joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e214
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x50856d3
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov ecx, ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41e2c5
add edx, ebx
mov eax, edx
mov esi, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
add edx, ebx
mov dword [ebp - 0x10], edx
mov edi, dword [eax + 0x20]
add edi, ebx
mov edx, dword [eax + 0x24]
add edx, ebx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 4]
cmp edx, 0xffff
jbe 0x41e2ae
test esi, esi
jbe 0x41e2c5
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088dc
test eax, eax
jne 0x41e2a0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41e2c5
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41e27d
jmp 0x41e2c5
mov ecx, edx
sub ecx, dword [eax + 0x10]
cmp ecx, dword [eax + 0x14]
jae 0x41e2c5
mov eax, ecx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50856da
ret
Function at 0x41eb1c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov word [ebp - 2], dx
xor eax, eax
push ebp
push 0x50860cb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x41eb57
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x41eb70
lea eax, [ebp - 0x10]
mov edx, dword [0x509e258]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x41eb83
lea eax, [ebp - 0x10]
mov edx, dword [0x509e258]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x41eb8f
adc edx, 0
mov edx, dword [edx*4 + 0x509d0e8]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x41ec9d
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push edi
push esi
call fcn.00406d6c
test eax, eax
je 0x41ec90
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x41ec90
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406dcc
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x18
push edi
push esi
call fcn.00406d6c
test eax, eax
je 0x41ec90
mov eax, edi
cmp dword [eax], 0x4550
jne 0x41ec90
add eax, 4
mov dx, word [eax]
cmp dx, 0x14c
jb 0x41ec90
cmp dx, 0x150
ja 0x41ec90
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0xe0
push edi
push esi
call fcn.00406d6c
test eax, eax
je 0x41ec90
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 2]
jne 0x41ec90
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x41ecb5
inc ebx
cmp ebx, 0x19
jne 0x41eb49
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50860d2
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x5fc5f0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x184000]
push edi
or ebp, 0xffffffff
jmp 0x5fc612
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5fc619
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5fc608
mov eax, 1
add ebx, ebx
jne 0x5fc62b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5fc63c
jne 0x5fc65b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5fc65b
dec eax
add ebx, ebx
jne 0x5fc648
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5fc620
add ebx, ebx
jne 0x5fc657
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x5fc6ad
xor ecx, ecx
sub eax, 3
jb 0x5fc673
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5fc6e2
sar eax, 1
mov ebp, eax
jmp 0x5fc67e
add ebx, ebx
jne 0x5fc67e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5fc64c
inc ecx
add ebx, ebx
jne 0x5fc68c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5fc64c
add ebx, ebx
jne 0x5fc699
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x5fc68e
jne 0x5fc6aa
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5fc68e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5fc6cc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5fc6be
jmp 0x5fc60e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5fc6cc
add edi, ecx
jmp 0x5fc60e
pop esi
mov edi, esi
mov ecx, 0x6f25
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5fc6ea
cmp byte [edi], 0x1d
jne 0x5fc6ea
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5fc6ef
lea edi, [esi + 0x1e8000]
mov eax, dword [edi]
or eax, eax
je 0x5fc75e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x221b18]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x221b84]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5fc71c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x221b8c]
or eax, eax
je 0x5fc758
mov dword [ebx], eax
add ebx, 4
jmp 0x5fc739
call dword [esi + 0x221b88]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x5fc78f
cmp al, 0xef
ja 0x5fc782
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x5fc764
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x5fc771
mov ebp, dword [esi + 0x221b90]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x5fc7c3
sub esp, 0xffffff80
jmp 0x57eea8
Function at 0x10001000
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x20]
xor eax, eax
push ebp
mov al, byte [ebx + 1]
push esi
mov ebp, eax
push edi
mov edx, ebp
shr edx, 3
test edx, edx
mov dword [esp + 0x14], edx
jle 0x10001035
mov ecx, edx
xor eax, eax
mov esi, ecx
lea edi, [esp + 0x18]
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, esi
and ecx, 3
rep stosb byte es:[edi], al
xor eax, eax
test ebp, ebp
jle 0x10001098
xor ecx, ecx
mov cl, byte [ebx]
mov edx, dword [ecx*4 + 0x10011488]
mov dword [esp + 0x10], edx
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x24]
movsx ecx, byte [ecx + eax]
lea edx, [ecx - 1]
mov ecx, eax
sar ecx, 3
mov esi, edx
lea edi, [esp + ecx + 0x18]
xor ecx, ecx
sar edx, 3
and esi, 7
mov cl, byte [edx + ebx]
mov ebx, 0x80
mov edx, ecx
mov ecx, esi
sar ebx, cl
and edx, ebx
mov bl, byte [edi]
shl edx, cl
mov ecx, eax
and ecx, 7
sar edx, cl
or bl, dl
inc eax
cmp eax, ebp
mov byte [edi], bl
jl 0x1000104a
mov ebx, dword [esp + 0x2c]
mov edx, dword [esp + 0x14]
xor ecx, ecx
test edx, edx
jle 0x100010bb
mov eax, dword [esp + 0x28]
lea esi, [esp + 0x18]
sub esi, eax
mov dl, byte [esi + eax]
inc ecx
mov byte [eax], dl
xor edx, edx
mov dl, byte [ebx + 1]
inc eax
shr edx, 3
cmp ecx, edx
jl 0x100010a8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x100010d0
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push ebx
push ebp
push esi
push edi
mov dword [eax], 0
xor ebp, ebp
mov dword [esp + 0x10], 0x10011230
xor edi, edi
mov esi, 5
xor edx, edx
movsx ecx, byte [ebp + 0x10011388]
mov ebx, 0x80
lea eax, [ecx + edi - 1]
mov ecx, eax
and ecx, 7
sar ebx, cl
mov ecx, dword [esp + 0x1c]
sar eax, 3
mov al, byte [eax + ecx]
test al, bl
je 0x10001124
mov eax, 1
mov ecx, esi
shl eax, cl
jmp 0x10001126
xor eax, eax
add edx, eax
cmp esi, 3
jle 0x10001130
inc ebp
jmp 0x10001131
inc edi
dec esi
jns 0x100010f4
inc ebp
mov dword [esp + 0x14], edx
xor eax, eax
jmp 0x10001141
mov edx, dword [esp + 0x14]
movsx ecx, byte [ebp + 0x10011388]
mov edi, dword [esp + 0x20]
mov ebx, 8
lea esi, [ecx + eax - 1]
mov ecx, esi
sar ecx, 3
add edi, ecx
mov ecx, dword [esp + 0x10]
mov ecx, dword [ecx]
movsx edx, byte [edx + ecx]
mov ecx, eax
sar ebx, cl
lea ecx, [eax + 4]
and edx, ebx
mov bl, byte [edi]
shl edx, cl
mov ecx, esi
and ecx, 7
sar edx, cl
or bl, dl
inc eax
cmp eax, 4
mov byte [edi], bl
jl 0x1000113d
mov eax, dword [esp + 0x10]
inc ebp
add eax, 4
cmp eax, 0x10011250
mov dword [esp + 0x10], eax
jl 0x100010eb
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x100011b0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
sub esp, 0x10
lea eax, [esp + 8]
push esi
push 0x100114c0
push eax
push ecx
call section..text
mov esi, dword [esp + 0x24]
lea edx, [esp + 0x10]
push 0x100114bc
push edx
push esi
call section..text
add esp, 0x18
xor eax, eax
mov cl, byte [esp + eax + 0xc]
mov dl, byte [esp + eax + 4]
xor dl, cl
mov byte [esp + eax + 4], dl
inc eax
cmp eax, 6
jl 0x100011e1
lea edx, [esp + 0x1c]
lea eax, [esp + 4]
push edx
push eax
call fcn.100010d0
push 0x100114c8
lea ecx, [esp + 0x28]
push esi
push ecx
call section..text
add esp, 0x14
pop esi
add esp, 0x10
ret

Function at 0x10002820
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
sub esp, 0x104
mov al, byte [0x10014578]
push ebx
push ebp
push esi
push edi
mov byte [esp + 0x10], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11]
mov esi, dword [esp + 0x118]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ebx, ebx
stosb byte es:[edi], al
lea edi, [esp + 0x10]
sub edi, esi
mov al, byte [esi]
cmp al, 0x5c
je 0x10002866
cmp al, 0x2f
je 0x10002866
test al, al
jne 0x1000287f
lea ecx, [esp + 0x10]
push ecx
call ebp
cmp eax, 0xffffffff
jne 0x1000287f
lea edx, [esp + 0x10]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov al, byte [esi]
test al, al
mov byte [edi + esi], al
je 0x10002892
inc ebx
inc esi
cmp ebx, 0x104
jl 0x10002858
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
Function at 0x10004ab0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x40
or ecx, 0xffffffff
xor eax, eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x50]
push edi
mov edi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, 0x100149a0
mov edx, ecx
mov ecx, 0x10
mov ebx, edx
mov ebp, edx
and ebx, 0x1fffffff
mov dword [0x100149e0], edx
rep stosd dword es:[edi], eax
shr ebp, 0x1d
shl ebx, 3
mov ecx, 0x10
mov edi, 0x100149a0
mov dword [0x1001497c], 0x67452301
mov dword [0x10014980], 0xefcdab89
mov dword [0x10014984], 0x98badcfe
mov dword [0x10014988], 0x10325476
mov dword [0x100149e8], ebp
mov dword [0x100149e4], ebx
rep movsd dword es:[edi], dword [esi]
test edx, 0xffffffc0
mov dword [0x1001499c], eax
jbe 0x10004b88
call fcn.10004010
mov ecx, 0x10
xor eax, eax
mov edi, 0x100149a0
mov ebx, dword [esp + 0x54]
rep stosd dword es:[edi], eax
mov eax, dword [0x1001499c]
mov edx, dword [0x100149e0]
inc eax
mov ecx, 0x10
mov esi, eax
mov edi, 0x100149a0
shl esi, 6
add esi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov dword [0x1001499c], eax
shr ecx, 6
cmp eax, ecx
jb 0x10004b38
mov ebx, dword [0x100149e4]
mov ebp, dword [0x100149e8]
and edx, 0x3f
cmp edx, 0x37
mov byte [edx + 0x100149a0], 0x80
jbe 0x10004bb6
call fcn.10004010
mov ebx, dword [0x100149e4]
mov ebp, dword [0x100149e8]
mov ecx, 0x10
xor eax, eax
mov edi, 0x100149a0
rep stosd dword es:[edi], eax
mov dword [0x100149d8], ebx
mov dword [0x100149dc], ebp
call fcn.10004010
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov eax, dword [0x10014988]
mov edx, eax
mov ecx, eax
and edx, 0xff0000
shr ecx, 0x10
or edx, ecx
mov ecx, eax
shl ecx, 0x10
and eax, 0xff00
or ecx, eax
mov eax, dword [0x10014984]
shr edx, 8
shl ecx, 8
or edx, ecx
mov ecx, eax
push edx
mov edx, eax
and edx, 0xff0000
shr ecx, 0x10
or edx, ecx
mov ecx, eax
shl ecx, 0x10
and eax, 0xff00
or ecx, eax
mov eax, dword [0x10014980]
shr edx, 8
shl ecx, 8
or edx, ecx
mov ecx, eax
push edx
mov edx, eax
and edx, 0xff0000
shr ecx, 0x10
or edx, ecx
mov ecx, eax
shl ecx, 0x10
and eax, 0xff00
or ecx, eax
mov eax, dword [0x1001497c]
shr edx, 8
shl ecx, 8
or edx, ecx
mov ecx, eax
push edx
mov edx, eax
and edx, 0xff0000
shr ecx, 0x10
or edx, ecx
mov ecx, eax
shl ecx, 0x10
and eax, 0xff00
or ecx, eax
shr edx, 8
shl ecx, 8
or edx, ecx
push edx
lea edx, [esp + 0x20]
push str._08x_08x_08x_08x
push edx
call fcn.100066d7
lea edi, [esp + 0x28]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x18
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x58]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x40
ret
Function at 0x100051a0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x24]
test si, si
push edi
jne 0x100051bf
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret 0x10
mov edi, dword [esp + 0x20]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_ClearCommError]
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea edx, [esp + 0x20]
mov ebx, dword [esp + 0x24]
push 0
push edx
push 1
push ebx
push edi
call ebp
test eax, eax
je 0x1000520d
cmp si, 1
jbe 0x10005231
and esi, 0xffff
lea edx, [esp + 0x20]
push 0
dec esi
push edx
inc ebx
push esi
push ebx
push edi
call ebp
test eax, eax
jne 0x10005231
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_ClearCommError]
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0xc
ret 0x10
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret 0x10

Function at 0x10005240
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x48
push ebx
push ebp
push esi
lea eax, [esp + 0x18]
push edi
push eax
mov byte [esp + 0x14], 0
call fcn.10006889
mov ebp, dword [sym.imp.KERNEL32.dll_GetLocalTime]
add esp, 4
lea ecx, [esp + 0x30]
push ecx
call ebp
mov edi, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
mov esi, dword [esp + 0x5c]
and edi, 0xffff
lea edx, [esp + 0x24]
lea eax, [esp + 0x20]
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ClearCommError]
lea ecx, [esp + 0x14]
push 0
mov eax, dword [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x68]
and eax, 0xff
mov edx, edi
sub edx, eax
add eax, ecx
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10005335
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x1000531a
lea edx, [esp + 0x18]
push edx
call fcn.10006889
add esp, 4
lea eax, [esp + 0x44]
push eax
call ebp
mov eax, dword [esp + 0x18]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea ecx, [eax + eax*4]
mov eax, dword [esp + 0x1c]
shl ecx, 3
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
mov eax, dword [esp + 0x3e]
shl edx, 3
sub ecx, edx
mov edx, dword [esp + 0x52]
and eax, 0xffff
and edx, 0xffff
sub ecx, eax
add ecx, edx
cmp ecx, ebx
jae 0x10005335
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10005278
mov cl, byte [esp + 0x10]
add cl, al
xor ax, ax
mov al, cl
mov byte [esp + 0x10], cl
cmp ax, word [esp + 0x64]
jae 0x10005342
jmp 0x10005278
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x48
ret 0x10
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x48
ret 0x10
Function at 0x10005350
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x400
push ebx
mov ebx, dword [esp + 0x410]
push esi
push edi
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
mov al, bh
mov byte [esp + 0xc], 2
mov byte [esp + 0xd], al
mov eax, ebx
and eax, 0xffff
mov ecx, eax
and ecx, 0x800000ff
jns 0x10005391
dec ecx
or ecx, 0xffffff00
inc ecx
mov esi, dword [esp + 0x414]
mov byte [esp + 0xe], cl
mov ecx, eax
lea edi, [esp + 0xf]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [eax + 3]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor cl, cl
xor esi, esi
test edx, edx
mov byte [esp + eax + 0xf], 3
jle 0x100053c9
xor cl, byte [esp + esi + 0xd]
inc esi
cmp esi, edx
jl 0x100053c0
mov esi, dword [esp + 0x410]
push 0xc
push esi
mov byte [esp + eax + 0x18], cl
call dword [sym.imp.KERNEL32.dll_PurgeComm]
add bx, 5
push 3
lea eax, [esp + 0x10]
push ebx
push eax
push esi
call sym.umstools.dll_HLP_WriteSerial
neg eax
pop edi
pop esi
sbb eax, eax
pop ebx
add esp, 0x400
ret 0x10

Function at 0x10005400
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x400
mov ecx, 0x100
xor eax, eax
push ebx
push ebp
mov ebp, dword [esp + 0x40c]
push esi
push edi
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x420]
xor esi, esi
mov ebx, 2
push 0x1f4
lea eax, [esp + 0x14]
push 1
push eax
push ebp
call sym.umstools.dll_HLP_ReadSerial
test eax, eax
jne 0x1000544a
cmp byte [esp + 0x10], bl
je 0x10005462
xor esi, esi
inc esi
lea ecx, [edi + edi]
cmp esi, ecx
jle 0x1000542c
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x400
ret 0x10
push 0x1f4
lea edx, [esp + 0x15]
push ebx
push edx
push ebp
call sym.umstools.dll_HLP_ReadSerial
test eax, eax
je 0x10005489
pop edi
pop esi
pop ebp
mov eax, 0xfffffffe
pop ebx
add esp, 0x400
ret 0x10
mov ebx, dword [esp + 0x11]
mov eax, dword [esp + 0x12]
and ebx, 0xff
and eax, 0xff
shl ebx, 8
add ebx, eax
cmp ebx, 0x3e8
jle 0x100054bb
pop edi
pop esi
pop ebp
mov eax, 0xfffffffd
pop ebx
add esp, 0x400
ret 0x10
mov esi, 3
lea edi, [ebx + 5]
cmp edi, esi
jle 0x100054e2
push 0x1f4
lea ecx, [esp + esi + 0x14]
push 1
push ecx
push ebp
call sym.umstools.dll_HLP_ReadSerial
test eax, eax
jne 0x100054fb
inc esi
cmp esi, edi
jl 0x100054c7
cmp byte [esp + ebx + 0x13], 3
je 0x1000550d
pop edi
pop esi
pop ebp
mov eax, 0xfffffffb
pop ebx
add esp, 0x400
ret 0x10
pop edi
pop esi
pop ebp
mov eax, 0xfffffffc
pop ebx
add esp, 0x400
ret 0x10
lea edx, [ebx + 3]
xor cl, cl
xor eax, eax
test edx, edx
jle 0x10005521
xor cl, byte [esp + eax + 0x11]
inc eax
cmp eax, edx
jl 0x10005518
cmp byte [esp + ebx + 0x14], cl
je 0x10005539
pop edi
pop esi
pop ebp
mov eax, 0xfffffffa
pop ebx
add esp, 0x400
ret 0x10
mov edi, dword [esp + 0x418]
mov ecx, ebx
mov edx, ecx
lea esi, [esp + 0x13]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x41c]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov word [eax], bx
pop ebp
xor eax, eax
pop ebx
add esp, 0x400
ret 0x10
Function at 0x10005570
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push eax
push 2
call sub.WS2_32.dll_WSAStartup
neg eax
sbb eax, eax
add esp, 0x190
ret

Function at 0x100055d0
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
push ebx
push ebp
mov ebp, dword [esp + 0x11c]
push esi
mov esi, dword [esp + 0x11c]
xor ebx, ebx
mov eax, 1
push edi
cmp ebp, ebx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
lea edi, [esi + 1]
jle 0x10005640
jmp 0x1000560c
mov eax, dword [esp + 0x18]
cmp eax, 0x40
jae 0x1000561e
mov dword [esp + eax*4 + 0x1c], esi
mov eax, dword [esp + 0x18]
inc eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push 0
push 0
push ecx
push edi
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
je 0x1000564d
test eax, eax
jg 0x10005640
inc ebx
cmp ebx, ebp
jl 0x10005608
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10c
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x10c
ret

Function at 0x10005660
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x10
xor eax, eax
push ebx
mov ebx, dword [esp + 0x1c]
mov ecx, ebx
push ebp
push esi
push edi
mov dword [ecx], eax
mov esi, 2
xor ebp, ebp
mov dword [ecx + 4], eax
mov edx, dword [esp + 0x24]
push 0
push esi
push ebx
push edx
call sub.WS2_32.dll_recv
mov edi, eax
cmp edi, 0xffffffff
je 0x10005705
test edi, edi
je 0x10005710
add ebx, edi
test ebp, ebp
jne 0x100056d9
cmp edi, 2
jl 0x1000571d
mov ecx, dword [esp + 0x28]
xor eax, eax
mov dword [esp + 0x10], eax
mov dx, word [ecx]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x10]
mov word [esp + 0x10], dx
push eax
call fcn.100055b0
mov ecx, dword [esp + 0x30]
mov esi, eax
add esi, edi
add esp, 4
cmp esi, 0x270f
mov dword [ecx], esi
jg 0x1000572a
cmp esi, 4
jl 0x1000572a
sub esi, edi
test esi, esi
jle 0x10005744
mov edx, dword [esp + 0x24]
push 5
push edx
call fcn.100055d0
add esp, 8
test eax, eax
jne 0x10005737
inc ebp
cmp ebp, 0x14
jl 0x1000567b
pop edi
pop esi
pop ebp
mov eax, 0xffffffeb
pop ebx
add esp, 0x10
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x10
ret
pop edi
pop esi
pop ebp
mov eax, 0xfffffffe
pop ebx
add esp, 0x10
ret
pop edi
pop esi
pop ebp
mov eax, 0xfffffffd
pop ebx
add esp, 0x10
ret
pop edi
pop esi
pop ebp
mov eax, 0xfffffffb
pop ebx
add esp, 0x10
ret
pop edi
pop esi
pop ebp
mov eax, 0xfffffff2
pop ebx
add esp, 0x10
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret