joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x4031f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x403203
pop dword [ebp - 0x28]
mov eax, 0x84b764bb
add eax, 0x7b88cd48
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x5291c938
sub dword [ebp - 0x38], 0x43f83ed
mov dword [ebp - 0x34], 0x3f9ad8df
add dword [ebp - 0x34], 0xf2987366
mov dword [ebp - 0x30], 0x106c342f
add dword [ebp - 0x30], 0x3be00fff
mov dword [ebp - 0x2c], 0x21dbc611
add dword [ebp - 0x2c], 0xde2439ef
lea eax, [ebp - 0x38]
push eax
mov eax, 0x82e7ac1f
add eax, 0x7d58c445
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x35f68242
add dword [ebp - 0x38], 0x3e7be714
mov dword [ebp - 0x34], 0x881bdfcf
sub dword [ebp - 0x34], 0x46af7e5a
mov dword [ebp - 0x30], 0xde0cd5e0
sub dword [ebp - 0x30], 0x7a9d6974
mov dword [ebp - 0x2c], 0xfba3bc79
add dword [ebp - 0x2c], 0x45c4387
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x8f3c554d
sub eax, 0x8efbe4a5
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x36f8d
push 0
call eax
mov ecx, 0x41c93ca2
sub ecx, 0x41c8f31f
xor ebx, ebx
add ebx, eax
mov edi, 0x32698be2
sub edi, 0x32288be2
add edi, dword [ebp - 0x28]
mov edx, 0xe272ac7f
mov esi, dword [edi]
sub dword [ebp - 0x24], 0x294e7cc4
xor esi, edx
xor dword [ebp - 0x18], 0x88c75b9d
mov dword [ebx], esi
xor dword [ebp - 0x18], ebx
add ebx, 0x9ddb5190
sub ebx, 0x9ddb518c
add edi, 4
loop 0x403321
add eax, 0xe6e36cdd
sub eax, 0xe6e253fe
xor ebx, ebx
add ebx, eax
add eax, 0x9efb2686
sub eax, 0x9efb2681
mov ecx, 0x886b0e75
sub ecx, 0x882b0e75
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x1002f94
Capabilities:
Connect to http server
Parse url

Disassembly:
mov edi, edi
push esi
mov esi, ecx
mov dword [esi], 0x100149c
jmp 0x1002fba
mov eax, dword [esi + 8]
dec dword [esi + 4]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [edx], ecx
add eax, 0xfffffca0
mov dword [ecx + 4], edx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [esi + 4], 0
jne 0x1002f9f
lea ecx, [esi + 0x18]
pop esi
jmp fcn.01002c76

Function at 0x1003223
Capabilities:
Parse url

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
cmp edi, dword [esi + reloc.KERNEL32.dll_GetStartupInfoA]
jle 0x1003249
call fcn.01012aaf
cmp edi, reloc.KERNEL32.dll_GetStartupInfoA
ja 0x1003243
push edi
call fcn.01007902
pop ecx
mov dword [esi], eax
mov dword [esi + reloc.KERNEL32.dll_GetStartupInfoA], edi
mov eax, dword [esi]
pop edi
pop esi
pop ebp
ret 4

Function at 0x1003755
Capabilities:
Parse url

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
mov esi, ecx
push dword [ebp + 8]
and dword [esi], 0
and dword [esi + 4], 0
lea eax, [esi + 0x10]
mov dword [esi + 0xc], eax
mov dword [esi + 8], 0x80
call fcn.0100367a
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x1004f06
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
push esi
lea ecx, [ebp - 8]
call fcn.010029f5
and dword [ebp - 4], 0
cmp dword [esi + 0x18], 0
jne 0x1004eff
push 0x54
call fcn.01007902
test eax, eax
pop ecx
je 0x1004eef
lea ecx, [ebp - 4]
push ecx
mov ecx, eax
call fcn.01004e08
jmp 0x1004ef1
xor eax, eax
test eax, eax
mov dword [esi + 0x18], eax
jne 0x1004eff
mov esi, 0x8007000e
jmp 0x1004f16
mov ecx, esi
call fcn.01003044
cmp dword [ebp - 4], 0
jge 0x1004f13
mov ecx, esi
call fcn.0100306b
mov esi, dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
pop esi
leave
ret

Function at 0x100592f
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
lea ecx, [ebp - 4]
push ecx
push eax
push eax
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jge 0x1005951
xor eax, eax
jmp 0x100595a
xor eax, eax
cmp eax, dword [ebp - 4]
sbb eax, eax
neg eax
leave
ret 4

Function at 0x1006815
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [reloc.KERNEL32.dll_GetStartupInfoA]
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
cmp esi, edi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], edi
je 0x10067b4
lea eax, [ebp - 0x18]
push eax
push 0x10018f4
push 1
push edi
push 0x10018e4
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jge 0x10067b8
mov eax, dword [ebp - 0x18]
cmp eax, edi
je 0x10067b4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
jmp 0x1006827
cmp dword [esi], edi
push ebx
mov ebx, esi
je 0x1006817
cmp dword [ebp + 0x10], 0
mov esi, dword [ebx + 4]
mov eax, dword [ebp - 0x18]
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edx, [ebp - 0x14]
push edx
movsd dword es:[edi], dword [esi]
push 1
push dword [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
mov ecx, dword [eax]
push eax
je 0x1006802
cmp dword [ebx], 1
jne 0x10067e8
call dword [ecx + 0x14]
jmp 0x10067eb
call dword [ecx + 0x1c]
mov esi, eax
test esi, esi
jge 0x100680f
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x10067fe
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
jmp 0x1006826
cmp dword [ebx], 1
jne 0x100680c
call dword [ecx + 0x18]
jmp 0x100680f
call dword [ecx + 0x20]
add ebx, 8
cmp dword [ebx], 0
jne 0x10067bf
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1006824
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.01007613
leave
ret 0xc
Function at 0x100cb8c
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push edi
push 0x1001d50
call fcn.0100f4ab
mov edi, eax
test edi, edi
je 0x100cbba
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1001d3c
push edi
call esi
push 0x1001d28
push edi
mov dword [reloc.KERNEL32.dll_GetStartupInfoA], eax
call esi
cmp dword [reloc.KERNEL32.dll_GetStartupInfoA], 0
mov dword [reloc.KERNEL32.dll_GetStartupInfoA], eax
pop esi
je 0x100cbac
test eax, eax
jne 0x100cbba
and dword [reloc.KERNEL32.dll_GetStartupInfoA], 0
and dword [reloc.KERNEL32.dll_GetStartupInfoA], 0
mov dword [reloc.KERNEL32.dll_GetStartupInfoA], 1
pop edi
ret

