joyce8/EMBER2024-capa huggingface dataset:
Function at 0x789c70
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x789c95
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x789ca0
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x789c95
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x789ce8
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x789cde
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x789cea
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x789cd0
xor eax, eax
pop ebx
pop esi
ret

Function at 0x78aae0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x13c
mov ebx, dword [esp + 0x150]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov dword [eax], 0
test ebx, ebx
je 0x78ac60
cmp byte [ebx], 0
je 0x78ac28
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
sub esp, 4
cmp eax, 0xffffffff
je 0x78ac70
test al, 0x10
je 0x78ac28
lea esi, [esp + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0x104
mov dword [esp], esi
call sub.msvcrt.dll__fullpath
mov dword [esp], esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov dword [esp + 0x1c], eax
mov ebx, eax
lea eax, [eax + 0x233]
mov dword [esp], eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov edx, eax
test eax, eax
je 0x78ac7f
lea ebp, [eax + 0x22c]
lea eax, [ebx + 1]
cmp eax, 4
jb 0x78ac00
mov ecx, dword [esp + eax + 0x28]
mov edi, ebp
mov dword [ebp + eax - 4], ecx
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
cmp byte [edx + 0x22c], 0
je 0x78abaa
movzx ecx, byte [edx + ebx + 0x22b]
cmp cl, 0x5c
je 0x78abaa
cmp cl, 0x2f
jne 0x78ac48
mov eax, dword [esp + 0x1c]
mov ecx, 0x2a
lea ebx, [edx + 0x120]
mov edi, ebx
mov word [ebp + eax], cx
xor eax, eax
mov ecx, 0x41
mov dword [edx + 0x224], 0xffffffff
mov dword [edx + 0x228], 0
mov dword [edx + 0x118], 0
mov dword [edx + 0x11c], 0
rep stosd dword es:[edi], eax
add esp, 0x13c
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
test eax, eax
je 0x78ab8b
movzx ecx, byte [esp + 0x2c]
mov byte [ebp], cl
test al, 2
je 0x78ab8b
movzx ecx, word [esp + eax + 0x2a]
mov word [ebp + eax - 2], cx
jmp 0x78ab8b
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
xor edx, edx
mov dword [eax], 0x14
add esp, 0x13c
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, 0x5c
mov dword [esp + 0x1c], eax
mov word [ebp + ebx], si
jmp 0x78abaa
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
xor edx, edx
mov dword [eax], 0xe
jmp 0x78ac35
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
xor edx, edx
mov dword [eax], 2
jmp 0x78ac35
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
xor edx, edx
mov dword [eax], 0xc
jmp 0x78ac35
Function at 0x797e00
Capabilities:
Capture screenshot

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [0xae662c]
mov dword [esp + 0x4c], eax
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_GetDC]
sub esp, 4
mov ebx, eax
mov dword [esp], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ebp, dword [sym.imp.USER32.dll_GetSystemMetrics]
sub esp, 4
mov esi, eax
mov dword [esp], 0
call ebp
sub esp, 4
mov edi, eax
mov dword [esp], 1
call ebp
sub esp, 4
mov ebp, eax
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
sub esp, 0xc
mov dword [esp + 4], eax
mov dword [esp + 0x3c], eax
mov dword [esp], esi
call dword [sym.imp.GDI32.dll_SelectObject]
sub esp, 8
mov dword [esp + 0x20], 0xcc0020
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ebp
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], esi
call dword [sym.imp.GDI32.dll_BitBlt]
sub esp, 0x24
mov dword [esp], esi
call dword [sym.imp.GDI32.dll_DeleteDC]
sub esp, 4
mov dword [esp + 4], ebx
mov dword [esp], 0
call dword [sym.imp.USER32.dll_ReleaseDC]
sub esp, 8
mov eax, dword [esp + 0x4c]
sub eax, dword [0xae662c]
mov edx, dword [esp + 0x3c]
jne 0x797ef6
add esp, 0x5c
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.00788f70
nop
nop
nop
nop
nop
Function at 0x8b41b0
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [0xae662c]
mov dword [esp + 0x1c], eax
xor eax, eax
mov edi, dword [esp + 0x40]
mov ebp, dword [esp + 0x44]
call 0x8b4350
test eax, eax
je 0x8b427c
mov esi, eax
call fcn.00797e00
mov ebx, eax
test eax, eax
je 0x8b4283
mov dword [esp + 0xc], 0x64
mov dword [esp + 8], ebp
mov dword [esp + 4], edi
mov dword [esp], eax
call fcn.00798e10
test eax, eax
je 0x8b4238
mov dword [esp], ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
sub esp, 4
mov dword [esp], esi
call sub.gdiplus.dll_GdiplusShutdown
xor eax, eax
sub esp, 4
mov edx, dword [esp + 0x1c]
sub edx, dword [0xae662c]
jne 0x8b42bd
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov dword [esp + 8], 0x24
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Failed_to_save_screenshot_to_buffer_n
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov dword [esp], ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
sub esp, 4
mov dword [esp], esi
call sub.gdiplus.dll_GdiplusShutdown
sub esp, 4
mov eax, 0xffffffff
jmp 0x8b421d
mov dword [esp], 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov dword [esp + 8], 0x19
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Failed_to_capture_screen_n
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov dword [esp], esi
call sub.gdiplus.dll_GdiplusShutdown
sub esp, 4
jmp 0x8b427c
call fcn.00788f70
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x8b4350
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x84
mov eax, dword [0xae662c]
mov dword [esp + 0x7c], eax
xor eax, eax
mov dword [esp], 0
mov esi, dword [esp + 0x90]
lea ebx, [esp + 0x18]
call fcn.008bb7d0
mov dword [esp + 8], 0x98eae1
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x64
mov dword [esp], ebx
call fcn.008bb640
mov dword [esp], ebx
call fcn.008b6790
mov dword [esp + 4], str.current_time
mov dword [esp + 8], eax
mov dword [esp], esi
call fcn.008b6820
mov eax, dword [esp + 0x7c]
sub eax, dword [0xae662c]
jne 0x8b4347
add esp, 0x84
pop ebx
pop esi
ret
call fcn.00788f70
nop
nop
nop
nop
sub esp, 0x3c
mov eax, dword [0xae662c]
mov dword [esp + 0x2c], eax
xor eax, eax
lea eax, [esp + 0x18]
mov dword [esp + 8], 0
mov dword [esp + 4], eax
lea eax, [esp + 0x14]
mov dword [esp], eax
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
call sub.gdiplus.dll_GdiplusStartup
sub esp, 0xc
mov edx, eax
mov eax, dword [esp + 0x14]
test edx, edx
jne 0x8b43c0
mov edx, dword [esp + 0x2c]
sub edx, dword [0xae662c]
jne 0x8b43f1
add esp, 0x3c
ret
mov dword [esp], 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov dword [esp + 8], 0x1a
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Failed_to_initialize_GDI_n
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
xor eax, eax
jmp 0x8b43a7
call fcn.00788f70
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x8b4400
Capabilities:
Check os version
Generate random numbers via winapi

Disassembly:
push ebx
sub esp, 0x38
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [esp + 0xc], 1
cmp al, 5
mov dword [esp + 8], 0
sbb eax, eax
mov dword [esp + 4], 0
and eax, 0xffffffc0
sub eax, 0xfffffc0
mov dword [esp + 0x10], eax
lea eax, [esp + 0x2c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
sub esp, 0x14
test eax, eax
je 0x8b44a0
lea eax, [esp + 0x28]
mov dword [esp + 4], 4
mov dword [esp + 8], eax
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
sub esp, 0xc
mov ebx, eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
sub esp, 8
test ebx, ebx
je 0x8b44e0
mov eax, dword [esp + 0x28]
add esp, 0x38
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], 2
mov ebx, eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 4], 0xad4818
mov dword [esp], eax
call fcn.0078b4e0
mov dword [esp], 0
call sub.api_ms_win_crt_time_l1_1_0.dll__time32
add esp, 0x38
imul eax, eax, 0x19d699a5
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], 2
mov ebx, eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 4], str.error_CryptGenRandom_0x_08lx
mov dword [esp], eax
call fcn.0078b4e0
jmp 0x8b44c9
Function at 0x4076c4
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x42600c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
xor edi, edi
mov dword [ebp - 0x210], ecx
lea eax, [ebp - 0x20c]
mov esi, edx
push edi
push eax
call fcn.004095f0
add esp, 0xc
lea ecx, [ebp - 0x20c]
call fcn.004072b0
lea eax, [ebp - 0x20c]
push eax
push edi
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov ebx, eax
test ebx, ebx
jne 0x407756
push ecx
push str.ReadSharedMemory__:
push ecx
mov edi, 0x82
mov ecx, esi
mov edx, edi
call fcn.00403b0e
lea ecx, [esi + 0x208]
mov edx, edi
push ecx
push str.Could_not_open_file_mapping_object.
push ecx
call fcn.00403b0e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x410], eax
xor eax, eax
jmp 0x407820
push 0x1e78
push edi
push edi
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
jne 0x4077aa
push ecx
push str.ReadSharedMemory__:
push ecx
mov edi, 0x82
mov ecx, esi
mov edx, edi
call fcn.00403b0e
lea ecx, [esi + 0x208]
mov edx, edi
push ecx
push str.Could_not_map_view_of_file.
push ecx
call fcn.00403b0e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
mov dword [esi + 0x410], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40774f
mov eax, dword [ebp - 0x210]
test eax, eax
jne 0x4077c6
call fcn.0040d306
mov dword [eax], 0x16
call fcn.0040d23a
jmp 0x4077d5
push 0x1034
push edi
push eax
call fcn.00408e00
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
push str.ReadSharedMemory__:
push ecx
mov edx, 0x82
mov ecx, esi
call fcn.00403b0e
lea eax, [ebp - 0x20c]
push eax
push str.succeeded._mapping_obj_name:__s
lea eax, [esi + 0x208]
push 0x104
push eax
call fcn.00406b11
and dword [esi + 0x410], 0
xor eax, eax
add esp, 0x10
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407989
leave
ret

Function at 0x408290
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push eax
push ecx
nop
push edx
push ebx
push esp
push ebp
push esi
push edi
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
Function at 0x4082b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
add byte [eax], al
add bh, al
inc ebp
clc
or dword [eax], eax
add byte [eax], al

Function at 0x40830b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
add eax, dword [ebp - 0x28]
movzx edx, byte [eax]
movzx ecx, byte [ebp - 0x20]
xor edx, ecx
mov byte [eax], dl
inc dword [ebp - 0x10]
Function at 0x4049fc
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404c2c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404a7f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404c2c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404a7f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404c48
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x404b08
xor eax, eax
push ebp
push 0x404b01
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00404844
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x404ae6
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x404c68
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x404ae6
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404b08
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x404c22
cmp byte [ebp - 0xd], 0
jne 0x404b4f
cmp byte [ebp - 0x12], 0
je 0x404c22
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x404b68
dec ebx
cmp byte [ebx], 0x2e
je 0x404b77
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x404b67
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x404c22
inc ebx
cmp byte [ebp - 0x12], 0
je 0x404bb4
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404c22
cmp byte [ebp - 0xd], 0
je 0x404c22
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404c22
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4052b8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x40531e
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00403b68
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.004028d8
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405308
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405325
lea eax, [ebp - 0x10]
call fcn.004038f8
ret

Function at 0x409454
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40948d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004039e8
jmp 0x409496
mov eax, ebx
mov edx, esi
call fcn.0040394c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4094a0
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x4094c1
mov al, byte [esp]
jmp 0x4094c3
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x409b48
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x4099c0
mov eax, dword [0x41350c]
cmp byte [eax], 0
je 0x409bc4
mov eax, dword [0x41342c]
call fcn.00402854
call fcn.0040271c
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00406e08
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x409c0c
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x409bfa
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x413408]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x414660]
call fcn.00404808
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40a8a8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40a90c
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00403b68
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.004069c8
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a913
lea eax, [ebp - 0xc]
call fcn.004038f8
ret

Function at 0x412454
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00403d84
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x4124ac
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x41358c]
mov dl, 1
mov eax, dword [0x411f60]
call fcn.00409d08
call fcn.00403358
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.004120d4
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4128b4
Capabilities:
Copy file
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, 0x412824
call fcn.00405518
xor eax, eax
push ebp
push 0x412953
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
call fcn.00412738
mov edx, dword [ebp - 0x14]
mov eax, 0x414884
call fcn.0040394c
push 0
lea eax, [ebp - 0x18]
mov ecx, 0x412968
mov edx, dword [0x414884]
call fcn.00403be0
mov eax, dword [ebp - 0x18]
call fcn.00403d84
push eax
push 0x412980
call sub.kernel32.dll_CopyFileA
push 0x41299c
call sub.gdi32.dll_AddFontResourceA
push 1
push 0
push 0
push 0x4129b0
push 0x4129c4
push ebx
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41295a
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.0040391c
ret
Function at 0x10001db0
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x14
xor eax, eax
cmp dword [esi + 0x454], eax
push 4
lea ecx, [esp + 4]
push ecx
setne al
push 8
push 0xffff
push edi
mov dword [esp + 0x14], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jge 0x10001dee
push edi
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
push esi
call fcn.100219d0
add esp, 0xc
add esp, 0x14
ret
mov edx, dword [esi + 0x458]
push edx
mov dword [esp + 0xc], 1
call fcn.100311f0
imul eax, eax, 0x3e8
mov dword [esp + 4], eax
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x45c]
push eax
call fcn.100311f0
imul eax, eax, 0x3e8
add esp, 8
push 0
push 0
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 0xc
lea edx, [esp + 0x20]
push edx
push 0x98000004
push edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x34], eax
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x10001e67
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
push esi
call fcn.100219d0
add esp, 0x10
add esp, 0x14
ret
Function at 0x10002440
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x10c
mov eax, dword [0x1003b064]
xor eax, esp
mov dword [esp + 0x108], eax
push ebp
mov ebp, dword [esp + 0x114]
cmp dword [ebp + 0x8c], 2
push edi
mov edi, dword [ebp]
mov dword [esp + 0xc], edi
je 0x100025a5
cmp dword [ebp + 0x1cc], 0
push ebx
push esi
jne 0x1000259a
mov esi, dword [esp + 0x124]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov ebx, 0x80
push esi
mov dword [esp + 0x1c], ebx
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x100024c9
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push ebp
call fcn.10025e30
push eax
push esi
push str.getpeername___failed_with_errno__d:__s
push edi
call fcn.10021a60
add esp, 0x18
jmp 0x100025a3
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x9c]
push eax
push esi
mov dword [esp + 0x1c], ebx
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x10002509
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push ebp
call fcn.10025e30
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
push edi
call fcn.10021a60
add esp, 0x18
jmp 0x100025a3
lea edi, [ebp + 0xb6]
lea ebx, [ebp + 0xe4]
lea esi, [esp + 0x18]
call fcn.10002400
test eax, eax
jne 0x10002547
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push ebp
call fcn.10025e30
mov ecx, dword [esp + 0x1c]
push eax
push esi
push str.ssrem_inet_ntop___failed_with_errno__d:__s
push ecx
call fcn.10021a60
add esp, 0x18
jmp 0x100025a3
lea edi, [ebp + 0x58]
mov ecx, 0xb
lea esi, [ebp + 0xb6]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea ebx, [ebp + 0x118]
lea edi, [ebp + 0xe8]
lea esi, [esp + 0x98]
call fcn.10002400
test eax, eax
jne 0x1000259a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push ebp
call fcn.10025e30
mov edx, dword [esp + 0x1c]
push eax
push esi
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push edx
call fcn.10021a60
add esp, 0x18
jmp 0x100025a3
push ebp
call fcn.100023a0
add esp, 4
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
pop edi
pop ebp
xor ecx, esp
call fcn.10031292
add esp, 0x10c
ret

Function at 0x100025c0
Capabilities:
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, dword [edi]
mov eax, dword [esi + 0x354]
push 4
lea ecx, [esp + 8]
push ecx
push 1
push 6
push edx
mov dword [esp + 0x18], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jge 0x10002603
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
call fcn.10025e30
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.100219d0
add esp, 0x14
pop esi
pop ecx
ret
push str.TCP_NODELAY_set_n
push esi
call fcn.100219d0
add esp, 8
pop esi
pop ecx
ret