joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000cca0
Capabilities:
Terminate process
Write file on windows

Disassembly:
lea edx, [ebp - 0x338]
push edx
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x1000cc80
mov ecx, 0x83
xor eax, eax
lea edi, [ebp - 0x210]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 0x324]
mov dword [ebp - 0x208], ecx
mov edx, dword [ebp - 0x31c]
mov dword [ebp - 0x20c], edx
mov eax, dword [ebp - 0x330]
mov dword [ebp - 0x210], eax
lea ecx, [ebp - 0x314]
push ecx
lea edx, [ebp - 0x204]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x5c
push 0
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.SHLWAPI.dll_StrRChrA]
test eax, eax
jne 0x1000cc59
lea ecx, [ebp - 0x204]
push ecx
mov edx, dword [ebp - 0x210]
push edx
call fcn.1000a200
add esp, 8
push 0
lea eax, [ebp - 0x33c]
push eax
push 0x20c
lea ecx, [ebp - 0x210]
push ecx
mov edx, dword [ebp - 0x340]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x1000cbcf
mov eax, dword [ebp - 0x340]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
push eax
xor eax, eax
je 0x1000ccb8
jae 0x1000cc50
mov eax, dword [0xf0458b58]
pop eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.SHLWAPI.dll_StrToIntA]
mov dword [ebp - 4], eax
call fcn.1000a290
mov eax, dword [ebp - 4]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1000ccf7
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], 0x1b6a
jmp 0x1000cd27
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x1000cd1d
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0x1b6a
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000cd27
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000ce30
Capabilities:
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
mov dword [ebp - 0x30], ecx
push eax
xor eax, eax
je 0x1000ce48
jae 0x1000cde0
mov eax, dword [0xd0458b58]
pop eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc], ecx
call fcn.1000a290
push 0xe00f003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x1000ce7e
mov edx, dword [ebp - 0x30]
mov dword [edx + 4], 0x1b5b
jmp 0x1000cf47
push 0xf01ff
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000ceb3
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x30]
mov dword [eax + 4], 0x1b5b
jmp 0x1000cf47
mov dword [ebp - 8], 0
mov dword [ebp - 0x2c], 0
mov ecx, 6
xor eax, eax
lea edi, [ebp - 0x28]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x400]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x1000cef1
sub dword [ebp - 0x38], 1
cmp dword [ebp - 0x38], 0
je 0x1000cf04
jmp 0x1000cf17
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov dword [ebp - 8], eax
jmp 0x1000cf17
lea edx, [ebp - 0x2c]
push edx
push 1
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000cf29
mov ecx, dword [ebp - 0x30]
mov dword [ecx + 4], 0
jmp 0x1000cf33
mov edx, dword [ebp - 0x30]
mov dword [edx + 4], 0x1b5b
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000cf50
Capabilities:
Delete service

Disassembly:
inc ebp
clc
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0x14], ecx
push eax
xor eax, eax
je 0x1000cf68
jae 0x1000cf00
mov eax, dword [0xec458b58]
pop eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc], ecx
call fcn.1000a290
push 0xe00f003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x1000cf9b
mov edx, dword [ebp - 0x14]
mov dword [edx + 4], 0x1b5d
jmp 0x1000cffe
push 0xf01ff
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000cfcd
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x14]
mov dword [eax + 4], 0x1b5d
jmp 0x1000cffe
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
Function at 0x1000d250
Capabilities:
Query service configuration

Disassembly:
jmp 0x1000d201
invalid
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov dword [ebp - 0x1c], ecx
push eax
xor eax, eax
je 0x1000d268
jae 0x1000d200
mov eax, dword [0x1ff6858]
str word [ebx - 0x3f7cf3bb]
adc byte [eax - 0x75], dl
dec ebp
or byte [ecx - 1], dl
adc eax, sym.imp.ADVAPI32.dll_OpenServiceA
pop eax
push 0xf01ff
mov eax, dword [ebp + 0xc]
add eax, 0x10
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000d28d
jmp 0x1000d3b5
mov dword [ebp - 8], 0
push 0x2000
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov ecx, 0x800
xor eax, eax
mov edi, dword [ebp - 0x10]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 8]
push ecx
push 0x2000
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
je 0x1000d399
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 8]
mov dword [ecx + 8], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x14]
mov dword [ecx + 0xc], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp + 0xc]
add eax, 0x448
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x18]
push edx
mov eax, dword [ebp + 0xc]
add eax, 0x848
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x10]
push edx
mov eax, dword [ebp + 0xc]
add eax, 0x648
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1c]
push edx
mov eax, dword [ebp + 0xc]
add eax, 0xc48
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp + 0xc]
add ecx, 0x10
push ecx
push str.SYSTEMControlSet001Services_s
mov edx, dword [ebp - 0x10]
Function at 0x1000d3c0
Capabilities:
Write file on windows

Disassembly:
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov eax, dword [ebp + 0xc]
add eax, 0x1048
push eax
push str.Description
mov ecx, dword [ebp - 0x10]
push ecx
push reloc.WS2_32.dll_bind
call fcn.1000a110
add esp, 0x10
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
push eax
xor eax, eax
je 0x1000d3d8
jae 0x1000d370
mov eax, dword [0xf44d8b58]
pop eax
mov ecx, dword [ebp - 0xc]
call fcn.1000da30
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x1000d3f6
mov eax, dword [ebp - 0xc]
mov dword [eax + 4], 0x1b69
jmp 0x1000d43f
mov dword [ebp - 4], 0
push 0
lea ecx, [ebp - 4]

Function at 0x1000d450
Capabilities:
Set registry value
Write file on windows

Disassembly:
dec ebp
cld
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1000d435
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], 0x1b69
jmp 0x1000d43f
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
push eax
xor eax, eax
je 0x1000d468
jae 0x1000d400
mov eax, dword [0xf0458b58]
pop eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0
lea edx, [ebp - 4]
push edx
push 0xf003f
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1208]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000d4ad
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0x1b68
jmp 0x1000d508
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1200]
push edx
mov eax, dword [ebp - 0xc]
add eax, 0xa00
push eax
Function at 0x1000d510
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1204]
push edx
push 0
mov eax, dword [ebp - 0xc]
add eax, 0x800
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000d4fe
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0x1b67
jmp 0x1000d508
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
push eax
xor eax, eax
je 0x1000d528
jae 0x1000d4c0
mov eax, dword [0xf0458b58]
pop eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0
lea edx, [ebp - 4]
push edx
push 0xf003f
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1208]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000d56d
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0x1b68
jmp 0x1000d5aa
mov ecx, dword [ebp - 0xc]
add ecx, 0x800
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000d5a0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], 0x1b64
jmp 0x1000d5aa
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000d5c0
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
push eax
xor eax, eax
je 0x1000d5d8
jae 0x1000d570
mov eax, dword [0xf0458b58]
pop eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0
lea edx, [ebp - 4]
push edx
push 0xf003f
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1208]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000d61d
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0x1b68
jmp 0x1000d655
push 0x100146e0
Function at 0x1000da30
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
push eax
xor eax, eax
je 0x1000da48
jae 0x1000d9e0
mov eax, dword [0xf8458b58]
pop eax
mov eax, dword [ebp - 8]
add eax, 0x124
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
mov ecx, dword [ebp - 8]
add ecx, 0x124
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000da90
Capabilities:
Delete file
Get file size
Read file on windows

Disassembly:
test byte [ebx], al
add byte [eax], al
add byte [ebx - 0x67], dh
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov dword [ebp - 0x1c], ecx
push eax
xor eax, eax
je 0x1000daa8
jae 0x1000da40
mov eax, dword [0xe4458b58]
pop eax
mov eax, dword [ebp - 0x1c]
mov dword [eax + 8], 0
mov dword [ebp - 4], 1
mov dword [ebp - 8], 0
push 0
push 0x80
push 3
push 0
push 1
push bind
mov ecx, dword [ebp - 0x1c]
add ecx, 0x124
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x1000db5a
push 0
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 0x1c]
cmp dword [edx + 8], 0
je 0x1000db41
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 8]
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], 0
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 8]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1c]
add eax, 0x124
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x10
call fcn.100050a0
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
je 0x1000db92
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [ebp - 4]
Function at 0x1000e3e0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x1000e3b4
and al, byte [ecx]
adc byte [ebp - 0x7ee28b40], al
mov ebp, 0xfffffcdc
mov dh, 5
add byte [eax], al
cmp dword [ebp - 0x324], 0x5b6
jne 0x1000e3a5
jmp 0x1000e3b4
lea ecx, [ebp - 0x328]
push ecx
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x1000e380
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x20]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov ecx, dword [ebp - 4]
call fcn.1000e6b0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x2e0]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
push eax
xor eax, eax
je 0x1000e3f8
jae 0x1000e390
mov eax, dword [0x8458b58]
pop eax
mov eax, dword [ebp + 8]
push eax
push 0x1f46
mov ecx, dword [ebp - 0xc]
add ecx, 0xb4
call fcn.10004ab0
test eax, eax
je 0x1000e42f
mov ecx, dword [ebp + 8]
push ecx
push 0x1f53
mov ecx, dword [ebp - 0xc]
add ecx, 0x1c8
call fcn.10004ab0
test eax, eax
jne 0x1000e433
xor eax, eax
jmp 0x1000e49c
mov edx, dword [ebp - 0xc]
push edx
push 0
push 0x1000dee0
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0x1000e190
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
mov dword [ebp - 8], 0
xor ecx, ecx
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x2dc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x2e0]
mov dword [ebp - 4], edx
push 0xffffffffffffffff
push 1
lea eax, [ebp - 8]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1000ffe0
Capabilities:
Create thread

Disassembly:
mov eax, 1
test eax, eax
je 0x1000ffd6
push 0
push 0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.WS2_32.dll_accept]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x1000ff70
jmp 0x1000ffd6
push 0x68
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov dword [ecx], edx
mov eax, dword [ebp - 0xc]
mov dword [eax + 4], 0
mov ecx, dword [ebp - 8]
add ecx, 0xa
push ecx
mov edx, dword [ebp - 0xc]
add edx, 8
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp - 8]
add eax, 0x4a
push eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x48
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [ebp - 0xc]
push edx
push 0
push 0x1000f320
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
jmp 0x1000ff47
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
push eax
xor eax, eax
je 0x1000fff6
jae 0x1000ff8e
mov eax, dword [0xfc7d8b58]
pop eax
mov edi, dword [ebp - 4]
add edi, 8
mov ecx, 0x18
mov esi, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov edx, dword [ebp - 4]
push edx
push 0
push 0x1000ff00
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10010040
Capabilities:
Create thread

Disassembly:
test byte [ebx], al
add byte [eax], al
add byte [ebx - 0x67], dh
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
push eax
xor eax, eax
je 0x10010056
jae 0x1000ffee
mov eax, dword [0xfc458b58]
pop eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100101f0
Capabilities:
Read file on windows

Disassembly:
sar dword [ecx + eax], 0
add al, ch
cmpsb byte [esi], byte es:[edi]
dec edx
invalid
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
push eax
xor eax, eax
je 0x10010208
jae 0x100101a0
mov eax, dword [0xfc45c758]
add byte [eax], al
add byte [eax], al
pop eax
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov byte [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0x7fff00
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
ja 0x100102f3
push 0
lea ecx, [ebp - 8]
push ecx
push 1
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10010258
cmp dword [ebp - 8], 0
jne 0x1001025f
xor eax, eax
jmp 0x100102f6
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
mov al, byte [ebp - 0x14]
mov byte [edx], al
movsx ecx, byte [ebp - 0x14]
cmp ecx, 0x3e
jne 0x100102e5
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 5
jb 0x100102e3
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
movsx ecx, byte [eax - 1]
cmp ecx, 0x3e
jne 0x100102e3
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movsx eax, byte [edx - 2]
cmp eax, 0x52
jne 0x100102e3
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 3]
cmp edx, 0x49
jne 0x100102e3
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
movsx ecx, byte [eax - 4]
cmp ecx, 0x44
jne 0x100102e3
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movsx eax, byte [edx - 5]
cmp eax, 0x3c
jne 0x100102e3
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
cmp ecx, 0x50
jge 0x100102e3
jmp 0x10010229
jmp 0x100102f3
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
jmp 0x10010229
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100103a0
Capabilities:
Write file on windows

Disassembly:
cld
add byte [ebp + 2], dh
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
push eax
xor eax, eax
je 0x100103b8
jae 0x10010350
mov eax, dword [0xfc45c758]
add byte [eax], al
add byte [eax], al
pop eax
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
push 0xffff
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
mov ecx, 1
test ecx, ecx
je 0x10010428
push 1
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x18]
add ecx, 0x28
call fcn.10004c90
test eax, eax
jne 0x10010405
jmp 0x10010428
cmp dword [ebp - 4], 0
je 0x10010426
push 0
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x100103dd
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov edx, dword [ebp - 0x18]
cmp dword [edx + 4], 0
jne 0x1001045a
mov eax, dword [ebp - 0x18]
mov dword [eax + 4], 0
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x14], 0
jne 0x1001047a
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 0xc], 0