joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4041b4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor edx, edx
mov ecx, dword [ebp + 0xc]
and eax, 3
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, edx
sub ecx, eax
je 0x4041fe
rol edx, 5
xor edx, dword [esi + ebx]
add esi, 4
imul eax, edx, 0x9e3779b9
rol eax, 5
xor eax, 4
imul edx, eax, 0x9e3779b9
cmp esi, ecx
jb 0x4041cd
jmp 0x4041fe
movsx ecx, byte [esi + ebx]
rol edx, 5
xor edx, ecx
imul edx, edx, 0x9e3779b9
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x4041ee
pop esi
mov eax, edx
pop ebx
pop ebp
ret

Function at 0x404261
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov ebx, dword [sym.TestSplayTree.exe_gMozillaPoisonSize]
push esi
push edi
push 1
lea esi, [ebx - 1]
push 0x2000
not esi
push ebx
and esi, 0xf0deafff
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x404299
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [ebp - 0x1c]
jb 0x4042c3
lea eax, [esi + ebx]
cmp eax, dword [ebp - 0x1c]
jb 0x4042c3
test edi, edi
je 0x404290
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x404290
test edi, edi
je 0x4042cb
mov eax, edi
jmp 0x404292
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x404292
int3

Function at 0x4042fa
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
mov dword [sym.TestSplayTree.exe_gMozillaPoisonSize], eax
call fcn.00404261
mov ecx, dword [sym.TestSplayTree.exe_gMozillaPoisonSize]
mov dword [sym.TestSplayTree.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x404330
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestSplayTree.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret
Function at 0x1002a27
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x818
mov eax, dword [0x100d048]
push ebx
push esi
push edi
push 0x17
pop ecx
mov esi, 0x1001338
lea edi, [ebp - 0x604]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
movsw word es:[edi], word [esi]
push 0x68
pop ecx
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x818], eax
xor eax, eax
push 0x7e
xor ebx, ebx
lea edi, [ebp - 0x5a6]
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 0x204], ebx
lea edi, [ebp - 0x200]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x7e
pop ecx
xor eax, eax
mov dword [ebp - 0x804], ebx
lea edi, [ebp - 0x800]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x804]
push eax
mov dword [ebp - 0x810], ebx
mov dword [ebp - 0x80c], ebx
mov dword [ebp - 0x814], 0xff
call esi
push 0x7e
mov dword [ebp - 0x404], ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x400]
rep stosd dword es:[edi], eax
push 0x1fc
stosw word es:[edi], ax
call dword [sym.imp.msvcrt.dll_malloc]
cmp eax, ebx
pop ecx
mov dword [ebp - 0x808], eax
je 0x1002c42
push dword [ebp - 0x818]
call esi
test eax, eax
lea eax, [ebp - 0x204]
je 0x1002b16
push 0x1001330
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [ebp - 0x818]
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x1002b23
push dword [ebp - 0x818]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x80c]
push eax
push 0x80000002
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
test eax, eax
jne 0x1002c36
lea eax, [ebp - 0x810]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x604]
push eax
push dword [ebp - 0x80c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1002c36
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x814]
push eax
push dword [ebp - 0x808]
mov edi, 0x1001318
push ebx
push ebx
push edi
push dword [ebp - 0x810]
call esi
cmp eax, 0xea
jne 0x1002bc6
mov eax, dword [ebp - 0x814]
add eax, eax
push eax
push dword [ebp - 0x808]
call dword [sym.imp.msvcrt.dll_realloc]
pop ecx
pop ecx
lea ecx, [ebp - 0x814]
push ecx
push eax
push ebx
push ebx
push edi
push dword [ebp - 0x810]
mov dword [ebp - 0x808], eax
call esi
cmp eax, ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x810]
je 0x1002be2
call esi
push dword [ebp - 0x80c]
call esi
jmp 0x1002c42
call esi
push dword [ebp - 0x80c]
call esi
push 0x1001310
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x404]
push eax
push dword [ebp - 0x808]
call dword [sym.imp.msvcrt.dll_wcsstr]
mov esi, eax
neg esi
sbb esi, esi
neg esi
inc esi
pop ecx
inc esi
cmp dword [ebp - 0x808], ebx
pop ecx
je 0x1002c32
push dword [ebp - 0x808]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov eax, esi
jmp 0x1002c45
push dword [ebp - 0x80c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 4
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01006b1c
leave
ret 4
Function at 0x10040c9
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x19c
mov eax, dword [0x100d048]
push esi
mov esi, dword [ebp + 8]
test esi, esi
mov dword [ebp - 4], eax
jne 0x10040eb
xor eax, eax
jmp 0x100424a
and dword [ebp - 0x198], 0
push ebx
push 0x101
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
test ebx, ebx
pop ecx
jne 0x100413a
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x9c
call fcn.01008098
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
call fcn.01007c8b
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
call fcn.01007f13
xor eax, eax
jmp 0x1004249
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x1004159
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
jmp 0x1004106
push edi
push 0x40
pop ecx
push 0x100
push ebx
xor eax, eax
mov edi, ebx
push esi
rep stosd dword es:[edi], eax
call fcn.010074aa
push esi
call fcn.010098cb
test eax, eax
pop edi
je 0x10041d7
and dword [ebp - 0x19c], 0
push ebx
call dword [sym.imp.WS2_32.dll_inet_addr]
push 2
mov dword [ebp - 0x19c], eax
push 4
lea eax, [ebp - 0x19c]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyaddr]
jmp 0x10041e8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x9c
call fcn.01008098
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
call fcn.01007c8b
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
call fcn.01007f13
jmp 0x1004236
push esi
call fcn.010099bc
test eax, eax
je 0x1004204
push ebx
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x10041a1
push 0xf
push esi
push dword [eax]
call fcn.01007555
push esi
call fcn.0100403d
mov dword [ebp - 0x198], eax
jmp 0x1004236
push 0x9c
call fcn.01008098
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
call fcn.01007c8b
push 0xa4
call fcn.01008098
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
call fcn.01007c8b
call dword [sym.imp.WS2_32.dll_WSACleanup]
push ebx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
mov eax, dword [ebp - 0x198]
pop ecx
pop ebx
mov ecx, dword [ebp - 4]
pop esi
call fcn.01006b1c
leave
ret 4
Function at 0x1005021
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push 0x100d6ac
push 0x2001f
push 0
push 0x1001460
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100508a
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x1001448
push dword [0x100d6ac]
mov dword [ebp - 4], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100507e
cmp dword [ebp - 8], 4
jne 0x100507e
mov eax, dword [ebp - 0xc]
leave
ret
push dword [0x100d6ac]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
leave
ret

Function at 0x1005137
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
push edi
push 0x38
lea eax, [ebp - 0x40]
pop ebx
mov dword [0x100d684], eax
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 0x40]
push eax
push 0x11
call esi
mov edi, 0xc0000004
jmp 0x10051ac
cmp dword [ebp - 4], ebx
jbe 0x10051b0
mov eax, dword [0x100d684]
lea ecx, [ebp - 0x40]
cmp eax, ecx
je 0x1005182
push eax
call fcn.01005119
mov eax, dword [ebp - 4]
add eax, 0x1000
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.010050d2
test eax, eax
mov dword [0x100d684], eax
je 0x10051c6
mov ebx, dword [ebp - 8]
lea ecx, [ebp - 4]
push ecx
push ebx
push eax
push 0x11
call esi
cmp eax, edi
je 0x100516b
test eax, eax
jge 0x10051ca
mov eax, dword [0x100d684]
lea ecx, [ebp - 0x40]
cmp eax, ecx
je 0x10051c6
push eax
call fcn.01005119
xor al, al
jmp 0x1005237
mov edx, dword [0x100d684]
mov eax, edx
mov ecx, dword [eax + 0xc]
cmp ecx, 0x80
jae 0x10051f4
mov esi, dword [eax + 0x30]
lea ecx, [ecx + ecx*2]
mov dword [ecx*4 + 0x100d070], esi
mov esi, dword [eax + 0x34]
mov dword [ecx*4 + 0x100d074], esi
mov eax, dword [eax]
test eax, eax
je 0x10051fe
add eax, edx
jmp 0x10051d2
push 0x10014c4
push 0x100d068
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov eax, 0x100d070
mov ecx, 0x81
cmp word [eax], 0
jne 0x100522f
mov edx, dword [0x100d068]
mov dword [eax], edx
mov edx, dword [0x100d06c]
mov dword [eax + 4], edx
add eax, 0xc
dec ecx
jne 0x1005218
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x1005243
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
push edi
push 0x24
lea eax, [ebp - 0x30]
pop ebx
mov dword [0x100d680], eax
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 0x30]
push eax
push 0x40
call esi
mov edi, 0xc0000004
jmp 0x10052b8
cmp dword [ebp - 4], ebx
jbe 0x10052bc
mov eax, dword [0x100d680]
lea ecx, [ebp - 0x30]
cmp eax, ecx
je 0x100528e
push eax
call fcn.01005119
mov eax, dword [ebp - 4]
add eax, 0x1000
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
call fcn.010050d2
test eax, eax
mov dword [0x100d680], eax
je 0x10052d2
mov ebx, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push ebx
push eax
push 0x40
call esi
cmp eax, edi
je 0x1005277
test eax, eax
jge 0x10052d6
mov eax, dword [0x100d680]
lea ecx, [ebp - 0x30]
cmp eax, ecx
je 0x10052d2
push eax
call fcn.01005119
xor al, al
jmp 0x100534c
mov edi, dword [0x100d684]
mov esi, dword [0x100d680]
mov ebx, edi
movzx edx, word [ebx + 0x32]
add edx, dword [ebx + 0x34]
mov dword [ebp - 0xc], ebx
cmp dword [edx + 0x14], 0
je 0x1005335
and dword [ebp - 8], 0
cmp dword [esi], 0
lea eax, [esi + 8]
jbe 0x1005335
mov ecx, dword [eax + 0x14]
inc dword [ebp - 8]
test cl, cl
js 0x100532b
mov ebx, dword [eax]
cmp ebx, dword [edx + 4]
mov ebx, dword [ebp - 0xc]
jne 0x100532b
or ecx, 0x80
mov dword [eax], edx
mov dword [eax + 0x14], ecx
mov esi, dword [0x100d680]
mov edi, dword [0x100d684]
mov ecx, dword [ebp - 8]
add eax, 0x1c
cmp ecx, dword [esi]
jb 0x1005300
mov edx, dword [edx]
test edx, edx
je 0x100533f
add edx, edi
jmp 0x10052ee
mov eax, dword [ebx]
test eax, eax
je 0x100534a
lea ebx, [eax + edi]
jmp 0x10052e4
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x1005358
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x100d048]
mov dword [ebp - 4], eax
mov eax, 0x100d688
mov dword [0x100d68c], eax
mov dword [0x100d688], eax
lea eax, [ebp - 0x10c]
push eax
mov dword [ebp - 0x10c], 0x10000
call fcn.010050d2
test eax, eax
mov dword [0x100d67c], eax
jne 0x10053a0
xor al, al
jmp 0x10054f5
push ebx
mov ebx, dword [ebp - 0x10c]
push esi
mov esi, dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
push edi
push 0
push ebx
push eax
push 5
call esi
mov edi, 0xc0000004
jmp 0x1005404
push 0x4000
push ebx
push dword [0x100d67c]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
je 0x1005430
lea eax, [ebx + ebx]
cmp eax, ebx
jb 0x1005430
mov dword [ebp - 0x10c], eax
lea eax, [ebp - 0x10c]
push eax
call fcn.010050d2
test eax, eax
mov dword [0x100d67c], eax
je 0x1005430
mov ebx, dword [ebp - 0x10c]
push 0
push ebx
push eax
push 5
call esi
cmp eax, edi
je 0x10053be
test eax, eax
jl 0x1005430
mov esi, dword [0x100d67c]
and dword [ebp - 0x10c], 0
mov ebx, dword [sym.imp.msvcrt.dll_sprintf]
xor edi, edi
cmp dword [esi + 0x3c], edi
jne 0x1005437
push dword [esi + 0x44]
push 0x10014e8
jmp 0x1005440
xor al, al
jmp 0x10054f2
lea eax, [esi + 0x38]
push eax
push 0x10014e4
lea eax, [ebp - 0x108]
push eax
call ebx
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.ntdll.dll_RtlInitAnsiString]
push 1
lea eax, [ebp - 0x114]
push eax
lea eax, [esi + 0x38]
push eax
call dword [sym.imp.ntdll.dll_RtlAnsiStringToUnicodeString]
mov eax, dword fs:[0x18]
mov ecx, dword [esi + 4]
mov eax, dword [eax + 0x30]
lea ecx, [ecx*4 + 0x10]
push ecx
push 8
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
cmp eax, edi
je 0x1005430
mov dword [eax + 4], eax
mov dword [eax], eax
mov dword [eax + 8], esi
cmp dword [esi + 4], 0
lea ecx, [esi + 0xb8]
jbe 0x10054bb
lea edx, [eax + 0xc]
mov dword [edx], ecx
add ecx, 0x40
inc edi
add edx, 4
cmp edi, dword [esi + 4]
jb 0x10054ad
mov ecx, dword [0x100d68c]
mov dword [eax], 0x100d688
mov dword [eax + 4], ecx
mov dword [ecx], eax
mov dword [0x100d68c], eax
mov esi, dword [esi]
test esi, esi
je 0x10054f0
add dword [ebp - 0x10c], esi
mov eax, dword [0x100d67c]
mov ecx, dword [ebp - 0x10c]
lea esi, [eax + ecx]
jmp 0x100541f
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
call fcn.01006b1c
leave
ret 4
Function at 0x10055be
Capabilities:
Manipulate console buffer

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xb0
mov eax, dword [0x100d048]
mov edx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
xor esi, esi
mov dword [ebp - 0xa8], eax
push 0x27
xor eax, eax
cmp ebx, esi
mov word [ebp - 0xa4], si
pop ecx
lea edi, [ebp - 0xa2]
rep stosd dword es:[edi], eax
mov dword [ebp - 0xb0], esi
stosw word es:[edi], ax
je 0x1005690
mov ax, word [edx + 6]
push 0x14
pop ecx
mov word [ebp - 0xaa], ax
mov word [ebp - 0xac], si
push dword [ebp - 0xac]
mov esi, dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
xor eax, eax
lea edi, [ebp - 0xa4]
push ebx
rep stosd dword es:[edi], eax
call esi
push 0
lea eax, [ebp - 0xb0]
push eax
push 0x4f
push 0x4f
push 0x10012d0
lea eax, [ebp - 0xa4]
push eax
call fcn.010070d7
mov edi, dword [sym.imp.KERNEL32.dll_WriteConsoleW]
push eax
push ebx
call edi
push dword [ebp - 0xac]
push ebx
call esi
cmp dword [ebp - 0xa8], 0
je 0x1005690
push 0
lea eax, [ebp - 0xb0]
push eax
push dword [ebp - 0xa8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push dword [ebp - 0xa8]
push ebx
call edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01006b1c
leave
ret 0xc
Function at 0x1006688
Capabilities:
Get process heap flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
call fcn.01005021
push 0xe7
mov esi, eax
call fcn.01008098
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push eax
push dword [ebp + 0x14]
call edi
test eax, eax
jne 0x10066d9
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
test byte [eax + 0x69], 0x40
jne 0x10066c6
push 0xe9
jmp 0x1006731
and esi, 0xffffbfff
push esi
call fcn.01005093
push 0xe5
jmp 0x1006731
push 0xe6
call fcn.01008098
push eax
push dword [ebp + 0x14]
call edi
test eax, eax
jne 0x100670f
mov eax, dword fs:[0x18]
mov ecx, dword [eax + 0x30]
mov eax, 0x4000
test dword [ecx + 0x68], eax
jne 0x100672c
or esi, eax
push esi
call fcn.01005093
push 0xe4
jmp 0x1006731
push 0x1001280
push dword [ebp + 0x14]
call edi
test eax, eax
jne 0x1006756
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
test byte [eax + 0x69], 0x40
je 0x10066bf
push 0xea
call fcn.01008098
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
call fcn.01007c8b
push dword [0x100d6ac]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1006828
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
test byte [eax + 0x69], 0x40
push dword [0x100d6ac]
jne 0x100678f
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xe3
call fcn.01008098
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
call fcn.01007c8b
jmp 0x1006828
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
mov dword [0x100d690], eax
mov esi, 0x100d694
je 0x10067b3
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
push esi
push 0xb9
call fcn.01008098
push eax
push dword [0x100d690]
call fcn.010055be
or dword [0x100d6b0], 0xffffffff
and dword [0x100dcc0], 0
push 4
push 0x100dbc0
push 0x100152c
mov byte [0x100d6b8], 0
mov byte [0x100dcc4], 0
call fcn.01004fca
call fcn.01005cd4
mov esi, eax
test esi, esi
je 0x100682b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.01005d43
mov eax, dword [0x100d6b0]
cmp eax, 0xffffffff
je 0x1006821
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.ntdll.dll_RtlDestroyQueryDebugBuffer]
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
ret 0x10
Function at 0x1006c34
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x28
push 0x1001578
call fcn.01006edc
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x1006c6f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1006c6f
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x1006c87
cmp eax, 0x20b
je 0x1006c74
mov dword [ebp - 0x1c], edi
jmp 0x1006c9b
cmp dword [ecx + 0x84], 0xe
jbe 0x1006c6f
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x1006c95
cmp dword [ecx + 0x74], 0xe
jbe 0x1006c6f
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x100dcf0], 0xffffffff
or dword [0x100dcf4], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x100dcd4]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x100dcd0]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x100dcf8], eax
call fcn.01006ed4
cmp dword [0x100d050], edi
jne 0x1006cf6
push fcn.01006ed4
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.01006ebd
push 0x100d010
push 0x100d00c
call sub.msvcrt.dll__initterm
mov eax, dword [0x100dccc]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x100dcc8]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___wgetmainargs]
mov dword [ebp - 0x34], eax
push 0x100d008
push section..data
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x20]
mov ecx, dword [sym.imp.msvcrt.dll___winitenv]
mov dword [ecx], eax
push dword [ebp - 0x20]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.0100364c
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x1c], edi
jne 0x1006d6d
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x1006da2
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.01006f17
ret
Function at 0x1009ae8
Capabilities:
Initialize winsock library

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x19c
mov eax, dword [0x100d048]
and dword [ebp - 0x198], 0
cmp dword [0x100dcd8], 0
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x19c], eax
jne 0x1009b4c
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x1009b42
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1009bf2
mov dword [0x100dcd8], 1
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
lea eax, [esi + 5]
push 1
push eax
call dword [sym.imp.msvcrt.dll_calloc]
mov edi, eax
test edi, edi
pop ecx
pop ecx
jne 0x1009b7d
push 0x8007000e
call dword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.010073ca
jmp 0x1009bbd
push esi
push edi
push ebx
call fcn.010074aa
push edi
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
mov dword [ebp - 0x198], eax
jne 0x1009ba6
push edi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push 0x800300fd
jmp 0x1009b70
push 2
push 4
lea eax, [ebp - 0x198]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyaddr]
mov esi, eax
test esi, esi
jne 0x1009bc1
xor eax, eax
jmp 0x1009bf0
push edi
call dword [sym.imp.msvcrt.dll_free]
cmp dword [ebp + 0x10], 0
mov eax, dword [esi]
pop ecx
jne 0x1009bdf
push 0x10016a0
push eax
call dword [sym.imp.msvcrt.dll_strtok]
pop ecx
pop ecx
push 0xf
push dword [ebp - 0x19c]
push eax
call fcn.01007555
xor eax, eax
inc eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
pop ebx
call fcn.01006b1c
leave
ret 0xc

Function at 0x1009c28
Capabilities:
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x100d048]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x3f
xor edx, edx
pop ecx
mov dword [ebp - 4], eax
xor eax, eax
cmp ebx, edx
lea edi, [ebp - 0x100]
mov dword [ebp - 0x104], edx
rep stosd dword es:[edi], eax
push 0x3f
pop ecx
lea edi, [ebp - 0x200]
mov dword [ebp - 0x204], edx
mov dword [ebp - 0x208], edx
rep stosd dword es:[edi], eax
je 0x1009d17
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x1009d17
mov esi, dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x104]
push eax
mov edi, 0x80
push 4
mov dword [ebp - 0x208], edi
call esi
push 0
push 1
push ebx
lea eax, [ebp - 0x104]
push eax
call fcn.01007b40
test eax, eax
je 0x1009d17
push ebx
call fcn.010098cb
cmp eax, 1
jne 0x1009ce7
push 0
lea eax, [ebp - 0x204]
push eax
push ebx
call fcn.01009ae8
test eax, eax
je 0x1009d1a
push 0
push 1
lea eax, [ebp - 0x204]
push eax
jmp 0x1009d04
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x104]
push eax
push 7
mov dword [ebp - 0x208], edi
call esi
push 0
push 1
push ebx
lea eax, [ebp - 0x104]
push eax
call fcn.01007b40
neg eax
sbb eax, eax
inc eax
jmp 0x1009d1a
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01006b1c
leave
ret 4