joyce8/EMBER2024-capa huggingface dataset:
Function at 0x721550
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x72158f
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x72158f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x72158f
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x72158f
cmp dword [ecx + 0x74], 0xe
jbe 0x72158f
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x7294b8
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x73b9b8
push 0x73b9b0
push str.FlsAlloc
push 0x1f
call fcn.007298cf
mov esi, eax
add esp, 0x10
test esi, esi
je 0x7294ec
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
jmp 0x7294f2
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x729536
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x73b9c8
push 0x73b9c0
push str.FlsGetValue
push 0x21
call fcn.007298cf
mov esi, eax
add esp, 0x10
test esi, esi
je 0x72956d
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x729575
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x73b9d0
push 0x73b9c8
push str.FlsSetValue
push 0x22
call fcn.007298cf
mov esi, eax
add esp, 0x10
test esi, esi
je 0x7295af
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x72db08
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x787524]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.00728b7b
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00728b7b
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x72db7f
cmp word [ecx], dx
je 0x72db7f
mov eax, dword [0x73be44]
push edi
dec eax
push eax
push 0x73bd30
call fcn.0072dcf8
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x72dbf2
cmp word [eax], dx
je 0x72dbf2
mov eax, dword [edi]
test eax, eax
je 0x72dba3
cmp word [eax], dx
je 0x72dba3
lea eax, [ebp - 0x10]
push eax
call fcn.0072dd59
jmp 0x72dbac
lea eax, [ebp - 0x10]
push eax
call fcn.0072e047
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x72dc1c
mov eax, dword [0x73bd2c]
push dword [ebp - 0x14]
dec eax
push eax
push 0x73ba20
call fcn.0072dcf8
add esp, 0xc
test al, al
je 0x72dc1c
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x72dbe7
cmp word [eax], di
je 0x72dbe7
lea eax, [ebp - 0x10]
push eax
call fcn.0072dd59
pop ecx
jmp 0x72dc1e
lea eax, [ebp - 0x10]
push eax
call fcn.0072e047
jmp 0x72dbe4
mov eax, dword [edi]
test eax, eax
je 0x72dc09
cmp word [eax], dx
je 0x72dc09
lea eax, [ebp - 0x10]
push eax
call fcn.0072e17b
pop ecx
jmp 0x72dc1c
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x72dce7
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.0072e26d
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x72dce7
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x72dce7
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x72dce7
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x72dc74
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.00729712
test ebx, ebx
je 0x72dce2
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.00729712
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x72dce7
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x72dce7
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.00735941
add esp, 0x10
xor eax, eax
inc eax
jmp 0x72dce9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0071bb24
leave
ret
Function at 0x72e373
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.00728b7b
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x72e3e2
cmp esi, dword [ebp - 4]
je 0x72e3dd
cmp dword [ebp + 0xc], 0
je 0x72e3dd
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x72e3ba
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.0072e43c
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x72e3e4
xor eax, eax
inc eax
jmp 0x72e3e4
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x72f47c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00719960
mov eax, dword [0x787524]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.0072bf73
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x72f4be
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x72f61a
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.0072fda0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x78ae28]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.0072f224
mov ecx, dword [esi*4 + 0x78ae28]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x72f613
cmp eax, dword [ecx + edi + 0x24]
jne 0x72f613
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x72f613
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0072f224
add esp, 0x14
test edx, edx
jl 0x72f613
jg 0x72f589
test eax, eax
jb 0x72f613
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x72f613
jl 0x72f5a3
cmp dword [ebp - 0x1008], eax
ja 0x72f613
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x72f5c1
test ebx, ebx
je 0x72f5fa
cmp ecx, edi
jae 0x72f5fa
mov al, byte [ecx]
cmp al, 0xd
jne 0x72f5db
lea eax, [edi - 1]
cmp ecx, eax
jae 0x72f5e7
cmp byte [ecx + 1], 0xa
jne 0x72f5e7
inc ecx
jmp 0x72f5e7
movzx eax, al
movsx eax, byte [eax + 0x787e40]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x72f5c1
cmp edx, ebx
jne 0x72f5c1
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x72f618
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0071bb24
leave
ret
Function at 0x72fa22
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x72fabf
push ebx
push esi
call fcn.0072fac2
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00728a39
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x72fa6c
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x72fabe
push edi
push eax
call fcn.00728929
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x72fa8c
call fcn.007288ef
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x72fabd
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00728a39
add esp, 0x20
test eax, eax
jne 0x72faab
push edi
call fcn.007288ef
jmp 0x72fab3
push ebx
call fcn.007288ef
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x731a1c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x78ae28]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x731a5c
cmp byte [ebx], 0xa
jne 0x731a5c
or byte [edi + eax + 0x28], 4
jmp 0x731a61
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x731b60
mov dl, byte [eax]
cmp dl, 0x1a
je 0x731b43
inc eax
cmp dl, 0xd
je 0x731a8d
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x731ab3
cmp eax, ecx
jae 0x731ac1
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x731a75
jmp 0x731b60
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x731b3e
cmp dword [ebp - 0x10], 0
je 0x731b3e
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x78ae28]
test byte [eax + edi + 0x28], 0x48
je 0x731b18
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x731b03
mov byte [esi], dl
jmp 0x731b14
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x78ae28]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x731b60
cmp byte [ebp - 1], 0xa
jne 0x731b27
cmp esi, ebx
jne 0x731b27
mov byte [esi], 0xa
jmp 0x731b5f
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0072f1c6
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x731b60
mov byte [esi], 0xd
jmp 0x731b5f
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x78ae28]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x731b5d
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x731b60
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x731b69
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x78ae28]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x731baf
cmp word [ebx], dx
jne 0x731baf
or byte [eax + edi + 0x28], 4
jmp 0x731bb4
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x731d17
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x731cf7
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x731bf5
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x731c2b
cmp eax, edx
jae 0x731c39
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x731bd0
jmp 0x731d17
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x731cf2
cmp dword [ebp - 0x18], 0
je 0x731cf2
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x78ae28]
test byte [eax + edi + 0x28], 0x48
je 0x731cc8
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x731c8c
mov word [esi], cx
jmp 0x731cc3
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x78ae28]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x78ae28]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x78ae28]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x731d17
pop eax
cmp word [ebp - 4], ax
jne 0x731cd8
cmp esi, ebx
jne 0x731cd8
mov word [esi], ax
jmp 0x731d14
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0072f1c6
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x731d17
push 0xd
pop eax
jmp 0x731cd3
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x78ae28]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x731d11
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x731d17
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10054cd
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x100704c]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
test esi, esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x70], eax
je 0x1005503
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
push eax
mov dword [ebp - 0x74], eax
call fcn.01005198
test eax, eax
jne 0x1005507
xor eax, eax
jmp 0x100556c
push edi
push 0x33
lea eax, [ebp - 0x6c]
push esi
push eax
call dword [sym.imp.msvcrt.dll_wcsncpy]
mov edi, dword [sym.imp.msvcrt.dll_wcslen]
and word [ebp - 6], 0
lea eax, [ebp - 0x6c]
push eax
call edi
add esp, 0x10
cmp word [ebp + eax*2 - 0x6e], 0x5c
jne 0x100553e
lea eax, [ebp - 0x6c]
push eax
call edi
and word [ebp + eax*2 - 0x6e], 0
pop ecx
lea eax, [ebp - 0x6c]
push eax
call fcn.010051bc
mov edi, eax
cmp edi, 0xffffffff
jne 0x1005552
xor eax, eax
jmp 0x100556b
mov ecx, dword [ebp - 0x70]
push ebx
push esi
push dword [ebp - 0x74]
push edi
call fcn.010051fa
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.01005656
leave
ret 0xc

Function at 0x10003fbb
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x100128b0
cmp edx, dword [eax]
je 0x10003fdd
add eax, 8
inc ecx
cmp eax, 0x10012940
jl 0x10003fce
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x100128b0]
jne 0x1000410b
mov eax, dword [0x10016fdc]
cmp eax, 1
je 0x100040e5
test eax, eax
jne 0x1000400e
cmp dword [0x10016fe0], 1
je 0x100040e5
cmp edx, 0xfc
je 0x1000410b
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10004045
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.10004bd0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.10004cc0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x10004088
lea eax, [ebp - 0x1a4]
push eax
call fcn.10004cc0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x1000f59c
push edi
call fcn.10006be0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.10004bd0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.10004be0
lea eax, [ebp - 0xa0]
push 0x1000f57c
push eax
call fcn.10004be0
push dword [esi + 0x100128b4]
lea eax, [ebp - 0xa0]
push eax
call fcn.10004be0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.10006b48
add esp, 0x2c
pop edi
jmp 0x1000410b
lea eax, [ebp + 8]
lea esi, [esi + 0x100128b4]
push 0
push eax
push dword [esi]
call fcn.10004cc0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x407320
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x40732f
pop dword [ebp - 0xc]
mov eax, 0x6253f8ae
sub eax, 0x6213857f
sub dword [ebp - 0xc], eax
push 0x40
push 0x1000
push 0x3b110
push 0
mov eax, 0xdc180970
add eax, 0x2428d768
add eax, dword [ebp - 0xc]
call dword [eax]
mov ecx, 0x72f7f70d
sub ecx, 0x72f7a7ef
mov esi, eax
mov edi, 0xf9a0452d
add edi, 0x6a0f697
add edi, dword [ebp - 0xc]
mov edx, 0x5b429ba2
add edx, 0x31316e0b
xor dword [ebp - 4], 0x3410beca
mov ebx, dword [edi]
xor ebx, edx
add dword [ebp - 8], 0xa648918c
mov dword [esi], ebx
add dword [ebp - 4], 0x435859f2
add esi, 0x1414283a
add esi, 0xebebd7ca
add edi, 0x43e48eb6
add edi, 0xbc1b714e
loop 0x40738e
add eax, 0xcdcbaf77
sub eax, 0xcdca802c
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x10001918
Capabilities:
Connect socket

Disassembly:
push ecx
mov eax, dword [edi + 0x18]
push ebx
xor ebx, ebx
cmp eax, ebx
push esi
je 0x10001934
call fcn.1002f6a3
mov esi, dword [edi + 0x18]
call fcn.1002f643
mov dword [edi + 0x18], ebx
mov eax, dword [edi + 0x1c]
cmp eax, 0xffffffff
je 0x10001947
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
or dword [edi + 0x1c], 0xffffffff
mov ecx, dword [edi + 0x2c]
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.10004105
mov ecx, dword [edi + 0x30]
add esp, 0x14
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.10004105
add esp, 0x14
xor eax, eax
inc eax
push 6
push eax
push 2
mov dword [edi + 0x24], eax
mov dword [edi + 0x28], ebx
mov dword [edi + 0x13f0], ebx
mov dword [edi + 0x13ec], ebx
mov dword [edi + 0x3dc], ebx
mov dword [edi + 0x3e0], ebx
mov dword [edi + 0x3e4], ebx
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [edi + 0x1c], eax
je 0x10001a04
push 0x10
push edi
push eax
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x10001a04
mov eax, dword [edi + 0x40]
push str.http:
push dword [eax]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x100019c8
mov eax, dword [edi + 0x24]
jmp 0x10001a09
push dword [edi + 0x14]
call fcn.1002f5fc
cmp eax, ebx
pop ecx
mov dword [edi + 0x18], eax
je 0x10001a04
mov ecx, dword [edi + 0x1c]
lea edx, [eax + 0xf8]
lea esi, [eax + 0xfc]
mov dword [edx], ecx
mov dword [esi], ecx
mov dword [eax + 0x110], edx
mov dword [eax + 0x114], esi
mov eax, dword [edi + 0x18]
call fcn.1002f91c
cmp eax, 1
je 0x100019c3
mov dword [edi + 0x24], ebx
xor eax, eax
pop esi
pop ebx
pop ecx
ret

Function at 0x10001a0d
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [edi + 0x24], 0
push esi
jne 0x10001a1e
xor eax, eax
jmp 0x10001a95
mov eax, dword [ebx + 4]
and dword [ebp - 4], 0
test eax, eax
mov dword [ebp - 8], eax
jle 0x10001a92
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 4]
mov eax, 0x1000
cmp ecx, eax
jl 0x10001a3d
mov ecx, eax
mov eax, dword [ebx]
mov esi, dword [edi + 0x18]
add eax, dword [ebp - 4]
test esi, esi
je 0x10001a5b
push ecx
push eax
call fcn.100327f5
test eax, eax
pop ecx
pop ecx
jge 0x10001a68
or esi, 0xffffffff
jmp 0x10001a6a
push 0
push ecx
push eax
push dword [edi + 0x1c]
call dword [sym.imp.WS2_32.dll_send]
mov esi, eax
test esi, esi
jle 0x10001a98
mov eax, dword [edi + 0x3e8]
test eax, eax
je 0x10001a87
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10001a98
add dword [ebp - 4], esi
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jl 0x10001a2c
xor eax, eax
inc eax
pop esi
leave
ret
and dword [edi + 0x24], 0
jmp 0x10001a1a
Function at 0x10001aa1
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ecx
push ecx
cmp dword [esi + 0x24], 0
push ebx
push ebp
push edi
jne 0x10001ab3
xor eax, eax
jmp 0x10001b8a
mov edi, dword [esi + 0x13f0]
mov eax, edi
cdq
mov ebx, bind
add eax, ebx
adc edx, 0
mov dword [esp + 0x10], edx
mov ebp, 0x1000
js 0x10001b17
jg 0x10001ad7
cmp eax, ebp
jbe 0x10001b17
mov ecx, dword [esi + 0x13ec]
test ecx, ecx
je 0x10001b17
cmp edi, ebp
je 0x10001aee
mov eax, edi
sub eax, ecx
cmp eax, 0x10
jg 0x10001b17
mov eax, edi
sub eax, ecx
push eax
mov dword [esi + 0x13f0], eax
lea eax, [ecx + esi + 0x3ec]
push eax
lea eax, [esi + 0x3ec]
push eax
call sub.MSVCRT.dll_memmove
add esp, 0xc
and dword [esi + 0x13ec], 0
mov eax, dword [esi + 0x13f0]
mov ecx, ebp
sub ecx, eax
cmp ecx, ebx
jle 0x10001b27
mov ecx, ebx
mov edx, dword [esi + 0x18]
xor ebx, ebx
cmp edx, ebx
lea eax, [eax + esi + 0x3ec]
je 0x10001b44
push ecx
push eax
push edx
call fcn.1002f67c
add esp, 0xc
jmp 0x10001b50
push ebx
push ecx
push eax
push dword [esi + 0x1c]
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
cmp edi, ebx
jge 0x10001b5e
mov dword [esi + 0x24], ebx
jmp 0x10001aac
mov eax, dword [esi + 0x3e8]
cmp eax, ebx
je 0x10001b76
push ebx
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10001b56
add dword [esi + 0x13f0], edi
cmp edi, ebx
jne 0x10001b87
mov dword [esi + 0x28], 1
mov eax, dword [esi + 0x24]
pop edi
pop ebp
pop ebx
pop ecx
pop ecx
ret

Function at 0x10002a9e
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, eax
mov ecx, edi
and ecx, 0xff00
mov edx, edi
shl edx, 0x10
or ecx, edx
shl ecx, 8
movzx edx, di
or ecx, edx
xor ecx, 0xb11924e1
movsx esi, cl
mov edx, ecx
shr edx, 8
movsx edx, dl
mov ebx, esi
mov ebp, dword [esp + 0x14]
shl ebx, 5
add ebx, esi
add edx, ebx
mov esi, edx
shl esi, 5
add esi, edx
mov edx, ecx
shr edx, 0x10
movsx edx, dl
add esi, edx
shr ecx, 0x18
mov edx, esi
shl edx, 5
add edx, esi
movsx ecx, cl
mov ebx, edi
and ebx, 3
mov eax, 0x96438af7
lea ecx, [ecx + edx + 0x7c5d0f85]
mov dword [esp + 0x14], ebx
je 0x10002b60
mov esi, ebp
jmp 0x10002b19
mov edx, ecx
and edx, 0xff
add eax, dword [edx*4 + 0x10053078]
mov ebp, ecx
not ebp
shl ebp, 0x15
mov dl, al
add dl, cl
xor dl, byte ds:[esi]
add ebp, 0x2611501
shr ecx, 0xb
or ecx, ebp
mov ebp, eax
shl ebp, 5
add ebp, eax
movzx eax, dl
mov byte ds:[esi], dl
add esi, 1
sub ebx, 1
lea eax, [ebp + eax + 3]
jne 0x10002b19
sub edi, dword [esp + 0x14]
mov ebp, esi
test edi, edi
mov esi, ebp
je 0x10002ba7
jmp 0x10002b6a
mov edx, ecx
and edx, 0xff
add eax, dword [edx*4 + 0x10053078]
mov ebx, ecx
not ebx
shl ebx, 0x15
lea edx, [eax + ecx]
xor edx, dword ds:[esi]
add ebx, 0x3938731
shr ecx, 0xb
or ecx, ebx
mov ebx, eax
shl ebx, 5
add ebx, edx
mov dword ds:[esi], edx
add esi, 4
sub edi, 4
lea eax, [ebx + eax + 3]
jne 0x10002b6a
pop edi
pop esi
pop ebp
pop ebx
ret