joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100261e0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, ecx
push esi
push edi
lea esi, [ebp + 4]
mov ecx, 8
xor eax, eax
mov edi, esi
mov dword [ebp], 0
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x10]
push eax
push 0x1004eef8
push esi
call dword [sym.imp.MSVCRT.dll_sprintf]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x10026250
mov edx, esi
mov ecx, 0x1505
mov al, byte [edx]
inc edx
test eax, eax
je 0x1002623c
mov esi, ecx
shl esi, 5
add eax, esi
add ecx, eax
xor eax, eax
mov al, byte [edx]
inc edx
test eax, eax
jne 0x1002622a
mov dword [ebp], ecx
mov ecx, dword [0x1004edf0]
pop edi
mov dword [ebp + 0x24], ecx
mov eax, ebp
pop esi
pop ebp
ret 4
mov edx, dword [0x1004edf0]
pop edi
mov dword [ebp + 0x24], edx
mov eax, ebp
pop esi
pop ebp
ret 4
Function at 0x1002a1a0
Capabilities:
Get mac address on windows

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
mov esi, dword [sym.imp.MSVCRT.dll_malloc]
push 0x280
mov byte [esp + 0x13], 0
mov dword [ebp], 0
call esi
add esp, 4
mov ebx, eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x10], ebx
push eax
push ebx
mov dword [esp + 0x24], 0x280
call sub.iphlpapi.dll_GetAdaptersInfo
cmp eax, 0x6f
jne 0x1002a208
push ebx
call dword [sym.imp.MSVCRT.dll_free]
mov ecx, dword [esp + 0x20]
push ecx
call esi
mov ebx, eax
add esp, 8
test ebx, ebx
mov dword [esp + 0x10], ebx
jne 0x1002a208
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0xc
ret
lea edx, [esp + 0x1c]
push edi
push edx
push ebx
call sub.iphlpapi.dll_GetAdaptersInfo
test eax, eax
jne 0x1002a345
test ebx, ebx
mov edi, ebx
je 0x1002a353
cmp dword [edi + 0x190], 6
jne 0x1002a33b
mov eax, dword [esp + 0x24]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov ecx, eax
test ecx, ecx
mov dword [esp + 0x18], ecx
je 0x1002a33b
lea eax, [edi + 0x1ac]
test eax, eax
je 0x1002a33b
jmp 0x1002a260
mov ecx, dword [esp + 0x18]
lea esi, [eax + 4]
mov bl, byte [ecx]
mov dl, bl
cmp bl, byte [esi]
jne 0x1002a287
test dl, dl
je 0x1002a283
mov bl, byte [ecx + 1]
mov dl, bl
cmp bl, byte [esi + 1]
jne 0x1002a287
add ecx, 2
add esi, 2
test dl, dl
jne 0x1002a263
xor ecx, ecx
jmp 0x1002a28c
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
je 0x1002a29b
mov eax, dword [eax]
test eax, eax
jne 0x1002a25c
jmp 0x1002a337
xor ecx, ecx
xor edx, edx
mov cl, byte [edi + 0x199]
mov dl, byte [edi + 0x198]
xor eax, eax
push ecx
mov al, byte [edi + 0x197]
push edx
xor ecx, ecx
push eax
mov cl, byte [edi + 0x196]
xor edx, edx
mov dl, byte [edi + 0x195]
xor eax, eax
mov al, byte [edi + 0x194]
push ecx
push edx
push eax
lea ecx, [ebp + 4]
push 0x1004ef1c
push ecx
mov byte [esp + 0x33], 1
call dword [sym.imp.MSVCRT.dll_sprintf]
mov dl, byte [edi + 0x194]
add esp, 0x20
mov byte [ebp + 0x84], dl
mov al, byte [edi + 0x195]
mov byte [ebp + 0x85], al
mov cl, byte [edi + 0x196]
mov byte [ebp + 0x86], cl
mov dl, byte [edi + 0x197]
mov byte [ebp + 0x87], dl
mov al, byte [edi + 0x198]
mov byte [ebp + 0x88], al
mov cl, byte [edi + 0x199]
mov byte [ebp + 0x89], cl
mov dword [ebp], 1
mov ebx, dword [esp + 0x14]
mov edi, dword [edi]
test edi, edi
jne 0x1002a226
test ebx, ebx
je 0x1002a353
push ebx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x1002aaa0
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
xor al, al
ret

Function at 0x1002ac70
Capabilities:
Check os version
Get system information on windows

Disassembly:
mov al, byte [0x1005c44a]
sub esp, 0xc4
test al, al
push esi
jne 0x1002aeb8
push edi
mov ecx, 0x26
xor eax, eax
lea edi, [esp + 0x34]
mov dword [esp + 0x30], 0
mov dword [esp + 0xc], eax
rep stosd dword es:[edi], eax
mov ecx, 8
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
push eax
mov dword [0x1005c464], eax
call fcn.10036900
xor eax, eax
add esp, 4
xor esi, esi
cmp eax, 0x1004f1c8
je 0x1002ace0
mov edi, 0x1004f1c8
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x1002ace0
push 0x1004f1c8
call fcn.10036790
add esp, 4
mov esi, eax
push 0x1004f1d8
push esi
call fcn.100368e0
push esi
mov edi, eax
call fcn.10036900
add esp, 0xc
test edi, edi
je 0x1002ad03
lea ecx, [esp + 0xc]
push ecx
call edi
jmp 0x1002ad0e
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea eax, [esp + 0x30]
mov dword [esp + 0x30], 0x9c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
pop edi
je 0x1002ae91
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
and edx, 0xffff
cmp ecx, 5
mov dword [0x1005c454], ecx
mov dword [0x1005c458], eax
mov dword [0x1005c460], edx
jne 0x1002ae1b
test eax, eax
jne 0x1002ad73
mov dword [0x1005c450], 1
mov byte [0x1005c44a], 1
pop esi
add esp, 0xc4
ret
cmp eax, 1
jne 0x1002ad8f
mov dword [0x1005c450], 2
mov byte [0x1005c44a], al
pop esi
add esp, 0xc4
ret
cmp eax, 2
jne 0x1002aeb8
cmp byte [esp + 0xc6], 1
jne 0x1002adc3
cmp word [esp + 8], 9
jne 0x1002adc3
mov dword [0x1005c450], 3
mov byte [0x1005c44a], 1
pop esi
add esp, 0xc4
ret
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x59
call esi
test eax, eax
je 0x1002ae02
cmp word [esp + 0xc4], 0x8000
je 0x1002ae02
push 0x59
call esi
test eax, eax
je 0x1002aeb8
mov dword [0x1005c450], 5
mov byte [0x1005c44a], 1
pop esi
add esp, 0xc4
ret
mov dword [0x1005c450], 4
mov byte [0x1005c44a], 1
pop esi
add esp, 0xc4
ret
cmp ecx, 6
jne 0x1002aeb8
test eax, eax
jne 0x1002ae4b
mov dl, byte [esp + 0xc6]
mov byte [0x1005c44a], 1
cmp dl, 1
pop esi
setne al
add eax, ecx
mov dword [0x1005c450], eax
add esp, 0xc4
ret
cmp eax, 1
jne 0x1002ae73
mov cl, byte [esp + 0xc6]
mov byte [0x1005c44a], al
dec cl
pop esi
neg cl
sbb ecx, ecx
add ecx, 9
mov dword [0x1005c450], ecx
add esp, 0xc4
ret
cmp eax, 2
jne 0x1002aeb8
mov dword [0x1005c450], 0xa
mov byte [0x1005c44a], 1
pop esi
add esp, 0xc4
ret
push 0
call fcn.10024ef0
add esp, 4
lea ecx, [esp + 4]
push eax
push str._comm__detect_OS_type_failed:__s
push 0x1004f1ec
call fcn.10024c50
push eax
call fcn.10024c60
add esp, 0xc
mov byte [0x1005c44a], 1
pop esi
add esp, 0xc4
ret
Function at 0x1002afb0
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, dword [esp + 0xc]
mov edx, ecx
push edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [edx + 4]
push esi
push 1
push eax
mov eax, dword [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
ret 8

Function at 0x1002b060
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
lea eax, [esp + 4]
lea edx, [esp]
push eax
lea eax, [esp + 0x10]
push edx
mov edx, dword [esp + 0x14]
push eax
mov eax, dword [ecx + 4]
push 0
push edx
push eax
mov dword [esp + 0x1c], 4
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1002b0a1
mov ecx, dword [esp + 0x10]
mov edx, dword [esp]
mov dword [ecx], edx
add esp, 8
ret 8
Function at 0x1002bd30
Capabilities:
Create directory

Disassembly:
sub esp, 0x118
push ebx
mov ebx, dword [esp + 0x120]
push ebp
xor ebp, ebp
mov eax, dword [ebx + 4]
push esi
cmp eax, ebp
jne 0x1002bd4e
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
mov esi, dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
push eax
call esi
test eax, eax
jne 0x1002be54
push edi
mov ecx, 0x40
lea edi, [esp + 0x25]
mov byte [esp + 0x24], al
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebx + 4]
cmp eax, ebp
jne 0x1002bd7e
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
push eax
lea eax, [esp + 0x28]
push 0x1004f2f4
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
test eax, eax
je 0x1002be3e
lea edx, [esp + 0x24]
push edx
call esi
test eax, eax
jne 0x1002be3e
mov al, byte [esp + 0x13]
lea edi, [esp + 0x24]
mov byte [esp + 0x14], al
or ecx, 0xffffffff
xor eax, eax
mov dword [esp + 0x18], ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov ebp, ecx
push 1
push ebp
lea ecx, [esp + 0x1c]
call dword [sym.imp.MSVCP60.dll_private:_bool___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Grow_unsigned_int__bool_]
test al, al
je 0x1002be0d
mov edi, dword [esp + 0x18]
mov ecx, ebp
mov edx, ecx
lea esi, [esp + 0x24]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x1c], ebp
mov byte [eax + ebp], 0
lea ecx, [esp + 0x14]
push ecx
call fcn.1002bd30
mov ecx, dword [esp + 0x1c]
add esp, 4
test ecx, ecx
je 0x1002be3e
mov al, byte [ecx - 1]
test al, al
je 0x1002be34
cmp al, 0xff
je 0x1002be34
dec al
mov byte [ecx - 1], al
jmp 0x1002be3e
dec ecx
push ecx
call fcn.100463e2
add esp, 4
mov eax, dword [ebx + 4]
pop edi
test eax, eax
jne 0x1002be4b
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
pop esi
pop ebp
pop ebx
add esp, 0x118
ret

Function at 0x1002c020
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
test eax, eax
je 0x1002c03d
push str.Wow64Redirection::restore_____
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [esp + 8]
push eax
call dword [esi + 0xc]
pop esi
ret 4
Function at 0x1002c530
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x1002c557
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1002c54d
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
ret
and al, 0xfe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
pop esi
ret

Function at 0x1002c560
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x90
push ebx
push esi
push edi
xor ebx, ebx
mov ecx, 0x21
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [esp + 0xa0]
lea eax, [esp + 0x14]
push 0x1001
push eax
push edi
call dword [sym.imp.KERNEL32.dll_OpenFile]
mov esi, eax
push ebx
cmp esi, ebx
jne 0x1002c5d0
call fcn.10024ef0
add esp, 4
lea ecx, [esp + 0xc]
push eax
push edi
push str._comm__write_file__s__OpenFile_failed:__s
push 0x1004f41c
call fcn.10024c50
push eax
call fcn.10024c60
add esp, 0x10
mov al, bl
pop edi
pop esi
pop ebx
add esp, 0x90
ret
mov edx, dword [esp + 0xac]
mov eax, dword [esp + 0xa8]
lea ecx, [esp + 0x14]
push ecx
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1002c62a
push ebx
call fcn.10024ef0
add esp, 4
lea ecx, [esp + 0xc]
push eax
push edi
push str._comm__write_file__s__WriteFile_failed:__s
push 0x1004f450
call fcn.10024c50
push eax
call fcn.10024c60
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov al, bl
pop esi
pop ebx
add esp, 0x90
ret
push esi
mov bl, 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov al, bl
pop esi
pop ebx
add esp, 0x90
ret

Function at 0x1002c640
Capabilities:
Delete file

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push esi
call fcn.1002c530
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp eax, 1
sete bl
test bl, bl
jne 0x1002c688
push 0
call fcn.10024ef0
add esp, 4
lea ecx, [esp + 0xc]
push eax
push esi
push str._comm__del__s__failed:__s
push 0x1004f488
call fcn.10024c50
push eax
call fcn.10024c60
add esp, 0x10
mov al, bl
pop esi
pop ebx
ret

Function at 0x1002c690
Capabilities:
Copy file

Disassembly:
mov dl, byte [esp + 0xc]
mov ecx, dword [esp + 8]
xor eax, eax
test dl, dl
mov edx, dword [esp + 4]
sete al
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
cmp eax, 1
sete al
ret

Function at 0x1002ccd0
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [ecx + 0x134]
xor eax, eax
test ecx, ecx
je 0x1002ccf2
mov eax, dword [esp + 8]
push ecx
mov ecx, dword [esp + 8]
push eax
push 1
push ecx
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
ret 8

Function at 0x1002cd00
Capabilities:
Read file on windows

Disassembly:
mov ecx, dword [ecx + 0x134]
xor eax, eax
test ecx, ecx
je 0x1002cd22
mov eax, dword [esp + 8]
push ecx
mov ecx, dword [esp + 8]
push eax
push 1
push ecx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
ret 8
Function at 0x1002cf80
Capabilities:
Copy file
Delete file
Print debug messages
Write file on windows

Disassembly:
mov eax, 0x1114
call fcn.100465c0
mov eax, dword [0x1004f710]
push ebp
push esi
mov esi, dword [esp + 0x1120]
cmp esi, eax
push edi
jb 0x1002d179
mov eax, dword [esp + 0x1128]
test eax, eax
je 0x1002d179
mov ecx, 0x200
xor eax, eax
lea edi, [esp + 0x20]
cmp esi, 8
rep stosd dword es:[edi], eax
mov ecx, 0x240
lea edi, [esp + 0x820]
rep stosd dword es:[edi], eax
jbe 0x1002cfd2
xor esi, esi
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x1a]
mov eax, dword [esp + 0x18]
push str.GWCLI
shl esi, 4
add esi, 0x1004f718
and ecx, 0xffff
push esi
and edx, 0xffff
push ecx
mov ecx, dword [esp + 0x22]
push edx
mov edx, dword [esp + 0x22]
and eax, 0xffff
and ecx, 0xffff
push eax
and edx, 0xffff
push ecx
push edx
push str.__02d__02d__02d:_02d:_02d___s___s_
lea eax, [esp + 0x40]
push 0x800
push eax
call fcn.1002d190
mov edx, dword [esp + 0x1150]
lea ecx, [esp + 0x1154]
push ecx
push edx
lea eax, [esp + 0x850]
push 0x800
push eax
call dword [sym.imp.MSVCRT.dll__vsnprintf]
mov esi, dword [sym.imp.MSVCRT.dll_strncat]
lea ecx, [esp + 0x858]
push 0x7ff
lea edx, [esp + 0x5c]
push ecx
push edx
call esi
add esp, 0x44
lea eax, [esp + 0x20]
mov byte [esp + 0x81f], 0
push 0x1004f818
push eax
call dword [sym.imp.SHLWAPI.dll_StrTrimA]
push 0x7ff
lea ecx, [esp + 0x24]
push 0x1004f81c
push ecx
call esi
mov al, byte [0x1004f714]
add esp, 0xc
test al, 1
mov byte [esp + 0x81f], 0
je 0x1002d0be
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test byte [0x1004f714], 2
je 0x1002d179
xor ebp, ebp
push ebp
push 0x80
push 4
push ebp
push ebp
push 0x40000000
push str.c:gwlog.txt
mov dword [esp + 0x28], ebp
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x1002d179
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 2
push ebp
push ebp
push esi
call edi
cmp eax, 0x400000
jbe 0x1002d10f
mov ebp, 1
push 2
push 0
push 0
push esi
call edi
cmp eax, 0x500000
jbe 0x1002d12f
push 0
push 0
push 0
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
lea eax, [esp + 0xc]
push 0
push eax
lea edi, [esp + 0x28]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, ebp
je 0x1002d179
push 0
push str.c:gwlogbk.txt
push str.c:gwlog.txt
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push str.c:gwlog.txt
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
pop ebp
add esp, 0x1114
ret
Function at 0x10033d80
Capabilities:
Get common file path

Disassembly:
sub esp, 0x22c
mov eax, dword [0x10065114]
mov dword [esp], str.getaddrinfo
test eax, eax
mov dword [esp + 4], 0x10031590
mov dword [esp + 8], str.getnameinfo
mov dword [esp + 0xc], 0x10031cd0
mov dword [esp + 0x10], str.freeaddrinfo
mov dword [esp + 0x14], 0x10031540
je 0x10033ddb
mov eax, dword [esp + 0x230]
and eax, 0xffff
mov eax, dword [eax*8 + 0x1005093c]
add esp, 0x22c
ret 4
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x134]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x10033f24
lea edi, [esp + 0x134]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x28]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x28]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.ws2_32
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
and ecx, 3
lea eax, [esp + 0x28]
rep movsb byte es:[edi], byte [esi]
push eax
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x10033e7c
push str.getaddrinfo
push esi
call ebp
test eax, eax
jne 0x10033ef4
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea edi, [esp + 0x134]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x28]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x28]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.wship6
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x28]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call ebx
mov esi, eax
test esi, esi
je 0x10033f24
push str.getaddrinfo
push esi
call ebp
test eax, eax
jne 0x10033ef4
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x10033f24
xor ebx, ebx
lea edi, [esp + 0x14]
mov ecx, dword [edi - 4]
push ecx
push esi
call ebp
test eax, eax
mov dword [edi], eax
je 0x10033eeb
inc ebx
add edi, 8
cmp ebx, 3
jl 0x10033efa
xor eax, eax
mov edx, dword [esp + eax + 0x14]
mov dword [eax + 0x1005093c], edx
add eax, 8
cmp eax, 0x18
jl 0x10033f12
mov eax, dword [esp + 0x240]
pop edi
and eax, 0xffff
pop esi
pop ebp
mov dword [0x10065114], 1
mov eax, dword [eax*8 + 0x1005093c]
pop ebx
add esp, 0x22c
ret 4
Function at 0x10034210
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x128
push ebx
push esi
push 0
push 0xa
xor bl, bl
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x10034292
push ebp
lea eax, [esp + 0xc]
push edi
push eax
push esi
mov dword [esp + 0x18], 0x128
call sub.KERNEL32.dll_Process32First
cmp eax, 1
jne 0x1003427e
mov edi, dword [esp + 0x140]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea ecx, [esp + 0x34]
push ecx
push edi
call ebp
test eax, eax
je 0x1003426f
lea edx, [esp + 0x10]
push edx
push esi
call sub.KERNEL32.dll_Process32Next
cmp eax, 1
jne 0x1003427e
jmp 0x10034251
mov eax, dword [esp + 0x13c]
mov ecx, dword [esp + 0x18]
mov bl, 1
mov dword [eax], ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebp
mov al, bl
pop esi
pop ebx
add esp, 0x128
ret
mov al, bl
pop esi
pop ebx
add esp, 0x128
ret
Function at 0x10034aa0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0xc80
push ebx
push esi
push edi
xor ebx, ebx
mov ecx, 0x1f
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x8d]
mov byte [esp + 0x8c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x48d]
mov byte [esp + 0x48c], bl
rep stosd dword es:[edi], eax
mov esi, dword [esp + 0xc98]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [sym.imp.MSVCRT.dll_sprintf]
push esi
lea eax, [esp + 0x10]
push str.___s__
push eax
call edi
add esp, 0xc
lea ecx, [esp + 0x8c]
lea edx, [esp + 0xc]
push 0x400
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [esp + 0x8c]
lea ecx, [esp + 0x48c]
push eax
push esi
push 0x10050bf4
push ecx
call edi
mov esi, dword [esp + 0xca0]
mov eax, dword [esp + 0xca4]
add esp, 0x10
mov byte [esi + eax], bl
inc eax
xor ecx, ecx
mov dl, byte [esp + ecx + 0x48c]
cmp dl, bl
je 0x10034b6f
mov byte [eax + esi], dl
inc eax
inc ecx
cmp ecx, 0x800
jl 0x10034b57
mov byte [eax + esi + 1], bl
mov byte [eax + esi + 2], bl
pop edi
pop esi
pop ebx
add esp, 0xc80
ret
Function at 0x100351a0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x128
push ebx
push esi
push 0
push 0xa
xor bl, bl
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x10035205
lea eax, [esp + 8]
push edi
push eax
push esi
mov dword [esp + 0x14], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x100351f2
mov edi, dword [esp + 0x138]
cmp dword [esp + 0x14], edi
je 0x100351f0
lea ecx, [esp + 0xc]
push ecx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x100351f2
jmp 0x100351d9
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov al, bl
pop esi
pop ebx
add esp, 0x128
ret
mov al, bl
pop esi
pop ebx
add esp, 0x128
ret

Function at 0x10035210
Capabilities:
Check os version
Get system information on windows

Disassembly:
sub esp, 0xc0
push ebx
push esi
lea eax, [esp + 0xa4]
push edi
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, 0x26
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x9c
push ecx
call esi
test eax, eax
jne 0x1003526a
lea edx, [esp + 0xc]
mov dword [esp + 0xc], 0x94
push edx
call esi
pop edi
pop esi
xor al, al
pop ebx
add esp, 0xc0
ret
cmp dword [esp + 0x10], 6
jne 0x1003527c
mov eax, dword [esp + 0x14]
cmp eax, 2
mov al, 1
je 0x1003527e
mov al, bl
pop edi
pop esi
pop ebx
add esp, 0xc0
ret
Function at 0x10035290
Capabilities:
Enumerate processes
Terminate process

Disassembly:
sub esp, 0x530
push ebp
mov ebp, dword [esp + 0x538]
test ebp, ebp
mov byte [esp + 7], 0
jne 0x100352b1
xor al, al
pop ebp
add esp, 0x530
ret
push ebx
push esi
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x144]
rep stosd dword es:[edi], eax
mov esi, 1
mov dword [esp + 0x140], ebp
call fcn.10035210
push 0
push 0xa
mov bl, al
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x1003538d
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x128
push eax
push edi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x10035386
test bl, bl
je 0x1003531e
lea ecx, [esp + 0x3c]
push ecx
push 0x10050f08
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x10035372
mov edx, dword [esp + 0x30]
cmp edx, ebp
jne 0x10035341
mov eax, dword [esp + 0x20]
mov byte [esp + 0x13], 1
mov dword [esp + esi*4 + 0x140], eax
inc esi
cmp esi, 0x100
jb 0x10035372
jmp 0x10035370
xor eax, eax
test esi, esi
jbe 0x10035372
lea ecx, [esp + 0x140]
cmp edx, dword [ecx]
je 0x1003535c
inc eax
add ecx, 4
cmp eax, esi
jb 0x1003534e
jmp 0x10035372
mov ecx, dword [esp + 0x20]
mov dword [esp + esi*4 + 0x140], ecx
inc esi
cmp esi, 0x100
jb 0x10035372
xor esi, esi
lea edx, [esp + 0x18]
push edx
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
setne al
test al, al
jne 0x10035306
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jbe 0x100353e0
mov ebx, dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [esp + 0x14], esi
mov esi, dword [sym.imp.KERNEL32.dll_OpenProcess]
lea ebp, [esp + 0x140]
mov eax, dword [ebp]
test eax, eax
je 0x100353d2
push eax
push 0
push 0x1f0fff
call esi
mov edi, eax
test edi, edi
je 0x100353d2
push 1
push edi
call ebx
test eax, eax
push edi
setne byte [esp + 0x17]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x14]
add ebp, 4
dec eax
mov dword [esp + 0x14], eax
jne 0x100353a8
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebx
pop ebp
add esp, 0x530
ret