joyce8/EMBER2024-capa huggingface dataset:
Function at 0x625eac
Capabilities:
Encode data using xor

Disassembly:
int 0xfe
push 0x40505a22
mov al, byte [0x5922f175]
dec edx
sub esi, 0x32
mov eax, dword [0xabc04062]
sub al, byte [edx + ebx*2 + 0x6fe35856]
xlatb
xlatb
sub byte [edx + 0x44], ah
xor al, byte [edi + 0x25]
mov dl, 0x5e
fdiv st(3)
test ch, 0x1e
jge 0x625e31
jge 0x625e31
rol byte [ecx], 1
xor byte [ebx + 0x3d], al
invalid
cmp bh, byte [ebp - 0x2c]
invalid
aam 0xfe
pop esi
mov eax, 0xd36a03e3
rcr byte [edx - 0x1a9fc774], 0x3f
in al, dx
add byte [ecx + 0x36], 0x86
mov eax, dword [0x7b40ba2c]
inc ebx
stosd dword es:[edi], eax
movsb byte es:[edi], byte [esi]
or eax, 0xd7b2525d
ja 0x625e5e
retf
adc byte [eax], bh
lea edi, [edx + edx*2 + 0x112ce9f7]
ja 0x625ed2
xchg esp, eax
sbb cl, byte [ecx + 0x6f]
jmp 0x625ed9
jecxz 0x625e7c
jge 0x625ed6
ret 0x22f1
cdq
call 0x51cb8e62
sub byte [edi], 0x69
push ecx
mov byte [0x1024f2b5], al
js 0x625e7e
jg 0x625edc
xor byte [ecx + 0x3c52962e], 0x3d
cmpsd dword [esi], dword es:[edi]
jo 0x625f56
and byte [ebx], ah
rcr byte [edx + 0x6fbc26c5], 1
add byte [esi], 0xb5
dec ebp
add byte [ebx - 0x63], dl
popfd
mov dword [0x41a239f0], eax
mov edx, 0xe035fc68
xor al, 0xf0
or dword [esi + 0x206c379d], edx
jo 0x625f6d
aaa
cmp ecx, esi
cwde
adc eax, 0x8c487036
xor al, 0x95
lodsd eax, dword [esi]
sbb eax, 0x81a7fbf1
xchg ebx, eax
call 0x1a2d29e6
int1
jp 0x625f01
cmp eax, 0x33502b5f
cmpsb byte [esi], byte es:[edi]
add dword [esi - 0x43], eax
xor al, 0x62
daa
jno 0x625f44
invalid
out dx, eax
iretd
inc esp
or bl, ah
sub al, 0xc0
add bl, byte [ecx - 0xdbf4ee4]
stc
cwde
xor dword [eax - 0x4bdb0d77], esi
add dword [ebx + 0x73], ebp
fisubr word [ecx]
mov cs, word [ebp + 0x30]
nop
xlatb
sub dword [esi - 0x286fcfb3], ecx
jo 0x625fbe
insb byte es:[edi], dx
inc ebx
push ebx
imul esp, dword [esi + 0x41], 0xffffffaf
inc ecx
scasd eax, dword es:[edi]
xchg byte [eax - 0x65], bl
fucomp st(4)
wait
xor al, byte [eax + 0x506c3d23]
mov cl, 0xc3
loope 0x625f79
inc eax
ret 0x852
cmp eax, 0x7f1df55f
aad 0xe
xchg ecx, eax

Function at 0x64d9fd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x656388
cmp edx, dword [eax]
je 0x64da1f
add eax, 8
inc ecx
cmp eax, 0x656418
jl 0x64da10
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x656388]
jne 0x64db4d
mov eax, dword [0xa59ce0]
cmp eax, 1
je 0x64db27
test eax, eax
jne 0x64da50
cmp dword [0x6562b4], 1
je 0x64db27
cmp edx, 0xfc
je 0x64db4d
int1
add byte [eax], al
invalid
lea eax, [ebp - 0x1a4]
push 0x104
add byte [eax + 0x6a], dl
add bh, bh
adc eax, sym.imp.KERNEL32.dll_GetModuleFileNameA
lea eax, [ebp + 8]
lea esi, [esi + 0x65638c]
push 0
push eax
push dword [esi]
call fcn.0064e870
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
Function at 0x4063c3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, 0x104
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
pop esi
jbe 0x4063e7
xor eax, eax
test eax, eax
je 0x4063f9
cmp byte [ebp + eax - 0x121], 0x5c
je 0x4063f9
xor ecx, ecx
jmp 0x4063fc
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx + 0x40a014]
lea eax, [ebp + eax - 0x120]
push ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
leave
ret 4

Function at 0x4064e8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4232c4], 0
push esi
jne 0x40651f
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4064f9
mov dword [ecx*4 + 0x4232c0], eax
inc ecx
cmp ecx, 0x100
jl 0x4064f4
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406550
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4232c0]
xor eax, esi
inc ecx
dec edx
jne 0x406532
pop edi
not eax
pop esi
ret 0xc

Function at 0x10930000
Capabilities:
Decompress data using aplib

Disassembly:
jmp 0x1093000a
jmp 0x1093200f
jmp fcn.106811b8
Function at 0x100024f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10063c15
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x100988d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
push dword [esi + 0xc]
mov ecx, dword [0x10099dfc]
lea eax, [ebp - 0x14]
push eax
call fcn.10031f90
mov edi, dword [ebp + 8]
mov ecx, edi
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.ScCore.dll_public:_bool___thiscall_ScCore::String::operator_class_ScCore::String_const__const]
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
mov bl, al
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::String::destructor_void_]
test bl, bl
je 0x1000261b
mov edi, dword [esi + 8]
mov eax, dword [esi + 0xc]
push 0
push 1
mov esi, dword [edi]
push 0
push eax
push eax
mov esi, dword [esi + 4]
mov ecx, esi
call dword [0x10070958]
mov ecx, edi
call esi
mov esi, eax
test esi, esi
je 0x10002605
push 0
push dword [esi + 0x14]
lea ecx, [ebp - 0x10]
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::String::constructor_char_const___class_ScCore::Encoder_const__]
push 0x2c
mov dword [ebp - 4], 1
call dword [sym.imp.ScCore.dll_public:_static_void____cdecl_ScCore::Heap::operator_new_unsigned_int_]
add esp, 4
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x100025e4
push 0
lea ecx, [ebp - 0x10]
push ecx
push dword [esi + 0xc]
mov ecx, eax
push dword [esi + 4]
call fcn.10031f90
lea ecx, [ebp - 0x10]
mov esi, eax
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::String::destructor_void_]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x10]
xor esi, esi
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::String::destructor_void_]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi]
mov ecx, dword [0x10099dfc]
add eax, 0xc
push eax
call fcn.10031f90
mov ecx, dword [esi]
push eax
mov esi, dword [ecx + 0x30]
mov ecx, esi
call dword [0x10070958]
mov ecx, dword [ebp - 0x18]
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10004300
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006408f
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x100988d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
mov eax, esi
and eax, 0xe0000000
cmp eax, 0x20000000
jg 0x100043cc
je 0x100043c7
cmp eax, 0x80000000
je 0x100043c7
test eax, eax
jne 0x100043d3
lea ecx, [ebp - 0x2c]
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Variant::constructor_void_]
mov eax, dword [0x10099e0c]
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0xa
mov ecx, dword [eax]
test ecx, ecx
je 0x1000437e
add ecx, 0x28
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Lock::acquire_void_]
mov ecx, dword [edi]
push esi
mov byte [ebp - 4], 1
call fcn.10031f90
push eax
lea ecx, [ebp - 0x2c]
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Variant::setString_unsigned_short_int_const__]
mov eax, dword [0x10099e0c]
mov byte [ebp - 4], 2
mov ecx, dword [eax]
test ecx, ecx
je 0x100043ac
add ecx, 0x28
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Lock::release_void_]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call dword [sym.imp.ScCore.dll_public:_double___thiscall_ScCore::Variant::getDouble_void_const]
lea ecx, [ebp - 0x2c]
fstp qword [ebp - 0x14]
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Variant::destructor_void_]
jmp 0x100043ef
xorps xmm0, xmm0
jmp 0x100043ea
cmp eax, 0x40000000
je 0x100043df
and esi, 0x1fffffff
movd xmm0, esi
jmp 0x100043e6
movzx eax, si
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [ebp - 0x14], xmm0
fld qword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10031f90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x10031f9f
pop dword [ebp - 0x44]
mov eax, 0x10031f9f
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x5d914137
add dword [ebp - 0x54], 0xf0c10414
mov dword [ebp - 0x50], 0x792363c0
sub dword [ebp - 0x50], 0x46f0177b
mov dword [ebp - 0x4c], 0xec76d31b
add dword [ebp - 0x4c], 0x5fd57113
mov dword [ebp - 0x48], 0x54d85d5a
add dword [ebp - 0x48], 0xab27a2a6
lea eax, [ebp - 0x54]
push eax
mov eax, 0xe1d05b35
add eax, 0x2e36a4cf
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xdc6c879b
sub dword [ebp - 0x54], 0x67fa1e45
mov dword [ebp - 0x50], 0x5207616e
sub dword [ebp - 0x50], 0x109afff9
mov dword [ebp - 0x4c], 0xf5165fb9
add dword [ebp - 0x4c], 0x6e590cb3
mov dword [ebp - 0x48], 0xabb973fa
sub dword [ebp - 0x48], 0xabb973fa
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x4530726
sub eax, 0xf44c071e
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x46bdb
push 0
call eax
mov ecx, 0x28fe9f55
sub ecx, 0x28fe5641
xor ebx, ebx
add ebx, eax
mov edx, 0x100a9e00
add edx, dword [ebp - 0x44]
mov edi, 0xff48e745
add edi, 0x8c6be35
mov dword [ebp - 0x2c], 0x37646904
mov esi, dword [edx]
sub dword [ebp - 0x20], 0xdff8ef4a
xor esi, edi
sub dword [ebp - 8], 0x289fac4f
mov dword [ebx], esi
xor dword [ebp - 0x34], 0x60257293
add ebx, 0xe246e7d3
sub ebx, 0xe246e7cf
add edx, 0x217ec70e
sub edx, 0x217ec70a
loop 0x100320b8
add eax, 0x11723
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x402c00
pop dword [ebp - 0x28]
mov eax, 0x72e8d275
add eax, 0x8d57598b
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x89bbbbf9
sub dword [ebp - 0x38], 0x3b6976ae
mov dword [ebp - 0x34], 0xb8a1aa10
sub dword [ebp - 0x34], 0x866e5dcb
mov dword [ebp - 0x30], 0x19dd1547
add dword [ebp - 0x30], 0x326f2ee7
mov dword [ebp - 0x2c], 0x98f95150
add dword [ebp - 0x2c], 0x6706aeb0
lea eax, [ebp - 0x38]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x11948305
add dword [ebp - 0x38], 0x62dde651
mov dword [ebp - 0x34], 0xa97645de
sub dword [ebp - 0x34], 0x6809e469
mov dword [ebp - 0x30], 0xb90ed238
add dword [ebp - 0x30], 0xaa609a34
mov dword [ebp - 0x2c], 0x18aa2bf3
sub dword [ebp - 0x2c], 0x18aa2bf3
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3992e
push 0
call eax
mov ecx, 0x538a
xor esi, esi
add esi, eax
mov edi, 0x16302ee7
sub edi, 0x15ef1ee7
add edi, dword [ebp - 0x28]
mov ebx, 0x7464a537
sub dword [ebp - 8], esi
mov edx, dword [edi]
sub dword [ebp - 0x1c], esi
xor edx, ebx
sub dword [ebp - 0x1c], edx
mov dword [esi], edx
mov dword [ebp - 8], 0xfa5d0abb
add esi, 0x9d1cfc89
add esi, 0x62e3037b
add edi, 0x39f778b3
add edi, 0xc6088751
loop 0x402d0e
add eax, 0x140fb
mov ebx, eax
add eax, 0x4423e48b
sub eax, 0x4423e486
mov ecx, 0x83de61d4
add ecx, 0x7c619e2c
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x1003bc10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x1003bc1f
pop dword [ebp - 0xc]
mov eax, 0x309ea74c
add eax, 0xdf6514d3
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xd5d5aabe
add dword [ebp - 0x1c], 0x787c9a8d
mov dword [ebp - 0x18], 0x25a802cf
sub dword [ebp - 0x18], 0xf374b68a
mov dword [ebp - 0x14], 0x8e3e68fa
add dword [ebp - 0x14], 0xbe0ddb34
mov dword [ebp - 0x10], 0x17d1aca7
add dword [ebp - 0x10], 0xe82e5359
lea eax, [ebp - 0x1c]
push eax
mov eax, 0xaf9ee52f
sub eax, 0x9f95842f
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x5517dc1b
add dword [ebp - 0x1c], 0x1f5a8d3b
mov dword [ebp - 0x18], 0xc16ae7a6
add dword [ebp - 0x18], 0x800179cf
mov dword [ebp - 0x14], 0x1b8e6eae
sub dword [ebp - 0x14], 0xb81f0242
mov dword [ebp - 0x10], 0x8b66a511
sub dword [ebp - 0x10], 0x8b66a511
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0x1784e1f7
sub eax, 0x77b80e7
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x57e14
push 0
call eax
mov ecx, 0x429de21b
sub ecx, 0x429da3f8
xor edx, edx
add edx, eax
mov ebx, 0xbba0fd8
sub ebx, 0xfbad2fd8
add ebx, dword [ebp - 0xc]
mov edi, 0x5e2b91e7
add edi, 0x9fa47329
mov esi, dword [ebx]
add dword [ebp - 4], edi
add esi, edi
xor dword [ebp - 4], 0x967ba18a
mov dword [edx], esi
sub dword [ebp - 4], edx
add edx, 4
add ebx, 0x9ac9898d
sub ebx, 0x9ac98989
loop 0x1003bd43
add eax, 0xeb5f
xor ebx, ebx
add ebx, eax
add eax, 0xc4f042d1
sub eax, 0xc4f042cc
mov ecx, 0x77f83767
add ecx, 0x9807c899
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x10043080
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
cmp ecx, edx
je 0x100430a8
push edi
mov edi, esi
mov eax, esi
shr eax, 2
shl edi, 6
add edi, eax
movzx eax, word [ecx]
add eax, 0x9e3779b9
add ecx, 2
add eax, edi
xor esi, eax
cmp ecx, edx
jne 0x10043088
pop edi
mov eax, 3
mul esi
mov eax, esi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1e
imul eax, eax, 0x7fffffff
sub esi, eax
or esi, 0x40000000
mov eax, esi
pop esi
ret
Function at 0x100858d9
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x100858ea
pop esi
ret
push ebx
push edi
push esi
call fcn.1003bc10
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.1003bc10
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x10085912
push ebx
push esi
push edi
call fcn.10067180
add esp, 0xc
push 0
call fcn.1003bc10
pop ecx
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x100013d0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000f27a
mov eax, dword fs:[0]
push eax
sub esp, 0x19c
mov eax, dword [0x100140f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esi + 4]
mov dword [ebp - 0x1a8], esi
mov dword [esi], vtable.CClientSocket.0
call fcn.10001000
lea ecx, [esi + 0x2c]
mov dword [ebp - 4], 0
call fcn.10001000
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 1
call fcn.10001000
lea ecx, [esi + 0x7c]
mov byte [ebp - 4], 2
call fcn.10001000
lea eax, [ebp - 0x1a0]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebp - 0x1a8], 0x2a264024
mov ecx, dword [ebp - 0x1a8]
mov dword [esi + 0xac], eax
mov word [esi + 0xb4], 0x25
mov dword [esi + 0xa8], 0xffffffff
mov dword [esi + 0xb0], ecx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10003c80
mov esp, ebp
pop ebp
ret

Function at 0x100015a0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100140f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
call fcn.100016e0
push dword [esi + 0xac]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 6
push 1
push 2
mov byte [esi + 0xb5], 0
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 0xa8], eax
cmp eax, 0xffffffff
jne 0x100015fa
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003c80
mov esp, ebp
pop ebp
ret 8
push edi
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov edi, eax
test edi, edi
je 0x100015e6
push dword [ebp + 0xc]
mov eax, 2
mov word [ebp - 0x20], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x1e], ax
mov eax, dword [edi + 0xc]
push 0x10
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
push eax
push dword [esi + 0xa8]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x100015e6
push 4
lea eax, [ebp - 0x24]
push eax
push 8
push 0xffff
push dword [esi + 0xa8]
mov dword [ebp - 0x24], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x10001698
push eax
push eax
lea eax, [ebp - 0x28]
push eax
push 0
push 0
push 0xc
lea eax, [ebp - 0x10]
push eax
push 0x98000004
push dword [esi + 0xa8]
mov dword [ebp - 0x10], 1
mov dword [ebp - 0xc], 0x2bf20
mov dword [ebp - 8], 0x1388
call dword [sym.imp.WS2_32.dll_WSAIoctl]
push 1
push 0
push 0
push esi
push 0x10001bd0
push 0
push 0
mov byte [esi + 0xb5], 1
call fcn.10001e70
mov ecx, dword [ebp - 4]
add esp, 0x1c
mov dword [esi + 0xa4], eax
pop edi
xor ecx, ebp
mov al, 1
pop esi
call fcn.10003c80
mov esp, ebp
pop ebp
ret 8
Function at 0x10001af0
Capabilities:
Encode data using xor
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov dword [ebp - 8], ecx
mov ecx, dword [ebp + 0xc]
push esi
xor edx, edx
push edi
mov edi, dword [ebp + 8]
test ecx, ecx
jle 0x10001b17
mov al, byte [edx + edi]
xor al, 0x91
sub al, 0x67
mov byte [edx + edi], al
inc edx
cmp edx, ecx
jl 0x10001b08
mov ebx, dword [ebp + 0x10]
mov edx, dword [sym.imp.WS2_32.dll_send]
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp + 8], ecx
cmp ecx, ebx
jb 0x10001b7a
lea esp, [esp]
xor esi, esi
mov eax, dword [ebp - 8]
push 0
push ebx
push edi
push dword [eax + 0xa8]
call edx
test eax, eax
jg 0x10001b51
mov edx, dword [sym.imp.WS2_32.dll_send]
inc esi
cmp esi, 0xf
jl 0x10001b32
cmp esi, 0xf
je 0x10001bbe
mov esi, dword [ebp - 4]
add esi, eax
push 0xa
mov dword [ebp - 4], esi
add edi, ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp + 8]
mov edx, dword [sym.imp.WS2_32.dll_send]
sub ecx, ebx
mov dword [ebp + 8], ecx
cmp ecx, ebx
jae 0x10001b30
test ecx, ecx
jle 0x10001bac
xor esi, esi
mov eax, dword [ebp - 8]
push 0
push ecx
push edi
push dword [eax + 0xa8]
call edx
test eax, eax
jg 0x10001ba2
mov ecx, dword [ebp + 8]
mov edx, dword [sym.imp.WS2_32.dll_send]
inc esi
cmp esi, 0xf
jl 0x10001b80
cmp esi, 0xf
je 0x10001bbe
mov esi, dword [ebp - 4]
add esi, eax
or eax, 0xffffffff
cmp esi, dword [ebp + 0xc]
pop edi
cmove eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10001e70
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x10]
push esi
push 0
push 0
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
push 0
push 0
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push dword [ebp + 0x1c]
mov dword [ebp - 4], eax
push dword [ebp + 0x18]
lea eax, [ebp - 0x10]
push eax
push 0x100020f0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.100043f5
add esp, 0x18
mov esi, eax
push 0xffffffffffffffff
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10002290
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x100140f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 2
push 0
push 0
mov edi, ecx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edx, dword [ebp + 8]
lea esi, [ebp - 0x1f8]
mov ebx, eax
sub esi, edx
mov cl, byte [edx]
mov byte [esi + edx], cl
lea edx, [edx + 1]
test cl, cl
jne 0x100022c1
push 0xf01ff
lea eax, [ebp - 0x1f8]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 0x214]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x210], 1
je 0x1000230f
lea eax, [ebp - 0x214]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [edi + 0xc]
mov ecx, edi
call fcn.10002610
mov esi, eax
test esi, esi
je 0x10002351
push esi
call dword [sym.imp.KERNEL32.dll_LocalSize]
push eax
push esi
mov ecx, edi
call fcn.10001df0
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10003c80
mov esp, ebp
pop ebp
ret 8