joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49e82a
Capabilities:
Reference wmi statements

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
and dword [esp], 0
cmp dword [edx + 8], 0
mov esi, edx
mov edi, ecx
je 0x49e8bc
push 0x4ec8ba
call sub.OLEAUT32.dll_SysReAllocString
mov ebx, eax
push str.SELECT__FROM_MSAcpi_ThermalZoneTemperature
call sub.OLEAUT32.dll_SysReAllocString
mov ecx, dword [esi + 0xc]
mov ebp, eax
mov edx, esp
mov eax, dword [ecx]
push edx
push 0
push 0x30
push ebp
push ebx
push ecx
call dword [eax + 0x50]
mov dword [esp + 4], eax
push ebx
call sub.OLEAUT32.dll_SysStringLen
push ebp
call sub.OLEAUT32.dll_SysStringLen
cmp dword [esp + 4], 0
js 0x49e8bc
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0x14]
mov ebx, dword [esp]
call fcn.0049c99c
mov dword [esi + 0x10], 1
mov dword [esi + 0x14], ebx
movsd xmm1, qword [esi + 8]
mov eax, dword [esi + 0x18]
movsd xmm0, qword [esi]
movsd qword [edi + 8], xmm1
movsd xmm1, qword [esi + 0x10]
mov dword [edi + 0x18], eax
movsd qword [edi], xmm0
movsd qword [edi + 0x10], xmm1
jmp 0x49e8c9
mov ecx, esi
mov dword [edi], 2
call fcn.0049c93a
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x49f0b5
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [ecx]
test eax, eax
je fcn.004cae20
dec eax
ret

Function at 0x49fc2a
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x90
mov esi, ecx
mov ecx, 0x53c114
call fcn.0049f0b5
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x49fc62
mov ebx, eax
mov eax, dword [eax]
or eax, dword [ebx + 4]
je 0x49fc62
add ebx, 8
jmp 0x49fd18
mov ecx, 0x53c114
call fcn.0049f0b5
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x49fcd5
mov ebx, eax
test eax, eax
jne 0x49fcab
push 0x50
pop ecx
push 8
pop edx
call fcn.0049fd22
and dword [eax + 4], 0
and dword [eax], 0
mov ecx, 0x53c114
mov ebx, eax
mov dword [eax + 0x48], 0x53c114
call fcn.0049f0b5
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
je 0x49fce0
push 0x12
pop ecx
mov eax, esp
mov edx, esi
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [eax]
and dword [edx], 0
and dword [edx + 4], 0
or ecx, dword [eax + 4]
je 0x49fcd9
lea esi, [esp + 8]
push 0x10
pop ecx
lea edi, [esp + 0x48]
jmp 0x49fcec
xor ebx, ebx
jmp 0x49fd18
mov ecx, esp
call fcn.0049f0c1
push 0x10
pop ecx
lea edi, [esp + 0x48]
mov esi, 0x4edd18
rep movsd dword es:[edi], dword [esi]
push 0x12
pop ecx
mov eax, esp
mov esi, ebx
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov dword [ebx], 1
and dword [ebx + 4], 0
add ebx, 8
push 0x10
pop ecx
lea esi, [esp + 0x48]
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
call fcn.0049f0c1
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4a40e3
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
mov edx, eax
xor edx, 3
lock cmpxchg dword [ecx], edx
jne 0x4a40e5
test al, 1
je 0x4a40fc
test al, 2
jne 0x4a410b
xor eax, 3
ret
push 0x23
pop edx
mov ecx, str.assertion_failed:_prev.is_running__
push 0x4ef300
jmp 0x4a4118
push 0x25
pop edx
mov ecx, str.assertion_failed:__prev.is_complete__
push 0x4ef2cc
call fcn.004c88c0
pop eax
ud2

Function at 0x4a4f27
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
push eax
mov ecx, 0x53c124
call fcn.0049f0b5
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x4a4f4d
