joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1008a92
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push 2
push 0x21
push 0x1001afc
lea ecx, [ebp - 0x30]
call fcn.0100771f
mov ebx, dword [ebp + 0x10]
xor esi, esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
cmp ebx, esi
je 0x1008ac1
mov dword [ebx], esi
push 0x2a
pop eax
cmp dword [ebp + 0xc], esi
jne 0x1008ad9
mov dword [ebp - 0x30], 0x80070057
mov word [ebp - 0x2a], ax
jmp 0x1008b86
push 0x2b
mov word [ebp - 0x2c], ax
pop eax
cmp ebx, esi
je 0x1008ac9
mov word [ebp - 0x2c], ax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp + 0xc]
mov dword [ebp - 0x30], esi
push dword [ebp + 8]
mov dword [ebp - 4], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp + 0x14], esi
je 0x1008b20
cmp eax, 2
jne 0x1008b20
mov dword [ebp - 0x30], 1
push 0x31
jmp 0x1008b81
cmp eax, esi
jle 0x1008b2e
and eax, 0xffff
or eax, 0x80070000
push 0x34
mov dword [ebp - 0x30], eax
cmp eax, esi
pop eax
jge 0x1008b45
mov word [ebp - 0x2a], ax
mov dword [ebp - 0x28], 1
jmp 0x1008b86
cmp dword [ebp - 8], 4
push 0x36
mov word [ebp - 0x2c], ax
pop eax
je 0x1008b5e
mov dword [ebp - 0x30], 0x8007065d
jmp 0x1008ad0
cmp dword [ebp - 4], 4
mov word [ebp - 0x2c], ax
je 0x1008b77
push 0x37
mov dword [ebp - 0x30], 0x80004005
pop eax
jmp 0x1008ad0
mov eax, dword [ebp - 0xc]
mov dword [ebx], eax
mov dword [ebp - 0x30], esi
push 0x3b
pop eax
mov word [ebp - 0x2c], ax
mov esi, dword [ebp - 0x30]
lea ecx, [ebp - 0x30]
call fcn.010078e6
mov eax, esi
pop esi
pop ebx
leave
ret 0x10
Function at 0x10091f0
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x100c004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
push 1
push 0x393
push 0x1001c74
lea ecx, [ebp - 0x234]
call fcn.0100771f
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov eax, 0x398
test edi, edi
jne 0x100925e
mov dword [ebp - 0x234], 0x80070057
mov word [ebp - 0x22e], ax
jmp 0x1009308
cmp dword [ebp + 0xc], 0
mov word [ebp - 0x230], ax
mov eax, 0x399
jbe 0x1009248
and dword [ebp - 0x234], 0
mov word [ebp - 0x230], ax
xor eax, eax
mov word [edi], ax
mov esi, 0x105
push esi
lea eax, [ebp - 0x210]
push eax
push 0x1001c54
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x10092b1
call fcn.01008973
mov dword [ebp - 0x234], eax
mov eax, 0x3a2
jmp 0x1009252
mov ecx, 0x3a2
cmp eax, esi
mov word [ebp - 0x230], cx
lea eax, [ecx + 1]
jbe 0x10092d0
mov dword [ebp - 0x234], 0x8007007a
jmp 0x1009252
push dword [ebp + 0xc]
and dword [ebp - 0x234], 0
mov word [ebp - 0x230], ax
push edi
lea eax, [ebp - 0x210]
push eax
call fcn.01008ee0
mov dword [ebp - 0x234], eax
test eax, eax
mov eax, 0x3a5
jl 0x1009252
mov word [ebp - 0x230], ax
mov esi, dword [ebp - 0x234]
lea ecx, [ebp - 0x234]
call fcn.010078e6
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.01006fd7
leave
ret 8
Function at 0x1026aa4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x1001204]
test eax, eax
je 0x1026afe
push esi
push eax
call dword [0x1001208]
mov esi, eax
test esi, esi
je 0x1026aef
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x100120c]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x1026aeb
cmp esi, eax
jae 0x1026aef
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x1026add
cmp esi, eax
jb 0x1026af3
xor eax, eax
jmp 0x1026afd
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop ebp
ret 0xc
Function at 0x102820f
Capabilities:
Check for time delay via gettickcount
Query service status

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10b30cc]
mov esi, 0x10b30cc
cmp eax, esi
mov edi, 0x10022a4
je 0x1028257
test byte [eax + 0x1c], 1
je 0x1028257
cmp byte [eax + 0x19], 5
jb 0x1028257
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
push 0x31
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010442ac
mov eax, dword [0x10b30cc]
and dword [ebp - 8], 0
and dword [ebp - 4], 0
cmp eax, esi
je 0x1028282
test byte [eax + 0x1c], 2
je 0x1028282
cmp byte [eax + 0x19], 5
jb 0x1028282
push edi
push 0x32
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01026c05
mov eax, dword [0x10b30cc]
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 4], 1
je 0x10283bf
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ebp + 0x14]
cmp ecx, edx
jae 0x102829e
mov edx, ecx
mov ebx, 0x1f4
cmp edx, ebx
jb 0x10282b0
mov ebx, dword [ebp + 0x14]
cmp ecx, ebx
jae 0x10282b0
mov ebx, ecx
cmp eax, esi
je 0x10282cf
test byte [eax + 0x1c], 2
je 0x10282cf
cmp byte [eax + 0x19], 5
jb 0x10282cf
push ebx
push edi
push 0x33
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01028164
push ebx
call dword [0x10011d4]
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
push 0x24
push ebx
push 0
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x102831c
cmp dword [ebx + 4], 1
je 0x1028355
mov ebx, dword [fcn.010011d8]
call ebx
sub eax, dword [ebp + 0x10]
cmp eax, dword [ebp + 0x14]
ja 0x1028382
mov eax, dword [ebp + 0xc]
cmp dword [eax + 4], 1
mov eax, dword [0x10b30cc]
jne 0x102828f
jmp 0x10283bf
call dword [fcn.010011dc]
mov dword [ebp - 4], eax
mov eax, dword [0x10b30cc]
cmp eax, esi
je 0x10283ef
test byte [eax + 0x1c], 2
je 0x10283bf
cmp byte [eax + 0x19], 2
jb 0x10283bf
push dword [ebp - 4]
push edi
push 0x34
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01028164
jmp 0x10283ba
and dword [ebp - 4], 0
mov eax, dword [0x10b30cc]
cmp eax, esi
je 0x10283ef
test byte [eax + 0x1c], 2
je 0x10283bf
cmp byte [eax + 0x19], 5
jb 0x10283bf
push edi
push 0x35
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01026c05
jmp 0x10283ba
mov dword [ebp - 4], 0x5b4
mov eax, dword [0x10b30cc]
cmp eax, esi
je 0x10283ef
test byte [eax + 0x1c], 2
je 0x10283bf
cmp byte [eax + 0x19], 2
jb 0x10283bf
push dword [ebp + 0x14]
call ebx
push eax
push dword [ebp + 0x10]
mov eax, dword [0x10b30cc]
push edi
push 0x36
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0104412d
mov eax, dword [0x10b30cc]
cmp eax, esi
je 0x10283ef
test byte [eax + 0x1c], 1
je 0x10283ef
mov edx, dword [ebp - 4]
movzx ecx, byte [eax + 0x19]
neg edx
sbb edx, edx
and edx, 0xfffffffd
add edx, 5
cmp ecx, edx
jl 0x10283ef
push dword [ebp - 4]
push edi
push 0x37
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01028164
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x10283fe
Capabilities:
Query service status
Stop service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x10b30cc]
mov esi, 0x10b30cc
cmp eax, esi
mov ebx, 0x10022a4
je 0x102843f
test byte [eax + 0x1c], 1
je 0x102843f
cmp byte [eax + 0x19], 5
jb 0x102843f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
push 0x38
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0104412d
and dword [ebp - 0x28], 0
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
call dword [fcn.010011d8]
mov dword [ebp + 8], eax
lea eax, [ebp - 4]
push eax
push 0x24
lea eax, [ebp - 0x28]
push eax
xor edi, edi
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x10284ad
call dword [fcn.010011dc]
mov edi, eax
mov eax, dword [0x10b30cc]
cmp eax, esi
je 0x102854b
test byte [eax + 0x1c], 2
je 0x102851e
cmp byte [eax + 0x19], 2
jb 0x102851e
push edi
push ebx
push 0x39
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01028164
jmp 0x1028519
cmp dword [ebp - 0x24], 1
jne 0x10284dc
mov eax, dword [0x10b30cc]
cmp eax, esi
je 0x102854b
test byte [eax + 0x1c], 2
je 0x102851e
cmp byte [eax + 0x19], 5
jb 0x102851e
push ebx
push 0x3a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01026c05
jmp 0x1028519
cmp dword [ebp - 0x24], 3
jne 0x1028554
mov eax, dword [0x10b30cc]
cmp eax, esi
je 0x1028505
test byte [eax + 0x1c], 2
je 0x1028505
cmp byte [eax + 0x19], 5
jb 0x1028505
push ebx
push 0x3b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01026c05
push dword [ebp + 0x10]
lea eax, [ebp - 0x28]
push dword [ebp + 8]
push eax
push dword [ebp + 0xc]
call fcn.0102820f
mov edi, eax
mov eax, dword [0x10b30cc]
cmp eax, esi
je 0x102854b
test byte [eax + 0x1c], 1
je 0x102854b
movzx ecx, byte [eax + 0x19]
mov edx, edi
neg edx
sbb edx, edx
and edx, 0xfffffffd
add edx, 5
cmp ecx, edx
jl 0x102854b
push edi
push ebx
push 0x3d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01028164
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0xc
mov eax, dword [0x10b30cc]
cmp eax, esi
je 0x1028577
test byte [eax + 0x1c], 2
je 0x1028577
cmp byte [eax + 0x19], 5
jb 0x1028577
push ebx
push 0x3c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01026c05
lea eax, [ebp - 0x28]
push eax
push 1
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x1028505
call dword [fcn.010011dc]
jmp 0x1028517
Function at 0x1028f67
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10b30cc]
mov esi, 0x10b30cc
cmp eax, esi
mov edi, 0x10022a4
je 0x1028faf
test byte [eax + 0x1c], 1
je 0x1028faf
cmp byte [eax + 0x19], 5
jb 0x1028faf
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
push 0x29
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01028190
mov eax, dword [0x10b30cc]
and dword [ebp - 4], 0
cmp eax, esi
je 0x1028ff9
test byte [eax + 0x1c], 2
je 0x1028fd6
cmp byte [eax + 0x19], 5
jb 0x1028fd6
push edi
push 0x2a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01026c05
mov eax, dword [0x10b30cc]
cmp eax, esi
je 0x1028ff9
test byte [eax + 0x1c], 2
je 0x1028ff9
cmp byte [eax + 0x19], 5
jb 0x1028ff9
push 0x1f4
push edi
push 0x2b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01028164
push 0x1f4
call dword [0x10011d4]
mov eax, dword [0x10b30cc]
cmp eax, esi
je 0x1029027
test byte [eax + 0x1c], 2
je 0x1029027
cmp byte [eax + 0x19], 5
jb 0x1029027
push edi
push 0x2c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01026c05
push 1
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
test ebx, ebx
je 0x102906e
mov dword [ebp - 8], 1
mov eax, dword [0x10b30cc]
cmp eax, esi
je 0x1029065
test byte [eax + 0x1c], 2
je 0x1029065
cmp byte [eax + 0x19], 5
jb 0x1029065
push edi
push 0x2d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01026c05
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1029095
and dword [ebp - 8], 0
mov eax, dword [0x10b30cc]
cmp eax, esi
je 0x1029095
test byte [eax + 0x1c], 2
je 0x1029095
cmp byte [eax + 0x19], 5
jb 0x1029095
push edi
push 0x2e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01026c05
mov ebx, dword [fcn.010011d8]
call ebx
sub eax, dword [ebp + 0x10]
cmp eax, dword [ebp + 0x14]
ja 0x10290b1
cmp dword [ebp - 8], 0
jne 0x1028fd1
jmp 0x10290e9
mov dword [ebp - 4], 0x5b4
mov eax, dword [0x10b30cc]
cmp eax, esi
je 0x102911e
test byte [eax + 0x1c], 2
je 0x10290ee
cmp byte [eax + 0x19], 2
jb 0x10290ee
push dword [ebp + 0x14]
call ebx
push eax
push dword [ebp + 0x10]
mov eax, dword [0x10b30cc]
push edi
push 0x2f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0104412d
mov eax, dword [0x10b30cc]
cmp eax, esi
je 0x102911e
test byte [eax + 0x1c], 1
je 0x102911e
mov edx, dword [ebp - 4]
movzx ecx, byte [eax + 0x19]
neg edx
sbb edx, edx
and edx, 0xfffffffd
add edx, 5
cmp ecx, edx
jl 0x102911e
push dword [ebp - 4]
push edi
push 0x30
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01028164
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.01026e74
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x102bbc0
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x10b30cc]
cmp eax, 0x10b30cc
mov edi, dword [ebp + 0x18]
mov esi, 0x10023d0
je 0x102bc0f
test byte [eax + 0x1c], 1
je 0x102bc0f
cmp byte [eax + 0x19], 5
jb 0x102bc0f
push dword [ebp + 0x1c]
push dword [edi]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
push 0x31
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0102ad12
mov eax, dword [0x10b30cc]
mov edx, dword [ebp + 8]
xor ebx, ebx
cmp edx, 0xffffffff
mov dword [ebp + 0x18], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], edx
je 0x102bc32
cmp edx, ebx
je 0x102bc32
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x102bc32
cmp word [ecx], bx
jne 0x102bc71
mov ecx, 0x80070057
mov dword [ebp + 0x18], ecx
cmp eax, 0x10b30cc
je 0x102bd7a
test byte [eax + 0x1c], 2
je 0x102bd46
cmp byte [eax + 0x19], 2
jb 0x102bd46
push dword [ebp + 0x1c]
push dword [edi]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edx
push ecx
push esi
push 0x32
jmp 0x102bd36
mov eax, dword [ebp + 0x14]
mov dword [edi], eax
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x102bc95
cmp word [eax], bx
je 0x102bc95
push 0x2011f
push eax
push edx
lea ecx, [ebp - 4]
call fcn.01028000
mov ebx, eax
jmp 0x102bca1
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 4]
call fcn.0102bb64
test ebx, ebx
jne 0x102bcd6
and dword [ebp - 8], ebx
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
lea ecx, [ebp - 4]
call fcn.0102aa71
mov ebx, eax
test ebx, ebx
jne 0x102bcc2
mov eax, dword [ebp - 8]
mov dword [edi], eax
cmp dword [ebp + 0x1c], 1
jne 0x102bcd6
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebx, eax
cmp ebx, 0x490
je 0x102bce3
cmp ebx, 2
jne 0x102bce5
xor ebx, ebx
test ebx, ebx
je 0x102bd41
jle 0x102bcf7
and ebx, 0xffff
or ebx, 0x80070000
mov dword [ebp + 0x18], ebx
mov eax, dword [0x10b30cc]
cmp eax, 0x10b30cc
je 0x102bd7a
test byte [eax + 0x1c], 2
je 0x102bd46
movzx ecx, byte [eax + 0x19]
xor edx, edx
cmp ebx, edx
setl dl
dec edx
and edx, 3
inc edx
inc edx
cmp ecx, edx
jl 0x102bd46
push dword [ebp + 0x1c]
push dword [edi]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
push esi
push 0x33
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0102ac2f
mov eax, dword [0x10b30cc]
cmp eax, 0x10b30cc
je 0x102bd7a
test byte [eax + 0x1c], 1
je 0x102bd7a
movzx ecx, byte [eax + 0x19]
xor edx, edx
cmp dword [ebp + 0x18], edx
setl dl
dec edx
and edx, 3
inc edx
inc edx
cmp ecx, edx
jl 0x102bd7a
push dword [ebp + 0x18]
push esi
push 0x34
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01028164
lea ecx, [ebp - 0xc]
call fcn.01027fe2
lea ecx, [ebp - 4]
call fcn.01027fe2
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebx
leave
ret 0x18
Function at 0x1043520
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0
push dword [ebp + 8]
push 0
call dword [0x10013d0]
test eax, eax
jne 0x1043557
push dword [ebp + 8]
call dword [0x1001168]
cmp eax, 0xffffffff
jne 0x104354c
call dword [fcn.010011dc]
jmp 0x1043559
test al, 0x10
jne 0x1043557
mov eax, 0x10b
jmp 0x1043559
xor eax, eax
pop ebp
ret 4

Function at 0x10439d7
Capabilities:
Delete directory
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [0x10b3818]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x258], ebx
mov dword [ebp - 0x250], ebx
mov dword [ebp - 0x254], ebx
call fcn.01049c36
test eax, eax
je 0x1043bbe
call fcn.01049bdb
test eax, eax
je 0x1043bbe
cmp esi, ebx
je 0x1043bb9
cmp dword [ebp + 0xc], 0x104
jb 0x1043bb9
push edi
push esi
push ebx
push ebx
push 0x1c
push ebx
mov word [esi], bx
call dword [0x10013cc]
cmp eax, ebx
jl 0x1043b63
push 0x1003c00
push dword [ebp + 0xc]
push esi
call fcn.01043959
cmp eax, ebx
jl 0x1043b63
push esi
call fcn.01043520
mov edi, eax
cmp edi, ebx
jne 0x1043ba6
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x1043a77
sub eax, edx
push 0x1003bc4
push dword [ebp + 0xc]
sar eax, 1
lea eax, [esi + eax*2]
push esi
mov dword [ebp - 0x258], eax
call fcn.01043959
cmp eax, ebx
jl 0x1043b63
push esi
mov edi, 0x124
push edi
lea eax, [ebp - 0x24c]
push eax
call fcn.0104391f
cmp eax, ebx
jl 0x1043b63
push 0x1003bac
push edi
lea eax, [ebp - 0x24c]
push eax
call fcn.01043959
cmp eax, ebx
jl 0x1043b63
push esi
call fcn.01043520
mov edi, eax
cmp edi, ebx
jne 0x1043b92
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x1043aee
sub eax, edx
sar eax, 1
lea eax, [esi + eax*2]
push esi
mov dword [ebp - 0x250], eax
call fcn.01043790
mov edi, eax
cmp edi, ebx
jne 0x1043b7e
push 0x1003ba0
push dword [ebp + 0xc]
push esi
call fcn.01043959
cmp eax, ebx
jl 0x1043b63
push esi
call fcn.01043520
mov edi, eax
cmp edi, ebx
jne 0x1043b7e
push esi
call fcn.01043679
mov edi, eax
cmp edi, ebx
jne 0x1043b7e
lea eax, [ebp - 0x24c]
push eax
call fcn.01043520
mov edi, eax
cmp edi, ebx
jne 0x1043b7e
lea eax, [ebp - 0x24c]
push eax
mov dword [ebp - 0x254], 1
call fcn.01043562
mov edi, eax
cmp edi, ebx
je 0x1043bab
cmp dword [ebp - 0x254], ebx
je 0x1043b7e
lea eax, [ebp - 0x24c]
push eax
call dword [0x100116c]
mov eax, dword [ebp - 0x250]
cmp eax, ebx
je 0x1043b92
push esi
mov word [eax], bx
call dword [0x100116c]
mov eax, dword [ebp - 0x258]
cmp eax, ebx
je 0x1043ba6
push esi
mov word [eax], bx
call dword [0x100116c]
mov word [esi], bx
jmp 0x1043bb4
mov eax, dword [ebp - 0x250]
mov word [eax], bx
mov eax, edi
pop edi
jmp 0x1043bc3
push 0x57
pop eax
jmp 0x1043bc3
mov eax, 0x8000ffff
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0107a6bf
leave
ret 8
Function at 0x104675f
Capabilities:
Monitor local ipv4 address changes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
call fcn.01049c36
test eax, eax
je 0x10468b0
call fcn.01049bdb
test eax, eax
je 0x10468b0
push ebx
push edi
mov ebx, 0x10b6b94
push ebx
call dword [fcn.010011c4]
xor eax, eax
mov edi, 0x10b6b80
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push esi
push esi
stosd dword es:[edi], eax
push esi
push esi
mov dword [0x10b6bc0], esi
stosd dword es:[edi], eax
call dword [0x10011c8]
xor edi, edi
inc edi
cmp eax, esi
mov dword [0x10b6b90], eax
je 0x10467d9
push esi
push 0xffffffffffffffff
push esi
push 0x104653e
push eax
push 0x10b6bbc
call dword [0x100117c]
test eax, eax
jne 0x10467e4
call dword [fcn.010011dc]
mov dword [ebp - 4], eax
jmp 0x104681f
push 0x10b6b80
push 0x10b6bb8
mov dword [ebp - 8], edi
call fcn.01081968
cmp eax, 0x3e5
mov dword [ebp - 4], eax
jne 0x104681f
mov esi, 0x10b6bb4
mov dword [ebp - 0xc], edi
call fcn.01044417
test eax, eax
mov dword [ebp - 4], eax
jne 0x1046826
and dword [ebp - 4], eax
mov dword [0x10b6bd0], edi
xor esi, esi
cmp dword [ebp - 4], esi
je 0x10468a2
jmp 0x1046828
xor esi, esi
push ebx
mov dword [0x10b6bc0], edi
call dword [fcn.010011c0]
cmp dword [ebp - 8], esi
je 0x104684e
push 0xffffffffffffffff
push dword [0x10b6bbc]
call dword [0x1001170]
mov dword [0x10b6bbc], esi
push ebx
call dword [fcn.010011c4]
cmp dword [ebp - 0xc], esi
je 0x1046864
push 0x10b6b80
call fcn.01081938
mov eax, dword [0x10b6b90]
cmp eax, esi
je 0x1046874
push eax
call dword [fcn.010011f8]
xor eax, eax
mov edi, 0x10b6b80
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [0x10b6bb4]
cmp eax, esi
je 0x1046896
push eax
call fcn.0107a4d2
pop ecx
mov dword [0x10b6bb4], esi
mov dword [0x10b6bb8], esi
mov dword [0x10b6bd0], esi
push ebx
call dword [fcn.010011c0]
mov eax, dword [ebp - 4]
pop edi
pop ebx
jmp 0x10468df
mov eax, dword [0x10b30cc]
cmp eax, 0x10b30cc
je 0x10468da
test byte [eax + 0x1c], 4
je 0x10468da
cmp byte [eax + 0x19], 2
jb 0x10468da
push 0x1003c18
push 0x66
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01026c05
mov eax, 0x8000ffff
pop esi
leave
ret
Function at 0x1052eb5
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 8], edi
je 0x1052ed1
mov eax, 0x8000ffff
jmp 0x1052fb4
lea ecx, [esi + 0x24]
mov dword [ebp - 4], ecx
call fcn.0102a6f3
cmp eax, edi
jl 0x1052fb4
push ebx
mov ebx, dword [0x10011c8]
push edi
push edi
push edi
push edi
call ebx
cmp eax, edi
mov dword [esi + 0x40], eax
jne 0x1052f0a
mov ecx, dword [ebp - 4]
call fcn.010520e5
call fcn.0102a70c
jmp 0x1052fb3
push edi
push edi
push edi
push edi
call ebx
cmp eax, edi
mov dword [ebp - 8], eax
je 0x1052f78
push edi
push edi
push eax
mov ecx, esi
call fcn.01052ce2
cmp eax, edi
mov dword [ebp - 4], eax
jge 0x1052f3f
push dword [ebp - 8]
call dword [fcn.010011f8]
push 0x2710
mov ecx, esi
call fcn.01052699
jmp 0x1052fb0
push edi
push edi
push edi
push edi
call ebx
mov ebx, eax
cmp ebx, edi
je 0x1052f78
push edi
push edi
push ebx
mov ecx, esi
call fcn.01052ce2
cmp eax, edi
mov dword [ebp - 4], eax
jge 0x1052f5f
push ebx
jmp 0x1052f2b
lea eax, [esi + 4]
push eax
push edi
push esi
push 0x1052d84
push edi
push edi
call dword [0x1001188]
cmp eax, edi
mov dword [esi], eax
jne 0x1052f99
call fcn.0102a70c
push 0x2710
mov ecx, esi
mov ebx, eax
call fcn.01052699
cmp eax, edi
jge 0x1052f95
cmp ebx, edi
jl 0x1052f95
mov ebx, eax
mov eax, ebx
jmp 0x1052fb3
push 0xffffffffffffffff
push dword [esi + 0x40]
call dword [fcn.010011d0]
test eax, eax
je 0x1052fb0
call fcn.0102a70c
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ebx
pop edi
pop esi
leave
ret