joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000f860
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1002f018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 4
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1000f892
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001eb32
mov esp, ebp
pop ebp
ret
push ebx
lea eax, [ebp - 0x20]
push eax
push esi
mov dword [ebp - 0x20], 0x1c
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x1000f8c0
mov ebx, dword [sym.imp.KERNEL32.dll_Thread32Next]
nop
cmp dword [ebp - 0x14], edi
je 0x1000f8d9
lea ecx, [ebp - 0x20]
push ecx
push esi
call ebx
test eax, eax
jne 0x1000f8b0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001eb32
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x18]
pop ebx
xor ecx, ebp
pop esi
call fcn.1001eb32
mov esp, ebp
pop ebp
ret
Function at 0x10017550
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100217a0
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x1002f018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [sym.imp.MSVCR100.dll_strtoul]
xor ebx, ebx
jmp 0x10017590
mov dword [ebp - 0x3c], 0x72616548
mov dword [ebp - 0x38], 0x61426874
mov word [ebp - 0x34], 0x6573
mov byte [ebp - 0x32], bl
mov dword [ebp - 4], ebx
mov dword [ebp - 0x4c], 0x30317830
mov dword [ebp - 0x48], 0x303641
mov dword [ebp - 0x24], 0x66397830
mov dword [ebp - 0x20], 0x62636465
mov word [ebp - 0x1c], 0x6161
mov byte [ebp - 0x1a], bl
push 0x10
lea eax, [ebp - 0x4c]
push ebx
push eax
mov byte [ebp - 4], 2
call esi
push 0x10
lea ecx, [ebp - 0x24]
push ebx
push ecx
mov edi, eax
call esi
mov ecx, dword [0x10162608]
mov edx, dword [ecx]
mov edx, dword [edx + 0x28]
mov dword [ebp - 0x50], eax
add esp, 0x18
lea eax, [ebp - 0x3c]
push eax
call edx
mov ecx, dword [ebp - 0x50]
cmp dword [eax + edi], ecx
mov dword [ebp - 4], 0xffffffff
sete cl
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov word [ebp - 0x1c], ax
mov byte [ebp - 0x1a], al
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov word [ebp - 0x34], ax
mov byte [ebp - 0x32], al
cmp cl, bl
je 0x100176f9
mov dword [ebp - 0x30], 0x72616548
mov dword [ebp - 0x2c], 0x61426874
mov word [ebp - 0x28], 0x6573
mov byte [ebp - 0x26], bl
mov dword [ebp - 4], 3
mov dword [ebp - 0x44], 0x30317830
mov dword [ebp - 0x40], 0x303641
mov dword [ebp - 0x18], 0x45317830
mov word [ebp - 0x14], 0x38
push 0x10
lea edx, [ebp - 0x44]
push ebx
push edx
mov byte [ebp - 4], 5
call esi
push 0x10
mov edi, eax
lea eax, [ebp - 0x18]
push ebx
push eax
call esi
mov ecx, dword [0x10162608]
mov edx, dword [ecx]
mov edx, dword [edx + 0x28]
mov dword [ebp - 0x50], eax
add esp, 0x18
lea eax, [ebp - 0x30]
push eax
call edx
add eax, dword [ebp - 0x50]
mov edi, dword [eax + edi]
sub edi, 0x700
je 0x100176ce
mov dword [ebp - 0x50], ebx
push 0x10
push ebx
push str.0x34323032
call esi
mov ecx, dword [ebp - 0x50]
add esp, 0xc
cmp dword [ecx + edi], eax
je 0x100176cc
dec ecx
mov dword [ebp - 0x50], ecx
jmp 0x100176b1
add edi, ecx
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x10162a18], edi
mov dword [ebp - 0x18], eax
mov word [ebp - 0x14], ax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov word [ebp - 0x28], ax
mov byte [ebp - 0x26], al
jmp 0x100176ff
mov edi, dword [0x10162a18]
cmp edi, ebx
ja 0x10017713
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10017590
push edi
push str.HITT22__p_n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001eb32
mov esp, ebp
pop ebp
ret
Function at 0x10017d20
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
mov eax, dword [0x1002f018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.MSVCR100.dll_sprintf]
push edi
push esi
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x108]
push ecx
mov dword [ebp - 0x110], 0x2a5c7325
mov word [ebp - 0x10c], 0x2a2e
mov byte [ebp - 0x10a], 0
call ebx
add esp, 0xc
lea edx, [ebp - 0x250]
push edx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
nop
lea ecx, [ebp - 0x224]
push ecx
push esi
lea edx, [ebp - 0x110]
push edx
lea eax, [ebp - 0x108]
push eax
mov dword [ebp - 0x110], 0x255c7325
mov word [ebp - 0x10c], 0x73
call ebx
add esp, 0x10
xor eax, eax
lea ecx, [ebp - 0x108]
push ecx
mov dword [ebp - 0x110], eax
mov word [ebp - 0x10c], ax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [ebp - 0x250]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10017d80
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.1001eb32
mov esp, ebp
pop ebp
ret

Function at 0x10017e00
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
mov eax, dword [0x1002f018]
xor eax, esp
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov eax, dword [ebp + 0xc]
dec eax
jne 0x10017e9a
push 0x10162070
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov esi, 0x10162070
call fcn.10017d20
mov esi, str.C:Windowsprefetch
call fcn.10017d20
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x10], 0x742e4d47
mov word [esp + 0x14], 0x7478
mov byte [esp + 0x16], 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
mov dword [esp + 0xc], eax
mov word [esp + 0x10], ax
mov byte [esp + 0x12], al
call fcn.1001e9b0
mov edi, 0x1000f220
mov ecx, eax
call fcn.1001e8e0
call fcn.1001e9b0
mov edi, 0x10017b00
mov ecx, eax
call fcn.1001e8e0
mov ecx, dword [esp + 0x14]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.1001eb32
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1001a070
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10021c78
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1002f018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [edi + 0x44], 0
je 0x1001a1c8
cmp byte [edi + 0x49], 0
je 0x1001a1c8
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
mov ecx, edi
call edx
cmp eax, 0xffffffff
je 0x1001a1bc
lea esi, [ebp - 0x2c]
call fcn.10019d60
mov dword [ebp - 4], 0
mov ebx, 0x10
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x2c]
cmp eax, ebx
jae 0x1001a11b
lea ecx, [ebp - 0x2c]
mov eax, ecx
add ecx, dword [ebp - 0x1c]
lea edx, [ebp - 0x30]
push edx
push ecx
mov ecx, dword [edi + 0x44]
push eax
lea eax, [edi + 0x4c]
push eax
call dword [sym.imp.MSVCP100.dll_public:_int___thiscall_std::codecvt_char__char__int_::unshift_int___char___char___char___const]
sub eax, 0
je 0x1001a120
dec eax
je 0x1001a124
sub eax, 2
lea esi, [ebp - 0x2c]
je 0x1001a1c3
call fcn.100013c0
xor al, al
jmp 0x1001a1ca
mov eax, dword [ebp - 0x2c]
jmp 0x1001a0e5
mov byte [edi + 0x49], 0
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x2c]
mov eax, edx
cmp ecx, ebx
jae 0x1001a133
lea eax, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, eax
je 0x1001a158
mov eax, edx
cmp ecx, ebx
jae 0x1001a143
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp esi, eax
jne 0x1001a1b4
cmp byte [edi + 0x49], 0
je 0x1001a1c0
test esi, esi
jne 0x1001a0d6
mov eax, dword [ebp - 0x1c]
or edx, 0xffffffff
sub edx, eax
cmp edx, 8
jbe 0x1001a1e5
lea esi, [eax + 8]
lea eax, [ebp - 0x2c]
call fcn.10001640
test al, al
je 0x1001a0d6
mov ecx, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], ebx
jae 0x1001a191
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 0x1c]
xor eax, eax
mov dword [ecx + edx], eax
mov dword [ecx + edx + 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x18], ebx
jae 0x1001a1ab
lea eax, [ebp - 0x2c]
mov byte [eax + esi], 0
jmp 0x1001a0d6
lea esi, [ebp - 0x2c]
call fcn.100013c0
xor al, al
jmp 0x1001a1ca
lea esi, [ebp - 0x2c]
call fcn.100013c0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001eb32
mov esp, ebp
pop ebp
ret
push 0x10026bdc
call dword [sym.imp.MSVCP100.dll_void___cdecl_std::_Xlength_error_char_const__]
int3

Function at 0x1001b0c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, 0xf1
xor ecx, ecx
jmp 0x1001b0d0
mov al, byte [edi + ecx - 0x210f19]
xor al, dl
inc edx
and edx, 0x800000ff
mov byte [ecx + esi], al
jns 0x1001b0ed
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 0xc
jl 0x1001b0d0
mov byte [esi + 0xc], 0
mov eax, esi
ret
Function at 0x1001b790
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, 2
xor ecx, ecx
jmp 0x1001b7a0
mov al, byte [edi + ecx - 0x321a2a]
xor al, dl
inc edx
and edx, 0x800000ff
mov byte [ecx + esi], al
jns 0x1001b7bd
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 0x26
jl 0x1001b7a0
mov byte [esi + 0x26], 0
mov eax, esi
ret

Function at 0x1001b7d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, 2
xor ecx, ecx
jmp 0x1001b7e0
mov al, byte [edi + ecx - 0x321a2a]
xor al, dl
inc edx
and edx, 0x800000ff
mov byte [ecx + esi], al
jns 0x1001b7fd
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 0x20
jl 0x1001b7e0
mov byte [esi + 0x20], 0
mov eax, esi
ret

Function at 0x1001bf10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, 0x29
xor ecx, ecx
jmp 0x1001bf20
mov al, byte [edi + ecx + 0x1e7b41dd]
xor al, dl
inc edx
and edx, 0x800000ff
mov byte [ecx + esi], al
jns 0x1001bf3d
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 0xc
jl 0x1001bf20
mov byte [esi + 0xc], 0
mov eax, esi
ret

Function at 0x1001bf50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, 0x6c
xor ecx, ecx
jmp 0x1001bf60
mov al, byte [edi + ecx + 0x6fad512a]
xor al, dl
inc edx
and edx, 0x800000ff
mov byte [ecx + esi], al
jns 0x1001bf7d
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 0xc
jl 0x1001bf60
mov byte [esi + 0xc], 0
mov eax, esi
ret

Function at 0x1001bf90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, 0x49
xor ecx, ecx
jmp 0x1001bfa0
mov al, byte [edi + ecx + 0x16440e0f]
xor al, dl
inc edx
and edx, 0x800000ff
mov byte [ecx + esi], al
jns 0x1001bfbd
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 0xc
jl 0x1001bfa0
mov byte [esi + 0xc], 0
mov eax, esi
ret

Function at 0x1001c6a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, 0xfa
xor ecx, ecx
jmp 0x1001c6b0
mov al, byte [edi + ecx - 0x2b3158]
xor al, dl
inc edx
and edx, 0x800000ff
mov byte [ecx + esi], al
jns 0x1001c6cd
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 0xc
jl 0x1001c6b0
mov byte [esi + 0xc], 0
mov eax, esi
ret

Function at 0x1001c990
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, 0x1f
xor ecx, ecx
jmp 0x1001c9a0
mov al, byte [edi + ecx - 0x97d5a03]
xor al, dl
inc edx
and edx, 0x800000ff
mov byte [ecx + esi], al
jns 0x1001c9bd
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 0xc
jl 0x1001c9a0
mov byte [esi + 0xc], 0
mov eax, esi
ret

Function at 0x1001cd50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, 0x1d
xor ecx, ecx
jmp 0x1001cd60
mov al, byte [edi + ecx - 0x1a1d45]
xor al, dl
inc edx
and edx, 0x800000ff
mov byte [ecx + esi], al
jns 0x1001cd7d
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 0xc
jl 0x1001cd60
mov byte [esi + 0xc], 0
mov eax, esi
ret

Function at 0x1001d2d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, 0x58
xor ecx, ecx
jmp 0x1001d2e0
mov al, byte [edi + ecx - 0x221f1b]
xor al, dl
inc edx
and edx, 0x800000ff
mov byte [ecx + esi], al
jns 0x1001d2fd
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 0xc
jl 0x1001d2e0
mov byte [esi + 0xc], 0
mov eax, esi
ret
Function at 0x1001e2c0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10021f08
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x1002f018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 4], eax
cmp dword [ebp + 0x1c], 0x10
mov byte [ebp - 0x7c], al
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], 0x67452301
mov dword [ebp - 0x2c], 0xefcdab89
mov dword [ebp - 0x28], 0x98badcfe
mov dword [ebp - 0x24], 0x10325476
jae 0x1001e323
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp + 0x18]
lea esi, [ebp - 0x7c]
call fcn.1001e080
mov ecx, esi
call fcn.1001e130
mov ecx, edi
mov ebx, esi
call fcn.1001e210
cmp dword [ebp + 0x1c], 0x10
jb 0x1001e352
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001eb32
mov esp, ebp
pop ebp
ret
Function at 0x1001e650
Capabilities:
Access peb ldr_data
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100216b8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x1002f018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
xor edx, edx
mov ecx, 0x49
xor eax, eax
lea esp, [esp]
mov bl, byte [eax + 0x1002a7d4]
xor bl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x20], bl
jns 0x1001e6ad
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xc
jl 0x1001e690
mov byte [ebp - 0x14], dl
mov dword [ebp - 4], edx
mov dword [ebp - 0x2c], edx
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov ebx, dword [ebx]
mov ebx, dword [ebx]
mov ebx, dword [ebx + 0x10]
mov dword [ebp - 0x2c], ebx
mov edx, dword [ebp - 0x2c]
lea ecx, [ebp - 0x20]
push ecx
push edx
call fcn.1001e410
add esp, 8
mov dword [ebp - 0x34], eax
mov dword [ebp - 4], 0xffffffff
push dword [ebp - 0x30]
call dword [ebp - 0x34]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x1001e701
xor eax, eax
jmp 0x1001e738
push esi
push eax
call fcn.1001e410
add esp, 8
mov dword [ebp - 0x34], eax
test eax, eax
je 0x1001e6fd
test edi, edi
jle 0x1001e72f
lea eax, [ebp + 0xc]
mov ecx, edi
jmp 0x1001e720
mov edx, dword [eax + 4]
add eax, 4
mov dword [ebp - 0x30], edx
push dword [ebp - 0x30]
dec ecx
jne 0x1001e720
call dword [ebp - 0x34]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001eb32
mov esp, ebp
pop ebp
ret

Function at 0x1001eb32
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1002f018]
jne 0x1001eb3c
repz ret
jmp fcn.1001effb

Function at 0x1001f5b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x1001f621
mov ecx, dword [ebp - 4]
cmp dword [ecx + 8], 0
je 0x1001f621
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
test eax, eax
jne 0x1001f60a
jmp 0x1001f621
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
push 0x40
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x401236
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push 0x11
mov dword [ebp - 0x18], ebx
call fcn.0040621b
push 0x10
mov dword [ebp - 0x10], eax
call fcn.00403aa0
add esp, 0xc
push 0x12
mov dword [ebp - 0x20], eax
call fcn.00403aa0
pop ecx
mov esi, 0x20a
push esi
mov dword [ebp - 0x24], eax
call fcn.00408f15
pop ecx
push esi
mov dword [ebp - 4], eax
call fcn.00408f15
pop ecx
mov edi, eax
push esi
mov dword [ebp - 0x14], edi
call fcn.00408f15
pop ecx
push esi
mov dword [ebp - 8], eax
call fcn.00408f15
mov esi, eax
pop ecx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0xc], ebx
cmp edi, ebx
je 0x401419
cmp dword [ebp - 4], ebx
je 0x401419
push dword [ebp - 4]
call fcn.004059e2
pop ecx
test eax, eax
je 0x401419
cmp dword [ebp - 8], ebx
je 0x401419
push ebx
push dword [ebp - 8]
call fcn.00405a50
pop ecx
pop ecx
test eax, eax
je 0x401419
cmp esi, ebx
je 0x401419
push 1
push esi
call fcn.00405a50
pop ecx
pop ecx
test eax, eax
je 0x401419
push esi
push 0x40a208
push dword [ebp - 0x20]
push 3
push 0x104
push edi
call fcn.004058c5
add esp, 0x18
test eax, eax
je 0x401419
push ebx
push edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x4013bb
push edi
call fcn.00408f9a
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
pop ecx
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x28]
push eax
mov ebx, 0x20106
push ebx
push 0
push dword [ebp - 0x10]
push getpeername
call esi
test eax, eax
jne 0x40136a
mov eax, dword [ebp - 0x18]
push edi
push dword [ebp - 8]
lea edi, [ebp - 0x28]
call fcn.00403980
mov edi, dword [ebp - 0x14]
pop ecx
pop ecx
mov dword [ebp - 0x18], eax
jmp 0x40136e
and dword [ebp - 0x18], 0
push edi
call fcn.00408f9a
pop ecx
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x2c]
push eax
push ebx
push 0
push dword [ebp - 0x10]
push getpeername
call esi
test eax, eax
jne 0x4013a3
mov eax, dword [ebp - 0x30]
push edi
push dword [ebp - 8]
lea edi, [ebp - 0x2c]
call fcn.00403980
mov edi, dword [ebp - 0x14]
pop ecx
pop ecx
jmp 0x4013a5
xor eax, eax
xor ecx, ecx
test eax, eax
setg cl
xor eax, eax
cmp dword [ebp - 0x18], eax
setg al
or ecx, eax
mov dword [ebp - 0x18], ecx
xor ebx, ebx
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x401419
lea ecx, [ebp - 0xc]
push ecx
call fcn.004034bf
mov eax, dword [ebp - 0xc]
pop ecx
cmp eax, ebx
je 0x401419
xor esi, esi
push ebx
jmp 0x401406
push dword [ebp - 0x1c]
push 0x40a208
push eax
push 3
push 0x104
push edi
call fcn.004058c5
add esp, 0x18
test eax, eax
je 0x401401
push 1
push edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov eax, dword [ebp - 0xc]
inc esi
push esi
call fcn.00403491
pop ecx
cmp eax, ebx
jne 0x4013d8
push dword [ebp - 0xc]
call fcn.00408f75
pop ecx
push dword [ebp - 4]
call fcn.004038c7
pop ecx
push edi
call fcn.004038c7
pop ecx
push dword [ebp - 8]
call fcn.004038c7
pop ecx
push dword [ebp - 0x1c]
call fcn.004038c7
pop ecx
push dword [ebp - 0x10]
call fcn.004038c7
pop ecx
push dword [ebp - 0x20]
call fcn.004038c7
pop ecx
push dword [ebp - 0x24]
call fcn.004038c7
mov eax, dword [ebp - 0x18]
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402326
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 0x32
xor edi, edi
pop ebx
push edi
push edi
push edi
push edi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov esi, eax
cmp esi, edi
je 0x4023b1
push edi
push edi
push esi
push 0x404438
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], eax
push 1
dec ebx
call fcn.00404e67
pop ecx
test eax, eax
je 0x402375
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp ebx, edi
jne 0x40235a
jmp 0x40237c
mov dword [ebp - 4], 1
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ebx, dword [ebp - 8]
push 0xffffffffffffffff
push ebx
mov dword [ebp - 0xc], edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4023a1
lea eax, [ebp - 0xc]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
cmp ebx, edi
je 0x4023b1
push ebx
call esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4023b9
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0x14
call fcn.00408f15
pop ecx
xor ecx, ecx
cmp eax, ecx
je 0x4023f7
mov edx, dword [ebp + 0x14]
push ecx
mov dword [eax + 8], edx
mov edx, dword [ebp + 0xc]
push ecx
mov dword [eax], edx
mov edx, dword [ebp + 0x10]
push eax
push dword [ebp + 8]
mov dword [eax + 4], edx
mov edx, dword [ebp + 0x18]
mov dword [eax + 0xc], edx
mov edx, dword [ebp + 0x1c]
push ecx
push ecx
mov dword [eax + 0x10], edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x402612
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
xor edi, edi
mov esi, 0x20a
push esi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call fcn.00408f15
mov ebx, eax
push esi
mov dword [ebp - 0x14], ebx
call fcn.00408f15
mov esi, eax
pop ecx
pop ecx
mov dword [ebp - 0x18], esi
cmp esi, edi
je 0x40272d
cmp ebx, edi
je 0x40273b
push ebx
call fcn.004059f4
pop ecx
test eax, eax
je 0x40272d
push dword [ebp + 8]
push 0x40a208
push ebx
push 3
push 0x104
push esi
call fcn.004058c5
add esp, 0x18
test eax, eax
je 0x40272d
push edi
push edi
push 3
push edi
push edi
push closesocket
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40272d
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 2
push edi
push edi
push eax
call ebx
mov esi, eax
push esi
call fcn.00408f15
mov dword [ebp - 4], eax
lea eax, [esi + esi + 2]
push eax
call fcn.00408f15
pop ecx
pop ecx
mov dword [ebp - 8], eax
cmp dword [ebp - 4], edi
je 0x402724
cmp eax, edi
je 0x402724
push edi
push edi
push edi
push dword [ebp - 0xc]
call ebx
test eax, eax
jne 0x402724
push edi
lea eax, [ebp - 0x10]
push eax
push esi
push dword [ebp - 4]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x402724
cmp dword [ebp - 0x10], esi
jne 0x402724
mov ebx, dword [ebp - 8]
push esi
push ebx
push esi
push dword [ebp - 4]
push edi
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push dword [ebp + 0xc]
xor ecx, ecx
push ebx
mov word [ebx + eax*2], cx
call fcn.004023fb
pop ecx
pop ecx
mov dword [ebp - 0x1c], eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x14], edi
je 0x40273b
push dword [ebp - 0x14]
call fcn.00408f75
pop ecx
cmp dword [ebp - 0x18], edi
je 0x402749
push dword [ebp - 0x18]
call fcn.00408f75
pop ecx
cmp dword [ebp - 4], edi
je 0x402757
push dword [ebp - 4]
call fcn.00408f75
pop ecx
cmp dword [ebp - 8], edi
pop edi
pop esi
pop ebx
je 0x402768
push dword [ebp - 8]
call fcn.00408f75
pop ecx
mov eax, dword [ebp - 0x1c]
leave
ret