joyce8/EMBER2024-capa huggingface dataset:
Function at 0x27014d07
Capabilities:
Create process on windows
Create process suspended
Query environment variable
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x684
mov eax, dword [0x270b313c]
xor eax, esp
mov dword [esp + 0x680], eax
push ebx
push esi
push edi
mov edi, 0x104
push edi
lea eax, [esp + 0x74]
push eax
xor ebx, ebx
push 0x270a10a4
mov esi, ecx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], ebx
call sub.KERNEL32.dll_GetEnvironmentVariableW
push esi
push dword [ebp + 8]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x18]
push eax
call fcn.27014bc9
test eax, eax
je 0x27014ed6
cmp dword [esp + 0xc], ebx
je 0x27014ed6
cmp dword [esp + 0xc], edi
jae 0x27014ed6
lea eax, [esp + 0x70]
push eax
lea esi, [esp + 0x10]
mov ecx, edi
call fcn.270121a6
cmp eax, ebx
jl 0x27014ed6
mov ecx, dword [esp + 0xc]
mov eax, edi
sub eax, ecx
lea edx, [esp + ecx*2 + 0x70]
call fcn.27012230
cmp eax, ebx
jl 0x27014ed6
push edi
lea eax, [esp + 0x484]
push eax
mov eax, dword [esp + 0x18]
push 0xffffffffffffffff
add eax, 0xc
push eax
push ebx
push ebx
call sub.KERNEL32.dll_MultiByteToWideChar
cmp eax, edi
jae 0x27014ed6
cmp eax, ebx
jle 0x27014ed6
lea eax, [esp + 0x480]
push eax
mov ecx, edi
push str.rundll32.exe___s__1
lea edi, [esp + 0x280]
call fcn.270120e4
pop ecx
pop ecx
test eax, eax
jl 0x27014ed6
xor eax, eax
lea edi, [esp + 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x44
stosd dword es:[edi], eax
pop esi
push esi
stosd dword es:[edi], eax
lea eax, [esp + 0x2c]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [esp + 0x278]
mov dword [0x270bb494], eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x2c]
push eax
push ebx
push ebx
push 4
push ebx
push ebx
push ebx
lea eax, [esp + 0x298]
push eax
lea eax, [esp + 0x94]
push eax
mov dword [esp + 0x50], esi
call sub.KERNEL32.dll_CreateProcessW
mov dword [0x270bb494], ebx
cmp eax, ebx
je 0x27014ed6
mov eax, dword [esp + 0x10]
push ebx
push dword [eax]
push eax
push 0x270a04a0
push dword [esp + 0x28]
call sym.SocksCapExDLL32.dll_Ordinal_267
test eax, eax
jne 0x27014e8c
push 0xffffffffffffffff
push dword [esp + 0x1c]
call sub.KERNEL32.dll_TerminateProcess
push dword [esp + 0x18]
call sub.KERNEL32.dll_CloseHandle
push dword [esp + 0x1c]
call sub.KERNEL32.dll_CloseHandle
jmp 0x27014ed6
push dword [esp + 0x1c]
call sub.KERNEL32.dll_ResumeThread
push 0xffffffffffffffff
push dword [esp + 0x1c]
call sub.KERNEL32.dll_WaitForSingleObject
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x1c]
mov dword [esp + 0x14], 0x1f4
call sub.KERNEL32.dll_GetExitCodeProcess
push dword [esp + 0x18]
call sub.KERNEL32.dll_CloseHandle
push dword [esp + 0x1c]
call sub.KERNEL32.dll_CloseHandle
cmp dword [esp + 0xc], ebx
jne 0x27014ed6
mov dword [esp + 0x14], 1
cmp dword [esp + 0x10], ebx
je 0x27014ee5
lea esi, [esp + 0x10]
call fcn.27014f66
mov ecx, dword [esp + 0x68c]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.27088f70
mov esp, ebp
pop ebp
ret 4
Function at 0x27020398
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub eax, 0xae02858d
and esp, 0xfffffff8
xadd ax, ax
or ah, 0xb
push 0xffffffffffffffff
add eax, ebx
push 0x2708dbd5
inc ah
ror ax, cl
mov eax, dword fs:[0]
push eax
rcr ah, cl
test si, si
jmp 0x2723b6d2
Function at 0x270258be
Capabilities:
Accept command line arguments

Disassembly:
push 8
mov eax, 0x2708dda6
jmp loc.2718cd73

Function at 0x2702595a
Capabilities:
Set thread local storage value

Disassembly:
mov eax, dword [0x270b313c]
test di, dx
xor eax, ebp
clc
stc
mov dword [ebp + 0x1b0], eax
add eax, 0x123ff684
cmc
mov eax, dword [ebp + 0x1bc]
and dword [ebp - 0x5c], 0
jmp loc.271c88e9
push ebp
cbw
lea ebp, [esp - 0x1b4]
xor ax, bp
adc ax, bp
lea esp, [esp - 0x234]
jmp 0x270170a8

Function at 0x27025e51
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [ebp + 8]
mov esi, eax
mov eax, dword [ebp + 0x18]
and dword [esi], 0
mov byte [eax], 0
call sub.WS2_32.dll_gethostbyname
mov ebx, eax
test ebx, ebx
je 0x27025ec5
cmp word [ebx + 8], 2
jne 0x27025ea5
cmp word [ebx + 0xa], 4
jne 0x27025ea5
mov edi, dword [ebx + 0xc]
jmp 0x27025e9f
push dword [eax]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.27025de7
mov dword [esi], eax
test eax, eax
je 0x27025ec0
lea esi, [eax + 0x1c]
add edi, 4
mov eax, dword [edi]
test eax, eax
jne 0x27025e83
push 0x400
push dword [ebx]
push 0x401
push dword [ebp + 0x18]
call fcn.270891e6
add esp, 0x10
xor eax, eax
jmp 0x27025eea
push 8
pop eax
jmp 0x27025eea
call sub.WS2_32.dll_WSAGetLastError
mov ecx, eax
mov eax, 0x2af9
sub ecx, eax
je 0x27025eea
dec ecx
je 0x27025ee5
dec ecx
je 0x27025ede
dec ecx
jmp 0x27025eea
mov eax, 0x2afb
jmp 0x27025eea
mov eax, 0x2afa
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x2702651c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x270b313c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x27167e84], 0
push ebx
push esi
mov ebx, str.getaddrinfo
push edi
mov dword [ebp - 0x238], ebx
mov dword [ebp - 0x234], 0x2702608f
mov dword [ebp - 0x230], str.getnameinfo
mov dword [ebp - 0x22c], 0x27026355
mov dword [ebp - 0x228], str.freeaddrinfo
mov dword [ebp - 0x224], fcn.27026053
jne 0x2702668d
push 0x104
lea eax, [ebp - 0x220]
push eax
call sub.KERNEL32.dll_GetSystemDirectoryA
test eax, eax
je 0x27026683
lea eax, [ebp - 0x220]
push eax
mov esi, 0x10c
lea eax, [ebp - 0x118]
push esi
push eax
call fcn.2708917e
push str.ws2_32
lea eax, [ebp - 0x118]
push esi
push eax
call fcn.2708910a
add esp, 0x18
lea eax, [ebp - 0x118]
push eax
call sub.KERNEL32.dll_LoadLibraryA
mov edi, eax
test edi, edi
je 0x270265ec
push ebx
push edi
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
jne 0x270265e8
push edi
call sub.KERNEL32.dll_FreeLibrary
xor edi, edi
test edi, edi
jne 0x2702663e
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x118]
push esi
push eax
call fcn.2708917e
push str.wship6
lea eax, [ebp - 0x118]
push esi
push eax
call fcn.2708910a
add esp, 0x18
lea eax, [ebp - 0x118]
push eax
call sub.KERNEL32.dll_LoadLibraryA
mov edi, eax
test edi, edi
je 0x27026683
push ebx
push edi
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
jne 0x2702663a
push edi
call sub.KERNEL32.dll_FreeLibrary
xor edi, edi
test edi, edi
je 0x27026683
xor esi, esi
push dword [ebp + esi*8 - 0x238]
push edi
call sub.KERNEL32.dll_GetProcAddress
mov dword [ebp + esi*8 - 0x234], eax
test eax, eax
je 0x27026660
inc esi
cmp esi, 3
jl 0x27026640
jmp 0x27026668
push edi
call sub.KERNEL32.dll_FreeLibrary
xor edi, edi
test edi, edi
je 0x27026683
xor eax, eax
mov ecx, dword [ebp + eax - 0x234]
mov dword [eax + 0x270ba860], ecx
add eax, 8
cmp eax, 0x18
jl 0x2702666e
mov dword [0x27167e84], 1
movzx eax, word [ebp + 8]
mov ecx, dword [ebp - 4]
mov eax, dword [eax*8 + 0x270ba860]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.27088f70
leave
ret 4

Function at 0x2702681a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call sub.KERNEL32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x27026830
test al, 0x10
jne 0x27026830
xor eax, eax
inc eax
ret
xor eax, eax
ret
Function at 0x27026ffc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x270b313c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 4
pop eax
call fcn.27088fa0
mov ebx, esp
test ebx, ebx
jne 0x27027025
or eax, 0xffffffff
jmp 0x270270ab
mov esi, dword [ebp + 0xc]
and dword [ebp - 0x10], 0
and dword [ebp - 0xc], 0
mov edi, ebx
movsd dword es:[edi], dword [esi]
mov dword [ebp - 8], 1
call sub.KERNEL32.dll_GetTickCount
mov dword [ebp - 0x14], eax
mov edi, ebx
push 0
push 0x4ff
push dword [ebp + 8]
push ebx
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjectsEx]
mov esi, eax
call sub.KERNEL32.dll_GetTickCount
sub eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 8]
jbe 0x27027073
mov esi, 0x102
mov dword [ebp - 0xc], 1
cmp esi, dword [ebp - 8]
je 0x270270ef
jb 0x2702708c
cmp esi, 0x80
jb 0x270270a9
mov eax, dword [ebp - 8]
sub eax, 0xffffff80
cmp esi, eax
jae 0x270270a9
mov eax, dword [edi]
inc dword [ebp - 0x10]
mov dword [ebx + esi*4], eax
and dword [edi], 0
dec dword [ebp - 8]
sub edi, 4
cmp dword [ebp - 0x10], 1
je 0x270270a9
cmp dword [ebp - 0xc], 0
je 0x27027044
mov eax, esi
lea esp, [ebp - 0x3c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.27088f70
leave
ret
cmp dword [ebp - 0x2c], 0x12
je 0x27027106
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x30]
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x270270ef
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 1
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x270270bd
jmp 0x270270a3
push dword [ebp - 0x28]
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov dword [ebp - 0xc], 1
jmp 0x270270a3

Function at 0x270273aa
Capabilities:
Create thread

Disassembly:
push ebp
lea ebp, [esp - 0x1ac]
sub esp, 0x22c
mov eax, dword [0x270b313c]
xor eax, ebp
mov dword [ebp + 0x1a8], eax
mov eax, dword [ebp + 0x1b4]
push esi
xor esi, esi
push edi
mov dword [ebp - 0x64], 4
cmp eax, esi
jne 0x270273ee
lea eax, [ebp - 0x60]
push eax
call fcn.270277ac
push eax
call fcn.270269e5
pop ecx
pop ecx
lea eax, [ebp - 0x60]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp + 0x1b8]
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x6c]
push eax
push esi
lea eax, [ebp - 0x80]
push eax
push 0x270272e9
push esi
lea ecx, [ebp - 0x64]
push esi
mov dword [ebp - 0x80], 0x270a2cb0
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x74], 0x270a092c
mov dword [ebp - 0x6c], esi
call sub.KERNEL32.dll_CreateThread
mov dword [ebp - 0x68], eax
cmp eax, esi
je 0x27027435
push 0xffffffffffffffff
push eax
call sub.KERNEL32.dll_WaitForSingleObject
mov edi, dword [ebp - 0x64]
lea esi, [ebp - 0x68]
call fcn.2700ac6c
mov ecx, dword [ebp + 0x1a8]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.27088f70
add ebp, 0x1ac
leave
ret
Function at 0x27027459
Capabilities:
Enumerate processes on remote desktop session host
Get session information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
lea eax, [ebp - 4]
or edi, 0xffffffff
push eax
mov dword [ebp - 4], edi
call sub.KERNEL32.dll_GetCurrentProcessId
push eax
call sub.KERNEL32.dll_ProcessIdToSessionId
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
xor esi, esi
push 1
push esi
push esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
call sub.WTSAPI32.dll_WTSEnumerateSessionsW
test eax, eax
je 0x27027526
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0xc], esi
cmp dword [ebp - 0x10], esi
jbe 0x270274fc
mov dword [ebp - 8], esi
push ebx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov ebx, dword [ecx + eax]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
push 8
push ebx
push esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], esi
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x270274e9
mov eax, dword [ebp - 0x20]
mov edi, dword [eax]
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
cmp edi, esi
jne 0x270274e1
mov dword [ebp - 0x18], ebx
jmp 0x270274e9
cmp edi, 1
jne 0x270274e9
mov dword [ebp - 0x1c], ebx
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
add dword [ebp - 8], 0xc
cmp eax, dword [ebp - 0x10]
jb 0x270274a9
or edi, 0xffffffff
pop ebx
push dword [ebp - 0x14]
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 4], edi
je 0x2702751b
cmp eax, dword [ebp - 4]
je 0x27027528
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 4]
jne 0x27027526
jmp 0x27027528
cmp eax, edi
jne 0x27027528
mov eax, dword [ebp - 0x1c]
cmp eax, edi
jne 0x27027528
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x270275e1
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push esi
push edi
push 0x44
pop edi
push edi
xor esi, esi
lea eax, [ebp - 0x5c]
push esi
push eax
call sub.msvcrt.dll_memset
xor eax, eax
inc eax
mov ecx, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x5c], edi
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x5c]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 8]
mov word [ebp - 0x2c], cx
push esi
call sub.KERNEL32.dll_CreateProcessW
test eax, eax
je 0x2702764e
push dword [ebp - 0x14]
push 0xffffffffffffffff
call fcn.27027118
pop ecx
pop ecx
push dword [ebp - 0x14]
call sub.KERNEL32.dll_CloseHandle
push dword [ebp - 0x10]
mov dword [ebp - 0x14], esi
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp - 0xc]
pop edi
pop esi
leave
ret
Function at 0x270279ab
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x240
mov eax, dword [0x270b313c]
xor eax, esp
mov dword [esp + 0x23c], eax
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
push 0x228
mov dword [esp + 0x10], eax
lea eax, [esp + 0x18]
push esi
push eax
mov dword [esp + 0x1c], esi
call sub.msvcrt.dll_memset
add esp, 0xc
push esi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x270279fa
xor eax, eax
jmp 0x27027a3b
lea eax, [esp + 0x10]
push eax
push edi
mov dword [esp + 0x18], 0x22c
call sub.KERNEL32.dll_Process32FirstW
jmp 0x27027a2a
push dword [ebp + 0xc]
lea eax, [esp + 0x14]
push eax
call dword [esp + 0x14]
test eax, eax
je 0x27027a30
lea eax, [esp + 0x10]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x27027a0f
jmp 0x27027a33
xor esi, esi
inc esi
push edi
call sub.KERNEL32.dll_CloseHandle
mov eax, esi
mov ecx, dword [esp + 0x244]
pop edi
pop esi
xor ecx, esp
call fcn.27088f70
mov esp, ebp
pop ebp
ret 8

Function at 0x27027a51
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
xor edi, edi
cmp eax, edi
jne 0x27027a63
call sub.KERNEL32.dll_GetCurrentProcess
lea ecx, [ebp - 4]
push ecx
push 0x28
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x27027ac3
lea eax, [ebp - 0xc]
push eax
push 0x270a24c0
push edi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x27027abb
mov eax, dword [ebp - 0xc]
push edi
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
push edi
push 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
push edi
push dword [ebp - 4]
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x27027abb
xor edi, edi
inc edi
push dword [ebp - 4]
call sub.KERNEL32.dll_CloseHandle
mov eax, edi
pop edi
leave
ret
Function at 0x27027b25
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x63c
mov eax, dword [0x270b313c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
push 0x424
lea eax, [ebp - 0x634]
push esi
push eax
xor ebx, ebx
mov dword [ebp - 0x638], esi
call sub.msvcrt.dll_memset
add esp, 0xc
push dword [ebp + 8]
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x27027b86
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x18
jne 0x27027b82
push 1
call sub.KERNEL32.dll_Sleep
inc esi
cmp esi, 0xa
jl 0x27027b5a
xor eax, eax
jmp 0x27027be8
lea eax, [ebp - 0x638]
push eax
push edi
mov dword [ebp - 0x638], 0x428
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x27027bcc
push dword [ebp + 0xc]
lea eax, [ebp - 0x638]
push eax
call fcn.27027bf9
test eax, eax
je 0x27027bc7
lea eax, [ebp - 0x638]
push eax
push edi
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x27027ba1
jmp 0x27027bdc
xor ebx, ebx
inc ebx
jmp 0x27027bdc
call sub.KERNEL32.dll_GetLastError
lea ecx, [ebp - 0x210]
call fcn.27028284
test edi, edi
je 0x27027be6
push edi
call sub.KERNEL32.dll_CloseHandle
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.27088f70
leave
ret 8

Function at 0x27027c44
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, eax
test edi, edi
jne 0x27027c71
push esi
call sub.KERNEL32.dll_GetFileAttributesW
test al, 0x20
je 0x27027c71
push 0x5c
push esi
call dword [sym.imp.msvcrt.dll_wcsrchr]
pop ecx
pop ecx
test eax, eax
je 0x27027c71
lea esi, [eax + 2]
mov eax, dword [ebp + 0xc]
and dword [ebp - 0x10], 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x18]
push eax
push ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], edi
mov dword [ebp - 4], 8
call fcn.27027b25
pop esi
pop ebx
leave
ret 8

Function at 0x270286e6
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x270b313c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
push 0x104
lea edx, [ebp - 0x20c]
push edx
push 0x270a092c
push ecx
add eax, 0x208
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringW
call sub.KERNEL32.dll_GetLastError
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
xor ecx, ebp
inc eax
call fcn.27088f70
leave
ret 4

Function at 0x27028749
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x270b313c]
xor eax, ebp
mov dword [ebp - 4], eax
fld qword [ebp + 8]
push esi
push ecx
push ecx
fstp qword [esp]
push 0x270a5d58
lea eax, [ebp - 0x34]
push 0x18
push eax
mov esi, ecx
call sub.msvcrt.dll__snwprintf
add esp, 0x14
push esi
push 0x18
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x34]
push eax
push str.LastUpdateTime
add esi, 0x208
push esi
call sub.KERNEL32.dll_GetPrivateProfileStringW
fldz
lea eax, [ebp - 0x70]
fstp qword [ebp - 0x70]
push eax
lea eax, [ebp - 0x64]
push 0x270a5d60
push eax
call sub.msvcrt.dll_swscanf
fld qword [ebp - 0x70]
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop esi
call fcn.27088f70
leave
ret 8
Function at 0x2702889c
Capabilities:
Read .ini file

Disassembly:
push 0
mov eax, 0x2708d112
call fcn.2708a0be
mov ebx, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp + 8], edi
mov esi, dword [ebp + 0xc]
mov ecx, 0x270bb06c
call fcn.2700767e
mov dword [ebp - 4], edi
mov eax, dword [ebp + 0xc]
mov edi, 0x104
push edi
mov dword [ebp + 8], 1
mov esi, edi
call fcn.2700b343
push ebx
push edi
push eax
push dword [ebp + 0x14]
lea ecx, [ebx + 0x208]
push dword [ebp + 0x10]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringW
cmp eax, 0x103
jne 0x2702891d
mov eax, dword [ebp + 0xc]
add esi, edi
push esi
call fcn.2700b343
push ebx
push esi
push eax
push dword [ebp + 0x14]
lea eax, [ebx + 0x208]
push dword [ebp + 0x10]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringW
lea ecx, [esi - 1]
cmp eax, ecx
je 0x270288f6
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
call fcn.27007367
mov edx, esi
call fcn.270075ef
mov eax, esi
call fcn.2708a15d
ret 0x10
Function at 0x27032455
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x270b313c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 0x30
push esi
call fcn.270271d0
push 0
call sub.msvcrt.dll_time
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
call sub.msvcrt.dll_localtime
push eax
push str._Y__m__d__H:_M:_S
lea eax, [ebp - 0x18]
push 0x14
push eax
call sub.msvcrt.dll_strftime
call fcn.270326a1
lea eax, [ebp - 0x18]
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push str.__s_ERROR:
push eax
call sub.msvcrt.dll_fprintf
call fcn.270326ad
mov eax, dword [sym.imp.msvcrt.dll__iob]
push esi
add eax, 0x40
push 0x270a0acc
push eax
call sub.msvcrt.dll_fprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
call sub.msvcrt.dll_fflush
add esp, 0x40
push 0xffffffffffffffff
call dword [sym.imp.msvcrt.dll_exit]
int3

Function at 0x2703281d
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, eax
xor eax, dword [esp + 8]
cmp edi, 4
jl 0x2703285c
push ebx
push esi
mov esi, edi
shr esi, 2
mov ecx, esi
imul ecx, ecx, 0xfffffffc
add edi, ecx
mov ecx, dword [edx]
imul eax, eax, 0x5bd1e995
imul ecx, ecx, 0x5bd1e995
mov ebx, ecx
shr ebx, 0x18
xor ebx, ecx
imul ebx, ebx, 0x5bd1e995
xor eax, ebx
add edx, 4
dec esi
jne 0x27032837
pop esi
pop ebx
dec edi
je 0x27032877
dec edi
je 0x2703286e
dec edi
jne 0x27032884
movzx ecx, byte [edx + 2]
shl ecx, 0x10
xor eax, ecx
movzx ecx, byte [edx + 1]
shl ecx, 8
xor eax, ecx
movzx ecx, byte [edx]
xor ecx, eax
imul ecx, ecx, 0x5bd1e995
mov eax, ecx
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul ecx, ecx, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
pop edi
ret
Function at 0x2703324c
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x20]
push ebx
push edi
push 0
sub ecx, eax
push ecx
lea eax, [eax + esi + 0x24]
push eax
push dword [esi + 4]
call sub.WS2_32.dll_recv
cmp eax, 1
jl 0x270332fa
add dword [esi + 0x1c], eax
jmp 0x270332b3
mov eax, dword [esi + 0x18]
lea eax, [eax + esi + 0x24]
mov dword [ebp - 4], eax
movzx eax, word [eax]
push eax
call sub.WS2_32.dll_ntohs
movzx ebx, ax
cmp ebx, 0x2000
ja 0x270332fa
lea eax, [ebx + 2]
cmp eax, edi
ja 0x270332be
mov eax, dword [ebp - 4]
add eax, 2
push eax
mov ecx, ebx
call fcn.27032f69
add ebx, 2
add dword [esi + 0x18], ebx
pop ecx
mov edi, dword [esi + 0x1c]
sub edi, dword [esi + 0x18]
cmp edi, 2
ja 0x27033279
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 0x1c]
cmp ecx, eax
jne 0x270332d2
and dword [esi + 0x18], 0
and dword [esi + 0x1c], 0
jmp 0x2703330e
cmp ecx, 0x2000
jbe 0x2703330e
sub eax, ecx
mov edi, eax
lea eax, [ecx + esi + 0x24]
push edi
push eax
lea eax, [esi + 0x24]
push eax
call dword [sym.imp.msvcrt.dll_memmove]
add esp, 0xc
and dword [esi + 0x18], 0
mov dword [esi + 0x1c], edi
jmp 0x2703330e
push dword [esi + 4]
and dword [esi + 0x18], 0
and dword [esi + 0x1c], 0
call sub.WS2_32.dll_closesocket
or dword [esi + 4], 0xffffffff
pop edi
pop ebx
leave
ret