joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10031b60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100c520c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x10031c03
cmp byte [esi + 0x3d], 0
je 0x10031c03
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10031bb9
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x10031bcb
sub eax, 1
je 0x10031bcf
sub eax, 2
je 0x10031c03
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10067217
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10031bec
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.100711f0
add esp, 0x10
cmp edi, eax
jne 0x10031bb9
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10067217
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.10067217
mov esp, ebp
pop ebp
ret

Function at 0x10032540
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10097ca9
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x100c520c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], 0
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.100671cb
mov edi, eax
add esp, 4
test edi, edi
je 0x100325dd
push 1
call fcn.100663a1
add esp, 4
mov dword [edi + 4], eax
jmp 0x100325df
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov dword [ebp - 4], 0
mov eax, dword [esi + 0x30]
mov edi, dword [eax + 4]
mov ecx, edi
mov dword [ebp - 0x14], edi
mov eax, dword [edi]
call dword [eax + 4]
lea eax, [ebp - 0x18]
push eax
call fcn.1002ef20
add esp, 4
mov ecx, dword [eax]
push 0x20
mov edx, dword [ecx + 0x20]
mov ecx, eax
call edx
mov bl, al
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x10032644
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 8]
test eax, eax
je 0x10032644
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov byte [esi + 0x40], bl
jne 0x1003265d
mov eax, dword [esi + 0xc]
mov ecx, esi
push 0
or eax, 4
push eax
call fcn.10032000
cmp byte [ebp + 0xc], 0
je 0x1003266c
push esi
call fcn.100665fa
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10032930
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100c520c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x10032960
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10067217
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x1003299c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x1003299c
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10067217
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x10032a83
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x100329c4
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x100329f7
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.1007088c
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10067217
mov esp, ebp
pop ebp
ret 4
mov byte [ebp - 0x28], bl
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call edx
test eax, eax
js 0x10032a83
cmp eax, 1
jle 0x10032a56
cmp eax, 3
jne 0x10032a83
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.1002ed20
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10067217
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10032a73
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.100711f0
add esp, 0x10
cmp edi, eax
jne 0x10032a83
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x10032987
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10067217
mov esp, ebp
pop ebp
ret 4
Function at 0x10033820
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
je 0x100338f4
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test esi, esi
jl 0x100338e3
jg 0x10033858
test edx, edx
je 0x100338e3
call fcn.10031c20
mov esi, eax
mov eax, edx
mov dword [ebp - 8], eax
test eax, eax
jl 0x100338a8
jg 0x1003386e
test esi, esi
je 0x100338a8
cmp ebx, eax
jg 0x1003387d
jl 0x10033878
cmp edi, esi
jae 0x1003387d
mov esi, edi
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
push esi
mov eax, dword [eax + 0x1c]
push dword [eax]
push dword [ebp + 8]
call fcn.10068e00
mov ecx, dword [ebp - 4]
add esp, 0xc
sub edi, esi
sbb ebx, dword [ebp - 8]
mov eax, dword [ecx + 0x2c]
sub dword [eax], esi
mov eax, dword [ecx + 0x1c]
add dword [eax], esi
mov eax, dword [ebp + 8]
jmp 0x100338ca
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov ecx, eax
cmp ecx, 0xffffffff
je 0x100338dd
mov eax, dword [ebp + 8]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
mov byte [eax], cl
mov ecx, dword [ebp - 4]
add eax, esi
mov dword [ebp + 8], eax
test ebx, ebx
jg 0x10033858
jl 0x100338dd
test edi, edi
jne 0x10033858
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
pop edi
sbb esi, ebx
mov eax, edx
mov edx, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x1c]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], esi
mov eax, dword [eax]
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], eax
test eax, eax
je 0x10033913
mov eax, dword [ecx + 0x2c]
mov eax, dword [eax]
jmp 0x10033915
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [ebp + 0x10], eax
test edi, edi
jl 0x100339bd
jg 0x1003392f
test esi, esi
je 0x100339bd
test eax, eax
jl 0x1003396e
jg 0x10033939
test ebx, ebx
je 0x1003396e
cmp edi, eax
jg 0x10033948
jl 0x10033943
cmp esi, ebx
jae 0x10033948
mov ebx, esi
mov dword [ebp + 0x10], edi
push ebx
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.10068e00
mov ecx, dword [ebp - 4]
add esp, 0xc
add dword [ebp + 8], ebx
sub esi, ebx
sbb edi, dword [ebp + 0x10]
mov eax, dword [ecx + 0x2c]
sub dword [eax], ebx
mov eax, dword [ecx + 0x1c]
add dword [eax], ebx
jmp 0x10033974
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test edi, edi
jl 0x100339bd
jg 0x1003397e
test esi, esi
je 0x100339bd
mov edx, dword [ecx + 0x4c]
test edx, edx
je 0x100339bd
mov ebx, dword [ecx + 0xc]
lea eax, [ecx + 0x3c]
cmp dword [ebx], eax
jne 0x100339a9
mov edx, dword [ecx + 0x54]
mov ecx, dword [ecx + 0x50]
sub edx, ecx
mov dword [ebx], ecx
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov edx, dword [ebx + 0x4c]
push edx
push esi
push 1
push dword [ebp + 8]
call fcn.10070b5c
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10033aa0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
je 0x10033b6e
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test esi, esi
jl 0x10033b5d
jg 0x10033ad8
test edx, edx
je 0x10033b5d
call fcn.10031e40
mov esi, eax
mov eax, edx
mov dword [ebp - 8], eax
test eax, eax
jl 0x10033b26
jg 0x10033aee
test esi, esi
je 0x10033b26
cmp ebx, eax
jg 0x10033afd
jl 0x10033af8
cmp edi, esi
jae 0x10033afd
mov esi, edi
mov dword [ebp - 8], ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
push esi
push eax
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.10068e00
mov ecx, dword [ebp - 4]
add esp, 0xc
sub edi, esi
sbb ebx, dword [ebp - 8]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x10033b4a
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
push eax
call edx
cmp eax, 0xffffffff
je 0x10033b57
mov ecx, dword [ebp - 4]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [ebp + 8], esi
test ebx, ebx
jg 0x10033ad8
jl 0x10033b57
test edi, edi
jne 0x10033ad8
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
pop edi
sbb esi, ebx
mov eax, edx
mov edx, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], esi
mov eax, dword [eax]
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], eax
test eax, eax
je 0x10033b8d
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x10033b8f
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [ebp + 0x10], eax
test edi, edi
jl 0x10033c08
jg 0x10033ba1
test esi, esi
je 0x10033c08
test eax, eax
jl 0x10033be2
jg 0x10033bab
test ebx, ebx
je 0x10033be2
cmp edi, eax
jg 0x10033bba
jl 0x10033bb5
cmp esi, ebx
jae 0x10033bba
mov ebx, esi
mov dword [ebp + 0x10], edi
push ebx
push dword [ebp + 8]
push dword [ebp - 8]
call fcn.10068e00
mov ecx, dword [ebp - 4]
add esp, 0xc
mov edx, dword [ebp + 8]
add edx, ebx
sub esi, ebx
mov eax, dword [ecx + 0x30]
sbb edi, dword [ebp + 0x10]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
jmp 0x10033be5
mov edx, dword [ebp + 8]
test edi, edi
jl 0x10033c08
jg 0x10033bef
test esi, esi
je 0x10033c08
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x10033c08
push eax
push esi
push 1
push edx
call fcn.100711f0
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10033e50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub eax, 0
je 0x10033e82
sub eax, 1
jne 0x10033e82
push eax
push eax
push eax
push 0x10031860
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
call fcn.10031630
pop ebp
ret 0xc
mov eax, 1
pop ebp
ret 0xc
Function at 0x10035a40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009823e
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x100c520c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0xc]
mov dword [esi], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 1
push 0x1f
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.http:__sf.bb52sg.top_vs_vsc.bin
mov byte [ecx], 0
call fcn.1002a8b0
mov dword [ebp - 4], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0xf
mov byte [esi + 0x28], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], vtable.ff::fflua_t.0
mov dword [esi + 0x48], 0
mov byte [esi + 0x4c], 0
call fcn.10005780
push eax
mov dword [esi + 0x48], eax
call fcn.10003780
add esp, 4
mov byte [ebp - 4], 2
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0xf
mov byte [esi + 0x50], 0
mov byte [ebp - 4], 3
lea eax, [esi + 0x68]
mov dword [ebp - 0x14], eax
mov dword [eax], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 0xf
mov byte [eax + 4], 0
mov byte [ebp - 4], 4
mov dword [eax + 0x2c], 0
mov dword [eax + 0x30], 0xf
mov byte [eax + 0x1c], 0
mov byte [ebp - 4], 5
mov dword [eax + 0x44], 0
mov dword [eax + 0x48], 0xf
mov byte [eax + 0x34], 0
mov byte [ebp - 4], 6
mov byte [eax + 0x4c], 1
mov dword [eax + 0x50], 0
mov dword [eax + 0x54], 0
mov dword [eax + 0x58], 0
mov byte [ebp - 4], 7
mov dword [eax + 0x6c], 0
mov dword [eax + 0x70], 0xf
mov byte [eax + 0x5c], 0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10035c80
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10098353
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x100c520c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], 0
call fcn.10035ba0
mov dword [ebp - 4], 0
lea esi, [ebx + 0x28]
lea eax, [esi + 0x70]
mov dword [esi], 0x1009fd60
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], esi
mov dword [eax], vtable.std::ios_base.0
mov byte [ebp - 4], 1
mov dword [eax], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov byte [ebp - 4], 2
lea edi, [esi + 0x10]
mov eax, dword [esi]
push 0
push edi
mov dword [ebp - 0x10], 1
mov eax, dword [eax + 4]
mov dword [esi + eax], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ecx + esi - 4], eax
mov eax, dword [esi]
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov ecx, dword [eax + 4]
add ecx, esi
call fcn.10032540
mov dword [ebp - 4], 5
mov eax, dword [esi]
mov dword [ebp - 0x1c], edi
mov eax, dword [eax + 4]
mov dword [esi + eax], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ecx + esi - 4], eax
mov ecx, edi
call fcn.1002f440
mov byte [ebp - 4], 6
lea eax, [edi + 4]
mov dword [edi + 0xc], eax
lea ecx, [edi + 8]
lea eax, [edi + 0x14]
mov dword [edi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov byte [edi + 0x48], 0
mov byte [edi + 0x3d], 0
mov dword [edi + 0x10], ecx
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov dword [edi + 0x4c], 0
mov eax, dword [0x100c64e0]
mov dword [edi + 0x40], eax
mov eax, dword [0x100c64e4]
mov dword [edi + 0x44], eax
mov dword [edi + 0x38], 0
mov byte [ebp - 4], 8
mov eax, dword [ebp + 8]
mov dword [ebx + 0xe0], eax
mov dword [ebx + 0xf4], 0
mov dword [ebx + 0xf8], 0xf
mov byte [ebx + 0xe4], 0
mov byte [ebp - 4], 9
mov ecx, ebx
push ebx
mov dword [ebx + 0xfc], 0
call fcn.10039fb0
mov dword [ebp - 4], 0xffffffff
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10037100
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100987f0
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x100c520c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.10037250
test al, al
je 0x100371ec
lea eax, [ebp - 0x28]
mov ecx, edi
push eax
call fcn.10037530
test al, al
je 0x100371ec
cmp byte [edi + 0xb4], 0
je 0x100371df
lea eax, [ebp - 0x40]
mov ecx, edi
push eax
call fcn.10036f40
mov byte [ebp - 4], 1
mov esi, dword [edi + 0xb8]
mov ebx, dword [edi + 0xbc]
cmp esi, ebx
je 0x100371d3
nop dword [eax]
cmp dword [esi + 0x14], 0x10
mov ecx, esi
jb 0x100371aa
mov ecx, dword [esi]
push dword [esi + 0x10]
cmp dword [ebp - 0x2c], 0x10
lea eax, [ebp - 0x40]
push ecx
cmovae eax, dword [ebp - 0x40]
push 0
push dword [ebp - 0x30]
push eax
call fcn.10034e60
add esp, 0x14
cmp eax, 0xffffffff
jne 0x1003721b
add esi, 0x18
cmp esi, ebx
jne 0x100371a0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.10028c90
cmp dword [edi + 0x38], 0
jne 0x10037229
mov dword [edi + 4], 5
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10028c90
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10067217
mov esp, ebp
pop ebp
ret
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.10028c90
jmp 0x100371ec
push edi
push 0
push edi
push 0x10037350
push 0
push 0
call fcn.10072644
add esp, 0x18
mov bl, 1
jmp 0x100371ee

Function at 0x10037a90
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x10037aae
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenThread]
test eax, eax
je 0x10037aae
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov al, 1
ret
Function at 0x10039b60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10098df1
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x100c520c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov esi, dword [ebp + 8]
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x44], 0
mov dword [ebp - 4], 1
movups xmm0, xmmword [str.awsawqaspdxzb___45434etG34th8349ty]
mov edi, dword [ebp + 0x1c]
mov eax, dword [0x100a01c4]
movups xmmword [ebp - 0x34], xmm0
push edi
movups xmm0, xmmword [0x100a01b4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x38], edi
movups xmmword [ebp - 0x24], xmm0
call fcn.10067209
cmp dword [ebp + 0x20], 0x10
mov ecx, eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x3c], ecx
cmovae eax, dword [ebp + 0xc]
push edi
push eax
push ecx
call fcn.10068e00
mov eax, dword [ebp - 0x38]
add esp, 0x10
xor edi, edi
test eax, eax
jle 0x10039c37
nop word [eax + eax]
cmp dword [ebp + 0x20], 0x10
lea esi, [ebp + 0xc]
mov eax, 0x38e38e39
cmovae esi, dword [ebp + 0xc]
mul edi
mov eax, edi
shr edx, 3
lea ecx, [edx + edx*8]
shl ecx, 2
sub eax, ecx
mov ecx, dword [ebp - 0x3c]
mov al, byte [ebp + eax - 0x34]
xor al, byte [esi + edi]
mov byte [edi + ecx], al
inc edi
mov eax, dword [ebp - 0x38]
cmp edi, eax
jl 0x10039c00
mov esi, dword [ebp - 0x40]
push eax
push dword [ebp - 0x3c]
mov dword [esi + 0x10], 0
mov ecx, esi
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
call fcn.1002a8b0
mov dword [ebp - 0x44], 1
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.10028c90
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10067217
mov esp, ebp
pop ebp
ret
Function at 0x1003f630
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10098758
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x100c520c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x28]
push 0xe
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
push str.ime_user_2oock
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.1002a8b0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
cmovae eax, dword [ebp - 0x28]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1003f6c4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
jmp 0x1003f6c8
mov dword [edi], esi
mov bl, 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10028c90
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10067217
mov esp, ebp
pop ebp
ret

Function at 0x1003f700
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10099d78
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x100c520c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
push 0
cmovae eax, dword [ebp + 8]
push 0
push 3
push 0
push 1
push 8
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x1003f764
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1003f766
xor esi, esi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.10028c90
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1003ff20
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10099ed2
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x100c520c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.1003fe70
mov dword [ebp - 4], 0
lea eax, [esi + 0xac]
mov dword [ebp - 0x14], eax
xor ecx, ecx
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 7
mov word [eax + 4], cx
mov byte [ebp - 4], 1
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], 7
mov word [eax + 0x1c], cx
mov byte [ebp - 4], 2
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], 7
mov word [eax + 0x34], cx
mov byte [ebp - 4], 3
mov dword [eax + 0x5c], ecx
mov dword [eax + 0x60], 0xf
mov byte [eax + 0x4c], cl
mov byte [ebp - 4], 5
push 3
mov dword [esi + 0x28], ecx
mov dword [esi + 0x24], ecx
mov dword [esi], ecx
mov dword [esi + 4], ecx
mov dword [esi + 0x10], ecx
mov dword [esi + 0x18], ecx
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x20], ecx
lea ecx, [esi + 0x60]
push 0x100a03f0
mov dword [esi + 0x2c], 0x50
call fcn.1003b7a0
push 0x17
push str.WinHttpHeader_by_Onelio
lea ecx, [esi + 0x78]
call fcn.1003b7a0
push 0
push 0x100a0600
lea ecx, [esi + 0x90]
call fcn.1003b7a0
mov dword [esi + 0xa8], 0x1009ee82
mov dword [esi + 0x14], 0
mov dword [esi + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret