joyce8/EMBER2024-capa huggingface dataset:
Function at 0x470380
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x5d0464
mov dword [ebp - 0x24], 0x73002f
lea esi, [ebp - 0x24]
mov dword [ebp - 0x20], 0x6c0069
push edi
mov dword [ebp - 0x1c], 0x6e0065
mov edx, 0x11
mov dword [ebp - 0x18], 0x5f0074
sub esi, eax
mov dword [ebp - 0x14], 0x6e0069
mov dword [ebp - 0x10], 0x740073
mov dword [ebp - 0xc], 0x6c0061
mov dword [ebp - 8], 0x6c
nop word [eax + eax]
lea ecx, [edx + 0x7fffffed]
test ecx, ecx
je 0x4703fe
movzx ecx, word [esi + eax]
test cx, cx
je 0x4703fe
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x4703e0
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov eax, 0x5d0464
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047467d
mov esp, ebp
pop ebp
ret

Function at 0x470430
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x24], 0x77002f
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x24]
mov eax, 0x5d04cc
mov dword [ebp - 0x20], 0x5f0064
push edi
mov dword [ebp - 0x1c], 0x6f0070
mov edx, 0x10
mov dword [ebp - 0x18], 0x750070
sub esi, eax
mov dword [ebp - 0x14], 0x5f0070
mov dword [ebp - 0x10], 0x680073
mov dword [ebp - 0xc], 0x77006f
nop dword [eax + eax]
lea ecx, [edx + 0x7fffffee]
test ecx, ecx
je 0x4704ae
movzx ecx, word [esi + eax]
test cx, cx
je 0x4704ae
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x470490
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
mov word [ecx], ax
mov eax, 0x5d04cc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047467d
mov esp, ebp
pop ebp
ret

Function at 0x4704d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x5d0560
mov dword [ebp - 0x1c], 0x73002f
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x610074
mov dword [ebp - 0x14], 0x740072
mov edx, 0xd
mov dword [ebp - 0x10], str.m_v18
sub esi, eax
mov dword [ebp - 0xc], 0x6f0072
mov dword [ebp - 8], 0x6d
nop word [eax + eax]
lea ecx, [edx + 0x7ffffff1]
test ecx, ecx
je 0x47053e
movzx ecx, word [esi + eax]
test cx, cx
je 0x47053e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x470520
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5d0560
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047467d
mov esp, ebp
pop ebp
ret
Function at 0x470a20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x5d04b0
mov dword [ebp - 0x1c], 0x5f004d
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x5f0069
mov dword [ebp - 0x14], 0x5f0063
mov edx, 0xd
mov dword [ebp - 0x10], 0x5f0044
sub esi, eax
mov dword [ebp - 0xc], 0x5f0069
mov dword [ebp - 8], 0x72
nop word [eax + eax]
lea ecx, [edx + 0x7ffffff1]
test ecx, ecx
je 0x470a8e
movzx ecx, word [esi + eax]
test cx, cx
je 0x470a8e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x470a70
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5d04b0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047467d
mov esp, ebp
pop ebp
ret

Function at 0x470ab0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x20], 0x72002f
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x20]
mov eax, 0x5d0544
mov dword [ebp - 0x1c], 0x630065
mov dword [ebp - 0x18], 0x72006f
mov edx, 0xe
mov dword [ebp - 0x14], 0x5f0064
sub esi, eax
mov dword [ebp - 0x10], 0x6e0069
mov dword [ebp - 0xc], 0x6f0066
lea ecx, [edx + 0x7ffffff0]
test ecx, ecx
je 0x470b1e
movzx ecx, word [esi + eax]
test cx, cx
je 0x470b1e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x470b00
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5d0544
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047467d
mov esp, ebp
pop ebp
ret

Function at 0x470b40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x2c], 0x4f0053
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x2c]
mov eax, 0x5d05f4
mov dword [ebp - 0x28], 0x540046
mov dword [ebp - 0x24], 0x410057
mov edx, 0x14
mov dword [ebp - 0x20], 0x450052
sub esi, eax
mov dword [ebp - 0x1c], 0x4d005c
mov dword [ebp - 0x18], 0x630069
mov dword [ebp - 0x14], 0x6f0072
mov dword [ebp - 0x10], 0x610047
mov dword [ebp - 0xc], 0x65006d
lea ecx, [edx + 0x7fffffea]
test ecx, ecx
je 0x470bc3
movzx ecx, word [esi + eax]
test cx, cx
je 0x470bc3
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x470ba5
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5d05f4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047467d
mov esp, ebp
pop ebp
ret
Function at 0x471c10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x5d07f0
mov dword [ebp - 0x1c], 0x73002f
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x610074
mov dword [ebp - 0x14], 0x740072
mov edx, 0xd
mov dword [ebp - 0x10], str.m_v18
sub esi, eax
mov dword [ebp - 0xc], 0x6f0072
mov dword [ebp - 8], 0x6d
nop word [eax + eax]
lea ecx, [edx + 0x7ffffff1]
test ecx, ecx
je 0x471c7e
movzx ecx, word [esi + eax]
test cx, cx
je 0x471c7e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x471c60
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5d07f0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047467d
mov esp, ebp
pop ebp
ret

Function at 0x471e10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x2c], 0x4f0053
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x2c]
mov eax, 0x5d0868
mov dword [ebp - 0x28], 0x540046
mov dword [ebp - 0x24], 0x410057
mov edx, 0x14
mov dword [ebp - 0x20], 0x450052
sub esi, eax
mov dword [ebp - 0x1c], 0x4d005c
mov dword [ebp - 0x18], 0x630069
mov dword [ebp - 0x14], 0x6f0072
mov dword [ebp - 0x10], 0x610047
mov dword [ebp - 0xc], 0x65006d
lea ecx, [edx + 0x7fffffea]
test ecx, ecx
je 0x471e93
movzx ecx, word [esi + eax]
test cx, cx
je 0x471e93
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x471e75
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5d0868
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047467d
mov esp, ebp
pop ebp
ret

Function at 0x471ec0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x1c], 0x64002f
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x1c]
mov eax, 0x5d077c
mov dword [ebp - 0x18], 0x6c0065
mov dword [ebp - 0x14], 0x790061
mov edx, 0xc
mov dword [ebp - 0x10], 0x6c005f
sub esi, eax
mov dword [ebp - 0xc], 0x6b006e
nop dword [eax]
lea ecx, [edx + 0x7ffffff2]
test ecx, ecx
je 0x471f2e
movzx ecx, word [esi + eax]
test cx, cx
je 0x471f2e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x471f10
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5d077c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047467d
mov esp, ebp
pop ebp
ret
Function at 0x41796e
Capabilities:
Encode data using xor

Disassembly:
pop ss
in al, 0x49
push esi
shl dword [esi - 0x5504cc64], cl
sahf
cmpsd dword [esi], dword es:[edi]
stosb byte es:[edi], al
loope 0x417941
in al, dx
cdq
mov dl, byte [ebp + 0x4e]
call 0x84e159d1
xchg byte [esi + 0x53c8c172], bh
fsubr dword [ecx + 0x714c58eb]
mov dword [ecx], esi
aad 0x98
adc al, 0x6a
push eax
add ecx, ebx
jg 0x41790b
stosd dword es:[edi], eax
out 0x33, al
sahf
mov dword [0xd72fd946], eax
je 0x417922
and byte [eax + 0x3c3a8943], cl
xchg edi, eax
inc ecx
cmpsd dword [esi], dword es:[edi]
push ebx
test al, 0x5f
mov cs, edx
adc dh, byte [ebx]
popfd
mov bl, 0x24
pop ebp
xchg bh, bl
mov edx, 0x346ded4d
and al, 0x61
popfd
cmp dword cs:[ecx - 0x80], ebp
in al, 1
je 0x417945
sub ecx, dword [edx + edi*8]
popal
and edi, dword [0x655969fd]
push cs
into
popfd
mov bh, byte [ebx]
mov dword [0xdcca03ce], eax
jmp 0x41797a

Function at 0x417c10
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
lea eax, [esp]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push str.CLSIDEC3DAC94_DF80_3017_B381_B13DCED6C4D8InprocServer32
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x417c3e
xor eax, eax
pop esi
add esp, 8
ret 4
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 4]
lea ecx, [esp + 8]
mov dword [esp + 8], 0x104
push ecx
push edx
push 0
push 0
push str.ThreadingModel
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x417c6d
mov esi, 1
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 8
ret 4

Function at 0x47b926
Capabilities:
Encode data using xor

Disassembly:
xor ebp, dword [eax + ebx*4]
sub al, 0x98
dec esi
or bl, ch
insb byte es:[edi], dx
inc edi
xor al, 0xd5
imul edx, dword [esi - 0x67], 0x3dc3e40e
aam 0x61
mov al, dh
test byte [edi + 0xac71304], cl
aam 0xc7
js 0x47b925
retf
Function at 0x4ba7f5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c33d0
cmp edx, dword [eax]
je 0x4ba817
add eax, 8
inc ecx
cmp eax, 0x4c3460
jl 0x4ba808
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c33d0]
jne 0x4ba945
mov eax, dword [0x4c7d5c]
cmp eax, 1
je 0x4ba91f
test eax, eax
jne 0x4ba848
cmp dword [0x4c32f8], 1
je 0x4ba91f
cmp edx, 0xfc
je 0x4ba945
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4ba87f
lea eax, [ebp - 0x1a4]
push 0x4bfaa0
push eax
call fcn.004bb1e0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bb670
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4ba8c2
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bb670
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bfa9c
push edi
call fcn.004bd540
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4bfa80
push eax
call fcn.004bb1e0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bb1f0
lea eax, [ebp - 0xa0]
push 0x4bfa7c
push eax
call fcn.004bb1f0
push dword [esi + 0x4c33d4]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bb1f0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4bfa54
push eax
call fcn.004bd4b4
add esp, 0x2c
pop edi
jmp 0x4ba945
lea eax, [ebp + 8]
lea esi, [esi + 0x4c33d4]
push 0
push eax
push dword [esi]
call fcn.004bb670
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x10001000
Capabilities:
Hash data using crc32b

Disassembly:
push ebx
xor edx, edx
push edi
xor eax, eax
test dl, 1
je 0x10001010
mov eax, 0x80
mov ecx, edx
shr ecx, 1
test cl, 1
je 0x1000101c
or eax, 0x40
shr ecx, 1
test cl, 1
je 0x10001026
or eax, 0x20
shr ecx, 1
test cl, 1
je 0x10001030
or eax, 0x10
shr ecx, 1
test cl, 1
je 0x1000103a
or eax, 8
shr ecx, 1
test cl, 1
je 0x10001044
or eax, 4
shr ecx, 1
test cl, 1
je 0x1000104e
or eax, 2
test cl, 2
je 0x10001056
or eax, 1
shl eax, 0x18
mov ecx, eax
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
xor edi, edi
mov dword [esi + edx*4], ecx
mov eax, ecx
lea ecx, [edi + 0x1f]
jmp 0x10001110
test al, 1
je 0x1000111d
mov ebx, 1
shl ebx, cl
or edi, ebx
dec ecx
shr eax, 1
cmp ecx, 0xffffffff
jg 0x10001110
mov dword [esi + edx*4], edi
inc edx
cmp edx, 0xff
jle 0x10001004
pop edi
pop ebx
ret

Function at 0x10001140
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x10026018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push 0x1001d634
push eax
lea eax, [ebp - 0x408]
push eax
or esi, 0xffffffff
mov dword [ebp - 0x408], 0
call dword [sym.imp.MSVCR100.dll__wfopen_s]
add esp, 0xc
test eax, eax
je 0x10001192
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10019486
mov esp, ebp
pop ebp
ret 8
push ebx
push edi
mov ecx, dword [ebp - 0x408]
push ecx
push 0x400
lea edx, [ebp - 0x404]
push 1
push edx
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
mov ecx, eax
lea edx, [ebp - 0x404]
test eax, eax
je 0x100011da
mov edi, edi
movzx ebx, byte [edx]
mov edi, esi
and edi, 0xff
xor edi, ebx
mov ebx, dword [ebp + 8]
shr esi, 8
xor esi, dword [ebx + edi*4]
inc edx
dec ecx
jne 0x100011c0
cmp eax, 0x400
je 0x10001194
mov eax, dword [ebp - 0x408]
push eax
call dword [sym.imp.MSVCR100.dll_fclose]
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
mov eax, esi
pop ebx
xor ecx, ebp
not eax
pop esi
call fcn.10019486
mov esp, ebp
pop ebp
ret 8
Function at 0x10001210
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x1001d63c
push eax
lea ecx, [ebp - 4]
push ecx
mov dword [esi], 0xffffffff
mov dword [ebp - 4], 0
call dword [sym.imp.MSVCR100.dll_fopen_s]
add esp, 0xc
test eax, eax
je 0x10001242
xor al, al
mov esp, ebp
pop ebp
ret 4
push edi
push 0x400
call dword [sym.imp.MSVCR100.dll_malloc]
mov edi, eax
add esp, 4
mov dword [ebp - 8], edi
test edi, edi
jne 0x10001270
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 4]
push eax
push 0x400
push 1
push edi
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
test eax, eax
je 0x100012d3
push ebx
lea ebx, [ebx]
mov ecx, eax
mov edx, edi
test eax, eax
je 0x100012b9
mov eax, dword [esi]
movzx ebx, byte [edx]
mov edi, eax
and edi, 0xff
xor edi, ebx
mov ebx, dword [ebp + 8]
shr eax, 8
xor eax, dword [ebx + edi*4]
inc edx
dec ecx
mov dword [esi], eax
jne 0x10001298
mov edi, dword [ebp - 8]
mov ecx, dword [ebp - 4]
push ecx
push 0x400
push 1
push edi
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
test eax, eax
jne 0x10001290
pop ebx
push edi
call dword [sym.imp.MSVCR100.dll_free]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.MSVCR100.dll_fclose]
mov eax, dword [esi]
not eax
add esp, 8
mov dword [esi], eax
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret 4

Function at 0x10001300
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x1001d634
push eax
lea ecx, [ebp - 4]
push ecx
mov dword [esi], 0xffffffff
mov dword [ebp - 4], 0
call dword [sym.imp.MSVCR100.dll__wfopen_s]
add esp, 0xc
test eax, eax
je 0x10001332
xor al, al
mov esp, ebp
pop ebp
ret 4
push edi
push 0x400
call dword [sym.imp.MSVCR100.dll_malloc]
mov edi, eax
add esp, 4
mov dword [ebp - 8], edi
test edi, edi
jne 0x10001360
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 4]
push eax
push 0x400
push 1
push edi
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
test eax, eax
je 0x100013c3
push ebx
lea ebx, [ebx]
mov ecx, eax
mov edx, edi
test eax, eax
je 0x100013a9
mov eax, dword [esi]
movzx ebx, byte [edx]
mov edi, eax
and edi, 0xff
xor edi, ebx
mov ebx, dword [ebp + 8]
shr eax, 8
xor eax, dword [ebx + edi*4]
inc edx
dec ecx
mov dword [esi], eax
jne 0x10001388
mov edi, dword [ebp - 8]
mov ecx, dword [ebp - 4]
push ecx
push 0x400
push 1
push edi
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
test eax, eax
jne 0x10001380
pop ebx
push edi
call dword [sym.imp.MSVCR100.dll_free]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.MSVCR100.dll_fclose]
mov eax, dword [esi]
not eax
add esp, 8
mov dword [esi], eax
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x10001460
Capabilities:
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x10026018]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x198]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x10001499
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10019486
mov esp, ebp
pop ebp
ret
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x1002637c], eax
cmp eax, 0xffffffff
je 0x10001489
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
mov dword [0x10026380], eax
test eax, eax
je 0x10001489
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov dword [0x1012638c], 0x10001ff0
mov al, 1
call fcn.10019486
mov esp, ebp
pop ebp
ret
Function at 0x100014e0
Capabilities:
Connect socket
Encode data using xor
Resolve dns

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
mov eax, dword [0x10026018]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
mov esi, ecx
cmp dword [esi + 4], 0xffffffff
push edi
mov edi, dword [ebp + 8]
jne 0x10001563
push 0x100
push 0
push 0x11184108
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
jmp 0x10001520
mov cl, byte [eax + 0x1001d760]
sub cl, 0x1b
xor cl, 0xc
mov byte [eax + 0x11184108], cl
inc eax
cmp eax, 0x100
jb 0x10001520
push 0x11184108
push 0
mov ecx, 0x10126528
call fcn.1000b180
add esp, 8
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.10019486
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
mov edx, 2
push eax
mov word [esp + 0x10], dx
call dword [sym.imp.WS2_32.dll_htons]
push edi
mov word [esp + 0x12], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
jne 0x100015af
push edi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x100015af
movsx ecx, word [eax + 0xa]
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
push ecx
push eax
lea ecx, [esp + 0x18]
push ecx
call sub.MSVCR100.dll_memcpy
add esp, 0xc
mov eax, dword [esi + 4]
push 0x10
lea edx, [esp + 0x10]
push edx
push eax
call dword [sym.imp.WS2_32.dll_connect]
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0xffffffff
jne 0x1000160b
call edi
cmp eax, 0x2733
je 0x1000160b
call edi
push eax
mov eax, 2
call fcn.10015f10
push eax
push 0
mov ecx, 0x10126528
call fcn.1000b180
add esp, 0xc
call fcn.100016f0
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.10019486
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esi + 8]
mov edx, dword [esi + 4]
push 0x23
push ecx
push edx
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
jne 0x10001684
call edi
push eax
mov eax, 3
call fcn.10015f10
push eax
push 0
mov ecx, 0x10126528
call fcn.1000b180
mov eax, dword [esi + 4]
add esp, 0xc
cmp eax, 0xffffffff
je 0x10001653
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 4], 0xffffffff
mov eax, dword [esi + 8]
test eax, eax
je 0x10001668
push eax
call dword [sym.imp.WS2_32.dll_WSACloseEvent]
mov dword [esi + 8], 0
mov byte [esi + 0x100038], 0
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.10019486
mov esp, ebp
pop ebp
ret 8
push 0x80000
xor edi, edi
lea eax, [esi + 0xc]
push edi
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x80000
lea ecx, [esi + 0x80010]
push edi
push ecx
mov dword [esi + 0x8000c], edi
call sub.MSVCR100.dll_memset
add esp, 0xc
mov dword [esi + 0x100010], edi
push edi
mov ecx, esi
mov edi, 0x10001ca0
call fcn.10016170
mov ecx, dword [esp + 0x1c]
pop edi
mov byte [esi + 0x100038], 1
pop esi
xor ecx, esp
mov al, 1
call fcn.10019486
mov esp, ebp
pop ebp
ret 8
Function at 0x100019b0
Capabilities:
Encode data using xor
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8000c
call fcn.10019e90
mov eax, dword [0x10026018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x10126394
mov esi, ecx
mov edi, edx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x1002637c], 0xffffffff
je 0x10001ab5
cmp byte [0x101263b0], 0
je 0x10001ab5
push 0x80000
lea eax, [ebp - 0x80008]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
push esi
lea ecx, [ebp - 0x80008]
push edi
push ecx
call sub.MSVCR100.dll_memcpy
add esp, 0xc
xor eax, eax
cmp byte [ebp - 0x80008], 0xc1
jne 0x10001a4c
mov cl, byte [ebp - 0x80006]
lea edi, [esi - 3]
test edi, edi
jle 0x10001a78
mov dl, byte [ebp + eax - 0x80005]
xor dl, 0xa0
sub dl, cl
mov byte [ebp + eax - 0x80005], dl
inc eax
cmp eax, edi
jl 0x10001a32
jmp 0x10001a78
mov cl, byte [ebp - 0x80005]
lea edi, [esi - 4]
test edi, edi
jle 0x10001a78
lea esp, [esp]
mov dl, byte [ebp + eax - 0x80004]
xor dl, 0xa0
sub dl, cl
mov byte [ebp + eax - 0x80004], dl
inc eax
cmp eax, edi
jl 0x10001a60
mov ecx, dword [0x10126388]
test ecx, ecx
jle 0x10001b0e
lea eax, [ecx + esi]
cmp eax, 0x80000
jle 0x10001ad3
push eax
mov eax, 7
call fcn.10015f10
push eax
push 0
mov ecx, 0x10126528
call fcn.1000b180
add esp, 0xc
mov esi, 0x10026378
call fcn.100016f0
push 0x10126394
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10019486
mov esp, ebp
pop ebp
ret
push esi
lea eax, [ebp - 0x80008]
push eax
lea ecx, [ecx + 0x100a6388]
push ecx
call sub.MSVCR100.dll_memcpy
add esp, 0xc
add dword [0x10126388], esi
push 0x10126394
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.10019486
mov esp, ebp
pop ebp
ret
xor edi, edi
test esi, esi
jle 0x10001af0
mov ebx, dword [sym.imp.WS2_32.dll_send]
mov eax, dword [0x1002637c]
push 0
push esi
lea edx, [ebp + edi - 0x80008]
push edx
push eax
call ebx
cmp eax, 0xffffffff
je 0x10001b3c
sub esi, eax
add edi, eax
test esi, esi
jg 0x10001b1a
jmp 0x10001af0
mov ebx, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call ebx
cmp eax, 0x2733
jne 0x10001b7b
mov ecx, dword [0x10126388]
lea eax, [ecx + esi]
cmp eax, 0x80000
jle 0x10001b66
push eax
mov eax, 8
jmp 0x10001a96
push esi
lea edx, [ebp + edi - 0x80008]
push edx
lea eax, [ecx + 0x100a6388]
push eax
jmp 0x10001ae2
call ebx
push eax
mov eax, 9
jmp 0x10001a96