joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10005c10
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x10030a32
mov eax, dword fs:[0]
push eax
sub esp, 0x10c
mov eax, dword [0x1003cb10]
xor eax, esp
mov dword [esp + 0x108], eax
push ebx
mov eax, dword [0x1003cb10]
xor eax, esp
push eax
lea eax, [esp + 0x114]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 8], ebx
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
mov dword [esp + 0xc], esi
mov byte [esi + 4], bl
push 0xfe
lea eax, [esp + 0x15]
mov dword [esp + 0x120], ebx
push ebx
push eax
mov dword [esp + 0x14], 1
mov byte [esp + 0x1c], bl
call fcn.100197b0
mov ecx, dword [esp + 0x130]
add esp, 0xc
push ebx
push ecx
lea edx, [esp + 0x18]
push edx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [esp + 0x10]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x10005ca1
sub eax, edx
push eax
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call fcn.10002570
mov eax, esi
mov ecx, dword [esp + 0x114]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.10015adf
add esp, 0x118
ret 4

Function at 0x10007410
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x10031217
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1003cb10]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, dword [esp + 0x24]
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov dword [edi], 0x10036270
mov dword [edi + 0x58], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
lea esi, [edi + 8]
push esi
mov dword [esp + 0x20], ebx
push edi
mov dword [esp + 0x18], 1
call fcn.10008620
mov dword [esp + 0x1c], 1
mov eax, dword [edi]
mov ecx, dword [eax + 4]
mov dword [edi + ecx], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov ecx, esi
call fcn.10009270
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x48], bl
mov byte [esi + 0x41], bl
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ebx
mov eax, dword [esi + 0x24]
mov dword [eax], ebx
mov ecx, dword [esi + 0x34]
mov dword [ecx], ebx
mov edx, dword [esi + 0x10]
mov dword [edx], ebx
mov eax, dword [esi + 0x20]
mov dword [eax], ebx
mov ecx, dword [esi + 0x30]
mov dword [ecx], ebx
mov dword [esi + 0x4c], ebx
mov edx, dword [0x10040ee8]
mov dword [esi + 0x44], edx
mov dword [esi + 0x3c], ebx
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x10008070
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x100311c7
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1003cb10]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x2c]
xor ebx, ebx
mov dword [esp + 0x18], ebx
mov dword [ebp], 0x10036280
mov dword [ebp + 0x54], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [esp + 0x24], ebx
mov eax, dword [ebp]
mov ecx, dword [eax + 4]
mov dword [ecx + ebp], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov edx, dword [ebp]
mov edi, dword [edx + 4]
add edi, ebp
mov ecx, edi
mov dword [esp + 0x18], 1
call fcn.10004b20
lea esi, [ebp + 4]
push 0x20
mov ecx, edi
mov dword [edi + 0x28], esi
mov dword [edi + 0x2c], ebx
call fcn.10009a40
cmp dword [edi + 0x28], ebx
mov byte [edi + 0x30], al
jne 0x10008103
mov eax, dword [edi + 8]
or eax, 4
or eax, 4
push ebx
push eax
mov ecx, edi
call fcn.100049b0
mov dword [edi + 4], ebx
mov dword [esp + 0x24], 2
mov eax, dword [ebp]
mov ecx, dword [eax + 4]
mov dword [ecx + ebp], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov ecx, esi
call fcn.10009270
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x48], bl
mov byte [esi + 0x41], bl
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ebx
mov eax, dword [esi + 0x24]
mov dword [eax], ebx
mov ecx, dword [esi + 0x34]
mov dword [ecx], ebx
mov edx, dword [esi + 0x10]
mov dword [edx], ebx
mov eax, dword [esi + 0x20]
mov dword [eax], ebx
mov ecx, dword [esi + 0x30]
mov dword [ecx], ebx
mov dword [esi + 0x4c], ebx
mov edx, dword [0x10040ee8]
mov dword [esi + 0x44], edx
mov dword [esi + 0x3c], ebx
mov eax, ebp
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
Function at 0x10009270
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x1003062b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1003cb10]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.1002c76b
push 4
mov dword [esp + 0x24], 0
call fcn.1000a6ba
mov edi, eax
add esp, 4
test edi, edi
je 0x100092f4
call fcn.1002c9d1
mov dword [edi], eax
call fcn.1002c805
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.1002cd8b
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x100092e9
add eax, 1
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.1002cdac
jmp 0x100092f6
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x1000ba6d
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
test eax, eax
mov dword [esi], vtable.CInternetSession.0
jne 0x1000ba96
call fcn.1000d023
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
mov dword [esi + 8], eax
jne 0x1000bab9
push eax
push dword [esi + 4]
call fcn.1000b9f8
push esi
push eax
mov ecx, 0x1003e3dc
call fcn.1000b6ae
mov eax, esi
pop esi
pop ebp
ret 0x18

Function at 0x1000c2bb
Capabilities:
Connect to http server

Disassembly:
push 4
mov eax, 0x1002ff1b
call fcn.10017dd2
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [ebp + 0x1c]
mov edi, dword [ebp + 8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.1000c27d
and dword [ebp - 4], 0
lea ecx, [esi + 0x18]
mov dword [esi], vtable.CHttpConnection.0
call fcn.10003ee0
push dword [esi + 8]
mov edi, dword [edi + 8]
push 0
push 3
push dword [ebp + 0x18]
mov byte [ebp - 4], 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.WININET.dll_InternetConnectA]
test eax, eax
mov dword [esi + 4], eax
jne 0x1000c321
push eax
push dword [esi + 8]
call fcn.1000b9f8
push dword [esi + 0xc]
mov ecx, 0x1003e3dc
push eax
call fcn.1000b6ae
mov eax, esi
call fcn.10017e71
ret 0x18
Function at 0x10015adf
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1003cb10]
jne 0x10015ae9
repz ret
jmp fcn.1001bba8
Function at 0x1001e6b8
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x1003d378]
je 0x1001e6d3
inc edi
cmp edi, 0x17
jb 0x1001e6c4
cmp edi, 0x17
jae 0x1001e853
push ebp
push 3
call fcn.10027ef8
cmp eax, 1
pop ecx
je 0x1001e81f
push 3
call fcn.10027ef8
test eax, eax
pop ecx
jne 0x1001e707
cmp dword [0x100401e0], 1
je 0x1001e81f
cmp ebx, 0xfc
je 0x1001e852
push 0x100341c8
mov ebx, 0x314
push ebx
mov ebp, 0x100405b8
push ebp
call fcn.1001b0ca
add esp, 0xc
test eax, eax
je 0x1001e73d
push esi
push esi
push esi
push esi
push esi
call fcn.10015b73
add esp, 0x14
push 0x104
mov esi, 0x100405d1
push esi
push 0
mov byte [0x100406d5], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1001e781
push 0x100341b0
push 0x2fb
push esi
call fcn.1001b0ca
add esp, 0xc
test eax, eax
je 0x1001e781
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.10015b73
add esp, 0x14
push esi
call fcn.10017980
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x1001e7c6
push esi
call fcn.10017980
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x100408cc
push 0x100341ac
sub ecx, eax
push ecx
push eax
call fcn.1001b6cf
add esp, 0x14
test eax, eax
je 0x1001e7c6
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.10015b73
add esp, 0x14
jmp 0x1001e7c8
xor esi, esi
push 0x100341a8
push ebx
push ebp
call fcn.1001b60e
add esp, 0xc
test eax, eax
je 0x1001e7e8
push esi
push esi
push esi
push esi
push esi
call fcn.10015b73
add esp, 0x14
push dword [edi*8 + 0x1003d37c]
push ebx
push ebp
call fcn.1001b60e
add esp, 0xc
test eax, eax
je 0x1001e80a
push esi
push esi
push esi
push esi
push esi
call fcn.10015b73
add esp, 0x14
push 0x12010
push 0x10034180
push ebp
call fcn.10027d3b
add esp, 0xc
jmp 0x1001e852
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x1001e852
cmp ebp, 0xffffffff
je 0x1001e852
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x1003d37c]
push dword [esi]
call fcn.10017980
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x10027d3b
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.1001c0f7
xor ebx, ebx
cmp dword [0x10040c74], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x10027e11
push 0x10035c24
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x10027ef1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10035c18
push edi
call esi
cmp eax, ebx
je 0x10027ef1
push eax
call fcn.1001c089
mov dword [esp], 0x10035c08
push edi
mov dword [0x10040c74], eax
call esi
push eax
call fcn.1001c089
mov dword [esp], 0x10035bf4
push edi
mov dword [0x10040c78], eax
call esi
push eax
call fcn.1001c089
mov dword [0x10040c7c], eax
lea eax, [ebp - 0xc]
push eax
call fcn.1001b82b
test eax, eax
pop ecx
pop ecx
je 0x10027ddf
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.10015b73
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x10027e11
push 0x10035bd8
push edi
call esi
push eax
call fcn.1001c089
cmp eax, ebx
pop ecx
mov dword [0x10040c84], eax
je 0x10027e11
push 0x10035bc0
push edi
call esi
push eax
call fcn.1001c089
pop ecx
mov dword [0x10040c80], eax
mov eax, dword [0x10040c80]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x10027e96
cmp dword [0x10040c84], ecx
je 0x10027e96
push eax
call fcn.1001c100
push dword [0x10040c84]
mov esi, eax
call fcn.1001c100
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x10027e96
cmp edi, ebx
je 0x10027e96
call esi
cmp eax, ebx
je 0x10027e63
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10027e63
test byte [ebp - 0x18], 1
jne 0x10027e96
lea eax, [ebp - 0x10]
push eax
call fcn.1001b862
test eax, eax
pop ecx
je 0x10027e7e
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.10015b73
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x10027e8d
or dword [ebp + 0x10], 0x200000
jmp 0x10027ed1
or dword [ebp + 0x10], 0x40000
jmp 0x10027ed1
mov eax, dword [0x10040c78]
cmp eax, dword [ebp - 8]
je 0x10027ed1
push eax
call fcn.1001c100
cmp eax, ebx
pop ecx
je 0x10027ed1
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x10027ed1
mov eax, dword [0x10040c7c]
cmp eax, dword [ebp - 8]
je 0x10027ed1
push eax
call fcn.1001c100
cmp eax, ebx
pop ecx
je 0x10027ed1
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10040c74]
call fcn.1001c100
cmp eax, ebx
pop ecx
je 0x10027ef1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10027ef3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4282a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x17000]
push edi
jmp 0x4282ba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4282c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4282b0
mov eax, 1
add ebx, ebx
jne 0x4282d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4282c8
jne 0x4282e4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4282c8
xor ecx, ecx
sub eax, 3
jb 0x4282f8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42836a
mov ebp, eax
add ebx, ebx
jne 0x428303
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x428310
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x428334
inc ecx
add ebx, ebx
jne 0x428320
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x428315
jne 0x428331
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x428315
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x428354
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x428345
jmp 0x4282b6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x428354
add edi, ecx
jmp 0x4282b6
pop esi
mov edi, esi
mov ecx, 0x115
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x428372
cmp byte [edi], 3
jne 0x428372
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x428377
lea edi, [esi + 0x26000]
mov eax, dword [edi]
or eax, eax
je 0x4283e6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x28000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x280c4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4283a4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x280cc]
or eax, eax
je 0x4283e0
mov dword [ebx], eax
add ebx, 4
jmp 0x4283c1
call dword [esi + 0x280c8]
mov ebp, dword [esi + 0x280d0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ef]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42841a
sub esp, 0xffffff80
jmp 0x409ac0

Function at 0x430001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
jl 0x430030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x401000
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
mov dx, word [esp + 8]
lea ecx, [eax + eax*4]
mov word [ecx*8 + 0x412500], dx
lea ecx, [esp + 8]
push ecx
push 0
push eax
push 0x401030
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x401110
Capabilities:
Create thread

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov ecx, dword [ebx + 8]
inc ecx
mov eax, ecx
mov dword [ebx + 8], ecx
cmp eax, 1
jbe 0x401142
mov esi, dword [esp + 0x10]
push 0x40d058
push 0xfffffffffffffffe
push esi
call fcn.004011a0
push esi
push ebx
call fcn.00401220
add esp, 0x14
pop esi
pop ebx
ret
push edi
push 0x10018
call fcn.004063c0
mov esi, eax
mov ecx, 0x4006
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov dword [esi + 0x10010], eax
mov eax, dword [esp + 0x18]
push 0
push 0
push eax
mov dword [esi + 8], ebx
mov dword [esi], eax
call fcn.004011a0
add esp, 0x10
lea eax, [esp + 0x10]
push eax
push 0
push esi
push 0x401240
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
pop ebx
ret

Function at 0x4011a0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x100
push ebx
push esi
push edi
call fcn.004055e0
push eax
lea eax, [esp + 0x10]
push 0x40d080
push eax
call fcn.0040652e
lea edi, [esp + 0x18]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
mov ebx, dword [esp + 0x110]
dec ecx
mov esi, ecx
push eax
inc esi
lea ecx, [esp + 0x10]
push esi
push ecx
push ebx
call sub.WS2_32.dll_send
cmp eax, esi
jl 0x40120a
mov edx, dword [esp + 0x118]
test edx, edx
je 0x40120a
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
push 0
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push ebx
call sub.WS2_32.dll_send
pop edi
pop esi
pop ebx
add esp, 0x100
ret
Function at 0x4012e0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket
Set socket configuration

Disassembly:
sub esp, 0x430
push ebx
push ebp
push esi
mov esi, dword [esp + 0x440]
lea eax, [esp + 0x18]
push edi
mov ecx, dword [esi]
push eax
mov edi, 1
push 0x8004667e
push ecx
mov dword [esp + 0x28], edi
call sub.WS2_32.dll_ioctlsocket
mov eax, dword [esi]
push 0
lea edx, [esp + 0x24]
push 0x20
push edx
push eax
call sub.WS2_32.dll_recv
push 0x14
lea ecx, [esp + 0x44]
push 0x100
push ecx
call fcn.004018e0
add esp, 0xc
test eax, eax
jle 0x40139f
lea edx, [esp + 0x40]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], edx
mov eax, dword [esp + 0x14]
mov ebx, dword [eax]
mov eax, ebx
shr eax, 0x18
inc eax
test eax, eax
jle 0x401389
mov ebp, eax
mov edx, dword [esi]
push 0
lea ecx, [esp + 0x17]
push 1
push ecx
push edx
mov byte [esp + 0x23], bl
call sub.WS2_32.dll_send
mov edi, eax
mov al, byte [esp + 0x13]
cmp al, 0xa
jne 0x401383
mov eax, dword [esi]
push 0
push 1
push 0x40d0bc
push eax
call sub.WS2_32.dll_send
shr ebx, 8
dec ebp
jne 0x401353
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
add ecx, 4
dec eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
jne 0x401341
mov edx, dword [esi]
push 0
lea ecx, [esp + 0x24]
push 1
push ecx
push edx
call sub.WS2_32.dll_recv
test eax, eax
jg 0x4013bc
test edi, edi
jge 0x40131d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x430
ret

Function at 0x401e60
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [0x410eb8]
push esi
test eax, eax
je 0x401e9c
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401e9c
mov ecx, dword [0x411ec8]
add ecx, esi
cmp ecx, 0x8000000
ja 0x401e9c
mov ecx, dword [esp + 8]
lea edx, [esp + 0xc]
push 0
push edx
push esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
add dword [0x411ec8], esi
pop esi
ret

Function at 0x401ea0
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 4]
push esi
push edi
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [0x410eb8]
not ecx
dec ecx
test eax, eax
mov esi, ecx
je 0x401ee7
test esi, esi
je 0x401ee7
mov ecx, dword [0x411ec8]
add ecx, esi
cmp ecx, 0x8000000
ja 0x401ee7
lea ecx, [esp + 0xc]
push 0
push ecx
push esi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
add dword [0x411ec8], esi
pop edi
pop esi
ret

Function at 0x402250
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
xor esi, esi
push edi
mov edi, dword [esp + 0x18]
test ebx, ebx
jle 0x402283
mov ebp, dword [esp + 0x14]
mov ecx, dword [ebp]
mov eax, ebx
sub eax, esi
push 0
push eax
push edi
push ecx
call sub.WS2_32.dll_recv
test eax, eax
jle 0x40229a
add esi, eax
add edi, eax
cmp esi, ebx
jl 0x402266
mov edx, dword [esp + 0x18]
push 0
push esi
push edx
call fcn.00401ef0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x4023b0
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0xc]
or cl, 0xff
test edi, edi
jle 0x4023d0
push esi
mov esi, dword [esp + 0xc]
mov al, byte [esi]
mov dl, al
xor dl, cl
mov cl, al
mov byte [esi], dl
inc esi
dec edi
jne 0x4023c1
pop esi
pop edi
ret

Function at 0x402420
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
push 1
push esi
push edi
call fcn.00401ef0
mov eax, dword [esp + 0x18]
add esp, 0xc
mov ecx, dword [eax]
push 0
push esi
push edi
push ecx
call sub.WS2_32.dll_send
pop edi
pop esi
ret

Function at 0x402ee0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
or cl, 0xff
test edx, edx
jle 0x402efd
mov eax, dword [esp + 4]
push ebx
mov bl, byte [eax]
xor bl, cl
mov byte [eax], bl
inc eax
dec edx
mov cl, bl
jne 0x402ef0
pop ebx
ret

Function at 0x4031a0
Capabilities:
Create thread

Disassembly:
push ecx
push 0x40d528
call fcn.00401b50
mov eax, dword [esp + 0xc]
mov dx, word [esp + 0x10]
add esp, 4
lea ecx, [eax + eax*4]
mov word [ecx*8 + 0x412500], dx
lea ecx, [esp]
push ecx
push 0
push eax
push 0x4031e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ecx
ret

Function at 0x403310
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x18]
push esi
push eax
mov dword [esp + 8], 1
mov word [esp + 0xc], 2
call sub.WS2_32.dll_htons
push 0
push 1
push 2
mov word [esp + 0x16], ax
mov dword [esp + 0x18], 0
call sub.WS2_32.dll_socket
mov esi, eax
test esi, esi
jge 0x403353
or eax, 0xffffffff
pop esi
add esp, 0x14
ret
lea ecx, [esp + 4]
push 4
push ecx
push 4
push 0xffff
push esi
call sub.WS2_32.dll_setsockopt
test eax, eax
jge 0x403373
or eax, 0xffffffff
pop esi
add esp, 0x14
ret
lea edx, [esp + 8]
push 0x10
push edx
push esi
call sub.WS2_32.dll_bind
test eax, eax
jge 0x40338c
or eax, 0xffffffff
pop esi
add esp, 0x14
ret
push 5
push esi
call sub.WS2_32.dll_listen
test eax, eax
jge 0x4033a0
or eax, 0xffffffff
pop esi
add esp, 0x14
ret
mov eax, esi
pop esi
add esp, 0x14
ret

Function at 0x4033b0
Capabilities:
Create thread

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov ecx, dword [ebx + 8]
inc ecx
mov eax, ecx
mov dword [ebx + 8], ecx
cmp eax, 1
jbe 0x4033e2
mov esi, dword [esp + 0x10]
push 0x40d058
push 0xfffffffffffffffe
push esi
call fcn.00403440
push esi
push ebx
call fcn.00401220
add esp, 0x14
pop esi
pop ebx
ret
push edi
push 0x40d56c
call fcn.00404c10
push 0x10018
call fcn.004063c0
mov esi, eax
mov ecx, 0x4006
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov dword [esi + 0x10010], eax
mov eax, dword [esp + 0x1c]
push 0
push 0
push eax
mov dword [esi + 8], ebx
mov dword [esi], eax
call fcn.00403440
add esp, 0x14
lea eax, [esp + 0x10]
push eax
push 0
push esi
push 0x403520
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
pop ebx
ret