joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5dfe74
Capabilities:
Encode data using xor

Disassembly:
push edi
lea edx, [edx + 1]
mov byte [esp], cl
mov byte [esp], al
mov dword [esp + 0x30], edx
movsx dx, dl
not dh
mov edx, 0x1003dea8
mov byte [esp + 8], 0x39
call fcn.0050c1bd
loopne 0x56c456
mov al, byte [0xf3b560ba]
das
fist dword [ecx + 0x578e89]
inc esp
ficomp dword [eax - 0x27]
invalid
sbb eax, 0x3b503793
pop esi
mov dword [edi + 0x469a24da], esi
cmp ebx, dword [esi - 0x77]
mov bh, 0xda
and al, 0x9a
inc esi
out 0xef, al
adc eax, 0x7dafb4e3
invalid
mov edi, 0x94723a4e
xchg esp, eax
xor byte [ecx + edi + 0x9b77205], dh
ja 0x56c434
pop es
pop es
jle 0x56c44b
xor dword [eax + 0x4c], edi
xor dword [eax + 0x4c], edi
xlatb
stosd dword es:[edi], eax
dec edx
mov byte [ebx + 0x4a95b688], bh
inc esi
aam 0x4f
insb byte es:[edi], dx
salc
push ebx
lodsb al, byte [esi]
loopne 0x56c4af
lcall 0xc824, 0x3632710e
xchg dword [edx + 0x6eaba415], ecx
xchg dword [edi], edi
invalid
jl 0x56c430
loop 0x56c458
jl 0x56c447
invalid
pop es
scasb al, byte es:[edi]
jo 0x56c486
sub dh, 0x8c
dec ecx
cmp eax, 0xa854d883
salc
sub dword [eax - 0x2858e7a1], esi
lcall 0xb80, 0xd4ea95ac
jle 0x56c4e3
mov esp, 0x865a8c0e
xor bl, byte [edi]
and eax, 0xeef68cb2
stosb byte es:[edi], al
test eax, 0x4ed500d4
mov cr1, eax
jne 0x56c4ea
cld
daa
fidiv dword [ebx]
pop ss
mov dh, 0xc9
pop ecx
or dword [ebp + ebp*2 + 0x6123b78c], edx
add bh, byte [0x9e4f69ad]
jmp 0x56c4ad
mov edx, dword [esp + 0xc]
pushal
jmp 0x56c3da

Function at 0x5e59e6
Capabilities:
Encode data using xor

Disassembly:
adc ah, 0x7a
das
pop ebp
fsubr st(2), st(0)
inc esi
clc
pop edx
test byte [eax], ah
dec esi
cwde
inc esp
mov dh, 0x18
mov esp, 0x12234e4d
xor byte [edi], bh
mov bl, 0x9e
das
push ebp
push ebp
inc ebp
mov ecx, 0x2c883eb7
or al, 0x99
test al, 0x45
jae 0x5e59b4
imul ebx, edi, 0xc7743de1
cld
mov eax, dword [0xc299c17]
pushfd
sub dword [esp + ebx*4], ecx
pushfd
sub dword [esp + ebx*4], ecx
cld
jle 0x5e59ed
adc al, 0xa2
jle 0x5e59b0
jb 0x5e5a6b
ror dword [ecx], 1
iretd
jnp 0x5e5a9b
pop esp
aad 0x29
or ah, cl
mov esp, 0xe31a4d6f
in eax, 0x7a
sub eax, 0x4240cb05
mov es, word [esi]
pop ecx
pop ds
dec ebp
mov byte [0xc7a85ae4], al
sbb dword [edx], 0xfbf3f9dd
stosd dword es:[edi], eax
nop
mov edx, 0x2a5323ff
or eax, 0xe9833973
inc esp
pop ds
pushfd
xchg ecx, eax
xchg ebp, eax
sti
ficom word [ebx - 0x1156f91f]
cmp al, 0x1e
push ecx
ljmp 0x4c53
Function at 0x5ecc74
Capabilities:
Encode data using xor

Disassembly:
cmp dword [edi - 0x36], edi
and byte [edx], dl
movsd dword es:[edi], dword [esi]
adc eax, 0x2db0519
add edi, dword [ebx - 0x2b61cf84]
inc edx
lock sub dword [ebx], ebx
push 0xfffffffffffffffd
add eax, dword [esi]
add eax, 0x525eaad8
xor bl, byte [edi + 0x1b60342f]
arpl word [edx + ecx*8], cx
cld
push ss
or eax, dword [ecx]
inc ebx
xchg esp, eax
stosb byte es:[edi], al
rol byte [edx + esi*4], 1
outsb dx, byte [esi]
outsb dx, byte [esi]
push ebx
xor dword [edi], esp
je 0x5ecce4
sub edi, dword [edi + 0x44]
and esp, dword [esi + ebx*8]
mov dword [edi], ebp
mov edx, ecx
out 0x3b, eax
fst qword [esi]
test al, 0xc
add al, 0xc8
or eax, 0x9084ffce
and eax, 0x9bb64319
aam 0xea
popal
dec ebx
insb byte es:[edi], dx
add dl, byte [edx]
sal dword [ebx + 0x15], 1
leave
mov bl, 0xb
sbb al, 0xa1
sub al, 0xaf
adc eax, 0xa6b4f0dc
or al, 0xe1
or eax, 0xb3fd723f
dec dword [ecx]
push ebp
out 0x73, eax
or eax, 0x22573993
mov bl, 0xff
or dword [ebp - 0x19], edx
jae 0x5eccf8
xchg ebx, eax
cmp dword [edi + 0x22], edx
pop ss
sbb eax, 0x37328327
adc edx, dword [edi]
add ebx, dword [esi + 0x16]
pop esi
push ss
jg 0x5ecd69
cmp ebx, dword [edx - 0x66]
mov cs, ebx
mov al, 0xf6
push edx
invalid
xor byte [edi - 0x7a], dl
dec ecx
or dword [edi + 0x67], esi
pop edx
cmp dword [edx*2 + 0x1f8681b6], eax
invalid
jns 0x5ecd3b
dec esi
jb 0x5ecda4
sub eax, 0xca2a040
jb 0x5ecdb2
popal
daa
jne 0x5ecd75
invalid
cmp bl, byte [ebp - 0x65]
invalid
cmp cl, byte [edi]
invalid
std
sub dword [eax - 0x73], eax
add bh, byte [edx - 0x25a1964a]
or dword [eax], eax
aam 0x7d
jo 0x5ecd9c
int 0x72
sahf
stc
ret 0x4085

Function at 0x5f8ef8
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, 0x3ecf03df
leave
leave
leave
xchg dl, bh
into
mov bl, 0xa5
jne 0x5f8f64
pop ecx
push ebx
stc
jle 0x5f8f35
and dl, byte [esi - 0x28]
mov esi, 0x8402a41a
push esi
fdivr dword [esi - 0x7bfd5be6]
and bh, bl
aas
jne 0x5f8ef0
jge 0x5f8efe
push es
add byte [eax + 0x61], ah
pushal
popal
xor byte [0xb35cb34c], al
test eax, 0x68563946
or al, 0xcb
xor dword [ecx - 0x25], ecx
xchg esp, eax
scasb al, byte es:[edi]
xlatb
or eax, 0xc47e24a1
stosd dword es:[edi], eax
stc
mov ah, 0xea
mov dl, 0x14
jae 0x5f8f4c
jnp 0x5f8f4a
jle 0x5f8f0e
xor byte [edx - 0x702234e4], 0x13
add eax, 0x75aa3836
pop ebx
jecxz 0x5f8f30
mov dl, 0x1c
retf
int1
hlt
sub al, 0xcc
and eax, 0x3816df41
dec esp
pop ss
xchg edx, eax
push esi
push eax
stosb byte es:[edi], al
in al, dx
mov eax, 0x7f10b3e
shr byte [esi], cl
cmc
push ss
nop
xor al, 0x2e
inc edx
cmp al, 0xcc
jo 0x5f8ee9
invalid
and byte [ebx], dh

Function at 0x609065
Capabilities:
Encode data using xor

Disassembly:
imul edx, dword [ebx], 0xffffffdd
ja 0x609083
call 0xcbeffb25
xchg ah, dl
in eax, 0x29
and dword [esi], edi
aaa
cmp ch, byte [esi + 0x3f98bf33]
aas
fcmovu st(0), st(0)
mov cl, 7
stosd dword es:[edi], eax
xor byte [esi], 0xd8
test eax, 0xd59653f7
fsubr dword [ecx - 0x2a69ac09]
add ecx, 0xffffffcb
jo 0x60907b
insb byte es:[edi], dx
test eax, 0x769caef2
pushal
int3
Function at 0x62b4ce
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [eax - 0x78]
jl 0x62b4cd
or cl, ch
push edi
xchg ebx, eax
dec dword [ebx + 0x5dc1bbf]
add al, ch
lodsb al, byte [esi]
sar eax, 1
dec dword [ebp - 0x46af7453]
ret
dec dword [ebx - 0xcfdb8c]
je 0x62b4f9
mov esi, dword [esp + 0x30]
push dword [esp + 4]
mov dword [esp + 4], edx
add al, 0x89
push esp
and al, 4
push esp
lea esi, [esi + 1]
pushfd
mov dword [esp + 0x3c], esi
movzx esi, cl
cmp al, 0xf
mov dh, 0xf1
mov esi, 0x1000a908
pushfd
pushfd
mov esi, dword [esi + 0x2053d1]
mov byte [esp + 8], 0x13
or byte [ebx], dl
push dword [esp + 4]
pushfd
lea esi, [esi + 0x2d2dde4]
mov word [esp + 8], dx
call fcn.0064887e
pop eax
movsb byte es:[edi], byte [esi]
xchg ecx, eax
shl dword [eax + 0x3f7d833], cl
sbb eax, 0xe841db41
jae 0x62b4a4
xchg byte [edi], bh
jae 0x62b535
insd dword es:[edi], dx
daa
add esi, dword [ecx]
scasd eax, dword es:[edi]
jae 0x62b4e5
or al, 0xa8
push ss
jo 0x62b586
bnd je 0x62b585
neg byte [edi - 0x71]
push edx
pop eax
mov bp, 0xbda2
pushal
sbb al, 0x8e
shr dword [eax - 0x25], cl
cmc
mov bl, byte [esi - 0x7b459a70]
std
push ecx
push dword [edx - 0x1f59ae40]
aad 0x26
test al, 0xc
inc esi
aad 0x31
sub eax, 0xd2005a01
in eax, dx
mov bh, 0x57
pop ebx
test dword [ecx], esp
cmp ecx, dword [ebp - 0x48af7fd7]
mov eax, esi
and bl, byte [edx - 0x7a2c5845]
jp 0x62b511
invalid
pop ecx
xor dl, dl
test eax, 0x4d3afb27
jae 0x62b588
loope 0x62b5f7
retf
xchg edx, eax
js 0x62b5a0
dec esp
jb 0x62b5f9
mov bl, 0xa2
sub bh, byte [ecx]
cmpsd dword [esi], dword es:[edi]
push es
inc esi
mov byte [ecx + ecx*8], ch
ret
fsub dword [esi + 0x2003fa66]
inc eax
and al, 0xf3
stosd dword es:[edi], eax
pop esi
mov dl, 0x6c
test byte [edi + 0x2d], 0x80
invalid
daa
jo 0x62b630
mov byte ss:[edx], al
mov byte [edx], al
or eax, 0x221a014b
pushal
xchg dword [ecx], ecx
mov bl, 3
jo 0x62b5fd
dec ebx
add dword [edx], ebx
and ah, byte [eax - 0x79]
or dword [ebx - 0x370a8ffd], esi
enter 0x352e, 0x72
loopne 0x62b660
xor eax, 0xa652e072
cmpsb byte [esi], byte es:[edi]
sar byte [ebx - 0x68], 0x3e
insb byte es:[edi], dx
in eax, 0xc6
sub ah, dh
sub eax, 0x5fab1ca1
xchg edi, eax
sbb eax, 0x4f062062
popal
pop ss
jns 0x62b609
sub ah, byte [0xd9b67fa3]
out 0x8a, eax
cld
ret 0xec66
mov edx, 0xbba05e4c
cmp ah, byte [0xc8eecff]
stosb byte es:[edi], al
inc esp
cmc
and word [edi + 0x4c0003ec], dx
xchg edi, eax
in al, dx
add eax, dword [eax]
dec esp
neg dword [ebp - 0x49]
daa
ja 0x62b670
mov dl, 2
test al, 0xe4
rcr dword [ebx + 0x1939641a], 0x1e
int1
stosb byte es:[edi], al
cmp al, 0x6e
out 0xac, eax
add ah, byte [esi + 0x783720ac]
push es
mov ah, 0x4a
invalid
Function at 0x6300e2
Capabilities:
Encode data using xor

Disassembly:
add byte [ebp - 0x4d8d2e53], cl
mov cl, 0xff
xor al, 0x24
mov bl, 0xc7
jns 0x63008c
cmp dword [0x29f54327], ecx
pop ebx
mov bh, 0xf4
rcl dword [edi - 0x3c], 0xf7
push esp
sub ebp, esi
inc eax
mov gs, word [edx]
and dword [edi + 0x71], 0xffffffad
clc
sub al, byte [ebx - 0x7528e99]
out 0x42, al
ja 0x63004f
push esi
mov dl, byte [esi - 0x79]
pushal
jg 0x6300ed
or al, 0x48
mov byte [bx], cl
xchg cl, bl
int 0xc3
sub dl, byte [0xfb51f553]
lds ebx, [ecx]
xchg esp, eax
push ecx
and ebx, dword [ecx - 0x63]
dec ebx
out dx, eax
out 0x24, eax
cmp eax, 0x54f81c29
sbb al, 0xf8
clc
push esp
mov bh, 0xf0
cmp byte [edx], al
xlatb
add byte [esi], 0xda
jno 0x630096
dec ebx
xchg esp, eax
inc edx
sahf
add ebx, dword [ecx]
imul edi, dword [eax + ebx*4 - 0xc], 0x4aadfa96
or esp, ebx
jnp 0x630118
mov ecx, 0x339adc8b
mov ebx, esp
loop 0x630151
adc byte [edi + edx*4], dh
jno 0x630116
dec ecx
push ds
push eax
loopne 0x6300ad
and eax, 0x7c39982e
mov al, 0xc8
pop ds
and dword [ebx + edi*8 + 0x3e], edi
adc byte [edx], 0xd
sti
adc byte ds:[edx], 0xd
xor edi, dword [edi - 0x41214090]
pop edx
mul byte [eax + 0x72]
fidivr word [esi + 0x7260f65a]
mov al, 0xdc
movsd dword es:[edi], dword [esi]
mov dword [edi + 0x1d], edx
jg 0x6300dc
call 0x6bc12fa8
aad 0xbc
jns 0x630143
sbb dh, dl
sti
loop 0x6300db
mov ebp, 0x628b585f
invalid
leave
pop edi
imul ecx, ebp, 0x9d343eb3
inc ecx
mov esi, 0x2a8a4ef8
inc ecx
add al, 0xb4
cmp edx, esp
in eax, dx
pop es
jno 0x630198
push 0x2c
push edx
jge 0x63019b
test edi, edi
pop eax
popfd
mov bl, 0x2f
shl dword [edx], 9
cdq
popal
xchg ecx, eax
and dh, byte [ebp - 0x6af79c17]
mov al, 0xb2
movsd dword es:[edi], dword [esi]
mov dl, 0xa5
xlatb
loope 0x6301bd
cmp esi, dword [ebp + 0x30b71369]
push cs
jae 0x630121
shl edx, 0x90
xchg ebx, eax
arpl word [ecx - 0x3c], sp
cmp al, 3
test byte [ebp - 0x20d309d8], 0xdc
das
enter 0xffffffffffffa4f6, 0x1a
sti
lds ebx, [ecx]
jl 0x630173
sbb dword [eax + ebx*8 + 0x2f], edi
das
xchg edx, eax
arpl dx, ax
mov word [esp + edx - 0x1372f4c6], gs
or al, 0x4f
xchg dword [eax + 0x2294ca6e], edx
inc byte [esp + edi + 0x490d3b31]
aas
xchg ebx, eax
adc byte [ebx], ch
fst qword [eax - 0x1d]
cmp ecx, dword [0x10933f49]
sub ebx, ebp
push eax
jecxz 0x6301bc
push dword [ebp - 0x6bdeccd4]
mov ch, 0x2c
xor esp, dword [ecx]
xchg esp, eax
push edx
sub dword [ebx + 0x45], ebx
loopne 0x6301b2
pop esp
clc
dec edi
clc
jp 0x6301cc
mov dword [0x56800a34], eax
aam 0x70
or esp, dword [ebp - 0x1e]
pop edi
ret 0x8a51

Function at 0x634c96
Capabilities:
Encode data using xor

Disassembly:
mov bh, 0xa1
test dword [ebp - 0x4bf77eb2], esi
inc ebx
in al, dx
out 0xc0, al
xchg al, dh
cmp al, 0x42
xchg ebp, eax
stosd dword es:[edi], eax
sal ecx, 1
jbe 0x634cdc
cmp dh, byte [edi]
outsd dx, dword [esi]
push ds
or dword [esi + 0xd], ebx
pop ebx
adc bl, dh
invalid
cli
stc
lahf
fadd dword [edi - 0x61e72ec1]
rol dword [esi], 0x45
xor eax, 0x26a14f09
pop edx
pop edx
mov ch, 0x13
jge 0x634ccc
lcall 0x5cd2, 0xe450175f
or al, 0xb1
div dword [0x81422d7a]
xchg ebx, eax
xchg dword [ecx - 0x20], eax
dec edi
xchg ecx, eax
Function at 0x65b4ae
Capabilities:
Encode data using xor

Disassembly:
popfd
mov bh, 0x81
insb byte es:[edi], dx
pop edi
arpl bp, ax
nop
aam 4
retf
ficom dword [esi]
mov dword [ebx - 0x742d2fe3], 0xbb1ecc62
mov ecx, 0x28bb59b5
loope 0x65b499
dec eax
sbb byte [edi - 0x33fd920e], cl
stosb byte es:[edi], al
xchg ebp, esi
xlatb
xor dword [0x6fc4d8d8], 0xffffff8f
cli
imul ebx, dword [edx + 0x7e601bef], 0x12
mov esp, 0x82d246f2
dec esp
invalid

Function at 0x65b7c0
Capabilities:
Encode data using xor

Disassembly:
je 0x65b7ee
outsd dx, dword [esi]
mov cl, 0xc4
stc
add byte [edi - 0x5d], cl
mov ch, 0x98
dec ebp
mov byte [0x4eff2395], al
mov dword [0xa24d98b5], eax
xchg ebp, eax
and edi, edi
dec esi
push edx
jns 0x65b779
lcall 0xde1b, 0x512c6e04
mov byte [0x8daab014], al
dec eax
sub cl, byte [eax - 0x43]
fild dword [edi]
loope 0x65b774
popfd
mov eax, esi
das
test al, 0x8c
mov ah, 0xf8
imul esp, edx, 0xabb6161f
fmul st(3)
adc al, 0x8d
bound eax, qword [ecx + 0x57]
sub dword [ecx - 0x4354de6c], 0xc6bde7a6
adc bh, bl
fild qword [0xd245642a]
fild qword [0xd245642a]
mov esi, 0x7050acc1
add edi, 0xaa91b6b5
mov dh, 0x91
stosb byte es:[edi], al
sub ch, ch
xor eax, 0x6edbcbb3
stc
push esp
sal byte [edi], 1
pop eax
xchg esi, eax
insb byte es:[edi], dx
xor dword [ebx - 0x1e], eax
and byte [ecx - 0xc5a4c55], 0x4d
insb byte es:[edi], dx
jne 0x65b7db
call [edi + 0x5a]
call [edi + 0x5a]
dec esp
jecxz 0x65b77e
jne 0x65b7cf
pushfd
mov dword [ebp + 0x61c5cbd4], ecx
adc edx, dword [edi]
mov cl, 0xac
sbb edi, dword [ecx - 0x24b5341b]
movsb byte es:[edi], byte [esi]
ret
Function at 0x684e16
Capabilities:
Encode data using xor

Disassembly:
out 0x56, eax
xor dword [edi + 0x2eb0f0d0], esi
sal al, 1
mov al, 0x2e
sal al, 1
mov al, 0x2e
pushfd
pushfd
repne scasb al, byte es:[edi]
push 0x7e920982
mov word [esp + 0xc], ax
lea esp, [esp + 0x30]
jne 0x67361a
call fcn.00678ba4
add byte [eax], al
insd dword es:[edi], dx
cmp eax, 0xffff
inc edi
je 0x684e94
imul ebp, dword [esi + 0x64], 0x6554776f
js 0x684eba
push edi
add byte [eax + 0x73], bh
sub byte [esi + eax*2 - 0x7b1f7d69], ch
jle 0x684e12
add ecx, dword [esi + eax*8 - 0x5216530f]
xor byte [eax + 0x67], 0x1e
mov es, word [ebx]
inc eax
invalid
jmp 0x67d8d10a
pop ebp
mov cl, 0xc7
sbb edi, dword [0xce2142f7]
jl 0x684e33
test dword [edx + 0x21], 0x8a997cce
sub eax, 0x358eed26
mov ch, byte [0x358eed26]
imul esi, edi, 0xe056a71d
pop eax
mov eax, dword [0xcc8f5e2c]
fist word [ebp - 0x20]
jbe 0x684edd
invalid
stosd dword es:[edi], eax
scasb al, byte es:[edi]
lea ecx, [ebx]
inc esi
pop ds
jb 0x684e58
ror byte [ecx - 5], 0x32
xchg ebx, eax
mov eax, 0xc97fc3f3
sbb al, 0xa0
cdq
stc
mov dh, 0x18
pop edi
and eax, 0xf06f1ff0
ja 0x684e8f
pop es
test dword [eax - 0x30d80a8d], esp
mov bh, 0x6f
invalid
sub ecx, dword [edi - 0x1f]
pop ebp
loop 0x684eb6
rcr dword gs:[esi], 0x8c
mov ebx, 0x54668ec4
push edi
sti
jbe 0x684f28
in al, 0xd4
mov dh, 0x7e
xor dword [ebx - 0x365075], esp
and eax, 0x92a52f8b
jno 0x684eab
inc ebp
mov cl, 0xdb
in eax, 0x3f
and dword [0x9bb4bb37], 0x70a08925
inc esi
not edi
jae 0x684f33
fcmovu st(0), st(4)
dec edx
mov ch, 0xe5
sbb ebx, dword [ebp + 0x608ce94b]
pop eax
xchg edi, eax
invalid
scasd eax, dword es:[edi]
or edx, dword [ebx - 0x51d6cf7e]
xchg esi, eax
pop eax
and al, 0x28
Function at 0x10011fc
Capabilities:
Resolve dns
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40c
cmp byte [ebp + 0x10], 0
mov eax, dword [0x10030bc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.WS2_32.dll_getnameinfo]
push edi
mov dword [ebp - 4], eax
mov byte [ebp - 0x409], 0
mov edi, 0x401
je 0x1001262
push 4
push 0
push 0
push edi
lea eax, [ebp - 0x408]
push eax
push dword [ebp + 0xc]
push ebx
call esi
test eax, eax
jne 0x1001262
lea eax, [ebp - 0x408]
push eax
push 0x273a
push 1
mov byte [ebp - 0x409], 1
call fcn.01001189
add esp, 0xc
push 2
push 0
push 0
push edi
lea eax, [ebp - 0x408]
push eax
push dword [ebp + 0xc]
push ebx
call esi
test eax, eax
pop edi
pop esi
pop ebx
je 0x1001293
push 0x2724
push 1
call fcn.01001189
pop ecx
pop ecx
push 1
call dword [sym.imp.msvcrt.dll_exit]
cmp byte [ebp - 0x409], 0
lea eax, [ebp - 0x408]
push eax
je 0x10012aa
push 0x2710
jmp 0x10012af
push 0x273d
push 1
call fcn.01001189
mov ecx, dword [ebp - 4]
add esp, 0xc
call fcn.01001ead
leave
ret 0xc

Function at 0x1001404
Capabilities:
Resolve dns

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 0x18]
push esi
mov esi, dword [sym.imp.WS2_32.dll_getaddrinfo]
push edi
push 8
mov byte [eax], 0
pop ecx
xor eax, eax
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x20]
push eax
push 0
push dword [ebp + 0xc]
mov dword [ebp - 0x20], 4
call esi
test eax, eax
jne 0x100148a
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov edx, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
mov dword [edx], ecx
mov ecx, dword [eax + 0x10]
mov esi, dword [eax + 0x18]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
cmp byte [ebp + 0x20], 0
rep movsb byte es:[edi], byte [esi]
je 0x1001487
push 4
push 0
push 0
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [eax + 0x10]
push dword [eax + 0x18]
call dword [sym.imp.WS2_32.dll_getnameinfo]
mov eax, dword [ebp + 8]
push eax
jmp 0x10014de
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x20]
push eax
push 0
push dword [ebp + 0xc]
mov dword [ebp - 0x20], 2
call esi
test eax, eax
jne 0x10014e8
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x10]
mov ecx, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
mov dword [ecx], eax
mov ecx, dword [edx + 0x10]
mov esi, dword [edx + 0x18]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [edx + 0x14]
test ecx, ecx
jne 0x10014d0
mov ecx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x18]
mov al, byte [ecx]
inc ecx
mov byte [esi], al
inc esi
test al, al
jne 0x10014d3
push edx
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov al, 1
jmp 0x10014ea
xor al, al
pop edi
pop esi
leave
ret 0x1c
Function at 0x10014f5
Capabilities:
Resolve dns

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push edi
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x20]
push eax
push 0
push dword [ebp + 0xc]
mov dword [ebp - 0x20], 1
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x1001530
xor eax, eax
jmp 0x100154f
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov edi, dword [ebp + 0x10]
push esi
mov esi, dword [eax + 0x18]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
xor eax, eax
rep movsb byte es:[edi], byte [esi]
inc eax
pop esi
pop edi
leave
ret 0xc
Function at 0x1001fc5
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x28
push 0x1001100
call fcn.0100217c
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x1002000
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002000
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x1002018
cmp eax, 0x20b
je 0x1002005
mov dword [ebp - 0x1c], edi
jmp 0x100202c
cmp dword [ecx + 0x84], 0xe
jbe 0x1002000
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x1002026
cmp dword [ecx + 0x74], 0xe
jbe 0x1002000
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x1004364], 0xffffffff
or dword [0x1004368], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x10040ec]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x10040e8]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x100436c], eax
call fcn.01002172
cmp dword [0x10030c0], edi
jne 0x1002087
push fcn.01002172
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.0100215b
push 0x1003010
push 0x100300c
call sub.msvcrt.dll__initterm
mov eax, dword [0x10040e4]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x10040e0]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x34], eax
push 0x1003008
push section..data
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x20]
mov ecx, dword [sym.imp.msvcrt.dll___initenv]
mov dword [ecx], eax
push dword [ebp - 0x20]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.01001591
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x1c], edi
jne 0x10020fe
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x1002133
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.010021b7
ret
Function at 0x10025ee
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
and dword [esi + 0x14], 0
cmp dword [ebp + 8], 0
je 0x1002605
mov eax, dword [esi + 0xc]
jmp 0x1002607
xor eax, eax
push esi
push 0x100fa9d
push eax
movzx eax, word [esi + 0x1c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.USER32.dll_CreateDialogParamA]
push 1
push eax
mov dword [esi + 8], eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
cmp dword [esi + 8], eax
pop esi
setne al
pop ebp
ret 4

Function at 0x1004ce9
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x130
push ebx
push esi
push edi
mov eax, dword [0x1018120]
mov esi, 0x1001548
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov dword [ebp - 4], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x130]
push eax
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x1004d6b
cmp eax, esi
jge 0x1004d6b
lea eax, [ebp - 0x18]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1004d30
lea edi, [ebp - 0x130]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1004d40
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
push 0
mov ecx, eax
push 0
lea eax, [ebp - 0x130]
push eax
push dword [ebx + 8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.01014af3
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01012c8d
leave
ret

Function at 0x10052cb
Capabilities:
Get number of processors

Disassembly:
mov eax, 0x1014ddd
call fcn.01012f88
push ecx
push ebx
push esi
push dword [ebp + 8]
mov esi, ecx
push dword [ebp + 0x18]
mov dword [ebp - 0x10], esi
call fcn.0100252c
xor ebx, ebx
mov dword [ebp - 4], ebx
push 0x64
push ebx
lea ecx, [esi + 0x20]
mov dword [esi], 0x1001570
call sub.wbemcomn.dll_public:_void___thiscall_CFlexArray::constructor_int__int_
mov byte [ebp - 4], 1
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x48], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x54], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x58], eax
xor eax, eax
cmp dword [ebp + 0x18], 0x7e
mov dword [esi + 0x30], ebx
sete al
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov byte [esi + 0x3c], bl
mov dword [esi + 0x44], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], 1
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x50], eax
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x14