Function at 0x100cbfd
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
xor edi, edi
cmp dword [reloc.KERNEL32.dll_GetStartupInfoA], edi
mov ebx, ecx
jne 0x100cbe7
call fcn.0100cb6a
mov ecx, ebx
call fcn.0100a574
mov esi, dword [ebp + 0xc]
cmp esi, edi
mov dword [ebx + 8], esi
mov dword [ebx + 4], esi
mov dword [ebx + 0xc], edi
je 0x100cc98
mov eax, dword [reloc.KERNEL32.dll_GetStartupInfoA]
cmp eax, edi
je 0x100cc58
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0x10]
push ecx
push 1
push edi
push edi
push edi
push 0x1001558
lea ecx, [ebp - 8]
push ecx
mov dword [ebp - 8], esi
call eax
test eax, eax
jne 0x100cc6c
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
jg 0x100cc3c
call edi
jmp 0x100cc48
call edi
and eax, 0xffff
or eax, 0x80070000
cmp eax, 0x80090010
je 0x100cc56
cmp eax, 0x80070725
jne 0x100cc9a
xor edi, edi
push esi
call fcn.01007902
cmp eax, edi
pop ecx
mov dword [ebx], eax
jne 0x100cc7d
mov eax, 0x8007000e
jmp 0x100cc9a
mov eax, dword [ebp - 0xc]
mov dword [ebx], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0xc], 1
jmp 0x100cc95
mov ecx, esi
mov esi, dword [ebp + 8]
mov edi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp + 0xc]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebx + 8], eax
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x100d1d2
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp esi, edi
mov dword [ebp - 8], edi
jne 0x100d0ed
push 0x57
pop eax
jmp 0x100d219
push ebx
lea eax, [ebp - 8]
push eax
mov dword [esi], edi
call fcn.0100d776
cmp eax, edi
mov dword [ebp - 4], eax
jne 0x100d1f6
cmp dword [ebp - 8], edi
jne 0x100d115
mov dword [ebp - 4], 1
jmp 0x100d1f6
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov ebx, eax
lea eax, [ebx + ebx + 0x1c]
push eax
call fcn.01007902
cmp eax, edi
pop ecx
mov dword [esi], eax
jne 0x100d13d
mov dword [ebp - 4], 0xe
jmp 0x100d1f6
lea edi, [eax + 0x14]
lea ecx, [edi + ebx]
mov dword [ebp - 0x10], ecx
push 1
add ecx, ebx
push eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 0xc], ecx
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
jne 0x100d164
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
push 2
push 8
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
jne 0x100d180
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x100d1f0
push 0
push dword [ebp - 0xc]
push 1
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x100d175
mov esi, dword [ebp - 8]
mov ecx, ebx
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp - 0x14]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorGroup]
test eax, eax
je 0x100d1e4
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 0x10]
mov ecx, ebx
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp - 0x10]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
test eax, eax
jne 0x100d1ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
cmp dword [ebp - 4], 0
je 0x100d206
mov eax, dword [esi]
test eax, eax
je 0x100d206
push eax
call fcn.010078f6
and dword [esi], 0
pop ecx
cmp dword [ebp - 8], 0
pop ebx
je 0x100d216
push dword [ebp - 8]
call fcn.010078f6
pop ecx
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 4
Function at 0x100f3e5
Capabilities:
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
call fcn.0100f387
test al, al
je 0x100f3c4
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateEventW]
jmp 0x100f40a
xor eax, eax
cmp dword [ebp + 0x14], eax
je 0x100f3fa
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
lea eax, [esi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01007910
mov edi, esp
push 0xffffffffffffffff
push esi
push dword [ebp + 0x14]
push edi
call fcn.0100dacc
neg eax
sbb eax, eax
and eax, edi
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateEventA]
lea esp, [ebp - 8]
pop edi
pop esi
pop ebp
ret 0x10

Function at 0x100f971
Capabilities:
Resolve dns

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
call fcn.0100f387
test al, al
je 0x100f8d1
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x100f9c5
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
xor esi, esi
cmp dword [ebp + 0xc], esi
je 0x100f90b
push dword [ebp + 0xc]
call edi
lea esi, [eax + eax + 2]
lea eax, [esi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01007910
mov ebx, esp
push 0xffffffffffffffff
push esi
push dword [ebp + 0xc]
push ebx
call fcn.0100dacc
mov esi, eax
neg esi
sbb esi, esi
and esi, ebx
mov eax, dword [ebp + 0x14]
cmp eax, 1
je 0x100f97d
cmp eax, 2
je 0x100f97d
cmp eax, 7
jne 0x100f974
mov ebx, dword [ebp + 0x18]
xor eax, eax
test ebx, ebx
jne 0x100f92a
xor ecx, ecx
jmp 0x100f96e
push ebx
call fcn.0100db5b
cmp eax, reloc.KERNEL32.dll_GetStartupInfoA
push ebx
jne 0x100f93b
call edi
inc eax
jmp 0x100f940
call fcn.0100db5b
lea edi, [eax + eax]
lea eax, [edi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01007910
mov dword [ebp + 0x18], esp
push ebx
call fcn.0100db5b
push eax
push edi
push ebx
push dword [ebp + 0x18]
call fcn.0100dacc
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, dword [ebp + 0x18]
push eax
push ecx
push 7
jmp 0x100f9b8
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push eax
jmp 0x100f9b8
xor ecx, ecx
xor eax, eax
cmp dword [ebp + 0x18], ecx
je 0x100f9b3
push dword [ebp + 0x18]
call edi
lea edi, [eax + eax + 2]
lea eax, [edi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01007910
mov ebx, esp
push 0xffffffffffffffff
push edi
push dword [ebp + 0x18]
push ebx
call fcn.0100dacc
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, ebx
push eax
push ecx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
Function at 0x1010069
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [esi + 0x34], eax
mov eax, dword [esi]
push edi
call dword [eax + 0x10]
test eax, eax
je 0x1010074
mov ecx, dword [esi + 0x30]
lea edx, [ebp + 8]
xor edi, edi
push edx
mov dword [ebp + 8], edi
mov eax, dword [ecx]
push edi
call dword [eax + 0xc]
mov ecx, dword [ebp + 8]
cmp ecx, edi
je 0x1010088
mov eax, dword [ecx]
push edi
push edi
push edi
push esi
call dword [eax + 0xc]
jmp 0x1010088
mov ecx, esi
call fcn.0100a986
test eax, eax
jl 0x1010088
push dword [esi + 0x44]
call dword [sym.imp.KERNEL32.dll_SetEvent]
pop edi
pop esi
pop ebp
ret 4

Function at 0x101142b
Capabilities:
Set socket configuration

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [ebp + 0x18]
mov esi, ecx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.0100b5d1
mov edi, dword [ebp + 0xc]
xor ebx, ebx
lea eax, [edi + edi*2 + 3]
push eax
mov dword [esi], 0x1002520
mov dword [esi + 8], 0x100240c
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
call fcn.01007902
cmp eax, ebx
pop ecx
mov dword [esi + 0x58], eax
je 0x101146f
push ebx
push ebx
lea ecx, [edi + edi*2 + 3]
push ecx
push eax
inc edi
push edi
push dword [ebp + 8]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x101146f
push dword [esi + 0x58]
call fcn.010078f6
pop ecx
mov dword [esi + 0x58], ebx
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x10118d4
Capabilities:
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [reloc.KERNEL32.dll_GetStartupInfoA]
push ebx
push 0x101b374
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor eax, eax
inc eax
xor ebx, ebx
cmp dword [reloc.KERNEL32.dll_GetStartupInfoA], ebx
mov dword [reloc.KERNEL32.dll_GetStartupInfoA], eax
je 0x10119a4
push esi
push edi
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x30]
push eax
push 0x20019
push ebx
push 0x1002468
push 0x80000002
call fcn.0100f825
test eax, eax
push 4
mov esi, 0xc8000006
pop edi
jne 0x10118c7
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x38]
push eax
push ebx
push 0x100243c
push dword [ebp - 0x30]
mov dword [ebp - 0x3c], edi
call fcn.0100f9d4
test eax, eax
jne 0x10118b9
cmp dword [ebp - 0x38], edi
jne 0x10118b9
cmp dword [ebp - 0x28], ebx
setne al
mov dword [ebp - 0x34], eax
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x34], ebx
je 0x10118f7
push ebx
push ebx
lea eax, [ebp - 0x2c]
push eax
push edi
push 0x101b4d4
push 0x10
push 0x101a26c
push esi
push dword [ebp + 8]
call dword [0x101b4ac]
cmp eax, reloc.KERNEL32.dll_GetStartupInfoA
mov dword [ebp - 0x28], eax
jne 0x10118fd
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov dword [ebp - 0x28], eax
jmp 0x10118fd
mov dword [reloc.KERNEL32.dll_GetStartupInfoA], ebx
push ebx
push ebx
lea eax, [ebp - 0x2c]
push eax
push edi
push 0x101b4cc
push 0x10
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp + 8]
mov dword [ebp - 0x14], 0xb5367df1
mov word [ebp - 0x10], 0xcbac
mov word [ebp - 0xe], 0x11cf
mov byte [ebp - 0xc], 0x95
mov byte [ebp - 0xb], 0xca
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], 0x80
mov byte [ebp - 8], 0x5f
mov byte [ebp - 7], 0x48
mov byte [ebp - 6], 0xa1
mov byte [ebp - 5], 0x92
call dword [0x101b4ac]
push ebx
push ebx
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x2c]
push eax
push edi
push 0x101b4d0
push 0x10
lea eax, [ebp - 0x24]
push eax
push esi
push dword [ebp + 8]
mov dword [ebp - 0x24], 0xb5367df2
mov word [ebp - 0x20], 0xcbac
mov word [ebp - 0x1e], 0x11cf
mov byte [ebp - 0x1c], 0x95
mov byte [ebp - 0x1b], 0xca
mov byte [ebp - 0x1a], bl
mov byte [ebp - 0x19], 0x80
mov byte [ebp - 0x18], 0x5f
mov byte [ebp - 0x17], 0x48
mov byte [ebp - 0x16], 0xa1
mov byte [ebp - 0x15], 0x92
call dword [0x101b4ac]
pop edi
mov dword [reloc.KERNEL32.dll_GetStartupInfoA], ebx
pop esi
push 0x101b374
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
pop ebx
call fcn.01007613
leave
ret 4
Function at 0x1016f29
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [ecx + 8], eax
lea eax, [ecx + 0xc]
xor edx, edx
mov dword [ecx + 4], eax
mov dword [eax], edx
push esi
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
lea eax, [eax + edx + 4]
add edx, 0xc
cmp edx, 0xc0
mov dword [eax + 4], esi
mov dword [ecx], eax
jb 0x1016f16
pop esi
pop ebp
ret 4

Function at 0x1016fb8
Capabilities:
Get system information on windows

Disassembly:
mov eax, dword [ecx + 0x20]
test eax, eax
je 0x1016fc6
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
ret
Function at 0x10019190
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x100ae8c8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 1
cmp dword [0x1019aa88], esi
jne 0x100191bb
call fcn.10018560
cmp eax, dword [0x1019aa84]
jle 0x100191df
cmp dword [0x1019aa90], esi
jne 0x10019229
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x1019aa8c]
sub eax, dword [0x101a34bc]
imul ecx, ecx, 0xea60
cmp eax, ecx
jbe 0x10019229
cmp dword [0xeabd50], esi
jne 0x100191fd
call fcn.1003a6c0
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10086786
mov esp, ebp
pop ebp
ret 0x10
mov edx, dword [0x101a46e8]
mov eax, dword [0x100eaf2c]
add edx, 0x52
push edx
push eax
call dword [sym.imp.USER32.dll_KillTimer]
call fcn.10016830
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10086786
mov esp, ebp
pop ebp
ret 0x10
push ebx
push edi
mov edi, dword [0x2fcc3b0]
xor ebx, ebx
xor esi, esi
call fcn.10006a40
test eax, eax
je 0x10019261
add edi, 0x53c
mov eax, dword [edi]
test eax, eax
je 0x10019254
cmp dword [eax + 0x334], 1
jne 0x10019254
inc ebx
inc esi
add edi, 4
call fcn.10006a40
cmp esi, eax
jb 0x10019244
cmp ebx, dword [0x1019a9e8]
pop edi
pop ebx
mov esi, 1
jge 0x10019278
cmp dword [0x1019a9ec], esi
je 0x1001929c
cmp dword [0x1019a9f0], esi
jne 0x100192c5
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x1019a9f4]
sub eax, dword [0x101a34b4]
imul ecx, ecx, 0xea60
cmp eax, ecx
jb 0x100192c5
cmp dword [0xeabd50], esi
je 0x100191e7
mov edx, dword [0x101a46e8]
mov eax, dword [0x100eaf2c]
add edx, 0x52
push edx
push eax
call dword [sym.imp.USER32.dll_KillTimer]
push 0x100977b8
jmp 0x1001932c
push 0x32
lea ecx, [ebp - 0x38]
push ecx
mov ecx, 0x1019a9f8
call sub.mfc100.dll_Ordinal_6969
mov edx, 0x100977b0
lea ecx, [ebp - 0x38]
lea ecx, [ecx]
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x10019300
test al, al
je 0x100192fc
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x10019300
add ecx, 2
add edx, 2
test al, al
jne 0x100192e0
xor eax, eax
jmp 0x10019305
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1001933e
cmp dword [0xeabd50], eax
jne 0x1001933e
mov edx, dword [0x101a46e8]
mov eax, dword [0x100eaf2c]
add edx, 0x52
push edx
push eax
call dword [sym.imp.USER32.dll_KillTimer]
push 0x100977a4
call fcn.10008110
push 0x1009779c
call fcn.10019030
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10086786
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10019350
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x100ae8c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1012d3e4]
push edi
mov edi, ecx
cmp eax, 1
je 0x100194c8
cmp eax, 3
je 0x100194c8
push ebx
push 1
call sub.mfc100.dll_Ordinal_13219
push 0xa
lea eax, [ebp - 0x2c]
push eax
lea ecx, [edi + 0x300]
call sub.mfc100.dll_Ordinal_6969
mov ecx, 0x100977dc
lea eax, [ebp - 0x2c]
jmp 0x100193a0
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100193c0
test dl, dl
je 0x100193bc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100193c0
add eax, 2
add ecx, 2
test dl, dl
jne 0x100193a0
xor eax, eax
jmp 0x100193c5
sbb eax, eax
sbb eax, 0xffffffff
push esi
test eax, eax
jne 0x10019457
mov ecx, 0x101917c0
mov dword [0x1012d3e4], 2
call fcn.1000b180
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
push 0x100977b0
lea ecx, [edi + 0x300]
mov dword [0x101a34b4], eax
call sub.mfc100.dll_Ordinal_12868
push 0
lea ecx, [edi + 0x264]
call sub.mfc100.dll_Ordinal_3970
call fcn.1003a6c0
call esi
push 0
push 0
push 0
push 0
mov dword [0x101a34bc], eax
call fcn.10019190
mov ecx, dword [0x101a46e8]
mov edx, dword [0x100eaf2c]
push fcn.10019190
push 0x1388
add ecx, 0x52
push ecx
push edx
call dword [sym.imp.USER32.dll_SetTimer]
pop esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10086786
mov esp, ebp
pop ebp
ret
push 0x100977dc
lea ecx, [edi + 0x300]
mov dword [0x1012d3e4], 0
call sub.mfc100.dll_Ordinal_12868
mov eax, dword [0x101a46e8]
mov ecx, dword [0x100eaf2c]
mov esi, dword [sym.imp.USER32.dll_KillTimer]
add eax, 0x52
push eax
push ecx
call esi
mov edx, dword [0x101a46e8]
mov eax, dword [0x100eaf2c]
add edx, 0x44
push edx
push eax
call esi
push 1
lea ecx, [edi + 0x264]
call sub.mfc100.dll_Ordinal_3970
call fcn.1003a6c0
pop esi
pop ebx
mov dword [0x1011d17c], 0
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10086786
mov esp, ebp
pop ebp
ret
push 8
push 0x100977c4
call fcn.1003ae80
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
pop edi
call fcn.10086786
mov esp, ebp
pop ebp
ret