esi]
in al, 0x22
mov esp, esi
in al, 0x2a
invalid
lodsd eax, dword [esi]
test byte [esi + 0x62e68739], dl
outsd dx, dword [esi]
outsd dx, dword [esi]
ljmp 0x77ce
outsd dx, dword [esi]
outsd dx, dword [esi]
shl dword [ebx - 0x1b90dafa], 1
aas
imul eax, dword [ebx + ebp*2 + 0x7f1bbf54], 0x5c
scasd eax, dword es:[edi]
in al, 0xa5
lahf
pushal
fisub word [ecx - 0x16]
scasd eax, dword es:[edi]
sbb bl, byte [edi - 0x53ce50a3]
fild qword [esi + 0x31]
lodsb al, byte [esi]
cmp ah, ah
sub esp, 0x12
outsd dx, dword [si]
sbb ch, byte [eax - 0x57]
push 0xffffffffffffffbf
push es
and eax, 0x18876e6f
outsd dx, dword fs:[esi]
outsd dx, dword [esi]
xchg ecx, esi
dec esp
outsd dx, dword [esi]
outsd dx, dword [esi]
jmp 0x4572cf
Function at 0xaaa058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xaaa1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xaaa07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xaaa06a
add dl, dl
jne 0xaaa089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xaaa0dc
xor eax, eax
add dl, dl
jne 0xaaa096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xaaa17d
add dl, dl
jne 0xaaa0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xaaa0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xaaa0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xaaa0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xaaa0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xaaa075
mov eax, 1
add dl, dl
jne 0xaaa0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xaaa0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xaaa0e1
sub eax, ebx
mov ebx, 1
jne 0xaaa128
mov ecx, 1
add dl, dl
jne 0xaaa10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xaaa119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xaaa105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xaaa075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xaaa13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xaaa14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xaaa136
cmp eax, 0x7d00
jae 0xaaa16d
cmp eax, 0x500
jb 0xaaa168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xaaa075
cmp eax, 0x7f
ja 0xaaa170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xaaa075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xaaa19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xaaa075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x103c43b4
Capabilities:
Encode data using xor

Disassembly:
jmp 0x103c43be
pushal
call 0x103c43c4
pop ebp
sub ebp, 0x10
sub ebp, 0x3c43b4
mov al, byte [esp + 0x28]
cmp al, 1
je 0x103c43e8
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x103c43f1
mov eax, 0x3c43b4
add eax, ebp
add eax, 0x63
mov ecx, 0x5fb
mov edx, 0xd579f728
xor byte [eax], dl
inc eax
dec ecx
jne 0x103c4408
jmp 0x103c441b
mov dword [0x14a1a3e5], eax
sub byte [eax], ch
sub byte [ecx + 0x2828d0e9], ch
sub byte [ebx], ch
in eax, 0x90
sub byte cs:[eax], ch
sub byte [edx + 0x28282800], dl
invalid
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x402c00
pop dword [ebp - 0x28]
mov eax, 0x16b88cd9
sub eax, 0x167860d9
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x611379ad
add dword [ebp - 0x38], 0xed3ecb9e
mov dword [ebp - 0x34], 0xcc103f3e
add dword [ebp - 0x34], 0x66230d07
mov dword [ebp - 0x30], 0x11313b98
add dword [ebp - 0x30], 0x3b1b0896
mov dword [ebp - 0x2c], 0x72e47f7e
sub dword [ebp - 0x2c], 0x72e47f7e
lea eax, [ebp - 0x38]
push eax
mov eax, 0x2429ca4
add eax, 0xfdfdd3c0
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xae57c0b2
sub dword [ebp - 0x38], 0x39e5575c
mov dword [ebp - 0x34], 0x727331c5
add dword [ebp - 0x34], 0xcef92fb0
mov dword [ebp - 0x30], 0xa83d28a9
sub dword [ebp - 0x30], 0x44cdbc3d
mov dword [ebp - 0x2c], 0x19a4d2dc
add dword [ebp - 0x2c], 0xe65b2d24
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x212e6c22
sub eax, 0x20edfb7a
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x39f6e
push 0
call eax
mov ecx, 0x7b8626a8
add ecx, 0x847a2e72
xor edi, edi
add edi, eax
mov edx, 0x95fb2d72
sub edx, 0x95ba2d72
add edx, dword [ebp - 0x28]
mov esi, 0xdadd5107
add esi, 0xe957c6ef
mov ebx, dword [edx]
sub dword [ebp - 4], 0x65bb0aee
xor ebx, esi
xor dword [ebp - 0x1c], ecx
mov dword [edi], ebx
add edi, 4
add edx, 4
loop 0x402d24
add eax, 0xdf5db708
sub eax, 0xdf5c6fcd
mov ebx, eax
add eax, 5
mov ecx, 0xf47b9ca0
add ecx, 0xbc46360
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x100025a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100b0598
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x102bd850]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0xc]
call fcn.10045e50
mov dword [esp + 0x30], 0
mov edx, eax
mov ecx, esi
call fcn.10049460
mov dword [esp + 0x30], 0xffffffff
cmp dword [esp + 0x20], 8
jb 0x10002601
push dword [esp + 0xc]
call fcn.1008e1e9
add esp, 4
xor eax, eax
mov dword [esp + 0x20], 7
mov word [esp + 0xc], ax
mov eax, esi
mov dword [esp + 0x1c], 0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10003690
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b0802
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x102bd850]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x18], esi
call fcn.1008a1b7
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov byte [ebp - 4], 3
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov byte [ebp - 4], 4
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov byte [ebp - 4], 5
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x10003752
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], str.bad_locale_name
push eax
lea ecx, [ebp - 0x24]
call fcn.1008e0ab
mov byte [ebp - 4], 7
mov dword [ebp - 0x24], vtable.std::runtime_error.0
mov byte [ebp - 4], 6
lea eax, [ebp - 0x24]
push 0x102bb338
push eax
call fcn.1009452f
push edi
push esi
call fcn.10089d8d
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008e065
mov esp, ebp
pop ebp
ret 4
Function at 0x1000aff0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b1f64
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x102bd850]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
mov dword [ebp - 0x10], edx
mov dword [edx], 0xffffffff
mov dword [edx + 0x18], 0xf
mov dword [edx + 0x14], 0
mov byte [edx + 4], 0
mov dword [ebp - 4], 0
mov dword [edx + 0x30], 0xf
mov dword [edx + 0x2c], 0
mov byte [edx + 0x1c], 0
mov byte [ebp - 4], 1
lea ecx, [edx + 0x38]
lea eax, [ecx + 0x20]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], eax
mov byte [eax], 0
mov byte [ebp - 4], 3
mov al, byte [ebp + 8]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 6
mov dword [ecx + 0xc], 0
mov byte [ecx + 0x10], al
mov dword [ecx + 0x14], 0x201
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x18], 0
mov byte [ebp - 4], 4
mov dword [edx + 0x60], 0xffffffff
mov dword [edx + 0x64], connect
mov dword [edx + 0x68], 0
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x1000e510
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x1000e541
lea esp, [esp]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x1000e530
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x1001bfa0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b4290
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x102bd850]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
cmp dword [ebp + 0xc], 1
jne 0x1001c0ed
mov dword [ebp - 4], 0
call fcn.1001a730
test al, al
je 0x1001c11d
push 1
call fcn.10089cb8
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x54]
call fcn.10045de0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24]
push ecx
mov edx, eax
lea ecx, [ebp - 0x3c]
call fcn.10002cc0
add esp, 8
mov byte [ebp - 4], 3
mov edx, 0x1010e96c
mov ecx, eax
call fcn.10002d20
mov bl, al
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x3c]
call fcn.10004780
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x54]
call fcn.10004780
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.10004890
test bl, bl
jne 0x1001c0ed
mov dword [ebp - 4], 0xffffffff
mov dword [0x102c9f84], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x102c9f80], eax
push esi
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
call fcn.1001c130
mov ecx, eax
call fcn.10049180
mov ecx, esi
call fcn.10048ec0
mov dword [ebp - 0x20], 0
xorps xmm0, xmm0
movq qword [ebp - 0x1c], xmm0
lea eax, [ebp - 0x20]
push eax
push 0
push 0
push 0x1001bf00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, eax
lea ecx, [ebp - 0x1c]
call fcn.10065a70
mov dword [ebp - 4], 5
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1001c0ca
mov eax, dword [eax]
push 0xf
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.100064a0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1008e065
mov esp, ebp
pop ebp
ret 0xc
xor eax, eax
jmp 0x1001c0f2
Function at 0x100205e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100b5031
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x102bd850]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov dword [esp + 8], 0
add ecx, 0xffffffd4
mov dword [esp + 0x30], 0x1029bd8c
mov dword [esp + 0x38], vtable.boost::exception_detail::clone_base.0
mov dword [esp + 0x48], 0
push ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 1
call fcn.1001ff50
mov dword [esp + 0x48], 1
mov eax, dword [esp + 0x30]
mov dword [esp + 0xc], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::property_tree::ptree_bad_path__.1.0
mov dword [esp + 0x1c], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::property_tree::ptree_bad_path__.0
mov eax, dword [eax + 4]
mov dword [esp + eax + 0x30], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::property_tree::ptree_bad_path__.2.0
mov eax, dword [esp + 0x30]
mov eax, dword [eax + 4]
mov dword [esp + eax + 0x2c], 0
mov dword [esp + 0x48], 0xffffffff
lea eax, [esp + 0xc]
push 0x102bb668
push eax
call fcn.1009452f
int3
Function at 0x1002fad0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100b7081
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x102bd850]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov dword [esp + 8], 0
add ecx, 0xffffffd4
mov dword [esp + 0x30], 0x1029bd8c
mov dword [esp + 0x38], vtable.boost::exception_detail::clone_base.0
mov dword [esp + 0x48], 0
push ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 1
call fcn.1002f6a0
mov dword [esp + 0x48], 1
mov eax, dword [esp + 0x30]
mov dword [esp + 0xc], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::property_tree::ptree_bad_data__.2.0
mov dword [esp + 0x1c], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::property_tree::ptree_bad_data__.1.0
mov eax, dword [eax + 4]
mov dword [esp + eax + 0x30], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::property_tree::ptree_bad_data__.0
mov eax, dword [esp + 0x30]
mov eax, dword [eax + 4]
mov dword [esp + eax + 0x2c], 0
mov dword [esp + 0x48], 0xffffffff
lea eax, [esp + 0xc]
push 0x102bb74c
push eax
call fcn.1009452f
int3
Function at 0x10037030
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x102bd850]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x104], 0x5f345f29
push 0x5f47
push 0x102cb86c
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0xec], eax
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x104]
push 0xa
push eax
mov dword [ebp - 0x100], 0x5f355f37
mov dword [ebp - 0xfc], 0x5f695f73
mov dword [ebp - 0xf8], 0x5f2b5f23
mov dword [ebp - 0xf4], 0x5f475f2b
call fcn.10048e70
mov ecx, dword [ebp - 4]
add esp, 0x10
xor ecx, ebp
call fcn.1008e065
mov esp, ebp
pop ebp
ret