joyce8/EMBER2024-capa huggingface dataset:
Function at 0x603f6c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
cmp dword [ebx + 0x8c], 0
jne 0x603fe6
mov eax, dword [ebx + 8]
call fcn.0054317c
mov ecx, eax
mov dl, 1
mov eax, dword [0x551f38]
call fcn.0053d47c
mov esi, eax
mov dword [ebx + 0x8c], esi
xor edx, edx
mov eax, esi
call fcn.00558270
mov dword [esi + 0x2bc], ebx
mov dword [esi + 0x2b8], 0x60383c
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
push 0
mov eax, dword [ebx + 0x8c]
call fcn.0054317c
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x8c]
call fcn.0054317c
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x9c], 0
jne 0x60405c
mov eax, dword [ebx + 8]
call fcn.0054317c
mov ecx, eax
mov dl, 1
mov eax, dword [0x551f38]
call fcn.0053d47c
mov esi, eax
mov dword [ebx + 0x9c], esi
mov dl, 1
mov eax, esi
call fcn.00558270
mov dword [esi + 0x2bc], ebx
mov dword [esi + 0x2b8], 0x603888
push 8
push 0
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x9c]
call fcn.0054317c
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x9c]
call fcn.0054317c
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x94], 0
jne 0x6040c8
mov eax, dword [ebx + 8]
call fcn.0054317c
mov ecx, eax
mov dl, 1
mov eax, dword [0x5529b8]
call fcn.0053d47c
mov esi, eax
mov dword [ebx + 0x94], esi
mov eax, esi
mov byte [eax + 0x290], 1
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x94]
call fcn.0054317c
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x94]
call fcn.0054317c
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x63fd28
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x204], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x63fe81
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x63fe66
mov eax, ebx
test eax, eax
je 0x63fd61
sub eax, 4
mov eax, dword [eax]
jmp 0x63fd63
xor eax, eax
mov edi, eax
test ebx, ebx
je 0x63fd73
mov eax, ebx
sub eax, 0xa
movzx eax, word [eax]
jmp 0x63fd77
mov ax, 2
cmp ax, 1
jne 0x63fdf8
test ebx, ebx
je 0x63fd8b
mov eax, ebx
sub eax, 0xc
movzx eax, word [eax]
jmp 0x63fd93
mov eax, dword [0x717144]
movzx eax, word [eax]
push edi
push 0
push 0
movzx eax, ax
mov ecx, ebx
xor edx, edx
call fcn.0040df20
mov edi, eax
cmp edi, 0x100
jle 0x63fdbb
mov eax, edi
add eax, eax
call fcn.00406c64
mov esi, eax
jmp 0x63fdc1
lea esi, [ebp - 0x200]
test ebx, ebx
je 0x63fdcf
mov eax, ebx
sub eax, 0xc
movzx edx, word [eax]
jmp 0x63fdd8
mov edx, dword [0x717144]
movzx edx, word [edx]
mov eax, ebx
test eax, eax
je 0x63fde5
sub eax, 4
mov eax, dword [eax]
jmp 0x63fde7
xor eax, eax
push eax
push esi
push edi
movzx eax, dx
mov ecx, ebx
xor edx, edx
call fcn.0040df20
jmp 0x63fe31
cmp edi, 0x100
jle 0x63fe0d
mov eax, edi
add eax, eax
call fcn.00406c64
mov esi, eax
jmp 0x63fe13
lea esi, [ebp - 0x200]
lea edx, [ebp - 0x204]
mov eax, ebx
call fcn.00422c68
mov eax, dword [ebp - 0x204]
mov ecx, edi
add ecx, ecx
mov edx, esi
call fcn.00406ea4
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x63fe53
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x63fe3d
lea eax, [ebp - 0x200]
cmp esi, eax
je 0x63fe68
mov eax, esi
call fcn.00406c80
jmp 0x63fe68
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63fe88
lea eax, [ebp - 0x204]
call fcn.00409c10
ret

Function at 0x6664c0
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffeec
mov dword [esp], 0x114
push esp
call sub.kernel32.dll_GetVersionExW
cmp dword [esp + 0x10], 2
jne 0x6664e5
cmp dword [esp + 4], 5
jb 0x6664e5
mov al, 1
jmp 0x6664e7
xor eax, eax
add esp, 0x114
ret

Function at 0x685984
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo_1
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x6859d5
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x6859bc
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x6859ac
jmp 0x6859d5
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x6859bd
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x69842c
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf0
mov ebx, ecx
push esp
push edx
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListW
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.0040a9d0
add esp, 0x210
pop ebx
ret

Function at 0x6985fc
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
xor ecx, ecx
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x58], ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x6987a7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edx
cmp dword [eax + 0xc], 0
jne 0x6986d2
mov edx, 0x6987c0
mov eax, dword [ebx + 0x3f8]
call fcn.00539f10
mov eax, dword [ebx + 0x3f8]
call fcn.0053a564
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x44
call fcn.00407764
mov dword [ebp - 0x44], 0x44
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x44]
push eax
push 0
push 0
push 0x20
push 0xffffffffffffffff
push 0
push 0
lea eax, [ebp - 0x58]
mov ecx, 0x6987ec
mov edx, dword [ebx + 0x414]
call fcn.0040ab80
mov eax, dword [ebp - 0x58]
call fcn.0040a914
push eax
push 0
call sub.kernel32.dll_CreateProcessW
push 0xffffffffffffffff
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_WaitForSingleObject
push 0
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_TerminateProcess
mov edx, 0x698850
mov eax, dword [ebx + 0x3f8]
call fcn.00539f10
mov eax, dword [ebx + 0x3f8]
call fcn.0053a564
mov edx, dword [ebx + 0x3d4]
mov eax, ebx
call fcn.00698a14
jmp 0x69878c
cmp dword [eax + 0xc], 1
jne 0x69878c
mov edx, 0x69887c
mov eax, dword [ebx + 0x3f8]
call fcn.00539f10
mov eax, dword [ebx + 0x3f8]
call fcn.0053a564
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x44
call fcn.00407764
mov dword [ebp - 0x44], 0x44
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x44]
push eax
push 0
push 0
push 0x20
push 0xffffffffffffffff
push 0
push 0
push dword [ebx + 0x414]
push 0x6988c8
push 0x698934
lea eax, [ebp - 0x5c]
mov edx, 3
call fcn.0040ac08
mov eax, dword [ebp - 0x5c]
call fcn.0040a914
push eax
push 0
call sub.kernel32.dll_CreateProcessW
push 0xffffffffffffffff
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_WaitForSingleObject
push 0
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_TerminateProcess
mov edx, 0x6989d4
mov eax, dword [ebx + 0x3f8]
call fcn.00539f10
mov eax, dword [ebx + 0x3f8]
call fcn.0053a564
mov edx, dword [ebx + 0x3d4]
mov eax, ebx
call fcn.00698a14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6987ae
lea eax, [ebp - 0x5c]
mov edx, 2
call fcn.00409c70
ret
Function at 0x6f06a0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x6f06ce
mov eax, ebx
call fcn.006f115c
cmp dword [ebx + 0x40], 0
je 0x6f06c7
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x6f073f
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x6f0731
cmp dword [ebx + 8], 0
je 0x6f06f0
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x6f0702
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x6f0731
cmp dword [ebx + 8], 0
je 0x6f06e3
cmp eax, 3
je 0x6f0715
dec eax
jne 0x6f06e3
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x6f06e3
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x6f06e3
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x6f075d
cmp dword [ebx + 0x14], 0xcc
je 0x6f075d
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.006f0768
pop ebx
ret

Function at 0x700edc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
mov ebx, edx
lea edx, [ebp - 4]
push edx
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x20e]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListW
mov eax, ebx
lea edx, [ebp - 0x20e]
mov ecx, 0x105
call fcn.0040a9d0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x117fb6c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x118b520]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.01176e52
and dword [ebp - 0x14], 0
cmp dword [0x11cd558], 0
mov dword [ebp - 0x18], eax
jne 0x117fc1f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x117fcc7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x117fcc7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x11cd558], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x11cd55c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x11cd560], eax
call edi
push eax
call esi
mov dword [0x11cd568], eax
test eax, eax
je 0x117fc1f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x11cd564], eax
mov eax, dword [0x11cd564]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x117fc78
cmp dword [0x11cd568], ecx
je 0x117fc78
push eax
call esi
push dword [0x11cd568]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x117fc78
test ebx, ebx
je 0x117fc78
call edi
test eax, eax
je 0x117fc6f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x117fc6f
test byte [ebp - 8], 1
jne 0x117fc78
or dword [ebp + 0x10], 0x200000
jmp 0x117fcab
mov eax, dword [0x11cd55c]
cmp eax, dword [ebp - 0x18]
je 0x117fcab
push eax
call esi
test eax, eax
je 0x117fcab
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x117fcab
mov eax, dword [0x11cd560]
cmp eax, dword [ebp - 0x18]
je 0x117fcab
push eax
call esi
test eax, eax
je 0x117fcab
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x11cd558]
call esi
test eax, eax
je 0x117fcc7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x117fcc9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.011713cb
leave
ret

Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..3ean
nop
nop
mov ebx, 0x40915c
mov ecx, 0x2e863246
nop
nop
nop
test eax, eax
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x431024
nop
nop
nop
nop
mov eax, section..7LWLf
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x1d2e25bc
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x431084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x100013d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [0x1004ec68], 0x10023598
mov dword [0x1004ec6c], 0x100235b0
cmp dword [ebp + 0xc], 2
je 0x10001409
cmp dword [ebp + 0xc], 3
je 0x10001409
mov eax, dword [ebp + 0xc]
push eax
push str.Loaded_into_the_process._Reason_d._n
push 2
call fcn.100017c0
add esp, 0xc
call fcn.100064e0
test eax, eax
je 0x1000141c
mov eax, 1
jmp 0x100015ed
cmp dword [ebp + 0xc], 1
jne 0x10001586
push str._getStringForKey_UserDefault_cocos2d__QAE_AV__basic_string_DU__char_traits_D_std__V__allocator_D_2__std__PBD_Z
push str.libcocos2d.dll
call fcn.10005f70
mov dword [0x1002e1cc], eax
push str.luaL_loadbuffer
push str.lua51.dll
call fcn.10005f70
mov dword [0x1002e1d0], eax
cmp dword [0x1002e1d0], 0
jne 0x10001468
push str.XxteaDecrypt_function_not_found_n
push 4
call fcn.100017c0
add esp, 8
jmp 0x100014b2
mov ecx, dword [0x1002e1d0]
push ecx
push str.XxteaDecrypt_address__x_n
push 2
call fcn.100017c0
add esp, 0xc
call fcn.10005190
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.10005670
push 0x10001170
push 0x1002e1d0
call fcn.10004a30
call fcn.100051f0
push str.HookXxtea_installed_n
push 2
call fcn.100017c0
add esp, 8
cmp dword [0x1002e1cc], 0
jne 0x100014cc
push str.setStringForKey_function_not_found_n
push 4
call fcn.100017c0
add esp, 8
jmp 0x10001516
mov edx, dword [0x1002e1cc]
push edx
push str.setStringForKey_address__x_n
push 2
call fcn.100017c0
add esp, 0xc
call fcn.10005190
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.10005670
push 0x100010b0
push 0x1002e1cc
call fcn.10004a30
call fcn.100051f0
push str.HookGetStringForKey_installed_n
push 2
call fcn.100017c0
add esp, 8
mov eax, dword [sym.imp.USER32.dll_GetActiveWindow]
mov dword [0x1002e1c8], eax
cmp dword [0x1002e1c8], 0
je 0x10001564
mov ecx, dword [0x1002e1c8]
push ecx
push str.CocosFunction1_address__x_n
push 2
call fcn.100017c0
add esp, 0xc
call fcn.10005190
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.10005670
push section..text
push 0x1002e1c8
call fcn.10004a30
call fcn.100051f0
mov dword [ebp - 4], 1
lea edx, [ebp - 8]
push edx
push 0
lea eax, [ebp - 4]
push eax
push 0x10001070
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x100015e8
cmp dword [ebp + 0xc], 0
jne 0x100015e8
cmp dword [0x1002e1d0], 0
jne 0x100015ba
call fcn.10005190
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.10005670
push 0x10001170
push 0x1002e1d0
call fcn.10004ea0
call fcn.100051f0
cmp dword [0x1002e1cc], 0
jne 0x100015e8
call fcn.10005190
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.10005670
push 0x100010b0
push 0x1002e1cc
call fcn.10004ea0
call fcn.100051f0
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10001600
Capabilities:
Check mutex on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x1004ec64], 0
jne 0x10001620
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x1004ec64], eax
push 0xffffffffffffffff
mov eax, dword [0x1004ec64]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebp + 0xc], 0x40000
jle 0x1000164f
mov ecx, dword [ebp + 0xc]
push ecx
push str.Max_amount_of_data_to_send_to_hand2note_is_256kb_but_was__d_bytes
push 4
call fcn.100017c0
add esp, 0xc
jmp 0x100017b6
push 0xffffffffffffffff
mov edx, dword [0x1004ec6c]
push edx
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
mov dword [ebp - 4], 0
mov eax, 1
test eax, eax
je 0x1000170d
push 0
push 0
push 3
push 0
push 1
push 0x40000000
mov ecx, dword [0x1004ec6c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x10001699
jmp 0x1000170d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe7
je 0x100016d1
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_create_pipe_file_n._error_d__dataLength_d
push 4
call fcn.100017c0
add esp, 0x10
mov eax, dword [0x1004ec64]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x100017b6
push 0x1388
mov ecx, dword [0x1004ec6c]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
test eax, eax
jne 0x10001708
push str.Could_not_open_pipe:_5_second_wait_timed_out.
push 4
call fcn.100017c0
add esp, 8
mov edx, dword [0x1004ec64]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x100017b6
jmp 0x10001665
mov eax, dword [ebp + 0xc]
add eax, 4
push eax
call fcn.1000b908
add esp, 4
mov dword [ebp - 8], eax
lea ecx, [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.10001960
add esp, 8
push 4
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.10007f40
add esp, 0xc
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
add eax, 4
push eax
call fcn.10007f40
add esp, 0xc
push 0
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 0xc]
add edx, 4
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10001789
push str.Failed_to_write_into_pipe_n
push 4
call fcn.100017c0
add esp, 8
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
push ecx
call fcn.1000b7e6
add esp, 4
mov edx, dword [0x1004ec64]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov esp, ebp
pop ebp
ret
Function at 0x100017c0
Capabilities:
Check mutex on windows
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.10007190
mov eax, dword [0x1002d8c4]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x1000
push 0
lea eax, [ebp - 0x1004]
push eax
call fcn.100084c0
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
call fcn.100019d0
add esp, 4
push eax
lea edx, [ebp - 0x1004]
push edx
call fcn.1000b810
add esp, 8
lea eax, [ebp + 0x10]
mov dword [ebp - 0x100c], eax
mov ecx, dword [ebp - 0x100c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x1004]
push eax
call fcn.1000b750
add esp, 4
lea ecx, [ebp + eax - 0x1004]
push ecx
call fcn.10001af0
add esp, 0xc
mov dword [ebp - 0x100c], 0
cmp dword [0x1004ec60], 0
jne 0x10001860
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x1004ec60], eax
push 0xffffffffffffffff
mov edx, dword [0x1004ec60]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0xffffffffffffffff
mov ecx, dword [0x1004ec68]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
push 0
push 0
push 3
push 0
push 1
push 0x40000000
mov edx, dword [0x1004ec68]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x1008], eax
cmp dword [ebp - 0x1008], 0xffffffff
jne 0x100018d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_create_log_pipe_file._Error___lu__n
call fcn.10001a10
add esp, 8
mov eax, dword [0x1004ec60]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x10001944
push 0
lea ecx, [ebp - 0x1010]
push ecx
lea edx, [ebp - 0x1004]
push edx
call fcn.1000b750
add esp, 4
push eax
lea eax, [ebp - 0x1004]
push eax
mov ecx, dword [ebp - 0x1008]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1000191d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_write_into_log_pipe._Error___lu_n
call fcn.10001a10
add esp, 8
mov edx, dword [ebp - 0x1008]
push edx
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov eax, dword [ebp - 0x1008]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x1004ec60]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10007180
mov esp, ebp
pop ebp
ret

Function at 0x10001a10
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.10007190
mov eax, dword [0x1002d8c4]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x1000
push 0
lea eax, [ebp - 0x1004]
push eax
call fcn.100084c0
add esp, 0xc
lea ecx, [ebp + 0xc]
mov dword [ebp - 0x1008], ecx
mov edx, dword [ebp - 0x1008]
push edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x1004]
push ecx
call fcn.10001af0
add esp, 0xc
mov dword [ebp - 0x1008], 0
lea edx, [ebp - 0x1004]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10007180
mov esp, ebp
pop ebp
ret
Function at 0x100022f0
Capabilities:
Connect socket
Initialize winsock library
Resolve dns
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a4
mov eax, dword [0x1002d8c4]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x298]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 0
je 0x10002329
jmp 0x10002497
mov dword [ebp - 0x2a0], 0
lea ecx, [ebp - 0x2a0]
push ecx
push 0
push str.1500
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 0
je 0x1000235f
jmp 0x10002497
mov eax, dword [ebp - 0x2a0]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp - 0x2a0]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0x2a0]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 0xffffffff
jne 0x10002397
jmp 0x10002497
mov eax, dword [ebp - 0x2a0]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 0x2a0]
mov eax, dword [edx + 0x18]
push eax
mov ecx, dword [ebp - 0x2a4]
push ecx
call dword [sym.imp.WS2_32.dll_connect]
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 0
je 0x100023cc
jmp 0x10002497
push 0x104
push 0
lea edx, [ebp - 0x108]
push edx
call fcn.100084c0
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push str.GET__s__HTTP_1.1_nHost:__s_n_n
lea edx, [ebp - 0x108]
push edx
call fcn.10002f40
add esp, 0x10
push 0
lea eax, [ebp - 0x108]
push eax
call fcn.1000b750
add esp, 4
push eax
lea ecx, [ebp - 0x108]
push ecx
mov edx, dword [ebp - 0x2a4]
push edx
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 0xffffffff
jne 0x10002435
jmp 0x10002497
push 1
mov eax, dword [ebp - 0x2a4]
push eax
call dword [sym.imp.WS2_32.dll_shutdown]
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 0xffffffff
jne 0x10002455
jmp 0x10002497
mov ecx, dword [ebp - 0x2a4]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 0xffffffff
jne 0x10002473
jmp 0x10002497
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 0xffffffff
jne 0x1000248a
jmp 0x10002497
mov edx, dword [ebp - 0x2a0]
push edx
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10007180
mov esp, ebp
pop ebp
ret