joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40bf63
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40c000
push ebx
push esi
call fcn.0040bf2c
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040bec0
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40bfad
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40bfff
push edi
push eax
call fcn.0040cb80
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40bfcd
call fcn.0040aa21
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40bffe
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040bec0
add esp, 0x20
test eax, eax
jne 0x40bfec
push edi
call fcn.0040aa21
jmp 0x40bff4
push ebx
call fcn.0040aa21
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x40d2fd
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x43cc08
push 0x43cc00
push str.FlsAlloc
push 0x1f
call fcn.0040d1bc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d331
push dword [ebp + 8]
mov ecx, esi
call dword [0x416174]
call esi
jmp 0x40d337
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40d37b
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x43cc18
push 0x43cc10
push str.FlsGetValue
push 0x21
call fcn.0040d1bc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d3b2
push dword [ebp + 8]
mov ecx, esi
call dword [0x416174]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40d3ba
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x43cc20
push 0x43cc18
push str.FlsSetValue
push 0x22
call fcn.0040d1bc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d3f4
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x416174]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.00408518
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.00408518
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.00408518
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.00408518
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.00408518
mov dword [0x41203c], eax
call fcn.00408518
test eax, eax
jge 0x402550
push 8
call fcn.00408518
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.00408518
pop ecx
push 1
call fcn.00408518
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.00408518
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.00408518
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.00408518
jmp 0x402495
Function at 0x49604f
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x495ffb
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x496019
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x496077
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
add byte [eax], al
invalid
invalid
add byte [eax], al
add byte [eax + 0x3b184d8b], al
sal dword [esp + eax - 0x80], cl
or al, 8
add dword [ecx], edi
pop ebp
or byte [esp + eax - 0x80], dh
or al, 8
add bh, byte [ecx]
pop ebp
adc byte [ebp + eax + 3], dh
enter 0x980, 4
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x49605e
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x496067
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x496071
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x496053
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x495fdd
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x4960c4
dec eax
je 0x4960bb
sub eax, 3
je 0x4960b2
mov dword [ebp - 4], 0x40
jmp 0x4960e1
mov dword [ebp - 4], 4
jmp 0x4960c7
mov dword [ebp - 4], 0x20
jmp 0x4960c7
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x496113
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x496093
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00495924
movsb byte es:[edi], byte [esi]
cmp eax, 0x75ffacba
mov edx, 0x1475ffac
push 1
push esi
call edi
mov eax, esi
jmp 0x49611f
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x496146
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [esi - 0x25000004], ebp
and byte [ebp - 0x351], 0
mov byte [ebp - 0x350], 0x62
mov byte [ebp - 0x34f], 0x40
mov byte [ebp - 0x34e], 0x51
mov byte [ebp - 0x34d], 0x75
mov byte [ebp - 0x34c], 0x57
mov byte [ebp - 0x34b], 0x4a
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.00495934
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004958e9
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.00495934
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004958e9
add esp, 0xc
invalid

Function at 0x498064
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push 0x44
push 0
mov ebx, 0x4d3008
push ebx
call fcn.004222d0
push 0x10
push 0
mov esi, 0x4d304c
push esi
call fcn.004222d0
add esp, 0x18
mov dword [0x4d3008], 0x44
xor eax, eax
inc eax
mov dword [0x4d3034], eax
push esi
push ebx
mov word [0x4d3038], ax
xor eax, eax
push eax
push eax
push 0x20
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
pop esi
pop ebx
test eax, eax
je 0x4980c9
push dword [0x4d304c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
ret 4
Function at 0x4980cd
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
push 3
pop esi
mov edx, dword [edi + 4]
mov dword [ebp + 8], edx
cmp dword [edi + 0x190], ebx
je 0x49817f
mov ebx, esi
cmp dword [0x4d1934], esi
jl 0x498176
mov eax, dword [0x4d1924]
mov eax, dword [eax + ebx*4]
mov ecx, dword [eax]
test ecx, ecx
je 0x49816d
cmp dword [ecx + 4], edx
jne 0x49816d
mov dl, byte [ecx + 0x90]
cmp dl, 0xb
je 0x49816a
mov dh, byte [ecx + 0x93]
movzx eax, dh
cmp eax, dword [edi + 0x190]
je 0x49813a
cmp byte [edi + 0x198], 0
je 0x49816a
cmp dh, 0xff
je 0x49816a
cmp dl, 0xa
je 0x49816a
push 0
push dword [ecx]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x4d1924]
mov eax, dword [eax + ebx*4]
mov eax, dword [eax]
test byte [eax + 0x92], 0x40
je 0x49816a
cmp byte [eax + 0x90], 0x1a
jne 0x49816a
push 0
push dword [eax]
call dword [sym.imp.USER32.dll_EnableWindow]
mov edx, dword [ebp + 8]
inc ebx
cmp ebx, dword [0x4d1934]
jle 0x4980f8
mov ebx, dword [ebp + 0xc]
mov dword [edi + 0x190], ebx
cmp dword [0x4d1934], esi
jl 0x498213
mov eax, dword [0x4d1924]
mov eax, dword [eax + esi*4]
mov ecx, dword [eax]
test ecx, ecx
je 0x498203
cmp dword [ecx + 4], edx
jne 0x498203
cmp byte [ecx + 0x90], 0xb
je 0x498203
movzx eax, byte [ecx + 0x93]
cmp eax, dword [edi + 0x190]
jne 0x498203
test byte [ecx + 0x92], 0x20
jne 0x498203
push 0
push dword [ecx]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x4d1924]
push 4
mov eax, dword [eax + esi*4]
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x4d1924]
mov eax, dword [eax + esi*4]
mov eax, dword [eax]
test byte [eax + 0x92], 0x40
je 0x498203
cmp byte [eax + 0x90], 0x1a
jne 0x498203
push 1
push dword [eax]
call dword [sym.imp.USER32.dll_EnableWindow]
mov edx, dword [ebp + 8]
inc esi
cmp esi, dword [0x4d1934]
jle 0x49818b
push 0
push ebx
push 0x130c
push dword [edi + 0x188]
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x10001000
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebx
push esi
push edi
mov edi, 0x104
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
push edi
push 0
push esi
call sub.MSVCRT.dll_memset
add esp, 0x10
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push str.Zone.ini
push esi
call sub.MSVCRT.dll_strcat
pop ecx
mov edi, 0x1008ff68
pop ecx
push esi
push 0x20
push edi
push 0x10008554
push str.Name
push str.World
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push esi
call fcn.10005c00
mov ebx, 0x1008ff28
push edi
push ebx
call sub.MSVCRT.dll_strcpy
add esp, 0xc
xor esi, esi
lea eax, [esi + 0x10008020]
push edi
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
jne 0x10001088
lea eax, [esi + 0x100082b0]
push eax
push ebx
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
add esi, 0x10
cmp esi, 0x290
jl 0x10001066
pop edi
pop esi
pop ebx
ret
Function at 0x10001ad3
Capabilities:
Parse pe header

Disassembly:
mov edx, dword [esp + 4]
xor eax, eax
test edx, edx
je 0x10001af4
cmp word [edx], 0x5a4d
jne 0x10001af4
mov ecx, dword [edx + 0x3c]
add ecx, edx
cmp dword [ecx], 0x4550
jne 0x10001af4
mov eax, dword [ecx + 0x50]
ret 4
Function at 0x10002828
Capabilities:
Delete file

Disassembly:
mov eax, 0x10005e90
call fcn.10005c40
sub esp, 0x164
push ebx
push esi
push edi
push 1
pop edi
xor ebx, ebx
lea eax, [ebp - 0x3c]
push ebx
push eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
call sub.gdiplus.dll_GdiplusStartup
push dword [ebp + 8]
lea eax, [ebp - 0x170]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
lea eax, [ebp - 0x170]
pop ecx
push 0x100085f0
push eax
call sub.MSVCRT.dll_strlen
pop ecx
lea ecx, [ebp - 0x170]
sub ecx, 3
add eax, ecx
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
pop ecx
push ebx
push ebx
push 0xffffffffffffffff
push dword [ebp + 8]
push ebx
push ebx
call esi
mov dword [ebp - 0x10], eax
lea eax, [eax + eax + 2]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x14], eax
push dword [ebp - 0x10]
push eax
push 0xffffffffffffffff
push dword [ebp + 8]
push ebx
push ebx
call esi
push ebx
push ebx
lea eax, [ebp - 0x170]
push 0xffffffffffffffff
push eax
push ebx
push ebx
call esi
mov dword [ebp - 0x10], eax
lea eax, [eax + eax + 2]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x18], eax
push dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x170]
push 0xffffffffffffffff
push eax
push ebx
push ebx
call esi
lea eax, [ebp - 0x24]
mov dword [ebp - 0x28], 0x10006210
mov dword [ebp - 0x24], ebx
push eax
push dword [ebp - 0x14]
call sub.gdiplus.dll_GdipLoadImageFromFile
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x6c]
mov dword [ebp - 4], ebx
push eax
push str.image_jpeg
call fcn.1000299b
mov dword [ebp - 0x5c], edi
mov esi, 0x10006218
lea edi, [ebp - 0x58]
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop ecx
lea eax, [ebp + 0xc]
movsd dword es:[edi], dword [esi]
push 1
mov dword [ebp - 0x40], eax
pop esi
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x6c]
push eax
mov dword [ebp - 0x44], 4
push dword [ebp - 0x18]
mov dword [ebp - 0x48], esi
push dword [ebp - 0x24]
call sub.gdiplus.dll_GdipSaveImageToFile
cmp eax, ebx
je 0x10002958
mov dword [ebp - 0x20], eax
push dword [ebp - 0x14]
call fcn.10005c00
push dword [ebp - 0x18]
call fcn.10005c00
pop ecx
mov dword [ebp - 0x28], 0x10006210
pop ecx
push dword [ebp - 0x24]
call sub.gdiplus.dll_GdipDisposeImage
push dword [ebp - 0x2c]
call sub.gdiplus.dll_GdiplusShutdown
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x100030b7
Capabilities:
Create thread

Disassembly:
push ebx
push esi
xor esi, esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
push esi
push esi
push esi
push 0x10002fa8
push esi
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call ebx
push esi
push esi
push esi
push 0x1000305f
push esi
push esi
call edi
push eax
call ebx
push 1
pop eax
pop edi
pop esi
pop ebx
ret
Function at 0x10003254
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
lea eax, [ebp - 0x190]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x10003291
cmp byte [ebp - 0x190], 2
jne 0x1000328b
mov al, byte [ebp - 0x18f]
cmp al, 2
jne 0x1000328b
push 1
pop eax
leave
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
leave
ret

Function at 0x1000334b
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x10003392
mov ecx, dword [eax + 0xc]
mov ecx, dword [ecx]
test ecx, ecx
je 0x10003392
movsx eax, word [eax + 0xa]
push eax
lea eax, [ebp - 0xc]
push ecx
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push dword [ebp - 0xc]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
push dword [ebp + 0xc]
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
push 1
pop eax
leave
ret
xor eax, eax
leave
ret

Function at 0x10003396
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100033b4
xor eax, eax
jmp 0x100033f3
push dword [ebp + 8]
mov word [ebp - 0x10], 2
call dword [sym.imp.WS2_32.dll_inet_addr]
push dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0xe], ax
lea eax, [ebp - 0x10]
push 0x10
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x100033f1
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
jmp 0x100033f3
mov eax, esi
pop esi
leave
ret
Function at 0x1000362c
Capabilities:
Create thread

Disassembly:
push esi
xor esi, esi
cmp dword [0x1008f900], esi
jne 0x10003661
push edi
push esi
push esi
push esi
push 0x10003996
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [esp + 0xc], esi
mov edi, eax
je 0x10003659
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
ret 4
Function at 0x10003df3
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x10003d8c
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
ret
Function at 0x100043a5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov ecx, dword [eax]
mov ebx, dword [eax + 4]
jle 0x100043f5
push esi
inc cl
movzx ecx, cl
mov edx, dword [eax + ecx*4 + 8]
mov dword [ebp + 8], ecx
lea esi, [eax + ecx*4 + 8]
mov cl, dl
add cl, bl
movzx ebx, cl
mov ecx, dword [eax + ebx*4 + 8]
mov dword [esi], ecx
mov esi, dword [ebp + 0xc]
add cl, dl
mov dword [eax + ebx*4 + 8], edx
movzx ecx, cl
add esi, edi
mov cl, byte [eax + ecx*4 + 8]
xor byte [esi], cl
mov ecx, dword [ebp + 8]
inc edi
cmp edi, dword [ebp + 0x10]
jl 0x100043ba
pop esi
mov dword [eax + 4], ebx
pop edi
mov dword [eax], ecx
pop ebx
pop ebp
ret 0xc
Function at 0x10004b29
Capabilities:
Get common file path

Disassembly:
push ebx
push ebp
push esi
mov esi, 0x104
push edi
push esi
push 0x1008fb0c
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push esi
push 0x1008fa08
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x1008f904
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ebx, 0x1008fc10
push esi
push ebx
push 0
call edi
mov eax, dword [0x1008ff1c]
mov ebp, dword [sym.imp.MSVCRT.dll__strlwr]
test eax, eax
je 0x10004b84
push esi
mov esi, 0x1008fe18
push esi
push eax
call edi
push esi
call ebp
pop ecx
push ebx
call ebp
push ebx
call fcn.10004ba0
push eax
push 0x1008fd14
call sub.MSVCRT.dll_strcpy
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x10004d12
Capabilities:
Set file attributes

Disassembly:
push 6
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret

Function at 0x10004da4
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov dword [ecx], 0x67452301
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x58], eax
ret

Function at 0x10005875
Capabilities:
Accept command line arguments
Delete file
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov esi, str.ServerMain
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea ecx, [ebp - 0xc]
push ecx
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
mov esi, eax
pop ecx
test esi, esi
pop ecx
je 0x100058bd
add esi, 0xb
push 0
push esi
call dword [sym.imp.MSVCRT.dll__access]
pop ecx
cmp eax, 0xffffffff
pop ecx
je 0x100058bd
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x100058a4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x100058c7
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
and byte [ebp - 0x104], 0
push edi
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x104]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push dword [ebp + 0xc]
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x208]
push str._s_s
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp + 8]
pop edi
mov dword [ecx], eax
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
leave
ret 8
Function at 0x10005939
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and byte [ebp - 0x10], 0
push edi
xor eax, eax
lea edi, [ebp - 0xf]
stosd dword es:[edi], eax
push dword [ebp + 8]
stosd dword es:[edi], eax
push dword [ebp + 0xc]
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
pop edi
jne 0x10005988
mov eax, dword [ebp + 8]
shr eax, 0x10
test ax, ax
jne 0x10005980
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push 0x10008574
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0xfffffffffffffffe
call dword [sym.imp.KERNEL32.dll_ExitProcess]
leave
ret 8
Function at 0x427b43
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x427b52
pop dword [ebp - 0x44]
mov eax, 0x580f3fba
sub eax, 0x57ccc468
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xc327f818
sub dword [ebp - 0x54], 0x74d5b2cd
mov dword [ebp - 0x50], 0x7c87a852
sub dword [ebp - 0x50], 0x4a545c0d
mov dword [ebp - 0x4c], 0x5f0738bc
sub dword [ebp - 0x4c], 0x12baf48e
mov dword [ebp - 0x48], 0x86bcae9b
sub dword [ebp - 0x48], 0x86bcae9b
lea eax, [ebp - 0x54]
push eax
mov eax, 0x8e0abb35
sub eax, 0x8dc50ad1
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x1b37503b
sub dword [ebp - 0x54], 0xa6c4e6e5
mov dword [ebp - 0x50], 0x5ed70af4
add dword [ebp - 0x50], 0xe2955681
mov dword [ebp - 0x4c], 0x650bcfe2
add dword [ebp - 0x4c], 0xfe639c8a
mov dword [ebp - 0x48], 0x2a2b589a
add dword [ebp - 0x48], 0xd5d4a766
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x53e92b3d
add eax, 0xac5c8543
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x51cd2
push 0
call eax
mov ecx, 0x2414ae6e
add ecx, 0xdbebaaf4
mov edx, eax
mov edi, 0x472c589d
add edi, 0xb91b0763
add edi, dword [ebp - 0x44]
mov esi, 0x1a206b72
add esi, 0xcbfbc5d2
mov ebx, dword [edi]
xor dword [ebp - 0x24], ecx
add ebx, esi
add dword [ebp - 0x24], esi
mov dword [edx], ebx
xor dword [ebp - 0x14], 0x105fad19
add edx, 4
add edi, 0x6f28ea82
sub edi, 0x6f28ea7e
loop 0x427c74
add eax, 0xae4bb2c8
add eax, 0x51b5a593
mov ebx, eax
add eax, 0x5f21a20
sub eax, 0x5f21a1b
mov ecx, 0x400000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret