joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401290
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x30
push ebx
push esi
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
mov esi, dword [esp + 0x3c]
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0xc]
mov ecx, dword [0x430060]
mov eax, dword [esp + 0x10]
push 0
sub edx, ebx
push ecx
push 0x3e8
sub edx, 0x28
push esi
push edx
mov edx, dword [esp + 0x1c]
sub eax, edx
push eax
push 0x28
push 0
push 0x50808011
push 0x414960
push str.SysListView32
push 0x200
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
test esi, esi
jne 0x4012fd
pop esi
pop ebx
add esp, 0x30
ret
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0xffffff
push 0
push 0x1001
push esi
call edi
push 0xffffff
push 0
push 0x1026
push esi
call edi
push 0
push 0
push 0x1024
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push 0x4300a0
push 0x32
push str.Column1
push 0x4130a0
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x30], 2
call ebx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x24], eax
push ecx
push 1
push 0x101b
push esi
mov dword [esp + 0x38], str.Interface
mov dword [esp + 0x40], 1
call edi
push 0x4300a0
push 0x64
push str.Column2
push 0x4130a0
call ebx
lea edx, [esp + 0x1c]
mov dword [esp + 0x24], eax
push edx
push 2
push 0x101b
push esi
mov dword [esp + 0x38], str.IP_Address
mov dword [esp + 0x40], 2
mov dword [esp + 0x30], 0
call edi
push 0x4300a0
push 0xb4
push str.Column3
push 0x4130a0
call ebx
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
push eax
push 3
push 0x101b
push esi
mov dword [esp + 0x38], str.Mac_ID
mov dword [esp + 0x40], 3
call edi
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x30
ret
Function at 0x403310
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x1f4
lea eax, [esp + 0x64]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
je 0x40335f
mov edx, dword [0x430060]
lea ecx, [esp]
push 0x64
push ecx
push eax
push edx
call dword [sym.imp.USER32.dll_LoadStringA]
mov ecx, dword [esp + 0x1f8]
push 0
lea eax, [esp + 4]
push str.Error
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
add esp, 0x1f4
ret
mov edx, dword [esp + 0x64]
push ebx
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
push esi
and edx, 0xffff
push edi
push edx
lea eax, [esp + 0x10]
push 0x413054
push eax
call ebx
mov esi, dword [esp + 0x210]
mov edi, dword [sym.imp.USER32.dll_SetDlgItemTextA]
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
push 0x3fe
push esi
call edi
mov edx, dword [esp + 0x72]
lea eax, [esp + 0xc]
and edx, 0xffff
push edx
push str.wHighVersion...._d
push eax
call ebx
add esp, 0xc
lea ecx, [esp + 0x74]
push ecx
push 0x3fa
push esi
call edi
lea edx, [esp + 0x175]
push edx
push 0x3f9
push esi
call edi
mov eax, dword [esp + 0x1f6]
lea ecx, [esp + 0xc]
and eax, 0xffff
push eax
push 0x4132b0
push ecx
call ebx
add esp, 0xc
lea edx, [esp + 0xc]
push edx
push 0x3fd
push esi
call edi
mov eax, dword [esp + 0x1f8]
lea ecx, [esp + 0xc]
and eax, 0xffff
push eax
push 0x4132b0
push ecx
call ebx
add esp, 0xc
lea edx, [esp + 0xc]
push edx
push 0x3fc
push esi
call edi
call sub.WSOCK32.dll_WSACleanup
pop edi
pop esi
pop ebx
add esp, 0x1f4
ret
Function at 0x4056d0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x30
push ebx
push esi
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
mov esi, dword [esp + 0x3c]
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0xc]
mov ecx, dword [0x430060]
mov eax, dword [esp + 0x10]
push 0
sub edx, ebx
push ecx
push 0x3e8
sub edx, 0x28
push esi
push edx
mov edx, dword [esp + 0x1c]
sub eax, edx
push eax
push 0x28
push 0
push 0x50808011
push 0x414960
push str.SysListView32
push 0x200
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
test esi, esi
jne 0x40573d
pop esi
pop ebx
add esp, 0x30
ret
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0xffffff
push 0
push 0x1001
push esi
call edi
push 0xffffff
push 0
push 0x1026
push esi
call edi
push 0
push 0
push 0x1024
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push 0x4300a0
push 0x32
push str.Column1
push str.Netstat
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x30], 0
call ebx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x24], eax
push ecx
push 1
push 0x101b
push esi
mov dword [esp + 0x38], str.Proto
mov dword [esp + 0x40], 1
call edi
push 0x4300a0
push 0xc8
push str.Column2
push str.Netstat
call ebx
lea edx, [esp + 0x1c]
mov dword [esp + 0x24], eax
push edx
push 2
push 0x101b
push esi
mov dword [esp + 0x38], str.Local
mov dword [esp + 0x40], 2
call edi
push 0x4300a0
push 0xb4
push str.Column3
push str.Netstat
call ebx
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
push eax
push 3
push 0x101b
push esi
mov dword [esp + 0x38], str.Remote
mov dword [esp + 0x40], 3
call edi
push 0x4300a0
push 0x46
push str.Column4
push str.Netstat
call ebx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x24], eax
push ecx
push 4
push 0x101b
push esi
mov dword [esp + 0x38], str.State
mov dword [esp + 0x40], 4
call edi
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x30
ret

Function at 0x407b20
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x214
push esi
mov esi, dword [esp + 0x220]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x4300a0
lea eax, [esp + 0x1c]
push 0x100
push eax
push str.www.usf.edu
push str.Hostname
push esi
call edi
push 0x4300a0
lea ecx, [esp + 0x11c]
push 0x100
push ecx
push 0x414960
push str.String
push esi
call edi
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push 0x4300a0
push 3
push str.Port
push esi
call edi
push 0x4300a0
push 0x8c
push str.Left
push esi
mov dword [esp + 0x228], eax
call edi
push 0x4300a0
push 0x64
push 0x413afc
push esi
mov dword [esp + 0x18], eax
call edi
push 0x4300a0
push 0x1c2
push str.Width
push esi
mov dword [esp + 0x1c], eax
call edi
push 0x4300a0
push 0x12c
push str.Height
push esi
mov dword [esp + 0x20], eax
call edi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x220]
mov ecx, 0x85
lea esi, [esp + 8]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
add esp, 0x214
ret
Function at 0x407d00
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push 0
push 0
push 0x18b
push 0x40d
push ebp
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov ebx, eax
test ebx, ebx
jne 0x407d24
pop ebp
pop ebx
ret
push ebp
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x407d32
pop ebp
pop ebx
ret
push esi
push edi
call dword [sym.imp.USER32.dll_EmptyClipboard]
push 0xffff
push 0x2042
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
xor edi, edi
mov esi, eax
dec ebx
test ebx, ebx
mov byte [esi], 0
jle 0x407d8e
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, esi
push eax
push edi
push 0x189
push 0x40d
push ebp
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push 0x413218
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
inc edi
cmp edi, ebx
jl 0x407d61
mov esi, dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBeep]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret

Function at 0x407e00
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x10c
push ebx
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push esi
push edi
mov edi, dword [esp + 0x124]
mov esi, 1
push esi
lea eax, [esp + 0x14]
push str.Item_d
push eax
call ebx
add esp, 0xc
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x10]
push 0x4300a0
push 0x100
push ecx
push 0x414960
push edx
push edi
call ebp
lea eax, [esp + 0x1c]
push 0x414960
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x407e7c
mov edx, dword [esp + 0x120]
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0x143
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
inc esi
cmp esi, 0xb
jl 0x407e22
mov eax, dword [esp + 0x120]
push 0
push 0
push 0x14e
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret
Function at 0x408910
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x30
push ebx
push esi
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
mov esi, dword [esp + 0x3c]
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0xc]
mov ecx, dword [0x430060]
mov eax, dword [esp + 0x10]
push 0
sub edx, ebx
push ecx
push 0x3f2
sub edx, 0x28
push esi
push edx
mov edx, dword [esp + 0x1c]
sub eax, edx
push eax
push 0x28
push 0
push 0x50808001
push 0x414960
push str.SysListView32
push 0x200
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
test esi, esi
jne 0x40897d
pop esi
pop ebx
add esp, 0x30
ret
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0xffffff
push 0
push 0x1001
push esi
call edi
push 0xffffff
push 0
push 0x1026
push esi
call edi
push 0
push 0
push 0x1024
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push 0x4300a0
push 0x32
push str.Column1
push str.Trace_Route
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x30], 2
call ebx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x24], eax
push ecx
push 1
push 0x101b
push esi
mov dword [esp + 0x38], 0x413c24
mov dword [esp + 0x40], 1
call edi
push 0x4300a0
push 0x64
push str.Column2
push str.Trace_Route
call ebx
lea edx, [esp + 0x1c]
mov dword [esp + 0x24], eax
push edx
push 2
push 0x101b
push esi
mov dword [esp + 0x38], 0x413c20
mov dword [esp + 0x40], 2
mov dword [esp + 0x30], 0
call edi
push 0x4300a0
push 0xb4
push str.Column3
push str.Trace_Route
call ebx
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
push eax
push 3
push 0x101b
push esi
mov dword [esp + 0x38], str.IP_Address
mov dword [esp + 0x40], 3
call edi
push 0x4300a0
push 0xb4
push str.Column4
push str.Trace_Route
call ebx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x24], eax
push ecx
push 4
push 0x101b
push esi
mov dword [esp + 0x38], str.Hostname
mov dword [esp + 0x40], 4
call edi
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x30
ret
Function at 0x40ccf9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x413fd0
cmp edx, dword [eax]
je 0x40cd1b
add eax, 8
inc ecx
cmp eax, 0x414060
jl 0x40cd0c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x413fd0]
jne 0x40ce49
mov eax, dword [0x42fc20]
cmp eax, 1
je 0x40ce23
test eax, eax
jne 0x40cd4c
cmp dword [0x413cd8], 1
je 0x40ce23
cmp edx, 0xfc
je 0x40ce49
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40cd83
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0040dd40
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0040d640
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40cdc6
lea eax, [ebp - 0x1a4]
push eax
call fcn.0040d640
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x411620
push edi
call fcn.0040eb40
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0040dd40
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0040dd50
lea eax, [ebp - 0xa0]
push 0x411600
push eax
call fcn.0040dd50
push dword [esi + 0x413fd4]
lea eax, [ebp - 0xa0]
push eax
call fcn.0040dd50
push HeapDestroy
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0040eaab
add esp, 0x2c
pop edi
jmp 0x40ce49
lea eax, [ebp + 8]
lea esi, [esi + 0x413fd4]
push 0
push eax
push dword [esi]
call fcn.0040d640
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x29a0f127
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x29a0f136
pop dword [ebp - 0x28]
mov eax, 0xdb91c624
sub eax, 0xb1f0d4ee
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x740aba10
add dword [ebp - 0x38], 0xda478b3b
mov dword [ebp - 0x34], 0xaaa7023b
add dword [ebp - 0x34], 0x878c4a0a
mov dword [ebp - 0x30], 0x1ae31b85
sub dword [ebp - 0x30], 0xce96d757
mov dword [ebp - 0x2c], 0xe74d027d
add dword [ebp - 0x2c], 0x18b2fd83
lea eax, [ebp - 0x38]
push eax
mov eax, 0xd43b8426
add eax, 0x5565bc66
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xb77ee856
sub dword [ebp - 0x38], 0x430c7f00
mov dword [ebp - 0x34], 0x98a0f3
add dword [ebp - 0x34], 0x40d3c082
mov dword [ebp - 0x30], 0xa167307d
sub dword [ebp - 0x30], 0x3df7c411
mov dword [ebp - 0x2c], 0x79508c05
add dword [ebp - 0x2c], 0x86af73fb
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0xc9166d4c
add eax, 0x608ad2f8
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x393d3
push 0
call eax
mov ecx, 0x43ca
xor edx, edx
add edx, eax
mov ebx, 0x50a8ab05
add ebx, 0xd8f974fb
add ebx, dword [ebp - 0x28]
mov edi, 0xc38b0c3a
sub edi, 0x3c98b218
sub dword [ebp - 4], edx
mov esi, dword [ebx]
xor dword [ebp - 0x18], ebx
sub esi, edi
sub dword [ebp - 8], esi
mov dword [edx], esi
add dword [ebp - 0x10], ebx
add edx, 4
add ebx, 0x4acda7a1
sub ebx, 0x4acda79d
loop 0x29a0f254
add eax, 0x595b42ca
add eax, 0xa6a5bf31
xor ebx, ebx
add ebx, eax
add eax, 0x2f860754
sub eax, 0x2f86074f
mov ecx, 0x29a00000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ed0
nop
nop
mov ecx, 0x36620dd8
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
mov ecx, 0x5a052d93
nop
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x10013bc0
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xdc
mov eax, dword [0x10066a80]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0xd8]
push esi
push edi
mov edi, dword [ebp + 8]
push eax
push edi
mov dword [ebp - 0xdc], ebx
call fcn.10013040
mov esi, eax
test esi, esi
je 0x10013c23
mov ecx, dword [ebp - 0xd8]
sub esi, edi
mov edx, dword [ebp - 0xd4]
mov al, 3
mov dword [ebx], ecx
mov dword [ebx + 4], edx
mov byte [ebx + 8], al
lea eax, [esi + 1]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004d464
mov esp, ebp
pop ebp
ret 8
push 0x10051c98
push edi
call fcn.10034450
add esp, 8
test eax, eax
je 0x10013c55
movzx ebx, byte [eax]
or ebx, 0x20
cmp ebx, 0x6e
jne 0x10013c57
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004d464
mov esp, ebp
pop ebp
ret 8
xor ebx, ebx
push ebx
lea eax, [ebp - 0xd8]
push eax
push edi
call fcn.10012fd0
mov esi, eax
test esi, esi
jne 0x10013cf1
push 0x2e
push edi
call fcn.10028210
mov esi, eax
add esp, 8
test esi, esi
je 0x10013c40
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10013c85
sub ecx, edx
cmp ecx, 0xc8
ja 0x10013c40
lea edx, [ebp - 0xd0]
mov ecx, edi
sub edx, edi
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x10013ca0
call fcn.100310dd
sub esi, edi
push ebx
mov eax, dword [eax]
mov al, byte [eax]
mov byte [ebp + esi - 0xd0], al
lea eax, [ebp - 0xd8]
push eax
lea eax, [ebp - 0xd0]
push eax
call fcn.10012fd0
mov esi, eax
test esi, esi
je 0x10013c40
mov eax, edi
lea ecx, [ebp - 0xd0]
sub eax, ecx
add esi, eax
test esi, esi
je 0x10013c40
mov ebx, dword [ebp - 0xdc]
sub esi, edi
movsd xmm0, qword [ebp - 0xd8]
mov al, 0x13
mov ecx, dword [ebp - 4]
pop edi
movsd qword [ebx], xmm0
xor ecx, ebp
mov byte [ebx + 8], al
lea eax, [esi + 1]
pop esi
pop ebx
call fcn.1004d464
mov esp, ebp
pop ebp
ret 8
Function at 0x10013dd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
call fcn.100310dd
mov ecx, dword [ebp + 8]
xor edi, edi
xor esi, esi
xorps xmm1, xmm1
mov eax, dword [eax]
movsx eax, byte [eax]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
mov al, byte [ecx]
mov byte [ebp - 1], al
movzx eax, al
test byte [eax + 0x10050f79], 8
je 0x10013e23
nop dword [eax]
mov al, byte [ecx + 1]
inc ecx
mov byte [ebp - 1], al
movzx eax, al
test byte [eax + 0x10050f79], 8
jne 0x10013e10
mov al, byte [ebp - 1]
lea edx, [ecx + 1]
cmp al, 0x2d
jne 0x10013e36
mov dword [ebp - 0x14], 1
jmp 0x10013e3e
cmp al, 0x2b
mov dword [ebp - 0x14], esi
cmovne edx, ecx
cmp byte [edx], 0x30
jne 0x10013f77
mov al, byte [edx + 1]
cmp al, 0x78
je 0x10013e56
cmp al, 0x58
jne 0x10013f77
movsd xmm2, qword [0x10051d18]
add edx, 2
mov al, byte [edx]
movsx ecx, al
mov dword [ebp - 0x10], edx
mov byte [ebp - 1], al
cmp ecx, dword [ebp - 0x18]
jne 0x10013e81
cmp dword [ebp - 8], 0
jne 0x10013ed3
mov dword [ebp - 8], 1
inc edx
jmp 0x10013e61
movzx eax, al
test byte [eax + 0x10050f79], 0x10
je 0x10013ed3
test edi, edi
jne 0x10013e9c
cmp byte [ebp - 1], 0x30
jne 0x10013e9c
inc dword [ebp - 0xc]
jmp 0x10013ec9
inc edi
cmp edi, 0x1e
jg 0x10013ec8
test byte [ecx + 0x10050f79], 2
je 0x10013eb0
add ecx, 0xffffffd0
jmp 0x10013eb6
or ecx, 0x20
sub ecx, 0x57
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
mulsd xmm1, xmm2
addsd xmm1, xmm0
jmp 0x10013ec9
inc esi
cmp dword [ebp - 8], 0
je 0x10013ed0
dec esi
inc edx
jmp 0x10013e61
mov eax, dword [ebp - 0xc]
add eax, edi
je 0x10013f77
mov eax, dword [ebp + 0xc]
shl esi, 2
mov dword [eax], edx
mov al, byte [edx]
cmp al, 0x70
je 0x10013ef0
cmp al, 0x50
jne 0x10013f51
mov al, byte [edx + 1]
inc edx
xor ecx, ecx
cmp al, 0x2d
jne 0x10013f05
mov edx, dword [ebp - 0x10]
lea edi, [ecx + 1]
add edx, 2
jmp 0x10013f11
cmp al, 0x2b
jne 0x10013f0f
mov edx, dword [ebp - 0x10]
add edx, 2
xor edi, edi
mov al, byte [edx]
mov byte [ebp - 1], al
movzx eax, al
test byte [eax + 0x10050f79], 2
je 0x10013f77
movsx eax, byte [ebp - 1]
lea ecx, [ecx + ecx*4]
inc edx
lea ecx, [ecx - 0x18]
lea ecx, [eax + ecx*2]
mov al, byte [edx]
mov byte [ebp - 1], al
movzx eax, al
test byte [eax + 0x10050f79], 2
jne 0x10013f22
mov eax, ecx
neg eax
test edi, edi
cmove eax, ecx
add esi, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
cmp dword [ebp - 0x14], 0
je 0x10013f5e
xorps xmm1, xmmword [0x10051d20]
push esi
sub esp, 8
movsd qword [esp], xmm1
call fcn.1002f176
add esp, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
fldz
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x10018da0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov eax, esi
xor eax, dword [ebp + 0x10]
test esi, esi
je 0x10018dcf
push edi
mov edi, dword [ebp + 8]
movzx edx, byte [edi + esi - 1]
mov ecx, eax
shl ecx, 5
add edx, ecx
mov ecx, eax
shr ecx, 2
add edx, ecx
xor eax, edx
sub esi, 1
jne 0x10018db4
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x10018de0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 6], 0
jne 0x10018e2c
mov edx, dword [edi + 8]
push esi
mov esi, dword [edi + 0xc]
xor edx, esi
test esi, esi
je 0x10018e1d
push ebx
lea ebx, [edi + 0xf]
add ebx, esi
mov ecx, edx
lea ebx, [ebx - 1]
mov eax, edx
shl ecx, 5
shr eax, 2
add ecx, eax
movzx eax, byte [ebx + 1]
add ecx, eax
xor edx, ecx
sub esi, 1
jne 0x10018e00
pop ebx
pop esi
mov dword [edi + 8], edx
mov eax, edx
mov byte [edi + 6], 1
pop edi
pop ebp
ret 4
mov eax, dword [edi + 8]
pop edi
pop ebp
ret 4

Function at 0x10025ac0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x10025b24
mov eax, dword [ebp + 0x14]
shl dword [ebp + 0x10], 8
mov ecx, dword [ebp + 8]
push ebx
mov eax, dword [eax]
mov ebx, dword [ebp + 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
push esi
mov cl, byte [ecx]
movsx edx, cl
sub cl, 0x61
cmp cl, 0x19
mov ecx, dword [ebp + 0x10]
lea esi, [edx - 0x20]
cmova esi, edx
mov edx, dword [ebp - 4]
add ecx, esi
add eax, ebx
xor eax, dword [edx + ecx*4]
mov ecx, ebx
shl ecx, 5
add ecx, 3
add ecx, esi
add ebx, ecx
mov ecx, dword [ebp + 8]
inc ecx
add ebx, eax
mov dword [ebp + 8], ecx
sub edi, 1
jne 0x10025ae3
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [ebp + 0x18]
pop edi
mov esp, ebp
pop ebp
ret 0x18
Function at 0x10027a00
Capabilities:
Listen for remote procedure calls

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
mov eax, dword [0x10066a80]
xor eax, ebp
mov dword [ebp - 4], eax
movups xmm0, xmmword [0x10054418]
mov eax, dword [0x10054458]
push edi
mov edi, dword [ebp + 8]
movups xmmword [ebp - 0x148], xmm0
mov dword [ebp - 0x108], eax
movups xmm0, xmmword [0x10054428]
movups xmmword [ebp - 0x138], xmm0
movups xmm0, xmmword [0x10054438]
movups xmmword [ebp - 0x128], xmm0
movups xmm0, xmmword [0x10054448]
movups xmmword [ebp - 0x118], xmm0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
mov eax, dword [ebp - 0x114]
push dword [eax + 4]
lea eax, [ebp - 0x104]
push str._s_d
push eax
call fcn.10026fc0
add esp, 0x10
cmp eax, 0xffffffff
jne 0x10027a99
mov eax, 0x6aa
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004d464
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 0x114]
push esi
push 0
mov eax, dword [eax]
mov dword [ebp - 0x150], eax
lea eax, [ebp - 0x104]
mov dword [ebp - 0x14c], eax
lea eax, [ebp - 0x150]
mov dword [ebp - 0x114], eax
lea eax, [ebp - 0x148]
push eax
push 0xa
call dword [sym.imp.RPCRT4.dll_RpcServerUseAllProtseqsIf]
mov esi, eax
test esi, esi
jne 0x10027b1e
push eax
push eax
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.RPCRT4.dll_RpcServerRegisterIf]
mov esi, eax
test esi, esi
jne 0x10027b1e
push 0x10066be0
push dword [ebp + 0xc]
mov ecx, edi
push fcn.10027940
call dword [0x100501d0]
call edi
mov esi, eax
test esi, esi
js 0x10027b1c
push 1
push 0x4d2
push 1
call dword [sym.imp.RPCRT4.dll_RpcServerListen]
mov esi, eax
test esi, esi
je 0x10027b2c
cmp dword [0x10066be0], 0
je 0x10027b2c
call fcn.10027b40
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop edi
call fcn.1004d464
mov esp, ebp
pop ebp
ret 8

Function at 0x10029069
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10054bdc
push 0x10054bd4
push 0x10054bdc
push 0x21
call fcn.10028ed4
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100290a0
push dword [ebp + 8]
mov ecx, esi
call dword [0x100501d0]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x100290a8
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10054bf0
push 0x10054be8
push 0x10054bf0
push 0x22
call fcn.10028ed4
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100290e2
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x100501d0]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]

Function at 0x10029180
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push str.GetTempPath2W
push 0x10054aac
push str.GetTempPath2W
push 5
call fcn.10028ed4
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100291ba
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x100501d0]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetTempPathW]