joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001d770
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x204
mov eax, dword [0x100778dc]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebp
mov ebp, dword [esp + 0x214]
test ebp, ebp
push esi
mov esi, dword [esp + 0x214]
mov dword [esp + 0x20c], eax
push edi
jne 0x1001d7a3
push esi
call ebx
mov ebp, eax
mov ecx, dword [esp + 0x224]
mov eax, dword [ecx]
cmp eax, ebp
jae 0x1001d7b5
inc ebp
mov dword [ecx], ebp
mov ebp, eax
mov edi, dword [esp + 0x220]
mov ecx, ebp
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
mov edi, edi
mov byte [esp + eax + 0x10], al
inc eax
cmp eax, 0x100
jb 0x1001d7d0
mov ecx, dword [esp + 0x228]
test ecx, ecx
mov esi, str.lK25_
mov edi, 5
je 0x1001d805
mov eax, dword [esp + 0x22c]
test eax, eax
mov esi, ecx
mov edi, eax
jne 0x1001d805
push ecx
call ebx
mov edi, eax
xor ecx, ecx
xor edx, edx
lea esp, [esp]
cmp ecx, edi
jne 0x1001d816
xor ecx, ecx
mov al, byte [ecx + esi]
inc ecx
mov byte [esp + edx + 0x110], al
inc edx
cmp edx, 0x100
jb 0x1001d810
xor esi, esi
xor eax, eax
mov edi, edi
mov cl, byte [esp + eax + 0x10]
xor edx, edx
mov dl, byte [esp + eax + 0x110]
xor ebx, ebx
mov bl, cl
add ebx, esi
add edx, ebx
and edx, 0xff
mov esi, edx
mov dl, byte [esp + esi + 0x10]
mov byte [esp + eax + 0x10], dl
inc eax
cmp eax, 0x100
mov byte [esp + esi + 0x10], cl
jb 0x1001d830
xor edi, edi
xor esi, esi
xor eax, eax
test ebp, ebp
jbe 0x1001d8db
jmp 0x1001d870
xor edx, edx
inc esi
and esi, 0xff
mov cl, byte [esp + esi + 0x10]
mov dl, cl
add edx, edi
and edx, 0xff
mov edi, edx
mov dl, byte [esp + edi + 0x10]
mov byte [esp + esi + 0x10], dl
xor edx, edx
mov byte [esp + edi + 0x10], cl
mov dl, byte [esp + esi + 0x10]
add edx, ecx
mov ecx, dword [esp + 0x220]
mov bl, byte [eax + ecx]
and edx, 0xff
mov dl, byte [esp + edx + 0x10]
xor bl, dl
mov byte [eax + ecx], bl
inc eax
cmp eax, ebp
jb 0x1001d870
mov ecx, dword [esp + 0x224]
pop edi
pop esi
pop ebp
mov dword [ecx], eax
pop ebx
mov ecx, dword [esp + 0x200]
call fcn.1004189e
add esp, 0x204
ret
mov edx, dword [esp + 0x224]
mov ecx, dword [esp + 0x210]
pop edi
pop esi
pop ebp
mov dword [edx], eax
pop ebx
call fcn.1004189e
add esp, 0x204
ret
Function at 0x1001e8d0
Capabilities:
Check if file exists
Delete file

Disassembly:
sub esp, 0x10c
mov eax, dword [0x100778dc]
push ebp
mov ebp, dword [esp + 0x118]
mov dword [esp + 0x10c], eax
push esi
lea eax, [esp + 0xb]
push eax
push ebx
mov esi, ecx
call fcn.1001e4a0
add esp, 8
test al, al
je 0x1001ea8e
mov al, byte [esp + 0xb]
test al, al
push edi
mov edi, esi
je 0x1001e9a6
mov edi, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 0x104
push ebp
push esi
call edi
cmp eax, 0x104
ja 0x1001e980
test eax, eax
jne 0x1001e9a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x1001e980
mov al, byte [0x10062318]
test al, al
je 0x1001e980
push 0
push 0x80
push 1
push 0
push 1
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x1001e980
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x104
push ebp
push esi
call edi
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1001e998
mov byte [0x10062318], al
pop edi
pop esi
xor al, al
pop ebp
mov ecx, dword [esp + 0x108]
call fcn.1004189e
add esp, 0x10c
ret
test edi, edi
je 0x1001e980
cmp edi, 0x104
ja 0x1001e980
mov edi, ebp
mov eax, dword [esp + 0x124]
test eax, eax
je 0x1001e9bc
mov cl, byte [esp + 0xf]
test cl, cl
sete cl
mov byte [eax], cl
mov esi, dword [ebx + 4]
cmp esi, dword [ebx + 8]
je 0x1001e9dc
mov edx, dword [esi]
push edi
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1001ea37
mov eax, dword [ebx + 8]
add esi, 0x10
cmp esi, eax
jne 0x1001e9c4
mov al, byte [esp + 0xf]
test al, al
jne 0x1001e980
mov esi, dword [ebx + 4]
cmp esi, dword [ebx + 8]
je 0x1001e980
mov ebp, dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
mov ecx, dword [esi]
push 0x104
lea eax, [esp + 0x14]
push eax
push ecx
call ebp
test eax, eax
je 0x1001ea15
push edi
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1001ea64
mov eax, dword [ebx + 8]
add esi, 0x10
cmp esi, eax
jne 0x1001e9f2
pop edi
pop esi
xor al, al
pop ebp
mov ecx, dword [esp + 0x108]
call fcn.1004189e
add esp, 0x10c
ret
mov eax, dword [esi + 4]
test eax, eax
je 0x1001ea49
mov al, byte [esp + 0x11c]
test al, al
je 0x1001ea76
pop edi
pop esi
mov eax, 1
pop ebp
mov ecx, dword [esp + 0x108]
call fcn.1004189e
add esp, 0x10c
ret
mov eax, dword [esi + 4]
test eax, eax
je 0x1001ea49
mov al, byte [esp + 0x11c]
test al, al
jne 0x1001ea49
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x108]
call fcn.1004189e
add esp, 0x10c
ret
mov ecx, dword [esp + 0x110]
pop esi
xor al, al
pop ebp
call fcn.1004189e
add esp, 0x10c
ret
Function at 0x1001f080
Capabilities:
Get common file path

Disassembly:
sub esp, 0x108
mov eax, dword [0x100778dc]
mov dword [esp + 0x104], eax
mov al, byte [0x1007aab8]
test al, al
jne 0x1001f142
push esi
push 0x104
lea eax, [esp + 8]
push eax
mov byte [0x1007aab8], 1
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov esi, dword [sym.imp.SHLWAPI.dll_wnsprintfA]
lea ecx, [esp + 4]
push ecx
push str.res:___s_shdoclc.dll_http_404.htm
push 0x104
push 0x1007a9a8
call esi
push str.res:__ieframe.dll_http_404.htm
push 0x104
push 0x1007a8a0
call esi
push str.res:__ieframe.dll_tabswelcome.htm
push 0x104
push 0x1007a798
call esi
push 0
push 0
push 0x104
push 0x1007a480
call fcn.100172f0
push 0x65
push 0x1007a480
push str.res:___s__d
push 0x104
push 0x1007a690
call esi
add esp, 0x4c
push str.tabswelcome.htm
push 0x1007a480
push str.res:___s__s
push 0x104
push 0x1007a588
call esi
add esp, 0x14
pop esi
mov ecx, dword [esp + 0x104]
call fcn.1004189e
add esp, 0x108
ret

Function at 0x1001f160
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 8]
push esi
push eax
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x1001f182
pop esi
xor eax, eax
pop ebx
ret
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1001f17d
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x1001f1a0
pop edi
pop esi
pop ebx
ret
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [esp + 0x1c]
mov dword [edx], eax
neg eax
sbb eax, eax
and eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x10021410
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x10050c78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
mov ecx, dword [esp + 0x6c]
mov eax, dword [0x100778dc]
push ebx
mov ebx, dword [esp + 0x6c]
push esi
push edi
mov edi, dword [esp + 0x70]
sub ebx, edi
sub ecx, edi
sar ebx, 6
sar ecx, 6
test ebx, ebx
mov dword [esp + 0x5c], eax
mov eax, ecx
mov esi, ebx
je 0x1002145d
cdq
idiv esi
mov eax, esi
test edx, edx
mov esi, edx
jne 0x10021452
cmp eax, ecx
jge 0x100215c0
test eax, eax
jle 0x100215c0
push ebp
mov esi, ebx
mov ebp, eax
shl esi, 6
shl ebp, 6
mov dword [esp + 0x78], esi
add ebp, edi
mov dword [esp + 0x10], eax
jmp 0x10021488
mov esi, dword [esp + 0x78]
push ebp
lea ecx, [esp + 0x24]
mov edi, ebp
call fcn.10020fb0
mov ecx, dword [esp + 0x7c]
lea eax, [esi + ebp]
cmp eax, ecx
mov dword [esp + 0x6c], 0
jne 0x100214ad
lea eax, [esp + 0x74]
jmp 0x100214b5
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
mov esi, dword [eax]
cmp esi, ebp
je 0x10021522
jmp 0x100214c0
push 0xffffffffffffffff
push 0
push esi
mov ecx, edi
call fcn.10001320
push 0xffffffffffffffff
push 0
lea eax, [esi + 0x1c]
push eax
lea ecx, [edi + 0x1c]
call fcn.10001320
mov ecx, dword [esi + 0x38]
mov eax, dword [esp + 0x7c]
sub eax, esi
mov dword [edi + 0x38], ecx
mov edx, dword [esi + 0x3c]
sar eax, 6
cmp ebx, eax
mov dword [edi + 0x3c], edx
mov edi, esi
jge 0x10021507
mov eax, dword [esp + 0x78]
add eax, esi
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
jmp 0x1002151c
mov ecx, ebx
sub ecx, eax
mov eax, dword [esp + 0x74]
shl ecx, 6
add ecx, eax
mov dword [esp + 0x18], ecx
lea eax, [esp + 0x18]
mov esi, dword [eax]
cmp esi, ebp
jne 0x100214c0
push 0xffffffffffffffff
push 0
lea edx, [esp + 0x28]
push edx
mov ecx, edi
call fcn.10001320
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x44]
push eax
lea ecx, [edi + 0x1c]
call fcn.10001320
mov ecx, dword [esp + 0x58]
mov dword [edi + 0x38], ecx
mov edx, dword [esp + 0x5c]
mov dword [edi + 0x3c], edx
mov eax, dword [esp + 0x54]
mov esi, 0x10
cmp eax, esi
mov dword [esp + 0x6c], 0xffffffff
jb 0x10021573
mov eax, dword [esp + 0x40]
push eax
call fcn.1004119d
add esp, 4
cmp dword [esp + 0x38], esi
mov edi, 0xf
mov dword [esp + 0x54], edi
mov dword [esp + 0x50], 0
mov byte [esp + 0x40], 0
jb 0x1002159c
mov ecx, dword [esp + 0x24]
push ecx
call fcn.1004119d
add esp, 4
mov eax, dword [esp + 0x10]
sub ebp, 0x40
dec eax
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], 0
mov byte [esp + 0x24], 0
mov dword [esp + 0x10], eax
jne 0x10021484
pop ebp
mov ecx, dword [esp + 0x60]
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x54]
pop ebx
call fcn.1004189e
add esp, 0x60
ret
Function at 0x10025d10
Capabilities:
Persist via run registry key

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100510f8
push eax
mov dword fs:[0], esp
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
push edi
push 0
je 0x10025dfe
push str.OpenServiceA
call fcn.1001d040
test eax, eax
je 0x10025d5b
mov ecx, dword [esp + 0x1c]
mov edx, dword [esi + 4]
push 0xf01ff
push ecx
push edx
call eax
mov edi, eax
test edi, edi
jne 0x10025d77
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor al, al
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 0xc
push 0
push str.StartServiceA
mov ecx, esi
call fcn.1001d040
test eax, eax
jne 0x10025dbb
mov eax, dword [esi + 4]
test eax, eax
je 0x10025da5
push 0
push str.CloseServiceHandle
mov ecx, esi
call fcn.1001d040
test eax, eax
je 0x10025da5
push edi
call eax
xor al, al
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 0xc
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push ecx
push edx
push edi
call eax
test eax, eax
mov eax, dword [esi + 4]
je 0x10025d8c
test eax, eax
je 0x10025de8
push 0
push str.CloseServiceHandle
mov ecx, esi
call fcn.1001d040
test eax, eax
je 0x10025de8
push edi
call eax
mov al, 1
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 0xc
mov eax, dword [str.SoftwareMicrosoftWindowsCurrentVersionRun]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x30]
call fcn.100264f0
mov eax, dword [esp + 0x24]
test eax, eax
mov dword [esp + 0x14], 0
jne 0x10025e4f
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 0x24]
mov dword [esp + 0x14], 0xffffffff
call fcn.10026790
xor al, al
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 0xc
mov ecx, dword [esp + 0x1c]
push 0
push 0
push ecx
lea ecx, [esp + 0x30]
call fcn.10026550
mov esi, eax
test esi, esi
je 0x10025e28
push 0
push 0
push 0
push 0
push esi
call fcn.100271c0
push esi
mov bl, al
call fcn.10041868
add esp, 0x18
lea ecx, [esp + 0x24]
mov dword [esp + 0x14], 0xffffffff
call fcn.10026790
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov al, bl
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 0xc
Function at 0x10025ff0
Capabilities:
Persist via run registry key

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10051118
push eax
mov dword fs:[0], esp
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
push edi
je 0x100260cc
push 0
push str.CreateServiceA
call fcn.1001d040
test eax, eax
je 0x100260b6
mov ecx, dword [esp + 0x24]
push 0x100539ea
mov edx, dword [esi + 4]
push 0
push 0
push 0
push 0
push ecx
mov ecx, dword [esp + 0x34]
push 0
push 2
push 0x10
push 2
push ecx
push ecx
push edx
call eax
mov edi, eax
test edi, edi
je 0x100260b0
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x10026087
push 0
push str.ChangeServiceConfig2A
mov ecx, esi
call fcn.1001d040
test eax, eax
je 0x10026087
lea ecx, [esp + 0x24]
push ecx
push 1
push edi
mov dword [esp + 0x30], ebx
call eax
test eax, eax
jne 0x10026087
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [esi + 4]
test eax, eax
je 0x1002614c
push 0
push str.CloseServiceHandle
mov ecx, esi
call fcn.1001d040
test eax, eax
je 0x1002614c
push edi
call eax
jmp 0x1002614c
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor al, al
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 0xc
mov edx, dword [str.SoftwareMicrosoftWindowsCurrentVersionRun]
push 1
push edx
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x2c]
call fcn.100264f0
mov eax, dword [esp + 0x20]
test eax, eax
mov dword [esp + 0x14], 0
jne 0x10026120
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], 0xffffffff
lea ecx, [esp + 0x20]
call fcn.10026790
xor al, al
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
push 0
push 0
push eax
push ecx
lea ecx, [esp + 0x30]
call fcn.10026670
test al, al
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], 0xffffffff
je 0x10026105
call fcn.10026790
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov al, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 0xc
Function at 0x10026170
Capabilities:
Persist via run registry key

Disassembly:
push 0xffffffffffffffff
push 0x10051138
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x10026241
push ebx
push 0
push str.DeleteService
call fcn.1001d040
mov ebx, eax
test ebx, ebx
jne 0x100261bc
pop ebx
xor al, al
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 4
mov eax, dword [esi + 4]
test eax, eax
push edi
je 0x100261ec
push 0
push str.OpenServiceA
mov ecx, esi
call fcn.1001d040
test eax, eax
je 0x100261ec
mov ecx, dword [esp + 0x20]
mov edx, dword [esi + 4]
push 0xf01ff
push ecx
push edx
call eax
mov edi, eax
test edi, edi
jne 0x10026208
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop ebx
xor al, al
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 4
push edi
call ebx
test eax, eax
je 0x100261ec
mov eax, dword [esi + 4]
test eax, eax
je 0x1002622b
push 0
push str.CloseServiceHandle
mov ecx, esi
call fcn.1001d040
test eax, eax
je 0x1002622b
push edi
call eax
pop edi
pop ebx
mov al, 1
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 4
mov eax, dword [str.SoftwareMicrosoftWindowsCurrentVersionRun]
push 1
push eax
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x10]
call fcn.100264f0
mov eax, dword [esp + 4]
test eax, eax
mov dword [esp + 0x10], 0
jne 0x10026292
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 4]
mov dword [esp + 0x10], 0xffffffff
call fcn.10026790
xor al, al
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 4
mov ecx, dword [esp + 0x18]
push ecx
lea ecx, [esp + 8]
call fcn.10026770
test al, al
je 0x10026267
lea ecx, [esp + 4]
mov dword [esp + 0x10], 0xffffffff
call fcn.10026790
mov ecx, dword [esp + 8]
mov al, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x10026390
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x100778dc]
mov dword [esp + 0x190], eax
lea eax, [esp]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x100263d9
mov ax, word [esp]
cmp al, 2
jne 0x100263d3
test ah, ah
jne 0x100263d3
mov al, 1
mov ecx, dword [esp + 0x190]
call fcn.1004189e
add esp, 0x194
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x190]
xor al, al
call fcn.1004189e
add esp, 0x194
ret
Function at 0x100263f0
Capabilities:
Resolve dns

Disassembly:
mov eax, dword [esp + 8]
push esi
push edi
mov edi, dword [esp + 0x14]
push eax
mov word [edi], 2
call dword [sym.imp.WS2_32.dll_htons]
mov esi, dword [esp + 0xc]
test esi, esi
mov word [edi + 2], ax
je 0x10026447
push esi
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x1002644f
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x1002642e
pop edi
xor al, al
pop esi
ret
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
mov dword [edi + 4], eax
xor eax, eax
add edi, 8
mov dword [edi], eax
mov dword [edi + 4], eax
pop edi
mov al, 1
pop esi
ret
push 0
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [edi + 4], eax
xor eax, eax
add edi, 8
mov dword [edi], eax
mov dword [edi + 4], eax
pop edi
mov al, 1
pop esi
ret

Function at 0x10026470
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
sub esp, 0x14
mov eax, dword [0x100778dc]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x10], eax
push esi
lea eax, [esp + 4]
push eax
push ecx
push edx
call fcn.100263f0
add esp, 0xc
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
je 0x100264c1
push 0x10
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x100264d2
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x10]
call fcn.1004189e
add esp, 0x14
ret
mov ecx, dword [esp + 0x14]
mov eax, esi
pop esi
call fcn.1004189e
add esp, 0x14
ret

Function at 0x10026550
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push esi
lea eax, [esp + 0x14]
push eax
push 0
mov esi, ecx
mov edx, dword [esi]
lea ecx, [esp + 0x14]
push ecx
push 0
push ebx
push edx
call ebp
test eax, eax
jne 0x100265de
mov al, byte [esp + 0x18]
mov ecx, dword [esp + 0xc]
neg al
sbb eax, eax
and eax, 6
inc eax
cmp ecx, eax
jne 0x100265de
mov ecx, dword [esp + 0x14]
push edi
push ecx
call fcn.1003fb26
mov ecx, dword [esi]
add esp, 4
lea edx, [esp + 0x18]
push edx
mov edi, eax
push edi
lea eax, [esp + 0x18]
push eax
push 0
push ebx
push ecx
call ebp
test eax, eax
je 0x100265c6
push edi
call fcn.10041868
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 0xc
mov eax, dword [esp + 0x20]
test eax, eax
je 0x100265d4
mov edx, dword [esp + 0x18]
mov dword [eax], edx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 0xc
Function at 0x100265f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push esi
lea eax, [esp + 0xc]
push eax
push 0
mov esi, ecx
mov edx, dword [esi]
lea ecx, [esp + 0x1c]
push ecx
push 0
push ebx
push edx
call ebp
test eax, eax
jne 0x1002665e
mov al, byte [esp + 0x20]
mov ecx, dword [esp + 0x14]
neg al
sbb eax, eax
and eax, 6
inc eax
cmp ecx, eax
jne 0x1002665e
mov ecx, dword [esp + 0xc]
cmp ecx, dword [esp + 0x1c]
ja 0x1002665e
mov ecx, dword [esi]
push edi
mov edi, dword [esp + 0x1c]
lea edx, [esp + 0x20]
push edx
push edi
lea eax, [esp + 0x20]
push eax
push 0
push ebx
push ecx
call ebp
neg eax
sbb eax, eax
not eax
and eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 0x10

Function at 0x10026670
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, ecx
mov cl, byte [esp + 0x18]
mov al, cl
neg al
sbb eax, eax
and eax, 6
inc eax
mov ebx, eax
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x100266b5
test cl, cl
je 0x100266ad
mov eax, esi
cmp byte [eax], 0
jne 0x100266a3
mov cl, byte [eax + 1]
test cl, cl
je 0x100266a6
inc eax
jmp 0x10026697
sub eax, esi
add eax, 2
jmp 0x100266b5
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
mov ecx, dword [esp + 0x10]
mov edx, dword [edi]
push eax
push esi
push ebx
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
neg eax
pop edi
sbb eax, eax
pop esi
inc eax
pop ebx
ret 0x10

Function at 0x100266e0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
lea eax, [esp]
push eax
lea edx, [esp + 8]
push edx
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x14]
push eax
mov eax, dword [ecx]
push 0
push edx
push eax
mov dword [esp + 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10026718
cmp dword [esp + 0xc], 4
jne 0x10026718
xor al, al
jmp 0x1002671a
mov al, 1
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x10026724
mov byte [ecx], al
test al, al
mov eax, 0xffffffff
jne 0x10026731
mov eax, dword [esp + 4]
add esp, 8
ret 8

Function at 0x10026740
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 4]
push 4
lea eax, [esp + 0xc]
push eax
mov eax, dword [ecx]
push 4
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
neg eax
sbb eax, eax
inc eax
ret 8
Function at 0x10026d30
Capabilities:
Check os version

Disassembly:
sub esp, 0x98
mov eax, dword [0x100778dc]
mov dword [esp + 0x94], eax
mov al, byte [0x1007ab24]
test al, al
jne 0x10026db7
lea eax, [esp]
push eax
mov dword [esp + 4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
mov ecx, 1
je 0x10026d97
mov eax, dword [esp + 4]
cmp eax, 5
ja 0x10026d77
jne 0x10026d97
cmp dword [esp + 8], ecx
jb 0x10026d97
mov al, cl
mov byte [0x1007ab23], al
mov byte [0x1007ab24], cl
mov ecx, dword [esp + 0x94]
call fcn.1004189e
add esp, 0x98
ret
xor al, al
mov byte [0x1007ab23], al
mov byte [0x1007ab24], cl
mov ecx, dword [esp + 0x94]
call fcn.1004189e
add esp, 0x98
ret
mov ecx, dword [esp + 0x94]
mov al, byte [0x1007ab23]
call fcn.1004189e
add esp, 0x98
ret

Function at 0x100270d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push esi
push edi
mov edi, dword [esp + 0xc]
push eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x100270f9
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x100270fe
pop edi
xor eax, eax
pop esi
ret
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x10027135
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x10027135
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x1002713b
push eax
push ebx
push ecx
call fcn.10012120
add esp, 0xc
test al, al
jne 0x1002713b
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ebx
pop edi
xor eax, eax
pop esi
ret
mov eax, ebx
pop ebx
pop edi
pop esi
ret

Function at 0x10027150
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x1002715f
xor al, al
ret
push esi
push edi
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov edi, dword [esp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
jne 0x10027194
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
xor al, al
pop esi
ret
push edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
mov al, 1
pop esi
ret