joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000bfe0
Capabilities:
Create process on windows

Disassembly:
and byte [ecx], al
adc byte [ebp - 0xdd8a40], al
adc eax, sym.imp.KERNEL32.dll_GetLastError
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
push eax
xor eax, eax
xor eax, eax
je 0x1000bffa
jae 0x1000bf92
xor dword [eax - 0x75], ebx
inc ebp
clc
pop eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 4], ecx
push 5
push 0
push 0
mov edx, dword [ebp - 4]
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000c950
Capabilities:
Enumerate gui resources
Write file on windows

Disassembly:
cld
push eax
call fcn.1000a250
add esp, 8
mov dword [ebp - 0x10c], 0
push 0
lea ecx, [ebp - 0x10c]
push ecx
push 0x808
lea edx, [ebp - 0x914]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
push eax
xor eax, eax
xor eax, eax
je 0x1000c96a
jae 0x1000c902
xor dword [eax - 0x75], ebx
dec ebp
invalid
pop eax
mov ecx, dword [ebp - 0x10]
call fcn.1000dac0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x1000c988
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0x1b69
jmp 0x1000c9dd
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
mov dword [ebp - 8], eax
push 0x2000000
push 0
push 0
call dword [sym.imp.USER32.dll_OpenInputDesktop]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000c9ba
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_SetThreadDesktop]
mov edx, dword [ebp - 0xc]
push edx
push 0x1000c7f0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_SetThreadDesktop]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000c9f0
Capabilities:
Enumerate gui resources

Disassembly:
adc eax, sym.imp.USER32.dll_OpenInputDesktop
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
push eax
xor eax, eax
xor eax, eax
je 0x1000ca0a
jae 0x1000c9a2
xor dword [eax - 0x75], ebx
inc ebp
invalid
pop eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
mov dword [ebp - 8], eax
push 0x2000000
push 0
push 0
call dword [sym.imp.USER32.dll_OpenInputDesktop]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000ca46
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_SetThreadDesktop]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x804]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0x10
je 0x1000ca5a
jmp 0x1000ca72
push 0
push 0
push 0x10
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x800]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x1000ca8c
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x804]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x800]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x804], 3
je 0x1000caa4
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x804], 5
jne 0x1000cac4
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x800]
push edx
call dword [sym.imp.USER32.dll_BringWindowToTop]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x800]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.USER32.dll_SetThreadDesktop]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000cae0
Capabilities:
Enumerate processes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x344
push ebx
push esi
push edi
mov dword [ebp - 0x344], ecx
push eax
xor eax, eax
xor eax, eax
je 0x1000cb00
jae 0x1000ca98
xor dword [eax + 0x6a], ebx
add byte [edx + 2], ch
pop eax
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000cb25
mov eax, dword [ebp - 0x344]
mov dword [eax + 4], 0x1b59
jmp 0x1000cd19
mov dword [ebp - 0x338], 0
mov ecx, 0x49
xor eax, eax
lea edi, [ebp - 0x334]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x338], 0x128
lea ecx, [ebp - 0x338]
push ecx
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x1000cb78
mov eax, dword [ebp - 0x344]
mov dword [eax + 4], 0x1b59
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000cd19
call fcn.1000a2e0
mov ecx, dword [ebp - 0x344]
call fcn.1000dac0
mov dword [ebp - 0x340], eax
cmp dword [ebp - 0x340], 0xffffffff
jne 0x1000cba9
mov edx, dword [ebp - 0x344]
mov dword [edx + 4], 0x1b69
jmp 0x1000cd19
mov dword [ebp - 0x210], 0
mov ecx, 0x82
xor eax, eax
lea edi, [ebp - 0x20c]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x324]
mov dword [ebp - 0x208], eax
mov ecx, dword [ebp - 0x31c]
mov dword [ebp - 0x20c], ecx
mov edx, dword [ebp - 0x330]
mov dword [ebp - 0x210], edx
lea eax, [ebp - 0x314]
push eax
lea ecx, [ebp - 0x204]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x5c
push 0
lea edx, [ebp - 0x204]
push edx
call dword [sym.imp.SHLWAPI.dll_StrRChrA]
test eax, eax
jne 0x1000cc25
lea eax, [ebp - 0x204]
push eax
mov ecx, dword [ebp - 0x210]
push ecx
call fcn.1000a250
add esp, 8
mov dword [ebp - 0x33c], 0
push 0
lea edx, [ebp - 0x33c]
push edx
push 0x20c
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp - 0x340]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
Function at 0x1000cd20
Capabilities:
Terminate process
Write file on windows

Disassembly:
lea edx, [ebp - 0x338]
push edx
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x1000cd02
mov ecx, 0x83
xor eax, eax
lea edi, [ebp - 0x210]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 0x324]
mov dword [ebp - 0x208], ecx
mov edx, dword [ebp - 0x31c]
mov dword [ebp - 0x20c], edx
mov eax, dword [ebp - 0x330]
mov dword [ebp - 0x210], eax
lea ecx, [ebp - 0x314]
push ecx
lea edx, [ebp - 0x204]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x5c
push 0
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.SHLWAPI.dll_StrRChrA]
test eax, eax
jne 0x1000ccdb
lea ecx, [ebp - 0x204]
push ecx
mov edx, dword [ebp - 0x210]
push edx
call fcn.1000a250
add esp, 8
push 0
lea eax, [ebp - 0x33c]
push eax
push 0x20c
lea ecx, [ebp - 0x210]
push ecx
mov edx, dword [ebp - 0x340]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x1000cc51
mov eax, dword [ebp - 0x340]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
push eax
xor eax, eax
xor eax, eax
je 0x1000cd3a
jae 0x1000ccd2
xor dword [eax - 0x75], ebx
inc ebp
invalid
pop eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.SHLWAPI.dll_StrToIntA]
mov dword [ebp - 4], eax
call fcn.1000a2e0
mov eax, dword [ebp - 4]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1000cd79
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], 0x1b6a
jmp 0x1000cda9
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x1000cd9f
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0x1b6a
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000cda9
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000cfd0
Capabilities:
Delete service

Disassembly:
inc ebp
clc
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0x14], ecx
push eax
xor eax, eax
xor eax, eax
je 0x1000cfea
jae 0x1000cf82
xor dword [eax - 0x75], ebx
inc ebp
in al, dx
pop eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc], ecx
call fcn.1000a2e0
push 0xe00f003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x1000d01d
mov edx, dword [ebp - 0x14]
mov dword [edx + 4], 0x1b5d
jmp 0x1000d080
push 0xf01ff
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000d04f
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x14]
mov dword [eax + 4], 0x1b5d
jmp 0x1000d080
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
Function at 0x1000d2d0
Capabilities:
Query service configuration

Disassembly:
jmp 0x1000d283
invalid
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov dword [ebp - 0x1c], ecx
push eax
xor eax, eax
xor eax, eax
je 0x1000d2ea
jae 0x1000d282
xor dword [eax + 0x68], ebx
inc dword [ecx]
str word [ebx - 0x3f7cf3bb]
adc byte [eax - 0x75], dl
dec ebp
or byte [ecx - 1], dl
adc eax, sym.imp.ADVAPI32.dll_OpenServiceA
pop eax
push 0xf01ff
mov eax, dword [ebp + 0xc]
add eax, 0x10
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000d30f
jmp 0x1000d437
mov dword [ebp - 8], 0
push 0x2000
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov ecx, 0x800
xor eax, eax
mov edi, dword [ebp - 0x10]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 8]
push ecx
push 0x2000
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
je 0x1000d41b
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 8]
mov dword [ecx + 8], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x14]
mov dword [ecx + 0xc], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp + 0xc]
add eax, 0x448
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x18]
push edx
mov eax, dword [ebp + 0xc]
add eax, 0x848
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x10]
push edx
mov eax, dword [ebp + 0xc]
add eax, 0x648
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1c]
push edx
mov eax, dword [ebp + 0xc]
add eax, 0xc48
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp + 0xc]
add ecx, 0x10
push ecx
push str.SYSTEMCONTROLSET001Services_s
mov edx, dword [ebp - 0x10]
Function at 0x1000d4d0
Capabilities:
Set registry value
Write file on windows

Disassembly:
dec ebp
cld
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1000d4b7
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], 0x1b69
jmp fcn.1000d4c1
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
push eax
xor eax, eax
xor eax, eax
je 0x1000d4ea
jae 0x1000d482
xor dword [eax - 0x75], ebx
inc ebp
invalid
pop eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0
lea edx, [ebp - 4]
push edx
push 0xf003f
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1208]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000d52f
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0x1b68
jmp fcn.1000d58a
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1200]
push edx
mov eax, dword [ebp - 0xc]
add eax, 0xa00
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1204]
push edx
push 0
mov eax, dword [ebp - 0xc]
add eax, 0x800

Function at 0x1000d5a0
Capabilities:
Delete registry value
Set registry value

Disassembly:
add byte [eax], cl
add byte [eax], al
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000d580
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0x1b67
jmp fcn.1000d58a
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
push eax
xor eax, eax
xor eax, eax
je 0x1000d5ba
jae 0x1000d552
xor dword [eax - 0x75], ebx
inc ebp
invalid
pop eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0
lea edx, [ebp - 4]
push edx
push 0xf003f
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1208]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000d5ff
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0x1b68
jmp 0x1000d63c
mov ecx, dword [ebp - 0xc]
add ecx, 0x800
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000d632
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], 0x1b64
jmp 0x1000d63c
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000d650
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
push eax
xor eax, eax
xor eax, eax
je 0x1000d66a
jae 0x1000d602
xor dword [eax - 0x75], ebx
inc ebp
invalid
pop eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0
lea edx, [ebp - 4]
push edx
push 0xf003f
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1208]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000d6af
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0x1b68
jmp 0x1000d6e7
push 0x100146e0
Function at 0x1000dac0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
push eax
xor eax, eax
xor eax, eax
je 0x1000dada
jae 0x1000da72
xor dword [eax - 0x75], ebx
inc ebp
clc
pop eax
mov eax, dword [ebp - 8]
add eax, 0x124
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
mov ecx, dword [ebp - 8]
add ecx, 0x124
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000db20
Capabilities:
Delete file
Get file size
Read file on windows

Disassembly:
test byte [ebx], al
add byte [eax], al
add byte [ebx - 0x67], dh
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov dword [ebp - 0x1c], ecx
push eax
xor eax, eax
xor eax, eax
je 0x1000db3a
jae 0x1000dad2
xor dword [eax - 0x75], ebx
inc ebp
in al, 0xc7
inc eax
or byte [eax], al
add byte [eax], al
add bh, al
inc ebp
cld
add dword [eax], eax
add byte [eax], al
pop eax
mov eax, dword [ebp - 0x1c]
mov dword [eax + 8], 0
mov dword [ebp - 4], 1
mov dword [ebp - 8], 0
push 0
push 0x80
push 3
push 0
push 1
push bind
mov ecx, dword [ebp - 0x1c]
add ecx, 0x124
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x1000dbec
push 0
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 0x1c]
cmp dword [edx + 8], 0
je 0x1000dbd3
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 8]
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], 0
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 8]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1c]
add eax, 0x124
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x10
call fcn.100050c0
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
je 0x1000dc24
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [ebp - 4]
Function at 0x1000e490
Capabilities:
Create thread

Disassembly:
add eax, 0x2750000
jmp 0x1000e458
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x20]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov ecx, dword [ebp - 4]
call fcn.1000e760
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x2e0]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
push eax
xor eax, eax
xor eax, eax
je 0x1000e4aa
jae 0x1000e442
xor dword [eax - 0x75], ebx
inc ebp
or byte [eax + 0x68], dl
inc esi
pop ds
add byte [eax], al
pop eax
mov eax, dword [ebp + 8]
push eax
push 0x1f46
mov ecx, dword [ebp - 0xc]
add ecx, 0xb4
call fcn.10004ad0
test eax, eax
je 0x1000e4e1
mov ecx, dword [ebp + 8]
push ecx
push 0x1f53
mov ecx, dword [ebp - 0xc]
add ecx, 0x1c8
call fcn.10004ad0
test eax, eax
jne 0x1000e4e5
xor eax, eax
jmp 0x1000e54e
mov edx, dword [ebp - 0xc]
push edx
push 0
push 0x1000df70
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0x1000e230
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
mov dword [ebp - 8], 0
xor ecx, ecx
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x2dc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x2e0]
mov dword [ebp - 4], edx
push 0xffffffffffffffff
push 1
lea eax, [ebp - 8]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100100b0
Capabilities:
Create thread

Disassembly:
mov eax, 1
test eax, eax
je 0x100100a8
push 0
push 0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.WS2_32.dll_accept]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x10010042
jmp 0x100100a8
push 0x68
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov dword [ecx], edx
mov eax, dword [ebp - 0xc]
mov dword [eax + 4], 0
mov ecx, dword [ebp - 8]
add ecx, 0xa
push ecx
mov edx, dword [ebp - 0xc]
add edx, 8
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp - 8]
add eax, 0x4a
push eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x48
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [ebp - 0xc]
push edx
push 0
push 0x1000f3f0
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
jmp 0x10010019
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
push eax
xor eax, eax
xor eax, eax
je 0x100100c8
jae 0x10010060
xor dword [eax - 0x75], ebx
jge 0x100100c8
pop eax
mov edi, dword [ebp - 4]
add edi, 8
mov ecx, 0x18
mov esi, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov edx, dword [ebp - 4]
push edx
push 0
push 0x1000ffd0
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10010110
Capabilities:
Create thread

Disassembly:
test byte [ebx], al
add byte [eax], al
add byte [ebx - 0x67], dh
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
push eax
xor eax, eax
xor eax, eax
je 0x10010128
jae 0x100100c0
xor dword [eax - 0x75], ebx
inc ebp
cld
pop eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret