joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43719f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
add ecx, 0x101fd
call fcn.00437134
add byte [edi + 0x4b], cl
cmp dword [ecx + 0x40], ecx
dec ebp
inc ecx
cmp cl, byte [edx - 0x7d]
add esp, 4
jmp 0x43713d
inc edi
cmp al, byte [esi + 0x4e]
add esp, 4
jmp 0x43713d
sub ecx, 0x50b1
pop ecx
push edx
push edi
add esp, 4
and edx, 0xac4
pop edx
lea edx, [ebp - 0x16cc]
mov dword [ebp - 0xc28], edx
mov eax, dword [ebp - 0x4d8]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc24], ecx
xor edx, edx
mov word [ebp - 0x1fc], dx
xor eax, eax
mov word [ebp - 0x104], ax
push ecx
push edx
add esp, 4
add ecx, 0x8ee4
sub ecx, 0x593a
pop ecx
push edx
call 0x43719f
add byte [ecx*2 + 0x353a5040], dh
aas
dec edi
dec ebp
add esp, 4
or edx, 0xe797
sub edx, 0x12c91
pop edx
mov ecx, dword [ebp - 0xc24]
mov dx, word [ecx]
mov word [ebp - 0xf82], dx
mov eax, dword [ebp - 0xc24]
add eax, 2
mov dword [ebp - 0xc24], eax
mov cx, word [ebp - 0xf82]
mov word [ebp - 0x1fc], cx
mov edx, dword [ebp - 0xc28]
mov ax, word [edx]
mov word [ebp - 0xf84], ax
mov ecx, dword [ebp - 0xc28]
add ecx, 2
mov dword [ebp - 0xc28], ecx
mov dx, word [ebp - 0xf84]
mov word [ebp - 0x104], dx
push ecx
add ecx, 0x180a8
call 0x43721d
add byte [edx], dh
xor dh, byte [esi]
cmp byte ss:[esi], dh
inc ebp
add esp, 4
pop ecx
push esi
add esi, 0x5b47
xor esi, 0x144c8
pop esi
push esi
push ecx
add esp, 4
sub esi, 0x4c47
pop esi
movzx eax, word [ebp - 0x104]
test eax, eax
jne 0x43725e
movzx ecx, word [ebp - 0x1fc]
movzx edx, word [ebp - 0x104]
sub ecx, edx
mov dword [ebp - 0x14e4], ecx
jmp 0x4372c1
movzx eax, word [ebp - 0x1fc]
movzx ecx, word [ebp - 0x104]
cmp eax, ecx
je 0x43717d
movzx edx, word [ebp - 0x1fc]
xor edx, 0x20
movzx eax, word [ebp - 0x104]
cmp edx, eax
je 0x43717d
movzx ecx, word [ebp - 0x1fc]
movzx edx, word [ebp - 0x104]
cmp ecx, edx
jge 0x4372ab
mov dword [ebp - 0x14e0], 0xffffffff
jmp 0x4372b5
mov dword [ebp - 0x14e0], 1
mov eax, dword [ebp - 0x14e0]
mov dword [ebp - 0x14e4], eax
cmp dword [ebp - 0x14e4], 0
jne 0x43730a
push edi
push esi
add esp, 4
sub edi, 0xda6d
add edi, 0xa4c0
add edi, 0x1ac1
pop edi
push ebx
and ebx, 0x11e27
and ebx, 0x14751
sub ebx, 0x7107
and ebx, 0x3c66
pop ebx
mov ecx, dword [ebp - 0x4d8]
mov dword [ebp - 0x6ec], ecx
jmp 0x437372
push edx
push esi
add esp, 4
xor edx, 0x3272
jmp 0x43731e
or edx, 0x115ea
jmp 0x43732d
pop edx
push ebx
sub ebx, 0x15edc
sub ebx, 0x84f6
pop ebx
mov edx, dword [ebp - 0x4d8]
mov eax, dword [edx]
mov dword [ebp - 0x4d8], eax
mov ecx, dword [ebp - 0x4d8]
cmp ecx, dword [ebp - 0xc2c]
je 0x437368
mov edx, dword [ebp - 0x4d8]
cmp dword [edx + 0x30], 0
jne 0x43711e
mov dword [ebp - 0x6ec], 0
Function at 0x43721d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
add ecx, 0x101fd
call fcn.00437134
add byte [edi + 0x4b], cl
cmp dword [ecx + 0x40], ecx
dec ebp
inc ecx
cmp cl, byte [edx - 0x7d]
add esp, 4
jmp 0x43713d
inc edi
cmp al, byte [esi + 0x4e]
add esp, 4
jmp 0x43713d
sub ecx, 0x50b1
pop ecx
push edx
push edi
add esp, 4
and edx, 0xac4
pop edx
lea edx, [ebp - 0x16cc]
mov dword [ebp - 0xc28], edx
mov eax, dword [ebp - 0x4d8]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc24], ecx
xor edx, edx
mov word [ebp - 0x1fc], dx
xor eax, eax
mov word [ebp - 0x104], ax
push ecx
push edx
add esp, 4
add ecx, 0x8ee4
sub ecx, 0x593a
pop ecx
push edx
call 0x43719f
add byte [ecx*2 + 0x353a5040], dh
aas
dec edi
dec ebp
add esp, 4
or edx, 0xe797
sub edx, 0x12c91
pop edx
mov ecx, dword [ebp - 0xc24]
mov dx, word [ecx]
mov word [ebp - 0xf82], dx
mov eax, dword [ebp - 0xc24]
add eax, 2
mov dword [ebp - 0xc24], eax
mov cx, word [ebp - 0xf82]
mov word [ebp - 0x1fc], cx
mov edx, dword [ebp - 0xc28]
mov ax, word [edx]
mov word [ebp - 0xf84], ax
mov ecx, dword [ebp - 0xc28]
add ecx, 2
mov dword [ebp - 0xc28], ecx
mov dx, word [ebp - 0xf84]
mov word [ebp - 0x104], dx
push ecx
add ecx, 0x180a8
call 0x43721d
add byte [edx], dh
xor dh, byte [esi]
cmp byte ss:[esi], dh
inc ebp
add esp, 4
pop ecx
push esi
add esi, 0x5b47
xor esi, 0x144c8
pop esi
push esi
push ecx
add esp, 4
sub esi, 0x4c47
pop esi
movzx eax, word [ebp - 0x104]
test eax, eax
jne 0x43725e
movzx ecx, word [ebp - 0x1fc]
movzx edx, word [ebp - 0x104]
sub ecx, edx
mov dword [ebp - 0x14e4], ecx
jmp 0x4372c1
movzx eax, word [ebp - 0x1fc]
movzx ecx, word [ebp - 0x104]
cmp eax, ecx
je 0x43717d
movzx edx, word [ebp - 0x1fc]
xor edx, 0x20
movzx eax, word [ebp - 0x104]
cmp edx, eax
je 0x43717d
movzx ecx, word [ebp - 0x1fc]
movzx edx, word [ebp - 0x104]
cmp ecx, edx
jge 0x4372ab
mov dword [ebp - 0x14e0], 0xffffffff
jmp 0x4372b5
mov dword [ebp - 0x14e0], 1
mov eax, dword [ebp - 0x14e0]
mov dword [ebp - 0x14e4], eax
cmp dword [ebp - 0x14e4], 0
jne 0x43730a
push edi
push esi
add esp, 4
sub edi, 0xda6d
add edi, 0xa4c0
add edi, 0x1ac1
pop edi
push ebx
and ebx, 0x11e27
and ebx, 0x14751
sub ebx, 0x7107
and ebx, 0x3c66
pop ebx
mov ecx, dword [ebp - 0x4d8]
mov dword [ebp - 0x6ec], ecx
jmp 0x437372
push edx
push esi
add esp, 4
xor edx, 0x3272
jmp 0x43731e
or edx, 0x115ea
jmp 0x43732d
pop edx
push ebx
sub ebx, 0x15edc
sub ebx, 0x84f6
pop ebx
mov edx, dword [ebp - 0x4d8]
mov eax, dword [edx]
mov dword [ebp - 0x4d8], eax
mov ecx, dword [ebp - 0x4d8]
cmp ecx, dword [ebp - 0xc2c]
je 0x437368
mov edx, dword [ebp - 0x4d8]
cmp dword [edx + 0x30], 0
jne 0x43711e
mov dword [ebp - 0x6ec], 0
Function at 0x464197
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.0045852d
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x4641cf
xor eax, eax
jmp 0x4641fb
cmp esi, dword [ebp - 4]
je 0x4641f8
cmp dword [ebp + 0xc], 0
je 0x4641f8
push dword [edi + 0x9c]
call fcn.00463da5
push dword [edi + 0x9c]
mov esi, eax
call int.0044c94a
pop ecx
pop ecx
cmp esi, eax
je 0x4641cb
xor eax, eax
inc eax
pop edi
pop esi
leave
ret
Function at 0x10001037
Capabilities:
Connect socket
Resolve dns

Disassembly:
jmp 0x10006880
sub esp, 0x10
xor eax, eax
push esi
mov esi, ecx
push edi
or ecx, 0xffffffff
lea edx, [esi + 0x15c]
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 1
jae 0x100068a4
pop edi
pop esi
add esp, 0x10
ret
push edx
call dword [sym.imp.WSOCK32.dll_gethostbyname]
test eax, eax
jne 0x100068cc
push 0x837
push str.host_Proxy_server_error
mov ecx, esi
call fcn.1000113b
mov byte [esi + 4], 0x11
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret
mov eax, dword [eax + 0xc]
xor edx, edx
mov ecx, dword [eax]
mov ax, word [esi + 0x16]
push eax
mov edi, dword [ecx]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], edx
mov word [esp + 0xc], 2
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], edx
call dword [sym.imp.WSOCK32.dll_htons]
mov edx, dword [esi + 0x10]
lea ecx, [esp + 8]
push 0x10
push ecx
push edx
mov word [esp + 0x16], ax
mov dword [esp + 0x18], edi
call dword [sym.imp.WSOCK32.dll_connect]
test eax, eax
je 0x10006932
push 0x838
push str.connect_Proxy_server_error
mov ecx, esi
call fcn.1000113b
mov byte [esi + 4], 0
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret
mov ecx, esi
call fcn.10001271
test eax, eax
jne 0x1000695a
push 0x838
push str.handle_Proxy_error
mov ecx, esi
call fcn.1000113b
mov byte [esi + 4], 0
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret
mov dword [esi + 0xc], 1
mov byte [esi + 4], 1
pop edi
mov eax, 1
pop esi
add esp, 0x10
ret

Function at 0x10001041
Capabilities:
Encode data using xor

Disassembly:
jmp 0x100044a0
sub esp, 0x1c
mov al, 1
push ebx
mov byte [esp + 4], al
mov byte [esp + 6], al
mov byte [esp + 9], al
mov byte [esp + 0xa], al
mov byte [esp + 0xc], al
mov byte [esp + 0xd], al
mov byte [esp + 0xe], al
xor eax, eax
mov dword [esp + 0x10], eax
push esi
mov dword [esp + 0x18], eax
push edi
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x20], eax
mov word [esp + 0x24], ax
mov ecx, edi
mov byte [esp + 0x26], al
xor edx, edx
mov eax, dword [ecx]
mov byte [esp + 0xd], dl
mov byte [esp + 0xf], dl
mov byte [esp + 0x10], dl
mov cl, byte [ecx + 4]
mov byte [esp + 0x13], dl
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], cl
xor esi, esi
mov al, byte [esp + esi + 0x18]
lea ecx, [esp + esi + 0x18]
cmp al, dl
je 0x1000451d
xor eax, eax
mov bl, byte [esp + eax + 0xc]
xor byte [ecx + eax], bl
inc eax
cmp eax, 0xa
jle 0x10004510
inc esi
cmp esi, 5
jl 0x10004502
mov edx, dword [esp + 0x1d]
mov ecx, dword [esp + 0x21]
lea eax, [edi + 5]
pop edi
pop esi
pop ebx
mov dword [eax], edx
mov dx, word [esp + 0x19]
mov dword [eax + 4], ecx
mov word [eax + 8], dx
xor eax, eax
add esp, 0x1c
ret 4
Function at 0x10001064
Capabilities:
Get proxy
Query or enumerate registry value

Disassembly:
jmp 0x10006b20
sub esp, 0x520
push ebx
mov ebx, ecx
push edi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x24]
rep stosd dword es:[edi], eax
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
lea eax, [esp + 0x28]
push 0x1001fd54
push eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x400
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [esp + 0xc]
lea edx, [esp + 0x24]
push ecx
push edx
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x10006ccc
mov dword [esp + 0x10], eax
mov ecx, 0x100
mov dword [esp + 0x14], eax
lea edi, [esp + 0x128]
mov dword [esp + 0x18], eax
push ebp
mov dword [esp + 0x20], eax
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
push esi
lea edx, [esp + 0x130]
push ecx
push edx
push eax
mov dword [esp + 0x34], eax
push eax
mov eax, dword [esp + 0x24]
push str.ProxyServer
push eax
call ebp
test eax, eax
jne 0x10006c58
lea ecx, [esp + 0x130]
push str.socks
push ecx
call fcn.1000c990
mov edx, eax
add esp, 8
test edx, edx
je 0x10006c58
lea esi, [ebx + 0x15c]
mov ecx, 0x10
xor eax, eax
mov edi, esi
add edx, 6
rep stosd dword es:[edi], eax
mov al, byte [edx]
mov edi, dword [esp + 0x10]
cmp al, 0x3a
je 0x10006c1c
cmp al, 0x3b
je 0x10006c1c
lea ecx, [esp + edi + 0x130]
cmp edx, ecx
jae 0x10006c1c
mov byte [esi], al
mov al, byte [edx + 1]
inc esi
inc edx
cmp al, 0x3a
jne 0x10006c02
cmp byte [edx], 0x3a
jne 0x10006c58
mov al, byte [edx + 1]
inc edx
cmp al, 0x3a
je 0x10006c47
lea ecx, [esp + 0x18]
cmp al, 0x3b
je 0x10006c47
lea esi, [esp + edi + 0x130]
cmp edx, esi
jae 0x10006c47
mov byte [ecx], al
mov al, byte [edx + 1]
inc ecx
inc edx
cmp al, 0x3a
jne 0x10006c2d
lea edx, [esp + 0x18]
push edx
call fcn.1000bbf2
add esp, 4
mov word [ebx + 0x16], ax
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x130]
mov edx, dword [esp + 0x14]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
lea ecx, [esp + 0x130]
push eax
push ecx
push 0
push 0
push str.ProxyEnable
push edx
mov dword [esp + 0x28], 0xa
call ebp
pop esi
pop ebp
test eax, eax
jne 0x10006cc1
mov cl, byte [esp + 0x128]
mov eax, 1
cmp cl, al
jne 0x10006cba
mov dword [ebx + 8], eax
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
add esp, 0x520
ret
mov dword [ebx + 8], 0
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
add esp, 0x520
ret
Function at 0x10001069
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x1000b430
sub esp, 0x210
push esi
push edi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x114]
mov dword [esp + 8], 0
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x21c]
lea eax, [esp + 0x10]
push eax
push ecx
mov dword [esp + 0x14], 0x103
call fcn.10001032
add esp, 8
lea edx, [esp + 8]
xor esi, esi
push edx
push 0x10029e30
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x1000b4c4
lea eax, [esp + 0xc]
lea ecx, [esp + 0x114]
push eax
mov eax, dword [esp + 0xc]
push ecx
push esi
lea edx, [esp + 0x1c]
push esi
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x114]
push ecx
call fcn.100011ae
add esp, 4
mov esi, eax
mov eax, dword [esp + 8]
test eax, eax
je 0x1000b4d3
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
add esp, 0x210
ret

Function at 0x10001078
Capabilities:
Hash data using sha1

Disassembly:
jmp 0x100081b0
mov dword [ecx], 0x1001d044
jmp fcn.100012b7

Function at 0x10001082
Capabilities:
Initialize winsock library

Disassembly:
jmp 0x100029a0
mov eax, dword [esp + 8]
sub esp, 0x190
sub eax, 0
je 0x100029f3
dec eax
jne 0x10002a02
lea eax, [esp]
push eax
push 2
call sub.WSOCK32.dll_WSAStartup
test eax, eax
je 0x100029d6
push 0
push str.error
push str.error___unable_to_start_winsock._n
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.100012a8
mov ecx, 0x10028390
call fcn.1000103c
mov eax, 1
add esp, 0x190
ret 0xc
mov ecx, 0x10022868
call fcn.10001154
call sub.WSOCK32.dll_WSACleanup
mov eax, 1
add esp, 0x190
ret 0xc

Function at 0x10001113
Capabilities:
Receive data
Receive data on socket

Disassembly:
jmp 0x10007460
push esi
mov esi, ecx
call fcn.100011fe
test eax, eax
jne 0x10007482
mov ecx, esi
mov dword [esi + 0x2f0], eax
call fcn.10001244
mov ecx, esi
call fcn.1000124e
pop esi
ret
push ebx
push edi
xor ebx, ebx
mov ecx, 0x100
xor eax, eax
lea edi, [esi + 0x2f8]
mov dword [esi + 0x2f4], ebx
push 0x64
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [sym.imp.WSOCK32.dll_recv]
mov eax, dword [esi + 0x2f0]
test eax, eax
je 0x1000750e
mov ecx, dword [esi + 0x2f4]
mov eax, 0x3ff
sub eax, ecx
push 0
push eax
lea eax, [ecx + esi + 0x2f8]
mov ecx, dword [esi + 0x10]
push eax
push ecx
call edi
cmp eax, 1
jge 0x100074d7
inc ebx
test eax, eax
jne 0x100074ea
mov eax, dword [esi + 0x2f4]
test eax, eax
jle 0x100074f2
add ebx, 5
jmp 0x100074f2
jle 0x100074f2
add dword [esi + 0x2f4], eax
cmp dword [esi + 0x2f4], 0x3f6
jg 0x1000750e
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp ebx, 0x12c
jl 0x100074a9
mov ecx, esi
call fcn.100011bd
mov ecx, esi
mov dword [esi + 0x2f0], 0
call fcn.10001244
mov ecx, esi
call fcn.1000124e
pop edi
pop ebx
pop esi
ret
Function at 0x10001136
Capabilities:
Create process on windows

Disassembly:
jmp 0x1000ae90
sub esp, 0x104
mov ecx, 0x41
xor eax, eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
cmp dword [0x10029f7c], 0x61
jne 0x1000aee4
push 0x10029f48
call esi
cmp eax, 0xa
jle 0x1000aee4
push 0x10029f48
push 0x10020e18
push 0x10020dec
lea eax, [esp + 0x14]
push str._s_r_n_r_n_s_r_n_r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
jmp 0x1000af31
push 0x10029f48
call esi
cmp eax, 0xa
jle 0x1000af14
push 0x10029f48
push 0x10020da4
push 0x10020d78
lea ecx, [esp + 0x14]
push str._s_r_n_r_n_s_r_n_r_n
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
jmp 0x1000af31
push 0x10020d50
push 0x10020d24
lea edx, [esp + 0x10]
push str._s_r_n_r_n_s_r_n
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x40
lea eax, [esp + 0xc]
push 0x10020d04
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 5
push 0
push str.http:__www.fzbozc.com_BarRegister.aspx
push str.iexplore.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
add esp, 0x104
ret

Function at 0x10001145
Capabilities:
Check if file exists
Get file attributes

Disassembly:
jmp 0x10006220
sub esp, 0x208
mov ecx, 0x41
xor eax, eax
push ebx
push esi
push edi
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x110]
rep stosd dword es:[edi], eax
push eax
lea eax, [esp + 0x114]
push eax
call fcn.100012a3
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x118]
push str.BozcRunLog.txt
push ecx
lea edx, [esp + 0x1c]
push str._s_s
push edx
call ebx
add esp, 0x18
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10006290
lea ecx, [esp + 0xc]
push 0x1001fd50
push ecx
jmp 0x1000629a
lea edx, [esp + 0xc]
push 0x1002085c
push edx
call fcn.1000bb2a
mov esi, eax
add esp, 8
test esi, esi
je 0x10006301
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x21c]
mov ecx, dword [esp + 0x218]
push eax
push ecx
push 0
call fcn.1000ca10
add esp, 4
lea edx, [esp + 0x14]
push eax
push str._d___s__d__r_n
push edx
call ebx
add esp, 0x14
lea eax, [esp + 0xc]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea ecx, [esp + 0x14]
push 1
push ecx
call fcn.1000bd0c
push esi
call fcn.1000ba7c
add esp, 0x14
pop edi
pop esi
pop ebx
add esp, 0x208
ret
Function at 0x100011bd
Capabilities:
Create process on windows

Disassembly:
jmp 0x10007580
sub esp, 0x208
push ebx
mov ebx, ecx
mov edx, dword [ebx + 0x2f4]
cmp edx, 0x28
jge 0x1000759e
xor eax, eax
pop ebx
add esp, 0x208
ret
push esi
push edi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0xc]
push str.__BarVer_
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push str._BarVer_
push eax
lea ecx, [ebx + 0x2f8]
push edx
push ecx
call fcn.1000129e
add esp, 0x14
test eax, eax
jle 0x100076c7
lea edx, [esp + 0xc]
push edx
call fcn.100011ae
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
add esp, 4
cmp esi, 0x2777
jle 0x10007675
lea eax, [ebx + 0x2b4]
push eax
call edi
cmp eax, 0xa
jge 0x10007675
call fcn.100010a0
cmp eax, 0x5a
jge 0x10007675
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x110]
push esi
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x114]
push 0x10020c00
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [esp + 0x110]
push 0x40
push 0x10020bf0
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 5
push 0
push str.http:__www.fzbozc.com_DownLoad.html
push str.iexplore.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x208
ret
cmp esi, 0x2710
jle 0x10007698
cmp esi, 0x2774
jge 0x1000769e
call fcn.100010a0
cmp eax, 0x5a
jge 0x10007698
add esi, 0xffffd8f0
push esi
jmp 0x100076ba
cmp esi, 0x2774
jle 0x100076c7
call fcn.100010a0
cmp eax, 0x5a
jle 0x100076c7
add ebx, 0x2b4
push ebx
call edi
cmp eax, 0xa
jle 0x100076c7
push 0
push str.FM_l_icdij
call fcn.1000125d
add esp, 8
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x208
ret
Function at 0x100011d1
Capabilities:
Connect socket
Resolve dns

Disassembly:
jmp 0x10006710
sub esp, 0x54
push ebp
push esi
mov esi, ecx
push edi
lea ebp, [esi + 0x11c]
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 1
jge 0x10006744
push 0x837
push str.host_name_error
mov ecx, esi
call fcn.1000113b
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x54
ret
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x20]
push eax
push ebp
call fcn.100011b3
add esp, 8
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.WSOCK32.dll_gethostbyname]
test eax, eax
jne 0x1000678c
push 0x837
push str.host_server_error
mov ecx, esi
call fcn.1000113b
mov byte [esi + 4], 0xf
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x54
ret
mov edx, dword [eax + 0xc]
xor ecx, ecx
mov eax, dword [edx]
mov dx, word [esi + 0x14]
push edx
mov edi, dword [eax]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
mov word [esp + 0x14], 2
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
call dword [sym.imp.WSOCK32.dll_htons]
mov ecx, dword [esi + 0x10]
mov word [esp + 0x12], ax
lea eax, [esp + 0x10]
push 0x10
push eax
push ecx
mov dword [esp + 0x20], edi
call dword [sym.imp.WSOCK32.dll_connect]
test eax, eax
je 0x100067f3
push 0x838
push str.host_connect_error
mov ecx, esi
call fcn.1000113b
mov byte [esi + 4], 0
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x54
ret
mov eax, dword [esi + 0x10]
lea edx, [esp + 0xc]
push edx
push 0x8004667e
push eax
mov byte [esi + 4], 1
mov dword [esi + 0xc], 1
mov dword [esp + 0x18], 1
call dword [sym.imp.WSOCK32.dll_ioctlsocket]
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x54
ret

Function at 0x100011d6
Capabilities:
Send data
Send data on socket

Disassembly:
jmp 0x10006680
push esi
mov esi, dword [ecx + 0x10]
cmp esi, 0xffffffff
jne 0x1000668f
xor eax, eax
pop esi
ret 8
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
test ecx, ecx
jne 0x100066a9
push edi
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
pop edi
push 0
push ecx
push edx
push esi
call dword [sym.imp.WSOCK32.dll_send]
xor ecx, ecx
pop esi
cmp ecx, eax
sbb eax, eax
neg eax
ret 8
Function at 0x100011e0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x100041e0
sub esp, 0x3c
xor eax, eax
push ebx
mov ebx, ecx
lea ecx, [ebx + 0x33d0]
cmp dword [ecx], 0
je 0x100041fc
inc eax
add ecx, 0x10
cmp eax, 0x51
jl 0x100041ee
test eax, eax
jle 0x10004352
push ebp
push esi
lea esi, [ebx + 0x33dc]
push edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x20], eax
mov eax, dword [esi]
mov ecx, dword [esi - 0xc]
mov edx, dword [esi - 8]
mov ebp, dword [esi - 4]
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], ecx
mov ecx, 8
xor eax, eax
lea edi, [esp + 0x2c]
cmp edx, 1
rep stosd dword es:[edi], eax
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], edx
mov byte [esp + 0x2c], 1
jl 0x100042b0
mov edi, 0x1002054c
mov eax, 1
xor ebp, ebp
sub eax, edi
mov dword [esp + 0x1c], eax
mov dl, byte [esp + ebp + 0x2c]
mov esi, ebp
test ebp, ebp
mov byte [esp + ebp + 0x2d], dl
jle 0x10004283
mov al, byte [edi]
mov cl, byte [esp + esi + 0x2c]
push eax
push ecx
mov ecx, ebx
call fcn.1000121c
xor al, byte [esp + esi + 0x2b]
mov byte [esp + esi + 0x2c], al
dec esi
test esi, esi
jg 0x10004267
mov dl, byte [edi]
mov eax, dword [esp + 0x2c]
push edx
push eax
mov ecx, ebx
call fcn.1000121c
mov ecx, dword [esp + 0x1c]
inc ebp
inc edi
mov byte [esp + 0x2c], al
mov eax, dword [esp + 0x10]
add ecx, edi
cmp ecx, eax
jle 0x10004259
mov ebp, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
mov edx, eax
mov ecx, dword [esp + 0x24]
mov eax, ebp
add ecx, ebp
mov dword [esp + 0x1c], eax
cmp ebp, ecx
mov dword [esp + 0x24], ecx
jge 0x10004332
mov ecx, dword [esp + 0x28]
lea ebp, [ecx + ebx + 0x2a51]
xor ecx, ecx
xor esi, esi
mov cl, byte [ebx + eax + 0x1ec5]
mov edi, ecx
xor ecx, ecx
mov cl, byte [ebp]
xor edi, ecx
test edx, edx
jle 0x10004321
lea edx, [esp + edx + 0x2b]
mov dword [esp + 0x14], edx
mov eax, dword [esp + 0x14]
mov cl, byte [eax]
push ecx
push edi
mov ecx, ebx
call fcn.1000121c
mov cl, byte [esi + ebp + 1]
xor al, cl
mov ecx, dword [esp + 0x14]
mov byte [esi + ebp], al
mov eax, dword [esp + 0x10]
inc esi
dec ecx
cmp esi, eax
mov dword [esp + 0x14], ecx
jl 0x100042ef
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x24]
inc eax
cmp eax, ecx
mov dword [esp + 0x1c], eax
jl 0x100042cf
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
add esi, 0x10
dec eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x20], eax
jne 0x10004215
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x3c
ret
xor eax, eax
pop ebx
add esp, 0x3c
ret