joyce8/EMBER2024-capa huggingface dataset:
Function at 0x609530
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
sub esp, 8
push esi
mov esi, ecx
test edx, edx
jne 0x60954c
mov eax, 0xfe1e0002
pop esi
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esi + 0x1c]
cmp ecx, 0xffffffff
jne 0x609560
mov eax, 0xfe1e0021
pop esi
mov esp, ebp
pop ebp
ret 4
push ebx
movzx ebx, word [esi + 0x28]
mov eax, 2
push edi
mov edi, dword [esi + 0x10]
add edi, 0x20
cmp ax, bx
jne 0x60957d
mov eax, 0x10
jmp 0x609595
mov dword [ebp - 4], 0x17
xor eax, eax
cmp word [ebp - 4], bx
mov dword [ebp - 8], 0x1c
cmove eax, dword [ebp - 8]
push 0
push edi
push eax
lea eax, [esi + 0x28]
push eax
push 0
lea eax, [ebp - 8]
push eax
push 1
lea eax, [edx + 0x18]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_WSASendTo]
pop edi
pop ebx
cmp eax, 0xffffffff
jne 0x6095f3
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x609642
push 0
push 0
push eax
push str.::WSASendTo
push 0x45
push 0xda
push str.C:_temp_build_thehoffQuicksilver_fcs0.742171161775Quicksilver_fcs_vpnCommonIPCUdpTcpTransports_win.cpp
push str.CUdpTransport::internalWriteSocket
call fcn.00612830
add esp, 0x20
mov eax, 0xfe1e000b
pop esi
mov esp, ebp
pop ebp
ret 4
cmp dword [ebp - 8], 0
jne 0x609642
cmp dword [0x795850], 0
je 0x60960d
push 0x274a
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 0
push 0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.::WSASendTo
push 0x49
push 0xe2
push str.C:_temp_build_thehoffQuicksilver_fcs0.742171161775Quicksilver_fcs_vpnCommonIPCUdpTcpTransports_win.cpp
push str.CUdpTransport::internalWriteSocket
call fcn.00612830
add esp, 0x20
mov eax, 0xfe1e0010
pop esi
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esi + 0x10]
call fcn.005ff6f0
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x609660
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
test edi, edi
jne 0x60967e
pop edi
mov eax, 0xfe1e0002
pop esi
mov esp, ebp
pop ebp
ret 4
mov edx, dword [esi + 0x1c]
cmp edx, 0xffffffff
jne 0x609693
pop edi
mov eax, 0xfe1e0021
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0xc]
lea ecx, [esi + 0x170]
push 0
add eax, 0x20
mov dword [ecx], 0x80
push eax
push ecx
lea eax, [esi + 0x178]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 1
lea eax, [edi + 0x18]
push eax
push edx
call dword [sym.imp.WS2_32.dll_WSARecvFrom]
cmp eax, 0xffffffff
jne 0x609712
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x609762
push 0
push 0
push eax
push str.::WSARecvFrom
push 0x45
push 0x9a
push str.C:_temp_build_thehoffQuicksilver_fcs0.742171161775Quicksilver_fcs_vpnCommonIPCUdpTcpTransports_win.cpp
push str.CUdpTransport::internalReadSocket
call fcn.00612830
add esp, 0x20
mov eax, 0xfe1e000a
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
cmp dword [ebp - 8], 0
jne 0x609762
cmp dword [0x795850], 0
je 0x60972c
push 0x274a
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 0
push 0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.::WSARecvFrom
push 0x49
push 0xa2
push str.C:_temp_build_thehoffQuicksilver_fcs0.742171161775Quicksilver_fcs_vpnCommonIPCUdpTcpTransports_win.cpp
push str.CUdpTransport::internalReadSocket
call fcn.00612830
add esp, 0x20
mov eax, 0xfe1e0010
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esi + 0xc]
call fcn.005ff6f0
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x6098a0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 8]
push esi
mov esi, ecx
test edx, edx
jne 0x6098ba
mov eax, 0xfe1e0002
pop esi
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esi + 0x1c]
cmp ecx, 0xffffffff
jne 0x6098ce
mov eax, 0xfe1e0021
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x10]
push 0
add eax, 0x20
push eax
push 0
lea eax, [ebp - 4]
push eax
push 1
lea eax, [edx + 0x18]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0xffffffff
jne 0x60992b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x60997a
push 0
push 0
push eax
push str.::WSASend
push 0x45
push 0x1b0
push str.C:_temp_build_thehoffQuicksilver_fcs0.742171161775Quicksilver_fcs_vpnCommonIPCUdpTcpTransports_win.cpp
push str.CTcpTransport::internalWriteSocket
call fcn.00612830
add esp, 0x20
mov eax, 0xfe1e000b
pop esi
mov esp, ebp
pop ebp
ret 4
cmp dword [ebp - 4], 0
jne 0x60997a
cmp dword [0x795850], 0
je 0x609945
push 0x274a
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 0
push 0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.::WSASend
push 0x49
push 0x1b8
push str.C:_temp_build_thehoffQuicksilver_fcs0.742171161775Quicksilver_fcs_vpnCommonIPCUdpTcpTransports_win.cpp
push str.CTcpTransport::internalWriteSocket
call fcn.00612830
add esp, 0x20
mov eax, 0xfe1e0010
pop esi
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esi + 0x10]
call fcn.005ff6f0
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x609990
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
sub esp, 8
push esi
mov esi, ecx
test edx, edx
jne 0x6099ac
mov eax, 0xfe1e0002
pop esi
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esi + 0x1c]
cmp ecx, 0xffffffff
jne 0x6099c0
mov eax, 0xfe1e0021
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0xc]
push 0
add eax, 0x20
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 1
lea eax, [edx + 0x18]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_WSARecv]
cmp eax, 0xffffffff
jne 0x609a26
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x609a75
push 0
push 0
push eax
push str.::WSARecv
push 0x45
push 0x17e
push str.C:_temp_build_thehoffQuicksilver_fcs0.742171161775Quicksilver_fcs_vpnCommonIPCUdpTcpTransports_win.cpp
push str.CTcpTransport::internalReadSocket
call fcn.00612830
add esp, 0x20
mov eax, 0xfe1e000a
pop esi
mov esp, ebp
pop ebp
ret 4
cmp dword [ebp - 8], 0
jne 0x609a75
cmp dword [0x795850], 0
je 0x609a40
push 0x274a
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 0
push 0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.::WSARecv
push 0x49
push 0x186
push str.C:_temp_build_thehoffQuicksilver_fcs0.742171161775Quicksilver_fcs_vpnCommonIPCUdpTcpTransports_win.cpp
push str.CTcpTransport::internalReadSocket
call fcn.00612830
add esp, 0x20
mov eax, 0xfe1e0010
pop esi
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esi + 0xc]
call fcn.005ff6f0
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x609a90
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0xc
push ebx
mov ebx, ecx
push edi
test eax, eax
je 0x609bb7
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x609bb7
cmp dword [ebx + 0x1c], 0xffffffff
jne 0x609ac3
pop edi
mov eax, 0xfe1e0021
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp byte [ebx + 0x158], 0
je 0x609ad9
pop edi
mov eax, 0xfe1e0022
pop ebx
mov esp, ebp
pop ebp
ret 8
push esi
xor esi, esi
nop dword [eax]
add eax, esi
mov dword [ebp - 8], eax
mov eax, edi
push 0
push 0
sub eax, esi
push 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
push eax
push 1
lea eax, [ebp - 0xc]
push eax
push dword [ebx + 0x1c]
call dword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0xffffffff
je 0x609b70
mov eax, dword [ebp - 4]
test eax, eax
je 0x609b25
add esi, eax
mov eax, dword [ebp + 8]
cmp esi, edi
jb 0x609ae0
pop esi
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [0x795850], 0
je 0x609b39
push 0x274a
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 0
push 0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.::WSASend
push 0x49
push 0x150
push str.C:_temp_build_thehoffQuicksilver_fcs0.742171161775Quicksilver_fcs_vpnCommonIPCUdpTcpTransports_win.cpp
push str.CTcpTransport::writeSocketBlocking
call fcn.00612830
add esp, 0x20
mov eax, 0xfe1e0010
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push 0
push 0
mov esi, eax
push esi
push str.::WSASend
push 0x45
push 0x142
push str.C:_temp_build_thehoffQuicksilver_fcs0.742171161775Quicksilver_fcs_vpnCommonIPCUdpTcpTransports_win.cpp
push str.CTcpTransport::writeSocketBlocking
call fcn.00612830
add esp, 0x20
mov eax, 0xfe1e000b
cmp esi, 0x2733
mov ecx, 0xfe1e0026
cmove eax, ecx
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
mov eax, 0xfe1e0002
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x609f00
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x78a6d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, edx
mov dword [ebp - 0x234], eax
push edi
xor edi, edi
mov dword [ebp - 0x238], esi
mov ebx, ecx
test esi, esi
je 0x609f87
push 0x22c
lea eax, [ebp - 0x230]
push edi
push eax
call fcn.0058d130
add esp, 0xc
mov dword [ebp - 0x230], 0x22c
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x609fa0
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Process32First
push 0x45
push 0x72c
push str.C:_temp_build_thehoffQuicksilver_fcs0.742171161775Quicksilver_fcs_vpnCommonIPCWinsecAPI.cpp
push str.CWinsecApiUtil::searchProcessesForUserToken
call fcn.00612830
add esp, 0x20
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058a893
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x228]
push 1
push 0x450
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x609ff4
cmp esi, 0xffffffff
je 0x609ff4
test ebx, ebx
je 0x609fd6
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.0059f052
add esp, 8
test eax, eax
jne 0x609fe9
push dword [ebp - 0x234]
push ecx
mov ecx, esi
call fcn.0060a1f0
mov edi, eax
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x60a01c
lea eax, [ebp - 0x230]
push eax
push dword [ebp - 0x238]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x609fa0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058a893
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0058a893
mov esp, ebp
pop ebp
ret

Function at 0x60a030
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x78a6d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
mov esi, ecx
mov word [ebp - 8], 0x500
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x60a09a
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_EqualSid]
push dword [ebp - 0x10]
test eax, eax
setne bl
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.0058a893
mov esp, ebp
pop ebp
ret
Function at 0x60a0f0
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x78a6d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 4
push 1
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
mov esi, ecx
mov word [ebp - 8], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
push dword [ebp - 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
mov eax, dword [ebp - 0x10]
setne bl
test eax, eax
je 0x60a155
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.0058a893
mov esp, ebp
pop ebp
ret

Function at 0x60a170
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x78a6d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
mov esi, ecx
mov word [ebp - 8], 0x200
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
push dword [ebp - 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
mov eax, dword [ebp - 0x10]
setne bl
test eax, eax
je 0x60a1d5
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.0058a893
mov esp, ebp
pop ebp
ret

Function at 0x612b30
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x612b46
mov eax, 0xfe000002
mov esp, ebp
pop ebp
ret 0x14
mov edx, dword [ecx + 4]
test edx, edx
je 0x612ba2
cmp edx, 0xffffffff
je 0x612ba2
mov ecx, dword [ebp + 8]
push 0
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 0
push 1
push 0
push ecx
push dword [ebp + 0x14]
call fcn.00612a30
push eax
xor eax, eax
cmp ecx, 7
sete al
movzx eax, ax
push eax
push dword [ebp + 0x18]
push ecx
call fcn.00612aa0
movzx eax, ax
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
neg eax
sbb eax, eax
and eax, 0x1fffff7
add eax, 0xfe000009
mov esp, ebp
pop ebp
ret 0x14
mov eax, 0xfe000007
mov esp, ebp
pop ebp
ret 0x14
Function at 0x615ef0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x78a6d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
test ebx, ebx
jne 0x615f18
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058a893
mov esp, ebp
pop ebp
ret
push esi
push edi
push ebx
call fcn.0059a3bd
xor ecx, ecx
mov edx, 2
lea esi, [eax*2 + 2]
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0058ae90
add esp, 8
mov edi, eax
shr esi, 1
je 0x615f86
mov edx, accept
mov ecx, edi
sub edx, esi
sub ebx, edi
lea eax, [edx + esi]
test eax, eax
je 0x615f7f
movzx eax, word [ebx + ecx]
test ax, ax
je 0x615f78
mov word [ecx], ax
add ecx, 2
sub esi, 1
jne 0x615f53
sub ecx, 2
xor eax, eax
mov word [ecx], ax
jmp 0x615f8f
test esi, esi
jne 0x615f7f
sub ecx, 2
xor eax, eax
mov word [ecx], ax
jmp 0x615f8f
test esi, esi
je 0x615f8f
xor eax, eax
mov word [edi], ax
push 0x5c
push edi
call fcn.0058e547
mov esi, eax
add esp, 8
test esi, esi
je 0x615ff8
mov ebx, 0x5c
xor eax, eax
xorps xmm0, xmm0
mov word [esi], ax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x28]
push eax
push 0
push edi
movups xmmword [ebp - 0x28], xmm0
movups xmmword [ebp - 0x18], xmm0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
jne 0x615fe1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x615fe1
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x616016
lea eax, [esi + 2]
mov word [esi], bx
push 0x5c
push eax
call fcn.0058e547
mov esi, eax
add esp, 8
test esi, esi
jne 0x615fa5
mov bl, 1
push edi
call fcn.0058ac7a
mov ecx, dword [ebp - 4]
add esp, 4
mov al, bl
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0058a893
mov esp, ebp
pop ebp
ret
xor bl, bl
jmp 0x615ffa
Function at 0x62c350
Capabilities:
Get local ipv4 addresses

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
push 0x3a98
mov dword [ebp - 4], 0x3a98
mov dword [esi], 0
call fcn.005a79f0
add esp, 4
mov dword [esi], eax
test eax, eax
jne 0x62c3a9
push eax
push eax
push 0x8007000e
push str.malloc
push 0x45
push 0x3c7
push str.C:_temp_build_thehoffQuicksilver_fcs0.742171161775Quicksilver_fcs_vpnCommonUtilityNetInterface_win.cpp
push str.CNetInterface::getAdaptersAddrsInternal
call fcn.00612830
add esp, 0x20
mov eax, 0xfe0e0004
pop esi
mov esp, ebp
pop ebp
ret 0xc
push ebx
push edi
xor edi, edi
nop dword [eax]
lea ecx, [ebp - 4]
push ecx
push eax
push 0
push dword [ebp + 0x10]
push 0
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersAddresses]
test eax, eax
je 0x62c462
cmp eax, 0x6f
jne 0x62c41a
push dword [ebp - 4]
push dword [esi]
call fcn.005a79e0
add esp, 8
mov dword [esi], eax
test eax, eax
je 0x62c3ef
inc edi
mov ebx, 0xfe0e0011
cmp edi, 5
jl 0x62c3b0
jmp 0x62c442
push 0
push 0
push 0x8007000e
push str.realloc
push 0x45
push 0x3e6
push str.C:_temp_build_thehoffQuicksilver_fcs0.742171161775Quicksilver_fcs_vpnCommonUtilityNetInterface_win.cpp
push str.CNetInterface::getAdaptersAddrsInternal
call fcn.00612830
mov ebx, 0xfe0e0004
jmp 0x62c43f
push 0
push 0
push eax
push str.::GetAdaptersAddresses
push 0x45
push 0x3f0
push str.C:_temp_build_thehoffQuicksilver_fcs0.742171161775Quicksilver_fcs_vpnCommonUtilityNetInterface_win.cpp
push str.CNetInterface::getAdaptersAddrsInternal
call fcn.00612830
mov ebx, 0xfe0e000b
add esp, 0x20
mov eax, dword [esi]
test eax, eax
je 0x62c464
push eax
call fcn.0059a280
add esp, 4
mov dword [esi], 0
mov eax, ebx
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0xc
xor ebx, ebx
pop edi
mov eax, ebx
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x62ff90
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
je 0x62ffc2
push dword [ebp + 8]
push 0
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, 0x102
je 0x630045
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [ebp + 8]
mov dword [ebp - 4], eax
xor eax, eax
test esi, esi
je 0x630045
push 0x4ff
mov ecx, esi
sub ecx, eax
push ecx
push 0
push ebx
push edi
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp eax, edi
jne 0x63004a
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x63001c
cmp dword [ebp - 0x1c], 0x12
je 0x630035
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 4]
cmp eax, esi
jb 0x62ffd4
pop edi
pop esi
mov eax, 0x102
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 0x12
push 0
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, 0x102
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6304d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp byte [esi + 4], 0
je 0x6304e6
mov eax, 0xfe34000d
pop esi
pop ebp
ret 8
push edi
lea edi, [esi + 0x14]
mov byte [esi + 4], 1
push edi
push 0
push dword [ebp + 0xc]
push 0x630490
push dword [esi + 0xc]
push 0
call fcn.005a7b9c
add esp, 0x18
mov dword [esi + 0x18], eax
test eax, eax
jne 0x630542
push eax
push eax
mov byte [esi + 4], al
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.::_beginthreadex
push 0x45
push 0x102
push str.C:_temp_build_thehoffQuicksilver_fcs0.742171161775Quicksilver_fcs_vpnCommonUtilityThread.cpp
push str.CThread::createThread
call fcn.00612830
add esp, 0x20
mov eax, 0xfe34000a
pop edi
pop esi
pop ebp
ret 8
push dword [edi]
push str.The_thread__0x_.8X__has_been_successfully_created.
push 0x49
push 0x107
push str.C:_temp_build_thehoffQuicksilver_fcs0.742171161775Quicksilver_fcs_vpnCommonUtilityThread.cpp
push str.CThread::createThread
call fcn.006129f0
add esp, 0x18
xor eax, eax
pop edi
pop esi
pop ebp
ret 8

Function at 0x630570
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 4], 0
je 0x630617
cmp byte [esi + 0x10], 0
jne 0x6305f7
lea eax, [ebp - 4]
push eax
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
jne 0x6305bf
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x753354
push 0x45
push 0x99
push str.C:_temp_build_thehoffQuicksilver_fcs0.742171161775Quicksilver_fcs_vpnCommonUtilityThread.cpp
push str.CThread::StaticKill
call fcn.00612830
add esp, 0x20
cmp dword [ebp - 4], 0x103
jne 0x6305f7
push dword [esi + 0x14]
push str.Terminating_thread__0x_.8X__that_is_still_running_unexpectedly.
push 0x57
push 0x9f
push str.C:_temp_build_thehoffQuicksilver_fcs0.742171161775Quicksilver_fcs_vpnCommonUtilityThread.cpp
push str.CThread::StaticKill
call fcn.006129f0
add esp, 0x18
push 0x8000ffff
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi + 0x18]
test eax, eax
je 0x630605
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [esi + 4], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x6341e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x78a6d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.CExceptionHandlerEx_0x_.8X
lea eax, [ebp - 0x54]
push 0x28
push eax
call fcn.0062e730
add esp, 0x10
lea eax, [ebp - 0x54]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x795e58], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x795e58], 0
mov esi, eax
je 0x63435c
cmp esi, 0xb7
jne 0x634279
lea eax, [ebp - 0x54]
push eax
push str.Mutex_lock_already_exists___ls__for_this_process.
push 0
push esi
push str.CExceptionHandlerEx::InstallGlobalExceptionHandler
push 0x49
push 0x9a
push str.C:_temp_build_thehoffQuicksilver_fcs0.742171161775Quicksilver_fcs_vpnCommonUtilityWinMinidump.cpp
push str.CExceptionHandlerEx::InstallGlobalExceptionHandler
call fcn.00612830
add esp, 0x24
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058a893
mov esp, ebp
pop ebp
ret
push ecx
push str.Dbghelp.dll
mov ecx, 0x795e30
call fcn.00633510
test eax, eax
jne 0x6342ba
push ecx
push str.MiniDumpWriteDump
push 0x795998
mov ecx, 0x795e30
call fcn.006335f0
test eax, eax
je 0x6342ba
mov eax, 0x80004005
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058a893
mov esp, ebp
pop ebp
ret
push 0
mov byte [0x795e5c], 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x7959a0
push 0x104
mov dword [0x795e60], eax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x7959a0
call fcn.0059a3bd
add esp, 4
cmp word [eax*2 + 0x79599e], 0x5c
jne 0x634336
push 0x7959a0
call fcn.0059a3bd
add esp, 4
lea eax, [eax*2 - 2]
cmp eax, 0x208
jae 0x6343a4
xor ecx, ecx
push 0x7959a0
mov word [eax + 0x7959a0], cx
call fcn.0059a3bd
add esp, 4
cmp word [eax*2 + 0x79599e], 0x5c
je 0x6342f6
push 0x6341a0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov dword [0x795994], eax
call fcn.00633790
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058a893
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x54]
push eax
push str.Mutex_lock___ls__could_not_be_created
push 0
push esi
push str.CExceptionHandlerEx::InstallGlobalExceptionHandler
push 0x45
push 0xa4
push str.C:_temp_build_thehoffQuicksilver_fcs0.742171161775Quicksilver_fcs_vpnCommonUtilityWinMinidump.cpp
push str.CExceptionHandlerEx::InstallGlobalExceptionHandler
call fcn.00612830
add esp, 0x24
test esi, esi
jle 0x634393
movzx esi, si
or esi, 0x80070000
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0058a893
mov esp, ebp
pop ebp
ret
call fcn.0058afbb
int3