joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100bbfb0
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x140
push ebx
mov ebx, dword [esp + 0x154]
push ebp
push esi
mov esi, dword [ebx]
push edi
mov edi, dword [esp + 0x154]
xor ebp, ebp
test edi, edi
je 0x100bc02f
push edi
call fcn.100c13a0
add esp, 4
test eax, eax
jbe 0x100bc02f
test esi, esi
je 0x100bbfed
cmp esi, 0xffffffff
je 0x100bbfed
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
mov dword [ebx], esi
je 0x100bc071
mov eax, dword [esp + 0x15c]
test eax, eax
je 0x100bc01b
mov ecx, dword [esp + 0x10]
and ecx, 0x10
cmp cl, 0x10
je 0x100bc02f
jmp 0x100bc02a
mov edx, dword [esp + 0x158]
mov eax, dword [esp + 0x10]
test edx, eax
je 0x100bc02f
mov ebp, 1
test esi, esi
je 0x100bc071
cmp esi, 0xffffffff
je 0x100bc071
test ebp, ebp
jne 0x100bc0a8
mov eax, dword [esp + 0x15c]
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
lea eax, [esp + 0x10]
push eax
push esi
je 0x100bc07e
call edi
test eax, eax
je 0x100bc071
mov ecx, dword [esp + 0x10]
and ecx, 0x10
cmp cl, 0x10
jne 0x100bc0a8
lea edx, [esp + 0x10]
push edx
push esi
call edi
test eax, eax
jne 0x100bc059
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x140
ret
call edi
test eax, eax
je 0x100bc071
mov ebx, dword [esp + 0x158]
test dword [esp + 0x10], ebx
jne 0x100bc0a8
lea ecx, [esp + 0x10]
push ecx
push esi
call edi
test eax, eax
jne 0x100bc08b
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x140
ret
lea edx, [esp + 0x3c]
push edx
call fcn.100c13a0
inc eax
push eax
call fcn.100b95d0
mov edx, eax
lea edi, [esp + 0x44]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x140
ret
Function at 0x100bebd0
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x1c
push ebx
push esi
push edi
lea ecx, [esp + 0x14]
call fcn.100c2130
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 0x100cecd0
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test eax, eax
je 0x100bec81
mov edx, dword [esp + 0x10]
mov ecx, 1
cmp edx, ecx
mov dword [esp + 0xc], ecx
jle 0x100bec81
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea ebx, [eax + 4]
mov ecx, dword [ebx]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ecx
push 0
push 0x3a8
call ebp
mov esi, eax
test esi, esi
jle 0x100bec6c
lea edx, [esi + 1]
push edx
call fcn.100b95d0
mov edi, eax
add esp, 4
test edi, edi
je 0x100bec62
mov eax, dword [ebx]
push 0
push 0
push esi
push edi
push 0xffffffffffffffff
push eax
push 0
push 0x3a8
call ebp
mov byte [eax + edi], 0
push edi
lea ecx, [esp + 0x1c]
call fcn.100c23c0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
inc eax
add ebx, 4
cmp eax, ecx
mov dword [esp + 0x10], eax
jl 0x100bec1c
pop ebp
mov ebx, dword [esp + 0x30]
mov eax, dword [ebx]
test eax, eax
je 0x100bec94
push eax
call fcn.100c2bc0
add esp, 4
mov edi, dword [esp + 0x24]
shr edi, 2
shl edi, 2
lea ecx, [edi + 8]
push ecx
call fcn.100b95d0
mov dword [eax], 1
mov edx, dword [esp + 0x28]
shr edx, 2
mov dword [eax + 4], edx
mov esi, dword [esp + 0x28]
mov ecx, dword [esp + 0x20]
add esp, 4
neg esi
sbb esi, esi
and esi, ecx
mov ecx, edi
mov edx, ecx
lea edi, [eax + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
mov dword [ebx], eax
mov dword [esp + 0x14], 0x100cecb8
call fcn.100c2330
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
Function at 0x100bef20
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
push edi
push eax
call fcn.100c2030
mov edi, dword [esp + 0x38]
xor ebp, ebp
push edi
mov ebx, eax
mov dword [esp + 0x18], ebp
call fcn.100c13a0
add esp, 8
test ebx, ebx
je 0x100bf062
test eax, eax
je 0x100bf062
inc eax
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebp, eax
or ecx, 0xffffffff
xor eax, eax
push 0x5c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebp
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call sub.MSVCRT.dll_strrchr
mov edi, eax
add esp, 0xc
test edi, edi
je 0x100bef91
mov byte [edi], 0
inc edi
lea eax, [esp + 0x1c]
push eax
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x100bf04f
push 0x400
mov dword [esp + 0x18], 0x400
mov dword [esp + 0x1c], 1
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
mov esi, eax
mov eax, dword [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push esi
push edx
push 0
push edi
push eax
call ebx
test eax, eax
je 0x100bf019
cmp eax, 0xea
jne 0x100bf03b
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov ecx, dword [esp + 0x18]
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ecx, dword [esp + 0x24]
add esp, 8
lea edx, [esp + 0x14]
mov esi, eax
push edx
lea eax, [esp + 0x1c]
push esi
push eax
push 0
push edi
push ecx
call ebx
test eax, eax
jne 0x100befe4
mov eax, dword [esp + 0x18]
cmp eax, 1
je 0x100bf027
cmp eax, 2
jne 0x100bf03b
push esi
call fcn.100c13a0
push eax
push esi
call fcn.100c20f0
add esp, 0xc
mov dword [esp + 0x10], eax
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov edx, dword [esp + 0x20]
add esp, 4
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov eax, dword [esp + 0x14]
add esp, 4
test eax, eax
jne 0x100bf08a
mov ebp, eax
mov eax, dword [esp + 0x48]
test eax, eax
je 0x100bf096
mov esi, dword [esp + 0x40]
test esi, esi
je 0x100bf096
push esi
call fcn.100c13a0
push eax
push esi
call fcn.100c20f0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x100bf150
Capabilities:
Resolve dns

Disassembly:
mov eax, dword [esp + 4]
push eax
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x100bf166
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
ret
or eax, 0xffffffff
ret
Function at 0x100bf170
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push esi
push eax
push 0x202
xor esi, esi
call sub.WS2_32.dll_WSAStartup
test eax, eax
jne 0x100bf1c0
mov ecx, dword [esp + 0x19c]
push ecx
call fcn.100bf150
add esp, 4
cmp eax, 0xffffffff
je 0x100bf1bb
push eax
call sub.WS2_32.dll_inet_ntoa
mov esi, eax
push esi
call fcn.100c13a0
push eax
push esi
call fcn.100c20f0
add esp, 0xc
mov esi, eax
call sub.WS2_32.dll_WSACleanup
mov eax, esi
pop esi
add esp, 0x190
ret

Function at 0x100bf1d0
Capabilities:
Get hostname
Initialize winsock library

Disassembly:
sub esp, 0x294
lea eax, [esp + 0x104]
push esi
push eax
push 0x202
xor esi, esi
call sub.WS2_32.dll_WSAStartup
test eax, eax
jne 0x100bf221
lea ecx, [esp + 4]
push 0x104
push ecx
call sub.WS2_32.dll_gethostname
test eax, eax
jne 0x100bf21c
lea edx, [esp + 4]
push edx
call fcn.100c13a0
push eax
lea eax, [esp + 0xc]
push eax
call fcn.100c20f0
add esp, 0xc
mov esi, eax
call sub.WS2_32.dll_WSACleanup
mov eax, esi
pop esi
add esp, 0x294
ret

Function at 0x100bf450
Capabilities:
Get common file path
Get disk size

Disassembly:
mov eax, dword [esp + 0x10]
sub esp, 0x114
test eax, eax
push esi
jne 0x100bf475
lea eax, [esp + 0x14]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x100bf4de
jmp 0x100bf494
mov esi, dword [esp + 0x120]
push esi
call fcn.100c13a0
add esp, 4
test eax, eax
je 0x100bf4de
mov cl, byte [esi]
mov byte [esp + 0x15], 0x3a
mov byte [esp + 0x14], cl
lea edx, [esp + 8]
lea eax, [esp + 0x10]
push edx
lea ecx, [esp + 8]
push eax
lea edx, [esp + 0x14]
push ecx
lea eax, [esp + 0x20]
push edx
push eax
mov byte [esp + 0x2a], 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x100bf4de
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 8]
imul edx, dword [esp + 4]
push 0x400
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_MulDiv]
pop esi
add esp, 0x114
ret
or eax, 0xffffffff
pop esi
add esp, 0x114
ret

Function at 0x100bf6b0
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x400
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x40]
mov ecx, dword [esp + 0x28]
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x30]
push ebx
push 0x400
push esi
push ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, 0x3ff
jl 0x100bf71a
push esi
lea edi, [eax + 0x400]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edx, dword [esp + 0x38]
add esp, 8
mov esi, eax
mov eax, dword [esp + 0x24]
push ebx
push edi
push esi
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
dec edi
cmp eax, edi
jge 0x100bf6ea
push esi
xor edi, edi
call fcn.100c13a0
add esp, 4
test eax, eax
je 0x100bf735
push eax
push esi
call fcn.100c20f0
add esp, 8
mov edi, eax
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x100bf940
Capabilities:
Get file size

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x100bf94e
or eax, 0xffffffff
pop esi
ret
push esi
call fcn.100c27f0
add esp, 4
test eax, eax
jne 0x100bf960
or eax, 0xffffffff
pop esi
ret
mov ecx, dword [esi]
or eax, 0xffffffff
cmp ecx, 1
je 0x100bf97e
cmp ecx, 3
je 0x100bf97e
cmp ecx, 2
jne 0x100bf98d
mov ecx, dword [esi + 4]
call fcn.100c2e10
pop esi
ret
mov esi, dword [esi + 4]
lea eax, [esp + 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
pop esi
ret

Function at 0x100bf990
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x10
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
jne 0x100bf9a6
mov eax, 1
pop edi
add esp, 0x10
ret
push edi
call fcn.100c27f0
add esp, 4
test eax, eax
jne 0x100bf9bd
mov eax, 1
pop edi
add esp, 0x10
ret
mov eax, dword [edi]
push ebx
push ebp
mov ebp, 1
cmp eax, ebp
push esi
mov dword [esp + 0x10], ebp
je 0x100bfa61
cmp eax, 3
je 0x100bfa61
cmp eax, 2
jne 0x100bfb08
mov esi, dword [edi + 4]
mov ecx, esi
call fcn.100c2e10
mov ebx, eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
mov edi, eax
cmp edi, ebx
jae 0x100bfb08
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x10], 0
test eax, eax
je 0x100bfb08
mov eax, dword [esp + 0x34]
test eax, eax
je 0x100bfb08
mov edx, dword [esi]
lea eax, [esp + 0x28]
push ebp
push eax
mov ecx, esi
call dword [edx + 0x20]
mov edx, dword [esi]
push 0
push edi
mov ecx, esi
mov ebx, eax
call dword [edx + 0x18]
test ebx, ebx
je 0x100bfb08
mov al, byte [esp + 0x28]
test al, al
je 0x100bfa53
cmp al, 0x1a
jne 0x100bfb08
mov dword [esp + 0x10], ebp
mov eax, ebp
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x10
ret
mov esi, dword [edi + 4]
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push esi
mov dword [esp + 0x24], eax
call ebp
mov ebx, eax
cmp ebx, 0xffffffff
je 0x100bfb08
cmp ebx, dword [esp + 0x14]
jae 0x100bfb08
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x10], 0
test eax, eax
je 0x100bfb08
mov eax, dword [esp + 0x34]
test eax, eax
je 0x100bfb08
lea ecx, [esp + 0x1c]
push 0
push ecx
lea edx, [esp + 0x30]
push 1
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
push 0
push ebx
push esi
mov dword [esp + 0x24], eax
call ebp
cmp dword [edi], 3
jne 0x100bfaec
mov ecx, dword [edi + 0x130]
lea eax, [edi + 0xc]
push eax
add edi, 0x2c
push ecx
push edi
lea edx, [esp + 0x34]
push 1
push edx
push ebx
call fcn.100c1bc0
add esp, 0x18
mov eax, dword [esp + 0x14]
test eax, eax
je 0x100bfb08
mov al, byte [esp + 0x28]
test al, al
je 0x100bfb00
cmp al, 0x1a
jne 0x100bfb08
mov dword [esp + 0x10], 1
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x10
ret
Function at 0x100bfb20
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
jne 0x100bfb35
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
push edi
call fcn.100c27f0
add esp, 4
test eax, eax
jne 0x100bfb48
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov esi, dword [esp + 0x28]
test esi, esi
jg 0x100bfb58
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov eax, dword [edi]
xor ebx, ebx
cmp eax, 1
jne 0x100bfbb1
mov edi, dword [edi + 4]
push esi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov ebp, eax
lea eax, [esp + 0x1c]
push ebx
push eax
push esi
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100bfb93
push ebp
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov ecx, dword [esp + 0x1c]
push ecx
push ebp
call fcn.100c20b0
push ebp
mov ebx, eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
cmp eax, 2
jne 0x100bfbfc
mov edi, dword [edi + 4]
lea edx, [esi + 8]
push edx
call fcn.100b95d0
mov ebx, eax
add esp, 4
lea ecx, [ebx + 8]
mov dword [ebx], 1
mov dword [ebx + 4], esi
mov eax, dword [edi]
push esi
push ecx
mov ecx, edi
call dword [eax + 0x20]
test eax, eax
jne 0x100bfbf1
push ebx
call fcn.100b9690
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
mov dword [ebx + 4], eax
pop esi
mov eax, ebx
pop ebp
pop ebx
pop ecx
ret
cmp eax, 3
jne 0x100bfc78
mov ebx, dword [edi + 4]
push esi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov ebp, eax
push 1
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea edx, [esp + 0x1c]
push 0
push edx
push esi
push ebp
push ebx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100bfc45
push ebp
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov edx, dword [edi + 0x130]
mov eax, dword [esp + 0x1c]
lea ecx, [edi + 0xc]
add edi, 0x2c
push ecx
push edx
push edi
mov esi, eax
push eax
mov eax, dword [esp + 0x20]
push ebp
push eax
call fcn.100c1bc0
push esi
push ebp
call fcn.100c20b0
push ebp
mov ebx, eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 0x24
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
pop ecx
ret
Function at 0x100bfe90
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebp
push esi
push edi
push eax
call fcn.100c2030
mov edi, dword [esp + 0x28]
mov ebp, eax
push edi
xor esi, esi
call fcn.100c13a0
add esp, 8
test ebp, ebp
je 0x100bff59
test eax, eax
je 0x100bff59
inc eax
push ebx
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
or ecx, 0xffffffff
xor eax, eax
push 0x5c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call sub.MSVCRT.dll_strrchr
mov esi, eax
add esp, 0xc
test esi, esi
je 0x100bfefb
mov byte [esi], 0
inc esi
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100bff35
mov ecx, dword [esp + 0x10]
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [esp + 0x10]
mov esi, eax
neg esi
sbb esi, esi
push edx
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x100bff48
mov eax, dword [esp + 0x28]
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
neg esi
sbb esi, esi
inc esi
push ebx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, esi
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret
mov eax, esi
pop edi
pop esi
pop ebp
pop ecx
ret
Function at 0x100c01b0
Capabilities:
Delete directory

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x100c01bd
xor eax, eax
pop esi
ret
push esi
call fcn.100c13a0
add esp, 4
test eax, eax
jne 0x100c01cc
pop esi
ret
cmp eax, 1
jne 0x100c01da
cmp byte [esi], 0x5c
jne 0x100c01da
xor eax, eax
pop esi
ret
push esi
call fcn.100bff60
add esp, 4
test eax, eax
je 0x100c01ee
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop esi
ret

Function at 0x100c0220
Capabilities:
Create directory

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x14]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
lea eax, [esp]
mov dword [esp], 0xc
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add esp, 0xc
ret

Function at 0x100c0270
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x1c]
push ebp
push esi
push edi
push eax
call fcn.100c2030
mov edi, dword [esp + 0x38]
xor esi, esi
push edi
mov ebp, eax
mov dword [esp + 0x20], esi
mov dword [esp + 0x14], esi
call fcn.100c13a0
add esp, 8
cmp ebp, esi
je 0x100c034f
cmp eax, esi
je 0x100c034f
inc eax
push ebx
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
or ecx, 0xffffffff
xor eax, eax
push 0x5c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call sub.MSVCRT.dll_strrchr
mov esi, eax
add esp, 0xc
test esi, esi
je 0x100c02e5
mov byte [esi], 0
inc esi
lea eax, [esp + 0x18]
push eax
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x100c033d
lea ecx, [esp + 0x20]
lea edx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x18]
push edx
push eax
push 0
mov edi, 4
push esi
push ecx
mov dword [esp + 0x38], edi
mov dword [esp + 0x2c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100c0332
cmp dword [esp + 0x14], edi
jne 0x100c0332
mov dword [esp + 0x1c], 1
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov eax, dword [esp + 0x20]
add esp, 4
test eax, eax
pop ebx
jne 0x100c035b
mov eax, dword [esp + 0x48]
test eax, eax
mov eax, dword [esp + 0x40]
jne 0x100c035f
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
add esp, 0x14
ret

Function at 0x100c0370
Capabilities:
Query environment variable

Disassembly:
push ebp
push esi
push edi
push 0x104
call fcn.100b9580
mov ebp, dword [esp + 0x18]
add esp, 4
mov edi, eax
push 0x104
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
cmp esi, 0x104
jbe 0x100c03c7
push ebx
push edi
call fcn.100b9690
push esi
mov ebx, esi
call fcn.100b9580
add esp, 8
mov edi, eax
push esi
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
cmp esi, ebx
ja 0x100c039e
mov eax, edi
pop ebx
pop edi
pop esi
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x100c1480
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, edx
push esi
push edi
mov esi, ebp
xor edi, edi
and esi, 3
mov eax, ecx
jle 0x100c14a1
mov dl, byte [eax]
inc eax
cmp dl, bl
je 0x100c14fb
inc edi
cmp edi, esi
jl 0x100c1495
mov edi, ebx
and edi, 0xff
mov esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
lea edi, [ecx + ebp]
cmp eax, edi
jae 0x100c1530
mov edx, dword [eax]
xor edx, esi
lea ebp, [edx - 0x1010101]
not edx
and ebp, edx
test ebp, 0x80808080
je 0x100c14ea
cmp byte [eax], bl
je 0x100c1505
cmp byte [eax + 1], bl
je 0x100c150e
cmp byte [eax + 2], bl
je 0x100c1518
cmp byte [eax + 3], bl
je 0x100c1524
add eax, 4
cmp eax, edi
jb 0x100c14c1
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
dec eax
pop ebx
ret 4
pop edi
pop esi
pop ebp
sub eax, ecx
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
inc eax
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 2
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 3
pop ebx
ret 4
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4

Function at 0x100c1b30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x100c1b86
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x100c1b6d
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x100c3be0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push eax
push 1
call sub.WS2_32.dll_WSAStartup
add esp, 0x190
ret

Function at 0x100c3e00
Capabilities:
Create tcp socket

Disassembly:
sub esp, 0x10
push esi
push edi
call fcn.100c3c20
mov edi, eax
call fcn.100c49b0
push 6
push 1
push 2
mov dword [edi + 8], eax
call sub.WS2_32.dll_socket
mov ecx, dword [esp + 0x1c]
mov esi, eax
xor eax, eax
mov dword [edi], esi
mov dword [esp + 8], eax
push ecx
mov dword [esp + 0x10], eax
mov word [esp + 0xc], 2
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], eax
call sub.WS2_32.dll_htons
lea edx, [esp + 8]
push 0x10
push edx
push esi
mov word [esp + 0x16], ax
call sub.WS2_32.dll_bind
test eax, eax
jge 0x100c3e6e
push esi
call sub.WS2_32.dll_closesocket
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret
push 1
push esi
call sub.WS2_32.dll_listen
test eax, eax
jge 0x100c3e88
push esi
call sub.WS2_32.dll_closesocket
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret
mov eax, edi
pop edi
pop esi
add esp, 0x10
ret