joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002a0d0
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1004b040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x100598d8]
lea eax, [ebp - 0xc]
push eax
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x1002a23b
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x1002a23b
mov eax, dword [0x100598d8]
test eax, eax
je 0x1002a11d
inc dword [eax + 0xb0]
push edi
push 0x38
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
je 0x1002a13e
push 0x38
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
jmp 0x1002a140
xor edi, edi
or dword [esi + 0xc], 6
mov dword [esi + 0x70], edi
mov dword [esi + 0x68], str.imgui_impl_win32
mov esi, dword [0x100598d8]
mov dword [edi], ebx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], ecx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], ecx
mov dword [edi + 0x20], 9
test esi, esi
je 0x1002a17e
mov esi, dword [esi + 0x70]
jmp 0x1002a180
xor esi, esi
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 4
add esi, 0x24
shr eax, 0x10
push esi
push 0x20001004
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x1002a1a3
mov dword [esi], eax
mov eax, dword [0x100598d8]
xor esi, esi
mov dword [ebp - 0x30], str.xinput1_4.dll
mov dword [ebp - 0x2c], str.xinput1_3.dll
mov dword [ebp - 0x28], str.xinput9_1_0.dll
mov eax, dword [eax + 0x47ec]
mov dword [ebp - 0x24], str.xinput1_2.dll
mov dword [ebp - 0x20], str.xinput1_1.dll
mov eax, dword [eax]
mov dword [eax + 0x24], ebx
mov byte [edi + 0x29], 1
nop dword [eax]
push dword [ebp + esi*4 - 0x30]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
jne 0x1002a209
inc esi
cmp esi, 5
jl 0x1002a1e0
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100400ab
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.XInputGetCapabilities
push ebx
mov dword [edi + 0x2c], ebx
call esi
push str.XInputGetState
push ebx
mov dword [edi + 0x30], eax
call esi
mov dword [edi + 0x34], eax
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100400ab
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop esi
xor ecx, ebp
pop ebx
call fcn.100400ab
mov esp, ebp
pop ebp
ret
Function at 0x10039780
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1004b040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
mov esi, ecx
push ebx
push 4
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
mov dword [ebp - 0x24], edi
cmp edi, 0xffffffff
je 0x10039893
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x1003988c
mov ebx, 1
nop dword [eax]
cmp dword [ebp - 0x20], 0x10
jb 0x1003984f
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x14], eax
jne 0x1003984f
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x1003984f
mov edx, dword [esi]
test edx, edx
jne 0x10039818
push 0x200
push edx
push dword [0x100598e4]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x10039874
lea edi, [esi + 8]
jmp 0x10039842
mov eax, dword [esi + 4]
lea edi, [esi + 8]
cmp dword [edi], eax
jb 0x10039842
add eax, eax
mov dword [esi + 4], eax
shl eax, 2
push eax
push edx
push 0
push dword [0x100598e4]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x100398a6
mov dword [esi], edx
mov ecx, dword [edi]
mov eax, dword [ebp - 0x18]
mov dword [edx + ecx*4], eax
inc dword [edi]
mov edi, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x100397d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x1003988c
mov eax, dword [esi]
xor ebx, ebx
test eax, eax
je 0x1003988c
push eax
push ebx
push dword [0x100598e4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100400ab
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x24]
jmp 0x10039874

Function at 0x100398b0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.10039780
test eax, eax
jne 0x100398e1
mov eax, 9
pop edi
mov esp, ebp
pop ebp
ret
cmp dword [edi], 0
je 0x10039932
push esi
xor esi, esi
cmp dword [edi + 8], esi
jbe 0x1003992a
push ebx
nop
mov eax, dword [edi]
push dword [eax + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x10039923
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [ebp + 8]
mov edx, dword [ebp - 4]
mov ecx, ebx
call fcn.10039610
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [edi + 8]
jb 0x100398f0
pop ebx
pop esi
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10039940
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, ecx
cmp dword [ebx], 0
je 0x1003998c
push esi
xor esi, esi
cmp dword [ebx + 8], esi
jbe 0x1003997b
push edi
mov eax, dword [ebx]
push dword [eax + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x10039974
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebx + 8]
jb 0x10039951
pop edi
push dword [ebx]
push 0
push dword [0x100598e4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop ebx
ret

Function at 0x10039990
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1004b040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
imul esi, ecx, 0x2c
mov ebx, edx
push edi
add esi, dword [0x10059990]
mov eax, dword [esi]
mov cl, byte [esi + 0x14]
and cl, 1
lea edi, [eax - 5]
cmove edi, eax
movzx eax, cl
lea ecx, [ebp - 8]
push ecx
push 0x40
lea eax, [eax*2 + 5]
push eax
push edi
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x100399f1
pop edi
pop esi
mov eax, 0xa
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100400ab
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x10039a12
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x10039a33
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x10039a33
mov eax, dword [esi + 0xc]
test byte [esi + 0x14], 1
mov dword [edi], eax
je 0x10039a2d
mov ax, word [esi + 0x10]
mov word [edi + 4], ax
mov al, byte [esi + 0x12]
mov byte [edi + 6], al
jmp 0x10039a33
mov al, byte [esi + 0x10]
mov byte [edi + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov cl, bl
xor eax, eax
add cl, cl
shl bl, 2
xor cl, byte [esi + 0x14]
and cl, 2
xor cl, byte [esi + 0x14]
xor bl, cl
and bl, 4
xor bl, cl
mov ecx, dword [ebp - 4]
pop edi
mov byte [esi + 0x14], bl
xor ecx, ebp
pop esi
pop ebx
call fcn.100400ab
mov esp, ebp
pop ebp
ret
Function at 0x10039a90
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [0x10059998]
sub esp, 0x10
push ebx
push esi
xor esi, esi
mov ebx, ecx
test edx, edx
je 0x10039ac4
mov eax, dword [0x10059990]
add eax, 0x14
nop
movzx ecx, byte [eax]
shr ecx, 1
and ecx, 1
cmp ecx, ebx
jne 0x10039acc
inc esi
add eax, 0x2c
cmp esi, edx
jb 0x10039ab0
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
cmp esi, 0xffffffff
je 0x10039b82
test ebx, ebx
lea ecx, [ebp - 0x10]
setne al
or edx, 0xffffffff
push eax
call fcn.100398b0
add esp, 4
mov dword [ebp - 4], eax
test eax, eax
jne 0x10039b82
mov ecx, dword [0x10059998]
push edi
cmp esi, ecx
jae 0x10039b3a
imul edi, esi, 0x2c
mov eax, dword [0x10059990]
movzx eax, byte [edi + eax + 0x14]
shr eax, 1
and eax, 1
cmp eax, ebx
je 0x10039b2f
mov edx, ebx
mov ecx, esi
call fcn.10039990
mov dword [ebp - 4], eax
test eax, eax
jne 0x10039b3a
mov ecx, dword [0x10059998]
jmp 0x10039b32
mov eax, dword [ebp - 4]
inc esi
add edi, 0x2c
cmp esi, ecx
jb 0x10039b04
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x10039b81
xor esi, esi
cmp dword [ebp - 8], esi
jbe 0x10039b6f
push dword [ebx + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x10039b69
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebp - 8]
jb 0x10039b48
push ebx
push 0
push dword [0x100598e4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003a3a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
jne 0x1003a3d3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0
push 0
push dword [ebp + 8]
push 0x1003a2f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x1003a3d3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop ebp
ret 0xc
Function at 0x10001010
Capabilities:
Terminate process

Disassembly:
call fcn.10001150
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
ret

Function at 0x10001040
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
xor ecx, ecx
push edi
mov edi, dword [ebp + 8]
mov eax, dword [esi]
mov dword [ebp - 8], eax
mov eax, 4
cmp edx, eax
jle 0x1000109e
push ebx
jmp 0x10001070
mov ecx, eax
and ecx, 3
mov cl, byte [ebp + ecx - 8]
xor cl, byte [eax + esi]
mov byte [edi + eax - 4], cl
inc eax
cmp eax, edx
jl 0x10001070
pop ebx
mov byte [edi + edx - 4], 0
lea eax, [edx - 4]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10001822
mov esp, ebp
pop ebp
ret
mov byte [edi + ecx], cl
mov eax, ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10001822
mov esp, ebp
pop ebp
ret

Function at 0x100010c0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
push esi
mov esi, ecx
test edx, edx
je 0x10001144
cmp edx, 0x10
jb 0x10001126
movdqa xmm1, xmmword [0x100104a0]
mov ecx, edx
movdqa xmm2, xmmword [0x100104b0]
and ecx, 0xf
movdqa xmm3, xmmword [str.9999999999999999]
push edi
mov edi, edx
sub edi, ecx
mov ecx, esi
movdqu xmm0, xmmword [ecx]
add eax, 0x10
lea ecx, [ecx + 0x10]
paddb xmm0, xmm1
movdqu xmmword [ecx - 0x10], xmm0
movdqu xmm0, xmmword [ecx - 0x10]
pxor xmm0, xmm2
movdqu xmmword [ecx - 0x10], xmm0
movdqu xmm0, xmmword [ecx - 0x10]
psubb xmm0, xmm3
movdqu xmmword [ecx - 0x10], xmm0
cmp eax, edi
jb 0x100010f2
pop edi
cmp eax, edx
jae 0x10001144
lea ebx, [ebx]
mov cl, byte [eax + esi]
add cl, 0x7b
xor cl, 0xed
sub cl, 0x39
mov byte [eax + esi], cl
inc eax
cmp eax, edx
jb 0x10001130
pop esi
ret
Function at 0x100024df
Capabilities:
Parse pe header

Disassembly:
mov edx, dword [esp + 4]
xor eax, eax
test edx, edx
je 0x10002500
cmp word [edx], 0x5a4d
jne 0x10002500
mov ecx, dword [edx + 0x3c]
add ecx, edx
cmp dword [ecx], 0x4550
jne 0x10002500
mov eax, dword [ecx + 0x50]
ret 4
Function at 0x10003234
Capabilities:
Delete file

Disassembly:
mov eax, 0x100068a0
call fcn.10006650
sub esp, 0x164
push ebx
push esi
push edi
push 1
pop edi
xor ebx, ebx
lea eax, [ebp - 0x3c]
push ebx
push eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
call sub.gdiplus.dll_GdiplusStartup
push dword [ebp + 8]
lea eax, [ebp - 0x170]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
lea eax, [ebp - 0x170]
pop ecx
push 0x1000a8f4
push eax
call sub.MSVCRT.dll_strlen
pop ecx
lea ecx, [ebp - 0x170]
sub ecx, 3
add eax, ecx
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
pop ecx
push ebx
push ebx
push 0xffffffffffffffff
push dword [ebp + 8]
push ebx
push ebx
call esi
mov dword [ebp - 0x10], eax
lea eax, [eax + eax + 2]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x14], eax
push dword [ebp - 0x10]
push eax
push 0xffffffffffffffff
push dword [ebp + 8]
push ebx
push ebx
call esi
push ebx
push ebx
lea eax, [ebp - 0x170]
push 0xffffffffffffffff
push eax
push ebx
push ebx
call esi
mov dword [ebp - 0x10], eax
lea eax, [eax + eax + 2]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x18], eax
push dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x170]
push 0xffffffffffffffff
push eax
push ebx
push ebx
call esi
lea eax, [ebp - 0x24]
mov dword [ebp - 0x28], 0x10007228
mov dword [ebp - 0x24], ebx
push eax
push dword [ebp - 0x14]
call sub.gdiplus.dll_GdipLoadImageFromFile
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x6c]
mov dword [ebp - 4], ebx
push eax
push str.image_jpeg
call fcn.100033a7
mov dword [ebp - 0x5c], edi
mov esi, 0x10007230
lea edi, [ebp - 0x58]
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop ecx
lea eax, [ebp + 0xc]
movsd dword es:[edi], dword [esi]
push 1
mov dword [ebp - 0x40], eax
pop esi
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x6c]
push eax
mov dword [ebp - 0x44], 4
push dword [ebp - 0x18]
mov dword [ebp - 0x48], esi
push dword [ebp - 0x24]
call sub.gdiplus.dll_GdipSaveImageToFile
cmp eax, ebx
je 0x10003364
mov dword [ebp - 0x20], eax
push dword [ebp - 0x14]
call fcn.1000660c
push dword [ebp - 0x18]
call fcn.1000660c
pop ecx
mov dword [ebp - 0x28], 0x10007228
pop ecx
push dword [ebp - 0x24]
call sub.gdiplus.dll_GdipDisposeImage
push dword [ebp - 0x2c]
call sub.gdiplus.dll_GdiplusShutdown
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x10003ac3
Capabilities:
Create thread

Disassembly:
push ebx
push esi
xor esi, esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
push esi
push esi
push esi
push 0x100039b4
push esi
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call ebx
push esi
push esi
push esi
push 0x10003a6b
push esi
push esi
call edi
push eax
call ebx
push 1
pop eax
pop edi
pop esi
pop ebx
ret
Function at 0x10003c60
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
lea eax, [ebp - 0x190]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x10003c9d
cmp byte [ebp - 0x190], 2
jne 0x10003c97
mov al, byte [ebp - 0x18f]
cmp al, 2
jne 0x10003c97
push 1
pop eax
leave
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
leave
ret

Function at 0x10003d57
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x10003d9e
mov ecx, dword [eax + 0xc]
mov ecx, dword [ecx]
test ecx, ecx
je 0x10003d9e
movsx eax, word [eax + 0xa]
push eax
lea eax, [ebp - 0xc]
push ecx
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push dword [ebp - 0xc]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
push dword [ebp + 0xc]
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
push 1
pop eax
leave
ret
xor eax, eax
leave
ret

Function at 0x10003da2
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10003dc0
xor eax, eax
jmp 0x10003dff
push dword [ebp + 8]
mov word [ebp - 0x10], 2
call dword [sym.imp.WS2_32.dll_inet_addr]
push dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0xe], ax
lea eax, [ebp - 0x10]
push 0x10
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x10003dfd
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
jmp 0x10003dff
mov eax, esi
pop esi
leave
ret
Function at 0x10004038
Capabilities:
Create thread

Disassembly:
push esi
xor esi, esi
cmp dword [0x10091d18], esi
jne 0x1000406d
push edi
push esi
push esi
push esi
push 0x100043a2
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [esp + 0xc], esi
mov edi, eax
je 0x10004065
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
ret 4
Function at 0x100047ff
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x10004798
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
ret
Function at 0x10004db1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov ecx, dword [eax]
mov ebx, dword [eax + 4]
jle 0x10004e01
push esi
inc cl
movzx ecx, cl
mov edx, dword [eax + ecx*4 + 8]
mov dword [ebp + 8], ecx
lea esi, [eax + ecx*4 + 8]
mov cl, dl
add cl, bl
movzx ebx, cl
mov ecx, dword [eax + ebx*4 + 8]
mov dword [esi], ecx
mov esi, dword [ebp + 0xc]
add cl, dl
mov dword [eax + ebx*4 + 8], edx
movzx ecx, cl
add esi, edi
mov cl, byte [eax + ecx*4 + 8]
xor byte [esi], cl
mov ecx, dword [ebp + 8]
inc edi
cmp edi, dword [ebp + 0x10]
jl 0x10004dc6
pop esi
mov dword [eax + 4], ebx
pop edi
mov dword [eax], ecx
pop ebx
pop ebp
ret 0xc
Function at 0x10005535
Capabilities:
Get common file path

Disassembly:
push ebx
push ebp
push esi
mov esi, 0x104
push edi
push esi
push 0x10091f24
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push esi
push 0x10091e20
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x10091d1c
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ebx, 0x10092028
push esi
push ebx
push 0
call edi
mov eax, dword [0x10092334]
mov ebp, dword [sym.imp.MSVCRT.dll__strlwr]
test eax, eax
je 0x10005590
push esi
mov esi, 0x10092230
push esi
push eax
call edi
push esi
call ebp
pop ecx
push ebx
call ebp
push ebx
call fcn.100055ac
push eax
push 0x1009212c
call sub.MSVCRT.dll_strcpy
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x1000571e
Capabilities:
Set file attributes

Disassembly:
push 6
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret

Function at 0x100057b0
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov dword [ecx], 0x67452301
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x58], eax
ret

Function at 0x10006281
Capabilities:
Accept command line arguments
Delete file
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov esi, str.ServerMain
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea ecx, [ebp - 0xc]
push ecx
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
mov esi, eax
pop ecx
test esi, esi
pop ecx
je 0x100062c9
add esi, 0xb
push 0
push esi
call dword [sym.imp.MSVCRT.dll__access]
pop ecx
cmp eax, 0xffffffff
pop ecx
je 0x100062c9
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x100062b0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x100062d3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
and byte [ebp - 0x104], 0
push edi
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x104]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push dword [ebp + 0xc]
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x208]
push str._s_s
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp + 8]
pop edi
mov dword [ecx], eax
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
leave
ret 8
Function at 0x10006345
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and byte [ebp - 0x10], 0
push edi
xor eax, eax
lea edi, [ebp - 0xf]
stosd dword es:[edi], eax
push dword [ebp + 8]
stosd dword es:[edi], eax
push dword [ebp + 0xc]
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
pop edi
jne 0x10006394
mov eax, dword [ebp + 8]
shr eax, 0x10
test ax, ax
jne 0x1000638c
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push 0x1000a7f4
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0xfffffffffffffffe
call dword [sym.imp.KERNEL32.dll_ExitProcess]
leave
ret 8
Function at 0x407539
Capabilities:
Check os version
Terminate process

Disassembly:
and esi, 0xffffffff
neg ecx
mov dword [0x410edb], esi
and edi, 0xffffffff
not ecx
mov dword [0x410ed7], edi
and ebx, 0xffffffff
not ecx
mov dword [0x410ee7], ebx
pop eax
jmp fcn.00403f7c

Function at 0x461980
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword fs:[0x14]
mov edx, esp
sub esp, 0x21c
mov dword [esp], esp
mov dword [esp + 4], 0x21c
call fcn.00461310
lea ecx, [esp + 0x30]
mov dword fs:[0x14], ecx
mov ebx, esp
sub esp, 0xd8
mov dword [ecx], esp
mov dword [ebx], esp
mov dword [esp], esp
mov dword [esp + 4], 0xd8
call fcn.00461310
lea ebx, [esp + 0xd8]
mov dword [esp + 0x18], ebx
lea ecx, [esp - 0x8000]
mov dword [esp], ecx
add ecx, 0xba0
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 4], edx
push eax
push dword [ebp + 0x10]
call dword [ebp + 8]
pop ecx
pop eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov esp, dword [ecx + 4]
pop dword fs:[0x14]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x406c81
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x460114], 0
jne 0x406cbf
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406c95
mov dword [ecx*4 + 0x460110], eax
inc ecx
cmp ecx, 0x100
jl 0x406c90
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x406cec
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x460110]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x406ccd
not eax
pop ebp
ret 0xc

Function at 0xf02758
Capabilities:
Encode data using xor

Disassembly:
jmp 0xf02762
pushal
call 0xf02768
pop ebp
sub ebp, 0x10
sub ebp, 0xb02758
jmp 0xf0277e
mov eax, 0xb02758
add eax, ebp
add eax, 0x4c
mov ecx, 0x5cb
mov edx, 0x3a107517
xor byte [eax], dl
inc eax
dec ecx
jne 0xf02795
jmp 0xf027a8
pushfd
ficomp dword [esi + ebx*4 + 0x1717172b]
xchg esi, eax
salc
out dx, eax
pop ss
pop ss
pop ss
adc al, 0xda
scasd eax, dword es:[edi]
adc dword [edi], edx
pop ss
pop ss
lodsd eax, dword [esi]
aas
pop ss
pop ss
pop ss
loopne 0xf027b9
adc al, 0xdf
pushfd
xchg esi, eax
sbb edx, dword [edi]
pop ss
pop ss
fistp word [esi + edx*4 + 0x1717171b]
adc al, 0xd2
inc edi
inc edi
jg 0xf027c5
invalid