joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10055f50
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1012eb00]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 8]
push edi
push 0
push 0
push 0
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0
push edx
push ecx
call dword [sym.imp.WS2_32.dll_WSASend]
mov ebx, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, dword [0x1012ee80]
mov edi, eax
mov ecx, dword [0x1012ee84]
cmp edx, 0x257edfd1
jne 0x10055fa8
cmp ecx, 0xb2ab117a
je 0x10055fb8
cmp edx, 0x257edfd0
jne 0x10055fbf
cmp ecx, 0xb2ab117a
jne 0x10055fbf
test edi, edi
setne al
jmp 0x10055fcf
mov eax, dword [0x1012ee78]
mov ecx, 0x1012ee78
push edi
mov eax, dword [eax + 0x18]
call eax
movzx ecx, al
mov dword [esi], edi
mov dword [esi + 4], 0x1012ee78
mov dword [ebp - 0xc], 0x1ffff7
lea eax, [ecx + 2]
mov dword [esi + 8], eax
cmp ecx, 0xffffffff
je 0x10055ff6
mov eax, edi
mov edx, 0x1012ee78
jmp 0x1005600b
xor edx, edx
mov eax, 0x1012ee78
div dword [ebp - 0xc]
imul eax, edx, 0x3e8
mov edx, dword [esi + 4]
add eax, edi
cmp eax, 0x40
jne 0x10056062
mov ecx, dword [0x1012ee80]
mov eax, dword [0x1012ee84]
cmp ecx, 0x257edfd1
jne 0x1005602a
cmp eax, 0xb2ab117a
je 0x10056039
cmp ecx, 0x257edfd0
jne 0x10056046
cmp eax, 0xb2ab117a
jne 0x10056046
mov al, 1
mov dword [esi], 0x2746
jmp 0x100560c9
mov eax, dword [0x1012ee78]
mov ecx, 0x1012ee78
push 0x2746
mov eax, dword [eax + 0x18]
call eax
mov dword [esi], 0x2746
jmp 0x100560c9
cmp ecx, 0xffffffff
jne 0x1005607a
mov eax, edx
mov ecx, 0x1ffff7
xor edx, edx
div ecx
imul eax, edx, 0x3e8
add edi, eax
cmp edi, 0x4d2
jne 0x100560d9
mov ecx, dword [0x1012ee80]
mov eax, dword [0x1012ee84]
cmp ecx, 0x257edfd1
jne 0x1005609c
cmp eax, 0xb2ab117a
je 0x100560ab
cmp ecx, 0x257edfd0
jne 0x100560af
cmp eax, 0xb2ab117a
jne 0x100560af
mov al, 1
jmp 0x100560c3
mov eax, dword [0x1012ee78]
mov ecx, 0x1012ee78
push 0x274d
mov eax, dword [eax + 0x18]
call eax
mov dword [esi], 0x274d
movzx eax, al
add eax, 2
mov dword [esi + 4], 0x1012ee78
mov dword [esi + 8], eax
test ebx, ebx
je 0x100560f1
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e4fca
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xorps xmm0, xmm0
mov eax, dword [ebp - 8]
xor ecx, ebp
movq qword [esi], xmm0
pop edi
mov dword [esi + 8], 0
pop esi
pop ebx
call fcn.100e4fca
mov esp, ebp
pop ebp
ret
Function at 0x100563c0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x1012eb00]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
cmp ecx, 0xffffffff
jne 0x10056449
mov ecx, dword [0x1012ee80]
mov eax, dword [0x1012ee84]
cmp ecx, 0x257edfd1
jne 0x100563f8
cmp eax, 0xb2ab117a
je 0x10056407
cmp ecx, 0x257edfd0
jne 0x1005640b
cmp eax, 0xb2ab117a
jne 0x1005640b
mov al, 1
jmp 0x1005641f
mov eax, dword [0x1012ee78]
mov ecx, 0x1012ee78
push 0x2719
mov eax, dword [eax + 0x18]
call eax
movzx eax, al
mov dword [esi], 0x2719
add eax, 2
mov dword [esi + 4], 0x1012ee78
mov dword [esi + 8], eax
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e4fca
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
lea eax, [ebp - 0x110]
mov dword [ebp - 0x10c], ecx
push eax
lea eax, [ecx + 1]
mov dword [ebp - 0x110], 1
push eax
call dword [sym.imp.WS2_32.dll_select]
mov ebx, eax
test ebx, ebx
js 0x10056495
xorps xmm0, xmm0
movq qword [esi], xmm0
mov dword [esi + 8], 0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e4fca
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, dword [0x1012ee80]
mov edi, eax
mov eax, dword [0x1012ee84]
cmp ecx, 0x257edfd1
jne 0x100564b7
cmp eax, 0xb2ab117a
je 0x100564c6
cmp ecx, 0x257edfd0
jne 0x100564cd
cmp eax, 0xb2ab117a
jne 0x100564cd
test edi, edi
setne al
jmp 0x100564dd
mov eax, dword [0x1012ee78]
mov ecx, 0x1012ee78
push edi
mov eax, dword [eax + 0x18]
call eax
mov ecx, dword [ebp - 4]
mov dword [esi], edi
xor ecx, ebp
movzx eax, al
add eax, 2
mov dword [esi + 4], 0x1012ee78
pop edi
mov dword [esi + 8], eax
mov eax, ebx
pop esi
pop ebx
call fcn.100e4fca
mov esp, ebp
pop ebp
ret
Function at 0x10056be0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e920d
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1012eb00]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov esi, dword [ebp + 0x1c]
cmp dword [eax], 0xffffffff
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x2c], ecx
je 0x10056c95
mov ecx, dword [0x1012eee0]
mov eax, dword [0x1012eee4]
cmp ecx, 0x257edfd1
jne 0x10056c48
cmp eax, 0xb2ab117a
je 0x10056c57
cmp ecx, 0x257edfd0
jne 0x10056c5b
cmp eax, 0xb2ab117a
jne 0x10056c5b
mov al, 1
jmp 0x10056c6c
mov eax, dword [0x1012eed8]
mov ecx, 0x1012eed8
push 1
mov eax, dword [eax + 0x18]
call eax
mov dword [esi], 1
mov dword [esi + 4], 0x1012eed8
movzx ecx, al
add ecx, 2
mov dword [esi + 8], ecx
movq xmm0, qword [esi]
movq qword [edi], xmm0
mov ecx, dword [esi + 8]
mov dword [edi + 8], ecx
jmp 0x10056d97
push 1
push 0
push 0
push ebx
push ecx
push edx
call dword [sym.imp.WS2_32.dll_WSASocketW]
mov ebx, eax
mov ecx, esi
cmp ebx, 0xffffffff
sete dl
call fcn.10055620
cmp ebx, 0xffffffff
jne 0x10056cbc
or ebx, ebx
jmp 0x10056cda
cmp dword [ebp - 0x14], 0x17
jne 0x10056cda
push 4
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push 0x1b
push 0x29
push ebx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov dword [ebp - 4], 0
cmp ebx, 0xffffffff
jne 0x10056cf6
movq xmm0, qword [esi]
movq qword [edi], xmm0
mov eax, dword [esi + 8]
jmp 0x10056d94
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x20]
push esi
push ebx
push eax
mov ecx, dword [ecx + 4]
call fcn.10054880
mov ecx, dword [eax + 8]
test cl, 1
je 0x10056d4f
cmp ecx, 1
jne 0x10056d19
cmp dword [eax], 0
je 0x10056d4f
movq xmm0, qword [esi]
lea edx, [ebp - 0x21]
movq qword [edi], xmm0
mov ecx, ebx
mov eax, dword [esi + 8]
xorps xmm0, xmm0
mov dword [edi + 8], eax
lea eax, [ebp - 0x20]
push eax
push 1
movq qword [ebp - 0x20], xmm0
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x21], 0
call fcn.10055940
add esp, 8
jmp 0x10056d97
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x28], 0xffffffff
mov dword [eax], ebx
sub ecx, 1
je 0x10056d74
sub ecx, 1
je 0x10056d6e
mov byte [eax + 4], 0
jmp 0x10056d78
mov byte [eax + 4], 0x20
jmp 0x10056d78
mov byte [eax + 4], 0x10
push dword [ebp - 0x2c]
push ecx
lea ecx, [eax + 8]
call fcn.10081fd0
xorps xmm0, xmm0
xor eax, eax
movq qword [esi], xmm0
mov dword [esi + 8], eax
movq qword [edi], xmm0
mov dword [edi + 8], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100e4fca
mov esp, ebp
pop ebp
ret 0x18
Function at 0x100584a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1012eb00]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x104
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.d3d9.dll
lea eax, [ebp - 0x108]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea ecx, [eax + 0x128000]
cmp eax, ecx
jae 0x1005851d
mov esi, 0x6c7
mov edx, 0x8689
inc eax
cmp word [eax], si
jne 0x10058513
cmp word [eax + 6], dx
jne 0x10058513
cmp word [eax + 0xc], dx
je 0x10058537
lea ecx, [eax + 0x128000]
cmp eax, ecx
jb 0x10058501
mov ecx, dword [eax + 1]
mov eax, dword [ebp + 8]
pop esi
mov eax, dword [ecx + eax*4]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e4fca
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [eax + 2]
jmp 0x10058520

Function at 0x10058de0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebx
push edi
mov eax, 0x7f9d50
mov bl, cl
call eax
mov edi, eax
test edi, edi
je 0x10058f2b
push esi
test bl, bl
je 0x10058e90
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x1013accc
push 0x40
push 5
push 0x53f3c6
call esi
push 0x1013acc8
push 0x40
push 5
push 0x53e9f1
call esi
push 0x1013ad04
push 0x40
push 5
push 0x748a1b
call esi
mov byte [0x53f3c6], 0xe9
mov eax, 0x53e9f1
mov dword [0x53f3c7], 0x15b
push 1
push edi
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
mov eax, 0x748a1b
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
mov eax, dword [edi]
call dword [eax + 0x30]
mov dword [0xb73424], 0
mov eax, 0x541bd0
mov dword [0xb73428], 0
call eax
pop esi
pop edi
mov eax, 0x541dd0
pop ebx
jmp eax
mov eax, dword [0x101071c8]
mov ecx, 0x53f3c6
mov dword [ecx], eax
movzx eax, byte [0x101071cc]
mov byte [ecx + 4], al
mov ecx, 0x53e9f1
mov eax, dword [0x101071d0]
mov dword [ecx], eax
movzx eax, byte [0x101071d4]
mov byte [ecx + 4], al
mov ecx, 0x748a1b
mov eax, dword [0x101071d8]
mov dword [ecx], eax
movzx eax, byte [0x101071dc]
mov byte [ecx + 4], al
mov eax, 0x541bd0
call eax
mov eax, 0x541dd0
call eax
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x1013accc
push dword [0x1013accc]
push 5
push 0x53f3c6
call esi
push 0x1013acc8
push dword [0x1013acc8]
push 5
push 0x53e9f1
call esi
push 0x1013ad04
push dword [0x1013ad04]
push 5
push 0x748a1b
call esi
mov eax, dword [edi]
push 0
push edi
call dword [eax + 0x30]
pop esi
pop edi
pop ebx
ret
Function at 0x10058f30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ec39b
mov eax, dword fs:[0]
push eax
sub esp, 0x140
mov eax, dword [0x1012eb00]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x130], esi
lea eax, [ebp - 0x114]
mov dword [ebp - 0x130], esi
push eax
push 0
push 0
push 5
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
xorps xmm0, xmm0
mov dword [ebp - 0x130], eax
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x11c], 0
movups xmmword [ebp - 0x12c], xmm0
mov dword [ebp - 0x118], 0
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10058fb0
sub ecx, edx
lea eax, [ebp - 0x114]
push ecx
push eax
lea ecx, [ebp - 0x12c]
call fcn.1004aee0
cmp dword [ebp - 0x130], 0
mov dword [ebp - 4], 0
je 0x10059045
mov ecx, edi
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10058ff5
sub ecx, edx
push ecx
push edi
mov ecx, esi
call fcn.1004aee0
mov ecx, dword [ebp - 0x118]
cmp ecx, 0xf
jbe 0x10059109
mov edx, dword [ebp - 0x12c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100590ff
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100590ff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
mov ecx, dword [ebp - 0x11c]
mov eax, accept
sub eax, ecx
cmp eax, 0x18
jb 0x10059126
cmp dword [ebp - 0x118], 0xf
lea eax, [ebp - 0x12c]
push 0x18
cmova eax, dword [ebp - 0x12c]
push str.Radmir_CRMP_User_Files_
push ecx
push eax
lea eax, [ebp - 0x12c]
push eax
push dword [ebp - 0x130]
lea ecx, [ebp - 0x148]
call fcn.1008a330
push edi
lea eax, [ebp - 0x148]
mov byte [ebp - 4], 1
push eax
push esi
call fcn.1004a950
mov ecx, dword [ebp - 0x134]
add esp, 0xc
cmp ecx, 0xf
jbe 0x100590df
mov edx, dword [ebp - 0x148]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100590d5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1005903f
push ecx
push edx
call fcn.100e50ed
add esp, 8
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x134], 0xf
mov byte [ebp - 0x148], 0
jmp 0x10059007
push ecx
push edx
call fcn.100e50ed
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100e4fca
mov esp, ebp
pop ebp
ret
call fcn.1002d480
int3
Function at 0x1005c260
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
cmp edi, dword [ebp + 0x14]
jne 0x1005c319
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
cmp edi, 4
jb 0x1005c2f9
mov ecx, eax
sub ecx, ebx
add ecx, 2
mov dword [ebp - 4], ecx
nop dword [eax + eax]
movzx esi, byte [ecx + ebx]
movzx ecx, byte [eax + 3]
movzx edx, byte [ebx + 3]
shl ecx, 8
or esi, ecx
shl edx, 8
movzx ecx, byte [eax]
shl esi, 0x10
or esi, ecx
movzx ecx, byte [eax + 1]
and ecx, 0xffdfdfdf
and esi, 0xdfdfdfdf
shl ecx, 8
or esi, ecx
movzx ecx, byte [ebx + 2]
or edx, ecx
movzx ecx, byte [ebx]
shl edx, 0x10
or edx, ecx
movzx ecx, byte [ebx + 1]
and ecx, 0xffdfdfdf
and edx, 0xdfdfdfdf
shl ecx, 8
or edx, ecx
cmp edx, esi
jne 0x1005c319
mov ecx, dword [ebp - 4]
sub edi, 4
add eax, 4
add ebx, 4
cmp edi, 4
jae 0x1005c290
test edi, edi
je 0x1005c310
sub ebx, eax
nop
mov cl, byte [ebx + eax]
xor cl, byte [eax]
test cl, 0xdf
jne 0x1005c319
inc eax
sub edi, 1
jne 0x1005c300
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1005f730
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ec80d
mov eax, dword fs:[0]
push eax
push ebx
push ecx
push esi
mov eax, dword [0x1012eb00]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov eax, dword [ebx + 8]
mov dword [ebp - 4], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov eax, dword [ebx + 0xc]
mov dword [esi + 0x20], eax
call fcn.1005f7e0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
Function at 0x10064dc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, ecx
push esi
push edi
mov edi, 1
mov esi, 1
mov ecx, dword [ebx + 0x30]
shl edi, cl
mov ecx, dword [ebx + 0x50]
shl esi, cl
add ecx, 2
mov dword [ebx + 0x2c], edi
lea eax, [edi - 1]
mov dword [ebx + 0x4c], esi
mov dword [ebx + 0x34], eax
add edi, edi
lea eax, [esi - 1]
mov dword [ebx + 0x54], eax
mov eax, 0xaaaaaaab
mul ecx
mov eax, dword [ebx + 0x169c]
lea ecx, [esi + esi]
shl eax, 2
shr edx, 1
mov dword [ebx + 0x58], edx
mov dword [ebp - 4], ecx
lea esi, [eax + edi*2]
add esi, ecx
cmp dword [ebx + 0xc], 0
je 0x10064e21
cmp dword [ebx + 8], esi
je 0x10064e4d
push esi
call fcn.100e57a2
mov edx, eax
lea ecx, [ebp - 0x18]
lea eax, [ebx + 0xc]
add esp, 4
cmp eax, ecx
je 0x10064e41
mov ecx, dword [eax]
mov dword [eax], edx
test ecx, ecx
je 0x10064e4a
push ecx
jmp 0x10064e42
push edx
call fcn.100e55eb
add esp, 4
mov dword [ebx + 8], esi
mov eax, dword [ebx + 0xc]
mov esi, edi
push esi
mov dword [ebx + 0x38], eax
add eax, esi
push 0
push eax
mov dword [ebx + 0x40], eax
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [ebx + 0xc]
add esp, 0xc
mov edx, dword [ebp - 4]
add edx, ecx
mov dword [ebx + 0x16c0], 0
add edx, esi
mov dword [ebx + 0x20], 0
lea eax, [ecx + esi]
mov dword [ebx + 0x10], 0x71
mov ecx, dword [ebx + 0x169c]
add eax, esi
mov dword [ebx + 0x44], eax
add edx, esi
mov dword [ebx + 0x14], edx
mov dword [ebx + 0x1c], edx
lea eax, [ecx*4]
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x18], eax
lea eax, [edx + ecx]
mov dword [ebx + 0x1698], eax
dec ecx
mov byte [ebx + 0x24], 1
lea eax, [ecx + ecx*2]
mov ecx, dword [ebx]
mov dword [ebx + 0x16a4], eax
lea eax, [ebx + 0x94]
mov dword [ebx + 0xb18], eax
lea eax, [ecx + 0x8b4]
mov dword [ebx + 0xb20], eax
lea eax, [ebx + 0x988]
mov dword [ebx + 0xb24], eax
lea eax, [ecx + 0x8c4]
mov dword [ebx + 0xb2c], eax
lea eax, [ebx + 0xa7c]
mov dword [ebx + 0xb30], eax
lea eax, [ecx + 0x8d4]
mov dword [ebx + 0xb38], eax
mov ecx, ebx
xor eax, eax
mov word [ebx + 0x16b8], ax
mov dword [ebx + 0x16bc], eax
call fcn.10064ff0
mov eax, dword [ebx + 0x2c]
xor edx, edx
mov ecx, dword [ebx + 0x4c]
add eax, eax
mov dword [ebx + 0x3c], eax
mov eax, dword [ebx + 0x44]
mov word [eax + ecx*2 - 2], dx
mov eax, dword [ebx + 0x4c]
lea eax, [eax*2 - 2]
push eax
push edx
push dword [ebx + 0x44]
call sub.VCRUNTIME140.dll_memset
mov edx, dword [ebx + 0x84]
lea ecx, [ebp - 0x14]
add esp, 0xc
call fcn.10064250
lea ecx, [ebp - 0x14]
movzx eax, word [eax + 2]
mov dword [ebx + 0x80], eax
call fcn.10064250
lea ecx, [ebp - 0x14]
movzx eax, word [eax]
mov dword [ebx + 0x8c], eax
call fcn.10064250
lea ecx, [ebp - 0x14]
movzx eax, word [eax + 4]
mov dword [ebx + 0x90], eax
call fcn.10064250
movzx eax, word [eax + 6]
pop edi
pop esi
mov dword [ebx + 0x7c], eax
mov dword [ebx + 0x6c], 0
mov dword [ebx + 0x5c], 0
mov dword [ebx + 0x74], 0
mov dword [ebx + 0x16b4], 0
mov dword [ebx + 0x78], 2
mov dword [ebx + 0x60], 2
mov dword [ebx + 0x68], 0
mov dword [ebx + 0x48], 0
mov byte [ebx + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10069410
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1012eb00]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [edx]
push ebx
push edi
mov edi, dword [ecx + 4]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ecx
cmp edi, 4
jb 0x10069461
mov bl, byte [ebp - 5]
mov edx, edi
mov bh, byte [ebp - 6]
shr edx, 2
xor byte [ecx], al
sub edi, 4
xor byte [ecx + 1], ah
xor byte [ecx + 2], bh
xor byte [ecx + 3], bl
add ecx, 4
sub edx, 1
jne 0x10069445
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], ecx
test edi, edi
je 0x100695ad
push esi
xor esi, esi
cmp edi, 8
jb 0x10069550
lea edx, [ecx - 1]
lea eax, [ebp + edi - 9]
add edx, edi
cmp ecx, eax
ja 0x1006948d
lea eax, [ebp - 8]
cmp edx, eax
jae 0x10069550
cmp edi, 0x40
jb 0x1006951a
mov edx, edi
lea eax, [ecx + 0x20]
and edx, 0x3f
mov ebx, edi
mov dword [ebp - 0x1c], edx
sub ebx, edx
lea edx, [ebp - 8]
sub edx, ecx
mov dword [ebp - 0x14], edx
lea edx, [ebp + 8]
mov edi, dword [ebp - 0x14]
sub edx, ecx
mov dword [ebp - 0x18], edx
mov ecx, edx
nop word [eax + eax]
movups xmm0, xmmword [eax - 0x20]
lea edx, [ebp - 8]
movups xmm1, xmmword [edx + esi]
mov edx, dword [ebp - 0x1c]
lea eax, [eax + 0x40]
xorps xmm1, xmm0
movups xmmword [eax - 0x60], xmm1
movups xmm0, xmmword [eax - 0x50]
movups xmm1, xmmword [ebp + esi + 8]
add esi, 0x40
xorps xmm1, xmm0
movups xmmword [eax - 0x50], xmm1
movups xmm0, xmmword [eax - 0x40]
movups xmm1, xmmword [edi + eax - 0x40]
xorps xmm1, xmm0
movups xmmword [eax - 0x40], xmm1
movups xmm0, xmmword [eax - 0x30]
movups xmm1, xmmword [ecx + eax - 0x40]
xorps xmm1, xmm0
movups xmmword [eax - 0x30], xmm1
cmp esi, ebx
jb 0x100694c0
mov ecx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
cmp edx, 8
jb 0x1006954c
mov edx, edi
lea ebx, [ebp - 8]
and edx, 0xfffffff8
lea eax, [esi + ecx]
sub ebx, ecx
nop word [eax + eax]
movq xmm0, qword [eax]
lea eax, [eax + 8]
movq xmm1, qword [ebx + eax - 8]
add esi, 8
xorps xmm1, xmm0
movq qword [eax - 8], xmm1
cmp esi, edx
jb 0x10069530
cmp esi, edi
jae 0x1006956e
lea ebx, [ebp - 8]
lea edx, [esi + ecx]
sub ebx, ecx
mov ecx, edi
sub ecx, esi
nop dword [eax]
mov al, byte [ebx + edx]
lea edx, [edx + 1]
xor byte [edx - 1], al
sub ecx, 1
jne 0x10069560
mov ecx, dword [ebp - 0x20]
pop esi
mov eax, dword [ecx]
mov dword [ebp - 0xc], eax
mov eax, edi
and eax, 3
movzx eax, byte [ebp + eax - 0xc]
mov byte [ecx], al
lea eax, [edi + 1]
and eax, 3
movzx eax, byte [ebp + eax - 0xc]
mov byte [ecx + 1], al
lea eax, [edi - 2]
and eax, 3
movzx eax, byte [ebp + eax - 0xc]
mov byte [ecx + 2], al
lea eax, [edi - 1]
and eax, 3
movzx eax, byte [ebp + eax - 0xc]
mov byte [ecx + 3], al
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.100e4fca
mov esp, ebp
pop ebp
ret
Function at 0x10069c40
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ecc52
mov eax, dword fs:[0]
push eax
mov eax, 0x1044
call fcn.100e78c0
mov eax, dword [0x1012eb00]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov eax, ecx
mov dword [ebp - 0x1030], eax
mov dword [ebp - 0x1038], eax
mov dword [ebp - 0x1050], eax
mov dword [ebp - 0x103c], 0
push 0
mov dword [ebp - 4], 1
call fcn.1007f210
push 0
push 0
push 0
push 1
mov dword [ebp - 4], 0
push str.Example
mov dword [ebp - 0x103c], 1
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x1038], eax
test eax, eax
je 0x10069e4d
cmp dword [esi + 0x14], 0xf
jbe 0x10069cd9
mov esi, dword [esi]
push 0
push accept
push 0
push 0
push esi
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov edi, eax
test edi, edi
je 0x10069e41
xorps xmm0, xmm0
mov dword [ebp - 0x101c], 0
movups xmmword [ebp - 0x102c], xmm0
mov dword [ebp - 0x1018], 0xf
mov byte [ebp - 0x102c], 0
lea eax, [ebp - 0x1014]
mov dword [ebp - 4], 2
mov esi, dword [sym.imp.WININET.dll_InternetReadFile]
push eax
push 0x1000
lea eax, [ebp - 0x1010]
push eax
push edi
call esi
test eax, eax
je 0x10069d79
mov eax, dword [ebp - 0x1014]
test eax, eax
je 0x10069d79
push eax
lea eax, [ebp - 0x1010]
push eax
lea ecx, [ebp - 0x102c]
call fcn.1004a7d0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1010]
push eax
push edi
call esi
test eax, eax
jne 0x10069d42
push 0
push 1
sub esp, 0x28
lea ecx, [ebp - 0x104c]
mov eax, esp
lea edx, [ebp - 0x102c]
mov dword [eax + 0x24], 0
call fcn.100833a0
mov esi, dword [ebp - 0x1030]
add esp, 0x30
mov al, byte [ebp - 0x104c]
mov cl, byte [esi]
mov byte [ebp - 0x1034], cl
mov byte [esi], al
mov edx, dword [esi + 8]
mov eax, dword [ebp - 0x1044]
mov esi, dword [esi + 0xc]
mov byte [ebp - 0x104c], cl
mov ecx, dword [ebp - 0x1030]
mov dword [ebp - 0x1044], edx
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x1030]
mov ecx, dword [ebp - 0x1040]
mov dword [ebp - 0x1040], esi
mov dword [eax + 0xc], ecx
push dword [ebp - 0x1034]
lea ecx, [ebp - 0x1044]
mov byte [ebp - 4], 3
call fcn.1007ee80
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, dword [ebp - 0x1018]
cmp ecx, 0xf
jbe 0x10069e41
mov edx, dword [ebp - 0x102c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10069e37
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10069e37
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100e50ed
add esp, 8
push dword [ebp - 0x1038]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, dword [ebp - 0x1030]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100e4fca
mov esp, ebp
pop ebp
ret
Function at 0x10077890
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub dword [ebp + 0xc], 1
jne 0x100778b7
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0
push 0
push 0
push 0x1006ff60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
pop ebp
ret 0xc