joyce8/EMBER2024-capa huggingface dataset:
Function at 0x488030
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x51cca4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
test esi, esi
je 0x488099
mov ecx, esi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x488050
sub ecx, edx
sar ecx, 1
lea ebx, [ecx + 1]
cmp ebx, 0x3fffffff
jg 0x488099
add ebx, ebx
mov eax, ebx
call fcn.00489c90
mov edi, esp
test edi, edi
je 0x488099
push 0
push 0
push ebx
push edi
push 0xffffffffffffffff
push esi
push 0
push 3
mov byte [edi], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
neg esi
sbb esi, esi
and esi, edi
jmp 0x48809b
xor esi, esi
mov eax, dword [ebp + 0x10]
push 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push str.SoftwarePdaNetAndroid
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4880e5
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push 0
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00489c7b
mov esp, ebp
pop ebp
ret 0xc

Function at 0x488100
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x51cca4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
test esi, esi
je 0x488169
mov ecx, esi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x488120
sub ecx, edx
sar ecx, 1
lea ebx, [ecx + 1]
cmp ebx, 0x3fffffff
jg 0x488169
add ebx, ebx
mov eax, ebx
call fcn.00489c90
mov edi, esp
test edi, edi
je 0x488169
push 0
push 0
push ebx
push edi
push 0xffffffffffffffff
push esi
push 0
push 3
mov byte [edi], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
neg esi
sbb esi, esi
and esi, edi
jmp 0x48816b
xor esi, esi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x4881c6
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x488177
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 1]
mov dword [ebp - 8], eax
cmp eax, 0x3fffffff
jg 0x4881c6
add eax, eax
call fcn.00489c90
mov ebx, esp
test ebx, ebx
je 0x4881c6
mov ecx, dword [ebp - 8]
push 0
push 0
mov byte [ebx], 0
lea eax, [ecx + ecx]
push eax
push ebx
push 0xffffffffffffffff
push edi
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
neg edi
sbb edi, edi
and edi, ebx
jmp 0x4881c8
xor edi, edi
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push str.SoftwarePdaNetAndroid
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x48820f
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push esi
push 1
push 0
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00489c7b
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4c7955
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004c755a

Function at 0x4c7960
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004c76db

Function at 0x4cbf28
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004cb70c

Function at 0x4cbf33
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004cb947

Function at 0x4cc585
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004cc30c
Function at 0x100046a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009e775
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x100b93c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov ebx, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0x10]
push 0
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x48]
push 0x32
push eax
push 0xcdc778
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x100046ff
mov byte [ebp - 0x17], 0
jmp 0x10004713
push str.UNKNOWN
lea eax, [ebp - 0x48]
push 0x32
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
add esp, 0xc
mov edi, dword [ebp + 0xc]
mov edx, ebx
mov ecx, edi
sub ecx, 4
jb 0x10004731
nop
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x10004736
add edx, 4
add esi, 4
sub ecx, 4
jae 0x10004720
cmp ecx, 0xfffffffc
je 0x1000476a
mov al, byte [edx]
cmp al, byte [esi]
jne 0x10004763
cmp ecx, 0xfffffffd
je 0x1000476a
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x10004763
cmp ecx, 0xfffffffe
je 0x1000476a
mov al, byte [edx + 2]
cmp al, byte [esi + 2]
jne 0x10004763
cmp ecx, 0xffffffff
je 0x1000476a
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
je 0x1000476a
sbb eax, eax
or eax, 1
jmp 0x1000476c
xor eax, eax
test eax, eax
je 0x100047bb
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x80]
call fcn.10008290
push str.d1d_u_kn0w_d1s_qp4L_uz3r
lea ecx, [ebp - 0x68]
mov dword [ebp - 4], 0
call fcn.10008290
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x68]
call fcn.100014f0
add esp, 4
lea ecx, [ebp - 0x68]
call fcn.10008240
lea ecx, [ebp - 0x80]
call fcn.10008240
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x4c]
push eax
push 0x40
push edi
push ebx
call esi
push edi
push dword [ebp - 0x50]
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x4c]
push eax
push dword [ebp - 0x4c]
push edi
push ebx
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1009ca62
mov esp, ebp
pop ebp
ret
Function at 0x1000b590
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x1000b5f1
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x1000b5d4
cmp edi, 2
jb 0x1000b5d4
cmp byte [esi], cl
jne 0x1000b5d4
cmp byte [esi + 1], cl
jne 0x1000b5d4
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100af250]
jmp 0x1000b5a5
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100af250]
test edi, edi
jne 0x1000b5a5
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x1000b620
cmp cl, 0x23
jne 0x1000b607
cmp byte [esi], cl
jne 0x1000b607
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x100af250]
test cl, cl
jne 0x1000b5f8
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x1000b730
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x1000b744
mov dword [ebx], 0
mov edx, 0x100ae720
call fcn.1000b630
mov esi, eax
test esi, esi
je 0x1000b832
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call edi
add esp, 4
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x1000b828
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x1000b828
push esi
call edi
mov edi, eax
add esp, 4
mov dword [ebp + 8], edi
cmp edi, 0xffffffff
je 0x1000b828
push 0
push dword [ebp - 4]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x1000b828
mov eax, dword [0x100b99b8]
test eax, eax
je 0x1000b7bc
inc dword [eax + 0xb0]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
je 0x1000b828
push esi
push dword [ebp + 8]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, dword [ebp + 8]
je 0x1000b80d
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [0x100b99b8]
add esp, 4
test eax, eax
je 0x1000b7fa
dec dword [eax + 0xb0]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test ebx, ebx
je 0x1000b81f
mov eax, dword [ebp + 8]
mov dword [ebx], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10018e50
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100b93c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
lea edx, [ebp - 8]
push ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov eax, dword [0x100b99b8]
push esi
push edi
mov esi, 4
mov edi, dword [eax + 0x3f04]
mov eax, dword [edi + 0xfc]
mov ebx, dword [edi + 0x104]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x100af250]
sub esi, 1
jne 0x10018e90
mov eax, dword [0x100b99b8]
not ebx
cmp dword [eax + 0x3f28], ebx
jne 0x10018eca
push ecx
push dword [ebp - 0xc]
lea edx, [esi + 4]
mov ecx, ebx
call fcn.10029fd0
add esp, 8
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push eax
lea ecx, [edi + 0xfc]
call fcn.1002a1d0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1009ca62
mov esp, ebp
pop ebp
ret
Function at 0x1001ea20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
cmp dword [edi + 0x53b8], 0
lea esi, [edi + 0x53bc]
je 0x1001eaa2
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x1001ea5c
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.1002aeb0
push dword [ebp + 8]
mov ecx, esi
mov dword [esi], 0
push ebx
call fcn.1000bb70
mov edx, dword [esi]
mov ecx, 0x100b99b3
push dword [edi + 0x53b8]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edi + 0x53c4]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
mov ecx, esi
push ebx
call fcn.1000bb70
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001ee80
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
mov dword [ebp - 4], ecx
push esi
lea esi, [ecx + 1]
push edi
test bl, bl
je 0x1001eec8
or edi, 0xffffffff
nop dword [eax]
cmp bl, 0x23
jne 0x1001eeaf
cmp byte [esi], bl
jne 0x1001eeaf
cmp byte [esi + 1], bl
cmove eax, edi
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
xor eax, dword [edx*4 + 0x100af250]
test bl, bl
jne 0x1001eea0
mov ebx, dword [0x100b99b8]
not eax
mov edi, dword [ebx + 0x5390]
mov esi, edi
neg esi
sbb esi, esi
lea ecx, [edi + 4]
and esi, ecx
je 0x1001ef02
cmp dword [esi], eax
je 0x1001ef11
mov edx, dword [esi - 4]
mov ecx, dword [ebx + 0x5388]
add edx, esi
add ecx, 4
xor esi, esi
add ecx, edi
cmp edx, ecx
cmovne esi, edx
test esi, esi
jne 0x1001eee3
mov ecx, dword [ebp - 4]
call fcn.1001eda0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x1001ef02
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001ef20
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
push edi
mov edi, dword [0x100b99b8]
test bl, bl
je 0x1001ef66
or edi, 0xffffffff
cmp bl, 0x23
jne 0x1001ef47
cmp byte [esi], bl
jne 0x1001ef47
cmp byte [esi + 1], bl
cmove eax, edi
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
xor eax, dword [edx*4 + 0x100af250]
test bl, bl
jne 0x1001ef38
mov edi, dword [0x100b99b8]
mov esi, dword [edi + 0x537c]
xor ecx, ecx
not eax
test esi, esi
jle 0x1001ef8c
mov edi, dword [edi + 0x5384]
lea edx, [edi + 4]
nop dword [eax]
cmp dword [edx], eax
je 0x1001ef92
inc ecx
add edx, 0x24
cmp ecx, esi
jl 0x1001ef80
pop edi
pop esi
xor eax, eax
pop ebx
ret
lea eax, [ecx + ecx*8]
lea eax, [edi + eax*4]
pop edi
pop esi
pop ebx
ret
Function at 0x100331e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x1003321a
mov eax, dword [0x100b99b8]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x1003320d
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x1003324b
mov eax, dword [0x100b99b8]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x1003323e
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x1003327c
mov eax, dword [0x100b99b8]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x1003326f
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x100332c9
mov eax, dword [0x100b99b8]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x100332bc
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x100332fa
mov eax, dword [0x100b99b8]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x100332ed
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x1003332b
mov eax, dword [0x100b99b8]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x1003331e
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x5c], 0
pop edi
lea ecx, [esi + 0x78]
pop esi
jmp fcn.10035b20
Function at 0x100465a0
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 1
jne 0x100465e0
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0
push 0
push 0
push 0x10046810
push 0
push 0
mov dword [0x100b99c4], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x100b99c0], eax
mov eax, 1
pop esi
pop ebp
ret 0xc
test eax, eax
jne 0x100465f1
push eax
push dword [0x100b99c0]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, 1
pop ebp
ret 0xc
Function at 0x1004f480
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov ecx, 0x2b
test edi, edi
je 0x1004f530
mov ebp, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
nop dword [eax]
mov ebx, 4
lea eax, [esp + 0x1c]
push 4
push eax
cmp edi, ebx
push ebp
cmovb ebx, edi
call fcn.100586e0
add esp, 0xc
cmp eax, 4
je 0x1004f4c3
mov ecx, eax
jmp 0x1004f4ed
cmp byte [0x100b9528], 0
jne 0x1004f4f7
push 2
push 4
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0
push eax
push 0
call sub.bcrypt.dll_BCryptGenRandom
neg eax
sbb ecx, ecx
and ecx, 2
mov eax, ecx
test eax, eax
jne 0x1004f532
mov eax, dword [esp + 0x1c]
jmp 0x1004f514
imul eax, dword [0x100b9524], 0x41c64e6d
add eax, 0x3039
mov dword [0x100b9524], eax
ror eax, 0x10
xor ecx, ecx
mov dword [esp + 0x1c], eax
test ebx, ebx
je 0x1004f528
mov byte [esi], al
dec edi
inc esi
shr eax, 8
sub ebx, 1
jne 0x1004f518
mov dword [esp + 0x1c], eax
test edi, edi
jne 0x1004f4a0
mov eax, ecx
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x1004f540
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
sub ebx, 1
je 0x1004f5bb
mov esi, dword [esp + 0x14]
mov ebp, 0x3e
nop word [eax + eax]
push 4
lea eax, [esp + 0x20]
push eax
push esi
call fcn.100586e0
add esp, 0xc
cmp eax, 4
jne 0x1004f59c
cmp byte [0x100b9528], 0
jne 0x1004f5c5
push 2
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0
push eax
push 0
call sub.bcrypt.dll_BCryptGenRandom
neg eax
sbb eax, eax
and eax, 2
test eax, eax
jne 0x1004f5c0
mov eax, dword [esp + 0x1c]
cmp eax, 0xfffffffc
jae 0x1004f560
xor edx, edx
div ebp
mov al, byte [edx + 0x100a2af0]
mov byte [edi], al
inc edi
sub ebx, 1
jne 0x1004f560
mov byte [edi], 0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
imul eax, dword [0x100b9524], 0x41c64e6d
add eax, 0x3039
mov dword [0x100b9524], eax
ror eax, 0x10
mov dword [esp + 0x1c], eax
jmp 0x1004f5a4

Function at 0x1004f5f0
Capabilities:
Generate random numbers via winapi

Disassembly:
push dword [esp + 8]
push 0
push dword [esp + 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 2
push dword [esp + 0xc]
push dword [esp + 0xc]
push 0
call sub.bcrypt.dll_BCryptGenRandom
neg eax
sbb eax, eax
and eax, 2
ret
Function at 0x100549e0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x10054a8f
push esi
call fcn.100654e0
add esp, 4
test al, al
jne 0x10054a8f
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x10054a07
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.1006ed70
add esp, 0xc
test eax, eax
je 0x10054a3b
sub eax, esi
push eax
push 0x2e
push esi
call fcn.1006ed70
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x10054a3d
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
lea ebx, [esi + edi]
mov edi, 0x1505
cmp esi, ebx
jae 0x10054a6e
nop dword [eax]
mov al, byte [esi]
push eax
call fcn.1004d790
movsx ecx, al
inc esi
mov eax, edi
add esp, 4
shl eax, 5
add eax, edi
xor ecx, eax
mov edi, ecx
cmp esi, ebx
jb 0x10054a50
mov eax, 0x4104105
mov esi, edi
mul edi
sub esi, edx
shr esi, 1
add esi, edx
shr esi, 5
mov ecx, esi
shl ecx, 6
sub ecx, esi
sub edi, ecx
mov eax, edi
pop edi
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x1005e240
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp byte [esi + 0x6c3], 0
je 0x1005e2dd
cmp dword [esi + 0x19c], 0
je 0x1005e297
push esi
call fcn.1004f9f0
push 1
push esi
mov byte [esp + 0x14], al
call fcn.1004fc80
push dword [esi + 0x14c]
mov eax, dword [esi + 0x19c]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push esi
call eax
push dword [esp + 0x28]
push esi
call fcn.1004fc80
add esp, 0x28
pop esi
ret
mov ecx, dword [esp + 0xc]
mov eax, ecx
sub eax, 0
je 0x1005e2ac
sub eax, 1
je 0x1005e2ac
sub eax, 1
jne 0x1005e2dd
push dword [esi + 0x148]
lea eax, [ecx*2 + 0x100a3e64]
push 1
add eax, ecx
push 2
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
push dword [esi + 0x148]
push 1
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x20
pop esi
ret

Function at 0x100608e0
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
push edi
push str.kernel32
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
test ebx, ebx
jne 0x100608fa
pop edi
pop ebx
pop ecx
ret
push ebp
push esi
push str.LoadLibraryExA
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [esp + 0x18]
mov ebp, eax
push 0x100a42dc
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strpbrk
add esp, 8
test eax, eax
je 0x10060942
test ebp, ebp
je 0x10060933
push 8
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
test ebp, ebp
je 0x10060968
push str.AddDllDirectory
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10060968
push 0x800
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, eax
mov dword [esp + 0x10], edx
test edx, edx
je 0x10060a1f
mov ecx, esi
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10060985
sub ecx, ebx
lea eax, [ecx + 1]
add eax, edx
push eax
call dword [section..data]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x10060a15
push dword [esp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x10060a15
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100609b7
sub ecx, edx
mov eax, 0x5c
mov word [ecx + ebx], ax
mov ecx, ebx
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100609d0
sub ecx, edx
sub ecx, esi
add ecx, ebx
nop dword [eax]
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x100609e0
test ebp, ebp
je 0x10060a0c
push 8
push 0
push ebx
call ebp
push ebx
mov edi, eax
call dword [0x100b9004]
add esp, 4
mov eax, edi
pop esi
pop ebp
pop edi
pop ebx
pop ecx
ret
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
push ebx
call dword [0x100b9004]
add esp, 4
pop esi
pop ebp
mov eax, edi
pop edi
pop ebx
pop ecx
ret
Function at 0x10065690
Capabilities:
Create udp socket

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x100656ce
mov eax, dword [esi + 0x7c]
cmp byte [eax + 0x104], 0
jne 0x100656bf
push 0
call fcn.10065690
add esp, 4
test al, al
mov eax, dword [esi + 0x7c]
setne cl
inc cl
mov byte [eax + 0x104], cl
mov eax, dword [esi + 0x7c]
pop esi
cmp byte [eax + 0x104], 2
sete al
ret
push 0
push 2
push 0x17
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
jne 0x100656e3
xor al, al
pop esi
ret
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov al, 1
pop esi
ret