joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10040e8
Capabilities:
Check mutex on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa70
mov eax, dword [0x1010b74]
push esi
mov esi, dword [ebp + 8]
push edi
push 0x10040ac
xor edi, edi
push edi
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
mov dword [0x1010fb8], eax
je 0x10041a2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1004192
call fcn.01009548
lea eax, [ebp - 0xa70]
push eax
push 0xa68
lea eax, [ebp - 0xa6c]
push eax
push 1
push 0xffffffffffffffff
push edi
call sub.WINSTA.dll_WinStationQueryInformationW
test al, al
je 0x1004192
test byte [ebp - 0x9ec], 4
jne 0x100415d
call fcn.01008fb8
test byte [ebp - 0x9ec], 1
jne 0x100416e
push esi
call fcn.01003d94
jmp 0x100417d
test byte [ebp - 0x9ec], 4
jne 0x100418d
push esi
call fcn.01007588
test byte [ebp - 0x9ec], 4
mov edi, eax
jne 0x100418d
call fcn.010073f6
call fcn.01009556
mov eax, dword [0x1010fb8]
test eax, eax
je 0x10041a2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
call fcn.010090ab
leave
ret 0x10
Function at 0x1005d8a
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1019ea8]
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 0xc]
inc esi
test eax, eax
mov dword [ebp + 0xc], eax
jne 0x1005dae
xor esi, esi
jmp 0x1005e0e
xor eax, eax
cmp edi, eax
je 0x1005e0e
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 8]
push eax
push edi
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
test esi, esi
jne 0x1005dfc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x1005df8
push 1
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov esi, eax
test esi, esi
je 0x1005e04
sub edi, dword [ebp + 8]
add ebx, dword [ebp + 8]
jmp 0x1005e0a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
jne 0x1005dae
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x1005ed0
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [0x1019ea8]
push ebx
push edi
xor edi, edi
xor ebx, ebx
cmp ecx, edi
je 0x1005fa0
cmp dword [ebp + 0x10], edi
je 0x1005fa9
mov eax, dword [0x1019eac]
cmp eax, edi
push esi
jne 0x1005f5f
mov eax, dword [ebp + 0x18]
push 0x1011820
push 0x1019eac
push 0x640
push 0x1019860
push ecx
mov dword [0x1011830], eax
mov dword [0x1011828], edi
mov dword [0x101182c], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call esi
cmp eax, 0x3e5
jne 0x1005f40
xor edi, edi
jmp 0x1005f9f
test edi, edi
jne 0x1005f4e
call esi
and dword [0x1019eac], edi
jmp 0x1005f98
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [0x1019eac]
test eax, eax
je 0x1005f98
mov ebx, dword [ebp + 0xc]
cmp eax, ebx
jae 0x1005f68
mov ebx, eax
mov esi, dword [0x1019eb0]
mov edi, dword [ebp + 8]
mov ecx, ebx
mov eax, ecx
shr ecx, 2
lea esi, [esi + 0x1019860]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
add dword [0x1019eb0], ebx
sub dword [0x1019eac], ebx
push 1
pop edi
jne 0x1005f9f
and dword [0x1019eb0], 0
pop esi
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x1005fa9
mov dword [eax], ebx
mov eax, edi
pop edi
pop ebx
pop ebp
ret 0x14
Function at 0x100618c
Capabilities:
Create udp socket

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x904
mov eax, dword [0x1010b74]
mov dword [ebp - 4], eax
mov eax, dword [0x1010b50]
cmp eax, 0xffffffff
jne 0x10061d3
push 0
push 2
push 2
call dword [sym.imp.WSOCK32.dll_socket]
cmp eax, 0xffffffff
mov dword [0x1010b50], eax
jne 0x10061d3
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov eax, dword [0x1010b50]
cmp eax, 0xffffffff
je 0x1006292
and dword [ebp - 0x8fc], 0
lea ecx, [ebp - 0x900]
push ecx
lea ecx, [ebp - 0x8fc]
push ecx
push 0x2003
push pe_overlay
push eax
mov dword [ebp - 0x900], 4
call dword [sym.imp.WSOCK32.dll_getsockopt]
mov eax, dword [ebp - 0x8fc]
mov ecx, 0x8000
cmp eax, ecx
jb 0x1006214
mov eax, ecx
shr eax, 2
shl eax, 2
cmp eax, 0x80
mov dword [ebp - 0x8fc], eax
jae 0x1006230
and dword [0x1010b54], 0
jmp 0x100623d
cmp eax, dword [0x1010b54]
jae 0x100623d
mov dword [0x1010b54], eax
lea eax, [ebp - 0x904]
push eax
push 0x8f4
lea eax, [ebp - 0x8f8]
push eax
push 6
push 0xffffffffffffffff
push 0
call sub.WINSTA.dll_WinStationQueryInformationW
test al, al
je 0x100628c
cmp dword [ebp - 0x450], 2
movzx eax, byte [ebp - 0x454]
mov dword [0x1010b58], eax
jne 0x1006292
lea eax, [ebp - 0x44c]
push eax
call fcn.01005afc
cmp eax, 0xffffffff
je 0x1006292
mov dword [0x1019f30], eax
jmp 0x1006292
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
call fcn.010090ab
leave
ret
Function at 0x100641c
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1010b74]
or dword [ebp - 0x10], 0xffffffff
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
push 0x20019
xor edi, edi
push edi
push 0x10062c6
push 0x80000002
mov dword [ebp - 0xc], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10065aa
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 4
pop eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
push 0x100635e
push dword [ebp - 0xc]
call esi
test eax, eax
jne 0x100648b
mov eax, dword [ebp - 0x10]
mov dword [0x1010b44], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
push 0x100637a
push dword [ebp - 0xc]
call esi
test eax, eax
jne 0x10064ae
mov eax, dword [ebp - 0x10]
mov dword [0x1019efc], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
push 0x1006396
push dword [ebp - 0xc]
call esi
test eax, eax
jne 0x10064d1
mov eax, dword [ebp - 0x10]
mov dword [0x1019f00], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
push 0x10063b2
push dword [ebp - 0xc]
call esi
test eax, eax
jne 0x10064f4
mov eax, dword [ebp - 0x10]
mov dword [0x1019f04], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
push 0x10063d2
push dword [ebp - 0xc]
call esi
test eax, eax
jne 0x1006526
mov eax, dword [ebp - 0x10]
cmp eax, dword [0x1010b54]
jae 0x1006526
cmp eax, 0x80
jb 0x1006526
mov dword [0x1010b54], eax
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 0x14]
push eax
push edi
push 0x10063e6
push dword [ebp - 0xc]
mov dword [ebp - 8], edi
call esi
cmp eax, 0xea
jne 0x10065a9
cmp dword [ebp - 0x14], 3
jne 0x10065a9
mov eax, dword [0x1019f08]
cmp eax, edi
push ebx
mov ebx, dword [sym.imp.msvcrt.dll_free]
je 0x100655e
push eax
call ebx
pop ecx
push dword [ebp - 8]
call dword [sym.imp.msvcrt.dll_malloc]
cmp eax, edi
pop ecx
mov dword [0x1019f08], eax
je 0x10065a8
lea ecx, [ebp - 8]
push ecx
push eax
lea eax, [ebp - 0x14]
push eax
push edi
push 0x10063fe
push dword [ebp - 0xc]
call esi
test eax, eax
je 0x10065a0
push dword [0x1019f08]
call ebx
pop ecx
mov dword [0x1019f08], edi
mov dword [0x1019f0c], edi
jmp 0x10065a8
mov eax, dword [ebp - 8]
mov dword [0x1019f0c], eax
pop ebx
pop esi
cmp dword [ebp - 0xc], edi
pop edi
je 0x10065b9
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
call fcn.010090ab
leave
ret
Function at 0x1006e5c
Capabilities:
Send data
Send data on socket

Disassembly:
push 0x2c
push 0x1001af0
call fcn.010093a8
mov eax, dword [0x1010b74]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
and dword [ebp - 0x38], 0
cmp dword [0x1010b58], 2
jb 0x1006ea4
push dword [ebp + 0x10]
mov ecx, dword [0x1019f38]
shl ecx, 8
movzx edx, byte [ebp + 8]
add ecx, edx
push ecx
push eax
call fcn.01005c2e
test eax, eax
je 0x1006fae
and dword [ebp - 4], 0
mov eax, dword [0x1010b54]
add eax, 3
and eax, 0xfffffffc
call fcn.01009410
mov dword [ebp - 0x18], esp
mov ebx, esp
mov dword [ebp - 0x3c], ebx
jmp 0x1006ee1
or dword [ebp - 4], 0xffffffff
test ebx, ebx
je 0x1006fae
cmp dword [0x1010b58], 2
sbb al, al
and al, 0xf9
add al, 9
mov byte [ebx], al
mov ax, word [0x1019edc]
mov word [ebx + 6], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov word [ebx + 4], ax
mov eax, dword [0x1019f38]
shl eax, 8
movzx ecx, byte [ebp + 8]
add eax, ecx
mov dword [ebx + 8], eax
mov word [ebp - 0x2c], 2
mov ax, word [0x1019f2c]
mov word [ebp - 0x2a], ax
mov eax, dword [0x1019f30]
mov dword [ebp - 0x28], eax
jmp 0x1006fa1
mov ecx, dword [ebp + 0x10]
lea edx, [ecx + 0xc]
mov eax, dword [0x1010b54]
cmp edx, eax
jae 0x1006f51
mov eax, ecx
mov dword [ebp - 0x34], eax
jmp 0x1006f57
add eax, 0xfffffff4
mov dword [ebp - 0x34], eax
lea ecx, [eax + 8]
mov word [ebx + 2], cx
mov ecx, eax
mov esi, dword [ebp - 0x30]
lea edi, [ebx + 0xc]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea esi, [eax + 0xc]
push 0x10
lea eax, [ebp - 0x2c]
push eax
push 0
push esi
push ebx
push dword [0x1010b50]
call dword [sym.imp.WSOCK32.dll_sendto]
cmp eax, 0xffffffff
je 0x1006fc4
mov dword [0x1019f18], esi
mov eax, dword [ebp - 0x34]
sub dword [ebp + 0x10], eax
add dword [ebp - 0x30], eax
cmp dword [ebp + 0x10], 0
jne 0x1006f3b
mov dword [ebp - 0x38], 1
mov eax, dword [ebp - 0x38]
lea esp, [ebp - 0x48]
mov ecx, dword [ebp - 0x1c]
call fcn.010090ab
call fcn.010093e3
ret 0xc
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
jmp 0x1006fae
Function at 0x1006fd2
Capabilities:
Send data
Send data on socket

Disassembly:
push 0x44
push 0x1001b00
call fcn.010093a8
mov eax, dword [0x1010b74]
mov dword [ebp - 0x1c], eax
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x50], esi
and dword [ebp - 0x40], 0
and dword [ebp - 4], 0
mov eax, dword [0x1010b54]
add eax, 3
and eax, 0xfffffffc
call fcn.01009410
mov dword [ebp - 0x18], esp
mov ebx, esp
mov dword [ebp - 0x54], ebx
or dword [ebp - 4], 0xffffffff
jmp 0x1007038
test ebx, ebx
je 0x100718e
mov edi, dword [0x1010b54]
add edi, 0xfffffff5
mov dword [ebp - 0x44], edi
mov ecx, dword [ebp + 0x10]
mov eax, ecx
xor edx, edx
div edi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], esi
add esi, ecx
mov dword [ebp - 0x4c], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x48], eax
mov word [ebp - 0x2c], 2
mov ax, word [0x1019f2c]
mov word [ebp - 0x2a], ax
mov eax, dword [0x1019f30]
mov dword [ebp - 0x28], eax
xor edx, edx
cmp dword [ebp - 0x34], edx
je 0x1007106
mov byte [ebx], 0xa
mov al, byte [ebp + 8]
mov byte [ebx + 1], al
mov dword [ebp - 0x38], edx
jbe 0x1007106
jmp 0x100709e
mov edi, dword [ebp - 0x44]
mov edx, dword [ebp - 0x38]
lea eax, [ebx + 2]
lea ecx, [edi + 3]
mov dword [ebp - 0x3c], ecx
cmp edx, 0x80
jb 0x10070bd
mov ecx, edx
shr ecx, 8
or cl, 0x80
mov byte [eax], cl
inc eax
inc dword [ebp - 0x3c]
mov byte [eax], dl
mov ecx, edi
mov esi, dword [ebp - 0x30]
lea edi, [eax + 1]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x10
lea eax, [ebp - 0x2c]
push eax
push 0
push dword [ebp - 0x3c]
push ebx
push dword [0x1010b50]
call dword [sym.imp.WSOCK32.dll_sendto]
cmp eax, 0xffffffff
je 0x100716d
mov eax, dword [ebp - 0x44]
add dword [ebp - 0x30], eax
inc dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x34]
jb 0x1007098
mov esi, dword [ebp - 0x4c]
mov byte [ebx], 0xb
mov ax, word [ebp + 0x10]
mov word [ebx + 1], ax
mov ax, word [ebp - 0x48]
mov word [ebx + 3], ax
mov ax, word [0x1019edc]
mov word [ebx + 5], ax
mov eax, dword [0x1019f38]
shl eax, 8
movzx ecx, byte [ebp + 8]
add eax, ecx
mov dword [ebx + 7], eax
sub esi, dword [ebp - 0x30]
mov eax, esi
mov ecx, eax
mov esi, dword [ebp - 0x30]
lea edi, [ebx + 0xb]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x10
lea ecx, [ebp - 0x2c]
push ecx
push 0
add eax, 0xb
push eax
push ebx
push dword [0x1010b50]
call dword [sym.imp.WSOCK32.dll_sendto]
cmp eax, 0xffffffff
jne 0x1007175
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
jmp 0x100718e
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x34]
lea ecx, [ecx + eax*2]
lea eax, [eax + ecx + 0xb]
mov dword [0x1019f18], eax
mov dword [ebp - 0x40], 1
mov eax, dword [ebp - 0x40]
lea esp, [ebp - 0x60]
mov ecx, dword [ebp - 0x1c]
call fcn.010090ab
call fcn.010093e3
ret 0xc
Function at 0x1007692
Capabilities:
Send data
Send data on socket

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1010b74]
mov dword [ebp - 4], eax
mov byte [ebp - 0x1c], 6
mov word [ebp - 0x1a], 4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [0x1010b50]
and word [ebp - 0x16], 0
cmp edx, 0xffffffff
mov word [ebp - 0x18], ax
je 0x1007708
mov ecx, dword [0x1019f2c]
test ecx, ecx
je 0x1007708
mov eax, dword [0x1019f30]
test eax, eax
je 0x1007708
push 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 8
lea eax, [ebp - 0x1c]
push eax
push edx
mov word [ebp - 0x14], 2
mov word [ebp - 0x12], cx
call dword [sym.imp.WSOCK32.dll_sendto]
cmp eax, 0xffffffff
jne 0x100771d
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
jmp 0x100771d
push 8
lea eax, [ebp - 0x1c]
push eax
call fcn.01005d8a
test eax, eax
jne 0x100771d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
call fcn.010090ab
leave
ret

Function at 0x1007afa
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
cmp dword [0x1010b50], 0xffffffff
je 0x1007bad
push ebx
push esi
mov esi, 0x1011788
mov ebx, 0x10117a0
push edi
xor eax, eax
mov edi, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
xor edi, edi
push edi
push esi
push edi
push edi
mov dword [0x1011798], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 1
push 0x1019ea0
push dword [0x1010b50]
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [0x1019ea0], 0x80
mov dword [0x1019ea4], ebx
call dword [sym.imp.WS2_32.dll_WSARecvFrom]
cmp eax, edi
mov dword [ebp - 0xc], eax
jne 0x1007b97
mov ecx, dword [ebp + 0xc]
cmp ecx, edi
je 0x1007b79
mov eax, dword [ebp + 0x10]
cmp eax, edi
jne 0x1007ba3
cmp dword [ebp - 4], 4
jb 0x1007b1c
mov eax, dword [0x10117a0]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x18], 0x10117a4
call fcn.0100772c
cmp dword [ebp - 0xc], 0xffffffff
jne 0x1007b1c
jmp 0x1007baa
mov dword [ecx], ebx
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1007db0
Capabilities:
Send data
Send data on socket

Disassembly:
push 0x40
push 0x1001b10
call fcn.010093a8
mov eax, dword [0x1010b74]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x44], eax
xor edx, edx
mov dword [ebp - 0x38], edx
cmp eax, edx
je 0x1007f41
cmp dword [0x1010b50], 0xffffffff
je 0x1007f41
cmp dword [0x1019f2c], edx
je 0x1007f41
mov eax, dword [0x1010b54]
cmp eax, 8
jb 0x1007f41
cmp dword [0x1019f30], edx
je 0x1007f41
mov ecx, 0x400
cmp eax, ecx
mov dword [ebp - 0x34], eax
jb 0x1007e19
mov dword [ebp - 0x34], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x34]
add eax, 3
and eax, 0xfffffffc
call fcn.01009410
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [ebp - 0x50], esi
jmp 0x1007e53
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x1007f41
mov ebx, dword [ebp - 0x34]
push ebx
push esi
call fcn.010062a2
mov word [ebp - 0x2c], 2
mov ax, word [0x1019f2c]
mov word [ebp - 0x2a], ax
mov eax, dword [0x1019f30]
mov dword [ebp - 0x28], eax
mov byte [esi], 6
lea eax, [ebx - 4]
mov word [esi + 2], ax
mov word [esi + 6], 0x400
mov dword [ebp - 0x40], 0xa
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov word [esi + 4], ax
push 0x10
lea eax, [ebp - 0x2c]
push eax
push 0
push ebx
mov ebx, dword [sym.imp.WSOCK32.dll_sendto]
jmp 0x1007f87
and dword [ebp - 0x30], 0
and dword [ebp - 0x3c], 0
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x44]
call fcn.01007afa
cmp dword [ebp - 0x30], 0
jne 0x1007f10
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [0x1019ec4]
mov dword [ebp - 0x48], eax
push 0x3e8
push 0
lea eax, [ebp - 0x4c]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, 1
je 0x1007f41
cmp eax, 0x102
je 0x1007f71
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.01007bb6
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x1007eb8
cmp dword [ebp - 0x3c], 8
jne 0x1007eb8
cmp byte [eax], 6
jne 0x1007eb8
cmp word [eax + 2], 4
ja 0x1007eb8
cmp dword [ebp - 0x40], 0
je 0x1007f41
call edi
movzx eax, ax
mov ecx, dword [ebp - 0x30]
movzx ecx, word [ecx + 4]
sub eax, ecx
inc eax
mov dword [ebp - 0x38], eax
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x1007f5e
mov eax, dword [ebp - 0x30]
movzx eax, word [eax + 6]
add eax, 8
imul eax, eax, 0x3e8
xor edx, edx
div dword [ebp - 0x38]
inc eax
lea esp, [ebp - 0x5c]
mov ecx, dword [ebp - 0x1c]
call fcn.010090ab
call fcn.010093e3
ret 4
dec dword [ebp - 0x40]
je 0x1007f29
call edi
mov word [esi + 4], ax
push 0x10
lea eax, [ebp - 0x2c]
push eax
push 0
push dword [ebp - 0x34]
push esi
push dword [0x1010b50]
call ebx
cmp eax, 0xffffffff
jne 0x1007eb8
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
jmp 0x1007f41
Function at 0x1008fb8
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
xor esi, esi
inc ebx
cmp dword [0x1019f1c], esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 4], esi
mov dword [0x1010b3c], ebx
jne 0x1008ff5
push esi
push esi
push esi
push esi
call edi
cmp eax, esi
mov dword [0x1019f1c], eax
jne 0x1008ff5
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x100902b
cmp dword [0x1019f20], esi
jne 0x100900c
push esi
push esi
push esi
push esi
call edi
cmp eax, esi
mov dword [0x1019f20], eax
je 0x1008fed
lea eax, [ebp - 8]
push eax
push esi
push esi
push 0x100878e
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, esi
mov dword [0x1019f3c], eax
je 0x1008fed
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10091c3
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x1001b30
call fcn.010093a8
xor ebx, ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x1009200
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1009200
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x1009218
cmp eax, 0x20b
je 0x1009205
mov dword [ebp - 0x1c], ebx
jmp 0x100922c
cmp dword [ecx + 0x84], 0xe
jbe 0x1009200
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x1009226
cmp dword [ecx + 0x74], 0xe
jbe 0x1009200
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x1022214], 0xffffffff
or dword [0x1022218], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x1021f54]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x1021f50]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x102221c], eax
call fcn.01009480
cmp dword [0x1010b80], ebx
jne 0x1009287
push fcn.01009480
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.01009469
push 0x1010010
push 0x101000c
call sub.msvcrt.dll__initterm
mov eax, dword [0x1021f4c]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x1021f48]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x38], eax
push 0x1010008
push section..data
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
cmp byte [esi], 0x22
jne 0x100931d
inc esi
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, bl
je 0x10092f1
cmp al, 0x22
jne 0x10092e3
cmp byte [esi], 0x22
jne 0x10092fa
inc esi
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, bl
je 0x1009304
cmp al, 0x20
jbe 0x10092f6
mov dword [ebp - 0x54], ebx
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x54], 1
je 0x1009328
movzx eax, word [ebp - 0x50]
jmp 0x100932b
cmp byte [esi], 0x20
jbe 0x10092fa
inc esi
mov dword [ebp - 0x20], esi
jmp 0x100931d
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call main
mov esi, eax
mov dword [ebp - 0x3c], esi
cmp dword [ebp - 0x1c], ebx
jne 0x1009348
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x100937d
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.010093e3
ret
Function at 0x1009870
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor edx, edx
xor ecx, ecx
push esi
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0xc]
push edi
mov edi, eax
mov ebx, dword [esp + 0x14]
push ebp
mov cl, byte [esi + 0x100]
mov ebp, ebx
mov dl, byte [esi + 0x101]
test ebx, ebx
je 0x10099ab
shr ebx, 2
and eax, 3
test ebx, ebx
je 0x1009980
test eax, eax
jne 0x1009980
mov eax, edi
lea edi, [edi + ebx*4]
mov dword [esp + 0x1c], edi
sub eax, 4
mov ebp, ebx
mov edi, dword [eax + 4]
inc ecx
xor eax, eax
and ecx, 0xff
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
inc ecx
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
xor edi, eax
and ecx, 0xff
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
inc ecx
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
shl eax, 8
xor edi, eax
and ecx, 0xff
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
inc ecx
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
shl eax, 0x10
xor edi, eax
and ecx, 0xff
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
shl eax, 0x18
lea ebx, [ebp*4]
xor edi, eax
mov eax, dword [esp + 0x1c]
sub eax, ebx
mov dword [eax], edi
dec ebp
jne 0x10098c0
mov ebp, dword [esp + 0x18]
and ebp, 3
test ebp, ebp
je 0x10099ab
lea edi, [eax + 4]
inc ecx
mov ebx, 0xff
and ecx, ebx
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, ebx
xor ebx, ebx
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov byte [esi + edx], al
add al, bl
mov bl, byte [edi]
mov al, byte [esi + eax]
xor bl, al
mov byte [edi], bl
inc edi
dec ebp
jne 0x1009980
pop ebp
pop edi
lea eax, [esi + 0x100]
pop esi
mov byte [eax], cl
pop ebx
mov byte [eax + 1], dl
ret 0xc