joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1014d160
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101db943
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x1026b040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ecx + 4]
lea ecx, [ebp - 0x20]
push ecx
mov ecx, dword [ebp + 8]
push eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0
call fcn.100533e0
mov eax, dword [0x10306528]
test al, 1
jne 0x1014d2de
or eax, 1
mov dword [0x10306528], eax
mov dword [ebp - 4], 0
mov ebx, dword [0x103030f8]
cmp ebx, dword [0x103030fc]
je 0x1014d214
nop dword [eax]
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x1014d209
mov esi, dword [eax + 0xc]
mov edi, 0x811c9dc5
xor ecx, ecx
inc ecx
cmp byte [esi + ecx], 0
jne 0x1014d1e3
xor edx, edx
test ecx, ecx
je 0x1014d209
movsx eax, byte [esi + edx]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x1014d1f0
cmp edi, 0x54aff69
je 0x1014d220
add ebx, 4
cmp ebx, dword [0x103030fc]
jne 0x1014d1d0
xor eax, eax
mov dword [0x1030653c], eax
jmp 0x1014d2e3
mov eax, dword [ebp - 0x10]
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
cmp dword [eax + 4], ebx
jle 0x1014d2c8
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
nop dword [eax]
mov edi, dword [eax]
add edi, ecx
mov ecx, dword [edi + 0x28]
test ecx, ecx
je 0x1014d271
cmp dword [ecx + 4], 0
jle 0x1014d271
push 0
mov edx, 0xa3316f9
call fcn.10115470
add esp, 4
test eax, eax
je 0x1014d26e
mov ecx, dword [edi + 0x2c]
add ecx, eax
add ebx, ecx
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp - 0x10]
mov esi, dword [edi]
mov ebx, 0x811c9dc5
xor ecx, ecx
nop word [eax + eax]
inc ecx
cmp byte [esi + ecx], 0
jne 0x1014d280
xor edx, edx
test ecx, ecx
je 0x1014d2ac
nop dword [eax]
movsx eax, byte [esi + edx]
inc edx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp edx, ecx
jb 0x1014d290
cmp ebx, 0xa3316f9
je 0x1014d2d1
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
inc edx
mov ebx, dword [ebp - 0x14]
add ecx, 0x3c
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], ecx
cmp edx, dword [eax + 4]
jl 0x1014d240
mov eax, ebx
mov dword [0x1030653c], eax
jmp 0x1014d2e3
mov eax, dword [edi + 0x2c]
add eax, dword [ebp - 0x14]
mov dword [0x1030653c], eax
jmp 0x1014d2e3
mov eax, dword [0x1030653c]
mov ecx, dword [ebp - 0x24]
movss xmm0, dword [ebp - 0x20]
lea eax, [eax + ecx*4]
mov ecx, dword [ebp + 8]
movss dword [eax + ecx], xmm0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10166900
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [eax + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 0x78]
test eax, eax
je 0x10166925
push dword [edi + 0x74]
call eax
add esp, 4
push ebx
push esi
mov esi, dword [edi + 0x54]
test esi, esi
je 0x1016698b
nop
mov ebx, dword [esi + 4]
xor edx, edx
mov eax, dword [ebx + 0x60]
mov eax, dword [eax + 8]
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0x54]
test eax, eax
je 0x10166984
mov ecx, dword [eax + 8]
cmp eax, esi
je 0x10166957
mov edx, eax
mov eax, ecx
test eax, eax
jne 0x10166946
jmp 0x10166984
test edx, edx
jne 0x10166960
mov dword [ebx + 0x54], ecx
jmp 0x10166963
mov dword [edx + 8], ecx
mov eax, dword [esi + 0x14]
test eax, eax
je 0x10166970
push esi
call eax
add esp, 4
push esi
call fcn.10166e80
mov eax, dword [esp + 0x20]
push esi
push eax
mov eax, dword [eax + 8]
call eax
add esp, 0xc
mov esi, dword [edi + 0x54]
test esi, esi
jne 0x10166930
lea eax, [edi + 0x6c]
test eax, eax
je 0x10166a0e
test ebp, ebp
je 0x10166a0e
mov ebx, dword [eax]
test ebx, ebx
je 0x10166a01
nop dword [eax]
mov esi, dword [ebx + 8]
mov eax, dword [ebx + 4]
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 8]
test eax, eax
je 0x101669b7
push esi
call eax
add esp, 4
mov eax, dword [esp + 0x20]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x3c]
test eax, eax
je 0x101669cb
push esi
call eax
add esp, 4
mov eax, dword [esi + 0x28]
test eax, eax
je 0x101669dc
push eax
mov eax, dword [ebp + 8]
push ebp
call eax
add esp, 8
mov dword [esi + 0x28], 0
mov eax, dword [ebp + 8]
push esi
push ebp
call eax
mov eax, dword [ebp + 8]
push ebx
push ebp
call eax
mov eax, dword [esp + 0x2c]
add esp, 0x10
mov ebx, eax
test eax, eax
jne 0x101669a0
lea eax, [edi + 0x6c]
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [edi + 0x30]
mov dword [edi + 0x58], 0
test eax, eax
je 0x10166a22
push edi
call eax
add esp, 4
push ebp
push edi
call fcn.10166880
mov eax, dword [esp + 0x18]
add esp, 8
mov eax, dword [eax + 0x34]
test eax, eax
je 0x10166a3d
push edi
call eax
add esp, 4
mov esi, dword [edi + 0x68]
mov eax, dword [edi + 8]
mov dword [esp + 0x20], eax
test esi, esi
je 0x10166a6f
mov eax, dword [esi + 0x18]
mov ebx, dword [esi + 0x1c]
test eax, eax
je 0x10166a5b
push esi
call eax
add esp, 4
test dword [esp + 0x20], 0x400
jne 0x10166a6f
mov eax, dword [ebx + 8]
push esi
push ebx
call eax
add esp, 8
mov eax, dword [edi + 0x80]
mov dword [edi + 0x68], 0
pop esi
pop ebx
test eax, eax
je 0x10166a96
push eax
mov eax, dword [ebp + 8]
push ebp
call eax
add esp, 8
mov dword [edi + 0x80], 0
mov eax, dword [ebp + 8]
push edi
push ebp
call eax
add esp, 8
pop edi
pop ebp
pop ecx
ret
Function at 0x101ad420
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x14
xorps xmm0, xmm0
push ebx
push ebp
mov ebp, dword [esp + 0x20]
lea ebx, [ebp + 0x318]
movups xmmword [ebx], xmm0
push esi
movq qword [ebx + 0x10], xmm0
movzx ecx, word [ebp + 0x98]
mov eax, dword [ebp + 0x9c]
shl ecx, 4
add ecx, eax
push edi
cmp eax, ecx
jae 0x101ad60d
cmp dword [eax], 0x42444620
jne 0x101ad465
mov esi, dword [eax + 0xc]
test esi, esi
jne 0x101ad479
add eax, 0x10
cmp eax, ecx
jb 0x101ad456
pop edi
pop esi
pop ebp
mov eax, 8
pop ebx
add esp, 0x14
ret
push dword [eax + 8]
mov edi, dword [esp + 0x30]
push edi
call fcn.10165cd0
add esp, 8
test eax, eax
jne 0x101ad60d
cmp esi, 8
jb 0x101ad60d
push ebx
push esi
push edi
call fcn.101653e0
add esp, 0xc
mov dword [esp + 0x20], eax
test eax, eax
jne 0x101ad60d
mov eax, dword [ebx]
lea ecx, [eax + esi]
mov dword [ebp + 0x31c], ecx
mov ecx, eax
movzx edi, byte [ecx + 2]
movzx eax, byte [ecx + 3]
movzx edx, byte [ecx + 5]
shl edi, 8
or edi, eax
movzx eax, byte [ecx + 4]
shl eax, 8
or edx, eax
movzx eax, byte [ecx + 6]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 7]
movzx ecx, byte [ecx + 1]
shl edx, 8
or edx, eax
mov eax, dword [ebx]
movzx eax, byte [eax]
shl eax, 8
or ecx, eax
cmp ecx, 1
jne 0x101ad5f5
cmp edx, 8
jb 0x101ad5f5
lea eax, [edx - 8]
shr eax, 2
cmp eax, edi
jb 0x101ad5f5
lea eax, [edx + 1]
cmp eax, esi
ja 0x101ad5f5
mov eax, dword [ebx]
sub esi, edx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [ebp + 0x328], edi
mov dword [ebp + 0x324], esi
lea ecx, [eax + edx]
mov dword [ebp + 0x320], ecx
lea edx, [eax + 8]
lea eax, [edx + edi*4]
mov dword [esp + 0x10], eax
cmp edi, 2
jb 0x101ad5b1
lea esi, [edi - 2]
xor ebx, ebx
shr esi, 1
inc esi
xor ebp, ebp
movzx ecx, byte [edx + 2]
sub edi, 2
movzx eax, byte [edx + 3]
shl ecx, 8
or ecx, eax
lea eax, [ecx + ecx*4]
movzx ecx, byte [edx + 6]
lea ebx, [ebx + eax*2]
shl ecx, 8
movzx eax, byte [edx + 7]
add edx, 8
or ecx, eax
lea eax, [ecx + ecx*4]
lea ebp, [ebp + eax*2]
sub esi, 1
jne 0x101ad565
mov dword [esp + 0x18], ebp
mov ebp, dword [esp + 0x28]
mov dword [esp + 0x14], ebx
mov esi, dword [ebp + 0x320]
lea ebx, [ebp + 0x318]
jmp 0x101ad5b3
mov esi, ecx
test edi, edi
je 0x101ad5d0
movzx ecx, byte [edx + 2]
movzx eax, byte [edx + 3]
mov edx, dword [esp + 0x10]
shl ecx, 8
or ecx, eax
lea eax, [ecx + ecx*4]
lea edx, [edx + eax*2]
jmp 0x101ad5d4
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
add eax, dword [esp + 0x18]
add eax, edx
cmp eax, esi
ja 0x101ad5f5
mov eax, dword [esp + 0x20]
pop edi
pop esi
mov byte [ebp + 0x32c], 1
pop ebp
pop ebx
add esp, 0x14
ret
push ebx
push dword [esp + 0x30]
call fcn.10165c90
xorps xmm0, xmm0
add esp, 8
movups xmmword [ebx], xmm0
movq qword [ebx + 0x10], xmm0
mov eax, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x101b96a0
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101dc286
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1026b040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov ebx, dword [ebp + 8]
lea edi, [esi + 0x2c]
mov dword [ebp + 8], edi
mov eax, dword [ebx]
mov dword [esi], eax
movzx eax, byte [ebx + 4]
mov byte [esi + 4], al
movzx eax, byte [ebx + 5]
mov byte [esi + 5], al
movzx eax, byte [ebx + 6]
mov byte [esi + 6], al
movzx eax, byte [ebx + 7]
mov byte [esi + 7], al
movzx eax, byte [ebx + 8]
mov byte [esi + 8], al
movzx eax, byte [ebx + 9]
mov byte [esi + 9], al
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebx + 0x14]
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], ecx
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x1c]
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ecx
mov eax, dword [ebx + 0x20]
mov ecx, dword [ebx + 0x24]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ecx
movzx eax, byte [ebx + 0x28]
mov byte [esi + 0x28], al
movzx eax, byte [ebx + 0x29]
mov byte [esi + 0x29], al
movzx eax, byte [ebx + 0x2a]
mov byte [esi + 0x2a], al
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov eax, dword [ebx + 0x30]
sub eax, dword [ebx + 0x2c]
je 0x101b978b
cmp eax, 0x7fffffff
ja 0x101b9841
push eax
mov ecx, edi
call fcn.101b9e30
mov esi, dword [ebx + 0x30]
mov eax, dword [ebx + 0x2c]
sub esi, eax
mov edi, dword [edi]
push esi
push eax
push edi
call sub.VCRUNTIME140.dll_memmove
mov ecx, dword [ebp + 8]
lea eax, [esi + edi]
mov esi, dword [ebp - 0x10]
add esp, 0xc
mov dword [ecx + 4], eax
lea eax, [esi + 0x38]
mov dword [ebp - 4], 0
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x38]
sar edi, 2
mov dword [ebp + 8], eax
test edi, edi
je 0x101b97ff
cmp edi, 0x3fffffff
ja 0x101b9846
push edi
mov ecx, eax
call fcn.101ba010
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov dword [ecx + 4], eax
lea eax, [eax + edi*4]
mov dword [ecx + 8], eax
mov esi, dword [ebx + 0x3c]
mov eax, dword [ebx + 0x38]
sub esi, eax
mov edi, dword [ecx]
push esi
push eax
push edi
call sub.VCRUNTIME140.dll_memmove
mov ecx, dword [ebp + 8]
add esp, 0xc
sar esi, 2
lea eax, [edi + esi*4]
mov esi, dword [ebp - 0x10]
mov dword [ecx + 4], eax
lea eax, [ebx + 0x44]
mov byte [ebp - 4], 1
lea ecx, [esi + 0x44]
push eax
call fcn.1002f6b0
lea eax, [ebx + 0x5c]
mov byte [ebp - 4], 2
push eax
lea ecx, [esi + 0x5c]
call fcn.1002f6b0
mov eax, dword [ebx + 0x74]
mov dword [esi + 0x74], eax
mov eax, dword [ebx + 0x78]
mov dword [esi + 0x78], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.1001d2d0
call fcn.101b9fa0
int3
Function at 0x101b9d00
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
mov dword [esi], eax
movzx eax, byte [edi + 4]
mov byte [esi + 4], al
movzx eax, byte [edi + 5]
mov byte [esi + 5], al
movzx eax, byte [edi + 6]
mov byte [esi + 6], al
movzx eax, byte [edi + 7]
mov byte [esi + 7], al
movzx eax, byte [edi + 8]
mov byte [esi + 8], al
movzx eax, byte [edi + 9]
mov byte [esi + 9], al
mov eax, dword [edi + 0x10]
mov ecx, dword [edi + 0x14]
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], ecx
mov eax, dword [edi + 0x18]
mov ecx, dword [edi + 0x1c]
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ecx
mov eax, dword [edi + 0x20]
mov ecx, dword [edi + 0x24]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ecx
lea ecx, [esi + 0x2c]
movzx eax, byte [edi + 0x28]
mov byte [esi + 0x28], al
movzx eax, byte [edi + 0x29]
mov byte [esi + 0x29], al
movzx eax, byte [edi + 0x2a]
mov byte [esi + 0x2a], al
lea eax, [edi + 0x2c]
push eax
call fcn.101b9bb0
lea eax, [edi + 0x38]
lea ecx, [esi + 0x38]
cmp ecx, eax
je 0x101b9d98
mov edx, dword [eax]
mov eax, dword [eax + 4]
sub eax, edx
sar eax, 2
push eax
push edx
call fcn.101b8730
lea eax, [edi + 0x44]
lea ecx, [esi + 0x44]
cmp ecx, eax
je 0x101b9db4
cmp dword [eax + 0x14], 0x10
mov edx, dword [eax + 0x10]
jb 0x101b9dad
mov eax, dword [eax]
push edx
push eax
call fcn.1002fce0
lea eax, [edi + 0x5c]
lea ecx, [esi + 0x5c]
cmp ecx, eax
je 0x101b9dd0
cmp dword [eax + 0x14], 0x10
mov edx, dword [eax + 0x10]
jb 0x101b9dc9
mov eax, dword [eax]
push edx
push eax
call fcn.1002fce0
mov eax, dword [edi + 0x74]
mov dword [esi + 0x74], eax
mov eax, dword [edi + 0x78]
mov dword [esi + 0x78], eax
mov eax, esi
pop edi
pop esi
pop ebp
ret 4
Function at 0x101bdaf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
push edi
mov edi, ecx
mov eax, dword [esi]
mov dword [edi], eax
movzx eax, byte [esi + 4]
mov byte [edi + 4], al
movzx eax, byte [esi + 5]
mov byte [edi + 5], al
movzx eax, byte [esi + 6]
mov byte [edi + 6], al
movzx eax, byte [esi + 7]
mov byte [edi + 7], al
movzx eax, byte [esi + 8]
mov byte [edi + 8], al
movzx eax, byte [esi + 9]
mov byte [edi + 9], al
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], ecx
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], ecx
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x24]
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], ecx
movzx eax, byte [esi + 0x28]
mov byte [edi + 0x28], al
movzx eax, byte [esi + 0x29]
mov byte [edi + 0x29], al
movzx eax, byte [esi + 0x2a]
mov byte [edi + 0x2a], al
mov edx, dword [esi + 0x34]
mov ecx, dword [esi + 0x30]
mov eax, dword [esi + 0x2c]
mov dword [esi + 0x34], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x2c], 0
mov dword [edi + 0x2c], eax
mov dword [edi + 0x30], ecx
mov dword [edi + 0x34], edx
mov eax, dword [esi + 0x38]
mov edx, dword [esi + 0x40]
mov ecx, dword [esi + 0x3c]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x38], 0
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], ecx
mov dword [edi + 0x40], edx
movups xmmword [edi + 0x44], xmm0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
movups xmm0, xmmword [esi + 0x44]
movups xmmword [edi + 0x44], xmm0
movq xmm0, qword [esi + 0x54]
movq qword [edi + 0x54], xmm0
xorps xmm0, xmm0
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0xf
mov byte [esi + 0x44], 0
movups xmmword [edi + 0x5c], xmm0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
movups xmm0, xmmword [esi + 0x5c]
movups xmmword [edi + 0x5c], xmm0
movq xmm0, qword [esi + 0x6c]
movq qword [edi + 0x6c], xmm0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x70], 0xf
mov byte [esi + 0x5c], 0
mov eax, dword [esi + 0x74]
mov dword [edi + 0x74], eax
mov eax, dword [esi + 0x78]
mov dword [edi + 0x78], eax
mov eax, edi
pop edi
pop esi
pop ebp
ret 4
Function at 0x101c2c40
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
mov al, byte [esi + 0xc]
lea edx, [edi + 0x430]
mov dword [ebp - 0xc], edx
test al, 3
je 0x101c2c7a
movzx eax, al
and eax, 3
mov ecx, dword [eax*8 + 0x101fff60]
or dword [edx], ecx
mov eax, dword [eax*8 + 0x101fff64]
or dword [edx + 4], eax
jmp 0x101c2c7d
mov dword [ebp - 0xc], edx
mov al, byte [esi + 0xc]
test al, 0xc
je 0x101c2ca0
movzx ecx, al
shr ecx, 2
and ecx, 3
mov eax, dword [ecx*8 + 0x101fff80]
or dword [edx], eax
mov eax, dword [ecx*8 + 0x101fff84]
or dword [edx + 4], eax
mov al, byte [esi + 0xc]
test al, 0x30
je 0x101c2cc3
movzx ecx, al
shr ecx, 4
and ecx, 3
mov eax, dword [ecx*8 + 0x101fffa0]
or dword [edx], eax
mov eax, dword [ecx*8 + 0x101fffa4]
or dword [edx + 4], eax
mov eax, dword [edi + 0xc]
jmp dword [eax*4 + 0x101c3044]

Function at 0x101c8b14
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x101c8b3b
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x101c8b3e
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.101c8af0
pop esi
leave
ret 8
Function at 0x40102c
Capabilities:
Create tcp socket
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
xor edi, edi
jmp loc.00405680

Function at 0x40131e
Capabilities:
Clear file content
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
cmp eax, ebx
jmp loc.0040580c

Function at 0x4013ba
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor eax, eax
cmp ecx, eax
je 0x4013dc
cmp dword [ebp + 0xc], eax
jbe 0x4013dc
jmp loc.00407c4b
xor eax, eax
pop ebp
ret

Function at 0x4016a9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 0x3c]
movzx eax, word [ebx + edi + 6]
jmp loc.00407504

Function at 0x401815
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
cmp dword [ebp + 0x14], ecx
jne 0x401834
cmp dword [ebp + 0xc], ecx
jle 0x401849
jmp loc.00406bd4
jmp loc.00406070
pop ebp
ret

Function at 0x40193d
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x192d0
jmp loc.00406dea

Function at 0x401b72
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
and word [ebp - 0x190], 0
push edi
push 0x63
xor eax, eax
pop ecx
lea edi, [ebp - 0x18e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x190]
push eax
push 0x202
jmp loc.004077d4

Function at 0x401bff
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
push ebx
push esi
xor eax, eax
push edi
jmp loc.004070af

Function at 0x401c9c
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
push 0x40
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x10b]
mov byte [ebp - 0x10c], bl
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x10c]
push eax
push ebx
jmp loc.004067be

Function at 0x401f42
Capabilities:
Get common file path
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push esi
push edi
lea eax, [ebp - 0x104]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x104]
push str.Proxy
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push dword [ebp + 0xc]
mov edi, dword [ebp + 8]
xor ebx, ebx
push ebx
push edi
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x104]
push ebx
push ebx
push 3
push ebx
push 2
push bind
push eax
call dword [0x4047f0]
mov esi, eax
cmp esi, 0xffffffff
je 0x401fde
lea eax, [ebp + 8]
push ebx
push eax
jmp loc.00408176
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4021b1
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push esi
push edi
jmp loc.00406927
Function at 0x40224e
Capabilities:
Initialize winhttp library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
push edi
xor esi, esi
push 0x18
lea eax, [ebp - 0x2c]
push esi
push eax
mov dword [ebp - 4], esi
jmp loc.00407d33

Function at 0x402482
Capabilities:
Send data
Send data on socket
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
and byte [ebp - 0x12c], 0
push ebx
push esi
push edi
mov ebx, ecx
push 0x4a
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
push 1
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [ebp + 8]
mov ecx, ebx
jmp loc.00407403

Function at 0x402569
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x650
and byte [ebp - 0x650], 0
mov edx, ecx
push edi
mov ecx, 0x18f
xor eax, eax
jmp loc.00406005

Function at 0x402634
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
push dword [ebp + 8]
mov esi, dword [sym.imp.WS2_32.dll_inet_addr]
jmp loc.00405ac8

Function at 0x402840
Capabilities:
Packed with generic packer

Disassembly:
push ecx
cmp eax, 0x1000
lea ecx, [esp + 8]
jb 0x402860
jmp loc.004079c6
sub ecx, eax
mov eax, esp
test dword [ecx], eax
mov esp, ecx
mov ecx, dword [eax]
mov eax, dword [eax + 4]
push eax
ret

Function at 0x40290e
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x403180
push 0x402a94
jmp loc.00405e1e

Function at 0x405189
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x408110
push 0x401dd0
push eax
push ebx
push edi
xor edx, edx
mov dl, ah
mov ecx, eax
and ecx, 0xff
shl ecx, 8
add ecx, edx
shr eax, 0x10
pop ecx
test eax, eax
add esp, 0x14
leave
popal
popfd
je fcn.00402186
jmp loc.0040206b

Function at 0x405fc6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
dec eax
salc
add dh, dl
salc
pop edi
push ebx
dec edi
pop edi
dec edi
dec ecx
and al, 0
add al, 0
popal
popfd
lea eax, [ebp - 0x110]
jmp loc.00402051

Function at 0x406715
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
dec eax
add al, ch
push ebx
push edx
dec ecx
dec ecx
add ch, al
add esp, 8
leave
popal
popfd
cmp dword [0x4048fc], 0xffffffff
jmp loc.00402883

Function at 0x407e6b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4050a0
push 0x401cd0
push eax
push ebx
push edi
xor edx, edx
mov dl, ah
mov ecx, eax
and ecx, 0xff
shl ecx, 8
add ecx, edx
shr eax, 0x10
pop ecx
test eax, eax
add esp, 0x14
leave
popal
popfd
call fcn.00401598
jmp loc.0040204b

Function at 0x408368
Capabilities:
Copy file
Delete file
Get common file path
Get file size
Move file
Write file on windows

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4050a0
push 0x401cd0
push eax
push ebx
push edi
xor edx, edx
mov dl, ah
mov ecx, eax
and ecx, 0xff
shl ecx, 8
add ecx, edx
shr eax, 0x10
pop ecx
test eax, eax
add esp, 0x14
leave
popal
popfd
call dword [sym.imp.WS2_32.dll_htons]
jmp loc.004023f0