joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000760a
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
xor bl, bl
push esi
mov esi, ecx
mov dword [esp + 0xc], edx
movzx ecx, ax
shr eax, 0x10
mov dword [esp + 0x24], eax
mov eax, ebp
mov dword [esp + 0x10], ecx
push edi
sub eax, 0xa1
je 0x10007679
push 3
pop ecx
sub eax, ecx
je 0x10007672
sub eax, ecx
je 0x1000766b
sub eax, 0x15a
je 0x10007664
sub eax, ecx
je 0x1000765d
sub eax, ecx
jne 0x10007749
mov edi, 0x209
jmp 0x10007680
mov edi, 0x206
jmp 0x10007680
mov edi, 0x203
jmp 0x10007680
mov edi, 0xa9
jmp 0x1000767e
mov edi, 0xa6
jmp 0x1000767e
mov edi, 0xa3
mov bl, 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x28]
sub ecx, dword [esi + 0x550]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x14]
sub eax, dword [esi + 0x54c]
cdq
xor eax, edx
sub eax, edx
mov dword [esp + 0x18], eax
mov eax, ecx
mov ecx, dword [esp + 0x10]
cdq
xor eax, edx
sub eax, edx
mov dword [esp + 0x1c], eax
cmp dword [esi + 0x53c], ecx
jne 0x1000771b
cmp dword [esi + 0x544], ebp
jne 0x1000771b
mov eax, dword [esp + 0x24]
sub eax, dword [esi + 0x548]
cmp eax, dword [0x100468dc]
ja 0x1000771b
test bl, bl
jne 0x100076e9
push 0xffffffffffffffe6
push ecx
call dword [sym.imp.USER32.dll_GetClassLongA]
test al, 8
je 0x1000771b
cmp dword [esp + 0x18], 2
jg 0x1000771b
cmp dword [esp + 0x1c], 2
jg 0x1000771b
xor eax, eax
mov dword [esi + 0x54c], eax
mov dword [esi + 0x550], eax
mov dword [esi + 0x544], eax
mov dword [esi + 0x548], eax
mov dword [esi + 0x53c], eax
mov eax, edi
jmp 0x1000774b
mov eax, dword [esp + 0x24]
mov dword [esi + 0x548], eax
mov eax, dword [esp + 0x10]
mov dword [esi + 0x53c], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 0x54c], eax
mov eax, dword [esp + 0x28]
mov dword [esi + 0x544], ebp
mov dword [esi + 0x550], eax
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x10008102
Capabilities:
Get graphical window text
Log keystrokes

Disassembly:
push ecx
push ebx
push ebp
push esi
mov eax, ecx
mov esi, edx
push 0
push eax
mov dword [esp + 0x14], eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 1
mov ebx, eax
push ebp
push ebx
call dword [sym.imp.USER32.dll_AttachThreadInput]
push esi
push dword [esp + 0x18]
push 0xd
push dword [esp + 0x18]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebp
push ebx
mov esi, eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x10008680
Capabilities:
Hide graphical window

Disassembly:
push esi
sub esp, 0xc
mov esi, ecx
mov edx, 0x1000863c
push esi
call fcn.10003806
add esp, 0xc
xor edx, edx
mov ecx, esi
push 0
push 0
call fcn.100073b6
add esp, 0xc
mov ecx, esi
xor edx, edx
pop esi
jmp fcn.10006abd
Function at 0x100086f4
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x20
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x18]
cdq
and edx, 0xfffff
add eax, edx
sar eax, 0x14
leave
ret

Function at 0x1000871c
Capabilities:
Get cpu information
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x18]
mov dword [0x100468e0], eax
lea eax, [ebp - 4]
push eax
push 0x20119
push 0
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000877e
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x100468e4
push 0
push 0
push str.MHz
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x100468e0], 2
ja 0x100087b0
cmp dword [0x100468e4], 0x7d0
ja 0x100087b0
call fcn.100086f4
movzx ecx, byte [0x10046812]
xor edx, edx
inc edx
cmp eax, 0x258
cmovl ecx, edx
mov byte [0x10046812], cl
leave
ret
Function at 0x1000a6b4
Capabilities:
Delete file
Get socket status
Read file on windows

Disassembly:
mov eax, 0x451c
call sub.ntdll.dll__chkstk
push ebx
push ebp
push esi
mov esi, ecx
mov dword [esp + 0x10], 0x2400
xor ebx, ebx
xor ebp, ebp
mov dword [esp + 0xc], ebx
inc ebp
push edi
mov eax, dword [esi]
mov eax, dword [eax + 0x328]
test eax, eax
je 0x1000a6ed
push esi
call eax
pop ecx
cmp eax, ebp
jne 0x1000a795
or eax, 0xffffffff
cmp dword [esi + 0x7638], eax
je 0x1000a795
cmp dword [esi + 0x764c], ebp
jne 0x1000a795
mov eax, dword [esi + 0x14]
lea ecx, [esp + 0x18]
push ecx
push ebx
lea ecx, [esp + 0x28]
mov dword [esp + 0x2c], eax
push ecx
push ebx
inc eax
mov dword [esp + 0x30], ebp
push eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jle 0x1000a795
mov edi, ebx
push ebx
lea eax, [esp + 0x14]
push eax
push 0x2000
lea eax, [esp + 0x134]
push eax
push dword [esi + 0x7638]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x10]
test eax, eax
push 0xffffffffffffffff
pop eax
cmove ecx, eax
mov dword [esp + 0x10], ecx
cmp ecx, eax
je 0x1000a838
test ecx, ecx
je 0x1000a7ec
lea eax, [esp + 0x128]
cmp dword [esi + 0x763c], ebx
jne 0x1000a7a2
push eax
push ecx
push ebx
push ebx
mov dl, 5
mov ecx, esi
call fcn.1000a2a3
add esp, 0x10
inc edi
cmp edi, 0x20
jl 0x1000a735
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x451c
ret
push ecx
push eax
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x2130]
call fcn.1001d19d
pop ecx
test eax, eax
mov eax, dword [esp + 0x14]
pop ecx
jne 0x1000a7e0
cmp dword [esp + 0x14], eax
jae 0x1000a7e0
lea eax, [esp + 0x2128]
push eax
push dword [esp + 0x18]
push ebp
push ebx
mov dl, 5
mov ecx, esi
call fcn.1000a2a3
add esp, 0x10
jmp 0x1000a797
lea ecx, [esp + 0x128]
push ecx
push eax
push ebx
jmp 0x1000a7d1
mov dl, 6
push ebx
push ebx
push ebx
push ebx
mov ecx, esi
call fcn.1000a2a3
mov ecx, dword [esi + 0x7638]
add esp, 0x10
mov edi, eax
call fcn.1001cef9
or dword [esi + 0x7638], 0xffffffff
mov dword [esi + 0x764c], ebx
mov dword [esi + 0x7648], ebx
cmp dword [esi + 0x7650], ebx
je 0x1000a831
lea eax, [esi + 0x7654]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, edi
jmp 0x1000a797
mov dl, 7
jmp 0x1000a7ee
Function at 0x1000ccb5
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0x2a8]
test edi, edi
je 0x1000cd7f
cmp dword [edi + 0x2c], 0
jne 0x1000cd7f
push 0
push 0x14
lea eax, [ebp - 0x14]
push eax
push dword [esi + 0x2a4]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x1000cd78
movzx ecx, byte [ebp - 0x14]
sub ecx, 4
je 0x1000cd39
sub ecx, 1
jne 0x1000cd78
cmp eax, 6
jne 0x1000cd78
movzx ecx, word [ebp - 0x10]
movzx edx, word [ebp - 0x12]
mov esi, dword [edi]
movzx eax, cl
shl eax, 8
shr ecx, 8
or eax, ecx
push edi
push eax
movzx eax, dl
shl eax, 8
shr edx, 8
or eax, edx
push eax
movzx eax, byte [ebp - 0x13]
push eax
call dword [esi + 0x310]
add esp, 0x10
jmp 0x1000cd7f
cmp eax, 8
jne 0x1000cd78
mov ecx, dword [ebp - 0x10]
mov edx, ecx
mov esi, dword [edi]
mov eax, ecx
shr eax, 0x10
and edx, 0xff0000
or edx, eax
mov eax, ecx
and eax, 0xff00
shl ecx, 0x10
or eax, ecx
shr edx, 8
shl eax, 8
or edx, eax
movzx eax, byte [ebp - 0x13]
push edi
push edx
push eax
call dword [esi + 0x308]
add esp, 0xc
jmp 0x1000cd7f
mov ecx, esi
call fcn.1000f515
pop edi
pop esi
leave
ret
Function at 0x1000d043
Capabilities:
Get hostname

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov ecx, 0x368
mov dword [esp + 0x10], 0xff
call fcn.1001cda8
mov ecx, dword [0x10046d24]
mov ebx, eax
mov edi, dword [esp + 0x18]
xor edx, edx
inc edx
test ecx, ecx
cmove ecx, edx
mov dword [ebx + 0x180], 0x170c
xor ebp, ebp
mov dword [0x10046d24], ecx
or eax, 0xffffffff
mov dword [ebx + 0x17c], ebp
mov dword [ebx + 0x298], eax
mov dword [ebx + 0x160], eax
mov dword [ebx + 0x2a4], eax
mov dword [ebx + 0x184], eax
mov eax, dword [esp + 0x1c]
mov dword [ebx + 0x10], eax
mov eax, dword [esp + 0x28]
shl eax, 3
push ebp
mov dword [ebx + 0x2e4], ebp
mov dword [ebx + 0x2e8], ebp
mov dword [ebx + 0x294], ebp
mov dword [ebx + 0x29c], ebp
mov dword [ebx + 0x14c], ebp
mov dword [ebx + 0x2ac], ebp
mov dword [ebx + 0x2a0], ebp
mov dword [ebx + 0x2a8], ebp
mov dword [ebx + 0x18c], ebp
mov dword [ebx + 0x2d8], ebp
mov dword [ebx + 0x2dc], ebp
mov dword [ebx + 0x2e0], ebp
mov dword [ebx + 0x2c8], ebp
mov dword [ebx + 0x2cc], edx
mov dword [ebx + 8], edi
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x2c4], 0x1000cf76
mov dword [ebx + 0x33c], edx
mov dword [ebx + 0x340], ebp
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [ebx + 0x344], eax
lea eax, [esp + 0x10]
push eax
lea eax, [ebx + 0x4c]
mov dword [ebx + 0x2d4], 5
push eax
mov dword [ebx + 0x2d0], 0x32
mov dword [ebx + 0x34c], ebp
mov dword [ebx + 0x354], 3
mov dword [ebx + 0x358], 8
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
imul edi, dword [esp + 0x28]
mov ecx, ebx
mov dword [ebx + 0xc], edi
call fcn.1000cfd0
mov dword [ebx + 0x2f4], ebp
mov dword [ebx + 0x2f0], ebp
mov dword [ebx + 0x2ec], ebp
mov dword [ebx + 0x2f8], ebp
mov dword [ebx + 0x2fc], ebp
mov dword [ebx + 0x300], 0x10045c14
mov dword [ebx + 0x308], fcn.1000cef0
mov dword [ebx + 0x30c], fcn.1000cef0
mov dword [ebx + 0x310], fcn.1000cef3
mov dword [ebx + 0x314], fcn.1000cef0
mov dword [ebx + 0x318], 0x1000cf69
mov dword [ebx + 0x31c], 0x1001257c
mov dword [ebx + 0x330], 0x1000cfcd
mov dword [ebx + 0x334], ebp
mov dword [ebx + 0x360], ebp
mov dword [ebx + 0x338], ebp
mov dword [ebx + 0x364], ebp
mov ecx, ebx
call fcn.10009642
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
pop ecx
ret
Function at 0x1000ecc4
Capabilities:
Set socket configuration

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor edi, edi
mov ebp, dword [esi + 0x344]
cmp dword [esi + 0x294], edi
jne 0x1000ee37
xor ebx, ebx
inc ebx
mov dword [esi + 0x294], ebx
cmp dword [esi + 0x14c], ebx
jne 0x1000ed0d
push dword [esi + 0x164]
lea edx, [esi + 0x150]
call fcn.1000f5df
pop ecx
mov dword [esi + 0x160], eax
jmp 0x1000ee37
mov eax, dword [esi + 0x298]
cmp eax, 0xffffffff
je 0x1000ed52
push 4
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], ebx
push ecx
push ebx
push 6
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
js 0x1000ee37
mov eax, dword [esi + 0x298]
mov dword [esi + 0x194], eax
mov dword [esi + 0x190], ebx
mov dword [esi + 0x18c], eax
jmp 0x1000ee37
cmp dword [esi + 0x17c], edi
je 0x1000eda5
mov ebx, 0x170c
mov edx, ebp
mov ecx, ebx
call fcn.1000f953
mov dword [esi + 0x184], eax
cmp eax, 0xffffffff
jne 0x1000ed81
inc ebx
cmp ebx, 0x1770
jl 0x1000ed5f
jmp 0x1000ee37
mov dword [esi + 0x180], ebx
cmp ebx, 0x1770
jge 0x1000ee37
mov dword [esi + 0x194], eax
mov dword [esi + 0x190], 1
jmp 0x1000edcd
mov ecx, dword [esi + 0x180]
test ecx, ecx
jle 0x1000edd3
mov edx, ebp
call fcn.1000f953
mov dword [esi + 0x184], eax
cmp eax, 0xffffffff
je 0x1000ee37
mov dword [esi + 0x194], eax
mov dword [esi + 0x190], ebx
mov dword [esi + 0x18c], eax
mov ecx, dword [esi + 0x2a0]
test ecx, ecx
je 0x1000ee37
mov edx, ebp
call fcn.1000fa98
mov dword [esi + 0x2a4], eax
test eax, eax
js 0x1000ee37
mov ecx, dword [esi + 0x190]
test ecx, ecx
je 0x1000ee0a
lea edx, [esi + 0x194]
cmp dword [edx], eax
je 0x1000ee0a
inc edi
add edx, 4
cmp edi, ecx
jb 0x1000edfe
cmp edi, ecx
jne 0x1000ee20
cmp ecx, 0x40
jae 0x1000ee20
mov dword [esi + edi*4 + 0x194], eax
inc dword [esi + 0x190]
mov eax, dword [esi + 0x18c]
mov ecx, dword [esi + 0x2a4]
cmp ecx, eax
cmovle ecx, eax
mov dword [esi + 0x18c], ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x1000f5df
Capabilities:
Send data
Send data on socket
Set socket configuration

Disassembly:
sub esp, 0x14
push ebx
push edi
push dword [esp + 0x20]
mov edi, ecx
mov dword [esp + 0xc], 1
call fcn.1000f9ed
mov ebx, eax
pop ecx
test ebx, ebx
jns 0x1000f610
mov dword [edi + 0x294], 2
or eax, 0xffffffff
jmp 0x1000f700
push ebp
push esi
push 4
lea eax, [esp + 0x14]
push eax
push 1
push 6
push ebx
lfence
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
js 0x1000f6e7
lea eax, [edi + 0x4c]
push eax
lfence
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, dword [sym.imp.WS2_32.dll_send]
xor ebp, ebp
push 5
pop ecx
movzx eax, ax
push ebp
mov dword [esp + 0x18], eax
mov word [esp + 0x22], ax
lea eax, [esp + 0x20]
push 4
push eax
push ebx
mov word [esp + 0x2c], cx
mov byte [esp + 0x30], 1
mov dword [esp + 0x28], esi
call esi
cmp eax, 4
jne 0x1000f6e7
push ebp
push 1
lea eax, [esp + 0x28]
push eax
push ebx
lfence
call esi
cmp eax, 1
jne 0x1000f6e7
mov eax, dword [esp + 0x14]
push ebp
movzx esi, ax
lea eax, [edi + 0x4c]
push esi
push eax
push ebx
lfence
call dword [esp + 0x28]
cmp eax, esi
jne 0x1000f6e7
lfence
mov eax, dword [edi + 0x190]
test eax, eax
je 0x1000f6bc
lea ecx, [edi + 0x194]
cmp dword [ecx], ebx
je 0x1000f6bc
inc ebp
add ecx, 4
cmp ebp, eax
jb 0x1000f6b0
cmp ebp, eax
jne 0x1000f6d2
cmp eax, 0x40
jae 0x1000f6d2
mov dword [edi + ebp*4 + 0x194], ebx
inc dword [edi + 0x190]
mov eax, dword [edi + 0x18c]
cmp ebx, eax
cmovg eax, ebx
mov dword [edi + 0x18c], eax
mov eax, ebx
jmp 0x1000f6fe
lfence
push ebx
mov dword [edi + 0x294], 2
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
pop esi
pop ebp
pop edi
pop ebx
add esp, 0x14
ret

Function at 0x1000f953
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0x10
mov esi, ecx
mov dword [ebp - 4], 1
pop ecx
xor al, al
lea edi, [ebp - 0x14]
rep stosb byte es:[edi], al
push 2
pop edi
push esi
mov ebx, edx
mov word [ebp - 0x14], di
call dword [sym.imp.WS2_32.dll_htons]
push 0
push 1
push edi
mov word [ebp - 0x12], ax
mov dword [ebp - 0x10], ebx
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000f9e5
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
js 0x1000f9db
push 0x10
lea eax, [ebp - 0x14]
push eax
push esi
lfence
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
js 0x1000f9db
push 0x20
push esi
lfence
call dword [sym.imp.WS2_32.dll_listen]
test eax, eax
js 0x1000f9db
lfence
mov eax, esi
jmp 0x1000f9e8
push esi
lfence
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000f9ed
Capabilities:
Connect socket
Resolve dns

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
push 0x10
mov ebp, ecx
lea edi, [esp + 0x14]
pop ecx
xor al, al
mov esi, edx
rep stosb byte es:[edi], al
push 2
pop edi
push dword [esp + 0x24]
mov word [esp + 0x14], di
call dword [sym.imp.WS2_32.dll_htons]
push esi
mov word [esp + 0x16], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
push 0xffffffffffffffff
mov dword [esp + 0x18], eax
call dword [sym.imp.WS2_32.dll_htonl]
cmp dword [esp + 0x14], eax
jne 0x1000fa49
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x1000fa5a
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [esp + 0x14], eax
push 6
push 1
push edi
call dword [sym.imp.WS2_32.dll_socket]
mov ebx, eax
test ebx, ebx
jns 0x1000fa5f
or eax, 0xffffffff
jmp 0x1000fa90
push 0x10
lea eax, [esp + 0x14]
push eax
push ebx
lfence
call dword [sym.imp.WS2_32.dll_connect]
lfence
test eax, eax
jns 0x1000fa80
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
jmp 0x1000fa5a
lea edi, [ebp + 0x168]
mov eax, ebx
lea esi, [esp + 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x1000fa98
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0x10
mov esi, ecx
mov dword [ebp - 4], 1
pop ecx
xor al, al
lea edi, [ebp - 0x14]
rep stosb byte es:[edi], al
push 2
pop edi
push esi
mov ebx, edx
mov word [ebp - 0x14], di
call dword [sym.imp.WS2_32.dll_htons]
push 0
push edi
push edi
mov word [ebp - 0x12], ax
mov dword [ebp - 0x10], ebx
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
test esi, esi
js 0x1000fb11
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0xffff
push esi
lfence
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
js 0x1000fb11
push 0x10
lea eax, [ebp - 0x14]
push eax
push esi
lfence
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
js 0x1000fb11
lfence
mov eax, esi
jmp 0x1000fb14
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1001bc8f
Capabilities:
Encrypt data using des

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xf0
push ebx
push esi
xor esi, esi
movzx edx, byte [esi + str.80_]
mov eax, edx
and edx, 7
shr eax, 3
mov al, byte [eax + ecx]
test byte [edx*2 + 0x1003e460], al
setne al
mov byte [ebp + esi + 0x40], al
inc esi
cmp esi, 0x38
jl 0x1001bc9e
xor edx, edx
movzx eax, byte [edx + 0x1003e6d8]
lea esi, [edx + edx]
and dword [ebp + esi*4 - 0x74], 0
and dword [ebp + esi*4 - 0x78], 0
xor ecx, ecx
cmp eax, 0x1c
jge 0x1001bce7
mov bl, byte [ebp + eax + 0x40]
jmp 0x1001bceb
mov bl, byte [ebp + eax + 0x24]
mov byte [ebp + ecx + 8], bl
inc ecx
inc eax
cmp ecx, 0x1c
jl 0x1001bcdc
movzx eax, byte [edx + 0x1003e6d8]
push 0x1c
pop ecx
add eax, ecx
cmp eax, 0x38
jge 0x1001bd0d
mov bl, byte [ebp + eax + 0x40]
jmp 0x1001bd11
mov bl, byte [ebp + eax + 0x24]
mov byte [ebp + ecx + 8], bl
inc ecx
inc eax
cmp ecx, 0x38
jl 0x1001bd02
xor ecx, ecx
movzx eax, byte [ecx + 0x1003e470]
cmp byte [ebp + eax + 8], 0
je 0x1001bd37
mov eax, dword [ecx*4 + 0x1003e200]
or dword [ebp + esi*4 - 0x78], eax
movzx eax, byte [ecx + 0x1003e488]
cmp byte [ebp + eax + 8], 0
je 0x1001bd50
mov eax, dword [ecx*4 + 0x1003e200]
or dword [ebp + esi*4 - 0x74], eax
inc ecx
cmp ecx, 0x18
jl 0x1001bd1e
inc edx
cmp edx, 0x10
jl 0x1001bcc6
lea ecx, [ebp - 0x78]
call fcn.1001bd6f
pop esi
pop ebx
add ebp, 0x78
leave
ret
Function at 0x1001becf
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push ecx
push ecx
push ebx
push ebp
mov ebp, ecx
mov dword [esp + 8], 8
push esi
push edi
mov dword [esp + 0x14], ebp
mov esi, dword [ebp]
mov eax, esi
mov edx, dword [ebp + 4]
mov ebp, 0x10047540
shr eax, 4
xor eax, edx
and eax, 0xf0f0f0f
xor edx, eax
shl eax, 4
xor esi, eax
mov eax, esi
shr eax, 0x10
xor eax, edx
movzx eax, ax
xor edx, eax
shl eax, 0x10
xor esi, eax
mov eax, edx
shr eax, 2
xor eax, esi
and eax, 0x33333333
xor esi, eax
shl eax, 2
xor edx, eax
mov edi, edx
shr edi, 8
xor edi, esi
and edi, 0xff00ff
xor esi, edi
shl edi, 8
xor edi, edx
rol edi, 1
mov ebx, edi
xor ebx, esi
and ebx, 0xaaaaaaaa
xor edi, ebx
xor ebx, esi
rol ebx, 1
mov edx, edi
ror edx, 4
xor edx, dword [ebp]
lea ebp, [ebp + 0x10]
mov ecx, edx
mov eax, edx
shr ecx, 0x18
shr eax, 0x10
and ecx, 0x3f
and eax, 0x3f
mov esi, dword [ecx*4 + 0x1003df00]
or esi, dword [eax*4 + 0x1003e360]
mov eax, edx
shr eax, 8
and edx, 0x3f
and eax, 0x3f
or esi, dword [eax*4 + 0x1003e6e8]
or esi, dword [edx*4 + 0x1003e260]
mov edx, dword [ebp - 0xc]
xor edx, edi
mov ecx, edx
mov eax, edx
shr ecx, 0x18
and ecx, 0x3f
shr eax, 0x10
and eax, 0x3f
mov ecx, dword [ecx*4 + 0x1003e4d8]
or ecx, dword [eax*4 + 0x1003e000]
mov eax, edx
shr eax, 8
and edx, 0x3f
and eax, 0x3f
or ecx, dword [eax*4 + 0x1003e5d8]
or ecx, dword [edx*4 + 0x1003e100]
or ecx, esi
xor ebx, ecx
mov edx, ebx
ror edx, 4
xor edx, dword [ebp - 8]
mov ecx, edx
mov eax, edx
shr ecx, 0x18
shr eax, 0x10
and ecx, 0x3f
and eax, 0x3f
mov esi, dword [ecx*4 + 0x1003df00]
or esi, dword [eax*4 + 0x1003e360]
mov eax, edx
shr eax, 8
and edx, 0x3f
and eax, 0x3f
or esi, dword [eax*4 + 0x1003e6e8]
or esi, dword [edx*4 + 0x1003e260]
mov edx, dword [ebp - 4]
xor edx, ebx
mov ecx, edx
mov eax, edx
shr ecx, 0x18
and ecx, 0x3f
shr eax, 0x10
and eax, 0x3f
mov ecx, dword [ecx*4 + 0x1003e4d8]
or ecx, dword [eax*4 + 0x1003e000]
mov eax, edx
shr eax, 8
and edx, 0x3f
and eax, 0x3f
or ecx, dword [eax*4 + 0x1003e5d8]
or ecx, dword [edx*4 + 0x1003e100]
or ecx, esi
xor edi, ecx
sub dword [esp + 0x10], 1
jne 0x1001bf4b
ror edi, 1
mov edx, edi
mov ebp, dword [esp + 0x14]
xor edx, ebx
and edx, 0xaaaaaaaa
xor edi, edx
xor edx, ebx
ror edx, 1
mov eax, edx
shr eax, 8
xor eax, edi
and eax, 0xff00ff
xor edi, eax
shl eax, 8
xor edx, eax
mov eax, edx
shr eax, 2
xor eax, edi
and eax, 0x33333333
xor edi, eax
shl eax, 2
xor edx, eax
mov eax, edi
shr eax, 0x10
xor eax, edx
movzx eax, ax
xor edx, eax
shl eax, 0x10
xor edi, eax
mov ecx, edi
shr ecx, 4
xor ecx, edx
and ecx, 0xf0f0f0f
mov eax, ecx
shl eax, 4
xor eax, edi
xor ecx, edx
pop edi
pop esi
mov dword [ebp], eax
mov dword [ebp + 4], ecx
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x1001cd5a
Capabilities:
Create thread

Disassembly:
cmp byte [0x100475c0], 0
je 0x1001cd6c
call fcn.1001cd09
test al, al
jne 0x1001cd95
push esi
xor esi, esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_HeapCreate]
push esi
push esi
push esi
push 0x1001cc4c
push esi
push esi
mov dword [0x100475c4], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov byte [0x100475c0], 1
pop esi
ret

Function at 0x1001ce80
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
lea eax, [ebp - 0x124]
push ebx
push esi
push edi
push 0x124
xor ebx, ebx
mov edi, ecx
push ebx
push eax
call fcn.10026030
add esp, 0xc
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x1001cef2
lea eax, [ebp - 0x128]
mov dword [ebp - 0x128], 0x128
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
cmp dword [ebp - 0x120], edi
je 0x1001cee9
lea eax, [ebp - 0x128]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1001cecd
jmp 0x1001ceeb
mov bl, 1
mov ecx, esi
call fcn.1001cef9
pop edi
pop esi
mov al, bl
pop ebx
leave
ret

Function at 0x1001cf30
Capabilities:
Encode data using xor

Disassembly:
cmp byte [0x10046813], 0
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
jne 0x1001cf45
call fcn.1001cf6c
or esi, 0xffffffff
test edi, edi
je 0x1001cf64
movzx eax, byte [ebx]
xor eax, esi
shr esi, 8
movzx eax, al
xor esi, dword [eax*4 + 0x100468f0]
inc ebx
sub edi, 1
jne 0x1001cf4c
not esi
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x1001cf6c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp byte [0x10046813], 0
jne 0x1001cfaf
push esi
mov byte [0x10046813], 1
xor edx, edx
push edi
push 8
mov esi, edx
pop edi
mov ecx, esi
mov eax, esi
shr ecx, 1
mov esi, ecx
xor esi, 0xedb88320
and al, 1
cmove esi, ecx
dec edi
test edi, edi
jg 0x1001cf85
mov dword [edx*4 + 0x100468f0], esi
inc edx
cmp edx, 0x100
jl 0x1001cf80
pop edi
pop esi
ret