joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1044200
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x50]
mov ecx, dword [eax + 0x54]
push edi
xor edi, edi
add ecx, 8
inc edi
call fcn.0104c957
test eax, eax
je 0x104424d
xor ebx, ebx
push ebx
push 0x47b1
push ebx
push edi
push ebx
push 0x4dc
push 0x1005760
call fcn.01056fa7
push eax
call fcn.01008074
push eax
call fcn.01058315
add esp, 0x18
jmp 0x1044322
lea ecx, [ebp - 8]
call fcn.0104c949
push 0x1005984
lea eax, [ebp - 8]
push eax
mov eax, dword [esi + 0x50]
mov ecx, dword [eax + 0x54]
call fcn.01043408
xor ebx, ebx
test eax, eax
jl 0x10442a8
lea ecx, [ebp - 8]
call fcn.0104c953
cmp eax, 0x104
jl 0x10442a8
push ebx
push 0x47b2
push ebx
push 1
push ebx
push 0x4e6
push 0x1005760
call fcn.01056fa7
push eax
call fcn.01008074
push eax
call fcn.01058315
add esp, 0x18
jmp 0x1044314
mov eax, dword [esi + 0x50]
mov ecx, dword [eax + 0x54]
add ecx, 8
call fcn.0104c9be
push eax
call fcn.0104df7f
test eax, eax
jne 0x1044316
mov eax, dword [esi + 0x50]
mov ecx, dword [eax + 0x54]
push ebx
add ecx, 8
call fcn.0104c9be
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1044316
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
jg 0x10442ea
call edi
jmp 0x10442f6
call edi
and eax, 0xffff
or eax, 0x80070000
push eax
push ebx
push 0x4f0
push 0x1005760
call fcn.01056fa7
push eax
call fcn.01008074
mov ecx, eax
call fcn.010581e7
xor edi, edi
lea ecx, [ebp - 8]
call fcn.0104cd4c
cmp edi, ebx
jne 0x1044339
push 1
push dword [esi + 0x264]
push 0x28
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
jmp 0x104433c
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1046004
Capabilities:
Initialize winsock library
Terminate process

Disassembly:
sub esp, 0x194
mov eax, dword [0x106ed40]
xor eax, dword [esp + 0x194]
push esi
mov dword [esp + 0x194], eax
lea eax, [esp + 4]
push eax
push 0x202
mov esi, ecx
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
jne 0x104603b
mov dword [esi + 0x58], 1
lea eax, [esi + 0x1c]
push eax
mov ecx, esi
call fcn.01045e2b
lea eax, [esi + 0x30]
push eax
mov ecx, esi
call fcn.01045e2b
mov ecx, dword [esp + 0x194]
xor ecx, dword [esp + 0x198]
pop esi
add esp, 0x194
jmp fcn.0104ab5e
Function at 0x104ab6c
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x1006238
call fcn.0104ad64
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
cmp word [0x1000000], 0x5a4d
jne 0x104abb4
mov eax, dword [0x100003c]
lea eax, [eax + 0x1000000]
cmp dword [eax], 0x4550
jne 0x104abb4
movzx ecx, word [eax + 0x18]
cmp ecx, 0x10b
je 0x104abcd
cmp ecx, 0x20b
je 0x104abba
and dword [ebp - 0x60], 0
jmp 0x104abe1
cmp dword [eax + 0x84], 0xe
jbe 0x104abb4
xor ecx, ecx
cmp dword [eax + 0xf8], ecx
jmp 0x104abdb
cmp dword [eax + 0x74], 0xe
jbe 0x104abb4
xor ecx, ecx
cmp dword [eax + 0xe8], ecx
setne cl
mov dword [ebp - 0x60], ecx
and dword [ebp - 4], 0
push 2
pop esi
push esi
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or edi, 0xffffffff
mov dword [0x10742d8], edi
mov dword [0x10742dc], edi
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x1072b88]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x1072b84]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x10742d4], eax
call fcn.0103ce7e
cmp dword [0x106ed50], 0
jne 0x104ac41
push fcn.0103ce7e
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.0104afb6
push 0x106508c
push 0x1065088
call sub.msvcrt.dll__initterm
mov eax, dword [0x1072b80]
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x64]
push eax
push dword [0x1072b7c]
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.msvcrt.dll___wgetmainargs]
mov dword [ebp - 0x74], eax
push 0x1065084
push section..data
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
cmp dword [eax], 0
jne 0x104aca5
mov dword [ebp - 4], edi
mov eax, 0xff
jmp 0x104ad56
mov eax, dword [eax]
mov dword [ebp - 0x78], eax
cmp word [eax], 0x22
jne 0x104ace8
add eax, esi
mov dword [ebp - 0x78], eax
mov cx, word [eax]
test cx, cx
je 0x104acc3
cmp cx, 0x22
jne 0x104acb0
cmp word [eax], 0x22
jne 0x104acce
add eax, esi
mov dword [ebp - 0x78], eax
mov cx, word [eax]
test cx, cx
je 0x104acdc
cmp cx, 0x20
jbe 0x104acc9
test byte [ebp - 0x30], 1
je 0x104acf5
movzx ecx, word [ebp - 0x2c]
jmp 0x104acf8
cmp word [eax], 0x20
jbe 0x104acce
add eax, esi
mov dword [ebp - 0x78], eax
jmp 0x104ace8
push 0xa
pop ecx
push ecx
push eax
push 0
push 0x1000000
call fcn.01011425
mov esi, eax
mov dword [ebp - 0x7c], esi
cmp dword [ebp - 0x60], 0
jne 0x104ad18
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], edi
jmp 0x104ad54
mov eax, esi
call fcn.0104ad9f
ret
Function at 0x104df5e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x104df7a
test al, 0x10
jne 0x104df7a
test al, 1
je 0x104df7a
xor eax, eax
inc eax
jmp 0x104df7c
xor eax, eax
ret 4

Function at 0x104df7f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x104df97
test al, 0x10
je 0x104df97
xor eax, eax
inc eax
jmp 0x104df99
xor eax, eax
ret 4

Function at 0x104e26d
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b8
mov eax, dword [0x106ed40]
xor eax, dword [ebp + 4]
cmp dword [ebp + 8], 0
push esi
mov dword [ebp - 4], eax
push edi
je 0x104e2e2
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x104e2e2
push 0x200
push 0x2b4
lea eax, [ebp - 0x2b8]
push eax
push 0
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x104e2e2
lea eax, [ebp - 0x2ac]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
mov esi, dword [ebp + 0x10]
cmp eax, esi
pop ecx
jae 0x104e2e2
push esi
lea eax, [ebp - 0x2ac]
push eax
push edi
call dword [sym.imp.msvcrt.dll_wcsncpy]
and word [edi + esi*2 - 2], 0
xor eax, eax
add esp, 0xc
inc eax
jmp 0x104e2e4
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop edi
pop esi
call fcn.0104ab5e
leave
ret 0xc

Function at 0x104e745
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x106ed40]
xor eax, dword [ebp + 4]
push ebx
push esi
mov esi, dword [ebp + 8]
push esi
mov dword [ebp - 4], eax
call fcn.0104df41
push esi
mov dword [ebp + 8], eax
mov ebx, 0x80
call fcn.0104eab7
test eax, eax
je 0x104e77b
xor eax, eax
inc eax
jmp 0x104e7bc
cmp dword [ebp + 8], 0
push esi
je 0x104e7cd
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
push 0
push ebx
push 3
push 0
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x104e7b9
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
push esi
je 0x104e819
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 5
pop eax
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop esi
pop ebx
call fcn.0104ab5e
leave
ret 4
call fcn.0104df7f
test eax, eax
je 0x104e7da
push 3
jmp 0x104e7bb
push 0x103
lea eax, [ebp - 0x20c]
push esi
push eax
call dword [sym.imp.msvcrt.dll_wcsncpy]
and word [ebp - 6], 0
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call fcn.0104e136
lea eax, [ebp - 0x20c]
push eax
call fcn.0104df7f
test eax, eax
jne 0x104e78a
push 4
jmp 0x104e7bb
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x104e7bc
Function at 0x104e823
Capabilities:
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x106ed40]
xor eax, dword [ebp + 4]
push esi
push edi
mov edi, dword [ebp + 8]
push edi
mov dword [ebp - 4], eax
call fcn.0104df41
push edi
mov dword [ebp + 8], eax
mov esi, 0x80
call fcn.0104eab7
test eax, eax
je 0x104e859
xor eax, eax
inc eax
jmp 0x104e8a8
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push edi
je 0x104e8b9
call fcn.0104df5e
test eax, eax
je 0x104e86f
push 2
jmp 0x104e8a6
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
push ebx
push esi
push 4
push ebx
push ebx
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x104e8a4
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
push esi
je 0x104e904
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 6
pop eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop edi
pop esi
call fcn.0104ab5e
leave
ret 4
call fcn.0104df7f
test eax, eax
je 0x104e8c6
push 3
jmp 0x104e8a6
push 0x103
lea eax, [ebp - 0x20c]
push edi
push eax
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
mov word [ebp - 6], bx
call fcn.0104e136
lea eax, [ebp - 0x20c]
push eax
call fcn.0104df7f
test eax, eax
jne 0x104e878
push 4
jmp 0x104e8a6
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 8], ebx
jne 0x104e916
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
jmp 0x104e8a7

Function at 0x104eb53
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x127c
call fcn.0104ae00
mov eax, dword [0x106ed40]
xor eax, dword [ebp + 4]
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
mov dword [ebp - 4], eax
je 0x104eb8c
lea eax, [ebp - 0x10]
push eax
push 0x1060
lea eax, [ebp - 0x127c]
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x104eb96
mov eax, 0x8000ffff
jmp 0x104ec1d
push esi
push edi
mov edi, dword [ebp - 0x10]
shr edi, 2
je 0x104ec16
push dword [ebp + ebx*4 - 0x127c]
and word [ebp - 0x21c], 0
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x104ec11
lea eax, [ebp - 0x14]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push esi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x104ec11
push 0x103
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 0xc]
push esi
call sub.PSAPI.DLL_GetModuleBaseNameW
push esi
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], 0
je 0x104ec11
push dword [ebp + 8]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x104ec2d
inc ebx
cmp ebx, edi
jb 0x104eba0
mov eax, 0x80004005
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop ebx
call fcn.0104ab5e
leave
ret 8
mov eax, dword [ebp + ebx*4 - 0x127c]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
xor eax, eax
jmp 0x104ec1b
Function at 0x10553a4
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
push edi
xor edi, edi
test eax, eax
jne 0x10553b3
inc eax
jmp 0x10553fa
cmp eax, 2
jne 0x10553bf
and dword [esi], 0
xor eax, eax
jmp 0x10553fa
push ebx
lea ebx, [esi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x10553f0
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
jg 0x10553e0
call edi
mov edi, eax
jmp 0x10553f0
call edi
mov edi, eax
and edi, 0xffff
or edi, 0x80070000
and dword [esi], 0
and word [ebx], 0
mov eax, edi
pop ebx
pop edi
pop esi
ret

Function at 0x10558ec
Capabilities:
Delete file
Get common file path

Disassembly:
sub esp, 0x214
mov eax, dword [0x106ed40]
xor eax, dword [esp + 0x214]
push ebp
push esi
mov ebp, ecx
xor esi, esi
cmp dword [ebp + 0x414], esi
mov dword [esp + 0x218], eax
jne 0x105591d
mov eax, 0x80004005
jmp 0x1055a33
cmp dword [ebp], esi
je 0x1055932
cmp dword [esp + 0x220], esi
je 0x1055944
mov ecx, ebp
call fcn.010553a4
mov ecx, ebp
call fcn.010558a6
test eax, eax
jne 0x105594b
mov dword [ebp], 2
xor eax, eax
jmp 0x1055a33
push ebx
push edi
lea eax, [esp + 0x18]
push eax
mov ebx, 0x104
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, esi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
jne 0x1055988
call edi
test eax, eax
jg 0x1055978
call edi
mov esi, eax
jmp 0x1055993
call edi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
cmp dword [esp + 0x10], ebx
jbe 0x1055993
mov esi, 0x8007006f
test esi, esi
jl 0x1055a0d
lea ebx, [ebp + 4]
push ebx
push 0
push 0x1005e4c
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x10559cd
call edi
test eax, eax
jg 0x10559bd
call edi
mov esi, eax
jmp 0x10559cd
call edi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
test esi, esi
jl 0x1055a0d
mov esi, dword [ebp + 0x414]
push ebx
lea ecx, [esp + 0x14]
call fcn.0101e638
cmp byte [eax + 4], 0
je 0x10559eb
xor eax, eax
jmp 0x10559f6
mov eax, dword [eax]
test eax, eax
jne 0x10559f6
mov eax, 0x1003060
mov ecx, dword [esi]
push eax
push esi
call dword [ecx + 0x24]
mov esi, eax
lea eax, [esp + 0x10]
push eax
call fcn.0105f3f3
test esi, esi
jge 0x1055a25
lea edi, [ebp + 4]
push edi
call fcn.0104ea9f
test eax, eax
jne 0x1055a25
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
and word [edi], 0
xor eax, eax
test esi, esi
setge al
pop edi
pop ebx
mov dword [ebp], eax
mov eax, esi
mov ecx, dword [esp + 0x218]
xor ecx, dword [esp + 0x21c]
pop esi
pop ebp
call fcn.0104ab5e
add esp, 0x214
ret 4
Function at 0x105dc97
Capabilities:
Get local ipv4 addresses
Get socket information
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov eax, dword [0x106ed40]
xor eax, dword [ebp + 4]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
mov dword [ebp - 4], eax
jne 0x105dcbd
mov eax, 0x80070057
jmp 0x105dd3a
lea eax, [ebp - 0x1a4]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
je 0x105dcd9
mov eax, 0xc00d0027
jmp 0x105dd3a
push edi
push ebx
push 0xffffffffffffffff
push ebx
push 6
push dword [esi]
call fcn.0105f214
mov edi, eax
cmp edi, 0xffffffff
jne 0x105dcf5
mov ebx, 0xc00d0028
jmp 0x105dd2c
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
mov dword [ebp + 8], 0x10
call sub.WSOCK32.dll_getsockname
cmp eax, 0xffffffff
jne 0x105dd1b
call sub.WSOCK32.dll_WSAGetLastError
mov ebx, 0xc00d0027
jmp 0x105dd28
push dword [ebp - 0x12]
call sub.WSOCK32.dll_htons
movzx eax, ax
mov dword [esi], eax
test edi, edi
je 0x105dd32
push edi
call sub.WSOCK32.dll_closesocket
call sub.WSOCK32.dll_WSACleanup
mov eax, ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop esi
pop ebx
call fcn.0104ab5e
leave
ret 4

Function at 0x105dd4b
Capabilities:
Get hostname

Disassembly:
push esi
push dword [esp + 0xc]
xor esi, esi
push dword [esp + 0xc]
push 3
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
jne 0x105dd84
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x105dd74
call esi
mov esi, eax
jmp 0x105dd84
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
mov eax, esi
pop esi
ret 8
Function at 0x105dd8a
Capabilities:
Get routing table

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor edi, edi
push edi
lea eax, [ebp - 4]
push eax
push edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], edi
call sub.iphlpapi.dll_GetIpAddrTable
push dword [ebp - 4]
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov esi, eax
push edi
lea eax, [ebp - 4]
push eax
push esi
call sub.iphlpapi.dll_GetIpAddrTable
push edi
lea eax, [ebp - 4]
push eax
push edi
mov dword [ebp - 4], edi
call sub.iphlpapi.dll_GetIpForwardTable
push dword [ebp - 4]
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov ebx, eax
push edi
lea eax, [ebp - 4]
push eax
push ebx
call sub.iphlpapi.dll_GetIpForwardTable
cmp esi, edi
je 0x105de50
cmp ebx, edi
je 0x105de49
mov dword [ebp - 8], edi
xor edx, edx
cmp dword [ebp - 8], 1
jne 0x105ddf6
or edx, 0xffffffff
mov edi, dword [ebx]
xor eax, eax
test edi, edi
jbe 0x105de3e
lea ecx, [ebx + 4]
cmp dword [ecx], edx
jne 0x105de0a
cmp dword [ecx + 4], edx
je 0x105de14
inc eax
add ecx, 0x38
cmp eax, edi
jb 0x105de01
jmp 0x105de3e
mov edi, dword [esi]
xor edx, edx
test edi, edi
jbe 0x105de3e
imul eax, eax, 0x38
mov eax, dword [eax + ebx + 0x14]
lea ecx, [esi + 8]
cmp dword [ecx], eax
je 0x105de34
inc edx
add ecx, 0x18
cmp edx, edi
jb 0x105de26
jmp 0x105de3e
lea eax, [edx + edx*2]
mov eax, dword [esi + eax*8 + 4]
mov dword [ebp - 0xc], eax
inc dword [ebp - 8]
xor edi, edi
cmp dword [ebp - 8], 2
jl 0x105ddeb
push esi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
cmp ebx, edi
je 0x105de5b
push ebx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x105df6d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x106ed40]
xor eax, dword [ebp + 4]
cmp dword [ebp + 8], 0
mov dword [ebp - 4], eax
je 0x105e017
cmp dword [ebp + 0x10], 0
je 0x105e017
push ebx
push esi
push edi
push dword [ebp + 0x10]
push 0x1003510
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
pop ecx
pop ecx
mov ebx, 0x7fffbffb
mov edi, 0x80004005
je 0x105dfd8
push 1
push 0xe
lea eax, [ebp - 0x210]
push eax
push 0
call esi
neg eax
sbb eax, eax
and eax, ebx
add eax, edi
mov dword [ebp - 8], eax
jns 0x105dff4
push 0
push 5
lea eax, [ebp - 0x210]
push eax
push 0
call esi
neg eax
sbb eax, eax
and eax, ebx
add eax, edi
mov dword [ebp - 8], eax
js 0x105dffd
lea eax, [ebp - 0x210]
push eax
jmp 0x105dfff
push 0
push 0x1006fd0
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp + 0x10]
call fcn.0104fc4c
pop edi
pop esi
pop ebx
jmp 0x105e01c
mov eax, 0x8000ffff
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
call fcn.0104ab5e
leave
ret 0xc
Function at 0x105e7f9
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x106ed40]
xor eax, dword [ebp + 4]
cmp dword [0x107342c], 0
mov dword [ebp - 4], eax
jne 0x105e85b
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor ecx, ecx
inc ecx
test eax, eax
je 0x105e84e
cmp dword [ebp - 0x108], 2
jne 0x105e84e
cmp dword [ebp - 0x114], 5
jb 0x105e84e
mov dword [0x107060c], ecx
jmp 0x105e855
and dword [0x107060c], 0
mov dword [0x107342c], ecx
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
mov eax, dword [0x107060c]
call fcn.0104ab5e
leave
ret

Function at 0x105e86d
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x106ed40]
xor eax, dword [ebp + 4]
cmp dword [0x1073430], 0
mov dword [ebp - 4], eax
jne 0x105e8d7
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor ecx, ecx
inc ecx
test eax, eax
je 0x105e8ca
cmp dword [ebp - 0x108], 2
jne 0x105e8ca
cmp dword [ebp - 0x114], 5
jb 0x105e8ca
cmp dword [ebp - 0x110], ecx
jb 0x105e8ca
mov dword [0x1070610], ecx
jmp 0x105e8d1
and dword [0x1070610], 0
mov dword [0x1073430], ecx
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
mov eax, dword [0x1070610]
call fcn.0104ab5e
leave
ret

Function at 0x105e920
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
mov eax, esi
cdq
idiv dword [esp + 0xc]
mov eax, dword [esp + 8]
mov al, byte [edx + eax]
xor byte [esi + ecx], al
inc esi
cmp esi, 0x10
jb 0x105e923
pop esi
ret 8
Function at 0x105f214
Capabilities:
Get hostname
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x106ed40]
xor eax, dword [ebp + 4]
push ebx
xor ebx, ebx
cmp dword [ebp + 0x10], ebx
mov dword [ebp - 4], eax
push edi
jne 0x105f256
push dword [ebp + 8]
lea eax, [ebp - 0x14]
mov dword [ebp + 0x10], eax
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov word [ebp - 0x14], 2
mov dword [ebp - 0x10], ebx
call dword [sym.imp.WSOCK32.dll_htons]
mov word [ebp - 0x12], ax
or edi, 0xffffffff
cmp dword [ebp + 0x14], edi
je 0x105f2b4
push 0x104
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.WSOCK32.dll_gethostname]
test eax, eax
jne 0x105f2a6
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.WSOCK32.dll_gethostbyname]
cmp eax, ebx
je 0x105f2a6
xor ecx, ecx
cmp dword [ebp + 0x14], ebx
je 0x105f29c
mov edx, dword [eax + 0xc]
cmp dword [edx], ebx
je 0x105f29c
inc ecx
add edx, 4
cmp ecx, dword [ebp + 0x14]
jne 0x105f28f
mov eax, dword [eax + 0xc]
lea eax, [eax + ecx*4]
cmp dword [eax], ebx
jne 0x105f2aa
mov eax, edi
jmp 0x105f316
mov eax, dword [eax]
mov eax, dword [eax]
mov ecx, dword [ebp + 0x10]
mov dword [ecx + 4], eax
xor eax, eax
cmp dword [ebp + 0xc], 6
push esi
push dword [ebp + 0xc]
setne al
inc eax
push eax
push 2
call dword [sym.imp.WSOCK32.dll_socket]
mov esi, eax
cmp esi, edi
je 0x105f313
cmp dword [ebp + 0x18], ebx
je 0x105f2ea
push 4
lea eax, [ebp + 0x18]
push eax
push 4
push 0xffff
push esi
call dword [sym.imp.WSOCK32.dll_setsockopt]
push 0x10
push dword [ebp + 0x10]
push esi
call dword [sym.imp.WSOCK32.dll_bind]
cmp eax, edi
jne 0x105f313
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push esi
mov edi, eax
call dword [sym.imp.WSOCK32.dll_closesocket]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
or esi, 0xffffffff
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop edi
pop ebx
call fcn.0104ab5e
leave
ret 0x14

Function at 0x105fd2f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push 0x100785c
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x105fd85
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x1007898
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x105fd78
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x105fd87
xor eax, eax
pop esi
leave
ret 4
Function at 0x100162d
Capabilities:
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x1001690
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
xor ecx, ebp
pop ebx
call fcn.0100265e
leave
ret

Function at 0x10016a5
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 0x210], esi
cmp ebx, edi
je 0x100176b
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x100176b
lea eax, [ebp - 0x208]
push eax
push 0x10008
push edi
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, edi
jne 0x1001770
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x204]
push eax
push edi
push dword [ebp - 0x208]
mov dword [ebp - 0x20c], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
cmp esi, 0x103
je 0x100174e
cmp esi, edi
jne 0x100175d
lea eax, [ebp - 0x204]
push eax
push dword [ebp - 0x208]
call fcn.010016a5
mov esi, eax
cmp esi, edi
je 0x10016fd
jmp 0x100175d
push ebx
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1001770
mov esi, 0x3f2
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100265e
leave
ret 8