joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004b30
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x1004a258]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x10004b60
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000eb31
mov esp, ebp
pop ebp
ret
push edi
push 0
push 0x2000000
push 3
push 0
push 0
push 0x60000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10004b93
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000eb31
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push 4
push 1
push edi
mov dword [ebp - 0x18], 0
call dword [sym.imp.ADVAPI32.dll_GetSecurityInfo]
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x221
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
mov word [ebp - 8], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x1c]
xorps xmm0, xmm0
lea eax, [ebp - 0x3c]
push eax
movq qword [ebp - 0x38], xmm0
movq qword [ebp - 0x28], xmm0
push 1
movq qword [ebp - 0x30], xmm0
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x3c], 0x10000000
mov dword [ebp - 0x34], 3
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x10], 0
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x10004c5f
push 0
push eax
push 0
push 0
push 4
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
call esi
push dword [ebp - 0x18]
call esi
push dword [ebp - 0x1c]
call esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 1
pop esi
call fcn.1000eb31
mov esp, ebp
pop ebp
ret
Function at 0x10004ca0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x654
mov eax, dword [0x1004a258]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
xor eax, eax
push 0x3fe
push eax
mov word [ebp - 0x404], ax
lea eax, [ebp - 0x402]
push eax
call fcn.1000f6b0
push ebx
lea eax, [ebp - 0x404]
push str._s.
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea eax, [ebp - 0x654]
push eax
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x10004d79
push edi
mov edi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x10004d10
test byte [ebp - 0x654], 0x10
je 0x10004d5f
cmp word [ebp - 0x628], 0x2e
je 0x10004d5f
cmp word [ebp - 0x626], 0x2e
je 0x10004d5f
lea eax, [ebp - 0x628]
push eax
push ebx
lea eax, [ebp - 0x404]
push str._s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x404]
push eax
call fcn.10004d90
add esp, 0x14
lea eax, [ebp - 0x404]
push eax
call edi
lea eax, [ebp - 0x654]
push eax
push esi
call dword [0x1006a8c4]
test eax, eax
jne 0x10004d10
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1000eb31
mov esp, ebp
pop ebp
ret

Function at 0x10004ee0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x1004a258]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0
push 2
xor bl, bl
mov dword [ebp - 0x230], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x10005035
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
cmp eax, 1
jne 0x1000502e
push edi
mov edi, eax
mov edi, edi
lea eax, [ebp - 0x20c]
push eax
push str.avgcsrvx.exe
call fcn.1000d93b
test eax, eax
lea eax, [ebp - 0x20c]
movzx ebx, bl
push eax
push str.avgemcx.exe
cmove ebx, edi
call fcn.1000d93b
test eax, eax
lea eax, [ebp - 0x20c]
movzx ebx, bl
push eax
push str.avgidsagent.exe
cmove ebx, edi
call fcn.1000d93b
test eax, eax
lea eax, [ebp - 0x20c]
movzx ebx, bl
push eax
push str.avgnsx.exe
cmove ebx, edi
call fcn.1000d93b
test eax, eax
lea eax, [ebp - 0x20c]
movzx ebx, bl
push eax
push str.avgrsx.exe
cmove ebx, edi
call fcn.1000d93b
test eax, eax
lea eax, [ebp - 0x20c]
movzx ebx, bl
push eax
push str.avgsvcx.exe
cmove ebx, edi
call fcn.1000d93b
test eax, eax
lea eax, [ebp - 0x20c]
movzx ebx, bl
push eax
push str.avgui.exe
cmove ebx, edi
call fcn.1000d93b
test eax, eax
lea eax, [ebp - 0x20c]
movzx ebx, bl
push eax
push str.avguix.exe
cmove ebx, edi
call fcn.1000d93b
add esp, 0x40
test eax, eax
lea eax, [ebp - 0x20c]
movzx ebx, bl
push eax
push str.avgwdsvcx.exe
cmove ebx, edi
call fcn.1000d93b
add esp, 8
test eax, eax
lea eax, [ebp - 0x230]
movzx ebx, bl
push eax
push esi
cmove ebx, edi
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
je 0x10004f30
pop edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.1000eb31
mov esp, ebp
pop ebp
ret
Function at 0x100050b0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003a698
mov eax, dword fs:[0]
push eax
sub esp, 0x44c
mov eax, dword [0x1004a258]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
push eax
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [ebp - 0x450]
push eax
push esi
mov dword [ebp - 0x450], 0x428
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x100051a9
jmp 0x10005110
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
cmp word [ebp - 0x230], ax
je 0x10005145
lea eax, [ebp - 0x230]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10005136
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x28]
call fcn.100092e0
movzx eax, byte [0x1006a890]
push eax
lea eax, [ebp - 0x28]
push eax
push 0
lea eax, [ebp - 0x458]
push eax
lea ecx, [edi + 0x40d0]
mov dword [ebp - 4], 0
call fcn.10001860
cmp dword [ebp - 0x14], 8
mov dword [ebp - 4], 0xffffffff
jb 0x10005194
push dword [ebp - 0x28]
call fcn.1000c900
add esp, 4
lea eax, [ebp - 0x450]
push eax
push esi
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x10005110
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000eb31
mov esp, ebp
pop ebp
ret 4
Function at 0x10005e80
Capabilities:
Check if file exists
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003a7c1
mov eax, dword fs:[0]
push eax
sub esp, 0x168
mov eax, dword [0x1004a258]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0xff
lea eax, [ebp - 0x10f]
push 0
push eax
mov byte [ebp - 0x110], 0
call fcn.1000f6b0
add esi, 0x414c
xor eax, eax
add esp, 0xc
mov byte [esi], 0
mov dword [ebp - 0x174], 0
mov dword [ebp - 0x12c], 7
mov dword [ebp - 0x130], 0
mov word [ebp - 0x140], ax
cmp word [0x1006a688], ax
jne 0x10005f09
xor ecx, ecx
jmp 0x10005f20
mov ecx, 0x1006a688
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10005f11
sub ecx, edx
sar ecx, 1
push ecx
push 0x1006a688
lea ecx, [ebp - 0x140]
call fcn.100092e0
push str.Databasedaily.cld
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x128]
push eax
mov dword [ebp - 4], 0
call fcn.100013b0
add esp, 0xc
cmp dword [ebp - 0x12c], 8
mov byte [ebp - 4], 2
jb 0x10005f6e
push dword [ebp - 0x140]
call fcn.1000c900
add esp, 4
xor eax, eax
cmp dword [ebp - 0x114], 8
mov word [ebp - 0x140], ax
lea eax, [ebp - 0x128]
cmovae eax, dword [ebp - 0x128]
push eax
mov dword [ebp - 0x12c], 7
mov dword [ebp - 0x130], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1000606e
push 0x1006a688
lea ecx, [ebp - 0x170]
call fcn.10001ce0
push str.Databasedaily.cvd
push eax
lea eax, [ebp - 0x158]
push eax
mov byte [ebp - 4], 3
call fcn.100013b0
mov edi, eax
lea eax, [ebp - 0x128]
add esp, 0xc
cmp eax, edi
je 0x10006023
cmp dword [ebp - 0x114], 8
jb 0x10005ffa
push dword [ebp - 0x128]
call fcn.1000c900
add esp, 4
xor eax, eax
push edi
lea ecx, [ebp - 0x128]
mov dword [ebp - 0x114], 7
mov dword [ebp - 0x118], 0
mov word [ebp - 0x128], ax
call fcn.10007fa0
cmp dword [ebp - 0x144], 8
jb 0x1000603a
push dword [ebp - 0x158]
call fcn.1000c900
add esp, 4
xor eax, eax
cmp dword [ebp - 0x15c], 8
mov dword [ebp - 0x144], 7
mov dword [ebp - 0x148], 0
mov word [ebp - 0x158], ax
jb 0x1000606e
push dword [ebp - 0x170]
call fcn.1000c900
add esp, 4
cmp dword [ebp - 0x114], 8
push 0
push 0x80
push 3
push 0
push 1
lea eax, [ebp - 0x128]
cmovae eax, dword [ebp - 0x128]
push connect
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x100060ed
push 0
lea eax, [ebp - 0x174]
push eax
push 0x100
lea eax, [ebp - 0x110]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0xed]
push 0x1003cae4
push eax
call fcn.1000d4f8
mov ecx, eax
add esp, 8
test ecx, ecx
je 0x100060ed
sub esi, ecx
mov al, byte [ecx]
mov byte [esi + ecx], al
lea ecx, [ecx + 1]
test al, al
jne 0x100060e1
cmp dword [ebp - 0x114], 8
jb 0x10006104
push dword [ebp - 0x128]
call fcn.1000c900
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000eb31
mov esp, ebp
pop ebp
ret
Function at 0x10006280
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003a848
mov eax, dword fs:[0]
push eax
sub esp, 0x248
mov eax, dword [0x1004a258]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
push eax
push 2
mov dword [ebp - 4], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x100062f9
lea eax, [ebp - 0x254]
push eax
push esi
mov dword [ebp - 0x254], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x10006330
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
cmp dword [ebp - 0x14], 8
jb 0x1000630c
push dword [ebp - 0x28]
call fcn.1000c900
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000eb31
mov esp, ebp
pop ebp
ret
cmp word [ebp - 0x230], 0
jne 0x1000633e
xor eax, eax
jmp 0x10006356
lea eax, [ebp - 0x230]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10006347
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x28]
call fcn.100092e0
lea eax, [ebp - 0x28]
push eax
mov ecx, edi
call fcn.1000b160
lea eax, [ebp - 0x254]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x10006330
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
jmp 0x100062fb

Function at 0x100064b0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.USER32.dll_EnumWindows]
push esi
push edi
mov edi, dword [ebp + 8]
mov byte [0x1004c540], 0
xor esi, esi
inc esi
cmp esi, 0x1e
jg 0x100064f0
push edi
push 0x10005250
call ebx
cmp byte [0x1004c540], 0
jne 0x100064f0
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x1004c540], 0
je 0x100064c8
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10006500
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x1004a258]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0x194]
push eax
push 0x101
mov edi, ecx
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [edi + 0x78], eax
cmp eax, 0xffffffff
je 0x10006594
push esi
lea esi, [edi + 0x40c0]
mov eax, 2
push str.127.0.0.1
mov word [esi], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [edi + 0x40c4], eax
mov eax, 0xcee
add ax, word [edi + 0x4170]
movzx eax, ax
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [edi + 0x40c2], ax
push 0x10
push esi
push dword [edi + 0x78]
call dword [sym.imp.WS2_32.dll_connect]
pop esi
cmp eax, 0xffffffff
jne 0x100065ab
push dword [edi + 0x78]
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000eb31
mov esp, ebp
pop ebp
ret
mov ecx, edi
call fcn.10006d80
test al, al
je 0x100065c8
push 0
push 4
push str.PING
push dword [edi + 0x78]
call dword [sym.imp.WS2_32.dll_send]
mov ecx, edi
call fcn.1000b250
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov al, 1
pop edi
call fcn.1000eb31
mov esp, ebp
pop ebp
ret
Function at 0x10006a20
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003a8f0
mov eax, dword fs:[0]
push eax
sub esp, 0x260
mov eax, dword [0x1004a258]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
push str.QueryFullProcessImageNameW
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [edi + 0x40d0]
lea esi, [edi + 0x40d0]
push dword [ecx + 4]
mov ecx, esi
call fcn.100083c0
mov eax, dword [esi]
mov dword [ebp - 0x2c], 7
mov dword [eax + 4], eax
mov eax, dword [esi]
mov dword [ebp - 0x30], 0
mov dword [eax], eax
mov eax, dword [esi]
mov dword [eax + 8], eax
xor eax, eax
mov dword [esi + 4], 0
mov dword [ebp - 0x26c], 0x22c
mov word [ebp - 0x40], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], eax
mov word [ebp - 0x28], ax
push eax
push 2
mov byte [ebp - 4], 1
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [ebp - 0x26c]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
cmp eax, 1
jne 0x10006b1f
lea eax, [ebp - 0x26c]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
jne 0x10006b1f
jmp 0x10006b00
push dword [ebp - 0x264]
mov ecx, edi
call fcn.100050b0
lea eax, [ebp - 0x26c]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
je 0x10006b00
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000eb31
mov esp, ebp
pop ebp
ret

Function at 0x10006d80
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
push esi
push edi
mov edi, ecx
push dword [edi + 0x78]
call dword [sym.imp.WS2_32.dll_closesocket]
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [edi + 0x78], eax
lea esi, [edi + 0x40c0]
mov eax, 2
push str.127.0.0.1
mov word [esi], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [edi + 0x40c4], eax
mov eax, 0xcee
add ax, word [edi + 0x4170]
movzx eax, ax
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [edi + 0x40c2], ax
push 0x10
push esi
push dword [edi + 0x78]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
pop edi
setne al
pop esi
ret
Function at 0x10007600
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003a9b8
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x1004a258]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 8]
sub esp, 0x18
mov ecx, esp
xor eax, eax
push 0xffffffffffffffff
push eax
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push edi
mov word [ecx], ax
call fcn.100091c0
lea eax, [ebp - 0x40]
push eax
call fcn.1000bae0
add esp, 0x1c
mov esi, eax
push 5
push str.SCAN
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.100090c0
push esi
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x58]
push eax
mov byte [ebp - 4], 1
call fcn.10001070
add esp, 0xc
cmp dword [ebp - 0x14], 0x10
jb 0x100076ad
push dword [ebp - 0x28]
call fcn.1000c900
add esp, 4
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
cmp dword [ebp - 0x2c], 0x10
mov byte [ebp - 4], 4
jb 0x100076d4
push dword [ebp - 0x40]
call fcn.1000c900
add esp, 4
cmp dword [edi + 0x14], 8
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x40], 0
jb 0x100076f0
mov eax, dword [edi]
jmp 0x100076f2
mov eax, edi
push 0
push 0x80
push 3
push 0
push 1
push connect
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x10007785
lea eax, [ebp - 0x5c]
push eax
push esi
mov dword [ebp - 0x5c], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x80000
ja 0x10007766
cmp dword [ebp - 0x5c], 0
jne 0x10007766
cmp dword [ebp - 0x44], 0x10
lea eax, [ebp - 0x58]
cmovae eax, dword [ebp - 0x58]
push eax
mov ecx, ebx
call fcn.1000b970
test al, al
je 0x1000777c
mov ecx, ebx
mov byte [ebx + 0x415c], 1
call fcn.1000b250
push esi
mov byte [ebx + 0x415c], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000779b
push 4
push str.:_OK
mov ecx, edi
call fcn.10008e60
push edi
mov ecx, ebx
call fcn.100077d0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000779b
push 4
push str.:_OK
mov ecx, edi
call fcn.10008e60
push edi
mov ecx, ebx
call fcn.100077d0
cmp dword [ebp - 0x44], 0x10
jb 0x100077ac
push dword [ebp - 0x58]
call fcn.1000c900
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000eb31
mov esp, ebp
pop ebp
ret 4
Function at 0x100079d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov ebx, ecx
push 0x44
lea eax, [ebx + 0x40e0]
push 0
push eax
mov dword [ebp - 0xc], ebx
call fcn.1000f6b0
push 0x1006a88c
call fcn.1000c6b6
add esp, 0x10
test eax, eax
je 0x10007a08
push eax
call fcn.1000c717
add esp, 4
lea ecx, [ebx + 0x407c]
mov byte [ebx + 0x40dd], 0
mov byte [ebx + 0x40da], 0
mov byte [ebx + 0x29], 0
call fcn.100089e0
push dword [ebp + 8]
lea eax, [ebp - 1]
push eax
mov dword [ebx + 0x40a4], 0
mov dword [ebx + 0x416c], 0
push dword [ebx + 0x4134]
push dword [ebx + 0x4130]
call fcn.10001610
mov eax, dword [ebx + 0x4130]
push dword [ebp + 8]
mov dword [ebx + 0x4134], eax
lea esi, [ebx + 0x413c]
lea eax, [ebp - 1]
push eax
push dword [esi + 4]
mov dword [ebp - 8], esi
push dword [esi]
call fcn.10001610
mov eax, dword [esi]
mov dword [esi + 4], eax
mov esi, dword [ebp + 8]
mov byte [ebx + 0x40dc], 1
mov ebx, dword [esi]
mov ecx, dword [esi + 4]
sub ecx, ebx
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add esp, 0x20
xor edi, edi
add eax, edx
je 0x10007ad9
xor esi, esi
mov ecx, dword [ebp - 8]
lea eax, [esi + ebx]
push eax
call fcn.1000b160
mov eax, dword [ebp + 8]
inc edi
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
sub ecx, ebx
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea esi, [esi + 0x18]
cmp edi, ecx
jb 0x10007aa7
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 4]
sub ecx, dword [esi]
mov esi, dword [ebp - 0xc]
mov eax, 0x2aaaaaab
imul ecx
push 0
push 0
sar edx, 2
push esi
mov eax, edx
push 0x10009bf0
shr eax, 0x1f
add eax, edx
push 0
push 0
mov dword [esi + 0x40fc], eax
call fcn.1000e0e3
push 0x1006a88c
mov dword [esi + 0x416c], eax
call fcn.1000c6c7
add esp, 0x1c
pop edi
pop esi
pop ebx
test eax, eax
je 0x10007b2e
push eax
call fcn.1000c717
add esp, 4
mov esp, ebp
pop ebp
ret 4
Function at 0x10007b40
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov esi, ecx
push 0x44
lea eax, [esi + 0x40e0]
push 0
push eax
mov dword [ebp - 0xc], esi
call fcn.1000f6b0
push 0x1006a88c
call fcn.1000c6b6
add esp, 0x10
test eax, eax
je 0x10007b78
push eax
call fcn.1000c717
add esp, 4
lea ecx, [esi + 0x407c]
mov byte [esi + 0x40dd], 0
mov byte [esi + 0x40da], 0
mov byte [esi + 0x29], 0
call fcn.100089e0
push dword [ebp + 8]
lea ebx, [esi + 0x4130]
lea eax, [ebp - 1]
push eax
mov dword [esi + 0x40a4], 0
mov dword [esi + 0x416c], 0
push dword [ebx + 4]
mov dword [ebp - 8], ebx
push dword [ebx]
call fcn.10001610
mov eax, dword [ebx]
push dword [ebp + 8]
mov dword [ebx + 4], eax
lea eax, [ebp - 1]
push eax
push dword [esi + 0x4140]
push dword [esi + 0x413c]
call fcn.10001610
mov eax, dword [esi + 0x413c]
mov ecx, dword [ebp + 8]
mov dword [esi + 0x4140], eax
mov byte [esi + 0x40dc], 1
mov ebx, dword [ecx]
mov ecx, dword [ecx + 4]
sub ecx, ebx
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add esp, 0x20
xor edi, edi
add eax, edx
je 0x10007c49
xor esi, esi
mov ecx, dword [ebp - 8]
lea eax, [esi + ebx]
push eax
call fcn.1000b160
mov eax, dword [ebp + 8]
inc edi
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
sub ecx, ebx
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea esi, [esi + 0x18]
cmp edi, eax
jb 0x10007c17
mov esi, dword [ebp - 0xc]
push 0
push 0
push esi
push 0x10009bf0
push 0
push 0
call fcn.1000e0e3
push 0x1006a88c
mov dword [esi + 0x416c], eax
call fcn.1000c6c7
add esp, 0x1c
pop edi
pop esi
pop ebx
test eax, eax
je 0x10007c7f
push eax
call fcn.1000c717
add esp, 4
mov esp, ebp
pop ebp
ret 4

Function at 0x10007eb0
Capabilities:
Check if file exists
Check mutex on windows
Create thread

Disassembly:
cmp byte [0x1004c542], 0
push esi
mov esi, ecx
je 0x10007f39
push str.UpdTm
push 0x5a0
call fcn.100041f0
test eax, eax
je 0x10007f39
push 0x5a0
mov ecx, esi
call fcn.100048d0
test eax, eax
je 0x10007f39
push str.GlobalPCAProMutex
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
je 0x10007efe
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x10007f39
cmp dword [0x1004c54c], 0
je 0x10007f1e
mov eax, dword [0x1004c54c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push esi
push 0x1000a380
push 0
push 0
call fcn.1000e0e3
add esp, 0x18
mov dword [0x1004c54c], eax
pop esi
ret
Function at 0x10008000
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x10008015
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10008054
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x10008050
lea ebx, [ebx]
cmp esi, edx
jae 0x10008054
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x10008040
cmp esi, edx
jb 0x10008059
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret
Function at 0x1000b970
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
call fcn.10006d80
test al, al
jne 0x1000b984
pop esi
pop ebp
ret 4
mov edx, dword [ebp + 8]
mov eax, edx
push edi
lea edi, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000b990
push 0
sub eax, edi
push eax
push edx
push dword [esi + 0x78]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
pop edi
setne al
pop esi
pop ebp
ret 4