joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003370
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp - 0xc]
lea edx, [eax + 8]
push esi
mov ecx, eax
push edi
mov dword [ebp + 8], ecx
mov dword [ebp - 4], edx
cmp eax, edx
jae case.0x100033b3.85
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
jmp 0x100033a0
lea eax, [ecx - 0x53]
cmp eax, 0x11
ja case.0x100033b3.86
movzx eax, byte [eax + 0x1000348c]
jmp dword [eax*4 + 0x10003470]
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
cmp edi, ecx
jne 0x100033cd
push str.group_message
jmp 0x100033d9
mov eax, dword [edi + 0x44]
cmp eax, ecx
jne 0x10003405
push str.msg_get_max_expected_size_plugin_callback_is_not_defined
push 0x1003455f
push ecx
push 0x1003455f
push 0x1003455c
push 2
call fcn.100021f0
add esp, 0x18
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x14]
mov dword [ebp + 8], 0x54
mov dword [ebp - 8], ecx
jmp case.0x100033b3.86
push edi
call eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edx
jmp 0x1000344f
mov al, byte [edi]
mov esi, 0x1505
mov ecx, edi
test al, al
je case.0x100033b3.86
lea ecx, [ecx]
mov edx, esi
shl edx, 5
movzx eax, al
add esi, edx
inc ecx
add esi, eax
mov al, byte [ecx]
test al, al
jne 0x10003420
jmp case.0x100033b3.86
mov ebx, esi
jmp case.0x100033b3.86
push 8
call fcn.10027b3d
mov dword [eax], 0
mov dword [eax + 4], 0
mov ebx, eax
add esp, 4
mov ecx, dword [ebp + 8]
inc ecx
mov dword [ebp + 8], ecx
cmp ecx, dword [ebp - 4]
jb 0x100033a0
mov edx, dword [ebp - 8]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100037c0
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, edx
imul edi, edi, 0x1f2
mov esi, edx
cmp edx, edi
ja 0x10003826
mov ebx, dword [ebp + 0x14]
lea ecx, [ecx]
mov ecx, esi
sub ecx, 0x98
je 0x100037f9
sub ecx, 0x45
je 0x10003823
sub ecx, 0x624b
je 0x10003826
jmp 0x10003810
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebx]
mov edx, dword [ebp + 0xc]
push eax
mov eax, dword [edx + 4]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov edx, dword [ebp + 8]
mov ecx, edx
imul ecx, ecx, 0xa6
add esi, ecx
cmp esi, edi
jbe 0x100037e0
pop edi
pop esi
pop ebx
pop ebp
ret
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10003ba0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x938
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
lea edi, [eax - 6]
mov ecx, eax
mov dword [ebp + 8], ecx
mov dword [ebp - 0x10], edi
cmp eax, edi
jbe case.0x10003bdf.176
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 8]
jmp 0x10003bd0
lea eax, [ecx - 0xaa]
cmp eax, 8
ja case.0x10003bdf.173
jmp dword [eax*4 + 0x10003d44]
mov eax, dword [ebp + 0xc]
push eax
push 0x3e
lea ecx, [ebp - 0x938]
push 0
push ecx
mov dword [ebp - 0x938], 4
call fcn.10023b10
add esp, 0x10
mov esi, eax
cmp ebx, 0xffffffff
je case.0x10003bdf.173
mov edi, 0x5d
cmp edi, 0x5d
je 0x10003c26
cmp edi, 0x62d
je 0x10003c7e
jmp 0x10003c91
mov edi, dword [ebp + 0xc]
lea edx, [ebp - 0x938]
push edx
push edi
push 0xd2
call fcn.10022960
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x10003c7e
mov eax, dword [ebp - 0x938]
test eax, eax
je 0x10003c7e
push 0
lea ecx, [ebp - 0x14]
push ecx
push eax
lea edx, [ebp - 0x934]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 0x938]
push eax
push edi
push 0xd2
call fcn.10022960
mov esi, eax
add esp, 0xc
test esi, esi
je 0x10003c44
push ebx
mov edi, 0x62d
mov dword [ebp + 8], 0xab
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add edi, 0x5d0
cmp edi, 0xba0
jbe 0x10003c17
mov edi, dword [ebp - 0x10]
jmp case.0x10003bdf.173
mov ecx, dword [ebp + 0x10]
push 0
push 0x80
push 1
push 0
push 0
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x934], eax
jmp case.0x10003bdf.173
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
test eax, eax
je 0x10003d12
mov ecx, dword [eax + 0x28]
test ecx, ecx
je case.0x10003bdf.173
cmp byte [eax + 0x40], 0
je case.0x10003bdf.173
push 0
push ecx
push 0xcd
call fcn.10025060
add esp, 0xc
jmp case.0x10003bdf.173
mov eax, dword [ebp - 8]
push eax
call fcn.100271f9
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword [ebp + 8], 0xb1
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 8]
dec ecx
mov dword [ebp + 8], ecx
cmp ecx, edi
ja 0x10003bd0
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10004940
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [esi + 0x318]
push edi
mov dword [ebp - 0xc], eax
cmp esi, eax
jae 0x10004a36
mov edi, dword [ebp + 8]
mov bl, byte [ebp + 0xf]
cmp esi, 0x135
ja 0x10004a0a
je 0x10004a00
lea eax, [esi - 0x37]
cmp eax, 0xa5
ja case.0x1000498a.56
movzx eax, byte [eax + 0x10004a54]
jmp dword [eax*4 + 0x10004a40]
xor eax, eax
mov dword [0x10040158], eax
mov dword [0x10040160], eax
mov dword [0x10040164], eax
mov dword [0x10040168], eax
mov dword [0x1004016c], eax
jmp case.0x1000498a.56
mov ecx, dword [ebp - 4]
mov bl, byte [ecx + 0xb8]
mov esi, 0xd2
jmp case.0x1000498a.56
xor bl, bl
mov dword [ebp - 4], edi
test edi, edi
jne case.0x1000498a.56
push str.2A1AiAiA9
push 0x1003455f
push 0
push 0x1003455f
push 0x1003455c
push 2
call fcn.100021f0
add esp, 0x18
mov esi, 0xd2
jmp case.0x1000498a.56
lea edx, [ebp - 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 8], eax
jmp case.0x1000498a.56
insb byte es:[edi], dx
and eax, 0x88bf3d95
pop ebp
or al, 0xeb
and byte [ebx + 0x13f2dc6], cl
add byte [eax], al
mov eax, esi
sub eax, 0x13f
je 0x10004a1f
sub eax, 0x59
je 0x10004a36
sub eax, 0xa
je 0x10004a36
jmp case.0x1000498a.56
imul esp, dword [ebp - 0x7450ebf3], 0x4d
clc
mov dword [ebp + 0xc], ecx
add esi, 0x63
cmp esi, dword [ebp - 0xc]
jb 0x10004963
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10006710
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push ebx
lea ecx, [eax + 0x94]
push esi
push edi
mov dword [ebp - 8], ecx
cmp eax, ecx
jae case.0x10006750.74
mov esi, dword [ebp + 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
lea edi, [eax - 0x88]
mov dword [ebp + 8], edi
nop
cmp edi, 0x59
ja case.0x10006750.1
movzx eax, byte [edi + 0x10006820]
jmp dword [eax*4 + 0x1000680c]
mov cx, word [esi]
and cx, 0xf
mov word [esi + 2], cx
je case.0x10006750.1
mov eax, 0x10
sub eax, ecx
movzx ecx, ax
mov word [esi + 2], ax
mov eax, dword [esi]
lea edx, [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
and eax, 0xffff
mov dword [ebp + 8], ecx
lea ecx, [eax + esi + 4]
push ecx
push edx
push 0x98
call fcn.100037c0
mov ax, word [esi + 2]
add esp, 0x10
add word [esi], ax
jmp case.0x10006750.1
push 0
push 0x80
push 3
push 0
push 1
push bind
push str.s_cbranch_scc1
mov dword [esi], 0
call ebx
mov edi, eax
cmp edi, 0xffffffff
je 0x100067e3
push 0
push esi
push 0x800
lea ecx, [esi + 4]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp + 8]
add edi, 0x25
lea eax, [edi + 0x88]
mov dword [ebp + 8], edi
cmp eax, dword [ebp - 8]
jb 0x10006740
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [esi]
mov dword [ebp - 4], edx
jmp case.0x10006750.1
Function at 0x10006f66
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
lea edi, [eax - 8]
mov ecx, eax
mov dword [ebp - 4], ecx
mov dword [ebp - 0x1c], edi
cmp eax, edi
jbe case.0x10006f25.35
mov ebx, dword [ebp - 0x10]
lea eax, [ecx - 0x14]
cmp eax, 0x12
ja case.0x10006f25.23
movzx eax, byte [eax + 0x1000711c]
jmp dword [eax*4 + 0x100070f8]
mov eax, dword [ebp + 0x1c]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, ecx
or eax, edx
jne 0x10006f44
push str.S_MANREGISTER_ST
jmp 0x10007052
mov esi, dword [ebp + 0x20]
mov eax, dword [esi + 0x5c]
test eax, eax
je case.0x10006f25.23
push edx
push ecx
mov ecx, dword [ebp + 8]
push ecx
push esi
call eax
add esp, 0x10
mov dword [ebp + 0x10], eax
jmp case.0x10006f25.23
mov edx, dword [ebp + 0x1c]
xor esi, esi
cmp dword [edx], esi
jbe case.0x10006f25.23
mov edi, dword [ebp + 8]
sub edi, dword [ebp + 0x20]
lea esp, [esp]
mov eax, dword [ebp + 0x18]
cmp dword [eax], edi
jne 0x10006f99
mov eax, dword [eax + 4]
add esi, 4
add edi, 4
test eax, eax
je 0x1000700e
mov dword [ebp + 0x18], eax
jmp 0x1000700e
xor edx, edx
mov eax, esi
div dword [ebp - 0xc]
mov eax, dword [ebp - 8]
movzx ecx, byte [edx + eax]
mov edx, dword [ebp + 0x14]
cmp byte [edx], 0
mov ecx, dword [ebx + ecx*4]
je 0x10006fc1
mov eax, dword [ebp + 8]
movzx edx, byte [esi + eax]
mov dl, byte [edx + ecx]
mov byte [esi + eax], dl
jmp 0x10006ff5
mov edx, dword [ebp + 8]
mov dl, byte [esi + edx]
xor eax, eax
lea esp, [esp]
movzx ebx, ax
cmp dl, byte [ebx + ecx]
je 0x10006fe5
inc eax
mov ebx, 0x100
cmp ax, bx
jb 0x10006fd0
jmp 0x10006feb
mov ecx, dword [ebp + 8]
mov byte [esi + ecx], al
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 4], 0x15
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x18]
push ecx
mov edx, ecx
push edx
push 0
inc esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
inc edi
mov eax, dword [ebp + 0x1c]
cmp esi, dword [eax]
jb 0x10006f80
mov edi, dword [ebp - 0x1c]
jmp case.0x10006f25.23
mov ecx, dword [ebp + 0x20]
mov dword [0x10040438], ecx
jmp case.0x10006f25.23
cmp dword [ebp + 0x20], 0
mov dword [ebp + 0x10], 0
jne 0x10007043
push str.module_handle
jmp 0x10007052
cmp dword [ebp + 8], 0
jne case.0x10006f25.23
push str.hostent:__s
push 0x1003455f
push 0
push 0x1003455f
push 0x1003455c
push 2
call fcn.100021f0
add esp, 0x18
mov dword [ebp + 0x10], 2
mov edx, dword [ebp + 0x10]
mov dword [ebp - 4], 0x24
mov dword [ebp - 0x14], edx
jmp case.0x10006f25.23
mov eax, dword [ebp + 0xc]
push eax
push 0x8e
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 8]
push eax
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0x20
call fcn.10002310
xor edx, edx
mov eax, 8
div dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
movzx edx, byte [edx + ecx]
push edx
call fcn.10001e20
mov ebx, eax
add esp, 0x18
mov dword [ebp - 0x10], ebx
jmp case.0x10006f25.23
mov eax, dword [ebx]
push eax
call fcn.10027d1a
push ebx
call fcn.10027d1a
add esp, 8
mov ecx, dword [ebp - 4]
dec ecx
mov dword [ebp - 4], ecx
cmp ecx, edi
ja 0x10006f12
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10008280
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 8]
lea ecx, [eax + 0x380]
push edi
mov edi, eax
mov dword [ebp - 8], ecx
cmp eax, ecx
jae 0x100082c8
mov ebx, dword [ebp + 0x10]
cmp edi, 0xe5
ja 0x100083be
je 0x10008350
mov eax, edi
sub eax, 0x63
je 0x1000832e
arpl word [esp + esi*2 - 0x7d], si
call 0x9312f6df
call 0xd8859226
add byte [eax], al
add byte [edi - 0x75], bl
invalid
sub eax, 0x1f
je 0x100082d1
sub eax, 0x61
jne 0x10008390
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
js 0x100082b7
mov esi, 0xf633b4af
test ebx, ebx
jne 0x100082f8
mov eax, 0xc0
cmp eax, 0xc0
je 0x100083dd
add eax, 0x2c40
cmp eax, 0x2c40
jbe 0x100082e1
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [ebx], eax
cmp eax, 0xffffffff
jne 0x10008390
push str.set_AvailableSize
push 0x1003455f
push 0
push 0x1003455f
push str.HG_Util
push 2
call fcn.100021f0
add esp, 0x18
or esi, 0xffffffff
jmp 0x10008390
mov eax, dword [ebp + 0xc]
mov cl, byte [eax]
push 0
lea edx, [ebp - 4]
push edx
push 0xa1
push 0
push ebx
mov byte [ebp - 4], cl
call fcn.10026480
add esp, 0x14
mov esi, eax
jmp 0x10008390
jae 0x100083c9
adc eax, 0x38be2f8
mov dword [ebp + 8], 0
test eax, eax
jne 0x100083a5
push str.get_TypeResolutionService
push 0x1003455f
push eax
push 0x1003455f
push 0x100345f0
push 2
call fcn.100021f0
add esp, 0x18
mov dword [ebp + 8], 3
mov esi, dword [ebp + 8]
mov edi, 0x165
sub edi, 0xffffff80
cmp edi, dword [ebp - 8]
jb 0x100082a1
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
add eax, 0xb4
push eax
push 0xdd
call fcn.100037c0
add esp, 0x10
jmp 0x10008390
mov eax, edi
sub eax, 0x102
je 0x100082c8
invalid
sub eax, 0x63
je 0x10008388
sub eax, 0x80
je 0x100082c8
jmp 0x10008390
push str.Error_when_serializing_message.
push 0x1003455f
push 0
push 0x1003455f
push str.HG_Util
push 2
call fcn.100021f0
add esp, 0x18
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100096b0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.10008280
Function at 0x1000bb90
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ecx, edi
imul ecx, ecx, 0x4e6
mov dword [ebp - 8], ecx
cmp edi, ecx
ja 0x1000bcd0
mov esi, dword [ebp + 0x18]
mov ebx, dword [ebp + 0xc]
jmp 0x1000bbc0
cmp edi, 0x16671
ja 0x1000bc76
je 0x1000bc0b
cmp edi, 0x35
je 0x1000bd09
cmp edi, 0xdb
je 0x1000bbfb
cmp edi, 0xb3a6
jne 0x1000bcbd
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], eax
jmp 0x1000bcbd
mov ebx, dword [ebp + 0x10]
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
jmp 0x1000bcbd
test esi, esi
je 0x1000bcda
mov eax, dword [esi]
mov edx, dword [ebp + 8]
mov ecx, dword [esi + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [edx + 4]
lea edx, [ebp - 0x14]
push edx
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ecx]
push ebx
push eax
lea eax, [ebp - 0xc]
push 0x95
push eax
call fcn.10009800
add esp, 0x14
test eax, eax
je 0x1000bcba
push str.Could_not_convert_address_to_string
push 0x1003455f
push 0
push 0x1003455f
push 0x100345f0
push 2
call fcn.100021f0
add esp, 0x18
mov dword [ebp - 4], 1
mov ecx, 0x91
inc ecx
jmp 0x1000bc8b
cmp edi, 0x2193c
je 0x1000bca9
cmp edi, 0x2cc07
jne 0x1000bcbd
mov ecx, 0x91
cmp ecx, 0x93
jae 0x1000bd09
mov eax, ecx
sub eax, 0x91
je 0x1000bc6e
dec eax
jne 0x1000bc73
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x10]
adc edx, dword [ebp - 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
imul eax, eax, 0xd1
add edi, eax
cmp edi, ecx
jbe 0x1000bbc0
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.NULL_buffer_size
push 0x1003455f
push 0
push 0x1003455f
push 0x100345f0
push 2
call fcn.100021f0
mov ecx, 0x91
add esp, 0x18
mov dword [ebp - 4], 3
inc ecx
jmp 0x1000bc8b
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000fb70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
push ebx
lea edx, [eax - 4]
push esi
mov ecx, eax
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
cmp eax, edx
jbe case.0x1000fbac.76
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
jmp 0x1000fba0
lea eax, [ecx - 0x4c]
cmp eax, 6
ja case.0x1000fbac.79
jmp dword [eax*4 + 0x1000fd74]
mov ecx, dword [ebp + 0x14]
mov edx, dword [esi]
lea eax, [ebp - 0x10]
push eax
push edi
push 0
push 0xf003f
push 0
push 0
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
sete byte [ebp + 0xf]
jmp case.0x1000fbac.79
cmp dword [edi], 6
mov ebx, str.sign_public
je 0x1000fbec
mov ebx, str.speedDialURL
push 0x100367f8
push esi
call fcn.10028762
add esp, 8
mov dword [0x100403e4], eax
test eax, eax
je 0x1000fd37
mov eax, dword [edi]
mov ecx, dword [0x100403ec]
push 0x100403f8
push 0
push 0
push eax
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptExportKey]
test eax, eax
je 0x1000fd1a
mov edx, dword [0x100403f8]
lea eax, [ebp - 8]
push eax
push 0xf3
mov dword [ebp - 8], edx
call fcn.1000cc30
add esp, 8
mov dword [0x100403f4], eax
test eax, eax
je 0x1000fd27
mov ecx, dword [edi]
mov edx, dword [0x100403ec]
push 0x100403f8
push eax
push 0
push ecx
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CryptExportKey]
test eax, eax
je 0x1000fcea
mov eax, 0x99
mov ecx, eax
sub ecx, 0x98
je 0x1000fcdb
dec ecx
jne 0x1000fce2
mov eax, dword [0x100403f8]
push esi
push eax
push str.____writing__i_bytes_to__s_n
call fcn.10026fc6
mov ecx, dword [ebp + 0x14]
mov eax, dword [ecx]
add esp, 0xc
sub eax, 0
je 0x1000fcc7
dec eax
jne 0x1000fcd4
mov edx, dword [0x100403e4]
mov eax, dword [0x100403f8]
mov ecx, dword [0x100403f4]
push edx
push eax
push 1
push ecx
call fcn.1002862c
add esp, 0x10
mov eax, 0x99
jmp 0x1000fce2
push 0
push ebx
push 0x63
call fcn.100011d0
add esp, 0xc
mov eax, 0x99
jmp 0x1000fce2
mov dword [ebp - 4], 0x52
dec eax
cmp eax, 0x97
ja 0x1000fc74
mov edx, dword [0x100403f4]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [0x100403e4]
push eax
mov dword [0x100403f4], 0
call fcn.10028461
add esp, 4
jmp case.0x1000fbac.79
push str.CloseClangDriver
call fcn.10002df0
add esp, 4
mov eax, dword [0x100403e4]
push eax
call fcn.10028461
add esp, 4
jmp case.0x1000fbac.79
push esi
push str.fopen__s_
call fcn.10002df0
add esp, 8
jmp case.0x1000fbac.79
push 0
push edi
push 0x97
push 0
call fcn.100010f0
add esp, 0x10
mov ecx, dword [ebp - 4]
dec ecx
mov dword [ebp - 4], ecx
cmp ecx, dword [ebp - 0xc]
ja 0x1000fba0
mov al, byte [ebp + 0xf]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000fd90
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0x10]
push ebx
lea edx, [eax + 0x130]
push esi
mov ecx, eax
push edi
mov dword [ebp + 0x10], ecx
mov dword [ebp - 0x1c], edx
cmp eax, edx
jae 0x1000ff81
mov esi, dword [ebp + 0x18]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x10]
jmp 0x1000fdc0
cmp ecx, 0x190
ja case.0x1000fdea.130
je 0x1000ff7c
lea eax, [ecx - 0x81]
cmp eax, 0xfc
ja case.0x1000fdea.130
movzx eax, byte [eax + 0x1000ffcc]
jmp dword [eax*4 + 0x1000ff8c]
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], eax
jmp case.0x1000fdea.130
mov ecx, dword [ebp + 8]
mov dword [edi + 8], ecx
jmp case.0x1000fdea.130
lea edx, [esi + 0x18]
push edx
push 0
push 0x9f
call fcn.10021740
mov dword [ebp - 8], eax
lea eax, [esi + 4]
push eax
push 0
push 0x9f
call fcn.10021740
add esp, 0x18
mov dword [ebp - 0x18], eax
jmp case.0x1000fdea.130
xor edi, edi
jmp case.0x1000fdea.130
mov ecx, dword [esi + 0x10]
lea eax, [esi + 0x10]
lea edx, [edi + 0xc]
mov dword [edx], ecx
test ecx, ecx
je 0x1000fe54
mov ecx, dword [eax]
mov dword [ecx + 0x10], edx
mov dword [eax], edi
mov dword [edi + 0x10], eax
inc dword [esi + 4]
jmp case.0x1000fdea.130
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
mov dword [edi + 4], eax
jmp case.0x1000fdea.130
mov eax, dword [ebp - 8]
lea ebx, [eax + 1]
and ebx, dword [esi + 0x24]
cmp eax, dword [ebp - 0x18]
je 0x1000ff66
jmp case.0x1000fdea.130
mov dword [ebp - 4], 0
test esi, esi
jne case.0x1000fdea.130
push str.resourcesData
push 0x1003455f
push esi
push 0x1003455f
push str.HG_Util
push 2
call fcn.100021f0
add esp, 0x18
mov dword [ebp - 4], 0xffffffff
mov dword [ebp + 0x10], 0x16a
mov ecx, dword [ebp + 0x10]
add ecx, 0x13
mov dword [ebp + 0x10], ecx
cmp ecx, dword [ebp - 0x1c]
jb 0x1000fdc0
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 4], 0
je 0x1000fedf
push edi
call fcn.100271f9
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x14], ecx
jmp case.0x1000fdea.130
mov dword [ebp - 0xc], 0
jmp case.0x1000fdea.130
push 0x14
call fcn.100279e1
mov edi, eax
add esp, 4
test edi, edi
jne case.0x1000fdea.130
push str.set_LowestLinkVector
push 0x1003455f
push eax
push 0x1003455f
push str.HG_Util
push 2
call fcn.100021f0
add esp, 0x18
jmp case.0x1000fdea.362
lea edx, [ebp + 0x10]
push edx
lea eax, [esi + 0x18]
push eax
push 0x9e
mov dword [ebp + 0x10], ebx
call fcn.100013a0
mov ecx, dword [ebp - 8]
lea edx, [esi + ecx*4 + 0x28]
push edx
push 0xcb
call fcn.1000dec0
mov dword [ebp - 0xc], edx
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x10]
push eax
lea ecx, [esi + 0x1c]
push ecx
push 0x9e
mov dword [ebp + 0x10], ebx
call fcn.100013a0
add esp, 0x20
mov dword [ebp + 0x10], 0xba
jmp case.0x1000fdea.130
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
sbb ebp, dword [edx]
cli
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10018c80
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.100186b0
Function at 0x1001ad20
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x1003e620]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
lea edx, [eax + 2]
mov ecx, eax
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x88], edx
cmp eax, edx
jae 0x1001af5e
push ebx
push edi
mov eax, ecx
sub eax, 0xbd
je 0x1001af4a
sub eax, 2
jne 0x1001af50
xor ebx, ebx
mov dword [ebp - 0x80], ebx
lea ecx, [ecx]
mov edi, 0xc7
mov dword [ebp - 0x84], edi
jmp 0x1001ad80
mov eax, edi
sub eax, 0xc7
je 0x1001adcc
sub eax, 0x5b
jne 0x1001af22
test ebx, ebx
jne 0x1001ada1
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
lea eax, [ebp - 0x74]
push eax
push 0
push 0x78
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call fcn.10003220
add esp, 0x38
jmp 0x1001af22
push 0
push 0xc8
lea ecx, [ebp - 0x78]
push ecx
lea edx, [ebp - 0x74]
push edx
mov dword [ebp - 0x78], 0
call fcn.1001ed30
mov eax, dword [esi + 0x14]
add esp, 0x10
push 6
push 1
push eax
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x1001af22
mov ebx, 0x59
mov eax, ebx
sub eax, 0x59
je 0x1001ae24
dec eax
jne 0x1001af0f
mov ecx, dword [esi]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
jmp 0x1001af0f
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x20]
lea edx, [ebp - 0x78]
push edx
lea edi, [esi + 0x24]
push edi
push 0
push eax
push ecx
mov dword [ebp - 0x78], 0x40
call dword [sym.imp.WS2_32.dll_WSAAddressToStringW]
push edi
push str.__connecting_to__s_n
call fcn.10026fc6
mov edx, dword [esi + 0x1c]
mov eax, dword [esi + 0x20]
mov ecx, dword [esi]
add esp, 8
push edx
push eax
push ecx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x1001aef7
mov edi, 0x8c
cmp edi, 0x8c
je 0x1001aec7
cmp edi, 0x13e
jne 0x1001aee3
push 0x79
lea edx, [ebp - 0x74]
push 0
push edx
call fcn.10022c00
add esp, 0xc
test eax, eax
je 0x1001aeb8
push 0
push 0
lea eax, [ebp - 0x74]
push 0xb0
push eax
call fcn.1001a6d0
push str.Connection_was_closed
mov dword [ebp - 0x80], eax
call fcn.10026fc6
add esp, 0x14
jmp 0x1001aee3
push 0x1003455f
call fcn.10002df0
add esp, 4
jmp 0x1001aee3
push str._2lld._0lldM
call fcn.10026fc6
mov ecx, dword [esi]
push str.ivec2_imageSize_uimage2D__
mov dword [ebp - 0x74], ecx
call fcn.10026fc6
add esp, 8
add edi, 0xb2
cmp edi, 0x1f0
jb 0x1001ae70
jmp 0x1001af04
push str.connect
call fcn.10002df0
add esp, 4
mov edx, dword [esi]
push 2
push edx
call dword [sym.imp.WS2_32.dll_shutdown]
inc ebx
cmp ebx, 0x5b
jb 0x1001ae08
mov ebx, dword [ebp - 0x80]
mov edi, dword [ebp - 0x84]
add edi, 0x5b
mov dword [ebp - 0x84], edi
cmp edi, 0x17d
jb 0x1001ad80
test ebx, ebx
je 0x1001ad70
mov edx, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x7c]
jmp 0x1001af50
mov dword [esi], 0
inc ecx
mov dword [ebp - 0x7c], ecx
cmp ecx, edx
jb 0x1001ad52
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10027670
mov esp, ebp
pop ebp
ret