joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4043a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x41b7a7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
push edi
lea eax, [esp + 0xc]
push 0
mov ecx, dword [esi + 0xc0]
push eax
mov dword [esp + 0x28], 0
call fcn.00401b50
mov ebx, 1
push 0
push 0x5c
push ebx
push ecx
mov dword [esp + 0x40], ebx
mov ecx, esp
mov dword [esp + 0x34], esp
push 0x423338
call fcn.00411fac
push ecx
lea edx, [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x30], esp
push edx
mov byte [esp + 0x48], 2
call fcn.00411cb3
mov ecx, dword [esi + 0xc0]
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0x48], bl
call fcn.004039d0
push 0x4230d0
push 0
push 0x5c
push ecx
lea edx, [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x34], esp
push edx
mov byte [esp + 0x44], 3
call fcn.00411cb3
mov ecx, dword [esi + 0xc0]
lea eax, [esp + 0x2c]
push eax
call fcn.00402d00
lea ecx, [esp + 0x10]
push eax
lea edx, [esp + 0x20]
push ecx
push edx
mov byte [esp + 0x40], 4
call fcn.00412121
push eax
lea eax, [esp + 0x1c]
push eax
mov byte [esp + 0x3c], 5
call fcn.00412187
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x34], 6
call fcn.0041202b
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 5
call fcn.00411f3e
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 4
call fcn.00411f3e
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 3
call fcn.00411f3e
push ebx
push 0
push 0
push ebx
mov ecx, dword [esi + 0xc0]
push 0
call fcn.004038a0
lea ecx, [esp + 0x30]
push eax
push ecx
mov ecx, dword [esi + 0xc0]
call fcn.00403770
mov edi, eax
mov ecx, dword [esi + 0xc0]
push 0
push ebx
push 0
push 7
push 5
mov byte [esp + 0x44], 7
call fcn.004038a0
mov ecx, dword [esi + 0xc0]
lea edx, [esp + 0x20]
push eax
push edx
call fcn.00403770
push eax
lea eax, [esp + 0x10]
lea ecx, [esp + 0x1c]
push eax
push ecx
mov byte [esp + 0x3c], 8
call fcn.00412121
push edi
lea edx, [esp + 0x20]
push eax
push edx
mov byte [esp + 0x3c], 9
call fcn.00412121
mov esi, dword [esp + 0x38]
push str..exe
push eax
push esi
mov byte [esp + 0x3c], 0xa
call fcn.00412187
mov dword [esp + 0x20], ebx
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 9
call fcn.00411f3e
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 8
call fcn.00411f3e
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 7
call fcn.00411f3e
lea ecx, [esp + 0x24]
mov byte [esp + 0x30], 3
call fcn.00411f3e
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], bl
call fcn.00411f3e
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 0
call fcn.00411f3e
mov ecx, dword [esp + 0x28]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x28
ret 4
Function at 0x4045b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x41b7df
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x4234f0]
push esi
push edi
mov edi, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x18], 1
cmp eax, 6
ja case.default.0x4045ee
jmp dword [eax*4 + 0x404680]
push str.7581817d32404e323f53323f53717c7c7a7d403b7b7281323f537e6f797c74323f53
jmp 0x404624
push str.605c5361644e5f523242503242505a76707f7c807c738132425032425064767b717c848032425032425050827f7f727b8163727f80767c7b3242503242505f827b
jmp 0x404624
push str.5a76707f7c807c7381
jmp 0x404624
push str.706c767b76813b7d757d3240537d6c76713240517c7d727b323f437a6e70324051
jmp 0x404624
push str.706c796e80813b7d757d3240537d6c76713240517c7d727b323f437a6e70324051
jmp 0x404624
push str.706c7c7d727b3b7d757d
jmp 0x404624
push str.7c7d727b3b7d757d3240537a324051
lea ecx, [esp + 0xc]
call fcn.0041207b
push 0xd
push 1
push ecx
lea edx, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x30], esp
push edx
call fcn.00411cb3
mov esi, dword [esp + 0x2c]
mov ecx, dword [edi + 0xc4]
push esi
call fcn.00401170
mov dword [esp + 0xc], 1
lea ecx, [esp + 8]
mov byte [esp + 0x18], 0
call fcn.00411f3e
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x14
ret 8

Function at 0x410831
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x410851
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004077d7
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x410874
test byte [esp + 8], 2
je 0x410874
call fcn.0040784a
mov dword [eax], 0xd
call fcn.00407853
mov dword [eax], 5
jmp 0x41084d
xor eax, eax
ret

Function at 0x418590
Capabilities:
Create http request

Disassembly:
mov eax, 0x41ba48
call fcn.00406d38
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 0xc]
and dword [ebp - 4], 0
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
test eax, eax
mov dword [esi], vtable.CInternetSession.0
jne 0x4185c8
call fcn.0041a51a
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
mov dword [esi + 8], eax
jne 0x4185ed
push eax
push dword [esi + 4]
call fcn.004191ec
jmp 0x4185f9
push esi
push eax
mov ecx, 0x426e30
call fcn.0041860a
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 0x18
Function at 0x4188bb
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
mov eax, 0x41baa7
call fcn.00406d38
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.00413e96
mov eax, dword [ebp + 0x18]
lea ebx, [esi + 0x24]
mov dword [esi + 0x1c], eax
mov eax, dword [0x4234f0]
xor edi, edi
mov dword [ebx], eax
mov dword [ebp - 4], edi
push dword [ebp + 0x10]
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 1
mov dword [esi], vtable.CInternetFile.0
call fcn.0041207b
push dword [ebp + 0x14]
mov ecx, ebx
call fcn.0041207b
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [esi + 0x18], eax
mov dword [esi + 0x3c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x40], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x18

Function at 0x41a08e
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x41a0bc
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x41a0da
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00419ff4
jmp 0x41a0da
mov eax, dword [esi + 0x14]
test eax, eax
je 0x41a0da
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00419ff4
test edi, edi
mov eax, edi
jne 0x41a0c4
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x56bac8
Capabilities:
Encode data using xor

Disassembly:
mov cl, 0x23
dec eax
fisub dword [esi + esi*8 + 0x5d]
iretd
mov esp, 0xe476dd4f
jl 0x56babe
test dword [edi], edx
test eax, 0x9a02903b
or bl, ah
jno 0x56bb2e
dec esp
add dword [esi], ebx
invalid
sub al, 0x33
mov esi, 0x337e61a1
sub al, 0xf5
ljmp 0x534c

Function at 0x5c00f8
Capabilities:
Encode data using xor

Disassembly:
popfd
xchg edx, eax
jmp 0x5c00d9
inc ebp
dec eax
psadbw mm6, qword [esp + ecx*8]
rcl byte [ebx], cl
adc al, 0xf2
into
xchg edx, eax
mov edx, 0xa75be3c1
inc ecx
pop ss
cmp cl, byte [edx - 0x2a]
mov eax, 0xdb84c778
and al, 0xa9
sbb byte [eax + ecx*4 - 0x53], 0x2c
invalid
lodsd eax, dword [esi]
sub al, 0x58
mov dword [ebx + ebx*8 + 0x5c82a924], 0x582cad88
mov byte [ebp - 0x3301a7d4], ch
dec ah
int3
lahf
mov cl, byte [ecx + esi*2 + 0x6691f934]
mov bl, 0x8d
xor dword [edx - 0x64dd83dd], ecx
ja 0x5c0091
xchg byte [edi - 0x5e], dl
out 0xe1, eax
jnp 0x5c00f1
push edi
mov byte [0xda7be1e7], al
imul eax, dword [ebx + ebx - 4], 0x5f
xor eax, 0x2cc59905
in al, 0xc2
pop eax
push edx
stc
cwde
mov al, byte [ebp + 0x6b]
dec eax
outsb dx, byte [esi]
cwde
adc ah, byte [edx - 0xe]
cwde
xchg dword [esi + 0x4b70ec4b], esi
imul ebp, dword [edi], 0xffffffc6
jns 0x5c0111
in eax, dx
jecxz 0x5c00fd
pop es
and eax, 0xfb145f10
adc cl, byte [ecx + 0x4bdc9066]
jb 0x5c0123
bound ebx, qword [ebx + 0x38]
fdiv qword fs:[esi + 0x65]
out dx, al
add al, byte [edi*4 + 0x3453d28b]
mov ebp, 0x3453d28b
Function at 0x406273
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x406298
mov eax, dword [0x40a8a0]
cmp eax, 0xffffffff
je 0x40628f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x40a8a0], 0xffffffff
jmp 0x40630b
cmp dword [0x440a40], ebx
je 0x40630b
cmp byte [0x440640], bl
je 0x4062d7
cmp dword [0x40a8a0], 0xffffffff
jne 0x4062e0
push 4
push 0x40000000
push 0x440640
call fcn.00405c27
cmp eax, 0xffffffff
mov dword [0x40a8a0], eax
je 0x40630b
push 2
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [0x40a8a0], 0xffffffff
je 0x40630b
push esi
mov esi, 0x444a60
push 0x40aae8
push esi
call fcn.00405f75
lea eax, [ebp + 8]
push ebx
push eax
push esi
call fcn.00405f68
push eax
push esi
push dword [0x40a8a0]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
pop ebx
pop ebp
ret 4

Function at 0x4064bd
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor esi, esi
cmp dword [0x44023c], esi
push edi
jne 0x4064f7
mov ecx, 0x440238
push 8
mov eax, esi
pop edi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec edi
jne 0x4064d3
mov dword [ecx], eax
add ecx, 4
inc esi
cmp ecx, 0x440638
jl 0x4064ce
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov edx, ecx
dec ecx
test edx, edx
not eax
jbe 0x40652c
lea edx, [ecx + 1]
mov ecx, dword [esp + 0x10]
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x440238]
xor eax, esi
inc ecx
dec edx
jne 0x40650f
pop edi
pop esi
not eax
ret 0xc

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403e6a
sub eax, 0x403e10
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x431030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x10001000
Capabilities:
Hash data using crc32b

Disassembly:
push ebx
xor edx, edx
push edi
xor eax, eax
test dl, 1
je 0x10001010
mov eax, 0x80
mov ecx, edx
shr ecx, 1
test cl, 1
je 0x1000101c
or eax, 0x40
shr ecx, 1
test cl, 1
je 0x10001026
or eax, 0x20
shr ecx, 1
test cl, 1
je 0x10001030
or eax, 0x10
shr ecx, 1
test cl, 1
je 0x1000103a
or eax, 8
shr ecx, 1
test cl, 1
je 0x10001044
or eax, 4
shr ecx, 1
test cl, 1
je 0x1000104e
or eax, 2
test cl, 2
je 0x10001056
or eax, 1
shl eax, 0x18
mov ecx, eax
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
xor edi, edi
mov dword [esi + edx*4], ecx
mov eax, ecx
lea ecx, [edi + 0x1f]
jmp 0x10001110
test al, 1
je 0x1000111d
mov ebx, 1
shl ebx, cl
or edi, ebx
dec ecx
shr eax, 1
cmp ecx, 0xffffffff
jg 0x10001110
mov dword [esi + edx*4], edi
inc edx
cmp edx, 0xff
jle 0x10001004
pop edi
pop ebx
ret

Function at 0x10001140
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x10025018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push 0x1001c634
push eax
lea eax, [ebp - 0x408]
push eax
or esi, 0xffffffff
mov dword [ebp - 0x408], 0
call dword [sym.imp.MSVCR100.dll__wfopen_s]
add esp, 0xc
test eax, eax
je 0x10001192
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10018a26
mov esp, ebp
pop ebp
ret 8
push ebx
push edi
mov ecx, dword [ebp - 0x408]
push ecx
push 0x400
lea edx, [ebp - 0x404]
push 1
push edx
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
mov ecx, eax
lea edx, [ebp - 0x404]
test eax, eax
je 0x100011da
mov edi, edi
movzx ebx, byte [edx]
mov edi, esi
and edi, 0xff
xor edi, ebx
mov ebx, dword [ebp + 8]
shr esi, 8
xor esi, dword [ebx + edi*4]
inc edx
dec ecx
jne 0x100011c0
cmp eax, 0x400
je 0x10001194
mov eax, dword [ebp - 0x408]
push eax
call dword [sym.imp.MSVCR100.dll_fclose]
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
mov eax, esi
pop ebx
xor ecx, ebp
not eax
pop esi
call fcn.10018a26
mov esp, ebp
pop ebp
ret 8
Function at 0x10001210
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x1001c63c
push eax
lea ecx, [ebp - 4]
push ecx
mov dword [esi], 0xffffffff
mov dword [ebp - 4], 0
call dword [sym.imp.MSVCR100.dll_fopen_s]
add esp, 0xc
test eax, eax
je 0x10001242
xor al, al
mov esp, ebp
pop ebp
ret 4
push edi
push 0x400
call dword [sym.imp.MSVCR100.dll_malloc]
mov edi, eax
add esp, 4
mov dword [ebp - 8], edi
test edi, edi
jne 0x10001270
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 4]
push eax
push 0x400
push 1
push edi
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
test eax, eax
je 0x100012d3
push ebx
lea ebx, [ebx]
mov ecx, eax
mov edx, edi
test eax, eax
je 0x100012b9
mov eax, dword [esi]
movzx ebx, byte [edx]
mov edi, eax
and edi, 0xff
xor edi, ebx
mov ebx, dword [ebp + 8]
shr eax, 8
xor eax, dword [ebx + edi*4]
inc edx
dec ecx
mov dword [esi], eax
jne 0x10001298
mov edi, dword [ebp - 8]
mov ecx, dword [ebp - 4]
push ecx
push 0x400
push 1
push edi
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
test eax, eax
jne 0x10001290
pop ebx
push edi
call dword [sym.imp.MSVCR100.dll_free]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.MSVCR100.dll_fclose]
mov eax, dword [esi]
not eax
add esp, 8
mov dword [esi], eax
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret 4

Function at 0x10001300
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x1001c634
push eax
lea ecx, [ebp - 4]
push ecx
mov dword [esi], 0xffffffff
mov dword [ebp - 4], 0
call dword [sym.imp.MSVCR100.dll__wfopen_s]
add esp, 0xc
test eax, eax
je 0x10001332
xor al, al
mov esp, ebp
pop ebp
ret 4
push edi
push 0x400
call dword [sym.imp.MSVCR100.dll_malloc]
mov edi, eax
add esp, 4
mov dword [ebp - 8], edi
test edi, edi
jne 0x10001360
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 4]
push eax
push 0x400
push 1
push edi
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
test eax, eax
je 0x100013c3
push ebx
lea ebx, [ebx]
mov ecx, eax
mov edx, edi
test eax, eax
je 0x100013a9
mov eax, dword [esi]
movzx ebx, byte [edx]
mov edi, eax
and edi, 0xff
xor edi, ebx
mov ebx, dword [ebp + 8]
shr eax, 8
xor eax, dword [ebx + edi*4]
inc edx
dec ecx
mov dword [esi], eax
jne 0x10001388
mov edi, dword [ebp - 8]
mov ecx, dword [ebp - 4]
push ecx
push 0x400
push 1
push edi
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
test eax, eax
jne 0x10001380
pop ebx
push edi
call dword [sym.imp.MSVCR100.dll_free]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.MSVCR100.dll_fclose]
mov eax, dword [esi]
not eax
add esp, 8
mov dword [esi], eax
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x10001460
Capabilities:
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x10025018]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x198]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x10001499
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10018a26
mov esp, ebp
pop ebp
ret
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x1002537c], eax
cmp eax, 0xffffffff
je 0x10001489
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
mov dword [0x10025380], eax
test eax, eax
je 0x10001489
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov dword [0x1012538c], 0x10001ff0
mov al, 1
call fcn.10018a26
mov esp, ebp
pop ebp
ret
Function at 0x100014e0
Capabilities:
Connect socket
Encode data using xor
Resolve dns

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
mov eax, dword [0x10025018]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
mov esi, ecx
cmp dword [esi + 4], 0xffffffff
push edi
mov edi, dword [ebp + 8]
jne 0x10001563
push 0x100
push 0
push 0x11183058
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
jmp 0x10001520
mov cl, byte [eax + 0x1001c760]
sub cl, 0x1b
xor cl, 0xc
mov byte [eax + 0x11183058], cl
inc eax
cmp eax, 0x100
jb 0x10001520
push 0x11183058
push 0
mov ecx, 0x10125528
call fcn.1000acc0
add esp, 8
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.10018a26
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
mov edx, 2
push eax
mov word [esp + 0x10], dx
call dword [sym.imp.WS2_32.dll_htons]
push edi
mov word [esp + 0x12], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
jne 0x100015af
push edi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x100015af
movsx ecx, word [eax + 0xa]
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
push ecx
push eax
lea ecx, [esp + 0x18]
push ecx
call sub.MSVCR100.dll_memcpy
add esp, 0xc
mov eax, dword [esi + 4]
push 0x10
lea edx, [esp + 0x10]
push edx
push eax
call dword [sym.imp.WS2_32.dll_connect]
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0xffffffff
jne 0x1000160b
call edi
cmp eax, 0x2733
je 0x1000160b
call edi
push eax
mov eax, 2
call fcn.100154d0
push eax
push 0
mov ecx, 0x10125528
call fcn.1000acc0
add esp, 0xc
call fcn.100016f0
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.10018a26
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esi + 8]
mov edx, dword [esi + 4]
push 0x23
push ecx
push edx
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
jne 0x10001684
call edi
push eax
mov eax, 3
call fcn.100154d0
push eax
push 0
mov ecx, 0x10125528
call fcn.1000acc0
mov eax, dword [esi + 4]
add esp, 0xc
cmp eax, 0xffffffff
je 0x10001653
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 4], 0xffffffff
mov eax, dword [esi + 8]
test eax, eax
je 0x10001668
push eax
call dword [sym.imp.WS2_32.dll_WSACloseEvent]
mov dword [esi + 8], 0
mov byte [esi + 0x100038], 0
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.10018a26
mov esp, ebp
pop ebp
ret 8
push 0x80000
xor edi, edi
lea eax, [esi + 0xc]
push edi
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x80000
lea ecx, [esi + 0x80010]
push edi
push ecx
mov dword [esi + 0x8000c], edi
call sub.MSVCR100.dll_memset
add esp, 0xc
mov dword [esi + 0x100010], edi
push edi
mov ecx, esi
mov edi, 0x10001ca0
call fcn.10015770
mov ecx, dword [esp + 0x1c]
pop edi
mov byte [esi + 0x100038], 1
pop esi
xor ecx, esp
mov al, 1
call fcn.10018a26
mov esp, ebp
pop ebp
ret 8
Function at 0x100019b0
Capabilities:
Encode data using xor
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8000c
call fcn.10019430
mov eax, dword [0x10025018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x10125394
mov esi, ecx
mov edi, edx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x1002537c], 0xffffffff
je 0x10001ab5
cmp byte [0x101253b0], 0
je 0x10001ab5
push 0x80000
lea eax, [ebp - 0x80008]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
push esi
lea ecx, [ebp - 0x80008]
push edi
push ecx
call sub.MSVCR100.dll_memcpy
add esp, 0xc
xor eax, eax
cmp byte [ebp - 0x80008], 0xc1
jne 0x10001a4c
mov cl, byte [ebp - 0x80006]
lea edi, [esi - 3]
test edi, edi
jle 0x10001a78
mov dl, byte [ebp + eax - 0x80005]
xor dl, 0xa0
sub dl, cl
mov byte [ebp + eax - 0x80005], dl
inc eax
cmp eax, edi
jl 0x10001a32
jmp 0x10001a78
mov cl, byte [ebp - 0x80005]
lea edi, [esi - 4]
test edi, edi
jle 0x10001a78
lea esp, [esp]
mov dl, byte [ebp + eax - 0x80004]
xor dl, 0xa0
sub dl, cl
mov byte [ebp + eax - 0x80004], dl
inc eax
cmp eax, edi
jl 0x10001a60
mov ecx, dword [0x10125388]
test ecx, ecx
jle 0x10001b0e
lea eax, [ecx + esi]
cmp eax, 0x80000
jle 0x10001ad3
push eax
mov eax, 7
call fcn.100154d0
push eax
push 0
mov ecx, 0x10125528
call fcn.1000acc0
add esp, 0xc
mov esi, 0x10025378
call fcn.100016f0
push 0x10125394
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10018a26
mov esp, ebp
pop ebp
ret
push esi
lea eax, [ebp - 0x80008]
push eax
lea ecx, [ecx + 0x100a5388]
push ecx
call sub.MSVCR100.dll_memcpy
add esp, 0xc
add dword [0x10125388], esi
push 0x10125394
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.10018a26
mov esp, ebp
pop ebp
ret
xor edi, edi
test esi, esi
jle 0x10001af0
mov ebx, dword [sym.imp.WS2_32.dll_send]
mov eax, dword [0x1002537c]
push 0
push esi
lea edx, [ebp + edi - 0x80008]
push edx
push eax
call ebx
cmp eax, 0xffffffff
je 0x10001b3c
sub esi, eax
add edi, eax
test esi, esi
jg 0x10001b1a
jmp 0x10001af0
mov ebx, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call ebx
cmp eax, 0x2733
jne 0x10001b7b
mov ecx, dword [0x10125388]
lea eax, [ecx + esi]
cmp eax, 0x80000
jle 0x10001b66
push eax
mov eax, 8
jmp 0x10001a96
push esi
lea edx, [ebp + edi - 0x80008]
push edx
lea eax, [ecx + 0x100a5388]
push eax
jmp 0x10001ae2
call ebx
push eax
mov eax, 9
jmp 0x10001a96
Function at 0x10001b90
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push edi
lea ebx, [esi + 0x10001c]
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edi, edi
cmp dword [esi + 0x100010], edi
jle 0x10001be8
lea ebx, [esi + 0x80010]
mov eax, dword [esi + 0x100010]
mov edx, dword [esi + 4]
push 0
push eax
lea ecx, [ebx + edi]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x10001bf7
sub dword [esi + 0x100010], eax
add edi, eax
cmp dword [esi + 0x100010], 0
jg 0x10001bb8
mov ebx, dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x10001c2f
mov eax, dword [esi + 0x100010]
push eax
lea ecx, [edi + esi + 0x80010]
push ecx
push ebx
call dword [sym.imp.MSVCR100.dll_memmove]
mov edx, dword [ebp - 4]
add esp, 0xc
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
mov eax, 0xa
call fcn.100154d0
push eax
push 0
mov ecx, 0x10125528
call fcn.1000acc0
mov eax, dword [esi + 4]
add esp, 0xc
cmp eax, 0xffffffff
je 0x10001c66
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 4], 0xffffffff
mov eax, dword [esi + 8]
test eax, eax
je 0x10001c7b
push eax
call dword [sym.imp.WS2_32.dll_WSACloseEvent]
mov dword [esi + 8], 0
mov eax, dword [ebp - 4]
push eax
mov byte [esi + 0x100038], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret