joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001dd2f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x1003f228]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1001dd6f
cmp byte [ebx], 0xa
jne 0x1001dd6f
or byte [edi + eax + 0x28], 4
jmp 0x1001dd74
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x1001de73
mov dl, byte [eax]
cmp dl, 0x1a
je 0x1001de56
inc eax
cmp dl, 0xd
je 0x1001dda0
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x1001ddc6
cmp eax, ecx
jae 0x1001ddd4
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x1001dd88
jmp 0x1001de73
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1001de51
cmp dword [ebp - 0x10], 0
je 0x1001de51
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x1003f228]
test byte [eax + edi + 0x28], 0x48
je 0x1001de2b
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x1001de16
mov byte [esi], dl
jmp 0x1001de27
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x1003f228]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x1001de73
cmp byte [ebp - 1], 0xa
jne 0x1001de3a
cmp esi, ebx
jne 0x1001de3a
mov byte [esi], 0xa
jmp 0x1001de72
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.1001e8b5
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x1001de73
mov byte [esi], 0xd
jmp 0x1001de72
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x1003f228]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x1001de70
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x1001de73
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x1001de7c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x1003f228]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1001dec2
cmp word [ebx], dx
jne 0x1001dec2
or byte [eax + edi + 0x28], 4
jmp 0x1001dec7
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x1001e02a
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x1001e00a
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x1001df08
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x1001df3e
cmp eax, edx
jae 0x1001df4c
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x1001dee3
jmp 0x1001e02a
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1001e005
cmp dword [ebp - 0x18], 0
je 0x1001e005
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x1003f228]
test byte [eax + edi + 0x28], 0x48
je 0x1001dfdb
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x1001df9f
mov word [esi], cx
jmp 0x1001dfd6
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x1003f228]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x1003f228]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x1003f228]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x1001e02a
pop eax
cmp word [ebp - 4], ax
jne 0x1001dfeb
cmp esi, ebx
jne 0x1001dfeb
mov word [esi], ax
jmp 0x1001e027
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.1001e8b5
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x1001e02a
push 0xd
pop eax
jmp 0x1001dfe6
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x1003f228]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x1001e024
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x1001e02a
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10022c30
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10022ccd
push ebx
push esi
call fcn.10022bf9
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10021a1a
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10022c7a
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10022ccc
push edi
push eax
call fcn.1001ea96
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10022c9a
call fcn.1001b66c
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10022ccb
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10021a1a
add esp, 0x20
test eax, eax
jne 0x10022cb9
push edi
call fcn.1001b66c
jmp 0x10022cc1
push ebx
call fcn.1001b66c
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10024f4a
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.10019cbc
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10024fb9
cmp esi, dword [ebp - 4]
je 0x10024fb4
cmp dword [ebp + 0xc], 0
je 0x10024fb4
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10024f91
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.10024a9c
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x10024fbb
xor eax, eax
inc eax
jmp 0x10024fbb
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x10025020
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1003a1c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.10019cbc
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.10019cbc
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x10025097
cmp word [ecx], dx
je 0x10025097
mov eax, dword [0x100324dc]
push edi
dec eax
push eax
push 0x100323c8
call fcn.10024fbf
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x1002510a
cmp word [eax], dx
je 0x1002510a
mov eax, dword [edi]
test eax, eax
je 0x100250bb
cmp word [eax], dx
je 0x100250bb
lea eax, [ebp - 0x10]
push eax
call fcn.100249a2
jmp 0x100250c4
lea eax, [ebp - 0x10]
push eax
call fcn.10024a3d
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x10025134
mov eax, dword [0x100323c4]
push dword [ebp - 0x14]
dec eax
push eax
push 0x100320b8
call fcn.10024fbf
add esp, 0xc
test al, al
je 0x10025134
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x100250ff
cmp word [eax], di
je 0x100250ff
lea eax, [ebp - 0x10]
push eax
call fcn.100249a2
pop ecx
jmp 0x10025136
lea eax, [ebp - 0x10]
push eax
call fcn.10024a3d
jmp 0x100250fc
mov eax, dword [edi]
test eax, eax
je 0x10025121
cmp word [eax], dx
je 0x10025121
lea eax, [ebp - 0x10]
push eax
call fcn.10024957
pop ecx
jmp 0x10025134
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x100251ff
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.10024e44
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x100251ff
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x100251ff
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x100251ff
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1002518c
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.1001bf19
test ebx, ebx
je 0x100251fa
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.1001bf19
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100251ff
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100251ff
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.10029574
add esp, 0x10
xor eax, eax
inc eax
jmp 0x10025201
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000e4c4
leave
ret
Function at 0x10029f21
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.10029e9d
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x1002a090
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x1002a090
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x1002a045
jg 0x10029f7d
test eax, eax
je 0x1002a03b
push 1
push 0x1000
call fcn.1001b8e2
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x10029fa0
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1002a032
push 0x8000
push ebx
call fcn.10029dce
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x10029fc9
jg 0x10029fc4
cmp ecx, 0x1000
jb 0x10029fc9
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.1001d0e9
add esp, 0x10
cmp eax, 0xffffffff
je 0x1002a00e
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x10029fc4
jl 0x10029ff5
test ecx, ecx
jne 0x10029fb6
push dword [ebp - 0xc]
push ebx
call fcn.10029dce
push esi
call fcn.1001b66c
add esp, 0xc
xor ebx, ebx
jmp 0x1002a09e
cmp byte [edi + 0x24], 0
je 0x1002a025
cmp dword [edi + 0x20], 5
jne 0x1002a025
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x1002a030
mov ebx, dword [edi + 0x18]
jmp 0x1002a032
xor ebx, ebx
push esi
call fcn.1001b66c
pop ecx
jmp 0x1002a09e
test ecx, ecx
jg 0x1002a007
jl 0x1002a045
test eax, eax
jae 0x1002a007
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1001e8b5
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x1002a065
cmp byte [edi + 0x1c], 0
je 0x1002a007
jmp 0x1002a096
push ebx
call fcn.10025719
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1002a007
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1002a09e
cmp byte [edi + 0x1c], 0
je 0x1002a09b
mov ebx, dword [edi + 0x18]
jmp 0x1002a09e
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.1001e8b5
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1002b0e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1002b10d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002b10d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401258
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
and dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0x237
cmp dword [ebp - 0x18], 0x1f2d
jle 0x40132a
lodsb al, byte [esi]
pushfd
ret
mov dword [ebp - 0xc], 0x1f
jmp 0x40133a
mov eax, dword [ebp - 0xc]
dec eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jl 0x401410
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
shl eax, cl
and eax, dword [ebp + 8]
je 0x401357
mov byte [ebp - 1], 1
jmp 0x40135b
mov byte [ebp - 1], 0
mov al, byte [ebp - 1]
mov byte [ebp - 3], al
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
shl eax, cl
and eax, dword [ebp + 0xc]
je 0x401374
mov byte [ebp - 2], 1
jmp 0x401378
mov byte [ebp - 2], 0
mov al, byte [ebp - 2]
mov byte [ebp - 4], al
movzx eax, byte [ebp - 3]
movzx ecx, byte [ebp - 4]
and eax, ecx
je 0x401390
and dword [ebp - 0x14], 0
jmp 0x40139d
movzx eax, byte [ebp - 3]
movzx ecx, byte [ebp - 4]
or eax, ecx
mov dword [ebp - 0x14], eax
mov al, byte [ebp - 0x14]
mov byte [ebp - 5], al
mov eax, dword [ebp - 0x10]
shl eax, 1
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1c], 0x11d
cmp dword [ebp - 0x1c], 0x2385
jle 0x401401
movzx eax, byte [ebp - 5]
or eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
jmp 0x401333
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x10001080
Capabilities:
Hash data using crc32b

Disassembly:
push ebx
xor edx, edx
push edi
xor eax, eax
test dl, 1
je 0x10001090
mov eax, 0x80
mov ecx, edx
shr ecx, 1
test cl, 1
je 0x1000109c
or eax, 0x40
shr ecx, 1
test cl, 1
je 0x100010a6
or eax, 0x20
shr ecx, 1
test cl, 1
je 0x100010b0
or eax, 0x10
shr ecx, 1
test cl, 1
je 0x100010ba
or eax, 8
shr ecx, 1
test cl, 1
je 0x100010c4
or eax, 4
shr ecx, 1
test cl, 1
je 0x100010ce
or eax, 2
test cl, 2
je 0x100010d6
or eax, 1
shl eax, 0x18
mov ecx, eax
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
xor edi, edi
mov dword [esi + edx*4], ecx
mov eax, ecx
lea ecx, [edi + 0x1f]
jmp 0x10001190
test al, 1
je 0x1000119d
mov ebx, 1
shl ebx, cl
or edi, ebx
dec ecx
shr eax, 1
cmp ecx, 0xffffffff
jg 0x10001190
mov dword [esi + edx*4], edi
inc edx
cmp edx, 0xff
jle 0x10001084
pop edi
pop ebx
ret

Function at 0x100011c0
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x1001b018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push 0x10016670
push eax
lea eax, [ebp - 0x408]
push eax
or esi, 0xffffffff
mov dword [ebp - 0x408], 0
call dword [sym.imp.MSVCR100.dll__wfopen_s]
add esp, 0xc
test eax, eax
je 0x10001212
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10012844
mov esp, ebp
pop ebp
ret 8
push ebx
push edi
mov ecx, dword [ebp - 0x408]
push ecx
push 0x400
lea edx, [ebp - 0x404]
push 1
push edx
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
mov ecx, eax
lea edx, [ebp - 0x404]
test eax, eax
je 0x1000125a
mov edi, edi
movzx ebx, byte [edx]
mov edi, esi
and edi, 0xff
xor edi, ebx
mov ebx, dword [ebp + 8]
shr esi, 8
xor esi, dword [ebx + edi*4]
inc edx
dec ecx
jne 0x10001240
cmp eax, 0x400
je 0x10001214
mov eax, dword [ebp - 0x408]
push eax
call dword [sym.imp.MSVCR100.dll_fclose]
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
mov eax, esi
pop ebx
xor ecx, ebp
not eax
pop esi
call fcn.10012844
mov esp, ebp
pop ebp
ret 8
Function at 0x100014b0
Capabilities:
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x1001b018]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x198]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x100014e9
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10012844
mov esp, ebp
pop ebp
ret
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x10020e74], eax
cmp eax, 0xffffffff
je 0x100014d9
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
mov dword [0x10020e78], eax
test eax, eax
je 0x100014d9
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov dword [0x10120e84], 0x10002f90
mov al, 1
call fcn.10012844
mov esp, ebp
pop ebp
ret

Function at 0x10001530
Capabilities:
Connect socket
Create thread
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1001b018]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [0x10020e74], 0xffffffff
push esi
mov esi, ecx
jne 0x1000157c
push 0x10020060
call fcn.1000f740
add esp, 4
push eax
push 0
mov ecx, 0x10121080
call fcn.10007010
add esp, 8
xor al, al
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10012844
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp + 8]
mov eax, 2
push ecx
mov word [ebp - 0x18], ax
call dword [sym.imp.WS2_32.dll_htons]
push esi
mov word [ebp - 0x16], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x14], eax
cmp eax, 0xffffffff
jne 0x100015c4
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x100015c4
movsx edx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
push edx
push ecx
lea edx, [ebp - 0x14]
push edx
call sub.MSVCR100.dll_memcpy
add esp, 0xc
mov ecx, dword [0x10020e74]
push 0x10
lea eax, [ebp - 0x18]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_connect]
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0xffffffff
jne 0x10001628
call esi
cmp eax, 0x2733
je 0x10001628
call esi
push eax
push 0x10020160
call fcn.1000f740
add esp, 4
push eax
push 0
mov ecx, 0x10121080
call fcn.10007010
add esp, 0xc
mov esi, 0x10020e70
call fcn.100016c0
xor al, al
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10012844
mov esp, ebp
pop ebp
ret 4
mov edx, dword [0x10020e78]
mov eax, dword [0x10020e74]
push 0x23
push edx
push eax
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
jne 0x1000164c
call esi
push eax
push 0x10020260
jmp 0x100015f3
push 0x80000
push 0
push 0x10020e7c
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x80000
push 0
push 0x100a0e80
mov dword [0x100a0e7c], 0
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x1012c0dc
push 0
push 0x10020e70
push 0x10001bf0
push 0
push 0
mov dword [0x10120e80], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 8]
mov dword [0x10120ea4], eax
mov al, 1
xor ecx, ebp
mov byte [0x10120ea8], al
pop esi
call fcn.10012844
mov esp, ebp
pop ebp
ret 4
Function at 0x10001750
Capabilities:
Encode data using xor
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov esi, eax
mov eax, dword [esi + 0x8000c]
xor edi, edi
push edi
mov ecx, 0x80000
sub ecx, eax
push ecx
lea edx, [eax + esi + 0xc]
mov eax, dword [esi + 4]
push edx
push eax
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x100017a0
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call edi
cmp eax, 0x2733
je 0x100018ca
call edi
push eax
push 0x10020360
jmp 0x10001912
add dword [esi + 0x8000c], eax
mov eax, dword [esi + 0x8000c]
cmp eax, 4
jl 0x100018ca
mov al, byte [esi + edi + 0xc]
lea edx, [esi + 0xc]
cmp al, 0xc1
jne 0x100017cb
movzx ebx, byte [edi + esi + 0xd]
mov cl, byte [edi + esi + 0xf]
jmp 0x100017ea
cmp al, 0xc2
jne 0x10001907
movzx ecx, byte [edi + esi + 0xd]
shl cx, 8
movzx ebx, cx
movzx ecx, byte [edi + esi + 0xe]
or ebx, ecx
mov cl, byte [edi + esi + 0x10]
cmp ebx, 4
jl 0x100018d3
cmp ebx, 0x80000
jg 0x100018d3
cmp ebx, dword [esi + 0x8000c]
jg 0x100018a1
cmp al, 0xc1
jne 0x1000183d
mov dl, byte [edi + esi + 0xe]
mov byte [ebp - 4], dl
lea edx, [ebx - 3]
xor eax, eax
lea ecx, [edi + esi + 0xf]
test edx, edx
jle 0x10001869
mov dl, byte [ecx + eax]
add dl, byte [ebp - 4]
lea ecx, [edi + esi + 0xf]
xor dl, 0xa0
mov byte [ecx + eax], dl
inc eax
lea edx, [ebx - 3]
cmp eax, edx
jl 0x10001823
jmp 0x10001869
mov cl, byte [edi + esi + 0xf]
lea edx, [ebx - 4]
xor eax, eax
mov byte [ebp - 4], cl
lea ecx, [edi + esi + 0x10]
test edx, edx
jle 0x10001869
mov dl, byte [ecx + eax]
add dl, byte [ebp - 4]
lea ecx, [edi + esi + 0x10]
xor dl, 0xa0
mov byte [ecx + eax], dl
inc eax
lea edx, [ebx - 4]
cmp eax, edx
jl 0x10001851
mov al, byte [ecx]
mov edx, dword [esi + 0x100014]
mov byte [ebp - 8], al
mov ecx, dword [ebp - 8]
push ebx
lea eax, [esi + edi + 0xc]
push eax
push ecx
call edx
sub dword [esi + 0x8000c], ebx
add esp, 0xc
add edi, ebx
cmp dword [esi + 0x8000c], 0
jg 0x100017b5
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
jle 0x100018ca
mov eax, dword [esi + 0x8000c]
test eax, eax
jle 0x100018ca
mov ecx, 0x80000
sub ecx, edi
cmp eax, ecx
jg 0x100018ca
push eax
lea eax, [edi + esi + 0xc]
push eax
push edx
call dword [sym.imp.MSVCR100.dll_memmove]
add esp, 0xc
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx ecx, cl
push ecx
movzx edx, al
push ebx
push edx
push 0x10020560
call fcn.1000f740
add esp, 4
push eax
push 0
mov ecx, 0x10121080
call fcn.10007010
add esp, 0x14
call fcn.100016c0
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx eax, byte [edi + esi + 0xc]
push eax
push 0x10020460
call fcn.1000f740
add esp, 4
push eax
push 0
mov ecx, 0x10121080
call fcn.10007010
add esp, 0xc
call fcn.100016c0
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret