joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000f053
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1000f092
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000f092
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000f092
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1000f092
cmp dword [ecx + 0x74], 0xe
jbe 0x1000f092
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10011d0f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10011dac
push ebx
push esi
call fcn.10011cd8
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10011c6c
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10011d59
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10011dab
push edi
push eax
call fcn.10012cca
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10011d79
call fcn.100107b4
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10011daa
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10011c6c
add esp, 0x20
test eax, eax
jne 0x10011d98
push edi
call fcn.100107b4
jmp 0x10011da0
push ebx
call fcn.100107b4
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10012019
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10019888
push 0x10019880
push str.FlsAlloc
push 0x1f
call fcn.10011f35
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001204d
push dword [ebp + 8]
mov ecx, esi
call dword [0x10018150]
call esi
jmp 0x10012053
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10012097
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10019898
push 0x10019890
push str.FlsGetValue
push 0x21
call fcn.10011f35
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100120ce
push dword [ebp + 8]
mov ecx, esi
call dword [0x10018150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x100120d6
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100198a0
push 0x10019898
push str.FlsSetValue
push 0x22
call fcn.10011f35
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10012110
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10018150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x100177b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100177dd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100177dd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10003e70
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10042770
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x10055080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
lea eax, [ecx + 4]
mov dword [ecx], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
lea ebx, [ecx + 0x24]
mov dword [ebp - 0x14], eax
lea edi, [ecx + 0x28]
mov dword [eax], 0
push 8
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x20], 0
mov dword [ebx], 0
mov dword [edi], 0
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], 0
call fcn.1001a7e2
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.10019d8e
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
mov ecx, eax
mov dword [eax + 0x34], esi
call fcn.100041c0
mov eax, dword [ebp - 0x10]
lea edx, [eax + 8]
lea ecx, [eax + 0x14]
lea esi, [eax + 4]
mov dword [eax + 0x10], edx
mov dword [eax + 0xc], esi
mov esi, eax
mov dword [eax], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [eax + 0x48], 0
mov byte [eax + 0x3d], 0
mov dword [eax + 0x1c], ecx
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], edi
mov esi, dword [ebp - 0x14]
mov dword [edx], 0
mov edx, dword [ebp - 0x10]
mov dword [eax], 0
mov dword [edi], 0
mov dword [esi], 0
mov dword [ecx], 0
mov dword [ebx], 0
mov dword [edx + 0x4c], 0
mov eax, dword [0x1005a9b0]
mov ecx, dword [0x1005a9b4]
mov dword [edx + 0x40], eax
mov eax, edx
mov dword [edx + 0x44], ecx
mov dword [edx + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10004220
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100427d0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x10055080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.1001a7e2
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.10019d8e
add esp, 8
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.100041c0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10006830
Capabilities:
Delete registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x10055080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea eax, [ebp - 0x10c]
push eax
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
push 0x80000001
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x1000688c
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x10c]
call edi
push dword [ebp - 0x10c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
lea eax, [ebp - 0x110]
push eax
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
push 0x80000002
call ebx
test eax, eax
jne 0x100068c0
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x110]
call edi
push dword [ebp - 0x110]
call esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x114]
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
push 0x80000002
call ebx
test eax, eax
jne 0x100068f8
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x114]
call edi
push dword [ebp - 0x114]
call esi
lea eax, [ebp - 0x118]
push eax
push 1
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
push 0x80000001
call ebx
test eax, eax
jne 0x1000692a
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x118]
call edi
push dword [ebp - 0x118]
call esi
lea eax, [ebp - 0x11c]
push eax
push 0xf013f
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
push 0x80000002
call ebx
test eax, eax
jne 0x1000695f
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x11c]
call edi
push dword [ebp - 0x11c]
call esi
mov eax, dword [0x1005aaa8]
push 0x200030
push dword [0x1005aa24]
cmp eax, 1
jne 0x10006991
push str.Anti_Kill___Scan___Administrative_privileges_are_not_allowed_for_this_application__n_nRestart_application_as_single_user_please_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x1000697c
push str.Anti_Kill___Scan___Pivilegios_administrativos_n
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x100069b0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x1005aaa8]
push 0x200030
push dword [0x1005aa24]
cmp eax, 1
jne 0x100069da
push str.Administrative_privileges_required_at_the_first_startup__n_nRight_click_on_application:_Run_as_administrator
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x100069c5
push str.Privilegios_administrativos_requeridos_na_primeira_inicializa
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x10006a50
Capabilities:
Create thread
Terminate process

Disassembly:
push 0
push 0
push 0
push 0x10006a00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x10006ee0
Capabilities:
Create thread
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10055080]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
mov word [ebp - 8], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x10006f39
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x10006f41
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x10006f56
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov dword [ebp - 0x10], 0
test esi, esi
jne 0x10006fcf
cmp dword [ebp - 0x14], esi
je 0x10006fa9
cmp dword [0x1005a9b8], esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
jne 0x10006f7e
push 0
push 0
push 0
push 0x10006a80
push 0
push 0
call esi
cmp dword [0x1005a9bc], 0
jne 0x10006fbe
push 0
push 0
push 0
push fcn.10006b00
push 0
push 0
call esi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001a7cf
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0x10006e70
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.1001a7cf
mov esp, ebp
pop ebp
ret
push 0x10053cd0
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], esi
push eax
call fcn.1001bf2b
int3
Function at 0x10007d50
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10042be0
mov eax, dword fs:[0]
push eax
sub esp, 0xb8
mov eax, dword [0x10055080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1005aaa4], 1
jne 0x10007e6d
sub esp, 8
lea ecx, [ebp - 0xc0]
push 8
push str.GameGuard_Log.txt
call fcn.10003390
mov edx, str._nFN_Scan:____File_not_found:
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xc0]
call fcn.10004540
mov edx, dword [0x1005a9f4]
lea ecx, [ebp - 0xc0]
call fcn.10004540
lea ecx, [ebp - 0xbc]
call fcn.10003c30
test eax, eax
jne 0x10007dfa
mov eax, dword [ebp - 0xc0]
lea ecx, [ebp - 0xc0]
push 0
add ecx, dword [eax + 4]
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10001dd0
mov eax, dword [ebp - 0xc0]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xc0], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0xc0]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0xc4], eax
lea ecx, [ebp - 0xbc]
call fcn.10002fe0
mov eax, dword [ebp - 0xc0]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xc0], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0xc0]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0xc4], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 4], 1
push eax
mov dword [ebp - 0x58], vtable.std::ios_base.0
call fcn.1001a02b
add esp, 4
mov eax, dword [0x1005aaa8]
cmp eax, 1
je 0x10007eae
cmp eax, 3
je 0x10007eae
cmp eax, 4
je 0x10007eae
push 0
cmp eax, 2
jne 0x10007ea8
push 0
push 0
push 0x10007d20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
push 0
push 0
push 0x10007cf0
jmp 0x10007e91
Function at 0x10008360
Capabilities:
Acquire debug privileges
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x10055080]
