joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6f47f4
Capabilities:
Set socket configuration

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, eax
xor esi, esi
xor edi, edi
movzx eax, byte [0x6f4850]
cmp al, byte [ebx + 0x28]
je 0x6f4818
mov esi, 0x401
mov eax, ebx
call fcn.006f4960
mov edi, eax
movzx eax, byte [ebx + 0x28]
push eax
push esi
push edi
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_WSAAsyncSelect
movzx eax, byte [0x6f4850]
cmp al, byte [ebx + 0x28]
jne 0x6f4848
xor eax, eax
mov dword [esp], eax
push esp
push 0x8004667e
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_ioctlsocket_1
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x6f48e8
Capabilities:
Connect socket

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, ebx
call fcn.006f47f4
mov cl, 1
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call fcn.00408b0c
push 0x10
lea eax, [ebx + 0x18]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_connect_1
mov edx, 0x6f4950
call fcn.006f3f58
mov byte [ebx + 0x29], 0
test byte [ebx + 0x28], 0x10
jne 0x6f493e
cmp dword [ebx + 4], 0xffffffff
setne al
mov byte [ebx + 8], al
mov cl, 2
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call fcn.00408b0c
pop esi
pop ebx
ret

Function at 0x6f4de0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov ebx, edx
xor eax, eax
push ebp
push 0x6f4e6e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
mov edx, ebx
mov ecx, 0
call fcn.0040adb0
mov eax, dword [ebp - 0xc]
call fcn.0040ad24
push eax
call sub.wsock32.dll_gethostbyname_1
mov ebx, eax
lea eax, [ebp - 8]
xor ecx, ecx
mov edx, 4
call fcn.00407eb4
test ebx, ebx
je 0x6f4e50
mov eax, ebx
mov edx, dword [eax + 0xc]
mov edx, dword [edx]
movzx ecx, byte [edx]
mov byte [ebp - 8], cl
movzx ecx, byte [edx + 1]
mov byte [ebp - 7], cl
movzx ecx, byte [edx + 2]
mov byte [ebp - 6], cl
movzx eax, byte [edx + 3]
mov byte [ebp - 5], al
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6f4e75
lea eax, [ebp - 0xc]
call fcn.0040a550
pop eax
jmp eax
Function at 0x6f4fd8
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x6f5009
mov ecx, dword [0x8a4574]
mov dl, 1
mov eax, dword [0x6f17b4]
call fcn.004302f0
call fcn.00409be8
push 0
push 1
push 2
call sub.wsock32.dll_socket_1
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], ebx
inc ebx
jne 0x6f5036
mov ecx, dword [0x8a3f54]
mov dl, 1
mov eax, dword [0x6f17b4]
call fcn.004302f0
call fcn.00409be8
xor eax, eax
push ebp
push 0x6f50b7
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xffff
call fcn.00408b0c
cmp byte [ebp + 8], 0
je 0x6f5091
mov eax, dword [ebp + 0x14]
push eax
movzx eax, word [ebp + 0x10]
push eax
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.006f4efc
mov edi, dword [ebp - 4]
lea esi, [ebp - 0x18]
add edi, 0x18
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.006f4854
jmp 0x6f50ad
mov eax, dword [ebp + 0x14]
push eax
movzx eax, word [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
push 0
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.006f4270
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6f50d4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x6f53f0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.006f4680
xor eax, eax
push ebp
push 0x6f5565
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x6f554d
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
je 0x6f543c
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x6f5446
call fcn.00409cdc
jmp 0x6f556c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00477f14
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x1010]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov ecx, 0x1000
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
test ebx, ebx
jle 0x6f5542
push 0
push ebx
lea eax, [ebp - 0x1010]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send_1
mov edi, eax
cmp edi, 0xffffffff
jne 0x6f54f5
call sub.wsock32.dll_WSAGetLastError_1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2733
je 0x6f54e2
lea eax, [ebp - 0x10]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00408b0c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
push ebp
call fcn.006f53a8
pop ecx
mov eax, dword [ebp - 4]
movzx edx, byte [0x6f5578]
cmp dl, byte [eax + 0x28]
je 0x6f5549
call fcn.00430188
jmp 0x6f5549
mov eax, dword [ebp - 0xc]
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00477f34
jmp 0x6f5549
cmp edi, ebx
jge 0x6f5511
mov eax, dword [ebp - 0xc]
add eax, edi
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00477f34
jmp 0x6f5446
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00477f14
cmp edx, dword [esp + 4]
jne 0x6f5531
cmp eax, dword [esp]
pop edx
pop eax
jne 0x6f5446
push ebp
call fcn.006f53a8
pop ecx
jmp 0x6f5549
push ebp
call fcn.006f53a8
pop ecx
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6f556c
mov eax, dword [ebp - 4]
call fcn.006f4688
pop eax
jmp eax
movzx eax, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6f55ac
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6f56d4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.006f4680
xor eax, eax
push ebp
push 0x6f56b5
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x6f55fc
call fcn.00409cdc
jmp 0x6f56bc
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send_1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x6f569d
call sub.wsock32.dll_WSAGetLastError_1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x6f569d
lea eax, [ebp - 0xc]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00408b0c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x6f569d
lea ecx, [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.0042ec50
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x6f56f0
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x8a430c]
mov dl, 1
mov eax, dword [0x6f17b4]
call fcn.004303c4
call fcn.00409be8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6f56bc
mov eax, dword [ebp - 4]
call fcn.006f4688
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6f56db
lea eax, [ebp - 0x28]
call fcn.0040a52c
pop eax
jmp eax
Function at 0x6f5740
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6f58b7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.006f4680
xor eax, eax
push ebp
push 0x6f5898
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp ebx, 0xffffffff
jne 0x6f57a5
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x6f57a5
lea eax, [ebp - 8]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket_1
jmp 0x6f5880
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x6f57b8
call fcn.00409cdc
jmp 0x6f589f
lea eax, [ebp - 0x10]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket_1
test eax, eax
jne 0x6f57df
cmp dword [ebp - 0x10], 0
jle 0x6f57df
cmp ebx, dword [ebp - 0x10]
jle 0x6f57df
mov ebx, dword [ebp - 0x10]
push 0
push ebx
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_recv_1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x6f5880
call sub.wsock32.dll_WSAGetLastError_1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x6f5880
lea eax, [ebp - 0xc]
push eax
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00408b0c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x6f5880
lea ecx, [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.0042ec50
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0x11
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
mov eax, 0x6f58d4
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0x11
lea eax, [ebp - 0x28]
push eax
push 2
mov ecx, dword [0x8a430c]
mov dl, 1
mov eax, dword [0x6f17b4]
call fcn.004303c4
call fcn.00409be8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6f589f
mov eax, dword [ebp - 4]
call fcn.006f4688
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6f58be
lea eax, [ebp - 0x2c]
call fcn.0040a52c
pop eax
jmp eax
Function at 0x6fdab0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
cmp dword [esi], 0
jne 0x6fdad7
push 0
push 0
mov dx, 4
mov eax, ebx
call fcn.006fcf4c
cmp dword [ebx + 0x48], 0xffffffff
jne 0x6fdaec
push 0xffffffffffffffff
push 0xffffffffffffffe8
mov dx, 0x18
mov eax, ebx
call fcn.006fcf4c
mov eax, dword [esi]
push eax
mov edx, edi
mov ecx, dword [ebp - 4]
xor eax, eax
call fcn.006fda6c
mov eax, dword [esi]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push edi
mov eax, dword [ebx + 0x48]
push eax
call sub.kernel32.dll_WriteFile
test eax, eax
jne 0x6fdb24
call sub.kernel32.dll_GetLastError
cmp eax, 0x3e5
je 0x6fdb24
xor eax, eax
jmp 0x6fdb26
mov al, 1
test al, al
jne 0x6fdb3e
call sub.kernel32.dll_GetLastError
xor edx, edx
push edx
push eax
mov dx, 2
mov eax, ebx
call fcn.006fcf4c
mov cl, 1
mov dl, 6
mov eax, ebx
call fcn.00701c74
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x6fdec4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
cmp dword [esi], 0
jne 0x6fdeeb
push 0
push 0
mov dx, 4
mov eax, ebx
call fcn.006fcf4c
mov eax, dword [esi]
mov byte [eax + 0x14], 1
cmp dword [ebx + 0x48], 0xffffffff
jne 0x6fdf06
push 0xffffffffffffffff
push 0xffffffffffffffe8
mov dx, 0x18
mov eax, ebx
call fcn.006fcf4c
mov eax, dword [esi]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push edi
mov eax, dword [ebx + 0x48]
push eax
call sub.kernel32.dll_ReadFile
test eax, eax
jne 0x6fdf2f
call sub.kernel32.dll_GetLastError
cmp eax, 0x3e5
je 0x6fdf2f
xor eax, eax
jmp 0x6fdf31
mov al, 1
test al, al
jne 0x6fdf49
call sub.kernel32.dll_GetLastError
xor edx, edx
push edx
push eax
mov dx, 3
mov eax, ebx
call fcn.006fcf4c
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x70215c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x702294
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0x7022a4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
mov ebx, eax
test ebx, ebx
jne 0x702277
mov dl, 1
mov eax, dword [0x44d5d0]
call fcn.00477d00
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x702270
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
mov dword [ebp - 0x10], pe_nt_image_headers32
mov dword [ebp - 0x14], pe_nt_image_headers32
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x10]
call fcn.0040b180
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x14]
call fcn.0040b180
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
call fcn.0040aff0
push eax
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.0040aff0
push eax
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegEnumValueW
mov ebx, eax
test ebx, ebx
jne 0x70222e
mov edx, dword [ebp - 0x14]
dec edx
lea eax, [ebp - 8]
call fcn.0040b180
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
inc esi
jmp 0x702236
cmp ebx, 0x103
jne 0x70223a
test ebx, ebx
je 0x7021c0
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
call dword [edx + 0xa4]
mov edx, dword [ebp - 0x1c]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x702277
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
mov eax, dword [ebp - 0x1c]
call fcn.00408708
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x70229b
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040a58c
pop eax
jmp eax

Function at 0x7175a8
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
mov ebx, ecx
add ebx, ebx
inc ebx
test ebx, ebx
js 0x7175cc
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x7175c5
mov edx, esp
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x717654
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0042d03c
fstp qword [ebp - 0x10]
wait
push dword [ebp - 0xc]
push dword [ebp - 0x10]
lea ecx, [ebp - 4]
mov edx, dword [0x8a42b4]
mov eax, 0x717674
call fcn.0042e02c
lea eax, [ebp - 0x18]
push eax
mov edx, esi
mov ecx, edi
mov eax, ebx
call fcn.0042b3ec
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.0040b258
mov eax, dword [ebp - 0x14]
call fcn.0040aff0
push eax
call sub.kernel32.dll_OutputDebugStringW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x71765b
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.0040a58c
lea eax, [ebp - 4]
call fcn.0040a52c
pop eax
jmp eax
Function at 0x722144
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
mov ebx, ecx
add ebx, ebx
inc ebx
test ebx, ebx
js 0x722168
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x722161
mov edx, esp
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x7221f0
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0042d03c
fstp qword [ebp - 0x10]
wait
push dword [ebp - 0xc]
push dword [ebp - 0x10]
lea ecx, [ebp - 4]
mov edx, dword [0x8a42b4]
mov eax, 0x722210
call fcn.0042e02c
lea eax, [ebp - 0x18]
push eax
mov edx, esi
mov ecx, edi
mov eax, ebx
call fcn.0042b3ec
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.0040b258
mov eax, dword [ebp - 0x14]
call fcn.0040aff0
push eax
call sub.kernel32.dll_OutputDebugStringW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7221f7
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.0040a58c
lea eax, [ebp - 4]
call fcn.0040a52c
pop eax
jmp eax
Function at 0x776fc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov byte [ebp - 1], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax]
test eax, eax
je 0x776fdc
sub eax, 4
mov eax, dword [eax]
test eax, eax
je 0x777067
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax]
movzx eax, byte [eax]
mov byte [ebp - 2], al
movzx eax, byte [ebp - 2]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0xc]
xor ax, word [edx + 4]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0xc]
and ax, word [edx + 6]
jne 0x777067
mov byte [ebp - 1], 1
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 8]
test eax, eax
je 0x777022
sub eax, 4
mov eax, dword [eax]
mov esi, eax
dec esi
test esi, esi
jl 0x777067
inc esi
xor edi, edi
lea eax, [edi + edi*2]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0xc]
mov edx, dword [edx + 8]
lea ebx, [edx + eax*2]
movzx eax, byte [ebx]
mov edx, eax
and dl, byte [ebp - 2]
cmp dl, al
jne 0x777063
mov eax, dword [ebp + 8]
push eax
movzx edx, byte [ebx + 4]
movzx eax, word [ebx + 2]
call fcn.00776f90
pop ecx
test al, al
je 0x777063
cmp byte [ebx + 4], 2
je 0x777067
inc edi
dec esi
jne 0x77702c
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x798530
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe70
lea eax, [ebp - 0x190]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup_1
mov esp, ebp
pop ebp
ret

Function at 0x79855c
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a610
xor eax, eax
push ebp
push 0x7985da
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.0040adb0
mov eax, dword [ebp - 8]
call fcn.0040ad24
mov esi, eax
push esi
call sub.wsock32.dll_inet_addr_1
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x7985ba
push esi
call sub.wsock32.dll_gethostbyname_1
test eax, eax
je 0x7985ba
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ebx, dword [eax]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7985e1
lea eax, [ebp - 8]
call fcn.0040a550
lea eax, [ebp - 4]
call fcn.0040a52c
pop eax
jmp eax
Function at 0x798664
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get socket status
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed8
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov esi, eax
mov byte [ebp - 1], 0
xor edx, edx
push ebp
push 0x7987fe
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [ebp + 8], 0
jne 0x798693
call fcn.00798530
xor edx, edx
push ebp
push 0x7987ed
push dword fs:[edx]
mov dword fs:[edx], esp
mov word [ebp - 0x128], 2
mov dword [ebp - 0x124], esi
mov word [ebp - 0x126], di
movzx ecx, bx
mov eax, ecx
mov esi, 0x3e8
xor edx, edx
div esi
mov dword [ebp - 0xc], eax
mov eax, ecx
mov ecx, 0x3e8
xor edx, edx
div ecx
mov dword [ebp - 8], edx
xor edx, edx
push ebp
push 0x7987b8
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 1
push 2
call sub.wsock32.dll_socket_1
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x7987a3
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0x10], 0xffffffff
jne 0x798719
xor ecx, ecx
mov dl, 1
mov eax, dword [0x798488]
call fcn.004301b4
call fcn.00409be8
mov dword [ebp - 0x14], 1
lea eax, [ebp - 0x14]
push eax
push 0x8004667e
mov eax, dword [ebp - 0x10]
push eax
call sub.wsock32.dll_ioctlsocket_1
push 0x10
lea eax, [ebp - 0x128]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.wsock32.dll_connect_1
lea eax, [ebp - 0x118]
call fcn.006b2648
lea edx, [ebp - 0x118]
mov eax, dword [ebp - 0x10]
call fcn.006b2638
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x118]
push eax
push 0
push 0
call sub.wsock32.dll_select_1
test eax, eax
jg 0x79878a
xor ecx, ecx
mov dl, 1
mov eax, dword [0x798488]
call fcn.004301b4
call fcn.00409be8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7987aa
mov eax, dword [ebp - 0x10]
push eax
call sub.wsock32.dll_closesocket_1
pop eax
jmp eax
Function at 0x7a7028
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
push ebx
push esi
push edi
mov ebx, ecx
test ebx, ebx
js 0x7a7041
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x7a703a
mov edx, esp
mov dword [ebp - 4], edx
mov ebx, eax
lea esi, [ebp - 0x84]
cmp dword [0x8b25a4], 0
jne 0x7a7061
mov eax, 0x40
call fcn.007a6ed4
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
add eax, 4
mov edx, 4
mov ecx, esi
xor ebx, ebx
mov dword [ecx], ebx
add ecx, 4
dec edx
jne 0x7a7071
mov ecx, eax
dec ecx
sub ecx, 4
jl 0x7a7097
inc ecx
mov eax, dword [ebp - 4]
lea edx, [esi + 0x10]
mov ebx, dword [eax]
mov dword [edx], ebx
add edx, 4
add eax, 4
dec ecx
jne 0x7a708a
mov edx, dword [ebp - 8]
dec edx
cmp edx, 0
jl 0x7a70d1
xor ecx, ecx
mov eax, 0x8b25a4
lea ebx, [edx + 4]
mov ebx, dword [esi + ebx*4]
mov edi, dword [eax]
shl edi, 5
lea edi, [edi*8 + 0x8ae5a4]
mov ebx, dword [edi + ebx*4]
lea edi, [ecx + edx]
xor dword [esi + edi*4], ebx
inc ecx
add eax, 4
cmp ecx, 5
jne 0x7a70a7
dec edx
cmp edx, 0xffffffff
jne 0x7a70a0
mov edx, 4
mov eax, esi
mov ecx, dword [ebp + 8]
mov ebx, dword [eax]
mov dword [ecx], ebx
add ecx, 4
add eax, 4
dec edx
jne 0x7a70db
mov edi, dword [ebp - 0x90]
mov esi, dword [ebp - 0x8c]
mov ebx, dword [ebp - 0x88]
mov esp, ebp
pop ebp
ret 4

Function at 0x7b1acc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
dec eax
test eax, eax
jl 0x7b1b3f
inc eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cmp byte [eax], 0
jne 0x7b1af8
push ebp
call fcn.007b1aa0
pop ecx
jmp 0x7b1b3a
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
mov esi, dword [eax*4 + 0x8a1aa0]
push ebp
call fcn.007b1aa0
pop ecx
mov ebx, dword [ebp + 0xc]
dec ebx
test ebx, ebx
jl 0x7b1b3a
inc ebx
xor ecx, ecx
mov eax, dword [ebp + 8]
movzx eax, byte [eax + ecx]
add eax, esi
mov edi, 0xff
cdq
idiv edi
movzx eax, byte [edx*4 + 0x8a16a0]
mov edx, dword [ebp - 4]
xor byte [edx + ecx], al
inc ecx
dec ebx
jne 0x7b1b17
dec dword [ebp - 0xc]
jne 0x7b1ae7
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x7b7990
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a610
xor eax, eax
push ebp
push 0x7b7a64
push dword fs:[eax]
mov dword fs:[eax], esp
or ebx, 0xffffffff
cmp dword [ebp - 4], 0
je 0x7b7a47
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00428ffc
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, 0x7b7a80
call fcn.0040b524
test eax, eax
jle 0x7b7a21
lea eax, [ebp - 0x10]
push eax
mov ecx, 6
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.0040b3c8
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00428c4c
mov eax, dword [ebp - 0xc]
mov edx, 0x7b7a90
call fcn.0040b390
je 0x7b7a21
lea eax, [ebp - 8]
mov ecx, dword [ebp - 8]
mov edx, 0x7b7aac
call fcn.0040b258
push 1
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.0040aff0
push eax
push 0
mov eax, dword [0x8a4154]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.shell32.dll_ShellExecuteW
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7b7a6b
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.0040a58c
pop eax
jmp eax