joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008c60
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
sub esp, 0x70
mov eax, dword [0x10076610]
xor eax, esp
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x74]
push ebx
push ebp
mov ebp, dword [esp + 0x80]
push esi
mov esi, dword [esp + 0x88]
push edi
push 0x40
mov edi, ecx
lea ecx, [esp + 0x3c]
push 0
push ecx
mov bx, dx
mov dword [esp + 0x40], eax
call fcn.1004e4c0
mov edx, 0x200
add esp, 0xc
movzx eax, bx
cmp bx, dx
jbe 0x10008cbc
lea ecx, [esp + 0x38]
push ecx
mov ecx, ebp
call fcn.10009fa0
add esp, 4
jmp 0x10008cd7
add eax, 7
cdq
and edx, 7
add eax, edx
sar eax, 3
push eax
lea edx, [esp + 0x3c]
push ebp
push edx
call fcn.1004e150
add esp, 0xc
lea eax, [esp + 0x38]
mov ecx, 0x40
xor byte [eax], 0x36
inc eax
sub ecx, 1
jne 0x10008ce0
xor eax, eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x10]
push eax
lea edx, [esp + 0x3c]
mov dword [esp + 0x14], 0x67452301
mov dword [esp + 0x18], 0xefcdab89
mov dword [esp + 0x1c], 0x98badcfe
mov dword [esp + 0x20], 0x10325476
mov dword [esp + 0x24], 0xc3d2e1f0
call fcn.10009ca0
add esp, 4
cmp edi, 0x200
jb 0x10008d5d
mov ebx, edi
shr ebx, 9
lea esp, [esp]
lea ecx, [esp + 0x10]
push ecx
mov edx, esi
call fcn.10009ca0
add esp, 4
add esi, 0x40
sub edi, 0x200
sub ebx, 1
jne 0x10008d40
mov edx, esi
mov ecx, edi
lea esi, [esp + 0x10]
call fcn.10009e60
lea eax, [esp + 0x38]
mov ecx, 0x40
xor byte [eax], 0x6a
inc eax
sub ecx, 1
jne 0x10008d73
mov ebx, dword [esp + 0x34]
lea edi, [esp + 0x10]
mov ecx, ebx
sub edi, ebx
mov edx, 5
mov eax, dword [edi + ecx]
mov esi, eax
and esi, 0xff0000
mov ebp, eax
shr ebp, 0x10
or esi, ebp
mov ebp, eax
shl ebp, 0x10
and eax, 0xff00
or ebp, eax
shr esi, 8
shl ebp, 8
or esi, ebp
mov dword [ecx], esi
add ecx, 4
sub edx, 1
jne 0x10008d8d
lea edx, [esp + 0x10]
xor eax, eax
push edx
lea edx, [esp + 0x3c]
mov dword [esp + 0x14], 0x67452301
mov dword [esp + 0x18], 0xefcdab89
mov dword [esp + 0x1c], 0x98badcfe
mov dword [esp + 0x20], 0x10325476
mov dword [esp + 0x24], 0xc3d2e1f0
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
call fcn.10009ca0
add esp, 4
mov ecx, 0xa0
mov edx, ebx
lea esi, [esp + 0x10]
call fcn.10009e60
mov ecx, ebx
mov edx, 5
jmp 0x10008e20
mov eax, dword [ecx + edi]
mov esi, eax
and esi, 0xff0000
mov ebx, eax
shr ebx, 0x10
or esi, ebx
mov ebx, eax
shl ebx, 0x10
and eax, 0xff00
or ebx, eax
shr esi, 8
shl ebx, 8
or esi, ebx
mov dword [ecx], esi
add ecx, 4
sub edx, 1
jne 0x10008e20
mov ecx, dword [esp + 0x7c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1004b0b2
add esp, 0x70
ret
Function at 0x10009bc0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x68
mov eax, dword [0x10076610]
xor eax, esp
mov dword [esp + 0x60], eax
push esi
push 0x58
lea eax, [esp + 0xc]
push 0
push eax
mov esi, ecx
call fcn.1004e4c0
add esp, 0xc
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0x67452301
mov dword [esp + 0x14], 0xefcdab89
mov dword [esp + 0x18], 0x98badcfe
mov dword [esp + 0x1c], 0x10325476
test esi, esi
je 0x10009c25
mov eax, esi
push edi
lea esi, [esp + 0xc]
call fcn.10009980
add esp, 4
push ebx
lea ecx, [esp + 0xc]
call fcn.10009a10
mov ecx, dword [esp + 0x68]
add esp, 4
pop esi
xor ecx, esp
call fcn.1004b0b2
add esp, 0x68
ret
Function at 0x10009ca0
Capabilities:
Hash data using sha1

Disassembly:
sub esp, 0x78
push ebp
mov ebp, dword [esp + 0x80]
mov eax, 0x10009c90
push esi
lea ecx, [esp + 0x40]
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], eax
mov eax, ecx
push ebx
mov dword [esp + 0x10], 0x10009c50
mov dword [esp + 0x18], 0x10009c70
mov dword [esp + 0x20], 0x5a827999
mov dword [esp + 0x24], 0x6ed9eba1
mov dword [esp + 0x28], 0x8f1bbcdc
mov dword [esp + 0x2c], 0xca62c1d6
sub edx, eax
mov esi, 0x10
push edi
jmp 0x10009d00
mov eax, dword [edx + ecx]
mov edi, eax
and edi, 0xff0000
mov ebx, eax
shr ebx, 0x10
or edi, ebx
mov ebx, eax
shl ebx, 0x10
and eax, 0xff00
or ebx, eax
shr edi, 8
shl ebx, 8
or edi, ebx
mov dword [ecx], edi
add ecx, 4
sub esi, 1
jne 0x10009d00
mov ecx, dword [ebp]
mov edx, dword [ebp + 4]
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x34], ecx
mov ecx, dword [ebp + 8]
mov dword [esp + 0x38], edx
mov edx, dword [ebp + 0x10]
mov dword [esp + 0x40], eax
xor al, al
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x44], edx
mov byte [esp + 0x13], 0
mov byte [esp + 0x11], 0
mov byte [esp + 0x12], al
jmp 0x10009d69
mov al, byte [esp + 0x12]
mov bl, al
and bl, 0xf
cmp al, 0x10
jb 0x10009d9d
movzx eax, bl
lea esi, [eax - 8]
and esi, 0xf
mov esi, dword [esp + esi*4 + 0x48]
lea edi, [eax - 3]
lea edx, [esp + eax*4 + 0x48]
and edi, 0xf
xor esi, dword [esp + edi*4 + 0x48]
add eax, 2
and eax, 0xf
xor esi, dword [esp + eax*4 + 0x48]
xor esi, dword [edx]
rol esi, 1
mov dword [edx], esi
mov eax, dword [esp + 0x40]
movzx edi, byte [esp + 0x13]
mov edx, dword [esp + edi*4 + 0x14]
push eax
push ecx
mov ecx, dword [esp + 0x40]
push ecx
call edx
mov esi, dword [esp + 0x40]
rol esi, 5
movzx ecx, bl
add esi, dword [esp + ecx*4 + 0x54]
push 0x10
add esi, dword [esp + edi*4 + 0x34]
lea edx, [esp + 0x44]
add esi, dword [esp + 0x54]
push edx
add esi, eax
lea eax, [esp + 0x4c]
push eax
call fcn.1004d790
mov al, byte [esp + 0x29]
mov ecx, dword [esp + 0x54]
add esp, 0x18
inc al
ror ecx, 2
mov dword [esp + 0x34], esi
mov dword [esp + 0x3c], ecx
mov byte [esp + 0x11], al
cmp al, 0x14
jne 0x10009e14
lea eax, [edi + 1]
and eax, reloc.WS2_32.dll_closesocket
mov byte [esp + 0x11], 0
jns 0x10009e10
dec eax
or eax, 0xfffffffc
inc eax
mov byte [esp + 0x13], al
mov al, byte [esp + 0x12]
inc al
mov byte [esp + 0x12], al
cmp al, 0x4f
jbe 0x10009d65
lea ecx, [esp + 0x34]
pop edi
mov eax, ebp
sub ecx, ebp
mov edx, 5
pop ebx
mov esi, dword [ecx + eax]
add dword [eax], esi
add eax, 4
sub edx, 1
jne 0x10009e35
add dword [ebp + 0x18], 0x200
pop esi
adc dword [ebp + 0x1c], edx
pop ebp
add esp, 0x78
ret
Function at 0x10009fa0
Capabilities:
Hash data using sha1

Disassembly:
sub esp, 0x20
push esi
mov esi, eax
xor eax, eax
push edi
mov edi, ecx
mov dword [esp + 8], 0x67452301
mov dword [esp + 0xc], 0xefcdab89
mov dword [esp + 0x10], 0x98badcfe
mov dword [esp + 0x14], 0x10325476
mov dword [esp + 0x18], 0xc3d2e1f0
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
test esi, 0xfffffe00
je 0x1000a003
lea eax, [esp + 8]
push eax
mov edx, edi
call fcn.10009ca0
sub esi, 0x200
add esp, 4
add edi, 0x40
test esi, 0xfffffe00
jne 0x10009fe3
mov ecx, esi
mov edx, edi
lea esi, [esp + 8]
call fcn.10009e60
mov ecx, dword [esp + 0x2c]
mov edx, esi
call fcn.10009f50
pop edi
pop esi
add esp, 0x20
ret
Function at 0x1001cd90
Capabilities:
Create udp socket

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x2b0], 2
jne 0x1001cda2
jmp fcn.1001cd30
mov eax, 1
ret

Function at 0x1001d080
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x10076610]
xor eax, esp
mov dword [esp + 0x190], eax
test byte [esp + 0x198], 2
je 0x1001d0df
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1001d0c5
mov eax, dword [esp]
cmp al, 2
jne 0x1001d0bf
shr eax, 8
cmp al, 2
je 0x1001d0df
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.1004b0b2
add esp, 0x194
ret
push 3
push 2
push 0
push 6
call fcn.1001cdc0
add esp, 0x10
test eax, eax
je 0x1001d11f
push 0x10079470
mov dword [0x10079478], 1
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor eax, eax
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.1004b0b2
add esp, 0x194
ret
mov ecx, dword [esp + 0x190]
xor ecx, esp
mov dword [0x10079478], 0
xor eax, eax
call fcn.1004b0b2
add esp, 0x194
ret
Function at 0x10021910
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x14
mov eax, dword [esi + 0xa90]
push 4
lea ecx, [esp + 4]
push ecx
push 8
shr eax, 0xc
push 0xffff
and eax, 1
push edi
mov dword [esp + 0x14], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jge 0x1002194f
push edi
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
push esi
call fcn.1001bdc0
add esp, 0xc
add esp, 0x14
ret
mov edx, dword [esi + 0xa50]
push edx
mov dword [esp + 0xc], 1
call fcn.1001b970
imul eax, eax, 0x3e8
mov dword [esp + 4], eax
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0xa54]
push eax
call fcn.1001b970
imul eax, eax, 0x3e8
add esp, 8
push 0
push 0
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 0xc
lea edx, [esp + 0x20]
push edx
push 0x98000004
push edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x34], eax
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x100219c8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
push esi
call fcn.1001bdc0
add esp, 0x10
add esp, 0x14
ret
Function at 0x10032d10
Capabilities:
Check http status code

Disassembly:
push ebx
mov ebx, eax
mov eax, 0x51eb851f
imul ecx
sar edx, 5
push ebp
mov ebp, dword [esp + 0xc]
mov eax, edx
shr eax, 0x1f
push esi
add eax, edx
xor esi, esi
push edi
mov edi, dword [ebx]
cmp eax, 2
je 0x10032d4a
push str.Couldnt_set_desired_mode
push edi
call fcn.1001bea0
add esp, 8
pop edi
lea eax, [esi + 0x11]
pop esi
pop ebp
pop ebx
ret
cmp ecx, 0xc8
je 0x10032d61
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push edi
call fcn.1001bdc0
add esp, 0xc
cmp ebp, 0x13
jne 0x10032d76
push ebx
call fcn.10032ca0
add esp, 4
pop edi
mov esi, eax
pop esi
pop ebp
pop ebx
ret
cmp ebp, 0x14
jne 0x10032d87
call fcn.10030130
pop edi
mov esi, eax
pop esi
pop ebp
pop ebx
ret
cmp ebp, 0x15
jne 0x10032d9a
mov eax, ebx
call fcn.10032cf0
pop edi
mov esi, eax
pop esi
pop ebp
pop ebx
ret
cmp ebp, 0x16
jne 0x10032da8
mov eax, ebx
call fcn.10032d00
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret

Function at 0x10034910
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
invalid
Function at 0x1003fbe0
Capabilities:
Set socket configuration

Disassembly:
sub esp, 8
push 0
push 0
lea eax, [esp + 0xc]
push eax
push 4
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
push 0x4004747b
push esi
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
jne 0x1003fc1f
push 4
lea edx, [esp + 4]
push edx
push 0x1001
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
add esp, 8
ret

Function at 0x1004b0b2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10076610]
jne 0x1004b0bc
repz ret
jmp fcn.100515de

Function at 0x1006095d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10051756
and dword [ebp - 4], 0
cmp dword [0x10078174], 0
mov ebx, eax
jne 0x10060a0e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10060abf
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x10060abf
push eax
call fcn.100516e4
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10078174], eax
call esi
push eax
call fcn.100516e4
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10078178], eax
call esi
push eax
call fcn.100516e4
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x1007817c], eax
call esi
push eax
call fcn.100516e4
pop ecx
mov dword [0x10078184], eax
test eax, eax
je 0x10060a0e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.100516e4
pop ecx
mov dword [0x10078180], eax
mov eax, dword [0x10078180]
cmp eax, ebx
je 0x10060a66
cmp dword [0x10078184], ebx
je 0x10060a66
push eax
call fcn.1005175f
push dword [0x10078184]
mov esi, eax
call fcn.1005175f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10060a66
test edi, edi
je 0x10060a66
call esi
test eax, eax
je 0x10060a5d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10060a5d
test byte [ebp - 0xc], 1
jne 0x10060a66
or dword [ebp + 0x10], 0x200000
jmp 0x10060a9f
mov eax, dword [0x10078178]
cmp eax, ebx
je 0x10060a9f
push eax
call fcn.1005175f
pop ecx
test eax, eax
je 0x10060a9f
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x10060a9f
mov eax, dword [0x1007817c]
cmp eax, ebx
je 0x10060a9f
push eax
call fcn.1005175f
pop ecx
test eax, eax
je 0x10060a9f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10078174]
call fcn.1005175f
pop ecx
test eax, eax
je 0x10060abf
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10060ac1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10065b98
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x10065bc9
call fcn.1004e6b9
mov dword [eax], esi
call fcn.1004e6a6
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.1004b652
add esp, 0x14
push 0x16
pop eax
jmp 0x10065c1e
test dword [ebp + 0xc], 0xfffffff9
jne 0x10065ba5
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10065bf6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.1004e6cc
pop ecx
call fcn.1004e6a6
mov eax, dword [eax]
jmp 0x10065c1e
test al, 0x10
jne 0x10065c1c
test al, 1
je 0x10065c1c
test byte [ebp + 0xc], 2
je 0x10065c1c
call fcn.1004e6b9
mov dword [eax], 5
call fcn.1004e6a6
mov dword [eax], 0xd
jmp 0x10065bed
xor eax, eax
pop esi
pop ebp
ret
Function at 0x10e92058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.10e921a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x10e9207e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10e9206a
add dl, dl
jne 0x10e92089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10e920dc
xor eax, eax
add dl, dl
jne 0x10e92096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10e9217d
add dl, dl
jne 0x10e920a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10e920b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10e920bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10e920c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x10e920d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10e92075
mov eax, 1
add dl, dl
jne 0x10e920ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10e920f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10e920e1
sub eax, ebx
mov ebx, 1
jne 0x10e92128
mov ecx, 1
add dl, dl
jne 0x10e9210e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10e92119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10e92105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10e92075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x10e9213f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10e9214a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10e92136
cmp eax, 0x7d00
jae 0x10e9216d
cmp eax, 0x500
jb 0x10e92168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10e92075
cmp eax, 0x7f
ja 0x10e92170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10e92075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x10e9219e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10e92075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4067e3
Capabilities:
Connect socket

Disassembly:
mov eax, dword [esi]
push 0x7a
push ebx
push 1
mov dword [eax + 0x14], edx
sbb al, 0xe
mov ebx, dword [edx + 0x27c98944]
push es
inc eax
xor al, 1
add byte [eax], al
add byte [ebx - 0x2f427cf2], cl
push ecx
call fcn.00406010
pop edi
jns 0x406866
pop ebp
ret
mov esi, dword [ebp + 0xc]
mov al, byte [0x7e8d144e]
sub byte [ecx + 0x42], dl

Function at 0x406840
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1f6c
dec edi
mov ebx, dword [ebp + 0x70]
rcl dword [edi - 0x75], cl
inc ebx
add al, 0x5e
fdiv st(7), st(0)
cmovle edx, dword [ecx + eax + 0x4b3159d2]
adc byte [ebp - 0x767bf037], al
or eax, 0x758b00c7
or al, 0xa0
dec esi
adc al, 0x8d
jle 0x406897
push ecx
inc edx
push eax
call dword [sym.imp.WSOCK32.dll_connect]
add byte [0x610b23b3], bh
jne 0x40b2f4
rcr byte [0x77738b20], 1
mov eax, edi
xor dh, al
jne 0x4068bd
pop edi
pop esi
mov eax, 0xb23c8
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebx + 4]
mov ecx, 0xa2000018
test esi, esi
mov dword [ebp - 0x20c], eax
mov dword [ecx - 0x10], eax
xchg ebx, eax
invalid
test dword [eax + eax + 0x7e8b0000], ebx
cmp al, 0x75
ror dword [edi], cl
test byte [ecx - 0x75000000], dl
pop esi
cmp byte [ebx + 0x5d3ffff], al
or eax, 0xffffffff
jmp 0x40b30c
Function at 0x1000d4c0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1011c100
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], 0xcccccccc
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.1000bde0
mov ecx, dword [ebp - 0x10]
add ecx, 0x38
call fcn.1000bcf0
mov ecx, dword [ebp - 0x10]
add ecx, 0x64
call fcn.1000d850
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x7c
call fcn.1000b610
mov ecx, dword [ebp - 0x10]
add ecx, 0x84
call fcn.1000b610
mov ecx, dword [ebp - 0x10]
add ecx, 0x8c
call fcn.1000b610
mov ecx, dword [ebp - 0x10]
add ecx, 0x94
call fcn.1000b610
mov eax, 4
shl eax, 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + eax + 0x28], 0xffffffff
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + eax + 0x28], 0xffffffff
mov edx, 4
shl edx, 0
mov eax, dword [ebp - 0x10]
mov dword [eax + edx + 0x30], 0
mov ecx, 4
imul edx, ecx, 0
mov eax, dword [ebp - 0x10]
mov dword [eax + edx + 0x30], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
add esp, 0x10
cmp ebp, esp
call fcn.1011a7c1
mov esp, ebp
pop ebp
ret
Function at 0x100109e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0x10]
not eax
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], 0x10143188
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0xc]
sub eax, 1
mov dword [ebp + 0xc], eax
cmp dword [ebp - 0x10], 0
je 0x10010a19
mov dword [ebp - 0x14], 1
jmp 0x10010a20
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0x14], 0
je 0x10010a57
mov ecx, dword [ebp - 4]
shr ecx, 8
mov edx, dword [ebp - 4]
and edx, 0xff
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
xor edx, eax
mov eax, dword [ebp - 0xc]
xor ecx, dword [eax + edx*4]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x18]
mov dword [ebp - 4], edx
jmp 0x100109fb
mov eax, dword [ebp - 4]
not eax
mov esp, ebp
pop ebp
ret

Function at 0x10010a60
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0x10]
not eax
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], 0x10143188
cmp dword [ebp + 0xc], 0
je 0x10010b2f
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0xc]
sub ecx, 1
mov dword [ebp + 0xc], ecx
cmp dword [ebp - 0x14], 0
je 0x10010aa9
mov dword [ebp - 0x18], 1
jmp 0x10010ab0
mov dword [ebp - 0x18], 0
cmp dword [ebp - 0x18], 0
je 0x10010b2d
mov edx, dword [ebp - 8]
mov al, byte [edx]
mov byte [ebp - 0x19], al
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov dl, byte [ebp - 0x19]
mov byte [ebp - 0xd], dl
movzx eax, byte [ebp - 0xd]
cmp eax, 0x23
jne 0x10010b0a
cmp dword [ebp + 0xc], 2
jb 0x10010b0a
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x23
jne 0x10010b0a
mov edx, 1
shl edx, 0
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x23
jne 0x10010b0a
mov edx, dword [ebp + 0x10]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
shr eax, 8
mov ecx, dword [ebp - 4]
and ecx, 0xff
movzx edx, byte [ebp - 0xd]
xor ecx, edx
mov edx, dword [ebp - 0xc]
xor eax, dword [edx + ecx*4]
mov dword [ebp - 4], eax
jmp 0x10010a8b
jmp 0x10010ba4
mov eax, dword [ebp - 8]
mov cl, byte [eax]
mov byte [ebp - 0x1a], cl
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov al, byte [ebp - 0x1a]
mov byte [ebp - 0xe], al
movzx ecx, byte [ebp - 0xe]
test ecx, ecx
je 0x10010ba4
movzx edx, byte [ebp - 0xe]
cmp edx, 0x23
jne 0x10010b85
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp - 8]
movzx eax, byte [edx + ecx]
cmp eax, 0x23
jne 0x10010b85
mov ecx, 1
shl ecx, 0
mov edx, dword [ebp - 8]
movzx eax, byte [edx + ecx]
cmp eax, 0x23
jne 0x10010b85
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
shr edx, 8
mov eax, dword [ebp - 4]
and eax, 0xff
movzx ecx, byte [ebp - 0xe]
xor eax, ecx
mov ecx, dword [ebp - 0xc]
xor edx, dword [ecx + eax*4]
mov dword [ebp - 4], edx
jmp 0x10010b2f
mov eax, dword [ebp - 4]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x10010e10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.100fb334
add esp, 0x10
xor edx, edx
cmp ebp, esp
call fcn.1011a7c1
pop ebp
ret

Function at 0x10010e40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.100fae83
add esp, 0x10
xor edx, edx
cmp ebp, esp
call fcn.1011a7c1
pop ebp
ret
Function at 0x10013800
Capabilities:
Check for peb ntglobalflag flag
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1011c421
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], 0xcccccccc
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.1000b610
mov ecx, dword [ebp - 0x10]
add ecx, 8
call fcn.1000b610
mov ecx, dword [ebp - 0x10]
add ecx, 0x10
call fcn.1000b610
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.1000b610
mov ecx, dword [ebp - 0x10]
add ecx, 0x20
call fcn.1000b610
mov ecx, dword [ebp - 0x10]
add ecx, 0x28
call fcn.1000b610
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.1000b610
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.1000c7e0
mov ecx, dword [ebp - 0x10]
add ecx, 0x48
call fcn.1000c7e0
mov ecx, dword [ebp - 0x10]
add ecx, 0x4c
call fcn.1000c7e0
mov ecx, dword [ebp - 0x10]
add ecx, 0x50
call fcn.1000b610
mov ecx, dword [ebp - 0x10]
add ecx, 0x68
call fcn.1000b610
mov ecx, dword [ebp - 0x10]
add ecx, 0x70
call fcn.1000d1d0
mov ecx, dword [ebp - 0x10]
add ecx, 0x94
call fcn.1002f6f0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0xbc
call fcn.1002f6f0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0xc8
call fcn.1002f6f0
nop
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
add esp, 0x10
cmp ebp, esp
call fcn.1011a7c1
mov esp, ebp
pop ebp
ret
Function at 0x1004bb00
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov dword [ebp - 4], 0xcccccccc
mov esi, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cmp esi, esp
call fcn.1011a7c1
movsx ecx, ax
and ecx, 0x8000
je 0x1004bb33
mov dword [ebp - 4], 1
jmp 0x1004bb3a
mov dword [ebp - 4], 0
movzx eax, byte [ebp - 4]
pop esi
add esp, 4
cmp ebp, esp
call fcn.1011a7c1
mov esp, ebp
pop ebp
ret