joyce8/EMBER2024-capa huggingface dataset:
Function at 0x272e5672
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push eax
setge ah
rcl eax, 0xa4
btc eax, 0xa5
lea esp, [esp - 0x3c]
clc
mov eax, dword [0x270b313c]
stc
test al, 0xaa
cmp si, 0x781f
xor dword [ebp - 8], eax
jmp 0x2736d392
push edi
movsx ebx, cx
not di
movzx ebx, di
push eax
movzx eax, ax
movsx eax, sp
bswap ax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
movzx eax, bp
jmp 0x2727d22f
push 0x2a
push esi
jmp 0x272d0b0b
call sym.SocksCapExDLL32.dll_Ordinal_260
push 0
jmp 0x27193110
push str.curl_7.77.1_DEV
push 0x2722
jmp 0x272feb7e
mov dword [ebp - 0x34], eax
nop
cmovno eax, ecx
mov eax, dword [ebp + 0x23c]
mov dword [ebp - 0x3c], eax
jmp 0x272f9678
lea esp, [esp - 0x20c]
sar al, 0xb5
push 0xfffffffffffffffe
sal al, cl
push 0x27368004
bsf eax, ecx
push 0x2708a1fd
bts eax, ebp
mov eax, dword fs:[0]
jmp 0x2717e7c1
push esi
jmp loc.2701f204
mov eax, dword [ebp + 0x230]
movsx bx, ch
mov dword [ebp - 0x2c], eax
mov eax, esp
seta bl
mov ebx, dword [ebp + 0x234]
cbw
cwde
mov dword [ebp - 0x40], ebx
mov eax, dword [ebp + 0x238]
jmp 0x271dcb65
mov dword [ebp - 0x18], esp
lahf
mov edi, ebp
mov eax, dword [ebp + 0x214]
mov dword [ebp - 0x20], eax
movsx ax, ch
movzx ebx, dx
mov eax, dword [ebp + 0x218]
xchg edi, ebx
mov dword [ebp - 0x24], eax
jmp 0x2732830e
push 0x2b
jmp 0x2721194b
call sym.SocksCapExDLL32.dll_Ordinal_260
push 1
jmp 0x2729d748
push ebp
btc ax, dx
lea ebp, [esp - 0x20c]
jmp 0x271f2ff3
call sym.SocksCapExDLL32.dll_Ordinal_259
mov esi, eax
mov dword [ebp - 0x48], esi
jmp 0x271b8da3
push esi
jmp 0x271ace1f
mov eax, dword [ebp + 0x21c]
mov dword [ebp - 0x28], eax
cmovle bx, bx
mov edi, dword [ebp + 0x220]
mov bx, dx
lahf
mov eax, dword [ebp + 0x224]
not bh
mov bh, 0x3c
movzx ebx, dx
mov dword [ebp - 0x4c], eax
cmovs bx, sp
mov eax, dword [ebp + 0x228]
mov dword [ebp - 0x44], eax
movsx bx, ch
mov eax, dword [ebp + 0x22c]
mov dword [ebp - 0x30], eax
not ah
jmp 0x2726fa5c
mov dword [ebp + 0x208], eax
push ebx
push esi
jmp 0x27181974
xor eax, ebp
jmp 0x27337b83
Function at 0x272f11e9
Capabilities:
Terminate process

Disassembly:
mov dword [ebp - 0x62c], esi
jmp loc.272e5a7f
call fcn.27012080
jmp 0x273337ae
jne 0x271f1a28
call sub.WS2_32.dll_WSAGetLastError
sub ecx, ecx
jmp 0x27321e60
push eax
jmp 0x2722fc72
call fcn.2702778a
pop ecx
jmp 0x272e4051
push eax
jmp 0x2727edf7
call fcn.27028284
lea eax, [ebp - 0x218]
push eax
cwde
xchg al, al
push str.WSASocket
xchg al, ah
lea eax, [ebp - 0x618]
push 0x200
jmp 0x272fa9b0
push edi
jmp 0x27319042
lea eax, [ebp - 0x218]
jmp 0x2720e50a
mov dword [ebx], esi
lea esi, [ebp - 0x62c]
jmp 0x2727dce7
mov dword [ebp - 0x62c], edi
push 2
adc ah, bh
pop eax
test si, di
mov byte [ebp - 4], 1
jmp 0x2728f0c0
call sub.WS2_32.dll_bind
cmp eax, 0xffffffff
jmp 0x2734952f
push eax
bswap eax
setbe ah
push str.bind_failed:__s__d_
movzx eax, di
lea eax, [ebp - 0x618]
jmp 0x27343246
push edi
mov dword [ebp - 0x624], esi
jmp 0x2720e422
mov word [ebp - 0x626], ax
jmp 0x27277946
call fcn.2708a127
mov eax, dword [ebp + 8]
rcl bl, 0x3e
bswap bx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x630], eax
bswap ax
shld ax, sp, 0x3a
mov eax, dword [ebp + 0x14]
clc
cmc
sub esi, esi
stc
test edx, 0x7b28f70b
mov dword [ebp - 0x648], ebx
mov dword [ebp - 0x640], eax
stc
test sp, sp
mov dword [ebp - 0x634], esi
push 1
push esi
push esi
cmp dh, cl
stc
push 6
push 1
clc
test ch, 0xa7
mov dword [ebp - 4], esi
or dword [ebp - 0x63c], 0xffffffff
clc
cmc
or dword [ebp - 0x638], 0xffffffff
jmp 0x272d048f
call fcn.2735868d
mov eax, ebx
call fcn.2708a171
ret 0x18
push 0x10
movzx ax, dl
mov eax, 0x46a85d24
lea eax, [ebp - 0x628]
jmp 0x271b7b7f
mov byte [ebp - 4], 0
jmp 0x271840f6
call fcn.27027248
add esp, 0xc
jmp 0x271e2219
push 0x10
jmp 0x271bd603
mov word [ebp - 0x628], ax
sub eax, eax
jmp 0x272496ee
call sub.WS2_32.dll_WSASocketW
mov edi, eax
test bx, si
jmp 0x2734e751
push 2
jmp 0x272c9915
jmp 0x271e2219
push 0x2701e83e
jmp 0x271de906
push 0x63c
bswap eax
cmovno eax, edi
mov eax, 0x2708eac8
jmp 0x2724cfbd
push eax
call sub.msvcrt.dll__snwprintf
push str.ErrMsg
cwde
setbe al
bswap eax
lea eax, [ebp - 0x618]
jmp loc.2701fc66
call sub.KERNEL32.dll_BindIoCompletionCallback
test eax, eax
jmp 0x2735f224
push esi
jmp 0x272efce1
mov word [ebp - 0x218], cx
lea ecx, [ebp - 0x218]
jmp 0x271dbc32
or dword [ebp - 4], 0xffffffff
lea edi, [ebp + 0x10]
jmp 0x2726e3b3
push 0x200
push eax
jmp 0x27343e73
call sub.msvcrt.dll__snwprintf
add esp, 0x14
mov ax, 0xcf87
push str.ErrMsg
lea eax, [ebp - 0x618]
jmp 0x272844a2
jne 0x2731bfe9
call sub.WS2_32.dll_WSAGetLastError
mov edi, eax
xor eax, eax
bswap ecx
mov word [ebp - 0x218], ax
movsx cx, ch
cbw
movzx ecx, dx
lea ecx, [ebp - 0x218]
mov ax, si
mov eax, edi
jmp 0x2735c691
mov dword [ebp - 0x644], edi
cmp edi, 0xffffffff
jmp 0x27195857
call fcn.27028284
push edi
jmp 0x271e01b1
jne 0x27023286
push str.BindIoCompletionCallback_failed__r_n
jmp 0x271bae6d
Function at 0x272f5088
Capabilities:
Get hostname

Disassembly:
push esi
jmp 0x2733a9b0
je 0x2732e68a
sub eax, eax
jmp loc.2702050c
push 0x2e
jmp 0x2718c249
push esi
jmp 0x27222e29
je 0x2723e63e
push 0x3a
jmp loc.270083b9
call edi
pop ecx
xadd ecx, ecx
btr ecx, 0x21
pop ecx
test eax, eax
jmp 0x2721e362
je 0x2723e63e
mov ebx, dword [sym.imp.msvcrt.dll_strchr]
jmp 0x271fe9fd
jne 0x2735a547
push 0x80
jmp 0x272a76c3
xor eax, eax
mov bx, si
cmovl di, cx
not bh
pop ebx
pop edi
ret
push edi
movsx edi, si
mov edi, 0xe4b4248d
bswap di
mov edi, 0x270bb4b0
jmp 0x27233782
push edi
jmp 0x2735a542
je 0x2723e63e
push edi
mov edi, edx
bswap edi
mov edi, dword [sym.imp.msvcrt.dll__stricmp]
jmp 0x2720dfb3
call fcn.2736c79a
test eax, eax
jmp 0x271cc3e6
cmp byte [0x270bb4b0], 0
jmp 0x2728a8fb
call ebx
pop ecx
or ecx, ecx
movzx ecx, bp
test bh, 0xb4
pop ecx
test eax, eax
jmp 0x272dc7c3
call sub.WS2_32.dll_gethostname
push ebx
test esi, esi
jmp 0x27227ec2

Function at 0x272f9f64
Capabilities:
Create process on windows
Terminate process

Disassembly:
sub eax, eax
ror cx, 0x10
btc edi, 0x99
mov ecx, dword [ebp - 0xc]
ror edi, 0xb1
sbb di, 0x5723
mov dword fs:[0], ecx
ror bx, 0x99
sar ebx, 0x2f
pop ecx
adc ecx, 0xd9cf3ab
or cl, 0x91
clc
pop edi
add cx, si
pop esi
sub ebx, eax
pop ebx
mov ecx, dword [ebp + 0x428]
test edx, 0x5cbc67a9
cmp ebp, 0xd01b7c05
xor ecx, ebp
jmp 0x272ae4c3
mov dword [ebp + 0x428], eax
push 0x40
mov ax, bp
mov eax, 0x2708d6ab
jmp 0x2727811c
call fcn.2708a0be
call fcn.27027843
mov ecx, 0x500
test di, 0xb491
clc
cmp ax, cx
jmp 0x272dfc66
call fcn.27088f70
add ebp, 0x42c
jmp loc.2700d756
ja 0x271902f2
sub esi, esi
jmp 0x27365076
push ebp
ror ah, cl
lea esp, [esp - 0x428]
rcr ax, cl
lea ebp, [esp - 4]
sbb ax, bp
mov eax, dword [0x270b313c]
stc
xor eax, ebp
jmp 0x271c0f09
push esi
jmp loc.2702c3e9
Function at 0x272fb79c
Capabilities:
Initialize winsock library

Disassembly:
call sub.WS2_32.dll_WSAStartup
neg eax
not di
xchg ecx, ecx
movsx edi, si
sbb eax, eax
inc eax
bts edi, esi
mov dword [esp + 0x18], eax
push 8
or di, 0xe928
mov ecx, esp
pop ecx
stc
mov dword [esp + 0x1e0], ebx
inc edi
xor eax, eax
movsx edi, sp
jmp 0x271bc8a2
lea edi, [esp + 0x1c]
jmp 0x2727aed9
sub eax, eax
cmovp di, cx
mov ecx, dword [esp + 0x1d8]
or si, dx
rcr bx, cl
add esi, ecx
mov dword fs:[0], ecx
sal ch, cl
pop ecx
ror si, 0xbc
xor esi, 0xbb4011a
pop edi
pop esi
pop ebx
xor cl, 0x3c
sub ecx, 0xe7203832
mov ecx, dword [esp + 0x1c0]
test si, 0xa333
xor ecx, esp
jmp 0x272ef7ac
rep stosd dword es:[edi], eax
movsx eax, bp
cbw
lea eax, [esp + 0x14]
push eax
not eax
movzx ax, bl
lea eax, [esp + 0x20]
jmp loc.2708faf4
je 0x272250bc
cmp esi, ebx
je 0x272250bc
lea eax, [esp + 0x3c]
jmp 0x272e71ab
push 0x202
jmp 0x27180671
push eax
jmp 0x272902b6
call fcn.27088f70
mov esp, ebp
xchg ebp, ebp
not bp
pop ebp
jmp loc.2708f3c4
push ebp
bts bp, si
mov ebp, esp
btr ax, dx
shrd ax, di, 0x81
add ah, bh
and esp, 0xfffffff8
sub al, 0xbe
push 0xffffffffffffffff
and ax, sp
push 0x2708d064
bt ax, 0x31
mov eax, dword fs:[0]
cmp bl, 0x28
stc
push eax
sub esp, 0x1c8
dec ah
bswap eax
bsr ax, si
mov eax, dword [0x270b313c]
xor eax, esp
test di, bx
mov dword [esp + 0x1c0], eax
and al, 0x10
neg eax
push ebx
ror ax, cl
cmp esp, 0x5ab2052a
push esi
btr esi, esp
push edi
mov eax, dword [0x270b313c]
bt si, 0x8d
xor eax, esp
push eax
neg si
lea eax, [esp + 0x1d8]
dec si
mov dword fs:[0], eax
btc esi, 0xa3
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
cmc
test eax, esp
cmp esi, 0x80a4d9a7
xor ebx, ebx
cmp edi, 0xcba76c9b
mov dword [esp + 0x10], eax
cmp di, 0xc8af
test bp, bx
cmp eax, ebx
jmp 0x2727cd62

Function at 0x27302076
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, ebx
mov cx, ax
lea ecx, [eax + 1]
xchg dl, dl
mov dl, byte [eax]
jmp loc.27316089
jne 0x2701159a
mov edx, esi
jmp 0x27275874
push esi
cmp bh, 0xb7
cmc
test ecx, 0x4e1c200f
sub eax, eax
cmp bp, 0x1cba
push edi
jmp 0x272357c6
test ebx, ebx
je 0x27308bb1
mov esi, dword [ebp + 0xc]
push 7
movzx edx, ax
setnp cl
bswap cx
pop ecx
mov edi, edi
mov dx, 0xf2a7
push 0x10
lea edi, [esp + 0x1c]
cwd
mov dh, 0x17
rep stosd dword es:[edi], eax
pop eax
movzx edx, bx
push 2
xchg dh, dl
mov dh, 0x20
pop ecx
movzx edx, bx
mov dh, 7
not dl
push ebx
movzx dx, ch
mov word [esp + 0x1c], cx
movzx dx, dl
mov ecx, dword [esi]
push 1
mov dl, 0x23
cwd
mov dword [esp + 0x24], ecx
xchg cl, dh
setae dl
push esi
push eax
bswap edx
cmovp ecx, ebp
lea edx, [esp + 0x24]
lea ecx, [esp + 0x28]
jmp 0x27278a04
mov ecx, ebx
call fcn.2731913a
test eax, eax
jmp loc.2701158b
mov dword [esp + 0x44], eax
call fcn.272daa60
lea esp, [esp + 0x10]
cmc
test sp, bp
mov dword [esp + 0x10], eax
cmc
cmp eax, 1
jmp 0x272ea3d4
and esp, 0xfffffff8
test dl, dh
sub esp, 0x2c
test cx, 0xc25
push ebx
mov ebx, dword [ebp + 8]
stc
jmp 0x272129d5
jne 0x2701159a
cmp dword [esp + 0x14], 0
jmp 0x271e1e1b
push ebp
bts bp, si
shr ebp, 0xbf
mov ebp, esp
jmp 0x2728232a
pop edi
mov esi, 0xbb05902f
xchg bl, bl
pop esi
pop ebx
jmp loc.27011205
Function at 0x2731d6d6
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov dword [esp + 0x18], edi
call fcn.27007877
xor edi, edi
jmp 0x27218067
inc edi
mov dword [esp + 0x1c], edi
jmp loc.27007a77
push ebp
movsx ebp, sp
mov ebp, esp
btr ax, sp
sar eax, cl
shl al, cl
and esp, 0xfffffff8
push 0xffffffffffffffff
btc ax, 0x24
movsx eax, bp
push 0x2708da7b
sub eax, edi
mov eax, dword fs:[0]
test di, di
cmp esp, 0xa8372297
push eax
sub esp, 0x20
setns al
push ebx
push esi
cwde
ror ax, cl
test bx, cx
push edi
clc
bt eax, 0xa2
mov eax, dword [0x270b313c]
xor di, cx
xchg di, di
xor eax, esp
not edi
mov edi, esp
push eax
movzx ax, bl
cwde
movsx eax, bp
lea eax, [esp + 0x30]
mov edi, 0x93201b81
xchg di, di
mov dword fs:[0], eax
not edi
movsx edi, dx
mov edi, 0x270c4c88
jmp 0x27189039

Function at 0x2731e751
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
jmp 0x27264c63
mov dword [eax + 4], 0xefcdab89
jmp 0x272beddc
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
jmp loc.2702ef66
and dword [eax + 0x10], 0
and dword [eax + 0x14], 0
jmp 0x2725b4cf

Function at 0x2731ec79
Capabilities:
Get local ipv4 addresses

Disassembly:
mov dword [esp + 0x20], edi
jmp 0x271b3448
push eax
btc eax, esi
sub esp, 0x30
xchg al, ah
push ebx
inc ax
shr ah, 0x85
push esi
push edi
bsf si, dx
mov eax, dword [0x270b313c]
movzx esi, di
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov esi, eax
mov si, 0x17b8
mov dword fs:[0], eax
dec esi
adc eax, 0x5b91d283
mov esi, dword [sym.imp.msvcrt.dll_malloc]
movzx eax, sp
sar al, cl
xchg al, ah
mov eax, 0x280
xor edi, edi
jmp 0x272eb490
mov dword [esp + 0x24], edi
jmp loc.27019334
push eax
mov dword [esp + 0x1c], edi
jmp 0x271785f6
push ebp
adc al, 0xa2
mov ebp, esp
ror ah, 9
shr eax, 0x1a
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x2708d53d
movzx eax, ax
bsf ax, di
mov eax, dword fs:[0]
cmp edx, 0x981cf72d
jmp 0x27191d7c
Function at 0x2732092e
Capabilities:
Receive data
Receive data on socket

Disassembly:
lea edi, [ebx + 0xc]
mov dword [ebp - 0x18], edi
jmp 0x272f47e4
jne 0x2718324a
mov dword [esi + 0x3c], edi
mov cx, sp
mov dword [eax], edi
xchg ch, ch
movsx ecx, bp
push edi
push esi
lea ecx, [ebp + 8]
jmp 0x271e8471
lea eax, [esi + 0x38]
cmc
mov dword [esi + 0x14], edi
cmova ecx, edx
mov dword [esi + 0x18], edi
add ch, dh
sal ch, 0x95
movzx ecx, di
mov dword [eax], 0x2000
sar cx, 0xa3
mov ecx, dword [ebx + 0x223c]
cmp ax, di
cmc
cmp ecx, edi
je 0x2718324a
cmp word [ecx + 0x16], 2
jmp 0x27183237
call fcn.2708a0be
mov esi, ecx
bsf ebx, ebx
mov ebx, dword [ebp + 8]
cmovl eax, ebp
mov eax, dword [esi + 0x30]
cmc
test eax, eax
jne 0x27174d86
xor eax, eax
call fcn.2708a15d
ret 8
inc edx
cmc
test cl, 0xc
mov dword [ebp - 0x14], edx
sub edi, edi
test ecx, 0x998ffe1c
clc
mov dword [ebp - 4], edi
test bx, bx
cmp dword [esi + 0x30], edi
jmp 0x2727e9f4
push ecx
bswap cx
lea ecx, [ebp - 0x10]
jmp 0x2722f7f2
mov dword [ebp + 8], edi
call sub.WS2_32.dll_WSARecv
cmp eax, 0xffffffff
jne 0x272c2a11
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x3e5
jmp 0x2702acb9
push eax
push dword [ebx + 4]
mov dword [ebp - 0x10], edi
jmp 0x271ff5f9
push ecx
jmp 0x27339d8a
jne 0x271938fc
lea esi, [ebp - 0x18]
jmp 0x272a0b94
call fcn.270077dd
jmp 0x2719c18d
inc edi
jmp 0x272d2e40
sub edi, edi
jmp 0x272a484c
jmp 0x2736ca93
call fcn.27007877
xor edx, edx
jmp 0x271b071d
push 0xc
movzx ax, bh
mov eax, 0x2708d266
jmp 0x2719c171
push edx
jmp 0x2722198c
lea esi, [ebp - 0x18]
call fcn.270077dd
mov eax, edi
jmp 0x2719c18f
Function at 0x2732508e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jne 0x271f52e7
mov dword [ebp + 8], 3
jmp 0x271a5656
jmp 0x271f52f7
mov dword [ebp + 8], eax
mov byte [edi], al
mov byte [edi + 1], al
mov byte [edi + 2], al
cmp edx, esp
cmp ah, 0x99
cmp dword [ebx + 0x54], eax
jmp 0x2700fd52
push ebp
btr ebp, ecx
shr bp, 0x38
mov ebp, esp
stc
push ebx
xor bl, bh
not bh
mov ebx, dword [ebp + 8]
stc
push esi
test dx, di
sub eax, eax
cmp word [ebx + 0x16], 0x55
push edi
cmovo edi, esi
mov edi, 0x1425b0bc
mov edi, dword [ebp + 0xc]
jmp 0x2717e6ea

Function at 0x27337e98
Capabilities:
Encode data using base64

Disassembly:
je fcn.27311364
push ebx
jmp 0x27343bb7
jne 0x2723cfbb
movzx ecx, byte [ebp - 4]
adc dh, al
shrd bx, dx, 6
mov edx, ecx
shr edx, 2
cmovne bx, si
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], dl
movzx edx, byte [ebp - 3]
test sp, bp
inc bh
and ecx, 3
and bx, 0xa1a2
bsf bx, si
xadd bl, bl
mov ebx, edx
shl ecx, 4
shr ebx, 4
mov cl, byte [ebx + ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
clc
mov byte [eax + 1], cl
adc ebx, edx
neg cl
rcr bl, 0x37
movzx ecx, byte [ebp - 2]
mov ebx, ecx
cmp esi, 0x633949b6
and edx, 0xf
test sp, 0x2235
shr ebx, 6
stc
cmc
cmp bx, bp
mov dl, byte [ebx + edx*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
test esp, ebx
mov byte [eax + 2], dl
clc
test ebp, esi
and ecx, 0x3f
jmp 0x2723cfab
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 3], cl
xor edx, edx
add eax, 4
inc cl
inc edi
shr cl, cl
sub cl, 0x30
mov cl, byte [edi]
stc
test cl, cl
jmp loc.27019cd5
inc edx
cmp ecx, edx
clc
test sp, ax
cmp edx, 3
jmp 0x272138d7
push ebp
jmp 0x27352b0d
mov byte [ebp + edx - 4], cl
jmp 0x27268f1d
mov ebp, esp
test dx, ax
cmp dh, 0xaf
push ecx
push edi
rcl edi, 0xb
adc di, 0xfd31
inc edi
mov edi, ecx
inc cl
adc cl, cl
mov cl, byte [edi]
cmp bh, 0x3c
sub edx, edx
test cl, cl
jmp 0x271ba54e

Function at 0x273420d6
Capabilities:
Terminate process

Disassembly:
push ebx
push 6
jmp loc.2700a826
push ebx
jmp 0x2717b1a4
push 1
jmp 0x27185390
mov dword [ebp - 0x20], edi
jmp 0x27315b5c
mov dword [ebp + 0x618], eax
lahf
not ax
push 0x14
cbw
lahf
not ax
mov eax, 0x2708e1a9
jmp 0x271fe8eb
call fcn.2708a0be
mov edi, ecx
xor si, dx
mov esi, edx
test cl, 0x8c
sub ebx, ebx
jmp 0x271a71ff
mov dword [ebp - 0x14], esi
jmp 0x27367f43
push ebp
btc bp, 0xb9
test di, si
sub esp, 0x618
add al, 0x3d
mov ah, cl
lea ebp, [esp - 4]
movzx eax, bx
mov eax, dword [0x270b313c]
test edx, edi
stc
clc
xor eax, ebp
jmp 0x271f807a
mov dword [ebp - 0x1c], ebx
jmp 0x271913cc
Function at 0x273457a3
Capabilities:
Set thread local storage value

Disassembly:
push dword [sym.SocksCapExDLL32.dll_Ordinal_198]
jmp 0x271a9f58
call sub.KERNEL32.dll_TlsSetValue
cmp esi, edi
jmp 0x2718c96f
jne 0x27364784
or eax, 0xffffffff
jmp 0x271c4ff8
push dword [ebp + 8]
jmp 0x2735fb63
mov esi, eax
jmp 0x2718b5bc
push edi
jmp 0x27287c3f
call fcn.2731dc4c
pop ecx
movzx eax, si
mov eax, edi
mov si, bx
pop edi
mov esi, edi
pop esi
bswap ebp
xchg ebp, ebp
movsx ebp, bx
pop ebp
jmp 0x2701e3cd
call fcn.272ce295
add esp, 0x20
mov esi, 0x35af7a95
push edi
mov si, dx
jmp 0x2717e89a
push edi
jmp 0x27233aa2
push sym.SocksCapExDLL32.dll_Ordinal_116
jmp 0x273584d2
push dword [ebp + 0x10]
jmp 0x272d5666
push dword [ebp + 8]
jmp 0x271fae85
push dword [sym.SocksCapExDLL32.dll_Ordinal_198]
call sub.KERNEL32.dll_TlsSetValue
sub edi, edi
jmp 0x2721a3e1
push dword [ebp + 0x14]
jmp 0x2724fea4
push esi
jmp 0x271c4fea
push edi
jmp 0x271a1951
push dword [ebp + 0xc]
jmp 0x272566f0
push ebp
mov bp, 0x609f
not bp
mov ebp, esp
push esi
jmp 0x272c636a
push sym.SocksCapExDLL32.dll_Ordinal_115
jmp 0x271c21e2
call sub.WS2_32.dll_inet_addr
mov edi, eax
test eax, 0x21a24f0b
cmp edi, 0xffffffff
jne 0x271c4ff3
push 1
jmp 0x27256e1f
mov eax, dword [esi + 0xc]
mov eax, dword [eax]
xchg edi, edi
mov edi, dword [eax]
jmp 0x272a0c29

Function at 0x273486d4
Capabilities:
Authenticate hmac

Disassembly:
mov eax, dword [ebp + 0x10]
mov dl, 0x29
push esi
mov esi, ecx
jmp loc.270259d5
push ebp
cbw
sbb al, 0xbd
mov ebp, esp
sub esp, 0x10c
lahf
or al, 0xaa
mov eax, dword [0x270b313c]
neg dl
add dl, 0xa4
xor eax, ebp
mov dword [ebp - 8], eax
cwde
inc al
mov ah, 0xac
mov eax, dword [ebp + 8]
mov dword [ebp - 0xb4], eax
mov ax, di
jmp 0x2729e3f3

Function at 0x27354786
Capabilities:
Connect socket

Disassembly:
pop ebx
jmp 0x272bb3b6
call fcn.272b947a
mov eax, 0x103
jmp 0x2717b108
call fcn.272b947a
movzx eax, word [esi]
jmp 0x272e0378
call sub.WS2_32.dll_socket
mov dword [edi], eax
cmc
cmp eax, 0xffffffff
jmp 0x2723e9dc
test edi, edi
jmp 0x2724049d
jne 0x272404a3
xor ecx, ecx
dec ah
push ebx
lahf
movzx ebx, word [edi + 0x1a]
inc ecx
mov al, 0x8c
movzx eax, ax
mov eax, edi
jmp 0x271bfcf1
je 0x2731e349
push dword [esp + 0xc]
jmp 0x272b01ea
jne 0x27269fee
mov eax, 0x101
pop esi
ret
test esi, esi
jmp 0x27300fc8
push eax
jmp 0x271e2412
push esi
push eax
jmp 0x2702b40f
pop esi
jmp 0x27008454
push 0
jmp 0x27314808
je 0x272404a3
cmp word [edi + 0x16], 0
jmp 0x2722926d
push 1
jmp 0x27272ae2
mov ecx, ebx
mov eax, edi
jmp 0x27197377
push esi
shl si, 0xf
rcr si, 0xb7
sbb esi, 0x7083e609
mov esi, eax
jmp 0x2721fb41
Function at 0x2736648a
Capabilities:
Initialize winsock library
Read .ini file

Disassembly:
lea eax, [esp + 0x434]
push eax
push 0x202
jmp fcn.272c5ea7
call fcn.27007699
push dword [esp + 0x10]
jmp 0x272d0f89
mov dword [esp], str.configdnsmap.ini
jmp 0x272a6f21
call fcn.270070be
pop ecx
cbw
pop ecx
shl al, cl
mov byte [esp + 0x5d8], 2
mov eax, dword [esp + 0x18]
jmp 0x27282ccc
push eax
cmovnp ax, di
mov ax, 0xaeae
cwde
lea eax, [esp + 0x5d0]
jmp 0x27230471
mov dword fs:[0], eax
call fcn.270277ac
push eax
not si
lea esi, [esp + 0x1c]
jmp 0x272c4b17
jne 0x2701c707
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
jmp loc.2702dd5d
add eax, 0xfffffff0
jmp 0x271cb519
push ecx
mov ecx, edi
not ecx
mov ecx, eax
jmp 0x2721a904
mov dword [esp + 0x5dc], esi
seta cl
cmovnp cx, si
lea ecx, [esp + 0x14]
jmp 0x271eded4
call fcn.27026a82
xor esi, esi
jmp 0x272ba7bd
call fcn.2702681a
pop ecx
cmp ecx, 0xcbb6c31e
test eax, eax
jmp 0x2725a1fd
push ebp
mov ebp, esp
or ah, 0x10
rcr ah, cl
bt ax, 0xba
and esp, 0xfffffff8
push 0xffffffffffffffff
dec ax
sar ax, 0x97
cmc
push 0x2708dab7
btc ax, sp
mov eax, dword fs:[0]
push eax
lea esp, [esp - 0x5c4]
shr ah, 0x2d
mov eax, dword [0x270b313c]
cmp esp, edi
xor eax, esp
test bx, 0x181a
stc
mov dword [esp + 0x5bc], eax
shrd eax, esp, 0x16
rol eax, 0x19
push esi
rcr ax, 0x3c
cmc
push edi
movzx eax, bp
btr eax, ebp
mov eax, dword [0x270b313c]
cmp edx, ecx
cmc
xor eax, esp
jmp 0x2722bcaa

Function at 0x27369fa9
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [ebx + 0x2b8]
jmp 0x2702a89d
movzx eax, word [ebp + 0x10]
jmp 0x271f8a44
test ecx, ecx
je 0x272a02e0
push dword [ebx]
jmp 0x27176dda
mov eax, 0x100
jmp 0x272f084b
push ebx
sal bl, 0x15
mov ebx, dword [ebp + 8]
jmp 0x273096e9
je 0x2702cc89
movzx edi, word [ebx + 0x1a]
sar eax, cl
xor ecx, ecx
dec ah
bswap eax
inc ecx
seta al
mov eax, ebx
mov dword [ebp - 0x810], edi
call fcn.272b947a
mov esi, ebx
jmp 0x27296077
test byte [ebx + 0x5c], 6
jmp 0x271fa36f
je 0x2726656a
cmp word [ebx + 0x16], 2
jmp 0x272cce4d
je 0x2701f700
mov eax, edi
lea edx, [eax + 1]
setge cl
mov cl, byte [eax]
jmp 0x2702d43d
je 0x27007a64
mov ecx, edi
setg ah
jne 0x272ac929
mov eax, 0x101
jmp 0x272acb70
je 0x2701f700
test byte [ebx + 0x5c], 4
jmp 0x27250dc0
call fcn.271f85bd
mov esi, eax
test esi, esi
jmp 0x2725d507
mov esi, 0x103
test esi, esi
jne 0x2725d50d
mov edi, dword [ebx + 0xc]
cmp dx, 0xbba6
test di, 0x2d1d
test edi, edi
jmp 0x27267d18
test eax, eax
jmp 0x2720f693
jmp 0x27293342
jne 0x2726656a
mov eax, dword [ebx + 0xc]
test di, 0xc81b
test eax, eax
jne 0x271fdbd6
test byte [ebx + 0x5c], 2
jmp 0x2702cc83
push esi
push edi
cmc
mov dword [ebp - 0x814], eax
test ebx, ebx
jmp 0x27266564
push ebp
mov ebp, esp
rol ah, cl
cmp esi, 0x8f341eb6
lea esp, [esp - 0x818]
mov eax, dword [0x270b313c]
test edx, ebp
xor eax, ebp
cmp ebp, ebx
mov dword [ebp - 8], eax
rol ax, cl
neg ax
shr ax, cl
mov eax, dword [ebp + 0xc]
cmp esp, ebp
test al, 0x2f
jmp 0x271ba2e4
Function at 0x2736c79a
Capabilities:
Check for time delay via gettickcount
Encrypt data using speck
Get system information on windows
Read .ini file
Resolve function by parsing pe exports

Disassembly:
je 0x271e057a
cmp dword [esi + 0x302ec], 2
jne 0x271e057a
push 1
movsx ax, bl
movsx ecx, dx
movzx ax, al
lea eax, [esi + 0x20188]
push eax
bswap ecx
mov ecx, esi
call fcn.2729eab9
jmp 0x271e057a
push esi
call fcn.27360fb3
pop edi
pop esi
xchg ebp, ebp
cmovne ebp, edi
movsx ebp, bx
pop ebp
jmp 0x2702a6a3
je 0x2718a122
cmp word [eax + 0x16], 0x55
jmp 0x2718a11c
mov dword [esp + 8], 0x2ca01775
push ecx
not esi
mov ecx, esi
push ecx
setbe cl
lea ecx, [ecx*8 + 0x4a82ea22]
mov esi, dword [esp + 0xc]
mov dword [esp + 0xc], esi
mov ecx, dword [esp + 4]
js 0x2736c7a5
not byte [esp]
and byte [esp], 0x16
push dword [esp + 8]
popfd
lea esp, [esp + 0xc]
jmp fcn.27266fa5
jne 0x271e0574
mov eax, dword [esi + 0x302c4]
test bh, dh
clc
cmp eax, edx
jmp 0x27213ce7
cmp dword [ecx + 0x18], edx
jmp 0x272ab529
call fcn.27007699
jmp 0x2718a12f
push 0xee04d588
mov byte [esp], 0x33
push esi
mov esi, dword [esp + 4]
pushfd
xor esi, esi
not byte [esp + 8]
jno 0x272a2ef2
je 0x272ba94d
push eax
lea edi, [ebp + 8]
call fcn.2702834b
mov eax, dword [ebp + 8]
rcl cx, 0x9c
pop ecx
stc
add eax, 0xfffffff0
jmp 0x27330af6