joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008eb0
Capabilities:
Stop service

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
sub esp, 0x1c
push esi
push 0xf01ff
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x10008ed6
xor al, al
pop esi
add esp, 0x1c
ret
lea edx, [esp + 4]
push ebx
push edx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
push esi
setne bl
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, bl
pop ebx
pop esi
add esp, 0x1c
ret

Function at 0x10009640
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a8ea0
push 0x1007e3d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x1c], 0x2000
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 4], esi
push esi
push esi
push 3
push esi
push 1
push bind
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
mov dword [ebp - 0x34], ebx
cmp ebx, 0xffffffff
je 0x10009709
lea ecx, [ebp - 0x30]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x30], eax
jb 0x10009709
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov esi, eax
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], esi
mov ecx, dword [ebp - 0x1c]
xor eax, eax
mov edi, esi
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
push 0
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10009707
cmp word [esi], 0x5a4d
jne 0x10009707
mov dword [ebp - 0x20], esi
mov edx, dword [esi + 0x3c]
lea esi, [edx + esi + 0x18]
mov dword [ebp - 0x28], esi
mov eax, dword [esi + 0x38]
mov dword [ebp - 0x24], eax
xor esi, esi
mov dword [ebp - 4], 0xffffffff
call fcn.1000972e
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000fd70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100a64cc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov al, byte [esp + 3]
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x100a9224
mov byte [esi + 4], al
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov cl, byte [esp + 0xb]
mov dword [esp + 0x18], edi
mov byte [esi + 0x14], cl
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dl, byte [esp + 0xb]
mov dword [esi + 0x28], edi
mov byte [esi + 0x24], dl
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov al, byte [esp + 0xb]
mov dword [esi + 0x38], edi
mov byte [esi + 0x34], al
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
lea ecx, [esi + 0x48]
mov byte [esp + 0x18], 3
call fcn.100099a0
lea edx, [esi + 0x68]
xor ecx, ecx
mov dword [esi], 0x100a91dc
lea eax, [esi + 0x74]
mov dword [edx], ecx
push eax
mov dword [edx + 4], ecx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x70], edi
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x10014010
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
xor eax, eax
xor edx, edx
mov ax, word [ebx + 0x14]
cmp word [ebx + 6], dx
lea eax, [eax + ebx + 0x18]
jbe 0x10014060
push ebp
push esi
push edi
add eax, 0x14
mov esi, dword [esp + 0x18]
mov edi, dword [eax]
mov ebp, dword [esp + 0x14]
mov ecx, dword [eax - 4]
add esi, edi
mov edi, dword [eax - 8]
add edi, ebp
mov ebp, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
add eax, 0x28
and ecx, 3
inc edx
rep movsb byte es:[edi], byte [esi]
xor ecx, ecx
mov cx, word [ebx + 6]
cmp edx, ecx
jl 0x1001402d
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x10014140
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x208
push esi
mov esi, dword [esp + 0x210]
push edi
mov ecx, dword [esi + 0x3c]
add ecx, esi
cmp word [esi], 0x5a4d
jne 0x10014276
cmp dword [ecx], 0x4550
jne 0x10014276
mov eax, dword [ecx + 0x78]
mov ecx, dword [ecx + 0x7c]
add eax, esi
test ecx, ecx
je 0x10014276
mov edx, dword [eax + 0x18]
test edx, edx
je 0x10014276
mov edx, dword [eax + 0x14]
test edx, edx
je 0x10014276
mov edx, dword [esp + 0x218]
mov edi, dword [eax + 0x10]
sub edx, edi
mov edi, dword [eax + 0x1c]
lea edx, [edi + edx*4]
mov edx, dword [edx + esi]
add edx, esi
cmp edx, eax
jb 0x1001426b
add ecx, eax
cmp edx, ecx
jae 0x1001426b
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x10d]
mov byte [esp + 0x10c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [sym.imp.MSVCRT.dll_strncpy]
push 0x103
lea eax, [esp + 0xc]
push edx
push eax
call edi
lea ecx, [esp + 0x14]
push 0x2e
push ecx
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 0x14
test eax, eax
je 0x10014276
lea esi, [eax + 1]
push 0x103
lea edx, [esp + 0x110]
push esi
push edx
call edi
push 3
lea eax, [esp + 0x18]
push 0x100c4a90
push eax
mov byte [esi], 0
call dword [sym.imp.MSVCRT.dll_strncat]
add esp, 0x18
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x1001425a
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x10014276
lea ecx, [esp + 0x10c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, eax
pop edi
mov eax, edx
pop esi
add esp, 0x208
ret
pop edi
xor eax, eax
pop esi
add esp, 0x208
ret
Function at 0x100143b0
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 0x10], 0
mov ebx, dword [ebp + 0x3c]
add ebx, ebp
mov ax, word [ebx + 0x14]
cmp word [ebx + 6], 0
lea eax, [eax + ebx + 0x18]
jbe 0x10014479
push esi
push edi
lea edi, [eax + 0x24]
mov eax, dword [edi]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x10014413
mov edx, dword [edi - 0x18]
mov ecx, dword [edi - 0x14]
push 0x4000
add edx, ebp
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x1001445d
lea ecx, [edx + ecx*2]
test eax, 0x4000000
lea edx, [esi + ecx*2]
mov esi, dword [edx*4 + 0x100c4a70]
je 0x1001442d
or esi, 0x200
mov edx, dword [edi - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x10014448
test al, 0x40
je 0x1001443f
mov ecx, dword [ebx + 0x20]
jmp 0x10014446
test al, 0x80
je 0x1001445d
mov ecx, dword [ebx + 0x24]
test ecx, ecx
jbe 0x1001445d
mov ecx, dword [edi - 0x18]
lea eax, [esp + 0x10]
push eax
push esi
add ecx, ebp
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [esp + 0x18]
xor edx, edx
mov dx, word [ebx + 6]
inc eax
add edi, 0x28
cmp eax, edx
mov dword [esp + 0x18], eax
jl 0x100143de
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x10014510
Capabilities:
Read file via mapping

Disassembly:
sub esp, 0x20
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor ebx, ebx
call esi
push eax
call esi
push eax
push str.XTDL
push str._s__X__d
lea eax, [esp + 0x18]
push 0x20
push eax
call fcn.100145e0
add esp, 0x18
lea ecx, [esp + 8]
push ecx
push ebx
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov esi, eax
test esi, esi
jne 0x10014571
lea edx, [esp + 8]
push edx
push 0x1000
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov esi, eax
test esi, esi
je 0x100145d7
mov ebx, 1
push 0
push 0
push 0
push 6
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edx, eax
test edx, edx
je 0x100145d0
test ebx, ebx
je 0x10014597
push edi
mov ecx, 0x400
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
pop edi
mov ecx, dword [edx]
test ecx, ecx
jne 0x100145a5
mov eax, dword [esp + 0x2c]
mov dword [edx], eax
jmp 0x100145c5
mov eax, dword [ecx + 0x114]
test eax, eax
je 0x100145bb
mov ecx, eax
mov eax, dword [ecx + 0x114]
test eax, eax
jne 0x100145af
mov eax, dword [esp + 0x2c]
mov dword [ecx + 0x114], eax
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test ebx, ebx
jne 0x100145d7
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
add esp, 0x20
ret
Function at 0x10014850
Capabilities:
Read file via mapping

Disassembly:
sub esp, 0x20
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push edi
call esi
push eax
call esi
push eax
push str.XTDL
push str._s__X__d
lea eax, [esp + 0x18]
push 0x20
push eax
call fcn.100145e0
add esp, 0x18
lea ecx, [esp + 8]
push ecx
push 0
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov edi, eax
test edi, edi
je 0x1001490a
push 0
push 0
push 0
push 6
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x10014903
mov ecx, dword [eax]
mov esi, dword [esp + 0x2c]
cmp ecx, esi
jne 0x100148c8
mov edx, dword [esi + 0x114]
push eax
mov dword [eax], edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
add esp, 0x20
ret
test ecx, ecx
je 0x100148fc
mov edx, dword [ecx + 0x114]
cmp edx, esi
je 0x100148f0
mov ecx, edx
test ecx, ecx
jne 0x100148cc
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
add esp, 0x20
ret
mov edx, dword [esi + 0x114]
mov dword [ecx + 0x114], edx
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
add esp, 0x20
ret
Function at 0x10014910
Capabilities:
Get common file path
Query environment variable

