joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10af980
Capabilities:
Get disk information
Get disk size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x428
push ebx
push esi
push edi
push 0x20a
xor esi, esi
lea eax, [ebp - 0x428]
push esi
push eax
call sub.msvcrt.dll_memset
push 0x20a
lea ecx, [ebp - 0x21c]
push esi
push ecx
call sub.msvcrt.dll_memset
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
add esp, 0x18
push edi
push ebx
call fcn.010af8f0
push 0x103
lea edx, [ebp - 0x21c]
push edx
push esi
push esi
mov dword [ebp + 8], eax
lea eax, [ebp + 0xc]
push eax
push 0x103
lea ecx, [ebp - 0x428]
push ecx
push edi
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationW]
test eax, eax
jne 0x10afa08
push 0x20a
lea edx, [ebp - 0x21c]
push esi
push edx
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp + 0xc], esi
push esi
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x10]
push ecx
push edi
call dword [sym.imp.KERNEL32.DLL_GetDiskFreeSpaceExW]
test eax, eax
jne 0x10afa28
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
push 0x31
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x10afab1
mov edx, dword [ebp + 8]
push edi
mov dword [esi], edx
call fcn.0107d320
mov dword [esi + 4], eax
lea eax, [ebp - 0x428]
push eax
call fcn.0107d320
lea ecx, [ebp - 0x21c]
push ecx
mov dword [esi + 8], eax
call fcn.0107d320
mov dword [esi + 0xc], eax
mov edx, dword [ebp + 0xc]
mov dword [esi + 0x10], edx
mov eax, dword [ebp - 0x10]
mov dword [esi + 0x18], eax
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x1c], ecx
mov edx, dword [ebp - 8]
mov dword [esi + 0x20], edx
mov eax, dword [ebp - 4]
mov dword [esi + 0x24], eax
mov eax, dword [ebx + 0x3041c]
test eax, eax
je 0x10afaa5
mov dword [eax + 0x28], esi
pop edi
mov dword [ebx + 0x3041c], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [ebx + 0x30418], esi
mov dword [ebx + 0x3041c], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10b7450
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, 0x5a
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov eax, dword [edi]
mov eax, dword [eax]
mov ecx, dword [eax + 0x16c8]
mov edx, dword [eax + 0x16cc]
mov dword [ebp - 0x20], ecx
mov ecx, dword [eax + 0x16d0]
mov dword [ebp - 0x1c], edx
mov edx, dword [eax + 0x16d4]
mov eax, dword [eax + 0x1e44]
push 0x4d1
push 8
mov dword [ebp - 8], 0x64
mov dword [ebp - 4], 0x1a2
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], edx
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
xor ebx, ebx
cmp esi, ebx
je 0x10b7540
mov ecx, dword [ebp + 8]
mov dword [esi], 0xa
cmp ecx, ebx
je 0x10b74e8
lea eax, [esi + 0x20]
cmp eax, ebx
je 0x10b74e8
push 0x1ff
push ecx
push eax
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0xc
mov eax, 1
mov dword [esi + 0x1c], eax
mov dword [esi + 0x42c], eax
mov dword [esi + 0x424], ebx
mov dword [esi + 0x428], 0x99e0d3
mov dword [esi + 0x430], ebx
mov dword [esi + 0x434], 9
mov dword [esi + 0x438], ebx
mov ecx, 0x2d
mov eax, 0x93
mov dword [esi + 4], ecx
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x2bc
mov dword [esi + 0x10], 0x14
mov dword [esi + 0x14], ecx
mov dword [esi + 0x18], eax
mov dword [esi + 0x4ac], ebx
mov dword [esi + 0x498], 0x1c
mov dword [esi + 0x49c], ebx
mov dword [esi + 0x4a0], 4
mov eax, dword [edi + 0x88]
cmp dword [eax], ebx
jne 0x10b756e
mov dword [eax], esi
jmp 0x10b7577
mov ecx, dword [eax + 4]
mov dword [ecx + 0x4c8], esi
push 0x43001
push ebx
push 1
push ebx
push ebx
push ebx
push 0x420
push 0x2c7
push 0xaf
push 0x2d
push ebx
push ebx
push 0x1080330
push ebx
mov edx, dword [edi + 0x88]
push ebx
push 0x10ab8c0
push ebx
push ebx
push ebx
push ebx
push 0x16
push 0xe
lea eax, [ebp - 0x10]
push eax
push 4
lea ecx, [ebp - 0x20]
push ecx
push edi
mov dword [edx + 4], esi
call fcn.0105f7e0
mov dword [eax + 0x4ac], ebx
mov dword [eax + 0x498], 0x1c
mov dword [eax + 0x49c], ebx
mov dword [eax + 0x4a0], 4
mov ecx, dword [edi + 0x88]
cmp dword [ecx], ebx
jne 0x10b75f0
mov dword [ecx], eax
jmp 0x10b75f9
mov edx, dword [ecx + 4]
mov dword [edx + 0x4c8], eax
mov ecx, dword [edi + 0x88]
mov dword [ecx + 4], eax
mov edx, dword [edi]
lea ecx, [ebp + 8]
push ecx
push ebx
mov dword [edx + 0x25fc0], eax
mov eax, dword [edi]
mov edi, dword [edi + 4]
push eax
push fcn.010acd30
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
cmp eax, ebx
je 0x10b762f
mov edx, dword [edi + 0x1c8]
push eax
call edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10b7a30
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor ebx, ebx
push 0x402
push 8
test esi, esi
je 0x10b7a7f
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov edi, eax
test edi, edi
je 0x10b7af8
mov eax, dword [ebp + 0xc]
push eax
add esi, 0x7fbc
push esi
push 0x1014590
push 0x103
push edi
call fcn.0102c510
add esp, 0x14
jmp 0x10b7ad2
mov ebx, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x10b7b01
push 0x103
push esi
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
mov edi, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10b7aa3
mov edx, dword [ebp + 0xc]
mov cx, word [0x10109ec]
push 0x1014588
push edx
push esi
mov word [edi], cx
call fcn.01084e00
push esi
push 0
mov edi, eax
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
test edi, edi
je 0x10b7b01
push edi
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
push edi
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 8
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8

Function at 0x10b7dd0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
je 0x10b7e94
mov eax, dword [ebp + 8]
push esi
push 0x1014740
push eax
call fcn.010b7a30
mov esi, eax
test esi, esi
je 0x10b7e8f
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 0x101472c
push esi
call edi
test eax, eax
jne 0x10b7e11
mov eax, fcn.01029d60
mov ebx, dword [ebp + 0xc]
push 0x101471c
push esi
mov dword [ebx + 0x3e4], eax
call edi
test eax, eax
jne 0x10b7e2b
mov eax, fcn.01029d60
push 0x101470c
push esi
mov dword [ebx + 0x3e8], eax
call edi
test eax, eax
jne 0x10b7e42
mov eax, fcn.01029d60
push 0x10146fc
push esi
mov dword [ebx + 0x3ec], eax
call edi
test eax, eax
jne 0x10b7e59
mov eax, fcn.01029d60
push 0x10146e8
push esi
mov dword [ebx + 0x3f0], eax
call edi
test eax, eax
jne 0x10b7e70
mov eax, fcn.01029d60
push 0x10146d0
push esi
mov dword [ebx + 0x400], eax
call edi
test eax, eax
jne 0x10b7e87
mov eax, fcn.01029d60
pop edi
mov dword [ebx + 0x3fc], eax
pop ebx
pop esi
pop ebp
ret 0xc
push 0x1014740
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
test eax, eax
je 0x10b7e90
push eax
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
pop ebp
ret 0xc
Function at 0x10b9f30
Capabilities:
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push 0x40
mov edi, eax
call fcn.0102b240
mov esi, dword [ebp + 8]
lea ebx, [esi + eax*4 + 8]
push ebx
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
push 0
push 1
push 0x40
push esi
call fcn.010b96d0
mov ecx, dword [esi + 0x1d8]
