joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001c2d0
Capabilities:
Encode data using base64

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
test esi, esi
je 0x1001c448
mov edx, dword [esp + 0x18]
test edx, edx
je 0x1001c448
mov al, byte [esi]
test al, al
je 0x1001c43b
push ebx
cmp al, 0xa
jne 0x1001c2fc
inc esi
mov al, byte [esi]
mov cl, byte [esi + 1]
mov byte [esp + 0xc], al
mov al, byte [esi + 2]
cmp al, 0x3d
mov byte [esp + 0xd], cl
mov cl, byte [esi + 3]
mov byte [esp + 0xe], al
mov byte [esp + 0xf], cl
je 0x1001c3b2
cmp cl, 0x3d
mov eax, dword [esp + 0xc]
push eax
je 0x1001c3e2
call fcn.1001b490
mov ecx, dword [esp + 0x11]
push ecx
mov byte [esp + 0x14], al
call fcn.1001b490
mov bl, al
mov eax, dword [esp + 0x16]
push eax
call fcn.1001b490
mov ecx, dword [esp + 0x1b]
push ecx
mov byte [esp + 0x1e], al
call fcn.1001b490
mov byte [esp + 0x1f], al
mov al, byte [esp + 0x1c]
shl al, 2
mov cl, bl
shr cl, 4
and cl, 3
or cl, al
mov al, byte [esp + 0x1e]
shr al, 2
and al, 0xf
shl bl, 4
or al, bl
mov byte [esp + 0x19], al
mov al, byte [esp + 0x1f]
mov byte [esp + 0x28], bl
mov bl, byte [esp + 0x1e]
shl bl, 6
and al, 0x3f
mov byte [edx], cl
mov cl, byte [esp + 0x19]
or al, bl
add esp, 0x10
mov byte [edx + 1], cl
mov byte [edx + 2], al
add esi, 4
mov byte [esp + 0x18], bl
add edx, 3
jmp 0x1001c430
cmp cl, 0x3d
jne 0x1001c430
mov eax, dword [esp + 0xc]
push eax
call fcn.1001b490
mov ecx, dword [esp + 0x11]
push ecx
mov bl, al
call fcn.1001b490
shr al, 4
and al, 3
shl bl, 2
or al, bl
add esp, 8
mov byte [edx], al
add esi, 4
inc edx
jmp 0x1001c430
call fcn.1001b490
mov ecx, dword [esp + 0x11]
push ecx
mov bl, al
call fcn.1001b490
mov byte [esp + 0x15], al
mov eax, dword [esp + 0x16]
push eax
call fcn.1001b490
mov cl, byte [esp + 0x19]
shr cl, 4
shl bl, 2
and cl, 3
or cl, bl
mov byte [esp + 0x24], bl
mov bl, byte [esp + 0x19]
shr al, 2
and al, 0xf
shl bl, 4
or al, bl
add esp, 0xc
mov byte [edx], cl
mov byte [edx + 1], al
add esi, 4
add edx, 2
mov al, byte [esi]
test al, al
jne 0x1001c2f7
pop ebx
mov byte [edx], 0
mov eax, 1
pop esi
add esp, 0xc
ret
xor eax, eax
pop esi
add esp, 0xc
ret

Function at 0x1001c580
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x6c
mov eax, dword [0x101b9578]
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x74]
push eax
push ecx
lea edx, [esp + 8]
push edx
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.1001bf50
lea eax, [esp + 0xc]
push eax
call fcn.1001c010
mov ecx, dword [esp + 0x88]
mov eax, dword [esp + 0x10]
add esp, 0x10
test ecx, ecx
je 0x1001c603
mov edx, dword [esp + 4]
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov edx, dword [esp + 8]
mov dword [ecx + 8], edx
mov edx, dword [esp + 0xc]
mov dword [ecx + 0xc], edx
mov ecx, dword [esp + 0x68]
call fcn.1010122d
add esp, 0x6c
ret
Function at 0x1001d080
Capabilities:
Hash data with md5

Disassembly:
push 0xffffffffffffffff
push 0x1015f676
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x480
mov eax, dword [0x101b9578]
push ebx
push edi
lea ecx, [esp + 0xc]
mov dword [esp + 0x484], eax
xor ebx, ebx
xor edi, edi
call fcn.10152f39
mov eax, dword [esp + 0x498]
push ebx
push 0x40
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x49c], ebx
call fcn.101531d1
test eax, eax
je 0x1001d20f
lea ecx, [esp + 0xc]
call fcn.10152e31
cmp edx, ebx
ja 0x1001d0ee
cmp eax, ebx
jbe 0x1001d206
push esi
mov esi, dword [esp + 0x4a4]
cmp esi, ebx
je 0x1001d105
lea ecx, [esp + 0x10]
call fcn.10152e31
mov dword [esi], eax
push 0x400
lea ecx, [esp + 0x8c]
push ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x28], 0x67452301
mov dword [esp + 0x2c], 0xefcdab89
mov dword [esp + 0x30], 0x98badcfe
mov dword [esp + 0x34], 0x10325476
call fcn.10152c4c
cmp eax, ebx
je 0x1001d177
push eax
lea edx, [esp + 0x8c]
push edx
lea eax, [esp + 0x28]
push eax
call fcn.1001bf50
add esp, 0xc
push 0x400
lea ecx, [esp + 0x8c]
push ecx
lea ecx, [esp + 0x18]
call fcn.10152c4c
cmp eax, ebx
jne 0x1001d147
lea edx, [esp + 0x20]
push ebp
push edx
call fcn.1001c010
mov ebp, dword [esp + 0x4a8]
mov eax, dword [ebp]
add esp, 4
cmp eax, ebx
je 0x1001d204
xor edi, edi
call fcn.10152999
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x10], eax
movzx eax, byte [esp + edi + 0x7c]
push eax
lea ecx, [esp + 0x14]
push str._02x
push ecx
mov byte [esp + 0x4a4], 1
call fcn.10001360
mov esi, dword [esp + 0x1c]
mov eax, dword [esi - 0xc]
add esp, 0xc
push eax
push esi
mov ecx, ebp
call fcn.1000e320
lea eax, [esi - 0x10]
mov byte [esp + 0x498], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x1001d1f9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
inc edi
cmp edi, 0x10
jl 0x1001d195
mov edi, 1
pop ebp
pop esi
lea ecx, [esp + 0xc]
call fcn.10152ed7
lea ecx, [esp + 0xc]
mov dword [esp + 0x490], 0xffffffff
call fcn.10152f78
mov ecx, dword [esp + 0x488]
mov eax, edi
pop edi
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x480]
pop ebx
call fcn.1010122d
add esp, 0x48c
ret
Function at 0x1001d370
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x38
mov eax, dword [0x101b9578]
push ebp
push esi
push edi
mov dword [esp + 0x40], eax
mov ebp, ecx
xor eax, eax
mov byte [esp + 0xc], 0
mov ecx, 0xc
lea edi, [esp + 0xd]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp]
stosb byte es:[edi], al
push 0x31
lea eax, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea edx, [esp + 0xc]
push 0x28
push edx
call fcn.10101920
mov esi, eax
lea eax, [esp + 0x14]
push 0x29
push eax
call fcn.10101920
add esp, 0x10
test esi, esi
je 0x1001d41a
test eax, eax
je 0x1001d41a
lea edx, [esp + 0xc]
mov byte [esi], 0
lea edi, [edx + 1]
push ebx
mov bl, byte [edx]
inc edx
test bl, bl
jne 0x1001d3d5
sub edx, edi
cmp edx, 0x40
jae 0x1001d3fa
lea edx, [esp + 0x10]
lea edi, [ebp + 4]
mov ecx, edx
sub edi, ecx
mov edi, edi
mov bl, byte [edx]
mov byte [edi + edx], bl
inc edx
test bl, bl
jne 0x1001d3f0
mov edx, eax
sub edx, esi
cmp edx, 0x10
pop ebx
jge 0x1001d41a
inc esi
mov ecx, eax
sub ecx, esi
mov eax, ecx
shr ecx, 2
lea edi, [ebp + 0x44]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x40]
pop edi
pop esi
pop ebp
call fcn.1010122d
add esp, 0x38
ret
Function at 0x1001e050
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1015f74b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x228
mov eax, dword [0x101b9578]
push ebx
xor ebx, ebx
mov dword [esp + 0x224], eax
mov dword [esp + 8], ebx
cmp dword [ecx], ebx
push esi
push edi
mov dword [esp + 0x14], ecx
jne 0x1001e098
push 0x10167a1b
jmp 0x1001e1e4
xor eax, eax
mov byte [esp + 0x18], bl
mov ecx, 0x40
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
mov esi, dword [sym.imp.USER32.dll_GetWindowTextA]
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x120], bl
mov ecx, 0x40
lea edi, [esp + 0x121]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 0xc]
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x103
lea eax, [esp + 0x1c]
push eax
push ecx
call esi
mov eax, dword [ebp + 0x10]
push 0x103
lea edx, [esp + 0x124]
push edx
push eax
call esi
mov esi, dword [esp + 0x14]
lea ecx, [esp + 0x120]
push ecx
mov ecx, esi
call fcn.1001df00
test eax, eax
jne 0x1001e110
lea edx, [esp + 0x18]
push edx
jmp 0x1001e1e4
lea eax, [esp + 0x18]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1001e117
sub eax, edx
mov dword [esp + 0x10], eax
je 0x1001e1df
cmp dword [ebp + 0x14], ebx
je 0x1001e153
lea eax, [esp + 0x120]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1001e140
sub eax, edx
mov dword [esp + 0x10], eax
je 0x1001e1df
cmp dword [ebp + 0x18], ebx
je 0x1001e197
lea ecx, [esp + 0x18]
push ecx
mov ecx, 0x101c7b20
call fcn.100032a0
lea edx, [esp + 0x120]
push edx
mov ecx, 0x101c7b24
call fcn.100032a0
mov ecx, dword [ebp + 0x1c]
mov eax, dword [esi]
push 0x1001dfb0
push ecx
push 0x2704
push ebx
mov dword [0x101c7b2c], eax
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x1001e1df
mov edx, dword [esi]
push ebx
push edx
lea eax, [esp + 0x128]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x10167a1b
call fcn.10003740
push ecx
lea edx, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x28], esp
push edx
mov dword [esp + 0x254], ebx
call fcn.10003740
mov dword [esp + 0x250], 0xffffffff
call fcn.10051890
add esp, 0x14
lea eax, [esp + 0x18]
push eax
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.10003740
mov ecx, dword [esp + 0x234]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x22c]
mov eax, esi
call fcn.1010122d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x1001e220
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1015f76b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x11c
mov eax, dword [0x101b9578]
push esi
mov esi, ecx
mov dword [esp + 0x118], eax
mov dword [esp + 4], 0
cmp dword [esi], 0
push edi
jne 0x1001e268
push 0x10167a1b
jmp 0x1001e362
xor eax, eax
mov byte [esp + 0x10], 0
mov ecx, 0x40
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 0xc]
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x103
lea eax, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov edi, dword [ebp + 0x10]
push edi
mov ecx, esi
call fcn.1001df00
test eax, eax
jne 0x1001e2aa
lea edx, [esp + 0x10]
push edx
jmp 0x1001e362
lea eax, [esp + 0x10]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001e2b1
sub eax, edx
mov dword [esp + 8], eax
je 0x1001e35d
push edi
lea eax, [esp + 0x14]
push eax
push str.:_s_:_s
push 2
call fcn.1001b560
mov eax, dword [ebp + 0x14]
add esp, 0x10
test eax, eax
je 0x1001e31a
lea ecx, [esp + 0x10]
push ecx
mov ecx, 0x101c7b20
call fcn.100032a0
push edi
mov ecx, 0x101c7b24
call fcn.100032a0
mov eax, dword [ebp + 0x18]
mov edx, dword [esi]
push 0x1001dfb0
push eax
push 0x2704
push 0
mov dword [0x101c7b2c], edx
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x1001e35d
mov ecx, dword [esi]
push 0
push ecx
push edi
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push 0
call fcn.10003740
push ecx
lea edx, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
mov dword [esp + 0x144], 0
call fcn.10003740
mov dword [esp + 0x140], 0xffffffff
call fcn.10051890
add esp, 0x14
lea eax, [esp + 0x10]
push eax
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.10003740
mov ecx, dword [esp + 0x124]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x11c]
mov eax, esi
call fcn.1010122d
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x14

Function at 0x1001ec20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1015f7d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x1c]
mov eax, dword [esi]
mov ecx, dword [eax - 0x10]
mov edx, dword [ecx]
push edi
xor edi, edi
mov dword [esp + 8], edi
call dword [edx + 0x10]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax]
mov edx, dword [eax - 0xc]
mov ecx, dword [esi]
mov esi, dword [ecx - 0xc]
push edx
push eax
push esi
push ecx
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x28], edi
call fcn.10010c50
mov esi, dword [esp + 0x34]
add esi, 0xfffffff0
push esi
call fcn.10001cd0
mov edi, dword [esp + 0x34]
add eax, 0x10
mov dword [edi], eax
add esp, 0x18
mov dword [esp + 0x14], 0xffffffff
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x1001ecb2
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov ecx, dword [esp + 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x1003eef0
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov esi, ecx
call fcn.10152999
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
add eax, 0x10
mov dword [esi], eax
xor eax, eax
push 0x14
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x1c], eax
call edi
push 0x90
and eax, 1
mov dword [esi + 4], eax
call edi
pop edi
and eax, 1
mov dword [esi + 8], eax
mov eax, esi
pop esi
ret

Function at 0x1003ef40
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov esi, ecx
call fcn.10152999
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
add eax, 0x10
mov dword [esi], eax
mov eax, dword [esp + 0xc]
mov dword [esi + 0x20], eax
xor eax, eax
push 0x14
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x24], edx
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
call edi
push 0x90
and eax, 1
mov dword [esi + 4], eax
call edi
pop edi
and eax, 1
mov dword [esi + 8], eax
mov eax, esi
pop esi
ret 0xc

Function at 0x1003efc0
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
cmp edi, 0xd
mov esi, ecx
je 0x1003f030
cmp edi, 0x6c
je 0x1003f030
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and eax, 1
cmp edi, 0x14
mov dword [esi + 0xc], eax
jne 0x1003effa
mov ecx, dword [esi + 4]
xor eax, eax
test ecx, ecx
sete al
pop edi
mov dword [esi + 4], eax
pop esi
ret 4
cmp edi, 0x90
jne 0x1003f014
mov eax, dword [esi + 8]
xor ecx, ecx
test eax, eax
sete cl
pop edi
mov dword [esi + 8], ecx
pop esi
ret 4
cmp edi, 0x25
je 0x1003f025
cmp edi, 0x64
jne 0x1003f035
mov eax, dword [esi + 8]
test eax, eax
jne 0x1003f030
mov eax, dword [esi + 0x10]
test eax, eax
jle 0x1003f030
dec eax
mov dword [esi + 0x10], eax
pop edi
pop esi
ret 4
cmp edi, 0x27
je 0x1003f046
cmp edi, 0x66
jne 0x1003f060
mov eax, dword [esi + 8]
test eax, eax
jne 0x1003f030
mov edi, dword [esi + 0x10]
mov eax, dword [esi]
inc edi
mov dword [esi + 0x10], edi
mov eax, dword [eax - 0xc]
mov ecx, edi
cmp ecx, eax
jle 0x1003f030
pop edi
mov dword [esi + 0x10], eax
pop esi
ret 4
cmp edi, 8
jne 0x1003f083
mov eax, dword [esi + 0x10]
test eax, eax
jle 0x1003f030
push 1
dec eax
push eax
mov ecx, esi
call fcn.1000dac0
mov eax, dword [esi + 0x10]
dec eax
pop edi
mov dword [esi + 0x10], eax
pop esi
ret 4
cmp edi, 0x2e
jne 0x1003f030
mov edx, dword [esi + 0x10]
push 1
push edx
mov ecx, esi
call fcn.1000dac0
pop edi
pop esi
ret 4
Function at 0x1003f150
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, dword [esp + 8]
cmp ebx, 0xd
push esi
mov esi, ecx
je 0x1003f1c4
cmp ebx, 0x6c
je 0x1003f1c4
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and eax, 1
cmp ebx, 0x14
mov dword [esi + 0xc], eax
jne 0x1003f18a
mov ecx, dword [esi + 4]
xor eax, eax
test ecx, ecx
sete al
mov dword [esi + 4], eax
pop esi
pop ebx
ret 4
cmp ebx, 0x90
jne 0x1003f1a4
mov eax, dword [esi + 8]
xor ecx, ecx
test eax, eax
sete cl
mov dword [esi + 8], ecx
pop esi
pop ebx
ret 4
cmp ebx, 0x25
je 0x1003f1b9
cmp ebx, 0x64
jne 0x1003f1c9
mov eax, dword [esi + 8]
test eax, eax
jne 0x1003f275
mov eax, dword [esi + 0x10]
test eax, eax
jle 0x1003f1c4
dec eax
mov dword [esi + 0x10], eax
pop esi
pop ebx
ret 4
cmp ebx, 0x27
je 0x1003f1de
cmp ebx, 0x66
jne 0x1003f1f8
mov eax, dword [esi + 8]
test eax, eax
jne 0x1003f275
mov ebx, dword [esi + 0x10]
mov eax, dword [esi]
inc ebx
mov dword [esi + 0x10], ebx
mov eax, dword [eax - 0xc]
mov ecx, ebx
cmp ecx, eax
jle 0x1003f1c4
mov dword [esi + 0x10], eax
pop esi
pop ebx
ret 4
cmp ebx, 8
jne 0x1003f21b
mov eax, dword [esi + 0x10]
test eax, eax
jle 0x1003f1c4
push 1
dec eax
push eax
mov ecx, esi
call fcn.1000dac0
mov eax, dword [esi + 0x10]
dec eax
mov dword [esi + 0x10], eax
pop esi
pop ebx
ret 4
cmp ebx, 0x2e
jne 0x1003f232
mov edx, dword [esi + 0x10]
push 1
push edx
mov ecx, esi
call fcn.1000dac0
pop esi
pop ebx
ret 4
cmp ebx, 0x40
jbe 0x1003f255
cmp ebx, 0x5b
jae 0x1003f255
cmp eax, dword [esi + 4]
mov byte [esp + 0xc], bl
jne 0x1003f2d8
add bl, 0x20
mov byte [esp + 0xc], bl
jmp 0x1003f2d8
cmp ebx, 0x2f
jbe 0x1003f26b
cmp ebx, 0x3a
jae 0x1003f26b
test eax, eax
je 0x1003f24c
mov dl, byte [ebx + str.password]
jmp 0x1003f2d4
cmp ebx, 0x5f
jbe 0x1003f2a8
cmp ebx, 0x70
jae 0x1003f2a8
sub ebx, 0x60
cmp ebx, 0xa
jae 0x1003f288
mov eax, dword [esi + 8]
test eax, eax
je 0x1003f1c4
mov eax, dword [esi + 0x10]
xor edx, edx
mov dl, byte [ebx + str.0123456789_n_._]
mov ecx, esi
push edx
push eax
call fcn.1003f0d0
mov eax, dword [esi + 0x10]
inc eax
mov dword [esi + 0x10], eax
pop esi
pop ebx
ret 4
cmp ebx, 0xb9
jbe 0x1003f2f4
cmp ebx, 0xc1
jae 0x1003f2f4
sub ebx, 0xba
test eax, eax
je 0x1003f2ce
mov cl, byte [ebx + str.:____]
mov byte [esp + 0xc], cl
jmp 0x1003f2d8
mov dl, byte [ebx + str.___.__]
mov byte [esp + 0xc], dl
mov eax, dword [esp + 0xc]
mov ecx, dword [esi + 0x10]
push eax
push ecx
mov ecx, esi
call fcn.1003f0d0
mov eax, dword [esi + 0x10]
inc eax
mov dword [esi + 0x10], eax
pop esi
pop ebx
ret 4
cmp ebx, 0xda
jbe 0x1003f1c4
cmp ebx, 0xdf
jae 0x1003f1c4
sub ebx, 0xdb
test eax, eax
je 0x1003f322
mov dl, byte [ebx + 0x101b23cc]
mov byte [esp + 0xc], dl
jmp 0x1003f32c
mov al, byte [ebx + 0x101b23c4]
mov byte [esp + 0xc], al
mov ecx, dword [esp + 0xc]
mov edx, dword [esi + 0x10]
push ecx
push edx
mov ecx, esi
call fcn.1003f0d0
mov eax, dword [esi + 0x10]
inc eax
mov dword [esi + 0x10], eax
pop esi
pop ebx
ret 4
Function at 0x1003f560
Capabilities:
Read file on windows

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
mov ecx, dword [ecx + 0x104]
push 0
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 0x10]
push edx
push eax
push ecx
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp]
neg eax
sbb eax, eax
and eax, ecx
pop ecx
ret 8

Function at 0x1003f5a0
Capabilities:
Write file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
test eax, eax
push edi
mov edi, dword [esp + 0xc]
mov dword [esp + 4], 0
jne 0x1003f5ca
mov eax, edi
push esi
lea esi, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1003f5c0
sub eax, esi
pop esi
push 0
lea edx, [esp + 8]
push edx
push eax
mov eax, dword [ecx + 0x104]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 4]
neg eax
sbb eax, eax
and eax, ecx
pop edi
pop ecx
ret 8
Function at 0x10042fb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10162118
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x1c]
mov eax, dword [esi]
mov ecx, dword [eax - 0x10]
mov edx, dword [ecx]
push edi
xor edi, edi
mov dword [esp + 8], edi
call dword [edx + 0x10]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x20], eax
mov al, byte [esp + 0x24]
mov byte [esp + 0x24], al
mov eax, dword [esi]
mov ecx, dword [eax - 0xc]
push 1
lea edx, [esp + 0x28]
push edx
push ecx
push eax
lea eax, [esp + 0x30]
push eax
mov dword [esp + 0x28], edi
call fcn.10010c50
mov esi, dword [esp + 0x34]
add esi, 0xfffffff0
push esi
call fcn.10001cd0
mov edi, dword [esp + 0x34]
add eax, 0x10
add esp, 0x18
mov dword [edi], eax
mov dword [esp + 0x14], 0xffffffff
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10043046
mov ecx, dword [esi]
mov eax, dword [ecx]
push esi
call dword [eax + 4]
mov ecx, dword [esp + 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x1004a540
Capabilities:
Set socket configuration

Disassembly:
push ecx
mov eax, dword [0x101c7f04]
test eax, eax
mov dword [0x101c8070], 0
je 0x1004a583
lea ecx, [esp]
push ecx
push 0x98000001
push eax
mov dword [esp + 0xc], 0
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov edx, dword [0x101c7f04]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [0x101c7f04], 0
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 1
pop ecx
ret

Function at 0x1004a7c0
Capabilities:
Create raw socket
Create udp socket
Get hostname
Initialize winsock library
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2b4
mov eax, dword [0x101b9578]
push ebx
push esi
mov dword [esp + 0x2b8], eax
push edi
lea eax, [esp + 0x128]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp eax, 0xffffffff
je 0x1004a8eb
mov byte [esp + 0x20], 0
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 0x21]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea ecx, [esp + 0x24]
push ecx
stosb byte es:[edi], al
call dword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
je 0x1004a8eb
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
test esi, esi
je 0x1004a8eb
mov ebx, dword [sym.imp.WS2_32.dll_htons]
push 0
call ebx
movzx eax, ax
push eax
push 3
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [0x101c7f04], eax
je 0x1004a8eb
mov word [esp + 0x10], 2
movsx ecx, word [esi + 0xa]
mov edx, dword [esi + 0xc]
mov esi, dword [edx]
mov eax, ecx
shr ecx, 2
lea edi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
call ebx
mov edx, dword [0x101c7f04]
push 0x10
lea ecx, [esp + 0x14]
push ecx
push edx
mov word [esp + 0x1e], ax
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x1004a8df
mov edx, dword [0x101c7f04]
lea ecx, [esp + 0xc]
push ecx
push 0x98000001
mov esi, 1
push edx
mov dword [esp + 0x18], esi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x1004a900
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ioctlsocket_error__d_
push 4
call fcn.1008a780
add esp, 0xc
mov eax, dword [0x101c7f04]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
mov ecx, dword [esp + 0x2bc]
call fcn.1010122d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0x1004a730
push 0
push 0
mov dword [0x101c8070], esi
call fcn.101021ba
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x2bc]
mov eax, esi
call fcn.1010122d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1004a9f0
Capabilities:
Create tcp socket
Create udp socket
Initialize winsock library
Send data
Send data on socket

Disassembly:
sub esp, 0x1a4
mov eax, dword [0x101b9578]
mov dword [esp + 0x1a0], eax
lea eax, [esp + 0x10]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp eax, 0xffffffff
jne 0x1004aa42
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.WSAStartup_error__d_
push 4
call fcn.1008a780
add esp, 0xc
xor eax, eax
mov ecx, dword [esp + 0x1a0]
call fcn.1010122d
add esp, 0x1a4
ret
push edi
mov edi, dword [esp + 0x1b4]
mov eax, edi
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1004aa50
sub eax, edx
cmp eax, 4
jae 0x1004aa74
xor eax, eax
pop edi
mov ecx, dword [esp + 0x1a0]
call fcn.1010122d
add esp, 0x1a4
ret
push esi
push 1
push 0
push 0
push 0
push 2
push 2
call dword [sym.imp.WS2_32.dll_WSASocketA]
push edi
mov esi, eax
mov word [esp + 0xc], 2
call dword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, dword [esp + 0x1bc]
push ecx
mov dword [esp + 0x10], eax
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [esp + 0x1b0]
push 0x10
lea edx, [esp + 0xc]
push edx
push 0
mov word [esp + 0x16], ax
mov eax, dword [esp + 0x1c0]
push eax
push ecx
push esi
call dword [sym.imp.WS2_32.dll_sendto]
cmp eax, 0xffffffff
push esi
jne 0x1004aaf1
call dword [sym.imp.WS2_32.dll_closesocket]
pop esi
xor eax, eax
pop edi
mov ecx, dword [esp + 0x1a0]
call fcn.1010122d
add esp, 0x1a4
ret
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x1a8]
pop esi
mov eax, 1
pop edi
call fcn.1010122d
add esp, 0x1a4
ret