joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100ce29
Capabilities:
Connect socket
Connect udp socket
Create udp socket
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
movzx eax, word [esi]
push edi
push 0x11
push 2
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.WS2_32.dll_socket]
or edi, 0xffffffff
mov dword [ebp + 8], eax
cmp eax, edi
jne 0x100ce6f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jg 0x100ce63
mov esi, eax
jmp 0x100cf53
and eax, 0xffff
or eax, 0x80070000
jmp 0x100ce5c
push dword [ebp + 0xc]
push esi
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, edi
jne 0x100ce99
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x100ce92
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
jmp 0x100cf3c
mov esi, dword [ebp + 0x14]
push 0x30
push ebx
push esi
call sub.msvcrt.dll_memset
mov al, byte [esi]
and al, 0xcb
or al, 0xb
add esp, 0xc
mov byte [esi], al
call fcn.0100d498
push edx
push eax
call fcn.0100d37b
push ebx
push 0x30
push esi
push dword [ebp + 8]
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], edx
call dword [sym.imp.WS2_32.dll_send]
cmp eax, edi
je 0x100ce7e
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x100ce7e
push 1
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, edi
je 0x100ce7e
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, edi
je 0x100ce7e
cmp eax, 0x102
jne 0x100cf16
mov esi, 0x800705b4
jmp 0x100cf3c
push ebx
push 0x30
push esi
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
call fcn.0100d498
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
mov dword [ecx + 4], edx
cmp esi, edi
je 0x100ce7e
xor esi, esi
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_closesocket]
cmp dword [ebp - 4], ebx
je 0x100cf53
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x14
Function at 0x100cf61
Capabilities:
Resolve dns

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
cmp dword [ebp + 0x10], ebx
je 0x100d0b6
cmp dword [ebp + 0x14], ebx
je 0x100d0b6
cmp dword [ebp + 0x18], ebx
je 0x100d0b6
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x28]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
dec eax
push 2
pop ecx
je 0x100cfb3
dec eax
je 0x100cfaa
mov dword [ebp - 0x24], ebx
jmp 0x100cfb6
mov dword [ebp - 0x24], 0x17
jmp 0x100cfb6
mov dword [ebp - 0x24], ecx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x28]
push eax
push 0x1002ffc
push dword [ebp + 8]
mov dword [ebp - 0x20], ecx
call dword [sym.imp.WS2_32.dll_GetAddrInfoW]
test eax, eax
je 0x100cfee
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, ebx
jle 0x100cfe7
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
jmp 0x100d0bb
mov eax, dword [ebp - 8]
jmp 0x100cff7
mov eax, dword [eax + 0x1c]
inc ebx
test eax, eax
jne 0x100cff3
lea ecx, [ebp + 0xc]
push ecx
push eax
push 0x80
push eax
push ebx
call fcn.0100be00
push edx
push eax
call fcn.0100985e
mov esi, eax
test esi, esi
jl 0x100d0bb
push dword [ebp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 0x40
call edi
mov dword [ebp - 4], eax
test eax, eax
je 0x100d05c
lea eax, [ebp + 0xc]
push eax
push 0
push 4
xor eax, eax
push eax
push ebx
call fcn.0100be00
push edx
push eax
call fcn.0100985e
mov esi, eax
test esi, esi
jl 0x100d0bb
push dword [ebp + 0xc]
push 0x40
call edi
mov edi, eax
test edi, edi
jne 0x100d063
mov esi, 0x8007000e
jmp 0x100d0bb
and dword [ebp + 0xc], 0
mov esi, dword [ebp - 8]
test ebx, ebx
jbe 0x100d09d
mov eax, dword [ebp - 4]
mov dword [ebp + 8], eax
push dword [esi + 0x10]
push dword [esi + 0x18]
push dword [ebp + 8]
call sub.msvcrt.dll_memcpy
mov eax, dword [esi + 0x10]
mov ecx, dword [ebp + 0xc]
sub dword [ebp + 8], 0xffffff80
add esp, 0xc
inc dword [ebp + 0xc]
mov dword [edi + ecx*4], eax
mov esi, dword [esi + 0x1c]
cmp dword [ebp + 0xc], ebx
jb 0x100d074
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov eax, dword [ebp + 0x14]
mov dword [eax], edi
mov eax, dword [ebp + 0x18]
xor esi, esi
mov dword [ebp - 4], esi
mov dword [eax], ebx
jmp 0x100d0bb
mov esi, 0x8000ffff
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x100d0c5
mov byte [eax], 1
cmp dword [ebp - 4], 0
je 0x100d0d4
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 8], 0
je 0x100d0e3
push dword [ebp - 8]
call dword [sym.imp.WS2_32.dll_FreeAddrInfoW]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x18
Function at 0x100d802
Capabilities:
List domain servers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
push edi
push dword [ebp + 8]
mov dword [eax], edi
mov eax, dword [ebp + 0x10]
push 0x18
mov dword [eax], edi
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 8]
push eax
push 0x65
push edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call sub.NETAPI32.dll_NetServerEnum
cmp eax, edi
je 0x100d853
jg 0x100d847
mov esi, eax
jmp 0x100d977
and eax, 0xffff
or eax, 0x80070000
jmp 0x100d840
mov ecx, dword [ebp - 0x14]
cmp ecx, edi
jbe 0x100d87c
mov eax, dword [ebp - 8]
add eax, 8
test dword [eax + 8], 0x1000
je 0x100d871
cmp dword [eax], 5
jb 0x100d871
inc dword [ebp - 4]
add eax, 0x18
dec ecx
jne 0x100d860
cmp dword [ebp - 4], edi
jne 0x100d886
mov esi, 0x80070774
jmp 0x100d977
mov eax, dword [ebp - 4]
imul eax, eax, 0x14
push ebx
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
mov dword [ebp + 8], ebx
cmp ebx, edi
je 0x100d993
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x10], edi
cmp dword [ebp - 0x14], edi
jbe 0x100d93c
mov eax, dword [ebp - 8]
add eax, edi
test dword [eax + 0x10], 0x1000
je 0x100d928
cmp dword [eax + 8], 5
jb 0x100d928
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 4]
jae 0x100d98c
mov eax, dword [eax + 4]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x100d8d8
sub eax, ecx
sar eax, 1
lea esi, [eax + 1]
lea eax, [esi + esi]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebx], eax
test eax, eax
je 0x100d993
mov ecx, dword [ebp - 8]
push dword [edi + ecx + 4]
push esi
push eax
call fcn.01003fae
mov esi, eax
test esi, esi
jl 0x100d951
mov eax, dword [ebp - 8]
mov eax, dword [edi + eax + 0x10]
shr eax, 3
and al, 1
inc dword [ebp - 0xc]
mov byte [ebx + 0x10], al
add ebx, 0x14
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
add edi, 0x18
cmp eax, dword [ebp - 0x14]
jb 0x100d8b2
xor edi, edi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x10]
mov dword [ebp + 8], edi
mov dword [ecx], eax
xor esi, esi
mov edi, dword [ebp + 8]
test edi, edi
je 0x100d974
mov ebx, dword [ebp - 4]
test ebx, ebx
jbe 0x100d96b
push edi
call fcn.0100d58f
add edi, 0x14
dec ebx
jne 0x100d95f
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor edi, edi
pop ebx
cmp dword [ebp - 8], edi
je 0x100d984
push dword [ebp - 8]
call sub.NETAPI32.dll_NetApiBufferFree
pop edi
mov eax, esi
pop esi
leave
ret 0xc
mov esi, 0x8000ffff
jmp 0x100d951
mov esi, 0x8007000e
jmp 0x100d951
Function at 0x100c3f6
Capabilities:
Get process heap flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
sub esp, 0xc
push ebx
push esi
push 8
xor esi, esi
push esi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ebx, eax
cmp ebx, esi
jne 0x100c424
mov esi, 0xc000009a
jmp 0x100c482
push edi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0100c343
test eax, eax
jl 0x100c493
mov edi, dword [ebp - 4]
cmp dword [edi + 0x14], esi
je 0x100c493
cmp dword [edi + 0x18], esi
jbe 0x100c467
mov eax, dword [edi + 0x14]
lea eax, [eax + esi*4]
cmp dword [eax], 0
je 0x100c461
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x100c48a
inc esi
cmp esi, dword [edi + 0x18]
jb 0x100c445
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push 0
push dword [eax + 0x18]
mov esi, 0xc000000d
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x14
mov dword [ebx], esi
xor esi, esi
mov dword [ebx + 4], esi
jmp 0x100c4b0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call fcn.0101073d
mov esi, eax
test esi, esi
jl 0x100c467
mov eax, dword [ebp - 0xc]
mov dword [ebx], eax
mov eax, dword [ebp - 8]
mov dword [ebx + 4], eax
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
mov eax, dword [ebp + 0x18]
mov dword [eax], 8
jmp 0x100c481
Function at 0x100d835
Capabilities:
Get process heap flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
mov ebx, dword [ebp + 0xc]
mov ecx, dword [ebx]
imul ecx, ecx, 0x14
push esi
push ecx
xor esi, esi
push esi
push dword [eax + 0x18]
mov dword [ebp - 0xc], esi
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ecx, eax
mov dword [ebp - 8], ecx
cmp ecx, esi
jne 0x100d875
mov dword [ebp - 0xc], 0xc000009a
jmp 0x100d969
cmp byte [ebp + 0x18], 0
push edi
mov dword [ebp + 0xc], esi
je 0x100d8bf
mov dword [ebp + 0x18], esi
cmp dword [ebx], esi
jbe 0x100d8bf
mov eax, dword [ebp + 8]
mov dword [ebp - 4], ecx
push 4
pop ecx
mov edi, 0x1001d64
mov esi, eax
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
jne 0x100d8b0
mov edi, dword [ebp - 4]
inc dword [ebp + 0xc]
add dword [ebp - 4], 0x14
push 5
pop ecx
mov esi, eax
rep movsd dword es:[edi], dword [esi]
and dword [eax + 0x10], edx
inc dword [ebp + 0x18]
mov ecx, dword [ebp + 0x18]
add eax, 0x14
cmp ecx, dword [ebx]
jb 0x100d88c
xor esi, esi
mov eax, dword [ebp + 0x14]
cmp eax, esi
jbe 0x100d92a
mov ecx, dword [ebp + 0x10]
mov dword [ebp + 0x10], ecx
mov dword [ebp - 4], eax
mov dword [ebp + 0x18], esi
cmp dword [ebx], esi
jbe 0x100d921
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
imul eax, eax, 0x14
add eax, dword [ebp - 8]
mov dword [ebp + 0x14], edi
cmp dword [edi + 0x10], esi
je 0x100d90e
mov esi, dword [ebp + 0x10]
push 4
pop ecx
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
jne 0x100d90c
mov edx, dword [ebp + 0x14]
inc dword [ebp + 0xc]
push 5
mov edi, eax
pop ecx
mov esi, edx
rep movsd dword es:[edi], dword [esi]
add eax, 0x14
and dword [edx + 0x10], 0
xor esi, esi
inc dword [ebp + 0x18]
mov edi, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x18]
add edi, 0x14
mov dword [ebp + 0x14], edi
cmp ecx, dword [ebx]
jb 0x100d8e5
add dword [ebp + 0x10], 0x10
dec dword [ebp - 4]
jne 0x100d8cf
mov eax, dword [ebx]
imul eax, eax, 0x14
push eax
push esi
push dword [ebp + 8]
call sub.msvcrt.dll_memset
mov edi, dword [ebp + 0xc]
mov eax, edi
imul eax, eax, 0x14
push eax
push dword [ebp - 8]
push dword [ebp + 8]
call sub.msvcrt.dll_memcpy
mov eax, dword fs:[0x18]
add esp, 0x18
push dword [ebp - 8]
mov dword [ebx], edi
mov eax, dword [eax + 0x30]
push esi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop edi
mov eax, dword [ebp - 0xc]
pop esi
pop ebx
leave
ret 0x14
Function at 0x100e228
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
mov ebx, 0x12000004
push ebx
push dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call fcn.01011292
cmp eax, esi
mov dword [ebp - 0xc], eax
jl 0x100e312
push esi
lea eax, [ebp - 8]
push eax
push sym.imp.KERNEL32.dll_GetModuleFileNameW
push 0x800
call fcn.010120fe
cmp eax, esi
mov dword [ebp - 0xc], eax
jl 0x100e312
mov eax, dword [ebp - 8]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x100e283
mov ecx, dword [ebp - 4]
sub eax, edx
sar eax, 1
lea eax, [ecx + eax*2 + 2]
mov dword [ebp - 4], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push dword [ebp - 4]
push esi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
cmp edi, esi
jne 0x100e2c1
mov dword [ebp - 0xc], 0xc000009a
jmp 0x100e2f9
push dword [ebp - 4]
push esi
push edi
call sub.msvcrt.dll_memset
push dword [ebp - 8]
push dword [ebp - 0x10]
push 0x10018fc
push dword [ebp - 4]
push edi
call fcn.0100dfcf
add esp, 0x20
cmp eax, esi
mov dword [ebp - 0xc], eax
jl 0x100e2f9
push dword [ebp - 4]
push edi
push ebx
push dword [ebp + 8]
call fcn.0101b18e
mov dword [ebp - 0xc], eax
cmp edi, esi
je 0x100e311
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push esi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop edi
cmp dword [ebp - 8], esi
je 0x100e32d
push dword [ebp - 8]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp dword [ebp - 0x10], esi
je 0x100e348
push dword [ebp - 0x10]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword [ebp - 0xc]
pop esi
pop ebx
leave
ret 4
Function at 0x100f45f
Capabilities:
Get process heap force flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 8], 0
xor eax, eax
push ebx
mov ebx, dword [ebp + 0x10]
inc eax
mov byte [ebp - 1], 0
mov dword [ebx + 4], ebx
mov dword [ebx], ebx
cmp dword [ebp + 8], eax
jbe 0x100f59c
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ecx, dword [esi + eax*4]
movzx ecx, word [ecx]
cmp cx, 0x2f
je 0x100f4aa
cmp cx, 0x2d
je 0x100f4aa
inc eax
mov byte [ebp - 1], 1
cmp eax, dword [ebp + 8]
jb 0x100f486
jmp 0x100f5b3
cmp eax, dword [ebp + 8]
jae 0x100f5ad
lea ecx, [esi + eax*4]
mov dword [ebp - 0xc], ecx
mov ecx, dword [ecx]
movzx ecx, word [ecx]
cmp cx, 0x2f
je 0x100f4ce
cmp cx, 0x2d
jne 0x100f58d
and dword [ebp + 0x10], 0
inc eax
mov dword [ebp - 0x10], eax
mov edi, eax
jmp 0x100f4f0
mov eax, dword [esi + edi*4]
movzx eax, word [eax]
cmp ax, 0x2f
je 0x100f4f5
cmp ax, 0x2d
je 0x100f4f5
inc dword [ebp + 0x10]
inc edi
cmp edi, dword [ebp + 8]
jb 0x100f4da
mov ecx, dword [ebp + 0x10]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
lea ecx, [ecx*4 + 0x10]
push ecx
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
test esi, esi
je 0x100f5a4
mov eax, dword [ebp + 0x10]
lea eax, [eax*4 + 0x10]
push eax
push 0
push esi
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
add esp, 0xc
inc eax
inc eax
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0xc], eax
test eax, eax
je 0x100f573
mov edi, dword [ebp - 0x10]
cmp edi, dword [ebp + 8]
jae 0x100f573
lea edx, [esi + 0x10]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + edi*4]
movzx ecx, word [eax]
cmp cx, 0x2f
je 0x100f573
cmp cx, 0x2d
je 0x100f573
mov dword [edx], eax
add edx, 4
inc edi
cmp edi, dword [ebp + 8]
jb 0x100f553
mov eax, dword [ebx + 4]
cmp edi, dword [ebp + 8]
mov dword [esi + 4], eax
mov dword [esi], ebx
mov dword [eax], esi
mov dword [ebx + 4], esi
mov esi, dword [ebp + 0xc]
mov eax, edi
jmp 0x100f4ad
mov dword [ebp - 8], 0xc000000d
push ebx
call fcn.0100f3c8
pop edi
pop esi
mov eax, dword [ebp - 8]
pop ebx
leave
ret 0xc
mov dword [ebp - 8], 0xc000009a
jmp 0x100f594
cmp byte [ebp - 1], 0
je 0x100f5cf
push 0x1001498
call fcn.0100f387
test al, al
jne 0x100f5cf
push 0x100148c
call fcn.0100f387
test al, al
je 0x100f58d
cmp dword [ebp + 8], 1
jbe 0x100f59a
mov eax, dword [esi + 4]
movzx eax, word [eax]
cmp ax, 0x2f
je 0x100f59a
cmp ax, 0x2d
je 0x100f59a
push 0x1001498
call fcn.0100f387
test al, al
jne 0x100f603
push 0x100148c
call fcn.0100f387
test al, al
je 0x100f59a
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0x10
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ecx, eax
test ecx, ecx
je 0x100f5a4
xor eax, eax
mov edi, ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
and dword [ecx + 0xc], 0
mov dword [ecx + 8], eax
mov eax, dword [ebx]
mov dword [ecx], eax
mov dword [ecx + 4], ebx
mov dword [eax + 4], ecx
mov dword [ebx], ecx
jmp 0x100f59a
Function at 0x1010398
Capabilities:
Check for peb beingdebugged flag
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1025050]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push 0x104
lea eax, [ebp - 0x20c]
push eax
push edi
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jne 0x10103e1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x10103e7
mov ebx, 0xc0000001
jmp 0x1010440
lea edi, [ebp - 0x20c]
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x10103ec
mov ecx, dword fs:[0x18]
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
mov eax, dword [ecx + 0x30]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [esi], eax
test eax, eax
jne 0x1010421
mov ebx, 0xc000009a
jmp 0x1010440
mov ecx, edi
lea esi, [ecx + 2]
mov dx, word [ecx]
inc ecx
inc ecx
test dx, dx
jne 0x1010426
sub ecx, esi
sar ecx, 1
push edi
inc ecx
push ecx
push eax
call fcn.0101296c
add esp, 0xc
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.010124d0
leave
ret 8

Function at 0x1010458
Capabilities:
Check for peb beingdebugged flag
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x1025050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov esi, 0x1001c44
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
push 0x43
mov dword [ebp - 0x90], eax
movsw word es:[edi], word [esi]
pop eax
mov esi, 0xc000000e
mov word [ebp - 0xc], ax
push 0x40
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x10104c3
lea eax, [ebp - 0x8c]
push eax
push dword [ebp - 0x90]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x10104d0
inc word [ebp - 0xc]
cmp word [ebp - 0xc], 0x5a
jbe 0x1010493
jmp 0x1010530
lea eax, [ebp - 0xc]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x10104d6
mov ecx, dword fs:[0x18]
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
mov eax, dword [ecx + 0x30]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebx], eax
test eax, eax
jne 0x101050b
mov esi, 0xc000009a
jmp 0x1010530
lea ecx, [ebp - 0xc]
lea esi, [ecx + 2]
mov dx, word [ecx]
inc ecx
inc ecx
test dx, dx
jne 0x1010511
sub ecx, esi
sar ecx, 1
lea edx, [ebp - 0xc]
push edx
inc ecx
push ecx
push eax
call fcn.0101296c
add esp, 0xc
xor esi, esi
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.010124d0
leave
ret 8
Function at 0x1010a10
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x1010b15
push ebx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
xor esi, esi
cmp edi, esi
jne 0x1010a4e
call ebx
test eax, eax
jne 0x1010b12
and edi, 0xffff7fff
cmp edi, 2
jne 0x1010a99
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
test eax, eax
jne 0x1010a71
call ebx
cmp eax, 6
je 0x1010a99
mov eax, dword [ebp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x1010a77
push esi
sub eax, edx
lea ecx, [ebp - 0x10]
push ecx
sar eax, 1
push eax
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
jmp 0x1010b12
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push dword [ebp + 8]
mov dword [ebp - 0xc], eax
push esi
push eax
call edi
mov ebx, eax
cmp ebx, esi
je 0x1010b12
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push esi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 8], eax
cmp eax, esi
je 0x1010b12
push esi
push esi
push ebx
push eax
push 0xffffffffffffffff
push dword [ebp + 8]
push esi
push dword [ebp - 0xc]
call edi
cmp eax, esi
je 0x1010afc
push esi
lea ecx, [ebp - 0x10]
push ecx
dec eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 8]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x10124c1
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x1023db0
call fcn.01012f44
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x1025728
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x10122d6
cmp eax, esi
jne 0x10122c9
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x10122d9
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10122b0
xor esi, esi
inc esi
mov eax, dword [0x1025724]
cmp eax, esi
jne 0x10122ec
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1012327
mov eax, dword [0x1025724]
test eax, eax
jne 0x1012321
mov dword [0x1025724], esi
push 0x100129c
push 0x1001290
call fcn.0101222d
pop ecx
pop ecx
test eax, eax
je 0x1012327
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x10123f1
mov dword [0x10253d8], esi
mov eax, dword [0x1025724]
cmp eax, esi
jne 0x101234b
push 0x100128c
push 0x1001284
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1025724], 2
cmp dword [ebp - 0x1c], ebx
jne 0x1012358
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1025730], ebx
je 0x1012379
push 0x1025730
call fcn.01012eb9
pop ecx
test eax, eax
je 0x1012379
push ebx
push 2
push ebx
call dword [0x1025730]
push dword [0x10253c0]
push dword [0x10253c4]
push dword [0x10253bc]
call fcn.010120b1
add esp, 0xc
mov dword [0x10253d4], eax
cmp dword [0x10253c8], ebx
jne 0x10123d7
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x10253d8], ebx
jne 0x10123e5
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x10253d4]
call fcn.01012f89
ret
call fcn.01013091
jmp 0x101228e