lea eax, [ebp - 0x10]
push eax
push 8
push edi
call ecx
test eax, eax
je 0x10ba010
push 0x44
lea edx, [ebp - 0x54]
push 0
push edx
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x54]
push ecx
push 0
push 0x1a
mov dword [ebp - 8], 0x44
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
je 0x10ba006
mov edi, dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x54]
push eax
push 0
call edi
test eax, eax
je 0x10ba006
cmp dword [ebp - 4], 0
jne 0x10ba006
cmp dword [esi + 0x8aec], 6
jb 0x10ba006
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push 4
lea edx, [ebp - 0xc]
push edx
push 0x13
push eax
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x10ba006
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x54]
push edx
push eax
call edi
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10ba3a0
Capabilities:
Acquire debug privileges

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x13c]
push edi
call eax
push eax
push esi
call fcn.010ba220
mov edi, eax
test edi, edi
je 0x10ba479
push 1
push 0x1015884
push edi
push esi
call fcn.010ba2a0
push 1
push 0x1015870
push edi
push esi
call fcn.010ba2a0
push 1
push 0x1015858
push edi
push esi
call fcn.010ba2a0
push 1
push 0x1015844
push edi
push esi
call fcn.010ba2a0
push 1
push 0x1015830
push edi
push esi
call fcn.010ba2a0
push 1
push 0x101581c
push edi
push esi
call fcn.010ba2a0
push 1
push 0x1015804
push edi
push esi
call fcn.010ba2a0
push 1
push 0x10157e8
push edi
push esi
call fcn.010ba2a0
push 1
push 0x10157cc
push edi
push esi
call fcn.010ba2a0
push 1
push 0x10157ac
push edi
push esi
call fcn.010ba2a0
push 1
push 0x101579c
push edi
push esi
call fcn.010ba2a0
push 1
push 0x1015784
push edi
push esi
call fcn.010ba2a0
push edi
push esi
call fcn.010ba150
push edi
push esi
call fcn.0102baa0
pop edi
pop esi
pop ebp
ret 4
Function at 0x10bc9c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 0x40
call fcn.0102b240
mov esi, dword [ebp + 8]
lea edi, [esi + eax*4 + 8]
push edi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
push 0
push 1
push 0x40
push esi
call fcn.010b96d0
mov eax, dword [esi + 0x158]
push connect
push 0
push 0
call eax
mov ebx, eax
test ebx, ebx
je 0x10bca7b
mov ecx, dword [ebp + 0xc]
mov edx, dword [esi + 0x14c]
push connect
push ecx
push ebx
call edx
mov edi, eax
test edi, edi
je 0x10bca6f
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [ebp + 8], eax
mov ecx, dword [esi + 0x150]
lea eax, [ebp - 0x20]
push eax
push edi
call ecx
test eax, eax
je 0x10bca3e
cmp dword [ebp - 0x1c], 4
je 0x10bca66
cmp dword [esi + 0x132b4], 0
jne 0x10bca66
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, dword [ebp + 8]
cmp eax, 0xea60
ja 0x10bca66
mov edx, dword [esi + 0x134]
push 0x1f4
call edx
jmp 0x10bca27
mov edx, dword [esi + 0x144]
push edi
call edx
mov eax, dword [esi + 0x144]
push ebx
call eax
mov edi, dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x10bd950
Capabilities:
Hash data with md5

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x10]
push eax
push ecx
push esi
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
call fcn.010bd7a0
push esi
call fcn.010bd870
pop esi
pop ebp
ret 0xc
Function at 0x10bda00
Capabilities:
Hash data with md5

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xb8
push ebx
push edi
xor edi, edi
push 0x2c
lea eax, [ebp - 0x50]
push edi
push eax
mov dword [ebp - 0x1c], edi
call sub.msvcrt.dll_memset
mov ecx, dword [ebp + 0x18]
mov ebx, dword [ebp + 0x10]
add esp, 0xc
push ecx
mov ecx, dword [ebp + 8]
xor eax, eax
lea edx, [ebp - 0x50]
push edx
push 7
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push eax
push ecx
mov dword [ebp - 0x50], ebx
call fcn.010379f0
test eax, eax
je 0x10bda94
mov edx, dword [ebp - 0x40]
xor edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x10], edx
mov edx, dword [ebp - 0x28]
xor edx, dword [ebp - 0x2c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0x14], 0x10
mov dword [ebp - 0x18], ebx
mov edx, dword [ebp + 0x14]
push edx
lea eax, [ebp - 0x18]
push eax
call fcn.01037600
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
push esi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], edi
mov dword [ebp + 0x18], edi
mov esi, ebx
cmp ebx, 0x10000
jb 0x10bdac2
mov eax, 0xbacf914d
mul ebx
mov eax, ebx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
imul eax, eax, 0x25
sub esi, eax
add esi, 4
lea ecx, [ebp - 0x24]
push ecx
xor eax, eax
push ebx
lea edx, [ebp - 0x20]
push edx
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xb8], 0x67452301
mov dword [ebp - 0xb4], 0xefcdab89
mov dword [ebp - 0xb0], 0x98badcfe
mov dword [ebp - 0xac], 0x10325476
call fcn.01037b70
cmp eax, 0xffffffff
je 0x10bdb7e
mov dword [ebp + 8], edi
mov edi, dword [ebp - 0x24]
xor ecx, ecx
mov edx, eax
mov ebx, ecx
add edx, esi
adc ecx, ebx
cmp ecx, ebx
mov ebx, dword [ebp + 0x10]
jg 0x10bdbbf
jl 0x10bdb30
cmp edx, ebx
ja 0x10bdbbf
mov ecx, dword [ebp + 0xc]
inc dword [ebp + 0x18]
add dword [ebp + 8], 0x3fd
push esi
add eax, ecx
push eax
lea edx, [ebp - 0xb8]
push edx
call fcn.010bd7a0
mov eax, dword [ebp + 0x18]
cmp eax, dword [ebp - 0x20]
jae 0x10bdb7b
xor edx, edx
lea eax, [edi + 0x936d]
mov ecx, 0x3fd
div ecx
add edx, dword [ebp + 8]
mov edi, edx
lea edx, [esi + edi]
cmp edx, ebx
jbe 0x10bdb74
mov edi, ebx
sub edi, esi
mov eax, edi
cmp edi, 0xffffffff
jne 0x10bdb11
mov edi, dword [ebp - 0x1c]
lea eax, [ebp - 0xb8]
push eax
call fcn.010bd870
mov ecx, dword [ebp - 0x60]
mov edx, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
mov dword [ebp - 0x14], 0x10
mov dword [ebp - 0x18], ebx
pop esi
test edi, edi
je 0x10bda7f
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
or edi, 0xffffffff
jmp 0x10bdb7e
Function at 0x10bdbd0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x14]
mov eax, dword [edi + 0x10]
mov ecx, dword [eax + 0x3c]
cmp esi, 0x30
jbe 0x10bdbff
cmp dword [eax + 0x1c], 0x58465352
jne 0x10bdbff
pop edi
mov eax, 0x1000002f
pop esi
mov esp, ebp
pop ebp
ret 4
push ebx
lea ebx, [esi - 0x10]
mov edx, 0x1e
cmp ecx, ebx
ja 0x10bdc97
cmp esi, 0x200
jb 0x10bdc97
add eax, ecx
movzx ecx, word [eax + 4]
mov ebx, 0x8664
cmp cx, bx
je 0x10bdd49
mov ebx, 0x200
cmp cx, bx
je 0x10bdd49
mov dword [edi + 0x4c], eax
movzx ecx, word [eax]
cmp ecx, 0x4550
jg 0x10bdc8c
je 0x10bdc69
sub ecx, 0x454c
je 0x10bdc60
sub ecx, 2
jne 0x10bdc97
mov dword [edi + 4], 0x1c
jmp 0x10bdc97
mov dword [edi + 4], 0x1b
jmp 0x10bdc97
push eax
mov ecx, 0x2000
push eax
push edi
test word [eax + 0x16], cx
je 0x10bdc7e
mov dword [edi + 4], 0x20
call fcn.01088150
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
cmp ecx, 0x5a4d
jne 0x10bdc97
mov dword [edi + 4], edx
mov dword [edi + 4], edx
cmp esi, 0x10000
jbe 0x10bdca7
mov esi, 0x10000
mov eax, 0xcccccccd
mul esi
mov ecx, edx
mov eax, 0x24924925
mul esi
mov eax, esi
sub eax, edx
shr eax, 1
add eax, edx
lea ebx, [edi + 8]
push ebx
shr eax, 2
shr ecx, 3
push eax
mov eax, dword [edi + 0x10]
mov dword [ebp - 4], ecx
add ecx, eax
push ecx
mov ecx, dword [edi + 0x5c]
mov edx, dword [ecx]
push edx
call fcn.01031840
mov eax, 0xaaaaaaab
mul esi
shr edx, 2
push ebx
push edx
mov dword [ebp + 8], edx
mov eax, 0xaaaaaaab
mul esi
mov eax, dword [edi + 0x5c]
mov ecx, dword [eax]
shr edx, 1
add edx, dword [edi + 0x10]
push edx
push ecx
call fcn.01031840
mov edx, dword [ebp + 8]
mov ecx, dword [edi + 0x5c]
push ebx
mov eax, esi
shr eax, 1
add eax, dword [edi + 0x10]
push edx
mov edx, dword [ecx]
push eax
push edx
call fcn.01031840
mov eax, 0xcccccccd
mul esi
sub esi, dword [ebp - 4]
mov eax, dword [edi + 0x5c]
add esi, dword [edi + 0x10]
mov ecx, dword [eax]
push ebx
shr edx, 4
push edx
push esi
push ecx
call fcn.01031840
pop ebx
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 4
or eax, 0xffffffff
pop ebx
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi], 1
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10bed20
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
push edi
push 0x40
call fcn.0102b240
mov ebx, dword [ebp + 8]
lea eax, [ebx + eax*4 + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
xor edi, edi
push edi
push 1
push 0x40
push ebx
call fcn.010b96d0
push 0x41
lea ecx, [ebp - 0x50]
push edi
push ecx
call sub.msvcrt.dll_memset
mov esi, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [edx], 0x20
mov eax, 0xaaaaaaaa
mov dword [esi], eax
add esp, 0xc
mov dword [esi + 4], eax
mov dword [esi + 8], eax
push edi
mov dword [esi + 0xc], eax
push edi
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
push edi
mov dword [esi + 0x18], eax
push edi
mov dword [esi + 0x1c], eax
mov edx, dword [ebx + 0x1a0]
lea eax, [ebp - 8]
push eax
push edi
push edi
lea ecx, [ebx + 0x87f6]
push ecx
mov dword [ebp - 0xc], edi
mov dword [ebp + 8], edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call edx
push ebx
call fcn.010baba0
mov edi, eax
test edi, edi
je 0x10bee14
mov eax, dword [ebx + 0x114]
push edi
call eax
cmp byte [eax], 4
jb 0x10bee0b
mov ecx, dword [ebx + 0x130]
push 1
push edi
call ecx
mov edx, dword [ebx + 0x130]
push 2
push edi
mov dword [ebp + 0x10], eax
call edx
push 3
mov dword [ebp + 0xc], eax
mov eax, dword [ebx + 0x130]
push edi
call eax
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x10bedf6
mov ecx, dword [ecx]
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x10bee02
mov edx, dword [ecx]
mov dword [ebp + 8], edx
test eax, eax
je 0x10bee0b
mov eax, dword [eax]
mov dword [ebp - 4], eax
mov ecx, dword [ebx + 0x19c]
push edi
call ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov edi, dword [ebp - 0xc]
push edx
push eax
push edi
push 0x1015e14
lea ecx, [ebp - 0x50]
push 0x3f
push ecx
call fcn.0102c510
add esp, 0x18
test edi, edi
jne 0x10bee5f
cmp dword [ebp + 8], edi
jne 0x10bee5f
cmp dword [ebp - 4], edi
jne 0x10bee5f
mov eax, 0xabababab
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
jmp 0x10beeb8
lea eax, [ebp - 0x50]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10bee65
sub eax, edx
cmp eax, 0x20
jbe 0x10bee76
mov byte [ebp - 0x30], cl
mov dx, word [0x1015e10]
lea ecx, [ecx]
lea eax, [ebp - 0x50]
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10bee86
sub eax, edi
cmp eax, 0x20
jae 0x10beea5
lea edi, [ebp - 0x50]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10bee98
mov word [edi], dx
jmp 0x10bee80
test esi, esi
je 0x10beeb8
push 0x20
lea edx, [ebp - 0x50]
push edx
push esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov ecx, dword [ebp - 8]
xor eax, eax
lea ecx, [ecx]
mov edx, dword [eax + esi]
xor edx, ecx
mov edi, ecx
mov cl, byte [eax + esi]
rol edi, cl
mov dword [eax + esi], edx
add eax, 4
mov ecx, edi
cmp eax, 0x20
jb 0x10beec0
add ebx, 0x20
push ebx
mov dword [ebp - 8], ecx
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10c2b30
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push 0x21
push 8
mov ebx, 3
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x10c2be0
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
push edi
mov dword [esi + 4], ecx
mov ecx, dword [ebp + 0x18]
mov dword [esi + 0x10], ecx
lea ecx, [ebp + 0xc]
push ecx
push 0
push esi
mov dword [esi], eax
mov eax, dword [ebp + 0x14]
push 0x10c2af0
mov dword [esi + 8], edx
mov edx, dword [ebp + 0x1c]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0x20]
push 0
push 0
mov dword [esi + 0x14], edx
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ebx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov edi, eax
test edi, edi
je 0x10c2bcf
cmp edi, 0xffffffff
je 0x10c2bcf
push 0x1388
push edi
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
cmp eax, 0x102
jne 0x10c2bc5
mov edx, dword [ebp + 8]
mov dword [edx + 0x8d98], 1
mov ebx, dword [esi + 0x1c]
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 0x1c
Function at 0x10c3390
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xde0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi]
xor ebx, ebx
cmp dword [edi + 0x132b4], ebx
jne 0x10c3535
push 0x400
call fcn.0102b240
lea eax, [eax*4 + 8]
mov dword [ebp - 4], eax
add eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
push ebx
push 1
push 0x400
push edi
call fcn.010b96d0
mov eax, dword [esi]
mov edx, dword [eax + 0x2d4]
lea ecx, [ebp - 0x3dc]
push ecx
push 0x202
call edx
test eax, eax
jne 0x10c3529
mov eax, dword [ebp + 0x18]
lea ecx, [ebp + 8]
push ecx
mov dword [ebp + 8], eax
call dword [sym.imp.msvcrt.dll_localtime]
push 0x41
lea edx, [ebp - 0x48]
push ebx
push edx
mov edi, eax
call sub.msvcrt.dll_memset
push edi
push 0x1016c94
lea eax, [ebp - 0x48]
push 0x3f
push eax
call dword [sym.imp.msvcrt.dll_strftime]
push 0xa01
lea ecx, [ebp - 0xde0]
push ebx
push ecx
call sub.msvcrt.dll_memset
mov eax, dword [esi]
add esp, 0x2c
test dword [eax + 0x1d1ac], 0x4000
lea edi, [ebx + 1]
je 0x10c3453
mov edi, dword [ebp + 0x20]
mov ecx, dword [eax + 0x8b88]
mov edx, dword [ebp + 0xc]
push edx
mov edx, dword [eax + 0x8af4]
neg ecx
sbb ecx, ecx
and ecx, 0x20
add ecx, 0x20
push ecx
mov ecx, dword [ebp + 0x1c]
push edx
add eax, 0x362e
push eax
mov eax, 0x10624dd3
mul ecx
shr edx, 6
imul edx, edx, 0x3e8
sub ecx, edx
push ecx
lea eax, [ebp - 0x48]
push eax
push edi
push 3
push 1
push 0x1016c88
push 0x1016c28
lea ecx, [ebp - 0xde0]
push 0x7ff
push ecx
call fcn.0102c510
push 0x201
lea edx, [ebp - 0x24c]
push 0
push edx
call sub.msvcrt.dll_memset
mov ecx, dword [ebp + 0x28]
mov edx, dword [ebp + 0x24]
add esp, 0x40
lea eax, [ebp - 0x24c]
push eax
push ecx
push edx
push esi
call fcn.01046c70
test eax, eax
je 0x10c34f1
lea eax, [ebp - 0x24c]
push eax
lea ecx, [ebp - 0xde0]
push ecx
call fcn.0102c070
mov edx, dword [esi]
cmp dword [edx + 0x1f668], ebx
je 0x10c3508
lea eax, [ebp - 0xde0]
push eax
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push ecx
push edx
lea eax, [ebp - 0xde0]
push eax
push esi
call fcn.01046b20
mov ecx, dword [esi]
mov edx, dword [ecx + 0x258]
mov ebx, eax
call edx
mov eax, dword [esi]
add eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0x24