joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e070
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x494648
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4b9a40]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
push str.Software_
lea ecx, [esp + 0x18]
mov dword [esp + 0x34], 1
call fcn.00401bc0
push 9
push str.yxdownbox
lea ecx, [esp + 0x1c]
mov byte [esp + 0x38], 2
call fcn.00405f90
mov eax, dword [esp + 0x38]
mov eax, dword [eax - 0xc]
xor ebx, ebx
cmp eax, ebx
je 0x41e0f1
push 1
push 0x4a03f4
lea ecx, [esp + 0x1c]
call fcn.00405f90
mov eax, dword [esp + 0x38]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.00405f90
mov edx, dword [esp + 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [esp + 0x18]
push ecx
push 0xf003f
push ebx
push edx
push SysReAllocStringLen
xor esi, esi
mov dword [esp + 0x2c], ebx
call edi
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
jne 0x41e124
mov esi, dword [esp + 0x18]
jmp 0x41e18c
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x20]
push ecx
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push edx
push SysReAllocStringLen
mov dword [esp + 0x40], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jne 0x41e15c
mov esi, dword [esp + 0x1c]
cmp esi, ebx
je 0x41e15c
push esi
call ebp
xor esi, esi
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x20]
push eax
push 0xf003f
push ebx
push ecx
push SysReAllocStringLen
mov dword [esp + 0x34], ebx
call edi
cmp eax, ebx
jne 0x41e1aa
xor eax, eax
cmp esi, ebx
je 0x41e184
push esi
call ebp
mov esi, dword [esp + 0x20]
cmp eax, ebx
jne 0x41e1aa
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x40]
push 4
lea eax, [esp + 0x44]
push eax
push 4
push ebx
push ecx
push esi
mov dword [esp + 0x58], edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp esi, ebx
je 0x41e1b1
push esi
call ebp
mov byte [esp + 0x30], 1
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41e1d6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x30], bl
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41e1fa
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x30], 0xffffffff
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41e222
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 0xc
Function at 0x4243b0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32
Write file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, ecx
cmp byte [esi + 0x2d], 0
push edi
mov edi, dword [esp + 0x14]
mov eax, ebx
je 0x42448b
mov eax, dword [esi + 0x3c]
push ebp
xor ebp, ebp
cmp eax, ebp
je 0x4243e4
cmp dword [esi + 0x40], edi
jae 0x4243e4
push eax
call fcn.00442458
add esp, 4
mov dword [esi + 0x3c], ebp
cmp dword [esi + 0x3c], ebp
jne 0x4243fb
lea eax, [edi + edi]
push eax
call fcn.0044244d
add esp, 4
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
mov ecx, dword [esi + 0x3c]
push edi
push ebx
push ecx
call fcn.0046a6a0
add esp, 0xc
cmp edi, ebp
jbe 0x424487
lea ecx, [ecx]
mov edx, dword [esi + 0x3c]
mov bl, byte [edx + ebp]
mov edi, dword [esi + 0x30]
mov eax, dword [esi + 0x38]
movsx ecx, bl
xor ecx, edi
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4a4dd0]
shr edi, 8
xor ecx, edi
mov dword [esi + 0x30], ecx
movzx ecx, cl
add ecx, dword [esi + 0x34]
mov edx, eax
imul ecx, ecx, 0x8088405
inc ecx
mov dword [esi + 0x34], ecx
shr ecx, 0x18
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x4a4dd0]
and edx, 0xfffd
mov dword [esi + 0x38], eax
mov ecx, dword [esi + 0x3c]
or edx, 2
mov eax, edx
xor eax, 1
imul eax, edx
shr eax, 8
xor al, bl
mov byte [ecx + ebp], al
inc ebp
cmp ebp, dword [esp + 0x18]
jb 0x424410
mov edi, dword [esp + 0x18]
mov eax, dword [esi + 0x3c]
pop ebp
mov edx, dword [esi + 0x20]
test edx, edx
je 0x4244c4
mov ecx, dword [esi + 0x24]
lea ebx, [ecx + edi]
cmp ebx, dword [esi + 0x28]
jb 0x4244ac
pop edi
mov dword [esi + 0x14], 0x30000
pop esi
xor eax, eax
pop ebx
ret 8
push edi
push eax
add ecx, edx
push ecx
call fcn.0046a6a0
add esp, 0xc
add dword [esi + 0x24], edi
mov eax, edi
pop edi
pop esi
pop ebx
ret 8
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4244e5
push 0
lea edx, [esp + 0x18]
push edx
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
ret 8
pop edi
mov dword [esi + 0x14], 0x1000000
pop esi
xor eax, eax
pop ebx
ret 8
Function at 0x4357c0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [edi]
mov ebx, eax
test esi, esi
jne 0x4357d1
pop esi
xor eax, eax
pop ebx
pop ecx
ret
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [edi], 0
mov edi, edi
mov eax, 0x400000
cmp esi, 0x400000
ja 0x4357ef
mov eax, esi
mov edx, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x10]
push ecx
push eax
mov eax, dword [edx]
push ebx
push eax
mov dword [esp + 0x20], 0
call ebp
mov ecx, dword [esp + 0xc]
add dword [edi], ecx
add ebx, ecx
sub esi, ecx
test eax, eax
je 0x435826
test ecx, ecx
je 0x43581f
test esi, esi
ja 0x4357e0
pop ebp
pop esi
xor eax, eax
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ebp
pop esi
pop ebx
pop ecx
ret

Function at 0x435840
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [edi]
mov ebx, eax
test esi, esi
jne 0x435851
pop esi
xor eax, eax
pop ebx
pop ecx
ret
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [edi], 0
mov edi, edi
mov eax, 0x400000
cmp esi, 0x400000
ja 0x43586f
mov eax, esi
mov edx, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x10]
push ecx
push eax
mov eax, dword [edx]
push ebx
push eax
mov dword [esp + 0x20], 0
call ebp
mov ecx, dword [esp + 0xc]
add dword [edi], ecx
add ebx, ecx
sub esi, ecx
test eax, eax
je 0x4358a6
test ecx, ecx
je 0x43589f
test esi, esi
ja 0x435860
pop ebp
pop esi
xor eax, eax
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ebp
pop esi
pop ebx
pop ecx
ret

Function at 0x4383a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ecx
xor edx, edx
mov eax, edx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x4c02e0], ecx
inc edx
cmp edx, 0x100
jb 0x4383a3
cmp edx, 0x800
jae 0x438479
lea ecx, [ecx]
mov eax, dword [edx*4 + 0x4bfee0]
mov ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x4c02e0]
inc edx
mov dword [edx*4 + 0x4c02dc], eax
cmp edx, 0x800
jb 0x438450
mov dword [0x4bec50], 0x439810
call fcn.004399e0
test eax, eax
jne 0x438496
mov dword [0x4bec50], 0x4398c0
pop ecx
ret
Function at 0x439d40
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x493033
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4b9a40]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.std::locale::_Locimp.0
push esi
mov dword [esp + 0x18], 1
call fcn.0047f595
add esp, 4
cmp dword [esi + 0x30], 0x10
jb 0x439d91
mov eax, dword [esi + 0x1c]
push eax
call fcn.00442458
add esp, 4
xor eax, eax
mov dword [esi + 0x30], 0xf
mov dword [esi + 0x2c], eax
mov byte [esi + 0x1c], al
mov dword [esi], vtable.std::locale::facet.0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x43a500
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [esp + 8]
sub esp, 8
push ebp
push esi
mov esi, dword [ecx]
xor ebp, ebp
and esi, 7
cmp eax, 5
jae 0x43a51d
pop esi
xor eax, eax
pop ebp
add esp, 8
ret
mov edx, dword [esp + 0x14]
push ebx
lea ebx, [edx + eax - 4]
push edi
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x14], ebx
lea edi, [edx + ebp]
cmp edi, ebx
jae 0x43a54d
lea ebx, [ebx]
mov al, byte [edi]
and al, 0xfe
cmp al, 0xe8
je 0x43a54d
inc edi
cmp edi, ebx
jb 0x43a540
mov ebp, edi
sub ebp, edx
mov eax, ebp
sub eax, dword [esp + 0x10]
cmp edi, ebx
jae 0x43a655
cmp eax, 3
jbe 0x43a580
xor esi, esi
mov al, byte [edi + 4]
mov dword [esp + 0x10], ebp
test al, al
je 0x43a5bb
cmp al, 0xff
je 0x43a5bb
and esi, 3
add esi, esi
or esi, 1
inc ebp
jmp 0x43a533
lea ecx, [eax - 1]
shl esi, cl
and esi, 7
je 0x43a566
movzx ecx, byte [esi + 0x4a4b50]
mov eax, edi
sub eax, ecx
cmp byte [esi + 0x4a4b48], 0
mov al, byte [eax + 4]
je 0x43a5a9
test al, al
je 0x43a5a9
cmp al, 0xff
jne 0x43a566
and esi, 3
add esi, esi
mov dword [esp + 0x10], ebp
or esi, 1
inc ebp
jmp 0x43a533
movzx ecx, byte [edi + 3]
movzx edx, al
movzx eax, byte [edi + 2]
shl edx, 8
or edx, ecx
movzx ecx, byte [edi + 1]
shl edx, 8
or edx, eax
shl edx, 8
or edx, ecx
lea esp, [esp]
sub edx, ebp
sub edx, 5
mov eax, edx
test esi, esi
je 0x43a627
movzx edx, byte [esi + 0x4a4b50]
add edx, edx
add edx, edx
add edx, edx
mov ecx, 0x18
sub ecx, edx
mov ebx, eax
shr ebx, cl
test bl, bl
je 0x43a60c
cmp bl, 0xff
jne 0x43a623
mov ebx, dword [esp + 0x14]
mov ecx, 0x20
sub ecx, edx
mov edx, 1
shl edx, cl
dec edx
xor edx, eax
jmp 0x43a5e0
mov ebx, dword [esp + 0x14]
mov edx, eax
shr edx, 0x18
and dl, 1
dec dl
not dl
mov byte [edi + 4], dl
mov edx, eax
shr edx, 8
mov ecx, eax
shr ecx, 0x10
mov byte [edi + 2], dl
mov edx, dword [esp + 0x1c]
mov byte [edi + 3], cl
mov byte [edi + 1], al
add ebp, 5
jmp 0x43a533
pop edi
pop ebx
cmp eax, 3
jbe 0x43a66c
mov eax, dword [esp + 0x18]
xor esi, esi
mov dword [eax], esi
pop esi
mov eax, ebp
pop ebp
add esp, 8
ret
lea ecx, [eax - 1]
mov eax, dword [esp + 0x18]
shl esi, cl
and esi, 7
mov dword [eax], esi
pop esi
mov eax, ebp
pop ebp
add esp, 8
ret
Function at 0x448b7a
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x490f35
call fcn.00465d51
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x448b9f
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x448be5
lea ecx, [ebp - 0x10]
call fcn.00401b90
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004427c0
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401180
mov eax, esi
call fcn.00465e29
ret 8

Function at 0x44ec5f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x44eca6
call fcn.00448214
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x44eca6
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x44ecc2
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0044e7d7
mov esi, eax
test edi, edi
je 0x44ecc0
test ebx, ebx
je 0x44ecc0
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x45fa81
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x45faa5
cmp dword [edi + 0x54], 0
jne 0x45faa5
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.00448214
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.0045fa42
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x461095
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4b9a40]
jne 0x46109f
repz ret
jmp fcn.0046a49e

Function at 0x47632f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00469e02
and dword [ebp - 4], 0
cmp dword [0x4be864], 0
mov ebx, eax
jne 0x4763e0
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x476491
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x476491
push eax
call fcn.00469d90
mov dword [esp], 0x49ccf0
push edi
mov dword [0x4be864], eax
call esi
push eax
call fcn.00469d90
mov dword [esp], 0x49ccdc
push edi
mov dword [0x4be868], eax
call esi
push eax
call fcn.00469d90
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4be86c], eax
call esi
push eax
call fcn.00469d90
pop ecx
mov dword [0x4be874], eax
test eax, eax
je 0x4763e0
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00469d90
pop ecx
mov dword [0x4be870], eax
mov eax, dword [0x4be870]
cmp eax, ebx
je 0x476438
cmp dword [0x4be874], ebx
je 0x476438
push eax
call fcn.00469e0b
push dword [0x4be874]
mov esi, eax
call fcn.00469e0b
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x476438
test edi, edi
je 0x476438
call esi
test eax, eax
je 0x47642f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x47642f
test byte [ebp - 0xc], 1
jne 0x476438
or dword [ebp + 0x10], 0x200000
jmp 0x476471
mov eax, dword [0x4be868]
cmp eax, ebx
je 0x476471
push eax
call fcn.00469e0b
pop ecx
test eax, eax
je 0x476471
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x476471
mov eax, dword [0x4be86c]
cmp eax, ebx
je 0x476471
push eax
call fcn.00469e0b
pop ecx
test eax, eax
je 0x476471
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4be864]
call fcn.00469e0b
pop ecx
test eax, eax
je 0x476491
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x476493
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100584a
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x1013024]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push 0x80
lea ecx, [ebp - 0x104]
push ecx
push 0x21
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10058a9
movzx eax, word [ebp - 0x104]
sub eax, 0x30
je 0x10058a5
dec eax
je 0x100589e
dec eax
je 0x1005897
xor eax, eax
inc eax
jmp 0x10058ab
mov word [esi], 2
jmp 0x10058a9
mov word [esi], 1
jmp 0x10058a9
and word [esi], 0
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
call fcn.0100db46
leave
ret 4
Function at 0x100fb95
Capabilities:
Initialize winsock library

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x19c
mov eax, dword [0x1013024]
and dword [ebp - 0x198], 0
cmp dword [0x1013038], 0
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x19c], eax
jne 0x100fbf9
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x100fbef
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x100fc9f
mov dword [0x1013038], 1
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
lea eax, [esi + 5]
push 1
push eax
call dword [sym.imp.msvcrt.dll_calloc]
mov edi, eax
test edi, edi
pop ecx
pop ecx
jne 0x100fc2a
push 0x8007000e
call dword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.0100e003
jmp 0x100fc6a
push esi
push edi
push ebx
call fcn.0100e0e3
push edi
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
mov dword [ebp - 0x198], eax
jne 0x100fc53
push edi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push 0x800300fd
jmp 0x100fc1d
push 2
push 4
lea eax, [ebp - 0x198]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyaddr]
mov esi, eax
test esi, esi
jne 0x100fc6e
xor eax, eax
jmp 0x100fc9d
push edi
call dword [sym.imp.msvcrt.dll_free]
cmp dword [ebp + 0x10], 0
mov eax, dword [esi]
pop ecx
jne 0x100fc8c
push 0x1001510
push eax
call dword [sym.imp.msvcrt.dll_strtok]
pop ecx
pop ecx
push 0xf
push dword [ebp - 0x19c]
push eax
call fcn.0100e18e
xor eax, eax
inc eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
pop ebx
call fcn.0100db46
leave
ret 0xc

Function at 0x100fcd5
Capabilities:
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x1013024]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x3f
xor edx, edx
pop ecx
mov dword [ebp - 4], eax
xor eax, eax
cmp ebx, edx
lea edi, [ebp - 0x100]
mov dword [ebp - 0x104], edx
rep stosd dword es:[edi], eax
push 0x3f
pop ecx
lea edi, [ebp - 0x200]
mov dword [ebp - 0x204], edx
mov dword [ebp - 0x208], edx
rep stosd dword es:[edi], eax
je 0x100fdc4
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x100fdc4
mov esi, dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x104]
push eax
mov edi, 0x80
push 4
mov dword [ebp - 0x208], edi
call esi
push 0
push 1
push ebx
lea eax, [ebp - 0x104]
push eax
call fcn.0100e779
test eax, eax
je 0x100fdc4
push ebx
call fcn.0100f978
cmp eax, 1
jne 0x100fd94
push 0
lea eax, [ebp - 0x204]
push eax
push ebx
call fcn.0100fb95
test eax, eax
je 0x100fdc7
push 0
push 1
lea eax, [ebp - 0x204]
push eax
jmp 0x100fdb1
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x104]
push eax
push 7
mov dword [ebp - 0x208], edi
call esi
push 0
push 1
push ebx
lea eax, [ebp - 0x104]
push eax
call fcn.0100e779
neg eax
sbb eax, eax
inc eax
jmp 0x100fdc7
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0100db46
leave
ret 4
Function at 0x1010017
Capabilities:
Connect network resource

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x1013024]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x408], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x410], eax
mov eax, dword [ebp + 0x14]
push 0x7e
mov dword [ebp - 0x40c], eax
pop ecx
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x404], ebx
lea edi, [ebp - 0x400]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x7e
pop ecx
mov dword [ebp - 0x204], ebx
xor eax, eax
lea edi, [ebp - 0x200]
rep stosd dword es:[edi], eax
push esi
stosw word es:[edi], ax
call fcn.0100fcd5
cmp eax, 1
jne 0x10100c4
cmp dword [ebp - 0x408], ebx
je 0x10100bd
push dword [ebp - 0x408]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x10100bd
mov esi, 0xa0010001
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x157e
call fcn.0100ec7a
push eax
call fcn.0100dd7c
mov eax, esi
jmp 0x101020c
xor eax, eax
jmp 0x101020c
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
lea eax, [ebp - 0x204]
push eax
call edi
push esi
call fcn.0100fcb1
cmp eax, 1
jne 0x10100ec
add esi, 4
push esi
lea eax, [ebp - 0x204]
push eax
call edi
lea eax, [ebp - 0x204]
push eax
call fcn.0100fa69
test eax, eax
jne 0x1010107
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x101020c
mov esi, 0x1001224
push esi
lea eax, [ebp - 0x404]
push eax
call edi
cmp dword [ebp - 0x40c], ebx
je 0x1010152
push dword [ebp - 0x40c]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x1010152
push dword [ebp - 0x40c]
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x404]
push 0x1001540
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
jmp 0x101016e
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x404]
push 0x1001514
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 8
pop ecx
xor eax, eax
push ebx
push dword [ebp - 0x408]
lea edi, [ebp - 0x430]
push dword [ebp - 0x410]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x404]
mov dword [ebp - 0x41c], eax
lea eax, [ebp - 0x430]
push eax
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x414], ebx
mov dword [ebp - 0x420], ebx
call sub.MPR.dll_WNetAddConnection2W
mov edi, eax
cmp edi, ebx
je 0x10101ce
cmp edi, 0x4b8
je 0x10101c7
call fcn.0100e003
jmp 0x101020a
call fcn.0100e05a
jmp 0x101020a
push esi
xor edi, edi
call fcn.0100dd7c
lea eax, [ebp - 0x204]
push eax
call fcn.0100fddb
cmp eax, 0x1388
jae 0x101020a
lea eax, [ebp - 0x204]
push eax
call fcn.0100fffa
push 0x157f
call fcn.0100ec7a
push eax
call fcn.0100dd7c
mov edi, 0x4b8
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0100db46
leave
ret 0x10