joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100370e0
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x1015a058
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
mov eax, dword [0x101b0cd0]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
cmp byte [edi + 0xa2], 0
je 0x100371ff
cmp byte [edi + 0xa1], 0
mov dword [esp + 0xc], 0
mov byte [esp + 0xb], 0
push 0
je 0x100371ad
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
xor eax, eax
mov dword [esp + 0x20], eax
push esi
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [esp + 0x10]
push eax
mov eax, dword [edi + 0xbc]
lea ecx, [esp + 0x10]
push ecx
push 1
lea edx, [esp + 0x17]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x100371a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x100371a4
mov eax, dword [edi + 0xbc]
push 1
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100371c6
mov eax, dword [edi + 0xbc]
lea ecx, [esp + 0x10]
push ecx
push 1
lea edx, [esp + 0x17]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push str.CPortLpt::WriteNullByte
lea eax, [esp + 0x14]
call fcn.10018050
push str.NULL_byte_write
lea ecx, [esp + 0x14]
push 0x1f3
mov dword [esp + 0x3c], 0
push ecx
mov ecx, dword [edi + 0x44]
call fcn.1001cc00
add esp, 0xc
lea ecx, [esp + 0x10]
call fcn.10018140
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x30
ret

Function at 0x100381f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1015cd68
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x101b0cd0]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
push str.CBXLParser::SetUseDevice
lea eax, [esp + 0xc]
call fcn.10018050
mov ecx, dword [esp + 0x34]
push str.over_deviceId
lea eax, [esp + 0xc]
mov dword [esp + 0x30], 0
mov ecx, dword [ecx + 0x2404]
push 0x126
push eax
call fcn.1001d480
add esp, 0xc
lea ecx, [esp + 8]
call fcn.10018140
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
add esp, 0x2c
ret 4
Function at 0x10038810
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x10159293
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101b0cd0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x40]
mov esi, ebp
call fcn.1003e710
xor ebx, ebx
mov dword [esp + 0x38], ebx
mov dword [ebp], vtable.CUsbObserver.0
mov dword [ebp + 0x48], vtable.CMap_class_ATL::CStringT_char__class_StrTraitMFC_char__class_ATL::ChTraitsCRT_char_____char_const___struct__OBSERVER_INFO____struct__OBSERVER_INFO___.0
mov dword [ebp + 0x4c], ebx
mov dword [ebp + 0x50], 0x11
mov dword [ebp + 0x54], ebx
mov dword [ebp + 0x58], ebx
mov dword [ebp + 0x5c], ebx
mov dword [ebp + 0x60], 0xa
mov byte [esp + 0x38], 1
mov dword [ebp + 0x40], ebx
mov eax, dword [ebp + 0x4c]
cmp eax, ebx
je 0x1003888b
push eax
call fcn.1004698d
add esp, 4
mov dword [ebp + 0x4c], ebx
xor ecx, ecx
mov eax, 0x10
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10046982
add esp, 4
mov dword [ebp + 0x4c], eax
cmp eax, ebx
jne 0x100388b5
call fcn.100490c5
push 0x40
push ebx
push eax
call fcn.10057070
add esp, 0xc
push ebx
push ebx
push ebx
mov dword [ebp + 0x50], 0x10
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp + 0x44], eax
push str.CUsbObserver
lea eax, [esp + 0x18]
call fcn.10018050
lea esi, [ebp + 4]
lea eax, [esp + 0x14]
cmp esi, eax
je 0x1003891a
mov edi, dword [esp + 0x1c]
mov eax, edi
cdq
idiv dword [esp + 0x24]
cmp eax, ebx
jle 0x10038914
push eax
call fcn.100184f0
cmp edi, ebx
jle 0x1003891a
mov ecx, dword [esp + 0x18]
push ecx
mov eax, esi
call fcn.10018600
jmp 0x1003891a
push ebx
call fcn.100184f0
lea ecx, [esp + 0x14]
call fcn.10018140
cmp dword [ebp + 0x30], ebx
jne 0x1003892f
mov dword [ebp + 0x30], 0x1003ea80
cmp dword [ebp + 0x3c], ebx
jne 0x10038937
mov dword [ebp + 0x3c], ebp
mov esi, ebp
mov dword [ebp + 0x2c], 0x64
call fcn.1003e7b0
mov eax, ebp
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4

Function at 0x1003b3d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1015c538
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
mov eax, dword [0x101b0cd0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [esp + 0x3c]
push eax
lea eax, [esp + 0x10]
call fcn.10018050
mov edx, dword [esp + 0x38]
mov ecx, eax
mov dword [esp + 0x30], 0
call fcn.1003b330
lea ecx, [esp + 0xc]
mov bl, al
call fcn.10018140
mov al, bl
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop ebx
add esp, 0x2c
ret 8
Function at 0x1003b530
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101597e1
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x101b0cd0]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
mov eax, dword [0x101b0cd0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x20], eax
mov ebx, edx
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov word [esp + 0x22], ax
mov dword [esp + 0x30], 1
mov eax, dword [ecx + 4]
lea ecx, [esp + 0x14]
push ecx
call fcn.1003ae30
test al, al
jne 0x1003b5a7
push 0x1019bc42
mov eax, esi
call fcn.10018050
jmp 0x1003b5ca
cmp word [esp + 0x22], 3
je 0x1003b5bd
push 0x1019bc42
mov eax, esi
call fcn.10018050
jmp 0x1003b5ca
lea edx, [esp + 0x14]
push edx
push esi
mov ecx, ebx
call fcn.1003b5f0
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.1005392f
add esp, 0x2c
ret
Function at 0x1003e520
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14c
mov eax, dword [0x101b0cd0]
xor eax, esp
mov dword [esp + 0x148], eax
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x24], edi
call fcn.1001a880
test al, al
jne 0x1003e566
mov eax, 0xffffff9d
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x148]
xor ecx, esp
call fcn.1005392f
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.SETUPAPI.dll_SetupDiClassGuidsFromNameA]
xor eax, eax
lea ecx, [esp + 0x14]
push ecx
push eax
push eax
push str.Ports
mov dword [esp + 0x24], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], eax
call esi
mov edx, dword [esp + 0x14]
shl edx, 4
push edx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, dword [esp + 0x14]
mov ebx, eax
lea eax, [esp + 0x14]
push eax
shl ecx, 4
push ecx
push ebx
push str.Ports
mov dword [esp + 0x38], ebx
call esi
push 2
push 0
push 0
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1003e6da
lea edx, [esp + 0x2c]
push edx
push 0
push ebx
mov dword [esp + 0x38], 0x1c
mov dword [esp + 0x28], 0
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x1003e6da
push 0x104
lea eax, [esp + 0x4c]
push 0
push eax
mov byte [esp + 0x1f], 0
mov dword [esp + 0x2c], 0x104
call fcn.10057070
add esp, 0xc
push 0x20019
push 1
push 0
push 1
lea ecx, [esp + 0x3c]
push ecx
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
mov esi, eax
cmp esi, 0xffffffff
je 0x1003e6bc
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x4c]
push eax
push 0
push 0
push str.PortName
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1003e68e
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
lea ecx, [esp + 0x48]
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1003e680
test dl, dl
je 0x1003e67c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1003e680
add eax, 2
add ecx, 2
test dl, dl
jne 0x1003e660
xor eax, eax
jmp 0x1003e685
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1003e68e
mov byte [esp + 0x13], 1
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [esp + 0x13], 0
je 0x1003e6bc
push 0
mov esi, edi
call fcn.100184f0
push edi
lea edi, [esp + 0x30]
mov esi, ebx
call fcn.1003e340
mov edi, dword [esp + 0x28]
add esp, 4
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x2c]
inc eax
push ecx
push eax
push ebx
mov dword [esp + 0x28], eax
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
jne 0x1003e5f1
mov edx, dword [esp + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov ecx, dword [esp + 0x154]
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1005392f
mov esp, ebp
pop ebp
ret
Function at 0x1003e7b0
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [esi + 0x24], 0
jne 0x1003e7c8
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov edx, dword [esi + 0x3c]
mov eax, dword [esi + 0x30]
lea ecx, [esp]
push ecx
push 0
push edx
push eax
push 0
push 0
mov byte [esi + 0x20], 0
mov dword [esi + 0x28], 1
mov dword [esp + 0x18], 0
call fcn.10058934
add esp, 0x18
test eax, eax
je 0x1003e80c
mov ecx, dword [esp]
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], ecx
pop ecx
ret

Function at 0x1003e810
Capabilities:
Suspend thread
Terminate thread

Disassembly:
sub esp, 8
push ebp
push esi
xor esi, esi
push edi
cmp dword [ebx + 0x34], esi
je 0x1003e860
mov eax, 2
cmp dword [ebx + 0x28], eax
je 0x1003e860
sub esp, 0x1c
mov edi, esp
sub esp, 0x1c
mov dword [ebx + 0x28], eax
mov eax, esp
mov dword [esp + 0x44], esp
lea esi, [ebx + 4]
mov ecx, 7
push str.XThread::Suspend
rep movsd dword es:[edi], dword [esi]
call fcn.10018050
call fcn.1001c8b0
mov eax, dword [ebx + 0x34]
add esp, 0x38
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
xor esi, esi
mov eax, dword [ebx + 0x24]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebx + 0x20], 1
cmp eax, esi
je 0x1003e881
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [ebx + 0x24]
push ecx
call ebp
mov dword [ebx + 0x24], esi
mov eax, dword [ebx + 0x34]
lea edx, [esp + 0xc]
push edx
push eax
mov dword [esp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [esp + 0xc], 0x103
jne 0x1003e8dc
sub esp, 0x1c
mov edi, esp
sub esp, 0x1c
mov eax, esp
mov dword [esp + 0x48], esp
lea esi, [ebx + 4]
mov ecx, 7
push str.XThread::StopThread
rep movsd dword es:[edi], dword [esi]
call fcn.10018050
call fcn.1001c8b0
mov ecx, dword [ebx + 0x34]
add esp, 0x38
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [ebx + 0x34]
push edx
call ebp
xor esi, esi
pop edi
mov dword [ebx + 0x34], esi
mov dword [ebx + 0x30], esi
mov dword [ebx + 0x3c], esi
pop esi
mov dword [ebx + 0x28], 3
pop ebp
add esp, 8
ret

Function at 0x1003ea30
Capabilities:
Resume thread

Disassembly:
push ecx
push esi
mov esi, eax
mov eax, dword [esi + 0x34]
push edi
test eax, eax
je 0x1003ea7a
mov edi, 1
cmp dword [esi + 0x28], edi
je 0x1003ea7a
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
sub esp, 0x1c
mov dword [esi + 0x28], edi
mov edi, esp
sub esp, 0x1c
mov eax, esp
mov dword [esp + 0x40], esp
add esi, 4
mov ecx, 7
push str.XThread::Resume
rep movsd dword es:[edi], dword [esi]
call fcn.10018050
call fcn.1001c8b0
add esp, 0x38
pop edi
pop esi
pop ecx
ret
Function at 0x10040bb0
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor eax, eax
or ecx, 0x100
push edi
lea ebx, [ebx]
mov ebx, ecx
shr ebx, 7
mov edi, ecx
shr edi, 8
movzx edi, word [esi + edi*2]
and ebx, 1
neg ebx
sar ebx, 4
shr edi, 4
and ebx, 0x7f
xor edi, ebx
add eax, dword [edx + edi*4]
add ecx, ecx
cmp ecx, 0x10000
jb 0x10040bc0
pop edi
pop ebx
ret

Function at 0x10040bf0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, eax
mov edx, 0x100
xor eax, eax
or ecx, edx
mov edi, edi
add esi, esi
mov ebx, edx
and ebx, esi
add ebx, edx
mov ebp, ecx
shr ebp, 8
add ebp, ebx
mov ebx, dword [esp + 0x10]
movzx ebx, word [ebx + ebp*2]
mov ebp, ecx
shr ebp, 7
and ebp, 1
neg ebp
shr ebx, 4
sar ebp, 4
and ebp, 0x7f
xor ebx, ebp
add eax, dword [edi + ebx*4]
add ecx, ecx
mov ebx, ecx
xor ebx, esi
not ebx
and edx, ebx
cmp ecx, 0x10000
jb 0x10040c00
pop esi
pop ebp
pop ebx
ret

Function at 0x10040d60
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov esi, eax
mov edi, ecx
xor eax, eax
lea edx, [eax + 1]
test edi, edi
je 0x10040da2
push ebx
push ebp
mov ebx, dword [esp + 0x14]
movzx ebx, word [ebx + edx*2]
mov ecx, esi
and ecx, 1
mov ebp, ecx
neg ebp
sar ebp, 4
and ebp, 0x7f
shr ebx, 4
xor ebx, ebp
mov ebp, dword [esp + 0x18]
add eax, dword [ebp + ebx*4]
add edx, edx
shr esi, 1
or edx, ecx
sub edi, 1
jne 0x10040d71
pop ebp
pop ebx
pop edi
pop esi
ret
Function at 0x10040ef0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
movzx eax, word [ebx]
mov ecx, eax
shr ecx, 4
mov edx, dword [esi + ecx*4]
movzx ecx, word [ebx + 2]
mov dword [esp], edx
mov edx, ecx
xor eax, 0x7f0
xor ecx, 0x7f0
shr edx, 4
mov edx, dword [esi + edx*4]
shr eax, 4
mov eax, dword [esi + eax*4]
shr ecx, 4
mov ecx, dword [esi + ecx*4]
add edx, eax
add ecx, eax
push ebp
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
xor edx, edx
push edi
cmp edx, dword [esp + 0x1c]
jae 0x10041063
mov eax, edx
or eax, 8
xor edi, edi
cmp eax, 1
je 0x10040f7a
lea ebx, [ebx]
mov ebp, dword [esp + 0x18]
mov ecx, eax
shr ecx, 1
and eax, 1
lea ebp, [ecx + ebp*8]
movzx ebp, word [ebx + ebp*2 + 4]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edi, dword [esi + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0x10040f50
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x20]
add edi, eax
mov dword [ecx + edx*4], edi
inc edx
cmp edx, 8
jb 0x10040f34
cmp edx, 0x10
jae 0x10040ffd
lea eax, [edx - 8]
mov dword [esp + 8], eax
lea esp, [esp]
cmp edx, dword [esp + 0x1c]
jae 0x10041063
or eax, 8
xor edi, edi
cmp eax, 1
je 0x10040fe1
mov ebp, dword [esp + 0x18]
mov ecx, eax
shr ecx, 1
and eax, 1
lea ebp, [ecx + ebp*8]
movzx ebp, word [ebx + ebp*2 + 0x104]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edi, dword [esi + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0x10040fb4
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x20]
add edi, eax
mov eax, dword [esp + 8]
mov dword [ecx + edx*4], edi
inc edx
inc eax
mov dword [esp + 8], eax
cmp edx, 0x10
jb 0x10040fa0
cmp edx, dword [esp + 0x1c]
jae 0x10041063
lea eax, [edx - 0x10]
mov dword [esp + 8], eax
lea ebx, [ebx]
or eax, 0x100
xor edi, edi
cmp eax, 1
je 0x10041046
lea esp, [esp]
mov ecx, eax
and eax, 1
shr ecx, 1
movzx ebp, word [ebx + ecx*2 + 0x204]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edi, dword [esi + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0x10041020
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
add edi, eax
mov eax, dword [esp + 8]
mov dword [ecx + edx*4], edi
inc edx
inc eax
mov dword [esp + 8], eax
cmp edx, dword [esp + 0x1c]
jb 0x10041010
pop edi
pop ebp
add esp, 0xc
ret
Function at 0x10042b10
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
xor esi, esi
lea eax, [edi + 0x3234c]
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
jmp 0x10042b30
xor edx, edx
lea ecx, [edx + 1]
mov dword [esp + 0xc], 4
lea ecx, [ecx]
movzx ebx, word [edi + ecx*2 + 0x329f0]
mov eax, esi
and eax, 1
mov ebp, eax
neg ebp
sar ebp, 4
shr ebx, 4
and ebp, 0x7f
xor ebx, ebp
add edx, dword [edi + ebx*4 + 0x30c9c]
add ecx, ecx
shr esi, 1
or ecx, eax
sub dword [esp + 0xc], 1
jne 0x10042b40
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
inc esi
mov dword [eax], edx
add eax, 4
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
cmp esi, 0x10
jb 0x10042b30
pop esi
pop ebp
mov dword [edi + 0x3238c], 0
pop ebx
add esp, 0xc
ret

Function at 0x10042ba0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x210
push ebx
push ebp
push edi
mov edi, 4
lea ebp, [esi + 0x30c9c]
movzx ebx, byte [esi + edi + 0x3049c]
mov ecx, ebx
mov edx, ebx
and edx, 1
shr ecx, 1
or edx, 2
dec ecx
shl edx, cl
mov eax, edi
push ebp
sub eax, edx
sub edx, ebx
lea edx, [esi + edx*2 + 0x3290a]
push edx
call fcn.10040d60
mov dword [esp + edi*4 + 0x24], eax
inc edi
add esp, 8
cmp edi, 0x80
jb 0x10042bb4
lea ebp, [esp + 0x1c]
sub ebp, esi
lea eax, [esi + 0x3270c]
lea ecx, [esi + 0x31b54]
sub ebp, 0x31b4c
lea edi, [esi + 0x3174c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], 4
jmp 0x10042c27
mov ecx, dword [esp + 0xc]
xor ebx, ebx
cmp dword [esi + 0x32390], ebx
jbe 0x10042c7f
mov eax, ebx
or eax, 0x40
xor edx, edx
cmp eax, 1
je 0x10042c73
lea ecx, [ecx]
mov ebp, dword [esp + 0x10]
mov ecx, eax
and eax, 1
shr ecx, 1
movzx ebp, word [ebp + ecx*2]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edx, dword [esi + ebp*4 + 0x30c9c]
mov eax, ecx
cmp eax, 1
jne 0x10042c40
mov ebp, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov dword [edi + ebx*4], edx
inc ebx
cmp ebx, dword [esi + 0x32390]
jb 0x10042c31
mov eax, 0xe
cmp dword [esi + 0x32390], eax
jbe 0x10042ca6
lea esp, [esp]
mov edx, eax
shr edx, 1
sub edx, 5
shl edx, 4
add dword [edi + eax*4], edx
inc eax
cmp eax, dword [esi + 0x32390]
jb 0x10042c90
mov eax, dword [edi]
mov dword [ecx - 8], eax
mov edx, dword [edi + 4]
mov dword [ecx - 4], edx
mov eax, dword [edi + 8]
mov dword [ecx], eax
mov edx, dword [edi + 0xc]
mov dword [ecx + 4], edx
mov eax, 4
add ecx, 8
jmp 0x10042cd0
movzx edx, byte [esi + eax + 0x3049c]
mov edx, dword [edi + edx*4]
add edx, dword [ecx + ebp]
inc eax
mov dword [ecx], edx
add ecx, 4
cmp eax, 0x80
jb 0x10042cd0
sub dword [esp + 0x10], 0xffffff80
add dword [esp + 0xc], 0x200
sub ebp, 0x200
add edi, 0x100
sub dword [esp + 0x18], 1
mov dword [esp + 0x14], ebp
jne 0x10042c23
pop edi
pop ebp
mov dword [esi + 0x3baf0], 0
pop ebx
add esp, 0x210
ret
Function at 0x10043dd0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov eax, edx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x101be178], ecx
inc edx
cmp edx, 0x100
jb 0x10043dd2
ret

Function at 0x10043e80
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
jbe 0x10043ea1
push esi
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x101be178]
dec ecx
inc edx
test ecx, ecx
ja 0x10043e85
pop esi
ret

Function at 0x10043fe0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
push esi
mov dword [eax + 0x30], edx
mov dword [eax + 0x20], edx
mov dword [eax + 0x2c], 0x20
mov dword [eax + 0x50], 1
mov dword [eax + 0x48], 4
mov dword [eax + 0x4c], edx
mov dword [eax + 0x54], edx
lea esi, [eax + 0x6c]
mov eax, edx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [esi], ecx
inc edx
add esi, 4
cmp edx, 0x100
jb 0x10044007
pop esi
ret
Function at 0x10046570
Capabilities:
Initialize winsock library

Disassembly:
push 0xffffffffffffffff
push 0x10159d29
mov eax, dword fs:[0]
push eax
sub esp, 0x1b8
mov eax, dword [0x101b0cd0]
xor eax, esp
mov dword [esp + 0x1b4], eax
push ebx
mov eax, dword [0x101b0cd0]
xor eax, esp
push eax
lea eax, [esp + 0x1c0]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esi], vtable.CIcmpHelper.0
mov dword [esp + 0xc], esi
mov dword [esi + 0xc], vtable.XStringA.0
mov dword [esi + 0x1c], 1
mov dword [esi + 0x10], ebx
cmp ebx, ebx
jne 0x100465e4
push 1
call fcn.10054f2b
add esp, 4
mov dword [esi + 0x10], eax
mov ecx, dword [esi + 0x1c]
push ecx
push ebx
push eax
call fcn.10057070
add esp, 0xc
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x1cc], ebx
push 0x202
mov dword [esi + 8], ebx
mov byte [esi + 4], bl
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x10046644
push str.CIcmpHelper::CIcmpHelper
lea eax, [esp + 0x14]
call fcn.10018050
push str.fail_WSAStartup
lea eax, [esp + 0x14]
push 0x49
push eax
mov byte [esp + 0x1d4], 1
call fcn.1001d2e0
add esp, 0xc
lea ecx, [esp + 0x10]
call fcn.10018140
mov eax, esi
mov ecx, dword [esp + 0x1c0]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x1b4]
xor ecx, esp
call fcn.1005392f
add esp, 0x1c4
ret
Function at 0x10046f17
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x160
mov eax, dword [0x101b0cd0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x800
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x11c], eax
mov esi, ecx
lea eax, [ebp - 0x120]
jne 0x10046fb5
push 0x1015e934
push 4
push eax
call fcn.10056eb8
push eax
call fcn.10015ea0
add esp, 0x10
push ebx
push edi
call fcn.10056454
mov edi, dword [eax]
call fcn.10056454
xor ebx, ebx
mov dword [eax], ebx
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x11c]
lea eax, [ebp - 0x118]
push esi
push 0x111
mov esi, 0x112
push esi
push eax
call fcn.10057046
add esp, 0x18
mov dword [ebp - 0x11c], eax
call fcn.10056454
cmp dword [eax], ebx
je 0x10046fcc
call fcn.10056454
push dword [eax]
call fcn.10046e72
pop ecx
jmp 0x10046fd3
push 4
push eax
push 3
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x10046f5d
jmp 0x1004705a
call fcn.10056454
mov dword [eax], edi
cmp dword [ebp - 0x11c], 0xffffffff
je 0x10047056
cmp dword [ebp - 0x11c], esi
jae 0x10047056
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push 0x3c
mov esi, eax
lea eax, [ebp - 0x15c]
push ebx
push eax
mov dword [ebp - 0x160], 0x40
call fcn.10057070
add esp, 0xc
push str.KERNEL32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, ebx
je 0x10047045
push str.FindActCtxSectionStringA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x10047045
lea ecx, [ebp - 0x160]
push ecx
push esi
push 2
push ebx
push ebx
call eax
test eax, eax
je 0x10047045
push ebx
push ebx
push esi
jmp 0x1004704e
push ebx
push ebx
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
jmp 0x10047058
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1005392f
leave
ret

Function at 0x1005392f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x101b0cd0]
jne 0x10053939
repz ret
jmp fcn.100599ff