joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000254f
Capabilities:
Get number of processors

Disassembly:
jmp 0x1004da20
push 0xffffffffffffffff
push 0x1008130a
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x100a0000]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov dword [edi], vtable.ProtocolFilters::XMPPFilter.0
lea ecx, [edi + 0xa0]
mov dword [esp + 0x1c], 3
call fcn.1000101e
lea ecx, [edi + 0x64]
mov byte [esp + 0x1c], 2
call fcn.1000101e
lea esi, [edi + 0x30]
mov dword [esp + 0x10], esi
mov ecx, dword [esi]
mov byte [esp + 0x1c], 4
test ecx, ecx
je 0x1004da89
mov eax, dword [ecx]
push 1
call dword [eax]
cmp dword [esi + 0x20], 0x10
jb 0x1004da9a
push dword [esi + 0xc]
call fcn.10052462
add esp, 4
mov dword [esi + 0x20], 0xf
mov dword [esi + 0x1c], 0
mov byte [esi + 0xc], 0
lea esi, [edi + 8]
mov dword [esp + 0x10], esi
mov ecx, dword [esi]
mov byte [esp + 0x1c], 5
test ecx, ecx
je 0x1004dac4
mov eax, dword [ecx]
push 1
call dword [eax]
cmp dword [esi + 0x20], 0x10
jb 0x1004dad5
push dword [esi + 0xc]
call fcn.10052462
add esp, 4
mov dword [esi + 0x20], 0xf
mov dword [esi + 0x1c], 0
mov byte [esi + 0xc], 0
mov dword [edi], vtable.ProtocolFilters::IFilterBase.0
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret
Function at 0x10002626
Capabilities:
Read file on windows

Disassembly:
jmp 0x10043b60
push 0xffffffffffffffff
push 0x10080a78
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x100a0000]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push esi
push edi
mov eax, dword [0x100a0000]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], 0
mov byte [esp + 0x1c], 0
cmp dword [edi + 0x1c], 8
lea eax, [edi + 8]
mov dword [esp + 0x40], 0
mov bl, 1
jb 0x10043bbd
mov eax, dword [eax]
push 0x10089254
push eax
call fcn.100548fd
mov esi, eax
add esp, 8
test esi, esi
jne 0x10043bd8
xor bl, bl
jmp 0x10043cba
push esi
push 4
lea eax, [esp + 0x18]
push 1
push eax
call fcn.100541ad
add esp, 0x10
cmp eax, 4
jne 0x10043cb1
jmp 0x10043c00
mov ecx, dword [esp + 0x10]
cmp ecx, 0x7d0
ja 0x10043caf
mov eax, dword [esp + 0x2c]
cmp ecx, eax
ja 0x10043c30
cmp dword [esp + 0x30], 0x10
lea eax, [esp + 0x1c]
cmovae eax, dword [esp + 0x1c]
mov dword [esp + 0x2c], ecx
mov byte [eax + ecx], 0
jmp 0x10043c3e
sub ecx, eax
push 0
push ecx
lea ecx, [esp + 0x24]
call fcn.10002720
push esi
push 8
lea eax, [esp + 0x1c]
push 1
push eax
call fcn.100541ad
add esp, 0x10
cmp eax, 8
jne 0x10043caf
cmp dword [esp + 0x30], 0x10
push esi
push dword [esp + 0x14]
lea eax, [esp + 0x24]
cmovae eax, dword [esp + 0x24]
push 1
push eax
call fcn.100541ad
add esp, 0x10
cmp eax, dword [esp + 0x10]
jne 0x10043caf
lea eax, [esp + 0x1c]
push eax
mov ecx, edi
call fcn.1000277a
mov ecx, dword [esp + 0x14]
mov dword [eax], ecx
mov ecx, dword [esp + 0x18]
push esi
push 4
mov dword [eax + 4], ecx
lea eax, [esp + 0x18]
push 1
push eax
call fcn.100541ad
add esp, 0x10
cmp eax, 4
je 0x10043c00
jmp 0x10043cb1
xor bl, bl
push esi
call fcn.10053f58
add esp, 4
cmp dword [esp + 0x30], 0x10
jb 0x10043ccd
push dword [esp + 0x1c]
call fcn.10052462
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.10052ab4
add esp, 0x34
ret

Function at 0x1000275c
Capabilities:
Read file on windows

Disassembly:
jmp 0x1000ff60
mov eax, dword [ecx + 4]
test eax, eax
jne 0x1000ff6a
ret 8
push eax
push dword [esp + 0xc]
push 1
push dword [esp + 0x10]
call fcn.100541ad
add esp, 0x10
ret 8
Function at 0x10002de7
Capabilities:
Get number of processors

Disassembly:
jmp 0x1004d950
push 0xffffffffffffffff
push 0x100812b0
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x100a0000]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov word [edi + 4], 0x100
mov esi, dword [esp + 0x24]
mov eax, esi
shr eax, 3
and al, 1
movzx eax, al
push eax
push 0x44c
lea ecx, [edi + 8]
mov dword [esp + 0x20], 0
mov dword [edi], vtable.ProtocolFilters::XMPPFilter.0
call fcn.10003391
mov eax, esi
shr eax, 2
and al, 1
movzx eax, al
push eax
push 0x44d
lea ecx, [edi + 0x30]
mov byte [esp + 0x20], 1
call fcn.10003391
mov eax, dword [esp + 0x20]
lea ecx, [edi + 0x64]
mov byte [esp + 0x18], 2
mov byte [edi + 0x58], 1
mov dword [edi + 0x5c], eax
mov dword [edi + 0x60], esi
call fcn.10002455
lea ecx, [edi + 0xa0]
mov byte [esp + 0x18], 3
call fcn.10002455
mov byte [edi + 5], 0
mov byte [edi + 0xdc], 0
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 8
Function at 0x100031f2
Capabilities:
Check if file exists
Create directory

Disassembly:
jmp 0x10030e00
push 0xffffffffffffffff
push 0x1007f603
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x100a0000]
xor eax, esp
mov dword [esp + 0x220], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100a0000]
xor eax, esp
push eax
lea eax, [esp + 0x238]
mov dword fs:[0], eax
mov ebp, ecx
mov esi, dword [esp + 0x248]
mov edi, ebp
mov edx, esi
sub edi, esi
lea ebx, [ebx]
movzx eax, word [edx]
mov word [edi + edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x10030e50
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push esi
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, 0xffffffff
je 0x10030e77
test al, 0x10
jne 0x10030e87
push 0
push esi
call edi
test eax, eax
jne 0x10030e87
xor al, al
jmp 0x10030f2e
lea ecx, [esp + 0x2c]
sub ecx, esi
lea ecx, [ecx]
movzx eax, word [esi]
mov word [ecx + esi], ax
lea esi, [esi + 2]
test ax, ax
jne 0x10030e90
lea ecx, [esp + 0x2c]
add ecx, 0xfffffffe
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x10030ea6
mov eax, dword [str._SSL]
mov dword [ecx], eax
mov eax, dword [0x100888f4]
mov dword [ecx + 4], eax
mov ax, word [0x100888f8]
mov word [ecx + 8], ax
lea eax, [esp + 0x2c]
push eax
call ebx
cmp eax, 0xffffffff
je 0x10030edb
test al, 0x10
jne 0x10030ee8
push 0
lea eax, [esp + 0x30]
push eax
call edi
test eax, eax
je 0x10030e80
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x18]
call fcn.10003085
lea eax, [esp + 0x14]
push eax
lea ecx, [ebp + 0x208]
mov dword [esp + 0x244], 0
call fcn.1000180c
test al, al
sete bl
cmp dword [esp + 0x28], 8
jb 0x10030f29
push dword [esp + 0x14]
call fcn.10052462
add esp, 4
test bl, bl
sete al
mov ecx, dword [esp + 0x238]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.10052ab4
add esp, 0x230
ret 4
Function at 0x100034ea
Capabilities:
Read file on windows
Write file on windows

Disassembly:
jmp 0x100444e0
push 0xffffffffffffffff
push 0x10080b58
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x100a0000]
xor eax, esp
mov dword [esp + 0x4c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100a0000]
xor eax, esp
push eax
lea eax, [esp + 0x64]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x74]
lea eax, [edi + 0x14]
push eax
mov dword [esp + 0x1c], vtable.ProtocolFilters::AutoLock.0
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea ecx, [esp + 0x20]
mov dword [esp + 0x6c], 0
call fcn.100022d4
push esi
lea eax, [esp + 0x4c]
push eax
mov ecx, edi
mov byte [esp + 0x74], 1
call fcn.1000253b
mov ebx, eax
push ebx
mov ecx, edi
mov byte [esp + 0x70], 2
call fcn.10003896
mov esi, eax
cmp esi, dword [edi]
je 0x1004458c
cmp dword [esi + 0x24], 0x10
mov ecx, dword [esi + 0x20]
lea eax, [esi + 0x10]
jb 0x10044574
mov eax, dword [eax]
push ecx
push eax
push dword [ebx + 0x10]
mov ecx, ebx
push 0
call fcn.10003eef
test eax, eax
js 0x1004458c
mov dword [esp + 0x14], esi
jmp 0x10044592
mov eax, dword [edi]
mov dword [esp + 0x14], eax
cmp dword [esp + 0x5c], 0x10
lea esi, [esp + 0x14]
mov esi, dword [esi]
jb 0x100445ab
push dword [esp + 0x48]
call fcn.10052462
add esp, 4
mov dword [esp + 0x5c], 0xf
mov dword [esp + 0x58], 0
mov byte [esp + 0x48], 0
cmp esi, dword [edi]
je 0x10044635
mov ebx, dword [esp + 0x78]
mov ebp, dword [esp + 0x7c]
push 0
push dword [esi + 0x28]
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebp
push dword [edi + 0x10]
call fcn.100542e8
push dword [edi + 0x10]
lea eax, [esp + 0x48]
push 0x10
push 1
push eax
call fcn.100541ad
add esp, 0x1c
cmp eax, 0x10
jne 0x10044635
push 0
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebp
push dword [esi + 0x28]
push dword [edi + 0x10]
call fcn.100542e8
push dword [edi + 0x10]
lea eax, [esp + 0x48]
push 0x10
push 1
push eax
call fcn.1005487f
add esp, 0x1c
cmp eax, 0x10
jne 0x10044635
push dword [edi + 0x10]
call fcn.10054dde
add esp, 4
mov bl, 1
jmp 0x10044637
xor bl, bl
lea ecx, [esp + 0x20]
mov byte [esp + 0x6c], 0
call fcn.100034ef
lea eax, [edi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.10052ab4
add esp, 0x5c
ret 0xc
Function at 0x100035e9
Capabilities:
Create thread

Disassembly:
jmp 0x100356c0
push edi
mov edi, ecx
cmp dword [edi + 0x4c], 0
je 0x1003570f
push esi
lea esi, [edi + 0x58]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
or dword [edi + 0x54], 1
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [edi + 0x50]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [edi + 0x4c]
pop esi
test eax, eax
je 0x10035709
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [edi + 0x4c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x4c], 0
cmp dword [edi + 0x4c], 0
jne 0x10035734
push 0
push 0
push edi
push 0x100030e9
push 0
push 0
call fcn.10057254
add esp, 0x18
mov dword [edi + 0x4c], eax
cmp eax, 0xffffffff
jne 0x10035734
mov dword [edi + 0x4c], 0
pop edi
ret
Function at 0x1000362a
Capabilities:
Get common file path

Disassembly:
jmp 0x10023280
push 0xffffffffffffffff
push 0x1007e9a2
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x100a0000]
xor eax, esp
mov dword [esp + 0x230], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100a0000]
xor eax, esp
push eax
lea eax, [esp + 0x248]
mov dword fs:[0], eax
mov ebp, ecx
mov ecx, dword [ebp + 4]
mov edx, dword [esp + 0x258]
test ecx, ecx
jne 0x100232d2
xor eax, eax
jmp 0x1002342c
push dword [esp + 0x25c]
mov eax, dword [ecx]
push edx
call dword [eax + 0x10]
mov esi, eax
mov dword [esp + 0x18], esi
test esi, esi
je 0x100232cb
cmp byte [ebp + 0xc], 0
jne 0x1002342a
mov ecx, dword [ebp + 4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x14]
call eax
test edx, edx
jb 0x1002342a
ja 0x10023310
cmp eax, dword [ebp + 8]
jbe 0x1002342a
lea eax, [esp + 0x24]
push eax
call fcn.10002a59
mov ecx, eax
call fcn.10002b71
cmp dword [esp + 0x38], 8
lea ecx, [esp + 0x3c]
push ecx
push 0
lea eax, [esp + 0x2c]
cmovae eax, dword [esp + 0x2c]
push 0x1008776c
push eax
mov dword [esp + 0x260], 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x10023421
push 8
call fcn.10052413
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x250], 1
test eax, eax
je 0x1002337a
mov ecx, eax
call fcn.10001da2
mov ebx, eax
jmp 0x1002337c
xor ebx, ebx
mov byte [esp + 0x250], 0
test ebx, ebx
je 0x10023421
push str.wbTD
lea eax, [esp + 0x40]
push eax
mov ecx, ebx
call fcn.10001339
push 1
test al, al
jne 0x100233ab
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax]
jmp 0x10023421
mov ecx, dword [ebp + 4]
push 0
mov eax, dword [ecx]
push 0
mov eax, dword [eax + 8]
call eax
mov ecx, dword [ebp + 4]
push ebx
mov esi, dword [ecx]
mov dword [esp + 0x18], eax
mov esi, dword [esi + 0x18]
mov dword [esp + 0x20], edx
call esi
mov ecx, dword [ebp + 4]
mov edi, eax
mov esi, dword [ecx]
mov dword [esp + 0x20], edx
mov esi, dword [esi + 0x14]
call esi
cmp edi, eax
jne 0x10023415
cmp dword [esp + 0x20], edx
jne 0x10023415
mov ecx, dword [ebp + 4]
mov eax, dword [ecx]
call dword [eax + 4]
push 0
push dword [esp + 0x20]
mov dword [ebp + 4], ebx
mov eax, dword [ebx]
push dword [esp + 0x1c]
mov ecx, ebx
call dword [eax + 8]
lea ecx, [esp + 0x24]
mov byte [ebp + 0xc], 1
call fcn.1000355d
mov esi, dword [esp + 0x18]
jmp 0x1002342a
mov eax, dword [ebx]
push 1
mov ecx, ebx
call dword [eax]
mov esi, dword [esp + 0x18]
lea ecx, [esp + 0x24]
call fcn.1000355d
mov eax, esi
mov ecx, dword [esp + 0x248]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x230]
xor ecx, esp
call fcn.10052ab4
add esp, 0x240
ret 8
Function at 0x1000363e
Capabilities:
Write file on windows

Disassembly:
jmp 0x100443d0
sub esp, 0xc
push ebp
mov ebp, ecx
push edi
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
mov byte [esp + 0xb], 1
jb 0x100443e7
mov eax, dword [eax]
push 0x1008926c
push eax
call fcn.100548fd
mov edi, eax
add esp, 8
test edi, edi
jne 0x10044403
pop edi
xor al, al
pop ebp
add esp, 0xc
ret
mov eax, dword [ebp]
push esi
mov esi, dword [eax]
mov dword [esp + 0x10], esi
cmp esi, eax
je 0x10044496
push ebx
mov eax, dword [esi + 0x20]
push edi
push 4
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
push 1
push eax
call fcn.1005487f
add esp, 0x10
cmp eax, 4
jne 0x10044490
push edi
push 8
lea eax, [esi + 0x28]
push 1
push eax
call fcn.1005487f
add esp, 0x10
cmp eax, 8
jne 0x10044490
mov ebx, dword [esi + 0x20]
add esi, 0x10
cmp dword [esi + 0x14], 0x10
jb 0x10044458
mov esi, dword [esi]
push edi
push ebx
push 1
push esi
call fcn.1005487f
add esp, 0x10
cmp eax, ebx
jne 0x10044490
lea ecx, [esp + 0x14]
call fcn.10002cac
mov esi, dword [esp + 0x14]
cmp esi, dword [ebp]
jne 0x10044416
pop ebx
push edi
call fcn.10053f58
mov al, byte [esp + 0x13]
add esp, 4
pop esi
pop edi
pop ebp
add esp, 0xc
ret
mov byte [esp + 0x13], 0
pop ebx
push edi
call fcn.10053f58
mov al, byte [esp + 0x13]
add esp, 4
pop esi
pop edi
pop ebp
add esp, 0xc
ret
Function at 0x10003940
Capabilities:
Create thread

Disassembly:
jmp 0x10035820
push esi
mov esi, ecx
call fcn.10003b07
cmp dword [esi + 0x70], 0
jne 0x10035853
push 0
push 0
push esi
push 0x10001aaa
push 0
push 0
call fcn.10057254
add esp, 0x18
mov dword [esi + 0x70], eax
cmp eax, 0xffffffff
jne 0x10035853
mov dword [esi + 0x70], 0
pop esi
ret

Function at 0x10003a7b
Capabilities:
Write file on windows

Disassembly:
jmp 0x100355f0
mov eax, dword [esp + 4]
cmp dword [eax + 0x14], 8
jb 0x100355fc
mov eax, dword [eax]
push ebx
push 0x100890c4
push eax
call fcn.100548fd
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x10035657
push esi
push edi
push 0
push 0
push ebx
call fcn.100542e8
mov edi, dword [esp + 0x20]
add esp, 0xc
mov ecx, edi
push ebx
call fcn.1000277f
push eax
push 1
mov ecx, edi
call fcn.10003670
push eax
call fcn.1005487f
add esp, 0x10
mov ecx, edi
mov esi, eax
call fcn.1000277f
pop edi
cmp esi, eax
pop esi
push ebx
je 0x1003565d
call fcn.10053f58
add esp, 4
xor al, al
pop ebx
ret 8
call fcn.10053f58
add esp, 4
mov al, 1
pop ebx
ret 8
Function at 0x100090a0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push edi
push 0x44
lea eax, [esp + 0x18]
push 0
push eax
call fcn.100535f0
add esp, 0xc
xor eax, eax
mov word [esp + 0x44], ax
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x68]
xorps xmm0, xmm0
push 0
push 8
push 0
push 0
push 0
push dword [esp + 0x7c]
mov dword [esp + 0x38], 0x44
push 0
mov dword [esp + 0x68], 1
movq qword [esp + 0x2c], xmm0
movq qword [esp + 0x34], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
test edi, edi
je 0x10009127
push 0xffffffffffffffff
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
add esp, 0x54
ret

Function at 0x100099a0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
jmp 0x100099a0
push 0xffffffffffffffff
push 0x1007ce48
mov eax, dword fs:[0]
push eax
sub esp, 0x404
mov eax, dword [0x100a0000]
xor eax, esp
mov dword [esp + 0x400], eax
push esi
push edi
mov eax, dword [0x100a0000]
xor eax, esp
push eax
lea eax, [esp + 0x410]
mov dword fs:[0], eax
mov esi, dword [esp + 0x420]
mov dword [esp + 0x20], 0xf
mov dword [esp + 0x1c], 0
mov byte [esp + 0xc], 0
cmp dword [esi + 0x14], 8
mov dword [esp + 0x418], 0
jb 0x10009a0a
mov eax, dword [esi]
jmp 0x10009a0c
mov eax, esi
push 0x10086198
push eax
call fcn.100548fd
mov edi, eax
add esp, 8
test edi, edi
jne 0x10009a3c
cmp dword [esp + 0x20], 0x10
jb 0x10009b09
push dword [esp + 0xc]
call fcn.10052462
add esp, 4
jmp 0x10009b09
push edi
push 0x3e7
lea eax, [esp + 0x2c]
push 1
push eax
call fcn.100541ad
add esp, 0x10
test eax, eax
je 0x10009aa8
cmp eax, 0x3e8
jae 0x10009b2f
mov byte [esp + eax + 0x24], 0
cmp byte [esp + 0x24], 0
jne 0x10009a70
xor eax, eax
jmp 0x10009a80
lea eax, [esp + 0x24]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10009a77
sub eax, edx
push eax
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x14]
call fcn.100026ee
push edi
push 0x3e7
lea eax, [esp + 0x2c]
push 1
push eax
call fcn.100541ad
add esp, 0x10
test eax, eax
jne 0x10009a55
push edi
call fcn.10053f58
add esp, 4
lea ecx, [esp + 0xc]
push 0x35
push 0
push str.user_pref__security.enterprise_roots.enabled___true__
call fcn.10002be9
cmp eax, 0xffffffff
jne 0x10009a20
cmp dword [esi + 0x14], 8
jb 0x10009ad4
mov esi, dword [esi]
push 0x100861a8
push esi
call fcn.100548fd
mov esi, eax
add esp, 8
test esi, esi
je 0x10009b00
push esi
push 0x36
push 1
push str.user_pref__security.enterprise_roots.enabled___true__
call fcn.1005487f
push esi
call fcn.10053f58
add esp, 0x14
lea ecx, [esp + 0xc]
call fcn.10002068
mov ecx, dword [esp + 0x410]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.10052ab4
add esp, 0x410
ret
call fcn.100537b6
int3
Function at 0x1000ab90
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov ecx, ebx
call fcn.1000259f
push 0x10085fc0
push dword [esp + 0x10]
call fcn.100548fd
mov esi, eax
add esp, 8
test esi, esi
jne 0x1000abb9
pop esi
xor al, al
pop ebx
ret
push edi
push 2
push 0
push esi
call fcn.100542e8
push esi
call fcn.100546c0
push 0
push 0
push esi
mov edi, eax
call fcn.100542e8
add esp, 0x1c
test edi, edi
je 0x1000ac10
push edi
mov ecx, ebx
call fcn.10002d15
push esi
test al, al
je 0x1000ac02
push edi
push 1
mov ecx, ebx
call fcn.10003670
push eax
call fcn.100541ad
add esp, 0x10
cmp eax, edi
je 0x1000ac10
push esi
call fcn.10053f58
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
ret
push esi
call fcn.10053f58
add esp, 4
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0x10023280
Capabilities:
Get common file path

Disassembly:
jmp 0x10023280
push 0xffffffffffffffff
push 0x1007e9a2
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x100a0000]
xor eax, esp
mov dword [esp + 0x230], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100a0000]
xor eax, esp
push eax
lea eax, [esp + 0x248]
mov dword fs:[0], eax
mov ebp, ecx
mov ecx, dword [ebp + 4]
mov edx, dword [esp + 0x258]
test ecx, ecx
jne 0x100232d2
xor eax, eax
jmp 0x1002342c
push dword [esp + 0x25c]
mov eax, dword [ecx]
push edx
call dword [eax + 0x10]
mov esi, eax
mov dword [esp + 0x18], esi
test esi, esi
je 0x100232cb
cmp byte [ebp + 0xc], 0
jne 0x1002342a
mov ecx, dword [ebp + 4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x14]
call eax
test edx, edx
jb 0x1002342a
ja 0x10023310
cmp eax, dword [ebp + 8]
jbe 0x1002342a
lea eax, [esp + 0x24]
push eax
call fcn.10002a59
mov ecx, eax
call fcn.10002b71
cmp dword [esp + 0x38], 8
lea ecx, [esp + 0x3c]
push ecx
push 0
lea eax, [esp + 0x2c]
cmovae eax, dword [esp + 0x2c]
push 0x1008776c
push eax
mov dword [esp + 0x260], 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x10023421
push 8
call fcn.10052413
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x250], 1
test eax, eax
je 0x1002337a
mov ecx, eax
call fcn.10001da2
mov ebx, eax
jmp 0x1002337c
xor ebx, ebx
mov byte [esp + 0x250], 0
test ebx, ebx
je 0x10023421
push str.wbTD
lea eax, [esp + 0x40]
push eax
mov ecx, ebx
call fcn.10001339
push 1
test al, al
jne 0x100233ab
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax]
jmp 0x10023421
mov ecx, dword [ebp + 4]
push 0
mov eax, dword [ecx]
push 0
mov eax, dword [eax + 8]
call eax
mov ecx, dword [ebp + 4]
push ebx
mov esi, dword [ecx]
mov dword [esp + 0x18], eax
mov esi, dword [esi + 0x18]
mov dword [esp + 0x20], edx
call esi
mov ecx, dword [ebp + 4]
mov edi, eax
mov esi, dword [ecx]
mov dword [esp + 0x20], edx
mov esi, dword [esi + 0x14]
call esi
cmp edi, eax
jne 0x10023415
cmp dword [esp + 0x20], edx
jne 0x10023415
mov ecx, dword [ebp + 4]
mov eax, dword [ecx]
call dword [eax + 4]
push 0
push dword [esp + 0x20]
mov dword [ebp + 4], ebx
mov eax, dword [ebx]
push dword [esp + 0x1c]
mov ecx, ebx
call dword [eax + 8]
lea ecx, [esp + 0x24]
mov byte [ebp + 0xc], 1
call fcn.1000355d
mov esi, dword [esp + 0x18]
jmp 0x1002342a
mov eax, dword [ebx]
push 1
mov ecx, ebx
call dword [eax]
mov esi, dword [esp + 0x18]
lea ecx, [esp + 0x24]
call fcn.1000355d
mov eax, esi
mov ecx, dword [esp + 0x248]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x230]
xor ecx, esp
call fcn.10052ab4
add esp, 0x240
ret 8
Function at 0x100237c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
jmp 0x100237c0
push 0xffffffffffffffff
push 0x1007ea7e
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x100a0000]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov word [esi + 4], 0x100
mov eax, dword [esp + 0x28]
mov dword [esi + 8], eax
mov eax, dword [esp + 0x2c]
lea ecx, [esi + 0x14]
mov dword [esp + 0x20], 0
mov dword [esi], vtable.ProtocolFilters::NNTPFilter.0
mov dword [esi + 0xc], eax
call fcn.100022d4
push 1
push 1
push 0x384
lea ecx, [esi + 0x38]
mov byte [esp + 0x2c], 1
call fcn.10001582
mov ecx, dword [esi + 8]
lea eax, [esi + 0x4c]
push eax
mov byte [esp + 0x24], 2
call fcn.10001055
xorps xmm0, xmm0
lea eax, [esp + 8]
push eax
mov dword [esi + 0x10], 0
movlpd qword [esp + 0xc], xmm0
movlpd qword [esp + 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call fcn.10057070
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], edx
mov byte [esi + 5], 0
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x1c
ret 8

Function at 0x10025870
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
jmp 0x10025870
push 0xffffffffffffffff
push 0x1007ec5e
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x100a0000]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov word [esi + 4], 0x100
mov eax, dword [esp + 0x28]
mov dword [esi + 8], eax
mov eax, dword [esp + 0x2c]
lea ecx, [esi + 0x14]
mov dword [esp + 0x20], 0
mov dword [esi], vtable.ProtocolFilters::POP3Filter.0
mov dword [esi + 0xc], eax
call fcn.100022d4
push 1
push 1
push 0x12c
lea ecx, [esi + 0x38]
mov byte [esp + 0x2c], 1
call fcn.10001582
mov ecx, dword [esi + 8]
lea eax, [esi + 0x4c]
push eax
mov byte [esp + 0x24], 2
call fcn.10001055
xorps xmm0, xmm0
lea eax, [esp + 8]
push eax
mov dword [esi + 0x10], 0
movlpd qword [esp + 0xc], xmm0
movlpd qword [esp + 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call fcn.10057070
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], edx
mov byte [esi + 5], 0
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x1c
ret 8