joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101b384
Capabilities:
Change the wallpaper
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x104a328]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x214], eax
xor eax, eax
xor esi, esi
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
mov ebx, ecx
push esi
push eax
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x210], esi
call sub.msvcrt.dll_memset
add esp, 0xc
cmp dword [ebp + 0xc], 1
mov edi, 0x104
jne 0x101b48b
push esi
lea eax, [ebp - 0x20c]
push eax
push edi
push 0x73
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
test eax, eax
jne 0x101b425
push esi
push 0x1003dc8
push 0xdc9
push 0x1003cc0
push 0x10018c8
mov ecx, 0x104abe8
call fcn.0102f8f0
mov dword [ebp - 0x210], 0x80004005
jmp 0x101b57c
lea eax, [ebp - 0x20c]
push eax
push 0x10021f0
call fcn.0102f538
cmp eax, esi
mov dword [ebp - 0x210], eax
jge 0x101b44d
push eax
push 0x1003dc8
push 0xdd1
jmp 0x101b472
lea eax, [ebx + 0x50]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.01030f22
cmp eax, esi
mov dword [ebp - 0x210], eax
jge 0x101b48b
push eax
push 0x1003dc8
push 0xdd7
push 0x1003cc0
push 0x10018c8
mov ecx, 0x104abe8
call fcn.0102f8f0
jmp 0x101b574
mov ebx, dword [ebx + 0x50]
cmp ebx, esi
jne 0x101b4a2
push esi
push 0x1003dc8
push 0xde3
jmp 0x101b402
cmp word [ebx], si
jne 0x101b4b7
push esi
push 0x1003dc8
push 0xded
jmp 0x101b402
push 0x208
lea eax, [ebp - 0x20c]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push edi
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, esi
je 0x101b4e3
cmp eax, edi
jbe 0x101b50f
mov eax, 0x80004005
push eax
push 0x1003dc8
mov dword [ebp - 0x210], eax
push 0xe02
push 0x1003cc0
push 0x10018c8
mov ecx, 0x104abe8
call fcn.0102f8f0
jmp 0x101b57c
lea eax, [ebp - 0x20c]
push eax
call fcn.01020c60
test eax, eax
jne 0x101b536
push esi
push 0x1003dc8
mov dword [ebp - 0x210], 0x80004005
push 0xe13
jmp 0x101b4f9
push 3
push dword [ebp - 0x214]
push esi
push 0x14
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
test eax, eax
jne 0x101b574
push esi
push 0x1003dc8
push 0xe1f
push 0x1003cc0
push 0x10018c8
mov ecx, 0x104abe8
call fcn.0102f8f0
mov dword [ebp - 0x210], 0x80004005
cmp dword [ebp - 0x210], esi
jge 0x101b59b
mov edi, dword [ebp - 0x218]
mov eax, dword [edi + 0x50]
cmp eax, esi
je 0x101b59b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x50], esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x210]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0102da5f
leave
ret 8
Function at 0x101c07a
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0x4c], 1
jne 0x101c0a3
push 0x3e8
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 4]
call fcn.01023024
jmp 0x101c135
push ebx
push edi
mov edi, 0x104abe8
push 0x1001978
mov ecx, edi
call fcn.0102f6f0
mov ecx, dword [0x104a794]
push 1
push 5
add ecx, 0x138
call fcn.0102ff97
mov ecx, dword [0x104a794]
push eax
add ecx, 0x138
call fcn.0102fbef
xor ebx, ebx
push ebx
push ebx
push dword [esi + 0x3c]
push 0x101ba27
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
jne 0x101c12c
push ebx
push 0xfffe
push ebx
push dword [esi + 4]
push 0x28a
push 0x213
call fcn.0102556f
push ebx
push 0x1003f78
push 0x437
push 0x1003cc0
push 0x10018c8
mov ecx, edi
call fcn.0102f8f0
jmp 0x101c133
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
xor eax, eax
pop esi
pop ebp
ret 0x10

Function at 0x101d1d6
Capabilities:
Get graphical window text
Open clipboard
Write clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [ebp - 4]
xor edi, edi
push eax
push edi
push edi
xor ebx, ebx
mov dword [ebp - 4], edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov esi, eax
cmp esi, edi
jge 0x101d21e
push esi
push 0x10041b4
push 0x166a
push 0x1003cc0
push 0x10018c8
mov ecx, 0x104abe8
call fcn.0102f8f0
jmp 0x101d335
push 0x104a890
push 0x800
call fcn.0102ddd1
mov ebx, eax
pop ecx
pop ecx
cmp ebx, edi
jne 0x101d247
mov esi, 0x8007000e
push esi
push 0x10041b4
push 0x1670
jmp 0x101d205
mov esi, 0x400
push esi
push ebx
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x101d284
push edi
push 0x10041b4
push 0x1672
push 0x1003cc0
push 0x10018c8
mov ecx, 0x104abe8
call fcn.0102f8f0
mov esi, 0x80004005
jmp 0x101d335
lea eax, [ebp - 8]
push eax
push esi
push ebx
call fcn.0101ca72
mov esi, eax
cmp esi, edi
jge 0x101d2a5
push esi
push 0x10041b4
push 0x1673
jmp 0x101d205
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push edi
add edx, 2
push edx
push ebx
push eax
call dword [ecx + 0x10]
mov esi, eax
cmp esi, edi
jge 0x101d2cd
push esi
push 0x10041b4
push 0x1676
jmp 0x101d205
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x101d2ea
push edi
push 0x10041b4
push 0x1677
jmp 0x101d266
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call dword [sym.imp.ole32.dll_GetHGlobalFromStream]
mov esi, eax
cmp esi, edi
jge 0x101d324
push esi
push 0x10041b4
push 0x167f
push 0x1003cc0
push 0x10018c8
mov ecx, 0x104abe8
call fcn.0102f8f0
jmp 0x101d32f
push dword [ebp - 0xc]
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp - 4]
cmp eax, edi
je 0x101d345
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], edi
cmp ebx, edi
je 0x101d350
push ebx
call fcn.0102d44c
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x101ed6f
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x104a794]
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
inc ebx
mov esi, ecx
mov dword [ebp - 4], edi
mov dword [ebp - 8], ebx
mov ecx, dword [eax + 0x210]
call fcn.010334ad
cmp eax, 3
jne 0x101ef65
cmp dword [esi + 0x4c], ebx
jne 0x101edbf
push 0x3e8
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 4]
call fcn.01023024
jmp 0x101ef65
mov eax, dword [esi + 0x2c]
mov ecx, dword [ebp + 0xc]
cmp eax, 4
jne 0x101edd3
cmp ecx, 3
je 0x101ef65
push 2
pop ebx
sub ecx, ebx
je 0x101ef3b
dec ecx
jne 0x101ef65
cmp eax, ebx
jne 0x101ee02
push edi
push edi
push 3
mov eax, dword [0x104a794]
mov ecx, dword [eax + 0x210]
call fcn.0103814e
jmp 0x101ef65
lea eax, [ebp - 8]
push eax
mov eax, dword [0x104a794]
mov ecx, dword [eax + 0x210]
call fcn.01032e2d
cmp eax, edi
jge 0x101ee34
push eax
push 0x10045c0
push 0x505
push 0x1003cc0
push 0x10018c8
jmp 0x101ef26
mov ecx, dword [0x104a794]
lea eax, [ebp - 4]
add ecx, 0x1b8
cmp dword [ebp - 8], 3
push eax
je 0x101eebc
push 1
call fcn.01030898
test eax, eax
jge 0x101ee9f
mov ecx, dword [0x104a794]
lea eax, [ebp - 4]
push eax
push 3
add ecx, 0x1b8
call fcn.010307cb
mov ebx, eax
cmp ebx, edi
jge 0x101ee9f
mov esi, 0x104abe8
push 0x1001a28
mov ecx, esi
call fcn.0102f6f0
push ebx
push 0x10045c0
push 0x517
push 0x1003cc0
push 0x10018c8
mov ecx, esi
jmp 0x101ef2b
cmp dword [ebp - 4], edi
jne 0x101eed0
push 0x1001a28
mov ecx, 0x104abe8
call fcn.0102f6f0
push edi
push edi
push 4
jmp 0x101eded
push 5
call fcn.01030898
test eax, eax
jge 0x101ee9f
mov dword [ebp - 4], 1
jmp 0x101ee9f
mov ecx, dword [0x104a794]
push edi
push 9
add ecx, 0x1d0
call fcn.0100adf6
push edi
push edi
push edi
push 0x101baf1
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
jne 0x101ef32
push edi
push 0xfffe
push edi
push dword [esi + 4]
push 0x28a
push 0x213
call fcn.0102556f
push edi
push 0x10045c0
push 0x55a
push 0x1003cc0
push 0x10018b8
mov ecx, 0x104abe8
call fcn.0102f8f0
jmp 0x101ef65
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x101ef65
cmp dword [esi + 0x38], 1
jne 0x101ef5a
mov ecx, dword [0x104a794]
push edi
push 0xe
add ecx, 0x1d0
call fcn.0100adf6
mov dword [esi + 0x30], ebx
jmp 0x101ef65
push dword [ebp + 0x10]
mov ecx, esi
push ebx
call fcn.0101e0a8
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10
Function at 0x101f207
Capabilities:
Capture webcam image

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 8], 1
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
jne 0x101f343
push ebx
push 0xfac
push ebx
call fcn.0101cf24
lea eax, [ebp - 4]
push eax
mov eax, dword [0x104a794]
mov ecx, dword [eax + 0x210]
call fcn.01033f1f
cmp eax, ebx
jge 0x101f26d
push eax
push 0x1004658
push 0xbf0
push 0x1003cc0
push 0x10018c8
mov ecx, 0x104abe8
call fcn.0102f8f0
jmp 0x101f3d2
push dword [ebp - 4]
mov ecx, dword [0x104a794]
push 2
add ecx, 0x1d0
call fcn.0100adf6
mov ecx, dword [0x104a794]
push 6
add ecx, 0x138
call fcn.0102fc2b
mov ecx, dword [0x104a794]
push 4
add ecx, 0x138
call fcn.01030044
mov eax, dword [esi + 0x24]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push 0x12b
push 0x419
push eax
call edi
push ebx
push eax
push 0x416
push dword [esi + 0x24]
call edi
push ebx
push 0x109
mov ebx, 0x404
push ebx
push dword [esi + 0x24]
call edi
push 0
push 0x121
push ebx
push dword [esi + 0x24]
call edi
push 0x40d
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 1
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 2
mov ecx, esi
call fcn.0101cb9a
push 0
mov ecx, esi
call fcn.0101e6dc
lea eax, [ebp - 8]
push eax
mov eax, dword [0x104a794]
mov ecx, dword [eax + 0x210]
call fcn.01032dbb
test eax, eax
jl 0x101f3d0
push dword [ebp - 8]
mov ecx, 0x104abe8
push 0x1001ab8
call fcn.0102f73f
xor ebx, ebx
cmp dword [ebp + 8], 2
jne 0x101f3d2
push ebx
push 0xfab
push 0x24f
mov ecx, esi
call fcn.0101cf24
push 5
pop edi
cmp dword [esi + 0x2c], edi
je 0x101f37b
mov ecx, dword [0x104a794]
push ebx
push 3
add ecx, 0x1d0
call fcn.0100adf6
mov eax, dword [esi + 0x2c]
cmp eax, edi
je 0x101f3a5
cmp eax, ebx
je 0x101f3a5
cmp eax, 6
je 0x101f3a5
cmp eax, 1
je 0x101f3a5
mov ecx, dword [0x104a794]
push 1
push 6
add ecx, 0x138
call fcn.0102ff97
push 0x40d
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push ebx
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push ebx
mov ecx, esi
call fcn.0101e6dc
push ebx
mov ecx, esi
mov dword [esi + 0x2c], edi
call fcn.0101cb9a
jmp 0x101f3d2
xor ebx, ebx
cmp dword [ebp - 4], ebx
pop edi
pop esi
pop ebx
je 0x101f3e3
push dword [ebp - 4]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
leave
ret 4

Function at 0x10210ec
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1021145
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x1021137
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x1021133
cmp esi, eax
jae 0x1021137
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x1021125
cmp esi, eax
jb 0x102113b
xor eax, eax
jmp 0x1021144
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop ebp
ret 0xc
Function at 0x1021446
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
push 4
pop ebx
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], edi
cmp esi, edi
jne 0x102147e
mov eax, 0x80004003
push eax
push 0x1004ad4
push 0x106f
jmp 0x10214d6
lea eax, [ebp - 8]
push eax
call fcn.010213d4
cmp eax, edi
mov dword [ebp + 8], eax
jge 0x102149b
push eax
push 0x1004ad4
push 0x1075
jmp 0x10214d9
xor edi, edi
inc edi
cmp dword [ebp - 8], edi
jne 0x10214ab
and dword [ebp + 8], 0
mov dword [esi], edi
jmp 0x102151a
lea eax, [ebp - 4]
push eax
push edi
push 0
push 0x1004a60
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10214ef
mov eax, 0x80004005
push eax
push 0x1004ad4
push 0x1089
mov dword [ebp + 8], eax
push 0x10047a8
push 0x10018c8
mov ecx, 0x104abe8
call fcn.0102f8f0
jmp 0x102151a
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x1004a2c
push dword [ebp - 4]
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10214a7
cmp dword [ebp - 0x10], eax
sete al
mov dword [esi], eax
cmp dword [ebp - 4], 0
pop edi
pop esi
pop ebx
je 0x102152c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 8]
leave
ret 4
Function at 0x102316d
Capabilities:
Get graphical window text

Disassembly:
push 0xc
mov eax, 0x104372e
call fcn.0102daac
xor edi, edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edi
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
cmp ebx, edi
je 0x1023236
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
cmp eax, edi
je 0x102326e
push 0x104a890
lea esi, [eax + 1]
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0102ddd1
mov edi, eax
pop ecx
pop ecx
mov dword [ebp + 0xc], edi
test edi, edi
jne 0x10231fb
mov eax, 0x8007000e
push eax
push 0x1004ffc
push 0x1ca
push 0x10047a8
push 0x10018c8
mov ecx, 0x104abe8
mov dword [ebp - 0x14], eax
call fcn.0102f8f0
jmp 0x102325c
push esi
push edi
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x1023215
push eax
push 0x1004ffc
push 0x1ce
jmp 0x1023241
push edi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.0100ac19
jmp 0x102325c
push edi
push 0x1004ffc
push 0x1d6
push 0x10047a8
push 0x10018c8
mov ecx, 0x104abe8
call fcn.0102f8f0
mov dword [ebp - 0x14], 0x80004005
test edi, edi
je 0x1023267
push edi
call fcn.0102d44c
pop ecx
mov esi, dword [ebp - 0x14]
test esi, esi
jl 0x102327b
push dword [ebp + 0x10]
lea ecx, [ebp - 0x18]
call fcn.01022d37
mov esi, eax
push dword [ebp - 0x18]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, esi
call fcn.0102db60
ret 0xc

Function at 0x10288c1
Capabilities:
Create thread
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
xor edi, edi
xor esi, esi
xor ebx, ebx
inc edi
mov dword [ebp - 4], esi
cmp eax, 6
je 0x1028934
jle 0x102896b
cmp eax, 8
jle 0x102894c
cmp eax, 0xa
je 0x102894c
cmp eax, 0xe
jne 0x102896b
push 0x1005bc0
lea eax, [ebp - 4]
push eax
push esi
call fcn.0102f3d1
mov ebx, eax
cmp ebx, esi
jge 0x1028916
push ebx
push 0x1005be0
push 0x41b
jmp 0x10289b5
mov edi, dword [ebp + 8]
push 3
push dword [ebp - 4]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x1028932
push 7
push edi
call fcn.010288c1
xor edi, edi
mov eax, dword [0x104a794]
mov ecx, dword [eax + 0x210]
call fcn.0103707c
cmp eax, esi
jne 0x1028974
cmp edi, esi
jne 0x102895d
mov eax, dword [0x104a794]
push dword [eax + 0x21c]
call dword [sym.imp.KERNEL32.dll_SetEvent]
cmp dword [ebp - 4], esi
je 0x102896b
push dword [ebp - 4]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 8
cmp edi, esi
jne 0x102895d
mov ecx, dword [0x104a794]
push 0x3039
add ecx, 0x138
call fcn.0102fc2b
push esi
push esi
push 1
push 0x1028522
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, esi
jne 0x10289cb
mov eax, 0x80004005
push eax
push 0x1005be0
mov ebx, eax
push 0x449
push 0x1005ac0
push 0x10018c8
mov ecx, 0x104abe8
call fcn.0102f8f0
jmp 0x102895d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x102895d
Function at 0x10297ac
Capabilities:
Connect socket
Initialize winsock library

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x104a328]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x20
pop ecx
lea esi, [ebp + 8]
lea edi, [ebp - 0x84]
rep movsd dword es:[edi], dword [esi]
movzx esi, word [ebp - 0x84]
xor eax, eax
push 0x18e
xor edi, edi
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x212]
push edi
push eax
xor ebx, ebx
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x1029846
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
mov eax, 0x80004005
push eax
push 0x1005d70
push 0x47b
push 0x1005c58
mov esi, 0x104abe8
push 0x10018c8
mov ecx, esi
mov ebx, eax
call fcn.0102f8f0
jmp 0x10298f0
push 6
movzx eax, si
push 1
push eax
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 0x218], eax
mov esi, 0x104abe8
cmp eax, 0xffffffff
jne 0x102987e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
mov eax, 0x80004005
push eax
push 0x1005d70
push 0x487
jmp 0x10298be
xor ecx, ecx
cmp word [ebp - 0x84], 2
setne cl
dec ecx
and ecx, 0xfffffff4
add ecx, 0x1c
push ecx
lea ecx, [ebp - 0x84]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x10298d1
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
mov eax, 0x80004005
push eax
push 0x1005d70
push 0x494
push 0x1005c58
push 0x10018c8
mov ecx, esi
mov ebx, eax
call fcn.0102f8f0
cmp dword [ebp - 0x218], 0xffffffff
je 0x10298e6
push dword [ebp - 0x218]
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
test ebx, ebx
jge 0x1029904
push edi
push 0x1001ac8
mov ecx, esi
call fcn.0102f73f
push 0x1001aa8
jmp 0x1029909
push 0x1001a98
mov ecx, esi
call fcn.0102f6f0
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0102da5f
leave
ret 0x80
Function at 0x102a5f2
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
cmp eax, ebx
jne 0x102a632
mov eax, 0x80004003
push eax
push 0x1005fcc
push 0x11d
push 0x1005c58
push 0x10018c8
mov ecx, 0x104abe8
mov dword [ebp + 8], eax
call fcn.0102f8f0
jmp 0x102a7cd
mov ecx, dword [ebp + 0x10]
lea edi, [esi + 0x20]
push edi
mov dword [esi + 0x44], ecx
mov dword [esi + 0x1c], eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
cmp eax, ebx
mov dword [ebp + 8], eax
jge 0x102a65c
push eax
push 0x1005fcc
push 0x129
jmp 0x102a7b4
push edi
push 2
call dword [sym.imp.ADVAPI32.dll_EventActivityIdControl]
test eax, eax
je 0x102a694
push ebx
push 0x1005fcc
push 0x131
push 0x1005c58
push 0x10018c8
mov ecx, 0x104abe8
call fcn.0102f8f0
mov dword [ebp + 8], 0x80004005
jmp 0x102a7cd
mov eax, dword [ebp + 0x10]
dec eax
dec eax
je 0x102a6bb
dec eax
jne 0x102a6e0
push esi
call fcn.0102a28f
cmp eax, ebx
mov dword [ebp + 8], eax
jge 0x102a6e0
push eax
push 0x1005fcc
push 0x149
jmp 0x102a7b4
mov ecx, dword [ebp + 0xc]
call fcn.010341b7
push esi
call fcn.0102a080
cmp eax, ebx
mov dword [ebp + 8], eax
jge 0x102a6e0
push eax
push 0x1005fcc
push 0x143
jmp 0x102a7b4
push esi
push edi
push 0x1005f90
call fcn.01030e21
cmp eax, ebx
mov dword [ebp + 8], eax
jge 0x102a703
push eax
push 0x1005fcc
push 0x154
jmp 0x102a7b4
lea eax, [esi + 4]
push eax
push edi
push 0x1005f54
call fcn.01030e21
cmp eax, ebx
mov dword [ebp + 8], eax
jge 0x102a729
push eax
push 0x1005fcc
push 0x158
jmp 0x102a7b4
push dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebx
push ebx
push ebx
call edi
mov dword [esi + 8], eax
cmp eax, ebx
jne 0x102a74d
push ebx
push 0x1005fcc
push 0x164
jmp 0x102a674
push dword [esi + 4]
push ebx
push ebx
push ebx
call edi
mov dword [esi + 0xc], eax
push ebx
cmp eax, ebx
jne 0x102a76c
push 0x1005fcc
push 0x16b
jmp 0x102a674
push ebx
push ebx
push ebx
call edi
mov dword [esi + 0x10], eax
cmp eax, ebx
jne 0x102a788
push ebx
push 0x1005fcc
push 0x172
jmp 0x102a674
lea eax, [esi + 0x18]
push eax
push ebx
push esi
push 0x102943e
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x14], eax
cmp eax, ebx
jne 0x102a7c8
push ebx
push 0x1005fcc
mov dword [ebp + 8], 0x80004005
push 0x184
push 0x1005c58
push 0x10018c8
mov ecx, 0x104abe8
call fcn.0102f8f0
cmp dword [ebp + 8], ebx
jge 0x102a7d3
push esi
call fcn.0102951a
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x102a999
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
and dword [ebp - 0x14], 0
and dword [ebp - 4], 0
push ebx
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov ebx, ecx
stosd dword es:[edi], eax
mov eax, dword [ebx]
sub eax, 0x7dc
je 0x102aa1f
dec eax
jne 0x102aaa6
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x435
push dword [ebp + 8]
call esi
add ebx, 0xc
push ebx
push 0x1026fd2
mov edi, eax
push 0
push edi
call fcn.01027144
mov dword [ebp - 4], eax
test eax, eax
jge 0x102aa14
push eax
push 0x1006094
push 0x93
push 0x1006040
push 0x10018c8
mov ecx, 0x104abe8
call fcn.0102f8f0
jmp 0x102aaa6
lea eax, [ebp - 0x14]
push eax
push 0x3f9
jmp 0x102aa5c
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x434
push dword [ebp + 8]
call esi
add ebx, 8
push ebx
push 0x1026fd2
mov edi, eax
push 1
push edi
call fcn.01027144
mov dword [ebp - 4], eax
test eax, eax
jge 0x102aa53
push eax
push 0x1006094
push 0x73
jmp 0x102a9fb
lea eax, [ebp - 0x14]
push eax
push 0x3f8
push dword [ebp + 8]
call esi
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push 2
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [ebp - 0x10]
sub dword [ebp - 8], eax
mov ecx, dword [ebp - 0x14]
sub dword [ebp - 0xc], ecx
push 1
push dword [ebp - 8]
push dword [ebp - 0xc]
push eax
push ecx
push edi
call dword [sym.imp.USER32.dll_MoveWindow]
push 5
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 4