joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004d230
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c3bc8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x100f7084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x2c]
call fcn.1004d190
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x2c]
mov dword [eax], vtable.CDriverHelp.0
mov ecx, dword [ebp - 0x2c]
mov dword [ecx + 4], 0
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0xc], 0
mov eax, dword [ebp - 0x2c]
mov dword [eax + 0x10], 0
mov ecx, dword [ebp - 0x2c]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x18], 0
mov eax, dword [ebp - 0x2c]
mov dword [eax + 0x1c], 0
mov ecx, dword [ebp - 0x2c]
mov dword [ecx + 0x20], 0
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x24], 0
mov eax, dword [ebp - 0x2c]
mov dword [eax + 0x28], 0
mov ecx, dword [ebp - 0x2c]
mov dword [ecx + 0x2c], 0
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x30], 0
mov eax, dword [ebp - 0x2c]
mov dword [eax + 0x34], 0
mov ecx, dword [ebp - 0x2c]
mov dword [ecx + 0x38], 0
call fcn.1003ff40
add eax, 0x214
push eax
lea edx, [ebp - 0x28]
push edx
call fcn.1002f210
add esp, 8
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
call fcn.10049c40
push eax
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [ebp - 0x2c]
mov dword [ecx + 8], eax
lea ecx, [ebp - 0x28]
call fcn.1000c290
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ecx, dword [ebp - 0x2c]
call fcn.1004d7f0
mov ecx, dword [ebp - 0x2c]
call fcn.1004da50
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10086b0f
mov esp, ebp
pop ebp
ret
Function at 0x1004ee40
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c3e00
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x100f7084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x50], 0x3a8
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x58], 0
push 0
mov ecx, dword [ebp + 8]
call fcn.10049c40
push eax
call fcn.100acf82
add esp, 8
cmp eax, 0xffffffff
je 0x1004ef67
lea ecx, [ebp - 0x28]
call fcn.1002d970
mov dword [ebp - 4], 0
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x28]
call fcn.10037190
push 0x100d0e5c
lea ecx, [ebp - 0x28]
call fcn.1002e890
lea ecx, [ebp - 0x40]
push ecx
call fcn.1004ed40
add esp, 4
mov dword [ebp - 0x44], eax
mov edx, dword [ebp - 0x44]
mov dword [ebp - 0x48], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x48]
push eax
lea ecx, [ebp - 0x28]
call fcn.1002e870
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.1000c290
push 0
lea ecx, [ebp - 0x28]
call fcn.10049c40
push eax
call fcn.100acf82
add esp, 8
test eax, eax
je 0x1004eeaf
lea ecx, [ebp - 0x28]
call fcn.10049c40
push eax
mov ecx, dword [ebp + 8]
call fcn.10049c40
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
lea ecx, [ebp - 0x28]
call fcn.10049c40
push eax
call fcn.100ad5f5
add esp, 4
test eax, eax
je 0x1004ef58
push 4
push 0
lea ecx, [ebp - 0x28]
call fcn.10049c40
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.1000c290
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10086b0f
mov esp, ebp
pop ebp
ret
Function at 0x100505f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c4000
mov eax, dword fs:[0]
push eax
sub esp, 0x84
mov eax, dword [0x100f7084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x28]
call fcn.1002d7f0
mov byte [ebp - 4], 1
mov dword [ebp - 0x90], 0
push 0x40
push 0
lea ecx, [ebp - 0x8c]
push ecx
call fcn.1009ee30
add esp, 0xc
mov dword [ebp - 0x90], 0x44
mov dword [ebp - 0x64], 1
mov dx, word [ebp + 0x10]
mov word [ebp - 0x60], dx
movzx eax, word [ebp + 0x10]
test eax, eax
jne 0x1005067c
mov ecx, dword [ebp + 0x14]
or ecx, 0x8000000
mov dword [ebp + 0x14], ecx
cmp dword [ebp + 8], 0
je 0x1005068a
mov edx, dword [ebp + 8]
mov dword [ebp - 0x30], edx
jmp 0x10050690
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x30], eax
lea ecx, [ebp + 0x18]
call fcn.10021b60
movzx ecx, al
test ecx, ecx
je 0x100506a8
mov dword [ebp - 0x34], 0
jmp 0x100506b3
lea ecx, [ebp + 0x18]
call fcn.10049c40
mov dword [ebp - 0x34], eax
mov edx, dword [ebp - 0x30]
push edx
lea eax, [ebp - 0x90]
push eax
mov ecx, dword [ebp - 0x34]
push ecx
push 0
mov edx, dword [ebp + 0x14]
push edx
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.1002e4e0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x10050718
cmp dword [ebp + 8], 0
jne 0x10050718
movzx eax, byte [ebp + 0x30]
test eax, eax
je 0x10050704
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x4c]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 0x48]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x38], 0
je 0x10050727
mov dword [ebp - 0x3c], 1
jmp 0x1005072e
mov dword [ebp - 0x3c], 0
mov cl, byte [ebp - 0x3c]
mov byte [ebp - 0x29], cl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.1000c290
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x18]
call fcn.1000c290
mov al, byte [ebp - 0x29]
jmp 0x10050776
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10086b0f
mov esp, ebp
pop ebp
ret
Function at 0x10062330
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c55cb
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x100f7084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x234], ecx
mov ecx, dword [ebp - 0x234]
call fcn.1002d970
mov dword [ebp - 4], 0
push str.C:Windows_system32
mov ecx, dword [ebp - 0x234]
call fcn.1002e340
xor eax, eax
mov word [ebp - 0x218], ax
push 0x206
push 0
lea ecx, [ebp - 0x216]
push ecx
call fcn.1009ee30
add esp, 0xc
push 0x104
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x100623ed
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.10007e50
mov dword [ebp - 0x238], eax
mov ecx, dword [ebp - 0x238]
push ecx
mov ecx, dword [ebp - 0x234]
call fcn.1002e250
lea ecx, [ebp - 0x230]
call fcn.1000c290
push str.driversetchosts
mov ecx, dword [ebp - 0x234]
call fcn.1002e890
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x234]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10086b0f
mov esp, ebp
pop ebp
ret
Function at 0x10073a20
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c6856
mov eax, dword fs:[0]
push eax
sub esp, 0xb8
mov eax, dword [0x100f7084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.winsock_reset
lea ecx, [ebp - 0x40]
call fcn.10007e50
mov dword [ebp - 4], 0
lea eax, [ebp - 0x40]
push eax
call fcn.10039f70
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x10073a7e
mov dword [ebp - 0xa8], 1
jmp 0x10073a88
mov dword [ebp - 0xa8], 0
mov dl, byte [ebp - 0xa8]
mov byte [ebp - 0xa1], dl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.1000c290
movzx eax, byte [ebp - 0xa1]
test eax, eax
je 0x10073ab5
xor al, al
jmp 0x10073c48
call fcn.1003ff40
add eax, 0x7c
push eax
lea ecx, [ebp - 0x88]
push ecx
call fcn.1002f210
add esp, 8
mov dword [ebp - 0xb0], eax
mov edx, dword [ebp - 0xb0]
mov dword [ebp - 0xb4], edx
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0xb4]
push eax
lea ecx, [ebp - 0x70]
push ecx
call fcn.1005e140
mov ecx, eax
call fcn.1005e030
mov dword [ebp - 0xb8], eax
mov edx, dword [ebp - 0xb8]
mov dword [ebp - 0xbc], edx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0xbc]
push eax
lea ecx, [ebp - 0x28]
push ecx
call fcn.10035f90
add esp, 0xc
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x70]
call fcn.1000c290
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x88]
call fcn.1000c290
lea edx, [ebp - 0x28]
push edx
call fcn.10039360
add esp, 4
movzx eax, al
test eax, eax
jne 0x10073b75
mov byte [ebp - 0xa2], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.1000c290
mov al, byte [ebp - 0xa2]
jmp 0x10073c48
lea ecx, [ebp - 0x28]
call fcn.10049c40
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x10073ba9
mov byte [ebp - 0xa3], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.1000c290
mov al, byte [ebp - 0xa3]
jmp 0x10073c48
push 0x100d708c
lea ecx, [ebp - 0x58]
call fcn.10007e50
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xa0]
call fcn.1002d970
mov dword [ebp - 0xc0], eax
mov ecx, dword [ebp - 0xc0]
mov dword [ebp - 0xc4], ecx
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0xc4]
push edx
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x28]
push ecx
call fcn.10039b30
add esp, 0xc
test eax, eax
jne 0x10073c02
mov dword [ebp - 0xac], 1
jmp 0x10073c0c
mov dword [ebp - 0xac], 0
mov dl, byte [ebp - 0xac]
mov byte [ebp - 0xa4], dl
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xa0]
call fcn.1000c290
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x58]
call fcn.1000c290
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.1000c290
mov al, byte [ebp - 0xa4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10086b0f
mov esp, ebp
pop ebp
ret
Function at 0x10073f50
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c690f
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x100f7084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x44], ecx
mov ecx, dword [ebp - 0x44]
call fcn.100412e0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x44]
add ecx, 8
call fcn.1004a660
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x44]
add ecx, 0x130
call fcn.10005e50
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x44]
add ecx, 0x148
call fcn.1006caf0
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp + 8]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 0x44]
mov dword [edx + 0x14], 0
mov eax, dword [ebp - 0x44]
mov dword [eax + 0x18], 0
mov ecx, dword [ebp - 0x44]
mov dword [ecx + 0x20], 5
mov edx, dword [ebp - 0x44]
mov dword [edx + 0x1c], 0x114
mov eax, dword [ebp - 0x44]
add eax, 0x1c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov ecx, dword [ebp - 0x44]
cmp dword [ecx + 0x20], 6
jb 0x10074036
push 0x100d7560
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edx, dword [ebp - 0x44]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 0x44]
cmp dword [eax + 0x14], 0
je 0x10074036
push str.GetIpInterfaceEntry
mov ecx, dword [ebp - 0x44]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x44]
mov dword [ecx + 0x18], eax
mov edx, dword [ebp - 0x44]
add edx, 0x14c
push edx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
cmp dword [ebp + 8], 4
je 0x100740d2
call fcn.1003ff40
add eax, 0x3ac
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.1002f210
add esp, 8
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0x4c], ecx
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x4c]
call fcn.10049c40
push eax
mov ecx, dword [ebp - 0x44]
call fcn.100752f0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x28]
call fcn.1000c290
call fcn.1003ff40
add eax, 0x394
push eax
lea edx, [ebp - 0x40]
push edx
call fcn.1002f210
add esp, 8
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x54]
call fcn.10049c40
push eax
mov ecx, dword [ebp - 0x44]
call fcn.100752f0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x40]
call fcn.1000c290
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10086b0f
mov esp, ebp
pop ebp
ret 4
Function at 0x10079500
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c6e90
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x100f7084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 4], 0
mov byte [ebp - 0x29], 0
mov eax, dword [ebp + 0x20]
mov dword [eax], 0
mov byte [ebp - 0x30], 0
xor ecx, ecx
mov byte [ebp - 0x2f], cl
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x30], 0x2a
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x30], 1
push 2
lea edx, [ebp - 0x30]
push edx
call fcn.10043c50
add esp, 8
push 0
push 2
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx + 0xa0]
push edx
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jg 0x1007963f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, dword [ebp + 0x20]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x38]
call fcn.1007a730
movzx edx, al
test edx, edx
je 0x100795c0
mov eax, dword [ebp - 0x38]
movzx ecx, byte [eax + 0x78]
test ecx, ecx
jne 0x100795c0
mov byte [ebp - 0x2a], 0
jmp 0x100795c4
mov byte [ebp - 0x2a], 1
mov dl, byte [ebp - 0x2a]
mov byte [ebp - 0x29], dl
call dword [0x100fa7f0]
movzx eax, al
test eax, eax
je 0x1007963d
call dword [0x100fa7f8]
cmp eax, 3
jg 0x1007963d
movzx ecx, byte [ebp - 0x29]
push ecx
mov edx, dword [ebp + 0x20]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 0x3c]
push ecx
lea edx, [ebp + 8]
push edx
lea eax, [ebp - 0x28]
push eax
call fcn.1002f210
add esp, 8
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x44], ecx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x44]
call fcn.10049c40
push eax
push str._AGENT
push 3
push 0x143
push 0x100d80d0
call dword [0x100fa800]
add esp, 0x20
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.1000c290
jmp 0x10079656
mov byte [ebp - 0x29], 1
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
jne 0x1007953f
mov al, byte [ebp - 0x29]
mov byte [ebp - 0x31], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.10005f30
mov al, byte [ebp - 0x31]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10086b0f
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x10079fe0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0xa4]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x1007a007
mov dword [ebp - 8], 1
jmp 0x1007a00e
mov dword [ebp - 8], 0
mov dl, byte [ebp - 8]
mov byte [ebp - 1], dl
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret
Function at 0x1007a020
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 0x1007a490
push 0
push 0
call fcn.100ad205
add esp, 0x18
mov edx, dword [ebp - 4]
mov dword [edx + 0xa4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xa4], 0
jne 0x1007a063
mov ecx, dword [ebp - 4]
call fcn.1007a3e0
xor al, al
jmp 0x1007a065
mov al, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x100830a0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c77a0
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x100f7084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x5c], ecx
call fcn.1003ff40
add eax, 0x364
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.1002f210
add esp, 8
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp - 0x60]
mov dword [ebp - 0x64], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x64]
push edx
lea eax, [ebp - 0x40]
push eax
call fcn.1005e140
mov ecx, eax
call fcn.1005e030
mov dword [ebp - 0x68], eax
mov ecx, dword [ebp - 0x68]
mov dword [ebp - 0x6c], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x6c]
push edx
lea eax, [ebp - 0x28]
push eax
call fcn.10035f90
add esp, 0xc
mov dword [ebp - 0x70], eax
mov ecx, dword [ebp - 0x70]
call fcn.10049c40
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [ebp - 0x5c]
mov dword [ecx + 0x20], eax
lea ecx, [ebp - 0x28]
call fcn.1000c290
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.1000c290
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.1000c290
mov edx, dword [ebp - 0x5c]
cmp dword [edx + 0x20], 0
je 0x100831df
push str.VPN_INIT
mov eax, dword [ebp - 0x5c]
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0x5c]
mov dword [edx + 0xc], eax
push str.VPN_STOP
mov eax, dword [ebp - 0x5c]
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0x5c]
mov dword [edx + 0x10], eax
push str.CONNECT_VPN_PPTP
mov eax, dword [ebp - 0x5c]
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0x5c]
mov dword [edx + 0x14], eax
push str.CONNECT_VPN_l2TP
mov eax, dword [ebp - 0x5c]
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0x5c]
mov dword [edx + 0x18], eax
push str.CONNECT_VPN_IKEV2
mov eax, dword [ebp - 0x5c]
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0x5c]
mov dword [edx + 0x1c], eax
mov eax, dword [ebp - 0x5c]
mov dword [eax + 4], 0x10083080
mov ecx, dword [ebp - 0x5c]
mov dword [ecx + 8], 0x10082eb0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10086b0f
mov esp, ebp
pop ebp
ret
Function at 0x10083210
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c77db
mov eax, dword fs:[0]
push eax
sub esp, 0x740
mov eax, dword [0x100f7084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x74c], ecx
cmp dword [ebp + 8], 0
jne 0x1008324e
xor al, al
jmp 0x100833ff
lea eax, [ebp - 0x738]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries64000000000001
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10083277
xor al, al
jmp 0x100833ff
mov dword [ebp - 0x73c], 0x378
mov dword [ebp - 0x744], 0x378
lea ecx, [ebp - 0x73c]
push ecx
lea edx, [ebp - 0x388]
push edx
push 0
push 0
push str.PackedCatalogItem
mov eax, dword [ebp - 0x738]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100832bf
cmp dword [ebp - 0x73c], 0x378
je 0x100832c6
xor al, al
jmp 0x100833ff
lea ecx, [ebp - 0x388]
push ecx
lea ecx, [ebp - 0x718]
call fcn.10005de0
mov dword [ebp - 4], 0
mov edx, dword [0x100c9c48]
push edx
push 0x5c
lea ecx, [ebp - 0x718]
call fcn.10083630
mov dword [ebp - 0x740], eax
mov eax, dword [ebp - 0x740]
lea ecx, [ebp + eax - 0x387]
mov dword [ebp - 0x748], ecx
lea edx, [ebp - 0x744]
push edx
lea eax, [ebp - 0x700]
push eax
push 0
push 0
push str.ProtocolName
mov ecx, dword [ebp - 0x738]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x10083358
mov byte [ebp - 0x731], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x718]
call fcn.10005f30
mov al, byte [ebp - 0x731]
jmp 0x100833ff
lea edx, [ebp - 0x700]
push edx
call fcn.100b0289
add esp, 4
push eax
lea ecx, [ebp - 0x730]
call fcn.10005de0
mov eax, dword [ebp - 0x738]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x748]
push ecx
call fcn.100b0289
add esp, 4
push eax
mov edx, dword [ebp + 0xc]
push edx
call fcn.100b0289
add esp, 4
push eax
call fcn.100b002b
add esp, 8
test eax, eax
jne 0x100833d5
mov byte [ebp - 0x732], 1
lea ecx, [ebp - 0x730]
call fcn.10005f30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x718]
call fcn.10005f30
mov al, byte [ebp - 0x732]
jmp 0x100833ff
mov byte [ebp - 0x733], 0
lea ecx, [ebp - 0x730]
call fcn.10005f30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x718]
call fcn.10005f30
mov al, byte [ebp - 0x733]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10086b0f
mov esp, ebp
pop ebp
ret 8
Function at 0x10083420
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c77db
mov eax, dword fs:[0]
push eax
sub esp, 0x740
mov eax, dword [0x100f7084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x74c], ecx
cmp dword [ebp + 8], 0
jne 0x1008345e
xor al, al
jmp 0x1008360f
lea eax, [ebp - 0x738]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries000000000001
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10083487
xor al, al
jmp 0x1008360f
mov dword [ebp - 0x73c], 0x378
mov dword [ebp - 0x744], 0x378
lea ecx, [ebp - 0x73c]
push ecx
lea edx, [ebp - 0x388]
push edx
push 0
push 0
push 0x100d982c
mov eax, dword [ebp - 0x738]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100834cf
cmp dword [ebp - 0x73c], 0x378
je 0x100834d6
xor al, al
jmp 0x1008360f
lea ecx, [ebp - 0x388]
push ecx
lea ecx, [ebp - 0x718]
call fcn.10005de0
mov dword [ebp - 4], 0
mov edx, dword [0x100c9c48]
push edx
push 0x5c
lea ecx, [ebp - 0x718]
call fcn.10083630
mov dword [ebp - 0x740], eax
mov eax, dword [ebp - 0x740]
lea ecx, [ebp + eax - 0x387]
mov dword [ebp - 0x748], ecx
lea edx, [ebp - 0x744]
push edx
lea eax, [ebp - 0x700]
push eax
push 0
push 0
push 0x100d9850
mov ecx, dword [ebp - 0x738]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x10083568
mov byte [ebp - 0x731], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x718]
call fcn.10005f30
mov al, byte [ebp - 0x731]
jmp 0x1008360f
lea edx, [ebp - 0x700]
push edx
call fcn.100b0289
add esp, 4
push eax
lea ecx, [ebp - 0x730]
call fcn.10005de0
mov eax, dword [ebp - 0x738]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x748]
push ecx
call fcn.100b0289
add esp, 4
push eax
mov edx, dword [ebp + 0xc]
push edx
call fcn.100b0289
add esp, 4
push eax
call fcn.100b002b
add esp, 8
test eax, eax
jne 0x100835e5
mov byte [ebp - 0x732], 1
lea ecx, [ebp - 0x730]
call fcn.10005f30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x718]
call fcn.10005f30
mov al, byte [ebp - 0x732]
jmp 0x1008360f
mov byte [ebp - 0x733], 0
lea ecx, [ebp - 0x730]
call fcn.10005f30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x718]
call fcn.10005f30
mov al, byte [ebp - 0x733]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10086b0f
mov esp, ebp
pop ebp
ret 8

Function at 0x10089bf6
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x100b493c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100b47bb