joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001fa0
Capabilities:
Check mutex on windows
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
call fcn.10003ad0
lea eax, [ebp - 0x2c]
push 0xc
push 0x101021b9
push 0x1d
push 0x1010219c
push eax
call fcn.1000aeb0
add esp, 0x14
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x28]
cmp edi, 7
ja 0x10001fed
test edi, edi
je 0x10002028
xor edx, edx
nop dword [eax]
cmp byte [ebx + edx], 0
je 0x10001ffd
inc edx
cmp edi, edx
jne 0x10001fe0
jmp 0x10002028
push edi
push ebx
push 0
call fcn.100e11a0
add esp, 0xc
test eax, eax
je 0x10002028
cmp esi, 0x80000000
je 0x10002041
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edx
lea eax, [ebp - 0x1c]
push 0x101021d0
push 0x1010212c
push eax
push 0
push 1
call fcn.100dc670
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], edi
push eax
call fcn.100d1340
add esp, 4
mov ebx, eax
mov edi, edx
push ebx
push 0
push 0
call sub.kernel32.dll_CreateMutexA
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
je 0x10002169
mov dword [ebp - 0x20], ebx
call fcn.1000b340
push 0x7d0
call fcn.1000a5c0
add esp, 4
mov esi, dword [0x10194460]
movzx eax, byte [esi]
push 1
push 0x6b600
call fcn.1000d070
add esp, 8
test eax, eax
je 0x10002186
mov ebx, eax
push 0x6b600
push 0x101021e0
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
xor eax, eax
nop word [eax + eax]
mov ecx, eax
and ecx, 0x1f
movzx ecx, byte [ecx + 0x1016d7e0]
xor byte [ebx + eax], cl
inc eax
cmp eax, 0x6b600
jne 0x100020b0
push 0xfa0
call fcn.1000a5c0
add esp, 4
lea eax, [ebp - 0x1c]
push eax
call fcn.10009260
add esp, 4
mov eax, dword [ebp - 0x1c]
cmp eax, 0x80000000
je 0x100020fc
test eax, eax
je 0x100020fc
push 1
push eax
push dword [ebp - 0x18]
call fcn.1000d080
add esp, 0xc
movzx eax, byte [esi]
push 1
push 0x6b600
call fcn.1000d070
add esp, 8
test eax, eax
je 0x10002186
mov esi, eax
push 0x6b600
push ebx
push eax
call sub.msvcrt.dll_memcpy
sub esp, 0xc
mov dword [esp], esi
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x6b600
call fcn.1000c1d0
add esp, 0x18
push 1
push 0x6b600
push esi
call fcn.1000d080
add esp, 0xc
push 1
push 0x6b600
push ebx
call fcn.1000d080
add esp, 0xc
mov ebx, dword [ebp - 0x20]
test edi, edi
mov byte [ebx], 0
je 0x1000217e
push 1
push edi
push ebx
call fcn.1000d080
add esp, 0x2c
jmp 0x10002181
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x6b600
push 1
call fcn.100d0890
nop word cs:[eax + eax]
nop dword [eax]
Function at 0x10005230
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [0x101010b8]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
movzx eax, byte [eax]
cmp al, 1
jne 0x10005258
call fcn.100055c0
jmp 0x1000542f
mov eax, dword [edx + 8]
movdqu xmm0, xmmword [ecx + 0x30]
test eax, eax
je 0x1000542a
movdqu xmm7, xmmword [ecx]
mov esi, dword [edx]
movdqu xmm5, xmmword [ecx + 0x10]
movdqu xmm3, xmmword [ecx + 0x20]
mov edx, dword [edx + 4]
xor edi, edi
movdqa xmmword [esp], xmm7
nop word cs:[eax + eax]
nop dword [eax]
mov ebx, 0xa
movdqa xmm4, xmm5
movdqa xmm6, xmm0
movdqa xmm2, xmm3
nop word cs:[eax + eax]
nop dword [eax + eax]
paddd xmm7, xmm5
dec ebx
pxor xmm6, xmm7
movdqa xmm1, xmm6
pslld xmm6, 0x10
psrld xmm1, 0x10
por xmm6, xmm1
paddd xmm3, xmm6
pxor xmm5, xmm3
movdqa xmm1, xmm5
pslld xmm5, 0xc
psrld xmm1, 0x14
por xmm5, xmm1
paddd xmm7, xmm5
pxor xmm6, xmm7
pshufd xmm7, xmm7, 0x93
movdqa xmm1, xmm6
pslld xmm6, 8
psrld xmm1, 0x18
por xmm6, xmm1
paddd xmm3, xmm6
pshufd xmm6, xmm6, 0x4e
pxor xmm5, xmm3
pshufd xmm3, xmm3, 0x39
movdqa xmm1, xmm5
pslld xmm5, 7
psrld xmm1, 0x19
por xmm5, xmm1
paddd xmm7, xmm5
pxor xmm6, xmm7
movdqa xmm1, xmm6
pslld xmm6, 0x10
psrld xmm1, 0x10
por xmm6, xmm1
paddd xmm3, xmm6
pxor xmm5, xmm3
movdqa xmm1, xmm5
pslld xmm5, 0xc
psrld xmm1, 0x14
por xmm5, xmm1
paddd xmm7, xmm5
pxor xmm6, xmm7
pshufd xmm7, xmm7, 0x39
movdqa xmm1, xmm6
pslld xmm6, 8
psrld xmm1, 0x18
por xmm6, xmm1
paddd xmm3, xmm6
pshufd xmm6, xmm6, 0x4e
pxor xmm5, xmm3
pshufd xmm3, xmm3, 0x93
movdqa xmm1, xmm5
pslld xmm5, 7
psrld xmm1, 0x19
por xmm5, xmm1
jne 0x100052b0
mov ebx, edi
paddd xmm6, xmm0
paddd xmm3, xmm2
movdqa xmmword [esp + 0x10], xmm0
movdqa xmm0, xmm2
movdqa xmm2, xmmword [esp]
paddd xmm5, xmm4
inc edi
shl ebx, 6
cmp eax, edi
movdqu xmm1, xmmword [esi + ebx + 0x30]
paddd xmm7, xmm2
pxor xmm6, xmm1
movdqu xmm1, xmmword [esi + ebx + 0x20]
pxor xmm3, xmm1
movdqu xmm1, xmmword [esi + ebx + 0x10]
pxor xmm5, xmm1
movdqu xmm1, xmmword [esi + ebx]
pxor xmm7, xmm1
movdqu xmmword [edx + ebx], xmm7
movdqu xmmword [edx + ebx + 0x10], xmm5
movdqu xmmword [edx + ebx + 0x20], xmm3
movdqa xmm3, xmm0
movdqa xmm0, xmmword [esp + 0x10]
movdqa xmm7, xmm2
movdqa xmm5, xmm4
movdqu xmmword [edx + ebx + 0x30], xmm6
paddd xmm0, xmmword [0x1016e4a0]
jne 0x10005290
movd dword [ecx + 0x30], xmm0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10012ca0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov eax, dword [ebp + 8]
mov esi, dword [eax]
test esi, esi
je 0x10012d29
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x10012d21
je 0x10012cd6
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x10012cda
mov edi, dword [eax]
mov dword [eax], 0
test edi, edi
je 0x10012cdc
mov edi, dword [eax + 4]
jmp 0x10012cdc
xor eax, eax
jmp 0x10012d21
xor edi, edi
mov eax, dword [0x10194460]
movzx eax, byte [eax]
push 4
push 8
call fcn.1000d070
add esp, 8
test eax, eax
je 0x10012d45
mov dword [eax], edi
mov dword [eax + 4], esi
push esi
mov ebx, eax
call sub.kernel32.dll_TlsGetValue
mov edi, eax
mov dword [ebp - 0x10], ebx
push ebx
push esi
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x10012d1e
push 4
push 8
push edi
call fcn.1000d080
add esp, 0xc
mov eax, dword [ebp - 0x10]
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call fcn.100adc50
add esp, 4
mov esi, eax
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x10012cbc
jmp 0x10012d21
push 8
push 4
call fcn.100d08b0
nop

Function at 0x10012d50
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov eax, dword [ebp + 8]
mov esi, dword [eax]
test esi, esi
je 0x10012e0f
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x10012e07
je 0x10012e05
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x10012d8f
mov edi, dword [eax + 4]
cmp dword [eax], 0
mov dword [eax], 0
jne 0x10012d9f
call fcn.10052b60
push eax
call fcn.10050ce0
add esp, 4
mov edi, eax
mov eax, dword [0x10194460]
movzx eax, byte [eax]
push 4
push 8
call fcn.1000d070
add esp, 8
test eax, eax
je 0x10012e36
mov dword [eax], edi
mov dword [eax + 4], esi
push esi
mov ebx, eax
call sub.kernel32.dll_TlsGetValue
mov edi, eax
mov dword [ebp - 0x10], ebx
push ebx
push esi
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x10012e00
mov eax, dword [edi]
mov ecx, dword [eax + 0x410]
lea edx, [ecx - 1]
mov dword [eax + 0x410], edx
cmp dword [eax + 0x40c], 0
jne 0x10012df3
cmp ecx, 1
je 0x10012e2b
push 4
push 8
push edi
call fcn.1000d080
add esp, 0xc
mov eax, dword [ebp - 0x10]
jmp 0x10012e07
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call fcn.100adc50
add esp, 4
mov esi, eax
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x10012d74
jmp 0x10012e07
push eax
call fcn.10051800
add esp, 4
jmp 0x10012df3
push 8
push 4
call fcn.100d08b0
nop
Function at 0x10012e40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [ebp + 8]
mov esi, dword [eax]
test esi, esi
je 0x10012f11
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x10012f09
je 0x10012f07
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x10012e96
mov ecx, dword [eax + 4]
mov edi, dword [eax + 8]
cmp dword [eax], 0
mov dword [eax], 0
je 0x10012e96
mov eax, edi
mov ebx, edi
mov dword [ebp - 0x10], ecx
shr eax, 0x10
shr ebx, 0x18
mov dword [ebp - 0x14], eax
jmp 0x10012ea6
mov dword [ebp - 0x14], 0
xor edi, edi
mov dword [ebp - 0x10], 0
mov eax, dword [0x10194460]
movzx eax, byte [eax]
push 4
push 0xc
call fcn.1000d070
add esp, 8
test eax, eax
je 0x10012f2d
movzx edx, byte [ebp - 0x14]
movzx ecx, bl
shl ecx, 0x18
shl edx, 0x10
or edx, ecx
movzx ecx, di
or ecx, edx
mov edx, dword [ebp - 0x10]
mov dword [eax + 4], ecx
mov dword [eax], edx
mov dword [eax + 8], esi
push esi
mov ebx, eax
call sub.kernel32.dll_TlsGetValue
mov edi, eax
mov dword [ebp - 0x10], ebx
push ebx
push esi
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x10012f02
push 4
push 0xc
push edi
call fcn.1000d080
add esp, 0xc
mov eax, dword [ebp - 0x10]
jmp 0x10012f09
xor eax, eax
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call fcn.100adc50
add esp, 4
mov esi, eax
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x10012e66
jmp 0x10012f09
push 0xc
push 4
call fcn.100d08b0
nop word cs:[eax + eax]

Function at 0x10012f40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [ebp + 8]
mov esi, dword [eax]
test esi, esi
je 0x10013002
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x10012ffa
je 0x10012ff8
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x10012f8e
mov ecx, dword [eax]
movups xmm0, xmmword [eax + 8]
mov dword [eax], 0
or ecx, dword [eax + 4]
mov dword [eax + 4], 0
jne 0x10012fa8
xorps xmm0, xmm0
lea eax, [esp + 0x10]
movaps xmmword [esp + 0x10], xmm0
push 0x10
push eax
call dword [sym.imp.bcryptprimitives.dll_ProcessPrng]
movaps xmm0, xmmword [esp + 0x10]
mov eax, dword [0x10194460]
movaps xmmword [esp], xmm0
movzx eax, byte [eax]
push 8
push 0x18
call fcn.1000d070
add esp, 8
test eax, eax
je 0x1001301e
movaps xmm0, xmmword [esp]
movups xmmword [eax], xmm0
mov dword [eax + 0x10], esi
push esi
mov ebx, eax
call sub.kernel32.dll_TlsGetValue
mov edi, eax
mov dword [esp], ebx
push ebx
push esi
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x10012ff3
push 8
push 0x18
push edi
call fcn.1000d080
add esp, 0xc
mov eax, dword [esp]
jmp 0x10012ffa
xor eax, eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call fcn.100adc50
add esp, 4
mov esi, eax
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x10012f69
jmp 0x10012ffa
push 0x18
push 8
call fcn.100d08b0
nop word [eax + eax]
Function at 0x10013cf0
Capabilities:
List groups for user account

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp byte [eax + 0x28], 0
je 0x10013d61
cmp dword [eax + 0x18], 0x80000000
je 0x10013d61
mov eax, dword [eax + 0x1c]
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x30], 0
lea edx, [ebp - 0x20]
lea esi, [ebp - 0x1c]
push ecx
push edx
push 0xffffffffffffffff
push esi
push 1
push 0
push eax
push 0x1017004c
call sub.netapi32.dll_NetUserGetLocalGroups
test eax, eax
je 0x10013d7a
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x10], 0
jmp 0x10013e7a
mov dword [ebx], 0
mov dword [ebx + 4], 4
mov dword [ebx + 8], 0
jmp 0x10013ea7
mov esi, dword [ebp - 0x20]
test esi, esi
je 0x10013db5
mov edi, esi
shl edi, 4
cmp esi, 0x7ffffff
ja 0x10013ecb
mov eax, dword [0x10194460]
movzx eax, byte [eax]
push 4
push edi
call fcn.1000d070
add esp, 8
test eax, eax
jne 0x10013dba
mov eax, 4
push edi
push eax
call fcn.100d0890
mov eax, 4
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
test ecx, ecx
mov dword [ebp - 0x2c], ecx
je 0x10013e98
mov ebx, dword [ebp - 0x20]
cmp ebx, esi
ja 0x10013eb1
xor edx, edx
test ebx, ebx
je 0x10013e74
mov ecx, edx
add edx, ebx
xor edi, edi
shl ecx, 4
mov dword [ebp - 0x24], edx
lea eax, [ecx + eax + 0xc]
mov dword [ebp - 0x28], eax
jmp 0x10013e1c
mov esi, dword [ebp - 0x28]
mov dword [esi + edi*4 - 0xc], ecx
mov dword [esi + edi*4 - 8], edx
mov dword [esi + edi*4 - 4], eax
mov dword [esi + edi*4], 0
add edi, 4
dec ebx
je 0x10013e71
mov eax, dword [ebp - 0x2c]
mov edx, 1
mov ecx, 0
mov eax, dword [eax + edi]
mov dword [ebp - 0x34], eax
test eax, eax
mov eax, 0
je 0x10013e00
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.10041590
add esp, 8
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x38]
mov edx, 0
mov esi, 1
cmp ecx, 0x80000000
cmove eax, edx
mov edx, dword [ebp - 0x3c]
cmove edx, esi
mov esi, 0
cmove ecx, esi
jmp 0x10013e00
mov edx, dword [ebp - 0x24]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
movsd xmm0, qword [ebp - 0x18]
test eax, eax
mov dword [ebx + 8], ecx
movsd qword [ebx], xmm0
je 0x10013ea7
push eax
call sub.netapi32.dll_NetApiBufferFree
jmp 0x10013ea7
mov eax, dword [ebp - 0x10]
movsd xmm0, qword [ebp - 0x18]
mov dword [ebx + 8], eax
movsd qword [ebx], xmm0
mov eax, ebx
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [ebp - 0x18]
push ebx
push 0
push eax
call fcn.10023ab0
add esp, 0xc
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
jmp 0x10013dea
xor eax, eax
push edi
push eax
call fcn.100d0890
nop word cs:[eax + eax]
nop
Function at 0x10014990
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [ebp + 8]
mov ebx, dword [eax]
test ebx, ebx
je 0x10014954
mov edx, dword [eax + 4]
mov eax, dword [eax + 8]
test eax, eax
je 0x10014910
mov ecx, ebx
xor ebx, ebx
jmp 0x1001480c
mov eax, dword [ebp - 0x14]
xor ecx, ecx
dec eax
je 0x10014929
test ebx, ebx
mov dword [ebp - 0x14], eax
je 0x10014830
mov eax, ecx
movzx ecx, word [ebx + 0xb6]
cmp edx, ecx
jae 0x10014870
jmp 0x10014856
xor eax, eax
test edx, edx
je 0x1001485e
mov ebx, ecx
nop dword [eax + eax]
mov ebx, dword [ebx + 0xb8]
dec edx
jne 0x10014840
xor edx, edx
movzx ecx, word [ebx + 0xb6]
cmp edx, ecx
jae 0x10014870
mov ecx, edx
mov edi, eax
mov esi, ebx
jmp 0x100148b2
xor edx, edx
mov ebx, ecx
movzx ecx, word [ebx + 0xb6]
cmp edx, ecx
jb 0x10014856
nop dword [eax]
mov esi, dword [ebx]
test esi, esi
je 0x1001495c
movzx ecx, word [ebx + 0xb4]
lea edi, [eax + 1]
test eax, eax
mov eax, 0xe8
mov edx, 0xb8
cmove eax, edx
mov dword [ebp - 0x10], ecx
push 4
push eax
push ebx
call fcn.1000d080
mov ecx, dword [ebp - 0x10]
add esp, 0xc
cmp cx, word [esi + 0xb6]
mov ebx, esi
mov eax, edi
jae 0x10014870
lea edx, [ecx + 1]
test edi, edi
je 0x100148d0
lea eax, [esi + edx*4 + 0xb8]
mov ebx, dword [eax]
dec edi
lea eax, [ebx + 0xb8]
jne 0x100148c0
xor edx, edx
jmp 0x100148d2
mov ebx, esi
lea eax, [ecx + ecx*2]
mov edi, dword [esi + eax*4 + 0x30]
mov esi, dword [esi + eax*4 + 0x34]
mov eax, dword [esi]
test eax, eax
je 0x100148ef
push edi
mov dword [ebp - 0x10], edx
call eax
mov edx, dword [ebp - 0x10]
add esp, 4
mov eax, dword [esi + 4]
test eax, eax
je 0x10014800
push dword [esi + 8]
push eax
push edi
mov esi, edx
call fcn.1000d080
mov edx, esi
add esp, 0xc
jmp 0x10014800
test edx, edx
je 0x10014929
nop word cs:[eax + eax]
nop
mov ebx, dword [ebx + 0xb8]
dec edx
jne 0x10014920
xor esi, esi
nop dword [eax + eax]
mov edi, dword [ebx]
sub esi, 1
mov eax, 0xe8
mov ecx, 0xb8
cmovb eax, ecx
push 4
push eax
push ebx
call fcn.1000d080
add esp, 0xc
test edi, edi
mov ebx, edi
jne 0x10014930
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
test eax, eax
mov eax, 0xb8
mov ecx, 0xe8
cmove ecx, eax
push 4
push ecx
push ebx
call fcn.1000d080
add esp, 0xc
push 0x10170168
call fcn.100dbfb0
nop word cs:[eax + eax]
nop dword [eax + eax]
push ebp
mov ebp, esp
push esi
push eax
xor ecx, ecx
call fcn.100144d0
test eax, eax
je 0x100149e5
mov ecx, eax
mov eax, dword [ebp + 8]
