joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10009e40
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10023d4b
mov eax, dword fs:[0]
push eax
sub esp, 0x238
mov eax, dword [0x1003406c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
push str.asio_hw_fun26
mov dword [ebp - 0x228], eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x21c], esi
test esi, esi
jne 0x10009ec0
xorps xmm0, xmm0
mov dword [ebp - method.std::runtime_error.virtual_0], 0x10024228
push 0x10033194
lea eax, [ebp - 0x244]
movq qword [ebp - 0x240], xmm0
push eax
mov dword [ebp - 0x240], str.bad_allocation
call fcn.1000f434
mov dword [ebp - 4], 0
movups xmm0, xmmword [str.BankIndexDataArray]
mov eax, dword [0x10030268]
mov dword [ebp - 0x1f8], eax
mov ax, word [0x1003026c]
movups xmmword [ebp - 0x218], xmm0
push 0x1e2
movups xmm0, xmmword [0x10030258]
mov word [ebp - 0x1f4], ax
lea eax, [ebp - 0x1f2]
push 0
push eax
movups xmmword [ebp - 0x208], xmm0
call fcn.1000f4b0
mov eax, dword [edi + 4]
lea edx, [ebp - 0x224]
add esp, 0xc
mov dword [ebp - 0x224], 0
xor bl, bl
mov ecx, dword [eax]
push 0
push edx
push 0
push esi
push eax
call dword [ecx + 0x4c]
test eax, eax
js 0x1000a00d
mov eax, dword [ebp - 0x224]
lea edx, [ebp - 0x220]
push edx
mov dword [ebp - 0x220], 0
push 0
mov ecx, dword [eax]
push eax
call dword [ecx + 0x3c]
test eax, eax
js 0x1000a001
push dword [ebp - 0x228]
mov eax, 8
mov word [ebp - 0x238], ax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
push 8
mov dword [ebp - 0x230], eax
lea edx, [ebp - 0x238]
mov eax, dword [ebp - 0x220]
push edx
push 0
lea edx, [ebp - 0x218]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x14]
test eax, eax
js 0x10009fe8
mov eax, dword [edi]
lea edx, [ebp - 0x228]
push 0
push edx
push dword [ebp - 0x220]
mov dword [ebp - 0x228], 0
mov ecx, dword [eax]
push 0
push 0
push esi
push dword [edi + 8]
push eax
call dword [ecx + 0x60]
test eax, eax
js 0x10009fdd
push str._ASUSWMIManager___BurstWriteEC__ExecMethod_Successful.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov bl, 1
jmp 0x10009fe8
push str._ASUSWMIManager___BurstWriteEC__ExecMethod_failed.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x220]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [ebp - 0x224]
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000c5be
mov esp, ebp
pop ebp
ret 4
Function at 0x405b99
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, 0x4083f8
and byte [ebp - 0x1f], 0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
and dword [ebp - 0x14], 0
and dword [ebp - 4], 0
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push esi
push eax
mov byte [ebp - 0x20], 1
push dword [ebp + 8]
mov word [ebp - 0x1e], 4
mov dword [ebp - 0x10], 0x4083e8
mov dword [ebp - 0xc], 0xc
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x405bea
xor eax, eax
jmp 0x405c11
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0xb7
jne 0x405c11
lea eax, [ebp - 0x20]
push eax
push 0x80000007
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityW]
test eax, eax
jne 0x405be6
call esi
pop esi
leave
ret 4

Function at 0x405c4b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [0x45e750], 0x44
push eax
xor eax, eax
push 0x45e750
push eax
push eax
push 0x4000000
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x405c8a
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x405c8e
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
and dword [eax + 0x24], 0
mov dword [eax], 0x3c
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
ret 4

Function at 0x405d2c
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push esi
call fcn.00406133
mov edi, eax
cmp edi, 0xffffffff
je 0x405d6d
test byte [esp + 0x10], 1
push esi
je 0x405d4f
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x405d55
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x405d5e
xor eax, eax
inc eax
jmp 0x405d6f
test byte [esp + 0x10], 4
jne 0x405d6d
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
pop edi
pop esi
ret 8
Function at 0x405d74
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push edi
mov dword [ebp - 4], eax
call fcn.0040603f
test bl, 8
mov dword [ebp - 8], eax
je 0x405db3
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x4702e8], eax
jmp 0x405f30
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
je 0x405dcd
test eax, eax
je 0x405ede
test bl, 2
je 0x405ede
mov esi, 0x456750
push edi
push esi
call fcn.00406668
cmp dword [ebp + 8], 0
je 0x405dec
push str..
push esi
call sub.KERNEL32.dll_lstrcatW
jmp 0x405df2
push edi
call fcn.00405f83
cmp word [edi], 0
jne 0x405e02
cmp word [0x456750], 0x5c
jne 0x405e0d
push 0x40a014
push edi
call sub.KERNEL32.dll_lstrcatW
push edi
call sub.KERNEL32.dll_lstrlenW
lea ebx, [edi + eax*2]
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405ed3
cmp word [ebp - 0x22c], 0x2e
jne 0x405e57
cmp word [ebp - 0x22a], 0
je 0x405eb6
cmp word [ebp - 0x22a], 0x2e
jne 0x405e57
cmp word [ebp - 0x228], 0
je 0x405eb6
lea eax, [ebp - 0x22c]
push eax
push ebx
call fcn.00406668
test byte [ebp - 0x258], 0x10
je 0x405e82
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405eb6
push dword [ebp + 0xc]
push edi
call fcn.00405d74
jmp 0x405eb6
push dword [ebp - 4]
push edi
call fcn.00405d2c
test eax, eax
jne 0x405eae
cmp dword [ebp - 4], eax
je 0x405ea6
push edi
push 0xfffffffffffffff1
call fcn.004056ca
push 0
push edi
call fcn.00406428
jmp 0x405eb6
inc dword [0x4702e8]
jmp 0x405eb6
push edi
push 0xfffffffffffffff2
call fcn.004056ca
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x405e2f
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405ede
and word [ebx - 2], 0
xor esi, esi
cmp dword [ebp + 8], esi
je 0x405f30
cmp dword [ebp - 8], esi
jne 0x405ef2
inc dword [0x4702e8]
jmp 0x405f30
push edi
call fcn.0040699e
test eax, eax
je 0x405f30
push edi
call fcn.00405f37
mov eax, dword [ebp - 4]
or al, 1
push eax
push edi
call fcn.00405d2c
test eax, eax
jne 0x405f28
cmp dword [ebp - 4], esi
je 0x405eea
push edi
push 0xfffffffffffffff1
call fcn.004056ca
push esi
push edi
call fcn.00406428
jmp 0x405f30
push edi
push 0xffffffffffffffe5
call fcn.004056ca
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x886530
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push eax
push 0x40
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp + 0xc]
add esp, 0x10
test eax, eax
jne 0x886553
mov eax, 1
jmp 0x88665e
mov edx, dword [ebp + 8]
movzx eax, word [edx]
cmp eax, 0x5a4d
jne 0x886569
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x3c], 0
jne 0x886573
mov eax, 2
jmp 0x88665e
mov edx, dword [ebp + 0x10]
push edx
push 0xf8
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
push ecx
mov edx, dword [ebp + 8]
add edx, 0x40
push edx
call dword [ebp + 0xc]
add esp, 0x10
test eax, eax
jne 0x88659e
mov eax, 1
jmp 0x88665e
mov eax, dword [ebp + 8]
cmp dword [eax + 0x40], 0x4550
jne 0x8865c4
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + 0x58]
cmp edx, 0x10b
jne 0x8865c4
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 0x46]
test ecx, ecx
jne 0x8865ce
mov eax, 2
jmp 0x88665e
mov edx, dword [ebp + 8]
movzx eax, word [edx + 0x46]
imul eax, eax, 0x28
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x140], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x140]
push eax
call fcn.00898a10
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x138], eax
mov edx, dword [ebp + 8]
cmp dword [edx + 0x138], 0
jne 0x88660f
mov eax, 3
jmp 0x88665e
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
mov edx, dword [ebp + 8]
movzx eax, word [edx + 0x54]
lea ecx, [ecx + eax + 0x18]
mov edx, dword [ebp + 8]
mov dword [edx + 0x13c], ecx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x140]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x13c]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x138]
push eax
call dword [ebp + 0xc]
add esp, 0x10
test eax, eax
jne 0x88665c
mov eax, 1
jmp 0x88665e
xor eax, eax
pop ebp
ret

Function at 0x887000
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
cmp ecx, 0x5a4d
je 0x887016
xor eax, eax
jmp 0x887056
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x3c]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp dword [ecx], 0x4550
jne 0x88703b
mov edx, dword [ebp - 4]
movzx eax, word [edx + 0x18]
cmp eax, 0x10b
je 0x88703f
xor eax, eax
jmp 0x887056
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x78]
push ecx
call fcn.00887060
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x8970d0
Capabilities:
Get steam token

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x484
push 0x64000
call 0x76fcb100
nop
add esp, 4
mov dword [ebp - 0x458], eax
mov eax, dword [ebp - 0x458]
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
push 0x8a05bd
lea ecx, [ebp - 0x1c]
call fcn.0089a740
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0x1fffff
call 0x480d95
nop
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x897148
mov dword [ebp - 0x45c], 0x8a05be
lea ecx, [ebp - 0x1c]
call fcn.0089a800
mov eax, dword [ebp - 0x45c]
jmp 0x8972df
mov edx, 1
test edx, edx
je 0x8972ae
mov byte [ebp - 0x438], 0
push 0x207
push 0
lea eax, [ebp - 0x437]
push eax
call fcn.0089aae0
add esp, 0xc
lea ecx, [ebp - 0x230]
push ecx
mov edx, dword [ebp - 8]
push edx
push 0xfff
push 0xffffffffffffffff
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
push 0x8a0ba8
mov edx, dword [ebp - 4]
push edx
call fcn.00896f00
add esp, 0x20
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x28]
add eax, 0x208
mov ecx, dword [ebp - 0x24]
adc ecx, 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0x24], 0
ja 0x8971ca
jb 0x8971c5
cmp dword [ebp - 0x28], 0
ja 0x8971ca
jmp 0x8972ae
cmp dword [ebp - 0x24], 0
ja 0x8971d9
cmp dword [ebp - 0x28], 0xffff
jbe 0x8971f5
push 0
push 0x208
lea edx, [ebp - 0x438]
push edx
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [ebp - 4]
push ecx
call 0x480e8a
nop
lea edx, [ebp - 0x438]
push edx
lea ecx, [ebp - 0x1c]
call fcn.0089a820
lea ecx, [ebp - 0x1c]
call fcn.0089aad0
push eax
call dword [fcn.00aca784]
cmp eax, 0x12c
jle 0x8972a9
lea ecx, [ebp - 0x1c]
call fcn.0089aad0
push eax
lea ecx, [ebp - 0x478]
call fcn.00897320
lea eax, [ebp - 0x478]
push eax
lea ecx, [ebp - 0x454]
push ecx
call fcn.00896b60
add esp, 8
lea ecx, [ebp - 0x478]
call fcn.00888060
lea ecx, [ebp - 0x454]
call fcn.00897380
movzx edx, al
test edx, edx
jne 0x89729e
lea ecx, [ebp - 0x454]
call fcn.00897360
cmp eax, 0xa
jbe 0x89729e
lea ecx, [ebp - 0x1c]
call fcn.0089aad0
mov dword [ebp - 0x47c], eax
lea ecx, [ebp - 0x454]
call fcn.00888060
lea ecx, [ebp - 0x1c]
call fcn.0089a800
mov eax, dword [ebp - 0x47c]
jmp 0x8972df
lea ecx, [ebp - 0x454]
call fcn.00888060
jmp 0x897148
mov eax, dword [ebp - 8]
mov dword [ebp - 0x480], eax
mov ecx, dword [ebp - 0x480]
push ecx
call 0x76fcb0f3
nop
add esp, 4
mov dword [ebp - 0x484], 0x8a05bf
lea ecx, [ebp - 0x1c]
call fcn.0089a800
mov eax, dword [ebp - 0x484]
mov esp, ebp
pop ebp
ret

Function at 0x899750
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x899780
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [ebp + 8], 0
jne 0x899793
xor eax, eax
jmp 0x899851
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x8997ae
xor eax, eax
jmp 0x899851
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
cmp dword [edx], 0x4550
je 0x8997cc
xor eax, eax
jmp 0x899851
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x78]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x1c]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x24]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x20]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x1c], 0
jmp 0x89980e
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [eax + 0x18]
jae 0x89984f
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax*4]
push edx
call fcn.00898a30
add esp, 8
test eax, eax
jne 0x89984d
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + edx*4]
mov eax, ecx
jmp 0x899851
jmp 0x899805
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x64f9b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, 8
pxor mm7, mm7
push ecx
movd mm6, ebx
mov ebx, 0x80008000
push edx
punpckldq mm6, mm6
movd mm5, ebx
push edi
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
punpckldq mm5, mm5
movq mm0, qword [edx]
movq mm2, qword [edx + 8]
movq mm4, qword [edx + 0x10]
movq mm1, mm2
psrlq mm2, 0x20
punpckldq mm2, mm4
paddd mm0, mm2
movq mm3, mm4
psrlq mm4, 0x20
sub eax, 4
jl 0x64fab9
jmp 0x64fa10
pxor mm5, qword [ecx]
add edi, 8
add ecx, 8
movq mm2, qword [edx + 0x18]
punpckldq mm4, mm2
paddd mm0, mm2
paddd mm1, mm4
movq mm4, mm5
punpcklwd mm5, mm7
punpckhwd mm4, mm7
pcmpeqd mm7, mm7
psubd mm0, mm5
pslld mm7, 0x12
psubd mm1, mm4
pslld mm5, 4
pslld mm4, 4
psubd mm5, mm0
movq mm0, mm6
paddd mm5, mm7
paddd mm4, mm7
psrld mm7, 0x1e
pand mm0, mm5
paddd mm5, mm7
psrld mm0, 3
paddd mm5, mm0
movq mm0, qword [edx + 0x20]
psrad mm5, 3
paddd mm1, mm0
add edx, 0x10
psubd mm4, mm1
movq mm1, mm6
sub eax, 4
pand mm1, mm4
paddd mm4, mm7
psrld mm1, 3
paddd mm4, mm1
movq mm1, mm2
psrad mm4, 3
psrlq mm2, 0x20
packssdw mm5, mm4
movq mm4, mm0
movq mm0, mm3
punpckldq mm2, mm4
movq mm3, mm4
psrlq mm4, 0x20
movq qword [edi - 8], mm5
movd mm5, ebx
paddd mm0, mm2
punpckldq mm5, mm5
pxor mm7, mm7
jge 0x64fa10
add eax, 4
jle 0x64fb43
pxor mm5, qword [ecx]
movq mm2, qword [edx + 0x18]
punpckldq mm4, mm2
paddd mm0, mm2
paddd mm1, mm4
movq mm4, mm5
punpcklwd mm5, mm7
punpckhwd mm4, mm7
pcmpeqd mm7, mm7
psubd mm0, mm5
pslld mm7, 0x12
pslld mm5, 4
psubd mm1, mm4
psubd mm5, mm0
paddd mm1, qword [edx + 0x20]
pslld mm4, 4
paddd mm5, mm7
psubd mm4, mm1
movq mm2, mm6
paddd mm4, mm7
psrld mm7, 0x1e
pand mm2, mm5
paddd mm5, mm7
psrld mm2, 3
pand mm6, mm4
paddd mm4, mm7
psrld mm6, 3
paddd mm5, mm2
paddd mm4, mm6
psrad mm5, 3
psrad mm4, 3
packssdw mm5, mm4
cmp eax, 2
jl 0x64fb3d
movd dword [edi], mm5
je 0x64fb43
psrlq mm5, 0x20
add edi, 4
movd edx, mm5
mov word [edi], dx
pop edi
pop edx
pop ecx
pop ebx
ret

Function at 0x6da626
Capabilities:
Encode data using xor

Disassembly:
test eax, 0x624ec182
in al, 0x1c
pop edx
lodsb al, byte [esi]
rcr byte [esp + ebp + 0x7e], 1
adc edi, dword [ebx]
imul edx, dword [ecx], 0x434e1caf
inc edx
xchg ecx, eax
xlatb
out dx, eax
invalid
Function at 0x1000e4e0
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x1000e4c3
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x1000e4e1
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
invalid
and al, 0x8d
inc esp
or bh, bh
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x1000e53f
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1000e526
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x1000e52f
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1000e539
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x1000e51b
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x1000e4a5
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x1000e58c
dec eax
je 0x1000e583
sub eax, 3
je 0x1000e57a
mov dword [ebp - 4], 0x40
jmp 0x1000e5a9
mov dword [ebp - 4], 4
jmp 0x1000e58f
mov dword [ebp - 4], 0x20
jmp 0x1000e58f
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x1000e5db
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x1000e55b
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.1000ddec
adc eax, 0xff39bc99
jne 0x1000e5e6
push 1
push esi
call edi
mov eax, esi
jmp 0x1000e5e7
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
rcr byte [edi + 0x5e], 0x5b
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000eae0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp dword [ebp + 0xc], 8
jne 0x1000ec72
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
mov byte [ebp - 0x6a6], 9
mov byte [ebp - 0x6a5], 0xb
mov byte [ebp - 0x6a4], 0x16
mov byte [ebp - 0x6a3], 0x1d
mov byte [ebp - 0x6a2], 0x64
lea eax, [ebp - 0x6b8]
push eax
call fcn.1000ddfc
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1000ddb1
add esp, 0xc
mov dword [ebp - 0x690], eax
mov byte [ebp - 0x6a0], 0x8b
or byte [ebp - 0x69f], 0xff
mov byte [ebp - 0x69e], 0x55
mov byte [ebp - 0x69d], 0x8b
mov byte [ebp - 0x69c], 0xec
lea eax, [ebp - 0x694]
push eax
push 5
lea eax, [ebp - 0x6a0]
push eax
call fcn.1000ddec
or eax, 0x801db915
movsd dword es:[edi], dword [esi]
mov esp, 0xfffffa
push 0
call dword [ebp - 0x340]
mov dword [ebp + 8], eax
push 0x104
lea eax, [ebp - 0x334]
push eax
push 0
call dword [ebp - 0x538]
call fcn.1000ddec
mov ecx, 0x80e72ea2
movsd dword es:[edi], dword [esi]
sar ch, 1
invalid

Function at 0x1000ecb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [edx + 0x40], ch
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.1000ddca
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
invalid
invalid
movsd dword es:[edi], dword [esi]
cld
Function at 0x10015100
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
push ebx
push esi
push edi
mov dword [ebp - 0x104], 0
mov dword [ebp - 0x114], 0
jmp 0x10015131
mov eax, dword [ebp - 0x114]
add eax, 1
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x114]
cmp eax, dword [ebp - 0x104]
jae 0x10015155
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp + eax*4 - 0x100]
cmp ecx, dword [ebp + 8]
jne 0x10015153
jmp 0x10015155
jmp 0x10015122
mov eax, dword [ebp - 0x114]
cmp eax, dword [ebp - 0x104]
jne 0x1001518b
cmp dword [ebp - 0x104], 0x40
jae 0x1001518b
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x100], ecx
mov eax, dword [ebp - 0x104]
add eax, 1
mov dword [ebp - 0x104], eax
xor eax, eax
jne 0x10015116
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], 0
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
lea eax, [ebp - 0x110]
push eax
push 0
push 0
lea ecx, [ebp - 0x104]
push ecx
mov edx, dword [ebp + 8]
add edx, 1
push edx
call dword [sym.imp.WS2_32.dll_select]
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
jle 0x100151ef
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_recv]
jmp 0x10015207
cmp dword [ebp - 0x108], 0
jne 0x10015201
mov eax, dword [ebp + 0x18]
mov dword [eax], 1
mov eax, dword [ebp - 0x108]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret