joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4025fd
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x447008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
or dword [ebp - 8], 0xffffffff
push ebx
mov ebx, ecx
mov dword [ebp - 0xc], 0x4000
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x18], ebx
push ecx
push eax
push 0
push 0
push 2
call dword [sym.imp.MPR.dll_WNetOpenEnumW]
test eax, eax
jne 0x402721
push esi
push dword [ebp - 0xc]
call fcn.00425390
mov esi, eax
pop ecx
test esi, esi
je 0x402717
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.MPR.dll_WNetEnumResourceW]
test eax, eax
jne 0x402710
push edi
and dword [ebp - 0x1c], 0
cmp dword [ebp - 8], 0
jle 0x4026ea
lea edi, [esi + 0x14]
test dword [edi - 8], 2
je 0x40269d
lea eax, [edi - 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx]
mov ecx, dword [eax + 0x24]
test ecx, ecx
je 0x402730
mov eax, dword [ecx]
lea edx, [ebp - 0x14]
push edx
call dword [eax + 8]
jmp 0x4026db
push 0x208
call fcn.00425390
mov ebx, eax
pop ecx
test ebx, ebx
je 0x4026d8
push dword [edi]
push str.__s
push 0x104
push ebx
call fcn.00401714
mov edx, dword [ebp - 0x18]
mov ecx, ebx
mov edx, dword [edx + 4]
mov edx, dword [edx]
call fcn.004023e1
push ebx
call fcn.00425375
add esp, 0x14
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
add edi, 0x20
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, dword [ebp - 8]
jl 0x402676
or dword [ebp - 8], 0xffffffff
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 0x4000
push eax
push dword [ebp - 0x10]
call dword [sym.imp.MPR.dll_WNetEnumResourceW]
test eax, eax
je 0x402669
pop edi
push esi
call fcn.00425375
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.MPR.dll_WNetCloseEnum]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0040328f
leave
ret 4
call fcn.00403f4c
int3

Function at 0x42b10a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042ad87
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ed0
nop
nop
mov ecx, 0x603a387e
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x19987744
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x430002
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
mov eax, section..idata
nop
nop
mov ebx, 0x408ecc
mov ecx, 0x71887122
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x405a06e3
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x10003cc0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x10005840
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
lea eax, [ebp - 0x30]
push 8
push 0x100386a0
push eax
call fcn.1000f7a0
add esp, 0xc
mov eax, dword [ebp - 0x30]
cmp eax, 0x80000000
jne 0x10003d3d
movsd xmm0, qword [ebp - 0x2c]
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x3c]
movsd qword [ebp - 0x3c], xmm0
push 0x100386a8
push 0x100383c8
push eax
push 0x2b
push 0x100383d8
call fcn.10037910
add esp, 0x14
jmp 0x10003e2a
mov ebx, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x28]
mov dword [ebp - 0x44], eax
push 0x40
push 0x1000
push edi
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
mov esi, eax
push edi
mov dword [ebp - 0x40], ebx
push ebx
push eax
call fcn.10029590
add esp, 0xc
mov dword [ebp - 0x28], 0x80000000
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x10], 1
lea eax, [ebp - 0x3c]
push esi
lea ecx, [ebp - 0x30]
push ecx
push eax
call fcn.100018d0
add esp, 0xc
cmp dword [ebp - 0x3c], 0
jne 0x10003dc2
movsd xmm0, qword [ebp - 0x38]
mov dword [ebp - 0x10], 3
movsd qword [ebp - 0x30], xmm0
push 0x10038670
push 0x100383c8
lea eax, [ebp - 0x30]
push eax
push 0x16
push 0x1003860c
call fcn.10037910
add esp, 0x14
jmp 0x10003e2a
mov eax, dword [ebp - 0x34]
movsd xmm0, qword [ebp - 0x3c]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x30]
movsd qword [ebp - 0x30], xmm0
push eax
call section..text
add esp, 4
test eax, eax
jne 0x10003e00
nop word cs:[eax + eax]
nop dword [eax]
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
call fcn.1000ed20
add esp, 0xc
jmp 0x10003df0
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x10], 2
push 0x100386b8
push 0x10038404
lea eax, [ebp - 0x30]
push eax
push 0x2b
push 0x100383d8
call fcn.10037910
add esp, 0x14
ud2
Function at 0x1000c1d0
Capabilities:
Get system information on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
xorps xmm0, xmm0
call 0x1000c1df
pop edi
lea eax, [esp + 0x18]
mov dword [esp + 0x38], 0
movups xmmword [esp + 0x28], xmm0
movups xmmword [esp + 0x18], xmm0
push eax
call sub.kernel32.dll_GetSystemInfo
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x1000c27f
mov ecx, dword [esp + 0x54]
xor edx, edx
mov ebx, dword [esp + 0x5c]
mov ebp, dword [esp + 0x50]
mov eax, ecx
div esi
lea eax, [esi + ecx]
sub eax, edx
test edx, edx
cmove eax, ecx
test eax, eax
cmove eax, esi
test ebx, ebx
mov dword [esp + 4], eax
je 0x1000c267
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x10], 0
mov dword [esp], 0
mov dword [esp + 8], 0
xor edx, edx
mov dword [esp + 0xc], 0
mov eax, dword [ecx]
lea ebp, [ecx + ebx*8]
mov ebx, dword [ecx + 4]
mov esi, dword [eax*4 + 0x1000c434]
xor eax, eax
add esi, edi
jmp esi
mov ebx, dword [esp + 4]
xor ecx, ecx
xor edx, edx
xor esi, esi
mov dword [esp + 8], 0
test dl, dl
je 0x1000c289
jmp 0x1000c296
push 0x1003da44
call fcn.10037b90
mov eax, 1
test cl, cl
je 0x1000c3ad
mov dword [ebp + 4], 7
jmp 0x1000c422
test esi, esi
je 0x1000c3ba
mov dword [ebp + 4], 8
jmp 0x1000c422
push eax
push 0x3000
push ebx
push dword [esp + 0x14]
call sub.kernel32.dll_VirtualAlloc
test eax, eax
je 0x1000c3d7
mov dword [ebp], 1
jmp 0x1000c40b
call fcn.10017660
mov dword [ebp + 4], 0xa
jmp 0x1000c41f
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], ebx
jmp 0x1000c429
mov dword [ebp + 8], eax
mov dword [ebp], 2
mov eax, ebp
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1000f190
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x438
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x1001a3b0
mov edi, 0x200
lea eax, [ebp - 0x18]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x2c], 2
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x20], 0
cmp edi, 0x201
jae 0x1000f220
jmp 0x1000f20e
jbe 0x1000f2a6
cmp edi, 0x201
jae 0x1000f220
mov dword [ebp - 0x30], 0x200
lea ebx, [ebp - 0x444]
mov esi, edi
jmp 0x1000f251
mov esi, dword [ebp - 0x34]
sub edi, esi
je 0x1000f245
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x28]
mov edx, esi
push edi
call fcn.100368b0
add esp, 4
mov esi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov ebx, dword [ebp - 0x2c]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x34], esi
push 0
call dword [sym.imp.kernel32.dll_SetLastError]
push ebx
push esi
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov edi, eax
test eax, eax
jne 0x1000f275
call dword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x1000f309
cmp edi, esi
jne 0x1000f200
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1000f328
lea edi, [esi + esi]
test esi, esi
mov eax, 0xffffffff
cmovs edi, eax
cmp edi, 0x201
jb 0x1000f20e
jmp 0x1000f220
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x10], 0
cmp edi, eax
ja 0x1000f345
lea eax, [ebp - 0x44]
push edi
push ebx
push eax
call fcn.10012710
add esp, 0xc
movsd xmm0, qword [ebp - 0x44]
mov esi, dword [ebp + 8]
movsd xmm1, qword [ebp - 0x3c]
movsd qword [esi + 8], xmm1
movsd qword [esi], xmm0
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x1000f2f3
add eax, eax
push 2
push eax
push dword [ebp - 0x24]
call fcn.100063d0
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x438
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, dword [ebp + 8]
mov byte [esi + 4], 0
mov dword [esi + 8], eax
mov dword [esi], 0x80000000
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x1000f2e3
jmp 0x1000f2f3
mov dword [ebp - 0x10], 0
push 0x1003f8e4
push 0x28
push str.internal_error:_entered_unreachable_code_rustc_d9284afea99e0969a0e692b9e9fd61ea4ba21366library_alloc_src_vecmod.rs
call fcn.100376d0
add esp, 0xc
jmp 0x1000f354
push 0x1003f8d4
push eax
push edi
call fcn.100379e0
add esp, 0xc
ud2
Function at 0x10012f50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov dword [ebp - 0x14], ecx
mov ecx, edx
mov edi, edx
call fcn.100129c0
mov ecx, dword [edi + 4]
cmp eax, ecx
ja 0x1001306b
mov edx, dword [edi]
mov ebx, edx
lea esi, [edx + eax]
movzx edx, byte [edi + 8]
mov edi, eax
sub edi, ecx
mov byte [ebp - 0xd], dl
jne 0x10012f97
mov ebx, dword [ebp - 0x14]
xor edi, edi
movzx edx, byte [ebp - 0xd]
sub ecx, eax
jne 0x10013013
jmp 0x10012ff1
cmp dl, 3
mov dword [ebp - 0x18], esi
jae 0x10012fbf
mov edx, ebx
lea esi, [ecx + ebx - 1]
mov ebx, dword [ebp - 0x14]
mov edi, eax
sub edi, ecx
nop dword [eax]
cmp byte [esi], 0x5c
je 0x10013055
dec esi
inc edi
jne 0x10012fb0
jmp 0x10012fe4
mov edx, ebx
lea esi, [ecx + ebx - 1]
nop word cs:[eax + eax]
nop
movzx ebx, byte [esi]
cmp ebx, 0x2f
je 0x10012ff5
cmp ebx, 0x5c
je 0x10012ff5
dec esi
inc edi
jne 0x10012fd0
mov ebx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
xor edi, edi
movzx edx, byte [ebp - 0xd]
sub ecx, eax
jne 0x10013013
mov al, 0xa
jmp 0x10013040
mov ebx, dword [ebp - 0x14]
not edi
lea eax, [eax + edi + 1]
cmp eax, ecx
ja 0x1001305f
add edx, eax
mov edi, 1
mov esi, edx
movzx edx, byte [ebp - 0xd]
sub ecx, eax
je 0x10012ff1
mov al, 9
cmp ecx, 2
je 0x10013032
cmp ecx, 1
jne 0x10013040
cmp byte [esi], 0x2e
jne 0x10013040
xor eax, eax
cmp dl, 3
setae al
lea eax, [eax + eax*2 + 7]
jmp 0x10013040
cmp byte [esi], 0x2e
jne 0x10013040
cmp byte [esi + 1], 0x2e
sete al
xor al, 9
add edi, ecx
mov dword [ebx], edi
mov byte [ebx + 4], al
mov dword [ebx + 8], esi
mov dword [ebx + 0xc], ecx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
not edi
lea eax, [eax + edi + 1]
cmp eax, ecx
jbe 0x10013002
push 0x1003eaa4
push ecx
push eax
call fcn.10037980
push 0x1003ea94
push ecx
push eax
call fcn.10037980
int3
Function at 0x10017370
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, ecx
mov ecx, dword [ebp + 0xc]
cmp dword [ebp + 0x10], 0
mov edi, edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x103
je 0x100173b4
mov eax, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0x18]
lea edx, [esp + 0x20]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], eax
xor eax, eax
mov ebx, 1
jmp 0x100173ba
xor ebx, ebx
xor eax, eax
xor edx, edx
mov dword [esp + 0x1c], eax
lea eax, [esp + 8]
mov dword [esp + 0x18], ebx
push 0
push edx
push ecx
push dword [ebp + 8]
push eax
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x100173ef
push 0xffffffffffffffff
push edi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [esp + 8]
cmp eax, 0xc0000011
jne 0x100173ff
mov dword [esi + 4], 0
jmp 0x10017411
cmp eax, 0x103
je 0x1001742b
test eax, eax
js 0x1001741c
mov eax, dword [esp + 0xc]
mov dword [esi + 4], eax
mov byte [esi], 4
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov byte [esi], 0
mov dword [esi + 4], eax
jmp 0x10017414
lea eax, [esp + 4]
mov dword [esp + 0x18], 0x1003f45c
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
lea ecx, [esp + 0x10]
lea esi, [esp + 0x34]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x24], 0
push eax
push ecx
push esi
call fcn.10011cb0
add esp, 0xc
mov ecx, esi
call fcn.1000dd10
mov ecx, 7
int 0x29
ud2

Function at 0x10017490
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, ecx
mov ecx, dword [ebp + 0xc]
cmp dword [ebp + 0x10], 0
mov edi, edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x103
je 0x100174d4
mov eax, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0x18]
lea edx, [esp + 0x20]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], eax
xor eax, eax
mov ebx, 1
jmp 0x100174da
xor ebx, ebx
xor eax, eax
xor edx, edx
mov dword [esp + 0x1c], eax
lea eax, [esp + 8]
mov dword [esp + 0x18], ebx
push 0
push edx
push ecx
push dword [ebp + 8]
push eax
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x10017516
push 0xffffffffffffffff
push edi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [esp + 8]
cmp eax, 0x103
je 0x10017538
test eax, eax
js 0x10017522
mov eax, dword [esp + 0xc]
mov bl, 4
jmp 0x1001752b
xor ebx, ebx
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [esi + 4], eax
mov byte [esi], bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [esp + 4]
mov dword [esp + 0x18], 0x1003f45c
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
lea ecx, [esp + 0x10]
lea esi, [esp + 0x34]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x24], 0
push eax
push ecx
push esi
call fcn.10011cb0
add esp, 0xc
mov ecx, esi
call fcn.1000dd10
mov ecx, 7
int 0x29
ud2
Function at 0x100175a0
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov ebx, 0x17
cmp word [eax], 0
mov eax, 2
cmove ebx, eax
push 0x81
push 0
push 0
push 0
push edi
push ebx
call dword [sym.imp.ws2_32.dll_WSASocketW]
cmp eax, 0xffffffff
je 0x100175e5
mov dword [esi + 4], eax
mov byte [esi], 4
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x2726
je 0x100175f9
cmp eax, 0x2739
jne 0x10017624
push 1
push 0
push 0
push 0
push edi
push ebx
call dword [sym.imp.ws2_32.dll_WSASocketW]
cmp eax, 0xffffffff
je 0x1001762c
mov edi, eax
push 0
push 1
push eax
call dword [sym.imp.kernel32.dll_SetHandleInformation]
test eax, eax
je 0x1001763d
mov dword [esi + 4], edi
jmp 0x100175db
mov byte [esi], 0
mov dword [esi + 4], eax
jmp 0x100175de
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov dword [esi + 4], eax
mov dword [esi], 0
jmp 0x100175de
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [esi + 4], eax
mov dword [esi], 0
push edi
call dword [sym.imp.ws2_32.dll_closesocket]
jmp 0x100175de
Function at 0x100180b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x1001a640
lea eax, [ebp - 0x18]
mov ebx, dword [ebp + 0x10]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
movzx eax, byte [0x1005f029]
push 4
push 8
call fcn.100063c0
add esp, 8
test eax, eax
je 0x1001819b
mov esi, eax
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
mov dword [esi], ebx
mov dword [esi + 4], ecx
push 0
push 0x10000
push esi
push 0x10018210
push eax
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
test eax, eax
je 0x1001812d
mov dword [edi + 4], eax
mov byte [edi], 4
jmp 0x10018188
mov eax, dword [esi]
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x20], eax
mov eax, dword [eax]
test eax, eax
je 0x10018153
mov dword [ebp - 0x10], 1
push dword [ebp - 0x24]
call eax
mov edi, dword [ebp + 8]
add esp, 4
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov eax, dword [edx + 4]
test eax, eax
je 0x1001816d
push dword [edx + 8]
push eax
push ecx
call fcn.100063d0
add esp, 0xc
push 4
push 8
push dword [ebp - 0x28]
call fcn.100063d0
add esp, 0xc
call dword [sym.imp.kernel32.dll_GetLastError]
mov byte [edi], 0
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, edi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
push 8
push 4
call fcn.10037520
add esp, 8
ud2
Function at 0x10019ce0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1b8
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, dword [eax]
mov ebx, dword [eax + 4]
movzx eax, word [eax + 8]
mov word [ebp - 0xe], ax
mov eax, dword [0x1005f0c4]
cmp eax, 3
jne 0x10019dd0
lea eax, [ebp - 0xe]
cmp ebx, 0x17f
mov dword [ebp - 0x18], eax
ja 0x10019de7
lea esi, [ebp - 0x1c4]
push ebx
push edi
push esi
call fcn.10029590
add esp, 0xc
mov byte [ebp + ebx - 0x1c4], 0
inc ebx
lea eax, [ebp - 0x24]
push ebx
push esi
push eax
call fcn.10021f10
add esp, 0xc
cmp dword [ebp - 0x24], 0
je 0x10019d6c
mov eax, dword [0x1003ec20]
mov esi, dword [ebp + 8]
mov ecx, dword [0x1003ec24]
mov dword [esi + 8], ecx
mov dword [esi + 4], eax
mov dword [esi], 1
jmp 0x10019df8
mov eax, dword [ebp - 0x20]
xorps xmm0, xmm0
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 0
lea edx, [ebp - 0x44]
movups xmmword [ebp - 0x44], xmm0
movups xmmword [ebp - 0x34], xmm0
mov dword [ebp - 0x3c], 1
push ecx
push edx
push 0
push eax
call dword [sym.imp.ws2_32.dll_getaddrinfo]
mov esi, dword [ebp + 8]
test eax, eax
je 0x10019db9
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov ecx, 1
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov dword [esi], ecx
jmp 0x10019df8
mov eax, dword [ebp - 0x14]
movzx ecx, word [ebp - 0xe]
mov dword [esi + 4], eax
mov dword [esi + 8], eax
xor eax, eax
mov word [esi + 0xc], cx
mov dword [esi], eax
jmp 0x10019df8
call fcn.10036b10
lea eax, [ebp - 0xe]
cmp ebx, 0x17f
mov dword [ebp - 0x18], eax
jbe 0x10019d1f
lea eax, [ebp - 0x18]
mov ecx, esi
mov edx, edi
push eax
push ebx
call fcn.10036bb0
add esp, 8
mov eax, esi
add esp, 0x1b8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10025750
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 8]
test eax, eax
je 0x100257a8
lea edi, [edx + eax*2]
xor ebx, ebx
movzx esi, byte [edx + 1]
cmp byte [edx], ch
lea edx, [edx + 2]
lea eax, [ebx + esi]
jne 0x100257a0
cmp eax, ebx
jb 0x10025816
cmp eax, dword [ebp + 0x10]
ja 0x10025822
add ebx, dword [ebp + 0xc]
nop word cs:[eax + eax]
nop
test esi, esi
je 0x100257a2
dec esi
cmp byte [ebx], cl
lea ebx, [ebx + 1]
jne 0x10025790
jmp 0x100257ff
ja 0x100257a8
cmp edx, edi
mov ebx, eax
jne 0x10025762
mov edx, dword [ebp + 0x18]
test edx, edx
je 0x10025803
mov esi, dword [ebp + 0x14]
movzx ecx, cx
mov al, 1
add edx, esi
nop dword [eax]
movzx ebx, byte [esi]
lea edi, [esi + 1]
test bl, bl
js 0x100257e0
mov esi, edi
sub ecx, ebx
jns 0x100257f7
jmp 0x10025805
cmp edi, edx
je 0x1002580c
movzx edi, byte [esi + 1]
and ebx, 0x7f
add esi, 2
shl ebx, 8
or ebx, edi
sub ecx, ebx
js 0x10025805
xor al, 1
cmp esi, edx
jne 0x100257c0
jmp 0x10025805
xor eax, eax
jmp 0x10025805
mov al, 1
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x10041424
call fcn.10037590
push 0x10041434
push eax
push ebx
call fcn.10037a40
push 0x10041434
push dword [ebp + 0x10]
push eax
call fcn.100379e0

Function at 0x1002e50d
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10043210
push 0x10043208
push str.FlsAlloc
push 0x1e
call fcn.1002e42b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002e541
push dword [ebp + 8]
mov ecx, esi
call dword [0x100381d4]
call esi
jmp 0x1002e547
call dword [sym.imp.kernel32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1002e58b
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10043220
push 0x10043218
push str.FlsGetValue
push 0x20
call fcn.1002e42b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002e5c2
push dword [ebp + 8]
mov ecx, esi
call dword [0x100381d4]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.kernel32.dll_TlsGetValue]

Function at 0x1002ee76
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1002ece7