joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1007e4fa
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov esi, dword [ebp + 0xc]
lea ecx, [esp + 0x48]
lea eax, [esp + 0x148]
xor ebx, ebx
xorps xmm0, xmm0
lea edi, [esp + 8]
mov dword [ecx - 0xc], ecx
mov dword [ecx - 8], ecx
mov dword [ecx - 4], eax
lea eax, [esp + 0x10]
mov dword [eax + 0x24], ebx
mov dword [eax + 0x20], ebx
movaps xmmword [eax + 0x10], xmm0
movaps xmmword [eax], xmm0
mov dword [eax + 0x28], 0xffff
push eax
push esi
push edi
call fcn.1007dcdc
add esp, 0xc
cmp dword [edi], ebx
je 0x1007e592
mov ebx, dword [ebp + 8]
push 0x1020cc5c
push 0x10062a96
push 0x1020cc58
call fcn.10183b1b
add esp, 0xc
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 4]
cmp eax, dword [0x1020cc60]
jne 0x1007e586
cmp dword [esp + 8], 2
jne 0x1007e586
cmp byte [ebp + 0x10], 0
jne 0x1007e5e1
movsd xmm0, qword [esp + 8]
movsd qword [ebx], xmm0
jmp 0x1007e602
lea eax, [esp + 0x3c]
push eax
push esi
mov ebx, dword [ebp + 8]
push ebx
call fcn.1007e0c1
add esp, 0xc
cmp dword [ebx], 0
jne 0x1007e602
mov esi, dword [esp + 0x34]
mov word [esp + 8], 0
lea ecx, [esp + 0x3c]
push edi
call fcn.1007e868
lea eax, [esp + 0x3c]
add dword [eax + 4], 0xfffffffe
cmp esi, 3
mov eax, dword [eax]
jne 0x1007e5d6
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x1007e5dd
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x1007e621
mov esi, 0x1020cc50
mov dword [ebx], 0
push esi
push 0x10062908
push 0x1020cc4c
call fcn.10183b1b
add esp, 0xc
mov dword [ebx + 4], esi
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 0x48]
cmp eax, ecx
je 0x1007e617
push eax
call fcn.101aff0e
add esp, 4
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
call fcn.1007c160
add esp, 8
push 0x1020cc5c
push 0x10062a96
push 0x1020cc58
call fcn.10183b1b
add esp, 0xc
mov eax, dword [ebx + 4]
mov eax, dword [eax + 4]
cmp eax, dword [0x1020cc60]
jne 0x1007e602
cmp dword [ebx], 2
jne 0x1007e602
cmp byte [ebp + 0x10], 0
jne 0x1007e5e1
jmp 0x1007e602
Function at 0x100da296
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x134
mov ebx, dword [esp + 0x14c]
mov ebp, dword [esp + 0x148]
lea esi, [esp + 0x24]
mov edi, ecx
mov ecx, esi
mov eax, dword [ebx]
mov dword [esp + 4], eax
call fcn.101219f0
movzx eax, byte [ebx + 0x18]
cmp eax, 2
jne 0x100da44b
mov esi, dword [esp + 4]
lea ecx, [edi + 0x24]
mov dword [esp + 0x1c], ecx
shl esi, 5
add esi, 0x165d0
call fcn.100b1880
lea ebx, [esp + 0x110]
push esi
push eax
push ebx
call fcn.10042ef9
add esp, 0xc
xor eax, eax
lea ebp, [esp + 0x12c]
inc eax
mov ecx, ebp
push eax
push dword [ebx]
call fcn.100bb686
mov dword [esp + 0x20], edi
mov edi, dword [ebp + 4]
mov ecx, ebp
call fcn.100b19e4
lea edx, [esp + 0xc]
lea ecx, [esp + 0x24]
mov dword [edx + 4], edi
mov dword [edx], eax
mov eax, esp
push edx
push eax
call fcn.1003df62
mov ebx, dword [esp + 0x1c]
lea edi, [esi + 8]
mov ecx, ebx
call fcn.100b1880
lea ecx, [esp + 0x10c]
push edi
push eax
push ecx
mov edi, ecx
call fcn.10042ef9
add esp, 0xc
xor eax, eax
lea ebp, [esp + 0x124]
inc eax
mov ecx, ebp
push eax
push dword [edi]
call fcn.100bb686
mov edi, dword [ebp + 4]
mov ecx, ebp
call fcn.100b19e4
lea edx, [esp + 0xc]
lea ecx, [esp + 0x28]
mov dword [edx + 4], edi
mov dword [edx], eax
push edx
lea eax, [esp + 4]
push eax
call fcn.1003df62
mov ecx, ebx
lea edi, [esi + 0x10]
call fcn.100b1880
lea ecx, [esp + 0x108]
push edi
push eax
push ecx
mov edi, ecx
call fcn.10042ef9
add esp, 0xc
xor eax, eax
lea ebp, [esp + 0x11c]
inc eax
mov ecx, ebp
push eax
push dword [edi]
call fcn.100bb686
mov edi, dword [ebp + 4]
mov ecx, ebp
call fcn.100b19e4
lea edx, [esp + 0xc]
lea ecx, [esp + 0x2c]
mov dword [edx + 4], edi
mov dword [edx], eax
push edx
lea eax, [esp + 4]
push eax
call fcn.1003df62
mov ecx, ebx
add esi, 0x18
call fcn.100b1880
lea ebp, [esp + 0x104]
push esi
push eax
push ebp
call fcn.10042ef9
add esp, 0xc
xor eax, eax
lea edi, [esp + 0x114]
inc eax
mov ecx, edi
push eax
push dword [ebp]
mov ebp, dword [esp + 0x150]
call fcn.100bb686
mov esi, dword [edi + 4]
mov ecx, edi
mov edi, dword [esp + 0x20]
call fcn.100b19e4
lea ecx, [esp + 0xc]
mov dword [ecx + 4], esi
mov dword [ecx], eax
mov eax, ecx
lea esi, [esp + 0x24]
lea ecx, [esp + 0x30]
push eax
mov ebx, dword [esp + 0x150]
lea eax, [esp + 4]
push eax
call fcn.1003df62
mov eax, dword [ebx + 0x18]
movsx eax, al
cmp eax, 3
ja case.default.0x100da453
jmp dword [eax*4 + 0x101e1f80]
cmp eax, 0x14
je 0x100da472
cmp eax, 0x17
add edi, 0x4cc
mov ecx, ebp
push edi
jmp 0x100db490
Function at 0x100e6f4c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x58
mov al, byte [esp + 0x78]
mov esi, dword [esp + 0x70]
mov ebx, dword [esp + 0x6c]
test al, al
je 0x100e7097
lea eax, [esp + 0x18]
mov dword [esp], ecx
mov ecx, eax
call fcn.10121c36
call fcn.10041e42
xor ebx, ebx
push ebx
push ebx
push eax
push dword [esi + 0x18]
call fcn.1003be3a
add esp, 0x10
lea ecx, [esp + 4]
push ebx
push ebx
push ebx
push eax
push ecx
mov edi, ecx
call fcn.10122af1
add esp, 0x14
call fcn.10041e42
push ebx
push ebx
push eax
push dword [edi]
call fcn.1003be3a
add esp, 0x10
mov ebp, eax
call fcn.10041e42
push ebx
push ebx
push eax
push dword [esi]
call fcn.1003be3a
add esp, 0x10
lea edi, [esp + 0x14]
push ebp
push eax
push edi
call fcn.10041365
add esp, 0xc
lea ecx, [esp + 0x18]
lea eax, [esp + 0x38]
push dword [edi]
push eax
call fcn.10042446
call fcn.10041e42
push ebx
push ebx
push eax
lea eax, [esp + 0x10]
push dword [eax]
call fcn.1003be3a
add esp, 0x10
mov ebp, eax
call fcn.10041e42
push ebx
push ebx
push eax
push dword [esi + 8]
call fcn.1003be3a
add esp, 0x10
lea edi, [esp + 0x10]
push ebp
push eax
push edi
call fcn.10041365
add esp, 0xc
lea ecx, [esp + 0x20]
push dword [edi]
lea eax, [esp + 0x3c]
push eax
call fcn.10042446
call fcn.10041e42
push ebx
push ebx
push eax
lea eax, [esp + 0x10]
push dword [eax]
call fcn.1003be3a
add esp, 0x10
mov ebp, eax
call fcn.10041e42
push ebx
push ebx
push eax
push dword [esi + 0x10]
call fcn.1003be3a
add esp, 0x10
lea edi, [esp + 0xc]
push ebp
push eax
push edi
call fcn.10041365
add esp, 0xc
lea ecx, [esp + 0x28]
push dword [edi]
lea edi, [esp + 0x3c]
push edi
call fcn.10042446
mov ecx, dword [esp]
push ebx
push ebx
push esi
push esi
push esi
push esi
lea eax, [esp + 0x30]
push eax
push dword [esp + 0x90]
push edi
call fcn.100ea5cc
mov ecx, dword [esp + 0x6c]
jmp 0x100e70b7
movzx eax, byte [esp + 0x7c]
lea edi, [esp + 0x18]
push 0
push eax
push esi
push esi
push esi
push esi
push esi
push dword [esp + 0x90]
push edi
call fcn.100ea5cc
mov ecx, ebx
push edi
call fcn.10121dba
add esp, 0x58
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
Function at 0x100ef780
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xbc
mov edi, ecx
call fcn.1003ddac
xor esi, esi
push esi
push eax
call fcn.1003b692
add esp, 8
mov dword [esp + 4], eax
call fcn.1003ddac
push esi
push eax
call fcn.1003b692
add esp, 8
mov dword [esp + 0x10], eax
mov eax, dword [edi + 0x468]
mov al, byte [eax + 8]
shr al, 3
and al, 7
dec al
cmp al, 6
ja case.default.0x100ef7d2
mov ebp, dword [esp + 0xd4]
movzx eax, al
jmp dword [eax*4 + 0x101e2510]
mov ecx, dword [esp + 0xd0]
mov eax, esp
push 0xf
Function at 0x1011846c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ecx + 4]
mov edx, dword [esp + 4]
mov cl, byte [eax + 4]
xor eax, eax
cmp cl, 1
jg 0x1011848e
cmp cl, 0x95
je case.0x101132f3.159
cmp cl, 0x96
je case.0x101132f3.159
cmp cl, 0x97
je case.0x101132f3.159
jmp case.0x101132f3.154
mov ch, cl
add ch, 0xfe
cmp ch, 0x33
ja case.default.0x1011849b
movzx ecx, ch
jmp dword [ecx*4 + 0x101e33e0]
add cl, 0x94
cmp cl, 0x11
ja case.0x101132f3.154
movzx ecx, cl
jmp dword [ecx*4 + 0x101e34b0]
Function at 0x10121640
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
cmp dword [ecx + 0x38], 0
mov al, 1
je 0x101216ba
cmp byte [ecx + 0x3d], 0
mov esi, ecx
je 0x101216ba
mov eax, dword [esi]
xor edi, edi
mov ecx, esi
dec edi
push edi
call dword [eax + 0xc]
cmp eax, edi
je 0x101216b4
mov ecx, dword [esi + 0x38]
lea eax, [esp + 0x24]
mov ebp, esp
lea edi, [esp + 4]
lea edx, [esi + 0x40]
mov ebx, dword [ecx]
push ebp
push eax
push edi
push edx
call dword [ebx + 0x20]
cmp eax, 3
je 0x101216b8
cmp eax, 1
je 0x10121691
test eax, eax
jne 0x101216b4
mov byte [esi + 0x3d], 0
mov ebx, dword [esp]
sub ebx, edi
je 0x101216ab
push dword [esi + 0x4c]
push ebx
push 1
push edi
call fcn.101b0062
add esp, 0x10
cmp ebx, eax
jne 0x101216b4
cmp byte [esi + 0x3d], 0
sete al
jmp 0x101216ba
xor eax, eax
jmp 0x101216ba
mov al, 1
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1013312a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x54
movzx eax, word [esp + 0x70]
mov ebx, dword [esp + 0x6c]
mov esi, dword [esp + 0x68]
cmp eax, 0x1ff
ja 0x1013332c
lea edi, [esp + 0x44]
mov ecx, edi
call fcn.10042176
lea ecx, [esp + 0x14]
call fcn.10042176
lea ecx, [esp + 0x4c]
call fcn.10042176
lea ecx, [esp + 0x3c]
call fcn.1004013a
call fcn.10041e42
xor ecx, ecx
push ecx
push ecx
push eax
push dword [ebx]
call fcn.1003be3a
add esp, 0x10
lea ebp, [esp + 0x38]
push eax
push ebp
call fcn.1004261c
add esp, 8
lea ebx, [esp + 4]
mov ecx, edi
push dword [ebp]
push ebx
call fcn.10042446
lea ecx, [esp + 0x14]
push edi
push ebx
call fcn.1004240a
lea ecx, [esp + 4]
mov edi, ecx
push 0x7f
call fcn.100404fa
call fcn.10040264
xor ecx, ecx
push ecx
push ecx
push eax
push dword [edi]
call fcn.1003be3a
add esp, 0x10
mov ebp, eax
lea eax, [esp + 0x44]
lea ebx, [esp + 0x2c]
push eax
push ebx
call fcn.100b1bc2
add esp, 8
lea edi, [esp + 0x30]
push 0x17
push dword [ebx]
push edi
call fcn.1003d2a9
add esp, 0xc
mov edi, dword [edi]
call fcn.10040264
push eax
push edi
call fcn.1003c15c
add esp, 8
lea edi, [esp + 0x34]
push ebp
push eax
push edi
call fcn.1003cc42
add esp, 0xc
lea ebp, [esp + 0x3c]
lea ebx, [esp + 0xc]
mov ecx, ebp
push dword [edi]
push ebx
call fcn.10040380
call fcn.10040264
xor ecx, ecx
push ecx
push ecx
push eax
push dword [ebp]
call fcn.1003be3a
add esp, 0x10
lea edi, [esp + 4]
mov ecx, edi
push eax
call fcn.10041f74
mov ecx, esi
push edi
push ebx
call fcn.1004240a
mov eax, 0x3f800000
mov ecx, edi
push eax
call fcn.1003ed02
mov eax, esp
push edi
push eax
call fcn.100b1bc2
add esp, 8
lea ecx, [esp + 0xc]
mov edi, ecx
push 0x7fffff
call fcn.100404fa
call fcn.10040264
xor ecx, ecx
push ecx
push ecx
push eax
push dword [edi]
call fcn.1003be3a
add esp, 0x10
mov ebx, eax
lea eax, [esp + 0x14]
lea edi, [esp + 0x20]
push eax
push edi
call fcn.100b1bc2
add esp, 8
lea ebp, [esp + 0x24]
push ebx
push dword [edi]
push ebp
call fcn.1003c798
add esp, 0xc
mov eax, esp
lea edi, [esp + 0x28]
push dword [eax]
push dword [ebp]
push edi
call fcn.1003c7b8
add esp, 0xc
mov edi, dword [edi]
call fcn.10041e42
push eax
push edi
call fcn.1003c15c
add esp, 8
lea ecx, [esi + 8]
lea edx, [esp + 0x1c]
push eax
push edx
call fcn.10042446
call fcn.10041e42
xor ecx, ecx
push ecx
push ecx
xor edi, edi
push eax
mov eax, dword [esp + 0x78]
push dword [eax]
call fcn.1003be3a
add esp, 0x10
push edi
push edi
push eax
lea edi, [esp + 0x10]
push edi
call fcn.10122315
add esp, 0x10
lea ecx, [esi + 0x10]
push edi
lea eax, [esp + 0x10]
push eax
call fcn.1004240a
add esi, 0x18
mov eax, 0x3f800000
mov ecx, esi
push eax
push edi
call fcn.10042394
jmp 0x10133335
push 1
push ebx
push esi
call fcn.1012ba0a
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x10160224
Capabilities:
Resolve dns

Disassembly:
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [esp + 0x34]
movaps xmm0, xmmword [0x101e68e0]
mov esi, ecx
mov ecx, dword [esp + 0x38]
mov ebx, esp
xor edx, edx
lea edi, [esp + 4]
mov dword [esi], 0xffffffff
mov dword [edi + 0x14], edx
mov dword [edi + 0x10], edx
mov dword [edi + 0x1c], edx
mov dword [edi + 0x18], edx
mov dword [ebx], edx
movups xmmword [edi], xmm0
push ebx
push edi
push ecx
push eax
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov eax, dword [ebx]
test eax, eax
je 0x1016028b
push dword [eax + 0xc]
push dword [eax + 8]
push dword [eax + 4]
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi], eax
mov ecx, dword [esp]
push dword [ecx + 0x10]
push dword [ecx + 0x18]
push eax
call dword [sym.imp.WS2_32.dll_bind]
mov eax, esi
add esp, 0x24
pop esi
pop edi
pop ebx
ret 8

Function at 0x101602b0
Capabilities:
Get socket status

Disassembly:
push esi
sub esp, 0x10c
mov eax, dword [ecx]
mov esi, dword [esp + 0x114]
lea ecx, [esp + 8]
mov edx, 0x431bde83
mov dword [ecx + 4], eax
mov eax, esi
mov dword [ecx], 1
imul edx
mov eax, edx
sar edx, 0x12
shr eax, 0x1f
add edx, eax
mov eax, esp
mov dword [eax], edx
imul edx, edx, 0xf4240
sub esi, edx
xor edx, edx
mov dword [eax + 4], esi
push eax
push edx
push edx
push ecx
push 0x40
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
setg al
add esp, 0x10c
pop esi
ret 4

Function at 0x10160330
Capabilities:
Receive data
Receive data on socket

Disassembly:
push 0
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [ecx]
call dword [sym.imp.WS2_32.dll_recv]
ret 8

Function at 0x10160346
Capabilities:
Send data
Send data on socket

Disassembly:
push 0
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [ecx]
call dword [sym.imp.WS2_32.dll_send]
ret 8

Function at 0x1016035c
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
mov eax, esp
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
add esp, 0x190
ret

Function at 0x10160380
Capabilities:
Create thread

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, dword [esp + 0x24]
xor ebp, ebp
mov esi, ecx
mov byte [ecx + 4], 0
push ebp
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [esp + 0x28]
mov edi, esp
mov dword [edi], eax
lea eax, [esp + 4]
mov dword [eax], ebx
mov dword [eax + 4], ecx
mov dword [eax + 8], edi
push ebp
push ebp
push eax
push 0x101603fc
push 0x100000
push ebp
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
push 0xffffffffffffffff
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x10174a20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebp, dword [esp + 0x14]
xor ebx, ebx
mov eax, 0x8ce0
mov esi, ecx
mov dword [ecx + 0x4c], ebx
mov dword [ecx + 0x48], ebx
mov dword [ecx + 0x54], ebx
mov dword [ecx + 0x50], ebx
mov dword [ecx + 0x5c], ebx
mov dword [ecx + 0x58], ebx
mov dword [ecx + 0x64], ebx
mov dword [ecx + 0x60], ebx
mov dword [ecx + 0x8c], ebx
mov dword [ecx + 0x98], ebx
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov eax, 0x10
mov dword [ecx + 0x90], ebx
mov dword [ecx + 0x94], ebx
mov dword [ecx + 0x9c], ebx
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0xc], ebx
mov dword [ecx + 0x18], ebx
mov dword [ecx + 0x14], ebx
mov dword [ecx + 0x20], ebx
mov dword [ecx + 0x1c], ebx
mov dword [ecx + 0x28], ebx
mov dword [ecx + 0x24], ebx
mov dword [ecx + 0x30], ebx
mov dword [ecx + 0x2c], ebx
mov dword [ecx + 0x38], ebx
mov dword [ecx + 0x34], ebx
mov dword [ecx + 0x44], ebx
mov dword [ecx + 0x40], ebx
mov dword [ecx + 0x3c], ebx
mov dword [ecx + 0x6c], ebx
mov dword [ecx + 0x68], ebx
mov dword [ecx + 0x74], ebx
mov dword [ecx + 0x70], ebx
mov dword [ecx + 0x7c], ebx
mov dword [ecx + 0x78], ebx
mov dword [ecx + 0x84], ebx
mov dword [ecx + 0x80], ebx
mov dword [ecx + 0x88], ebx
mov dword [ecx], 0x101ea42c
push eax
call fcn.10183019
add esp, 4
mov edi, eax
mov ecx, eax
push ebp
push ebx
call fcn.1017c09e
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
mov ecx, dword [esi + 0x48]
test ecx, ecx
je 0x10174aef
mov eax, dword [ecx]
call dword [eax + 4]
mov ebp, dword [esp + 0x18]
mov dword [esi + 0x48], edi
mov edi, 0xffffffe4
mov eax, 0x405
mov dword [esi + 0x28], 0x8218
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov ecx, dword [esi + edi + 0x68]
test ecx, ecx
je 0x10174b1a
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [esi + edi + 0x68], ebx
mov dword [esi + edi + 0x48], ebx
add edi, 4
jne 0x10174b0d
push 0x10
call fcn.10183019
add esp, 4
mov edi, eax
mov ecx, eax
push ebp
push 0
call fcn.1017c09e
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
mov ecx, dword [esi + 0x8c]
test ecx, ecx
je 0x10174b52
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [esi + 0x8c], edi
mov ecx, edi
mov eax, dword [edi]
call dword [eax]
mov ecx, dword [esi + 0x98]
test ecx, ecx
je 0x10174b6d
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, edi
mov dword [esi + 0x98], edi
call fcn.1017c170
test eax, eax
mov ebx, 0x8218
mov ecx, edi
cmovne eax, ebx
mov dword [esi + 0x88], eax
call fcn.1017c182
test eax, eax
cmove ebx, eax
mov eax, esi
mov dword [esi + 0x94], ebx
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x10176558
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebp, dword [esp + 0x18]
test ebp, ebp
js 0x101765b3
mov edi, ecx
mov eax, dword [ecx + 0x2b8]
mov ecx, dword [ecx + 0x2bc]
sub ecx, eax
sar ecx, 5
cmp ecx, ebp
jle 0x101765b3
shl ebp, 5
mov eax, dword [eax + ebp + 0x1c]
cmp eax, 0xffffffff
je 0x101765b3
mov ecx, dword [edi + 0x2a0]
mov ebx, dword [esp + 0x1c]
mov eax, dword [ecx + eax*4]
mov dword [esp], eax
push dword [eax]
call fcn.1017c958
add esp, 4
mov esi, eax
test ebx, ebx
je 0x101765c1
lea eax, [esi*4]
cmp dword [ebx], eax
jae 0x101765c1
xor ebx, ebx
mov eax, ebx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov eax, dword [esp]
mov bl, 1
push dword [eax]
call fcn.1017c9d4
add esp, 4
lea ecx, [eax - 0x1404]
cmp ecx, 2
jb 0x10176616
mov edx, dword [esp + 0x20]
cmp eax, 0x1406
je 0x1017663f
mov ecx, dword [esp]
cmp eax, 0x8b56
jne 0x101765b5
test esi, esi
je 0x101765b5
mov eax, dword [edi + 0x2b8]
mov edi, edx
mov eax, dword [eax + ebp + 0x18]
imul eax, esi
add eax, dword [ecx + 0x44]
xor ecx, ecx
movzx edx, byte [eax + ecx]
mov dword [edi + ecx*4], edx
inc ecx
cmp esi, ecx
jne 0x10176608
jmp 0x101765b5
mov eax, dword [edi + 0x2b8]
mov ecx, dword [esp]
shl esi, 2
mov eax, dword [eax + ebp + 0x18]
imul eax, esi
add eax, dword [ecx + 0x44]
push esi
push eax
push dword [esp + 0x28]
call fcn.1019f110
add esp, 0xc
jmp 0x101765b5
mov ecx, dword [esp]
test esi, esi
je 0x101765b5
mov eax, dword [edi + 0x2b8]
movss xmm0, dword [0x101c8f44]
mov eax, dword [eax + ebp + 0x18]
mov ebp, edx
imul eax, esi
shl eax, 2
add eax, dword [ecx + 0x44]
xor ecx, ecx
movss xmm1, dword [eax + ecx*4]
movaps xmm2, xmm1
cvttss2si edx, xmm1
subss xmm2, xmm0
cvttss2si edi, xmm2
xor edi, 0x80000000
ucomiss xmm0, xmm1
cmova edi, edx
mov dword [ebp + ecx*4], edi
inc ecx
cmp esi, ecx
jne 0x10176669
jmp 0x101765b5

Function at 0x1017f180
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
push edi
push esi
sub esp, 0x48
mov ebx, dword [esp + 0x58]
cmp byte [0x10254864], 0
mov esi, ecx
jne 0x1017f1a1
call fcn.10004168
mov byte [0x10254864], 1
push 0xc0
call fcn.10183019
add esp, 4
mov edi, eax
mov ecx, eax
push ebx
push esi
call fcn.10025098
mov esi, esp
mov ecx, esi
call fcn.100038f4
movaps xmm0, xmmword [0x101eb760]
movaps xmm1, xmmword [0x101eb770]
movaps xmm2, xmmword [0x101c80d0]
mov eax, 0x40
mov ecx, edi
movups xmmword [esi], xmm0
movups xmmword [esi + 0x10], xmm1
movaps xmm1, xmmword [0x101e1660]
movups xmmword [esi + 0x20], xmm2
movups xmmword [esi + 0x30], xmm1
mov dword [esi + 0x40], 1
mov dword [esi + 0x44], eax
push esi
call fcn.10003ade
mov eax, edi
add esp, 0x48
pop esi
pop edi
pop ebx
ret 4

Function at 0x101886b1
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x101bf379
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.101bf384
Function at 0x4121c0
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebx
mov edx, 7
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x4121c6
mov eax, dword [esp + 0x28]
mov dword [0x4840ac], eax
mov edx, dword [esp + 0x24]
lea ecx, [esp]
call fcn.00423000
mov dword [esp + 4], 0x10000
push 0
push 0
push 0
push 0
push dword [esp + 0x10]
call sub.WININET.DLL_InternetOpenW
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x4122f0
push 0
push 0x80000000
push 0
push 0
push dword [esp + 0x10]
push dword [esp + 0x1c]
call sub.WININET.DLL_InternetOpenUrlW
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], 0
je 0x4122e7
push dword [0x4840ac]
push dword [0x4840ac]
push dword [esp + 0xc]
call fcn.004391f0
lea eax, [esp + 0x14]
push eax
call fcn.0043b5a0
mov dword [esp + 0x14], 1
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
call fcn.00439fb0
push eax
mov eax, dword [esp + 0x18]
push eax
push dword [esp + 0x18]
call sub.WININET.DLL_InternetReadFile
mov ebx, eax
and ebx, ebx
je 0x4122a5
mov ebx, dword [esp + 0x14]
and ebx, ebx
jle 0x4122a5
mov eax, 1
jmp 0x4122a7
xor eax, eax
and eax, eax
je 0x4122e7
mov edx, dword [esp + 0x18]
push dword [0x4840ac]
push edx
call fcn.0043b540
push dword [0x4840ac]
push dword [0x4840ac]
push 2
push dword [esp + 0x24]
mov eax, dword [esp + 0x24]
push eax
call fcn.0043a6c0
pop eax
lea eax, [esp + 0x1c]
push eax
call fcn.0043b5a0
jmp 0x412273
push dword [esp + 8]
call sub.WININET.DLL_InternetCloseHandle
mov edx, dword [esp + 0x18]
push dword [0x4840ac]
push edx
call fcn.0043b540
pop eax
add eax, dword [0x47ee78]
jmp 0x412319
push dword [esp + 0x18]
call fcn.0043b710
push dword [esp + 0x10]
call fcn.0043b710
push dword [esp]
call fcn.0043b710
add esp, 0x1c
pop ebx
ret 4
Function at 0x412bac
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
mov eax, dword [esp + 0x30]
mov dword [0x4840ac], eax
mov edx, dword [esp + 0x24]
lea ecx, [esp]
call fcn.00423000
mov edx, dword [esp + 0x28]
lea ecx, [esp + 4]
call fcn.00423000
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 8]
call fcn.00423000
mov dword [esp + 0xc], 0
push dword [0x4840ac]
push dword [0x4840ac]
push 0xff
call fcn.004391f0
lea eax, [esp + 0x14]
push eax
call fcn.0043b5a0
mov dword [esp + 0x14], 0xff
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push dword [esp + 0xc]
push dword [esp + 0x30]
call sub.ADVAPI32.DLL_RegOpenKeyExW
and eax, eax
je 0x412c50
mov edx, dword [esp + 8]
push dword [0x4840ac]
push edx
call fcn.0043b540
lea eax, [esp + 0x14]
push eax
call fcn.0043b5a0
jmp 0x412cbf
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
push eax
push 0
push 0
push dword [esp + 0x14]
push dword [esp + 0x20]
call sub.ADVAPI32.DLL_RegQueryValueExW
and eax, eax
je 0x412c91
mov edx, dword [esp + 8]
push dword [0x4840ac]
push edx
call fcn.0043b540
lea eax, [esp + 0x14]
push eax
call fcn.0043b5a0
jmp 0x412cb6
push dword [0x4840ac]
push dword [0x4840ac]
mov ebx, dword [esp + 0x1c]
dec ebx
push ebx
push dword [esp + 0x1c]
call fcn.00439240
lea eax, [esp + 0x14]
push eax
call fcn.0043b5a0
push dword [esp + 0xc]
call sub.ADVAPI32.DLL_RegCloseKey
mov edx, dword [esp + 0x10]
push dword [0x4840ac]
push edx
call fcn.0043b540
pop eax
add eax, dword [0x47ee78]
jmp 0x412ce8
push dword [esp + 0x10]
call fcn.0043b710
push dword [esp]
call fcn.0043b710
push dword [esp + 8]
call fcn.0043b710
push dword [esp + 4]
call fcn.0043b710
add esp, 0x18
pop ebx
ret 0x10