joyce8/EMBER2024-capa huggingface dataset:
Function at 0x15e0c10
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x15e0d1c
test eax, eax
je 0x15e0d1c
push esi
push edi
mov ecx, 0x10
mov esi, 0x15fbfe8
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x15e0d03
lea edi, [eax + 4]
jmp 0x15e0c67
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x15e0c7c
mov dword [ebp - 4], 2
jmp 0x15e0c9d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x15e0c93
mov dword [ebp - 4], 1
jmp 0x15e0c9d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x15e0d13
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x15e0cd6
mov byte [ecx], 0x3d
jmp 0x15e0ce2
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x15e0ced
mov byte [ecx], 0x3d
jmp 0x15e0cf3
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x15e0c64
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1a82565
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap eax
cmp edi, 0x11852467
neg eax
test dx, 0x5e8c
bswap eax
cmc
cmp bp, bx
lea eax, [eax - 0x6dc66343]
stc
cmp al, cl
clc
xor ebx, eax
cmp cx, 0x31d
test di, cx
add esi, eax
jmp 0x1a30f8f
push esi
ret
push eax
pushfd
push ebx
movzx eax, bp
mov ebx, eax
push edx
rdtsc
cwde
push esi
cwde
not ebx
rdtsc
push ebp
push edi
dec di
rdtsc
push ecx
movsx esi, si
cwde
jmp 0x1aede5f
mov edx, 0
movsx edi, bx
lahf
push edx
mov ebp, dword [esp + 0x28]
cbw
dec edi
inc ebp
btr bx, 9
ror ebp, 1
not edi
inc ebp
neg ebp
add ebp, edx
bt eax, 0x68
mov edi, esp
sub esp, 0xc0
mov ebx, ebp
cmp bp, 0x5810
mov eax, 0
xor si, 0x720f
sub ebx, eax
lea esi, [0x1aede9e]
rcl ax, cl
mov eax, dword [ebp]
lea ebp, [ebp + 4]
xor eax, ebx
test esi, 0x273145e6
cmp dx, bp
lea eax, [eax - 0x7d7028a1]
test si, 0x581c
jmp 0x1a128e5
Function at 0x4011e0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
push eax
mov eax, 0x4058
call fcn.0040104c
mov ebx, 0xffffffff
sub esp, eax
lea esi, [ebp - 0x4018]
lea edi, [ebp - 0x401c]
mov eax, dword [esp + eax]
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x2000
mov dword [esp + 8], esi
mov dword [esp], 4
mov dword [esp + 4], 0
call dword [sym.imp.ucrtbase.dll___stdio_common_vswprintf]
mov dword [esp], 0xfffffff5
test eax, eax
cmovns ebx, eax
mov eax, dword [sym.imp.kernel32.dll_GetStdHandle]
mov dword [ebp - 0x402c], eax
call eax
sub esp, 4
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteConsoleW]
sub esp, 0x14
test eax, eax
je 0x401290
mov edx, dword [ebp - 0x401c]
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [sym.imp.kernel32.dll_GetOEMCP]
mov dword [ebp - 0x4038], eax
mov dword [ebp - 0x4044], ecx
call ecx
mov dword [esp + 0x1c], 0
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [ebp - 0x403c], eax
call eax
sub esp, 0x20
mov dword [ebp - 0x4030], eax
mov ecx, dword fs:[0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ecx + 0x30]
mov dword [ebp - 0x4040], ecx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov edx, dword [ebp - 0x4038]
sub esp, 0xc
test eax, eax
mov dword [ebp - 0x4034], eax
je 0x40127e
mov ecx, dword [ebp - 0x4044]
call ecx
mov ecx, dword [ebp - 0x4034]
mov edx, dword [ebp - 0x4030]
mov dword [esp + 8], esi
mov dword [esp + 0x1c], 0
mov esi, dword [ebp - 0x403c]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call esi
mov esi, dword [ebp - 0x402c]
sub esp, 0x20
mov dword [esp], 0xfffffff5
call esi
mov edx, dword [ebp - 0x4030]
sub esp, 4
mov dword [esp + 0xc], edi
mov edi, dword [ebp - 0x4034]
mov dword [esp + 8], edx
mov dword [esp + 0x10], 0
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteFile]
mov ecx, dword [ebp - 0x4040]
sub esp, 0x14
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
jmp 0x401278
Function at 0x4013e0
Capabilities:
Get hostname

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x4c
mov esi, dword [ecx]
mov ebx, dword [ecx + 4]
cmp esi, 1
jle 0x4014a0
mov dword [esp + 8], 2
mov dword [esp + 4], 0x403006
mov eax, dword [ebx + 4]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcsncmp]
test eax, eax
je 0x40147a
mov edx, 1
mov eax, dword [ebx + edx*4]
cmp word [eax], 0x2d
jne 0x401470
movzx eax, word [eax + 2]
cmp ax, 0x3f
je 0x40147a
cmp ax, 0x73
je 0x401498
mov dword [esp + 4], eax
mov dword [esp], 0x66
call sym._hostname_message_printfW
mov eax, 0x65
call sym._hostname_message
lea esp, [ebp - 0xc]
mov eax, 1
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
mov eax, 0x68
call sym._hostname_message
mov eax, 0x65
call sym._hostname_message
lea esp, [ebp - 0xc]
mov eax, 1
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
inc edx
cmp edx, esi
jne 0x401426
lea esi, [esi]
lea eax, [ebp - 0x3c]
lea ebx, [ebp - 0x38]
mov dword [ebp - 0x3c], 0x10
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_GetComputerNameW]
sub esp, 8
test eax, eax
je 0x4014e0
mov dword [esp + 4], ebx
mov dword [esp], 0x40300c
call sym._hostname_printfW
lea esp, [ebp - 0xc]
xor eax, eax
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp], 0x67
mov dword [esp + 4], eax
call sym._hostname_message_printfW
lea esp, [ebp - 0xc]
mov eax, 1
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret

Function at 0x401510
Capabilities:
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
inc eax
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop
Function at 0x40bc9c
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0040b919
Function at 0x100019ae
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
push 0xf8
call fcn.10013c63
mov esi, eax
pop ecx
mov dword [ebp - 8], esi
call fcn.1000187b
push dword [ebp + 0xc]
lea eax, [ebp - 0x24]
push dword [ebp + 8]
push eax
call fcn.100068df
lea eax, [ebp - 0x24]
add esp, 0xc
push eax
call fcn.100068f8
mov dword [ebp - 0xc], eax
pop ecx
lea eax, [ebp - 0x24]
push eax
call fcn.1000698e
mov dword [ebp - 0x14], eax
pop ecx
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x10], edx
call fcn.1000698e
mov dword [ebp - 0x2c], eax
pop ecx
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x28], edx
call fcn.1000698e
mov dword [ebp - 0x34], eax
pop ecx
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x30], edx
call fcn.1000698e
mov esi, eax
pop ecx
lea eax, [ebp - 0x24]
push eax
mov ebx, edx
call fcn.1000698e
pop ecx
push 0x40
push 0x3000
push dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
push 0
mov dword [ebp - 0x18], edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
mov dword [ebp - 4], edi
test edi, edi
je 0x10001bb8
push ebx
lea eax, [ebp - 0x44]
push esi
push eax
call fcn.100068df
add esp, 0xc
lea eax, [ebp - 0x44]
push 0xc
push eax
call fcn.10006966
jmp 0x10001b36
mov ecx, 0x400
cmp ax, cx
jne 0x10001a8c
mov esi, dword [ebx + 8]
push edi
mov edi, dword [ebp - 0x2c]
jmp 0x10001b15
mov ecx, 0x401
cmp ax, cx
jne 0x10001a9f
mov esi, dword [ebx + 8]
push edi
mov edi, dword [ebp - 0x34]
jmp 0x10001b15
mov ecx, 0x402
cmp ax, cx
jne 0x10001aaf
mov esi, dword [ebx + 8]
push edi
jmp 0x10001b15
mov ecx, 0x403
cmp ax, cx
jne 0x10001b09
lea eax, [ebp - 0x44]
push eax
call fcn.10006a4e
mov esi, eax
pop ecx
lea eax, [ebp - 0x44]
push eax
call fcn.10006a4e
pop ecx
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x10001ae3
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10001b9d
mov edx, dword [ebp - 8]
mov edi, eax
call fcn.10001844
test eax, eax
je 0x10001bb0
mov edi, eax
jmp 0x10001b10
mov ecx, dword [ebp - 8]
cwde
lea edi, [ecx + eax*4]
push dword [ebp - 4]
xor esi, esi
mov ecx, dword [ebp - 0x14]
mov eax, ebx
call fcn.10001961
pop ecx
test eax, eax
je 0x10001bb8
lea eax, [ebp - 0x44]
push 0xc
push eax
call fcn.10006966
mov edi, dword [ebp - 4]
mov ebx, eax
movzx eax, word [ebx + 2]
pop ecx
pop ecx
mov ecx, 0x404
cmp ax, cx
jne 0x10001a76
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push edi
call fcn.1001a750
add esp, 0xc
push dword [ebp - 0x10]
xor esi, esi
push esi
push dword [ebp - 0x14]
call fcn.1001b930
mov eax, dword [ebp - 0xc]
add esp, 0xc
push dword [ebp - 0x18]
add eax, edi
push dword [ebp - 0x1c]
call eax
push dword [ebp - 0x10]
push esi
push edi
call fcn.1001b930
add esp, 0x14
push 0x8000
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push dword [ebp - 8]
call fcn.10013b86
jmp 0x10001bb7
push edi
push esi
push str._s__s
push 0x4c
call fcn.10001ef6
add esp, 0x10
jmp 0x10001bb8
push 0x4e
call fcn.10001ee1
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10001f50
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0x3a980
call fcn.10009c12
xor edx, edx
inc edx
call fcn.10009716
xor ecx, ecx
and al, 8
cmp al, 8
setne cl
push 0x32
pop edx
dec ecx
and ecx, 0x803000
add ecx, 0x84400200
mov dword [0x10032c64], ecx
call fcn.10009716
cmp ax, 1
jne 0x10001f9c
or dword [0x10032c64], 0x80000
push esi
push edi
push 0x23
pop edx
call fcn.10009716
movzx eax, ax
xor edi, edi
sub eax, edi
je 0x10001fc1
dec eax
je 0x10002079
dec eax
je 0x10002070
dec eax
dec eax
jne 0x10001fdc
push edi
push edi
push 0x20
pop edx
call fcn.1000973f
push eax
push 3
push dword [ebp + 0x10]
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [0x10035fa4], eax
mov esi, dword [sym.imp.WININET.dll_InternetSetOptionA]
push 4
lea eax, [ebp - 4]
push eax
push 5
push dword [0x10035fa4]
call esi
push 4
lea eax, [ebp - 4]
push eax
push 6
push dword [0x10035fa4]
call esi
push 0x10032c60
push edi
push 3
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [0x10035fa4]
call dword [sym.imp.WININET.dll_InternetConnectA]
mov edi, eax
push 0x23
pop edx
mov dword [0x10035fa8], edi
call fcn.10009716
cmp ax, 4
jne 0x10002067
push 0x21
pop edx
call fcn.10009750
push eax
push 0x21
pop edx
call fcn.1000973f
push eax
push 0x2b
push edi
call esi
push 0x22
pop edx
call fcn.10009750
push eax
push 0x22
pop edx
call fcn.1000973f
push eax
push 0x2c
push dword [0x10035fa8]
call esi
call fcn.10009c33
pop edi
pop esi
leave
ret
push edi
push edi
push edi
push edi
jmp 0x10001fce
push edi
push edi
push edi
push 1
jmp 0x10001fce
Function at 0x100020ea
Capabilities:
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4b4
push ebx
push esi
push edi
xor ebx, ebx
push 0x3ff
lea eax, [ebp - 0x4af]
push ebx
push eax
mov dword [ebp - 0x2c], 0x1002c52c
mov dword [ebp - 0x28], ebx
mov byte [ebp - 0x4b0], bl
call fcn.1001b930
push 0x7f
lea eax, [ebp - 0xaf]
push ebx
push eax
mov byte [ebp - 0xb0], bl
call fcn.1001b930
add esp, 0x18
push 8
xor eax, eax
pop ecx
lea edi, [ebp - 0x20]
mov dword [ebp - 0x24], ebx
rep stosd dword es:[edi], eax
mov eax, dword [0x10035fb0]
cmp eax, ebx
je 0x10002278
lea esi, [ebp - 0x24]
call fcn.10007e91
push 0x10039cc0
mov edi, 0x1002c520
push edi
mov esi, 0x400
push esi
push dword [ebp - 0x1c]
call fcn.10013db6
push dword [0x100398a0]
lea eax, [ebp - 0xb0]
push 0x1002c530
push 0x80
push eax
call fcn.10013db6
lea eax, [ebp - 0xb0]
add esp, 0x20
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x10002195
push dword [0x10035fb0]
sub eax, ecx
push dword [0x10035fac]
push eax
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x24]
push eax
push 0xd
pop edx
call fcn.1000973f
push eax
call fcn.1000783e
mov eax, dword [ebp - 0x20]
add esp, 0x18
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x100021cd
sub eax, ecx
lea eax, [ebp - 0x4b0]
jne 0x100021ee
push dword [ebp - 0x1c]
push edi
push esi
push eax
call fcn.10013db6
add esp, 0x10
jmp 0x10002203
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push 0x1002c534
push esi
push eax
call fcn.10013db6
add esp, 0x14
call fcn.10009c12
push 0x10032c60
push dword [0x10032c64]
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
lea eax, [ebp - 0x4b0]
push eax
push 0x1b
pop edx
call fcn.1000973f
push eax
push dword [0x10035fa8]
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov esi, eax
push esi
call fcn.100020a5
mov eax, dword [ebp - 0x24]
pop ecx
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x10002244
push dword [ebp - 0x14]
sub eax, ecx
push dword [ebp - 0x18]
push eax
push dword [ebp - 0x24]
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
lea eax, [ebp - 0x24]
call fcn.10007f0e
mov dword [0x10035fb0], ebx
call fcn.10009c33
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000251a
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
cmp dword [0x10035fb4], 1
je 0x10002573
lea eax, [ebp - 0x190]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jge 0x1000254f
call dword [sym.imp.WS2_32.dll_WSACleanup]
push 1
call fcn.1001450c
push 0x14
pop edx
mov dword [0x10035fb4], 1
call fcn.10009728
push 0x13
pop edx
mov dword [0x10035fb8], eax
call fcn.10009728
mov dword [0x10035fbc], eax
leave
ret

Function at 0x10002575
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.1000251a
push 0x100
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x100025b2
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x100025b2
cmp word [eax + 8], 2
jne 0x100025b2
mov eax, dword [eax + 0xc]
cmp dword [eax], 0
je 0x100025b2
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x100025b4
xor eax, eax
pop ecx
pop ebp
ret

Function at 0x100025cb
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
cmp esi, 0x3ff
jg 0x10002604
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x400]
push eax
call fcn.10013e70
add esp, 0xc
lea eax, [ebp - 0x400]
push eax
mov byte [ebp + esi - 0x400], 0
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
leave
ret

Function at 0x100028dd
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push esi
push edi
push 0x44
pop edi
push edi
xor esi, esi
lea eax, [ebp - 0x70]
push esi
push eax
call fcn.1001b930
mov dword [ebp - 0x70], edi
xor eax, eax
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
push 0x100000
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], 0xc
mov dword [ebp - 0xc], 1
call dword [sym.imp.KERNEL32.dll_CreatePipe]
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
xor eax, eax
mov word [ebp - 0x40], ax
mov eax, dword [ebp - 4]
push esi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
push 0x10
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x70]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x44], 0x101
push dword [ebp + 8]
mov dword [ebp - 0x38], esi
call fcn.1000770b
add esp, 0x18
test eax, eax
je 0x10002994
push 0x2710
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 4]
lea esi, [ebp - 0x24]
push dword [ebp - 8]
sub esp, 0x10
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.100056e8
add esp, 0x18
pop edi
pop esi
leave
ret
Function at 0x10002a96
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, 0x400
push esi
call fcn.10013c63
mov ebx, eax
pop ecx
test ebx, ebx
je 0x10002b34
push dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push dword [ebp + 8]
push eax
call fcn.100068df
add esp, 0xc
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.10006a0a
pop ecx
pop ecx
test eax, eax
jne 0x10002ade
push ebx
call fcn.10013b86
jmp 0x10002b33
push dword [ebp + 0x10]
push ebx
call fcn.1001471d
mov esi, eax
pop ecx
pop ecx
cmp esi, 0xffffffff
je 0x10002b1d
test esi, esi
je 0x10002b1d
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.100069ad
add esp, 4
push eax
push 1
lea eax, [ebp - 0x14]
call fcn.100069b8
push eax
call fcn.10014896
push esi
call fcn.1001498f
add esp, 0x14
jmp 0x10002ad6
push ebx
call fcn.10013b86
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 8
call fcn.10001e83
pop ecx
pop ecx
pop esi
pop ebx
leave
ret

Function at 0x10002bb2
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov esi, eax
cmp esi, 0xffffffff
jne 0x10002bd0
or eax, 0xffffffff
jmp 0x10002c1f
push dword [ebp + 8]
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x10002bcb
movsx ecx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
push ecx
push dword [eax]
lea eax, [ebp - 0xc]
push eax
call fcn.1001a750
add esp, 0xc
push 2
pop eax
push dword [ebp + 0xc]
mov word [ebp - 0x10], ax
call sub.WS2_32.dll_htons
mov word [ebp - 0xe], ax
push 0x10
lea eax, [ebp - 0x10]
push eax
push esi
call sub.WS2_32.dll_connect
test eax, eax
je 0x10002c1d
push esi
call sub.WS2_32.dll_closesocket
jmp 0x10002bcb
mov eax, esi
pop esi
leave
ret

Function at 0x10002c22
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
or ebx, 0xffffffff
call esi
push dword [ebp + 0xc]
mov edi, eax
push dword [ebp + 8]
lea eax, [ebp - 0x20]
push eax
add edi, 0xea60
call fcn.100068df
lea eax, [ebp - 0x20]
add esp, 0xc
push eax
call fcn.10006a4e
mov dword [ebp - 8], eax
pop ecx
lea eax, [ebp - 0x20]
push eax
call fcn.100068f8
mov dword [ebp - 4], eax
pop ecx
lea eax, [ebp - 0x20]
call fcn.100069b8
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x20]
push eax
call fcn.100069ad
add esp, 4
mov dword [ebp - 0xc], eax
call fcn.1000251a
jmp 0x10002caa
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.10002bb2
mov ebx, eax
pop ecx
pop ecx
cmp ebx, 0xffffffff
jne 0x10002cce
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
call esi
cmp eax, edi
jb 0x10002c8b
push 0x46
call fcn.10001ee1
pop ecx
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
call sub.WS2_32.dll_closesocket
pop edi
pop esi
pop ebx
leave
ret
push 0
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push ebx
call sub.WS2_32.dll_send
jmp 0x10002cb8
Function at 0x10002cde
Capabilities:
Check for time delay via gettickcount
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
and dword [ebp - 0xc], 0
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
push dword [ebp + 0xc]
mov esi, eax
push dword [ebp + 8]
lea eax, [ebp - 0x24]
push eax
add esi, 0xea60
call fcn.100068df
add esp, 0xc
lea eax, [ebp - 0x24]
push 0x80
push eax
lea ebx, [ebp - 0xa8]
call fcn.10006a0a
lea eax, [ebp - 0x24]
call fcn.100069b8
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x24]
push eax
call fcn.100069ad
add esp, 0xc
mov dword [ebp - 8], eax
xor ebx, ebx
lea eax, [ebp - 0xa8]
push eax
lea ecx, [ebp - 4]
call fcn.10005aa1
pop ecx
test eax, eax
jne 0x10002d93
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x35
je 0x10002d76
call edi
cmp eax, esi
jae 0x10002d76
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0xa
jb 0x10002d40
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xa8]
push eax
push 0x32
call fcn.10001eb1
add esp, 0xc
pop edi
pop esi
pop ebx
leave
ret
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
call edi
cmp dword [ebp - 8], 0
jbe 0x10002de4
mov ebx, 0x2000
mov eax, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
sub eax, esi
cmp eax, ebx
jbe 0x10002dc3
mov eax, ebx
push 0
lea ecx, [ebp - 0x10]
push ecx
push eax
mov eax, dword [ebp - 0x14]
add eax, esi
push eax
push dword [ebp - 4]
call edi
test eax, eax
je 0x10002de4
add esi, dword [ebp - 0x10]
mov dword [ebp - 0xc], esi
cmp esi, dword [ebp - 8]
jb 0x10002db5
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10002d8e

Function at 0x10002fb9
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
cmp esi, 0x100
push ebx
jge 0x1000302e
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push eax
call fcn.1001a750
or dword [0x10032064], 0xffffffff
or dword [0x10032014], 0xffffffff
or dword [0x10032194], 0xffffffff
add esp, 0xc
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push 2
push 4
push 3
lea eax, [ebp - 0x104]
push eax
mov byte [ebp + esi - 0x104], bl
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov dword [0x10032014], eax
cmp eax, ebx
je 0x1000302e
push ebx
push 0x10002e4f
call fcn.10009b7f
pop ecx
pop ecx
mov dword [0x10032194], eax
pop ebx
leave
ret