joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100c3e40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10111728
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x10152034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x40], 0
je 0x100c3e80
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ecx + 0x45]
test edx, edx
jne 0x100c3e8c
mov al, 1
jmp 0x100c4031
mov dword [ebp - 0x54], 8
call fcn.10015b10
push eax
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x3c], eax
call fcn.10015b10
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.10015ae0
add esp, 8
movzx eax, al
test eax, eax
je 0x100c3ecf
xor al, al
jmp 0x100c4031
push 0
push 8
lea ecx, [ebp - 0x28]
call fcn.1002e570
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 0x58]
push edx
lea ecx, [ebp - 0x28]
call fcn.10007ce0
mov ecx, eax
call fcn.10007620
mov esi, eax
lea ecx, [ebp - 0x28]
call fcn.10001ca0
add esi, eax
push esi
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x28]
call fcn.10007ce0
mov ecx, eax
call fcn.10007620
push eax
mov ecx, dword [ebp - 0x2c]
add ecx, 0x48
push ecx
mov edx, dword [ebp - 0x2c]
mov ecx, dword [edx + 0x40]
call dword [sym.imp.MSVCP120.dll_public:_int___thiscall_std::codecvt_char__char__int_::unshift_int___char___char___char___const]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x100c3f4b
cmp dword [ebp - 0x38], 1
je 0x100c3f52
cmp dword [ebp - 0x38], 3
je 0x100c3fed
jmp 0x100c4005
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0x45], 0
lea ecx, [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x28]
call fcn.10007ce0
mov ecx, eax
call fcn.10007620
mov edx, dword [ebp - 0x44]
sub edx, eax
mov dword [ebp - 0x34], edx
je 0x100c3fb6
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x50]
push ecx
mov edx, dword [ebp - 0x34]
push edx
push 1
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x28]
call fcn.10007ce0
mov ecx, eax
call fcn.10007620
push eax
call dword [sym.imp.MSVCR120.dll_fwrite]
add esp, 0x10
cmp dword [ebp - 0x34], eax
je 0x100c3fb6
mov byte [ebp - 0x2f], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10008000
mov al, byte [ebp - 0x2f]
jmp 0x100c4031
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ecx + 0x45]
test edx, edx
jne 0x100c3fd9
mov byte [ebp - 0x30], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10008000
mov al, byte [ebp - 0x30]
jmp 0x100c4031
cmp dword [ebp - 0x34], 0
jne 0x100c3feb
push 0
push 8
lea ecx, [ebp - 0x28]
call fcn.100bfd20
jmp 0x100c401d
mov byte [ebp - 0x2e], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10008000
mov al, byte [ebp - 0x2e]
jmp 0x100c4031
mov byte [ebp - 0x2d], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10008000
mov al, byte [ebp - 0x2d]
jmp 0x100c4031
jmp 0x100c3ee2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1010a06b
mov esp, ebp
pop ebp
ret
Function at 0x100cbf30
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.MSVCR120.dll__vscwprintf]
add esp, 8
add eax, 1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
shl eax, 1
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100cbf9b
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.MSVCR120.dll_vswprintf_s]
add esp, 0x10
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
mov dword [ebp - 8], 0
mov esp, ebp
pop ebp
ret
Function at 0x100cc3d0
Capabilities:
Create pipe
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x10152034]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], ecx
xor eax, eax
mov dword [ebp - 0xc], eax
mov word [ebp - 8], ax
lea ecx, [ebp - 0x24]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
lea edx, [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x100cc417
xor eax, eax
jmp 0x100cc543
xor eax, eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x44], 3
mov dword [ebp - 0x40], 2
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 5
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x28], ecx
lea edx, [ebp - 0x20]
push edx
push 0
lea eax, [ebp - 0x44]
push eax
push 2
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclA]
mov dword [ebp - 0x54], eax
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0
jne 0x100cc482
xor eax, eax
jmp 0x100cc543
push 1
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
jne 0x100cc499
xor eax, eax
jmp 0x100cc543
push 0
mov eax, dword [ebp - 0x20]
push eax
push 1
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
jne 0x100cc4b6
xor eax, eax
jmp 0x100cc543
mov dword [ebp - 0x50], 0xc
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x48], 0
mov ecx, dword [ebp - 0x14]
add ecx, 0x64
call fcn.10001710
push eax
push str.CreatePileName:__ls
call fcn.100cbf30
add esp, 8
lea eax, [ebp - 0x50]
push eax
push 0
push 0x1000
push 0x1000
push 0xff
push 6
push 0x40000003
mov ecx, dword [ebp - 0x14]
add ecx, 0x64
call fcn.10001710
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x100cc540
mov ecx, dword [ebp - 0x1c]
push ecx
push str.hPipe__INVALID_HANDLE_VALUE:__d
call fcn.100cbf30
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1010a06b
mov esp, ebp
pop ebp
ret

Function at 0x100cdc00
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
call fcn.100cdbc0
cmp eax, 2
jne 0x100cdc1a
xor eax, eax
jmp 0x100cdc70
mov ecx, dword [ebp - 4]
call fcn.100cdbc0
cmp eax, 3
jne 0x100cdc2f
mov ecx, dword [ebp - 4]
call fcn.100cdc80
mov eax, dword [ebp - 4]
add eax, 8
push eax
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x100cdd70
push 0
push 0
call dword [sym.imp.MSVCR120.dll__beginthreadex]
add esp, 0x18
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x100cdc66
mov dword [ebp - 8], 1
jmp 0x100cdc6d
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x100cdcf0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x100cdd10
mov eax, 1
jmp 0x100cdd69
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100cdd39
push 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov dword [edx + 4], 0
cmp dword [ebp - 8], 0xffffffff
je 0x100cdd5f
mov dword [ebp - 0xc], 1
jmp 0x100cdd66
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x100cddb0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10111d48
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x10152034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x28]
call fcn.10007e50
mov dword [ebp - 4], 0
mov dword [ebp - 0x50], 0
push 0
lea eax, [ebp - 0x38]
push eax
push 4
lea ecx, [ebp - 0x2c]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x100cde2d
cmp dword [ebp - 0x38], 4
je 0x100cde2d
jmp 0x100cdeac
cmp dword [ebp - 0x2c], 0
je 0x100cdea4
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x100cde4b
jmp 0x100cdeac
mov ecx, dword [ebp - 0x2c]
push ecx
push 0
mov edx, dword [ebp - 0x30]
push edx
call sub.MSVCR120.dll_memset
add esp, 0xc
push 0
lea eax, [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0x30]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x100cde80
jmp 0x100cdeac
call fcn.10036f60
mov dword [ebp - 0x3c], eax
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x44], esp
mov edx, dword [ebp - 0x30]
push edx
call fcn.10007fa0
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x3c]
call fcn.100e97d0
xor eax, eax
jne 0x100cde06
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10008000
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1010a06b
mov esp, ebp
pop ebp
ret 4
Function at 0x100ce030
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10111d9c
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x10152034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
add ecx, 8
call fcn.1000c600
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.100ce490
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x28
call fcn.10013b80
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0x2c
call fcn.100cdf80
mov byte [ebp - 4], 3
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 0x10]
add ecx, 8
call fcn.1001abd0
mov ecx, dword [ebp - 0x10]
mov byte [ecx], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x100ce210
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], ecx
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 4
jl 0x100ce232
mov dword [ebp - 0xc], 4
jmp 0x100ce23d
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
shl edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0
jmp 0x100ce255
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 0x10]
jae 0x100ce28a
lea eax, [ebp - 0x14]
push eax
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x100ce330
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x18], eax
lea edx, [ebp - 0x18]
push edx
mov ecx, dword [ebp - 4]
add ecx, 8
call fcn.1000c660
jmp 0x100ce24c
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x100d2a90
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov byte [eax + 0x68], 0
mov ecx, 4
imul edx, ecx, 0
mov eax, dword [ebp - 4]
mov dword [eax + edx + 0x10], 0
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx + 0x10], 0
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx], 0x67452301
mov eax, 4
shl eax, 0
mov ecx, dword [ebp - 4]
mov dword [ecx + eax], 0xefcdab89
mov edx, 4
shl edx, 1
mov eax, dword [ebp - 4]
mov dword [eax + edx], 0x98badcfe
mov ecx, 4
imul edx, ecx, 3
mov eax, dword [ebp - 4]
mov dword [eax + edx], 0x10325476
mov esp, ebp
pop ebp
ret
Function at 0x100e5580
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
push eax
call fcn.10036ee0
mov ecx, eax
call fcn.100e4660
mov dword [ebp - 8], 0
lea ecx, [ebp - 8]
push ecx
push 0
mov edx, dword [ebp - 4]
push edx
push 0x100e5260
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x14], eax
mov esp, ebp
pop ebp
ret 4

Function at 0x100e9080
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], ecx
push str.start_websocket...
push 1
push 0xb7
push 0x10130358
push str.CClientWebsocket::Start
call fcn.100ff930
add esp, 0x14
movzx eax, byte [0x10157eb8]
test eax, eax
jne 0x100e90c1
mov ecx, dword [ebp - 4]
call fcn.100e9aa0
mov byte [0x10157eb8], 1
mov ecx, dword [ebp - 4]
mov byte [ecx + 0xc], 0
mov byte [0x101572a9], 0
mov byte [0x101572a8], 0
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edx, dword [ebp - 4]
mov dword [edx + 0xd0], eax
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xd4], eax
push 0
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov edx, dword [ebp - 4]
mov dword [edx + 0xdc], eax
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xe0], eax
mov dword [ebp - 8], 0
lea edx, [ebp - 8]
push edx
push 0
mov eax, dword [ebp - 4]
push eax
push 0x100e9ba0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x44], eax
mov dword [ebp - 0xc], 0
lea edx, [ebp - 0xc]
push edx
push 0
mov eax, dword [ebp - 4]
push eax
push 0x100e9f00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x48], eax
mov dword [ebp - 0x10], 0
lea edx, [ebp - 0x10]
push edx
push 0
mov eax, dword [ebp - 4]
push eax
push 0x100e8e70
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xe4], eax
mov dword [ebp - 0x14], 0
lea edx, [ebp - 0x14]
push edx
push 0
mov eax, dword [ebp - 4]
push eax
push 0x100e8fd0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xe8], eax
mov esp, ebp
pop ebp
ret
Function at 0x100e9aa0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov dword [ebp - 0xc], ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 4], eax
mov dword [ebp - 0x3c], 0
push 0x2c
push 0
lea eax, [ebp - 0x38]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0x3c], 0x30
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0x100e99c0
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x14], 0x10130494
mov dword [ebp - 0x18], 0
lea edx, [ebp - 0x3c]
push edx
call dword [sym.imp.USER32.dll_RegisterClassExW]
movzx eax, ax
test eax, eax
jne 0x100e9b2e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x101304b8
push 3
push 0x1e2
push 0x10130530
push 0x101304f8
call fcn.100ffcc0
add esp, 0x18
xor al, al
jmp 0x100e9b97
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0
push 0
push 0x64
push 0x64
push 0x64
push 0x64
push 0xcf0000
push str.CLIENTWEBSOCKET
push 0x101305a0
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x100e9b89
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateWindowEx_fail__code:__d_
push 3
push 0x1e9
push 0x101305e0
push str.CClientWebsocket::CreateWnd
call fcn.100ffcc0
add esp, 0x18
xor al, al
jmp 0x100e9b97
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x100ea0e0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x10152034]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 0xf
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0xffffffff
jne 0x100ea113
xor al, al
jmp 0x100ea1de
mov dword [ebp - 0x230], 0x22c
lea eax, [ebp - 0x230]
push eax
mov ecx, dword [ebp - 0x234]
push ecx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x100ea149
mov edx, dword [ebp - 0x234]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x100ea1de
mov ecx, dword [ebp + 8]
call fcn.10001710
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.MSVCR120.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x100ea1b3
mov ecx, dword [ebp - 0x228]
push ecx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
je 0x100ea1b3
push 0
mov edx, dword [ebp - 0x238]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0x238]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x234]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x100ea1de
lea edx, [ebp - 0x230]
push edx
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x100ea149
mov ecx, dword [ebp - 0x234]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1010a06b
mov esp, ebp
pop ebp
ret
Function at 0x100ed320
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [ebp - 1], 0
push 0x666
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x100ed34e
mov byte [ebp - 1], 1
push 0x3e8
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret
Function at 0x100fed20
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], ecx
mov eax, 1
test eax, eax
je 0x100fedc8
mov ecx, dword [ebp + 8]
push ecx
push str._DlpMonh_OpenPipeName_:_ls
call fcn.100cbf30
add esp, 8
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
cmp dword [edx], 0xffffffff
je 0x100fed6f
jmp 0x100fedc8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe7
je 0x100fed94
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreatePipeFile_GetLastError:_d
call fcn.100cbf30
add esp, 8
xor eax, eax
jmp 0x100fee09
push str.WaitNamedPipe_wcsPipeName__20000_
call fcn.100cbf30
add esp, 4
push 0x4e20
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
jne 0x100fedb8
xor eax, eax
jmp 0x100fee09
push str.CNamePipeClient_Initialize
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x100fed29
mov dword [ebp - 8], 2
push 0
push 0
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x100fee04
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetNamedPipeHandleState_GetLastError:_d
call fcn.100cbf30
add esp, 8
xor eax, eax
jmp 0x100fee09
mov eax, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x100fee10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], ecx
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x100fee40
xor eax, eax
jmp 0x100fee56
mov edx, dword [ebp + 0xc]
push edx
push str.CNamePipeClient_Send_size:_d
call fcn.100cbf30
add esp, 8
mov eax, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x100ff710
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10114fdb
mov eax, dword fs:[0]
push eax
sub esp, 0x138
mov eax, dword [0x10152034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x144]
push 0
push eax
call fcn.100ffdb0
add esp, 8
cmp byte [0x10156a96], 0
mov dword [ebp - 4], 0
je 0x100ff835
push 0x103
lea eax, [ebp - 0x113]
mov byte [ebp - 0x114], 0
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x114]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp dword [esi + 0x14], 0x10
jb 0x100ff7a0
mov ecx, dword [esi]
jmp 0x100ff7a2
mov ecx, esi
cmp dword [ebp - 0x130], 0x10
lea eax, [ebp - 0x144]
push ecx
cmovae eax, dword [ebp - 0x144]
push eax
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x12c]
push str.__d._d._s._s___s_n
push eax
call fcn.101003c0
add esp, 0x1c
lea eax, [ebp - 0x12c]
cmp dword [ebp - 0x118], 0x10
cmovae eax, dword [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [ebp - 0x118], 0x10
jb 0x100ff81a
push dword [ebp - 0x12c]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [ebp - 0x118], 0xf
mov dword [ebp - 0x11c], 0
mov byte [ebp - 0x12c], 0
mov eax, dword [0x10156a9c]
test eax, eax
jne 0x100ff865
push 0x18
call sub.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [0x10156a9c], eax
xorps xmm0, xmm0
movdqu xmmword [eax], xmm0
push eax
movq qword [eax + 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, dword [0x10156a9c]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call fcn.10105a30
lea ecx, [ebp - 0x144]
push ecx
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0x20]
call eax
test eax, eax
jne 0x100ff88f
push eax
push eax
call fcn.100ff370
add esp, 8
push dword [0x10156a9c]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.10105a30
cmp dword [esi + 0x10], 0
mov edi, eax
je case.default.0x100ff8bd
mov edx, dword [edi]
mov ecx, edi
mov edx, dword [edx + 0xc]
call edx
mov ecx, dword [ebp + 8]
cmp ecx, eax
jg case.default.0x100ff8bd
cmp ecx, 3
ja case.default.0x100ff8bd
jmp dword [ecx*4 + 0x100ff91c]
push esi
mov ecx, edi
call fcn.10105500
jmp case.default.0x100ff8bd
push esi
mov ecx, edi
call fcn.10105b00
jmp case.default.0x100ff8bd
push esi
mov ecx, edi
call fcn.10105fd0
jmp case.default.0x100ff8bd
push esi
mov ecx, edi
call fcn.10105840
cmp dword [ebp - 0x130], 0x10
jb 0x100ff901
push dword [ebp - 0x144]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1010a06b
mov esp, ebp
pop ebp
ret