joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402d9e
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x41a4c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
call fcn.0040acf0
cmp eax, 2
pop ecx
je 0x402dc9
push 0x497
push str.sfxhead.c
call fcn.0040281f
push esi
lea eax, [ebp - 0xc]
push 8
push eax
call fcn.0040b275
push eax
call fcn.00401065
add esp, 0x10
test al, al
jne 0x402de9
push 0x498
jmp 0x402dbf
push 0x41629c
lea eax, [ebp - 0xc]
push 8
push eax
call fcn.0040b275
push eax
call fcn.00401065
add esp, 0x10
test al, al
jne 0x402e0d
push 0x499
jmp 0x402dbf
lea eax, [ebp - 0xc]
push eax
call fcn.0040acf0
cmp eax, 8
pop ecx
jae 0x402eab
push ebx
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x20
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x402e4d
or ax, 0xffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0040b060
leave
ret
push 7
lea eax, [ebp - 0x2c]
push str.PKBACK
push eax
call fcn.004013b3
add esp, 0xc
test eax, eax
jne 0x402e3c
mov al, byte [ebp - 0x2c]
cmp al, bl
lea ecx, [ebp - 0x2c]
je 0x402e3c
cmp al, 0x2e
je 0x402e7d
cmp al, 0x20
je 0x402e7d
inc ecx
mov al, byte [ecx]
cmp al, bl
jne 0x402e6e
cmp byte [ecx], bl
je 0x402e3c
mov al, byte [ecx]
cmp al, 0x30
jb 0x402e8b
cmp al, 0x39
jbe 0x402e8e
inc ecx
jmp 0x402e81
xor eax, eax
jmp 0x402ea3
movzx edx, dl
imul eax, eax, 0xa
sub edx, 0x30
cmp edx, 9
ja 0x402e40
add eax, edx
inc ecx
mov dl, byte [ecx]
cmp dl, bl
jne 0x402e92
jmp 0x402e40
push 0x49a
push dword [0x41a01c]
jmp 0x402dc4
Function at 0x404486
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x5a4]
sub esp, 0x624
mov eax, dword [0x41a4c0]
xor eax, ebp
mov dword [ebp + 0x5a0], eax
mov eax, dword [ebp + 0x5ac]
push ebx
mov ebx, dword [ebp + 0x5b4]
push esi
push edi
mov edi, dword [ebp + 0x5b0]
push eax
mov dword [ebp - 0x2c], eax
mov esi, 0x2e3
lea eax, [ebp + 0x2bc]
push esi
push eax
call fcn.0040b275
push eax
call fcn.00401065
add esp, 0x10
test al, al
jne 0x4044e8
push 0xe3d
push str.sfxhead.c
call fcn.0040281f
cmp byte [edi], 0
je 0x404535
push 0x4163bc
lea eax, [ebp + 0x2bc]
push esi
push eax
call fcn.0040b135
push eax
call fcn.00401065
add esp, 0x10
test al, al
jne 0x404513
push 0xe40
jmp 0x4044de
push edi
lea eax, [ebp + 0x2bc]
push esi
push eax
call fcn.0040b135
push eax
call fcn.00401065
add esp, 0x10
test al, al
jne 0x404535
push 0xe41
jmp 0x4044de
xor edi, edi
cmp ebx, 0xffffffff
jne 0x404586
push 0x10
lea eax, [ebp - 0x80]
push edi
push eax
call fcn.004013de
push 0x44
lea eax, [ebp - 0x70]
push edi
push eax
call fcn.004013de
add esp, 0x18
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x70]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp + 0x2bc]
push eax
push edi
mov dword [ebp - 0x70], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x404586
mov eax, dword [ebp - 0x80]
jmp 0x40469b
mov eax, dword [0x41a064]
test eax, 0x10000
je 0x4045eb
test eax, 0x20000
je 0x4045eb
push 0x3c
pop edi
push edi
lea eax, [ebp - 0x68]
push 0
push eax
call fcn.004013de
mov eax, dword [0x41cb70]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x58], eax
add esp, 0xc
lea eax, [ebp - 0x68]
push eax
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x64], 0x640
mov dword [ebp - 0x5c], str.Install
mov dword [ebp - 0x4c], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov eax, dword [ebp - 0x48]
xor edi, edi
test ebx, ebx
je 0x404605
mov ecx, dword [ebp - 0x30]
mov dword [ebx], ecx
jmp 0x404605
lea eax, [ebp + 0x2bc]
push eax
call fcn.004021b1
cmp eax, edi
pop ecx
je 0x404657
cmp ebx, edi
je 0x404602
mov dword [ebx], eax
push 0x21
pop eax
cmp eax, 0x20
ja 0x40469b
push dword [ebp - 0x2c]
mov ecx, 0x400
push eax
call fcn.00402a7d
push eax
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.0040b259
add esp, 0x14
cmp eax, 0xffffffff
jne 0x404639
push 0xeaa
jmp 0x4044de
push edi
mov ecx, 0x7d0
call fcn.00402a7d
push eax
lea eax, [ebp - 0x28]
push eax
push dword [0x41cb70]
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x404699
push edi
push edi
lea eax, [ebp - 0x2c]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push edi
mov ecx, 0x7d0
call fcn.00402a7d
push eax
push dword [ebp - 0x2c]
push dword [0x41cb70]
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov ecx, dword [ebp + 0x5a0]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b060
add ebp, 0x5a4
leave
ret
Function at 0x4046b3
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, 0x7000
push esi
push 0
push dword [0x41b584]
call fcn.004013de
mov eax, dword [0x41b716]
add esp, 0xc
test eax, eax
jg 0x4046de
and dword [0x41cae4], 0
xor eax, eax
pop esi
ret
cmp eax, esi
ja 0x4046e4
mov esi, eax
push esi
push dword [0x41b584]
push dword [0x41a004]
call fcn.0040a659
add esp, 0xc
cmp dword [0x41cb10], 0
mov dword [0x41cae4], eax
je 0x404750
cmp eax, 0xffffffff
je 0x404750
cmp eax, esi
je 0x40475c
test eax, eax
jl 0x404750
mov ecx, dword [0x41a00c]
mov edx, dword [0x41cb14]
inc ecx
call fcn.00402ebb
mov eax, dword [0x41cae4]
test eax, eax
jne 0x404749
push esi
push dword [0x41b584]
push dword [0x41a004]
call fcn.0040a659
add esp, 0xc
mov dword [0x41cae4], eax
cmp eax, 0xffffffff
je 0x404750
mov esi, eax
cmp eax, esi
je 0x40475c
push 2
pop ecx
jmp fcn.00403eae
mov esi, dword [0x41b584]
mov ecx, dword [0x41a044]
mov dword [0x41cae0], esi
test byte [ecx + 0x28], 1
je 0x4047ae
mov byte [0x41cadf], 1
test word [ecx + 0x28], 0x1300
jne 0x4047ba
push edi
mov edi, eax
test edi, edi
je 0x4047a6
dec edi
call fcn.0040a2a5
xor byte [esi], al
movzx eax, byte [esi]
push eax
call fcn.0040a2bf
inc esi
test edi, edi
pop ecx
jne 0x40478a
mov eax, dword [0x41cae4]
mov byte [0x41cadf], 0
pop edi
mov ecx, eax
dec eax
mov dword [0x41cae4], eax
mov eax, ecx
pop esi
ret
push 0x100c
push dword [0x41a01c]
call fcn.0040281f
int3
Function at 0x4067a2
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
sub esp, 0x348
lea ebp, [esp - 4]
mov eax, dword [0x41a4c0]
xor eax, ebp
mov dword [ebp + 0x348], eax
push 0x20
mov eax, 0x415213
call fcn.0040bd83
mov esi, dword [ebp + 0x354]
push 0x103
lea eax, [ebp + 0x141]
push 0
push eax
mov byte [ebp + 0x140], 0
call fcn.004013de
add esp, 0xc
cmp dword [esi + 0x18], 0x10
lea edi, [esi + 4]
jb 0x4067f6
mov eax, dword [edi]
jmp 0x4067f8
mov eax, edi
mov ebx, dword [sym.imp.SHLWAPI.dll_PathCombineA]
push 0x41641c
push eax
lea eax, [ebp + 0x140]
push eax
call ebx
lea eax, [ebp]
push eax
lea eax, [ebp + 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x406907
push 0x103
lea eax, [ebp + 0x245]
push 0
push eax
mov byte [ebp + 0x244], 0
call fcn.004013de
add esp, 0xc
test byte [ebp], 0x10
je 0x4068c2
lea eax, [ebp + 0x2c]
push 0x416398
push eax
call fcn.0040be90
test eax, eax
pop ecx
pop ecx
je 0x4068e9
lea eax, [ebp + 0x2c]
push 0x416394
push eax
call fcn.0040be90
test eax, eax
pop ecx
pop ecx
je 0x4068e9
cmp dword [esi + 0x18], 0x10
jb 0x406883
mov eax, dword [edi]
jmp 0x406885
mov eax, edi
lea ecx, [ebp + 0x2c]
push ecx
push eax
lea eax, [ebp + 0x244]
push eax
call ebx
lea eax, [ebp + 0x244]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00406696
and dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
push eax
call fcn.004067a2
or dword [ebp - 4], 0xffffffff
pop ecx
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00404b84
jmp 0x4068e9
cmp dword [esi + 0x18], 0x10
jb 0x4068cc
mov eax, dword [edi]
jmp 0x4068ce
mov eax, edi
lea ecx, [ebp + 0x2c]
push ecx
push eax
lea eax, [ebp + 0x244]
push eax
call ebx
lea eax, [ebp + 0x244]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40682a
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [esi + 0x18], 0x10
jb 0x40690f
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
neg eax
sbb eax, eax
neg eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x348]
xor ecx, ebp
call fcn.0040b060
add ebp, 0x34c
leave
ret
Function at 0x40693f
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
lea ebp, [esp - 0xac]
sub esp, 0x12c
mov eax, dword [0x41a4c0]
xor eax, ebp
mov dword [ebp + 0xa8], eax
push ebx
push esi
mov esi, dword [ebp + 0xb4]
cmp dword [esi + 0x18], 0x10
push edi
lea edi, [esi + 4]
jb 0x406970
mov eax, dword [edi]
jmp 0x406972
mov eax, edi
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
push eax
call ebx
test eax, eax
je 0x4069f0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x80], eax
push dword [ebp - 0x80]
lea eax, [ebp + 0x88]
push 0x416420
push eax
call fcn.00402667
add esp, 0xc
cmp dword [esi + 0x18], 0x10
jb 0x4069a9
mov eax, dword [edi]
jmp 0x4069ab
mov eax, edi
lea ecx, [ebp + 0x88]
push ecx
push eax
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
lea eax, [ebp - 0x7c]
push eax
call ebx
test eax, eax
je 0x4069d6
inc dword [ebp - 0x80]
jmp 0x406988
push 0
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [ebp - 0x7c]
push eax
mov ecx, esi
call fcn.0040658d
xor eax, eax
inc eax
mov ecx, dword [ebp + 0xa8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b060
add ebp, 0xac
leave
ret

Function at 0x406a08
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x41a4c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
cmp eax, 0x103
jb 0x406a3c
xor eax, eax
jmp 0x406a7d
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push 0x208
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
test eax, eax
mov ecx, esi
lea eax, [ebp - 0x310]
jne 0x406a74
lea eax, [ebp - 0x108]
push eax
call fcn.0040658d
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040b060
leave
ret
Function at 0x40a2bf
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [0x426c18]
mov ecx, eax
xor ecx, dword [esp + 4]
shr eax, 8
mov edx, 0xff
and ecx, edx
xor eax, dword [ecx*4 + 0x41b728]
mov ecx, dword [0x426c20]
mov dword [0x426c18], eax
movzx eax, al
add eax, dword [0x426c1c]
imul eax, eax, 0x8088405
inc eax
mov dword [0x426c1c], eax
shr eax, 0x18
xor eax, ecx
and eax, edx
shr ecx, 8
xor ecx, dword [eax*4 + 0x41b728]
mov eax, dword [esp + 4]
mov dword [0x426c20], ecx
ret

Function at 0x40a34f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x41a4c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push dword [0x41cb0c]
mov esi, ecx
call fcn.0040a317
push 0xc
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.0040138e
add esp, 0x10
xor esi, esi
lea edx, [ebp + esi - 0x10]
call fcn.0040a2a5
xor byte [edx], al
movzx eax, byte [edx]
push eax
call fcn.0040a2bf
inc esi
cmp esi, 0xc
pop ecx
jl 0x40a37e
cmp dword [0x41cb08], 0
movzx ax, byte [ebp - 5]
movzx eax, ax
pop esi
je 0x40a3bd
movzx cx, byte [0x41b70f]
cmp ax, cx
je 0x40a3c7
or eax, 0xffffffff
jmp 0x40a3c9
movzx cx, byte [0x41b715]
jmp 0x40a3b3
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040b060
leave
ret

Function at 0x40b060
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41a4c0]
jne 0x40b06a
repz ret
jmp fcn.0040ce8d
Function at 0x414247
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0040d989
xor ebx, ebx
cmp dword [0x4276fc], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x41431c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x414287
xor eax, eax
jmp 0x4143e0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x417e54
push edi
call esi
cmp eax, ebx
je 0x414280
push eax
call fcn.0040d926
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4276fc], eax
call esi
push eax
call fcn.0040d926
mov dword [esp], 0x417e30
push edi
mov dword [0x427700], eax
call esi
push eax
call fcn.0040d926
mov dword [0x427704], eax
lea eax, [ebp - 8]
push eax
call fcn.0040ff80
test eax, eax
pop ecx
pop ecx
je 0x4142ea
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040b64f
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x41431c
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0040d926
cmp eax, ebx
pop ecx
mov dword [0x42770c], eax
je 0x41431c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040d926
pop ecx
mov dword [0x427708], eax
mov eax, dword [0x427708]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x414395
cmp dword [0x42770c], esi
je 0x414395
push eax
call fcn.0040d992
pop ecx
call eax
cmp eax, ebx
je 0x414362
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x42770c]
call fcn.0040d992
pop ecx
call eax
test eax, eax
je 0x414362
test byte [ebp - 0x18], 1
jne 0x414395
lea eax, [ebp - 0xc]
push eax
call fcn.0040ffb7
test eax, eax
pop ecx
je 0x41437d
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040b64f
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x41438c
or dword [ebp + 0x10], 0x200000
jmp 0x4143c6
or dword [ebp + 0x10], 0x40000
jmp 0x4143c6
mov eax, dword [0x427700]
cmp eax, esi
je 0x4143c6
push eax
call fcn.0040d992
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4143c6
mov eax, dword [0x427704]
cmp eax, esi
je 0x4143c6
push dword [ebp - 4]
push eax
call fcn.0040d992
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x4276fc]
call fcn.0040d992
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x422377
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004195c7
and dword [ebp - 4], 0
cmp dword [0x42efe8], 0
mov ebx, eax
jne 0x422428
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4224d9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4224d9
push eax
call fcn.00419555
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x42efe8], eax
call esi
push eax
call fcn.00419555
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x42efec], eax
call esi
push eax
call fcn.00419555
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42eff0], eax
call esi
push eax
call fcn.00419555
pop ecx
mov dword [0x42eff8], eax
test eax, eax
je 0x422428
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00419555
pop ecx
mov dword [0x42eff4], eax
mov eax, dword [0x42eff4]
cmp eax, ebx
je 0x422480
cmp dword [0x42eff8], ebx
je 0x422480
push eax
call fcn.004195d0
push dword [0x42eff8]
mov esi, eax
call fcn.004195d0
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x422480
test edi, edi
je 0x422480
call esi
test eax, eax
je 0x422477
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x422477
test byte [ebp - 0xc], 1
jne 0x422480
or dword [ebp + 0x10], 0x200000
jmp 0x4224b9
mov eax, dword [0x42efec]
cmp eax, ebx
je 0x4224b9
push eax
call fcn.004195d0
pop ecx
test eax, eax
je 0x4224b9
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4224b9
mov eax, dword [0x42eff0]
cmp eax, ebx
je 0x4224b9
push eax
call fcn.004195d0
pop ecx
test eax, eax
je 0x4224b9
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42efe8]
call fcn.004195d0
pop ecx
test eax, eax
je 0x4224d9
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4224db
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10f3fe24
Capabilities:
Encode data using xor

Disassembly:
jmp 0x10f3fe2e
pushal
call 0x10f3fe34
pop ebp
sub ebp, 0x10
sub ebp, 0xf3fe24
mov al, byte [esp + 0x28]
cmp al, 1
je 0x10f3fe58
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x10f3fe61
mov eax, 0xf3fe24
add eax, ebp
add eax, 0x63
mov ecx, 0x5ab
mov edx, 0xed1d3cd4
xor byte [eax], dl
inc eax
dec ecx
jne 0x10f3fe78
jmp 0x10f3fe8b
pop edi
sbb dword [edi + 0x5d], ebx
call 0x66c8d368
adc eax, 0xd4d4d42c
xlatb
sbb dword [edx + edx*8 - 0x2c], ebp
aam 0xd4
outsb dx, byte [esi]
cld
aam 0xd4
aam 0x23
xlatb
sbb al, 0x5f
push ebp
fcom st(4)
aam 0xd4
xlatb
adc dword [esp + eax*4 - 0x6580b44], eax
aam 0xbc
rcr byte [edi + 0x12], 1
aam 0xd5
clc
invalid
Function at 0x1000273c
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0x3a980
mov dword [0x1003ffc8], eax
call fcn.1000dec2
xor ecx, ecx
inc ecx
call fcn.1000c2dd
xor ecx, ecx
and al, 8
cmp al, 8
setne cl
push 0x32
dec ecx
and ecx, 0x803000
add ecx, 0x84400200
mov dword [0x1003cc58], ecx
pop ecx
call fcn.1000c2dd
cmp ax, 1
jne 0x1000278d
or dword [0x1003cc58], 0x80000
push esi
push edi
push 0x23
pop ecx
call fcn.1000c2dd
movzx eax, ax
xor edi, edi
sub eax, edi
je 0x100027b2
dec eax
je 0x1000286a
dec eax
je 0x10002861
dec eax
dec eax
jne 0x100027cd
push edi
push edi
push 0x20
pop ecx
call fcn.1000c2f3
push eax
push 3
push dword [ebp + 0x10]
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [0x1003ffb4], eax
mov esi, dword [sym.imp.WININET.dll_InternetSetOptionA]
push 4
lea eax, [ebp - 4]
push eax
push 5
push dword [0x1003ffb4]
call esi
push 4
lea eax, [ebp - 4]
push eax
push 6
push dword [0x1003ffb4]
call esi
push 0x1003ffc4
push edi
push 3
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [0x1003ffb4]
call dword [sym.imp.WININET.dll_InternetConnectA]
mov edi, eax
push 0x23
pop ecx
mov dword [0x1003ffb8], edi
call fcn.1000c2dd
cmp ax, 4
jne 0x10002858
push 0x21
pop ecx
call fcn.1000c2fe
push eax
push 0x21
pop ecx
call fcn.1000c2f3
push eax
push 0x2b
push edi
call esi
push 0x22
pop ecx
call fcn.1000c2fe
push eax
push 0x22
pop ecx
call fcn.1000c2f3
push eax
push 0x2c
push dword [0x1003ffb8]
call esi
call fcn.1000dee3
pop edi
pop esi
leave
ret
push edi
push edi
push edi
push edi
jmp 0x100027bf
push edi
push edi
push edi
push 1
jmp 0x100027bf
Function at 0x10002e6e
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
push esi
xor esi, esi
inc esi
cmp dword [0x1003ffcc], esi
je 0x10002eab
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jge 0x10002ea5
call dword [sym.imp.WS2_32.dll_WSACleanup]
push esi
call fcn.10018ede
mov dword [0x1003ffcc], esi
cmp dword [ebp + 8], 0
je 0x10002f0d
cmp dword [0x1003ffd0], esi
je 0x10002f0d
push 0x14
pop ecx
call fcn.1000c2e8
push 0x13
pop ecx
mov dword [0x1003ffd4], eax
call fcn.1000c2e8
push 0x3d
pop ecx
mov dword [0x1003ffd8], eax
call fcn.1000c2f3
push 0x3e
pop ecx
mov dword [0x10043e3c], eax
call fcn.1000c2f3
push 0x3f
pop ecx
mov dword [0x10043e30], eax
call fcn.1000c2f3
push 0x42
pop ecx
mov dword [0x10043e34], eax
call fcn.1000c2f3
mov dword [0x10043e38], eax
mov dword [0x1003ffd0], esi
pop esi
leave
ret

Function at 0x10002fcb
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
cmp esi, 0x3ff
jg 0x10003004
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x400]
push eax
call fcn.10019030
add esp, 0xc
lea eax, [ebp - 0x400]
push eax
mov byte [ebp + esi - 0x400], 0
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
leave
ret

Function at 0x100032ec
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push esi
push edi
push 0x44
pop edi
push edi
xor esi, esi
lea eax, [ebp - 0x70]
push esi
push eax
call fcn.10020520
mov dword [ebp - 0x70], edi
xor eax, eax
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
push 0x100000
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], 0xc
mov dword [ebp - 0xc], 1
call dword [sym.imp.KERNEL32.dll_CreatePipe]
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
xor eax, eax
mov word [ebp - 0x40], ax
mov eax, dword [ebp - 4]
push esi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
push 0x10
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x70]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x44], 0x101
push dword [ebp + 8]
mov dword [ebp - 0x38], esi
call fcn.100094d8
add esp, 0x18
test eax, eax
je 0x100033ac
push 0x2710
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x34], eax
je 0x10003394
or eax, 0xffffffff
push eax
push dword [ebp - 8]
lea esi, [ebp - 0x24]
sub esp, 0x10
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.10006e6b
add esp, 0x18
pop edi
pop esi
leave
ret
Function at 0x100034af
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, 0x400
push esi
call fcn.100187ff
mov ebx, eax
pop ecx
test ebx, ebx
je 0x1000354d
push dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push dword [ebp + 8]
push eax
call fcn.10008237
add esp, 0xc
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.10008426
pop ecx
pop ecx
test eax, eax
jne 0x100034f7
push ebx
call fcn.10018722
jmp 0x1000354c
push dword [ebp + 0x10]
push ebx
call fcn.10019218
mov esi, eax
pop ecx
pop ecx
cmp esi, 0xffffffff
je 0x10003536
test esi, esi
je 0x10003536
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.100083c9
add esp, 4
push eax
push 1
lea eax, [ebp - 0x14]
call fcn.100083d4
push eax
call fcn.10019391
push esi
call fcn.1001948a
add esp, 0x14
jmp 0x100034ef
push ebx
call fcn.10018722
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 8
call fcn.1000266f
pop ecx
pop ecx
pop esi
pop ebx
leave
ret

Function at 0x10003551
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x800
push 0x7ff
lea eax, [ebp - 0x7ff]
push 0
push eax
mov byte [ebp - 0x800], 0
call fcn.10020520
add esp, 0xc
lea eax, [ebp - 0x800]
push eax
push 0x800
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
jbe 0x1000359f
push 0x13
push eax
lea eax, [ebp - 0x800]
push eax
call fcn.100012d0
add esp, 0xc
leave
ret

Function at 0x10003615
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov esi, eax
cmp esi, 0xffffffff
jne 0x10003633
or eax, 0xffffffff
jmp 0x10003682
push dword [ebp + 8]
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x1000362e
movsx ecx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
push ecx
push dword [eax]
lea eax, [ebp - 0xc]
push eax
call fcn.1001f330
add esp, 0xc
push 2
pop eax
push dword [ebp + 0xc]
mov word [ebp - 0x10], ax
call sub.WS2_32.dll_htons
mov word [ebp - 0xe], ax
push 0x10
lea eax, [ebp - 0x10]
push eax
push esi
call sub.WS2_32.dll_connect
test eax, eax
je 0x10003680
push esi
call sub.WS2_32.dll_closesocket
jmp 0x1000362e
mov eax, esi
pop esi
leave
ret