xor eax, esp
mov dword [esp + 0x1c], eax
cmp dword [0x1005aacc], 1
jne 0x100083a6
push 0
push 0
push 0
push 0x10007ec0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.1001a7cf
mov esp, ebp
pop ebp
ret
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10008448
lea eax, [esp + 4]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x10008448
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
push 0
push 0
push 0x10
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
push eax
push 0
push dword [esp + 0x14]
mov dword [esp + 0x24], 1
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x10008448
push dword [esp]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x10008448
push 0
push 0
push 0
push 0x10007f60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.1001a7cf
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x1c]
xor eax, eax
xor ecx, esp
call fcn.1001a7cf
mov esp, ebp
pop ebp
ret
Function at 0x1000c440
Capabilities:
Capture public ip
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10043060
mov eax, dword fs:[0]
push eax
sub esp, 0xe8
mov eax, dword [0x10055080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.WININET.dll_InternetOpenA]
push 0
push 0x80000000
push 0
push 0
push str.http:__icanhazip.com_
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov esi, eax
test esi, esi
je 0x1000c5e0
lea eax, [ebp - 0x44]
push eax
push 0x2f
lea eax, [ebp - 0x40]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
mov eax, dword [ebp - 0x44]
cmp eax, 0x2f
jae 0x1000c5e5
sub esp, 8
mov byte [ebp + eax - 0x40], 0
lea ecx, [ebp - 0xf4]
push 8
push str.Temp
call fcn.10003390
mov edx, str._nPublic_IP:
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xf4]
call fcn.10004540
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0xf4]
call fcn.10004540
mov edx, str._n_________Hack_Log___________n_n
lea ecx, [ebp - 0xf4]
call fcn.10004540
lea ecx, [ebp - 0xf0]
call fcn.10003c30
test eax, eax
jne 0x1000c541
mov eax, dword [ebp - 0xf4]
lea ecx, [ebp - 0xf4]
push 0
add ecx, dword [eax + 4]
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10001dd0
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
call fcn.1000bf10
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xf4], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0xf4]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0xf8], eax
lea ecx, [ebp - 0xf0]
call fcn.10002fe0
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xf4], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0xf4]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0xf8], eax
lea eax, [ebp - 0x8c]
mov dword [ebp - 4], 1
push eax
mov dword [ebp - 0x8c], vtable.std::ios_base.0
call fcn.1001a02b
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001a7cf
mov esp, ebp
pop ebp
ret
call fcn.1000bc70
call fcn.1001a965
int3
Function at 0x1000d0c0
Capabilities:
Create thread
Terminate process

Disassembly:
mov eax, dword [0x1005aaa8]
cmp eax, 1
je 0x1000d10c
cmp eax, 4
je 0x1000d10c
push 0
cmp eax, 2
jne 0x1000d0fc
push 0
push 0
push 0x1000d060
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 3
jne 0x1000d0f6
push 0
push 0
push 0x10001f70
jmp 0x1000d0df
push 0
push 0
push 0
push 0x1000d090
jmp 0x1000d0df
Function at 0x1000d900
Capabilities:
Connect to http server
Create http request
Read data from internet
Receive data
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x81c
mov eax, dword [0x10055080]
xor eax, esp
mov dword [esp + 0x818], eax
push ebx
push esi
push edi
push 0
push 0
push 0
push 0
push str.MyBrowser
call dword [sym.imp.WININET.dll_InternetOpenA]
mov esi, eax
test esi, esi
je 0x1000da79
push 1
push 0
push 3
push 0
push 0
push 0x50
push dword [0x1005aa10]
push esi
call dword [sym.imp.WININET.dll_InternetConnectA]
mov ebx, eax
test ebx, ebx
je 0x1000da79
push 1
push 0
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0x1004d8ac
push eax
push 0
push 0
push str.Codex_ServerSideBan_Renew.php
push str.POST
push ebx
mov dword [esp + 0x3c], 0
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov edi, eax
test edi, edi
je 0x1000da79
mov ecx, str._____________________________og94kfkldjs7ekk_r_nContent_Disposition:_form_data__name_uploadedfile___filename_Log.txt__r_nContent_Type:_text_plain_r_n_r_nCodex_Anti_Hack_r_n_____________________________og94kfkldjs7ekk___r_n
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000d9a0
sub ecx, edx
mov edx, str.Content_Type:_multipart_form_data__boundary___________________________og94kfkldjs7ekk
lea eax, [edx + 1]
mov dword [esp + 0x14], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x1000d9b5
sub edx, dword [esp + 0x14]
push ecx
push str._____________________________og94kfkldjs7ekk_r_nContent_Disposition:_form_data__name_uploadedfile___filename_Log.txt__r_nContent_Type:_text_plain_r_n_r_nCodex_Anti_Hack_r_n_____________________________og94kfkldjs7ekk___r_n
push edx
push str.Content_Type:_multipart_form_data__boundary___________________________og94kfkldjs7ekk
push edi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
je 0x1000da79
push 0x800
lea eax, [esp + 0x24]
push 0
push eax
call fcn.1001c530
add esp, 0xc
mov dword [esp + 0x10], 0x800
lea eax, [esp + 0x10]
push 0
push eax
lea eax, [esp + 0x28]
push eax
push 0x16
push edi
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x1000da79
lea edx, [esp + 0x20]
mov ecx, 0x10059cc8
call fcn.10004540
push eax
call fcn.10008480
add esp, 4
lea eax, [esp + 0x20]
push 0x800
push 0
push eax
call fcn.1001c530
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push 0x800
lea eax, [esp + 0x28]
push eax
push edi
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x1000da79
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push ebx
call esi
push edi
call esi
mov ecx, dword [esp + 0x824]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1001a7cf
mov esp, ebp
pop ebp
ret
call fcn.1000d650
int3
Function at 0x10010a70
Capabilities:
Capture public ip
Connect to http server
Create http request
Read data from internet
Receive data
Send file using ftp
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x10055080]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
mov ebx, dword [sym.imp.WININET.dll_InternetOpenA]
push esi
push edi
push 0
push 0
push 0
push 1
push 0
call ebx
push 0
push 0
push 1
push dword [0x1005aa18]
push dword [0x1005aa14]
push 0x15
push dword [0x1005aa10]
push eax
call dword [sym.imp.WININET.dll_InternetConnectA]
push 0
push 0
push 0
push 0
push 0
mov edi, eax
call ebx
push 0
push 0x80000000
push 0
push 0
push str.http:__icanhazip.com_
push eax
mov dword [esp + 0x28], eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov esi, eax
test esi, esi
je 0x10010bbf
lea eax, [esp + 0xc]
push eax
push 0x2f
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
mov eax, dword [esp + 0xc]
cmp eax, 0x2f
jae 0x10010be3
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
mov byte [esp + eax + 0x18], 0
call esi
push 0
push 2
lea eax, [esp + 0x1c]
push eax
push 0x1004ddc4
push edi
call dword [sym.imp.WININET.dll_FtpPutFileA]
test eax, eax
je 0x10010bd1
push edi
call esi
push dword [esp + 0x10]
call esi
push 0
push 0
push 0
push 1
push 0
call ebx
push 0
push 0x8000000
push 1
push dword [0x1005aa18]
mov edi, eax
push dword [0x1005aa14]
push 0x15
push dword [0x1005aa10]
push edi
call dword [sym.imp.WININET.dll_InternetConnectA]
push 0
push 1
push 0x80
push 1
push 0x1004ddc0
mov ebx, eax
push str.1Hardware_Banlist.txt
push ebx
call dword [sym.imp.WININET.dll_FtpGetFileA]
test eax, eax
je 0x10010bc4
push 2
push 0x1004ddc0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebx
call esi
push edi
call esi
call fcn.10010600
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1001a7cf
mov esp, ebp
pop ebp
ret
call fcn.1000ff10
push 0x1004ddc0
call fcn.10026829
add esp, 4
push 0x1004ddc4
call fcn.10026829
add esp, 4
call fcn.1000fc00
call fcn.1001a965
int3
Function at 0x10010bf0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10043340
mov eax, dword fs:[0]
push eax
sub esp, 0x11c
mov eax, dword [0x10055080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x78]
mov dword [ebp - 0x78], 0x64
push eax
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x10010d28
sub esp, 8
lea ecx, [ebp - 0x128]
push 8
push 0x1004ddc4
call fcn.10003390
mov edx, 0x1004dde0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x128]
call fcn.10004540
lea edx, [ebp - 0x74]
lea ecx, [ebp - 0x128]
call fcn.10004540
lea ecx, [ebp - 0x124]
call fcn.10003c30
test eax, eax
jne 0x10010caa
mov eax, dword [ebp - 0x128]
lea ecx, [ebp - 0x128]
push 0
add ecx, dword [eax + 4]
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10001dd0
call fcn.10010a70
mov eax, dword [ebp - 0x128]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ofstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x128]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0x12c], eax
lea ecx, [ebp - 0x124]
call fcn.10002fe0
mov eax, dword [ebp - 0x128]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ostream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x128]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0x12c], eax
lea eax, [ebp - 0xc0]
mov dword [ebp - 4], 1
push eax
mov dword [ebp - 0xc0], vtable.std::ios_base.0
call fcn.1001a02b
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001a7cf
mov esp, ebp
pop ebp
ret