joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2707fc00
Capabilities:
Hash data using sha256

Disassembly:
push edi
push 0x40
xor eax, eax
pop ecx
lea edi, [edx + 0x28]
rep stosd dword es:[edi], eax
and dword [edx + 4], eax
and dword [edx], eax
mov dword [edx + 8], 0x6a09e667
mov dword [edx + 0xc], 0xbb67ae85
mov dword [edx + 0x10], 0x3c6ef372
mov dword [edx + 0x14], 0xa54ff53a
mov dword [edx + 0x18], 0x510e527f
mov dword [edx + 0x1c], 0x9b05688c
mov dword [edx + 0x20], 0x1f83d9ab
mov dword [edx + 0x24], 0x5be0cd19
pop edi
ret

Function at 0x2707fc4a
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
mov ecx, dword [eax]
shr ecx, 5
and ecx, 0xf
lea ecx, [eax + ecx*4 + 0x28]
mov edx, dword [ecx]
push esi
movzx esi, byte [esp + 8]
shl edx, 8
or edx, esi
mov dword [ecx], edx
add dword [eax], 8
pop esi
jne 0x2707fc71
inc dword [eax + 4]
and dword [eax], 0
test dword [eax], 0x1ff
jne 0x2707fc7e
jmp fcn.2707fa90
ret

Function at 0x27085ad7
Capabilities:
Write file on windows

Disassembly:
push 0x34
mov eax, 0x2708cb0a
call fcn.2708a127
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x3c], ebx
je 0x27085bc6
cmp byte [esi + 0x41], bl
je 0x27085bc6
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 4]
cmp eax, 0xffffffff
jne 0x27085b0c
xor al, al
jmp 0x27085bc8
push ebx
push 8
lea ecx, [ebp - 0x2c]
call fcn.27085aad
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x2c]
call fcn.27085159
mov edi, dword [eax]
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x2c]
call fcn.27085159
mov eax, dword [eax]
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx]
lea ebx, [ebp - 0x30]
push ebx
mov ebx, dword [ebp - 0x18]
add ebx, edi
push ebx
push eax
lea eax, [esi + 0x44]
push eax
call dword [edx + 0x18]
sub eax, 0
je 0x27085b6b
dec eax
je 0x27085b6f
dec eax
dec eax
je 0x27085bc2
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.270291c7
mov al, bl
jmp 0x27085bc8
mov byte [esi + 0x41], 0
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.27085159
mov edi, dword [ebp - 0x30]
sub edi, dword [eax]
je 0x27085ba4
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x2c]
call fcn.27085159
push dword [esi + 0x4c]
mov eax, dword [eax]
push edi
push 1
push eax
call dword [sym.imp.msvcrt.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x27085b59
cmp byte [esi + 0x41], 0
je 0x27085bc2
test edi, edi
jne 0x27085b1a
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.2708577f
jmp 0x27085b1a
mov bl, 1
jmp 0x27085b5b
mov al, 1
call fcn.2708a171
ret
Function at 0x270872e1
Capabilities:
Write file on windows

Disassembly:
push 0x34
mov eax, 0x2708cb0a
call fcn.2708a127
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x3c], ebx
je 0x270873d7
cmp byte [esi + 0x42], bl
je 0x270873d7
mov eax, dword [esi]
mov edi, 0xffff
push edi
call dword [eax + 4]
movzx eax, ax
cmp di, ax
jne 0x2708731d
xor al, al
jmp 0x270873d9
push ebx
push 8
lea ecx, [ebp - 0x2c]
call fcn.27085aad
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x2c]
call fcn.27085159
mov edi, dword [eax]
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x2c]
call fcn.27085159
mov eax, dword [eax]
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx]
lea ebx, [ebp - 0x30]
push ebx
mov ebx, dword [ebp - 0x18]
add ebx, edi
push ebx
push eax
lea eax, [esi + 0x44]
push eax
call dword [edx + 0x18]
sub eax, 0
je 0x2708737c
dec eax
je 0x27087380
dec eax
dec eax
je 0x270873d3
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.270291c7
mov al, bl
jmp 0x270873d9
mov byte [esi + 0x42], 0
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.27085159
mov edi, dword [ebp - 0x30]
sub edi, dword [eax]
je 0x270873b5
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x2c]
call fcn.27085159
push dword [esi + 0x4c]
mov eax, dword [eax]
push edi
push 1
push eax
call dword [sym.imp.msvcrt.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x2708736a
cmp byte [esi + 0x42], 0
je 0x270873d3
test edi, edi
jne 0x2708732b
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.2708577f
jmp 0x2708732b
mov bl, 1
jmp 0x2708736c
mov al, 1
call fcn.2708a171
ret

Function at 0x270888a2
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x270b313c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
call fcn.270887f7
mov eax, sym.SocksCapExDLL32.dll_Ordinal_50
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x98]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x27088915
cmp dword [ebp - 0x94], 5
jb 0x27088936
jmp 0x27088932
cmp dword [ebp - 0x88], 1
jne 0x27088936
cmp dword [ebp - 0x94], 4
ja 0x27088932
jne 0x27088936
cmp dword [ebp - 0x90], 0
jbe 0x27088936
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x27090f3c
call fcn.2702953e
test eax, eax
jge 0x27088957
mov byte [0x27167e96], 1
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.27088f70
leave
ret
Function at 0x2718c798
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
test esp, 0xe637703f
and dword [ebp - 0xc], 0
jmp 0x272e657f
jl 0x2729340b
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x32
jmp 0x27293405
call sub.KERNEL32.dll_LeaveCriticalSection
mov eax, dword [ebp - 0xc]
movzx ebx, ax
pop edi
pop esi
pop ebx
jmp 0x2700f8de
push 0
call sub.msvcrt.dll_time
mov edi, dword [esi + 0x24]
sal dx, 0x28
sub eax, 0xa
movzx dx, ah
mov dh, 0xae
dec ebx
not dl
pop ecx
mov dl, 0x2c
mov edx, ebx
js 0x2726e182
mov ecx, dword [edi + edx*4]
cmp word [ecx + 0x1c], 1
jmp 0x27266bc4
call sub.KERNEL32.dll_InterlockedExchangeAdd
mov eax, dword [edi]
cmp eax, ebp
cmp dword [esi + 0x28], 0x32
jmp 0x2729d89f
jb 0x2726e182
mov eax, ebx
jmp 0x2708f1bd
jns 0x271c6fac
cmp dword [ebp - 4], 0x32
jmp 0x271fb905
push edi
mov si, dx
xchg esi, esi
movzx edi, ax
mov esi, eax
cmovo edi, ecx
xchg edi, edi
lea edi, [esi + 0x44]
mov bx, 0x5411
cmovge bx, dx
mov ebx, dword [edi]
push 1
jmp 0x272d71af
jne 0x2729340b
cmp dword [ecx + 0x74], eax
jmp 0x271948ba
cmp dword [esi + 0x38], 0
jmp 0x272eb6fa
ja 0x271fb90b
dec edx
jmp 0x2721515a
jbe 0x2719cf40
inc ebx
cmp ebx, 0x32
jb 0x2719cf40
push 0
push edi
call sub.KERNEL32.dll_InterlockedExchange
cmp dword [esi + 0x38], 0
jmp 0x272dd23c
push edi
jmp 0x271dcce0
je 0x2730240c
mov edi, dword [esi + 0x34]
jmp 0x27302407
push ebx
cmovs ebx, esi
push esi
jmp 0x2725c136
je 0x2719cf40
mov esi, dword [esi + 0x34]
cmp ebp, 0x3a985d13
cmc
cmp dx, dx
cmp dword [esi + 0x18], 0
jmp 0x272ec81b
je 0x2719cf40
push esi
jmp 0x2719cf3b
call fcn.27007877
mov ebx, dword [esi + 0x28]
cmc
and dword [ebp - 4], 0
jmp 0x271c6f86

Function at 0x27194484
Capabilities:
Terminate process

Disassembly:
push 0xc
cbw
mov eax, 0x2708e150
jmp loc.27019467
Function at 0x2719452f
Capabilities:
Send data
Send data on socket

Disassembly:
je 0x2729eb4d
push dword [ebp + 0x10]
movsx eax, ax
lahf
movzx ax, al
lea eax, [ebp - 0x10910]
push edi
push eax
jmp 0x27251c64
push eax
jmp 0x2718d95c
push dword [esi]
jmp 0x2729eb48
push ebp
jmp 0x27310d5b
push eax
push esi
jmp 0x27342020
push ecx
push ebx
jmp 0x271b5cf9
push dword [ebp + 0x10]
jmp 0x272fb0d7
mov eax, 0x10914
jmp 0x272bcafd
jle 0x2720c8a4
cmp word [esi + 0x16], 0x55
jmp 0x27267ae2
push dword [esi]
call sub.WS2_32.dll_send
cmp word [esi + 0x16], 0x55
jmp 0x27341dd4
jmp 0x2729eb4d
je 0x2729110b
cmp dword [esi + 0x7c], ecx
jmp 0x2732e591
je 0x2720c8a4
push ecx
mov ecx, ebp
movzx cx, cl
not ch
lea ecx, [ebp - 0x10910]
jmp 0x271bd490
call sub.WS2_32.dll_send
mov ecx, dword [ebp - 4]
shl bx, cl
pop edi
xor ecx, ebp
movzx ebx, sp
mov ebx, 0xc5b01580
movsx ebx, bp
pop ebx
jmp 0x27318d32
jne 0x2729eb4d
mov eax, ebx
jmp 0x272639c7
call fcn.27088fa0
mov eax, dword [0x270b313c]
xor eax, ebp
clc
mov dword [ebp - 4], eax
rol ax, 0xb
mov eax, dword [ebp + 8]
stc
test bp, 0x939e
push ebx
sub bx, di
shr bh, 0xd
mov ebx, dword [ebp + 0xc]
cmc
xor ecx, ecx
cmc
clc
cmp ax, bx
push edi
cmc
cmp eax, ecx
je 0x2720c8a4
cmp ebx, ecx
jmp 0x27244a1d
push ebx
jmp 0x271865b4
mov ebp, esp
jmp 0x2723fa0d
call fcn.27088f70
leave
jmp 0x270175ae
je 0x2720c8a4
cmp dword [esi + 0x80], ecx
jmp 0x27291105
jne 0x2729eb4d
cmp eax, edi
jmp 0x272aa041
call fcn.272dcbc9
mov edi, eax
test dx, bx
or eax, 0xffffffff
cmp esp, esp
test bx, sp
add esp, 0x14
clc
cmp cl, 0xae
cmp edi, eax
jmp 0x2717b866

Function at 0x2719b8a8
Capabilities:
Get system information on windows

Disassembly:
push 0
jmp 0x273345e0
push 0x6c
mov eax, 0x2708ec0e
call fcn.2708a127
mov ebx, dword [ebp + 8]
cmc
mov dword [ebp - 0x48], ebx
jmp 0x27269414
mov dword [ebp - 0x3c], ebx
cmc
and dword [ebp - 4], 0
jmp 0x27183596
call sub.KERNEL32.dll_BindIoCompletionCallback
test eax, eax
jmp loc.27022b29
push 0x2701e83e
jmp 0x27367181
push ebx
jmp 0x27274dc2

Function at 0x2719c220
Capabilities:
Terminate process

Disassembly:
push ebp
btc bp, 0x89
lea ebp, [esp - 0xa0c]
adc ax, 0x4d23
btr eax, 0x9d
shr ax, 8
lea esp, [esp - 0xa0c]
bt ax, di
xor eax, esi
push 0xfffffffffffffffe
inc eax
push 0x272f00f0
test dx, 0xd51d
mov ax, dx
bt eax, 0x9a
push 0x2708a1fd
sets ah
shl ax, cl
mov eax, dword fs:[0]
test esp, esi
push eax
setle al
lea esp, [esp - 0x34]
mov eax, dword [0x270b313c]

Function at 0x2719e204
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
adc bp, 0x2db0
mov ebp, esp
sar al, 0x22
rol ah, cl
and esp, 0xfffffff8
sal al, cl
bts ax, si
movzx eax, dx
push 0xffffffffffffffff
clc
rol al, cl
rol ah, 0x17
push 0x2708e277
mov eax, dword fs:[0]
jmp 0x27352b8d
push eax
cmovns di, sp
bswap edi
cwde
lea eax, [esp + 0x38]
not di
mov dword fs:[0], eax
mov edi, esi
movsx edi, bp
mov edi, 0x270c4e98
mov dword [esp + 0x2c], edi
jmp loc.2700a03c
push eax
not ah
test dh, dl
lea esp, [esp - 0x28]
push ebx
push esi
sbb ax, 0xd3a3
btr eax, 0xaf
push edi
shr eax, 0x29
mov eax, dword [0x270b313c]
shr di, 0x35
sar di, 0
bsf edi, esp
xor eax, esp
jmp 0x2728b38d
Function at 0x271a56f2
Capabilities:
Get socket status

Disassembly:
push ecx
jmp 0x2734bae7
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x51c
mov eax, dword [0x270b313c]
xor eax, esp
cmp bp, cx
mov dword [esp + 0x518], eax
test ax, 0x9c27
mov eax, dword [ebp + 0xc]
push ebx
rcl dh, cl
btr ebx, ecx
mov dx, sp
mov ebx, dword [ebp + 8]
neg dl
stc
btc dx, di
push esi
clc
stc
sub esi, esi
setle dl
xchg dh, dl
push edi
mov edi, dword [sym.imp.msvcrt.dll_strstr]
bswap dx
dec dx
mov dword [esp + 0xc], eax
jmp 0x271c294f
inc esi
movsx edx, dx
mov ax, bp
movzx eax, ax
mov eax, dword [ebx]
sub ecx, ecx
setae dh
cmovbe edx, edx
not dl
lea edx, [esp + 0x10]
push edx
jmp 0x271a4006
mov dword [esp + 0x2c], esi
jmp 0x272b798c
push ecx
inc eax
jmp 0x272eeaf6
mov dword [esp + 0x24], 0x12c
jmp loc.27015e9d
push eax
jmp 0x272508dc
mov dword [esp + 0x28], eax
jmp 0x2726af85
mov dword [esp + 0x20], ecx
not cx
lea ecx, [esp + 0x24]
jmp 0x272fdf39
push ecx
jmp 0x27348c0f

Function at 0x271ac478
Capabilities:
Initialize winsock library
Read .ini file
Resolve function by parsing pe exports

Disassembly:
call fcn.27007699
push dword [esp + 0x40]
jmp 0x272ee522
push ebp
mov ebp, esp
bts eax, ebx
and ax, 0xea2f
and esp, 0xfffffff8
push 0xffffffffffffffff
bts eax, ebx
push 0x2708e0cc
shr eax, cl
inc eax
mov eax, dword fs:[0]
cmp ebx, 0x15b17303
push eax
xor eax, esi
sal eax, 0xaa
xor al, 0xbb
sub esp, 0x658
xadd ah, ah
cmovbe eax, ebp
mov eax, dword [0x270b313c]
xor eax, esp
cmp dh, 0x83
cmp esp, esp
mov dword [esp + 0x650], eax
xor ax, 0x660b
sar eax, 0xbd
push ebx
push esi
ror ah, 0x38
push edi
mov eax, dword [0x270b313c]
stc
cmp al, ch
xor eax, esp
jmp 0x271e38f9
call fcn.270277ac
push eax
cmovnp esi, ebx
jmp 0x272a458b
call fcn.27026a82
sub ebx, ebx
xchg ecx, ecx
not ch
setno cl
mov dword [esp + 0x674], ebx
jmp 0x272f8577
mov dword [esp], str.configproxyrule.ini
push ecx
mov ecx, 0x37ac9533
mov ecx, eax
jmp 0x27368ea6
lea eax, [esp + 0x4cc]
jmp 0x2701a26f
push eax
lea eax, [esp + 0x668]
jmp 0x271f884c
mov dword fs:[0], eax
jmp 0x271b3d52
jmp 0x2734b46c
call fcn.27007699
xor eax, eax
jmp 0x271fdf19
lea esi, [esp + 0x70]
jmp 0x271bc27a
test eax, eax
jne 0x271ca686
mov eax, dword [esp + 0x40]
cmp si, 0x819a
cmc
add eax, 0xfffffff0
jmp 0x27277d28
call fcn.2702681a
pop ecx
cmc
test ebx, 0x47a6742a
jmp 0x272cc55d
lea ecx, [esp + 0x44]
jmp 0x271c66f2
call fcn.270070be
pop ecx
movsx cx, ah
pop ecx
bts eax, ecx
rol ah, 0xa7
mov byte [esp + 0x670], 2
cwde
neg al
mov eax, dword [esp + 0x6c]
add eax, 0xfffffff0
jmp 0x271aa253
Function at 0x271afc91
Capabilities:
Terminate process

Disassembly:
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [ebp - 0x238]
cmp esi, 0x79a2961d
add esp, 0x18
cmp ecx, 0xf534968d
add eax, 0xfffffff0
jmp 0x2702ef96
push 0x22c
mov ah, 0x3a
mov eax, 0x2708e491
jmp 0x271fe27b
lea eax, [ebp - 0x238]
push eax
call fcn.27026b42
pop ecx
jmp 0x27288d2d
call fcn.27027248
add esp, 0xc
jmp 0x271f3090
call fcn.27007877
mov eax, dword [ebp + 0xc]
mov edi, 0x270c4a48
jmp 0x272acdcb
push 1
jmp 0x272d4bba
call fcn.27324a81
mov dword [ebp - 4], ebx
jmp 0x272c9c38
call fcn.2708a127
mov eax, dword [ebp + 8]
jmp 0x272ef77f
push 0x270ba308
jmp 0x2701202f
lea eax, [ebp - 0x220]
jmp 0x272b1133
push eax
jmp 0x271a192e
mov esi, eax
bswap ax
mov eax, dword [ebp - 0x220]
push dword [eax + 0x20]
jmp 0x272f4c25
lea edi, [esi + 4]
jmp 0x271e1c7f
mov dword [esi + 0x20], eax
jmp 0x272ce89d
mov dword [ebp - 0x220], ebx
jmp 0x271fab7c
jmp 0x2730e957
push 0x270a1548
jmp 0x27285877
lea edi, [ebp - 0x230]
jmp 0x272b8de3
call fcn.27007877
mov eax, dword [ebp + 0xc]
jmp 0x27315884
call dword [sym.imp.msvcrt.dll_exit]
jmp 0x2729a203
jne 0x2729a203
push str.ErrMsg
push 0x10
jmp 0x272edc4a
jne 0x271b34ed
push 0x270c4a68
jmp 0x27316e53
push str.Out_of_memory_
jmp 0x271db3c6
push dword [ebp + 0xc]
cmp bh, 0xa5
cmp si, ax
stc
mov dword [ebp - 0x224], eax
sar eax, 0x1c
xadd eax, eax
rol ah, cl
lea eax, [ebp - 0x230]
xor ebx, ebx
jmp 0x27327919
push eax
jmp 0x27307305
call sub.KERNEL32.dll_GetCurrentProcessId
push eax
cwde
push dword [esi]
nop
cwde
lea eax, [ebp - 0x21c]
jmp 0x272c2d65
call fcn.2719075b
cmp dword [ebp - 0x220], ebx
jmp 0x272ebe24
push esi
jmp 0x27225edf
call fcn.2700bae4
mov esi, eax
cmc
cmp bp, di
cmp esi, ebx
jmp 0x272db3aa
call fcn.2728510a
mov eax, dword [eax]
pop ecx
mov esi, eax
pop ecx
jmp 0x27251dd7
push eax
mov dword [ebp - 0x22c], ebx
jmp 0x27326424
Function at 0x271b516e
Capabilities:
Create thread

Disassembly:
mov dword [ebp - 8], ebx
jmp 0x2702ad5f
jge 0x272988c3
sub eax, esi
test bp, 0xc98d
test edi, eax
cmc
cmp eax, ebx
jmp 0x27189276
push 0x2702435e
jmp 0x2720d806
call fcn.27025425
sub eax, eax
jmp 0x2701cbb8
cmp esi, eax
jmp 0x273455cc
push ebp
xadd bp, bp
test bp, 0x8f24
mov ebp, esp
test esi, 0xe09546b2
sub esp, 0x1c
cmc
push ebx
test al, ch
cmc
sub ebx, ebx
push esi
mov esi, eax
cmp dword [edi + 0x40], ebx
jmp 0x272534e2
call sub.KERNEL32.dll_CloseHandle
jmp 0x272b4eb3
push eax
push 0
jmp 0x2724f876
mov dword [ebp - 0xc], esi
jmp 0x2725de31
push ecx
jmp 0x2734c758
je 0x27220cc1
xor ebx, ebx
test ebx, ebx
jmp 0x272aa05a
call dword [sym.imp.msvcrt.dll__beginthreadex]
mov ebx, eax
add esp, 0x18
test ebp, esp
test edi, 0xdeab430f
test ebx, ebx
jmp 0x2735cd20
lea eax, [ebp - 0x10]
movzx esi, ax
push eax
movzx esi, bp
lea esi, [edi + 4]
jmp 0x2734b763
jne 0x272c837e
mov eax, 0x80004005
mov bh, ch
movsx ebx, bx
not esi
pop esi
pop ebx
jmp 0x2731b221
jle 0x272c67f8
push dword [edi + 0x3c]
jmp 0x27320702
push eax
call sub.KERNEL32.dll_WaitForSingleObject
test eax, eax
jne 0x27361151
lea eax, [ebp - 0x14]
movsx esi, cx
push eax
mov si, 0x16bc
jmp 0x27251c89
sub esi, eax
cmp esi, ebx
jmp 0x27214cbf
call fcn.27023c4e
test eax, eax
jmp 0x27220cb9
je 0x272ef463
push ebx
jmp 0x272ef45e
call fcn.270222cf
mov esi, eax
lea ecx, [ebp - 0x1c]
jmp 0x272b7e8a
call fcn.27025425
mov eax, esi
jmp 0x272534f4
sub esi, esi
jmp 0x272ec063
lea eax, [edi + 0x14]
push eax
mov dword [ebp - 0x1c], eax
call sub.KERNEL32.dll_EnterCriticalSection
mov eax, dword [edi + 0xc]
cmp ch, 0x10
mov byte [ebp - 0x18], 1
jmp 0x271a0d6b
call fcn.270222cf
push ebx
mov si, di
bswap esi
mov esi, eax
jmp 0x271f3c26
jmp 0x272b4eb3
call sub.KERNEL32.dll_CloseHandle
inc dword [ebp - 8]
or ax, 0x5230
add al, 0x1a
sar ah, 0x99
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
jl 0x2725de37
jmp 0x272c67f8
leave
ret 4
call sub.KERNEL32.dll_ResetEvent
mov eax, dword [edi + 0x2c]
movsx ecx, cx
movsx cx, ch
movzx ecx, ax
lea ecx, [ebp - 0x10]
jmp 0x2721f30b
jne 0x2701f677
lea ecx, [ebp - 0x1c]
jmp 0x27191530
mov dword [ebp - 0x14], ebx
jmp 0x2729cda7
push 0
push edi
jmp 0x27186288
je 0x272b4eac
push dword [ebp + 8]
setno ah
movsx eax, cx
mov eax, dword [edi + 0x3c]
jmp 0x2728fb86
cmp eax, 0x102
jne 0x272cf895
push ebx
jmp 0x2736c93e
call sub.KERNEL32.dll_CloseHandle
mov esi, 0x80070102
jmp 0x2708f98d

Function at 0x271ba63f
Capabilities:
Set thread local storage value

Disassembly:
push ebp
clc
mov ebp, esp
bt eax, 0x94
mov eax, dword [sym.SocksCapExDLL32.dll_Ordinal_204]
test di, dx
push esi
cmp edx, ebp
xor esi, esi
cmc
cmp si, 0x222f
cmp eax, 2
jmp 0x2735d8ff
je 0x2725d5ce
push edi
call fcn.271879fb
mov esi, eax
test esi, esi
jmp 0x27283338
jne 0x2725d5ce
cmp dword [ebp + 0x10], esi
jmp 0x27274a59
je 0x27274a5f
cmp eax, 1
jmp 0x272c63e7

Function at 0x271c7511
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
shr ebp, 0xd
xor ebp, 0xe73a1da0
bt bp, 0xaa
mov ebp, esp
cmp esp, 0x8f108b39
clc
test bp, cx
push ecx
test ax, di
test dl, 0x15
jmp loc.27022b56
Function at 0x271c96bd
Capabilities:
Create thread

Disassembly:
sub edi, edi
cmp dword [sym.SocksCapExDLL32.dll_Ordinal_203], edi
jmp 0x272b317e
push edi
jmp 0x27192b19
push edi
jmp loc.270084ce
jne 0x272dc8d0
call fcn.2718c798
test eax, eax
jmp 0x2730a76c
je 0x272dc8d0
cmp dword [sym.SocksCapExDLL32.dll_Ordinal_197], edi
jmp 0x2724c16c
pop edi
jmp loc.27006d63
je 0x272dc8d0
push esi
not esi
xchg si, si
mov esi, dword [sym.SocksCapExDLL32.dll_Ordinal_197]
jmp 0x271dbbfb

Function at 0x271cd259
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov ebp, esp
add ax, di
inc al
rcr al, 0xb5
push ecx
push ecx
mov eax, dword [ebp + 0xc]
cmc
push ebx
test bh, 0xb5
sub ebx, ebx
cmp eax, ebx
jmp 0x271e5993
push ebp
jmp 0x2719612c
je 0x271e599c
mov dword [eax], ebx
cmc
cmp dword [ebp + 8], ebx
jmp loc.27020435

Function at 0x271e768f
Capabilities:
Authenticate hmac
Encode data using base64
Read .ini file
Reference http user-agent string
Resolve function by parsing pe exports

Disassembly:
js 0x271e76d0
push dword [esp + 4]
popfd
mov dword [esp + 4], 0xb137e286
lea esp, [esp + 4]
jmp loc.272f8a82
push ecx
mov ecx, 0x462e009e
pushfd
cmp cx, 0x5693
push 0xaa0bc38c
jg 0x271e76d7
cmp dword [esp + ecx - 0x462e009e], 0x58113ba7
bswap ecx
je fcn.271e768f
mov ecx, dword [esp + 8]
mov dword [esp + 8], 0x9bd66929
shr word [esp], 0x3a
setns byte [esp]
mov word [esp], 0x72c
not byte [esp]
jns 0x271a91b0
mov edx, 0x39e58af
lea esi, [esi + edx*2 - 0x73cb162]
mov eax, dword [esi + edx*8 - 0x1cf2c578]
movzx ecx, dl
sub dx, 0x1101
neg edx
xor eax, ebx
push edx
rol ecx, cl
xchg dword [esp + ecx*2 - 0xaf0000], edx
neg eax
sar cx, 0x46
not eax
dec ecx
sal dx, 0xe
ror eax, 2
sal edx, 0x6f
neg ecx
xchg edx, ecx
not eax
xor ebx, eax
ror dl, 0x66
sar dword [esp], 0xb
adc edi, eax
mov ebp, dword [ebp]
not dword [esp]
lea eax, [ecx*4 + 0x62bd0b8e]
neg ecx
pop ecx
jns 0x272961ff
ret
Function at 0x271ed58f
Capabilities:
Receive data
Receive data on socket

Disassembly:
call fcn.270077dd
mov eax, edi
call fcn.2708a15d
ret 0xc
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], ebx
cmp bx, bp
test edx, esp
cmc
cmp dword [esi + 0x30], ebx
jne 0x271fe03a
lea esi, [ebp - 0x1c]
jmp 0x2727c63d
inc edi
jmp 0x2719111b
push eax
jmp 0x27213d2b
push 0x10
cmovle eax, eax
cwde
mov eax, 0x2708d2fb
jmp 0x272c28ac
mov dword [ebp - 0x1c], edi
jmp 0x27312006
push ebx
sbb ch, dl
push esi
rcr eax, cl
bts cx, si
lea ecx, [esi + 0x10060]
shr ah, 0xbe
shl al, 0x2d
bt ax, 7
push ecx
stc
rol ah, cl
sbb ax, 0xf412
lea eax, [esi + 0x3c]
stc
cmp edx, 0x1e9d38a1
mov dword [esi + 0x14], ebx
test al, al
cmc
mov dword [esi + 0x18], ebx
mov dword [ecx], 0x1c
rcl ch, cl
add esi, 0x10044
movsx ecx, bp
push esi
lea ecx, [ebp - 0x10]
jmp 0x272dae95
push dword [ebp + 0xc]
mov dword [eax], 0x10000
jmp 0x272806a4
je 0x2725b4e8
mov ecx, dword [ebp + 8]
test edx, 0x91062889
cmp dword [ecx + 0x302c4], ebx
je 0x2725b4e0
push dword [ebp + 0x10]
lea eax, [ecx + 0x20188]
jmp 0x2725b4da
call sub.WS2_32.dll_WSARecvFrom
cmp eax, 0xffffffff
jmp 0x27252434
jne 0x2725b4e8
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x3e5
jmp 0x2721627f
push eax
call fcn.2729eab9
sub edi, edi
movzx esi, si
xchg si, si
lea esi, [ebp - 0x1c]
jmp 0x2717d13c
call fcn.270077dd
jmp 0x272c28c7
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
jmp 0x272214ca
push ecx
push edi
jmp 0x271e157d
mov edi, dword [ebp + 8]
add edi, 0x20130
jmp 0x271f4f80
call fcn.2708a0be
mov esi, ecx
sbb ah, bl
mov eax, dword [esi + 0x30]
xor ebx, ebx
cmp cl, 0x1e
clc
cmc
cmp eax, ebx
jne 0x272a9b7c
xor eax, eax
jmp 0x27364ca9
push ecx
lea ecx, [ebp - 0x14]
jmp 0x27294e38
call fcn.27007877
sub edi, edi
jmp 0x271dc3a9
jmp 0x2717d143

Function at 0x271f85bd
Capabilities:
Connect socket
Resolve dns

Disassembly:
push dword [esi + 8]
jmp 0x271c0f25
call sub.WS2_32.dll_gethostbyname
mov edi, eax
call sub.WS2_32.dll_WSAGetLastError
test edi, edi
jne 0x2728bd54
mov eax, 0x107
jmp 0x2732c05e
push ebp
ror ax, 0xa
or ax, sp
mov ebp, esp
shr ah, cl
lea esp, [esp - 0x438]
mov eax, dword [0x270b313c]
cmc
xor eax, ebp
mov dword [ebp - 4], eax
cmc
test di, 0x4292
cmp dword [esi + 0x64], 0
jmp 0x27349259
push edi
jmp 0x272e61cc
lea eax, [ebp - 0x428]
jmp 0x27009edf
je 0x271c0b47
sub eax, eax
jmp 0x27300c52
mov ecx, dword [ebp - 4]
movsx ebx, ax
pop edi
xadd bh, bh
xor ecx, ebp
pop ebx
call fcn.27088f70
leave
ret
jmp 0x27300c52
push ebx
jmp 0x27244ca8
Function at 0x2721a991
Capabilities:
Get socket status

Disassembly:
push ebx
movzx ecx, ax
lea ecx, [ebp - 0x52c]
jmp 0x27294cfb
push ebp
shrd ebp, esi, 0x2f
mov ebp, esp
xchg ah, al
mov ax, sp
sub esp, 0x530
mov eax, dword [0x270b313c]
jmp 0x2736a6bf
mov dword [ebp - 0x414], 0x3ff
lahf
setl cl
jmp 0x272c9062
push ecx
cmovae cx, ax
push ebx
jmp 0x271c21ba
mov dword [ebp - 0x528], eax
jmp loc.2701b0e3
mov eax, dword [edi]
cmovle ecx, esi
dec ecx
movzx ecx, cx
lea ecx, [ebp - 0x424]
jmp 0x27257244
xor eax, ebp
cmp eax, 0x86a5e32b
test cl, 0x24
mov dword [ebp - 8], eax
add al, 0x9c
mov eax, dword [ebp + 8]
push ebx
push esi
bt si, 0x29
push edi
mov si, sp
mov edi, ecx
cmp edi, 0x2a115eb7
rcl esi, 0x9c
xor esi, 0xb7a4823b
xor ebx, ebx
dec esi
mov dword [ebp - 0x41c], edi
mov dword [ebp - 0x410], eax
xchg esi, esi
cmovnp ax, cx
mov dword [ebp - 0x418], ebx
lea esi, [ebp - 0x40c]
movzx ax, bl
movsx cx, cl
jmp 0x272477aa

Function at 0x2721f3dc
Capabilities:
Authenticate hmac
Reference http user-agent string

Disassembly:
mov ecx, dword [esp + ecx - 0x193c56ac]
mov dword [esp + 4], 0x3bd61340
push edi
mov edi, 0xc1bf6b9a
not di
push edx
shr edi, 0xef
push dword [esp + 8]
popfd
mov dword [esp + 8], esi
mov edi, dword [esp + 4]
mov edx, 0x5d03603a
not dl
mov edx, dword [esp + edx - 0x5d0360c5]
lea esp, [esp + 8]
jmp loc.272f8a82
push ecx
mov ecx, 0x193c56b0
pushfd
test cx, 0x2381
jns 0x271df315
int 0x5b
aas
pop esi
fnstsw word [edx + edx - 0xf6a24a5]
sbb ebp, dword [0x2a953390]
add dword [edi + 0x68], ecx
ljmp 0x48f0