movsd xmm3, qword [0x10170198]
movsd xmm2, qword [0x10170190]
movdqu xmm0, xmmword [ecx]
movd esi, xmm0
pshufd xmm1, xmm0, 0x55
add esi, 1
movd edx, xmm1
adc edx, 0
mov dword [ecx], esi
mov dword [ecx + 4], edx
movsd qword [eax + 8], xmm3
movsd qword [eax], xmm2
movdqu xmmword [eax + 0x10], xmm0
add esp, 4
pop esi
pop ebp
ret
lea eax, [ebp - 5]
push 0x101700e8
push 0x101700f8
push eax
push 0x46
push 0x10170050
call fcn.100dc670
nop
Function at 0x10016210
Capabilities:
Get local ipv4 addresses

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
xor esi, esi
xor ebx, ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0x3c00
nop word [eax + eax]
push dword [ebp - 0x14]
push esi
call sub.msvcrt.dll_realloc
add esp, 8
test eax, eax
je 0x100162b3
mov edi, eax
lea eax, [ebp - 0x14]
push eax
push edi
push 0
push 0xe
push 0
call sub.iphlpapi.dll_GetAdaptersAddresses
test eax, eax
mov dword [ebp - 0x18], eax
je 0x100162fb
cmp ebx, 1
ja 0x1001626a
inc ebx
cmp eax, 0x6f
mov esi, edi
je 0x10016230
lea eax, [ebp - 0x18]
mov dword [ebp - 0x38], 0x10170284
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1c], fcn.100ec7c0
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0x2c], 1
push eax
push dword [ebp - 0x10]
call fcn.100d19e0
add esp, 8
push edi
call sub.msvcrt.dll_free
add esp, 4
jmp 0x1001630a
mov eax, dword [0x10194460]
movzx eax, byte [eax]
push 1
push 0x32
call fcn.1000d070
add esp, 8
test eax, eax
je 0x10016312
mov edi, eax
push 0x32
push 0x10170228
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
push esi
call sub.msvcrt.dll_free
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x32
mov dword [eax + 4], edi
mov dword [eax + 8], 0x32
jmp 0x1001630a
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov dword [eax], 0x80000000
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x32
push 1
call fcn.100d0890
nop
nop
nop
push ebp
mov ebp, esp
push esi
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [edx + 4]
cmp eax, ecx
je 0x1001633a
lea esi, [eax + 1]
mov dword [edx], esi
movzx edx, byte [eax]
jmp 0x1001633a
cmp eax, ecx
setne al
pop esi
pop ebp
ret
Function at 0x1001af20
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, edx
mov edi, ecx
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
push eax
push 0x1017074c
push 1
push 0
push 0x101707dc
call sub.ole32.dll_CoCreateInstance
test eax, eax
js 0x1001af81
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x1001b01b
cmp dword [esi], 0
je 0x1001af68
push esi
call fcn.10047600
add esp, 4
mov dword [esi], ebx
movsd xmm0, qword [esi + 8]
movsd xmm1, qword [esi]
movsd qword [edi + 8], xmm0
movsd qword [edi], xmm1
jmp 0x1001b013
push eax
call fcn.10047f90
add esp, 4
mov dword [ebp - 0x14], eax
mov eax, 8
mov dword [ebp + eax - 0x18], edx
mov dword [ebp - 0x18], 1
cmp dword [ebp - 0x10], 0
je 0x1001afaf
lea eax, [ebp - 0x10]
push eax
call fcn.10047d70
add esp, 4
mov eax, dword [esi + 8]
mov byte [edi + 0xc], 2
mov dword [esi + 8], 0
test eax, eax
mov dword [ebp - 0x18], eax
je 0x1001afd0
lea eax, [ebp - 0x18]
push eax
call fcn.10047600
add esp, 4
mov eax, dword [esi + 4]
mov dword [esi + 4], 0
test eax, eax
mov dword [ebp - 0x18], eax
je 0x1001afed
lea eax, [ebp - 0x18]
push eax
call fcn.10047600
add esp, 4
mov eax, dword [esi]
mov dword [esi], 0
test eax, eax
mov dword [ebp - 0x18], eax
je 0x1001b008
lea eax, [ebp - 0x18]
push eax
call fcn.10047600
add esp, 4
cmp byte [esi + 0xc], 0
je 0x1001b013
call sub.ole32.dll_CoUninitialize
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
xor edx, edx
mov eax, 4
mov dword [ebp + eax - 0x18], edx
mov dword [ebp - 0x18], 1
cmp dword [ebp - 0x10], 0
jne 0x1001afa3
jmp 0x1001afaf
Function at 0x1001b2e0
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov ebx, dword [edx + 4]
mov esi, edx
test ebx, ebx
je 0x1001b3c4
mov dword [ebp - 0x1c], ecx
push 0x101707fe
call sub.oleaut32.dll_SysAllocString
mov edi, eax
mov dword [ebp - 0x38], eax
push str.SELECT__FROM_MSAcpi_ThermalZoneTemperature
call sub.oleaut32.dll_SysAllocString
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 0x20]
mov edx, dword [ebx]
push ecx
push 0
push 0x30
mov dword [ebp - 0x24], eax
push eax
mov dword [ebp - 0x28], edi
push edi
push ebx
call dword [edx + 0x50]
test eax, eax
js 0x1001b354
mov edx, dword [ebp - 0x20]
xor eax, eax
mov ecx, 4
test edx, edx
jne 0x1001b36a
mov eax, 1
xor edx, edx
mov dword [ebp - 0x10], 0
jmp 0x1001b36a
push eax
call fcn.10047f90
add esp, 4
mov dword [ebp - 0x14], eax
mov eax, 1
mov ecx, 8
mov dword [ebp + ecx - 0x18], edx
mov dword [ebp - 0x18], eax
push dword [ebp - 0x28]
call sub.oleaut32.dll_SysFreeString
push dword [ebp - 0x24]
call sub.oleaut32.dll_SysFreeString
mov eax, dword [ebp - 0x10]
movsd xmm0, qword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x3c]
movsd qword [ebp - 0x34], xmm0
push eax
call fcn.10040210
add esp, 4
lea eax, [ebp - 0x38]
push eax
call fcn.10040210
add esp, 4
cmp dword [ebp - 0x34], 0
je 0x1001b427
cmp dword [ebp - 0x2c], 0
je 0x1001b3c1
lea eax, [ebp - 0x2c]
push eax
call fcn.10047d70
add esp, 4
mov ecx, dword [ebp - 0x1c]
mov eax, dword [esi + 8]
mov byte [ecx + 0xc], 2
mov dword [esi + 8], 0
test eax, eax
mov dword [ebp - 0x18], eax
je 0x1001b3e5
lea eax, [ebp - 0x18]
push eax
call fcn.10047600
add esp, 4
test ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [esi + 4], 0
je 0x1001b3ff
lea eax, [ebp - 0x18]
push eax
call fcn.10047600
add esp, 4
mov eax, dword [esi]
mov dword [esi], 0
test eax, eax
mov dword [ebp - 0x18], eax
je 0x1001b41a
lea eax, [ebp - 0x18]
push eax
call fcn.10047600
add esp, 4
cmp byte [esi + 0xc], 0
je 0x1001b454
call sub.ole32.dll_CoUninitialize
jmp 0x1001b454
mov edi, dword [ebp - 0x30]
cmp dword [esi + 8], 0
je 0x1001b43c
lea eax, [esi + 8]
push eax
call fcn.10047600
add esp, 4
mov dword [esi + 8], edi
mov eax, dword [ebp - 0x1c]
movsd xmm0, qword [esi]
movsd xmm1, qword [esi + 8]
movsd qword [eax], xmm0
movsd qword [eax + 8], xmm1
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret