joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006915
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1002a180]
sub esp, 0x20
push esi
mov esi, dword [ebp + 8]
add esi, esi
push dword [eax + esi*8]
lea eax, [ebp - 0x20]
push str.p_08x
push 0x20
push eax
call fcn.100147fe
lea eax, [ebp - 0x20]
push eax
call fcn.1001b3e6
add esp, 0x14
test eax, eax
je 0x10006981
mov eax, dword [0x1002a180]
push 0x2710
push dword [eax + esi*8 + 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10006977
cmp eax, 0x102
mov eax, dword [0x1002a180]
push 1
push dword [eax + esi*8 + 8]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [0x1002a180]
and dword [eax + esi*8 + 4], 0
xor eax, eax
pop esi
leave
ret

Function at 0x10007591
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
push esi
jne 0x10007603
call fcn.10014560
push str.IJcdwzcx
xor esi, esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
test eax, eax
je 0x100075c5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x100075c5
xor eax, eax
jmp 0x10007606
push 3
call fcn.100154e7
pop ecx
test eax, eax
js 0x100075c1
push esi
push dword [ebp + 0x10]
push esi
push dword [ebp + 8]
call fcn.1001ac50
add esp, 0x10
call fcn.10015880
call fcn.100178b0
lea eax, [ebp + 0xc]
push eax
push esi
push esi
push 0x100073ef
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x10028d20], eax
xor eax, eax
inc eax
pop esi
pop ebp
ret 0xc
Function at 0x10007b3f
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x51c
push esi
push edi
push dword [0x1002a630]
lea eax, [ebp - 0x21c]
xor esi, esi
push 0xfe
push eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
call fcn.100147fe
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x21c]
push eax
mov edi, reloc.WS2_32.dll_bind
push edi
call dword [0x1002a2c0]
test eax, eax
je 0x10007b95
or eax, 0xffffffff
jmp 0x10007d4e
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x10007bbb
push 0xfffffffffffffffe
pop eax
jmp 0x10007d4e
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xc], esi
je 0x10007d45
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x31c]
push eax
mov eax, dword [ebp - 0xc]
dec eax
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x18], 0xff
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x10007d3c
push esi
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0x100
lea eax, [ebp - 0x11c]
push eax
push 0x1001d318
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], esi
call fcn.1001693c
push esi
push str.Publisher
lea eax, [ebp - 0x11c]
push eax
push edi
call fcn.1001b420
push esi
mov dword [ebp - 8], eax
push str.DisplayName
lea eax, [ebp - 0x11c]
push eax
push edi
call fcn.1001b420
add esp, 0x38
mov dword [ebp - 4], eax
cmp dword [ebp - 8], esi
je 0x10007cb2
cmp eax, esi
je 0x10007cb2
push str.Microsoft
push dword [ebp - 8]
call fcn.10014904
pop ecx
pop ecx
test eax, eax
je 0x10007cb2
push str.Update
push dword [ebp - 4]
call fcn.100167aa
pop ecx
pop ecx
test eax, eax
jne 0x10007c96
push str.Hotfix
push dword [ebp - 4]
call fcn.100167aa
pop ecx
pop ecx
test eax, eax
je 0x10007cb2
lea eax, [ebp - 8]
push esi
push eax
call fcn.100145b0
lea eax, [ebp - 4]
push esi
push eax
call fcn.100145b0
add esp, 0x10
jmp 0x10007d3c
push esi
push str.DisplayVersion
lea eax, [ebp - 0x11c]
push eax
push edi
call fcn.1001b420
add esp, 0x10
mov dword [ebp - 0x14], eax
cmp dword [ebp - 4], esi
je 0x10007d0f
cmp eax, esi
jne 0x10007cd9
mov eax, 0x1001d2d2
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x51c]
push 0x1001d518
push 0x200
push eax
call fcn.100147fe
lea eax, [ebp - 0x51c]
push eax
push dword [ebp + 8]
call fcn.10017b20
lea eax, [ebp - 4]
push esi
push eax
call fcn.100145b0
add esp, 0x24
cmp dword [ebp - 0x14], esi
je 0x10007d20
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.100145b0
pop ecx
pop ecx
cmp dword [ebp - 8], esi
je 0x10007d31
lea eax, [ebp - 8]
push esi
push eax
call fcn.100145b0
pop ecx
pop ecx
push esi
call ebx
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
dec dword [ebp - 0xc]
jne 0x10007bcb
push dword [ebp - 0x10]
call ebx
xor eax, eax
inc eax
pop ebx
pop edi
pop esi
leave
ret
Function at 0x10007ef5
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
push 0x7530
push dword [0x10027c5c]
xor edi, edi
call fcn.10016ec0
pop ecx
pop ecx
test eax, eax
jns 0x10007f19
xor eax, eax
jmp 0x10008081
push ebx
mov dword [ebp - 4], edi
xor ebx, ebx
mov eax, dword [0x10027c58]
mov eax, dword [ebx + eax]
cmp eax, edi
je 0x10007f46
push eax
call fcn.10007e2d
pop ecx
test eax, eax
jne 0x10007f50
mov eax, dword [0x10027c58]
add eax, ebx
push edi
push eax
call fcn.10007e47
pop ecx
pop ecx
mov eax, dword [0x10027c58]
cmp dword [ebx + eax], edi
je 0x10007f63
inc dword [ebp - 4]
add ebx, 0x20
cmp ebx, 0x1000
jb 0x10007f1f
jmp 0x10008072
push esi
mov esi, dword [ebp - 4]
shl esi, 5
cmp dword [ebp + 0xc], edi
je 0x10007fac
mov ebx, dword [ebp + 0x10]
push ebx
call fcn.10014580
pop ecx
mov ecx, dword [0x10027c58]
mov dword [esi + ecx + 0xc], eax
mov eax, dword [0x10027c58]
mov eax, dword [esi + eax + 0xc]
cmp eax, edi
je 0x10008071
push ebx
push dword [ebp + 0xc]
push eax
call fcn.10014290
mov eax, dword [0x10027c58]
add esp, 0xc
mov dword [esi + eax + 0x10], ebx
jmp 0x10007fb9
mov dword [esi + eax + 0xc], edi
mov eax, dword [0x10027c58]
mov dword [esi + eax + 0x10], edi
mov eax, dword [0x10027c58]
mov ecx, dword [ebp + 8]
mov dword [esi + eax + 8], ecx
mov eax, dword [0x10027c58]
mov ecx, dword [ebp + 0x14]
push 1
push edi
mov dword [esi + eax + 0x14], ecx
call fcn.10016ef9
pop ecx
pop ecx
mov ecx, dword [0x10027c58]
mov dword [esi + ecx + 0x1c], eax
mov eax, dword [0x10027c58]
add eax, esi
lea ecx, [eax + 4]
push ecx
push edi
push eax
push 0x10007ead
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [0x10027c58]
mov dword [esi + ecx], eax
mov eax, dword [0x10027c58]
mov ecx, dword [eax + esi]
cmp ecx, edi
jne 0x1000804b
push dword [eax + esi + 0x1c]
call dword [0x1002a22c]
mov eax, dword [0x10027c58]
lea ecx, [eax + esi + 0xc]
cmp dword [ecx], edi
je 0x10008037
push dword [eax + esi + 0x10]
push ecx
call fcn.100145b0
pop ecx
pop ecx
add esi, dword [0x10027c58]
push 0x20
push edi
push esi
call fcn.10014780
add esp, 0xc
jmp 0x10008071
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x10027c58]
push dword [esi + eax + 0x1c]
inc dword [0x10027c54]
call fcn.10016ee4
mov eax, dword [0x10027c58]
pop ecx
lea edi, [esi + eax]
pop esi
push dword [0x10027c5c]
call fcn.10016ee4
pop ecx
mov eax, edi
pop ebx
pop edi
leave
ret

Function at 0x10008084
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp esi, 0x7f
ja 0x100080d3
mov eax, dword [0x10027c58]
shl esi, 5
mov eax, dword [esi + eax]
test eax, eax
jne 0x100080a4
push 0xfffffffffffffffe
pop eax
jmp 0x100080d6
push eax
call fcn.10007e2d
pop ecx
test eax, eax
je 0x100080bf
mov eax, dword [0x10027c58]
push 0
push dword [esi + eax]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
add esi, dword [0x10027c58]
push 1
push esi
call fcn.10007e47
pop ecx
pop ecx
xor eax, eax
jmp 0x100080d6
or eax, 0xffffffff
pop esi
pop ebp
ret
Function at 0x100081fc
Capabilities:
Create directory
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
cmp dword [ebp + 8], ebx
jne 0x1000821b
or eax, 0xffffffff
jmp 0x100083e2
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp + 8]
call fcn.1001959c
add esp, 0xc
mov dword [ebp - 4], eax
cmp eax, ebx
jne 0x10008243
push 0xfffffffffffffffe
pop eax
jmp 0x100083e2
push esi
push edi
push ebx
push 0x1001d568
push 0x10029014
mov esi, 0x104
push esi
lea eax, [ebp - 0x10c]
push eax
mov edi, 0x1001d318
push edi
call fcn.1001693c
add esp, 0x18
push ebx
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push ebx
push 0x10028de4
lea eax, [ebp - 0x10c]
push eax
push esi
push eax
push edi
call fcn.1001693c
add esp, 0x18
push dword [0x1002a590]
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x10c]
push eax
call fcn.1001985f
pop ecx
test eax, eax
je 0x1000830c
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1000830c
push 0x77359400
push 0x64
push 0x10029240
call fcn.100157fe
push eax
lea eax, [ebp - 0x10c]
push eax
push str._s._u
lea eax, [ebp - 0x210]
push 0x103
push eax
call fcn.100147fe
add esp, 0x20
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
call fcn.1001bd45
cmp eax, 1
lea eax, [ebp - 0x10c]
jne 0x1000834d
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.1001bc34
add esp, 0xc
test eax, eax
jns 0x10008364
push dword [ebp - 8]
lea eax, [ebp - 0x10c]
push dword [ebp - 4]
push eax
call fcn.10019401
add esp, 0xc
test eax, eax
jns 0x10008364
push 0xfffffffffffffffc
pop edi
jmp 0x100083ba
push dword [ebp - 8]
push dword [ebp - 4]
push eax
call fcn.10019401
add esp, 0xc
test eax, eax
jns 0x10008364
push 0xfffffffffffffffb
jmp 0x1000834a
lea eax, [ebp - 0x10c]
push eax
call fcn.1001a030
pop ecx
test eax, eax
jne 0x10008379
push 0xfffffffffffffffa
jmp 0x1000834a
mov edi, 0x10028f10
lea eax, [ebp - 0x10c]
push edi
push eax
call fcn.10019713
pop ecx
pop ecx
test eax, eax
jns 0x10008395
push 0xfffffffffffffff9
jmp 0x1000834a
push edi
call fcn.10019828
push edi
call fcn.1001a030
pop ecx
pop ecx
test eax, eax
jne 0x100083ab
push 0xfffffffffffffff8
jmp 0x1000834a
call fcn.100081a6
test eax, eax
jns 0x100083b8
push 0xfffffffffffffff7
jmp 0x1000834a
xor edi, edi
cmp dword [ebp - 4], ebx
je 0x100083cd
push dword [ebp - 8]
lea eax, [ebp - 4]
push eax
call fcn.100145b0
pop ecx
pop ecx
push esi
lea eax, [ebp - 0x10c]
push ebx
push eax
call fcn.10014780
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100083e5
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
push ebx
xor ebx, ebx
cmp dword [ebp + 8], 1
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ebx
je 0x10008414
cmp dword [ebp + 8], 2
je 0x10008414
or eax, 0xffffffff
jmp 0x10008557
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [ebp - 0x14]
push ecx
push eax
push dword [ebp + 0xc]
call fcn.1001959c
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp eax, ebx
jne 0x1000843c
push 0xfffffffffffffffe
pop eax
jmp 0x10008557
push esi
push edi
push dword [ebp + 8]
lea edi, [ebp - 0x54]
call fcn.1000811f
push ebx
push 0x1001d568
push 0x10029014
mov edi, 0x104
push edi
lea eax, [ebp - 0x158]
push eax
mov esi, 0x1001d318
push esi
call fcn.1001693c
add esp, 0x1c
push ebx
lea eax, [ebp - 0x158]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push ebx
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x158]
push eax
push edi
push eax
push esi
call fcn.1001693c
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call fcn.1001bda1
mov esi, eax
add esp, 0x24
cmp esi, ebx
jg 0x100084b2
mov dword [ebp - 4], 0xfffffffd
jmp 0x10008504
push 2
push 0x10028de4
lea eax, [ebp - 0x158]
push 2
push eax
call fcn.1001756d
add esp, 0x10
mov dword [ebp - 0xc], eax
cmp eax, ebx
jne 0x100084da
mov dword [ebp - 4], 0xfffffffc
jmp 0x10008504
push esi
push dword [ebp - 8]
push eax
call fcn.100170fd
add esp, 0xc
test eax, eax
jns 0x100084f4
mov dword [ebp - 4], 0xfffffffb
jmp 0x10008504
call fcn.100081a6
test eax, eax
jns 0x10008504
mov dword [ebp - 4], 0xfffffffa
push dword [ebp - 0x14]
lea eax, [ebp - 0x10]
push eax
call fcn.100145b0
pop ecx
pop ecx
cmp esi, ebx
jg 0x10008518
xor esi, esi
lea eax, [ebp - 8]
push esi
push eax
call fcn.100145b0
pop ecx
pop ecx
cmp dword [ebp - 0xc], ebx
je 0x10008535
lea eax, [ebp - 0xc]
push ebx
push eax
call fcn.100176b0
pop ecx
pop ecx
push edi
lea eax, [ebp - 0x158]
push ebx
push eax
call fcn.10014780
push 0x40
lea eax, [ebp - 0x54]
push ebx
push eax
call fcn.10014780
mov eax, dword [ebp - 4]
add esp, 0x18
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10008f62
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x814
and dword [ebp - 4], 0
push 0x10029240
push 0xa
lea eax, [ebp - 0x14]
push 6
push eax
call fcn.100166e0
lea eax, [ebp - 0x14]
push eax
call fcn.100168cc
add esp, 0x14
mov dword [ebp - 4], eax
test eax, eax
jne 0x10008f99
push 0xa
pop eax
leave
ret
push esi
push dword [ebp + 0x10]
mov esi, 0x1ff
push dword [ebp + 0xc]
lea eax, [ebp - 0x814]
push 0x1001d5d0
push esi
push eax
call fcn.1001483e
push dword [ebp + 0x18]
lea eax, [ebp - 0x814]
push dword [ebp + 0x14]
push eax
call fcn.10008d55
add esp, 0x20
test eax, eax
je 0x10008fd8
push 2
pop esi
jmp 0x10009073
push dword [ebp - 4]
lea eax, [ebp - 0x814]
push eax
push str._s_s.exe
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.1001483e
lea eax, [ebp - 0x414]
push eax
push dword [edi + 0x628]
call fcn.1001bbe8
add esp, 0x1c
test eax, eax
jns 0x10009011
push 3
jmp 0x10008fd2
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x414]
push eax
call fcn.10019877
pop ecx
test eax, eax
je 0x1000900d
lea eax, [ebp - 0x414]
push eax
push edi
call dword [edi + 0x624]
push dword [ebp - 4]
lea eax, [ebp - 0x414]
push dword [edi + 0x62c]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10008eb2
add esp, 0x1c
test eax, eax
jne 0x10009071
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 5
jmp 0x10008fd2
xor esi, esi
push 1
push 0
lea eax, [ebp - 0x814]
push eax
call dword [0x10027c8c]
lea eax, [ebp - 4]
push 0
push eax
call fcn.100145b0
pop ecx
pop ecx
mov eax, esi
pop esi
leave
ret
Function at 0x1000958f
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
push ebx
push esi
push edi
xor esi, esi
push 0x28
lea eax, [ebp - 0x30]
push esi
push eax
mov dword [ebp - 4], esi
call fcn.10014780
push 0x50
lea eax, [ebp - 0x80]
push esi
push eax
call fcn.10014780
mov eax, dword [ebp + 8]
mov ebx, dword [eax + 0x630]
add esp, 0x18
xor edi, edi
mov dword [ebp - 8], edi
lea esi, [ebp - 0x80]
test ebx, ebx
je 0x10009627
cmp dword [ebp + edi*4 - 0x30], 0
jne 0x1000961e
mov eax, dword [ebp + 8]
push 1
push dword [ebx + 4]
call dword [eax + 0x620]
pop ecx
pop ecx
test eax, eax
je 0x100095ef
mov ebx, dword [ebx]
jmp 0x10009622
mov eax, dword [ebp + 8]
mov dword [esi], eax
lea eax, [ebp - 8]
push eax
xor eax, eax
push eax
push esi
push 0x1000933b
push eax
push eax
mov dword [ebp + edi*8 - 0x7c], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x100096e2
inc dword [ebp - 4]
mov dword [ebp + edi*4 - 0x30], eax
mov ebx, dword [ebx]
inc edi
add esi, 8
cmp edi, 0xa
jb 0x100095cc
cmp dword [ebp - 4], 0
je 0x100096de
push 0x112a880
push 0
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov ecx, eax
cmp ecx, dword [ebp - 4]
jb 0x1000965e
cmp ecx, 0x80
jb 0x10009671
mov eax, dword [ebp - 4]
sub eax, 0xffffff80
cmp ecx, eax
jae 0x10009671
push 0xa
lea edi, [ebp - 0x80]
lea edx, [ebp - 0x30]
pop eax
call fcn.10009559
dec dword [ebp - 4]
jmp 0x100096cd
cmp ecx, 0x102
jne 0x100096e2
xor esi, esi
cmp dword [ebp - 4], esi
jbe 0x100096cd
push 1
push dword [ebp + esi*4 - 0x30]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + esi*8 - 0x7c]
push 4
push 0
push 0
push dword [eax + 4]
push edi
call dword [edi + 0x61c]
add esp, 0x14
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0xa
lea edi, [ebp - 0x80]
lea edx, [ebp - 0x30]
pop eax
mov ecx, esi
call fcn.10009559
dec dword [ebp - 4]
inc esi
cmp esi, dword [ebp - 4]
jb 0x10009680
test ebx, ebx
jne 0x100095c4
cmp dword [ebp - 4], ebx
ja 0x100095c4
xor eax, eax
jmp 0x100096e5
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10009745
Capabilities:
Get hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push edi
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x1c], ebx
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [0x10025180]
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
cmp dword [eax], ebx
jne 0x10009782
push ebx
push 0x10025180
call fcn.100164c6
pop ecx
pop ecx
test eax, eax
jns 0x10009782
xor eax, eax
jmp 0x100098c4
push 0x650
call fcn.10014580
pop ecx
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x1000977b
mov ecx, dword [ebp + 8]
push dword [ebp + 0x18]
mov dword [eax + 0x618], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 0x61c], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x10]
mov dword [eax + 0x620], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x14]
mov dword [eax + 0x624], ecx
call fcn.100168cc
pop ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x628], eax
cmp dword [ebp + 0x1c], ebx
je 0x100097f9
push dword [ebp + 0x1c]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x100097f9
push dword [ebp + 0x1c]
call fcn.100168cc
pop ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x62c], eax
jmp 0x10009802
mov eax, dword [ebp - 4]
mov dword [eax + 0x62c], ebx
mov eax, dword [ebp - 4]
lea ecx, [eax + 0x628]
cmp dword [ecx], ebx
jne 0x10009828
push ebx
push ecx
call fcn.100145b0
lea eax, [ebp - 4]
push ebx
push eax
call fcn.100145b0
add esp, 0x10
jmp 0x1000977b
push esi
lea ecx, [ebp - 8]
push ecx
add eax, 0x18
mov esi, 0x200
push eax
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
add eax, 0x218
push eax
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov eax, dword [ebp - 4]
add eax, 0x18
cmp eax, ebx
je 0x100098b7
lea ecx, [ebp - 0x1c]
push ecx
push 0x64
push eax
call dword [0x10027c84]
test eax, eax
jne 0x100098ab
cmp dword [ebp - 0x14], ebx
je 0x100098ab
push dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
call esi
mov ecx, eax
add ecx, ecx
mov eax, 0x1fe
cmp ecx, eax
ja 0x10009894
push dword [ebp - 0x14]
call esi
add eax, eax
push eax
mov eax, dword [ebp - 4]
push dword [ebp - 0x14]
add eax, 0x418
push eax
call fcn.10014290
add esp, 0xc
jmp 0x100098b7
mov ecx, dword [ebp - 4]
xor eax, eax
mov word [ecx + 0x418], ax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, dword [ebp - 4]
pop esi
pop edi
pop ebx
leave
ret
Function at 0x1000a1ca
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb2c
push esi
mov esi, 0x80
push esi
call fcn.10014580
pop ecx
mov dword [ebp - 8], eax
test eax, eax
je 0x1000a367
mov eax, dword [ebp + 8]
push ebx
push edi
inc eax
push esi
push eax
lea eax, [ebp - 0xa8]
push eax
call fcn.100148c4
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
add esp, 0xc
lea eax, [ebp - 0xa8]
push eax
call edi
push 3
pop ebx
xor edx, edx
mov ecx, ebx
mov esi, eax
div ecx
test edx, edx
jne 0x1000a224
xor ebx, ebx
jmp 0x1000a226
sub ebx, edx
push ebx
lea eax, [ebp + esi - 0xa8]
push 0x20
push eax
call fcn.10014780
add esi, ebx
push 0x1001d2d2
mov byte [ebp + esi - 0xa8], 0
call fcn.1001c739
add eax, dword [ebp + 0xc]
lea ecx, [ebp - 0xb2c]
push ecx
push eax
mov dword [ebp - 4], eax
call fcn.100156ca
push 0x14
lea eax, [ebp - 0xb2c]
push 1
push eax
call fcn.100157fe
mov ebx, eax
lea eax, [ebp - 0xb2c]
push eax
push ebx
lea eax, [ebp - 0x28]
push ebx
push eax
call fcn.10016745
add esp, 0x34
xor ecx, ecx
mov byte [ebp + ebx - 0x28], 0
test esi, esi
je 0x1000a2ac
xor edx, edx
mov eax, ecx
div ebx
mov al, byte [ebp + edx - 0x28]
xor al, byte [ebp + ecx - 0xa8]
inc ecx
mov byte [ebp + ecx - 0x169], al
cmp ecx, esi
jb 0x1000a28f
push 0x40
lea eax, [ebp - 0xe8]
push eax
lea eax, [ebp - 0x168]
push esi
push eax
mov byte [ebp + ecx - 0x168], 0
call fcn.100194f3
mov eax, dword [ebp - 4]
and al, 3
add esp, 0x10
cmp al, 1
jbe 0x1000a2db
add bl, 0x61
jmp 0x1000a2de
add bl, 0x41
mov esi, dword [ebp - 8]
lea eax, [ebp - 0xe8]
push eax
lea eax, [ebp - 0x28]
push eax
movsx eax, bl
push eax
push str.__c_s_s
push 0x7f
push esi
call fcn.100147fe
add esp, 0x18
push esi
xor ebx, ebx
call edi
xor ecx, ecx
inc ecx
cmp eax, ecx
jbe 0x1000a321
cmp byte [esi + ecx], 0x2b
jne 0x1000a316
mov byte [esi + ecx], 0x2d
movsx edx, byte [esi + ecx]
add ebx, edx
inc ecx
cmp ecx, eax
jb 0x1000a30c
mov eax, ebx
push 0x1a
cdq
pop ecx
idiv ecx
test byte [ebp - 4], 1
jne 0x1000a334
add edx, 0x61
jmp 0x1000a337
add edx, 0x41
movzx eax, dl
push eax
push 0x1001d608
push esi
call edi
push 0x7f
pop ecx
sub ecx, eax
push ecx
push esi
call edi
add eax, esi
push eax
call fcn.100147fe
add esp, 0x10
push str..php
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
pop edi
mov eax, esi
pop ebx
pop esi
leave
ret
Function at 0x1000aac8
Capabilities:
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
push 6
push 1
xor edi, edi
push 2
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call dword [sym.imp.WS2_32.dll_socket]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x1000aaee
xor eax, eax
jmp 0x1000ab60
push esi
mov esi, 0x1300
push esi
call fcn.10014580
pop ecx
mov dword [ebp - 4], eax
cmp eax, edi
je 0x1000ab2f
push edi
push edi
lea ecx, [ebp - 8]
push ecx
push esi
push eax
push edi
push edi
push 0x4004747f
push ebx
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
jne 0x1000ab2f
mov eax, dword [ebp - 8]
push 0x4c
xor edx, edx
pop ecx
div ecx
mov dword [0x10027cb8], eax
cmp eax, edi
jne 0x1000ab46
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
lea eax, [ebp - 4]
push esi
push eax
call fcn.100145b0
pop ecx
pop ecx
xor eax, eax
jmp 0x1000ab5f
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [ebp + 8]
cmp eax, edi
je 0x1000ab5c
mov ecx, dword [0x10027cb8]
mov dword [eax], ecx
mov eax, dword [ebp - 4]
pop esi
pop edi
pop ebx
leave
ret

Function at 0x1000af5c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x15
call fcn.10015c20
pop ecx
test eax, eax
jne 0x1000aff7
push esi
push edi
xor edi, edi
push 0x1271
mov dword [ebp - 4], edi
call fcn.10015612
push eax
mov dword [ebp - 4], eax
call fcn.10016e8a
mov esi, eax
lea eax, [ebp - 4]
push eax
call fcn.100156b9
add esp, 0xc
cmp esi, edi
je 0x1000aff5
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.10009a30
mov esi, eax
cmp esi, edi
jne 0x1000afc9
push 0x1001d4d4
push str.IP_address_is:__strong_
push str.http:__www.ip_adress.com
call fcn.100076e0
mov esi, eax
add esp, 0xc
cmp esi, edi
jbe 0x1000aff5
push 0xc
call fcn.10014580
pop ecx
cmp eax, edi
je 0x1000aff5
mov ecx, dword [ebp + 8]
push edi
push edi
push eax
push 0x1000aedc
mov dword [eax + 4], ecx
mov ecx, dword [ebp + 0xc]
push edi
push edi
mov dword [eax], esi
mov dword [eax + 8], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
leave
ret

Function at 0x1000aff9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 0xc]
call fcn.10014580
mov edi, eax
xor edx, edx
pop ecx
cmp edi, edx
jne 0x1000b012
xor eax, eax
jmp 0x1000b039
cmp dword [ebp + 0xc], edx
jbe 0x1000b037
push esi
mov esi, dword [ebp + 8]
sub esi, edi
mov eax, edx
and eax, 0xf
mov al, byte [eax + str._vqKepZ]
lea ecx, [edx + edi]
xor al, byte [esi + ecx]
inc edx
mov byte [ecx], al
cmp edx, dword [ebp + 0xc]
jb 0x1000b01d
pop esi
mov eax, edi
pop edi
pop ebp
ret