cmp dword [eax + 4], 0
mov edi, eax
je 0x4a4f4d
add edi, 4
jmp 0x4a4fad
mov ecx, 0x53c124
call fcn.0049f0b5
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x4a4fab
mov esi, eax
test eax, eax
jne 0x4a4f92
push 8
pop ecx
push 4
pop edx
call fcn.0049fd22
mov dword [eax], 0x53c124
and dword [eax + 4], 0
mov ecx, 0x53c124
mov esi, eax
call fcn.0049f0b5
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
lea edi, [esi + 4]
call fcn.004a3476
mov edx, dword [esi + 4]
mov ecx, esp
mov dword [ecx], edx
mov dword [esi + 4], eax
call fcn.004a3496
jmp 0x4a4fad
xor edi, edi
mov eax, edi
add esp, 4
pop esi
pop edi
ret

Function at 0x4a7e10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x80
mov esi, ecx
mov ecx, dword [edx + 8]
mov eax, edx
call fcn.004a7e2b
Function at 0x4aa540
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 0xc]
movups xmm2, xmmword [eax]
mov ecx, dword [edx + 0xf0]
mov eax, dword [esp + 8]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
lea edx, [edx + 0x20]
xorps xmm2, xmm0
aesenc xmm2, xmm1
dec ecx
movups xmm1, xmmword [edx]
lea edx, [edx + 0x10]
jne 0x4aa562
aesenclast xmm2, xmm1
pxor xmm0, xmm0
pxor xmm1, xmm1
movups xmmword [eax], xmm2
pxor xmm2, xmm2
ret
Function at 0x4ae650
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x18]
mov eax, dword [ebx]
xor dword [esi], eax
mov eax, dword [ebx + 4]
xor dword [esi + 4], eax
mov eax, dword [ebx + 8]
xor dword [esi + 8], eax
mov eax, dword [ebx + 0xc]
xor dword [esi + 0xc], eax
mov eax, dword [ebx + 0x10]
xor dword [esi + 0x10], eax
mov eax, dword [ebx + 0x14]
xor dword [esi + 0x14], eax
mov eax, dword [ebx + 0x18]
xor dword [esi + 0x18], eax
mov eax, dword [ebx + 0x1c]
xor dword [esi + 0x1c], eax
cmp ebp, 1
jbe 0x4ae6e8
push edi
lea edi, [ebx + 0x28]
dec ebp
push esi
call fcn.004af3a0
push esi
call fcn.004af210
push esi
call fcn.004aea40
mov eax, dword [edi - 8]
lea edi, [edi + 0x20]
xor dword [esi], eax
add esp, 0xc
mov eax, dword [edi - 0x24]
xor dword [esi + 4], eax
mov eax, dword [edi - 0x20]
xor dword [esi + 8], eax
mov eax, dword [edi - 0x1c]
xor dword [esi + 0xc], eax
mov eax, dword [edi - 0x18]
xor dword [esi + 0x10], eax
mov eax, dword [edi - 0x14]
xor dword [esi + 0x14], eax
mov eax, dword [edi - 0x10]
xor dword [esi + 0x18], eax
mov eax, dword [edi - 0xc]
xor dword [esi + 0x1c], eax
sub ebp, 1
jne 0x4ae697
mov ebp, dword [esp + 0x18]
pop edi
push esi
call fcn.004af3a0
push esi
call fcn.004af210
shl ebp, 5
add esp, 8
mov eax, dword [ebx + ebp]
xor dword [esi], eax
mov eax, dword [ebx + ebp + 4]
xor dword [esi + 4], eax
mov eax, dword [ebx + ebp + 8]
xor dword [esi + 8], eax
mov eax, dword [ebx + ebp + 0xc]
xor dword [esi + 0xc], eax
mov eax, dword [ebx + ebp + 0x10]
xor dword [esi + 0x10], eax
mov eax, dword [ebx + ebp + 0x14]
xor dword [esi + 0x14], eax
mov eax, dword [ebx + ebp + 0x18]
xor dword [esi + 0x18], eax
mov eax, dword [ebx + ebp + 0x1c]
xor dword [esi + 0x1c], eax
pop esi
pop ebp
pop ebx
ret
Function at 0x4ae830
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x2c
mov eax, dword [0x53c158]
xor eax, esp
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x30]
push ebp
movups xmm0, xmmword [eax]
movups xmmword [esp + 0xc], xmm0
movups xmm0, xmmword [eax + 0x10]
lea eax, [esp + 0xc]
push eax
movups xmmword [esp + 0x20], xmm0
call fcn.004af910
xor ebp, ebp
add esp, 4
mov dword [esp + 4], ebp
cmp dword [esp + 0x38], ebp
jbe 0x4aea28
push ebx
lea eax, [ecx + 8]
push esi
mov dword [esp + 0x10], eax
push edi
nop
mov edx, dword [esp + ebp*4 + 0x30]
mov eax, dword [esp + ebp*4 + 0x28]
movzx eax, al
mov ebx, dword [esp + ebp*4 + 0x20]
mov ecx, dword [esp + ebp*4 + 0x18]
movzx edx, dl
shl edx, 8
or edx, eax
movzx eax, bl
shl edx, 8
or edx, eax
movzx eax, cl
shl edx, 8
or edx, eax
mov ecx, edx
shr ecx, 0xc
xor ecx, edx
and ecx, 0xf0f0
mov eax, ecx
shl eax, 0xc
xor eax, ecx
mov ecx, dword [esp + 0x10]
xor edx, eax
mov eax, edx
shr eax, 6
xor eax, edx
mov esi, dword [esp + ecx*4 + 0x18]
and eax, 0xcc00cc
mov ebx, eax
shl ebx, 6
xor ebx, eax
mov eax, dword [esp + ebp*4 + 0x30]
mov ebp, dword [esp + ecx*4 + 0x28]
xor ebx, edx
shr eax, 8
movzx edx, al
mov eax, ebp
shr eax, 8
movzx eax, al
shl edx, 8
or edx, eax
mov eax, dword [esp + ecx*4 + 0x20]
shr eax, 8
movzx eax, al
shl edx, 8
or edx, eax
mov eax, esi
shr eax, 8
movzx eax, al
shl edx, 8
or edx, eax
mov ecx, edx
shr ecx, 0xc
xor ecx, edx
and ecx, 0xf0f0
mov eax, ecx
shl eax, 0xc
xor eax, ecx
xor edx, eax
mov eax, edx
shr eax, 6
xor eax, edx
and eax, 0xcc00cc
mov edi, eax
shl edi, 6
xor edi, eax
mov eax, dword [esp + 0x10]
xor edi, edx
mov eax, dword [esp + eax*4 + 0x30]
shr eax, 0x10
movzx edx, al
mov eax, ebp
mov ebp, dword [esp + 0x10]
shr eax, 0x10
movzx eax, al
shl edx, 8
or edx, eax
mov eax, dword [esp + ebp*4 + 0x20]
shl edx, 8
shr eax, 0x10
movzx eax, al
or edx, eax
mov eax, esi
shr eax, 0x10
movzx eax, al
shl edx, 8
or edx, eax
mov ecx, edx
shr ecx, 0xc
xor ecx, edx
and ecx, 0xf0f0
mov eax, ecx
shl eax, 0xc
xor eax, ecx
xor edx, eax
mov eax, edx
shr eax, 6
xor eax, edx
and eax, 0xcc00cc
mov esi, eax
shl esi, 6
xor esi, eax
mov eax, dword [esp + ebp*4 + 0x18]
shr eax, 8
xor esi, edx
mov edx, dword [esp + ebp*4 + 0x20]
and edx, 0xff00ffff
or edx, eax
mov eax, dword [esp + ebp*4 + 0x28]
and eax, 0xff0000ff
shr edx, 8
or edx, eax
mov eax, dword [esp + ebp*4 + 0x30]
and eax, 0xff000000
shr edx, 8
or edx, eax
inc ebp
mov ecx, edx
mov dword [esp + 0x10], ebp
shr ecx, 0xc
xor ecx, edx
and ecx, 0xf0f0
mov eax, ecx
shl eax, 0xc
xor eax, ecx
xor edx, eax
mov eax, edx
shr eax, 6
xor eax, edx
and eax, 0xcc00cc
mov ecx, eax
shl ecx, 6
xor ecx, eax
mov eax, dword [esp + 0x14]
xor ecx, edx
mov dword [eax - 8], ebx
mov dword [eax - 4], edi
mov dword [eax], esi
mov dword [eax + 4], ecx
add eax, 0x10
mov dword [esp + 0x14], eax
cmp ebp, dword [esp + 0x44]
jb 0x4ae880
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2c]
pop ebp
xor ecx, esp
call fcn.004b9fa8
add esp, 0x2c
ret
Function at 0x4aecd0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x44
mov eax, dword [0x53c158]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x54]
lea eax, [esp + 0x2c]
push edi
push dword [esp + 0x5c]
push eax
mov dword [esi + 0xf0], 0xa
call fcn.004ae4b0
movups xmm0, xmmword [esp + 0x38]
add esp, 8
lea ebp, [esi + 0x10]
mov ebx, 1
movups xmmword [esi], xmm0
mov edx, dword [esp + 0x30]
xorps xmm0, xmm0
mov esi, dword [esp + 0x34]
shr edx, 1
and edx, 0x55555555
shr esi, 1
movups xmmword [esp + 0x10], xmm0
xor dword [esp + 0x14], edx
movups xmmword [esp + 0x20], xmm0
lea eax, [edx + edx]
mov edx, dword [esp + 0x1c]
xor esi, edx
psrldq xmm0, 4
xor eax, dword [esp + 0x30]
and esi, 0x55555555
xor edx, esi
mov dword [esp + 0x10], eax
movd ecx, xmm0
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x2c]
lea eax, [esi + esi]
mov esi, dword [esp + 0x38]
xor eax, dword [esp + 0x34]
shr esi, 1
xor esi, ecx
mov dword [esp + 0x18], eax
and esi, 0x55555555
xor ecx, esi
mov dword [esp + 0x24], ecx
lea eax, [esi + esi]
mov esi, dword [esp + 0x3c]
xor eax, dword [esp + 0x38]
shr esi, 1
xor esi, edx
mov dword [esp + 0x20], eax
and esi, 0x55555555
xor edx, esi
mov dword [esp + 0x2c], edx
lea eax, [esi + esi]
xor eax, dword [esp + 0x3c]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x10]
push eax
call fcn.004af3a0
mov eax, dword [esp + 0x18]
add esp, 4
mov edi, dword [esp + 0x10]
add eax, eax
mov esi, dword [esp + 0x18]
xor eax, edi
mov edx, dword [esp + 0x20]
and eax, 0xaaaaaaaa
xor edi, eax
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
add eax, eax
mov dword [esp + 0x40], edi
xor eax, esi
movzx edi, byte [ebx + 0x50120f]
and eax, 0xaaaaaaaa
xor esi, eax
mov eax, dword [esp + 0x24]
add eax, eax
mov dword [esp + 0x44], esi
xor eax, edx
and eax, 0xaaaaaaaa
xor edx, eax
mov eax, dword [esp + 0x2c]
add eax, eax
mov dword [esp + 0x48], edx
xor eax, ecx
and eax, 0xaaaaaaaa
xor ecx, eax
xor eax, eax
mov dword [esp + 0x4c], ecx
nop dword [eax]
mov ecx, dword [esp + eax*4 + 0x40]
mov edx, edi
mov esi, ecx
shr ecx, 8
and esi, 0x3000000
or esi, ecx
mov cl, al
add cl, cl
shr esi, 0x12
shr edx, cl
and edx, 3
xor esi, edx
xor esi, dword [esp + eax*4 + 0x30]
mov ecx, esi
shl ecx, 8
xor ecx, esi
shl ecx, 8
xor ecx, esi
shl ecx, 8
xor ecx, esi
mov dword [esp + eax*4 + 0x30], ecx
inc eax
cmp eax, 4
jb 0x4aee20
movups xmm0, xmmword [esp + 0x30]
inc ebx
movups xmmword [ebp], xmm0
add ebp, 0x10
cmp ebx, 0xa
jbe 0x4aed11
mov ecx, dword [esp + 0x50]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004b9fa8
add esp, 0x44
ret
Function at 0x4b0cb0
Capabilities:
Encrypt data using curve25519

Disassembly:
mov ecx, dword [esp + 4]
mov al, byte [ecx + 0x1f]
and byte [ecx], 0xf8
and al, 0x3f
or al, 0x40
mov byte [ecx + 0x1f], al
ret
Function at 0x4b8670
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push esi
or esi, 0xffffffff
test ebx, ebx
je 0x4b86b7
push ebp
mov ebp, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x18]
sub ebp, edi
nop dword [eax]
mov eax, dword [edi + ebp]
lea edi, [edi + 4]
xor eax, dword [edi - 4]
mov ecx, esi
not ecx
lea edx, [eax - 1]
not eax
shr edx, 0x1f
shr eax, 0x1f
and edx, eax
neg edx
or edx, ecx
and esi, edx
sub ebx, 1
jne 0x4b8690
pop edi
pop ebp
mov eax, esi
pop esi
pop ebx
ret

Function at 0x4b9970
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push ebx
push ebp
xorps xmm0, xmm0
mov dword [esp + 8], 0
movlpd qword [esp + 0x14], xmm0
mov eax, 1
mov edx, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
push esi
push edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0x40
mov edi, eax
xor ebx, ebx
and edi, 1
neg edi
adc ebx, ebx
and edi, dword [esp + 0x28]
neg ebx
mov ecx, edi
and edi, dword [esp + 0x14]
xor ecx, eax
mov esi, ebx
and esi, dword [esp + 0x2c]
mov eax, esi
and esi, dword [esp + 0x10]
xor eax, dword [esp + 0x10]
shrd ecx, eax, 1
shr eax, 1
add ecx, edi
mov dword [esp + 0x14], ecx
adc eax, esi
and ebx, 0x80000000
shrd ebp, edx, 1
mov dword [esp + 0x10], eax
xor eax, eax
shr edx, 1
add ebp, eax
mov eax, ecx
adc edx, ebx
sub dword [esp + 0x18], 1
jne 0x4b99a1
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x4cae20
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
cmp dword [ecx + 4], 0
mov esi, ecx
je 0x4cae9a
lea ebx, [esi + 0xc]
mov dword [esp + 4], 0
lea eax, [esp + 4]
push 0
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_InitOnceBeginInitialize]
cmp eax, 1
mov dword [esp], eax
jne 0x4caed5
cmp dword [esp + 4], 0
je 0x4caebc
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x4caef8
mov edi, eax
inc eax
mov dword [esi], eax
mov eax, dword [0x53cb98]
nop word cs:[eax + eax]
nop
mov dword [esi + 8], eax
lock cmpxchg dword [0x53cb98], esi
jne 0x4cae80
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_InitOnceComplete]
jmp 0x4caecc
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esp], eax
je 0x4caf3b
mov ecx, eax
xor eax, eax
inc ecx
lock cmpxchg dword [esi], ecx
jne 0x4caec0
mov edi, dword [esp]
jmp 0x4caecc
mov edi, dword [esi]
jmp 0x4caecb
mov edi, eax
push dword [esp]
call dword [sym.imp.KERNEL32.dll_TlsFree]
dec edi
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
ret
mov dword [esp + 8], 0
lea eax, [esp + 8]
mov ecx, esp
mov edx, 0x4ebaa8
push 0x4ebb08
push eax
call fcn.004caf70
add esp, 8
ud2
push 0
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_InitOnceComplete]
lea ecx, [esp + 8]
mov edx, 0x4ebaf8
mov dword [esp + 8], 0x4ebac0
mov dword [esp + 0xc], 1
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], 0x500c58
mov dword [esp + 0x14], 0
call fcn.004c8740
ud2
mov ecx, esp
lea edx, [esp + 8]
mov dword [esp + 8], 0x4ebac0
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 0x500c58
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call fcn.004cafd0
ud2
Function at 0x4cb4a0
Capabilities:
Resolve dns

Disassembly:
push ebx
push edi
push esi
sub esp, 0x34
mov esi, ecx
lea ecx, [esp + 4]
push dword [esp + 0x44]
call fcn.00425e90
add esp, 4
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x4cb4e0
mov eax, dword [0x4ea9f0]
mov edx, dword [0x4ea9f4]
cmp dword [esp + 8], 0
mov dword [esi + 8], edx
mov dword [esi + 4], eax
mov dword [esi], 1
jne 0x4cb54f
jmp 0x4cb559
mov edi, dword [esp + 8]
mov ebx, dword [esp + 0xc]
xorps xmm0, xmm0
mov eax, esp
mov dword [esp], 0
lea ecx, [esp + 0x14]
movups xmmword [esp + 0x14], xmm0
movups xmmword [esp + 0x24], xmm0
mov dword [esp + 0x1c], 1
push eax
push ecx
push 0
push edi
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x4cb530
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov eax, 1
jmp 0x4cb544
mov ecx, dword [esp]
movzx eax, word [esp + 0x48]
mov dword [esi + 4], ecx
mov dword [esi + 8], ecx
mov word [esi + 0xc], ax
xor eax, eax
test ebx, ebx
mov dword [esi], eax
mov byte [edi], 0
je 0x4cb559
mov ecx, edi
mov edx, 1
call fcn.00425c30
add esp, 0x34
pop esi
pop edi
pop ebx
ret
Function at 0x1000df23
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x1000dfa0
lea eax, [ebp + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1000df80
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1000df7e
push 0xbf5
push 0
push 0xe0b
push 0
push 0x42e3
call fcn.10011e1b
add esp, 0x14
jmp 0x1000df9e
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x1000df9e
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1000dff2
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x1000dfde
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x1000dfdc
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
jmp 0x1000dff2
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax]
and dword [eax], 0
mov esp, ebp
pop ebp
ret
Function at 0x100301e6
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1003024d
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1003022d
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1003022b
push 0x10f
push 0x10e6
push 0x8d4
call dword [sym.imp.GDI32.dll_LineTo]
jmp 0x1003024b
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x1003024b
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1003027f
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
push dword [eax]
push dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
push dword [eax]
push 0
push dword [ebp - 0x24]
call fcn.1002b38d
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x100342ac
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006d900
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x28
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10034405
lea eax, [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x100343fb
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x100343f9
mov dword [ebp - 0x28], 0x2f2c
mov dword [ebp - 0x30], 0x100083f0
cmp dword [ebp - 0x28], 0x2f8e
jle 0x1003439e
and dword [ebp - 0x20], 0
jmp 0x10034326
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x99a
jge 0x1003439e
and dword [ebp - 0x24], 0
jmp 0x1003433c
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x2f7a
jge 0x1003439c
and dword [ebp - 0x18], 0
jmp 0x10034352
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x45ee
jge 0x1003439a
and dword [ebp - 0x1c], 0
jmp 0x10034368
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x44c6
jge 0x10034398
mov eax, dword [ebp - 0x18]
and eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
xor ecx, dword [ebp - 0x24]
or eax, ecx
cdq
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
push dword [ebp - 0x34]
push dword [ebp - 0x38]
mov ecx, 0x10614bf8
call fcn.10020ad3
jmp 0x10034361
jmp 0x1003434b
jmp 0x10034335
jmp 0x1003431f
push 1
push 0x720f
push 1
push 0x6416
push 0x1246
call fcn.10033f4c
add esp, 0x14
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0x2c97
jge 0x100343d3
mov edx, dword [ebp - 0x30]
mov ecx, 0x10614bf8
call fcn.1002537e
jmp 0x100343ef
or dword [ebp - 4], 0xffffffff
jmp 0x100343f9
jmp 0x10034403
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1003440d
push 0
call fcn.10036e7c
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10039d3f
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x10039d70
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
push 0
push dword [ebp - 4]
push dword [ebp - 8]
push 0x7882
call fcn.1003a6d9
add esp, 0x10
jmp 0x10039da2
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10039d9a
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
and dword [eax], 0
jmp 0x10039da2
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esp, ebp
pop ebp
ret