joyce8/EMBER2024-capa huggingface dataset:
Function at 0x8288fa
Capabilities:
Access peb ldr_data
Get number of processors
Get process heap force flags

Disassembly:
mov eax, 0x8e2603
call fcn.00879bb8
push ecx
push ecx
push ebx
push esi
mov esi, ecx
lea eax, [esi + 4]
mov ecx, eax
neg ecx
lea edx, [eax - 4]
sbb ecx, ecx
and ecx, edx
push edi
mov dword [ebp - 0x14], esi
mov dword [0x978130], ecx
xor edi, edi
mov dword [ebp - 4], edi
mov dword [eax], edi
push 0x64
pop ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], 0x1f
mov dword [esi + 0x28], edi
mov dword [esi + 0x1c], 0x8f2f38
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], 0x18
lea eax, [ebp - 0xd]
push eax
lea ecx, [esi + 0x44]
mov dword [esi + 0x3c], 0x10
mov dword [esi + 0x40], edi
push edi
mov byte [ebp - 4], 4
mov dword [ecx], edi
call fcn.00829a65
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x34], 0x8f2f34
mov dword [esi + 0x48], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x54], 0x1f
mov dword [esi + 0x4c], 0x8f2f30
mov dword [esi + 0x60], 0x18
pop edi
mov dword [esi], 0x8f2f2c
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x828f39
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Get number of processors

Disassembly:
mov eax, 0x8e270f
call fcn.00879bb8
push ecx
push ebx
push esi
mov esi, ecx
lea eax, [esi + 4]
mov ecx, eax
neg ecx
lea edx, [eax - 4]
sbb ecx, ecx
and ecx, edx
push edi
mov dword [ebp - 0x10], esi
mov dword [0x979168], ecx
push 0x6ea8dc
push 0x8290f4
push 9
push 4
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.0087b2f0
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x28], 0x8f2f4c
push 0x1f
pop edi
mov dword [esi + 0x30], edi
push 0x64
pop edx
mov dword [esi + 0x38], edx
push 0x18
pop ecx
mov dword [esi + 0x3c], ecx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x54], ecx
mov dword [esi + 0x50], edx
mov eax, 0x8f2f48
mov dword [esi + 0x40], eax
mov dword [esi + 0x58], eax
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], ebx
mov dword [esi + 0x6c], ecx
mov dword [esi + 0x68], edx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], edi
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x84], ecx
mov dword [esi + 0x70], 0x8f1074
mov dword [esi + 0x80], edx
lea eax, [esi + 0x70]
lea eax, [esi + 0x88]
mov dword [eax + 4], ebx
mov dword [eax + 8], edi
mov dword [eax + 0xc], ebx
mov dword [eax + 0x14], ecx
mov ecx, dword [ebp - 0xc]
mov dword [eax], 0x8f2f44
mov dword [eax + 0x10], edx
mov dword [esi + 0xa0], ebx
pop edi
mov dword [esi], 0x8f2f40
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x860fac
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x8e7478
call fcn.00879bb8
push ecx
push ebx
push esi
push edi
mov esi, ecx
push 0xc
push 0
push esi
mov dword [ebp - 0x10], esi
mov dword [esi], 0x8e84a0
call fcn.0087a060
add esp, 0xc
and dword [ebp - 4], 0
lea edi, [esi + 0xc]
mov ecx, edi
call fcn.005d0bc9
lea ebx, [esi + 0x18]
mov ecx, ebx
mov byte [ebp - 4], 1
call fcn.005d0bc9
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call fcn.005d0bc9
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 3
call fcn.0079d48a
fld1
push ecx
push ecx
mov ecx, edi
fstp qword [esp]
mov byte [ebp - 4], 4
mov dword [esi], 0x8f3688
call fcn.005d0f1a
fld1
push ecx
push ecx
mov ecx, ebx
fstp qword [esp]
call fcn.005d0f1a
fldz
push ecx
push ecx
lea ecx, [esi + 0x24]
fstp qword [esp]
call fcn.005d0f1a
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x8619ed
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x8e7579
call fcn.00879bb8
push ecx
push esi
fld1
mov esi, ecx
push ecx
push ecx
fstp qword [esp]
mov dword [ebp - 0x10], esi
call fcn.007f44ed
fld1
and dword [ebp - 4], 0
push ecx
push ecx
lea ecx, [esi + 0xc]
fstp qword [esp]
call fcn.007f44ed
fld1
push ecx
push ecx
lea ecx, [esi + 0x18]
fstp qword [esp]
mov byte [ebp - 4], 1
call fcn.007f44ed
fld1
push ecx
push ecx
lea ecx, [esi + 0x24]
fstp qword [esp]
mov byte [ebp - 4], 2
call fcn.007f44ed
push 0
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 3
call fcn.0048b92c
lea ecx, [esi + 0x3c]
call fcn.0085fd35
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x861ae2
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x8e759a
call fcn.00879bb8
push ecx
xor eax, eax
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 4], 0x8f3698
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x24], 0x8f3694
push eax
mov byte [ebp - 4], 1
mov dword [esi], 0x8f3690
call fcn.00861f3c
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x1c], eax
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x865e4d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x14]
test ebx, ebx
mov dword [ebp - 4], 0xc65053f2
jne 0x865e63
lea ebx, [ebp - 4]
mov eax, dword [ebp + 0x10]
test eax, eax
jle 0x865eb2
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
sub edi, esi
mov dword [ebp + 0x14], eax
mov cl, byte [edi + esi]
mov al, cl
mov byte [ebp + 0x10], cl
push dword [ebp + 0x10]
shl cl, 4
shr al, 4
or al, cl
mov cl, al
and cl, 0xd5
shr al, 1
shl cl, 1
and al, 0x55
or cl, al
movzx eax, byte [ebx]
xor cl, byte [eax + 0x96ccb8]
push ebx
mov byte [esi], cl
call fcn.00865df0
pop ecx
inc esi
dec dword [ebp + 0x14]
pop ecx
jne 0x865e77
pop edi
pop esi
pop ebx
leave
ret
Function at 0x865eb5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x14]
test ebx, ebx
mov dword [ebp - 4], 0xc65053f2
jne 0x865ecb
lea ebx, [ebp - 4]
mov eax, dword [ebp + 0x10]
test eax, eax
jle 0x865f1a
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
sub edi, esi
mov dword [ebp + 0x14], eax
movzx eax, byte [ebx]
mov al, byte [eax + 0x96ccb8]
xor al, byte [edi + esi]
mov cl, al
shr al, 1
and cl, 0xd5
and al, 0x55
shl cl, 1
or cl, al
mov al, cl
shr al, 4
shl cl, 4
or al, cl
mov byte [ebp + 0x10], al
push dword [ebp + 0x10]
mov byte [esi], al
push ebx
call fcn.00865df0
pop ecx
inc esi
dec dword [ebp + 0x14]
pop ecx
jne 0x865edf
pop edi
pop esi
pop ebx
leave
ret

Function at 0x866ae3
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push edi
push dword [ebp + 8]
mov edi, ecx
call fcn.0086a710
pop ecx
lea eax, [ebp - 0x114]
push eax
mov dword [ebp - 0x114], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [ebp - 0x104], 2
jne 0x866bb2
push ebx
push esi
lea eax, [ebp - 0x80]
push eax
push 0x96a090
call fcn.00866977
pop ecx
pop ecx
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov ebx, eax
lea eax, [ebp - 0x80]
push eax
push 0x96ce18
call fcn.00866977
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
pop ecx
pop ecx
push eax
push ebx
call esi
mov dword [edi + 0x44], eax
lea eax, [ebp - 0x80]
push eax
push 0x96ce04
call fcn.00866977
pop ecx
pop ecx
push eax
push ebx
call esi
mov dword [edi + 0x48], eax
lea eax, [ebp - 0x80]
push eax
push 0x96cdf0
call fcn.00866977
pop ecx
pop ecx
push eax
push ebx
call esi
mov dword [edi + 0x4c], eax
lea eax, [ebp - 0x80]
push eax
push 0x96cddc
call fcn.00866977
pop ecx
pop ecx
push eax
push ebx
call esi
mov dword [edi + 0x50], eax
lea eax, [ebp - 0x80]
push eax
push 0x96cdc8
call fcn.00866977
pop ecx
pop ecx
push eax
push ebx
call esi
pop esi
mov dword [edi + 0x54], eax
pop ebx
pop edi
leave
ret 4
Function at 0x86a780
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x97fc64]
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x86a790
xor eax, eax
pop ebx
ret
push ebp
mov ebp, dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push esi
push edi
push 0x86ec30
call ebp
push 0x2b98
mov edi, eax
call fcn.00402605
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x86a862
lea eax, [esi + 0x28]
mov byte [esi], bl
mov byte [esi + 1], bl
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov byte [esi + 0x20], bl
mov byte [esi + 0x21], bl
mov byte [esi + 0x22], bl
mov byte [esi + 0x23], bl
push eax
mov dword [esi + 0x24], 0xffffffff
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
lea ecx, [esi + 0x1468]
mov dword [esi + 0x1464], ebx
call fcn.008740c0
lea ecx, [esi + 0x2ac4]
call fcn.00873290
mov dword [esi + 0x2b0c], ebx
mov dword [esi + 0x2b30], ebx
mov dword [esi + 0x2b34], ebx
mov byte [esi + 0x2b78], bl
mov byte [esi + 0x2b79], bl
mov dword [esi + 0x2b7c], 0x3e8
mov dword [esi + 0x2b80], ebx
mov dword [esi + 0x2b84], ebx
mov dword [esi + 0x2b88], ebx
mov byte [esi + 0x2b8c], bl
mov dword [esi + 0x2b90], ebx
mov dword [esi + 0x2b94], ebx
mov byte [esi + 0x2b38], bl
mov ecx, esi
jmp 0x86a864
xor ecx, ecx
mov edx, dword [esp + 0x14]
mov dword [0x97fc64], ecx
push edx
call fcn.0086ac80
mov ecx, dword [0x97fc64]
mov dword [ecx + 0x10], eax
mov edx, dword [0x97fc64]
mov eax, dword [edx + 0x18]
cmp eax, ebx
je 0x86a891
push eax
call dword [sym.imp.kernel32.dll_SetEvent]
mov eax, dword [0x97fc64]
mov eax, dword [eax + 0x1c]
cmp eax, ebx
je 0x86a8a5
push ebx
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
cmp edi, ebx
je 0x86a8ac
push edi
call ebp
mov ecx, dword [0x97fc64]
pop edi
pop esi
pop ebp
mov eax, dword [ecx + 0x10]
pop ebx
ret
Function at 0x86aa90
Capabilities:
Clear file content
Encode data using xor
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x8e7a54
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
mov dword [esp + 4], esi
lea ecx, [esi + 0x2ac4]
mov dword [esp + 0x14], 1
call fcn.008732e0
lea ecx, [esi + 0x1468]
mov byte [esp + 0x14], 0
call fcn.00874140
add esi, 0x24
mov dword [esp + 4], esi
mov eax, dword [esi]
mov dword [esp + 0x14], 2
cmp eax, 0xffffffff
je 0x86ac09
push ebx
push edi
lea edi, [esi + 0x101c]
push edi
call dword [sym.imp.kernel32.dll_GetLocalTime]
mov eax, dword [esi + 0x143c]
test eax, eax
je 0x86ab14
mov ecx, dword [esi + 0x1440]
cmp ecx, eax
mov eax, 0x96d790
ja 0x86ab19
mov eax, 0x978474
push eax
xor eax, eax
mov ax, word [esi + 0x102a]
xor ecx, ecx
mov cx, word [esi + 0x1028]
push eax
xor edx, edx
xor eax, eax
mov dx, word [esi + 0x1026]
mov ax, word [esi + 0x1024]
push ecx
push edx
xor ecx, ecx
push eax
mov cx, word [esi + 0x1022]
xor edx, edx
mov dx, word [esi + 0x101e]
xor eax, eax
mov ax, word [edi]
push ecx
push edx
push eax
push 0x96d738
lea ebx, [esi + 0x1c]
call fcn.00875010
add esp, 4
push eax
push ebx
call fcn.00879f55
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
add esp, 0x28
repne scasb al, byte es:[edi]
mov eax, dword [esi + 0x1438]
not ecx
dec ecx
test eax, eax
mov edi, ecx
je 0x86abbf
test edi, edi
jle 0x86abd1
push ebp
mov ebp, 0xffffffe4
mov eax, ebx
sub ebp, esi
mov ecx, dword [esi + 0x1438]
add ecx, 2
mov dword [esi + 0x1438], ecx
mov dl, byte [eax]
add cl, 0x43
xor dl, cl
mov byte [eax], dl
inc eax
lea edx, [eax + ebp]
cmp edx, edi
jl 0x86ab9c
pop ebp
jmp 0x86abd1
push ebx
push ebx
lea eax, [esi + 0x1030]
push edi
push eax
call fcn.008749c0
add esp, 0x10
cmp dword [esi + 0x143c], 0x3e7
je 0x86abef
mov edx, dword [esi]
lea ecx, [esp + 0x10]
push 0
push ecx
push edi
push ebx
push edx
call dword [sym.imp.kernel32.dll_WriteFile]
mov eax, dword [esi]
push eax
call dword [sym.imp.kernel32.dll_SetEndOfFile]
mov ecx, dword [esi]
push ecx
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
mov dword [esi], 0xffffffff
pop ebx
add esi, 4
push esi
call dword [sym.imp.kernel32.dll_DeleteCriticalSection]
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x86cff0
Capabilities:
Check for software breakpoints
Encode data using xor
Write file on windows

Disassembly:
mov eax, 0x1008
call fcn.0087a1b0
push ebp
push esi
mov esi, dword [esp + 0x1014]
cmp dword [esi], 0xffffffff
je 0x86d15f
mov eax, dword [esi + 0x143c]
test eax, eax
je 0x86d037
mov ecx, dword [esp + 0x1018]
cmp byte [ecx], 0x21
je 0x86d037
mov ecx, dword [esi + 0x1440]
cmp ecx, eax
ja 0x86d15f
inc ecx
mov dword [esi + 0x1440], ecx
lea ebp, [esi + 4]
push ebp
mov dword [esp + 0xc], ebp
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov eax, dword [esp + 0x1018]
lea edx, [esp + 0x101c]
push edx
lea ecx, [esp + 0x14]
push eax
push ecx
call fcn.0087d009
add esp, 0xc
lea edx, [esi + 0x101c]
push edx
call dword [sym.imp.kernel32.dll_GetLocalTime]
mov eax, fcn.00879f55
cmp byte [eax], 0xcc
je 0x86d158
mov ecx, dword [sym.imp.kernel32.dll_WriteFile]
cmp byte [ecx], 0xcc
je 0x86d158
xor eax, eax
push ebx
mov ax, word [esi + 0x102a]
lea edx, [esp + 0x14]
push edi
push edx
xor ecx, ecx
push eax
mov cx, word [esi + 0x1028]
xor edx, edx
mov dx, word [esi + 0x1026]
xor eax, eax
mov ax, word [esi + 0x1024]
push ecx
push edx
push eax
push 0x96df18
lea ebx, [esi + 0x1c]
call fcn.00875010
add esp, 4
push eax
push ebx
call fcn.00879f55
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
add esp, 0x1c
repne scasb al, byte es:[edi]
mov eax, dword [esi + 0x1438]
not ecx
dec ecx
test eax, eax
mov edi, ecx
je 0x86d120
test edi, edi
jle 0x86d132
mov ebp, 0xffffffe4
mov eax, ebx
sub ebp, esi
mov ecx, 2
mov edx, dword [esi + 0x1438]
add edx, ecx
mov dword [esi + 0x1438], edx
add dl, 0x43
xor byte [eax], dl
inc eax
lea edx, [eax + ebp]
cmp edx, edi
jl 0x86d0ff
mov ebp, dword [esp + 0x10]
jmp 0x86d132
push ebx
push ebx
lea eax, [esi + 0x1030]
push edi
push eax
call fcn.008749c0
add esp, 0x10
mov edx, dword [esi]
lea ecx, [esp + 0x14]
push 0
push ecx
push edi
push ebx
push edx
call dword [sym.imp.kernel32.dll_WriteFile]
push ebp
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
pop edi
pop ebx
pop esi
mov al, 1
pop ebp
add esp, 0x1008
ret
push ebp
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
pop esi
xor al, al
pop ebp
add esp, 0x1008
ret
Function at 0x86da80
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov al, byte [esi + 0x20]
test al, al
jne 0x86da8e
mov al, 1
pop esi
ret
push edi
push 0x96e28c
lea edi, [esi + 0x24]
call fcn.00875080
add esp, 4
push eax
push edi
call fcn.0086cff0
mov ecx, dword [esi + 0x2b0c]
lea eax, [esi + 0x2b38]
push eax
push ecx
call dword [esi + 0x2b94]
mov eax, dword [esi + 0x14]
add esp, 0x10
test eax, eax
mov byte [esi + 0x20], 0
je 0x86dacf
push eax
call dword [sym.imp.kernel32.dll_SetEvent]
mov edx, dword [esi + 0x2b34]
push 0x7d0
push edx
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x86db0e
push 0x96e274
call fcn.00875080
add esp, 4
push eax
push edi
call fcn.0086cff0
mov eax, dword [esi + 0x2b34]
add esp, 8
push 0
push eax
call dword [sym.imp.kernel32.dll_TerminateThread]
mov ecx, dword [esi + 0x2b34]
push ecx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [esi + 0x2b30]
test eax, eax
je 0x86db2c
push eax
call dword [sym.imp.kernel32.dll_FreeLibrary]
push 0x96e260
mov dword [esi + 0x2b90], 0
mov dword [esi + 0x2b94], 0
call fcn.00875080
add esp, 4
push eax
push edi
call fcn.0086cff0
add esp, 8
mov al, 1
pop edi
pop esi
ret

Function at 0x86db60
Capabilities:
Create udp socket
Initialize winsock library
Resolve dns
Send data
Send data on socket

Disassembly:
sub esp, 0x1a0
lea eax, [esp + 0x10]
push ebx
push ebp
push eax
mov ebp, ecx
push 0x202
call dword [sym.imp.ws2_32.dll_WSAStartup]
test eax, eax
je 0x86db89
pop ebp
xor eax, eax
pop ebx
add esp, 0x1a0
ret
push 0
push 2
push 2
call dword [sym.imp.ws2_32.dll_socket]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x86dba7
pop ebp
xor eax, eax
pop ebx
add esp, 0x1a0
ret
push 0x3a98
mov word [esp + 0xc], 2
call dword [sym.imp.ws2_32.dll_htons_1]
push 0x97fb60
mov word [esp + 0xe], ax
call dword [sym.imp.ws2_32.dll_inet_addr]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x86dc12
push 0x97fb60
call dword [sym.imp.ws2_32.dll_gethostbyname]
test eax, eax
jne 0x86dbf3
push ebx
call dword [sym.imp.ws2_32.dll_closesocket]
pop ebp
xor eax, eax
pop ebx
add esp, 0x1a0
ret
movsx ecx, word [eax + 0xa]
mov edx, dword [eax + 0xc]
push esi
mov eax, ecx
push edi
mov esi, dword [edx]
lea edi, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
lea ecx, [ebp + 0x1468]
call fcn.00873df0
test eax, eax
jne 0x86dc33
push ebx
call dword [sym.imp.ws2_32.dll_closesocket]
pop ebp
xor eax, eax
pop ebx
add esp, 0x1a0
ret
mov ecx, dword [eax]
lea edx, [esp + 8]
push 0x10
push edx
add ecx, 4
push 0
push ecx
push eax
push ebx
call dword [sym.imp.ws2_32.dll_sendto]
test eax, eax
jne 0x86dc60
push ebx
call dword [sym.imp.ws2_32.dll_closesocket]
pop ebp
xor eax, eax
pop ebx
add esp, 0x1a0
ret
cmp eax, 0xffffffff
push ebx
jne 0x86dc77
call dword [sym.imp.ws2_32.dll_closesocket]
pop ebp
xor eax, eax
pop ebx
add esp, 0x1a0
ret
call dword [sym.imp.ws2_32.dll_closesocket]
pop ebp
mov eax, 1
pop ebx
add esp, 0x1a0
ret
Function at 0x86dd80
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x20
push ebx
push ebp
mov ebp, ecx
push esi
push edi
lea ecx, [esp + 0x1c]
lea eax, [esp + 0x1c]
push 1
push ecx
mov dword [esp + 0x18], 0xc
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0
xor edi, edi
call dword [sym.imp.advapi32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x86ddcb
push edi
push edi
lea edx, [esp + 0x24]
push 1
push edx
call dword [sym.imp.advapi32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x86ddcb
lea edi, [esp + 0x10]
push 0x96e2e4
call fcn.00875080
mov ebx, dword [sym.imp.kernel32.dll_CreateMutexA]
add esp, 4
push eax
push 0
push edi
call ebx
mov esi, eax
test esi, esi
jne 0x86de33
push 0x96e2d8
call fcn.00875080
add esp, 4
push eax
push esi
push edi
call ebx
mov esi, eax
test esi, esi
jne 0x86de33
mov esi, dword [sym.imp.kernel32.dll_GetLastError]
call esi
call esi
push eax
push 0x96e2b4
call fcn.00875080
add esp, 4
add ebp, 0x24
push eax
push ebp
call fcn.0086cff0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 8
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xb7
jne 0x86de53
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret 8
mov eax, dword [esp + 0x38]
test eax, eax
je 0x86de81
mov eax, dword [esp + 0x34]
push eax
push esi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x86de88
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret 8
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x20
ret 8
Function at 0x86dea0
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x20
push ebx
push ebp
mov ebp, ecx
push esi
push edi
lea ecx, [esp + 0x1c]
lea eax, [esp + 0x1c]
push 1
push ecx
mov dword [esp + 0x18], 0xc
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0
xor edi, edi
call dword [sym.imp.advapi32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x86deeb
push edi
push edi
lea edx, [esp + 0x24]
push 1
push edx
call dword [sym.imp.advapi32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x86deeb
lea edi, [esp + 0x10]
push 0x96e054
call fcn.00875080
mov ebx, dword [sym.imp.kernel32.dll_CreateMutexA]
add esp, 4
push eax
push 0
push edi
call ebx
mov esi, eax
test esi, esi
jne 0x86df53
push 0x96e048
call fcn.00875080
add esp, 4
push eax
push esi
push edi
call ebx
mov esi, eax
test esi, esi
jne 0x86df53
mov esi, dword [sym.imp.kernel32.dll_GetLastError]
call esi
call esi
push eax
push 0x96e314
call fcn.00875080
add esp, 4
add ebp, 0x24
push eax
push ebp
call fcn.0086cff0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xb7
jne 0x86dfa0
mov eax, dword [esp + 0x34]
push eax
push esi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x86dfa0
push 0x96e2f8
call fcn.00875080
add esp, 4
add ebp, 0x24
push eax
push ebp
call fcn.0086cff0
add esp, 8
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret 4
push esi
call dword [sym.imp.kernel32.dll_ReleaseMutex]
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x20
ret 4

Function at 0x86dfc0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ecx
mov al, byte [0x97fb5d]
test al, al
je 0x86dfd3
xor eax, eax
mov esp, ebp
pop ebp
ret
mov al, byte [ecx + 0x2b79]
mov dword [ebp - 4], 0
test al, al
je 0x86dffb
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
movzx eax, byte [eax + 2]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov al, byte fs:[0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x86f300
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x8e7a8b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x418
push ebx
push edi
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], 4
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
call fcn.00878970
mov ebx, dword [esp + 0x430]
lea eax, [esp + 8]
push eax
push ebx
lea ecx, [esp + 0x24]
mov dword [esp + 0x430], 0
call fcn.00878a40
test al, al
jne 0x86f3a2
mov edi, dword [sym.imp.kernel32.dll_GetLastError]
call edi
mov eax, dword [0x97fc64]
test eax, eax
je 0x86f3a2
push esi
mov esi, dword [esp + 0x420]
call edi
push eax
push esi
push ebx
push 0x96ea10
call fcn.00875080
mov ecx, dword [0x97fc64]
add esp, 4
add ecx, 0x24
push eax
push ecx
call fcn.0086cff0
add esp, 0x14
pop esi
lea edx, [esp + 0x14]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x96e9dc
call fcn.00875080
add esp, 4
push eax
push 0x80000001
call dword [sym.imp.advapi32.dll_RegCreateKeyExA]
pop edi
pop ebx
test eax, eax
jne 0x86f449
cmp dword [esp + 0xc], 2
jne 0x86f409
mov eax, dword [esp + 0x42c]
lea ecx, [esp + 0x10]
lea edx, [esp + 4]
push ecx
push edx
push 0
push 0
push eax
call fcn.00875080
mov ecx, dword [esp + 0x1c]
add esp, 4
push eax
push ecx
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, dword [esp]
mov ecx, dword [esp + 4]
cmp eax, ecx
je 0x86f478
mov edx, dword [0x97fc64]
test edx, edx
je 0x86f4af
push ecx
push eax
push 0x96e9c4
call fcn.00875080
add esp, 4
push eax
mov eax, dword [0x97fc64]
add eax, 0x24
push eax
jmp 0x86f4a7
mov ecx, dword [0x97fc64]
test ecx, ecx
je 0x86f474
push eax
push 0x96e9ac
call fcn.00875080
mov ecx, dword [0x97fc64]
add esp, 4
add ecx, 0x24
push eax
push ecx
call fcn.0086cff0
add esp, 0xc
mov eax, dword [esp]
mov ecx, dword [esp + 0x430]
cmp eax, ecx
je 0x86f4da
mov edx, dword [0x97fc64]
test edx, edx
je 0x86f4af
push ecx
push eax
push 0x96e994
call fcn.00875080
mov edx, dword [0x97fc64]
add esp, 4
add edx, 0x24
push eax
push edx
call fcn.0086cff0
add esp, 0x10
lea ecx, [esp + 0x14]
mov dword [esp + 0x420], 0xffffffff
call fcn.008789b0
xor al, al
mov ecx, dword [esp + 0x418]
mov dword fs:[0], ecx
add esp, 0x424
ret
lea ecx, [esp + 0x14]
mov dword [esp + 0x420], 0xffffffff
call fcn.008789b0
mov ecx, dword [esp + 0x418]
mov al, 1
mov dword fs:[0], ecx
add esp, 0x424
ret