joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000e02b
Capabilities:
Create directory
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x840
mov eax, dword [0x100ba410]
xor eax, esp
mov dword [esp + 0x83c], eax
push ebx
push edi
xor ebx, ebx
lea eax, [esp + 0x41]
push 0x3ff
push ebx
push eax
mov byte [esp + 0x4c], bl
call fcn.10023400
add esp, 0xc
mov edx, str.FileExport
mov ecx, str.Config
push ebx
call fcn.1000a52a
pop ecx
test eax, eax
jne 0x1000e07c
xor eax, eax
jmp 0x1000e163
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [esp + 0x40]
push 0x400
push eax
push str._SystemRoot__system32LogFiles
call edi
lea ecx, [esp + 0x40]
call fcn.1000f3f1
cmp eax, 0xffffffff
je 0x1000e075
test eax, eax
jne 0x1000e0b5
push ebx
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x1000e075
push 0x400
lea eax, [esp + 0x44]
push eax
push str._SystemRoot__system32LogFilesSnare
call edi
lea ecx, [esp + 0x40]
call fcn.1000f3f1
cmp eax, 0xffffffff
je 0x1000e075
test eax, eax
jne 0x1000e0e8
push ebx
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x1000e075
lea eax, [esp + 0x10]
push eax
call fcn.10021d2a
pop ecx
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.100201c4
push dword [esp + 0x30]
mov eax, dword [esp + 0x38]
mov ebx, 0x400
inc eax
push eax
mov eax, dword [esp + 0x40]
add eax, 0x76c
push eax
push str._SystemRoot__system32LogFilesSnare_
push str._s_04d_02d_02d.log
push 0xffffffffffffffff
lea eax, [esp + 0x460]
push ebx
push eax
call fcn.1001f145
add esp, 0x28
lea eax, [esp + 0x40]
push ebx
push eax
lea eax, [esp + 0x448]
push eax
call edi
push 0x1009f758
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x14]
push eax
call fcn.1001f41f
mov eax, dword [esp + 0x18]
add esp, 0xc
mov ecx, dword [esp + 0x844]
pop edi
pop ebx
xor ecx, esp
call fcn.1001e010
mov esp, ebp
pop ebp
ret

Function at 0x1000e1b4
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, ecx
test esi, esi
jle 0x1000e23b
add edx, 2
movzx eax, byte [edx - 2]
shr eax, 2
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi], al
movzx ecx, byte [edx - 2]
movzx eax, byte [edx - 1]
and ecx, 3
shr eax, 4
shl ecx, 4
or ecx, eax
dec esi
mov al, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + 1], al
test esi, esi
jle 0x1000e212
movzx ecx, byte [edx - 1]
movzx eax, byte [edx]
and ecx, 0xf
shr eax, 6
shl ecx, 2
or ecx, eax
mov al, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
jmp 0x1000e214
mov al, 0x3d
dec esi
mov byte [edi + 2], al
test esi, esi
jle 0x1000e22a
movzx eax, byte [edx]
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
jmp 0x1000e22c
mov al, 0x3d
mov byte [edi + 3], al
dec esi
add edx, 3
add edi, 4
inc ebx
test esi, esi
jg 0x1000e1c8
mov byte [edi], 0
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x100100dc
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x81c
mov eax, dword [0x100ba410]
xor eax, esp
mov dword [esp + 0x818], eax
push ebx
push esi
push edi
mov edi, dword [0x100c4ce0]
xor eax, eax
push 0x7fe
mov word [esp + 0x24], ax
xor ebx, ebx
lea eax, [esp + 0x26]
mov esi, ecx
push ebx
push eax
call fcn.10023400
add esp, 0xc
mov dword [esp + 0x14], ebx
test esi, esi
jne 0x1001012c
xor eax, eax
jmp 0x10010282
push esi
push str.SYSTEMCurrentControlSetServicesEventLog_s
push 0xffffffffffffffff
lea eax, [esp + 0x2c]
push 0x400
push eax
call fcn.10020f63
add esp, 0x14
lea eax, [esp + 0x14]
push eax
push 0x2001b
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x2c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
je 0x100101d2
cmp dword [0x100c1c2c], 1
jl 0x1001017d
push esi
push str.Cannot_determine_if_log__S_exists___checking_Microsoft_Windows_subscriptions
call fcn.100144ba
pop ecx
pop ecx
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionWINEVTChannels_s
push 0xffffffffffffffff
lea eax, [esp + 0x2c]
push 0x400
push eax
call fcn.10020f63
add esp, 0x14
lea eax, [esp + 0x14]
push eax
push 0x2001b
push 0
lea eax, [esp + 0x2c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
je 0x100101d2
cmp dword [0x100c1c2c], 1
jl 0x10010125
push esi
push str.Cannot_determine_if_log__S_exists___openkey_failed
call fcn.100144ba
pop ecx
pop ecx
jmp 0x10010125
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 4
push eax
lea eax, [esp + 0x14]
xor ebx, ebx
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x18], ebx
push eax
push ebx
push str.Retention
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x10010219
cmp dword [0x100c1c2c], 1
jl 0x10010234
push esi
push str.Cannot_check_log_retention_settings___queryvalueex_failed_for_log__S
call fcn.100144ba
pop ecx
pop ecx
cmp dword [0x100c1c2c], 1
jl 0x10010234
push esi
push dword [esp + 0x14]
push str.Log_retention_settings_are_set_to__d_for_log__S
call fcn.100144ba
add esp, 0xc
test edi, edi
jne 0x10010275
cmp dword [esp + 0x10], ebx
je 0x10010275
push 4
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ebx
push eax
push 4
push ebx
push str.Retention
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x10010275
cmp dword [0x100c1c2c], 1
jl 0x10010275
push esi
push str.Cannot_set_log_retention_settings___regsetvalueex_failed_for_log__S
call fcn.100144ba
pop ecx
pop ecx
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
mov ecx, dword [esp + 0x824]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1001e010
mov esp, ebp
pop ebp
ret
Function at 0x10010a05
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2058
call fcn.10035de0
mov eax, dword [0x100ba410]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x2058]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0x20
lea eax, [ebp - 0x44]
mov edi, 0x800
push eax
push str.dd_MM_yyyy
lea eax, [ebp - 0x2058]
push eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetDateFormatA]
push 0x20
lea eax, [ebp - 0x24]
push eax
push str.HH:mm:ss
lea eax, [ebp - 0x2058]
push eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetTimeFormatA]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str.4.4.2
lea eax, [esi + 4]
mov edi, 0x2000
push eax
push str.__s__s___lu____s__s_:
push 0xffffffffffffffff
lea eax, [ebp - 0x2048]
push edi
push eax
call fcn.1001f145
lea ecx, [ebp - 0x2048]
add esp, 0x24
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10010aa6
lea eax, [ebp + 0x10]
sub ecx, edx
push eax
push dword [ebp + 0xc]
mov eax, edi
sub eax, ecx
push 0xffffffffffffffff
push eax
lea eax, [ebp - 0x2048]
add eax, ecx
push eax
call fcn.1001fed3
lea eax, [ebp - 0x2048]
push eax
push 0x1009f9e4
push 0xffffffffffffffff
push edi
push eax
call fcn.1001f145
add esp, 0x28
lea eax, [ebp - 0x2048]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [esi + 0x78], 0
je 0x10010b09
lea eax, [ebp - 0x2048]
push eax
push 0x1009e65c
call fcn.10020e18
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1001e010
mov esp, ebp
pop ebp
ret
Function at 0x1001121e
Capabilities:
List user accounts for group
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x100ba410]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x214], edx
push 0xfe
lea eax, [ebp - 0x207]
mov dword [ebp - 0x210], ebx
mov esi, ecx
mov dword [ebp - 0x218], ebx
push ebx
push eax
mov dword [ebp - 0x21c], esi
mov byte [ebp - 0x208], bl
call fcn.10023400
add esp, 0xc
mov byte [ebp - 0x108], bl
lea eax, [ebp - 0x107]
push 0xff
push ebx
push eax
call fcn.10023400
add esp, 0xc
inc ebx
cmp dword [0x100c1c2c], 5
jl 0x1001129b
push str.ShowThisLocalGroupMembers
call fcn.100144ba
pop ecx
xor ecx, ecx
lea eax, [ebp - 0x218]
push ecx
push eax
lea eax, [ebp - 0x210]
mov dword [ebp - 0x20c], ecx
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x20c]
push eax
push 3
push esi
push ecx
call dword [sym.imp.NETAPI32.dll_NetLocalGroupGetMembers]
cmp dword [0x100c1c2c], 5
mov esi, eax
mov edi, dword [ebp - 0x20c]
mov dword [ebp - 0x220], edi
jl 0x100112e7
push str.grabbed_list_of_users__sending_data
call fcn.100144ba
pop ecx
test esi, esi
je 0x10011324
cmp esi, 5
je 0x1001131d
cmp esi, 0xea
je 0x10011316
cmp esi, 0x560
je 0x1001130f
cmp esi, 0x92f
jne 0x1001132f
push str.NERR_InvalidComputer
jmp 0x10011329
push str.ERROR_NO_SUCH_ALIAS
jmp 0x10011329
push str.ERROR_MORE_DATA
jmp 0x10011329
push str.ERROR_ACCESS_DENIED
jmp 0x10011329
push str.NERR_Success
call fcn.100144ba
pop ecx
cmp dword [ebp - 0x210], 0
je 0x100113cf
mov edi, dword [ebp - 0x214]
xor ecx, ecx
lea eax, [ebp - 0x208]
push ecx
push ecx
push 0xfe
push eax
mov eax, dword [ebp - 0x20c]
push 0xffffffffffffffff
push dword [eax]
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x108]
test ebx, ebx
jne 0x1001137c
push 0x100a9814
jmp 0x10011383
xor ebx, ebx
push 0x1009e65c
push 0xffffffffffffffff
push 0x100
push eax
call fcn.1001f145
lea ecx, [ebp - 0x108]
add esp, 0x14
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001139c
push 0
sub ecx, edx
lea eax, [ebp - 0x108]
push ecx
push eax
push edi
call dword [sym.imp.WS2_32.dll_send]
add dword [ebp - 0x20c], 4
dec dword [ebp - 0x210]
jne 0x10011342
mov edi, dword [ebp - 0x220]
test edi, edi
je 0x100113da
push edi
call dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
cmp esi, 0xea
mov esi, dword [ebp - 0x21c]
je 0x1001129b
cmp dword [0x100c1c2c], 5
jl 0x10011400
push str.finished_ShowThisLocalGroupMembers
call fcn.100144ba
pop ecx
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001e010
mov esp, ebp
pop ebp
ret
Function at 0x10011da9
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebx
push 0x64
mov ebx, 0x100c1c50
push ebx
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
je 0x100067e6
push 0xffffffffffffffff
push str.localhost.unknown
push 0x64
push ebx
call fcn.10021c86
add esp, 0x10
pop ebx
ret
push esi
push ebx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
test esi, esi
je 0x10006894
cmp dword [esi + 4], 0
push edi
je 0x10006854
mov eax, dword [esi + 4]
mov edi, dword [eax]
test edi, edi
je 0x10006854
mov edx, edi
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x1000680d
sub edx, ecx
mov ecx, ebx
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000681b
sub ecx, ebx
mov ebx, 0x100c1c50
cmp edx, ecx
jbe 0x1000684e
push ecx
push edi
push ebx
call fcn.1001fbe0
add esp, 0xc
test eax, eax
jne 0x1000684e
mov eax, dword [esi + 4]
push 0xffffffffffffffff
push dword [eax]
push 0x64
push ebx
call fcn.10021c86
add esp, 0x10
add dword [esi + 4], 4
jne 0x100067ff
mov edx, dword [esi]
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x10006859
sub edx, ecx
mov ecx, ebx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10006867
sub ecx, edi
pop edi
cmp edx, ecx
jbe 0x10006894
push ecx
push dword [esi]
push ebx
call fcn.1001fbe0
add esp, 0xc
test eax, eax
jne 0x10006894
push 0xffffffffffffffff
push dword [esi]
push 0x64
push ebx
call fcn.10021c86
add esp, 0x10
pop esi
pop ebx
ret
push 0x64
push 0x100c1c50
mov edx, str.Clientname
mov byte [0x100c1c50], 0
mov ecx, str.Config
call fcn.10002e70
cmp byte [0x100c1c50], 0
pop ecx
pop ecx
je 0x100067bf
ret
Function at 0x100130a4
Capabilities:
List user accounts for group
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x100ba410]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
xor eax, eax
mov esi, edx
push edi
push 0xfe
push eax
mov dword [ebp - 0x210], eax
mov ebx, ecx
mov dword [ebp - 0x21c], eax
mov byte [ebp - 0x20c], al
lea eax, [ebp - 0x20b]
push eax
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x218], ebx
call fcn.10023400
add esp, 0xc
mov byte [ebp - 0x10c], 0
lea eax, [ebp - 0x10b]
push 0xff
push 0
push eax
call fcn.10023400
xor edi, edi
add esp, 0xc
inc edi
cmp dword [0x100c1c2c], 5
jl 0x10013127
push str.ShowThisDomainGroupMembersNT
call fcn.100144ba
pop ecx
push 0
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x210]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x214]
push eax
push 0
push ebx
push esi
call dword [sym.imp.NETAPI32.dll_NetGroupGetUsers]
cmp dword [ebp - 0x210], 0
mov ebx, eax
mov ecx, dword [ebp - 0x214]
mov esi, ecx
je 0x100131ec
xor edx, edx
lea eax, [ebp - 0x20c]
push edx
push edx
push 0xfe
push eax
push 0xffffffffffffffff
push dword [ecx]
push edx
push edx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x10c]
test edi, edi
jne 0x10013195
push 0x100a9814
jmp 0x1001319c
xor edi, edi
push 0x1009e65c
push 0xffffffffffffffff
push 0x100
push eax
call fcn.1001f145
lea ecx, [ebp - 0x10c]
add esp, 0x14
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100131b5
push 0
sub ecx, edx
lea eax, [ebp - 0x10c]
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_send]
mov ecx, dword [ebp - 0x214]
add ecx, 4
dec dword [ebp - 0x210]
mov dword [ebp - 0x214], ecx
jne 0x10013161
test esi, esi
je 0x100131f7
push esi
call dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
mov esi, dword [ebp - 0x220]
cmp ebx, 0xea
mov ebx, dword [ebp - 0x218]
je 0x10013127
mov ecx, dword [ebp - 8]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001e010
mov esp, ebp
pop ebp
ret
Function at 0x100148fe
Capabilities:
Create udp socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [0x100c1c2c], 9
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, ecx
jl 0x1001491f
push str.ConnectToServer
call fcn.100144ba
pop ecx
lea esi, [ebx + 0x14]
test esi, esi
je 0x100149ec
cmp dword [ebp + 8], 0
je 0x100149ec
mov al, byte [esi]
test al, al
je 0x100149ec
and dword [ebx + 0x214], 0
movsx eax, al
push eax
call fcn.1002163a
pop ecx
push 2
pop edx
push esi
test eax, eax
je 0x1001496f
xor eax, eax
lea edi, [ebx + 4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov word [ebx + 4], dx
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebx + 8], eax
jmp 0x100149b0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ecx, eax
mov dword [ebp - 8], ecx
test ecx, ecx
jne 0x10014986
push esi
push str.Error:_gethostbyname_failed:__s.
jmp 0x100149da
xor eax, eax
lea edi, [ebx + 4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
movsx eax, word [ecx + 0xa]
push eax
mov eax, dword [ecx + 0xc]
push dword [eax]
lea eax, [ebx + 8]
push eax
call fcn.1003e240
mov eax, dword [ebp - 8]
add esp, 0xc
mov ax, word [eax + 8]
mov word [ebx + 4], ax
push dword [ebp - 4]
call dword [sym.imp.WS2_32.dll_htons]
push 0
push 2
push 2
mov word [ebx + 6], ax
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
jne 0x100149ef
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.socket_failed_to_create_datagram_socket:__d_n
push 0xffffffffffffffff
push 0x400
push dword [ebp + 8]
call fcn.1001f145
add esp, 0x14
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10014a3e
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x100ba410]
xor eax, esp
mov dword [esp + 0x18], eax
cmp dword [0x100c1c2c], 5
push ebx
push esi
push edi
mov esi, edx
mov edi, ecx
jl 0x10014a6d
push str.InitWebServer:_configuring_listening_port
call fcn.100144ba
pop ecx
xor ebx, ebx
mov edx, str.AccessKey
push ebx
mov ecx, str.Remote
call fcn.1000a52a
pop ecx
test eax, eax
je 0x10014b03
push 1
mov edx, str.AllowBasicAuth
mov ecx, str.Remote
call fcn.1000a52a
mov dword [esp], 0x100
mov edx, str.AccessKeySet
push 0x100c29f0
mov ecx, str.Remote
mov dword [0x100bb73c], eax
call fcn.10002e70
push 0x100
push 0x100c2af8
mov edx, str.AccessKeySetSnare1
mov ecx, str.Remote
call fcn.10002e70
push 0x100
push 0x100c2770
mov edx, str.AccessKeySetSnare2
mov ecx, str.Remote
call fcn.10002e70
push 0x100
push 0x100c28b0
mov edx, str.AccessKeySetSnare3
mov ecx, str.Remote
call fcn.10002e70
add esp, 0x20
mov dword [0x100c2af0], ebx
test esi, esi
je 0x10014b58
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10014b12
sub ecx, edx
je 0x10014b58
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
push 0xffffffffffffffff
test eax, eax
je 0x10014b3a
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
jmp 0x10014b3b
push esi
imul eax, dword [0x100c2af0], 0x11
push 0x11
add eax, 0x100c1ccc
push eax
call fcn.10021c86
add esp, 0x10
inc dword [0x100c2af0]
push 2
pop esi
push edi
mov word [esp + 0x18], si
mov dword [esp + 0x1c], ebx
call dword [sym.imp.WS2_32.dll_htons]
push ebx
push 1
push esi
mov word [esp + 0x22], ax
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x100bb734], eax
cmp eax, 0xffffffff
jne 0x10014ba0
cmp dword [0x100c1c2c], 5
jl 0x10014b98
push str.bind___failed:_INVALID_SOCKET
call fcn.100144ba
pop ecx
or eax, 0xffffffff
jmp 0x10014c6f
push 1
lea ecx, [esp + 0x13]
mov byte [esp + 0x13], bl
push ecx
push 0xffffff7f
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x10014bd4
cmp dword [0x100c1c2c], 5
jl 0x10014bd4
push str.setsockopt_DONTLINGER__failed:_SOCKET_ERROR
call fcn.100144ba
pop ecx
mov esi, dword [sym.imp.WS2_32.dll_bind]
lea eax, [esp + 0x14]
push 0x10
push eax
push dword [0x100bb734]
call esi
cmp eax, 0xffffffff
jne 0x10014c2b
cmp dword [0x100c1c2c], 5
jl 0x10014c02
push str.bind___failed:_SOCKET_ERROR
call fcn.100144ba
pop ecx
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10014c10
cmp ebx, 4
je 0x10014c55
inc ebx
push 0x3e8
call edi
push 0x10
lea eax, [esp + 0x18]
push eax
push dword [0x100bb734]
call esi
cmp eax, 0xffffffff
je 0x10014c0a
push 5
push dword [0x100bb734]
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
jne 0x10014c6c
cmp dword [0x100c1c2c], 5
jl 0x10014b98
push str.listen___failed:_SOCKET_ERROR
jmp 0x10014b92
cmp dword [0x100c1c2c], 5
jl 0x10014b98
push str.bind___failed__unable_to_initialise_web_server
jmp 0x10014b92
xor eax, eax
inc eax
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1001e010
mov esp, ebp
pop ebp
ret
Function at 0x100159a3
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
push esi
push edi
movzx edi, word [ecx + 6]
add edx, eax
xor esi, esi
test edi, edi
je 0x100159d5
mov ecx, dword [ebp + 8]
cmp ecx, dword [edx + 0xc]
jb 0x100159cd
mov eax, dword [edx + 0x10]
add eax, dword [edx + 0xc]
cmp ecx, eax
jb 0x100159db
add edx, 0x28
inc esi
cmp esi, edi
jb 0x100159be
xor eax, eax
pop edi
pop esi
pop ebp
ret
mov eax, edx
jmp 0x100159d7

Function at 0x10015b7f
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
push ebx
push edi
mov ebx, edx
mov edi, ecx
jle 0x10015be7
sub ebx, dword [ebp + 8]
push esi
inc byte [edi + 0x100]
movzx esi, byte [edi + 0x100]
mov al, byte [esi + edi]
add byte [edi + 0x101], al
movzx edx, byte [edi + 0x101]
mov cl, byte [esi + edi]
mov al, byte [edx + edi]
mov byte [esi + edi], al
mov byte [edx + edi], cl
movzx eax, byte [edi + 0x101]
movzx ecx, byte [edi + 0x100]
mov al, byte [eax + edi]
add al, byte [ecx + edi]
mov ecx, dword [ebp + 8]
movzx eax, al
mov al, byte [eax + edi]
xor al, byte [ebx + ecx]
mov byte [ecx], al
inc ecx
dec dword [ebp + 0xc]
mov dword [ebp + 8], ecx
jne 0x10015b92
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x10017e36
Capabilities:
Hash data with md5

Disassembly:
and dword [ecx + 0x10], 0
and dword [ecx + 0x14], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret

Function at 0x10018255
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x19c
mov eax, dword [0x100ba410]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
test esi, esi
jne 0x10018273
xor eax, eax
jmp 0x100182b6
lea eax, [ebp - 0x198]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x100182b3
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.WSAStartup_failed:_WSA_ERROR:__d_r_n
push 0x400
push esi
call fcn.1001f278
add esp, 0x10
cmp dword [0x100c1c2c], 9
jl 0x100182b3
push esi
call fcn.100144ba
pop ecx
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1001e010
mov esp, ebp
pop ebp
ret
Function at 0x10018bf8
Capabilities:
Enumerate files on windows
Enumerate files recursively
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34c
mov eax, dword [0x100ba410]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov esi, edi
mov dword [ebp - 0x34c], ebx
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x10018c1d
sub esi, ecx
cmp esi, 0xc
jbe 0x10018c79
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10018c30
sub ecx, edx
lea eax, [edi - 0xc]
add eax, ecx
push eax
push str.msaudite.dll
call fcn.1001f912
pop ecx
pop ecx
test eax, eax
jne 0x10018c79
push 0x100
lea eax, [ebp - 0x208]
push eax
push str._SystemRoot__system32msaudite.dll
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [ebp - 0x208]
push eax
push edi
call fcn.1001f912
pop ecx
pop ecx
test eax, eax
je 0x10018c86
push ebx
push 0xa08
push edi
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityA]
mov esi, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea eax, [ebp - 0x348]
push eax
push edi
call esi
cmp eax, 0xffffffff
je 0x10018df8
mov ebx, dword [sym.imp.KERNEL32.dll_FindClose]
push eax
call ebx
test byte [ebp - 0x348], 0x10
je 0x10018df8
push edi
push str._s
push 0xffffffffffffffff
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.1001f145
add esp, 0x14
lea eax, [ebp - 0x348]
push eax
lea eax, [ebp - 0x108]
push eax
call esi
mov esi, eax
cmp esi, 0xffffffff
je 0x10018df5
mov ebx, dword [ebp - 0x34c]
lea eax, [ebp - 0x31c]
push eax
push edi
push 0x1009e654
push 0xffffffffffffffff
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.1001f145
add esp, 0x18
test byte [ebp - 0x348], 0x10
je 0x10018d67
cmp byte [ebp - 0x31c], 0x2e
je 0x10018dd9
lea ecx, [ebp - 0x31c]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10018d34
sub ecx, edx
cmp ecx, 1
je 0x10018d58
cmp byte [ebp - 0x31b], 0x2e
je 0x10018dd9
cmp ecx, 2
jne 0x10018dd9
mov edx, ebx
lea ecx, [ebp - 0x108]
call fcn.10018bf8
jmp 0x10018dd9
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10018d70
sub ecx, edx
cmp ecx, 0xc
jbe 0x10018dc6
lea eax, [ebp + ecx - 0x114]
push eax
push str.msaudite.dll
call fcn.1001f912
pop ecx
pop ecx
test eax, eax
jne 0x10018dc6
push 0x100
lea eax, [ebp - 0x208]
push eax
push str._SystemRoot__system32msaudite.dll
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.1001f912
pop ecx
pop ecx
test eax, eax
je 0x10018dd9
push ebx
push 0xa08
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityA]
lea eax, [ebp - 0x348]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10018cf2
mov ebx, dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001e010
mov esp, ebp
pop ebp
ret