joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000c820
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1002fb88
mov eax, dword fs:[0]
push eax
sub esp, 0x70
push ebx
push esi
push edi
mov eax, dword [0x1003a1c0]
xor eax, esp
push eax
lea eax, [esp + 0x80]
mov dword fs:[0], eax
mov edi, dword [sym.imp.KERNEL32.DLL_CreateEventA]
xor ebx, ebx
push str.GlobalEXPLORERYZSTARTMEM
push ebx
push ebx
push ebx
mov byte [0x1003b4c4], bl
call edi
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
je 0x1000c9c6
mov edx, dword [ebp + 8]
cmp edx, ebx
je 0x1000c89f
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x1000c888
sub eax, esi
push eax
push edx
mov ecx, 0x1003b4cc
call fcn.10007110
push ebx
push ebx
push ebx
push ebx
mov dword [esp + 0x74], ebx
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], ebx
mov byte [esp + 0x4c], bl
mov dword [esp + 0x50], 0xffffffff
mov dword [esp + 0x54], ebx
mov byte [esp + 0x58], bl
call edi
push ebx
push 1
push ebx
push ebx
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x80], ebx
call edi
mov dword [esp + 0x4c], eax
push 0x2727
lea edi, [esp + 0x40]
mov dword [esp + 0x8c], ebx
call fcn.10019330
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x1c
lea eax, [esp + 0x24]
push eax
push 0x1000c7f0
call dword [sym.imp.KERNEL32.DLL_VirtualQuery]
neg eax
sbb eax, eax
and eax, dword [esp + 0x24]
push ebx
push eax
push 0x1000c7d0
push 5
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov esi, dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov dword [esp + 0x1c], eax
mov byte [esp + 0x17], bl
xor edi, edi
mov ecx, dword [esp + 0x18]
push 0x3e8
push ecx
call esi
test eax, eax
je 0x1000c95a
add edi, 1
cmp edi, 0x3c
jl 0x1000c940
jmp 0x1000c95f
mov byte [esp + 0x17], 1
lea eax, [esp + 0x3c]
call fcn.10019620
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
lea eax, [esp + 0x3c]
call fcn.10019620
cmp byte [esp + 0x17], bl
mov eax, dword [esp + 0x64]
mov byte [esp + 0x3c], bl
mov dword [esp + 0x70], ebx
mov dword [esp + 0x44], ebx
jne 0x1000c9b9
cmp eax, ebx
je 0x1000c99f
push eax
call fcn.1001dad4
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x80]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp eax, ebx
je 0x1000c9c6
push eax
call fcn.1001dad4
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x80]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1000c9f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1002fb88
mov eax, dword fs:[0]
push eax
sub esp, 0x70
push ebx
push esi
push edi
mov eax, dword [0x1003a1c0]
xor eax, esp
push eax
lea eax, [esp + 0x80]
mov dword fs:[0], eax
mov edi, dword [sym.imp.KERNEL32.DLL_CreateEventA]
xor ebx, ebx
push str.GlobalEXPLORERYZSTARTMEM
push ebx
push ebx
push ebx
mov byte [0x1003b4c4], bl
call edi
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
je 0x1000cb96
mov edx, dword [ebp + 8]
cmp edx, ebx
je 0x1000ca6f
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x1000ca58
sub eax, esi
push eax
push edx
mov ecx, 0x1003b4cc
call fcn.10007110
push ebx
push ebx
push ebx
push ebx
mov dword [esp + 0x74], ebx
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], ebx
mov byte [esp + 0x4c], bl
mov dword [esp + 0x50], 0xffffffff
mov dword [esp + 0x54], ebx
mov byte [esp + 0x58], bl
call edi
push ebx
push 1
push ebx
push ebx
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x80], ebx
call edi
mov dword [esp + 0x4c], eax
push 0x2727
lea edi, [esp + 0x40]
mov dword [esp + 0x8c], ebx
call fcn.10019330
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x1c
lea eax, [esp + 0x24]
push eax
push 0x1000c7f0
