joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002ba5
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
push 0x1c
call fcn.1002ffeb
add esp, 4
mov dword [ebp - 8], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 7
rep stosd dword es:[edi], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], esp
push 0
push 4
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x10002c13
push 0x19
push 0x402f1bb
push 6
call fcn.1002fffd
add esp, 0xc
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 8]
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x14]
mov dword [ebx], 0x1c
mov dword [ebp - 0x14], esp
push dword [ebp - 8]
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_Thread32First]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x10002c54
push 0x80
push 0x402f1bb
push 6
call fcn.1002fffd
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x10002cc2
mov ebx, dword [ebp - 8]
add ebx, 0xc
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp + 8]
mov ebx, dword [ebp - 0x14]
cmp dword [ebx], eax
jne 0x10002c8e
mov ebx, dword [ebp - 8]
add ebx, 8
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x14]
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
jmp 0x10002cc2
mov dword [ebp - 0x14], esp
push dword [ebp - 8]
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_Thread32Next]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x10002cbd
push 0x16d
push 0x402f1bb
push 6
call fcn.1002fffd
add esp, 0xc
mov dword [ebp - 0xc], eax
jmp 0x10002c57
mov dword [ebp - 0x14], esp
push dword [ebp - 4]
xor eax, eax
call dword [0x101487ee]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x10002cee
push 0x1a3
push 0x402f1bb
push 6
call fcn.1002fffd
add esp, 0xc
mov eax, dword [ebp - 0x10]
jmp 0x10002cf6
push eax
mov ebx, dword [ebp - 8]
push ebx
call fcn.1002fff1
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4

Function at 0x10002d0a
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], 0x10002dbd
mov eax, dword [ebp + 8]
leave
sub esp, 0x60
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]
Function at 0x10002e6e
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0
lea eax, [ebp - 8]
push eax
push 8
call fcn.1002ffeb
add esp, 4
mov dword [ebp - 0xc], eax
mov edi, eax
mov esi, 0x1005430c
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call fcn.10002fb3
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.1002fff1
add esp, 4
cmp word [ebp - 0x10], 0x5a4d
je 0x10002ed9
mov eax, 0
jmp 0x10002fad
push 0x3c
push dword [ebp + 8]
call fcn.10003148
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
push 0
lea eax, [ebp - 0xc]
push eax
push 8
call fcn.1002ffeb
add esp, 4
mov dword [ebp - 0x10], eax
mov edi, eax
mov esi, 0x1005430c
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
call fcn.10003165
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.1002fff1
add esp, 4
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.10003148
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
push 0
lea eax, [ebp - 0xc]
push eax
push 8
call fcn.1002ffeb
add esp, 4
mov dword [ebp - 0x10], eax
mov edi, eax
mov esi, 0x1005430c
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
call fcn.10002fb3
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.1002fff1
add esp, 4
cmp word [ebp - 0x14], 0x4550
je 0x10002f9d
mov eax, 0
jmp 0x10002fad
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.10003148
jmp 0x10002fad
mov esp, ebp
pop ebp
ret 4

Function at 0x100049c4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.10002d0a
test eax, eax
je 0x10004a07
xor eax, eax
xchg dword [ebp + 8], eax
cmp eax, 0xffff
jle 0x10004a07
cmp word [eax], 0x5a4d
jne 0x10004a07
add eax, dword [eax + 0x3c]
cmp dword [eax], 0x4550
jne 0x10004a07
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.100030fc
mov eax, dword [ebp + 8]
jmp 0x10004a20
mov esp, ebp
pop ebp
ret 4
Function at 0x100110e7
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x10011110
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x1001110c
imul eax, dword [ebx]
jmp 0x10011101
mov ecx, eax
test ecx, ecx
je 0x10011153
push ecx
push ebx
mov ebx, dword [ebx]
push ebx
add ebx, 0xc
push ebx
mov ebx, dword [ebx]
test ebx, ebx
je 0x1001112e
push ebx
call fcn.1002fff1
add esp, 4
pop ebx
add ebx, 4
push ebx
mov ebx, dword [ebx]
test ebx, ebx
je 0x10011142
push ebx
call fcn.1002fff1
add esp, 4
pop ebx
call fcn.1002fff1
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x10011116
call fcn.1002fff1
add esp, 4
mov eax, 0x1005430c
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
push dword [ebp + 8]
call fcn.100111b6
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push 0x100118cf
xor eax, eax
call dword [sym.imp.USER32.dll_EnumWindows]
nop
nop
cmp dword [ebp - 8], esp
je 0x100111a1
push 0x31
push 0x4030161
push 6
call fcn.1002fffd
add esp, 0xc
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
call fcn.10001546
jmp 0x100111b0
mov esp, ebp
pop ebp
ret 8

