joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001310
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10035818
push 0x1002e320
mov eax, dword fs:[0]
push eax
sub esp, 0x110
mov eax, dword [0x10038400]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x120], eax
mov byte [ebp - 0x11c], 0
push 0xff
push 0
lea eax, [ebp - 0x11b]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor ebx, ebx
mov esi, dword [ebp + 0xc]
mov dl, byte [esi]
test dl, dl
je 0x100013ee
nop dword [eax]
mov ecx, ebx
and ecx, 1
mov dh, dl
sub dh, 0x30
cmp dh, 9
ja 0x100013ab
mov eax, ebx
test eax, eax
jns 0x10001398
add eax, 1
sar eax, 1
xor ecx, 1
shl ecx, 2
shl dh, cl
add byte [ebp + eax - 0x11c], dh
jmp 0x100013e6
lea eax, [edx - 0x41]
cmp al, 5
ja 0x100013c2
mov eax, ebx
test eax, eax
jns 0x100013bb
add eax, 1
sar eax, 1
sub dl, 0x37
jmp 0x100013d7
lea eax, [edx - 0x61]
cmp al, 5
ja 0x100013e7
mov eax, ebx
test eax, eax
jns 0x100013d2
add eax, 1
sar eax, 1
sub dl, 0x57
xor ecx, 1
shl ecx, 2
shl dl, cl
add byte [ebp + eax - 0x11c], dl
inc ebx
inc esi
mov dl, byte [esi]
test dl, dl
jne 0x10001380
test bl, 1
jne 0x10001403
mov eax, ebx
cdq
sub eax, edx
mov esi, eax
sar esi, 1
cmp esi, 1
jae 0x10001406
jmp 0x1000147b
or esi, 0xffffffff
mov ebx, dword [ebp - 0x120]
cmp byte [edi + 0x10], 0
je 0x1000141a
mov eax, dword [edi]
cmp ebx, eax
jae 0x1000141a
add ebx, eax
lea eax, [edi + 0x1c]
push eax
push 0x40
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10001432
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], esi
mov dword [ebp - 4], 0
push esi
lea eax, [ebp - 0x11c]
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [ebp - 4], 0xfffffffe
lea eax, [ebp - 0x120]
push eax
push dword [edi + 0x1c]
push dword [edi + 0x18]
push dword [edi + 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, 1
jmp 0x1000147d
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1002e06b
mov esp, ebp
pop ebp
ret 8
Function at 0x1000cce0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x100388d4], 0
jne 0x1000cd8c
xor edx, edx
mov ecx, edx
mov eax, edx
and ecx, 1
shr eax, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [edx*4 + 0x100388d0], eax
inc edx
cmp edx, 0x100
jb 0x1000ccf2
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
not ebx
push edi
mov edi, dword [ebp + 0xc]
mov eax, ebx
test edi, edi
jle 0x1000cdc1
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100388d0]
sub edi, 1
jne 0x1000cda0
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x1000cdf0
cmp cl, 0x23
jne 0x1000cdd7
cmp byte [esi], cl
jne 0x1000cdd7
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x100388d0]
test cl, cl
jne 0x1000cdc8
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
Function at 0x10012da0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
mov eax, dword [0x100388b8]
mov dword [eax + 0x2c2c], 0
je 0x10012e97
push esi
push edi
mov edi, dword [0x100388b8]
lea esi, [edi + 0x2c30]
mov dword [edi + 0x2c2c], 0
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x10012df4
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.100156b0
mov dword [esi], 0
cmp dword [esi + 4], 0
jne 0x10012e09
push 8
mov ecx, esi
call fcn.100156b0
mov eax, dword [esi]
mov ecx, dword [esi + 8]
push ebx
mov dword [ebp - 4], 0
mov byte [ecx + eax], 0
inc dword [esi]
cmp dword [edi + 0x2c3c], 0
jle 0x10012e4c
xor ebx, ebx
mov eax, dword [edi + 0x2c44]
add eax, ebx
push esi
push eax
push edi
mov eax, dword [eax + 0x10]
call eax
mov eax, dword [ebp - 4]
add esp, 0xc
inc eax
add ebx, 0x18
mov dword [ebp - 4], eax
cmp eax, dword [edi + 0x2c3c]
jl 0x10012e27
cmp dword [esi + 8], 0
je 0x10012e57
mov esi, dword [esi]
dec esi
jmp 0x10012e59
xor esi, esi
mov eax, dword [edi + 0x2c38]
mov ebx, 0x100388bc
test eax, eax
push 0x100306b4
push dword [ebp + 8]
cmovne ebx, eax
call fcn.1000caf0
mov edi, eax
add esp, 8
test edi, edi
je 0x10012e94
push edi
push esi
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10015c00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002f466
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10038400]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x18], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x30], 0
mov eax, 0x3f
mov byte [ebp - 4], 2
mov dword [esi + 4], 0x3f800000
mov word [esi + 0x3c], ax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
call fcn.10018800
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10022ec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp dword [ebp + 0x14], ecx
jle 0x100230a6
push esi
mov esi, dword [ebp + 0x10]
mov edx, 0x100
add esi, 0x14
xorps xmm0, xmm0
push edi
mov dword [ebp - 8], esi
nop word [eax + eax]
movss xmm1, dword [esi - 0x14]
comiss xmm1, xmm0
mov eax, dword [ebp + 0xc]
jbe 0x10022f43
mov esi, dword [eax + 4]
mov edi, dword [eax + 0x1c]
movsx eax, dx
movzx ecx, byte [edi + esi + 6]
movsx ecx, cx
imul ecx, eax
movzx eax, byte [edi + esi + 7]
add cx, ax
mov eax, 0x100
movsx edx, cx
movzx ecx, byte [edi + esi + 4]
cwde
movsx ecx, cx
imul ecx, eax
movzx eax, byte [edi + esi + 5]
mov esi, dword [ebp - 8]
add cx, ax
movsx eax, cx
sub eax, edx
movd xmm0, eax
jmp 0x10022f63
mov edx, dword [eax + 0x14]
mov eax, dword [eax + 4]
xorps xmm1, xmmword [0x10030820]
movzx ecx, byte [edx + eax + 0x12]
movzx eax, byte [edx + eax + 0x13]
shl ecx, 8
add ecx, eax
movd xmm0, ecx
mov ecx, dword [ebp + 8]
xor edi, edi
cvtdq2ps xmm0, xmm0
movzx eax, byte [ecx + 0x18]
mov byte [esi], al
movzx eax, byte [ecx + 0x1c]
divss xmm1, xmm0
mov byte [esi + 1], al
movss dword [ebp - 0xc], xmm1
cmp dword [esi - 8], edi
jle 0x10023089
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x18]
shl eax, 4
add ecx, 6
add eax, ecx
mov dword [ebp - 8], eax
nop dword [eax + eax]
mov eax, dword [esi - 0xc]
test eax, eax
jne 0x10022fae
mov eax, dword [esi - 0x10]
add eax, edi
jmp 0x10022fb1
mov eax, dword [eax + edi*4]
push eax
push dword [ebp + 0xc]
call fcn.100225e0
mov edx, dword [ebp + 8]
mov ecx, eax
add esp, 8
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [edx + 0x1c]
sub esp, 0x10
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mov dword [esp + 0xc], 0
shr eax, 0x1f
mov dword [esp + 8], 0
addsd xmm0, qword [eax*8 + 0x10030800]
mov eax, dword [edx + 0x18]
cvtpd2ps xmm0, xmm0
mulss xmm0, xmm1
movss dword [esp + 4], xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10030800]
cvtpd2ps xmm0, xmm0
mulss xmm0, xmm1
movss dword [esp], xmm0
push ecx
push dword [ebp + 0xc]
call fcn.10022970
mov ecx, dword [ebp + 8]
inc edi
mov edx, dword [ebp - 8]
add esp, 0x28
movss xmm1, dword [ebp - 0xc]
movzx eax, word [ecx + 0x18]
sub ax, word [ebp - 0x10]
dec ax
add ax, word [ecx + 0x14]
add ax, word [ebp - 0x14]
mov word [edx - 2], ax
movzx eax, word [ecx + 0x1c]
sub ax, word [ebp - 0x18]
dec ax
add ax, word [ecx + 0x14]
add ax, word [ebp - 0x1c]
mov ecx, dword [ebp - 4]
mov word [edx], ax
inc ecx
add edx, 0x10
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
cmp edi, dword [esi - 8]
jl 0x10022fa0
jmp 0x1002308c
mov ecx, dword [ebp - 4]
add esi, 0x18
xorps xmm0, xmm0
sub dword [ebp + 0x14], 1
mov edx, 0x100
mov dword [ebp - 8], esi
jne 0x10022ef0
pop edi
pop esi
mov eax, ecx
mov esp, ebp
pop ebp
ret
Function at 0x10024140
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x10038400]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call fcn.1000c510
mov edi, eax
lea eax, [ebp - 0x14]
push eax
push dword [0x10038d00]
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x14]
movd xmm0, eax
lea eax, [ebp - 0x24]
movd xmm1, ecx
cvtdq2ps xmm1, xmm1
push eax
cvtdq2ps xmm0, xmm0
movss dword [edi + 8], xmm1
movss dword [edi + 0xc], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 0x24]
sub ecx, dword [0x10038d08]
mov edx, dword [ebp - 0x20]
sbb edx, dword [0x10038d0c]
call fcn.1002e2a0
mov edx, dword [0x10038d14]
mov ecx, dword [0x10038d10]
cvtsd2ss xmm0, xmm0
movss dword [ebp - 0x18], xmm0
call fcn.1002e2a0
movss xmm1, dword [ebp - 0x18]
cvtsd2ss xmm0, xmm0
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
divss xmm1, xmm0
movss dword [edi + 0x10], xmm1
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov dword [0x10038d08], eax
mov dword [0x10038d0c], ecx
call esi
shr eax, 0xf
and al, 1
push 0x10
mov byte [edi + 0xf4], al
call esi
shr eax, 0xf
and al, 1
push 0x12
mov byte [edi + 0xf5], al
call esi
shr eax, 0xf
and al, 1
mov byte [edi + 0xf7], 0
mov byte [edi + 0xf6], al
call fcn.1000c510
cmp byte [eax + 0x373], 0
lea esi, [eax + 0xdc]
je 0x10024267
cvttss2si eax, dword [eax + 0xe0]
cvttss2si ecx, dword [esi]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push eax
push dword [0x10038d00]
mov dword [ebp - 0x1c], ecx
call dword [sym.imp.USER32.dll_ClientToScreen]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call dword [sym.imp.USER32.dll_SetCursorPos]
mov dword [esi], 0xff7fffff
mov dword [esi + 4], 0xff7fffff
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [0x10038d00]
jne 0x100242bd
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x100242bd
lea eax, [ebp - 0x2c]
push eax
push dword [0x10038d00]
call dword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x100242bd
movd xmm0, dword [ebp - 0x2c]
movd xmm1, dword [ebp - 0x28]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [esi], xmm0
movss dword [esi + 4], xmm1
cmp byte [edi + 0xb4], 0
pop edi
pop esi
je 0x100242cd
or eax, 0xffffffff
jmp 0x100242d2
call fcn.1000c520
cmp dword [0x10038138], eax
je 0x100242e4
mov dword [0x10038138], eax
call fcn.10024310
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002e06b
mov esp, ebp
pop ebp
ret
Function at 0x10025600
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002f569
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10038400]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10038eb8]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10038d20]
cmp eax, dword [ecx + 4]
jg 0x10025777
mov eax, dword [0x10038d18]
xor esi, esi
mov ebx, dword [ebp + 8]
mov edi, eax
mov dword [ebp - 0x14], eax
mov ecx, dword [eax + 4]
mov dword [ebp - 0x10], ecx
cmp byte [ecx + 0xd], 0
jne 0x10025683
mov eax, ecx
mov dword [ebp - 0x10], eax
cmp dword [eax + 0x10], ebx
jae 0x10025674
mov eax, dword [eax + 8]
xor esi, esi
jmp 0x1002567d
mov edi, eax
mov esi, 1
mov eax, dword [eax]
cmp byte [eax + 0xd], 0
je 0x10025665
cmp byte [edi + 0xd], 0
jne 0x1002568e
cmp ebx, dword [edi + 0x10]
jae 0x100256ed
cmp dword [0x10038d1c], 0xaaaaaaa
je 0x100257d5
mov dword [ebp - 0x1c], 0x10038d18
push 0x18
mov dword [ebp - 4], 1
mov dword [ebp - 0x18], 0
call fcn.1002dc30
mov ecx, dword [ebp - 0x14]
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov dword [eax + 0x10], ebx
mov byte [eax + 0x14], 0
mov dword [eax], ecx
push eax
mov dword [eax + 4], ecx
push esi
push dword [ebp - 0x10]
mov dword [eax + 8], ecx
mov ecx, 0x10038d18
mov word [eax + 0xc], 0
call fcn.100293e0
mov edi, eax
cmp byte [edi + 0x14], 0
push 0
push dword [ebp + 0xc]
jne 0x1002572b
mov ecx, dword [ebx]
push dword [ecx*4 + 0x10038140]
call fcn.10024c70
add esp, 0xc
test al, al
je 0x10025765
push 0x14
mov byte [edi + 0x14], 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x10030600
call fcn.10024c70
add esp, 0xc
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, 0x10034468
push dword [esi]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1002575a
mov eax, dword [esi]
mov dword [ebx], eax
mov byte [edi + 0x14], 0
add esi, 4
cmp esi, str._I64u
jne 0x10025745
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x10038d20
call fcn.1002e007
add esp, 4
cmp dword [0x10038d20], 0xffffffff
jne 0x10025648
push 0x18
mov dword [ebp - 4], 0
call fcn.1002dc30
push 0x1002f660
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [0x10038d18], eax
call fcn.1002df73
push 0x10038d20
mov dword [ebp - 4], 0xffffffff
call fcn.1002dfb6
add esp, 0xc
jmp 0x10025648
call fcn.100295d0
int3
Function at 0x1002dbf0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
jne 0x1002dc15
mov eax, dword [ebp + 8]
push 0
push 0
push eax
push 0x1002ac00
push 0
push 0
mov dword [0x10038dfc], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
pop ebp
ret 0xc
Function at 0x100010a0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x19c
mov eax, dword [0x1002d00c]
xor eax, esp
mov dword [esp + 0x198], eax
push esi
mov esi, ecx
lea eax, [esp + 8]
push eax
push 0x202
mov dword [esi], vtable.CClientSocket.0
mov dword [esi + 4], vtable.CBuffer.0
mov dword [esi + 0x10], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x14], vtable.CBuffer.0
mov dword [esi + 0x20], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], vtable.CBuffer.0
mov dword [esi + 0x30], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x34], vtable.CBuffer.0
mov dword [esi + 0x40], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0x4c], eax
mov eax, esi
mov dword [esp + 4], 0x20206d74
mov ecx, dword [esp + 4]
mov dword [esi + 0x50], ecx
mov ecx, dword [esp + 0x19c]
mov byte [esi + 0x54], 0
mov dword [esi + 0x48], 0xffffffff
pop esi
xor ecx, esp
call fcn.1000c111
mov esp, ebp
pop ebp
ret

Function at 0x100011c0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1002d00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
push 0xffffffffffffffff
lea esi, [edi + 0x54]
mov byte [esi], 0
push dword [edi + 0x44]
mov dword [edi], vtable.CClientSocket.0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [edi + 0x48]
cmp eax, 0xffffffff
je 0x1000123c
push 4
lea ecx, [ebp - 8]
mov dword [ebp - 8], 1
push ecx
push 0x80
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
push dword [edi + 0x48]
call dword [sym.imp.KERNEL32.dll_CancelIo]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push dword [edi + 0x48]
call dword [sym.imp.WS2_32.dll_closesocket]
push dword [edi + 0x4c]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [edi + 0x48], 0xffffffff
push dword [edi + 0x44]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [edi + 0x4c]
call esi
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [edi + 0x38]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [edi + 0x34], vtable.CBuffer.0
test eax, eax
je 0x10001270
push 0x8000
push 0
push eax
call esi
mov eax, dword [edi + 0x28]
mov dword [edi + 0x24], vtable.CBuffer.0
test eax, eax
je 0x10001288
push 0x8000
push 0
push eax
call esi
mov eax, dword [edi + 0x18]
mov dword [edi + 0x14], vtable.CBuffer.0
test eax, eax
je 0x100012a0
push 0x8000
push 0
push eax
call esi
mov eax, dword [edi + 8]
mov dword [edi + 4], vtable.CBuffer.0
test eax, eax
je 0x100012b8
push 0x8000
push 0
push eax
call esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1000c111
mov esp, ebp
pop ebp
ret
Function at 0x100012d0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1002d00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 8]
push 4
push eax
mov esi, ecx
mov dword [ebp - 8], 1
push 0x80
push 0xffff
push dword [esi + 0x48]
call dword [sym.imp.WS2_32.dll_setsockopt]
push dword [esi + 0x48]
call dword [sym.imp.KERNEL32.dll_CancelIo]
push 0
lea ebx, [esi + 0x54]
push ebx
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push dword [esi + 0x48]
call dword [sym.imp.WS2_32.dll_closesocket]
push dword [esi + 0x4c]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push dword [esi + 0x4c]
mov dword [esi + 0x48], 0xffffffff
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 6
push 1
push 2
mov byte [ebx], 0
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 0x48], eax
cmp eax, 0xffffffff
je 0x10001423
push edi
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov edi, eax
test edi, edi
je 0x10001423
push dword [ebp + 0xc]
mov eax, 2
mov word [ebp - 0x2c], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x2a], ax
mov eax, dword [edi + 0xc]
push 0x10
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x2c]
push eax
push dword [esi + 0x48]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x10001423
push 4
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 1
push eax
push 8
push 0xffff
push dword [esi + 0x48]
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x100013f7
push eax
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x18], 1
push eax
push 0
push 0
push 0xc
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x2bf20
push eax
push 0x98000004
push dword [esi + 0x48]
mov dword [ebp - 0x10], 0x1388
call dword [sym.imp.WS2_32.dll_WSAIoctl]
sub esp, 0xc
mov byte [ebx], 1
push esi
push 0x10001440
call fcn.10007950
mov dword [esi + 0x44], eax
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000c111
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000c111
mov esp, ebp
pop ebp
ret 8
Function at 0x10001b20
Capabilities:
Encode data using xor
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0xc]
xor edx, edx
mov dword [ebp - 4], ecx
push esi
push edi
mov edi, dword [ebp + 8]
test ebx, ebx
jle 0x10001bcf
cmp ebx, 0x40
jb 0x10001bb7
mov eax, ebx
and eax, 0x8000003f
jns 0x10001b4f
dec eax
or eax, 0xffffffc0
inc eax
movaps xmm2, xmmword [0x10029bc0]
mov esi, ebx
movaps xmm3, xmmword [0x10029be0]
sub esi, eax
movups xmm0, xmmword [edi + edx]
movaps xmm1, xmm2
pxor xmm1, xmm0
psubb xmm1, xmm3
movups xmmword [edi + edx], xmm1
movups xmm0, xmmword [edi + edx + 0x10]
movaps xmm1, xmm2
pxor xmm1, xmm0
psubb xmm1, xmm3
movups xmmword [edi + edx + 0x10], xmm1
movups xmm0, xmmword [edi + edx + 0x20]
movaps xmm1, xmm2
pxor xmm0, xmm2
psubb xmm0, xmm3
movups xmmword [edi + edx + 0x20], xmm0
movups xmm0, xmmword [edi + edx + 0x30]
pxor xmm1, xmm0
psubb xmm1, xmm3
movups xmmword [edi + edx + 0x30], xmm1
add edx, 0x40
cmp edx, esi
jl 0x10001b61
cmp edx, ebx
jge 0x10001bcf
nop dword [eax + eax]
mov al, byte [edx + edi]
xor al, 0x30
sub al, 0x49
mov byte [edx + edi], al
inc edx
cmp edx, ebx
jl 0x10001bc0
xor esi, esi
mov eax, ebx
cmp ebx, 0x32000
mov dword [ebp - 8], esi
mov ebx, dword [sym.imp.WS2_32.dll_send]
mov dword [ebp + 8], eax
jb 0x10001c3a
xor esi, esi
nop dword [eax]
push 0
push 0x32000
push edi
push dword [ecx + 0x48]
call ebx
test eax, eax
jg 0x10001c0a
mov ecx, dword [ebp - 4]
inc esi
cmp esi, 0xf
jl 0x10001bf0
cmp esi, 0xf
je 0x10001c75
mov esi, dword [ebp - 8]
add edi, 0x32000
add esi, eax
push 0xa
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
sub eax, 0x32000
mov dword [ebp + 8], eax
cmp eax, 0x32000
jae 0x10001be7
test eax, eax
jle 0x10001c65
xor esi, esi
push 0
push eax
push edi
push dword [ecx + 0x48]
call ebx
mov edx, eax
test edx, edx
jg 0x10001c5b
mov eax, dword [ebp + 8]
inc esi
mov ecx, dword [ebp - 4]
cmp esi, 0xf
jl 0x10001c40
cmp esi, 0xf
je 0x10001c75
mov esi, dword [ebp - 8]
add esi, edx
cmp esi, dword [ebp + 0xc]
jne 0x10001c75
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret 0xc