joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100c58e
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x1028aa8]
push ebx
xor ebx, ebx
cmp dword [0x102e20c], ebx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 0x34], ebx
jne 0x100c6ba
push esi
push 7
xor esi, esi
call fcn.0100ca78
test eax, eax
je 0x100c615
call fcn.0100c4a8
cmp ax, bx
mov word [0x102e208], ax
je 0x100c6a5
push 0x10
lea ecx, [ebp - 0x30]
push ecx
movzx eax, ax
push 0x58
push eax
call dword [sym.imp.KERNEL32.DLL_GetLocaleInfoW]
test eax, eax
je 0x100c6a5
test byte [ebp - 0x21], 8
je 0x100c6a5
xor eax, eax
mov ax, word [0x102e208]
push eax
call fcn.0100c528
test eax, eax
je 0x100c6a5
jmp 0x100c6a2
push 5
call fcn.0100ca78
test eax, eax
je 0x100c6a5
push 0x4a
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x100c6a5
lea eax, [ebp - 0x38]
push eax
push 0x20019
push ebx
push 0x1002b00
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100c6a5
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push 0x1002afc
push dword [ebp - 0x38]
mov dword [ebp - 0x3c], 0xc
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x38]
mov byte [ebp - 5], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0100c3b2
test eax, eax
je 0x100c6a5
mov eax, dword [ebp - 0x34]
and eax, 0x3ff
cmp eax, 1
je 0x100c69c
cmp eax, 0xd
jne 0x100c6a5
mov word [0x102e208], ax
xor esi, esi
inc esi
xor eax, eax
cmp esi, ebx
sete al
inc eax
push eax
push 0x102e20c
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
pop esi
cmp dword [0x102e20c], 1
jne 0x100c6d0
cmp edi, ebx
je 0x100c6d0
mov ax, word [0x102e208]
mov word [edi], ax
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [0x102e20c], 1
pop edi
sete al
pop ebx
call fcn.0100b845
leave
ret 4
Function at 0x100c6fc
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edi
lea eax, [ebp + 0xc]
push eax
push 1
xor edi, edi
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
push dword [ebp + 8]
call esi
test eax, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jne 0x100c75d
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp + 0x14]
mov dword [ebp - 8], 4
push dword [ebp + 0xc]
call ebx
test eax, eax
jne 0x100c754
cmp dword [ebp - 0xc], 4
je 0x100c754
mov dword [ebp - 4], edi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp + 0xc]
push eax
push 1
push edi
push dword [ebp + 0x10]
push dword [ebp + 8]
call esi
test eax, eax
jne 0x100c7a0
push 4
pop esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp + 0x14]
mov dword [ebp - 8], esi
push dword [ebp + 0xc]
call ebx
test eax, eax
jne 0x100c797
cmp dword [ebp - 0xc], esi
je 0x100c797
mov dword [ebp - 4], edi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x100c7af
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x1028aa8]
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 0x10]
lea edx, [ebp - 0x10c]
push edx
push 1
xor esi, esi
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100c825
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x114]
push eax
push esi
push edi
push dword [ebp - 0x10c]
mov dword [ebp - 0x110], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x10c]
mov esi, eax
neg esi
sbb esi, esi
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
call fcn.0100b845
leave
ret 0xc

Function at 0x100c991
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x1002bf0
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100c9e3
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x1002bd4
push dword [ebp - 4]
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
leave
ret
Function at 0x100c9ed
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1028af0]
cmp eax, 0xffffffff
jne 0x100ca71
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x1002c74
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100ca60
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x1002c68
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100ca57
cmp dword [ebp - 0xc], 4
jne 0x100ca57
cmp dword [ebp - 0x10], eax
je 0x100ca57
mov dword [0x1028af0], 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x1028af0]
cmp eax, 0xffffffff
jne 0x100ca71
xor eax, eax
mov dword [0x1028af0], eax
leave
ret
Function at 0x100d054
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [0x1028cf0]
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov ecx, dword [eax + 8]
call fcn.01019df3
test eax, eax
je 0x100d08a
mov ecx, dword [ebp + 8]
mov dword [eax + 8], ecx
mov ecx, dword [ebp + 0xc]
mov word [eax + 2], 6
mov dword [eax + 0xc], ecx
mov dword [eax + 4], 1
pop ebp
ret 8

Function at 0x100d093
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [0x1028cf0]
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov ecx, dword [eax + 8]
call fcn.01019df3
test eax, eax
je 0x100d0c9
mov ecx, dword [ebp + 8]
mov dword [eax + 8], ecx
mov ecx, dword [ebp + 0xc]
mov word [eax + 2], 7
mov dword [eax + 0xc], ecx
mov dword [eax + 4], 1
pop ebp
ret 8

Function at 0x100d121
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [0x1028cf0]
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov ecx, dword [eax + 8]
call fcn.01019df3
test eax, eax
je 0x100d155
mov ecx, dword [ebp + 8]
mov word [eax + 2], 9
mov byte [eax + 8], 2
mov dword [eax + 0xc], ecx
mov dword [eax + 4], 1
pop ebp
ret 4

Function at 0x100d15e
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [0x1028cf0]
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov ecx, dword [eax + 8]
call fcn.01019df3
test eax, eax
je 0x100d19a
mov cl, byte [ebp + 0x10]
mov byte [eax + 8], cl
mov ecx, dword [ebp + 8]
mov dword [eax + 0xc], ecx
mov ecx, dword [ebp + 0xc]
mov word [eax + 2], 9
mov dword [eax + 0x10], ecx
mov dword [eax + 4], 1
pop ebp
ret 0xc

Function at 0x100d1a3
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [0x1028cf0]
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov ecx, dword [eax + 8]
call fcn.01019df3
test eax, eax
je 0x100d1e5
mov cl, byte [ebp + 0x14]
mov byte [eax + 8], cl
mov ecx, dword [ebp + 8]
mov dword [eax + 0xc], ecx
mov ecx, dword [ebp + 0xc]
mov dword [eax + 0x10], ecx
mov ecx, dword [ebp + 0x10]
mov word [eax + 2], 9
mov dword [eax + 0x14], ecx
mov dword [eax + 4], 1
pop ebp
ret 0x10

Function at 0x100d1ee
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [0x1028cf0]
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov ecx, dword [eax + 8]
call fcn.01019df3
test eax, eax
je 0x100d228
mov ecx, dword [ebp + 8]
mov dword [eax + 0xc], ecx
mov ecx, dword [ebp + 0xc]
mov word [eax + 2], 9
mov byte [eax + 8], 5
mov dword [eax + 0x10], ecx
mov dword [eax + 4], 1
pop ebp
ret 8

Function at 0x100d231
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [0x1028cf0]
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov ecx, dword [eax + 8]
call fcn.01019df3
test eax, eax
je 0x100d271
mov ecx, dword [ebp + 8]
mov dword [eax + 0xc], ecx
mov ecx, dword [ebp + 0xc]
mov dword [eax + 0x10], ecx
mov ecx, dword [ebp + 0x10]
mov word [eax + 2], 9
mov byte [eax + 8], 6
mov dword [eax + 0x14], ecx
mov dword [eax + 4], 1
pop ebp
ret 0xc
Function at 0x100d2b3
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push dword [0x1028cf0]
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov bl, byte [ebp + 0xc]
cmp bl, 2
mov esi, dword [eax + 8]
je 0x100d2da
cmp bl, 7
jne 0x100d2ef
push dword [ebp + 8]
call fcn.010155dd
push dword [ebp + 8]
mov edi, eax
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x100d2f2
mov edi, dword [ebp + 8]
test edi, edi
jne 0x100d2fd
xor eax, eax
jmp 0x100d3f0
mov ecx, esi
call fcn.01019df3
mov esi, eax
test esi, esi
je 0x100d3ee
mov al, byte [ebp + 0x18]
mov cl, byte [ebp + 0x14]
and dword [esi + 0xc], 0
or al, 0xfe
shl al, 1
and cl, 1
or al, cl
mov cl, byte [esi + 0x14]
shl al, 5
and cl, 0x1c
or al, cl
mov byte [esi + 0x14], al
lea eax, [ebp - 0x18]
push eax
push 0x18
push edi
mov word [esi + 2], 0xb
mov dword [esi + 8], edi
call dword [sym.imp.GDI32.dll_GetObjectW]
mov ax, word [ebp - 0x14]
mov word [esi + 0x10], ax
mov ax, word [ebp - 0x10]
mov word [esi + 0x12], ax
mov al, bl
shl al, 2
xor al, byte [esi + 0x14]
and al, 0x1c
xor byte [esi + 0x14], al
test bl, bl
je 0x100d3e3
jbe 0x100d3e7
cmp bl, 2
jbe 0x100d37c
cmp bl, 3
je 0x100d384
cmp bl, 6
je 0x100d3d2
cmp bl, 7
jne 0x100d3e7
mov al, byte [ebp + 0x10]
mov byte [esi + 0x15], al
jmp 0x100d3e7
mov ebx, dword [ebp + 0x10]
cmp ebx, 0xffffffff
jne 0x100d3d5
cmp dword [esi + 8], 0
je 0x100d3d5
push 0
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
test eax, eax
mov dword [ebp + 0xc], eax
je 0x100d3d5
push dword [esi + 8]
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
push eax
call edi
push 0
push 0
push dword [ebp + 0xc]
mov dword [ebp + 0x18], eax
call dword [sym.imp.GDI32.dll_GetPixel]
push dword [ebp + 0x18]
mov ebx, eax
push dword [ebp + 0xc]
call edi
push dword [ebp + 0xc]
call dword [sym.imp.GDI32.dll_DeleteDC]
jmp 0x100d3d5
mov ebx, dword [ebp + 0x10]
mov byte [esi + 0x15], bl
mov byte [esi + 0x16], bh
shr ebx, 0x10
mov byte [esi + 0x17], bl
jmp 0x100d3e7
mov byte [esi + 0x15], 0
mov dword [esi + 4], 1
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x100d3fc
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
push dword [0x1028cf0]
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov ecx, dword [eax + 8]
call fcn.01019df3
mov esi, eax
test esi, esi
je 0x100d4a7
mov cl, byte [esi + 0x14]
mov eax, dword [ebp + 8]
and dword [esi + 0xc], 0
and cl, 0xfd
or cl, 1
test eax, eax
mov word [esi + 2], 0xb
mov dword [esi + 8], eax
mov byte [esi + 0x14], cl
je 0x100d47f
push edi
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetIconInfo]
lea eax, [ebp - 0x2c]
push eax
push 0x18
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_GetObjectW]
mov ax, word [ebp - 0x28]
push dword [ebp - 8]
mov edi, dword [sym.imp.GDI32.dll_DeleteObject]
mov word [esi + 0x10], ax
mov ax, word [ebp - 0x24]
mov word [esi + 0x12], ax
call edi
push dword [ebp - 4]
call edi
pop edi
mov al, byte [ebp + 0x10]
mov cl, byte [ebp + 0xc]
or al, 0xfe
and cl, 1
shl al, 1
or al, cl
mov cl, byte [esi + 0x14]
shl al, 5
and cl, 3
or al, cl
mov byte [esi + 0x15], 0
mov byte [esi + 0x14], al
mov dword [esi + 4], 1
mov eax, esi
pop esi
leave
ret 0xc

Function at 0x100df5c
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x1028cf0]
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
test eax, eax
jne 0x100df6d
ret
mov eax, dword [eax + 0xc]
ret
Function at 0x100f746
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push dword [0x1028cf0]
mov esi, ecx
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
cmp byte [ebp + 0xc], 0
mov ebx, dword [eax + 0xc]
je 0x100f80d
test byte [ebp + 0xa], 1
je 0x100f7f5
test byte [esi + 0x65], 4
je 0x100f7a1
mov ecx, esi
call fcn.0100eeae
mov ebx, eax
mov edi, 0xf000
test edi, ebx
je 0x100f7a1
call fcn.0100df39
test al, al
je 0x100f7a1
push edi
push ebx
mov ecx, esi
call fcn.0101193a
jmp 0x100f7f5
lea eax, [ebp - 4]
push eax
mov ecx, esi
call fcn.01007311
mov edi, eax
lea eax, [ebp - 8]
push eax
mov ecx, esi
call fcn.01007336
mov ecx, dword [edi]
mov edx, dword [eax]
lea ebx, [edx + ecx]
cmp ebx, ecx
jl 0x100f7e5
mov eax, dword [eax + 4]
mov ebx, dword [edi + 4]
add ebx, eax
cmp ebx, dword [edi + 4]
mov dword [ebp + 0xc], eax
jl 0x100f7e5
push 0xb
push eax
push edx
push dword [edi + 4]
push ecx
push dword [esi + 4]
call dword [sym.imp.DUSER.dll_SetGadgetRect]
mov ecx, dword [ebp - 4]
call fcn.010072f8
mov ecx, dword [ebp - 8]
call fcn.010072f8
test byte [ebp + 0xa], 2
je 0x100f8b3
push dword [esi + 4]
call dword [sym.imp.DUSER.dll_InvalidateGadget]
jmp 0x100f8b3
test byte [ebp + 8], 5
je 0x100f85a
mov eax, esi
mov edi, eax
mov eax, dword [eax + 0x20]
test eax, eax
je 0x100f824
cmp dword [edi + 0x44], 0xfffffffe
jne 0x100f815
test byte [ebp + 8], 1
je 0x100f83b
or byte [esi + 0x66], 2
mov ecx, dword [ebx + 0x14]
push 1
push 1
push edi
call fcn.0100e018
test byte [ebp + 8], 4
je 0x100f85a
mov eax, dword [esi + 0x68]
and eax, 0xfffffffd
push 1
or eax, 1
push 1
mov dword [esi + 0x68], eax
mov ecx, dword [ebx + 0x10]
push edi
call fcn.0100e018
test byte [ebp + 8], 0xa
je 0x100f8b3
mov eax, esi
xor edi, edi
mov esi, eax
mov eax, dword [eax + 0x20]
test eax, eax
je 0x100f879
test edi, edi
jne 0x100f873
mov edi, eax
cmp dword [esi + 0x44], 0xfffffffe
jne 0x100f864
test edi, edi
je 0x100f8b3
test byte [ebp + 8], 2
je 0x100f894
or byte [edi + 0x66], 2
mov ecx, dword [ebx + 0x14]
push 1
push 1
push esi
call fcn.0100e018
test byte [ebp + 8], 8
je 0x100f8b3
mov eax, dword [edi + 0x68]
and eax, 0xfffffffd
push 1
or eax, 1
push 1
mov dword [edi + 0x68], eax
mov ecx, dword [ebx + 0x10]
push esi
call fcn.0100e018
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x10158d3
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xd0
mov eax, dword [0x1028aa8]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
push edi
push esi
push 0x1003c6c
mov dword [ebp - 4], eax
lea eax, [ebp - 0xd0]
push 0x65
push eax
mov ebx, ecx
call dword [sym.imp.msvcrt.dll__snwprintf]
and word [ebp - 8], 0
add esp, 0x18
lea eax, [ebp - 0xd0]
push eax
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringW]
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x101592d
push dword [ebp + 0x10]
push edi
push esi
call eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0100b845
leave
ret 0xc

Function at 0x1017060
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x1028aa8]
push ebx
push esi
mov esi, ecx
xor ecx, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
cmp eax, ecx
push edi
mov dword [esi + 0x43c], eax
mov word [esi + 0x2c], cx
mov word [esi + 0x234], cx
jne 0x101709d
lea eax, [esi + 0x440]
mov dword [eax], ecx
mov dword [esi + 0x43c], eax
mov eax, dword [ebp + 0x10]
push dword [ebp + 8]
mov dword [esi + 0x10], eax
lea eax, [ebp - 0x58]
push 0x1003e98
push eax
mov byte [esi + 0xc], 0
call dword [sym.imp.msvcrt.dll_swprintf]
mov eax, dword [esi + 0x43c]
mov edi, dword [eax]
add esp, 0xc
push 0x1003e88
lea eax, [ebp - 0x58]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x1017107
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
je 0x1017107
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
push ebx
push edi
mov dword [ebp - 0x5c], eax
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
push eax
push dword [ebp - 0x5c]
mov ecx, esi
call fcn.01016cca
test eax, eax
jl 0x1017109
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0100b845
leave
ret 0xc

Function at 0x10176dd
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x1028aa8]
push edi
push 0x25
mov dword [ebp - 4], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x98]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
cmp dword [ebp - 0x94], 5
pop edi
jb 0x101772a
xor eax, eax
inc eax
cmp dword [ebp - 0x90], eax
jae 0x101772c
xor eax, eax
mov ecx, dword [ebp - 4]
call fcn.0100b845
leave
ret
Function at 0x1017856
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1028cf0]
cmp eax, 0xffffffff
push ebx
push esi
push edi
jne 0x1017875
mov edi, 0x80004005
jmp 0x1017974
push eax
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
xor ebx, ebx
cmp eax, ebx
je 0x101788c
inc dword [eax + 4]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
push 0x1c
call fcn.0100de3b
mov esi, eax
cmp esi, ebx
jne 0x10178a3
mov edi, 0x8007000e
jmp 0x1017937
push esi
push dword [0x1028cf0]
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
lea eax, [esi + 8]
push eax
push ebx
push 0x30
push 0x18
call fcn.01019e90
mov edi, eax
cmp edi, ebx
jl 0x1017937
lea eax, [esi + 0xc]
push eax
call fcn.0100fe4a
mov edi, eax
cmp edi, ebx
jl 0x1017937
lea eax, [esi + 0x10]
push eax
push 8
call fcn.0101c43d
mov edi, eax
cmp edi, ebx
jl 0x1017937
mov dword [esi + 4], 1
mov byte [esi + 0x14], bl
mov dword [esi + 0x18], ebx
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor ecx, ecx
cmp dword [0x102e2f8], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
setne cl
push 2
pop eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0x14
mov dword [ebp - 8], ebx
add ecx, eax
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0xc], ecx
call dword [sym.imp.DUSER.dll_InitGadgets]
cmp eax, ebx
mov dword [esi], eax
jne 0x1017885
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edi, eax
cmp esi, ebx
je 0x1017974
mov ecx, dword [esi + 0x10]
cmp ecx, ebx
je 0x1017947
call fcn.0101c42f
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x1017954
push eax
call fcn.0100d79e
mov eax, dword [esi]
cmp eax, ebx
je 0x1017961
push eax
call dword [sym.imp.DUSER.dll_DeleteHandle]
push esi
call fcn.01008235
push ebx
push dword [0x1028cf0]
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
mov eax, edi
jmp 0x1017887

Function at 0x1017980
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x1028cf0]
cmp eax, 0xffffffff
jne 0x1017990
mov eax, 0x80004005
ret
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x10179a5
mov eax, 0x8004000a
pop esi
ret
dec dword [esi + 4]
cmp dword [esi + 4], 0
jg 0x10179ee
push dword [esi]
call dword [sym.imp.DUSER.dll_DeleteHandle]
cmp byte [esi + 0x14], 0
je 0x10179c2
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [esi + 0x10]
call fcn.0101c42f
push dword [esi + 0xc]
call fcn.0100d79e
mov ecx, dword [esi + 8]
call fcn.0101c42f
push esi
call fcn.01008235
push 0
push dword [0x1028cf0]
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
xor eax, eax
pop esi
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..reloc
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
je 0x433072
nop
nop
nop
nop
nop
mov ebx, 0x40de38
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x21d41c2b
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..rdata
nop
cmp eax, 0
nop
nop
je 0x4330d2
nop
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x49bf6cbe
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x405730
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov eax, dword [esi - 0xcca8f8]
test ebx, ebx
les eax, [ecx + edi*8 + 0x56009e55]
pop ds
mov eax, dword [esi]
pop esp
add dword [edx - 0x61], ebp
push 0
push eax
call 0xd740a4b0
cmp eax, 0x11176
je fcn.00405764
mov dword [esi + 4], 0x40000000

Function at 0x406fa0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
pop edi
cmc
jne 0x406feb
xor ebx, ebx
cmp esi, ebx
push edi
jne 0x407027
hlt
jne 0x8640707d
push esi
call dword [sym.imp.WSOCK32.dll_inet_addr]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
lea ecx, [ebp - 0x14]
invalid
call 0xffec4a60
leave
clc
xor eax, eax
movsd dword es:[edi], dword [esi]
idiv dword [ecx + 0x71000e]
rep stosd dword es:[edi], eax
mov edi, edx
sbb al, 0x8b
dec ebp
or al, 0x8b
jge 0x40703e
insb byte es:[edi], dx
mov edx, dword [ecx + 0xc]
mov eax, dword [esp + edi]
mov ecx, edx
adc al, 0x52
rol byte [edx], cl
mov ecx, dword [eax]
push esi
mov dword [esi + 0x2c], ecx
invalid

Function at 0x408db0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov esp, dword [edx + edx*8 + 0x33101d8b]
leave
test eax, eax
jecxz 0x408e2d
pop edi
mov dword [eax - 4], edi
dec ebx
dec ebp
or al, 0xd1
stc
inc eax
push esi
jg 0x758ffc
pushal
fild dword [edi]
scasb al, byte es:[edi]
add byte [edx + 0x15f98349], bl
xchg esp, eax
xchg dword [eax], eax
rcr byte [ebx - 0x752dcd00], cl
xchg ecx, eax
adc byte [ecx + 0x60ff0040], dl
out dx, eax
clc
nop
inc eax
add byte [ebx - 0x2dccf78b], cl
mov eax, edi
cmp byte [ebx - 0x2f98731f], al
clc
unpckhps xmm0, xmm2
cmp eax, edx
je 0x408e31
dec ebp
leave
add al, 0x8d
inc ebp
cld
push 0xffffffffffffffd2
push eax
push 8
push 0x32cfae
push ecx
call dword [sym.imp.WSOCK32.dll_setsockopt]
cmp eax, 0xffffffb0
je 0x40908e
mov eax, dword [ebp + 0x10]
test eax, eax
and dword [eax], eax
cmp byte [esi + ecx + 0xc], dh
mov ah, 0xbb
cmp byte [0xd88b5e19], bl
sbb eax, 0xd88b5e19
pop ebp
ret 0xc
je 0x40909f
or ah, 2
mov dword [esi + 0x38], eax
xor eax, eax
pop esi
mov eax, dword [ecx]
pop ebp
ret 0xc
jmp 0x46ca8e88