joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1007714b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x100771a4
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x1007714b
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x1007715a
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x1047cdfd
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x100771ab
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.1005e021
cmp eax, dword [ebp + 0xc]
pop eax
je 0x1007724a
add edi, 4
add eax, 2
dec ecx
jne 0x10077190
call 0x100771f7
loope 0x100771ed
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x10077247
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x10077258
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x1007720b
cmp eax, ecx
ja 0x1007720b
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x10077295
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x1007728b
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.1005e500
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x1007715a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x100771a4
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x1007714b
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x1007715a
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x1047cdfd
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x100771ab
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.1005e021
cmp eax, dword [ebp + 0xc]
pop eax
je 0x1007724a
add edi, 4
add eax, 2
dec ecx
jne 0x10077190
call 0x100771f7
loope 0x100771ed
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x10077247
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x10077258
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x1007720b
cmp eax, ecx
ja 0x1007720b
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x10077295
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x1007728b
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.1005e500
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x190f4b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xa64000]
push edi
or ebp, 0xffffffff
jmp 0x190f4d2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x190f4d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x190f4c8
mov eax, 1
add ebx, ebx
jne 0x190f4eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x190f4fc
jne 0x190f51b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x190f51b
dec eax
add ebx, ebx
jne 0x190f508
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x190f4e0
add ebx, ebx
jne 0x190f517
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x190f56d
xor ecx, ecx
sub eax, 3
jb 0x190f533
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x190f5a2
sar eax, 1
mov ebp, eax
jmp 0x190f53e
add ebx, ebx
jne 0x190f53e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x190f50c
inc ecx
add ebx, ebx
jne 0x190f54c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x190f50c
add ebx, ebx
jne 0x190f559
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x190f54e
jne 0x190f56a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x190f54e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x190f58c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x190f57e
jmp 0x190f4ce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x190f58c
add edi, ecx
jmp 0x190f4ce
pop esi
mov edi, esi
mov ecx, 0x384d9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x190f5aa
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x190f5af
lea edi, [esi + 0x150a000]
mov eax, dword [edi]
or eax, eax
je 0x190f617
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x151f66c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x151f7d4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x190f5d5
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x151f7d8]
or eax, eax
je 0x190f611
mov dword [ebx], eax
add ebx, 4
jmp 0x190f5f2
call dword [esi + 0x151f7e8]
mov ebp, dword [esi + 0x151f7dc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x190f64b
sub esp, 0xffffff80
jmp 0xd30478
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x40288e
pop dword [ebp - 0xc]
mov eax, 0x9e54740e
add eax, 0x61ebb480
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xc7d7a39d
add dword [ebp - 0x1c], 0x867aa1ae
mov dword [ebp - 0x18], 0x1c3fd28d
add dword [ebp - 0x18], 0x15f379b8
mov dword [ebp - 0x14], 0xd0a3cd4a
sub dword [ebp - 0x14], 0x8457891c
mov dword [ebp - 0x10], 0x1273c7f1
sub dword [ebp - 0x10], 0x1273c7f1
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x139c64ff
add eax, 0xeca40b65
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x8e6de7f8
sub dword [ebp - 0x1c], 0x19fb7ea2
mov dword [ebp - 0x18], 0x16db1cdf
add dword [ebp - 0x18], 0x2a914496
mov dword [ebp - 0x14], 0xdfec4980
sub dword [ebp - 0x14], 0x7c7cdd14
mov dword [ebp - 0x10], 0x1a9ed76c
sub dword [ebp - 0x10], 0x1a9ed76c
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0x701e3c9c
sub eax, 0x6fddcbf4
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x39396
push 0
call eax
mov ecx, 0x5283
xor edx, edx
add edx, eax
mov ebx, 0x4fdcab1b
sub ebx, 0x4f9bab1b
add ebx, dword [ebp - 0xc]
mov edi, 0x15a2fca3
sub edi, 0x326567ad
add dword [ebp - 4], 0xd9e567c6
mov esi, dword [ebx]
xor dword [ebp - 8], 0xc48b8871
sub esi, edi
sub dword [ebp - 4], ebx
mov dword [edx], esi
xor dword [ebp - 4], eax
add edx, 0xf33d2a27
sub edx, 0xf33d2a23
add ebx, 4
loop 0x4029ac
add eax, 0x13cdf
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push 0x413e64
lea eax, [ebp - 4]
mov esi, ecx
push 0x416f70
push eax
call fcn.004016cf
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x40102d
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push 0x413eb4
push esi
push 0
or ebx, 0xffffffff
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4010a0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 8], eax
test eax, eax
jle 0x4010a0
push 0x413eb4
push esi
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
jne 0x401069
xor esi, esi
jmp 0x4010a3
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x4010a3
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x4010a3
push dword [ebp - 4]
push dword [ebp - 8]
push 1
push eax
call fcn.0040186d
push dword [ebp - 4]
mov ebx, eax
call fcn.004019a2
add esp, 0x14
jmp 0x4010a3
mov esi, dword [ebp - 8]
push dword [ebp - 4]
call fcn.00401b4b
add esp, 4
test esi, esi
je 0x4010b9
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4010d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
mov dword [ebp - 0x28], 0
call fcn.00401bf3
push eax
call fcn.00401be3
xorps xmm0, xmm0
mov eax, 0x101
movdqu xmmword [ebp - 0x24], xmm0
add esp, 8
mov word [ebp - 0x24], ax
mov esi, 2
mov edi, edi
call fcn.00401bc2
and eax, 0x800000ff
jns 0x401123
dec eax
or eax, 0xffffff00
inc eax
mov byte [ebp + esi - 0x24], al
inc esi
cmp esi, 0x10
jl 0x401110
lea eax, [ebp - 0x28]
push eax
push 0x2011f
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
js 0x401168
push 0x10
lea eax, [ebp - 0x24]
push eax
push 3
push 0
push str.Identity
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x401176
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004015fc
mov esp, ebp
pop ebp
ret
Function at 0x1000125c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0xc], 0
call sub.KERNEL32.DLL_GetEnvironmentStringsA
mov ebx, eax
mov dword [ebp - 0x10], ebx
jmp 0x10001299
cmp byte [ebx], 0x3d
je 0x10001285
inc dword [ebp - 0xc]
mov edi, ebx
xor eax, eax
stc
sbb ecx, ecx
repne scasb al, byte es:[edi]
neg ecx
lea eax, [ecx - 2]
mov edi, eax
inc edi
lea ebx, [ebx + edi]
cmp byte [ebx], 0
jne 0x10001278
mov edi, dword [ebp - 0xc]
inc edi
lea edi, [edi*4]
mov dword [ebp - 0x14], edi
push dword [ebp - 0x14]
call sub.CRTDLL.DLL_malloc
pop ecx
mov dword [ebp - 8], eax
mov dword [0x10003010], eax
cmp dword [ebp - 8], 0
jne 0x100012cc
xor eax, eax
jmp 0x10001342
mov ebx, dword [ebp - 0x10]
jmp 0x10001325
mov edi, ebx
xor eax, eax
stc
sbb ecx, ecx
repne scasb al, byte es:[edi]
neg ecx
lea eax, [ecx - 2]
mov edi, eax
inc edi
mov dword [ebp - 4], edi
cmp byte [ebx], 0x3d
je 0x1000131f
push dword [ebp - 4]
call sub.CRTDLL.DLL_malloc
pop ecx
mov esi, dword [ebp - 8]
mov dword [esi], eax
or eax, eax
jne 0x10001308
jmp 0x10001342
push ebx
mov edi, dword [ebp - 8]
push dword [edi]
call sub.CRTDLL.DLL_strcpy
add esp, 8
add dword [ebp - 8], 4
mov edx, dword [ebp - 4]
lea ebx, [ebx + edx]
cmp byte [ebx], 0
jne 0x100012d1
mov edx, dword [ebp - 8]
mov dword [edx], 0
mov eax, 1
pop edi
pop esi
pop ebx
leave
ret

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x410b3c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x410b4b
pop dword [ebp - 0x34]
mov eax, 0x89912566
sub eax, 0x89501a1b
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xf880bf25
add dword [ebp - 0x44], 0x55d18626
mov dword [ebp - 0x40], 0xf0f720e3
add dword [ebp - 0x40], 0x413c2b62
mov dword [ebp - 0x3c], 0x8c3e8209
sub dword [ebp - 0x3c], 0x3ff23ddb
mov dword [ebp - 0x38], 0x32a1a97a
add dword [ebp - 0x38], 0xcd5e5686
lea eax, [ebp - 0x44]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0xef404927
sub dword [ebp - 0x44], 0x7acddfd1
mov dword [ebp - 0x40], 0xc0c0c296
add dword [ebp - 0x40], 0x80ab9edf
mov dword [ebp - 0x3c], 0x885bcd21
add dword [ebp - 0x3c], 0xdb139f4b
mov dword [ebp - 0x38], 0x92f72345
sub dword [ebp - 0x38], 0x92f72345
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0xf555394
sub eax, 0xf132270
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x3e53e
push 0
call eax
mov ecx, 0x47fa
xor edi, edi
add edi, eax
mov ebx, 0x4e23b7d4
add ebx, 0xb21f8c2c
add ebx, dword [ebp - 0x34]
mov esi, 0x5f01aba7
add esi, 0x814cf442
add dword [ebp - 0x18], 0x2bfcd75b
mov edx, dword [ebx]
xor dword [ebp - 4], 0x17666f39
sub edx, esi
xor dword [ebp - 0x18], 0xaaabc2a6
mov dword [edi], edx
add dword [ebp - 0x28], esi
add edi, 0x68519685
add edi, 0x97ae697f
add ebx, 0x272abfc8
add ebx, 0xd8d5403c
loop 0x410c64
add eax, 0xb5cd2498
add eax, 0x4a33ee23
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x10003f57
Capabilities:
Create tcp socket

Disassembly:
push 0xc
push 0x10026548
call fcn.10012350
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], ebx
cmp dword [0x100469ec], ebx
je 0x10004019
mov eax, dword [0x100469f0]
cmp eax, ebx
je 0x10004019
mov dword [ebp - 0x1c], eax
push 0x48
pop ecx
mov esi, eax
mov edi, 0x100464b0
rep movsd dword es:[edi], dword [esi]
lea esi, [eax + 0x120]
mov edi, 0x10046478
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea esi, [ebp - 0x1c]
call fcn.10004bee
call fcn.1000472d
push 1
push ebx
push ebx
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_WSASocketW]
mov dword [0x10029210], eax
cmp eax, 0xffffffff
je 0x10003ffa
mov esi, 0x1004648c
call fcn.10004967
test eax, eax
je 0x10003ffa
cmp dword [ebp + 0x14], 0x7fffffff
je 0x10003ffa
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0xffffffffffffffff
push dword [0x10046490]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], 0xfffffffe
call fcn.1000405c
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.10012395
ret 0x10
push str.Global1B4BAB0F_4544_4c13_90E9_622E2EE1411B
push 0x1000
push ebx
push 0x8000004
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [0x100469ec], eax
cmp eax, ebx
je 0x10004057
push ebx
push ebx
push ebx
push 0xf001f
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x100469f0], eax
cmp eax, ebx
jne 0x10003f84
mov dword [ebp - 0x1c], ebx
jmp 0x10003ffa

Function at 0x100043be
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x198
mov eax, dword [0x10028500]
xor eax, esp
mov dword [esp + 0x194], eax
cmp dword [ebp + 0xc], 1
mov eax, dword [ebp + 8]
jne 0x10004423
push eax
mov dword [0x10046474], eax
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0x100470f8
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor eax, eax
push 0x18e
push eax
mov word [esp + 8], ax
lea eax, [esp + 0xa]
push eax
call fcn.10016310
add esp, 0xc
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
jmp 0x1000444f
cmp dword [ebp + 0xc], 0
jne 0x1000444f
push 0x100470f8
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push closesocket
push 0
push 0
push 0
call sym.CollInfo.dll_StopRoutineW
call fcn.1000194c
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x194]
xor eax, eax
xor ecx, esp
inc eax
call fcn.1000b28c
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10004466
Capabilities:
Read file on windows

Disassembly:
push 0x40
push 0x100259c0
call fcn.10012350
mov esi, dword [ebp + 0xc]
xor edi, edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 4], edi
push 0x10023d40
push dword [ebp + 8]
call fcn.1000c994
pop ecx
pop ecx
mov dword [ebp - 0x20], eax
cmp eax, edi
jne 0x1000449f
mov dword [ebp - 0x1c], 1
jmp 0x100044ef
mov dword [ebp - 0x50], edi
push 0x2c
push edi
lea eax, [ebp - 0x4c]
push eax
call fcn.10016310
lea eax, [ebp - 0x50]
push eax
push dword [ebp + 8]
call fcn.1000caac
add esp, 0x14
mov eax, dword [ebp - 0x3c]
cmp eax, edi
je 0x10004496
mov dword [esi + 8], eax
push eax
call fcn.1000b2ea
pop ecx
mov dword [esi + 4], eax
cmp eax, edi
je 0x10004496
push dword [ebp - 0x20]
push dword [ebp - 0x3c]
xor ebx, ebx
inc ebx
push ebx
push eax
call fcn.1000d192
add esp, 0x10
test eax, eax
ja 0x100044ef
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], 0xfffffffe
call fcn.1000450e
xor eax, eax
cmp dword [ebp - 0x1c], edi
sete al
call fcn.10012395
ret

Function at 0x1000455e
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
push 0x14
push 0x100259a0
call fcn.10012350
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
push dword [ebp + 0xc]
push ebx
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x20], eax
cmp eax, ebx
je 0x1000461b
mov eax, dword [ebp + 8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10004598
sub eax, edx
push 4
push 0x1000
inc eax
push eax
push ebx
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, eax
cmp esi, ebx
je 0x1000461b
mov eax, dword [ebp + 8]
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x100045c0
sub eax, edi
push ebx
push eax
push dword [ebp + 8]
push esi
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1000461b
push 0x10023d48
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x1000461b
push ebx
push ebx
push esi
push eax
push ebx
push ebx
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0x24], eax
cmp eax, ebx
je 0x1000461b
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
jne 0x10004622
mov dword [ebp - 0x1c], 1
mov dword [ebp - 4], 0xfffffffe
call fcn.1000463e
xor eax, eax
cmp dword [ebp - 0x1c], ebx
sete al
call fcn.10012395
ret
Function at 0x1000465b
Capabilities:
Enumerate processes

Disassembly:
push 0x240
push 0x10025980
call fcn.10020550
mov esi, ecx
mov edi, edx
xor ebx, ebx
mov dword [ebp - 0x250], ebx
or dword [ebp - 0x24c], 0xffffffff
push 0x228
push ebx
lea eax, [ebp - 0x244]
push eax
call fcn.10016310
add esp, 0xc
mov dword [ebp - 0x248], 0x22c
mov dword [ebp - 4], ebx
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
mov dword [ebp - 0x24c], ebx
cmp ebx, 0xffffffff
je 0x100046ff
lea eax, [ebp - 0x248]
push eax
push ebx
call sub.KERNEL32.dll_Process32FirstW
jmp 0x100046fb
push edi
lea eax, [ebp - 0x224]
push eax
call fcn.1000d7a0
pop ecx
pop ecx
test eax, eax
jne 0x100046ee
test esi, esi
je 0x100046e2
mov eax, dword [ebp - 0x240]
mov dword [esi], eax
mov dword [ebp - 0x250], 1
jmp 0x100046ff
lea eax, [ebp - 0x248]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x100046c3
mov dword [ebp - 4], 0xfffffffe
call fcn.10004717
mov eax, dword [ebp - 0x250]
call fcn.10020598
ret

Function at 0x100047c2
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x10]
xor esi, esi
jmp 0x100047e8
mov eax, dword [ebp + 0xc]
push 0
push edi
add eax, esi
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x100047ec
add esi, eax
sub edi, eax
test edi, edi
jg 0x100047ce
xor eax, eax
cmp esi, dword [ebp + 0x10]
pop edi
sete al
pop esi
pop ebp
ret

Function at 0x100047f8
Capabilities:
Receive data
Receive data on socket

Disassembly:
push esi
xor esi, esi
push edi
mov edi, dword [0x10029210]
test ebx, ebx
jle 0x10004825
push 0
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [esp + 0x14]
add eax, esi
push eax
push edi
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x1000482f
add esi, eax
cmp esi, ebx
jl 0x10004806
xor eax, eax
cmp ebx, esi
sete al
pop edi
pop esi
ret
xor eax, eax
jmp 0x1000482c