call dword [sym.imp.KERNEL32.DLL_VirtualQuery]
neg eax
sbb eax, eax
and eax, dword [esp + 0x24]
push ebx
push eax
push 0x1000c7d0
push 5
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov esi, dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov dword [esp + 0x1c], eax
mov byte [esp + 0x17], bl
xor edi, edi
mov ecx, dword [esp + 0x18]
push 0x3e8
push ecx
call esi
test eax, eax
je 0x1000cb2a
add edi, 1
cmp edi, 0x3c
jl 0x1000cb10
jmp 0x1000cb2f
mov byte [esp + 0x17], 1
lea eax, [esp + 0x3c]
call fcn.10019620
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
lea eax, [esp + 0x3c]
call fcn.10019620
cmp byte [esp + 0x17], bl
mov eax, dword [esp + 0x64]
mov byte [esp + 0x3c], bl
mov dword [esp + 0x70], ebx
mov dword [esp + 0x44], ebx
jne 0x1000cb89
cmp eax, ebx
je 0x1000cb6f
push eax
call fcn.1001dad4
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x80]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
cmp eax, ebx
je 0x1000cb96
push eax
call fcn.1001dad4
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x80]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x1000cbf0
Capabilities:
Create thread

Disassembly:
xor eax, eax
mov dword [esi], vtable.CHookExplorer.0
push eax
mov dword [esi + 0x20], eax
push eax
mov ecx, 0xf
mov dword [esi + 0x24], ecx
mov byte [esi + 0x10], al
push esi
mov dword [esi + 0x40], ecx
mov dword [esi + 0x3c], eax
mov byte [esi + 0x2c], al
push 0x1000cc40
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x58], eax
push eax
mov byte [esi + 0x48], al
push eax
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [esi + 8], eax
mov eax, esi
ret
Function at 0x1000ced0
Capabilities:
Read file on windows

Disassembly:
push ecx
test edi, edi
je 0x1000cf02
push 0
lea eax, [esp + 4]
push eax
push 0x420
push esi
push edi
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
push 0
push 0
push 0
push edi
jne 0x1000cf06
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
xor al, al
pop ecx
ret
cmp dword [esp + 0x10], 0x420
jae 0x1000cf2a
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
push 0x420
push 0
push esi
call fcn.10020580
add esp, 0xc
xor al, al
pop ecx
ret
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
add dword [esi + 8], 0xfffff000
adc dword [esi + 0xc], 0xffffffff
cmp dword [esi + 0xc], 0
jg 0x1000cf49
jl 0x1000cf02
cmp dword [esi + 8], 0
jbe 0x1000cf02
mov al, 1
pop ecx
ret
Function at 0x1000fcd0
Capabilities:
Create udp socket
Send data
Send data on socket

Disassembly:
sub esp, 0x118
mov eax, dword [0x1003a1c0]
xor eax, esp
mov dword [esp + 0x114], eax
mov eax, dword [esp + 0x11c]
mov ecx, dword [esp + 0x120]
mov edx, dword [esp + 0x124]
push esi
push 0
mov dword [esp + 8], eax
mov eax, dword [esp + 0x130]
push 2
push 2
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000fd8c
push 0x103
lea ecx, [esp + 0x19]
push 0
push ecx
call fcn.10020580
mov eax, dword [0x10033314]
mov ecx, dword [0x10033318]
mov edx, dword [str.yzlanhostmem]
add esp, 0xc
mov dword [esp + 0x18], eax
movzx eax, word [0x1003c4b0]
push 0x10
mov byte [esp + 0x25], al
mov byte [esp + 0x26], ah
lea eax, [esp + 8]
push eax
push 0
mov dword [esp + 0x28], ecx
push 0xf
lea ecx, [esp + 0x24]
mov dword [esp + 0x24], edx
mov dl, byte [0x1003331c]
push ecx
push esi
mov byte [esp + 0x38], dl
call dword [sym.imp.WS2_32.dll_sendto]
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [esp + 0x118]
pop esi
xor ecx, esp
call fcn.1001e327
add esp, 0x118
ret
Function at 0x10010540
Capabilities:
Create thread

Disassembly:
push edi
mov edi, eax
test edi, edi
je 0x100105be
cmp dword [edi + 0x38], 0
je 0x100105be
push esi
push 0x10
call fcn.1001e422
add esp, 4
push 0
mov esi, eax
mov al, byte [esp + 0x10]
push 0
push 0
push 0
mov dword [esi], edi
mov dword [esi + 8], 0
mov byte [esi + 4], al
call dword [sym.imp.KERNEL32.DLL_CreateEventA]
push 0
push 0
push esi
push 0x100105d0
push 0
push 0
mov dword [esi + 0xc], eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
jne 0x100105a1
push esi
call fcn.1001dad4
add esp, 4
pop esi
xor eax, eax
pop edi
ret
mov ecx, dword [esi + 0xc]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov edi, dword [esi + 8]
push esi
call fcn.1001dad4
add esp, 4
pop esi
mov eax, edi
pop edi
ret
xor eax, eax
pop edi
ret

Function at 0x10010790
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, eax
cmp dword [ebx + 0x38], 0
jne 0x100107a1
xor al, al
pop ebx
pop ecx
ret 4
mov eax, dword [esp + 0xc]
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
mov dword [esp + 4], eax
je 0x1001079a
mov ecx, dword [ebx + 0x38]
push ebp
push esi
push edi
push ecx
call fcn.1001d552
mov ebp, eax
mov eax, dword [ebx + 0x38]
add esp, 4
push ebp
call fcn.10010840
mov esi, dword [ebx + 0x38]
xor edi, edi
test esi, esi
jle 0x10010817
mov ebx, dword [sym.imp.KERNEL32.DLL_WriteFile]
mov ecx, dword [esp + 0x10]
push 0
lea edx, [esp + 0x1c]
push edx
push esi
lea eax, [edi + ebp]
push eax
push ecx
mov dword [esp + 0x2c], 0
call ebx
mov eax, dword [esp + 0x18]
sub esi, eax
add edi, eax
test esi, esi
jg 0x100107f0
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push ebp
call fcn.1001dedd
add esp, 4
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
pop ecx
ret 4
Function at 0x10011580
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebx
mov ebx, dword [eax + 4]
mov eax, dword [eax]
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
push ebp
push esi
push edi
lea ecx, [ecx + eax + 0x18]
mov dword [esp + 0x10], 0
jbe 0x10011638
mov ebp, dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
lea esi, [ecx + 0xc]
mov eax, dword [esi + 4]
test eax, eax
jne 0x100115e9
mov edx, dword [esp + 0x1c]
mov edi, dword [edx + 0x38]
test edi, edi
jle 0x10011618
mov eax, dword [esi]
push 4
push 0x1000
push edi
add eax, ebx
push eax
call ebp
test eax, eax
je 0x10011643
mov eax, dword [esi]
push edi
add eax, ebx
push 0
push eax
mov dword [esi - 4], eax
call fcn.10020580
jmp 0x10011615
mov ecx, dword [esi]
push 4
push 0x1000
push eax
add ecx, ebx
push ecx
call ebp
test eax, eax
je 0x10011643
mov eax, dword [esi + 8]
mov edx, dword [esi + 4]
add eax, dword [esp + 0x18]
mov edi, dword [esi]
push edx
add edi, ebx
push eax
push edi
call fcn.10022e90
mov dword [esi - 4], edi
add esp, 0xc
mov ecx, dword [esp + 0x20]
mov edx, dword [ecx]
mov eax, dword [esp + 0x10]
movzx ecx, word [edx + 6]
add eax, 1
add esi, 0x28
cmp eax, ecx
mov dword [esp + 0x10], eax
jl 0x100115b2
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x100116f0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x2c]
mov eax, dword [edi]
movzx ecx, word [eax + 0x14]
mov edx, dword [edi + 0x30]
mov esi, dword [ecx + eax + 0x20]
sub edx, 1
lea ecx, [ecx + eax + 0x18]
not edx
and edx, esi
mov dword [esp + 0x14], esi
mov esi, dword [ecx + 0x10]
test esi, esi
mov dword [esp + 0x18], edx
jne 0x10011736
mov ebx, dword [ecx + 0x24]
test bl, 0x40
je 0x1001172f
mov esi, dword [eax + 0x20]
jmp 0x10011736
test bl, bl
jns 0x10011736
mov esi, dword [eax + 0x24]
mov dword [esp + 0x1c], esi
mov esi, dword [ecx + 0x24]
mov dword [esp + 0x20], esi
mov esi, 1
add ecx, 0x28
cmp word [eax + 6], si
mov dword [esp + 0x24], 0
mov dword [esp + 0x10], esi
jbe 0x10011816
lea ebx, [ecx + 0x24]
mov esi, dword [edi + 0x30]
mov ebp, dword [ebx - 0x1c]
mov edi, dword [ebx - 0x14]
sub esi, 1
not esi
and esi, ebp
test edi, edi
jne 0x10011789
mov ecx, dword [ebx]
test cl, 0x40
je 0x10011782
mov edi, dword [eax + 0x20]
jmp 0x10011789
test cl, cl
jns 0x10011789
mov edi, dword [eax + 0x24]
cmp edx, esi
je 0x100117c2
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
add eax, ecx
cmp eax, esi
ja 0x100117c2
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 0x14]
call fcn.10011650
test eax, eax
je 0x10011837
mov eax, dword [ebx]
mov edx, esi
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], edx
mov dword [esp + 0x20], eax
jmp 0x100117ee
mov eax, dword [ebx]
test eax, 0x2000000
je 0x100117db
test dword [esp + 0x20], 0x2000000
je 0x100117db
or dword [esp + 0x20], eax
jmp 0x100117e8
or eax, dword [esp + 0x20]
and eax, 0xfdffffff
mov dword [esp + 0x20], eax
sub edi, dword [esp + 0x14]
add edi, ebp
mov eax, dword [esp + 0x2c]
mov eax, dword [eax]
mov ecx, dword [esp + 0x10]
movzx esi, word [eax + 6]
add ecx, 1
add ebx, 0x28
cmp ecx, esi
mov dword [esp + 0x1c], edi
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x10], ecx
jl 0x10011762
lea ecx, [esp + 0x14]
mov edx, edi
mov dword [esp + 0x24], 1
call fcn.10011650
pop edi
neg eax
pop esi
sbb eax, eax
pop ebp
neg eax
pop ebx
add esp, 0x18
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
Function at 0x10012fd0
Capabilities:
Get file version info

Disassembly:
push 0xffffffffffffffff
push 0x1002e338
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x1003a1c0]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebx
push ebp
push edi
mov eax, dword [0x1003a1c0]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x60]
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
push ebx
push ebp
mov dword [esp + 0x60], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
cmp edi, ebx
jne 0x1001305d
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x24]
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
push eax
mov ecx, esi
mov byte [esi + 4], bl
call fcn.10006680
cmp dword [esp + 0x34], 0x10
jb 0x10013158
mov ecx, dword [esp + 0x20]
push ecx
jmp 0x10013150
push edi
call fcn.1001d552
add esp, 4
cmp eax, ebx
mov dword [esp + 0x14], eax
jne 0x1001309f
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x24]
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
push edx
mov ecx, esi
mov byte [esi + 4], bl
call fcn.10006680
cmp dword [esp + 0x34], 0x10
jb 0x10013158
mov eax, dword [esp + 0x20]
push eax
jmp 0x10013150
push eax
push edi
push ebx
push ebp
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x1001311b
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x14]
push edx
push 0x10032dc0
push eax
mov dword [esp + 0x28], ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x1001311b
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + 0xc]
mov ecx, dword [ecx + 8]
movzx edx, ax
push edx
shr eax, 0x10
push eax
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
lea ecx, [esp + 0x48]
push str._d._d._d._d
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x50]
add esp, 0x18
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x10013101
sub eax, edx
push eax
lea edx, [esp + 0x3c]
push edx
lea ecx, [esp + 0x24]
call fcn.10007110
mov eax, dword [esp + 0x14]
push eax
call fcn.1001dedd
add esp, 4
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x24]
push ecx
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
mov ecx, esi
mov byte [esi + 4], bl
call fcn.10006680
cmp dword [esp + 0x34], 0x10
jb 0x10013158
mov edx, dword [esp + 0x20]
push edx
call fcn.1001dad4
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.1001e327
add esp, 0x4c
ret
Function at 0x100138d0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x68
xor eax, eax
push edi
mov dword [esp + 0xc], eax
push 0x44
mov dword [esp + 8], eax
push eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x10], 0xc
call fcn.10020580
add esp, 0xc
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov eax, esi
mov dword [esp + 0x20], 0x44
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x10013920
sub eax, edx
add eax, 1
push eax
call fcn.1001d552
mov edi, eax
mov edx, edi
add esp, 4
mov eax, esi
sub edx, esi
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x10013940
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x24]
push edx
push 0
push 0
push 0
push 0
lea eax, [esp + 0x1c]
push eax
mov ecx, eax
push ecx
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
je 0x1001397e
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push edi
call fcn.1001dedd
mov eax, dword [esp + 0x14]
add esp, 4
pop edi
add esp, 0x68
ret

Function at 0x10013990
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x88
mov eax, dword [0x1003a1c0]
xor eax, esp
mov dword [esp + 0x80], eax
push ebx
push esi
xor ebx, ebx
xor eax, eax
push edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], eax
push 0x44
mov dword [esp + 0x18], eax
mov esi, ecx
mov ecx, 0xc
lea eax, [esp + 0x44]
push ebx
push eax
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x24], ebx
call fcn.10020580
mov eax, esi
add esp, 0xc
mov dword [esp + 0x40], 0x44
lea edx, [eax + 1]
nop
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x10013a00
sub eax, edx
add eax, 1
push eax
call fcn.1001d552
mov edi, eax
mov edx, edi
add esp, 4
mov eax, esi
sub edx, esi
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
cmp cl, bl
jne 0x10013a20
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x44]
push edx
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x28]
push eax
mov ecx, eax
push ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
je 0x10013a82
mov edx, dword [esp + 0x24]
push 0xfa0
push edx
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
mov edx, dword [esp + 0x28]
push edx
call esi
mov eax, dword [esp + 0x24]
push eax
call esi
push edi
call fcn.1001dedd
mov ecx, dword [esp + 0x20]
add esp, 4
push ecx
call esi
mov edx, dword [esp + 0x20]
push edx
call esi
mov ecx, dword [esp + 0x8c]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1001e327
add esp, 0x88
ret
Function at 0x10013b90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x1002ea6a
mov eax, dword fs:[0]
push eax
sub esp, 0x84
mov eax, dword [0x1003a1c0]
xor eax, esp
mov dword [esp + 0x80], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1003a1c0]
xor eax, esp
push eax
lea eax, [esp + 0x98]
mov dword fs:[0], eax
mov ebp, dword [esp + 0xa8]
mov eax, dword [esp + 0xac]
xor ebx, ebx
mov dword [esp + 0xa0], ebx
push 0xffffffffffffffff
mov dword [esp + 0x20], ebx
push ebx
mov dword [ebp + 0x18], 0xf
mov dword [ebp + 0x14], ebx
push eax
mov ecx, ebp
mov dword [esp + 0x2c], ebp
mov byte [ebp + 4], bl
call fcn.10006680
push 2
push 0x10033418
mov dword [esp + 0xa8], ebx
push ebp
xor eax, eax
mov dword [esp + 0x28], 1
call fcn.1000c650
cmp eax, ebx
jl 0x10013d86
push 4
lea ecx, [eax + 2]
lea esi, [esp + 0x7c]
mov edx, ebp
call fcn.100062d0
mov eax, esi
push eax
mov ecx, 0x1003341c
lea edi, [esp + 0x44]
mov dword [esp + 0xa4], 1
call fcn.10008e10
add esp, 4
mov byte [esp + 0xa0], 2
mov eax, dword [esp + 0x44]
mov esi, 0x10
cmp dword [esp + 0x58], esi
mov dword [esp + 0x18], ebx
jae 0x10013c76
lea eax, [esp + 0x44]
lea ecx, [esp + 0x18]
push ecx
push 1
push eax
call dword [sym.imp.SHLWAPI.dll_StrToIntExA]
test eax, eax
je 0x10013d2f
mov dl, byte [esp + 0x18]
lea eax, [esp + 0x14]
mov word [esp + 0x15], bx
mov byte [esp + 0x14], dl
mov byte [esp + 0x15], bl
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x10013ca4
sub eax, edx
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x48]
call fcn.10007110
lea ecx, [esp + 0x78]
push ecx
mov ecx, 0x10033418
lea edi, [esp + 0x60]
call fcn.10008e10
add esp, 4
mov byte [esp + 0xa0], 3
cmp dword [esp + 0x58], esi
mov eax, dword [esp + 0x44]
jae 0x10013cea
lea eax, [esp + 0x44]
cmp dword [esp + 0x74], esi
mov ebx, dword [esp + 0x60]
jae 0x10013cf8
lea ebx, [esp + 0x60]
push eax
lea edx, [esp + 0x28]
push ebp
push edx
call fcn.10013ac0
add esp, 0xc
cmp dword [esp + 0x3c], esi
jb 0x10013d1a
mov eax, dword [esp + 0x28]
push eax
call fcn.1001dad4
add esp, 4
cmp dword [esp + 0x74], esi
jb 0x10013d2d
mov ecx, dword [esp + 0x60]
push ecx
call fcn.1001dad4
add esp, 4
xor ebx, ebx
cmp dword [esp + 0x58], esi
jb 0x10013d42
mov edx, dword [esp + 0x44]
push edx
call fcn.1001dad4
add esp, 4
mov byte [esp + 0xa0], bl
cmp dword [esp + 0x90], esi
mov dword [esp + 0x58], 0xf
mov dword [esp + 0x54], ebx
mov byte [esp + 0x44], bl
jb 0x10013d6f
mov eax, dword [esp + 0x7c]
push eax
call fcn.1001dad4
add esp, 4
push 2
push 0x10033418
push ebp
xor eax, eax
call fcn.1000c650
cmp eax, ebx
jge 0x10013c28
mov eax, ebp
mov ecx, dword [esp + 0x98]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.1001e327
add esp, 0x90
ret
Function at 0x10014ae0
Capabilities:
Connect to http server
Create http request
Send data
Send http request
Send http request with host header

Disassembly:
push ebx
push 0
push 0
push 0
push 1
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.1__SV1__.NET_CLR_1.1.4322__.NET_CLR_2.0.50727_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov ebx, eax
test ebx, ebx
jne 0x10014afc
pop ebx
ret
push edi
push 0
push 0
push 3
push 0
push 0
push 0x50
push str.img.users.51.la
push ebx
call dword [sym.imp.WININET.dll_InternetConnectA]
mov edi, eax
test edi, edi
jne 0x10014b27
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
pop edi
xor eax, eax
pop ebx
ret
push esi
push 0
push SysReAllocString
push 0
push 0
push 0
push str._17839502.asp
push 0x10033480
push edi
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov esi, eax
test esi, esi
jne 0x10014b5e
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push edi
call esi
push ebx
call esi
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov eax, str.Referer:_http:__localhost:8080_stat_log.html_r_n
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x10014b66
push 0x20000000
sub eax, edx
push eax
push str.Referer:_http:__localhost:8080_stat_log.html_r_n
push esi
call dword [sym.imp.WININET.dll_HttpAddRequestHeadersA]
push 0
push 0
push 0
push 0
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push edi
call esi
push ebx
call esi
pop esi
pop edi
mov eax, 1
pop ebx
ret

Function at 0x10014bb0
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [0x1003c784]
test eax, eax
mov byte [0x1003c78c], 1
je 0x10014bcc
push eax
call dword [sym.imp.KERNEL32.DLL_SetEvent]
mov eax, dword [0x1003c784]
mov ecx, dword [0x1003c788]
test ecx, ecx
je 0x10014c06
push 0x3e8
push ecx
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
cmp eax, 0x102
jne 0x10014bf7
mov eax, dword [0x1003c788]
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
mov eax, dword [0x1003c784]
mov dword [0x1003c788], 0
test eax, eax
je 0x10014c1b
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [0x1003c784], 0
ret