joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000cb10
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x1000cb2e
inc ebx
push edi
je 0x1000cb87
pop eax
mov ecx, dword [ebp - 0x10]
call fcn.1000dce0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x1000cb4c
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0x1b69
jmp 0x1000cba1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
mov dword [ebp - 8], eax
push 0x2000000
push 0
push 0
call dword [sym.imp.USER32.dll_OpenInputDesktop]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000cb7e
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_SetThreadDesktop]
mov edx, dword [ebp - 0xc]
push edx
push 0x1000c9b0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_SetThreadDesktop]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000cef0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x1000cf0e
inc ebx
push edi
je 0x1000cf67
pop eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.SHLWAPI.dll_StrToIntA]
mov dword [ebp - 4], eax
call fcn.1000a410
mov eax, dword [ebp - 4]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1000cf4d
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], 0x1b6a
jmp 0x1000cf7d
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x1000cf73
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0x1b6a
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000cf7d
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000cf90
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x1000cfae
inc ebx
push edi
je 0x1000d007
pop eax
call fcn.1000a410
push 0xe00f003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1000cfdb
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0x1b5c
jmp 0x1000d086
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 8], edx
push 0xf01ff
mov eax, dword [ebp - 8]
add eax, 0x10
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000d019
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0x1b5b
jmp 0x1000d086
mov ecx, dword [ebp - 8]
add ecx, 0x218
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
test eax, eax
jne 0x1000d068
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], 0x1b5b
jmp 0x1000d086
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000d090
Capabilities:
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
mov dword [ebp - 0x30], ecx
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x1000d0ae
inc ebx
push edi
je 0x1000d107
pop eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc], ecx
call fcn.1000a410
push 0xe00f003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x1000d0e4
mov edx, dword [ebp - 0x30]
mov dword [edx + 4], 0x1b5b
jmp 0x1000d1ad
push 0xf01ff
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000d119
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x30]
mov dword [eax + 4], 0x1b5b
jmp 0x1000d1ad
and byte [ecx], al
adc byte [ebx + 0x40c7d045], cl
add al, 0x5b
sbb eax, dword [eax]
add cl, ch
xchg esp, eax
add byte [eax], al
add bh, al
inc ebp
clc
add byte [eax], al
add byte [eax], al
mov dword [ebp - 8], 0
mov dword [ebp - 0x2c], 0
mov ecx, 6
xor eax, eax
lea edi, [ebp - 0x28]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x400]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x1000d157
sub dword [ebp - 0x38], 1
cmp dword [ebp - 0x38], 0
je 0x1000d16a
jmp 0x1000d17d
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov dword [ebp - 8], eax
jmp 0x1000d17d
lea edx, [ebp - 0x2c]
push edx
push 1
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000d18f
mov ecx, dword [ebp - 0x30]
mov dword [ecx + 4], 0
jmp 0x1000d199
mov edx, dword [ebp - 0x30]
mov dword [edx + 4], 0x1b5b
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000d1c0
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0x14], ecx
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x1000d1de
inc ebx
push edi
je 0x1000d237
pop eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc], ecx
call fcn.1000a410
push 0xe00f003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x1000d211
mov edx, dword [ebp - 0x14]
mov dword [edx + 4], 0x1b5d
jmp 0x1000d274
push 0xf01ff
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000d243
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x14]
mov dword [eax + 4], 0x1b5d
jmp 0x1000d274
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 8], 0
jne 0x1000d274
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 4], 0x1b5d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000d4d0
Capabilities:
Query service configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov dword [ebp - 0x1c], ecx
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x1000d4ee
inc ebx
push edi
je 0x1000d547
pop eax
push 0xf01ff
mov eax, dword [ebp + 0xc]
add eax, 0x10
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000d513
jmp 0x1000d63b
mov dword [ebp - 8], 0
push 0x2000
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov ecx, 0x800
xor eax, eax
mov edi, dword [ebp - 0x10]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 8]
push ecx
push 0x2000
add byte [eax], ah
add byte [eax], al
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
je 0x1000d61f
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 8]
mov dword [ecx + 8], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x14]
mov dword [ecx + 0xc], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp + 0xc]
add eax, 0x448
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x18]
push edx
mov eax, dword [ebp + 0xc]
add eax, 0x848
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x10]
push edx
mov eax, dword [ebp + 0xc]
add eax, 0x648
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1c]
push edx
mov eax, dword [ebp + 0xc]
add eax, 0xc48
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp + 0xc]
add ecx, 0x10
push ecx
push str.SYSTEMControlSet001Services_s
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov eax, dword [ebp + 0xc]
add eax, 0x1048
push eax
push str.Description
mov ecx, dword [ebp - 0x10]
push ecx
push reloc.WS2_32.dll_bind
call fcn.1000a280
add esp, 0x10
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1000d650
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x1000d66e
inc ebx
push edi
je 0x1000d6c7
pop eax
mov ecx, dword [ebp - 0xc]
call fcn.1000dce0
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x1000d68c
mov eax, dword [ebp - 0xc]
mov dword [eax + 4], 0x1b69
jmp 0x1000d6d5
mov dword [ebp - 4], 0
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1000d6cb
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], 0x1b69
add byte [eax], al
jmp 0x1000d6d5
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000d6e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x1000d6fe
inc ebx
push edi
je 0x1000d757
pop eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0
lea edx, [ebp - 4]
push edx
push 0xf003f
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1208]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000d743
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0x1b68
jmp 0x1000d79e
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1200]
push edx
mov eax, dword [ebp - 0xc]
add eax, 0xa00
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1204]
push edx
push 0
mov eax, dword [ebp - 0xc]
add eax, 0x800
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000d794
dec ebp
hlt
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0x1b67
jmp 0x1000d79e
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000d7b0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x1000d7ce
inc ebx
push edi
je 0x1000d827
pop eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0
lea edx, [ebp - 4]
push edx
push 0xf003f
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1208]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000d813
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0x1b68
jmp 0x1000d850
mov ecx, dword [ebp - 0xc]
add ecx, 0x800
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000d846
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], 0x1b64
jmp 0x1000d850
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000d860
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x1000d87e
inc ebx
push edi
je 0x1000d8d7
pop eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0
lea edx, [ebp - 4]
push edx
push 0xf003f
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1208]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000d8c3
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0x1b68
jmp 0x1000d8fb
push 0x100146d0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000d8f1
clc
add byte [esi + edx - 0x75], dh
push ebp
cld
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0x1b64
jmp 0x1000d8fb
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000dc70
Capabilities:
Delete file
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x1000dc8e
inc ebx
push edi
je 0x1000dce7
pop eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0xc], 0
je 0x1000dcb7
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ecx, dword [ebp - 8]
mov dword [ecx + 0xc], 0
mov edx, dword [ebp - 8]
add edx, 4
push edx
mov eax, dword [ebp - 8]
add eax, 8
push eax
mov ecx, dword [ebp - 8]
add ecx, 0xc
push ecx
mov ecx, dword [ebp - 8]
add ecx, 0x10
call fcn.10005370
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push edi
mov dword [ebp - 8], ecx
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x1000dcfe
inc ebx
push edi
je 0x1000dd57
pop eax
mov eax, dword [ebp - 8]
add eax, 0x124
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
mov ecx, dword [ebp - 8]
add ecx, 0x124
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
add eax, dword [eax]
add byte [eax], al
inc ebx
push edi
je 0x1000ddb7
mov eax, dword [ebp - 0x1c]
mov dword [eax + 8], 0
mov dword [ebp - 4], 1
mov dword [ebp - 8], 0
push 0
push 0x80
push 3
push 0
push 1
push connect
mov ecx, dword [ebp - 0x1c]
add ecx, 0x124
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x1000de10
push 0
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 0x1c]
cmp dword [edx + 8], 0
je 0x1000ddf7
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 8]
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], 0
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 8]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1c]
add eax, 0x124
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x10
call fcn.10005130
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
je 0x1000de48
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000dd40
Capabilities:
Delete file
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov dword [ebp - 0x1c], ecx
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x1000dd5e
pop eax

Function at 0x1000e6c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x1000e6de
inc ebx
push edi
je 0x1000e737
pop eax
mov eax, dword [ebp + 8]
push eax
push 0x1f46
mov ecx, dword [ebp - 0xc]
add ecx, 0xb4
call fcn.10004b20
test eax, eax
je 0x1000e715
mov ecx, dword [ebp + 8]
push ecx
push 0x1f53
mov ecx, dword [ebp - 0xc]
add ecx, 0x1c8
call fcn.10004b20
test eax, eax
jne 0x1000e719
xor eax, eax
jmp 0x1000e782
mov edx, dword [ebp - 0xc]
push edx
push 0
push 0x1000e1a0
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0x1000e460
call dword [sym.imp.MSVCRT.dll__beginthread]
adc bh, bh
adc eax, sym.imp.MSVCRT.dll__beginthread
add esp, 0xc
mov dword [ebp - 8], 0
xor ecx, ecx
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x2dc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x2e0]
mov dword [ebp - 4], edx
push 0xffffffffffffffff
push 1
lea eax, [ebp - 8]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1000f390
Capabilities:
Get socket status
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push ebx
push esi
push edi
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x1000f3ae
inc ebx
push edi
je 0x1000f407
pop eax
mov dword [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x100]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x10c], 0
xor eax, eax
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x10c], 0x493e0
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x110], 0
push 0x1000
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x11c], eax
mov ecx, dword [ebp - 0x11c]
mov dword [ebp - 0x114], ecx
in al, 0xfe
invalid
mov edx, 1
test edx, edx
je 0x1000f516
mov dword [ebp - 0x104], 0
mov dword [ebp - 0x118], 0
jmp 0x1000f449
mov eax, dword [ebp - 0x118]
add eax, 1
mov dword [ebp - 0x118], eax
mov ecx, dword [ebp - 0x118]
cmp ecx, dword [ebp - 0x104]
jae 0x1000f46d
mov edx, dword [ebp - 0x118]
mov eax, dword [ebp + edx*4 - 0x100]
cmp eax, dword [ebp + 8]
jne 0x1000f46b
jmp 0x1000f46d
jmp 0x1000f43a
mov ecx, dword [ebp - 0x118]
cmp ecx, dword [ebp - 0x104]
jne 0x1000f4a3
cmp dword [ebp - 0x104], 0x40
jae 0x1000f4a3
mov edx, dword [ebp - 0x118]
mov eax, dword [ebp + 8]
mov dword [ebp + edx*4 - 0x100], eax
mov ecx, dword [ebp - 0x104]
add ecx, 1
mov dword [ebp - 0x104], ecx
xor edx, edx
test edx, edx
jne 0x1000f42e
lea eax, [ebp - 0x10c]
push eax
push 0
push 0
lea ecx, [ebp - 0x104]
push ecx
mov edx, dword [ebp + 8]
add edx, 1
push edx
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jg 0x1000f4ce
jmp 0x1000f516
push 0
push 0xfff
mov eax, dword [ebp - 0x114]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
jg 0x1000f4f7
jmp 0x1000f516
push 0
mov edx, dword [ebp - 0x110]
push edx
mov eax, dword [ebp - 0x114]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.WS2_32.dll_send]
jmp 0x1000f417
mov edx, dword [ebp - 0x114]
mov dword [ebp - 0x120], edx
mov eax, dword [ebp - 0x120]
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10010320
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x1001033c
inc ebx
push edi
je 0x10010395
pop eax
mov edi, dword [ebp - 4]
add edi, 8
mov ecx, 0x18
mov esi, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov edx, dword [ebp - 4]
push edx
push 0
push 0x10010230
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
add eax, dword [eax]
add byte [eax], al
inc ebx
push edi
je 0x100103f5
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
sar dword [ecx + eax], 0
add al, ch
loope 0x10010430
invalid
inc ebp
invalid