Disassembly:
sub esp, 0x400
lea eax, [esp]
push 0x400
push eax
push 0
mov byte [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x10014948
lea ecx, [esp]
push 0x5c
push ecx
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 8
test eax, eax
je 0x10014948
mov byte [eax], 0
push ebx
push ebp
push esi
push edi
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push eax
mov ebx, ecx
push eax
mov esi, ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0
push 0
add ebx, eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0
push 0
add ebx, eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0
push 0
push str.PATH
add ebx, eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea ebx, [ebx + eax + 1]
push 4
push 0x3000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, ebx
mov ebp, eax
mov edx, ecx
xor eax, eax
mov edi, ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, ebx
jae 0x100149d9
lea edi, [esp + 0x10]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
jmp 0x100149db
mov ecx, ebx
lea eax, [esp + 0x10]
push ecx
push eax
push ebp
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0xc
mov byte [esi + ebp], 0x3b
inc esi
mov edx, ebx
sub edx, esi
lea ecx, [esi + ebp]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
add esi, eax
mov eax, ebx
mov byte [esi + ebp], 0x3b
inc esi
sub eax, esi
lea ecx, [esi + ebp]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
add esi, eax
mov edx, ebx
mov byte [esi + ebp], 0x3b
inc esi
sub edx, esi
lea eax, [esi + ebp]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
add esi, eax
mov byte [esi + ebp], 0x3b
inc esi
sub ebx, esi
lea ecx, [esi + ebp]
push ebx
push ecx
push str.PATH
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
add esi, eax
pop edi
mov eax, ebp
mov byte [esi + ebp], 0x3b
mov byte [esi + ebp + 1], 0
pop esi
pop ebp
pop ebx
add esp, 0x400
ret
Function at 0x10017bc0
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
xor esi, esi
push esi
push esi
push 3
push esi
push 1
push bind
mov dword [esp + 0x28], ecx
push str.TR0001.dat
mov dword [esp + 0x30], esi
mov dword [esp + 0x28], esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x10017c66
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
mov esi, edi
shr esi, 2
lea eax, [esi*4]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x10017c4d
lea ecx, [esp + 0x10]
push 0
push ecx
push edi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0x10], edi
jne 0x10017c4d
test esi, esi
jbe 0x10017c46
mov edi, ebx
mov edx, dword [edi]
mov ecx, dword [esp + 0x14]
push edx
call fcn.10017d30
add edi, 4
dec esi
jne 0x10017c34
mov esi, 1
jmp 0x10017c51
mov esi, dword [esp + 0x18]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
pop edi
je 0x10017c66
push ebx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x10018060
Capabilities:
Initialize winsock library

Disassembly:
push 0xffffffffffffffff
push 0x100a6765
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x198
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push ebp
push esi
mov esi, ecx
push edi
push 0x10140b28
mov dword [esp + 0x18], esi
mov dword [esi], 0x100a9370
mov dword [esi + 4], 0x100a936c
call ebx
mov eax, dword [0x10140b20]
xor ebp, ebp
inc eax
cmp eax, 1
mov dword [0x10140b20], eax
jne 0x100180e7
mov ecx, 0x63
xor eax, eax
lea edi, [esp + 0x1a]
mov word [esp + 0x18], bp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x18]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
cmp eax, ebp
je 0x100180e7
lea ecx, [esp + 0x18]
push ecx
push 0x101
call sub.WS2_32.dll_WSAStartup
push 0x10140b28
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [esi + 0x28]
mov dword [esp + 0x1b0], 1
call fcn.10018990
push 0x10140b04
mov dword [esi], 0x100a9348
mov dword [esi + 4], 0x100a9344
mov dword [esp + 0x14], 0x10140b04
call ebx
mov edi, dword [0x10140afc]
push 0xc
mov byte [esp + 0x1b4], 3
mov ebx, dword [edi + 4]
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
cmp edi, ebp
mov ecx, edi
jne 0x10018144
mov ecx, eax
cmp ebx, ebp
mov dword [eax], ecx
jne 0x1001814c
mov ebx, eax
mov dword [eax + 4], ebx
mov dword [edi + 4], eax
mov ecx, dword [eax + 4]
mov dword [ecx], eax
add eax, 8
cmp eax, ebp
je 0x10018160
mov dword [eax], esi
mov eax, dword [0x10140b00]
push 0x10140b04
inc eax
mov byte [esp + 0x1b4], 2
mov dword [0x10140b00], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, esi
mov dword [esi + 0xc], ebp
mov dword [esi + 0x1c], ebp
mov dword [esi + 0x20], ebp
mov dword [esi + 0x70], ebp
mov dword [esi + 0x74], ebp
call fcn.10018380
push ebp
call dword [sym.imp.MSVCRT.dll_time]
push eax
call dword [sym.imp.MSVCRT.dll_srand]
mov ecx, dword [esp + 0x1b0]
add esp, 8
mov eax, esi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a4
ret
Function at 0x10018083
Capabilities:
Initialize winsock library

Disassembly:
push 0xffffffffffffffff
push 0x100a6765
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x198
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push ebp
push esi
mov esi, ecx
push edi
push 0x10140b28
mov dword [esp + 0x18], esi
mov dword [esi], 0x100a9370
mov dword [esi + 4], 0x100a936c
call ebx
mov eax, dword [0x10140b20]
xor ebp, ebp
inc eax
cmp eax, 1
mov dword [0x10140b20], eax
jne 0x100180e7
mov ecx, 0x63
xor eax, eax
lea edi, [esp + 0x1a]
mov word [esp + 0x18], bp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x18]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
cmp eax, ebp
je 0x100180e7
lea ecx, [esp + 0x18]
push ecx
push 0x101
call sub.WS2_32.dll_WSAStartup
push 0x10140b28
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [esi + 0x28]
mov dword [esp + 0x1b0], 1
call fcn.10018990
push 0x10140b04
mov dword [esi], 0x100a9348
mov dword [esi + 4], 0x100a9344
mov dword [esp + 0x14], 0x10140b04
call ebx
mov edi, dword [0x10140afc]
push 0xc
mov byte [esp + 0x1b4], 3
mov ebx, dword [edi + 4]
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
cmp edi, ebp
mov ecx, edi
jne 0x10018144
mov ecx, eax
cmp ebx, ebp
mov dword [eax], ecx
jne 0x1001814c
mov ebx, eax
mov dword [eax + 4], ebx
mov dword [edi + 4], eax
mov ecx, dword [eax + 4]
mov dword [ecx], eax
add eax, 8
cmp eax, ebp
je 0x10018160
mov dword [eax], esi
mov eax, dword [0x10140b00]
push 0x10140b04
inc eax
mov byte [esp + 0x1b4], 2
mov dword [0x10140b00], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, esi
mov dword [esi + 0xc], ebp
mov dword [esi + 0x1c], ebp
mov dword [esi + 0x20], ebp
mov dword [esi + 0x70], ebp
mov dword [esi + 0x74], ebp
call fcn.10018380
push ebp
call dword [sym.imp.MSVCRT.dll_time]
push eax
call dword [sym.imp.MSVCRT.dll_srand]
mov ecx, dword [esp + 0x1b0]
add esp, 8
mov eax, esi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a4
ret

Function at 0x10018b00
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
test eax, eax
je 0x10018aaa
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x10018a90
test byte [esi + 0x20], 2
je 0x10018a7e
mov ecx, dword [esi + 0x2c]
test ecx, ecx
je 0x10018a90
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [esi + 0x10], 0
pop esi
ret
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x10], 0
pop esi
ret
mov dword [ecx + 8], 1
jmp 0x10018a60
Function at 0x10019bf0
Capabilities:
Encode data using xor
Hash data using crc32b

Disassembly:
push ebx
push ebp
mov ebx, ecx
push esi
push edi
xor edi, edi
lea esi, [ebx + 4]
push 8
push edi
mov ecx, ebx
call fcn.10019c50
shl eax, 0x18
mov dword [esi], eax
mov edx, 8
mov ebp, eax
mov ecx, ebp
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
dec edx
mov ebp, eax
jne 0x10019c11
push 0x20
push eax
mov ecx, ebx
mov dword [esi], ebp
call fcn.10019c50
mov dword [esi], eax
inc edi
add esi, 4
cmp edi, 0xff
jle 0x10019bfb
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x10019c90
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, ecx
mov ecx, dword [esp + 0xc]
or eax, 0xffffffff
test ecx, ecx
je 0x10019cc3
mov edx, dword [esp + 8]
push ebx
push esi
lea esi, [ecx]
mov ecx, eax
xor ebx, ebx
mov bl, byte [edx]
and ecx, 0xff
xor ecx, ebx
shr eax, 8
mov ecx, dword [edi + ecx*4 + 4]
xor eax, ecx
inc edx
dec esi
jne 0x10019ca6
pop esi
pop ebx
not eax
pop edi
ret 8

Function at 0x1001a9d0
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
mov eax, dword [edi]
push eax
call sub.WS2_32.dll_ntohl
mov ecx, dword [edi + 4]
mov esi, eax
push ecx
call sub.WS2_32.dll_ntohl
mov ebp, dword [esp + 0x28]
lea edx, [esp + 0x10]
mov edi, eax
lea ebx, [esp + 0x10]
sub ebp, edx
mov dword [esp + 0x24], 4
mov eax, dword [ebx + ebp]
push eax
call sub.WS2_32.dll_ntohl
mov dword [ebx], eax
mov eax, dword [esp + 0x24]
add ebx, 4
dec eax
mov dword [esp + 0x24], eax
jne 0x1001aa06
mov ecx, dword [esp + 0x1c]
xor eax, eax
mov dword [esp + 0x24], 0x10
mov ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0x10]
mov edx, edi
sub eax, 0x61c88647
shr edx, 5
add edx, ebx
mov ebx, edi
shl ebx, 4
add ebx, ebp
mov ebp, dword [esp + 0x18]
xor edx, ebx
lea ebx, [eax + edi]
xor edx, ebx
add esi, edx
mov edx, esi
mov ebx, esi
shr edx, 5
shl ebx, 4
add edx, ecx
add ebx, ebp
xor edx, ebx
lea ebx, [eax + esi]
xor edx, ebx
add edi, edx
mov edx, dword [esp + 0x24]
dec edx
mov dword [esp + 0x24], edx
jne 0x1001aa2d
push esi
call sub.WS2_32.dll_htonl
mov esi, dword [esp + 0x2c]
push edi
mov dword [esi], eax
call sub.WS2_32.dll_htonl
mov dword [esi + 4], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x1001aaa0
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
push edi
mov eax, dword [esi]
push eax
call sub.WS2_32.dll_ntohl
mov ecx, dword [esi + 4]
mov edi, eax
push ecx
call sub.WS2_32.dll_ntohl
mov ebp, dword [esp + 0x28]
lea edx, [esp + 0x10]
mov esi, eax
lea ebx, [esp + 0x10]
sub ebp, edx
mov dword [esp + 0x24], 4
mov eax, dword [ebx + ebp]
push eax
call sub.WS2_32.dll_ntohl
mov dword [ebx], eax
mov eax, dword [esp + 0x24]
add ebx, 4
dec eax
mov dword [esp + 0x24], eax
jne 0x1001aad6
mov ecx, dword [esp + 0x14]
mov eax, 0xe3779b90
mov dword [esp + 0x24], 0x10
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
mov edx, edi
shr edx, 5
add edx, ebx
mov ebx, edi
shl ebx, 4
add ebx, ebp
mov ebp, dword [esp + 0x10]
xor edx, ebx
lea ebx, [eax + edi]
xor edx, ebx
sub esi, edx
mov edx, esi
mov ebx, esi
shr edx, 5
shl ebx, 4
add edx, ecx
add ebx, ebp
xor edx, ebx
lea ebx, [eax + esi]
xor edx, ebx
add eax, 0x61c88647
sub edi, edx
mov edx, dword [esp + 0x24]
dec edx
mov dword [esp + 0x24], edx
jne 0x1001ab00
push edi
call sub.WS2_32.dll_htonl
mov edi, dword [esp + 0x2c]
push esi
mov dword [edi], eax
call sub.WS2_32.dll_htonl
mov dword [edi + 4], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x1002fadc
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100a69d1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov al, byte [esp + 3]
push esi
mov esi, ecx
push edi
push 0xc
mov dword [esp + 0x10], esi
mov dword [esi], 0x100a9438
mov byte [esi + 8], al
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
xor edi, edi
mov dword [eax], eax
mov dword [eax + 4], eax
add esp, 4
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], edi
mov cl, byte [esp + 0xb]
mov dword [esp + 0x18], edi
mov byte [esi + 0x38], cl
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
lea ecx, [esi + 0x48]
mov byte [esp + 0x18], 1
call fcn.10032d00
lea ecx, [esi + 0x4c]
mov byte [esp + 0x18], 2
call fcn.10033a80
mov ecx, dword [esp + 0x10]
mov dword [esi + 4], edi
mov dword [esi + 0x4cc], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x4c0], edi
mov dword [esi + 0x4c4], edi
mov dword [esi + 0x4c8], edi
mov dword [esi + 0x4d4], edi
mov dword [esi], 0x100a9418
mov dword [esi + 0x4d0], 0xea60
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x10030490
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x204
push esi
mov esi, ecx
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
mov byte [esp + 0x108], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x109]
push 0x100
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x214]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
jne 0x100304f1
pop edi
pop esi
add esp, 0x204
ret 8
lea edx, [esp + 8]
push edx
call dword [sym.imp.MSVCRT.dll__mbsupr]
add esp, 4
lea eax, [esp + 0x108]
lea edi, [esp + 8]
or ecx, 0xffffffff
push 0
push 0x104
push eax
xor eax, eax
add esi, 0x4c
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
call fcn.10034080
mov edx, dword [esp + 0x214]
lea eax, [esp + 0x108]
push edx
push eax
mov ecx, esi
call fcn.10034010
pop edi
pop esi
add esp, 0x204
ret 8