joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001450
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
je 0x1000146f
mov dword [ebp - 0x10], 1
jmp 0x10001476
mov dword [ebp - 0x10], 0
mov cl, byte [ebp - 0x10]
mov byte [ebp - 1], cl
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
and edx, 0x8000
je 0x10001498
mov dword [ebp - 0x14], 1
jmp 0x1000149f
mov dword [ebp - 0x14], 0
mov al, byte [ebp - 0x14]
mov byte [ebp - 2], al
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
and ecx, 0x8000
je 0x100014c1
mov dword [ebp - 0x18], 1
jmp 0x100014c8
mov dword [ebp - 0x18], 0
mov dl, byte [ebp - 0x18]
mov byte [ebp - 3], dl
push 0x5b
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
je 0x100014e7
mov dword [ebp - 0x1c], 1
jmp 0x100014ee
mov dword [ebp - 0x1c], 0
mov cl, byte [ebp - 0x1c]
mov byte [ebp - 4], cl
push 0x5c
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
and edx, 0x8000
je 0x10001510
mov dword [ebp - 0x20], 1
jmp 0x10001517
mov dword [ebp - 0x20], 0
mov al, byte [ebp - 0x20]
mov byte [ebp - 5], al
mov dword [ebp - 0xc], 0
movzx ecx, byte [ebp - 1]
test ecx, ecx
je 0x10001535
mov dword [ebp - 0x24], 2
jmp 0x1000153c
mov dword [ebp - 0x24], 0
mov edx, dword [ebp - 0xc]
or edx, dword [ebp - 0x24]
mov dword [ebp - 0xc], edx
movzx eax, byte [ebp - 2]
test eax, eax
je 0x10001556
mov dword [ebp - 0x28], 1
jmp 0x1000155d
mov dword [ebp - 0x28], 0
mov ecx, dword [ebp - 0xc]
or ecx, dword [ebp - 0x28]
mov dword [ebp - 0xc], ecx
movzx edx, byte [ebp - 3]
test edx, edx
je 0x10001577
mov dword [ebp - 0x2c], 4
jmp 0x1000157e
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0xc]
or eax, dword [ebp - 0x2c]
mov dword [ebp - 0xc], eax
movzx ecx, byte [ebp - 4]
test ecx, ecx
jne 0x100015a0
movzx edx, byte [ebp - 5]
test edx, edx
jne 0x100015a0
mov dword [ebp - 0x30], 0
jmp 0x100015a7
mov dword [ebp - 0x30], 8
mov eax, dword [ebp - 0xc]
or eax, dword [ebp - 0x30]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x100021b0
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1002d02c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jl 0x100021cc
cmp dword [ebp + 8], 5
jl 0x100021d3
xor eax, eax
jmp 0x100022bf
mov dword [ebp - 0x18], 0x10002c70
mov dword [ebp - 0x14], 0x10002c90
mov dword [ebp - 0x10], 0x10002cb0
mov dword [ebp - 0xc], 0x10002cd0
mov dword [ebp - 8], 0x10002cf0
mov dword [ebp - 0x2c], 0x10002d10
mov dword [ebp - 0x28], 0x10002d30
mov dword [ebp - 0x24], 0x10002d50
mov dword [ebp - 0x20], 0x10002d70
mov dword [ebp - 0x1c], 0x10002d90
mov eax, dword [ebp + 8]
cmp dword [eax*4 + 0x1002e520], 0
jne 0x1000225a
push 0
mov ecx, dword [0x1002e5f0]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp + edx*4 - 0x18]
push eax
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov ecx, dword [ebp + 8]
mov dword [ecx*4 + 0x1002e520], eax
mov edx, dword [ebp + 8]
cmp dword [edx*4 + 0x1002e520], 0
jne 0x1000225a
xor eax, eax
jmp 0x100022bf
mov eax, dword [ebp + 8]
cmp dword [eax*4 + 0x1002e50c], 0
jne 0x100022ba
push 0
mov ecx, dword [0x1002e5f0]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp + edx*4 - 0x2c]
push eax
push 7
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov ecx, dword [ebp + 8]
mov dword [ecx*4 + 0x1002e50c], eax
mov edx, dword [ebp + 8]
cmp dword [edx*4 + 0x1002e50c], 0
jne 0x100022ba
mov eax, dword [ebp + 8]
mov ecx, dword [eax*4 + 0x1002e520]
push ecx
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov edx, dword [ebp + 8]
mov dword [edx*4 + 0x1002e520], 0
xor eax, eax
jmp 0x100022bf
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001028b
mov esp, ebp
pop ebp
ret

Function at 0x10002880
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x100028a2
mov eax, 1
jmp 0x10002947
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 4], 0
jne 0x100028c3
jmp 0x10002936
push 0
push 1
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 8], 0
jne 0x100028e4
jmp 0x10002936
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0xc], 0
jne 0x10002905
jmp 0x10002936
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x10004400
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x1000292f
jmp 0x10002936
mov dword [ebp - 8], 1
cmp dword [ebp - 8], 0
jne 0x10002944
mov ecx, dword [ebp - 4]
call fcn.10002950
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x10002950
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x100029b9
mov ecx, dword [ebp - 4]
call fcn.10002aa0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [ebp - 4]
mov dword [eax + 0x18], 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x1388
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 1
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.1000b4b0
add esp, 8
push 0
mov edx, dword [ebp - 4]
add edx, 4
push edx
call fcn.1000b4b0
add esp, 8
push 0
mov eax, dword [ebp - 4]
add eax, 8
push eax
call fcn.1000b4b0
add esp, 8
push 0
mov ecx, dword [ebp - 4]
add ecx, 0xc
push ecx
call fcn.1000b4b0
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x10004be0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x1002d02c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x118], 0x114
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x114], 6
jb 0x10004c25
mov dword [ebp - 0x11c], 1
jmp 0x10004c2f
mov dword [ebp - 0x11c], 0
mov eax, dword [ebp - 0x11c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001028b
mov esp, ebp
pop ebp
ret
Function at 0x10007430
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
test al, 0x50
call fcn.10007197
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.1000714c
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x10007475
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.10007187
pop ecx
inc edi
sar eax, cl
lea eax, [ebp - 0x40]
push eax
call fcn.10007197
push eax
push esi
push dword [ebp + 8]
call fcn.1000714c
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.10007187
add dword [eax], ebp
test al, 0xe3
lea eax, [ebp - 0x18]
mov byte [ebp - 0x18], bl
push eax
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.10007197
push eax
push esi
push dword [ebp + 8]
call fcn.1000714c
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.10007197
push eax
push esi
push dword [ebp + 8]
call fcn.1000714c
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.10007197
push eax
push esi
push dword [ebp + 8]
call fcn.1000714c
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.10007187
in eax, dx
adc eax, 0x9d8849af
jl 0x1000760c
invalid
invalid
Function at 0x1000aa40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1000aa64
xor eax, eax
jmp 0x1000aae4
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000aa7b
xor eax, eax
jmp 0x1000aae4
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x1000aac7
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jae 0x1000aac7
mov edx, dword [ebp - 4]
movzx eax, word [edx]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x1000aa9e
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x1000aad3
xor eax, eax
jmp 0x1000aae4
mov edx, dword [ebp - 4]
movzx eax, word [edx]
test eax, eax
jne 0x1000aae1
xor eax, eax
jmp 0x1000aae4
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x1000e960
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x1002d02c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x8c], 0
lea eax, [ebp - 0x88]
push eax
mov ecx, dword [ebp + 0x18]
or ecx, 1
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0
je 0x1000e9d2
jmp 0x1000ea6a
mov dword [ebp - 0xa0], 0x40
lea ecx, [ebp - 0xa0]
push ecx
lea edx, [ebp - 0x84]
push edx
lea eax, [ebp - 0x9c]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x88]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0
je 0x1000ea17
jmp 0x1000ea6a
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 1
je 0x1000ea45
cmp dword [ebp - 0x98], 4
je 0x1000ea37
jmp 0x1000ea5c
mov ecx, dword [ebp - 0x84]
mov dword [ebp - 0x90], ecx
jmp 0x1000ea60
lea edx, [ebp - 0x84]
push edx
call fcn.10013944
add esp, 4
mov dword [ebp - 0x90], eax
jmp 0x1000ea60
jmp 0x1000ea6a
mov dword [ebp - 0x8c], 1
cmp dword [ebp - 0x88], 0
je 0x1000ea80
mov eax, dword [ebp - 0x88]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x8c], 0
je 0x1000ea9a
cmp dword [ebp + 0x14], 0
je 0x1000ea9a
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x90]
mov dword [ecx], edx
mov eax, dword [ebp - 0x8c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001028b
mov esp, ebp
pop ebp
ret
Function at 0x1000f5d0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1000f605
jmp 0x1000f65e
mov edx, dword [ebp - 8]
add edx, 1
push edx
call fcn.10010952
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
call sub.VERSION.dll_GetFileVersionInfoW
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0x10024294
mov edx, dword [ebp - 4]
push edx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x1000f65e
mov eax, dword [ebp - 4]
push eax
call fcn.100107d0
add esp, 4
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
je 0x1000f66c
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x1000fb18
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
lea eax, [ebp - 4]
xor edi, edi
push eax
push 0x20019
push edi
mov dword [ebp - 4], edi
call fcn.1000fb94
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000fb8d
cmp dword [ebp - 4], edi
je 0x1000fb8d
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], edi
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 8], edi
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0x10], 4
push eax
push edi
push str.Tracing
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x1000fb89
cmp dword [ebp - 8], 4
cmove edi, dword [ebp - 0xc]
mov eax, edi
jmp 0x1000fb8f
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x1000fb94
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x1002d02c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x110
lea eax, [ebp - 0x114]
push 0
push eax
call fcn.10010740
add esp, 0xc
mov dword [ebp - 0x118], 0x114
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 6
mov ecx, str.SoftwareAppDataLowDeskperienceTraceServer
mov eax, str.SoftwareDeskperienceTraceServer
cmovae eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001028b
mov esp, ebp
pop ebp
ret
Function at 0x1004a7b
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x10080d3
call fcn.01005de8
sub esp, 0x20c
mov eax, dword [0x100a19c]
push ebx
push esi
xor esi, esi
mov dword [ebp - 0x10], eax
mov ebx, ecx
mov dword [ebp - 0x214], esi
push 0x20019
push 0x1001208
push 0x80000002
lea ecx, [ebp - 0x214]
mov dword [ebp - 4], esi
call fcn.01001916
cmp eax, esi
je 0x1004ac4
mov esi, eax
jmp 0x1004b2b
push edi
xor edi, edi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x210]
push eax
push edi
push dword [ebp - 0x214]
mov dword [ebp - 0x218], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc edi
cmp eax, 0x103
je 0x1004b2a
cmp eax, esi
jne 0x1004b2a
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.01004574
test al, al
je 0x1004ac7
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x214]
push eax
mov ecx, ebx
call fcn.01004841
jmp 0x1004ac7
pop edi
lea ecx, [ebp - 0x214]
call fcn.010018f8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.01005aae
leave
ret
Function at 0x1005bc6
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x1001598
call fcn.01005e9c
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x1005c01
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1005c01
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x1005c19
cmp eax, 0x20b
je 0x1005c06
mov dword [ebp - 0x1c], edi
jmp 0x1005c2d
cmp dword [ecx + 0x84], 0xe
jbe 0x1005c01
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x1005c27
cmp dword [ecx + 0x74], 0xe
jbe 0x1005c01
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 2
pop ebx
push ebx
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x100a318], 0xffffffff
or dword [0x100a31c], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x100a29c]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x100a298]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x100a314], eax
call fcn.01005e92
cmp dword [0x100a1a0], edi
jne 0x1005c8a
push fcn.01005e92
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.01005e7b
push 0x100a01c
push 0x100a018
call sub.msvcrt.dll__initterm
mov eax, dword [0x100a294]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x100a290]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.msvcrt.dll___wgetmainargs]
mov dword [ebp - 0x38], eax
push 0x100a014
push section..data
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
mov esi, dword [eax]
cmp esi, edi
jne 0x1005cf0
or dword [ebp - 4], 0xffffffff
mov eax, 0xff
jmp 0x1005daa
mov dword [ebp - 0x20], esi
cmp word [esi], 0x22
jne 0x1005d3e
add esi, ebx
mov dword [ebp - 0x20], esi
mov ax, word [esi]
cmp ax, di
je 0x1005d0c
cmp ax, 0x22
jne 0x1005cf9
cmp word [esi], 0x22
jne 0x1005d17
add esi, ebx
mov dword [ebp - 0x20], esi
mov ax, word [esi]
cmp ax, di
je 0x1005d25
cmp ax, 0x20
jbe 0x1005d12
mov dword [ebp - 0x54], edi
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [ebp - 0x54], 1
je 0x1005d4b
movzx eax, word [ebp - 0x50]
jmp 0x1005d4e
cmp word [esi], 0x20
jbe 0x1005d17
add esi, ebx
mov dword [ebp - 0x20], esi
jmp 0x1005d3e
push 0xa
pop eax
push eax
push esi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
mov dword [ebp - 0x3c], esi
cmp dword [ebp - 0x1c], edi
jne 0x1005d6f
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x1005da4
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.01005ed7
ret
Function at 0x1006093
Capabilities:
Set socket configuration

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x30]
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x10060b1
push eax
call dword [sym.imp.WSOCK32.dll_closesocket]
or dword [esi], 0xffffffff
push 0x1001674
call dword [sym.imp.WSOCK32.dll_inet_addr]
push esi
push 0
push eax
call fcn.01006800
test eax, eax
mov dword [ebp - 4], eax
jne 0x10060ec
push ebx
lea ebx, [edi + 0x2c]
push ebx
add edi, 0x28
push edi
push dword [esi]
call fcn.010066ce
mov dword [ebp - 4], eax
xor eax, eax
mov ax, word [ebx]
push eax
call dword [sym.imp.WSOCK32.dll_ntohs]
pop ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret

Function at 0x1006365
Capabilities:
Set socket configuration

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
and dword [ebp - 4], 0
and dword [ebp - 8], 0
cmp eax, 0xc0000120
push ebx
push esi
push edi
mov ebx, ecx
je 0x10064b4
cmp byte [0x100a2ac], 0
jne 0x10064b4
test eax, eax
mov edi, dword [ebp + 0x10]
mov esi, dword [edi + 8]
je 0x10063fb
cmp eax, 0x3e3
je 0x1006481
cmp eax, 0x2775
je 0x1006499
cmp eax, 0x2746
je 0x1006499
cmp eax, 0x274c
je 0x1006499
cmp eax, 0x2742
je 0x1006499
cmp eax, 0x2736
je 0x1006499
cmp eax, 0x274a
je 0x1006499
cmp eax, 0x2745
jne 0x1006481
jmp 0x1006499
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
add edi, 0x50
push edi
mov ecx, ebx
call fcn.01005f1d
test eax, eax
jl 0x100646f
xor edi, edi
cmp dword [ebp - 4], edi
je 0x100646f
push 4
lea eax, [ebx + 0x30]
push eax
push 0x700b
push pe_overlay
push esi
call dword [sym.imp.WSOCK32.dll_setsockopt]
push 0x6c
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, edi
pop ecx
je 0x1006449
mov ecx, eax
call fcn.0100721e
mov edi, eax
test edi, edi
je 0x100646f
push dword [ebp + 8]
mov ecx, edi
push dword [ebp - 8]
push dword [ebp - 4]
push esi
call fcn.01007850
test eax, eax
jl 0x100647b
push edi
mov ecx, 0x100a2b0
call fcn.01007d8e
jmp 0x100647b
cmp esi, 0xffffffff
je 0x100647b
push esi
call dword [sym.imp.WSOCK32.dll_closesocket]
mov edi, dword [ebp + 0x10]
or esi, 0xffffffff
push 0
push ebx
push 0x1006fd5
push edi
push esi
push dword [ebx + 0x30]
push 0
call fcn.01006af4
test eax, eax
je 0x10064ca
cmp esi, 0xffffffff
je 0x10064a5
push esi
call dword [sym.imp.WSOCK32.dll_closesocket]
mov ecx, ebx
call fcn.010060f8
push edi
call fcn.01007a82
jmp 0x10064ca
push dword [ebp + 0x10]
call fcn.01007a82
mov eax, dword [ebx + 0x20]
test eax, eax
je 0x10064ca
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x10066ce
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100a19c]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x18], 0x10
call dword [sym.imp.WSOCK32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x100670b
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
jmp 0x1006721
test esi, esi
je 0x1006714
mov eax, dword [ebp - 0x10]
mov dword [esi], eax
test edi, edi
je 0x100671f
mov ax, word [ebp - 0x12]
mov word [edi], ax
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.01005aae
leave
ret 0xc

Function at 0x1006800
Capabilities:
Create tcp socket
Set socket configuration

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100a19c]
push esi
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
call dword [sym.imp.WSOCK32.dll_ntohs]
push 1
xor edi, edi
push edi
push edi
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_WSASocketW]
mov esi, eax
cmp esi, 0xffffffff
mov dword [ebp - 0x1c], esi
jne 0x1006847
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov esi, eax
jmp 0x10068c0
push ebx
push edi
push 0x100661e
push esi
call dword [sym.imp.KERNEL32.dll_BindIoCompletionCallback]
push 4
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x18], edi
mov ebx, 0x1001
push ebx
mov edi, pe_overlay
push edi
push esi
mov esi, dword [sym.imp.WSOCK32.dll_setsockopt]
call esi
and dword [ebp - 0x18], 0
push 4
lea eax, [ebp - 0x18]
push eax
push ebx
push edi
mov edi, dword [ebp - 0x1c]
push edi
call esi
mov eax, dword [ebp + 8]
cmp eax, 0xffffffff
pop ebx
je 0x10068c4
mov cx, word [ebp + 0xc]
mov dword [ebp - 0x10], eax
push 0x10
lea eax, [ebp - 0x14]
push eax
push edi
mov word [ebp - 0x14], 2
mov word [ebp - 0x12], cx
call dword [sym.imp.WSOCK32.dll_bind]
cmp eax, 0xffffffff
jne 0x10068c4
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push edi
mov esi, eax
call dword [sym.imp.WSOCK32.dll_closesocket]
mov eax, esi
jmp 0x10068cb
mov eax, dword [ebp - 0x20]
mov dword [eax], edi
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.01005aae
leave
ret 0xc