joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401dc8
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
mov ebx, dword [ebp + 8]
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00404e1c
add esp, 0xc
mov dx, word [ebp + 0xc]
push edx
call sub.WSOCK32.DLL_htons
mov word [ebp - 0x12], ax
mov word [ebp - 0x14], 2
push 0
call sub.WSOCK32.DLL_htonl
mov dword [ebp - 0x10], eax
mov byte [ebp - 1], 1
push 1
lea ecx, [ebp - 1]
push ecx
push 4
push 0xffff
push ebx
call sub.WSOCK32.DLL_setsockopt
push 0x10
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.WSOCK32.DLL_bind
test eax, eax
jge 0x401e48
push str.____Socket_bind_error.
push 0x442bec
call fcn.00401654
add esp, 8
push 0x442bec
call fcn.004015f0
pop ecx
xor eax, eax
jmp 0x401e77
push 5
push ebx
call sub.WSOCK32.DLL_listen
test eax, eax
jge 0x401e75
push str.____Listen_error.
push 0x442bec
call fcn.00401654
add esp, 8
push 0x442bec
call fcn.004015f0
pop ecx
xor eax, eax
jmp 0x401e77
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402760
Capabilities:
Connect socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push dword [ebp + 0xc]
call sub.WSOCK32.DLL_gethostbyname
mov ebx, eax
test eax, eax
jne 0x402779
xor eax, eax
jmp 0x4027c2
push 0x10
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.00404e1c
add esp, 0xc
mov word [ebp - 0x10], 2
mov cx, word [ebp + 0x10]
push ecx
call sub.WSOCK32.DLL_htons
mov word [ebp - 0xe], ax
mov eax, dword [ebx + 0xc]
mov edx, dword [eax]
mov ecx, dword [edx]
mov dword [ebp - 0xc], ecx
push 0x10
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call sub.WSOCK32.DLL_connect
test eax, eax
jge 0x4027bd
xor eax, eax
jmp 0x4027c2
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403bb8
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret

Function at 0x406898
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
cmp esi, dword [0x43a614]
jb 0x4068bc
push 6
call fcn.00406c04
pop ecx
jmp 0x406941
mov ebx, dword [esi*4 + 0x4427c4]
push 0x24
push 0
push edi
call fcn.00404e1c
add esp, 0xc
push ebx
call sub.KERNEL32.DLL_GetFileType
dec eax
je 0x4068e9
dec eax
je 0x4068e1
dec eax
je 0x406939
jmp 0x40693f
mov word [edi + 4], 0x2000
jmp 0x40693f
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 8]
push edx
lea ecx, [ebp - 0x10]
push ecx
push ebx
call sub.KERNEL32.DLL_GetFileTime
dec eax
je 0x406905
call fcn.00406c68
jmp 0x406941
push 0
push ebx
call sub.KERNEL32.DLL_GetFileSize
push eax
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 8]
push edx
lea ecx, [ebp - 0x10]
push ecx
test byte [esi*4 + 0x43a619], 1
je 0x406928
xor eax, eax
jmp 0x40692d
mov eax, 1
push eax
push edi
call fcn.0040c08c
add esp, 0x18
jmp 0x40693f
mov word [edi + 4], 0x1000
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40a9e4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x40aa46
call fcn.0040a994
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.00404ef0
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.00404ef0
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x40aaa4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x43b5b0], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x40ab7e
cmp dword [0x43b5ac], 0
jne 0x40ab7e
cmp dword [0x43b7a0], 0
je 0x40ab38
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.0040a894
add esp, 8
mov ebx, eax
test eax, eax
jne 0x40ab1e
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.0040a894
add esp, 8
mov ebx, eax
test eax, eax
jne 0x40ab1e
lea ebx, [ebp - 0x84]
jmp 0x40ab1f
inc ebx
call fcn.0040aa60
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x40abb9
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x43b5b4
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.00404ef0
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x43b5b7
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x40abb9
cmp dword [0x43b5ac], 0
je 0x40ab98
cmp dword [0x43b5ac], 0xffffffff
je 0x40abb9
push esi
call dword [0x43b5ac]
pop ecx
mov eax, dword [0x43b5b0]
test eax, eax
je 0x40abb9
cmp dword [0x43b5b0], 0xffffffff
je 0x40abb9
cmp byte [eax], 0
je 0x40abb9
push esi
push eax
call fcn.0040a9e4
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40b3fc
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x442afc], 0
jne 0x40b47d
cmp dword [0x442b1c], 0
jne 0x40b42c
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x442b1c], eax
test eax, eax
jne 0x40b42c
push str.GetEnvironmentStrings_failed
call fcn.0040abd0
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x442b1c]
jmp 0x40b440
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.00404ef0
pop ecx
mov edi, eax
test eax, eax
jne 0x40b438
lea edi, [ebp + 1]
push edi
call fcn.00403170
pop ecx
mov ebx, eax
mov dword [0x442b00], ebx
test ebx, ebx
jne 0x40b46a
xor eax, eax
jmp 0x40b540
push edi
mov edx, dword [0x442b1c]
push edx
push ebx
call fcn.00404dac
add esp, 0xc
jmp 0x40b49d
xor esi, esi
mov ebx, dword [0x442afc]
jmp 0x40b497
push eax
call fcn.00404ef0
pop ecx
test eax, eax
jne 0x40b493
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40b487
lea ebx, [esi + 4]
push 4
mov dword [0x442b04], ebx
inc ebx
push ebx
call fcn.004029b8
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x40b4c0
xor eax, eax
jmp 0x40b540
cmp dword [0x442afc], 0
jne 0x40b4f1
xor esi, esi
mov ebx, dword [0x442b00]
mov eax, dword [esp]
mov ebp, eax
jmp 0x40b4e2
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.00404ef0
pop ecx
mov edi, eax
test eax, eax
jne 0x40b4d8
jmp 0x40b522
xor esi, esi
mov ebx, dword [0x442afc]
mov eax, dword [esp]
mov edi, eax
jmp 0x40b51c
push eax
call fcn.00404ef0
pop ecx
test eax, eax
je 0x40b511
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x40b515
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40b500
mov eax, dword [0x442afc]
test eax, eax
je 0x40b532
push eax
call fcn.00403180
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x442afc], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40e29c
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
lea eax, [ebp + 0xc]
push eax
mov edx, dword [ebp + 8]
push edx
push 0x1000
lea ecx, [ebp - 0x1000]
push ecx
call fcn.00407088
add esp, 0x10
lea eax, [ebp - 0x1000]
push eax
call sub.KERNEL32.DLL_OutputDebugStringA
mov esp, ebp
pop ebp
ret
Function at 0x40feec
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
lea ebx, [ebp + 8]
mov eax, 0x43d230
call fcn.00405160
mov word [ebp - 0x14], 8
mov edx, 0x43d5d0
mov ecx, dword [ebx]
mov dword [ecx], edx
mov eax, dword [ebx]
xor edx, edx
mov dword [eax + 4], edx
mov ecx, dword [ebx]
xor eax, eax
mov dword [ecx + 8], eax
mov edx, dword [ebx]
xor ecx, ecx
mov dword [edx + 0xc], ecx
mov eax, dword [ebx]
xor edx, edx
mov dword [eax + 0x10], edx
mov ecx, dword [ebx]
xor eax, eax
mov dword [ecx + 0x14], eax
mov edx, dword [ebx]
xor ecx, ecx
mov dword [edx + 0x18], ecx
mov eax, dword [ebx]
xor edx, edx
mov dword [eax + 0x1c], edx
mov ecx, dword [ebx]
add ecx, 0x20
push ecx
call fcn.00437458
pop ecx
inc dword [ebp - 8]
mov eax, dword [ebx]
xor edx, edx
mov dword [eax + 0x24], edx
mov ecx, dword [ebx]
xor eax, eax
mov dword [ecx + 0x28], eax
mov edx, dword [ebx]
xor ecx, ecx
mov dword [edx + 0x2c], ecx
mov eax, dword [ebx]
xor edx, edx
mov dword [eax + 0x30], edx
mov ecx, dword [ebx]
xor eax, eax
mov dword [ecx + 0x34], eax
mov edx, dword [ebx]
xor ecx, ecx
mov dword [edx + 0x38], ecx
mov eax, dword [ebx]
xor edx, edx
mov dword [eax + 0x3c], edx
mov ecx, dword [ebx]
xor eax, eax
mov dword [ecx + 0x40], eax
mov edx, dword [ebx]
xor ecx, ecx
mov dword [edx + 0x44], ecx
mov eax, dword [ebx]
add eax, 0x4c
push eax
call fcn.0040ee54
pop ecx
add dword [ebp - 8], 4
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
mov eax, dword [ebx]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x415b70
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
lea eax, [ebp - 4]
push eax
mov edx, dword [ebp + 8]
push edx
call sub.KERNEL32.DLL_GetFileSize
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x415b99
call sub.KERNEL32.DLL_GetLastError
test eax, eax
je 0x415b99
xor eax, eax
jmp 0x415b9c
mov eax, dword [ebp - 8]
pop ecx
pop ecx
pop ebp
ret

Function at 0x415ba0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
mov eax, 0x43e08c
push ebx
mov ebx, dword [ebp + 8]
call fcn.00405160
mov dword [ebx], 0xffffffff
xor edx, edx
mov dword [ebx + 8], edx
mov byte [ebx + 0xc], 0
mov byte [ebx + 0xd], 0
cmp dword [0x43e088], 0
jne 0x415be1
lea ecx, [ebp - 0x48]
push ecx
call sub.KERNEL32.DLL_GetSystemInfo
mov eax, dword [ebp - 0x44]
mov dword [0x43e088], eax
xor edx, edx
mov dword [ebx + 4], edx
cmp dword [0x43e088], 0
ja 0x415bf9
mov dword [0x43e088], 0x1000
mov ecx, dword [ebp - 0x24]
mov dword fs:[0], ecx
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x415ca0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
push 0
lea eax, [ebp - 4]
push eax
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
mov eax, dword [esi]
push eax
call sub.KERNEL32.DLL_ReadFile
test byte [esi + 8], 4
jne 0x415d70
cmp dword [ebp - 4], 0
je 0x415d70
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 4]
dec eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 0xc]
jmp 0x415d45
mov al, byte [ebx]
movsx edx, al
cmp edx, 0xd
je 0x415cf7
mov byte [edi], al
inc edi
jmp 0x415d44
cmp ebx, dword [ebp - 8]
jae 0x415d0b
movsx ecx, byte [ebx + 1]
cmp ecx, 0xa
je 0x415d44
mov byte [edi], 0xd
inc edi
jmp 0x415d44
mov byte [ebp - 9], 0x20
lea eax, [ebp - 0x10]
push 0
push eax
lea edx, [ebp - 9]
push 1
push edx
mov ecx, dword [esi]
push ecx
call sub.KERNEL32.DLL_ReadFile
cmp dword [ebp - 0x10], 0
je 0x415d37
push 1
push 0
push 0xffffffffffffffff
mov eax, dword [esi]
push eax
call sub.KERNEL32.DLL_SetFilePointer
movsx edx, byte [ebp - 9]
cmp edx, 0xa
je 0x415d44
mov byte [edi], 0xd
inc edi
inc ebx
cmp ebx, dword [ebp - 8]
ja 0x415d52
movsx ecx, byte [ebx]
cmp ecx, 0x1a
jne 0x415ce8
cmp ebx, dword [ebp - 8]
ja 0x415d6a
push 1
push 0
mov eax, dword [ebp - 8]
inc eax
sub eax, ebx
push eax
mov edx, dword [esi]
push edx
call sub.KERNEL32.DLL_SetFilePointer
sub edi, dword [ebp + 0xc]
mov dword [ebp - 4], edi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x415d7c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffffd4
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
test byte [eax + 8], 1
je 0x415da5
push 4
push 0
mov edx, dword [ebp + 8]
push edx
call fcn.00415ef4
add esp, 0xc
mov ecx, dword [ebp + 8]
test byte [ecx + 8], 4
je 0x415dcf
push 0
lea eax, [ebp - 4]
push eax
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
mov eax, dword [ebp + 8]
mov edx, dword [eax]
push edx
call sub.KERNEL32.DLL_WriteFile
mov eax, dword [ebp - 4]
jmp 0x415ec4
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x2c]
mov dword [ebp - 8], eax
lea ebx, [ebp - 0x102c]
mov edx, dword [ebp + 0xc]
add edx, dword [ebp + 0x10]
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], 0x1000
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 0x10]
jge 0x415dfb
lea eax, [ebp - 0x10]
jmp 0x415dfe
lea eax, [ebp + 0x10]
mov edi, dword [eax]
jmp 0x415e50
mov edi, dword [ebp - 0x14]
sub edi, esi
push edi
push esi
push ebx
call fcn.00404dac
add ebx, edi
xor ecx, ecx
inc edi
add esp, 0xc
mov byte [ebx], 0xd
inc ebx
add esi, edi
mov byte [ebx], 0xa
inc ebx
mov edx, dword [ebp - 8]
sub edx, ebx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x18]
jge 0x415e39
lea eax, [ebp - 0x18]
jmp 0x415e3c
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0xc]
sub edx, esi
mov dword [ebp - 0x20], edx
mov ecx, dword [eax]
cmp ecx, dword [ebp - 0x20]
jl 0x415e4e
lea eax, [ebp - 0x20]
mov edi, dword [eax]
test edi, edi
jle 0x415e67
push edi
push 0xa
push esi
call fcn.00404fc1
add esp, 0xc
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x415e02
test edi, edi
jle 0x415e7a
push edi
push esi
push ebx
call fcn.00404dac
add esp, 0xc
add ebx, edi
add esi, edi
lea eax, [ebp - 0x102c]
mov dword [ebp - 0x24], eax
sub ebx, eax
test ebx, ebx
je 0x415ebf
push 0
lea edx, [ebp - 0x28]
push edx
mov edi, ebx
push edi
mov eax, dword [ebp - 0x24]
push eax
mov edx, dword [ebp + 8]
mov ecx, dword [edx]
push ecx
call sub.KERNEL32.DLL_WriteFile
cmp edi, dword [ebp - 0x28]
je 0x415ebf
cmp dword [ebp - 0x28], 0
jne 0x415eb0
xor eax, eax
jmp 0x415eea
mov edx, dword [ebp - 0x28]
add dword [ebp - 0x24], edx
sub edi, dword [ebp - 0x28]
mov ebx, edi
test ebx, ebx
jne 0x415e89
mov eax, esi
sub eax, dword [ebp + 0xc]
cmp eax, dword [ebp + 0x10]
jne 0x415ecd
mov al, 1
jmp 0x415eea
test eax, eax
jle 0x415ee1
cmp eax, dword [ebp + 0x10]
jge 0x415ee1
sub dword [ebp + 0x10], eax
add dword [ebp + 0xc], eax
jmp 0x415d8c
xor eax, eax
jmp 0x415eea
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x415f84
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebx]
push eax
call sub.KERNEL32.DLL_CreateFileMappingA
mov esi, eax
mov dword [ebx + 4], esi
test esi, esi
je 0x415ff0
mov eax, dword [ebp + 0x10]
mov edx, edi
and edx, 0xffffffff
push eax
mov eax, edi
push edx
cdq
mov eax, edx
xor edx, edx
push eax
push 4
push esi
call sub.KERNEL32.DLL_MapViewOfFile
mov esi, eax
test esi, esi
je 0x415fde
push 1
add edi, dword [ebp + 0x10]
push edi
push ebx
call fcn.00415ef4
add esp, 0xc
test eax, eax
jge 0x415ff2
mov edx, dword [ebp + 0x10]
push edx
push esi
push ebx
call fcn.00415ffc
add esp, 0xc
xor esi, esi
jmp 0x415ff2
xor esi, esi
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0xf4f48c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
mov esi, ecx
mov dword [ebp - 8], esi
push dword [esi + 0x14]
call dword [0x1002e08c]
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [esi], eax
test ebx, ebx
jg 0xf4f4cd
lea eax, [ebp - 0x30]
push eax
call dword [0x1002e088]
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
mov eax, 1
cmove ebx, eax
test ebx, ebx
jle 0xf4f554
push edi
lea eax, [ebp - 0xc]
push eax
push 0
push esi
push 0x100016e0
push 0
push 0
call fcn.00f5e12d
mov edi, eax
add esp, 0x18
mov dword [ebp - 4], edi
test edi, edi
je 0xf4f54c
cmp edi, 0xffffffff
je 0xf4f54c
mov eax, dword [esi + 8]
lea ecx, [ebp - 4]
cmp ecx, eax
jae 0xf4f52e
mov ecx, dword [esi + 4]
lea edx, [ebp - 4]
cmp ecx, edx
ja 0xf4f52e
mov edi, edx
sub edi, ecx
sar edi, 2
cmp eax, dword [esi + 0xc]
jne 0xf4f51d
push ecx
lea ecx, [esi + 4]
call fcn.00f561cc
mov ecx, dword [esi + 8]
test ecx, ecx
je 0xf4f545
mov eax, dword [esi + 4]
mov eax, dword [eax + edi*4]
mov dword [ecx], eax
jmp 0xf4f545
cmp eax, dword [esi + 0xc]
jne 0xf4f53c
push ecx
lea ecx, [esi + 4]
call fcn.00f561cc
mov eax, dword [esi + 8]
test eax, eax
je 0xf4f545
mov dword [eax], edi
add dword [esi + 8], 4
mov esi, dword [ebp - 8]
dec ebx
jne 0xf4f4ce
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0xf52cdc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0x1003b180
mov esi, ecx
call dword [0x1002e0a8]
cmp dword [0x1003a178], 0xffffffff
je 0xf52d5b
cmp dword [0x1003a17c], 0xffffffff
jne 0xf52d5b
test esi, esi
je 0xf52d5b
push dword [0x1003a16c]
mov dword [0x1003b064], esi
mov esi, dword [0x1002e08c]
call esi
push dword [0x1003a168]
call esi
push dword [0x1003a164]
call esi
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x100037a0
push 0
push 0
call fcn.00f5e12d
add esp, 0x18
test eax, eax
jne 0xf52d70
push dword [0x1003a168]
call dword [0x1002e084]
mov dword [0x1003a17c], 0xffffffff
push 0x1003b180
or esi, 0xffffffff
call dword [0x1002e0a0]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
push dword [0x1003a164]
mov dword [0x1003a17c], eax
call dword [0x1002e080]
push 0x1003b180
xor esi, esi
call dword [0x1002e0a0]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x16586cc
Capabilities:
Create thread

Disassembly:
push ecx
lea eax, [esp]
push esi
push eax
xor eax, eax
push 4
push eax
push 0x1000ae3a
push eax
mov esi, ecx
push eax
call fcn.016b81c7
add esp, 0x18
mov dword [esi + 0x34], eax
pop esi
pop ecx
ret
Function at 0x165f455
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x1006ad14
call fcn.016b7fd0
push ecx
push ebx
push esi
mov esi, ecx
push 4
mov dword [ebp - 0x10], esi
or dword [esi], 0xffffffff
lea ebx, [esi + 4]
mov ecx, ebx
call fcn.0165f291
mov dword [ebx], 0x100717d0
xor ebx, ebx
mov dword [esi + 0x28], 4
mov dword [ebp - 4], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x18], 0x100717e8
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
mov byte [esi + 0x2c], 1
call fcn.0165f55c
lea ecx, [esi + 0x8c]
mov byte [esi + 0x88], bl
push 3
mov byte [ebp - 4], 2
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.0165803c
lea ecx, [esi + 0x9c]
mov byte [esi + 0x98], bl
mov byte [esi + 0x99], bl
push 3
mov byte [ebp - 4], 3
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.0165803c
lea ecx, [esi + 0xac]
mov byte [esi + 0xa8], bl
mov byte [esi + 0xa9], bl
mov byte [esi + 0xaa], bl
push 3
mov byte [ebp - 4], 4
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.0165803c
lea ecx, [esi + 0xb8]
push 3
mov byte [ebp - 4], 5
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.0165803c
mov ecx, dword [ebp - 0xc]
lea eax, [esi + 0xc4]
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], 8
mov dword [eax], 0x100717e0
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x165f55c
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x1006ad5f
call fcn.016b7fd0
push ecx
push ebx
push esi
push edi
push 3
mov esi, ecx
pop edi
xor ebx, ebx
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call fcn.0165803c
lea ecx, [esi + 0xc]
push edi
mov dword [ebp - 4], ebx
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.0165803c
lea ecx, [esi + 0x18]
push edi
mov byte [ebp - 4], 1
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.0165803c
lea ecx, [esi + 0x24]
push edi
mov byte [ebp - 4], 2
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.0165803c
lea ecx, [esi + 0x30]
push edi
mov byte [ebp - 4], 3
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.0165803c
lea ecx, [esi + 0x40]
mov byte [esi + 0x3c], bl
push edi
mov byte [ebp - 4], 4
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.0165803c
lea ecx, [esi + 0x4c]
push edi
mov byte [ebp - 4], 5
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.0165803c
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x1661ca4
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x1006b216
call fcn.016b7fd0
push ecx
push ebx
push esi
mov esi, ecx
push edi
xor ebx, ebx
push 3
lea ecx, [esi + 0xc]
mov dword [ebp - 0x10], esi
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.0165803c
lea edi, [esi + 0x24]
push 3
mov ecx, edi
mov dword [ebp - 4], ebx
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
call fcn.0165803c
push 0x100874c0
mov ecx, edi
mov byte [ebp - 4], 1
mov byte [esi], bl
mov dword [esi + 4], 0x10084850
call fcn.01657b6e
mov ecx, esi
mov dword [esi + 8], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
call fcn.01661f65
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x166c30e
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1006bf1b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi], 0x100720a0
mov dword [esi + 4], 0x10072090
mov dword [esi + 8], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x24], edi
mov dword [esp + 8], esi
mov dword [esi + 0x30], edi
lea ecx, [esi + 0x140]
mov dword [esp + 0x14], edi
call fcn.01669da6
lea eax, [esi + 0x6ff8]
mov dword [esi + 0x6fe4], edi
push eax
mov dword [esi + 0x6ff4], edi
call fcn.016b7b78
mov ecx, dword [esp + 0xc]
mov eax, 1
mov dword [esi + 0x7020], edi
mov dword [esi + 0x6fec], edi
mov dword [esi + 0x6ff0], edi
mov dword [esi + 0x7010], eax
mov byte [esi + 0x6fe0], al
mov dword [esi], 0x10072078
mov dword [esi + 4], 0x10072068
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x166f438
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 0x31
call fcn.0166eaf8
push 0x41
mov ecx, esi
call fcn.0166eaf8
push 0x59
mov ecx, esi
call fcn.0166eaf8
push 0x26
mov ecx, esi
call fcn.0166eaf8
push 0x53
mov ecx, esi
call fcn.0166eaf8
push 0x59
mov ecx, esi
call fcn.0166eaf8
mov ecx, dword [esp + 0x1c]
or eax, 0xffffffff
xor edi, edi
xor ebp, ebp
mov bl, byte [ecx]
mov byte [esp + 0x10], bl
mov edx, dword [esp + 0x1c]
cmp edi, 4
mov cl, byte [edx + ebp]
mov byte [esp + 0x14], cl
jne 0x166f4c8
test cl, cl
jbe 0x166f4c4
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
and edx, 0xff
and ecx, 0xff
mov edi, eax
shr edi, 0x18
xor edi, edx
shl eax, 8
mov edi, dword [edi*4 + 0x10087ef0]
xor eax, edi
dec ecx
jne 0x166f4ae
xor edi, edi
jmp 0x166f4f7
cmp bl, cl
jne 0x166f4cf
inc edi
jmp 0x166f4da
mov bl, cl
mov edi, 1
mov byte [esp + 0x10], bl
mov edx, dword [esp + 0x14]
mov ecx, eax
shr ecx, 0x18
and edx, 0xff
xor ecx, edx
shl eax, 8
mov ecx, dword [ecx*4 + 0x10087ef0]
xor eax, ecx
mov ecx, dword [esp + 0x20]
inc ebp
cmp ebp, ecx
jb 0x166f486
not eax
mov edi, eax
mov ecx, esi
push edi
call fcn.0166eb38
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push edx
push eax
mov ecx, esi
call fcn.0166ec38
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8