joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10041210
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x39
mov dword [ebp - 8], 0
jmp 0x10041232
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x10
jge 0x10041271
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x7bb6f8e8]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1004126c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10041229
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x10], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10041290
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x6b
mov dword [ebp - 8], 0
jmp 0x100412b2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 9
jge 0x100412f1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x46cbf18e]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x100412ec
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x100412a9
mov eax, dword [ebp - 0xc]
mov byte [eax + 9], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10041310
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xd4
mov dword [ebp - 8], 0
jmp 0x10041332
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 6
jge 0x10041371
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x162539dc]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1004136c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10041329
mov eax, dword [ebp - 0xc]
mov byte [eax + 6], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10041390
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xa0
mov dword [ebp - 8], 0
jmp 0x100413b2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xd
jge 0x100413f1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x2efa48c0]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x100413ec
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x100413a9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xd], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x10043a24
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1007ab3c]
jne 0x10043a2e
repz ret
jmp fcn.10043fcf

Function at 0x10045650
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x10045758
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x10045758
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x10045758
push 2
push ebx
lea eax, [ebp + 8]
push eax
push esi
call fcn.10044370
add esp, 0x10
cmp eax, 2
je 0x10045699
pop edi
pop esi
mov eax, 0x80004005
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x5a4d
cmp word [ebp + 8], ax
jne 0x1004568d
push 4
lea eax, [ebx + 0x3c]
push eax
lea eax, [ebp - 4]
push eax
push esi
call fcn.10044370
add esp, 0x10
cmp eax, 4
jne 0x1004568d
add ebx, dword [ebp - 4]
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x100456c8
mov dword [eax], ebx
push 2
lea eax, [ebx + 4]
push eax
lea eax, [ebp + 8]
push eax
push esi
call fcn.10044370
add esp, 0x10
cmp eax, 2
jne 0x1004568d
movzx eax, word [ebp + 8]
cmp eax, 0x14c
je 0x10045723
cmp eax, 0x8664
jne 0x1004568d
push 0x108
push ebx
push edi
push esi
call fcn.10044370
add esp, 0x10
cmp eax, 0x108
jne 0x1004568d
cmp dword [edi], 0x4550
mov eax, 0x40
pop edi
mov ecx, 0x80004005
pop esi
cmovne eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
push 0xf8
push ebx
push edi
push esi
call fcn.10044370
add esp, 0x10
cmp eax, 0xf8
jne 0x1004568d
cmp dword [edi], 0x4550
mov eax, 0x20
pop edi
mov ecx, 0x80004005
pop esi
cmovne eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x80070057
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6cc49a40
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, dword [0x6cc6a044]
push ebp
mov ebp, esp
push ebx
cmp eax, 0x9bf
ja 0x6cc49a8b
mov ecx, dword [eax + section..bss]
lea edx, [eax + 4]
mov dword [0x6cc6a044], edx
mov edx, ecx
mov ebx, dword [ebp - 4]
leave
shr edx, 0xb
xor edx, ecx
mov eax, edx
shl eax, 7
and eax, 0x9d2c5680
xor eax, edx
mov edx, eax
shl edx, 0xf
and edx, 0xefc60000
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
ret
cmp eax, 0x9c0
jne 0x6cc49bc7
mov ebx, dword [section..bss]
xor edx, edx
nop
and ebx, 0x80000000
mov ecx, ebx
mov ebx, dword [edx*4 + 0x6cc7f004]
mov eax, ebx
and eax, 0x7fffffff
or eax, ecx
mov ecx, eax
and eax, 1
shr ecx, 1
xor ecx, dword [edx*4 + 0x6cc7f634]
neg eax
and eax, 0x9908b0df
xor ecx, eax
mov dword [edx*4 + section..bss], ecx
add edx, 1
cmp edx, 0xe3
jne 0x6cc49aa0
movdqa xmm5, xmmword [0x6cc6d5e0]
mov eax, 0x6cc7f38c
movdqa xmm4, xmmword [0x6cc6d5f0]
movdqa xmm3, xmmword [0x6cc6d600]
nop
movdqa xmm1, xmmword [eax + 4]
add eax, 0x10
movdqu xmm0, xmmword [eax - 0x10]
pand xmm1, xmm5
pand xmm0, xmm4
por xmm1, xmm0
movdqa xmm2, xmm1
pand xmm1, xmm3
movdqa xmm0, xmm1
psrld xmm2, 1
pxor xmm2, xmmword [eax - 0x39c]
pslld xmm0, 3
paddd xmm0, xmm1
pslld xmm0, 9
paddd xmm0, xmm1
pslld xmm0, 5
paddd xmm0, xmm1
pslld xmm0, 2
psubd xmm0, xmm1
pslld xmm0, 3
psubd xmm0, xmm1
movdqa xmm6, xmm0
pslld xmm6, 4
paddd xmm0, xmm6
pslld xmm0, 5
psubd xmm0, xmm1
pxor xmm2, xmm0
movups xmmword [eax - 0x10], xmm2
cmp eax, 0x6cc7f9bc
jne 0x6cc49b00
mov ecx, dword [section..bss]
mov eax, dword [0x6cc7f9bc]
mov edx, ecx
and edx, 0x7fffffff
and eax, 0x80000000
or eax, edx
mov edx, eax
and eax, 1
shr edx, 1
xor edx, dword [0x6cc7f630]
neg eax
and eax, 0x9908b0df
xor eax, edx
mov edx, 4
mov dword [0x6cc7f9bc], eax
jmp 0x6cc49a59
xor eax, eax
xor edx, edx
lea esi, [esi]
nop
imul eax, eax, 0x7ff8a3ed
add eax, 0x2aa01d31
mov ecx, eax
rol ecx, 0x10
xor ecx, 0x31415926
mov dword [edx*4 + section..bss], ecx
add edx, 1
cmp edx, 0x270
jne 0x6cc49bd0
jmp 0x6cc49a96
Function at 0x6cc65650
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
sub esp, 4
add esp, 0x1c
ret
Function at 0x6cc66040
Capabilities:
Create thread

Disassembly:
sub esp, 0x3c
movd xmm0, dword [esp + 0x48]
mov dword [esp], 0xc
movd xmm1, dword [esp + 0x44]
punpckldq xmm1, xmm0
movq qword [esp + 0x28], xmm1
call dword [sym.imp.ucrtbase.dll_malloc]
test eax, eax
je 0x6cc660af
mov edx, dword [esp + 0x40]
movq xmm1, qword [esp + 0x28]
movq qword [eax + 4], xmm1
mov dword [eax], edx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x6cc64e80
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateThread]
sub esp, 0x18
add esp, 0x3c
ret
Function at 0x6cc695a0
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x220
mov eax, dword [0x6cc7fb00]
test eax, eax
je 0x6cc69648
mov dword [esp], ebx
call eax
sub esp, 4
test eax, eax
mov dword [ebx + 8], eax
jns 0x6cc695d8
mov eax, dword [ebx]
add esp, 0x220
pop ebx
pop esi
pop edi
ret
lea edi, [esp + 0x18]
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.MODULE
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], str.SystemRoot
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.SystemRoot
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
jmp 0x6cc695c9
mov dword [esp], str.atl100.dll
call dword [sym.imp.kernel32.dll_LoadLibraryW]
sub esp, 4
test eax, eax
je 0x6cc6967d
mov dword [esp + 4], 0x6cc7c890
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
sub esp, 8
mov dword [0x6cc7fb00], eax
test eax, eax
jne 0x6cc695ba
mov dword [ebx + 8], 0x80004002
xor eax, eax
jmp 0x6cc695cb
Function at 0x1a0f830
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x145a000]
push edi
or ebp, 0xffffffff
jmp 0x1a0f852
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1a0f859
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1a0f848
mov eax, 1
add ebx, ebx
jne 0x1a0f86b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1a0f87c
jne 0x1a0f89b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1a0f89b
dec eax
add ebx, ebx
jne 0x1a0f888
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x1a0f860
add ebx, ebx
jne 0x1a0f897
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x1a0f8ed
xor ecx, ecx
sub eax, 3
jb 0x1a0f8b3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1a0f922
sar eax, 1
mov ebp, eax
jmp 0x1a0f8be
add ebx, ebx
jne 0x1a0f8be
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1a0f88c
inc ecx
add ebx, ebx
jne 0x1a0f8cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1a0f88c
add ebx, ebx
jne 0x1a0f8d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1a0f8ce
jne 0x1a0f8ea
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1a0f8ce
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x1a0f90c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x1a0f8fe
jmp 0x1a0f84e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x1a0f90c
add edi, ecx
jmp 0x1a0f84e
pop esi
mov edi, esi
mov ecx, 0x4ca7b1
mov al, 0xe8
repne scasb al, byte es:[edi]
jne 0x1a0f947
cmp byte [edi], 0x25
jne 0x1a0f92c
mov eax, dword [edi]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
stosd dword es:[edi], eax
jmp 0x1a0f92a
lea edi, [esi + 0x15d3000]
mov eax, dword [edi]
or eax, eax
je 0x1a0f98f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2581908]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2581a38]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1a0f94d
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2581a40]
or eax, eax
je 0x1a0f989
mov dword [ebx], eax
add ebx, 4
jmp 0x1a0f96a
call dword [esi + 0x2581a3c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x1a0f9c0
cmp al, 0xef
ja 0x1a0f9b3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x1a0f995
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x1a0f9a2
mov ebp, dword [esi + 0x2581a44]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1a0f9f4
sub esp, 0xffffff80
jmp 0x92006c
Function at 0x10001000
Capabilities:
Hash data using crc32b

Disassembly:
push ebx
xor edx, edx
push edi
xor eax, eax
test dl, 1
je 0x10001010
mov eax, 0x80
mov ecx, edx
shr ecx, 1
test cl, 1
je 0x1000101c
or eax, 0x40
shr ecx, 1
test cl, 1
je 0x10001026
or eax, 0x20
shr ecx, 1
test cl, 1
je 0x10001030
or eax, 0x10
shr ecx, 1
test cl, 1
je 0x1000103a
or eax, 8
shr ecx, 1
test cl, 1
je 0x10001044
or eax, 4
shr ecx, 1
test cl, 1
je 0x1000104e
or eax, 2
test cl, 2
je 0x10001056
or eax, 1
shl eax, 0x18
mov ecx, eax
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
xor edi, edi
mov dword [esi + edx*4], ecx
mov eax, ecx
lea ecx, [edi + 0x1f]
jmp 0x10001110
test al, 1
je 0x1000111d
mov ebx, 1
shl ebx, cl
or edi, ebx
dec ecx
shr eax, 1
cmp ecx, 0xffffffff
jg 0x10001110
mov dword [esi + edx*4], edi
inc edx
cmp edx, 0xff
jle 0x10001004
pop edi
pop ebx
ret

Function at 0x10001140
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x1001e580
push eax
lea ecx, [ebp - 4]
push ecx
mov dword [esi], 0xffffffff
mov dword [ebp - 4], 0
call fcn.1000e2ee
add esp, 0xc
test eax, eax
je 0x10001171
xor al, al
mov esp, ebp
pop ebp
ret 4
push edi
push 0x400
call fcn.1000e335
mov edi, eax
add esp, 4
mov dword [ebp - 8], edi
test edi, edi
jne 0x1000119d
mov edx, dword [ebp - 4]
push edx
call fcn.1000e436
add esp, 4
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 4]
push eax
push 0x400
push 1
push edi
call fcn.1000e6f4
add esp, 0x10
test eax, eax
je 0x100011fa
push ebx
mov ecx, eax
mov edx, edi
test eax, eax
je 0x100011e1
mov edi, edi
mov eax, dword [esi]
movzx ebx, byte [edx]
mov edi, eax
and edi, 0xff
xor edi, ebx
mov ebx, dword [ebp + 8]
shr eax, 8
xor eax, dword [ebx + edi*4]
inc edx
dec ecx
mov dword [esi], eax
jne 0x100011c0
mov edi, dword [ebp - 8]
mov ecx, dword [ebp - 4]
push ecx
push 0x400
push 1
push edi
call fcn.1000e6f4
add esp, 0x10
test eax, eax
jne 0x100011b6
pop ebx
push edi
call fcn.1000e711
mov edx, dword [ebp - 4]
push edx
call fcn.1000e436
mov eax, dword [esi]
not eax
add esp, 8
mov dword [esi], eax
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x10001220
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x1001e584
push eax
lea ecx, [ebp - 4]
push ecx
mov dword [esi], 0xffffffff
mov dword [ebp - 4], 0
call fcn.1000e809
add esp, 0xc
test eax, eax
je 0x10001251
xor al, al
mov esp, ebp
pop ebp
ret 4
push edi
push 0x400
call fcn.1000e335
mov edi, eax
add esp, 4
mov dword [ebp - 8], edi
test edi, edi
jne 0x1000127d
mov edx, dword [ebp - 4]
push edx
call fcn.1000e436
add esp, 4
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 4]
push eax
push 0x400
push 1
push edi
call fcn.1000e6f4
add esp, 0x10
test eax, eax
je 0x100012da
push ebx
mov ecx, eax
mov edx, edi
test eax, eax
je 0x100012c1
mov edi, edi
mov eax, dword [esi]
movzx ebx, byte [edx]
mov edi, eax
and edi, 0xff
xor edi, ebx
mov ebx, dword [ebp + 8]
shr eax, 8
xor eax, dword [ebx + edi*4]
inc edx
dec ecx
mov dword [esi], eax
jne 0x100012a0
mov edi, dword [ebp - 8]
mov ecx, dword [ebp - 4]
push ecx
push 0x400
push 1
push edi
call fcn.1000e6f4
add esp, 0x10
test eax, eax
jne 0x10001296
pop ebx
push edi
call fcn.1000e711
mov edx, dword [ebp - 4]
push edx
call fcn.1000e436
mov eax, dword [esi]
not eax
add esp, 8
mov dword [esi], eax
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret 4

Function at 0x10001340
Capabilities:
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x10025080]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x198]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x10001379
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000e223
mov esp, ebp
pop ebp
ret
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x1002622c], eax
cmp eax, 0xffffffff
je 0x10001369
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
mov dword [0x10026230], eax
test eax, eax
je 0x10001369
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov dword [0x1012623c], 0x10002130
mov al, 1
call fcn.1000e223
mov esp, ebp
pop ebp
ret
Function at 0x100013c0
Capabilities:
Connect socket
Create thread
Encode data using xor
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10025080]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [0x1002622c], 0xffffffff
push esi
mov esi, ecx
jne 0x10001433
push 0x100
push 0
push 0x10131a00
call fcn.1000fa10
add esp, 0xc
xor eax, eax
mov cl, byte [eax + 0x1001e6b0]
sub cl, 0x1b
xor cl, 0xc
mov byte [eax + 0x10131a00], cl
inc eax
cmp eax, 0x100
jb 0x100013f2
push 0x10131a00
push 0
mov ecx, 0x101263d8
call fcn.10005150
add esp, 8
xor al, al
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1000e223
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
mov edx, 2
push eax
mov word [ebp - 0x18], dx
call dword [sym.imp.WS2_32.dll_htons]
push esi
mov word [ebp - 0x16], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x14], eax
cmp eax, 0xffffffff
jne 0x1000147b
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x1000147b
movsx ecx, word [eax + 0xa]
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
push ecx
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.1000f6a0
add esp, 0xc
mov eax, dword [0x1002622c]
push 0x10
lea edx, [ebp - 0x18]
push edx
push eax
call dword [sym.imp.WS2_32.dll_connect]
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0xffffffff
jne 0x100014db
call esi
cmp eax, 0x2733
je 0x100014db
call esi
push eax
mov eax, 2
call fcn.1000b4e0
push eax
push 0
mov ecx, 0x101263d8
call fcn.10005150
add esp, 0xc
mov esi, 0x10026228
call fcn.10001580
xor al, al
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1000e223
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [0x10026230]
mov edx, dword [0x1002622c]
push 0x23
push ecx
push edx
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
jne 0x10001500
call esi
push eax
mov eax, 3
jmp 0x100014a9
push 0x80000
push 0
push 0x10026234
call fcn.1000fa10
add esp, 0xc
push 0x80000
push 0
push 0x100a6238
mov dword [0x100a6234], 0
call fcn.1000fa10
add esp, 0xc
push 0x101316bc
push 0
push 0x10026228
push 0x10001b10
push 0
push 0
mov dword [0x10126238], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 8]
mov dword [0x1012625c], eax
xor ecx, ebp
mov byte [0x10126260], 1
mov al, 1
pop esi
call fcn.1000e223
mov esp, ebp
pop ebp
ret 4

Function at 0x10001580
Capabilities:
Terminate thread

Disassembly:
push ebx
xor ebx, ebx
cmp dword [esi + 0x100034], ebx
je 0x100015b6
mov dword [0x101316bc], 0xffffffff
mov eax, dword [esi + 0x100034]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 0x100034]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x100034], ebx
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x100015cc
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 4], 0xffffffff
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x100015dd
push eax
call dword [sym.imp.WS2_32.dll_WSACloseEvent]
mov dword [esi + 8], ebx
mov byte [esi + 0x100038], bl
pop ebx
ret
Function at 0x10001610
Capabilities:
Encode data using xor
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov esi, eax
mov eax, dword [esi + 0x8000c]
xor edi, edi
push edi
mov ecx, 0x80000
sub ecx, eax
push ecx
lea edx, [eax + esi + 0xc]
mov eax, dword [esi + 4]
push edx
push eax
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x10001697
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call edi
cmp eax, 0x2733
je 0x100017c4
push 0x100
push 0
push 0x10131a00
call fcn.1000fa10
add esp, 0xc
xor eax, eax
lea esp, [esp]
mov cl, byte [eax + 0x1001e9b0]
sub cl, 0x1b
xor cl, 0xc
mov byte [eax + 0x10131a00], cl
inc eax
cmp eax, 0x100
jb 0x10001670
call edi
push eax
push 0x10131a00
jmp 0x1000180f
add dword [esi + 0x8000c], eax
mov eax, dword [esi + 0x8000c]
cmp eax, 4
jl 0x100017c4
lea esp, [esp]
mov al, byte [esi + edi + 0xc]
lea edx, [esi + 0xc]
cmp al, 0xc1
jne 0x100016c6
movzx ebx, byte [edi + esi + 0xd]
mov cl, byte [edi + esi + 0xf]
jmp 0x100016e5
cmp al, 0xc2
jne 0x100017fe
movzx ecx, byte [edi + esi + 0xd]
shl cx, 8
movzx ebx, cx
movzx ecx, byte [edi + esi + 0xe]
or ebx, ecx
mov cl, byte [edi + esi + 0x10]
cmp ebx, 4
jl 0x100017cd
cmp ebx, 0x80000
jg 0x100017cd
cmp ebx, dword [esi + 0x8000c]
jg 0x1000179c
cmp al, 0xc1
jne 0x10001738
mov dl, byte [edi + esi + 0xe]
mov byte [ebp - 4], dl
lea edx, [ebx - 3]
xor eax, eax
lea ecx, [edi + esi + 0xf]
test edx, edx
jle 0x10001764
mov dl, byte [ecx + eax]
add dl, byte [ebp - 4]
lea ecx, [edi + esi + 0xf]
xor dl, 0xa0
mov byte [ecx + eax], dl
inc eax
lea edx, [ebx - 3]
cmp eax, edx
jl 0x1000171e
jmp 0x10001764
mov cl, byte [edi + esi + 0xf]
lea edx, [ebx - 4]
xor eax, eax
mov byte [ebp - 4], cl
lea ecx, [edi + esi + 0x10]
test edx, edx
jle 0x10001764
mov dl, byte [ecx + eax]
add dl, byte [ebp - 4]
lea ecx, [edi + esi + 0x10]
xor dl, 0xa0
mov byte [ecx + eax], dl
inc eax
lea edx, [ebx - 4]
cmp eax, edx
jl 0x1000174c
mov al, byte [ecx]
mov edx, dword [esi + 0x100014]
mov byte [ebp - 8], al
mov ecx, dword [ebp - 8]
push ebx
lea eax, [esi + edi + 0xc]
push eax
push ecx
call edx
sub dword [esi + 0x8000c], ebx
add esp, 0xc
add edi, ebx
cmp dword [esi + 0x8000c], 0
jg 0x100016b0
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
jle 0x100017c4
mov eax, dword [esi + 0x8000c]
test eax, eax
jle 0x100017c4
mov ecx, 0x80000
sub ecx, edi
cmp eax, ecx
jg 0x100017c4
push eax
lea eax, [edi + esi + 0xc]
push eax
push edx
call fcn.1000e990
add esp, 0xc
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx ecx, cl
push ecx
movzx edx, al
push ebx
push edx
mov eax, 6
call fcn.1000b4e0
push eax
push 0
mov ecx, 0x101263d8
call fcn.10005150
add esp, 0x14
call fcn.10001580
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx eax, byte [edi + esi + 0xc]
push eax
mov eax, 5
call fcn.1000b4e0
push eax
push 0
mov ecx, 0x101263d8
call fcn.10005150
add esp, 0xc
call fcn.10001580
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret