joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10031e60
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10031f72
push 0
push str.TrayNotifyWnd
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_FindWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10031f72
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
jmp 0x10031ec0
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 5
jge 0x10031f6e
push 0
push str.SysPager
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_FindWindowExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10031eed
jmp 0x10031f6e
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x10031efd
jmp 0x10031eb7
push 0
push 0x1005f0d0
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.USER32.dll_FindWindowExA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x10031f1b
jmp 0x10031eb7
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x10031f2b
jmp 0x10031eb7
cmp dword [0x1011fd7c], 4
jne 0x10031f4b
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
push str.hToolbar:_08x__d_
push 0
call fcn.1003b7a0
add esp, 0x10
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10031ae0
add esp, 8
movzx edx, al
test edx, edx
je 0x10031f69
mov al, 1
jmp 0x10031fea
jmp 0x10031eb7
xor al, al
jmp 0x10031fea
push 0
push str.NotifyIconOverflowWindow
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10031f8c
xor al, al
jmp 0x10031fea
push 0
push str.ToolbarWindow32
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_FindWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10031fac
xor al, al
jmp 0x10031fea
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x10031fbe
xor al, al
jmp 0x10031fea
cmp dword [0x1011fd7c], 4
jne 0x10031fda
mov edx, dword [ebp - 4]
push edx
push str.hToolbar2:_08x
push 0
call fcn.1003b7a0
add esp, 0xc
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10031ae0
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x10033740
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x10067bf0]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x130], 0
push 0x124
push 0
lea eax, [ebp - 0x12c]
push eax
call fcn.1003e4c0
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0xffffffff
jne 0x100337a6
xor eax, eax
jmp 0x10033845
mov dword [ebp - 0x130], 0x128
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x130]
push ecx
mov edx, dword [ebp - 0x134]
push edx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x10033835
mov eax, dword [ebp - 0x128]
push eax
push 0
push 0x43a
call dword [0x101496b8]
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0
jne 0x100337f3
jmp 0x1003381e
mov ecx, dword [ebp - 0x13c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x1003381e
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
lea edx, [ebp - 0x130]
push edx
mov eax, dword [ebp - 0x134]
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x100337ce
mov ecx, dword [ebp - 0x134]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1003e4ab
mov esp, ebp
pop ebp
ret
Function at 0x10035840
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
mov eax, dword [0x10067bf0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x130], 0
push 0x124
push 0
lea eax, [ebp - 0x12c]
push eax
call fcn.1003e4c0
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0xffffffff
jne 0x1003589c
xor eax, eax
jmp 0x1003598e
mov dword [ebp - 0x130], 0x128
lea ecx, [ebp - 0x130]
push ecx
mov edx, dword [ebp - 0x134]
push edx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x10035971
mov dword [ebp - 0x13c], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x10c]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1003592d
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x128], eax
je 0x1003592d
mov edx, dword [ebp - 0x128]
push edx
push 0
push 0x401
call dword [0x101496b8]
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0
je 0x1003592d
push 0
mov eax, dword [ebp - 0x140]
push eax
call dword [0x10176c60]
mov ecx, dword [ebp - 0x140]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x130], 0x128
cmp dword [ebp - 0x13c], 0x2710
jle 0x10035945
jmp 0x1003596f
mov edx, dword [ebp - 0x13c]
add edx, 1
mov dword [ebp - 0x13c], edx
lea eax, [ebp - 0x130]
push eax
mov ecx, dword [ebp - 0x134]
push ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x100358cb
jmp 0x1003597b
mov dword [ebp - 0x138], 0
mov edx, dword [ebp - 0x134]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003e4ab
mov esp, ebp
pop ebp
ret
Function at 0x10037920
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2898
call fcn.1003e9a0
mov eax, dword [0x10067bf0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2898], 0x2880
lea eax, [ebp - 0x2898]
push eax
lea ecx, [ebp - 0x2888]
push ecx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
mov dword [ebp - 0x2894], eax
cmp dword [ebp - 0x2894], 0
je 0x1003796a
xor al, al
jmp 0x10037aa7
lea edx, [ebp - 0x2888]
mov dword [ebp - 0x288c], edx
cmp dword [ebp - 0x288c], 0
jne 0x10037986
xor al, al
jmp 0x10037aa7
mov dword [ebp - 0x2890], 0
mov eax, dword [ebp - 0x288c]
movzx ecx, byte [eax + 0x194]
mov edx, dword [ebp - 0x288c]
movzx eax, byte [edx + 0x195]
and ecx, eax
mov edx, dword [ebp - 0x288c]
movzx eax, byte [edx + 0x196]
and ecx, eax
mov edx, dword [ebp - 0x288c]
movzx eax, byte [edx + 0x197]
and ecx, eax
mov edx, dword [ebp - 0x288c]
movzx eax, byte [edx + 0x198]
and ecx, eax
mov edx, dword [ebp - 0x288c]
movzx eax, byte [edx + 0x199]
and ecx, eax
cmp ecx, 0xff
jne 0x100379f2
jmp 0x10037a70
mov ecx, dword [ebp - 0x288c]
movzx edx, byte [ecx + 0x194]
mov eax, dword [ebp - 0x288c]
movzx ecx, byte [eax + 0x195]
or edx, ecx
mov eax, dword [ebp - 0x288c]
movzx ecx, byte [eax + 0x196]
or edx, ecx
mov eax, dword [ebp - 0x288c]
movzx ecx, byte [eax + 0x197]
or edx, ecx
mov eax, dword [ebp - 0x288c]
movzx ecx, byte [eax + 0x198]
or edx, ecx
mov eax, dword [ebp - 0x288c]
movzx ecx, byte [eax + 0x199]
or edx, ecx
jne 0x10037a4e
jmp 0x10037a70
push 6
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x288c]
add eax, 0x194
push eax
call fcn.10041373
add esp, 0xc
test eax, eax
jne 0x10037a70
mov al, 1
jmp 0x10037aa7
mov ecx, dword [ebp - 0x288c]
mov edx, dword [ecx]
mov dword [ebp - 0x288c], edx
cmp dword [ebp - 0x2890], 0x10
jle 0x10037a89
jmp 0x10037aa5
mov eax, dword [ebp - 0x2890]
add eax, 1
mov dword [ebp - 0x2890], eax
cmp dword [ebp - 0x288c], 0
jne 0x10037990
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003e4ab
mov esp, ebp
pop ebp
ret

Function at 0x10037ac0
Capabilities:
Get local ipv4 addresses

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2898
call fcn.1003e9a0
mov eax, dword [0x10067bf0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2898], 0x2880
lea eax, [ebp - 0x2898]
push eax
lea ecx, [ebp - 0x2888]
push ecx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
mov dword [ebp - 0x2894], eax
cmp dword [ebp - 0x2894], 0
je 0x10037b07
xor al, al
jmp 0x10037b7e
lea edx, [ebp - 0x2888]
mov dword [ebp - 0x288c], edx
cmp dword [ebp - 0x288c], 0
jne 0x10037b20
xor al, al
jmp 0x10037b7e
mov dword [ebp - 0x2890], 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x288c]
add ecx, 0x1b0
push ecx
call fcn.10008260
add esp, 8
test eax, eax
jne 0x10037b4b
mov al, 1
jmp 0x10037b7e
mov edx, dword [ebp - 0x288c]
mov eax, dword [edx]
mov dword [ebp - 0x288c], eax
cmp dword [ebp - 0x2890], 0x10
jle 0x10037b64
jmp 0x10037b7c
mov ecx, dword [ebp - 0x2890]
add ecx, 1
mov dword [ebp - 0x2890], ecx
cmp dword [ebp - 0x288c], 0
jne 0x10037b2a
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003e4ab
mov esp, ebp
pop ebp
ret
Function at 0x10039ea0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x444
mov eax, dword [0x10067bf0]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x208], 0
push 0x1ff
push 0
lea eax, [ebp - 0x207]
push eax
call fcn.1003e4c0
add esp, 0xc
mov byte [ebp - 0x418], 0
push 0x1ff
push 0
lea ecx, [ebp - 0x417]
push ecx
call fcn.1003e4c0
add esp, 0xc
push 0x1011ef18
push str._sLogDump
lea edx, [ebp - 0x208]
push edx
call fcn.1003e91e
add esp, 0xc
push 0
lea eax, [ebp - 0x208]
push eax
call fcn.10042e62
add esp, 8
test eax, eax
je 0x10039f2a
push 0
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x1011f518
push str._s.dmp
lea edx, [ebp - 0x418]
push edx
call fcn.1003e91e
add esp, 0xc
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x208]
push ecx
call fcn.1003fd70
add esp, 8
push str.DBGHELP.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x214], eax
push str.MiniDumpWriteDump
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x438], eax
cmp dword [ebp - 0x438], 0
jne 0x10039f92
xor eax, eax
jmp 0x1003a0bf
call fcn.1000fc80
mov dword [ebp - 0x430], eax
lea eax, [ebp - 0x208]
mov dword [ebp - 0x434], eax
cmp dword [ebp - 0x434], 0
jne 0x10039fbe
mov dword [ebp - 0x43c], 0
jmp 0x1003a032
mov ecx, dword [ebp - 0x434]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0x3fffffff
jle 0x10039fec
mov dword [ebp - 0x440], 0
jmp 0x1003a026
mov eax, dword [ebp - 0x20c]
shl eax, 1
call fcn.100400a0
mov dword [ebp - 0x444], esp
mov edx, dword [ebp - 0x430]
push edx
mov eax, dword [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 0x434]
push ecx
mov edx, dword [ebp - 0x444]
push edx
call fcn.1000fc90
mov dword [ebp - 0x440], eax
mov eax, dword [ebp - 0x440]
mov dword [ebp - 0x43c], eax
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
mov ecx, dword [ebp - 0x43c]
push ecx
call dword [0x1017fb68]
mov dword [ebp - 0x41c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x42c], eax
mov edx, dword [ebp + 8]
mov dword [ebp - 0x428], edx
mov dword [ebp - 0x424], 0
push 0
push 0
mov eax, dword [ebp + 8]
neg eax
sbb eax, eax
lea ecx, [ebp - 0x42c]
and eax, ecx
push eax
push 0
mov edx, dword [ebp - 0x41c]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [ebp - 0x438]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
lea esp, [ebp - 0x444]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003e4ab
mov esp, ebp
pop ebp
ret
Function at 0x1003b510
Capabilities:
Create directory
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa20
mov eax, dword [0x10067bf0]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
and eax, dword [0x1028ac70]
je 0x1003b533
jmp 0x1003b749
mov ecx, dword [0x1028ac70]
or ecx, dword [ebp + 8]
mov dword [0x1028ac70], ecx
mov byte [ebp - 0x210], 0
push 0x1ff
push 0
lea edx, [ebp - 0x20f]
push edx
call fcn.1003e4c0
add esp, 0xc
mov byte [ebp - 0xa20], 0
push 0x3ff
push 0
lea eax, [ebp - 0xa1f]
push eax
call fcn.1003e4c0
add esp, 0xc
mov byte [ebp - 0x620], 0
push 0x3ff
push 0
lea ecx, [ebp - 0x61f]
push ecx
call fcn.1003e4c0
add esp, 0xc
push 0x1011ef18
push 0x10060c34
lea edx, [ebp - 0x210]
push edx
call fcn.1003e91e
add esp, 0xc
push 0
lea eax, [ebp - 0x210]
push eax
call fcn.10042e62
add esp, 8
test eax, eax
je 0x1003b5d6
push 0
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea edx, [ebp - 8]
push edx
call fcn.1003b780
add esp, 4
lea eax, [ebp - 8]
push eax
call fcn.1003b760
add esp, 4
mov dword [ebp - 0x21c], eax
mov ecx, dword [ebp - 0x21c]
mov edx, dword [ecx + 0x10]
add edx, 1
push edx
mov eax, dword [ebp - 0x21c]
mov ecx, dword [eax + 0x14]
add ecx, 0x76c
push ecx
push str._04d__02d_AT.txt
lea edx, [ebp - 0xa20]
push edx
call fcn.1003e91e
add esp, 0x10
lea eax, [ebp - 0xa20]
push eax
lea ecx, [ebp - 0x210]
push ecx
call fcn.1003fd70
add esp, 8
mov dword [ebp - 0x218], 0
push 0
lea edx, [ebp - 0x210]
push edx
call fcn.10042e62
add esp, 8
test eax, eax
jne 0x1003b676
push 0x10060c50
lea eax, [ebp - 0x210]
push eax
call fcn.10040ef8
add esp, 8
mov dword [ebp - 0x218], eax
jmp 0x1003b690
push 0x10060c54
lea ecx, [ebp - 0x210]
push ecx
call fcn.10040ef8
add esp, 8
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jne 0x1003b69e
jmp 0x1003b749
lea edx, [ebp + 0x10]
mov dword [ebp - 0x214], edx
mov eax, dword [ebp - 0x214]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0xa20]
push edx
call fcn.10040e1a
add esp, 0xc
mov dword [ebp - 0x214], 0
lea eax, [ebp - 0xa20]
push eax
push 0x1011f118
mov ecx, dword [ebp - 0x21c]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp - 0x21c]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp - 0x21c]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0x21c]
mov edx, dword [ecx + 0xc]
push edx
push 0x10060c58
lea eax, [ebp - 0x620]
push eax
call fcn.1003e91e
add esp, 0x20
mov ecx, dword [ebp - 0x218]
push ecx
push 1
lea edx, [ebp - 0x620]
push edx
call fcn.1003e420
add esp, 4
push eax
lea eax, [ebp - 0x620]
push eax
call fcn.10040d1a
add esp, 0x10
mov ecx, dword [ebp - 0x218]
push ecx
call fcn.10040b3c
add esp, 4
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1003e4ab
mov esp, ebp
pop ebp
ret
Function at 0x1003d040
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 4
mov dword [ebp - 8], 4
push 1
push 0x10060fc8
call fcn.1003bfa0
add esp, 8
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x1003d097
push 0
push 0x10060fdc
call fcn.1003bfa0
add esp, 8
mov eax, dword [ebp + 0x14]
jmp 0x1003d1e2
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x10]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x1003d0d8
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 0x10060ff0
call fcn.1003bfa0
add esp, 8
mov eax, dword [ebp + 0x14]
jmp 0x1003d1e2
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 0x10061004
call fcn.1003bfa0
add esp, 8
push str.tc_ssl
mov edx, dword [ebp + 0x10]
push edx
call fcn.10008290
add esp, 8
test eax, eax
je 0x1003d1df
movzx eax, byte [0x10124fc9]
test eax, eax
je 0x1003d1df
push 0x10061020
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x1003d156
push 0x10061034
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x1003d156
push 0x1006104c
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1003d1df
mov byte [ebp - 0x11], 0
mov dword [ebp - 0x18], 0
jmp 0x1003d16c
mov ecx, dword [ebp - 0x18]
add ecx, 1
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp + 0x10]
push edx
call fcn.1003e420
add esp, 4
cmp dword [ebp - 0x18], eax
jae 0x1003d19a
mov eax, dword [ebp + 0x10]
add eax, dword [ebp - 0x18]
movsx ecx, byte [eax]
push ecx
call fcn.10043025
add esp, 4
movsx edx, byte [ebp - 0x11]
add edx, eax
mov byte [ebp - 0x11], dl
jmp 0x1003d163
movsx eax, byte [ebp - 0x11]
and eax, 0x8000001f
jns 0x1003d1aa
dec eax
or eax, 0xffffffe0
inc eax
mov byte [ebp - 0x11], al
movsx eax, byte [ebp - 0x11]
xor edx, edx
mov ecx, 0x20
div ecx
mov esi, dword [ebp - 4]
mov ecx, edx
shl esi, cl
movsx eax, byte [ebp - 0x11]
xor edx, edx
mov ecx, 0x20
div ecx
mov ecx, 0x20
sub ecx, edx
mov edx, dword [ebp - 4]
shr edx, cl
or esi, edx
mov dword [ebp - 4], esi
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1003d360
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
cmp dword [0x1011eafc], 0
je 0x1003d377
xor eax, eax
jmp 0x1003d4df
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
movzx ecx, byte [0x10124fc9]
test ecx, ecx
je 0x1003d453
push 0x100610b0
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x1003d3c9
push 0x100610c4
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x1003d3c9
push 0x100610dc
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1003d453
mov byte [ebp - 9], 0
mov dword [ebp - 0x10], 0
jmp 0x1003d3df
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0x10]
push eax
call fcn.1003e420
add esp, 4
cmp dword [ebp - 0x10], eax
jae 0x1003d40d
mov ecx, dword [ebp + 0x10]
add ecx, dword [ebp - 0x10]
movsx edx, byte [ecx]
push edx
call fcn.10043025
add esp, 4
movsx ecx, byte [ebp - 9]
add ecx, eax
mov byte [ebp - 9], cl
jmp 0x1003d3d6
movsx edx, byte [ebp - 9]
and edx, 0x8000001f
jns 0x1003d41e
dec edx
or edx, 0xffffffe0
inc edx
mov byte [ebp - 9], dl
movsx eax, byte [ebp - 9]
xor edx, edx
mov ecx, 0x20
div ecx
mov esi, dword [ebp - 8]
mov ecx, edx
shr esi, cl
movsx eax, byte [ebp - 9]
xor edx, edx
mov ecx, 0x20
div ecx
mov ecx, 0x20
sub ecx, edx
mov edx, dword [ebp - 8]
shl edx, cl
or esi, edx
mov dword [ebp - 8], esi
push 1
push 0x100610e8
call fcn.1003bfa0
add esp, 8
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x1003d48a
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x1003d4c4
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 0x100610fc
call fcn.1003bfa0
add esp, 8
or eax, 0xffffffff
jmp 0x1003d4df
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 0x10061110
call fcn.1003bfa0
add esp, 8
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1003d9f0
Capabilities:
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x31b0
call fcn.1003e9a0
mov eax, dword [0x10067bf0]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [0x1011fd7c], 0x888
jne 0x1003da2a
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push str.in_Send8Str__s___s_
push 0
call fcn.1003b7a0
add esp, 0x10
movzx edx, byte [0x10280c58]
test edx, edx
je 0x1003da46
mov eax, dword [ebp + 0x10]
push eax
call fcn.1003d4f0
add esp, 4
jmp 0x1003dba6
lea ecx, [ebp - 0x198]
push ecx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x1003da6f
mov edx, dword [ebp + 0x10]
push edx
push str.WSAStartup_err___s_
push 0
call fcn.1003b7a0
add esp, 0xc
mov eax, dword [ebp + 0xc]
push eax
call fcn.100081e0
add esp, 4
mov dword [ebp - 4], eax
mov byte [ebp - 0x2fb0], 0
push 0x2dff
push 0
lea ecx, [ebp - 0x2faf]
push ecx
call fcn.1003e4c0
add esp, 0xc
mov edx, dword [ebp + 0x10]
push edx
push 0x1006120c
lea eax, [ebp - 0x2fb0]
push eax
call fcn.1003e91e
add esp, 0xc
mov byte [ebp - 0x1b1], 0
push 0x11
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 0xffffffff
jne 0x1003daed
mov ecx, dword [ebp + 0x10]
push ecx
push str.socket_err___s_
push 0
call fcn.1003b7a0
add esp, 0xc
jmp 0x1003dba6
push 0x10
push 0
lea edx, [ebp - 0x1a8]
push edx
call fcn.100083a0
add esp, 0xc
mov eax, 2
mov word [ebp - 0x1a8], ax
push 0x1f99
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x1a6], ax
push str.127.0.0.1
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x1a4], eax
push 0x10
lea ecx, [ebp - 0x1a8]
push ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
call fcn.1003e420
add esp, 4
add eax, 1
push eax
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x1ac]
push ecx
call dword [0x101779d4]
cmp eax, 0xffffffff
jne 0x1003db8b
lea edx, [ebp - 0x31b0]
push edx
call fcn.1003bc40
add esp, 4
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x31b0]
push ecx
push str.sendto_err_:__s___s_
push 0
call fcn.1003b7a0
add esp, 0x10
jmp 0x1003dba6
cmp dword [0x1011fd7c], 0x888
jne 0x1003dba6
push str.in_Send8Str_OK_send
push 0
call fcn.1003b7a0
add esp, 8
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1003e4ab
mov esp, ebp
pop ebp
ret