joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002725
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x270
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x264]
push ecx
add eax, 0xb0
push eax
mov dword [ebp - 0x268], 0x200
call sub.IPHLPAPI.DLL_ConvertInterfaceLuidToGuid
test eax, eax
jne 0x10027bb
push 0x27
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x264]
push eax
call sub.IPHLPAPI.DLL_ConvertGuidToStringW
test eax, eax
jne 0x10027bb
lea eax, [ebp - 0x26c]
push eax
push 1
push 1
lea eax, [ebp - 0x54]
push eax
call fcn.010025f2
test eax, eax
jne 0x10027bb
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x270]
push eax
push 0
push 0x10027cc
push dword [ebp - 0x26c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1002bba
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01002713
leave
ret 4
lea eax, [ebp - 0x254]
push eax
push 0x278e
call fcn.01001708
pop ecx
pop ecx
jmp 0x10027bb
Function at 0x100442d
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x78], eax
push esi
push edi
xor esi, esi
xor eax, eax
mov dword [ebp - 0x64], esi
lea edi, [ebp - 0x60]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov word [ebp - 0x70], ax
lea edi, [ebp - 0x6e]
stosd dword es:[edi], eax
mov dword [ebp - 0x68], esi
stosw word es:[edi], ax
mov dword [ebp - 0x74], esi
cmp ebx, esi
jne 0x1004476
mov ebx, 0x1003388
mov eax, ebx
lea edi, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x100447b
sub eax, edi
sar eax, 1
cmp eax, 0x100
jb 0x1004498
push 0x57
pop eax
jmp 0x10045f0
mov edi, edx
test edx, edx
je 0x10045c3
cmp dword [edi + 0x40], 0x18
je 0x10045b3
push dword [ebp - 0x78]
push dword [edi + 0x28]
call fcn.010036a0
test eax, eax
je 0x10045b3
inc dword [ebp - 0x74]
lea eax, [ebp - 0x64]
push eax
lea eax, [edi + 0xb0]
push eax
call sub.IPHLPAPI.DLL_ConvertInterfaceLuidToGuid
mov esi, eax
test esi, esi
jne 0x10045ee
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.ntdll.dll_RtlStringFromGUID]
test eax, eax
jl 0x10045ee
cmp word [ebp - 0x70], 0x50
jae 0x10045d5
movzx esi, word [ebp - 0x70]
push esi
push dword [ebp - 0x6c]
lea eax, [ebp - 0x54]
push eax
call sub.msvcrt.dll_memcpy
xor eax, eax
shr esi, 1
mov word [ebp + esi*2 - 0x54], ax
add esp, 0xc
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
lea eax, [ebp - 0x68]
push eax
push 2
push 3
lea eax, [ebp - 0x54]
push eax
call fcn.0100431a
mov esi, eax
test esi, esi
jne 0x10045e6
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1004544
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push ebx
push 1
push 0
push 0x100338c
push dword [ebp - 0x68]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x68]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x1004578
sub eax, ecx
sar eax, 1
push eax
push ebx
lea eax, [ebp - 0x54]
push eax
call sub.dhcpcsvc6.DLL_Dhcpv6SetUserClass
push dword [edi + 0x28]
mov esi, eax
test esi, esi
je 0x10045a7
push esi
push 0x2939
call fcn.01004732
jmp 0x10045b3
push 0x293a
call fcn.01001708
pop ecx
pop ecx
mov edi, dword [edi + 8]
test edi, edi
jne 0x10044a2
cmp dword [ebp - 0x74], edi
jne 0x10045ee
push 0x2908
call fcn.01001708
pop ecx
mov eax, 0x490
jmp 0x10045f0
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
mov eax, 0x54f
jmp 0x10045f0
push esi
push 0xe
call fcn.010047bd
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01002713
leave
ret 0xc
Function at 0x100464d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x270
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x264]
push ecx
add eax, 0xb0
push eax
mov dword [ebp - 0x268], 0x200
call sub.IPHLPAPI.DLL_ConvertInterfaceLuidToGuid
test eax, eax
jne 0x10046f2
push 0x27
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x264]
push eax
call sub.IPHLPAPI.DLL_ConvertGuidToStringW
test eax, eax
jne 0x10046f2
lea eax, [ebp - 0x26c]
push eax
push 1
push 3
lea eax, [ebp - 0x54]
push eax
call fcn.0100431a
test eax, eax
jne 0x10046f2
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x270]
push eax
push 0
push 0x100338c
push dword [ebp - 0x26c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10046f2
lea eax, [ebp - 0x254]
push eax
push 0x293f
call fcn.01001708
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01002713
leave
ret 4

Function at 0x1004e3d
Capabilities:
Resolve dns

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x1c], 0
push esi
push dword [ebp + 0xc]
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x18]
push eax
call fcn.0100551b
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
push 0x8010
push dword [ebp + 0xc]
push esi
call sub.DNSAPI.dll_DnsQuery_W
test eax, eax
je 0x1004ee9
cmp eax, 0x251d
jne 0x1004e90
lea eax, [ebp - 0x18]
push eax
push esi
push 0x295e
jmp 0x1004edd
cmp eax, 0x232a
jne 0x1004ea3
lea eax, [ebp - 0x18]
push eax
push esi
push 0x2964
jmp 0x1004edd
cmp eax, 0x5b4
jne 0x1004eb6
lea eax, [ebp - 0x18]
push eax
push esi
push 0x2963
jmp 0x1004edd
cmp eax, 0x232b
jne 0x1004ecc
push esi
push 0x295f
call fcn.01001708
pop ecx
pop ecx
jmp 0x1004ee5
cmp eax, 0x25e5
je 0x1004ee5
lea eax, [ebp - 0x18]
push eax
push esi
push 0x2960
call fcn.01001708
add esp, 0xc
xor eax, eax
jmp 0x1004f11
cmp dword [ebp - 0x1c], 0
je 0x1004f0e
push esi
push 0x2961
call fcn.01001708
pop ecx
pop ecx
push dword [ebp - 0x1c]
call fcn.01004e1c
push 1
push dword [ebp - 0x1c]
call sub.DNSAPI.dll_DnsFree
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.01002713
leave
ret 8

Function at 0x100513c
Capabilities:
Query service status

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 6
pop ecx
push 1
xor esi, esi
push 0x10051b4
xor eax, eax
mov dword [ebp - 0x20], esi
lea edi, [ebp - 0x1c]
push esi
mov dword [ebp - 4], esi
rep stosd dword es:[edi], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
cmp ebx, esi
je 0x10051a9
push 4
push dword [0x1007170]
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
cmp edi, esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
je 0x10051a6
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x10051a3
xor eax, eax
cmp dword [ebp - 0x1c], 4
sete al
mov dword [ebp - 4], eax
push edi
call esi
push ebx
call esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1005622
Capabilities:
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push 0x20
push 2
push eax
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x10], eax
cmp eax, ebx
je 0x1005693
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x1005681
mov dword [ebp - 0x10], ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [ebp - 0x10], ebx
je 0x1005693
mov al, 1
jmp 0x1005695
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.01002713
leave
ret 4

Function at 0x10056d1
Capabilities:
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 1
push 1
lea eax, [ebp - 0xc]
push eax
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 2
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x10], eax
cmp eax, ebx
je 0x1005740
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x100572e
mov dword [ebp - 0x10], ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [ebp - 0x10], ebx
je 0x1005740
mov al, 1
jmp 0x1005742
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.01002713
leave
ret
Function at 0x10002040
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp byte [eax + 0x1d4], 0
jne 0x10002071
mov eax, dword [eax + 0x190]
cmp eax, 0xffffffff
je 0x10002071
push 2
push 1
lea ecx, [ebp + 0xb]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x10002071
mov al, 1
pop ebp
ret
xor al, al
pop ebp
ret

Function at 0x10002710
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10065b70]
mov dword [ebp - 8], 0x4020
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 4
test eax, eax
jne 0x10002761
push 3
push 2
push eax
push 6
call fcn.100291a0
add esp, 0x10
test al, al
je 0x10002755
mov dword [0x10065b70], 2
mov esp, ebp
pop ebp
ret
mov dword [0x10065b70], 1
jmp 0x10002766
cmp eax, 2
je 0x100027a6
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0x1001
push 0xffff
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x1000278d
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jg 0x100027a6
push 4
lea eax, [ebp - 8]
push eax
push 0x1001
push 0xffff
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
mov esp, ebp
pop ebp
ret

Function at 0x10002880
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp + 8]
push 4
push eax
push 1
mov esi, dword [edi]
push 6
push dword [ebp + 0xc]
mov dword [ebp + 8], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x100028c8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
call fcn.100286e0
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.10023640
add esp, 0x14
pop edi
pop esi
pop ebp
ret
push str.TCP_NODELAY_set_n
push esi
call fcn.10023640
add esp, 8
pop edi
pop esi
pop ebp
ret
Function at 0x100029c0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1006512c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x8c], 2
mov ebx, dword [edi]
je 0x10002b9a
cmp byte [edi + 0x256], 0
push esi
jne 0x10002b90
cmp byte [edi + 0x272], 0
jne 0x10002b90
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x104]
mov dword [ebp - 0x108], 0x80
push eax
push esi
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x10002a58
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push edi
call fcn.100286e0
push eax
push esi
push str.getpeername___failed_with_errno__d:__s
push ebx
call fcn.10023590
add esp, 0x18
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100375f3
mov esp, ebp
pop ebp
ret
push 0x80
lea eax, [ebp - 0x84]
mov dword [ebp - 0x108], 0x80
push 0
push eax
call fcn.100385d0
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x84]
push eax
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x10002ac1
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push edi
call fcn.100286e0
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
push ebx
call fcn.10023590
add esp, 0x18
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100375f3
mov esp, ebp
pop ebp
ret
lea eax, [edi + 0x130]
push eax
lea esi, [edi + 0x102]
lea eax, [ebp - 0x104]
push esi
push eax
call fcn.100030a0
add esp, 0xc
test al, al
jne 0x10002b12
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push edi
call fcn.100286e0
push eax
push esi
push str.ssrem_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.10023590
add esp, 0x18
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100375f3
mov esp, ebp
pop ebp
ret
movups xmm0, xmmword [esi]
mov eax, dword [esi + 0x28]
movups xmmword [edi + 0x58], xmm0
movups xmm0, xmmword [esi + 0x10]
movups xmmword [edi + 0x68], xmm0
movq xmm0, qword [esi + 0x20]
movq qword [edi + 0x78], xmm0
mov dword [edi + 0x80], eax
mov ax, word [esi + 0x2c]
mov word [edi + 0x84], ax
lea eax, [edi + 0x164]
push eax
lea eax, [edi + 0x134]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.100030a0
add esp, 0xc
test al, al
jne 0x10002b90
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push edi
call fcn.100286e0
push eax
push esi
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.10023590
add esp, 0x18
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100375f3
mov esp, ebp
pop ebp
ret
push edi
call fcn.10002630
add esp, 4
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.100375f3
mov esp, ebp
pop ebp
ret
Function at 0x10003420
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1006512c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, dword [ebp + 0xc]
push 4
cmp byte [esi + 0x494], al
setne al
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 8
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x1000347d
push edi
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
push esi
call fcn.10023640
add esp, 0xc
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100375f3
mov esp, ebp
pop ebp
ret
push dword [esi + 0x498]
mov dword [ebp - 0x10], 1
call fcn.10035560
push dword [esi + 0x49c]
imul eax, eax, 0x3e8
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], eax
call fcn.10035560
add esp, 8
imul eax, eax, 0x3e8
push 0
push 0
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0xc
lea eax, [ebp - 0x10]
push eax
push 0x98000004
push edi
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x100034ed
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
push esi
call fcn.10023640
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100375f3
mov esp, ebp
pop ebp
ret
Function at 0x10004ee0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x14]
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [eax], ebx
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x1000505b
push edi
mov edi, dword [ebp - 8]
test edi, edi
je 0x10005047
push esi
nop dword [eax]
cmp dword [edi + 4], 2
jne 0x10004fd8
cmp dword [edi + 0x18], 0
je 0x10004fd8
mov eax, dword [edi + 0x10]
test eax, eax
je 0x10004fd8
cmp eax, 0x10
jb 0x10004fd8
push 0x20
call dword [0x10065008]
mov esi, eax
add esp, 4
test esi, esi
je 0x1000503c
mov eax, dword [edi]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
push 0x10
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 0x10
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x1c], 0
call dword [0x10065008]
add esp, 4
mov dword [esi + 0x18], eax
test eax, eax
je 0x1000502b
mov ecx, dword [edi + 0x18]
movups xmm0, xmmword [ecx]
movups xmmword [eax], xmm0
mov eax, dword [edi + 0x14]
test eax, eax
je 0x10004fc6
push eax
call dword [0x10065014]
add esp, 4
mov dword [esi + 0x14], eax
test eax, eax
je 0x10005011
mov eax, dword [ebp - 4]
test ebx, ebx
cmove ebx, esi
test eax, eax
je 0x10004fd5
mov dword [eax + 0x1c], esi
mov dword [ebp - 4], esi
mov edi, dword [edi + 0x1c]
test edi, edi
jne 0x10004f20
mov edi, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
pop esi
test eax, eax
je 0x10004ff5
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
test edi, edi
je 0x10005043
push ebx
call fcn.10004ea0
mov eax, dword [ebp + 0x14]
add esp, 4
xor ebx, ebx
mov dword [eax], ebx
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [esi + 0x18]
mov edi, 8
call dword [0x1006500c]
push esi
call dword [0x1006500c]
add esp, 8
jmp 0x10004fe6
push esi
mov edi, 8
call dword [0x1006500c]
add esp, 4
jmp 0x10004fe6
mov edi, 8
jmp 0x10004fe6
test ebx, ebx
jne 0x10005053
mov edi, 0x2af9
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10005280
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
test edi, edi
je 0x100052cd
push ebx
mov ebx, dword [ebp + 8]
mov cl, byte [esi + ebx]
mov dl, cl
mov al, cl
shr dl, 1
and al, 0xfe
not dl
movzx eax, al
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
or cl, 1
and dl, 2
movzx ecx, cl
cmove ecx, eax
mov byte [esi + ebx], cl
inc esi
cmp esi, edi
jb 0x10005292
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x10005d70
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push esi
push edi
mov byte [edi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [edi + esi - 1], 0
test eax, eax
jne 0x10005da3
push 0x2e
push edi
call fcn.10038cb0
add esp, 8
test eax, eax
je 0x10005da1
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
pop ebp
ret

Function at 0x10005f80
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [ebp + 0xc]
push edi
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x10005f90
sub esi, ecx
lea eax, [esi + esi]
push eax
mov dword [ebp - 0xc], eax
call dword [0x10065008]
mov edi, eax
add esp, 4
test edi, edi
jne 0x10005fb8
lea eax, [edi + 0x1b]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push esi
push dword [ebp + 0xc]
push edi
call fcn.10006220
add esp, 0xc
lea eax, [ebp - 8]
push 0xf0000000
push 1
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov esi, dword [ebp + 0x10]
test eax, eax
je 0x10006037
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x8002
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1000602c
push 0
push dword [ebp - 0xc]
mov dword [ebp - 0x10], 0x10
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0
lea eax, [ebp - 0x10]
push eax
push esi
push 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esi + 0x10], 0
push edi
mov byte [esi + 0x14], 0
call dword [0x1006500c]
add esp, 4
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10006290
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1006512c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x1c]
push edi
mov edi, dword [ebp + 0x10]
push 0xf0000000
push 1
push 0
push 0
push eax
mov dword [ebp - 0x20], 8
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x10006322
lea eax, [ebp - 0xc]
mov dword [ebp - 0x18], 0x208
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0x6601
push edi
movlpd qword [ebp - 0xc], xmm0
mov dword [ebp - 0x10], 8
call fcn.10006380
lea eax, [ebp - 0xc]
push 8
push eax
call fcn.10005280
add esp, 0x10
lea eax, [ebp - 0x24]
push eax
push 0
push 0
push 0x14
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x10006334
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100375f3
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
push dword [ebp - 0x20]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push eax
push esi
push 0
push 0
push 0
push dword [ebp - 0x24]
mov dword [esi], ecx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push 0
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.100375f3
mov esp, ebp
pop ebp
ret

Function at 0x10006e90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call fcn.10040630
add esp, 0x18
test eax, eax
je 0x10006eb2
cmp eax, 0xffffffff
jne 0x10006eb4
xor eax, eax
pop ebp
ret

Function at 0x10007a80
Capabilities:
Print debug messages

Disassembly:
push esi
push 0x10054c54
call fcn.10023fd0
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 4
push str.TRACE
call esi
push 0xc49
call fcn.100074e0
jmp 0x10007a91