joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10024aae
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x10024ad1
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x10024ad1
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x10024adb
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x10024b1d
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x10024b7f
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x10024b7a
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x10024b65
test dl, dl
je 0x10024b61
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x10024b65
add ecx, 2
add eax, 2
test dl, dl
jne 0x10024b45
xor eax, eax
jmp 0x10024b6a
sbb eax, eax
or eax, 1
test eax, eax
je 0x10024b8b
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x10024b32
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8

Function at 0x100287ff
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0x80000301
push 0
push 0x3e8
push 1
mov ebx, 0x1bc
call fcn.10031ad0
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x1002884b
push ebx
call fcn.10030ff3
add esp, 4
pop eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
call fcn.10001198
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push dword [ebp - 0xc]
push 0x101
xor eax, eax
call dword [sym.imp.WS2_32.dll_WSAStartup]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x1002888c
push 0xe5
push 0x401117e
push 6
call fcn.10030fe1
add esp, 0xc
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x1002889f
push ebx
call fcn.10030ff3
add esp, 4
mov esp, ebp
pop ebp
ret 4
Function at 0x1002cd91
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [esi]
mov edx, dword [esi + 4]
bswap eax
bswap edx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], esp
mov esp, dword [ebp + 0xc]
mov edi, dword [ebp - 4]
xor eax, dword [ecx + edi*4]
mov edi, eax
mov esi, eax
shr edi, 0x18
shr esi, 0x10
and esi, 0xff
mov ebx, dword [esp + edi*4]
add ebx, dword [esp + esi*4 + 0x400]
movzx edi, ah
movzx esi, al
xor ebx, dword [esp + edi*4 + 0x800]
add ebx, dword [esp + esi*4 + 0xc00]
xor ebx, edx
inc dword [ebp - 4]
mov edx, eax
cmp dword [ebp - 4], 0x10
mov eax, ebx
jne 0x1002cdb4
mov esp, dword [ebp - 8]
xchg edx, eax
xor edx, dword [ecx + 0x40]
xor eax, dword [ecx + 0x44]
mov esi, dword [ebp + 8]
bswap eax
bswap edx
mov dword [esi], eax
mov dword [esi + 4], edx
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x1002ce8c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [esi]
mov edx, dword [esi + 4]
bswap eax
bswap edx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], esp
mov esp, dword [ebp + 0xc]
mov edi, dword [ebp - 4]
xor eax, dword [ecx + edi*4]
mov edi, eax
mov esi, eax
shr edi, 0x18
shr esi, 0x10
and esi, 0xff
mov ebx, dword [esp + edi*4]
add ebx, dword [esp + esi*4 + 0x400]
movzx edi, ah
movzx esi, al
xor ebx, dword [esp + edi*4 + 0x800]
add ebx, dword [esp + esi*4 + 0xc00]
xor ebx, edx
inc dword [ebp - 4]
mov edx, eax
cmp dword [ebp - 4], 0x10
mov eax, ebx
jne 0x1002ceaf
mov esp, dword [ebp - 8]
xchg edx, eax
xor edx, dword [ecx + 0x40]
xor eax, dword [ecx + 0x44]
mov esi, dword [ebp + 8]
bswap eax
bswap edx
mov dword [esi], eax
mov dword [esi + 4], edx
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x1002d068
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [esi]
mov edx, dword [esi + 4]
bswap eax
bswap edx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], esp
mov esp, dword [ebp + 0xc]
mov edi, dword [ebp - 4]
xor eax, dword [ecx + edi*4]
mov edi, eax
mov esi, eax
shr edi, 0x18
shr esi, 0x10
and esi, 0xff
mov ebx, dword [esp + edi*4]
add ebx, dword [esp + esi*4 + 0x400]
movzx edi, ah
movzx esi, al
xor ebx, dword [esp + edi*4 + 0x800]
add ebx, dword [esp + esi*4 + 0xc00]
xor ebx, edx
inc dword [ebp - 4]
mov edx, eax
cmp dword [ebp - 4], 0x10
mov eax, ebx
jne 0x1002d08b
mov esp, dword [ebp - 8]
xchg edx, eax
xor edx, dword [ecx + 0x40]
xor eax, dword [ecx + 0x44]
mov esi, dword [ebp + 8]
bswap eax
bswap edx
mov dword [esi], eax
mov dword [esi + 4], edx
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x100301bc
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0x80000301
push 0
push 0x20
push 1
mov ebx, 0x1bc
call fcn.10031ad0
add esp, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x1003021d
push ebx
call fcn.10030ff3
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
call fcn.10001198
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp + 8]
push dword [ebx]
xor eax, eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
adc dword [eax - 0xf9ac670], edx
je 0x1003025b
push 0xc9
push 0x4011287
push 6
call fcn.10030fe1
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10030394
push edi
push edx
push esi
mov eax, dword [ebp - 8]
movsx ecx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
mov edx, ecx
mov edi, dword [ebp - 4]
mov esi, dword [eax]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
pop edx
pop edi
push 0x80000301
push 0
push 4
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0x910
call fcn.100337a0
add esp, 0x1c
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0x80000301
push 0
push 3
push htons
push 0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x100302ea
mov eax, 0x1003c230
push eax
push 3
mov ebx, 0x19c
call fcn.10032d00
add esp, 0x28
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], ecx
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x10030316
push ebx
call fcn.10030ff3
add esp, 4
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
cmp ecx, 0x80000101
jne 0x1003032e
and eax, 0xff
jmp 0x10030383
cmp ecx, 0x80000201
jne 0x10030339
cwde
jmp 0x10030383
cmp ecx, 0x80000301
je 0x10030383
cmp ecx, 0x80000401
je 0x10030383
mov dword [ebp - 0x24], eax
cmp ecx, 0x80000501
je 0x10030373
cmp ecx, 0x80000601
je 0x10030378
push 0x366
push 0x4011287
push 2
call fcn.10030fe1
add esp, 0xc
fld dword [ebp - 0x24]
jmp 0x1003037e
mov dword [ebp - 0x20], edx
fld qword [ebp - 0x24]
call fcn.10001dcf
push eax
call fcn.100303b6
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
jmp 0x1003039e
mov eax, 0x1003c211
jmp 0x1003039e
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x100303af
push ebx
call fcn.10030ff3
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4

Function at 0x10033ed0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x10033eee
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x10033ee3
pop esi
ret
Function at 0x10034540
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push edi
push 0
push 0x20
push 3
push 0
push 3
push connect
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x100345a9
push ebx
lea ecx, [esp + 0x10]
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea edx, [ebx + 8]
push edx
call fcn.10031870
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esi + 8]
push ebx
push ecx
push edi
mov dword [esi], 1
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
pop edi
ret
Function at 0x10034f20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, edx
push esi
push edi
mov esi, ebp
xor edi, edi
and esi, 3
mov eax, ecx
jle 0x10034f41
mov dl, byte [eax]
inc eax
cmp dl, bl
je 0x10034f9b
inc edi
cmp edi, esi
jl 0x10034f35
mov edi, ebx
and edi, 0xff
mov esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
lea edi, [ecx + ebp]
cmp eax, edi
jae 0x10034fd0
mov edx, dword [eax]
xor edx, esi
lea ebp, [edx - 0x1010101]
not edx
and ebp, edx
test ebp, 0x80808080
je 0x10034f8a
cmp byte [eax], bl
je 0x10034fa5
cmp byte [eax + 1], bl
je 0x10034fae
cmp byte [eax + 2], bl
je 0x10034fb8
cmp byte [eax + 3], bl
je 0x10034fc4
add eax, 4
cmp eax, edi
jb 0x10034f61
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
dec eax
pop ebx
ret 4
pop edi
pop esi
pop ebp
sub eax, ecx
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
inc eax
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 2
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 3
pop ebx
ret 4
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4

Function at 0x100375a0
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x1003e3f4]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x100375b3
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x100375f4
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x1003e49c]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x10037626
mov bl, byte [esp + ecx + 0x4c]
jmp 0x1003762a
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x1003761b
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x10037648
mov bl, byte [esp + ecx + 0x4c]
jmp 0x1003764c
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x1003763d
xor ecx, ecx
mov eax, 0x1003e404
xor ebx, ebx
mov bl, byte [ecx + 0x1003e4ac]
cmp byte [esp + ebx + 0x14], 0
je 0x10037677
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x1003e4c4]
cmp byte [esp + ebx + 0x14], 0
je 0x1003768e
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x1003765e
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x100375e7
lea edx, [esp + 0x84]
push edx
call fcn.100376d0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x1004f3db
Capabilities:
Delete service

Disassembly:
mov dword [esp + 0xc], esi
not word [esp + 4]
bswap ecx
cmp ecx, 0x484744c5
push ebx
lea eax, [eax + ecx + 0x354dbfd9]
mov ebx, dword [esp + 0x10]
lea ecx, [ebx*4 + 0x1d14225d]
push edi
xchg dword [esp + 0x2c], eax
jl 0x10707a83
xor dword [esp + 0x10], 0x58fa3bdc
xor ebx, esi
mov esi, dword [esp + 0x2c]
neg ecx
sete byte [esp]
cmp dword [esp + 4], 0x1afe46b1
call fcn.105b5962
inc eax
xor ebx, eax
add ebp, eax
jmp 0x1041fd62
push ebp
ret
test byte [esp + 0xc], 0xc9
push 0x19f34bcc
jne 0x103073d3

Function at 0x10050d4e
Capabilities:
Check for software breakpoints

Disassembly:
jae 0x10474e83
jne 0x10423a26
mov eax, dword [ebp]
jmp 0x10198c1b
call eax
mov ebp, dword [ebp - 4]
sal si, 0x2a
cwd
xchg dh, bl
mov dword [ebp], eax
sar dl, cl
sbb bx, sp
neg bl
mov edi, ebp
add bl, 0x43
pop ebx
btc dx, 0x8f
jmp 0x102f36b1
not edx
add edx, 0x3904970
cmp sp, ax
xor ebx, edx
stc
cmp di, ax
add ebp, edx
jmp ebp
pop ebp
bts edx, ecx
bt edx, 0x6d
bswap esi
pop esi
bsr edx, ecx
neg dh
mov edx, dword [esi]
add esi, 4
xor edx, ebx
clc
rol edx, 3
test ebp, esi
neg edx
cmp esi, 0x3bf83a92
test al, 0x9b
xor edx, 0x12d43d6
inc edx
test cl, 0x83
jmp 0x102bd100
mov eax, dword [ebp + ebx*4]
cmc
cmp edx, ebx
push eax
cmp cl, 0xcc
sub ebx, 1
jmp 0x10050d54
push dword [esp + 0x10]
popfd
lea esp, [esp + 0x14]
call fcn.1049af8c
Function at 0x10053bf0
Capabilities:
Contain obfuscated stackstrings
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 0x48
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 0x10]
cmp ebx, esi
je 0x10053d52
cmp edi, esi
je 0x10053d52
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
add eax, edi
mov dword [ebp - 0x48], 0x44434241
mov dword [ebp - 0x44], 0x48474645
mov dword [ebp - 0x40], 0x4c4b4a49
mov dword [ebp - 0x3c], 0x504f4e4d
mov dword [ebp - 0x38], 0x54535251
mov dword [ebp - 0x34], 0x58575655
mov dword [ebp - 0x30], 0x62615a59
mov dword [ebp - 0x2c], 0x66656463
mov dword [ebp - 0x28], 0x6a696867
mov dword [ebp - 0x24], 0x6e6d6c6b
mov dword [ebp - 0x20], 0x7271706f
mov dword [ebp - 0x1c], 0x76757473
mov dword [ebp - 0x18], 0x7a797877
mov dword [ebp - 0x14], 0x33323130
mov dword [ebp - 0x10], 0x37363534
mov dword [ebp - 0xc], 0x2f2b3938
mov dword [ebp - 4], esi
mov ecx, edi
mov dword [ebp - 8], eax
cmp edx, esi
jbe 0x10053d42
add edi, 4
jmp 0x10053ca3
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x10053cb8
mov dword [ebp - 4], 2
jmp 0x10053cd9
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x10053ccf
mov dword [ebp - 4], 1
jmp 0x10053cd9
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x10053d52
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x48]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x48]
mov byte [ecx + 1], bl
mov ebx, dword [ebp - 4]
cmp ebx, 1
jbe 0x10053d10
mov byte [ecx + 2], 0x3d
jmp 0x10053d1d
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x48]
mov byte [ecx + 2], al
add ecx, 3
add edi, 3
test ebx, ebx
je 0x10053d2c
mov byte [ecx], 0x3d
jmp 0x10053d32
mov dl, byte [ebp + edx - 0x48]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x10053ca0
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
sub ecx, edi
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x101700bf
Capabilities:
Encode data using xor

Disassembly:
mov word [esp + 0x20], 0x6e3f
setle byte [esp + 0x20]
test dword [esp + 0x20], 0xaf37353
push dword [esp + 0x24]
popfd
lea esp, [esp + 0x2c]
ret 4
pop esi
insd dword es:[edi], dx
rcl dword [0xd01a1694], cl
pushal
mov ss, word [esi + 0x4590a543]
lahf
xor dword [ecx - 0x2bc2e6ec], ebp
fisubr dword [ebp + 0xf]
jge 0x105c451e
push ss
jge 0x105c451e
push ss
cli
jb 0x1017011d
pushfd
jno 0x10170142
insd dword es:[edi], dx
retf
push esi
jae 0x101700a7
in eax, dx
sbb byte [edx - 0x43feb67f], bh
push edi
in eax, 0x20
imul eax, dword [eax + 0x25e1c9bb], 0x16e091a3
lodsd eax, dword [esi]
cmp ch, dl
push es
xchg ebp, eax
das
shl cl, 1
add eax, 0x56fac06f
in al, dx
loope 0x101701a2
sbb byte [edx - 0x2d], bl
mov ah, byte [ecx]
div byte [edx - 0x35c490eb]
psubw mm3, qword [ecx]
stosd dword es:[edi], eax
idiv ch
idiv byte [edi - 0x1ee0e007]
jp 0x101700c6
adc eax, 0xfca3b6f
stc
sbb dword [ebx - 0x4009020a], ebp
stc
pop ds
pop ds
loope 0x101701b7
mov byte [ecx + edi*8 - 0x6e], dh
je 0x10170139
xchg edx, eax
test eax, 0x3fd596c4
loopne 0x10170153
les edx, [esi + 0xbe03fd5]
popal
sbb al, byte [ecx + 0x8f2f276]
push ds
pop esp
sahf
stosd dword es:[edi], eax
mov ebx, 0xb4633daa
imul ecx, dword [eax + esi*4], 0x6de854e
push esi
push ss
in eax, 0x48
jp 0x101700fe
imul ecx, dword [ecx + 0x45], 0x73
and dword [ecx - 0x68bcf8ff], eax
push es
or dword [ebx - 2], 0x7344086b
adc dword [esi - 0x5d9e9077], edx
inc esp
loop 0x101701e2
je 0x1017012c
sbb dword [esi - 0x1461ce6], eax
jecxz 0x10170207
rcl cl, cl
cwde
retf
imul edx, dword [ecx], 0xb9c44d00
dec edx
lodsd eax, dword [esi]
mov esp, 0x3a1ed403
xchg edi, eax
pop ecx
pop esi
lodsd eax, dword [esi]
xchg edx, eax
insd dword es:[edi], dx
mov edx, 0x4edf0283
add bl, bh
dec esi
jno 0x101701bd
pop es
xchg esi, eax
xchg ebx, eax
or eax, 0x91fef120
scasd eax, dword es:[edi]
pop ecx
mov al, byte fs:[0xb9ae5c85]
out dx, al
xchg edi, eax
dec esi
invalid
mov eax, 0x802250f2
iretd
mov dl, 0xbe
invalid
mov ebp, dword [esp + 8]
jno 0x1004fad0
call fcn.1028cb57
add esi, ecx
jmp 0x1068705d
jmp fcn.1064a544

Function at 0x101cace5
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
call fcn.1065efa1
mov esp, ebp
and edi, edx
movsx eax, cx
sub edx, 0x432c791a
pop ecx
bswap edx
rdtsc
pop edi
rol eax, cl
xchg bh, dh
pop ebx
btc dx, bp
pop eax
or ebp, 0x5335798
rol ebp, 0xb7
btc esi, 0x11
pop esi
jmp 0x106e4f80
pop edx
bsf ebp, ecx
bts ebp, edx
add ebp, ecx
popfd
mov ebp, 0x33f8252e
pop ebp
jmp fcn.1002f575

Function at 0x1023b25f
Capabilities:
Check for software breakpoints

Disassembly:
push dword [esp + 0x10]
popfd
lea esp, [esp + 0x20]
call fcn.107d8211
pushfd
mov dword [esp], 0xddea1b82
push edi
mov edi, 0x7b702072
pushfd
sub edi, edi
push edi
cmp dword [esp], 0x345e46b6
mov edi, dword [esp + 8]
call fcn.10018ea4
Function at 0x102cac2b
Capabilities:
Encode data using xor

Disassembly:
test edi, 0xc581559a
or byte [eax], al
add byte [eax], al
mov dword [eax], ecx
sar eax, cl
sub esi, 4
mov eax, dword [esi]
cmp ecx, esi
cmc
xor eax, ebx
jmp 0x1038deaf
xor cl, byte [eax + eax]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x14], 0xf96a318a
push ecx
lea ebp, [ebp*4 + 0x553d781f]
jl 0x10505db4
mov ebp, dword [esp + 0x10]
mov ecx, 0x2bde5124
and al, 0x51
fisubr word [ebx]
setl cl
call fcn.100db91b
in al, dx
stosb byte es:[edi], al
insb byte es:[edi], dx
add dword [edi - 0x112813c], ebx
push es
jb 0x102cac83
loope 0x102cac0b
cmp dword [ecx], esp
je 0x102cac4a
loope 0x102cace3
jns 0x102cac68
std
mov eax, dword [ecx + 1]
cmpsd dword [esi], dword es:[edi]
mov al, 0xa1
popfd
invalid
add dword [edi - 0x1625e50], esp
mov esi, 0x1986814
pop ebx
jne 0x102cac88
test byte [esi], bl
xchg byte [esp + ebp + 0x24f3fe98], ah
xor ebp, dword [esi - 0x1f]
mov al, byte [0xe17ce17a]
invalid
and al, 0x33
and al, 0x33
outsb dx, byte [esi]
loope 0x102cac28
jp 0x102cac6b
jl 0x102cac6d
popal
mov ch, 0xae
xchg ecx, eax
add dword [edi - 0x115fa7c], ebx
mov gs, word [esi + 9]
daa
loope 0x102cac82
inc ecx
pop edx
jae 0x102cac81
loope 0x102cace7
invalid
add dword [esi + 0x3d3018e], eax
rol dword [ebx], cl
pop ebp
and byte [edi], bl
push esp
ret
dec eax
jmp 0x1055ae6f
xor eax, 0x93b00df
bswap eax
jmp 0x10745bfb
jmp edi
rol eax, 3
inc eax
clc
xor ebx, eax
add edi, eax
jmp 0x105e1063

Function at 0x102f47d7
Capabilities:
Encode data using xor

Disassembly:
dec ecx
jmp 0x106e1207
xor dword [esp + 8], 0x1085741b
sete byte [esp + 8]
jo fcn.102f47d7
push dword [esp + 0x14]
popfd
lea esp, [esp + 0x2c]
call fcn.102cfe90
inc ecx
ror ecx, 2
jmp 0x10244f74
jmp fcn.1041d716
xor ebx, ecx
test edx, esp
add edi, ecx
jmp 0x106b3b5d
Function at 0x102f6f65
Capabilities:
Encode data using xor

Disassembly:
inc ecx
inc esi
inc ebp
test ah, dh
clc
dec eax
test edi, 0x4b384946
inc ecx
xor esi, 0x522803f6
inc ebp
cmp cl, ah
inc ecx
push ebx
inc esp
xor dword [esp], esi
inc ecx
pop ebx
cmc
clc
dec ebp
arpl si, si
clc
cmc
dec ecx
add esi, esi
jmp 0x10141110
jmp fcn.1039c27c
inc ecx
bswap esi
jmp 0x10110f74
or bl, bl
or ebx, 0x3ef034dd
mov ebx, 0x4570276a
setns bl
mov dword [esp + 0x10], ebx
neg dword [esp + 0x10]
mov dword [esp + ebx - 0x457026e8], ebp
cmp byte [esp + 0x10], bh
movzx ebx, word [esp + 0x10]
push ecx
jno 0x103d36ea
dec ecx
mov ecx, ebp
inc esp
cmp al, ah
inc ecx
xor dh, 0
inc ecx
btc esi, edi
dec ecx
sub ebp, 4
inc ecx
mov dword [ebp], ecx
inc bp
xchg esi, esi
dec ebp
shrd esi, ecx, 2
inc ecx
cmp ah, 0x6a
dec ecx
sub edi, 4
inc cx
add esi, 0x8b454a35
aaa
stc
clc
inc ebp
xor esi, ebx
inc esp
cmp bl, al
inc ecx
xor esi, 0x20e03826
jmp 0x1021912f
jge 0x106c038f
mov bx, word [esp + 0x16]
mov bl, 0x62
and bl, byte [esp + 0x17]
add dword [esp + 4], 0x3b60d4
mov ebp, dword [esp + 0x14]
call fcn.1059bbe9
pushfd
call fcn.1071081e
add byte [eax + ebp*8 + 0x33d10c], bl
dec ebx
inc ecx
lahf
sub esp, 0xffffffc5
sbb cl, 0xce
add bh, byte [esi + 0x4a]
sbb al, 0x79
stc
jge 0x103d3778
wait
js 0x103d3780
jl 0x103d3766
dec ebp
sbb byte [ebx], 0x3c
xlatb
aaa
jb 0x103d370b
push edi
jg 0x103d3712
cmp byte [eax], dh
mov dh, 0x5e
xchg esi, eax
mov cl, 0x74
stosd dword es:[edi], eax
insb byte es:[edi], dx
imul edx, ebx, 0x48
xchg ebx, eax
cwde
xchg ecx, eax
invalid
xor bh, byte [eax]
add al, 0xa5
fimul word [ecx]
mov bh, 0x9c
xchg ebx, eax
aam 0xe9
mov esi, fs
adc al, 1
fldcw word [edi + 0x26ad6722]
and eax, 0x56c2ab00
lodsd eax, dword [si]
and eax, 0x56c2ab00
invalid
not edx
setno dl
mov dword [esp + 4], 0x2ffb66e0
cmovl dx, word [esp + 6]
call fcn.100ec9de
jmp edi

Function at 0x103660c0
Capabilities:
Encode data using xor

Disassembly:
jns 0x10312516
add dword [esp + 0x24], 0x30f57e14
mov bp, 0x595e
mov word [esp + 0x40], 0x10bc
mov ebp, dword [esp + 0x28]
jo 0x104805bf
neg dword [esp + 0x40]
add dword [esp + 0x34], 0xef82ba88
add byte [esp + 0x40], 0x7f
neg dword [esp + 0x40]
push dword [esp + 0x3c]
popfd
lea esp, [esp + 0x44]
ret
mov byte [esp + 0x14], 0x8c
not dword [esp + 0x24]
mov edx, dword [esp + 0x1c]
neg word [esp + 0x14]
jbe 0x1019c939
cmp al, byte [edx + 0x24]
mov dh, 0x3f
bound esp, qword [0x3b4910d8]
sbb dword [ecx + 0x399429ee], esp
shr bh, 1
add edi, esp
mov dl, 0xfe
adc dword [edi], ebx
sbb eax, 0x6b113b05
xchg ecx, eax
outsd dx, dword [esi]
xor al, 0x11
cdq
or eax, 0x2c1117c5
std
mov ebx, 0x56e410a7
mov ebp, 0xbe50ee83
jae 0x103660eb
out dx, al
les edi, [ecx]
pop ecx
lcall 0x4213, 0xea763bef
pop ebp
loop 0x1036611e
sbb ecx, esi
jmp 0xf0e2ba07
jmp 0xf0e2ba07

Function at 0x1040852f
Capabilities:
Encode data using xor

Disassembly:
jle 0x10408539
push dword [esp + 0x1c]
popfd
lea esp, [esp + 0x20]
call fcn.106eb0bb
sal ebp, 1
pop edi
cld
invalid