joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d12b0
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x735d28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, ecx
push eax
mov dword [esp + 0x18], esi
call fcn.0049f110
xor ebx, ebx
mov dword [esi], 0x757bdc
lea ecx, [esi + 0x44]
mov dword [esp + 0x2c], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
call fcn.006d10b0
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov ecx, dword [0x7a3a28]
mov eax, dword [ecx + 0xb8]
mov edi, dword [eax + 0x74]
push str.DISTANCE
lea ecx, [esp + 0x1c]
call fcn.005e5a90
lea edx, [esi + 0x38]
push edx
lea eax, [esp + 0x1c]
push eax
push 8
mov ecx, edi
mov byte [esp + 0x38], 1
call fcn.00413430
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], bl
call fcn.005e5c20
push str.HEIGHT
lea ecx, [esp + 0x1c]
call fcn.005e5a90
lea ecx, [esi + 0x40]
push ecx
lea edx, [esp + 0x1c]
push edx
push 8
mov ecx, edi
mov byte [esp + 0x38], 2
call fcn.00413430
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], bl
call fcn.005e5c20
push str.PITCH
lea ecx, [esp + 0x1c]
call fcn.005e5a90
lea eax, [esi + 0x30]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 8
mov ecx, edi
mov byte [esp + 0x38], 3
call fcn.00413430
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], bl
call fcn.005e5c20
push str.ROTATION
lea ecx, [esp + 0x1c]
call fcn.005e5a90
lea edx, [esi + 0x34]
push edx
lea eax, [esp + 0x1c]
push eax
push 8
mov ecx, edi
mov byte [esp + 0x38], 4
call fcn.00413430
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], bl
call fcn.005e5c20
push str.SPEED
lea ecx, [esp + 0x1c]
call fcn.005e5a90
lea ecx, [esi + 0x3c]
push ecx
lea edx, [esp + 0x1c]
push edx
push 8
mov ecx, edi
mov byte [esp + 0x38], 5
call fcn.00413430
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], bl
call fcn.005e5c20
push str.VIEWANGLE
lea ecx, [esp + 0x1c]
call fcn.005e5a90
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 8
mov ecx, edi
mov byte [esp + 0x38], 6
call fcn.00413430
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], bl
call fcn.005e5c20
mov ecx, dword [esi + 0x10]
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [esp + 0x10]
mov edx, dword [eax]
push ecx
mov ecx, eax
call dword [edx + 0x44]
mov edx, dword [0x7a39fc]
mov ecx, dword [edx + 4]
call fcn.005ed700
mov ecx, eax
call fcn.0061d5e0
fstp dword [esi + 0x84]
mov eax, dword [0x7a39fc]
mov ecx, dword [eax + 4]
call fcn.005ed700
mov ecx, eax
call fcn.0061d610
fstp dword [esi + 0x88]
mov ecx, dword [0x7a39fc]
mov ecx, dword [ecx + 4]
call fcn.005ed700
mov ecx, eax
call fcn.0061d640
mov ecx, dword [esp + 0x24]
fstp dword [esi + 0x8c]
mov edx, dword [0x8338f0]
pop edi
mov dword [esi + 0x90], edx
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x6d8310
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x736008
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
push edi
mov esi, ecx
push 0xb
mov dword [esp + 0x18], esi
call fcn.0063e530
lea edi, [esi + 0x158]
xor ebx, ebx
mov ecx, edi
mov dword [esp + 0x30], ebx
mov dword [esi], 0x757e28
call fcn.00405ed0
mov eax, dword [0x7a39fc]
mov ecx, dword [eax + 4]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x10]
push eax
call fcn.005ed4f0
mov ecx, eax
call fcn.004ade40
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov dword [esi + 0x40], edx
mov dword [esi + 0x3c], ecx
mov ecx, ebx
lea eax, [esi + 0x30]
mov dword [eax], ecx
mov dword [esp + 0x1c], 0x3f800000
mov edx, dword [esp + 0x1c]
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
mov eax, ebx
lea edx, [esi + 0x24]
mov dword [edx], eax
mov dword [edx + 4], ecx
mov dword [edx + 8], eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esi + 0x124], ebx
mov dword [esi + 0x128], ebx
mov dword [esi + 0x12c], ebx
mov byte [esi + 0x13f], bl
lea ecx, [esi + 0x13c]
lea eax, [esi + 0x108]
mov edx, 3
mov byte [ecx], bl
mov dword [eax + 0xc], ebx
mov dword [eax], ebx
add eax, 4
inc ecx
dec edx
jne 0x6d83e0
push 0x73d71c
lea ecx, [esp + 0x1c]
push ecx
mov ecx, edi
mov dword [esi + 0xfc], ebx
mov dword [esi + 0x130], ebx
mov dword [esi + 0x134], ebx
mov dword [esi + 0x120], ebx
mov dword [esi + 0x138], ebx
mov dword [esi + 0x140], ebx
mov dword [esi + 0x144], ebx
mov dword [esi + 0x104], ebx
mov dword [esi + 0x148], ebx
mov dword [esi + 0x100], ebx
mov dword [esi + 0x14c], ebx
mov dword [esi + 0x150], ebx
mov dword [esi + 0x154], ebx
call fcn.00406290
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x168], ebx
mov dword [esi + 0x16c], ebx
mov dword [esi + 0x174], ebx
pop edi
mov dword [esi + 0x178], 0x7f000000
mov dword [esi + 0x170], 0xffffffff
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x70be37
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
push edi
mov dword [ebp - 8], ebx
je 0x70bea2
push 0x3d
push dword [ebp + 8]
call fcn.0070c017
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], esi
je 0x70bea2
cmp dword [ebp + 8], esi
je 0x70bea2
xor eax, eax
cmp byte [esi + 1], al
sete al
mov dword [ebp - 4], eax
mov eax, dword [0x833c08]
cmp eax, dword [0x833c0c]
jne 0x70be88
mov edi, eax
call fcn.0070bdd6
mov dword [0x833c08], eax
cmp eax, ebx
jne 0x70bee1
cmp dword [ebp + 0xc], ebx
je 0x70beaa
cmp dword [0x833c10], ebx
je 0x70beaa
call fcn.0070b372
test eax, eax
je 0x70bee1
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
cmp dword [ebp - 4], ebx
jne 0x70bfe5
push 4
call fcn.006fd8fb
cmp eax, ebx
pop ecx
mov dword [0x833c08], eax
je 0x70bea2
mov dword [eax], ebx
cmp dword [0x833c10], ebx
jne 0x70bee1
push 4
call fcn.006fd8fb
cmp eax, ebx
pop ecx
mov dword [0x833c10], eax
je 0x70bea2
mov dword [eax], ebx
mov ebx, dword [0x833c08]
mov edi, esi
mov esi, dword [ebp + 8]
sub edi, esi
push esi
call fcn.0070bd89
mov edi, eax
test edi, edi
pop ecx
jl 0x70bf3a
cmp dword [ebx], 0
je 0x70bf3a
lea esi, [ebx + edi*4]
push dword [esi]
call fcn.006fb7b2
xor eax, eax
cmp dword [ebp - 4], eax
pop ecx
jne 0x70bf22
mov eax, dword [ebp + 8]
mov dword [esi], eax
jmp 0x70bf70
mov ecx, dword [esi + 4]
mov dword [esi], ecx
inc edi
add esi, 4
cmp dword [esi], eax
jne 0x70bf19
mov eax, edi
shl eax, 2
push eax
push ebx
call fcn.00701b2d
test eax, eax
pop ecx
pop ecx
je 0x70bf70
jmp 0x70bf6b
cmp dword [ebp - 4], 0
jne 0x70bfde
test edi, edi
jge 0x70bf4a
neg edi
lea eax, [edi*4 + 8]
push eax
push ebx
call fcn.00701b2d
test eax, eax
pop ecx
pop ecx
je 0x70bea2
lea ecx, [eax + edi*4]
and dword [ecx + 4], 0
mov dword [ecx], esi
mov dword [0x833c08], eax
cmp dword [ebp + 0xc], 0
je 0x70bfc7
push dword [ebp + 8]
call fcn.00701300
inc eax
inc eax
push eax
call fcn.006fd8fb
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x70bfc7
push dword [ebp + 8]
push esi
call fcn.00705910
mov eax, esi
sub eax, dword [ebp + 8]
pop ecx
add eax, dword [ebp - 0xc]
pop ecx
and byte [eax], 0
mov ecx, dword [ebp - 4]
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push esi
call dword [sym.imp.kernel32.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x70bfc0
or dword [ebp - 8], 0xffffffff
push esi
call fcn.006fb7b2
pop ecx
cmp dword [ebp - 4], 0
je 0x70bfd6
push dword [ebp + 8]
call fcn.006fb7b2
pop ecx
mov eax, dword [ebp - 8]
jmp 0x70bea5
push esi
call fcn.006fb7b2
pop ecx
xor eax, eax
jmp 0x70bea5

Function at 0x70c230
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ecx]
test ecx, ecx
je 0x70c23b
jmp fcn.00405040
xor eax, eax
ret
Function at 0x70dd78
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x73a8d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
mov esi, ecx
push edi
lea edi, [esi + 0xc]
mov ecx, edi
mov dword [esp + 8], esi
mov dword [esi], 0x75fb4c
call fcn.00405ed0
push 0x73d71c
lea eax, [esp + 0x10]
push eax
mov ecx, edi
mov dword [esi + 8], 0
call fcn.00406290
mov dword [esi + 4], 0
mov ecx, dword [esp + 0x3c]
push ecx
lea edx, [esp + 0x30]
push edx
mov ecx, esi
mov dword [esp + 0x2c], 0
mov dword [esi], 0x75fb50
call fcn.0070dbf0
mov ecx, dword [esp + 0x1c]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 0x14

Function at 0x70efa0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x73a978
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
mov esi, ecx
push edi
lea edi, [esi + 0xc]
mov ecx, edi
mov dword [esp + 8], esi
mov dword [esi], 0x75fb54
call fcn.00405ed0
push 0x73d71c
lea eax, [esp + 0x10]
push eax
mov ecx, edi
mov dword [esi + 8], 0
call fcn.00406290
mov dword [esi + 4], 0
mov ecx, dword [esp + 0x3c]
push ecx
lea edx, [esp + 0x30]
push edx
mov ecx, esi
mov dword [esp + 0x2c], 0
mov dword [esi], 0x75fb58
call fcn.0070ee30
mov ecx, dword [esp + 0x1c]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 0x14

Function at 0x70f270
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x73a9b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
mov esi, ecx
push edi
lea edi, [esi + 0xc]
mov ecx, edi
mov dword [esp + 8], esi
mov dword [esi], 0x75fb5c
call fcn.00405ed0
push 0x73d71c
lea eax, [esp + 0x10]
push eax
mov ecx, edi
mov dword [esi + 8], 0
call fcn.00406290
mov dword [esi + 4], 0
mov ecx, dword [esp + 0x3c]
push ecx
lea edx, [esp + 0x30]
push edx
mov ecx, esi
mov dword [esp + 0x2c], 0
mov dword [esi], 0x75fb60
call fcn.0070f0f0
mov ecx, dword [esp + 0x1c]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 0x14

Function at 0x70f980
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x73a9f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
mov esi, ecx
push edi
lea edi, [esi + 0xc]
mov ecx, edi
mov dword [esp + 8], esi
mov dword [esi], 0x75fb64
call fcn.00405ed0
push 0x73d71c
lea eax, [esp + 0x10]
push eax
mov ecx, edi
mov dword [esi + 8], 0
call fcn.00406290
mov dword [esi + 4], 0
mov ecx, dword [esp + 0x3c]
push ecx
lea edx, [esp + 0x30]
push edx
mov ecx, esi
mov dword [esp + 0x2c], 0
mov dword [esi], 0x75fb68
call fcn.0070f800
mov ecx, dword [esp + 0x1c]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 0x14
Function at 0x70fd10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x73aa38
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
mov esi, ecx
push edi
lea edi, [esi + 0xc]
mov ecx, edi
mov dword [esp + 8], esi
mov dword [esi], 0x75fb6c
call fcn.00405ed0
push 0x73d71c
lea eax, [esp + 0x10]
push eax
mov ecx, edi
mov dword [esi + 8], 0
call fcn.00406290
mov dword [esi + 4], 0
mov ecx, dword [esp + 0x3c]
push ecx
lea edx, [esp + 0x30]
push edx
mov ecx, esi
mov dword [esp + 0x2c], 0
mov dword [esi], 0x75fb70
call fcn.0070fb90
mov ecx, dword [esp + 0x1c]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 0x14

Function at 0x70ffe0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x73aa78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
mov esi, ecx
push edi
lea edi, [esi + 0xc]
mov ecx, edi
mov dword [esp + 8], esi
mov dword [esi], 0x75fb74
call fcn.00405ed0
push 0x73d71c
lea eax, [esp + 0x10]
push eax
mov ecx, edi
mov dword [esi + 8], 0
call fcn.00406290
mov dword [esi + 4], 0
mov ecx, dword [esp + 0x3c]
push ecx
lea edx, [esp + 0x30]
push edx
mov ecx, esi
mov dword [esp + 0x2c], 0
mov dword [esi], 0x75fb78
call fcn.0070fe60
mov ecx, dword [esp + 0x1c]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 0x14

Function at 0x710300
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x73aab8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
mov esi, ecx
push edi
lea edi, [esi + 0xc]
mov ecx, edi
mov dword [esp + 8], esi
mov dword [esi], 0x75fb7c
call fcn.00405ed0
push 0x73d71c
lea eax, [esp + 0x10]
push eax
mov ecx, edi
mov dword [esi + 8], 0
call fcn.00406290
mov dword [esi + 4], 0
mov ecx, dword [esp + 0x3c]
push ecx
lea edx, [esp + 0x30]
push edx
mov ecx, esi
mov dword [esp + 0x2c], 0
mov dword [esi], 0x75fb80
call fcn.00710180
mov ecx, dword [esp + 0x1c]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 0x14

Function at 0x7106c8
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x73aaf8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
mov esi, ecx
push edi
lea edi, [esi + 0xc]
mov ecx, edi
mov dword [esp + 8], esi
mov dword [esi], 0x75fb84
call fcn.00405ed0
push 0x73d71c
lea eax, [esp + 0x10]
push eax
mov ecx, edi
mov dword [esi + 8], 0
call fcn.00406290
mov dword [esi + 4], 0
mov ecx, dword [esp + 0x3c]
push ecx
lea edx, [esp + 0x30]
push edx
mov ecx, esi
mov dword [esp + 0x2c], 0
mov dword [esi], 0x75fb88
call fcn.00710530
mov ecx, dword [esp + 0x1c]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 0x14
Function at 0x710aa8
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x73ab38
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
mov esi, ecx
push edi
lea edi, [esi + 0xc]
mov ecx, edi
mov dword [esp + 8], esi
mov dword [esi], 0x75fb8c
call fcn.00405ed0
push 0x73d71c
lea eax, [esp + 0x10]
push eax
mov ecx, edi
mov dword [esi + 8], 0
call fcn.00406290
mov dword [esi + 4], 0
mov ecx, dword [esp + 0x3c]
push ecx
lea edx, [esp + 0x30]
push edx
mov ecx, esi
mov dword [esp + 0x2c], 0
mov dword [esi], 0x75fb90
call fcn.00710910
mov ecx, dword [esp + 0x1c]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 0x14

Function at 0x713d55
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x7a3180]
xor eax, dword [ebp + 4]
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
mov dword [ebp - 4], eax
je 0x713dd0
push ebx
call fcn.00713d1e
test eax, eax
pop ecx
jne 0x713da2
call fcn.006ffe81
mov dword [eax], 0xf
call fcn.006ffe78
mov dword [eax], 0xd
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop ebx
call fcn.00705d37
leave
ret
and byte [ebp + 0xb], 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10c]
push eax
push 0x104
lea eax, [ebp + 8]
add bl, 0x40
push eax
mov byte [ebp + 8], bl
mov byte [ebp + 9], 0x3a
mov byte [ebp + 0xa], 0x2e
call dword [sym.imp.kernel32.dll_GetFullPathNameA]
jmp 0x713de2
lea eax, [ebp - 0x10c]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x713d92
inc eax
cmp eax, 0x104
ja 0x713d92
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x713e1a
cmp eax, dword [ebp + 0x10]
jg 0x713dfd
mov eax, dword [ebp + 0x10]
push eax
call fcn.006fd8fb
pop ecx
mov ecx, eax
test ecx, ecx
jne 0x713e2f
call fcn.006ffe78
mov dword [eax], 0xc
jmp 0x713d92
cmp eax, dword [ebp + 0x10]
jle 0x713e2f
call fcn.006ffe78
mov dword [eax], 0x22
jmp 0x713d92
lea eax, [ebp - 0x10c]
push eax
push ecx
call fcn.00705910
pop ecx
pop ecx
jmp 0x713d94

Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..rdata
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x7f176886
nop
nop
nop
nop
test eax, eax
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x6bdb0fa8
nop
nop
nop
nop
test eax, eax
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x54f04fb2
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..reloc
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x17696917
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x401524
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Convert ip address from string
Create tcp socket
Initialize winsock library
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c8
mov dword [ebp - 0xc], 0xffffffff
lea eax, [ebp - 0x1a0]
mov dword [esp + 4], eax
mov dword [esp], 0x202
mov eax, dword [sym.imp.WS2_32.dll_WSAStartup]
call eax
sub esp, 8
test eax, eax
je 0x40155d
mov eax, 0
jmp 0x4016fc
mov dword [esp + 8], 6
mov dword [esp + 4], 1
mov dword [esp], 2
mov eax, dword [sym.imp.WS2_32.dll_socket]
call eax
sub esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x401598
mov eax, dword [sym.imp.WS2_32.dll_WSACleanup]
call eax
mov eax, 0
jmp 0x4016fc
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
lea eax, [ebp - 0x1b0]
mov dword [esp], eax
call sym._memset
mov word [ebp - 0x1b0], 2
mov dword [esp], 0x29a
mov eax, dword [sym.imp.WS2_32.dll_htons]
call eax
sub esp, 4
mov word [ebp - 0x1ae], ax
lea eax, [ebp - 0x1b0]
add eax, 4
mov dword [esp + 8], eax
mov dword [esp + 4], str.176.105.230.190
mov dword [esp], 2
mov eax, dword [sym.imp.WS2_32.dll_inet_pton]
call eax
sub esp, 0xc
cmp eax, 1
je 0x401623
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_closesocket]
call eax
sub esp, 4
mov eax, dword [sym.imp.WS2_32.dll_WSACleanup]
call eax
mov eax, 0
jmp 0x4016fc
mov dword [esp + 8], 0x10
lea eax, [ebp - 0x1b0]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_connect]
call eax
sub esp, 0xc
cmp eax, 0xffffffff
jne 0x40166b
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_closesocket]
call eax
sub esp, 4
mov eax, dword [sym.imp.WS2_32.dll_WSACleanup]
call eax
mov eax, 0
jmp 0x4016fc
mov dword [esp + 0xc], str.Shaiya_Tales_of_Teos
mov dword [esp + 8], str._s_r_n
mov dword [esp + 4], 0x100
lea eax, [ebp - 0x2b0]
mov dword [esp], eax
call sym._snprintf
mov dword [ebp - 0x10], eax
mov dword [esp + 0xc], 0
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], eax
lea eax, [ebp - 0x2b0]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_send]
call eax
sub esp, 0x10
cmp eax, 0xffffffff
jne 0x4016e0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_closesocket]
call eax
sub esp, 4
mov eax, dword [sym.imp.WS2_32.dll_WSACleanup]
call eax
mov eax, 0
jmp 0x4016fc
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_closesocket]
call eax
sub esp, 4
mov eax, dword [sym.imp.WS2_32.dll_WSACleanup]
call eax
mov eax, 1
leave
ret
Function at 0x4016fe
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0x94
lea edx, [ebp - 0x4c]
mov eax, 0
mov ecx, 0x11
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0x44
lea eax, [ebp - 0x5c]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x4c]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], str.T.O.T.exe
mov eax, dword [sym.imp.KERNEL32.dll_CreateProcessA]
call eax
sub esp, 0x28
test eax, eax
jne 0x40179e
mov eax, 0
jmp 0x4017c3
mov eax, dword [ebp - 0x5c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x58]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, 1
mov edi, dword [ebp - 4]
leave
ret

Function at 0x401aa0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]
Function at 0x401b00
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x40d068]
test esi, esi
jle 0x401c20
mov eax, dword [0x40d06c]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x401b34
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x401bb7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x401b20
mov dword [esp], ebx
call dbg.__mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x401c47
mov eax, dword [0x40d06c]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
mov edx, dword [0x40d06c]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401c27
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x401bb0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x401bc0
add dword [0x40d068], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x40d06c]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x401bb0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x401b3e
mov eax, dword [0x40d06c]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
nop

Function at 0x402160
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x40d084
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x40d07c]
sub esp, 4
test ebx, ebx
je 0x4021b5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x4021ae
test esi, esi
je 0x4021ae
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402190
mov dword [esp], 0x40d084
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret