joyce8/EMBER2024-capa huggingface dataset:
Function at 0x63391660
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ecx, 0x1a
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x80]
mov esi, 0x63410c31
push ebx
sub esp, 0x9c
mov eax, dword [str.not_enough_space_for_format_expansion__Please_submit_full_bug_report_at_https:__gcc.gnu.org_bugs__:_n]
mov dword [ebp - 0x81], eax
mov eax, dword [0x63410c95]
mov dword [ebp - 0x1c], eax
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp + 8]
lea eax, [edx + 0x84]
and eax, 0xfffffff0
call fcn.6337fa50
mov ecx, 0x1a
sub esp, eax
lea esi, [ebp - 0x81]
mov dword [ebp - 0x8c], edx
lea ebx, [esp + 0x1b]
and ebx, 0xfffffff0
mov edi, ebx
lea eax, [ebx + 0x68]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 8]
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], ecx
call sub.msvcr100.dll_memcpy
mov edx, dword [ebp - 0x8c]
mov byte [ebx + edx + 0x68], 0
mov dword [esp], ebx
call fcn.633a2f90
nop
nop
nop
nop
nop
nop
nop
push edi
push esi
push ebx
sub esp, 0x20
cmp byte [0x633bbb9c], 0
jne 0x63391786
mov byte [0x633bbb9c], 1
call fcn.633a3bf0
test eax, eax
je 0x63391754
mov ebx, dword [eax + 4]
xor eax, eax
cmp byte [ebx], 0x2a
mov dword [esp + 8], 0
sete al
mov dword [esp + 4], 0
add ebx, eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call fcn.6337ec00
mov dword [esp], 2
mov esi, dword [fcn.63375280]
mov edi, eax
call esi
mov dword [esp + 8], 0x30
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
call sub.msvcr100.dll_fwrite
mov edx, dword [esp + 0x1c]
mov dword [esp], 2
test edx, edx
je 0x63391744
call esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcr100.dll_fputs
mov dword [esp], 2
call esi
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x63410bf1
call sub.msvcr100.dll_fwrite
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x633a4a54
jmp 0x633a4a4c
call esi
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcr100.dll_fputs
jmp 0x6339170a
mov dword [esp], 2
call dword [0x633bbaf8]
mov dword [esp + 8], 0x2d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
call sub.msvcr100.dll_fwrite
jmp 0x633a4a47
mov dword [esp], 2
call dword [0x633bbaf8]
mov dword [esp + 8], 0x1d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_recursively_n
call sub.msvcr100.dll_fwrite
call sub.msvcr100.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
call sub.msvcr100.dll_abort
mov dword [esp], edi
call sub.msvcr100.dll_free
call fcn.633a3e10
call fcn.633a3ae0
call fcn.633a3c50
jmp 0x633a4a47
Function at 0x6339fb58
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x40
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
add eax, 4
mov dword [esp], 0
mov ecx, eax
call fcn.6339f930
sub esp, 4
mov dword [esp], 8
call fcn.633a3960
mov ebx, eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.633a343c
mov dword [ebp - 0xc], ebx
mov eax, dword [ebp - 0x1c]
add eax, 4
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x6339f8bc
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.msvcr100.dll__beginthreadex]
call eax
mov edx, eax
mov eax, dword [ebp - 0x1c]
mov dword [eax], edx
jmp 0x6339fbee
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 4

Function at 0x633a4e24
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.63375280
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcr100.dll_fwrite
mov dword [esp], 2
call fcn.63375280
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcr100.dll_vfprintf
call sub.msvcr100.dll_abort
nop
nop
nop
Function at 0x407180
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x4071be
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x4071b6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x4071c0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x4071a6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4072a0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x4072b6
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x4072d1
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x401dcd
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401e0c
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401e0c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401e0c
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401e0c
cmp dword [ecx + 0x74], 0xe
jbe 0x401e0c
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x403cdc
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x403d17
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x403cfe
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x403d0f
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x403d19
inc edi
add eax, 0x28
cmp edi, esi
jb 0x403cf4
xor eax, eax
pop edi
pop esi
ret

Function at 0x405cff
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push dword [ebp - 0x380]
call dword [ebp - 0x680]
jmp 0x405ceb
and dword [ebp - 0x37c], 0
push dword [ebp - 0x3a0]
call dword [ebp - 0x704]
mov dword [ebp - 0x3a4], eax
test dword [esp + edi*8 - 1], ebx
inc dword [ebx - 0x3a343]
inc dword [eax]
je 0x405d32
lea eax, [ebp - 0x714]
push eax
call fcn.00403cac
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.00403c61
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
je 0x405d3d
jmp 0x405d42
jmp 0x40563e
cmp dword [ebp - 0x37c], 0
jne 0x405dec
mov eax, dword [ebp - 0x748]
mov dword [ebp - 0x7ec], eax
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0x7e8], eax
and dword [ebp - 0x7e0], 0
inc dword [eax]
push 0x1000
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 0x7e4], eax
push dword [ebp - 0x7e4]
lea eax, [ebp - 0x7ec]
push eax
push dword [ebp - 0x748]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00403e78
add esp, 0x14
mov dword [ebp - 0x7e0], eax
cmp dword [ebp - 0x7e0], 0
je 0x405dd8
lea eax, [ebp - 0x714]
push eax
call fcn.00403cac
pop ecx
push eax
push dword [ebp - 0x7e0]
call fcn.00403d41
pop ecx
pop ecx
mov dword [ebp - 0x37c], eax
invalid

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x42e030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x44b020
Capabilities:
Encode data using xor

Disassembly:
jmp 0x6890f2
call eax
mov ebp, dword [ebp - 4]
xchg esi, edi
mov dword [ebp], eax
bsf edi, edi
mov edi, ebp
sbb bx, ax
rcl bl, cl
pop ebx
xchg ebp, ebp
pop ebp
pop esi
bsf edx, ebx
shr dh, cl
mov edx, dword [esi]
cmp bp, si
cmp edi, 0x12b43150
test eax, 0x65ba551a
add esi, 4
cmp ebp, edx
test ax, 0x318
cmp bl, 0x51
xor edx, ebx
cmc
xor edx, 0x1f1c088c
jmp 0x4d27cd
dec edx
cmc
clc
neg edx
ror edx, 3
lea edx, [edx + 0x44056e37]
xor ebx, edx
test di, dx
stc
add ebp, edx
jmp 0x591def
add eax, edx
mov dword [ebp - 4], eax
test ebx, ebx
jmp 0x4eb1d8
je 0x4eb1ef
mov eax, dword [ebp + ebx*4]
push eax
sub ebx, 1
jne 0x4eb1de
mov eax, dword [ebp]
jmp 0x4bb3aa
jmp ebp
mov edi, 0x80cafec2
repne movsb byte es:[edi], byte [esi]
mov eax, 0x36513fef
xor bl, dl
push esi
setb ah
xor eax, 0x61c54b57
push ebp
ror al, 0xd3
push ebx
mov ebp, edi
stc
rol bx, 0x72
and bx, si
mov ebx, edx
mov dx, bp
shr dh, 0xda
test bx, bp
mov edx, ebx
shl edx, 2
mov eax, ebp
stc
jmp 0x4e75c3
in al, 0xe5
jmp [eax + 1]
push 0x67724001
call fcn.005c00cb
mov al, 0xe3
jns 0x6890ef
add edi, edx
xchg esi, eax
jo 0x689107
cwde
rcr byte [ecx + 0x5378127d], 0x90
std
lds ecx, [edx + 0x24]
insb byte es:[edi], dx
add ch, byte [edx]
sub esp, dword [eax]
mov bh, byte [ebp - 0x78]
cld
mov eax, dword [edi + 0x1ef6f7fd]
or byte fs:[ebp + 0x7d9f1073], 0x6d
mov dword [esi + 0x6c], 0xda0b4402
jp 0x6890b4
loop 0x6890e2
mov ebx, 0x6747027d
in eax, 0xfc
adc al, 0xff
adc dl, dl
cdq
leave
sub al, 0x66
ja 0x6891be
and dword [edx - 0x5e], ecx
mov al, 0x45
invalid
lahf
push 0xffffffffffffff8c
std
dec esp
cmp edi, 0x24ba826f
int1
xchg esp, eax
jge 0x689247
mov al, 0xa7
add al, byte [bp + di]
inc esp
cmp esi, dword [ecx - 0x7e]
in eax, dx
inc edi
insd dword es:[edi], dx
mov bh, ch
or al, 0x6e
inc edx
xchg ebp, edi
jmp [0xff826e14]
lcall 0xe001, 0x90c72e82
mov dl, 0x75
and eax, 0x58372c43
div byte [esi]
dec ecx
xor edx, edx
rcl dl, 0
push ebp
jae 0x6892a9
inc edi
fadd qword [edi]
rcl byte [ebx - 0x4c838f0b], cl
add ah, bl
rol byte [edx + 0x7e4d9be7], 0x78
rol dword [esi], 1
sub eax, 0x14bf7d7d
xlatb
enter 0x50e9, 0x29
std
fadd dword [edx]
cmpsb byte [esi], byte es:[edi]
ret 0x64d9
sub edi, ebp
mov eax, 0x2db32da
jns 0x6892f7
mov ch, 0x7b
fnstenv [ecx - 0x109a4e73]
xchg edx, eax
mov dword [edi + 0x4c4ed4aa], esi
cli
add ah, ch
mov ch, 0x76
dec edi
int 0xe3
mov bl, 0xfd
nop
xchg ecx, eax
mov dword [0x7a4abb05], eax
cmp byte [ecx - 0x1b4a02f4], dl
in eax, 0x5f
cmp edx, ebx
cdq
ljmp 0x2d63
fsubr dword [esi + 0x54902e2]
jbe 0x689305
jge 0x689326
sbb byte [ebx], dl
out 0x4b, eax
cmpsb byte [esi], byte es:[edi]
pop ecx
mov ecx, 0xe31693b6
jmp 0x689358
ror ch, cl
or dh, byte [esp + ebx + 0x6b2e6f8e]
xor eax, 0xe14dd24f
add ch, byte [esi - 0x30494863]
inc eax
adc al, 0x2d
xchg edi, eax
push eax
add esp, dword [esi + 0x4eb47216]
inc eax
sub byte [ebp + 0x36], dh
mov eax, 0x867b267d
out 2, eax
test byte [esi - 0x68d21567], bh
mov edx, dword [ebx]
std
test byte [edx - 0x487aca8d], ah
jmp 0x60b2164f
Function at 0x44cc80
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x44cd8c
test eax, eax
je 0x44cd8c
push esi
push edi
mov ecx, 0x10
mov esi, 0x467ff0
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x44cd73
lea edi, [eax + 4]
jmp 0x44ccd7
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x44ccec
mov dword [ebp - 4], 2
jmp 0x44cd0d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x44cd03
mov dword [ebp - 4], 1
jmp 0x44cd0d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x44cd83
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x44cd46
mov byte [ecx], 0x3d
jmp 0x44cd52
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x44cd5d
mov byte [ecx], 0x3d
jmp 0x44cd63
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x44ccd4
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44ccac
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x44cd8c
test eax, eax
je 0x44cd8c
push esi
push edi
mov ecx, 0x10
mov esi, 0x467ff0
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x44cd73
lea edi, [eax + 4]
jmp 0x44ccd7
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x44ccec
mov dword [ebp - 4], 2
jmp 0x44cd0d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x44cd03
mov dword [ebp - 4], 1
jmp 0x44cd0d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x44cd83
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x44cd46
mov byte [ecx], 0x3d
jmp 0x44cd52
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x44cd5d
mov byte [ecx], 0x3d
jmp 0x44cd63
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x44ccd4
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401eec
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40a11c]
jne 0x401ef6
repz ret
jmp fcn.00403442

Function at 0x403e83
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402c5a
and dword [ebp - 4], 0
cmp dword [0x40b660], 0
mov ebx, eax
jne 0x403f34
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x403fe5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x403fe5
push eax
call fcn.00402be8
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40b660], eax
call esi
push eax
call fcn.00402be8
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40b664], eax
call esi
push eax
call fcn.00402be8
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40b668], eax
call esi
push eax
call fcn.00402be8
pop ecx
mov dword [0x40b670], eax
test eax, eax
je 0x403f34
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402be8
pop ecx
mov dword [0x40b66c], eax
mov eax, dword [0x40b66c]
cmp eax, ebx
je 0x403f8c
cmp dword [0x40b670], ebx
je 0x403f8c
push eax
call fcn.00402c63
push dword [0x40b670]
mov esi, eax
call fcn.00402c63
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x403f8c
test edi, edi
je 0x403f8c
call esi
test eax, eax
je 0x403f83
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x403f83
test byte [ebp - 0xc], 1
jne 0x403f8c
or dword [ebp + 0x10], 0x200000
jmp 0x403fc5
mov eax, dword [0x40b664]
cmp eax, ebx
je 0x403fc5
push eax
call fcn.00402c63
pop ecx
test eax, eax
je 0x403fc5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x403fc5
mov eax, dword [0x40b668]
cmp eax, ebx
je 0x403fc5
push eax
call fcn.00402c63
pop ecx
test eax, eax
je 0x403fc5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40b660]
call fcn.00402c63
pop ecx
test eax, eax
je 0x403fe5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x403fe7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x10002aa0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp dword [eax + 0x70], 0
mov dword [eax + 0x4c], ecx
jne 0x10002ab3
mov dword [eax + 0x70], 1
mov dword [eax + 0x54], ecx
mov edx, ecx
sub edx, dword [eax + 0x54]
cmp edx, 0x2710
jge 0x10002ac8
cmp edx, 0xffffd8f0
jge 0x10002acd
mov dword [eax + 0x54], ecx
jmp 0x10002ad1
test edx, edx
js 0x10002aec
mov edx, dword [eax + 0x50]
add dword [eax + 0x54], edx
push esi
push edi
mov edi, ecx
sub edi, dword [eax + 0x54]
pop edi
pop esi
js 0x10002ae7
add edx, ecx
mov dword [eax + 0x54], edx
jmp fcn.100024b0
ret

Function at 0x10002c70
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x19c
mov eax, dword [0x1007b210]
xor eax, esp
mov dword [esp + 0x198], eax
push edi
xor edi, edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi], vtable.CTcpSocket.0
mov dword [esi + 0x38], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov eax, vtable.CBuffer.0
mov dword [esi + 0x2c], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x48], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x4c], eax
lea eax, [esp + 8]
push eax
push 0x202
mov dword [esi + 0x58], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
call dword [sym.imp.WS2_32.dll_WSAStartup]
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push edi
lea ecx, [esi + 0x18]
push ecx
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov ecx, dword [esp + 0x19c]
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x14], edi
pop edi
xor ecx, esp
mov dword [esi + 0x64], 0xffffffff
mov eax, esi
call fcn.10007f62
mov esp, ebp
pop ebp
ret
Function at 0x10003250
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov esi, eax
mov dword [ebp - 4], 0
cmp ebx, 0x40000
jl 0x100032ad
jmp 0x10003270
xor edi, edi
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x64]
push 0
push 0x40000
push esi
push ecx
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x10003291
inc edi
cmp edi, 0xf
jl 0x10003272
cmp edi, 0xf
je 0x100032de
add dword [ebp - 4], eax
sub ebx, 0x40000
add esi, 0x40000
cmp ebx, 0x40000
jge 0x10003270
test ebx, ebx
jle 0x100032d6
xor edi, edi
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x64]
push 0
push ebx
push esi
push eax
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x100032ce
inc edi
cmp edi, 0xf
jl 0x100032b3
cmp edi, 0xf
je 0x100032de
add dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
je 0x100032e1
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x10003510
Capabilities:
Create thread
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, eax
mov eax, dword [esi + 0x198]
xor ebx, ebx
cmp eax, ebx
jne 0x10003532
mov dword [esi + 0x1b8], 0x598
jmp 0x10003549
cmp eax, 0x598
jbe 0x10003543
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [esi + 0x1b8], eax
push edi
mov dword [esi + 0x64], ebx
call fcn.10003670
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, 1
push 0x100afc38
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], 5
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], eax
mov dword [ebp - 8], ebx
call edi
mov dword [esi + 0x48], eax
cmp eax, ebx
jne 0x10003588
push 0x100afc38
call edi
mov dword [esi + 0x48], eax
mov ecx, dword [esi + 0x40]
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
push 4
lea eax, [ebp - 4]
push eax
push 0x1001
push 0xffff
mov ebx, 0x40000
push ecx
mov dword [ebp - 4], ebx
call edi
mov eax, dword [esi + 0x40]
push 4
lea edx, [ebp - 4]
push edx
push 0x1002
push 0xffff
push eax
mov dword [ebp - 4], ebx
call edi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push ecx
push edx
call fcn.10003700
test eax, eax
je 0x1000361d
lea eax, [esi + 0x58]
push eax
push 0
push esi
push 0x10003880
push 0
push 0
call fcn.1000898c
add esp, 0x18
mov dword [esi + 0x54], eax
test eax, eax
je 0x1000360f
mov ecx, dword [esi + 0x2c]
push ecx
mov edi, 1
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [esi + 0x5c], 8
push 0x65f
jmp 0x1000362b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x5c], 0xb
push eax
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
call ebx
xor eax, eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], 5
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, esi
call fcn.10003f70
push edi
call ebx
mov edi, dword [ebp - 8]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8