joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10053ad3
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e6700
push 0x100c1d20
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x30], 0
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x38], 0
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
mov eax, dword [ebp - 0x4c]
add eax, 0x514
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jne 0x10053b61
jmp 0x10053c4a
mov ecx, dword [ebp - 0x40]
add ecx, 2
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x44], eax
mov edx, dword [ebp - 0x44]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x40]
add eax, 2
push eax
push 0
mov ecx, dword [ebp - 0x38]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov edx, dword [ebp - 0x38]
push edx
mov eax, dword [ebp - 0x40]
push eax
push 0
mov ecx, dword [ebp - 0x4c]
add ecx, 0x514
push ecx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x10053bb0
jmp 0x10053c4a
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x34]
push eax
push 0x10133f00
mov ecx, dword [ebp - 0x38]
push ecx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x10053bcc
jmp 0x10053c4a
mov edx, dword [ebp - 0x34]
mov eax, dword [edx + 8]
shr eax, 0x10
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x34]
mov edx, dword [ecx + 8]
and edx, 0xffff
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + 0xc]
shr eax, 0x10
xor edx, edx
mov ecx, 0x64
div ecx
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x34]
mov eax, dword [edx + 0xc]
shr eax, 0x10
mov ecx, dword [ebp - 0x28]
imul ecx, ecx, 0x64
sub eax, ecx
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x34]
mov eax, dword [edx + 0xc]
and eax, 0xffff
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x30]
push ecx
push str._d._d._d._d
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.10003120
add esp, 0x1c
mov dword [ebp - 0x3c], 1
mov dword [ebp - 4], 0xffffffff
call fcn.10053c58
jmp 0x10053c59
cmp dword [ebp - 0x38], 0
je 0x10053c71
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x48], ecx
mov edx, dword [ebp - 0x48]
push edx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1005915f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0
push 0
push 3
push 0
push 3
push connect
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x1005918b
xor eax, eax
jmp 0x100591e0
mov word [ebp - 8], 0
mov dword [ebp - 4], 0
push 0
lea ecx, [ebp - 4]
push ecx
push 2
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100591d4
mov ecx, dword [ebp - 8]
and ecx, 0xffff
cmp ecx, 0x5a4d
jne 0x100591d4
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x100591e0
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10059c51
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x1017f944], 0
je 0x10059c83
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.1005a0aa
jmp 0x10059ca1
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret 0x18

Function at 0x10059ce5
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x10059d2a
cmp dword [ebp + 8], 0xffffffff
je 0x10059d2a
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cx, word [eax]
cmp ecx, 0x5a4d
jne 0x10059d2a
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x3c]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp dword [ecx], 0x4550
je 0x10059d2a
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x1005b51f
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1005b549
xor eax, eax
jmp 0x1005b5a4
push 0
push 0
push 0
push 4
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1005b572
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1005b5a4
push 0x104
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call sub.PSAPI.DLL_GetMappedFileNameA
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x1005c57c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e6828
push 0x100c1d20
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffff5c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0xb4], ecx
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0
pushal
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x1c], eax
popal
mov eax, dword [ebp - 0xb4]
mov ecx, dword [ebp - 0x1c]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 0xb4]
cmp dword [edx + 4], 0
je 0x1005c657
push 0x94
push 0
lea eax, [ebp - 0xb0]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0xb0], 0x94
lea ecx, [ebp - 0xb0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0xac], 5
jne 0x1005c62f
cmp dword [ebp - 0xa8], 0
jne 0x1005c62f
mov edx, dword [ebp - 0xb4]
mov dword [edx], 0x27
jmp 0x1005c63b
mov eax, dword [ebp - 0xb4]
mov dword [eax], 0x28
mov ecx, dword [ebp - 0xb4]
mov edx, dword [ecx]
mov eax, dword [ebp - 0xb4]
mov ecx, dword [eax + 4]
mov edx, dword [ecx + edx*4]
mov dword [0x1017fa80], edx
jmp 0x1005c661
mov dword [0x1017fa80], 0
mov dword [ebp - 4], 0xffffffff
jmp 0x1005c684
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1005dba2
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e3a93
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x448
push esi
mov dword [ebp - 0x454], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x43c], eax
mov ecx, dword [ebp - 0x454]
add ecx, 0x10
call fcn.100045e0
cmp dword [ebp - 0x43c], 0xffffffff
jne 0x1005dbf7
jmp 0x1005dd24
mov dword [ebp - 0x438], 0x224
lea eax, [ebp - 0x438]
push eax
mov ecx, dword [ebp - 0x43c]
push ecx
call sub.KERNEL32.dll_Module32First
test eax, eax
jne 0x1005dc2a
mov edx, dword [ebp - 0x43c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1005dd24
push 0x104
push 0
lea eax, [ebp - 0x110]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x104
push 0
lea ecx, [ebp - 0x214]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
lea edx, [ebp - 0x418]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp esi, eax
jne 0x1005dc76
jmp 0x1005dcfc
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
lea ecx, [ebp - 0x318]
push ecx
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x1005dcfc
lea edx, [ebp - 0x450]
push edx
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x44c]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x44c]
push ecx
mov ecx, dword [ebp - 0x454]
add ecx, 0x10
call fcn.10017290
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44c]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea edx, [ebp - 0x438]
push edx
mov eax, dword [ebp - 0x43c]
push eax
call sub.KERNEL32.dll_Module32Next
test eax, eax
jne 0x1005dc56
mov ecx, dword [ebp - 0x43c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100bfe60
Capabilities:
Create udp socket
Send data
Send data on socket

Disassembly:
mov eax, dword [0x1017fb2c]
test eax, eax
je 0x100bfe72
mov eax, dword [0x1017fb3c]
test eax, eax
jne 0x100bfe7f
call fcn.100bfee0
test eax, eax
je 0x100bfe7f
or eax, 0xffffffff
ret
mov eax, dword [0x1017b288]
cmp eax, 0xffffffff
jne 0x100bfea5
push 0
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [0x1017b288], eax
jne 0x100bfea5
mov eax, 0xfffffffe
ret
mov cl, byte [esp + 0xc]
test cl, cl
mov ecx, 0x1017fb28
jne 0x100bfeb7
mov ecx, 0x1017fb38
mov edx, dword [esp + 4]
push 0x10
push ecx
mov ecx, dword [esp + 0x10]
push 0
push ecx
push edx
push eax
call dword [sym.imp.WS2_32.dll_sendto]
cmp eax, 0xffffffff
jne 0x100bfedd
call fcn.100bffd0
mov eax, 0xfffffffd
ret
xor eax, eax
ret

Function at 0x100bfee0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x100bff04
or eax, 0xffffffff
add esp, 0x190
ret
mov ecx, dword [str.tss_qos_stat.gamesafe.qq.com]
push 0x1017fb28
push ecx
call fcn.100bff50
add esp, 8
test eax, eax
je 0x100bff28
mov eax, 0xfffffffe
add esp, 0x190
ret
mov edx, dword [str.tss_qos_alarm.gamesafe.qq.com]
push 0x1017fb38
push edx
call fcn.100bff50
add esp, 8
neg eax
sbb eax, eax
and al, 0xfd
add esp, 0x190
ret

Function at 0x100bff50
Capabilities:
Resolve dns

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov edi, eax
test edi, edi
jne 0x100bff69
pop edi
or eax, 0xffffffff
pop esi
ret
mov eax, dword [edi + 0xc]
xor esi, esi
cmp dword [eax], 0
je 0x100bff82
mov ecx, dword [eax + 4]
add eax, 4
inc esi
test ecx, ecx
jne 0x100bff73
test esi, esi
jne 0x100bff8a
pop edi
mov eax, 0xfffffffe
pop esi
ret
push 0
call dword [sym.imp.MSVCRT.dll_time]
xor edx, edx
mov ecx, dword [edi + 0xc]
div esi
mov esi, dword [esp + 0x14]
add esp, 4
push 0x1f90
mov edx, dword [ecx + edx*4]
mov eax, dword [edx]
mov word [esi], 2
mov dword [esi + 4], eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [esi + 2], ax
pop edi
xor eax, eax
pop esi
ret

Function at 0x100c13f0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edx, edx
xor eax, eax
mov ecx, ebp
mov edi, pe_nt_image_headers32
mov dword [ecx], eax
inc eax
add ecx, 4
dec edi
jne 0x100c1405
mov ecx, ebp
mov dword [esp + 0x14], pe_nt_image_headers32
mov eax, dword [esp + 0x18]
mov bl, byte [ecx]
mov edi, dword [ecx]
add ecx, 4
mov al, byte [edx + eax]
add eax, esi
add al, bl
and eax, 0xff
mov esi, eax
and eax, 0xffff
mov ebx, dword [ebp + eax*4]
lea eax, [ebp + eax*4]
mov dword [ecx - 4], ebx
mov dword [eax], edi
lea eax, [edx + 1]
xor edx, edx
div dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
dec eax
mov dword [esp + 0x14], eax
jne 0x100c1418
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x100c1460
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edx, edx
xor edi, edi
test eax, eax
jbe 0x100c14b5
mov ecx, dword [esp + 0xc]
push ebx
push ebp
mov ebp, dword [esp + 0x18]
inc edx
and edx, 0xff
mov eax, dword [ecx + edx*4]
add esi, eax
and esi, 0xff
mov ebx, dword [ecx + esi*4]
mov dword [ecx + edx*4], ebx
mov dword [ecx + esi*4], eax
mov ebx, dword [ecx + edx*4]
add eax, ebx
mov bl, byte [edi + ebp]
and eax, 0xff
mov al, byte [ecx + eax*4]
xor bl, al
mov eax, dword [esp + 0x1c]
mov byte [edi + ebp], bl
inc edi
cmp edi, eax
jb 0x100c147a
pop ebp
pop ebx
pop edi
pop esi
ret

Function at 0x100c2220
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e6aa0
push 0x100c1d20
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x1c
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x38], ecx
cmp word [ecx], 0x5a4d
jne 0x100c22bb
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x3c], eax
cmp dword [eax], 0x4550
jne 0x100c22bb
mov edx, dword [eax + 0xd8]
lea edi, [edx + ecx]
mov esi, dword [ebp + 0xc]
cmp esi, edi
jb 0x100c22bb
mov eax, dword [eax + 0xdc]
add eax, edx
add eax, ecx
cmp esi, eax
jae 0x100c22bb
mov dword [ebp - 4], 0xffffffff
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100c2dc0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e6ab0
push 0x100c1d20
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x1c
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x100c2e4a
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x34]
cmp word [eax], 0x5a4d
jne 0x100c2e43
mov ecx, dword [eax + 0x3c]
add ecx, eax
mov dword [ebp - 0x3c], ecx
cmp dword [ecx], 0x4550
jne 0x100c2e43
cmp word [ecx + 0x14], 0
mov dword [ebp - 4], 0xffffffff
je 0x100c2e4a
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100cd090
Capabilities:
Create pipe
Create two anonymous pipes

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 0xfffffffffffffff5
mov dword [esp + 0x2c], 0xc
mov dword [esp + 0x34], 1
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea eax, [esp + 0x28]
push 0
lea ecx, [esp + 0x14]
push eax
lea edx, [esp + 0x1c]
or ebx, 0xffffffff
push ecx
push edx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ebx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x100cd0e7
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
push 0
lea eax, [esp + 0x28]
push 0
push eax
mov dword [esp + 0x30], ebx
call edi
mov ecx, dword [esp + 0x24]
push eax
push ecx
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push eax
call ebp
test eax, eax
push 1
push 1
jne 0x100cd13d
lea edx, [esp + 0x1c]
mov ecx, esi
push edx
call fcn.100cda30
push 1
lea eax, [esp + 0x14]
push 1
push eax
mov ecx, esi
call fcn.100cda30
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24
ret
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
call fcn.100cda30
lea edx, [esp + 0x28]
push 0
lea eax, [esp + 0x20]
push edx
lea ecx, [esp + 0x20]
push eax
push ecx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x100cd174
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
push 2
push 0
lea edx, [esp + 0x2c]
push 0
push edx
mov dword [esp + 0x34], ebx
call edi
push eax
mov eax, dword [esp + 0x30]
push eax
call edi
push eax
call ebp
test eax, eax
push 1
push 1
jne 0x100cd1de
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
call fcn.100cda30
push 1
lea edx, [esp + 0x14]
push 1
push edx
mov ecx, esi
call fcn.100cda30
push 1
lea eax, [esp + 0x1c]
push 1
push eax
mov ecx, esi
call fcn.100cda30
push 1
lea ecx, [esp + 0x20]
push 1
push ecx
mov ecx, esi
call fcn.100cda30
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24
ret
lea edx, [esp + 0x24]
mov ecx, esi
push edx
call fcn.100cda30
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
push ecx
mov ecx, esi
call fcn.100cd2b0
test eax, eax
jne 0x100cd249
push 1
lea edx, [esp + 0x24]
push 1
push edx
mov ecx, esi
call fcn.100cda30
push 1
lea eax, [esp + 0x14]
push 1
push eax
mov ecx, esi
call fcn.100cda30
push 1
lea ecx, [esp + 0x1c]
push 1
push ecx
mov ecx, esi
call fcn.100cda30
push 1
lea edx, [esp + 0x28]
push 1
push edx
mov ecx, esi
call fcn.100cda30
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24
ret
lea eax, [esp + 0x10]
lea ecx, [esp + 0x20]
push eax
push ecx
mov ecx, esi
call fcn.100cd370
push 1
lea edx, [esp + 0x24]
push 1
push edx
mov ecx, esi
mov edi, eax
call fcn.100cda30
push 1
lea eax, [esp + 0x14]
push 1
push eax
mov ecx, esi
call fcn.100cda30
push 1
lea ecx, [esp + 0x1c]
push 1
push ecx
mov ecx, esi
call fcn.100cda30
push 1
lea edx, [esp + 0x28]
push 1
push edx
mov ecx, esi
call fcn.100cda30
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
Function at 0x100cd2b0
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x54
mov edx, dword [eax]
push esi
cmp edx, 0xffffffff
push edi
je 0x100cd358
mov ecx, dword [esp + 0x64]
mov esi, dword [ecx]
cmp esi, 0xffffffff
je 0x100cd358
xor eax, eax
mov ecx, 0x11
mov dword [esp + 8], eax
lea edi, [esp + 0x18]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x58], edx
or ecx, 0x101
mov dword [esp + 0x54], edx
mov dword [esp + 0x44], ecx
lea ecx, [esp + 8]
lea edx, [esp + 0x18]
push ecx
push edx
push eax
push eax
push eax
push 1
push eax
push eax
push str.ipconfig__all
push eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], 0x44
mov dword [esp + 0x78], esi
mov word [esp + 0x70], ax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, eax
test esi, esi
je 0x100cd358
mov eax, dword [esp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esp + 0xc]
push ecx
call edi
mov eax, esi
pop edi
pop esi
add esp, 0x54
ret 8
pop edi
xor eax, eax
pop esi
add esp, 0x54
ret 8
Function at 0x100d0320
Capabilities:
Create pipe
Create two anonymous pipes

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 0xfffffffffffffff5
mov dword [esp + 0x2c], 0xc
mov dword [esp + 0x34], 1
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea eax, [esp + 0x28]
push 0
lea ecx, [esp + 0x14]
push eax
lea edx, [esp + 0x1c]
or ebx, 0xffffffff
push ecx
push edx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ebx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x100d0377
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
push 0
lea eax, [esp + 0x28]
push 0
push eax
mov dword [esp + 0x30], ebx
call edi
mov ecx, dword [esp + 0x24]
push eax
push ecx
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push eax
call ebp
test eax, eax
push 1
push 1
jne 0x100d03cd
lea edx, [esp + 0x1c]
mov ecx, esi
push edx
call fcn.100d0a60
push 1
lea eax, [esp + 0x14]
push 1
push eax
mov ecx, esi
call fcn.100d0a60
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24
ret
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
call fcn.100d0a60
lea edx, [esp + 0x28]
push 0
lea eax, [esp + 0x20]
push edx
lea ecx, [esp + 0x20]
push eax
push ecx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x100d0404
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
push 2
push 0
lea edx, [esp + 0x2c]
push 0
push edx
mov dword [esp + 0x34], ebx
call edi
push eax
mov eax, dword [esp + 0x30]
push eax
call edi
push eax
call ebp
test eax, eax
push 1
push 1
jne 0x100d046e
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
call fcn.100d0a60
push 1
lea edx, [esp + 0x14]
push 1
push edx
mov ecx, esi
call fcn.100d0a60
push 1
lea eax, [esp + 0x1c]
push 1
push eax
mov ecx, esi
call fcn.100d0a60
push 1
lea ecx, [esp + 0x20]
push 1
push ecx
mov ecx, esi
call fcn.100d0a60
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24
ret
lea edx, [esp + 0x24]
mov ecx, esi
push edx
call fcn.100d0a60
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
push ecx
mov ecx, esi
call fcn.100d0780
test eax, eax
jne 0x100d04d9
push 1
lea edx, [esp + 0x24]
push 1
push edx
mov ecx, esi
call fcn.100d0a60
push 1
lea eax, [esp + 0x14]
push 1
push eax
mov ecx, esi
call fcn.100d0a60
push 1
lea ecx, [esp + 0x1c]
push 1
push ecx
mov ecx, esi
call fcn.100d0a60
push 1
lea edx, [esp + 0x28]
push 1
push edx
mov ecx, esi
call fcn.100d0a60
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24
ret
lea eax, [esp + 0x10]
lea ecx, [esp + 0x20]
push eax
push ecx
mov ecx, esi
call fcn.100d0840
push 1
lea edx, [esp + 0x24]
push 1
push edx
mov ecx, esi
mov edi, eax
call fcn.100d0a60
push 1
lea eax, [esp + 0x14]
push 1
push eax
mov ecx, esi
call fcn.100d0a60
push 1
lea ecx, [esp + 0x1c]
push 1
push ecx
mov ecx, esi
call fcn.100d0a60
push 1
lea edx, [esp + 0x28]
push 1
push edx
mov ecx, esi
call fcn.100d0a60
mov ecx, esi
call fcn.100d14b0
neg eax
sbb eax, eax
and eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret