joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
nop
mov ebx, 0x40c7d0
mov ecx, 0x10b1c56
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f314
mov ecx, 0x2e926e0e
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219

Function at 0xeefab8
Capabilities:
Encode data using xor

Disassembly:
jmp 0xeefac2
pushal
call 0xeefac8
pop ebp
sub ebp, 0x10
sub ebp, 0xaefab8
jmp 0xeefade
mov eax, 0xaefab8
add eax, ebp
add eax, 0x4c
mov ecx, 0x5da
mov edx, 0x3bc48d18
xor byte [eax], dl
inc eax
dec ecx
jne 0xeefaf5
jmp 0xeefb08
xchg ebx, eax
aad 0x93
xchg ecx, eax
and al, 0x18
sbb byte [eax], bl
cdq
fchs
sbb byte [eax], bl
sbb byte [ebx], bl
aad 0xa0
sbb al, 0x18
sbb byte [eax], bl
sbb edx, ebp
mov al, byte [0x1818181c]
mov byte [0x18181830], al
out dx, eax
cli
sbb edx, eax
xchg ebx, eax
cdq
adc al, 0x18
sbb byte [eax], bl
sbb ebx, ebp
xchg ebp, eax
jl 0xeefb6d
in al, 0x91
sbb al, 0x3c
xchg ebp, eax
jl 0xeefb74
in al, 0x91
sbb al, 0x3c
jo 0xeefb16
loop 0xeefb47
sbb byte [eax - 0x12], dh
out 0x96, eax
sbb byte [ecx], bl
xor al, 0x3c
jo 0xeefb5b
int3
in al, 0x91
xor al, 0x3c
xchg ebx, eax
hlt
xchg ebx, eax
xchg ebp, eax
or byte [eax], bl
sbb byte [eax], bl
fyl2x
int1
sbb ch, byte [ecx]
sbb bl, byte [ebx + 0x17511cda]
popfd
in al, dx
out 0xe7, eax
out 0x93, eax
xor al, 0x3c
xchg ebp, eax
jl 0xeefbc4
sbb al, 0xda
adc al, 0x18
xchg ebx, eax
xchg esp, eax
cmp al, 0x1c
sbb byte [eax], bl
sbb byte [eax - 0x28], dh
loop 0xeefb9e
sbb byte [eax - 0x12], dh
out 0x96, eax
sbb byte [ecx], bl
xor al, 0x3c
xchg ebp, eax
jl 0xeefbdf
in al, 0x91
adc al, 0x3c
invalid
sbb byte [ebx + 0x181810a5], dl
sbb byte [ebx], ch
rcr dword [ecx + 0x5fed63ea], 1
mov edi, 0xed63ea99
pop edi
mov edi, 0xf09bca2b
sbb eax, 0x569c1750
pop ss
pushfd
push esi
sbb byte [eax], bl
sbb byte [edi], dl
nop
push eax
sbb byte [eax], bl
sbb byte [esi - 0x6d], bh
xchg ebx, eax
add al, 0x21
cwde
jecxz 0xeefbe2
pop ss
pushfd
add bl, byte [eax]
sbb byte [eax], bl
cwde
jecxz 0xeefbec
pop ss
pushfd
or dword [eax], ebx
sbb byte [eax], bl
jle 0xeefb9c
jecxz 0xeefbec
cmp eax, 0x180d9c17
sbb byte [eax], bl
pop ecx
int1
aam 0xe7
out 0xe7, eax
xor dword [ecx + 0x19], edx
wait
fstp dword [0xf11cf09b]
movsd dword es:[edi], dword [esi]
out 0xe7, eax
out 0x31, eax
dec esp
and dword [edx], ebx
wait
fstp dword [esi]
wait
sbb al, 0x9b
invalid
Function at 0x401000
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.USER32.dll_LoadStringA]
push 0x64
push 0x4043c0
push 0x69
push esi
call edi
push 0x64
push 0x404428
push 0x6a
push esi
call edi
push 0x4040fc
push str.FirstWindow
call dword [sym.imp.USER32.dll_FindWindowA]
mov edi, eax
test edi, edi
je 0x40104f
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call dword [sym.imp.USER32.dll_UpdateWindow]
push esi
call fcn.00402370
add esp, 4
lea eax, [ebp - 8]
push eax
mov dword [ebp - 8], 8
mov dword [ebp - 4], 0x4000
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0
push esi
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push str.FirstWindow
push 0x4040fc
push 0
mov dword [0x4040ac], esi
call dword [sym.imp.USER32.dll_CreateWindowExA]
test eax, eax
jne 0x4010ae
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push 0
push 0
push 0
lea ecx, [ebp - 0x24]
push ecx
call esi
test eax, eax
je 0x4010ee
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
lea edx, [ebp - 0x24]
push edx
call edi
lea eax, [ebp - 0x24]
push eax
call ebx
push 0
push 0
push 0
lea ecx, [ebp - 0x24]
push ecx
call esi
test eax, eax
jne 0x4010d1
pop ebx
mov eax, dword [ebp - 0x1c]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x401ff0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x403690
push 0x4025de
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffff98
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push 2
call dword [sym.imp.MSVCRT.dll___set_app_type]
add esp, 4
mov dword [0x4044c0], 0xffffffff
mov dword [0x4044c4], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x4044bc]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov edx, dword [0x4044b8]
mov dword [eax], edx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov ecx, dword [eax]
mov dword [0x4044c8], ecx
call fcn.00401e30
mov eax, dword [0x404134]
test eax, eax
jne 0x402081
push 0x401fd0
call dword [sym.imp.MSVCRT.dll___setusermatherr]
add esp, 4
call fcn.004021b0
push 0x40400c
push 0x404008
call sub.MSVCRT.dll__initterm
add esp, 8
mov edx, dword [0x4044b4]
mov dword [ebp - 0x6c], edx
lea eax, [ebp - 0x6c]
push eax
mov ecx, dword [0x4044b0]
push ecx
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x60]
push ecx
call dword [sym.imp.MSVCRT.dll___getmainargs]
add esp, 0x14
push 0x404004
push section..data
call sub.MSVCRT.dll__initterm
add esp, 8
call dword [sym.imp.MSVCRT.dll___p__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x74], esi
cmp byte [esi], 0x22
jne 0x40218f
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x4020f5
cmp al, 0x22
jne 0x4020e7
cmp byte [esi], 0x22
jne 0x4020fe
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x40210e
cmp al, 0x20
ja 0x40210e
inc esi
mov dword [ebp - 0x74], esi
jmp 0x4020fe
mov dword [ebp - 0x30], 0
lea edx, [ebp - 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x40212f
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x402134
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x68], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
jmp 0x402174
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x20
jbe 0x4020fe
inc esi
mov dword [ebp - 0x74], esi
jmp 0x40218f
Function at 0x430db0
Capabilities:
Parse pe header

Disassembly:
mov esi, esp
mov esi, dword [esi]
add esp, 4
push 0x18
sub esi, dword [esp]
add esp, 4
push eax
mov dword [esp], 9
pop edx
mov dword [esi], edx
push ecx
add esp, 4
pop esi
push ebx
add esp, 4
pop edx
pushal
call 0x430cb5
pop ebx
mov eax, 0x500311d3
sub eax, 0x50031032
add eax, ebx
xor dword [eax], 0x78c9aed2
call 0x430db0
jmp 0x430d92
call fcn.00430cd2
push 0x86abc981
push 0x5ac18765
xor eax, eax
js 0x430e16
insb byte es:[edi], dx
imul esi, dword [eax + eax + 0x61], 0xa6e9
add byte [ebp - 0x75], dl
in al, dx
mov ebx, 0x77000000
add ebx, 0x10000
cmp ebx, 0x80000000
jne 0x430dcb
mov ebx, 0xbff00000
call fcn.00430e0f
cmp eax, 0
je 0x430db8
cmp word [ebx], 0x5a4d
jne 0x430db8
mov eax, dword [ebx + 0x3c]
add eax, ebx
cmp word [eax], 0x4550
jne 0x430db8
test byte [eax + 0x17], 0x20
je 0x430db8
mov eax, dword [eax + 0x78]
add eax, ebx
mov edx, dword [eax + 0xc]
add edx, ebx
cmp dword [edx], 0x4e52454b
jne 0x430db8
cmp dword [edx + 4], 0x32334c45
jne 0x430db8
mov eax, ebx
mov esp, ebp
pop ebp
ret
mov edx, 0x500311b8
sub edx, 0x50031192
add eax, edx
push eax
push dword fs:[0]
mov dword fs:[0], esp
mov ecx, dword [ebx]
mov ecx, 1
jmp 0x430e48
pop dword fs:[0]
pop eax
mov dword [esp + 0x1c], ecx
popal
ret
Function at 0x10001f00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 1
xor eax, eax
mov dl, byte [edi + eax + 0x3ed419b4]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0xb
jb 0x10001f11
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10001f40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 9
xor eax, eax
mov dl, byte [edi + eax - 0x7bd60ae8]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x1a
jb 0x10001f51
pop edi
mov byte [esi + 0x1a], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10001f80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 9
xor eax, eax
mov dl, byte [edi + eax - 0x1abd646a]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x28
jb 0x10001f91
pop edi
mov byte [esi + 0x28], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10002050
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x15
xor eax, eax
mov dl, byte [edi + eax + 0x43f2140e]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0xf
jb 0x10002061
pop edi
mov byte [esi + 0xf], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10002090
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x19
xor eax, eax
mov dl, byte [edi + eax + 0x1bf4bbef]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x88
jb 0x100020a1
pop edi
mov byte [esi + 0x88], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10002160
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x2d
xor eax, eax
mov dl, byte [edi + eax + 0x5d9825a0]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x25
jb 0x10002171
pop edi
mov byte [esi + 0x25], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x100021a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x34
xor eax, eax
mov dl, byte [edi + eax + 0x32593faf]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0xf
jb 0x100021b1
pop edi
mov byte [esi + 0xf], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x100021e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x36
xor eax, eax
mov dl, byte [edi + eax - 0x5023d40c]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x3b
jb 0x100021f1
pop edi
mov byte [esi + 0x3b], 0
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x10002320
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x50
xor eax, eax
mov dl, byte [edi + eax + 0x5abdd636]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0xb
jb 0x10002331
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10002360
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x5b
xor eax, eax
mov dl, byte [edi + eax - 0x416a29a2]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x25
jb 0x10002371
pop edi
mov byte [esi + 0x25], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x100024a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x70
xor eax, eax
mov dl, byte [edi + eax - 0x2a0c3c7f]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x2c
jb 0x100024b1
pop edi
mov byte [esi + 0x2c], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x100024e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x84
xor eax, eax
mov dl, byte [edi + eax - 0x49ba47c2]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x1e
jb 0x100024f1
pop edi
mov byte [esi + 0x1e], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10002520
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x89
xor eax, eax
mov dl, byte [edi + eax + 0x1af98a5a]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0xf
jb 0x10002531
pop edi
mov byte [esi + 0xf], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10002560
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x8c
xor eax, eax
mov dl, byte [edi + eax + 0x57243b52]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x10
jb 0x10002571
pop edi
mov byte [esi + 0x10], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10002610
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0xaf
xor eax, eax
mov dl, byte [edi + eax + 0x1f0ff0d2]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x23
jb 0x10002621
pop edi
mov byte [esi + 0x23], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x100026c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0xbe
xor eax, eax
mov dl, byte [edi + eax + 0x6e0053c7]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x11
jb 0x100026d1
pop edi
mov byte [esi + 0x11], 0
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x10002870
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0xe8
xor eax, eax
mov dl, byte [edi + eax + 0x3566316e]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x2a
jb 0x10002881
pop edi
mov byte [esi + 0x2a], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x100028b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0xeb
xor eax, eax
mov dl, byte [edi + eax - 0x7b6b46e5]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x20
jb 0x100028c1
pop edi
mov byte [esi + 0x20], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10002a10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0xf0
xor eax, eax
mov dl, byte [edi + eax + 0xab77782]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x17
jb 0x10002a21
pop edi
mov byte [esi + 0x17], 0
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x10005820
Capabilities:
Connect socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1013fbc4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
cmp dword [esi + 4], 0xffffffff
je 0x100058ab
push dword [ebp + 0xc]
mov eax, 2
mov word [ebp - 0x14], ax
call dword [sym.imp.WS2_32.dll_htons]
push edi
mov word [ebp - 0x12], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x10], eax
cmp eax, 0xffffffff
jne 0x10005883
push edi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x10005883
movsx ecx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
push ecx
push dword [eax]
lea eax, [ebp - 0x10]
push eax
call fcn.10016a60
add esp, 0xc
push 0x10
lea eax, [ebp - 0x14]
push eax
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x100058bf
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x100058bf
mov ecx, esi
call fcn.10005ef0
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001445f
mov esp, ebp
pop ebp
ret 8
push 0x23
push dword [esi + 8]
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
jne 0x10005918
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x100058e8
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 4], 0xffffffff
mov eax, dword [esi + 8]
test eax, eax
je 0x100058fd
push eax
call dword [sym.imp.WS2_32.dll_WSACloseEvent]
mov dword [esi + 8], 0
pop edi
mov byte [esi + 0x100038], 0
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001445f
mov esp, ebp
pop ebp
ret 8
push 0x80000
lea eax, [esi + 0xc]
push 0
push eax
call fcn.10016fe0
push 0x80000
lea eax, [esi + 0x80010]
mov dword [esi + 0x8000c], 0
push 0
push eax
call fcn.10016fe0
mov ecx, dword [ebp - 4]
add esp, 0x18
mov dword [esi + 0x100010], 0
xor ecx, ebp
mov byte [esi + 0x100038], 1
mov al, 1
pop edi
pop esi
call fcn.1001445f
mov esp, ebp
pop ebp
ret 8
Function at 0x100059d0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10030946
mov eax, dword fs:[0]
push eax
sub esp, 0x648
mov eax, dword [0x1013fbc4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x654], eax
mov eax, dword [0x10032884]
mov dword [ebp - 0x18], eax
mov ax, word [0x10032888]
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x620]
push eax
push 0x3ff
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x10005b34
lea esi, [ebp - 0x620]
nop dword [eax]
mov ax, word [esi]
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x220]
push 0x104
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x10005b20
xor eax, eax
mov dword [ebp - 0x624], 7
mov dword [ebp - 0x628], 0
mov word [ebp - 0x638], ax
cmp word [ebx], ax
je 0x10005a9f
mov eax, ebx
lea edx, [eax + 2]
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10005a90
sub eax, edx
sar eax, 1
push eax
push ebx
lea ecx, [ebp - 0x638]
call fcn.1000b180
cmp word [ebp - 0x220], 0
mov dword [ebp - 4], 0
jne 0x10005ac1
xor ecx, ecx
jmp 0x10005adf
lea ecx, [ebp - 0x220]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10005ad0
sub ecx, edx
sar ecx, 1
push ecx
push 0
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x638]
call fcn.1000bb00
mov edi, eax
cmp edi, 0xffffffff
jne 0x10005b52
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x624]
cmp eax, 8
jb 0x10005b20
inc eax
lea ecx, [ebp - 0x638]
push eax
push dword [ebp - 0x638]
call fcn.1000b4a0
nop dword [eax]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10005b20
cmp word [esi], ax
jne 0x10005a40
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001445f
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x650]
call fcn.10002d60
mov eax, dword [eax + 0x10]
lea ecx, [ebp - 0x638]
push esi
inc eax
mov byte [ebp - 4], 1
push eax
push edi
call fcn.1000d1d0
mov eax, dword [ebp - 0x63c]
cmp eax, 8
jb 0x10005b98
inc eax
lea ecx, [ebp - 0x650]
push eax
push dword [ebp - 0x650]
call fcn.1000b4a0
cmp dword [ebp - 0x624], 8
lea eax, [ebp - 0x638]
cmovae eax, dword [ebp - 0x638]
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x654]
call fcn.1001981d
mov eax, dword [ebp - 0x624]
add esp, 0xc
cmp eax, 8
jb 0x10005bdc
inc eax
lea ecx, [ebp - 0x638]
push eax
push dword [ebp - 0x638]
call fcn.1000b4a0
mov al, 1
jmp 0x10005b36
Function at 0x10005bf0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8000c
call fcn.10014470
mov eax, dword [0x1013fbc4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push edi
mov edi, ecx
mov dword [ebp - 0x80008], eax
lea ebx, [edi + 0x10001c]
push ebx
mov dword [ebp - 0x8000c], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [edi + 4], 0xffffffff
je 0x10005db3
cmp byte [edi + 0x100038], 0
je 0x10005db3
push esi
push 0x80000
lea eax, [ebp - 0x80004]
push 0
push eax
call fcn.10016fe0
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x80004]
push esi
push dword [ebp - 0x80008]
push eax
call fcn.10016a60
add esp, 0x18
cmp byte [ebp - 0x80004], 0xc1
jne 0x10005c86
push dword [ebp - 0x80002]
lea eax, [esi - 3]
push eax
lea eax, [ebp - 0x80001]
jmp 0x10005c96
push dword [ebp - 0x80001]
lea eax, [esi - 4]
push eax
lea eax, [ebp - 0x80000]
push eax
call fcn.10008ca0
mov ecx, dword [edi + 0x100010]
add esp, 0xc
test ecx, ecx
jle 0x10005cf8
lea eax, [ecx + esi]
cmp eax, 0x80000
jle 0x10005cd6
mov ecx, edi
call fcn.10005ef0
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop edi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001445f
mov esp, ebp
pop ebp
ret 8
push esi
lea eax, [ebp - 0x80004]
push eax
lea eax, [edi + 0x80010]
add eax, ecx
push eax
call fcn.10016a60
add esp, 0xc
add dword [edi + 0x100010], esi
push ebx
jmp 0x10005d29
xor ebx, ebx
test esi, esi
jle 0x10005d22
nop
push 0
push esi
lea eax, [ebp - 0x80004]
add eax, ebx
push eax
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x10005d44
sub esi, eax
add ebx, eax
test esi, esi
jg 0x10005d00
mov eax, dword [ebp - 0x8000c]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop edi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001445f
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x10005d8a
mov ecx, dword [edi + 0x100010]
lea eax, [ecx + esi]
cmp eax, 0x80000
jg 0x10005d8a
lea eax, [ebp - 0x80004]
add eax, ebx
push esi
push eax
lea eax, [edi + 0x80010]
add eax, ecx
push eax
call fcn.10016a60
add esp, 0xc
lea eax, [edi + 0x10001c]
add dword [edi + 0x100010], esi
jmp 0x10005d28
mov ecx, edi
call fcn.10005ef0
lea eax, [edi + 0x10001c]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop edi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001445f
mov esp, ebp
pop ebp
ret 8
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop ebx
call fcn.1001445f
mov esp, ebp
pop ebp
ret 8

Function at 0x10005dd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
xor eax, eax
test edx, edx
jle 0x10005dfe
push esi
mov esi, dword [ebp + 8]
mov cl, byte [0x10140b65]
add cl, 0xf
xor cl, byte [eax + esi]
sub cl, byte [0x10140b66]
add cl, 0xf
mov byte [eax + esi], cl
inc eax
cmp eax, edx
jl 0x10005de0
pop esi
pop ebp
ret
Function at 0x10005e00
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10030978
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x1013fbc4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x1013f768]
cmp eax, 0x927c0
jb 0x10005e45
call esi
mov dword [0x1013f768], eax
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 1
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x28], 0
push eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
call sub.gdiplus.dll_GdiplusStartup
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
push 0x14
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 0
push eax
mov ecx, 0x1003f39c
call fcn.1000bd10
test al, al
jne 0x10005ea8
mov esi, dword [ebp - 0x1c]
cmp esi, dword [ebp - 0x18]
jne 0x10005eb6
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.10009390
mov esi, dword [ebp - 0x1c]
push dword [ebp - 0x10]
call sub.gdiplus.dll_GdiplusShutdown
test esi, esi
je 0x10005ed1
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x1c]
sub eax, esi
push eax
push esi
call fcn.1000b440
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret