joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001c80
Capabilities:
Copy file
Create process on windows
Delete file

Disassembly:
mov al, byte [ecx + 0x321]
sub esp, 0x54
cmp al, 2
push esi
push edi
jne 0x10001cee
lea esi, [ecx + 4]
lea edi, [ecx + 0x104]
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x10001cae
pop edi
mov al, 1
pop esi
add esp, 0x54
ret
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
lea ecx, [esp + 8]
lea edx, [esp + 0x18]
push ecx
push edx
push 0
push 0
push 0x10
push 0
push 0
push 0
push 0x1001f818
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x10001cee
pop edi
mov al, 2
pop esi
add esp, 0x54
ret
pop edi
xor al, al
pop esi
add esp, 0x54
ret

Function at 0x10002ab0
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [0x100288cc]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x10002acf
push 0
push eax
call esi
mov dword [0x100288cc], 0
mov eax, dword [0x100288c8]
test eax, eax
je 0x10002ae7
push 0
push eax
call esi
mov dword [0x100288c8], 0
pop esi
ret
Function at 0x10002c80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100180af
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov al, 0x34
push ebp
push esi
mov byte [esp + 0x29], al
mov byte [esp + 0x2b], al
mov eax, dword [0x1001e818]
xor esi, esi
push edi
mov dword [esp + 0x20], esi
mov byte [esp + 0x28], 0x61
mov byte [esp + 0x29], 0x6f
mov byte [esp + 0x2a], 0x30
mov byte [esp + 0x2b], 0x32
mov byte [esp + 0x2c], 0x33
mov byte [esp + 0x2e], 0x35
mov dword [esp + 0x24], eax
mov dword [esp + 0x38], 1
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
mov byte [esp + 0x38], 3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov byte [esp + 0x14], al
lea ecx, [esp + 0x10]
mov eax, dword [esp + 0x14]
and eax, 0xff
push eax
push str._1.2x
push ecx
call fcn.1001178c
mov ebp, dword [esp + 0x50]
or ecx, 0xffffffff
mov edi, ebp
xor eax, eax
add esp, 0xc
xor dl, dl
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [esp + 0x18], dl
je 0x10002dbd
push ebx
jmp 0x10002d30
mov dl, byte [esp + 0x48]
mov bl, byte [esi + ebp]
mov cl, byte [esp + 0x18]
add bl, cl
cmp dl, 7
jae 0x10002d46
inc dl
mov byte [esp + 0x48], dl
jmp 0x10002d4b
mov byte [esp + 0x48], 0
mov edx, dword [esp + 0x48]
lea ecx, [esp + 0x10]
and edx, 0xff
xor bl, byte [esp + edx + 0x2c]
mov byte [esp + 0x20], bl
call fcn.10012ac8
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x10]
and eax, 0xff
push eax
push str._1.2x
push ecx
call fcn.1001178c
add esp, 0xc
lea edx, [esp + 0x10]
lea ecx, [esp + 0x14]
push edx
call fcn.10012c6d
mov al, byte [esp + 0x1c]
mov edi, ebp
inc al
or ecx, 0xffffffff
mov byte [esp + 0x1c], al
xor eax, eax
mov esi, dword [esp + 0x1c]
mov byte [esp + 0x18], bl
and esi, 0xff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp esi, ecx
jb 0x10002d2c
pop ebx
mov esi, dword [esp + 0x40]
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call fcn.100128b2
mov dword [esp + 0x20], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x38], 2
call fcn.10012b3d
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], 1
call fcn.10012b3d
lea ecx, [esp + 0x24]
mov byte [esp + 0x38], 0
call fcn.10012b3d
mov ecx, dword [esp + 0x30]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x30
ret
Function at 0x100034a0
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x10018168
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
xor ebx, ebx
push esi
push edi
xor ebp, ebp
mov dword [esp + 0x14], ebx
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x10]
push eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push ecx
push ebp
push 0xf003f
push ebp
push ebp
push ebp
push str.SOFTWAREMicrosoftSystem_ControlFiles
push reloc.WS2_32.dll_bind
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x34], ebp
call edi
cmp eax, ebp
jne 0x100034fd
mov ebx, dword [esp + 0x10]
mov dword [esp + 0x14], ebx
mov edx, dword [esp + 0x30]
lea eax, [esp + 0x18]
and edx, 0xff
push edx
push 0x1001e274
push eax
call fcn.1000a18e
mov ecx, dword [esp + 0x40]
push ecx
call fcn.10011350
lea edx, [esp + 0x20]
push eax
push edx
call fcn.10002c80
mov esi, dword [eax]
add esp, 0x18
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x34]
push eax
push ecx
push ebp
push 0xf003f
push ebp
push ebp
lea edx, [esp + 0x30]
push ebp
push edx
push ebx
mov dword [esp + 0x54], ebp
mov dword [esp + 0x58], ebp
call edi
cmp eax, ebp
jne 0x10003586
lea ecx, [esp + 0x30]
call fcn.10003320
mov ecx, dword [esp + 0x34]
cmp eax, ebp
mov dword [esp + 0x30], ecx
jne 0x10003586
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [esp + 0x30]
inc eax
push eax
push esi
push 1
push ebp
push ebp
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x30]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebp
je 0x10003597
push eax
call esi
lea ecx, [esp + 0x10]
call fcn.10012b3d
cmp ebx, ebp
je 0x100035a7
push ebx
call esi
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x100038d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10018180
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x134
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
call fcn.100037d0
test al, al
jne 0x100039bd
push 0
push 2
mov byte [ebp - 0x11], al
mov dword [ebp - 4], 0
call dword [0x1001f830]
mov esi, eax
lea eax, [ebp - 0x140]
push eax
push esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x140], 0x128
call dword [0x1001f82c]
mov ebx, dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x100039b6
lea ecx, [ebp - 0x140]
push ecx
push esi
call dword [0x1001f828]
mov edx, dword [ebp - 0x138]
mov edi, eax
push edx
push 0
push 1
call ebx
mov esi, eax
test esi, esi
je 0x100039aa
mov eax, dword [ebp + 8]
test eax, eax
je 0x10003990
lea eax, [ebp - 0x11c]
push eax
call fcn.100035c0
add esp, 4
test eax, eax
je 0x100039aa
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x18]
jmp 0x1000393a
mov cl, byte [ebp - 0x11]
mov al, cl
inc cl
mov byte [ebp - 0x11], cl
lea ecx, [ebp - 0x11c]
push ecx
push eax
call fcn.100034a0
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x18]
jmp 0x1000393a
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10004bd0
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebx
mov bl, byte [esp + 8]
push esi
mov esi, dword [esp + 0x10]
cmp bl, 0x12
jne 0x10004bf8
mov ecx, 0x10028650
push edi
mov eax, esi
sub ecx, esi
mov edi, 0x14
mov dl, byte [ecx + eax]
mov byte [eax], dl
inc eax
dec edi
jne 0x10004bee
pop edi
mov eax, dword [0x10028204]
test eax, eax
je 0x10004dbd
mov eax, dword [0x10028838]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp bl, 0x71
jne 0x10004c4f
mov eax, dword [0x10028228]
test eax, eax
je 0x10004db1
mov ecx, 0x100287f4
mov eax, esi
sub ecx, esi
mov esi, 0x3c
mov dl, byte [ecx + eax]
mov byte [eax], dl
inc eax
dec esi
jne 0x10004c31
mov ecx, dword [0x10028838]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop esi
mov eax, 1
pop ebx
ret
cmp bl, 0x72
jne 0x10004c7a
mov eax, dword [0x10028224]
test eax, eax
je 0x10004db1
mov ecx, 0x100287b8
mov eax, esi
sub ecx, esi
mov esi, 0x3c
mov dl, byte [ecx + eax]
mov byte [eax], dl
inc eax
dec esi
jne 0x10004c6f
jmp 0x10004c3a
cmp bl, 0x73
jne 0x10004ca5
mov eax, dword [0x10028220]
test eax, eax
je 0x10004db1
mov ecx, 0x1002877c
mov eax, esi
sub ecx, esi
mov esi, 0x3c
mov dl, byte [ecx + eax]
mov byte [eax], dl
inc eax
dec esi
jne 0x10004c9a
jmp 0x10004c3a
cmp bl, 0x74
jne 0x10004cd3
mov eax, dword [0x1002821c]
test eax, eax
je 0x10004db1
mov ecx, 0x10028740
mov eax, esi
sub ecx, esi
mov esi, 0x3c
mov dl, byte [ecx + eax]
mov byte [eax], dl
inc eax
dec esi
jne 0x10004cc5
jmp 0x10004c3a
cmp bl, 0x75
jne 0x10004d01
mov eax, dword [0x10028218]
test eax, eax
je 0x10004db1
mov ecx, 0x10028704
mov eax, esi
sub ecx, esi
mov esi, 0x3c
mov dl, byte [ecx + eax]
mov byte [eax], dl
inc eax
dec esi
jne 0x10004cf3
jmp 0x10004c3a
cmp bl, 0x76
jne 0x10004d2f
mov eax, dword [0x10028214]
test eax, eax
je 0x10004db1
mov ecx, 0x100286c8
mov eax, esi
sub ecx, esi
mov esi, 0x3c
mov dl, byte [ecx + eax]
mov byte [eax], dl
inc eax
dec esi
jne 0x10004d21
jmp 0x10004c3a
cmp bl, 0x77
jne 0x10004d59
mov eax, dword [0x10028210]
test eax, eax
je 0x10004db1
mov ecx, 0x1002868c
mov eax, esi
sub ecx, esi
mov esi, 0x3c
mov dl, byte [ecx + eax]
mov byte [eax], dl
inc eax
dec esi
jne 0x10004d4b
jmp 0x10004c3a
cmp bl, 0x78
jne 0x10004d83
mov eax, dword [0x10028890]
test eax, eax
je 0x10004db1
mov ecx, 0x100208e4
mov eax, esi
sub ecx, esi
mov esi, 0x1e
mov dl, byte [ecx + eax]
mov byte [eax], dl
inc eax
dec esi
jne 0x10004d75
jmp 0x10004c3a
cmp bl, 0x79
jne 0x10004c3a
mov eax, dword [0x10028894]
test eax, eax
je 0x10004db1
mov ecx, 0x100208c4
mov eax, esi
sub ecx, esi
mov esi, 0x1e
mov dl, byte [ecx + eax]
mov byte [eax], dl
inc eax
dec esi
jne 0x10004da3
jmp 0x10004c3a
mov eax, dword [0x10028838]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop esi
xor eax, eax
pop ebx
ret
Function at 0x10006120
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x20
mov dl, byte [eax + 1]
push esi
test dl, dl
je 0x10006286
mov cl, byte [eax]
test cl, cl
je 0x10006286
mov esi, dword [0x1002889c]
mov byte [esp + 4], 0xa2
test esi, esi
mov byte [esp + 5], 0x13
mov byte [esp + 6], 0x12
mov byte [esp + 7], 0x85
je 0x10006286
mov byte [esp + 8], cl
xor ecx, ecx
mov cl, byte [eax + 3]
mov byte [esp + 9], dl
mov dl, byte [eax + 2]
mov byte [esp + 0xa], cl
xor ecx, ecx
mov byte [esp + 0xb], dl
mov cl, byte [eax + 5]
mov dl, byte [eax + 4]
mov byte [esp + 0xc], cl
mov cl, byte [eax + 6]
mov byte [esp + 0xe], cl
mov cl, byte [0x100281fa]
xor cl, 0xd3
mov byte [esp + 0xd], dl
mov dl, byte [0x100281fb]
mov byte [esp + 0x10], cl
mov cl, byte [eax + 7]
xor dl, 0x3f
cmp cl, 6
mov byte [esp + 0xf], dl
je 0x100061b4
mov byte [eax + 7], 0
mov dl, byte [eax + 7]
xor ecx, ecx
mov cl, byte [eax + 9]
mov byte [esp + 0x11], dl
mov dl, byte [eax + 8]
mov byte [esp + 0x12], cl
xor ecx, ecx
mov byte [esp + 0x13], dl
mov cl, byte [eax + 0xb]
mov dl, byte [eax + 0xa]
mov byte [esp + 0x14], cl
xor ecx, ecx
mov cl, byte [eax + 0xd]
mov byte [esp + 0x15], dl
mov dl, byte [eax + 0xc]
mov byte [esp + 0x16], cl
mov byte [esp + 0x17], dl
mov eax, 4
mov cl, byte [esp + eax + 4]
sub cl, 0x7b
xor cl, 0x6d
mov byte [esp + eax + 4], cl
inc eax
cmp eax, 0x14
jl 0x100061f0
xor cl, cl
mov eax, 3
mov byte [esp + 0x18], cl
mov dl, byte [esp + eax + 4]
add cl, dl
inc eax
cmp eax, 0x14
mov byte [esp + 0x18], cl
jl 0x1000620f
mov edx, dword [0x1001f860]
push edi
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x1001f860]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ecx, 5
lea esi, [esp + 8]
mov edi, 0x10020239
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x1001f860]
movsb byte es:[edi], byte [esi]
push ecx
mov byte [0x10020238], 0x15
mov dword [0x10020234], 1
mov byte [0x10020280], 0xf
mov dword [0x1002027c], 0x3e8
call dword [sym.imp.KERNEL32.dll_SetEvent]
pop edi
mov eax, 1
pop esi
add esp, 0x20
ret
xor eax, eax
pop esi
add esp, 0x20
ret
Function at 0x10006a90
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [0x100288b8]
sub esp, 0x2c
cmp eax, 1
jne 0x10006aeb
mov al, byte [0x100288bd]
xor ecx, ecx
mov cl, al
inc al
push edi
mov byte [0x100288bd], al
push ecx
lea eax, [esp + 0x14]
push str.the_receive_set_commang:__d____
push eax
call fcn.1000a18e
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x14]
push ecx
push 0x14a
push 0xa
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
pop edi
xor edx, edx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 4], edx
mov dword [esp + 8], edx
mov al, 0x13
mov word [esp + 0xc], dx
mov byte [esp + 4], 0xa2
mov byte [esp + 5], al
mov byte [esp + 6], 7
mov byte [esp + 7], al
call esi
mov cl, al
mov dl, al
mov byte [esp + 0xa], al
xor cl, 0x63
xor dl, 0x51
xor al, 0x65
mov byte [esp + 8], cl
mov byte [esp + 9], dl
mov byte [esp + 0xb], al
call esi
shr eax, 8
xor cl, cl
mov byte [esp + 0xc], al
mov byte [esp + 0xd], cl
mov eax, 3
pop esi
mov dl, byte [esp + eax]
add cl, dl
inc eax
cmp eax, 9
mov byte [esp + 9], cl
jl 0x10006b48
mov eax, dword [0x1001f860]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [0x1001f860]
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov edx, dword [esp]
mov eax, dword [esp + 4]
mov cx, word [esp + 8]
mov dword [0x10020299], edx
mov edx, dword [0x1001f860]
mov dword [0x1002029d], eax
push edx
mov word [0x100202a1], cx
mov byte [0x10020298], 0xa
mov dword [0x10020294], 1
mov dword [0x100202dc], 0x3e8
mov byte [0x100202e0], 3
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [0x100288a0], 0
add esp, 0x2c
ret
Function at 0x100072d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov ax, word [esp + 4]
sub esp, 0xc
cmp ax, 0x200
push ebx
push ebp
push esi
push edi
ja 0x1000744f
mov ecx, dword [0x1002889c]
test ecx, ecx
je 0x1000744f
xor ecx, ecx
cmp ax, 0x100
mov dword [esp + 0x10], ecx
mov byte [esp + 0x10], 0xa2
mov dword [esp + 0x14], ecx
mov byte [esp + 0x11], 0x13
mov dword [esp + 0x18], ecx
mov cl, 0x25
mov byte [esp + 0x12], 6
mov byte [esp + 0x13], 0x37
mov byte [esp + 0x14], al
mov byte [esp + 0x15], cl
jbe 0x1000732c
mov cl, 0xed
mov byte [esp + 0x15], cl
mov al, cl
imul cl
mov byte [esp + 0x16], al
imul cl
xor bl, bl
mov byte [esp + 0x17], al
mov byte [esp + 0x18], bl
mov eax, 3
mov cl, byte [esp + eax + 0x10]
add bl, cl
inc eax
cmp eax, 8
mov byte [esp + 0x18], bl
jl 0x10007345
mov edx, dword [0x1001f860]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x1001f860]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [0x1001f860]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov byte [0x1001fe21], bl
mov ebx, 1
push eax
mov dword [0x1001fe19], ecx
mov dword [0x1001fe1d], edx
mov byte [0x1001fe18], 9
mov dword [0x1001fe14], ebx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x10028898], 0
call esi
mov edi, eax
mov al, byte [esp + 0x28]
cmp al, bl
jne 0x1000741d
mov eax, dword [0x10028898]
test eax, eax
jne 0x100073eb
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xa
call ebp
call esi
sub eax, edi
cmp eax, 0x1d4c0
ja 0x1000744f
mov eax, dword [0x10028898]
test eax, eax
je 0x100073d3
movzx cx, byte [0x100208a5]
cmp cx, word [esp + 0x20]
jne 0x1000744f
mov eax, dword [esp + 0x24]
mov ecx, 0x100208a6
sub ecx, eax
mov esi, 0x10
mov dl, byte [ecx + eax]
mov byte [eax], dl
inc eax
dec esi
jne 0x1000740a
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0xc
ret
movzx ax, byte [0x100208a5]
cmp ax, word [esp + 0x20]
jne 0x1000744f
mov eax, dword [esp + 0x24]
mov ecx, 0x100208a6
sub ecx, eax
mov esi, 0x10
mov dl, byte [eax + ecx]
mov byte [eax], dl
inc eax
dec esi
jne 0x1000743c
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0xc
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x10007570
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x40
mov ecx, 7
xor eax, eax
push ebx
push ebp
push edi
lea edi, [esp + 0x2c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 7
xor eax, eax
lea edi, [esp + 0xc]
mov ebp, dword [esp + 0x50]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 7
xor eax, eax
mov edi, ebp
xor bl, bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x2c]
mov dword [0x10028204], 1
push eax
push 0x78
call fcn.10004bd0
add esp, 8
test eax, eax
je 0x1000765d
xor cl, cl
xor edi, edi
xor eax, eax
mov dl, byte [esp + eax + 0x2c]
add cl, dl
inc eax
cmp eax, 0x19
jl 0x100075ce
cmp cl, byte [esp + 0x45]
jne 0x10007655
mov eax, 1
mov cl, byte [esp + 0x43]
mov bl, byte [esp + eax + 0x2c]
sub cl, 0x56
xor bl, cl
mov byte [esp + eax + 0x2c], bl
inc eax
cmp eax, 0x17
jl 0x100075e5
mov edx, dword [esp + 0x2d]
mov ecx, dword [esp + 0x31]
lea eax, [ebp + 1]
push esi
push eax
mov dword [eax], edx
mov dword [eax + 4], ecx
call fcn.100056b0
mov edx, dword [esp + 0x3d]
mov eax, dword [esp + 0x41]
lea esi, [ebp + 9]
push esi
mov dword [esi], edx
mov dword [esi + 4], eax
call fcn.10005760
push 0x1001e4c0
push esi
mov byte [ebp + 0x11], 0
call fcn.1000a6b0
add esp, 0x10
cmp eax, edi
pop esi
je 0x10007643
mov byte [eax], 0
mov cl, byte [esp + 0x41]
mov dl, byte [esp + 0x42]
mov byte [ebp + 0x1c], cl
mov byte [ebp], dl
mov bl, 1
jmp 0x1000765f
mov dword [0x10028890], edi
jmp 0x1000765f
xor edi, edi
lea eax, [esp + 0xc]
mov dword [0x10028204], 1
push eax
push 0x79
call fcn.10004bd0
add esp, 8
test eax, eax
je 0x10007749
xor cl, cl
xor eax, eax
mov dl, byte [esp + eax + 0xc]
add cl, dl
inc eax
cmp eax, 0x19
jl 0x10007684
cmp cl, byte [esp + 0x25]
jne 0x10007743
mov eax, 1
mov cl, byte [esp + 0x23]
mov dl, byte [esp + eax + 0xc]
sub cl, 0x56
xor dl, cl
mov byte [esp + eax + 0xc], dl
inc eax
cmp eax, 0x17
jl 0x1000769f
movzx dx, byte [esp + 0xd]
movzx ax, byte [esp + 0xe]
movzx cx, byte [esp + 0xf]
shl edx, 8
add edx, eax
movzx ax, byte [esp + 0x11]
mov word [ebp + 0x12], dx
movzx dx, byte [esp + 0x10]
shl ecx, 8
add ecx, edx
movzx dx, byte [esp + 0x13]
mov word [ebp + 0x16], cx
movzx cx, byte [esp + 0x12]
shl eax, 8
add eax, ecx
movzx cx, byte [esp + 0x15]
mov word [ebp + 0x14], ax
movzx ax, byte [esp + 0x14]
shl edx, 8
add edx, eax
mov al, byte [ebp]
mov word [ebp + 0x18], dx
movzx dx, byte [esp + 0x16]
shl ecx, 8
add ecx, edx
mov word [ebp + 0x1a], cx
mov cl, byte [esp + 0x22]
cmp al, cl
jne 0x1000772e
shl bl, 1
jmp 0x10007749
mov dword [0x10028890], edi
mov dword [0x10028894], edi
pop edi
pop ebp
xor al, al
pop ebx
add esp, 0x40
ret
mov dword [0x10028894], edi
cmp bl, 2
jne 0x1000775a
mov dword [0x10028890], edi
mov dword [0x10028894], edi
pop edi
mov al, bl
pop ebp
pop ebx
add esp, 0x40
ret
Function at 0x100086b0
Capabilities:
Get socket status
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
mov eax, 0x2104
call fcn.1000a730
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push esi
mov esi, dword [esp + 0x2110]
push edi
mov edi, dword [esp + 0x2118]
push 1
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], edi
mov dword [esp + 0x10], 2
call ebx
push 0
push 0
lea eax, [esp + 0x14]
push 0
push eax
push 5
call sub.WS2_32.dll_select
lea ecx, [esp + 0xc]
push ecx
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x10008739
push 0
lea edx, [esp + 0x114]
push 0x1fff
push edx
push esi
call sub.WS2_32.dll_recv
cmp eax, 0xffffffff
je 0x1000877f
test eax, eax
je 0x1000877f
push 0
push eax
lea eax, [esp + 0x118]
push eax
push edi
call sub.WS2_32.dll_send
test eax, eax
jl 0x1000877f
lea ecx, [esp + 0xc]
push ecx
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x100086d1
push 0
lea edx, [esp + 0x114]
push 0x1fff
push edx
push edi
call sub.WS2_32.dll_recv
cmp eax, 0xffffffff
je 0x1000877f
test eax, eax
je 0x1000877f
push 0
push eax
lea eax, [esp + 0x118]
push eax
push esi
call sub.WS2_32.dll_send
test eax, eax
jge 0x100086d1
push esi
call sub.WS2_32.dll_closesocket
push edi
call sub.WS2_32.dll_closesocket
pop edi
pop esi
pop ebx
add esp, 0x2104
ret

Function at 0x10008ca0
Capabilities:
Create tcp socket
Create thread
Create udp socket
Initialize winsock library
Resume thread

Disassembly:
sub esp, 0x1a4
lea eax, [esp + 0x14]
push esi
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x10008cca
call sub.WS2_32.dll_WSACleanup
or eax, 0xffffffff
pop esi
add esp, 0x1a4
ret
push 0xafa
mov word [esp + 8], 2
mov dword [esp + 0xc], 0
call sub.WS2_32.dll_htons
push 0
push 1
push 2
mov word [esp + 0x12], ax
call sub.WS2_32.dll_socket
mov esi, eax
cmp esi, 0xffffffff
jne 0x10008d0c
call sub.WS2_32.dll_WSACleanup
mov eax, 0xfffffffe
pop esi
add esp, 0x1a4
ret
lea ecx, [esp + 4]
push 0x10
push ecx
push esi
call sub.WS2_32.dll_bind
test eax, eax
je 0x10008d2f
call sub.WS2_32.dll_WSACleanup
mov eax, 0xfffffffd
pop esi
add esp, 0x1a4
ret
push 5
push esi
call sub.WS2_32.dll_listen
test eax, eax
je 0x10008d4d
call sub.WS2_32.dll_WSACleanup
mov eax, 0xfffffffc
pop esi
add esp, 0x1a4
ret
lea edx, [esp + 0x14]
mov dword [0x10028910], esi
push edx
push 4
push 0
push 0x10008960
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xa
push eax
mov dword [0x1002890c], eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x1002890c]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
call fcn.10008c30
mov eax, 1
pop esi
add esp, 0x1a4
ret

Function at 0x10008da0
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [0x10028910]
push eax
call sub.WS2_32.dll_closesocket
mov ecx, dword [0x1002890c]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [0x1002890c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
ret
Function at 0x10009265
Capabilities:
Create thread

Disassembly:
push ecx
lea eax, [esp]
push esi
mov esi, ecx
push eax
push 4
push esi
push 0x10009140
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
mov dword [esi + 0x3f4], eax
test eax, eax
setne cl
mov eax, ecx
pop esi
pop ecx
ret

Function at 0x100093e0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
mov esi, dword [esp + 0x18]
push edi
xor ebx, ebx
lea edi, [esi + 0x3f8]
mov dword [esp + 0x10], ebx
push edi
mov dword [esp + 0x18], ebx
call ebp
mov edx, dword [esi + 0x418]
lea eax, [esp + 0x20]
lea ecx, [esp + 0x10]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ClearCommError]
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [esp + 0x24], ebx
je 0x100094eb
push edi
call ebp
mov edx, dword [esi + 0x418]
lea ebx, [esi + 0x42c]
lea eax, [esp + 0x14]
push ebx
push eax
lea ecx, [esp + 0x24]
push 1
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10009490
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
mov dword [esp + 0x10], eax
je 0x1000946b
push str.ReadFile__
jmp 0x10009489
mov ecx, dword [esi + 0x418]
lea eax, [esp + 0x14]
push 1
push eax
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x10009490
push str.GetOverlappedResults___in_ReadFile__
mov ecx, esi
call fcn.100092b0
mov ebx, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push edi
call ebx
mov al, byte [esp + 0x1c]
xor edx, edx
mov dx, word [esi + 6]
mov byte [edx + esi + 0xa], al
mov ax, word [esi + 6]
cmp ax, 0x3e7
jae 0x100094b8
inc eax
mov word [esi + 6], ax
jmp 0x100094be
mov word [esi + 6], 0
inc word [esi + 8]
push edi
call ebp
mov eax, dword [esi + 0x418]
lea ecx, [esp + 0x20]
lea edx, [esp + 0x10]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ClearCommError]
push edi
call ebx
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x1000942c
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x100095e0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push esi
mov esi, ecx
push eax
push 0x202
mov dword [esi], 0x100194f8
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x10009614
push str._nError_in_Startup_session._n
call fcn.1000a829
add esp, 4
call sub.WS2_32.dll_WSACleanup
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0x30], eax
mov byte [esi + 0x20], 1
mov byte [esi + 0x22], 0
mov eax, esi
pop esi
add esp, 0x190
ret

Function at 0x10009660
Capabilities:
Terminate thread

Disassembly:
mov dword [ecx], 0x100194f8
mov ecx, dword [ecx + 0x28]
test ecx, ecx
je 0x10009676
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
ret