joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006fa0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8000c
call fcn.1001bbd0
mov eax, dword [0x10149be4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push edi
mov edi, ecx
mov dword [ebp - 0x80008], eax
lea ebx, [edi + 0x10001c]
push ebx
mov dword [ebp - 0x8000c], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [edi + 4], 0xffffffff
je 0x10007163
cmp byte [edi + 0x100038], 0
je 0x10007163
push esi
push 0x80000
lea eax, [ebp - 0x80004]
push 0
push eax
call fcn.1001e7e0
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x80004]
push esi
push dword [ebp - 0x80008]
push eax
call fcn.1001e260
add esp, 0x18
cmp byte [ebp - 0x80004], 0xc1
jne 0x10007036
push dword [ebp - 0x80002]
lea eax, [esi - 3]
push eax
lea eax, [ebp - 0x80001]
jmp 0x10007046
push dword [ebp - 0x80001]
lea eax, [esi - 4]
push eax
lea eax, [ebp - 0x80000]
push eax
call fcn.1000e940
mov ecx, dword [edi + 0x100010]
add esp, 0xc
test ecx, ecx
jle 0x100070a8
lea eax, [ecx + esi]
cmp eax, 0x80000
jle 0x10007086
mov ecx, edi
call fcn.10007380
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop edi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001bbbf
mov esp, ebp
pop ebp
ret 8
push esi
lea eax, [ebp - 0x80004]
push eax
lea eax, [edi + 0x80010]
add eax, ecx
push eax
call fcn.1001e260
add esp, 0xc
add dword [edi + 0x100010], esi
push ebx
jmp 0x100070d9
xor ebx, ebx
test esi, esi
jle 0x100070d2
nop
push 0
push esi
lea eax, [ebp - 0x80004]
add eax, ebx
push eax
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x100070f4
sub esi, eax
add ebx, eax
test esi, esi
jg 0x100070b0
mov eax, dword [ebp - 0x8000c]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop edi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001bbbf
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x1000713a
mov ecx, dword [edi + 0x100010]
lea eax, [ecx + esi]
cmp eax, 0x80000
jg 0x1000713a
lea eax, [ebp - 0x80004]
add eax, ebx
push esi
push eax
lea eax, [edi + 0x80010]
add eax, ecx
push eax
call fcn.1001e260
add esp, 0xc
lea eax, [edi + 0x10001c]
add dword [edi + 0x100010], esi
jmp 0x100070d8
mov ecx, edi
call fcn.10007380
lea eax, [edi + 0x10001c]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop edi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001bbbf
mov esp, ebp
pop ebp
ret 8
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop ebx
call fcn.1001bbbf
mov esp, ebp
pop ebp
ret 8
Function at 0x10007180
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x10001c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edi, edi
cmp dword [esi + 0x100010], edi
jle 0x100071d2
lea eax, [esi + 0x80010]
push 0
push dword [esi + 0x100010]
add eax, edi
push eax
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x100071df
sub dword [esi + 0x100010], eax
add edi, eax
cmp dword [esi + 0x100010], 0
lea eax, [esi + 0x80010]
jg 0x100071a2
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
mov al, 1
pop ebx
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x10007217
push dword [esi + 0x100010]
lea eax, [esi + 0x80010]
add eax, edi
push eax
lea eax, [esi + 0x80010]
push eax
call fcn.1001d370
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
mov al, 1
pop ebx
ret
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x1000722d
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 4], 0xffffffff
mov eax, dword [esi + 8]
test eax, eax
je 0x10007242
push eax
call dword [sym.imp.WS2_32.dll_WSACloseEvent]
mov dword [esi + 8], 0
push ebx
mov byte [esi + 0x100038], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
xor al, al
pop ebx
ret

Function at 0x10007260
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
xor eax, eax
test edx, edx
jle 0x1000728e
push esi
mov esi, dword [ebp + 8]
mov cl, byte [0x1014ac8d]
add cl, 0xf
xor cl, byte [eax + esi]
sub cl, byte [0x1014ac8e]
add cl, 0xf
mov byte [eax + esi], cl
inc eax
cmp eax, edx
jl 0x10007270
pop esi
pop ebp
ret

Function at 0x10007290
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10039a08
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x10149be4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x10149780]
cmp eax, 0x927c0
jb 0x100072d5
call esi
mov dword [0x10149780], eax
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 1
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x28], 0
push eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
call sub.gdiplus.dll_GdiplusStartup
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
push 0x14
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 0
push eax
mov ecx, 0x100493b4
call fcn.10013080
test al, al
jne 0x10007338
mov esi, dword [ebp - 0x1c]
cmp esi, dword [ebp - 0x18]
jne 0x10007346
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.1000fb30
mov esi, dword [ebp - 0x1c]
push dword [ebp - 0x10]
call sub.gdiplus.dll_GdiplusShutdown
test esi, esi
je 0x10007361
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x1c]
sub eax, esi
push eax
push esi
call fcn.100126f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100073c0
Capabilities:
Check if file exists
Encode data using xor
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x10149be4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x8c], 0
mov edx, 0xf
xor ecx, ecx
mov al, byte [ecx + str.LMEZZQY_KEYnnnqmSLLVPH]
xor al, dl
mov byte [ebp + ecx - 0x40], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x18
jb 0x100073e4
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
lea eax, [ebp - 0x40]
push eax
mov byte [ebp - 0x28], 0
call esi
test eax, eax
jne 0x100074ae
mov edx, 0x15
xor ecx, ecx
nop dword [eax]
mov al, byte [ecx + str.V_Kxnz_pg_wHDF]
xor al, dl
mov byte [ebp + ecx - 0x14], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0xf
jb 0x10007420
lea eax, [ebp - 0x14]
mov byte [ebp - 5], 0
push eax
call esi
test eax, eax
jne 0x100074ae
mov edx, 6
xor ecx, ecx
nop dword [eax]
mov al, byte [ecx + str.BTMk]
xor al, dl
mov byte [ebp + ecx - 0x24], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0xf
jb 0x10007450
lea eax, [ebp - 0x24]
mov byte [ebp - 0x15], 0
push eax
call esi
test eax, eax
jne 0x100074ae
mov eax, 0x1003ceec
lea ecx, [ebp - 0x70]
sub eax, 0x32593faf
push eax
call fcn.100025a0
push eax
call esi
test eax, eax
jne 0x100074ae
mov eax, str.S_Kxnz_pg_wHDF
lea ecx, [ebp - 0x80]
sub eax, 0x43f2140e
push eax
call fcn.100022c0
push eax
call esi
test eax, eax
jne 0x100074ae
xor al, al
jmp 0x100074b0
mov al, 1
test al, al
jne 0x100075ba
mov edx, 6
xor ecx, ecx
nop
mov al, byte [ecx + str.UHN__JHRByr_gzpcDNsuxrilbWQV_HSLXXEB_s_ZWSDdBKPRLZ2]
xor al, dl
mov byte [ebp + ecx - 0x60], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x3b
jb 0x100074c0
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x84]
push eax
push 0xf003f
push 0
lea eax, [ebp - 0x60]
mov byte [ebp - 0x25], 0
push eax
push connect
call esi
test eax, eax
jne 0x1000753b
push 4
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x88]
push eax
push 4
push 0
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x75526f4e
push eax
push dword [ebp - 0x84]
mov word [ebp - 8], 0x6e
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x84]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, 0xa1
xor ecx, ecx
mov al, byte [ecx + 0x1003cf48]
xor al, dl
mov byte [ebp + ecx - 0x50], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x2a
jb 0x10007542
lea eax, [ebp - 0x8c]
mov byte [ebp - 0x26], 0
push eax
push 0xf003f
push 0
lea eax, [ebp - 0x50]
push eax
push connect
call esi
test eax, eax
jne 0x100075ba
mov dword [ebp - 0x88], eax
lea ecx, [ebp - 0x10]
mov eax, 0x1003cf74
sub eax, 0x38d41ae2
push eax
call fcn.10002d50
push 4
lea ecx, [ebp - 0x88]
push ecx
push 4
push 0
push eax
push dword [ebp - 0x84]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x8c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1001bbbf
mov esp, ebp
pop ebp
ret
Function at 0x100075d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
xor eax, eax
test esi, esi
jle 0x10007601
push edi
mov edi, dword [ebp + 8]
mov dl, byte [eax + edi]
mov cl, byte [0x1014ac8d]
sub dl, 0xf
add dl, byte [0x1014ac8e]
add cl, 0xf
xor dl, cl
mov byte [eax + edi], dl
inc eax
cmp eax, esi
jl 0x100075e1
pop edi
pop esi
pop ebp
ret

Function at 0x10007670
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x10149be4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push 0x1003cab4
push eax
lea eax, [ebp - 0x408]
mov dword [ebp - 0x40c], ecx
push eax
or ebx, 0xffffffff
mov dword [ebp - 0x408], 0
call fcn.10021826
add esp, 0xc
test eax, eax
je 0x100076c7
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001bbbf
mov esp, ebp
pop ebp
ret 4
push esi
push edi
nop dword [eax]
push dword [ebp - 0x408]
lea eax, [ebp - 0x404]
push 0x400
push 1
push eax
call fcn.10024544
mov edi, eax
lea esi, [ebp - 0x404]
add esp, 0x10
mov dword [ebp - 0x410], edi
mov edx, edi
test edi, edi
je 0x10007722
mov edi, dword [ebp - 0x40c]
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [edi + ecx*4]
sub edx, 1
jne 0x10007706
mov edi, dword [ebp - 0x410]
cmp edi, 0x400
je 0x100076d0
push dword [ebp - 0x408]
call fcn.10023e4b
mov ecx, dword [ebp - 4]
add esp, 4
not ebx
xor ecx, ebp
mov eax, ebx
pop edi
pop esi
pop ebx
call fcn.1001bbbf
mov esp, ebp
pop ebp
ret 4
Function at 0x10007750
Capabilities:
Parse pe header
Read file on windows
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x10149be4]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push edi
push 0
push 0
push 3
push 0
push 1
push connect
mov dword [ebp - 0x48], ecx
mov ecx, dword [ebp + 0x10]
push eax
mov dword [ebp - 0x44], ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x100077a3
lea eax, [ebp - 0x38]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x100077b6
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001bbbf
mov esp, ebp
pop ebp
ret 0xc
push ebx
push 0
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebx, eax
test ebx, ebx
jne 0x100077eb
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001bbbf
mov esp, ebp
pop ebp
ret 0xc
push esi
push dword [ebp - 0x14]
push 0
push 0
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
je 0x1000786b
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x10007864
mov eax, dword [esi + 0x3c]
add eax, esi
mov dword [ebp - 0x3c], eax
cmp dword [eax], 0x4550
jne 0x10007864
movzx ecx, word [eax + 4]
mov edx, 0x14c
cmp cx, dx
je 0x10007834
mov edx, 0x8664
cmp cx, dx
jne 0x10007864
push dword [eax + 0x28]
push dword [eax + 0x34]
push eax
call dword [sym.imp.dbghelp.dll_ImageRvaToSection]
mov ecx, eax
test ecx, ecx
je 0x10007864
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
mov ecx, dword [ebp - 0x3c]
push 0
push 0
add eax, dword [ecx + 0x28]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x1000788c
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call esi
push edi
call esi
pop esi
pop ebx
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001bbbf
mov esp, ebp
pop ebp
ret 0xc
push 0
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0
push eax
push 0x20
push dword [ebp - 0x44]
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
test eax, eax
je 0x10007865
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ecx + 0x28]
add eax, dword [ecx + 0x34]
mov ecx, dword [ebp - 0x48]
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call esi
push edi
call esi
mov ecx, dword [ebp - 4]
mov al, 1
pop esi
pop ebx
xor ecx, ebp
pop edi
call fcn.1001bbbf
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10008f50
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x294
mov eax, dword [0x10149be4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x294]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0xff
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1001bbbf
mov esp, ebp
pop ebp
ret
Function at 0x100096b0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003973b
mov eax, dword fs:[0]
push eax
sub esp, 0xc28
mov eax, dword [0x10149be4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xc30], 0
mov dword [ebp - 0xc2c], 0
mov dword [ebp - 0xc28], 0
lea eax, [ebp - 0xc30]
mov dword [ebp - 4], 0
push eax
push dword [ebp + 8]
call fcn.100079f0
add esp, 8
mov word [ebp - 0xc24], 0xac2
mov byte [ebp - 0xc22], 0xc
call fcn.10021244
and eax, 0x800000ff
jns 0x10009738
dec eax
or eax, 0xffffff00
inc eax
mov ebx, dword [ebp - 0xc30]
xor edi, edi
mov byte [ebp - 0xc21], al
mov eax, dword [ebp - 0xc2c]
sub eax, ebx
mov byte [ebp - 0xc20], 0x21
sar eax, 2
mov dword [ebp - 0xc34], eax
mov dword [ebp - 0xc1c], eax
test eax, eax
je 0x10009818
lea esi, [ebp - 0x718]
cmp edi, 0x14
jge 0x10009818
push 0x104
lea eax, [ebp - 0x114]
push eax
push dword [ebx + edi*4]
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0x104
lea eax, [ebp - 0x218]
push eax
push dword [ebx + edi*4]
call dword [sym.imp.USER32.dll_GetClassNameA]
movups xmm0, xmmword [ebp - 0x114]
inc edi
movups xmmword [esi - 0x500], xmm0
movups xmm0, xmmword [ebp - 0x104]
movups xmmword [esi - 0x4f0], xmm0
movups xmm0, xmmword [ebp - 0xf4]
movups xmmword [esi - 0x4e0], xmm0
movups xmm0, xmmword [ebp - 0xe4]
movups xmmword [esi - 0x4d0], xmm0
movups xmm0, xmmword [ebp - 0x218]
movups xmmword [esi], xmm0
movups xmm0, xmmword [ebp - 0x208]
movups xmmword [esi + 0x10], xmm0
movups xmm0, xmmword [ebp - 0x1f8]
movups xmmword [esi + 0x20], xmm0
movups xmm0, xmmword [ebp - 0x1e8]
movups xmmword [esi + 0x30], xmm0
add esi, 0x40
cmp edi, dword [ebp - 0xc34]
jb 0x10009772
push 0xa0c
lea eax, [ebp - 0xc24]
mov ecx, 0x10049738
push eax
call fcn.10006fa0
test ebx, ebx
je 0x1000988a
mov eax, dword [ebp - 0xc28]
sub eax, ebx
sar eax, 2
cmp eax, 0x3fffffff
jbe 0x10009849
call fcn.10020f72
shl eax, 2
cmp eax, 0x1000
jb 0x10009881
test bl, 0x1f
je 0x1000985d
call fcn.10020f72
mov eax, dword [ebx - 4]
cmp eax, ebx
jb 0x10009869
call fcn.10020f72
sub ebx, eax
cmp ebx, 4
jae 0x10009875
call fcn.10020f72
cmp ebx, 0x23
jbe 0x1000987f
call fcn.10020f72
mov ebx, eax
push ebx
call fcn.1001b410
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001bbbf
mov esp, ebp
pop ebp
ret 4
Function at 0x1000a3e0
Capabilities:
Create thread
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100397f8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x10149be4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, 0x75
xor ecx, ecx
mov al, byte [ecx + 0x1003d280]
xor al, dl
mov byte [ebp + ecx - 0x34], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x21
jb 0x1000a411
mov byte [ebp - 0x13], 0
lea eax, [ebp - 0x34]
mov dword [ebp - 4], 0
push eax
push 1
push 2
push str._SplashScreen__SplashType:__d__TextSwitch:__d__DisplayText:__s
push 0
call fcn.1000e660
mov eax, dword [0x100493c4]
add esp, 0x14
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
mov edi, dword [sym.imp.USER32.dll_UnregisterClassA]
test eax, eax
je 0x1000a481
push 0
push 0
push 0x10
push eax
call esi
push dword [0x1014ac64]
mov dword [0x100493c4], 0
push dword [0x100493dc]
call edi
mov eax, dword [0x100494ec]
test eax, eax
je 0x1000a4ab
push 0
push 0
push 0x10
push eax
call esi
push dword [0x1014ac64]
mov dword [0x100494ec], 0
push dword [0x10049504]
call edi
mov eax, dword [0x10049614]
test eax, eax
je 0x1000a4d5
push 0
push 0
push 0x10
push eax
call esi
push dword [0x1014ac64]
mov dword [0x10049614], 0
push dword [0x1004962c]
call edi
push 0x2b39c0
lea eax, [ebp - 0x34]
mov ecx, 0x10049610
push eax
push 1
push 0x808080
push dword [0x1014ac64]
push 2
call fcn.10010120
push 0
push 0
push 0x10049610
push 0x1000fef0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push dword [0x10049618]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [0x10049618]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x10049614]
test eax, eax
je 0x1000a55e
push 0
push 0
push 0x10
push eax
call esi
push dword [0x1014ac64]
mov dword [0x10049614], 0
push dword [0x1004962c]
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0
call esi
push eax
call 0x10010440
jmp dword [pe_dos_header]

Function at 0x1000a5a0
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10149be4]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, 0x49
xor eax, eax
nop word [eax + eax]
mov cl, byte [eax + str.:__8__8_q]
xor cl, dl
mov byte [ebp + eax - 0x18], cl
inc eax
lea ecx, [edx + 1]
movzx edx, cl
cmp eax, 0x10
jb 0x1000a5c0
push 0
lea eax, [ebp - 0x18]
mov byte [ebp - 8], 0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call 0x10010440
jmp dword [pe_dos_header]
Function at 0x1000d0e0
Capabilities:
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x10149be4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x194]
mov esi, ecx
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x1000d11f
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001bbbf
mov esp, ebp
pop ebp
ret 4
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x1000d10c
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
mov dword [esi + 8], eax
test eax, eax
je 0x1000d10c
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov dword [esi + 0x100014], eax
xor ecx, ebp
mov al, 1
pop esi
call fcn.1001bbbf
mov esp, ebp
pop ebp
ret 4
Function at 0x1000db20
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov edx, 0x80
xor ecx, ecx
mov dword [ebp - 4], ecx
xor eax, eax
test cl, 1
cmovne eax, edx
shr ecx, 1
test cl, 1
je 0x1000db46
bts eax, 6
shr ecx, 1
test cl, 1
je 0x1000db51
bts eax, 5
shr ecx, 1
test cl, 1
je 0x1000db5c
bts eax, 4
shr ecx, 1
test cl, 1
je 0x1000db67
bts eax, 3
shr ecx, 1
test cl, 1
je 0x1000db72
bts eax, 2
shr ecx, 1
test cl, 1
je 0x1000db7d
bts eax, 1
test cl, 2
je 0x1000db86
bts eax, 0
shl eax, 0x18
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
add eax, eax
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
and edx, 0x80000000
neg edx
lea eax, [ecx + ecx]
sbb edx, edx
and edx, 0x4c11db7
xor edx, eax
mov ecx, edx
and ecx, 0x80000000
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
and edx, 0x80000000
neg edx
lea eax, [ecx + ecx]
sbb edx, edx
and edx, 0x4c11db7
xor edx, eax
mov ecx, edx
and ecx, 0x80000000
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
and edx, 0x80000000
neg edx
lea eax, [ecx + ecx]
sbb edx, edx
and edx, 0x4c11db7
xor edx, eax
mov ecx, edx
and ecx, 0x80000000
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x4c11db7
xor ecx, eax
mov ebx, ecx
and ebx, 0x80000000
neg ebx
lea eax, [ecx + ecx]
sbb ebx, ebx
and ebx, 0x4c11db7
xor ebx, eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [edi + eax*4], ebx
lea esi, [edi + eax*4]
lea ecx, [edx + 1]
nop
test bl, 1
je 0x1000dc5f
mov eax, 0x20
sub eax, ecx
bts edx, eax
inc ecx
shr ebx, 1
cmp ecx, 0x21
jl 0x1000dc50
mov ecx, dword [ebp - 4]
inc ecx
mov dword [esi], edx
mov dword [ebp - 4], ecx
mov edx, 0x80
cmp ecx, 0xff
jle 0x1000db33
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000e410
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push edi
mov edi, dword [ebp + 8]
push eax
push 0x40
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push dword [ebp + 0xc]
push edi
call fcn.1001e7e0
add esp, 0xc
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret