joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bfd10
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x4bfdb3
test eax, eax
jbe 0x4bfdb3
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x4bfdb3
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x4bfd5e
xor esi, esi
jmp 0x4bfd64
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x4bfd8f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.004c36a0
add esi, eax
push esi
mov ebx, esi
call fcn.004c36a0
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x4bfd70
pop ebp
test edi, edi
pop edi
jne 0x4bfdb3
test ebx, ebx
je 0x4bfdb3
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.004dcd80
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc

Function at 0x4bfed5
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x4bffed
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4bffed
mov eax, dword [esi + 0x3c]
push eax
call fcn.004eecae
mov esi, eax
test esi, esi
je 0x4bffed
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x4bffed
mov ecx, esi
call fcn.004bfe60
cmp edi, eax
jge 0x4bffed
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x4bff73
mov dword [esp + 0x34], 1
jmp 0x4bffce
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x4bffed
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.004bf3d0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc
Function at 0x4c70d0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x8c35b0]
xor edx, edx
cmp eax, edx
jne 0x4c70f6
xor eax, eax
mov byte [eax + 0x8c34b0], al
inc eax
cmp eax, 0x100
jl 0x4c70de
mov dword [0x8c35b0], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x8c34b0
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x4c7187
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x4c715a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x4c7128
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4c7200
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x4c7253
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x4c723a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4cdbe0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4fc22e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.004ce500
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x872544
call fcn.004ecfc2
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x4cdc73
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004ecfc2
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x4cdc6c
push 0
mov ecx, eax
call fcn.004c4d00
mov dword [esi + 0xc], eax
jmp 0x4cdc75
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4cdc75
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x4ef652
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4ef68a
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004ed6dc
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004ed6b4
jmp 0x4ef696
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4f0d40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4f0d82
call fcn.004f6841
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4f0d82
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4f0d79
xor eax, eax
jmp 0x4f0d8a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004f0d90
pop edi
pop esi
pop ebx
ret 4

Function at 0x4f6d71
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4f6d9f
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4f6dbd
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004f6cd7
jmp 0x4f6dbd
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4f6dbd
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004f6cd7
test edi, edi
mov eax, edi
jne 0x4f6da7
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x43ee50
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x13000]
push edi
jmp 0x43ee6a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x43ee71
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x43ee60
mov eax, 1
add ebx, ebx
jne 0x43ee83
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x43ee78
jne 0x43ee94
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x43ee78
xor ecx, ecx
sub eax, 3
jb 0x43eea8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x43ef1a
mov ebp, eax
add ebx, ebx
jne 0x43eeb3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x43eec0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x43eee4
inc ecx
add ebx, ebx
jne 0x43eed0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x43eec5
jne 0x43eee1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x43eec5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x43ef04
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x43eef5
jmp 0x43ee66
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x43ef04
add edi, ecx
jmp 0x43ee66
pop esi
mov edi, esi
mov ecx, 0x677
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x43ef22
cmp byte [edi], 0xa
jne 0x43ef22
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x43ef27
lea edi, [esi + 0x3c000]
mov eax, dword [edi]
or eax, eax
je 0x43ef96
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x3f438]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x3f488]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x43ef54
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x3f490]
or eax, eax
je 0x43ef90
mov dword [ebx], eax
add ebx, 4
jmp 0x43ef71
call dword [esi + 0x3f48c]
mov ebp, dword [esi + 0x3f494]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x43efca
sub esp, 0xffffff80
jmp 0x4039f0
Function at 0x401360
Capabilities:
Check if file exists
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push 0x104
lea eax, [ebp - 0x208]
push eax
push str._systemdrive_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [ebp - 0x208]
push ecx
push str._sProgram_Files__x86_
lea edx, [ebp - 0x410]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4013b1
mov al, 1
jmp 0x4013b3
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x4013c0
Capabilities:
Check if file exists
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push 0x104
lea eax, [ebp - 0x410]
push eax
push str._temp_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [ebp - 0x410]
push ecx
push str._sx3x432.jpg
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x401413
xor al, al
jmp 0x40144d
push 0
push 2
push 1
push 0
push 0
push 0x40000000
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 0xffffffff
je 0x40144b
mov edx, dword [ebp - 0x414]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x497cd0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov eax, ecx
mov ebx, dword [esp + 0x10]
cdq
and edx, 7
push ebp
add eax, edx
and ecx, 7
sar eax, 3
push esi
mov esi, dword [esp + 0x10]
test eax, eax
mov ebp, ecx
jle 0x497d1b
push edi
mov edi, eax
push 8
mov ecx, esi
call fcn.00492570
xor ecx, ecx
and eax, 0xff
mov cl, bh
xor edx, edx
xor eax, ecx
mov dh, bl
mov ebx, dword [eax*4 + 0x4a0084]
xor ebx, edx
dec edi
jne 0x497cf6
pop edi
test ebp, ebp
jle 0x497d47
push 1
mov ecx, esi
call fcn.00492570
mov ecx, ebx
and ebx, 0x7fff
shr ecx, 0xf
and ecx, 1
xor eax, ecx
shl ebx, 1
test eax, eax
je 0x497d44
xor ebx, 0x8005
dec ebp
jne 0x497d1f
pop esi
mov eax, ebx
pop ebp
pop ebx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x145b0b0
Capabilities:
Decompress data using aplib

Disassembly:
call 0x145b200
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x145b0d6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x145b0c2
add dl, dl
jne 0x145b0e1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x145b134
xor eax, eax
add dl, dl
jne 0x145b0ee
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x145b1d5
add dl, dl
jne 0x145b0fd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x145b108
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x145b113
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x145b11e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x145b12a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x145b0cd
mov eax, 1
add dl, dl
jne 0x145b142
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x145b14d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x145b139
sub eax, ebx
mov ebx, 1
jne 0x145b180
mov ecx, 1
add dl, dl
jne 0x145b166
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x145b171
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x145b15d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x145b0cd
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x145b197
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x145b1a2
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x145b18e
cmp eax, 0x7d00
jae 0x145b1c5
cmp eax, 0x500
jb 0x145b1c0
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x145b0cd
cmp eax, 0x7f
ja 0x145b1c8
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x145b0cd
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x145b1f6
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x145b0cd
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10001010
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x100027c0
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
push 0x40
push 0x1000
push 0x6065e
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
push 0x6065e
push 0x10037440
push eax
call fcn.10027680
add esp, 0xc
lea edi, [ebp - 0x28]
push esi
push edi
call fcn.10002a00
add esp, 8
push edi
call fcn.100028a0
add esp, 4
test eax, eax
jne 0x10001090
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
call fcn.10010380
add esp, 0xc
jmp 0x10001080
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x10], 0
push 0x10097aa0
push 0x1003729c
push edi
push 0x2b
push 0x10037260
call fcn.10035bb0
add esp, 0x14
ud2
Function at 0x1000b600
Capabilities:
Get system information on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
xorps xmm0, xmm0
call 0x1000b60f
pop edi
lea eax, [esp + 0x18]
mov dword [esp + 0x38], 0
movups xmmword [esp + 0x28], xmm0
movups xmmword [esp + 0x18], xmm0
push eax
call sub.KERNEL32.dll_GetSystemInfo
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x1000b6af
mov ecx, dword [esp + 0x54]
xor edx, edx
mov ebx, dword [esp + 0x5c]
mov ebp, dword [esp + 0x50]
mov eax, ecx
div esi
lea eax, [esi + ecx]
sub eax, edx
test edx, edx
cmove eax, ecx
test eax, eax
cmove eax, esi
test ebx, ebx
mov dword [esp + 4], eax
je 0x1000b697
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x10], 0
mov dword [esp], 0
mov dword [esp + 8], 0
xor edx, edx
mov dword [esp + 0xc], 0
mov eax, dword [ecx]
lea ebp, [ecx + ebx*8]
mov ebx, dword [ecx + 4]
mov esi, dword [eax*4 + 0x1000b864]
xor eax, eax
add esi, edi
jmp esi
mov ebx, dword [esp + 4]
xor ecx, ecx
xor edx, edx
xor esi, esi
mov dword [esp + 8], 0
test dl, dl
je 0x1000b6b9
jmp 0x1000b6c6
push 0x1009d0f4
call fcn.10036120
mov eax, 1
test cl, cl
je 0x1000b7dd
mov dword [ebp + 4], 7
jmp 0x1000b852
test esi, esi
je 0x1000b7ea
mov dword [ebp + 4], 8
jmp 0x1000b852
push eax
push 0x3000
push ebx
push dword [esp + 0x14]
call sub.KERNEL32.dll_VirtualAlloc
test eax, eax
je 0x1000b807
mov dword [ebp], 1
jmp 0x1000b83b
call fcn.10016240
mov dword [ebp + 4], 0xa
jmp 0x1000b84f
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], ebx
jmp 0x1000b859
mov dword [ebp + 8], eax
mov dword [ebp], 2
mov eax, ebp
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1000f9d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x1000ff90
lea eax, [ebp - 0x18]
mov ebx, dword [ebp + 0x10]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
movzx eax, byte [0x100c0049]
push 4
push 8
call fcn.10005870
add esp, 8
test eax, eax
je 0x1000fab2
mov esi, eax
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
mov dword [esi], ebx
mov dword [esi + 4], ecx
push 0
push 0x10000
push esi
push 0x1000fb30
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x1000fa4d
mov dword [edi + 4], eax
mov byte [edi], 4
jmp 0x1000fa9f
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x24], eax
push eax
mov dword [ebp - 0x20], ecx
call dword [ecx]
add esp, 4
mov ecx, dword [ebp - 0x20]
mov edi, dword [ebp + 8]
mov eax, dword [ecx + 4]
test eax, eax
je 0x1000fa84
push dword [ecx + 8]
push eax
push dword [ebp - 0x24]
call fcn.10005880
add esp, 0xc
push 4
push 8
push dword [ebp - 0x28]
call fcn.10005880
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [edi], 0
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, edi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
push 8
push 4
call fcn.10035aa0
add esp, 8
ud2

Function at 0x10011a30
Capabilities:
Create udp socket

Disassembly:
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x18]
mov ebx, 0x17
cmp word [eax], 0
mov eax, 2
cmove ebx, eax
push 0x81
push 0
push 0
push 0
push edi
push ebx
call dword [sym.imp.WS2_32.dll_WSASocketW]
cmp eax, 0xffffffff
je 0x10011a74
mov dword [esi + 4], eax
mov byte [esi], 4
mov eax, esi
pop esi
pop edi
pop ebx
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2726
je 0x10011a88
cmp eax, 0x2739
jne 0x10011ab3
push 1
push 0
push 0
push 0
push edi
push ebx
call dword [sym.imp.WS2_32.dll_WSASocketW]
cmp eax, 0xffffffff
je 0x10011abb
mov edi, eax
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x10011acc
mov dword [esi + 4], edi
jmp 0x10011a6b
mov byte [esi], 0
mov dword [esi + 4], eax
jmp 0x10011a6e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 4], eax
mov dword [esi], 0
jmp 0x10011a6e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 4], eax
mov dword [esi], 0
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
jmp 0x10011a6e
Function at 0x10011af0
Capabilities:
Resolve dns

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1b8
mov ebx, dword [esp + 0x1d4]
mov esi, dword [esp + 0x1cc]
mov edi, dword [esp + 0x1d0]
mov edx, ebx
jmp 0x10011b24
cmp edx, ebx
ja 0x10011b4a
push edx
push edi
push 0x3a
call fcn.100229c0
add esp, 0xc
cmp eax, 1
jne 0x10011b46
cmp edx, ebx
jae 0x10011b20
cmp byte [edi + edx], 0x3a
jne 0x10011b20
mov ebp, edx
lea eax, [edx + 1]
jmp 0x10011b5a
test eax, eax
jne 0x10011b5a
mov byte [esi + 4], 2
mov dword [esi + 8], 0x1009ee44
jmp 0x10011bdf
sub ebx, eax
add eax, edi
push ebx
push eax
call fcn.10022630
add esp, 8
test al, 1
jne 0x10011bd4
shr eax, 0x10
mov word [esp + 2], ax
mov eax, dword [0x100c00a4]
cmp eax, 3
jne 0x10011c5c
lea eax, [esp + 2]
cmp ebp, 0x17f
mov dword [esp + 8], eax
ja 0x10011c7d
lea ebx, [esp + 0x38]
push ebp
push edi
push ebx
call fcn.10027680
add esp, 0xc
mov byte [esp + ebp + 0x38], 0
inc ebp
lea eax, [esp + 0xc]
push ebp
push ebx
push eax
call fcn.10022410
add esp, 0xc
cmp dword [esp + 0xc], 0
je 0x10011bf2
mov eax, dword [0x1009f070]
mov ecx, dword [0x1009f074]
mov dword [esi + 8], ecx
mov dword [esi + 4], eax
jmp 0x10011bdf
mov byte [esi + 4], 2
mov dword [esi + 8], 0x1009ee64
mov dword [esi], 1
mov eax, esi
add esp, 0x1b8
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esp + 0x10]
xorps xmm0, xmm0
lea ecx, [esp + 4]
mov dword [esp + 4], 0
lea edx, [esp + 0x18]
movups xmmword [esp + 0x18], xmm0
movups xmmword [esp + 0x28], xmm0
mov dword [esp + 0x20], 1
push ecx
push edx
push 0
push eax
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x10011c43
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, 1
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov dword [esi], ecx
jmp 0x10011be5
mov eax, dword [esp + 4]
movzx ecx, word [esp + 2]
mov dword [esi + 4], eax
mov dword [esi + 8], eax
xor eax, eax
mov word [esi + 0xc], cx
mov dword [esi], eax
jmp 0x10011be5
push 0x100c00a4
call fcn.10034c70
add esp, 4
lea eax, [esp + 2]
cmp ebp, 0x17f
mov dword [esp + 8], eax
jbe 0x10011b96
lea eax, [esp + 8]
push 0x1009ee70
push eax
push ebp
push edi
push esi
call fcn.10035070
add esp, 0x14
jmp 0x10011be5
Function at 0x100137f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, ecx
mov ecx, dword [ebp + 0xc]
cmp dword [ebp + 0x10], 0
mov edi, edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x103
je 0x10013834
mov eax, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0x18]
lea edx, [esp + 0x20]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], eax
xor eax, eax
mov ebx, 1
jmp 0x1001383a
xor ebx, ebx
xor eax, eax
xor edx, edx
mov dword [esp + 0x1c], eax
lea eax, [esp + 8]
mov dword [esp + 0x18], ebx
push 0
push edx
push ecx
push dword [ebp + 8]
push eax
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x10013876
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 8]
cmp eax, 0x103
je 0x10013898
test eax, eax
js 0x10013882
mov eax, dword [esp + 0xc]
mov bl, 4
jmp 0x1001388b
xor ebx, ebx
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [esi + 4], eax
mov byte [esi], bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [esp + 4]
mov dword [esp + 0x18], 0x1009f600
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
lea ecx, [esp + 0x10]
lea edx, [esp + 0x34]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x24], 0
push eax
push ecx
push edx
call fcn.1000cf30
add esp, 0xc
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
call fcn.1000db90
mov ecx, 7
int 0x29
ud2