joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40fac0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a52d0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4d0084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x18]
push eax
push 0x54
mov dword [ebp - 0x2c], eax
call fcn.00411df0
mov edi, eax
add esp, 8
mov eax, dword [ebp - 0x24]
mov esi, dword [eax + 0xc]
test esi, esi
je 0x40fb1d
lock inc dword [esi + 8]
mov esi, dword [eax + 0xc]
mov ecx, dword [eax + 8]
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0x410560
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
test esi, esi
je 0x40fb6f
lea eax, [esi + 8]
lock inc dword [eax]
push dword [ebp - 0x2c]
mov dword [edi + 0x20], ecx
mov ecx, dword [ebp + 0xc]
mov dword [edi + 0x24], esi
mov eax, dword [ecx]
mov dword [edi + 0x28], eax
mov eax, dword [ecx + 4]
lea ecx, [edi + 0x30]
mov dword [edi + 0x2c], eax
call fcn.0040f420
mov dword [ebp - 4], 0
test esi, esi
je 0x40fbac
or eax, 0xffffffff
lea ecx, [esi + 8]
lock xadd dword [ecx], eax
jne 0x40fbac
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov eax, dword [ebp + 0xc]
mov esi, 0x10
mov ecx, dword [eax + 4]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x18], ecx
mov ecx, 0x1c
cmp word [eax], 2
mov eax, dword [ebx + 4]
cmovne esi, ecx
add eax, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [ebp - 0x24]
push 0
mov eax, dword [eax]
cmp eax, 0xffffffff
jne 0x40fbfa
mov ecx, dword [ebx + 4]
push 0x2719
push edi
call fcn.004124a0
jmp 0x40fc51
push edi
push esi
push dword [ebp - 0x28]
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push 0
push ecx
push 1
lea ecx, [ebp - 0x20]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_WSASendTo]
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test esi, esi
je 0x40fc48
cmp eax, 0x3e5
je 0x40fc48
push dword [ebp - 0x14]
mov ecx, dword [ebx + 4]
push eax
push edi
call fcn.004124a0
jmp 0x40fc51
mov ecx, dword [ebx + 4]
push edi
call fcn.00412520
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004785e6
mov esp, ebp
pop ebp
ret 0x14
Function at 0x475ea0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4abbf2
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x4d0084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x34], esi
cmp dword [edi + 0x14], 8
jb 0x475ee1
mov eax, dword [edi]
jmp 0x475ee3
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x38], eax
cmp eax, 0xffffffff
jne 0x475f02
push esi
push edi
push ebx
call fcn.00475670
add esp, 0xc
jmp 0x475ffe
test eax, 0x400
je 0x475fbd
cmp dword [edi + 0x14], 8
jb 0x475f17
mov eax, dword [edi]
jmp 0x475f19
mov eax, edi
push eax
lea ecx, [ebp - 0x28]
call fcn.004744c0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push 0x2000000
push 3
push 0
push 7
push 0
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x2c], esi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.00430f90
cmp esi, 0xffffffff
jne 0x475f72
push dword [ebp - 0x34]
push edi
push ebx
call fcn.00475670
add esp, 0xc
jmp 0x475ffe
push edi
call fcn.004751e0
add esp, 4
test al, al
jne 0x475fa5
mov eax, dword [ebp - 0x38]
push eax
push edi
call fcn.004752c0
add esp, 8
mov dword [ebx], 9
mov dword [ebx + 4], eax
push esi
mov dword [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x475ffe
push esi
mov dword [ebp - 4], 5
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x34]
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x475fcf
mov dword [esi], 0
call fcn.00473ff0
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x30], 3
push eax
push edi
test al, 0x10
jne 0x475fe6
mov dword [ebp - 0x30], 2
call fcn.004752c0
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x2c], eax
mov eax, dword [ecx]
add esp, 8
mov dword [ebx], eax
mov eax, dword [ecx + 4]
mov dword [ebx + 4], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004785e6
mov esp, ebp
pop ebp
ret
Function at 0x495877
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x7a9], 0
mov byte [ebp - 0x7a8], 0x4e
mov byte [ebp - 0x7a7], 0x55
mov byte [ebp - 0x7a6], 0x56
mov byte [ebp - 0x7a5], 0x7e
mov byte [ebp - 0x7a4], 0x21
mov byte [ebp - 0x7a3], 0x20
pop ebp
clc
invalid
jmp dword [eax]
mov byte [ebp - 0x7a2], 0x3c
mov byte [ebp - 0x7a1], 0x76
mov byte [ebp - 0x7a0], 0x7e
mov byte [ebp - 0x79f], 0x7e
mov byte [ebp - 0x79e], 0x12
push 0xb
lea eax, [ebp - 0x7ac]
push esp
clc
invalid
call dword [eax - 0x18]
mov dword [0x59ffffe2], eax
push eax
mov eax, dword [ebp - 0x338]
lea eax, [ebp + eax - 0x230]
push eax
call fcn.00493add
add esp, 0xc
jmp 0x495ae4
mov eax, dword [ebp - 0x6fc]
inc eax
mov dword [ebp - 0x6fc], eax
and dword [ebp - 0x37c], 0
call fcn.00493b6c
pop ebp
pop esi
outsd dx, dword [esi]
into
push dword [ebp - 0x3a0]
cld
invalid
invalid
call dword [ebp - 0x704]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
je 0x495b4f
lea eax, [ebp - 0x714]
push eax
call fcn.00493b7c
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.00493b31
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
jne 0x495b4f
jmp fcn.0049550e
cmp dword [ebp - 0x37c], 0
je 0x495b5d
jmp 0x495c12
push 0
push 0
push 2
push 0
push 2
push 0x40000000
push dword [ebp - 0x3a0]
call dword [ebp - 0x3c8]
invalid
invalid
invalid

Function at 0x499b75
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004999f4
Function at 0x10001217
Capabilities:
Parse url

Disassembly:
push ebp
sub esp, 0x44
lea ebp, [esp - 4]
mov eax, dword [0x10035060]
xor eax, ebp
mov dword [ebp + 0x44], eax
push 0x74
mov eax, 0x1002a26d
call fcn.10015181
mov eax, dword [ebp + 0x50]
mov dword [ebp], eax
mov eax, dword [ebp + 0x54]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0x58]
push 0x38
mov dword [ebp + 4], eax
xor edi, edi
lea eax, [ebp - 0x44]
push edi
push eax
mov esi, ecx
mov dword [ebp - 0x48], 0x3c
call fcn.10016970
add esp, 0xc
lea eax, [ebp - 0x48]
push eax
xor ebx, ebx
inc ebx
push edi
push esi
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
test eax, eax
jne 0x10001295
xor eax, eax
jmp 0x10001396
cmp dword [ebp - 0x3c], 3
jne 0x1000128e
push dword [ebp - 0x34]
lea esi, [ebp - 0x64]
push dword [ebp - 0x38]
call fcn.10002036
mov ecx, dword [ebp + 8]
push 0xffffffffffffffff
push edi
push eax
mov dword [ebp - 4], edi
call fcn.1000226e
or dword [ebp - 4], 0xffffffff
push edi
push ebx
mov ecx, esi
call fcn.1000247b
push dword [ebp + 8]
lea ecx, [ebp + 0xc]
call fcn.1000207c
mov dword [ebp - 4], ebx
cmp word [ebp - 0x30], 0x50
je 0x1000130a
movzx eax, word [ebp - 0x30]
push eax
push 0x1002e83c
lea esi, [ebp - 0x64]
call fcn.100122a5
pop ecx
pop ecx
push 0xffffffffffffffff
push edi
lea esi, [ebp + 0xc]
mov byte [ebp - 4], 2
call fcn.1000271c
push edi
push ebx
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], bl
call fcn.1000247b
mov cx, word [ebp - 0x30]
mov eax, dword [ebp + 4]
mov word [eax], cx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
add eax, ecx
push eax
push dword [ebp - 0x1c]
lea esi, [ebp + 0x28]
call fcn.10002036
mov byte [ebp - 4], 3
cmp dword [ebp + 0x3c], edi
jne 0x1000133d
push 0x1002e840
mov ecx, esi
call fcn.10002372
cmp dword [ebp + 0x24], 0x10
mov ecx, dword [ebp + 0x10]
jae 0x10001349
lea ecx, [ebp + 0x10]
cmp dword [ebp + 0x40], 0x10
mov eax, dword [ebp + 0x2c]
jae 0x10001355
lea eax, [ebp + 0x2c]
push ecx
push eax
push str.GET__s_HTTP_1.1_r_nHost:__s_r_nConnection:_close_r_nCache_Control:_no_cache_r_nAccept:___r_n_r_n
lea esi, [ebp - 0x80]
call fcn.100122a5
add esp, 0xc
mov ecx, dword [ebp]
push 0xffffffffffffffff
push edi
push eax
mov byte [ebp - 4], 4
call fcn.1000226e
push edi
push ebx
mov ecx, esi
call fcn.1000247b
push edi
push ebx
lea ecx, [ebp + 0x28]
call fcn.1000247b
push edi
push ebx
lea ecx, [ebp + 0xc]
call fcn.1000247b
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x44]
xor ecx, ebp
call fcn.10014392
add ebp, 0x48
leave
ret
Function at 0x100013b3
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
xor esi, esi
xor eax, eax
mov dword [ebp - 0x20], esi
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push esi
stosd dword es:[edi], eax
push esi
stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
push esi
push esi
mov dword [ebp - 0xc], 0x4000
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push esi
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp + 0xc]
push eax
push esi
push 1
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
mov dword [ebp + 0xc], esi
call dword [sym.imp.WS2_32.dll_WSARecv]
cmp eax, 0xffffffff
jne 0x10001421
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x10001421
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
pop edi
pop esi
leave
ret
push 0x7d0
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1000144f
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CancelIo]
or esi, 0xffffffff
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x1000141d
lea eax, [ebp + 0xc]
push eax
push esi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 8]
mov dword [ebp - 4], esi
call dword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
test eax, eax
je 0x10001442
mov esi, dword [ebp - 4]
jmp 0x10001442
Function at 0x10001981
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push 0x8c
mov eax, 0x1002b718
call fcn.100151ea
mov edi, ecx
xor ebx, ebx
mov esi, 0x1003813c
push ebx
mov eax, esi
mov dword [ebp - 0x7c], edi
call fcn.10012029
test eax, eax
je 0x10001ba4
cmp edi, ebx
je 0x10001ba4
movzx eax, word [0x1003815c]
push 0x3e8
push eax
push esi
call fcn.1001242f
mov edi, eax
or eax, 0xffffffff
add esp, 0xc
cmp edi, eax
je 0x10001ba7
push 0x3f
lea eax, [ebp - 0x4f]
push ebx
push eax
mov byte [ebp - 0x50], bl
call fcn.10016970
add esp, 0xc
lea esi, [ebp - 0x50]
call fcn.10011fa0
push ebx
push ebx
lea eax, [ebp - 0x98]
call fcn.10009a2b
sub esp, 0x18
mov dword [ebp - 4], 2
mov esi, esp
mov dword [ebp - 0x70], esp
push str.client
call fcn.10008a9f
lea eax, [ebp - 0x98]
push eax
mov edx, str.role
mov byte [ebp - 4], 3
call fcn.10009d1e
mov esi, eax
mov byte [ebp - 4], 2
call fcn.10008d93
sub esp, 0x18
lea eax, [ebp - 0x50]
mov esi, esp
mov dword [ebp - 0x70], esp
push eax
call fcn.10008a9f
lea eax, [ebp - 0x98]
push eax
mov edx, str.session
mov byte [ebp - 4], 4
call fcn.10009d1e
mov esi, eax
mov byte [ebp - 4], 2
call fcn.10008d93
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x70], esp
push dword [ebp - 0x7c]
call fcn.10008a9f
lea eax, [ebp - 0x98]
push eax
mov edx, str.serverMQId
mov byte [ebp - 4], 5
call fcn.10009d1e
mov esi, eax
mov byte [ebp - 4], 2
call fcn.10008d93
movzx eax, word [ebp + 8]
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x70], esp
push eax
call fcn.10008a5a
lea eax, [ebp - 0x98]
push eax
mov edx, str.serverPort
mov byte [ebp - 4], 6
call fcn.10009d1e
mov esi, eax
mov byte [ebp - 4], 2
call fcn.10008d93
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x70], esp
push dword [ebp + 0xc]
call fcn.10008a5a
mov byte [ebp - 4], 7
lea eax, [ebp - 0x98]
push eax
mov edx, str.timeout
call fcn.10009d1e
mov esi, eax
mov byte [ebp - 4], 2
call fcn.10008d93
lea eax, [ebp - 0x98]
push eax
lea ecx, [ebp - 0x6c]
call fcn.1000a13e
mov eax, dword [ebp - 0x58]
mov esi, dword [sym.imp.WS2_32.dll_send]
push ebx
mov dword [ebp - 0x74], eax
push 8
lea eax, [ebp - 0x78]
push eax
push edi
mov dword [ebp - 0x78], 0x1f60ba55
call esi
cmp eax, 8
jne 0x10001b83
cmp dword [ebp - 0x54], 0x10
mov eax, dword [ebp - 0x68]
jae 0x10001b37
lea eax, [ebp - 0x68]
push ebx
push dword [ebp - 0x74]
push eax
push edi
call esi
cmp eax, dword [ebp - 0x74]
jne 0x10001b83
push ebx
push 8
lea eax, [ebp - 0x78]
push eax
push edi
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 8
jne 0x10001b83
cmp dword [ebp - 0x74], ebx
jne 0x10001b83
cmp dword [ebp - 0x78], 0x1f60ba55
jne 0x10001b83
push ebx
push 1
lea ecx, [ebp - 0x6c]
call fcn.1000247b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x98]
call fcn.10008d26
mov eax, edi
jmp 0x10001ba7
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
push ebx
push 1
lea ecx, [ebp - 0x6c]
call fcn.1000247b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x98]
call fcn.10008d26
or eax, 0xffffffff
call fcn.1001526d
ret
Function at 0x1000328e
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x1002992a
call fcn.100151b4
xor edi, edi
mov dword [ebp - 4], edi
push 0x18
mov byte [ebp - 4], 1
call fcn.10014a07
mov esi, eax
pop ecx
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 2
cmp esi, edi
je 0x100032d8
mov ecx, dword [ebp + 0x18]
cmp ecx, edi
jne 0x100032c4
mov dword [esi + 0x10], edi
jmp 0x100032da
lea eax, [ebp + 8]
cmp ecx, eax
mov eax, dword [ecx]
jne 0x100032d0
push esi
jmp 0x100032d1
push edi
call dword [eax]
mov dword [esi + 0x10], eax
jmp 0x100032da
xor esi, esi
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push esi
push 0x1000331a
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
or dword [ebp - 4], 0xffffffff
lea esi, [ebp + 8]
mov edi, eax
call fcn.100020fb
mov eax, edi
jmp 0x10003314
call fcn.10015259
ret

Function at 0x10003994
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1002b661
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x10035060]
xor eax, esp
mov dword [esp + 0x44], eax
push ebx
push esi
mov eax, dword [0x10035060]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
xor ebx, ebx
push ebx
push ebx
lea eax, [esp + 0x24]
call fcn.10009a2b
sub esp, 0x18
mov dword [esp + 0x78], 2
mov esi, esp
mov dword [esp + 0x30], esp
push str.server
call fcn.10008a9f
lea eax, [esp + 0x34]
push eax
mov edx, str.role
mov byte [esp + 0x7c], 3
call fcn.10009d1e
mov esi, eax
mov byte [esp + 0x78], 2
call fcn.10008d93
sub esp, 0x18
mov edx, edi
mov esi, esp
mov dword [esp + 0x30], esp
call fcn.10008b52
lea eax, [esp + 0x34]
push eax
mov edx, str.session
mov byte [esp + 0x7c], 4
call fcn.10009d1e
mov esi, eax
mov byte [esp + 0x78], 2
call fcn.10008d93
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x38]
call fcn.1000a13e
mov byte [esp + 0x60], 5
mov eax, dword [esp + 0x48]
push ebx
mov dword [esp + 0x18], eax
push 8
lea eax, [esp + 0x18]
push eax
push dword [edi + 0x20]
mov dword [esp + 0x20], 0x1f60ba55
call sub.WS2_32.dll_send
cmp eax, 8
jne 0x10003add
cmp dword [esp + 0x4c], 0x10
mov eax, dword [esp + 0x38]
jae 0x10003a89
lea eax, [esp + 0x38]
push ebx
push dword [esp + 0x18]
push eax
push dword [edi + 0x20]
call sub.WS2_32.dll_send
cmp eax, dword [esp + 0x14]
jne 0x10003add
mov byte [esp + 0xf], 1
push ebx
push 1
lea ecx, [esp + 0x3c]
call fcn.1000247b
or dword [esp + 0x60], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.10008d26
mov al, byte [esp + 0xf]
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.10014392
mov esp, ebp
pop ebp
ret
push str.handshake_failed
call fcn.100132a2
pop ecx
mov byte [esp + 0xf], bl
jmp 0x10003aa2
Function at 0x10003b13
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x10035060]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
xor eax, eax
push edi
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x214], eax
push eax
mov esi, 0x200
jmp 0x10003b6a
add dword [ebp - 0x210], edi
push 0
push edi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0xc]
call sub.WS2_32.dll_send
cmp eax, edi
jne 0x10003ba3
add dword [ebp - 0x214], eax
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 8]
call sub.WS2_32.dll_recv
mov edi, eax
test edi, edi
jg 0x10003b3e
cmp byte [ebp + 0x10], 0
je 0x10003bee
cmp dword [ebx + 0x18], 0x10
lea esi, [ebx + 4]
jb 0x10003b93
mov eax, dword [esi]
jmp 0x10003b95
mov eax, esi
push eax
call sub.WS2_32.dll_WSAGetLastError
push eax
push str.internal_socket_read_error__d__on_session__s__disconnected_or_error
jmp 0x10003bbe
cmp dword [ebx + 0x18], 0x10
lea esi, [ebx + 4]
jb 0x10003bb0
mov eax, dword [esi]
jmp 0x10003bb2
mov eax, esi
push eax
call sub.WS2_32.dll_WSAGetLastError
push eax
push str.socket_write_error__d__on_session__s
call fcn.1001317a
add esp, 0xc
cmp byte [ebp + 0x10], 0
je 0x10003bee
cmp dword [ebx + 0x18], 0x10
jb 0x10003bd4
mov esi, dword [esi]
push dword [ebp - 0x214]
push dword [ebp - 0x210]
push esi
push str.sesseion__s:_readed__d_bytes__writed__d_bytes
call fcn.10012ee7
add esp, 0x10
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.10014392
leave
ret 0xc

Function at 0x100120e9
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x434
mov eax, dword [0x10035060]
xor eax, esp
mov dword [esp + 0x430], eax
mov eax, fcn.1001218b
push esi
test eax, eax
je 0x10012176
push 0x424
lea eax, [esp + 0x10]
push 0
push eax
call fcn.10016970
add esp, 0xc
push dword [ebp + 8]
mov dword [esp + 0xc], 0x428
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [esp + 4], esi
test esi, esi
je 0x1001216d
cmp esi, 0xffffffff
je 0x1001216d
lea eax, [esp + 8]
push eax
push esi
call sub.KERNEL32.dll_Module32FirstW
jmp 0x10012169
push edi
lea eax, [esp + 0xc]
push eax
call fcn.1001218b
test eax, eax
je 0x1001216d
lea eax, [esp + 8]
push eax
push esi
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x1001214f
lea eax, [esp + 4]
call fcn.10001201
mov ecx, dword [esp + 0x434]
pop esi
xor ecx, esp
call fcn.10014392
mov esp, ebp
pop ebp
ret 4
Function at 0x10013a88
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 4
shl eax, 4
pop edx
mov esi, ecx
lea edi, [eax + ecx + 0x3c]
mov dword [ebp - 4], edx
xor eax, eax
mov ecx, edi
mov bl, byte [ecx]
xor byte [esi + eax], bl
inc eax
add ecx, edx
cmp eax, edx
jl 0x10013aa2
inc edi
add esi, edx
dec dword [ebp - 4]
jne 0x10013a9e
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10013bbd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10035060]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 4
lea esi, [ebp - 8]
lea ecx, [eax + 4]
pop edi
mov al, byte [esi - 0xc]
mov dl, byte [esi - 8]
call fcn.10013d83
mov bl, al
mov al, dl
call fcn.10013d83
xor bl, al
xor bl, byte [esi - 4]
mov al, dl
xor bl, byte [esi]
xor bl, dl
mov byte [ecx - 4], bl
call fcn.10013d83
mov bl, al
mov al, byte [esi - 4]
call fcn.10013d83
xor bl, al
xor bl, byte [esi - 0xc]
mov al, byte [esi - 4]
xor bl, byte [esi]
xor bl, al
mov byte [ecx], bl
call fcn.10013d83
mov bl, al
mov al, byte [esi]
call fcn.10013d83
xor bl, al
mov al, byte [esi]
xor bl, dl
xor bl, byte [esi - 0xc]
xor bl, al
mov byte [ecx + 4], bl
call fcn.10013d83
mov bl, al
mov al, byte [esi - 0xc]
call fcn.10013d83
xor bl, al
xor bl, dl
xor bl, byte [esi - 4]
xor bl, byte [esi - 0xc]
inc ecx
mov byte [ecx + 7], bl
inc esi
dec edi
jne 0x10013be5
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10014392
leave
ret 4
Function at 0x10013c72
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10035060]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x10]
lea esi, [eax + 4]
mov dword [ebp - 0x1c], 4
mov al, byte [edi - 4]
mov bl, byte [edi + 4]
call fcn.10013dff
push ebx
mov dl, al
call fcn.10013dd8
xor dl, al
movzx eax, byte [edi + 8]
push eax
call fcn.10013d93
xor dl, al
movzx eax, byte [edi]
push eax
call fcn.10013db1
xor dl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi - 4], dl
call fcn.10013d93
push ebx
mov byte [ebp - 0x15], al
call fcn.10013db1
mov cl, byte [ebp - 0x15]
xor cl, al
movzx eax, byte [edi + 8]
push eax
mov byte [ebp - 0x15], cl
call fcn.10013dd8
mov cl, byte [ebp - 0x15]
xor cl, al
mov al, byte [edi]
mov byte [ebp - 0x15], cl
call fcn.10013dff
mov cl, byte [ebp - 0x15]
xor cl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi], cl
call fcn.10013dd8
mov bl, al
mov al, byte [edi + 4]
call fcn.10013dff
movzx edx, byte [edi + 8]
push edx
xor bl, al
call fcn.10013db1
xor bl, al
movzx eax, byte [edi]
push eax
call fcn.10013d93
xor bl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi + 4], bl
call fcn.10013db1
mov bl, al
movzx eax, byte [edi + 4]
push eax
call fcn.10013d93
xor bl, al
mov al, dl
call fcn.10013dff
xor bl, al
movzx eax, byte [edi]
push eax
call fcn.10013dd8
xor bl, al
mov byte [esi + 8], bl
inc esi
inc edi
dec dword [ebp - 0x1c]
jne 0x10013c9e
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10014392
leave
ret 4