joyce8/EMBER2024-capa huggingface dataset:
Function at 0x9fbf90
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x208
lea eax, [esp]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push ebp
push esi
push edi
xor edi, edi
push 0x104
push eax
push edi
push SysStringLen
call ebx
mov esi, dword [esp + 0x21c]
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x9fbffb
mov ecx, dword [esi + 8]
push 0
push ecx
call ebp
test eax, eax
je 0x9fc035
lea edx, [esp + 0x10]
push esi
push edx
push SysStringLen
call fcn.009fbe00
add esp, 0xc
lea eax, [esp + 0x10]
inc edi
push 0x104
push eax
push edi
push SysStringLen
call ebx
test eax, eax
je 0x9fbfc5
mov edi, 0xa168b0
mov ecx, dword [esi + 8]
push 0
push ecx
call ebp
test eax, eax
je 0x9fc035
mov edx, dword [edi]
push esi
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.009fbe00
add edi, 4
add esp, 0xc
cmp edi, 0xa168c0
jb 0x9fc000
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x208
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x208
ret

Function at 0x9fc070
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x250
push esi
push edi
mov edi, dword [esp + 0x25c]
push 0x5c
push edi
call fcn.00a02082
mov esi, eax
add esp, 8
test esi, esi
je 0x9fc107
lea eax, [esp + 8]
mov word [esi], 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x9fc102
push ebx
lea ebx, [esi + 2]
push ebp
lea ecx, [esp + 0x3c]
push ebx
push ecx
call fcn.00a01946
add esp, 8
test eax, eax
je 0x9fc0e3
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea edx, [esp + 0x10]
push edx
push edi
call ebp
test eax, eax
je 0x9fc0e8
lea eax, [esp + 0x3c]
push ebx
push eax
call fcn.00a01946
add esp, 8
test eax, eax
jne 0x9fc0c5
mov word [esi], 0x5c
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp word [esi], 0
pop ebp
pop ebx
je 0x9fc102
pop edi
mov al, 1
pop esi
add esp, 0x250
ret
mov word [esi], 0x5c
pop edi
xor al, al
pop esi
add esp, 0x250
ret
Function at 0x9fcf10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0xa119fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0x9fd002
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.00a00dff
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x9fd002
lea edx, [esp + 0x14]
push edx
push str.Mounting__s_n
call fcn.009f86e0
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.00a0120b
push 0x10
call fcn.00a011d3
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0x9fcfc5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.009ed1c0
jmp 0x9fcfc7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.009fcb80
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0x9fcff0
mov ecx, edi
call fcn.009ed2c0
push edi
call fcn.00a011c8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x9fd021
inc ebx
cmp ebx, 0x20
jb 0x9fcf3e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x9fe250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xa12808
push 0xa02288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x9fe329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x9fe329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00a011d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x9fe329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0x9fe329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0x9fe32c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.009fe351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x9fed20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x9fed58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x9fed60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x9fed94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x9fed94
push eax
push esi
call fcn.00a0120b
add esp, 8
pop esi
ret 0x10

Function at 0x9feda0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x9fee22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x9fee15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0xa17320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00a00dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x9fedda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x9fee30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x9feec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x9feeb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0xa17320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00a00dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x9feeab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x9fee6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x9ff000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x9ff131
push esi
call fcn.00a02145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.009f1080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x9ff131
push 0
push ebp
call fcn.009f13a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.009f1260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x9ff08b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.009f12f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x9ff121
push 0xa17918
push edi
call fcn.00a003f0
push eax
push ebx
push esi
call fcn.009fef60
push 0xa178f8
push edi
call fcn.00a003f0
push eax
push ebx
push esi
call fcn.009fef60
push 0xa178d8
push edi
call fcn.00a003f0
push eax
push ebx
push esi
call fcn.009fef60
push 0xa178c0
push edi
call fcn.00a003f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.009fef60
push 0xa178a0
push edi
call fcn.00a003f0
push eax
push ebx
push esi
call fcn.009fef60
push 0xa17888
push edi
call fcn.00a003f0
push eax
push ebx
push esi
call fcn.009fef60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0xa001b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00a00140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00a00140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00a00140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00a00140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xa00bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xa00c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xa1287c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xa00c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xa00c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x403670
Capabilities:
Encode data using xor

Disassembly:
jbe 0x403679
mov edi, 0xede0b3fa
test ebx, 0x14b3f6c2
test ebx, 0x14b3f6c2
add bl, dl
inc eax
lea esi, [0xa62797d6]
xor edi, esi
imul eax, ecx
mov ah, 0x61
mov ecx, 0xe9d419e2
imul ecx, edi
dec ebp
dec ecx
or dl, cl
test cl, 0xbc
mov ebp, 0xeb42
jmp 0x4036b6
xor ebp, 0xe89e
imul edx, esi
xor edi, 0xfe86b0e0
sub ebp, 0x3da
test edx, edx
lea esi, [ebp]
dec eax
xchg dh, al
imul esi, esi, 0x72f
dec edi
dec dl
mov edx, edi
mov al, dl
dec edx
test bl, 0x56
sub ebp, 0xc7579440
mov al, 0xb6
sub esi, 0xfffff02e
adc edx, 0xa5b01ed7
and eax, 0x11074eac
sub esi, 0xfd3
lea ebp, [0x650a0f19]
mov eax, ebp
xor eax, 0x84d4c8bd
cmp esi, 0x52e
jg 0x4036d9
movsx eax, cx
test ah, 3
lea edx, [0xc8dc76ba]
imul edi, ecx
imul edi, eax, 0x409b68
call 0x403753
imul ecx, esi
dec edx
sbb esi, edx
xchg bh, dh
imul eax, ecx, 0xb4d88d7d
xor ebp, 0x9689
or ah, 0x50
test ah, ah
mov edi, ebp
pop eax
dec ch
mov edi, esi
mov edi, 0xfa6bd566
cmp bl, 0x1f
cmp edx, esi
adc ch, dl
dec ecx
sbb edi, ebx
test ecx, 0x3b287a63
add ch, cl
xchg ecx, edi
mov ebp, 0x1e3cd
test dh, ah
mov esi, 0x883f43e3
add ecx, 0xdf7e1ff6
xor ebp, 0x99d4
jmp 0x403791
xor ebp, 0x7f4a
jmp 0x40379b
add ebx, ebp
test eax, ecx
imul esi, ebx
sub ebx, 0xb4f
imul edi, esi
mov ebx, ebp
cmp bh, dl
mov edi, 0x34469633
xor cl, al
mov ch, bh
and ecx, 0x8dedc382
push 0x479003
push 0xd0fb44
xchg ch, dl
sub dl, 0x64
mov bl, 0x24
sub ecx, 0xdd34a25a
test ecx, edx
movzx ecx, si
and dh, dh
add eax, 0x2ae1d
mov dh, 0xd1
mov ecx, edi
add eax, 0xafa
test eax, eax
jno 0x4037f8
dec dh
mov edx, 0x772f0170
push 0x3e5a43
push 0xdebe1e
movzx esi, bx
test ch, 0xa7
mov bl, bl
imul ebx, eax
imul ecx, ecx, 0xacf505aa
xchg esi, ebx
inc ebp
sbb dh, 0x95
imul ebp, eax
xor edi, 0x8096
cmp ebx, edi
movzx esi, bl
mov bl, dl
push 0x3f1d75
push esi
xchg dh, ch
inc ch
inc ebp
test al, 0x85
push ebp
push ebx
imul esi, ecx, 0xc0e88b7c
or ebx, ebx
sbb edx, esi
push eax
xchg bh, bh
ret
Function at 0x1001c30
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x18]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x1c]
and dword [edi], 0
push dword [ebp + 8]
and byte [eax], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebx, eax
test ebx, ebx
je 0x1001c9e
cmp word [ebx + 8], 2
jne 0x1001c86
cmp word [ebx + 0xa], 4
jne 0x1001c86
mov esi, dword [ebx + 0xc]
jmp 0x1001c80
push dword [eax]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.01001bcd
test eax, eax
mov dword [edi], eax
je 0x1001c99
lea edi, [eax + 0x1c]
add esi, 4
mov eax, dword [esi]
test eax, eax
jne 0x1001c64
mov ecx, dword [ebx]
mov edx, dword [ebp + 0x18]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x1001c8b
xor eax, eax
jmp 0x1001cc4
push 8
pop eax
jmp 0x1001cc4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
mov eax, 0x2af9
sub ecx, eax
je 0x1001cc4
dec ecx
je 0x1001cbf
dec ecx
je 0x1001cb8
dec ecx
jmp 0x1001cc4
mov eax, 0x2afb
jmp 0x1001cc4
mov eax, 0x2afa
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
Function at 0x1002295
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
cmp dword [0x100be1c], 0
mov dword [ebp - 0x18], 0x10011fc
mov dword [ebp - 0x14], 0x1001e67
mov dword [ebp - 0x10], 0x10011f0
mov dword [ebp - 0xc], 0x10020e1
mov dword [ebp - 8], 0x10011e0
mov dword [ebp - 4], fcn.01001e2e
jne 0x10023f1
push 0x104
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x10023e7
xor eax, eax
mov cl, byte [ebp + eax - 0x22c]
mov byte [ebp + eax - 0x124], cl
inc eax
test cl, cl
jne 0x10022f1
push ebx
push esi
push edi
lea edi, [ebp - 0x124]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x100230e
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, 0x10011d8
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x124]
push eax
movsd dword es:[edi], dword [esi]
call ebx
mov esi, eax
test esi, esi
je 0x100234f
push 0x10011fc
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x100234b
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor esi, esi
test esi, esi
jne 0x10023a6
xor eax, eax
mov cl, byte [ebp + eax - 0x22c]
mov byte [ebp + eax - 0x124], cl
inc eax
test cl, cl
jne 0x1002351
lea edi, [ebp - 0x124]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x100236b
mov esi, 0x10011d0
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x124]
push eax
movsd dword es:[edi], dword [esi]
call ebx
mov esi, eax
test esi, esi
je 0x10023e4
push 0x10011fc
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x10023a2
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor esi, esi
test esi, esi
je 0x10023e4
xor edi, edi
push dword [ebp + edi*8 - 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [ebp + edi*8 - 0x14], eax
je 0x10023c3
inc edi
cmp edi, 3
jl 0x10023a8
jmp 0x10023cc
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor esi, esi
test esi, esi
je 0x10023e4
xor eax, eax
mov ecx, dword [ebp + eax - 0x14]
mov dword [eax + 0x100b030], ecx
add eax, 8
cmp eax, 0x18
jl 0x10023d2
pop edi
pop esi
pop ebx
mov dword [0x100be1c], 1
movzx eax, word [ebp + 8]
mov eax, dword [eax*8 + 0x100b030]
leave
ret 4

Function at 0x1002417
Capabilities:
Terminate process

Disassembly:
cmp dword [0x100c0c0], 0
je 0x1002427
push 0x2729
jmp 0x100242c
push 0x274f
push 1
call fcn.01009b92
pop ecx
pop ecx
push esi
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
push eax
push dword [esp + 0xc]
call fcn.01009c01
call esi
push eax
push 0x272a
push 2
call fcn.01009b92
add esp, 0xc
call dword [sym.imp.WS2_32.dll_WSACleanup]
push 1
call fcn.01004643
pop esi

Function at 0x1002509
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
mov eax, dword [ebp + 0x10]
push 0
sub eax, esi
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_recv]
inc dword [0x100c46c]
test eax, eax
jl 0x1002540
je 0x1002539
add dword [ebp + 0xc], eax
add esi, eax
cmp esi, dword [ebp + 0x10]
jb 0x100250f
mov eax, esi
pop esi
pop ebp
ret 0xc
or eax, 0xffffffff
jmp 0x100253b
Function at 0x1002628
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
xor edi, edi
cmp dword [0x100bde8], edi
mov dword [ebp - 4], 0x80
je 0x1002698
cmp dword [0x100be04], edi
jne 0x10026b2
push esi
mov esi, dword [sym.imp.WS2_32.dll_recvfrom]
lea eax, [ebp - 4]
push eax
push dword [0x100b008]
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
cmp esi, edi
mov ebx, eax
jbe 0x1002695
cmp dword [0x100be18], edi
jne 0x1002695
push dword [0x100b008]
xor esi, esi
inc esi
mov dword [0x100be18], esi
call fcn.010025d3
push eax
push 0x272c
push esi
call fcn.01009b92
add esp, 0xc
pop esi
jmp 0x10026c4
cmp dword [0x100bdfc], edi
je 0x10026b2
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.01002509
mov ebx, eax
jmp 0x10026ca
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_recv]
mov ebx, eax
inc dword [0x100c46c]
cmp ebx, edi
jge 0x10026e4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 0x272d
push 1
call fcn.01009b92
add esp, 0xc
pop edi
mov eax, ebx
pop ebx
leave
ret 0xc

Function at 0x10026ec
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x100be00]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
cmp eax, edi
mov dword [ebp - 4], esi
je 0x100270d
push eax
call ebx
cmp dword [0x100bde8], edi
je 0x1002788
cmp dword [0x100be04], edi
jne 0x1002788
mov ecx, dword [0x100b008]
push ecx
call fcn.010025b5
push eax
push ecx
push edi
push esi
push dword [ebp + 0xc]
mov esi, dword [sym.imp.WS2_32.dll_sendto]
push dword [ebp + 8]
call esi
inc dword [0x100c46c]
mov edi, eax
test edi, edi
jge 0x10027d0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2747
jne 0x10027b1
push 0x4650
call ebx
mov ecx, dword [0x100b008]
push ecx
call fcn.010025b5
push eax
push ecx
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
inc dword [0x100c46c]
mov edi, eax
test edi, edi
jl 0x100274b
jmp 0x10027b1
cmp esi, edi
jle 0x10027d0
push 0
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_send]
inc dword [0x100c46c]
mov edi, eax
cmp edi, 0xffffffff
je 0x10027b1
add dword [ebp + 0xc], edi
sub esi, edi
test esi, esi
jg 0x100278c
test edi, edi
jge 0x10027d0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 0x272e
push 1
call fcn.01009b92
add esp, 0xc
or eax, 0xffffffff
jmp 0x10027d3
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x10047e4
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov ecx, dword [ebp + 8]
cmp ecx, dword [0x100d6e4]
push ebx
push esi
push edi
jae 0x1004969
mov eax, ecx
sar eax, 5
lea ebx, [eax*4 + 0x100d700]
mov eax, dword [ebx]
mov esi, ecx
and esi, 0x1f
shl esi, 3
mov al, byte [eax + esi + 4]
test al, 1
mov dword [ebp - 0x14], ebx
je 0x1004969
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x10], edi
jne 0x1004838
xor eax, eax
jmp 0x100497d
test al, 0x20
je 0x1004849
push 2
push edi
push edi
push ecx
call fcn.01006ce3
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x1004905
cmp dword [ebp + 0x10], edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov dword [ebp + 8], edi
jbe 0x100493d
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x418]
cmp ecx, dword [ebp + 0x10]
jae 0x100489f
mov edx, dword [ebp - 4]
inc dword [ebp - 4]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x1004890
inc dword [ebp - 0x10]
mov byte [eax], 0xd
inc eax
inc edi
mov ebx, dword [ebp - 0x14]
mov byte [eax], dl
inc eax
inc edi
invalid
invalid

Function at 0x1004be6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x1004c16
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13

Function at 0x1004c61
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.01004928
fstp qword [edi]
adc al, 0x1e
lea eax, [ebp - 0x40]
push eax
invalid
invalid

Function at 0x1004e60
Capabilities:
Inspect section memory permissions

Disassembly:
mov dword [ebp + 0xc], ebx
jbe 0x1004e98
movzx eax, word [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
lea eax, [eax + eax*4]
push dword [ecx + eax*8 + 0x10]
lea eax, [ecx + eax*8]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add ecx, dword [ebp + 0x10]
add eax, esi
push ecx
push eax
call fcn.01004899
add esp, 0xc
inc dword [ebp + 0xc]
mov ax, word [ebp + 0xc]
cmp ax, word [edi + 6]
jb 0x1004e65
invalid

Function at 0x1005634
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
invalid