joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5b2a40
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 0x18], 0
je 0x5b2a54
mov dword [esp + 0x18], fcn.005b1220
jmp fcn.005aa820
mov dword [esp + 0x18], fcn.005b04c0
jmp fcn.005aa520

Function at 0x5b4f20
Capabilities:
Hash data using sha1

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call fcn.004beae0
add esp, 4
test eax, eax
jne 0x5b4f34
pop esi
ret
lea eax, [esi + 0x5c]
pop esi
mov dword [esp + 4], eax
jmp fcn.004d4680

Function at 0x5bac90
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0xa8
push 0
lea eax, [esi + 0x40]
push eax
call fcn.00612090
mov edx, dword [esp + 0x18]
add esp, 0xc
mov dword [esi], 0xf3bcc908
mov dword [esi + 4], 0x6a09e667
mov dword [esi + 8], 0x84caa73b
mov dword [esi + 0xc], 0xbb67ae85
mov dword [esi + 0x10], 0xfe94f82b
mov dword [esi + 0x14], 0x3c6ef372
mov dword [esi + 0x18], 0x5f1d36f1
mov dword [esi + 0x1c], 0xa54ff53a
mov dword [esi + 0x20], 0xade682d1
mov dword [esi + 0x24], 0x510e527f
mov dword [esi + 0x28], 0x2b3e6c1f
mov dword [esi + 0x2c], 0x9b05688c
mov dword [esi + 0x30], 0xfb41bd6b
mov dword [esi + 0x34], 0x1f83d9ab
mov dword [esi + 0x38], 0x137e2179
mov dword [esi + 0x3c], 0x5be0cd19
movzx eax, byte [edx]
mov dword [esi + 0xe4], eax
mov ecx, dword [edx]
mov eax, dword [edx + 4]
xor ecx, 0xf3bcc908
mov dword [esi], ecx
xor eax, 0x6a09e667
mov dword [esi + 4], eax
mov ecx, dword [edx + 8]
mov eax, dword [edx + 0xc]
xor ecx, 0x84caa73b
mov dword [esi + 8], ecx
xor eax, 0xbb67ae85
mov dword [esi + 0xc], eax
mov ecx, dword [edx + 0x10]
mov eax, dword [edx + 0x14]
xor ecx, 0xfe94f82b
mov dword [esi + 0x10], ecx
xor eax, 0x3c6ef372
mov dword [esi + 0x14], eax
mov ecx, dword [edx + 0x18]
mov eax, dword [edx + 0x1c]
xor ecx, 0x5f1d36f1
mov dword [esi + 0x18], ecx
xor eax, 0xa54ff53a
mov dword [esi + 0x1c], eax
mov ecx, dword [edx + 0x20]
mov eax, dword [edx + 0x24]
xor ecx, 0xade682d1
mov dword [esi + 0x20], ecx
xor eax, 0x510e527f
mov dword [esi + 0x24], eax
mov ecx, dword [edx + 0x28]
mov eax, dword [edx + 0x2c]
xor ecx, 0x2b3e6c1f
xor eax, 0x9b05688c
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], eax
mov ecx, dword [edx + 0x30]
mov eax, dword [edx + 0x34]
xor ecx, 0xfb41bd6b
xor eax, 0x1f83d9ab
mov dword [esi + 0x30], ecx
mov dword [esi + 0x34], eax
mov ecx, dword [edx + 0x38]
mov eax, dword [edx + 0x3c]
xor ecx, 0x137e2179
xor eax, 0x5be0cd19
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], eax
pop esi
ret
Function at 0x5bcaa0
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x58
push 0
lea eax, [esi + 0x20]
push eax
call fcn.00612090
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
movzx eax, byte [ecx]
mov dword [esi + 0x74], eax
mov eax, dword [ecx]
xor eax, 0x6a09e667
mov dword [esi], eax
mov eax, dword [ecx + 4]
xor eax, 0xbb67ae85
mov dword [esi + 4], eax
mov eax, dword [ecx + 8]
xor eax, 0x3c6ef372
mov dword [esi + 8], eax
mov eax, dword [ecx + 0xc]
xor eax, 0xa54ff53a
mov dword [esi + 0xc], eax
mov eax, dword [ecx + 0x10]
xor eax, 0x510e527f
mov dword [esi + 0x10], eax
mov eax, dword [ecx + 0x14]
xor eax, 0x9b05688c
mov dword [esi + 0x14], eax
mov eax, dword [ecx + 0x18]
xor eax, 0x1f83d9ab
mov dword [esi + 0x18], eax
mov eax, dword [ecx + 0x1c]
xor eax, 0x5be0cd19
mov dword [esi + 0x1c], eax
pop esi
ret
Function at 0x5c6860
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
cmp dword [edi + 0x84], 0xffffffff
je 0x5c6934
push dword [edi]
call fcn.004cce80
mov esi, eax
add esp, 4
test esi, esi
js 0x5c6934
mov eax, dword [esp + 0x14]
test eax, eax
je 0x5c6891
mov dword [eax], esi
push ebp
mov ebp, dword [esp + 0x14]
test ebp, ebp
je 0x5c692b
mov ecx, dword [edi + 0x84]
push ebx
cmp ecx, esi
jne 0x5c68ca
test esi, esi
jle 0x5c6909
mov edx, ebp
lea ecx, [edi + 4]
mov ebx, esi
mov al, byte [ecx + 0x60]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
lea edx, [edx + 1]
mov byte [edx - 1], al
sub ebx, 1
jne 0x5c68b4
jmp 0x5c6909
mov eax, esi
mov byte [ecx + edi + 0x64], 0x80
sub eax, ecx
cmp eax, 1
jle 0x5c68ea
dec eax
push eax
lea eax, [edi + 0x65]
add eax, ecx
push 0
push eax
call fcn.00612090
add esp, 0xc
test esi, esi
jle 0x5c6909
mov edx, ebp
lea ecx, [edi + 0x24]
mov ebx, esi
mov al, byte [ecx + 0x40]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
lea edx, [edx + 1]
mov byte [edx - 1], al
sub ebx, 1
jne 0x5c68f5
push esi
push ebp
push ebp
push dword [edi]
call fcn.004cd630
add esp, 0x10
pop ebx
test eax, eax
jg 0x5c692b
push esi
push ebp
call fcn.00401320
add esp, 8
xor eax, eax
pop ebp
pop edi
pop esi
ret
pop ebp
pop edi
mov eax, 1
pop esi
ret
pop edi
xor eax, eax
pop esi
ret
Function at 0x5cf620
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x14
call fcn.0060ff70
mov edx, dword [esp + 0x18]
xor eax, eax
push ebx
mov ebx, dword [esp + 0x34]
or ecx, 0xffffffff
push ebp
mov ebp, dword [esp + 0x34]
cmp ebp, 1
push esi
mov esi, dword [edx]
setne al
add eax, ebx
mov dword [esp + 0x1c], esi
cmp eax, esi
jbe 0x5cf659
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret
cmp ebp, 1
je 0x5cf724
mov ecx, dword [esp + 0x2c]
dec ecx
add ecx, esi
cmp dword [esp + 0x40], 0
mov dword [esp + 0x10], ecx
mov cl, byte [ecx]
mov byte [esp + 0xf], cl
movzx ebp, cl
je 0x5cf690
sub esi, ebp
mov eax, 1
sub esi, ebx
dec esi
mov dword [edx], esi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
lea ecx, [eax + ebp]
mov ebx, esi
sub ebx, ecx
mov eax, esi
xor ebx, ecx
xor eax, ecx
or ebx, eax
mov eax, 0x100
xor ebx, esi
shr ebx, 0x1f
dec ebx
cmp esi, eax
push edi
cmovb eax, esi
xor edi, edi
mov dword [esp + 0x18], eax
test eax, eax
je 0x5cf707
mov esi, dword [esp + 0x14]
mov edx, ebp
shr edx, 0x1f
mov dword [esp + 0x1c], edx
mov ecx, ebp
lea esi, [esi - 1]
sub ecx, edi
mov eax, edi
shr ecx, 0x1f
inc edi
shr eax, 0x1f
xor cl, al
xor al, dl
or cl, al
movzx eax, byte [esp + 0x13]
xor cl, dl
dec cl
movzx edx, cl
movzx ecx, byte [esi + 1]
xor ecx, eax
and edx, ecx
not edx
and ebx, edx
mov edx, dword [esp + 0x1c]
cmp edi, dword [esp + 0x18]
jb 0x5cf6c7
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x28]
not ebx
lea eax, [ebp + 1]
mov ebp, dword [esp + 0x3c]
movzx ecx, bl
mov ebx, dword [esp + 0x40]
dec ecx
shr ecx, 0x1f
neg ecx
and eax, ecx
sub esi, eax
mov dword [edx], esi
pop edi
push dword [esp + 0x44]
push ecx
push ebx
push ebp
push dword [esp + 0x44]
push dword [esp + 0x44]
push dword [esp + 0x44]
push dword [esp + 0x44]
push edx
call fcn.005cf310
add esp, 0x24
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x5cfbe0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x30
call fcn.0060ff70
mov eax, dword [0x6ed0a4]
xor eax, esp
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x38]
push ebx
push ebp
mov ebp, dword [esp + 0x44]
push esi
push edi
mov edi, dword [esp + 0x44]
mov dword [esp + 0x14], eax
mov eax, dword [edi + 0x30]
test eax, eax
je 0x5cfcf2
movups xmm0, xmmword [edi + 0x10]
mov ebx, dword [esp + 0x50]
lea esi, [edi + 0x10]
dec eax
mov dword [esp + 0x10], ebx
movups xmmword [esp + 0x2c], xmm0
and byte [esp + 0x38], 0x7f
lea ecx, [esp + 0x2c]
push 1
mov dword [edi + 0x30], eax
push ecx
psrldq xmm0, 8
movd eax, xmm0
push 0
push 0
and al, 0x7f
mov byte [esp + 0x44], al
mov eax, dword [edi + 0x20]
push 0
push eax
mov dword [esp + 0x30], eax
call fcn.0050b3e0
add esp, 0x18
test eax, eax
je 0x5cfcf2
push dword [esp + 0x10]
lea eax, [esp + 0x14]
push dword [esp + 0x18]
push eax
push ebp
push dword [esp + 0x28]
call fcn.0050be70
add esp, 0x14
test eax, eax
je 0x5cfcf2
push ebx
push ebp
lea eax, [esp + 0x24]
push eax
push edi
call fcn.005d0190
add esp, 0x10
test eax, eax
je 0x5cfcf2
lea eax, [esi + 0xf]
xor edx, edx
lea ecx, [esp + 0x1c]
cmp ecx, eax
ja 0x5cfcc3
lea eax, [esp + 0x2b]
cmp eax, esi
jb 0x5cfcc3
mov eax, ecx
sub esi, eax
lea ecx, [esp + 0x1c]
add ecx, edx
inc edx
mov al, byte [esi + ecx]
xor byte [ecx], al
cmp edx, 0x10
jl 0x5cfcb0
jmp 0x5cfcd4
movups xmm1, xmmword [esp + 0x1c]
movups xmm0, xmmword [esi]
pxor xmm1, xmm0
movups xmmword [esp + 0x1c], xmm1
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
or ecx, dword [esp + 0x24]
or eax, dword [esp + 0x28]
or ecx, eax
je 0x5cfd07
push ebx
push ebp
call fcn.00401320
add esp, 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.0060f4a4
add esp, 0x30
ret
mov ecx, dword [esp + 0x3c]
mov eax, ebx
mov dword [edi + 0x2c], 0
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0060f4a4
add esp, 0x30
ret
Function at 0x62a359
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0062a1cf

Function at 0x63894f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x10004781
Capabilities:
Contain obfuscated stackstrings
Initialize winsock library

Disassembly:
mov eax, 0x100148f8
call fcn.10014654
sub esp, 0x1bc
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x38], esi
lea ecx, [esi + 4]
call fcn.10004444
xor ebx, ebx
lea ecx, [esi + 0x2c]
mov dword [ebp - 4], ebx
call fcn.10004444
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 1
call fcn.10004444
lea ecx, [esi + 0x7c]
mov byte [ebp - 4], 2
call fcn.10004444
mov byte [ebp - 4], 3
mov dword [esi], 0x10003190
nop
nop
nop
lea eax, [ebp - 0x24]
mov byte [ebp - 0x34], 0x6b
push eax
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 0x33], 0x65
mov byte [ebp - 0x32], 0x72
mov byte [ebp - 0x31], 0x6e
mov byte [ebp - 0x30], 0x65
mov byte [ebp - 0x2f], 0x6c
mov byte [ebp - 0x2e], 0x33
mov byte [ebp - 0x2d], 0x32
mov byte [ebp - 0x2c], 0x2e
mov byte [ebp - 0x2b], 0x64
mov byte [ebp - 0x2a], 0x6c
mov byte [ebp - 0x29], 0x6c
mov byte [ebp - 0x28], bl
mov byte [ebp - 0x24], 0x43
mov byte [ebp - 0x23], 0x72
mov byte [ebp - 0x22], 0x65
mov byte [ebp - 0x21], 0x61
mov byte [ebp - 0x20], 0x74
mov byte [ebp - 0x1f], 0x65
mov byte [ebp - 0x1e], 0x45
mov byte [ebp - 0x1d], 0x76
mov byte [ebp - 0x1c], 0x65
mov byte [ebp - 0x1b], 0x6e
mov byte [ebp - 0x1a], 0x74
mov byte [ebp - 0x19], 0x41
mov byte [ebp - 0x18], bl
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
lea eax, [ebp - 0x1c8]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push ebx
push ebx
push 1
push ebx
call edi
or dword [esi + 0xa8], 0xffffffff
mov dword [esi + 0xac], eax
lea eax, [ebp - 0x14]
push 5
push eax
lea eax, [esi + 0xb0]
push eax
mov byte [esi + 0xb5], bl
mov byte [ebp - 0x14], 0x68
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x11], 0x70
mov byte [ebp - 0x10], 0x73
call sub.MSVCRT.dll_memcpy
mov ecx, dword [ebp - 0xc]
add esp, 0xc
mov eax, esi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10004970
Capabilities:
Connect socket
Contain obfuscated stackstrings
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
lea eax, [ebp - 0xc]
push edi
push eax
lea eax, [ebp - 0x28]
xor ebx, ebx
mov esi, ecx
push eax
mov byte [ebp - 0xc], 0x52
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x73
mov byte [ebp - 9], 0x65
mov byte [ebp - 8], 0x74
mov byte [ebp - 7], 0x45
mov byte [ebp - 6], 0x76
mov byte [ebp - 5], 0x65
mov byte [ebp - 4], 0x6e
mov byte [ebp - 3], 0x74
mov byte [ebp - 2], bl
mov byte [ebp - 0x28], 0x6b
mov byte [ebp - 0x27], 0x65
mov byte [ebp - 0x26], 0x72
mov byte [ebp - 0x25], 0x6e
mov byte [ebp - 0x24], 0x65
mov byte [ebp - 0x23], 0x6c
mov byte [ebp - 0x22], 0x33
mov byte [ebp - 0x21], 0x32
mov byte [ebp - 0x20], 0x2e
mov byte [ebp - 0x1f], 0x64
mov byte [ebp - 0x1e], 0x6c
mov byte [ebp - 0x1d], 0x6c
mov byte [ebp - 0x1c], bl
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, esi
mov edi, eax
call fcn.100050f7
push dword [esi + 0xac]
call edi
mov byte [esi + 0xb5], bl
mov eax, dword [0x100152e8]
cmp eax, ebx
je 0x10004a1e
cmp eax, 4
je 0x10004a1e
cmp eax, 5
jne 0x10004ab4
push 6
push 1
push 2
call fcn.1000470e
add esp, 0xc
cmp eax, 0xffffffff
mov dword [esi + 0xa8], eax
je 0x10004ab4
cmp dword [0x100152e8], ebx
je 0x10004a46
push 0x100152ec
jmp 0x10004a49
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov edi, eax
cmp edi, ebx
je 0x10004ab4
cmp dword [0x100152e8], ebx
mov word [ebp - 0x38], 2
je 0x10004a6c
mov ax, word [0x100013e0]
push eax
jmp 0x10004a6f
push dword [ebp + 0xc]
call fcn.10004776
mov word [ebp - 0x36], ax
mov eax, dword [edi + 0xc]
pop ecx
mov eax, dword [eax]
push 0x10
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x38]
push eax
push dword [esi + 0xa8]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x10004ab4
cmp dword [0x100152e8], 5
jne 0x10004ab8
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call fcn.10004b36
test al, al
jne 0x10004ab8
xor al, al
jmp 0x10004b2f
push 1
lea eax, [ebp - 1]
pop edi
mov byte [ebp - 1], 1
push edi
push eax
push 8
push 0xffff
push dword [esi + 0xa8]
call fcn.10004742
add esp, 0x14
test eax, eax
jne 0x10004b0d
push ebx
lea eax, [ebp - 1]
push ebx
push eax
push ebx
push ebx
lea eax, [ebp - 0x18]
push 0xc
push eax
push 0x98000004
push dword [esi + 0xa8]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], 0x2bf20
mov dword [ebp - 0x10], 0x1388
call dword [sym.imp.WS2_32.dll_WSAIoctl]
push edi
push ebx
push ebx
push esi
push 0x10004e57
push ebx
push ebx
mov byte [esi + 0xb5], 1
call fcn.1000db9c
mov dword [esi + 0xa4], eax
add esp, 0x1c
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x100050f7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and byte [ebp - 0x14], 0
and byte [ebp - 8], 0
push esi
lea eax, [ebp - 0x10]
push edi
push eax
lea eax, [ebp - 0x20]
mov esi, ecx
push eax
mov byte [ebp - 0x20], 0x6b
mov byte [ebp - 0x1f], 0x65
mov byte [ebp - 0x1e], 0x72
mov byte [ebp - 0x1d], 0x6e
mov byte [ebp - 0x1c], 0x65
mov byte [ebp - 0x1b], 0x6c
mov byte [ebp - 0x1a], 0x33
mov byte [ebp - 0x19], 0x32
mov byte [ebp - 0x18], 0x2e
mov byte [ebp - 0x17], 0x64
mov byte [ebp - 0x16], 0x6c
mov byte [ebp - 0x15], 0x6c
mov byte [ebp - 0x10], 0x53
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 0xd], 0x45
mov byte [ebp - 0xc], 0x76
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x6e
mov byte [ebp - 9], 0x74
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
and word [ebp - 2], 0
lea eax, [ebp - 4]
push 4
push eax
push 0x80
push 0xffff
mov word [ebp - 4], 1
push dword [esi + 0xa8]
call fcn.10004742
push dword [esi + 0xa8]
call fcn.10004737
add esp, 0x18
lea eax, [esi + 0xb5]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push dword [esi + 0xa8]
call fcn.10004721
pop ecx
push dword [esi + 0xac]
call edi
or dword [esi + 0xa8], 0xffffffff
pop edi
pop esi
leave
ret
Function at 0x10005315
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea eax, [ebp - 0x18]
push edi
push eax
lea eax, [ebp - 0x2c]
xor ebx, ebx
mov dword [ebp - 8], ecx
push eax
mov byte [ebp - 0x2c], 0x57
mov byte [ebp - 0x2b], 0x53
mov byte [ebp - 0x2a], 0x32
mov byte [ebp - 0x29], 0x5f
mov byte [ebp - 0x28], 0x33
mov byte [ebp - 0x27], 0x32
mov byte [ebp - 0x26], 0x2e
mov byte [ebp - 0x25], 0x64
mov byte [ebp - 0x24], 0x6c
mov byte [ebp - 0x23], 0x6c
mov byte [ebp - 0x22], bl
mov byte [ebp - 0x3c], 0x6b
mov byte [ebp - 0x3b], 0x65
mov byte [ebp - 0x3a], 0x72
mov byte [ebp - 0x39], 0x6e
mov byte [ebp - 0x38], 0x65
mov byte [ebp - 0x37], 0x6c
mov byte [ebp - 0x36], 0x33
mov byte [ebp - 0x35], 0x32
mov byte [ebp - 0x34], 0x2e
mov byte [ebp - 0x33], 0x64
mov byte [ebp - 0x32], 0x6c
mov byte [ebp - 0x31], 0x6c
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x18], 0x73
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x16], 0x6e
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x14], bl
mov byte [ebp - 0x20], 0x53
mov byte [ebp - 0x1f], 0x6c
mov byte [ebp - 0x1e], 0x65
mov byte [ebp - 0x1d], 0x65
mov byte [ebp - 0x1c], 0x70
mov byte [ebp - 0x1b], bl
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x3c]
push eax
call esi
push eax
call edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
cmp eax, edi
mov dword [ebp - 4], ebx
mov dword [ebp + 8], eax
jb 0x10005421
mov dword [ebp + 0x10], ebx
mov eax, dword [ebp - 8]
push ebx
push edi
push esi
push dword [eax + 0xa8]
call dword [ebp - 0xc]
cmp eax, ebx
jg 0x10005409
inc dword [ebp + 0x10]
cmp dword [ebp + 0x10], 0xf
jl 0x100053ed
cmp dword [ebp + 0x10], 0xf
je 0x10005453
add dword [ebp - 4], eax
push 0xa
add esi, edi
call dword [ebp - 0x10]
sub dword [ebp + 8], edi
cmp dword [ebp + 8], edi
jae 0x100053ea
cmp dword [ebp + 8], ebx
jle 0x1000544b
xor edi, edi
mov eax, dword [ebp - 8]
push ebx
push dword [ebp + 8]
push esi
push dword [eax + 0xa8]
call dword [ebp - 0xc]
cmp eax, ebx
jg 0x10005443
inc edi
cmp edi, 0xf
jl 0x10005428
cmp edi, 0xf
je 0x10005453
add dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
je 0x10005456
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x100056a0
Capabilities:
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100031b0
push 0x100146c2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 4], 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
pop ecx
mov edi, eax
mov dword [ebp - 0x24], edi
test edi, edi
je 0x100057e4
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, edi
mov dword [ebp - 0x1c], esi
cmp byte [edi], 0x5c
jne 0x10005748
lea eax, [edi + 1]
cmp byte [eax], 0x5c
jne 0x10005748
mov esi, eax
mov dword [ebp - 0x1c], esi
inc esi
mov dword [ebp - 0x1c], esi
mov al, byte [esi]
test al, al
je 0x10005723
cmp al, 0x5c
je 0x10005723
push esi
call dword [sym.imp.USER32.dll_CharNextA]
mov esi, eax
jmp 0x1000570b
cmp byte [esi], 0
je 0x1000572c
inc esi
mov dword [ebp - 0x1c], esi
mov al, byte [esi]
test al, al
je 0x10005741
cmp al, 0x5c
je 0x10005741
push esi
call dword [sym.imp.USER32.dll_CharNextA]
mov esi, eax
jmp 0x10005729
cmp byte [esi], 0
je 0x10005767
jmp 0x10005763
lea eax, [edi + 1]
cmp byte [eax], 0x3a
jne 0x10005767
mov esi, eax
mov dword [ebp - 0x1c], esi
inc esi
mov dword [ebp - 0x1c], esi
mov al, byte [esi]
test al, al
je 0x10005767
cmp al, 0x5c
jne 0x10005767
inc esi
mov dword [ebp - 0x1c], esi
or ebx, 0xffffffff
mov al, byte [esi]
test al, al
je 0x100057c4
cmp al, 0x5c
jne 0x100057b6
and byte [esi], 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x20], eax
cmp eax, ebx
jne 0x1000579f
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x100057b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jmp 0x100057a4
and eax, 0x10
cmp al, 0x10
je 0x100057b3
push edi
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
mov dword [ebp - 4], ebx
jmp 0x100057e8
mov byte [esi], 0x5c
push esi
call dword [sym.imp.USER32.dll_CharNextA]
mov esi, eax
mov dword [ebp - 0x1c], esi
jmp 0x1000576a
mov dword [ebp - 4], ebx
push edi
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
mov al, 1
jmp 0x100057ea
or dword [ebp - 4], 0xffffffff
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x100057fb
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x368
push ebx
push esi
push edi
mov esi, 0x104
xor edi, edi
push esi
lea eax, [ebp - 0x174]
push edi
push eax
mov dword [ebp - 8], esi
call sub.MSVCRT.dll_memset
push 0x2e
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 0x14
cmp eax, edi
je 0x100058c1
lea ecx, [ebp - 4]
push ecx
push 0xf003f
push edi
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100058c1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x174]
push eax
push edi
push dword [ebp - 4]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
call edi
push dword [ebp - 4]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebx
push 0x1f4
lea eax, [ebp - 0x368]
push 0
push eax
call sub.MSVCRT.dll_memset
lea eax, [ebp - 0x174]
push eax
lea eax, [ebp - 0x368]
push 0x10001404
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
lea eax, [ebp - 4]
push eax
push 0xf003f
lea eax, [ebp - 0x368]
push 0
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x100058c8
xor al, al
jmp 0x100059a7
push esi
lea eax, [ebp - 0x174]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
xor esi, esi
push eax
lea eax, [ebp - 0x174]
push eax
push esi
push dword [ebp - 4]
call edi
push dword [ebp - 4]
call ebx
mov edi, dword [sym.imp.MSVCRT.dll_strstr]
lea eax, [ebp - 0x174]
push 0x10001400
push eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
pop ecx
cmp eax, esi
pop ecx
jne 0x10005945
lea eax, [ebp - 0x174]
push 0x100013fc
push eax
call edi
pop ecx
cmp eax, esi
pop ecx
jne 0x10005945
lea eax, [ebp - 0x174]
push 0x100013f8
push eax
call ebx
push dword [ebp + 8]
lea eax, [ebp - 0x174]
push eax
call ebx
jmp 0x1000594f
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x10
xor eax, eax
cmp dword [ebp + 0xc], esi
pop ecx
lea edi, [ebp - 0x6c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x70], 0x44
je 0x1000598b
mov esi, 0x100013ec
lea edi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [ebp - 0x12]
push 0x100013e4
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x1c]
push eax
call ebx
lea eax, [ebp - 0x1c]
xor esi, esi
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x70]
push eax
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x174]
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
pop esi
pop ebx
leave
ret 8