joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1020e11
Capabilities:
Enumerate disk volumes
Get disk information

Disassembly:
push 0x230
mov eax, 0x102db67
call fcn.01029310
mov esi, dword [ebp + 8]
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov dword [ebp - 0x238], eax
cmp eax, 0xffffffff
je 0x102106e
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x1020f9f
mov ecx, esi
xor ebx, ebx
call fcn.0101feed
test eax, eax
jbe 0x1020ecb
xor edi, edi
mov eax, dword [esi + 4]
add eax, edi
push eax
lea ecx, [ebp - 0x234]
call fcn.0101ff93
and dword [ebp - 4], 0
cmp dword [ebp - 0x21c], 8
mov eax, dword [ebp - 0x230]
jae 0x1020e93
lea eax, [ebp - 0x230]
lea ecx, [ebp - 0x218]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
or dword [ebp - 4], 0xffffffff
push 0
lea ecx, [ebp - 0x234]
push 1
test eax, eax
je 0x1020f9a
call fcn.01019504
mov ecx, esi
inc ebx
add edi, 0x1c
call fcn.0101feed
cmp ebx, eax
jb 0x1020e69
mov esi, 0xc105
push esi
call fcn.01027916
test eax, eax
je 0x1020eef
lea eax, [ebp - 0x218]
push eax
push 0x1008b28
push esi
call fcn.010279c4
add esp, 0xc
push dword [ebp - 0x238]
call dword [sym.imp.KERNEL32.dll_FindVolumeClose]
test eax, eax
jne 0x102106a
push esi
call fcn.01027916
mov edi, 0x1008af4
test eax, eax
je 0x1020f21
push edi
push 0x1008a60
push esi
call fcn.010279c4
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x238], eax
mov ebx, eax
test eax, eax
jle 0x1020f41
and ebx, 0xffff
or ebx, 0x80070000
test eax, eax
je 0x102106a
mov esi, 0x8105
push esi
call fcn.01027916
test eax, eax
je 0x1020f65
push edi
push 0x10089d0
push esi
call fcn.010279c4
add esp, 0xc
push esi
call fcn.01027916
test eax, eax
je 0x1020f83
push dword [ebp - 0x238]
push 0x1008940
push esi
call fcn.010279c4
add esp, 0xc
mov dword [ebp - 0x238], ebx
push 0x102f610
lea eax, [ebp - 0x238]
push eax
call sub.msvcrt.dll__CxxThrowException
call fcn.01019504
push 0x104
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x238]
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
test eax, eax
jne 0x1020e44
push dword [ebp - 0x238]
call dword [sym.imp.KERNEL32.dll_FindVolumeClose]
test eax, eax
jne 0x102106e
mov esi, 0xc105
push esi
call fcn.01027916
mov edi, 0x1008af4
test eax, eax
je 0x1020ff6
push edi
push 0x1008a60
push esi
call fcn.010279c4
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x238], eax
mov ebx, eax
test eax, eax
jle 0x1021016
and ebx, 0xffff
or ebx, 0x80070000
test eax, eax
je 0x102106e
mov esi, 0x8105
push esi
call fcn.01027916
test eax, eax
je 0x1021036
push edi
push 0x10089d0
push esi
call fcn.010279c4
add esp, 0xc
push esi
call fcn.01027916
test eax, eax
je 0x1021054
push dword [ebp - 0x238]
push 0x1008940
push esi
call fcn.010279c4
add esp, 0xc
mov dword [ebp - 0x23c], ebx
push 0x102f610
lea eax, [ebp - 0x23c]
jmp 0x1020f94
xor al, al
jmp 0x1021070
mov al, 1
call fcn.010293a2
ret 4
Function at 0x10237f2
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1032038]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea esi, [ebp + 8]
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, 0xc105
push esi
call fcn.01027916
test eax, eax
je 0x102382d
push 0x100bc70
push esi
call fcn.010279c4
pop ecx
pop ecx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
xor edi, edi
push edi
lea eax, [ebp - 0x18]
push eax
push edi
push 4
push edi
push edi
push edi
push 0x100b058
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
je 0x1023876
push esi
call fcn.01027916
test eax, eax
je 0x1023944
push 0x100b058
push 0x100bb80
push esi
call fcn.010279c4
add esp, 0xc
jmp 0x1023944
push edi
lea eax, [ebp - 0x20]
push eax
push edi
push 2
push edi
push edi
push edi
push 0x100b09c
push dword [ebp - 0x18]
call ebx
test eax, eax
je 0x10238ba
push esi
call fcn.01027916
test eax, eax
je 0x10238ac
push 0x100b0b8
push 0x100bb80
push esi
call fcn.010279c4
add esp, 0xc
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1023944
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.RPCRT4.dll_UuidToStringW]
test eax, eax
je 0x10238e5
push esi
call fcn.01027916
test eax, eax
je 0x1023934
push 0x100bac8
push esi
call fcn.010279c4
pop ecx
pop ecx
jmp 0x1023934
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x1c]
push 1
push edi
mov edi, 0x100b118
push edi
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x102392a
push esi
call fcn.01027916
test eax, eax
je 0x102392a
push edi
push 0x100b0b8
push 0x100ba30
push esi
call fcn.010279c4
add esp, 0x10
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.RPCRT4.dll_RpcStringFreeW]
push dword [ebp - 0x18]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x20]
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01016c45
leave
ret 0x10
Function at 0x102395a
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x1032038]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, 0xc105
push ebx
mov dword [ebp - 0x218], edi
call fcn.01027916
test eax, eax
je 0x1023997
push 0x100bfa8
push ebx
call fcn.010279c4
pop ecx
pop ecx
mov esi, 0x1010448
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x210]
push eax
movsd dword es:[edi], dword [esi]
push 1
xor edi, edi
push edi
mov esi, 0x100b0b8
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10239e3
push ebx
call fcn.01027916
test eax, eax
je 0x1023a75
push esi
push 0x100beb8
push ebx
call fcn.010279c4
add esp, 0xc
jmp 0x1023a75
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
push edi
mov edi, 0x100b118
push edi
push dword [ebp - 0x210]
mov dword [ebp - 0x214], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1023a3b
push ebx
call fcn.01027916
test eax, eax
je 0x1023a2d
push edi
push esi
push 0x100bda8
push ebx
call fcn.010279c4
add esp, 0x10
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1023a75
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x218]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.RPCRT4.dll_UuidFromStringW]
test eax, eax
je 0x1023a75
push ebx
call fcn.01027916
test eax, eax
je 0x1023a75
push 0x100bcd0
push ebx
call fcn.010279c4
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01016c45
leave
ret 4

Function at 0x1023a8b
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov esi, 0xc105
push esi
call fcn.01027916
test eax, eax
je 0x1023aaf
push 0x100c180
push esi
call fcn.010279c4
pop ecx
pop ecx
lea eax, [ebp - 4]
push eax
push 2
push 0
mov edi, 0x100b0b8
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1023ae7
push esi
call fcn.01027916
test eax, eax
je 0x1023b1f
push edi
push 0x100c0a0
push esi
call fcn.010279c4
add esp, 0xc
jmp 0x1023b1f
push ebx
mov ebx, 0x100b118
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x1023b15
push esi
call fcn.01027916
test eax, eax
je 0x1023b15
push ebx
push edi
push 0x100c010
push esi
call fcn.010279c4
add esp, 0x10
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
pop edi
pop esi
leave
ret
Function at 0x1028cdf
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 0x14]
push edi
push dword [ebp + 0x10]
lea eax, [ebp - 4]
push eax
xor esi, esi
push esi
push dword [ebp + 8]
mov dword [ebp - 4], esi
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
dec ecx
dec ecx
je 0x1028d6b
sub ecx, 0xe8
je 0x1028d6d
cmp eax, esi
je 0x1028d2a
push eax
push 0xc3
push 0x1010410
push 0x100fd3c
call fcn.0102880e
mov edi, dword [ebp + 0xc]
cmp dword [ebp - 4], edi
je 0x1028d5f
mov esi, 0x4004
push esi
call fcn.01027916
test eax, eax
je 0x1028d53
push dword [ebp - 4]
push edi
push 0x10103a8
push esi
call fcn.010279c4
add esp, 0x10
push 0x65d
push 0xca
jmp 0x1028d1b
xor eax, eax
cmp dword [ebp + 0x10], esi
setne al
mov esi, eax
jmp 0x1028d6d
mov dword [edi], esi
pop edi
mov eax, esi
pop esi
leave
ret 0x10

Function at 0x102ad40
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
xor ebx, ebx
push ebx
mov esi, ecx
push esi
push 0x102ad27
push ebx
push ebx
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
mov edi, eax
cmp edi, ebx
setne byte [ebp - 1]
cmp byte [ebp - 1], bl
jne 0x102ad97
mov esi, 0x4100
push esi
call fcn.01027916
test eax, eax
je 0x102adb6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1012980
push esi
call fcn.010279c4
add esp, 0xc
jmp 0x102adb6
mov ebx, 0xc100
push ebx
call fcn.01027916
test eax, eax
je 0x102adb3
push 0x1012910
push ebx
call fcn.010279c4
pop ecx
pop ecx
mov dword [esi + 0x44], edi
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1004bb1
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x23
push 8
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
jl 0x1004bdb
test byte [ebp - 7], 2
je 0x1004bdb
xor eax, eax
inc eax
jmp 0x1004bdd
xor eax, eax
leave
ret 4

Function at 0x1005e86
Capabilities:
Get token membership

Disassembly:
push 0x1c
push 0x1001b48
call fcn.010068c0
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x24], bl
mov byte [ebp - 0x23], bl
mov byte [ebp - 0x22], bl
mov byte [ebp - 0x21], bl
mov byte [ebp - 0x20], bl
mov byte [ebp - 0x1f], 5
mov dword [ebp - 0x28], ebx
push 2
call dword [sym.imp.ADVAPI32.dll_ImpersonateSelf]
lea eax, [ebp - 0x2c]
push eax
push ebx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
je 0x1005f27
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x28]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x1c], eax
cmp eax, ebx
je 0x1005f1e
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call sub.ADVAPI32.dll_CheckTokenMembership
test eax, eax
jne 0x1005f1e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1001b38
call dword [sym.imp.msvcrt.dll_printf]
pop ecx
pop ecx
mov dword [ebp - 0x1c], ebx
or dword [ebp - 4], 0xffffffff
call fcn.01005f36
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov eax, dword [ebp - 0x1c]
call fcn.010068f9
ret

Function at 0x10060be
Capabilities:
Terminate process

Disassembly:
push esi
push 0x50
call dword [sym.imp.msvcrt.dll_malloc]
mov esi, eax
test esi, esi
pop ecx
jne 0x10060d6
push 1
call dword [sym.imp.msvcrt.dll_exit]
push dword [esp + 0xc]
push dword [esp + 0xc]
push 0x1001b60
push esi
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0x10
mov eax, esi
pop esi
ret 8

Function at 0x10060f3
Capabilities:
Terminate process

Disassembly:
push esi
push 0x50
call dword [sym.imp.msvcrt.dll_malloc]
mov esi, eax
test esi, esi
pop ecx
jne 0x100610b
push 1
call dword [sym.imp.msvcrt.dll_exit]
push dword [esp + 0xc]
push dword [esp + 0xc]
push 0x1001b6c
push esi
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0x10
mov eax, esi
pop esi
ret 8

Function at 0x1006128
Capabilities:
Terminate process

Disassembly:
push esi
push 0x50
call dword [sym.imp.msvcrt.dll_malloc]
mov esi, eax
test esi, esi
pop ecx
jne 0x1006140
push 1
call dword [sym.imp.msvcrt.dll_exit]
push dword [esp + 0xc]
push dword [esp + 0xc]
push 0x1001b78
push esi
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0x10
mov eax, esi
pop esi
ret 8
Function at 0x1006746
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x28
push 0x1001bb0
call fcn.010068c0
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x1006781
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1006781
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x1006799
cmp eax, 0x20b
je 0x1006786
mov dword [ebp - 0x1c], edi
jmp 0x10067ad
cmp dword [ecx + 0x84], 0xe
jbe 0x1006781
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x10067a7
cmp dword [ecx + 0x74], 0xe
jbe 0x1006781
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x1008320], 0xffffffff
or dword [0x1008324], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x1008314]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x1008310]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x1008328], eax
call fcn.01006a04
cmp dword [0x1008300], edi
jne 0x1006808
push fcn.01006a04
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.010069f2
push 0x100118c
push 0x1001188
call sub.msvcrt.dll__initterm
mov eax, dword [0x100830c]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x1008308]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___wgetmainargs]
mov dword [ebp - 0x30], eax
push 0x1001184
push 0x1001180
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x24]
mov ecx, dword [sym.imp.msvcrt.dll___winitenv]
mov dword [ecx], eax
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.01003734
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x34], esi
cmp dword [ebp - 0x1c], edi
jne 0x100687f
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x10068b4
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.010068f9
ret
Function at 0x4011e0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
push str.CString
mov eax, dword [esi + 0xc]
mov dword [esp + 0x14], 0x64
push eax
mov ebp, 1
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 8
test eax, eax
jne 0x40129d
mov eax, dword [esi + 4]
lea edi, [esi + 0x10]
push edi
push eax
mov eax, dword [esi + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x40129d
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x401268
mov eax, dword [esi + 8]
mov edx, dword [edi]
lea ecx, [esp + 0x10]
lea ebx, [esi + 0x18]
push ecx
push ebx
push 0
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40129d
mov ecx, dword [esp + 0x18]
push ebx
call sub.MFC42.DLL_CString::operator_1
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
mov eax, dword [esp + 0x18]
mov edx, dword [esi + 8]
mov eax, dword [eax]
mov ecx, dword [eax - 8]
inc ecx
push ecx
mov ecx, dword [esp + 0x24]
neg ecx
sbb ecx, ecx
push eax
add ecx, 2
push ecx
push 0
push edx
mov edx, dword [edi]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x40129f
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 0xc
xor ebp, ebp
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc

Function at 0x4012c0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
push edi
push str.DWORD
mov dword [esp + 0x10], 0x64
mov eax, dword [esi + 0xc]
mov ebx, 1
push eax
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 8
test eax, eax
jne 0x401326
mov eax, dword [esi + 4]
lea edi, [esi + 0x10]
push edi
push eax
mov eax, dword [esi + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x401326
mov eax, dword [esp + 0x18]
test eax, eax
mov eax, dword [esi + 8]
je 0x40133b
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0xc]
push ecx
push edx
push 0
push 0
push eax
mov eax, dword [edi]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x401328
xor ebx, ebx
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, ebx
pop esi
pop ebx
pop ecx
ret 8
mov ecx, dword [esp + 0x14]
mov edx, dword [edi]
push 4
push ecx
push 4
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x401328
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 8
Function at 0x4021f0
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x402f58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 8], esp
push eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x14], 0x1c48345
mov dword [esp + 0x10], 0x8aed3500
call fcn.00402a20
mov ecx, esi
call fcn.004022d0
mov ecx, dword [esp + 0x20]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4022a1
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
lea edx, [esp + 4]
push 0
push edx
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea edx, [esp + 8]
lea eax, [esp + 8]
push edx
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x10]
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret 0xc
Function at 0x1001493
Capabilities:
Initialize winsock library

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
xor edi, edi
inc edi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
mov esi, dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.01001d64
push ebx
call dword [sym.imp.KERNEL32.dll_SetThreadUILanguage]
add esi, 4
mov eax, dword [esi]
cmp eax, ebx
je 0x1001529
mov cl, byte [eax]
cmp cl, 0x2d
je 0x1001517
cmp cl, 0x2f
je 0x1001517
cmp dword [esi], ebx
je 0x1001529
call sub.ntdll.dll_WinSqmIsOptedIn
test eax, eax
je 0x10014eb
push edi
push 0x1951
push ebx
call sub.ntdll.dll_WinSqmSetDWORD
push 0x10033e0
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp eax, ebx
je 0x1001559
push eax
push 0x271a
call fcn.01001d21
jmp 0x1001559
cmp cl, 0x6c
jne 0x1001529
mov dword [0x1003080], edi
inc eax
mov cl, byte [eax]
cmp cl, bl
jne 0x100150c
add esi, 4
mov eax, dword [esi]
cmp eax, ebx
jne 0x10014c6
jmp 0x10014d2
call fcn.01001205
mov eax, edi
jmp 0x100155f
push 0xa
call dword [sym.imp.msvcrt.dll_putchar]
pop ecx
push dword [esi]
call fcn.01001219
test eax, eax
jne 0x1001556
push dword [esi]
push 0x2710
push edi
call fcn.01001c91
add esp, 0xc
add esi, 4
cmp dword [esi], ebx
jne 0x1001532
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10017fd
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x1001dd8
call fcn.010019a4
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x100357c
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x1001612
cmp eax, esi
jne 0x1001605
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x1001615
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10015ec
xor esi, esi
inc esi
mov eax, dword [0x1003578]
cmp eax, esi
jne 0x1001628
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1001663
mov eax, dword [0x1003578]
test eax, eax
jne 0x100165d
mov dword [0x1003578], esi
push 0x1001104
push 0x10010f8
call fcn.01001569
pop ecx
pop ecx
test eax, eax
je 0x1001663
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x100172d
mov dword [0x10030a0], esi
mov eax, dword [0x1003578]
cmp eax, esi
jne 0x1001687
push 0x10010f4
push 0x10010ec
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1003578], 2
cmp dword [ebp - 0x1c], ebx
jne 0x1001694
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1003580], ebx
je 0x10016b5
push 0x1003580
call fcn.01001919
pop ecx
test eax, eax
je 0x10016b5
push ebx
push 2
push ebx
call dword [0x1003580]
push dword [0x1003088]
push dword [0x100308c]
push dword [0x1003084]
call fcn.01001493
add esp, 0xc
mov dword [0x100309c], eax
cmp dword [0x1003090], ebx
jne 0x1001713
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x10030a0], ebx
jne 0x1001721
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x100309c]
call fcn.010019e9
ret
call fcn.01001af1
jmp 0x10015ca

Function at 0x1001d6c
Capabilities:
Send data
Send data on socket

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [sym.imp.WS2_32.dll_send]
push 0xa
pop esi
jmp 0x1001d96
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2747
jne 0x1001dab
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
imul esi, esi, 0xa
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1001d7f
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 0x10