Function at 0x100116df
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], esp
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x10011722
push 0x2b
push 0x403016a
push 6
call fcn.1002fffd
add esp, 0xc
mov dword [ebp - 0x18], eax
fild dword [ebp - 0x18]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
fadd qword [0x1005ff41]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
call fcn.1000114b
mov dword [ebp - 4], eax
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x184
call fcn.100314d0
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x10011775
push ebx
call fcn.1002fff1
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x100117ab
push 0x84
push 0x403016a
push 6
call fcn.1002fffd
add esp, 0xc
mov eax, dword [ebp - 8]
test eax, eax
je 0x100117c7
push eax
mov ebx, eax
call fcn.1000188c
inc eax
push eax
call fcn.1002ffeb
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x100117cc
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x100117dd
push ebx
call fcn.1002fff1
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x10018fda
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov ebx, dword [ebp + 8]
cmp ebx, 0
je 0x1001901f
mov eax, dword [ebx + 0x3c]
add eax, ebx
mov edx, dword [eax + 0x78]
add edx, ebx
mov ecx, dword [edx + 0x18]
mov eax, dword [edx + 0x20]
push ecx
push ecx
push eax
xor eax, eax
or ecx, 0xffffffff
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
repne scasb al, byte es:[edi]
not ecx
pop eax
push ecx
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
mov esi, dword [eax + ebx]
add esi, ebx
repe cmpsb byte [esi], byte es:[edi]
pop ecx
je 0x10019025
add eax, 4
pop esi
dec esi
push esi
jne 0x10019007
xor eax, eax
leave
ret 8
pop esi
pop ecx
sub ecx, esi
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx eax, word [eax + ebx]
mov ecx, dword [edx + 0x1c]
lea eax, [ecx + eax*4]
mov eax, dword [eax + ebx]
add eax, ebx
leave
ret 8
Function at 0x10026cd2
Capabilities:
Access peb ldr_data

Disassembly:
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov edi, ebx
mov esi, dword [ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword [esi]
test cx, cx
je 0x10026d1f
mov al, cl
cmp al, 0x61
jb 0x10026cfa
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x10026d1f
mov al, cl
cmp al, 0x61
jb 0x10026d12
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, [esi + 4]
jmp 0x10026ceb
cmp edx, dword [esp + 0x18]
je 0x10026d2f
mov ebx, dword [ebx]
cmp edi, dword [ebx]
jne 0x10026ce4
xor eax, eax
jmp 0x10026d32
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x10026d3a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
pushal
mov ebx, ecx
mov eax, dword [ebx + 0x3c]
mov eax, dword [ebx + eax + 0x78]
test eax, eax
je 0x10026e21
lea esi, [ebx + eax]
test edx, 0xffff0000
je 0x10026e27
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0x20]
lea edi, [ebx + edi]
mov ebp, dword [edi + ecx*4 - 4]
lea ebp, [ebx + ebp]
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x10026d86
cmp al, 0x61
jb 0x10026d7e
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x10026d71
cmp edx, dword [esp + 0x14]
je 0x10026d96
dec ecx
jne 0x10026d66
xor eax, eax
jmp 0x10026e21
mov edx, dword [esi + 0x24]
lea edx, [ebx + edx]
mov edx, dword [edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword [esi + 0x1c]
lea eax, [ebx + eax]
mov eax, dword [eax + edx*4]
lea eax, [ebx + eax]
cmp eax, esi
jbe 0x10026e21
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x10026e21
mov ebp, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
cmp al, 0x61
jb 0x10026dd2
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
inc ebp
cmp al, 0x2e
je 0x10026de1
jmp 0x10026dc9
ror edx, 0xd
add edx, 0x44
ror edx, 0x1a
add edx, 0x4c
ror edx, 0x1a
add edx, 0x4c
ror edx, 0xd
mov ecx, edx
call fcn.10026cd2
test eax, eax
je 0x10026e21
mov ecx, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x10026e1c
cmp al, 0x61
jb 0x10026e14
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x10026e07
call fcn.10026d3a
mov dword [esp + 0x1c], eax
popal
ret
mov ecx, dword [esi + 0x10]
cmp edx, ecx
jb 0x10026e3f
mov eax, dword [esi + 0x14]
dec eax
cmp edx, eax
ja 0x10026e3f
sub edx, ecx
mov ecx, edx
jmp 0x10026d96
xor eax, eax
jmp 0x10026e21
Function at 0x10027fdd
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
mov ebx, dword [ebp + 8]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
nop
nop
cmp dword [ebp - 8], esp
je 0x1002801b
push 0x2b
push 0x402ff64
push 6
call fcn.1002fffd
add esp, 0xc
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp + 0xc]
push dword [ebx]
push dword [ebp - 0xc]
xor eax, eax
call dword [0x101488da]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x1002804f
push 0x2b
push 0x402ff64
push 6
call fcn.1002fffd
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1002809e
mov dword [ebp - 8], esp
mov eax, 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 0x10
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
nop
cmp dword [ebp - 8], esp
je 0x1002809e
push 0x84
push 0x402ff64
push 6
call fcn.1002fffd
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x100280a6
mov esp, ebp
pop ebp
ret 8

Function at 0x10030d90
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push edi
push 0
push 0x20
push 3
push 0
push 3
push connect
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x10030df9
push ebx
lea ecx, [esp + 0x10]
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea edx, [ebx + 8]
push edx
call fcn.10030880
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esi + 8]
push ebx
push ecx
push edi
mov dword [esi], 1
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
pop edi
ret

Function at 0x10031410
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x100314a2
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x10031494
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x1003148c
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x10031455
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
Function at 0x10031dd0
Capabilities:
Delete directory

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x10031ddd
xor eax, eax
pop esi
ret
push esi
call dword [0x10148e90]
add esp, 4
test eax, eax
jne 0x10031ded
pop esi
ret
cmp eax, 1
jne 0x10031dfb
cmp byte [esi], 0x5c
jne 0x10031dfb
xor eax, eax
pop esi
ret
push esi
call fcn.10031b80
add esp, 4
test eax, eax
je 0x10031e0f
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop esi
ret

Function at 0x100333c0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x100333de
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x100333d3
pop esi
ret

Function at 0x10033410
Capabilities:
Query environment variable

Disassembly:
push ebp
push esi
push edi
push 0x104
call fcn.10030830
mov ebp, dword [esp + 0x18]
add esp, 4
mov edi, eax
push 0x104
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
cmp esi, 0x104
jbe 0x10033467
push ebx
push edi
call fcn.10030940
push esi
mov ebx, esi
call fcn.10030830
add esp, 8
mov edi, eax
push esi
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
cmp esi, ebx
ja 0x1003343e
mov eax, edi
pop ebx
pop edi
pop esi
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x10033470
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 0x28]
sub esp, 0x18
push ebx
push ebp
xor ebx, ebx
xor ebp, ebp
cmp eax, 0x80000301
ja 0x100334f1
je 0x100334e2
cmp eax, 0x80000101
ja 0x100334db
je 0x100334e2
cmp eax, reloc.WS2_32.dll_connect
je 0x100334bc
cmp eax, 0x80000005
jne 0x10033506
mov eax, dword [esp + 0x40]
mov dword [esp + 8], 3
test eax, eax
je 0x10033553
mov ebx, dword [eax + 4]
lea ebp, [eax + 8]
jmp 0x10033553
mov eax, dword [esp + 0x40]
mov dword [esp + 8], 1
push eax
call dword [0x10148e90]
mov ebp, dword [esp + 0x44]
mov ebx, eax
add esp, 4
inc ebx
jmp 0x10033553
cmp eax, 0x80000201
jne 0x10033506
mov ebx, 4
lea ebp, [esp + 0x40]
mov dword [esp + 8], ebx
jmp 0x10033553
cmp eax, 0x80000401
je 0x1003353e
cmp eax, 0x80000501
je 0x10033526
cmp eax, 0x80000601
je 0x1003350e
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
fld qword [esp + 0x40]
mov ebx, 4
mov dword [esp + 8], ebx
call fcn.10038fa0
mov dword [esp + 0xc], eax
jmp 0x1003354f
fld dword [esp + 0x40]
mov ebx, 4
mov dword [esp + 8], ebx
call fcn.10038fa0
mov dword [esp + 0xc], eax
jmp 0x1003354f
mov ecx, dword [esp + 0x40]
mov ebx, 4
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ecx
lea ebp, [esp + 0xc]
mov edx, dword [esp + 0x28]
push esi
push edx
call fcn.10035170
mov esi, eax
mov eax, dword [esp + 0x3c]
push eax
mov dword [esp + 0x28], esi
mov dword [esp + 0x20], 0
call dword [0x10148e90]
add esp, 8
test esi, esi
je 0x1003362c
test eax, eax
je 0x1003362c
inc eax
push edi
push eax
call fcn.10045797
mov edi, dword [esp + 0x40]
mov edx, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x5c
mov eax, ecx
mov esi, edi
mov edi, edx
push edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [esp + 0x2c], edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.10039560
mov esi, eax
add esp, 0xc
test esi, esi
je 0x100335ce
mov byte [esi], 0
inc esi
mov edi, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x18]
push 0
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x10033622
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
push ebx
push ebp
push eax
push 0
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x10033617
mov dword [esp + 0x1c], 1
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call fcn.100457c0
add esp, 4
pop edi
mov eax, dword [esp + 0x18]
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x10033660
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebp
push esi
push edi
push eax
call fcn.10035170
mov edi, dword [esp + 0x28]
mov ebp, eax
push edi
xor esi, esi
call dword [0x10148e90]
add esp, 8
test ebp, ebp
je 0x1003372a
test eax, eax
je 0x1003372a
inc eax
push ebx
push eax
call fcn.10045797
mov ebx, eax
or ecx, 0xffffffff
xor eax, eax
push 0x5c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.10039560
mov esi, eax
add esp, 0xc
test esi, esi
je 0x100336cc
mov byte [esi], 0
inc esi
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10033706
mov ecx, dword [esp + 0x10]
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [esp + 0x10]
mov esi, eax
neg esi
sbb esi, esi
push edx
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x10033719
mov eax, dword [esp + 0x28]
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
neg esi
sbb esi, esi
inc esi
push ebx
call fcn.100457c0
add esp, 4
mov eax, esi
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret
mov eax, esi
pop edi
pop esi
pop ebp
pop ecx
ret

Function at 0x100337b3
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push esi
lea eax, [esp + 0x14]
push edi
push eax
mov dword [esp + 0x1c], 0x44
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov eax, dword [esp + 0x84]
xor edi, edi
cmp eax, edi
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], edi
mov dword [esp + 0x44], 1
je case.0x10033781.2
mov ecx, dword [esp + 0x7c]
lea eax, [ecx - 1]
cmp eax, 5
ja case.0x10033781.2
jmp dword [eax*4 + 0x1003380c]
mov word [esp + 0x48], di
jmp 0x100337ba
mov word [esp + 0x48], 2
jmp 0x100337ba
mov word [esp + 0x48], 3
jmp 0x100337ba
mov word [esp + 0x48], 4
jmp 0x100337ba
mov word [esp + 0x48], 7
jmp 0x100337ba
mov word [esp + 0x48], 5
lea edx, [esp + 8]
mov ecx, dword [esp + 0x64]
lea eax, [esp + 0x18]
push edx
push eax
push edi
push edi
push edi
push 1
push edi
push edi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, eax
cmp esi, edi
je 0x10033804
cmp dword [esp + 0x70], edi
je 0x100337f0
mov edx, dword [esp + 8]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esp + 0xc]
push ecx
call edi
mov eax, esi
pop edi
pop esi
add esp, 0x54
ret
Function at 0x100340d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, edx
push esi
push edi
mov esi, ebp
xor edi, edi
and esi, 3
mov eax, ecx
jle 0x100340f1
mov dl, byte [eax]
inc eax
cmp dl, bl
je 0x1003414b
inc edi
cmp edi, esi
jl 0x100340e5
mov edi, ebx
and edi, 0xff
mov esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
lea edi, [ecx + ebp]
cmp eax, edi
jae 0x10034180
mov edx, dword [eax]
xor edx, esi
lea ebp, [edx - 0x1010101]
not edx
and ebp, edx
test ebp, 0x80808080
je 0x1003413a
cmp byte [eax], bl
je 0x10034155
cmp byte [eax + 1], bl
je 0x1003415e
cmp byte [eax + 2], bl
je 0x10034168
cmp byte [eax + 3], bl
je 0x10034174
add eax, 4
cmp eax, edi
jb 0x10034111
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
dec eax
pop ebx
ret 4
pop edi
pop esi
pop ebp
sub eax, ecx
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
inc eax
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 2
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 3
pop ebx
ret 4
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4

Function at 0x100360b0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
sub esp, 0x10
push esi
push 6
push 1
push 2
call sub.WS2_32.dll_socket
mov ecx, dword [esp + 0x1c]
mov esi, eax
xor eax, eax
push ecx
mov dword [esp + 8], eax
mov word [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
call sub.WS2_32.dll_inet_addr
mov edx, dword [esp + 0x20]
mov dword [esp + 8], eax
push edx
call sub.WS2_32.dll_htons
mov word [esp + 6], ax
lea eax, [esp + 4]
push 0x10
push eax
push esi
call sub.WS2_32.dll_connect
test eax, eax
jne 0x1003610f
mov eax, esi
pop esi
add esp, 0x10
ret
push esi
call sub.WS2_32.dll_closesocket
xor eax, eax
pop esi
add esp, 0x10
ret
Function at 0x10036270
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x1ac
lea eax, [esp + 0x1c]
push ebx
push esi
push edi
push eax
push 1
call sub.WS2_32.dll_WSAStartup
test eax, eax
jne 0x10036393
mov ebx, dword [esp + 0x1c0]
test ebx, ebx
jl 0x10036393
cmp ebx, 0xffff
jg 0x10036393
mov edi, dword [esp + 0x1c4]
push edi
call fcn.10037400
add esp, 4
cmp eax, 1
jne 0x100362e0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x14]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x100362f6
lea ecx, [esp + 0x14]
push ecx
push edi
call fcn.100375f0
add esp, 8
test eax, eax
je 0x10036393
mov esi, dword [esp + 0x1bc]
xor edx, edx
lea ecx, [esp + 0x14]
push ebx
lea eax, [esi + 0x34]
push ecx
push esi
mov dword [eax], edx
mov byte [eax + 4], dl
call fcn.100360b0
add esp, 0xc
mov dword [esi + 0xc], eax
test eax, eax
je 0x10036393
push eax
call fcn.100365f0
push esi
lea edx, [esp + 0x18]
push 0x10036120
push edx
mov dword [esi + 0x10], 0
call fcn.10037640
mov eax, dword [esp + 0x20]
add esp, 0x10
mov dword [esi + 0x14], eax
mov eax, dword [esi + 4]
test eax, eax
jne 0x1003637c
push esi
lea ecx, [esp + 0x10]
push 0x10036190
push ecx
call fcn.10037640
mov edx, dword [esp + 0x18]
push esi
lea eax, [esp + 0x1c]
push 0x10036200
push eax
mov dword [esi + 0x18], edx
call fcn.10037640
mov ecx, dword [esp + 0x24]
add esp, 0x18
mov dword [esi + 0x1c], ecx
call fcn.10035fe0
mov dword [esi + 8], eax
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x1ac
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x1ac
ret

Function at 0x100365f0
Capabilities:
Set socket configuration

Disassembly:
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp]
push eax
push 0x8004667e
push ecx
mov dword [esp + 0xc], 1
call sub.WS2_32.dll_ioctlsocket
xor edx, edx
test eax, eax
setge dl
mov eax, edx
pop ecx
ret