joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100205a0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov esi, ecx
lea eax, [ebp - 0x24]
push eax
push edx
call sub.shell32.dll_CommandLineToArgvW
test eax, eax
mov dword [ebp - 0x1c], eax
je 0x10020662
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x10], 0
test ebx, ebx
je 0x10020646
mov edi, dword [ebp - 0x1c]
shl ebx, 2
jmp 0x10020619
mov eax, dword [ebp - 0x14]
movsd xmm0, qword [ebp - 0x34]
movsd xmm1, qword [ebp - 0x2c]
mov ecx, esi
add edi, 4
inc esi
shl ecx, 4
add ebx, 0xfffffffc
movsd qword [eax + ecx + 8], xmm1
movsd qword [eax + ecx], xmm0
mov dword [ebp - 0x10], esi
je 0x10020646
push edi
call fcn.10041570
add esp, 4
push edx
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.10091010
add esp, 0xc
mov esi, dword [ebp - 0x10]
cmp esi, dword [ebp - 0x18]
jne 0x100205f0
lea eax, [ebp - 0x18]
push eax
call fcn.10024030
add esp, 4
jmp 0x100205f0
push dword [ebp - 0x1c]
call sub.kernel32.dll_LocalFree
movsd xmm0, qword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
movsd qword [ecx], xmm0
mov dword [ecx + 8], eax
jmp 0x10020676
mov dword [esi], 0
mov dword [esi + 4], 4
mov dword [esi + 8], 0
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x100215f0
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
movzx ebx, byte [ebp + 0x10]
mov esi, dword [ebp + 8]
cmp byte [ebp + 0xc], 0
je 0x10021670
xorps xmm0, xmm0
lea eax, [esp + 0x10]
movaps xmmword [esp + 0x10], xmm0
movaps xmmword [esp + 0x40], xmm0
movaps xmmword [esp + 0x30], xmm0
movaps xmmword [esp + 0x20], xmm0
mov dword [esp + 0x10], 0x40
push eax
call sub.kernel32.dll_GlobalMemoryStatusEx
test eax, eax
je 0x10021641
movups xmm0, xmmword [esp + 0x18]
movups xmmword [esi + 0x40], xmm0
jmp 0x10021670
call fcn.10047dc0
movups xmm0, xmmword [esp + 0x18]
test edx, edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 4], 1
movups xmmword [esi + 0x40], xmm0
je 0x10021670
lea eax, [esp + 0xc]
push eax
call fcn.10047d70
add esp, 4
test bl, bl
je 0x100216d9
xorps xmm0, xmm0
lea eax, [esp + 0x10]
movsd qword [esp + 0x40], xmm0
xorps xmm0, xmm0
movaps xmmword [esp + 0x30], xmm0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
push 0x38
push eax
call sub.kernel32.dll_K32GetPerformanceInfo
test eax, eax
je 0x100216d9
mov edi, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x38]
xor ecx, ecx
mov edx, 0
sub eax, edi
sbb edx, edx
cmovb eax, ecx
mul ebx
mov dword [esi + 0x50], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 0x54], edx
mov edx, 0
sub eax, edi
sbb edx, edx
cmovb eax, ecx
mul ebx
mov dword [esi + 0x5c], edx
mov dword [esi + 0x58], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100226c0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
lea edi, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push edi
push 0
push 5
call sub.kernel32.dll_GetComputerNameExW
xor ecx, ecx
test eax, eax
jne 0x100226f3
call fcn.10047dc0
mov ecx, 1
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1c], ecx
test ebx, ebx
je 0x10022754
lea esi, [ebx + ebx]
cmp ebx, 0x3fffffff
ja 0x10022832
push 2
push esi
call fcn.1000d0c0
add esp, 8
test eax, eax
je 0x1002283b
mov edi, eax
lea eax, [ebp - 0x10]
push eax
push edi
push 5
call sub.kernel32.dll_GetComputerNameExW
test eax, eax
je 0x1002276b
xor eax, eax
nop word cs:[eax + eax]
cmp word [edi + eax*2], 0
je 0x10022770
inc eax
add esi, 0xfffffffe
jne 0x10022740
mov esi, dword [ebp + 8]
mov eax, ebx
jmp 0x10022773
push edi
push 2
push 5
call sub.kernel32.dll_GetComputerNameExW
test eax, eax
je 0x100227d1
xor eax, eax
mov edi, 2
jmp 0x10022773
mov esi, dword [ebp + 8]
jmp 0x100227d6
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x28]
push eax
push edi
push ecx
call fcn.100d2690
add esp, 0xc
cmp dword [ebp - 0x28], 0x80000000
jne 0x10022796
mov dword [esi], 0x80000000
test ebx, ebx
jne 0x100227a9
jmp 0x100227b7
mov eax, dword [ebp - 0x20]
movsd xmm0, qword [ebp - 0x28]
mov dword [esi + 8], eax
movsd qword [esi], xmm0
test ebx, ebx
je 0x100227b7
add ebx, ebx
push 2
push ebx
push edi
call fcn.1000d080
add esp, 0xc
cmp dword [ebp - 0x1c], 0
je 0x10022828
cmp dword [ebp - 0x14], 0
je 0x10022828
lea eax, [ebp - 0x14]
push eax
call fcn.10047d70
add esp, 4
jmp 0x10022828
mov edi, 2
call fcn.10047dc0
test edx, edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x28], 1
je 0x100227f8
lea eax, [ebp - 0x20]
push eax
call fcn.10047d70
add esp, 4
test ebx, ebx
je 0x1002280a
add ebx, ebx
push 2
push ebx
push edi
call fcn.1000d080
add esp, 0xc
cmp dword [ebp - 0x1c], 0
je 0x10022822
cmp dword [ebp - 0x14], 0
je 0x10022822
lea eax, [ebp - 0x14]
push eax
call fcn.10047d70
add esp, 4
mov dword [esi], 0x80000000
mov eax, esi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
push esi
push eax
call fcn.100d0890
mov eax, 2
push esi
push eax
call fcn.100d0890
nop word [eax + eax]
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov edx, 0x10170e00
mov ecx, esi
push 0x12
call fcn.10023060
add esp, 4
mov eax, esi
pop esi
pop ebp
ret
Function at 0x10022b50
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, dword [ebp + 8]
call 0x10022b61
pop edi
lea ebx, [ebp - 0x30]
push ebx
call fcn.1003b040
add esp, 4
push ebx
call sub.kernel32.dll_GetSystemInfo
movzx eax, word [ebp - 0x30]
cmp eax, 0xe
ja 0x10022d6f
add edi, dword [eax*4 + 0x10022dac]
jmp edi
mov dword [esi], 0x80000000
mov eax, esi
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10026ba0
Capabilities:
List user account groups

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4c
mov eax, dword [ebp + 8]
mov edi, dword [eax + 8]
mov esi, dword [eax + 4]
mov dword [eax + 8], 0
test edi, edi
je 0x10026bec
add esi, 4
jmp 0x10026bd6
add esi, 0x10
dec edi
je 0x10026bec
mov eax, dword [esi - 4]
test eax, eax
je 0x10026bd0
push 1
push eax
push dword [esi]
call fcn.1000d080
add esp, 0xc
jmp 0x10026bd0
lea ebx, [ebp - 0x14]
mov dword [ebp - 0x38], 0
nop word cs:[eax + eax]
lea eax, [ebp - 0x38]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x3c], 0
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x24]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
push eax
push 0
push 0
call sub.netapi32.dll_NetGroupEnum
test eax, eax
je 0x10026c3f
cmp eax, 0xea
jne 0x10026dc0
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x10]
test edi, edi
je 0x10026da6
shl edi, 2
mov dword [ebp - 0x28], eax
jmp 0x10026c6c
add esi, 4
add edi, 0xfffffffc
je 0x10026da0
mov eax, dword [esi]
test eax, eax
je 0x10026c60
mov dword [ebp - 0x14], 0
push ebx
push 3
push eax
push 0
call sub.netapi32.dll_NetGroupGetInfo
test eax, eax
jne 0x10026d60
mov eax, dword [ebp - 0x14]
push dword [eax + 8]
lea eax, [ebp - 0x58]
push eax
call fcn.100126f0
add esp, 8
mov eax, dword [ebp - 0x58]
cmp eax, 0x80000000
je 0x10026d60
mov ecx, dword [esi]
mov edx, dword [ebp - 0x54]
mov dword [ebp - 0x34], eax
test ecx, ecx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x40], ecx
je 0x10026d76
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.10041590
add esp, 8
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x48]
mov ebx, 1
mov eax, 0
cmp ecx, 0x80000000
cmove edx, ebx
cmove ecx, eax
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp - 0x44]
mov dword [ebp - 0x20], ecx
cmove edx, eax
mov dword [ebp - 0x18], edx
mov edx, dword [ebp + 8]
mov ebx, dword [edx + 8]
cmp ebx, dword [edx]
jne 0x10026d13
push edx
call fcn.10024030
mov edx, dword [ebp + 8]
add esp, 4
mov eax, ebx
mov dword [ebp - 0x30], ebx
mov ecx, dword [edx + 4]
mov ebx, dword [ebp - 0x20]
shl eax, 4
mov dword [ecx + eax], ebx
mov ebx, dword [ebp - 0x1c]
mov dword [ecx + eax + 4], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ecx + eax + 8], ebx
mov dword [ecx + eax + 0xc], 0
mov eax, dword [ebp - 0x30]
lea ebx, [ebp - 0x14]
inc eax
mov dword [edx + 8], eax
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x10026d60
push 1
push eax
push dword [ebp - 0x2c]
call fcn.1000d080
add esp, 0xc
nop dword [eax]
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x10026c60
push eax
call sub.netapi32.dll_NetApiBufferFree
jmp 0x10026c60
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x18], 0
mov edx, dword [ebp + 8]
mov ebx, dword [edx + 8]
cmp ebx, dword [edx]
je 0x10026d07
jmp 0x10026d13
mov esi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x28]
cmp eax, 0xea
jne 0x10026dc3
test esi, esi
je 0x10026c00
push esi
call sub.netapi32.dll_NetApiBufferFree
jmp 0x10026c00
mov esi, dword [ebp - 0x10]
test esi, esi
je 0x10026dcd
push esi
call sub.netapi32.dll_NetApiBufferFree
add esp, 0x4c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1004a110
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov edi, dword [esi + 0x40]
xor edi, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.1004c3f0
add esp, 0xc
mfence
nop word cs:[eax + eax]
nop dword [eax + eax]
mov eax, dword [esi + 0xb8]
test eax, 0x10000
jne 0x1004a16c
mov ecx, eax
or ecx, 0x10000
lock cmpxchg dword [esi + 0xb8], ecx
jne 0x1004a140
mov eax, ecx
and eax, 0xff
jne 0x1004a177
pop esi
pop edi
pop ebp
ret
mov ecx, eax
mov eax, ecx
and eax, 0xff
je 0x1004a168
cmp edi, 1
ja 0x1004a183
movzx ecx, ch
cmp ecx, eax
jne 0x1004a168
add esi, 0xac
push 1
push esi
call fcn.1004ef10
add esp, 8
pop esi
pop edi
pop ebp
ret
Function at 0x1004cab0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov eax, dword [ebp + 8]
mov esi, dword [eax]
test esi, esi
je 0x1004cb39
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x1004cb31
je 0x1004cae6
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1004caea
mov edi, dword [eax]
mov dword [eax], 0
test edi, edi
je 0x1004caec
mov edi, dword [eax + 4]
jmp 0x1004caec
xor eax, eax
jmp 0x1004cb31
xor edi, edi
mov eax, dword [0x10194460]
movzx eax, byte [eax]
push 4
push 8
call fcn.1000d070
add esp, 8
test eax, eax
je 0x1004cb55
mov dword [eax], edi
mov dword [eax + 4], esi
push esi
mov ebx, eax
call sub.kernel32.dll_TlsGetValue
mov edi, eax
mov dword [ebp - 0x10], ebx
push ebx
push esi
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x1004cb2e
push 4
push 8
push edi
call fcn.1000d080
add esp, 0xc
mov eax, dword [ebp - 0x10]
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call fcn.100adc50
add esp, 4
mov esi, eax
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x1004cacc
jmp 0x1004cb31
push 8
push 4
call fcn.100d08b0
nop
Function at 0x1004cb60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov eax, dword [ebp + 8]
mov esi, dword [eax]
test esi, esi
je 0x1004cc1f
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x1004cc17
je 0x1004cc15
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1004cb9f
mov edi, dword [eax + 4]
cmp dword [eax], 0
mov dword [eax], 0
jne 0x1004cbaf
call fcn.10052b60
push eax
call fcn.10050ce0
add esp, 4
mov edi, eax
mov eax, dword [0x10194460]
movzx eax, byte [eax]
push 4
push 8
call fcn.1000d070
add esp, 8
test eax, eax
je 0x1004cc46
mov dword [eax], edi
mov dword [eax + 4], esi
push esi
mov ebx, eax
call sub.kernel32.dll_TlsGetValue
mov edi, eax
mov dword [ebp - 0x10], ebx
push ebx
push esi
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x1004cc10
mov eax, dword [edi]
mov ecx, dword [eax + 0x410]
lea edx, [ecx - 1]
mov dword [eax + 0x410], edx
cmp dword [eax + 0x40c], 0
jne 0x1004cc03
cmp ecx, 1
je 0x1004cc3b
push 4
push 8
push edi
call fcn.1000d080
add esp, 0xc
mov eax, dword [ebp - 0x10]
jmp 0x1004cc17
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call fcn.100adc50
add esp, 4
mov esi, eax
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x1004cb84
jmp 0x1004cc17
push eax
call fcn.10051800
add esp, 4
jmp 0x1004cc03
push 8
push 4
call fcn.100d08b0
nop
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x18
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
lea edx, [ebp - 0x14]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 4
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 4
mov dword [ebp - 0xc], 0
lea edi, [ebp - 0x20]
push edx
push edi
push ecx
push eax
call fcn.1004cd40
add esp, 0x10
movsd xmm0, qword [ebp - 0x10]
movsd xmm2, qword [ebp - 0x20]
movsd xmm1, qword [ebp - 0x18]
mov eax, esi
movsd qword [esi + 0x10], xmm0
movsd qword [esi + 8], xmm1
movsd qword [esi], xmm2
add esp, 0x18
pop esi
pop edi
pop ebp
ret

Function at 0x10055f30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
vmovdqa ymm0, ymmword [edx]
vpslld ymm0, ymm0, 2
vmovdqa ymmword [ecx], ymm0
pop ebp
vzeroupper
ret

Function at 0x10055f50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
vmovdqa ymm0, ymmword [edx]
vpsrld ymm0, ymm0, 0x1a
vmovdqa ymmword [ecx], ymm0
pop ebp
vzeroupper
ret

Function at 0x10055f70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
vmovdqa ymm0, ymmword [edx]
vpsrlq ymm0, ymm0, 0x20
vmovdqa ymmword [ecx], ymm0
pop ebp
vzeroupper
ret

Function at 0x10055f90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
vmovaps ymm0, ymmword [edx]
vblendps ymm0, ymm0, ymmword [eax], 0xe0
vmovaps ymmword [ecx], ymm0
pop ebp
vzeroupper
ret

Function at 0x10056030
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
vpermpd ymm0, ymmword [edx], 0x93
vmovaps ymmword [ecx], ymm0
pop ebp
vzeroupper
ret
Function at 0x100560b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
vbroadcastf128 ymm0, xmmword [edx]
vmovaps ymmword [ecx], ymm0
pop ebp
vzeroupper
ret

Function at 0x100560d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
vmovaps ymm0, ymmword [eax]
vpermps ymm0, ymm0, ymmword [edx]
vmovaps ymmword [ecx], ymm0
pop ebp
vzeroupper
ret

Function at 0x100560f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xa0
mov esi, dword [ebp + 8]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
movaps xmm0, xmmword [0x10176fe0]
mov dword [esp + 0x5c], 2
mov dword [esp + 0x44], 0x10177474
mov dword [esp + 0x48], 2
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov ecx, dword [esi + 4]
mov edx, dword [esi]
mov edi, dword [esi + 8]
movups xmmword [esp + 0x64], xmm0
movaps xmm0, xmmword [0x10176ff0]
mov dword [esp + 0x74], 8
mov byte [esp + 0x78], 3
mov dword [esp + 0x7c], 2
mov ebx, ecx
shl ecx, 0x1a
movups xmmword [esp + 0x84], xmm0
mov dword [esp + 0x94], 8
mov byte [esp + 0x98], 3
shr ebx, 6
mov eax, ecx
add eax, edx
mov eax, ebx
adc eax, 0
mov eax, edi
setb byte [esp + 7]
shr eax, 0xc
shl edi, 0x14
add ecx, edx
movzx edx, byte [esp + 7]
adc edi, ebx
mov ebx, dword [esi + 0xc]
mov esi, dword [esi + 0x10]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edi
adc edx, eax
mov eax, ebx
setb byte [esp + 7]
shl ebx, 0xe
shr eax, 0x12
add ebx, edx
movzx edx, byte [esp + 7]
mov dword [esp + 0x18], ebx
adc eax, edx
mov edx, esi
shr esi, 0x18
shl edx, 8
add edx, eax
lea eax, [esp + 0x20]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x38], 0x100ebdf0
adc esi, 0
mov dword [esp + 0x1c], edx
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x5c]
mov dword [esp + 0x20], esi
mov dword [esp + 0x40], 0x100ebdf0
mov dword [esp + 0x54], eax
lea eax, [esp + 0x34]
mov dword [esp + 0x58], 2
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x44]
mov dword [esp + 0x50], 2
push eax
push dword [esp + 0xc]
push dword [esp + 0x14]
call fcn.100df660
add esp, 0xc
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10059200
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov eax, dword [ebp + 8]
mov esi, dword [eax]
test esi, esi
je 0x100593b6
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x100593ae
je 0x100593ac
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x10059246
mov edi, dword [eax]
mov dword [eax], 0
test edi, edi
jne 0x10059348
xorps xmm0, xmm0
lea edi, [esp + 0x30]
lea ebx, [esp + 0x18]
movups xmmword [esp + 0x40], xmm0
movups xmmword [esp + 0x30], xmm0
push 0x20
push edi
push ebx
call fcn.1005eec0
add esp, 0xc
test eax, eax
jne 0x100593db
movups xmm0, xmmword [esp + 0x30]
movups xmm1, xmmword [esp + 0x40]
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x50], xmm1
push 4
push 0x101775bc
call fcn.1005aa00
add esp, 8
mov dword [esp + 0xc], eax
lea eax, [0x101775c0]
push 4
push eax
call fcn.1005aa00
add esp, 8
mov ebx, eax
mov eax, dword [0x10194460]
movzx eax, byte [eax]
push 8
push 0x158
call fcn.1000d070
add esp, 8
test eax, eax
je 0x10059422
mov edi, eax
mov dword [eax], 1
mov dword [eax + 4], 1
add eax, 8
push 0x100
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
movaps xmm0, xmmword [esp + 0x20]
movaps xmm2, xmmword [esp + 0x50]
mov eax, dword [esp + 0xc]
movaps xmm1, xmmword [0x101776b0]
mov dword [edi + 0x108], 0x40
movups xmmword [edi + 0x110], xmm0
movups xmmword [edi + 0x120], xmm2
mov dword [edi + 0x130], 0
mov dword [edi + 0x134], 0
mov dword [edi + 0x138], eax
mov dword [edi + 0x13c], ebx
movups xmmword [edi + 0x140], xmm1
mov dword [edi + 0x150], 0
mov eax, dword [0x10194460]
movzx eax, byte [eax]
push 4
push 8
call fcn.1000d070
add esp, 8
test eax, eax
je 0x100593d2
mov dword [eax], edi
mov dword [eax + 4], esi
push esi
mov ebx, eax
call sub.kernel32.dll_TlsGetValue
mov edi, eax
mov dword [esp + 0x20], ebx
push ebx
push esi
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x100593a6
mov eax, dword [edi]
dec dword [eax]
jne 0x10059399
dec dword [eax + 4]
jne 0x10059399
push 8
push 0x158
push eax
call fcn.1000d080
add esp, 0xc
push 4
push 8
push edi
call fcn.1000d080
add esp, 0xc
mov eax, dword [esp + 0x20]
jmp 0x100593ae
xor eax, eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call fcn.100adc50
add esp, 4
mov esi, eax
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x10059229
jmp 0x100593ae
push 8
push 4
call fcn.100d08b0
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0x30], 0x101777c0
mov dword [esp + 0x34], 1
mov dword [esp + 0x40], 0
mov dword [esp + 0x38], ebx
mov dword [esp + 0x14], edx
mov dword [esp + 0x3c], 1
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], 0x1005eb70
push 0x10177834
push edi
call fcn.100dc150
push 0x158
push 8
call fcn.100d08b0
nop
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp + 0x14]
jne 0x10059454
shl eax, 2
push eax
push dword [ebp + 0x10]
push dword [ebp + 8]
call sub.msvcrt.dll_memcmp
add esp, 0xc
test eax, eax
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x1005f360
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 0xc]
xor esi, esi
test ebx, ebx
je 0x1005f39b
push 2
push ebx
push dword [ebp + 8]
push 0
call sub.bcrypt.dll_BCryptGenRandom
cmp eax, 0xc0000000
jb 0x1005f39b
mov edi, eax
push ebx
push dword [ebp + 8]
call sub.advapi32.dll_SystemFunction036
and edi, 0x7fffffff
xor esi, esi
test al, al
cmove esi, edi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x100754a0
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x420
call fcn.100754b4
Function at 0x10082da0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x24
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
lea eax, [ebp - 0x28]
mov dword [ebp - 8], 0
movups xmmword [ebp - 0x18], xmm0
movups xmmword [ebp - 0x28], xmm0
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x10082dd4
mov dword [esi + 4], eax
mov byte [esi], 4
jmp 0x10082de4
mov eax, dword [0x1017bf80]
mov ecx, dword [0x1017bf84]
mov dword [esi + 4], ecx
mov dword [esi], eax
mov eax, esi
add esp, 0x24
pop esi
pop ebp
ret
Function at 0x10084210
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x428
mov esi, 0x200
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 2
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x1c], 2
cmp esi, 0x201
jae 0x10084270
jmp 0x1008425e
jbe 0x100842e0
cmp esi, 0x201
jae 0x10084270
mov dword [ebp - 0x20], 0x200
lea edi, [ebp - 0x434]
mov ebx, esi
jmp 0x1008429a
mov ebx, dword [ebp - 0x24]
sub esi, ebx
je 0x1008428e
mov edx, ebx
lea ecx, [ebp - 0x18]
push esi
call fcn.1006f760
add esp, 4
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
push 0
call sub.kernel32.dll_SetLastError
push edi
push ebx
call sub.kernel32.dll_GetCurrentDirectoryW
mov esi, eax
test eax, eax
jne 0x100842b7
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x10084330
cmp esi, ebx
jne 0x10084250
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x1008434e
lea esi, [ebx + ebx]
test ebx, ebx
mov eax, 0xffffffff
cmovs esi, eax
cmp esi, 0x201
jb 0x1008425e
jmp 0x10084270
mov eax, dword [ebp - 0x20]
cmp esi, eax
ja 0x10084364
lea eax, [ebp - 0x34]
push esi
push edi
push eax
call fcn.10091010
add esp, 0xc
movsd xmm0, qword [ebp - 0x34]
mov eax, dword [ebp + 8]
movsd xmm1, qword [ebp - 0x2c]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x10084322
add eax, eax
push 2
push eax
push dword [ebp - 0x14]
call fcn.1000d080
add esp, 0xc
mov eax, dword [ebp + 8]
add esp, 0x428
pop esi
pop edi
pop ebx
pop ebp
ret
call sub.kernel32.dll_GetLastError
mov ecx, dword [ebp + 8]
mov byte [ecx + 4], 0
mov dword [ecx + 8], eax
mov dword [ecx], 0x80000000
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x10084312
jmp 0x10084322
push 0x1017c0b0
push 0x28
push str.internal_error:_entered_unreachable_codel
call fcn.100dc1e0
add esp, 0xc
jmp 0x10084373
push 0x1017c0a0
push eax
push esi
call fcn.100e1b70
add esp, 0xc
ud2
Function at 0x10097a90
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov esi, ecx
lea eax, [ebp - 0x20]
push dword [ebp + 8]
push edx
push eax
call fcn.100d1110
add esp, 0xc
mov eax, dword [ebp - 0x20]
cmp eax, 0x80000000
jne 0x10097b07
mov edi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
xorps xmm0, xmm0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x40]
movups xmmword [ebp - 0x40], xmm0
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x38], 1
push eax
push ecx
push 0
push edi
call sub.ws2_32.dll_getaddrinfo
test eax, eax
je 0x10097b33
call sub.ws2_32.dll_WSAGetLastError
mov dword [esi + 8], eax
mov eax, 1
mov dword [esi + 4], 0
test ebx, ebx
mov dword [esi], eax
mov byte [edi], 0
jne 0x10097b53
jmp 0x10097b5f
mov ecx, dword [0x1017a860]
mov edx, dword [0x1017a864]
test eax, eax
mov dword [esi + 8], edx
mov dword [esi + 4], ecx
mov dword [esi], 1
je 0x10097b5f
push 1
push eax
push dword [ebp - 0x1c]
call fcn.1000d080
add esp, 0x40
jmp 0x10097b62
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
mov eax, dword [eax]
movzx eax, word [eax]
mov dword [esi + 4], ecx
mov dword [esi + 8], ecx
mov word [esi + 0xc], ax
xor eax, eax
test ebx, ebx
mov dword [esi], eax
mov byte [edi], 0
je 0x10097b5f
push 1
push ebx
push edi
call fcn.1000d080
add esp, 0xc
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret