joyce8/EMBER2024-capa huggingface dataset:
Function at 0x546e8a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp + 0x10]
mov dword [0x6c4f70], eax
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x20]
call fcn.00546fd6
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x20]
call fcn.005470e8
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x20]
call fcn.005471ab
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x20]
call fcn.0054727b
mov ecx, dword [ebp - 0x20]
call fcn.00546624
push 0
push dword [ebp + 0x14]
push dword [ebp + 8]
mov ecx, dword [ebp - 0x20]
call fcn.00546762
push 0
push dword [ebp + 0x14]
push dword [ebp + 8]
mov ecx, dword [ebp - 0x20]
call fcn.00546922
push 0
push dword [ebp + 0x14]
push dword [ebp + 8]
mov ecx, dword [ebp - 0x20]
call fcn.00546a0a
push 0
push dword [ebp + 0x14]
push dword [ebp + 8]
mov ecx, dword [ebp - 0x20]
call fcn.00546d17
mov eax, dword [ebp - 8]
xor edx, edx
div dword [ebp + 0xc]
mov dword [ebp - 4], edx
and dword [ebp - 0xc], 0
cmp dword [ebp - 4], 0
je 0x546f8f
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
call fcn.00565bb9
pop ecx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
push dword [ebp - 0xc]
push 0x58
push dword [ebp - 0x14]
call fcn.0058ee10
add esp, 0xc
and dword [ebp - 0x10], 0
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x14]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x6c4f6c
push dword [ebp - 0x10]
mov ecx, dword [ebp + 0x14]
call fcn.004f24ac
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x1c]
call fcn.00565be4
pop ecx
mov al, 1
leave
ret 0x10
Function at 0x55002e
Capabilities:
Encrypt data using twofish

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
and dword [ebp - 4], 0
jmp 0x550041
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x100
jge 0x550201
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x6be890]
mov byte [ebp - 0xc], al
movzx eax, byte [ebp - 0xc]
movzx ecx, byte [ebp - 0xc]
sar ecx, 2
movzx edx, byte [ebp - 0xc]
and edx, 2
neg edx
sbb edx, edx
and edx, 0xb4
xor ecx, edx
movzx edx, byte [ebp - 0xc]
and edx, 1
neg edx
sbb edx, edx
and edx, 0x5a
xor ecx, edx
xor eax, ecx
mov byte [ebp - 8], al
movzx eax, byte [ebp - 0xc]
movzx ecx, byte [ebp - 0xc]
sar ecx, 1
movzx edx, byte [ebp - 0xc]
and edx, 1
neg edx
sbb edx, edx
and edx, 0xb4
xor ecx, edx
xor eax, ecx
movzx ecx, byte [ebp - 0xc]
sar ecx, 2
movzx edx, byte [ebp - 0xc]
and edx, 2
neg edx
sbb edx, edx
and edx, 0xb4
xor ecx, edx
movzx edx, byte [ebp - 0xc]
and edx, 1
neg edx
sbb edx, edx
and edx, 0x5a
xor ecx, edx
xor eax, ecx
mov byte [ebp - 0x14], al
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x6be990]
mov byte [ebp - 0xb], al
movzx eax, byte [ebp - 0xb]
movzx ecx, byte [ebp - 0xb]
sar ecx, 2
movzx edx, byte [ebp - 0xb]
and edx, 2
neg edx
sbb edx, edx
and edx, 0xb4
xor ecx, edx
movzx edx, byte [ebp - 0xb]
and edx, 1
neg edx
sbb edx, edx
and edx, 0x5a
xor ecx, edx
xor eax, ecx
mov byte [ebp - 7], al
movzx eax, byte [ebp - 0xb]
movzx ecx, byte [ebp - 0xb]
sar ecx, 1
movzx edx, byte [ebp - 0xb]
and edx, 1
neg edx
sbb edx, edx
and edx, 0xb4
xor ecx, edx
xor eax, ecx
movzx ecx, byte [ebp - 0xb]
sar ecx, 2
movzx edx, byte [ebp - 0xb]
and edx, 2
neg edx
sbb edx, edx
and edx, 0xb4
xor ecx, edx
movzx edx, byte [ebp - 0xb]
and edx, 1
neg edx
sbb edx, edx
and edx, 0x5a
xor ecx, edx
xor eax, ecx
mov byte [ebp - 0x13], al
mov al, byte [ebp - 0xb]
mov byte [ebp - 0x10], al
mov al, byte [ebp - 7]
mov byte [ebp - 0xf], al
mov al, byte [ebp - 0x13]
mov byte [ebp - 0xe], al
mov al, byte [ebp - 0x13]
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
mov dword [eax*4 + 0x6c4f78], ecx
mov al, byte [ebp - 0x14]
mov byte [ebp - 0x10], al
mov al, byte [ebp - 0x14]
mov byte [ebp - 0xf], al
mov al, byte [ebp - 8]
mov byte [ebp - 0xe], al
mov al, byte [ebp - 0xc]
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
mov dword [eax*4 + 0x6c5378], ecx
mov al, byte [ebp - 7]
mov byte [ebp - 0x10], al
mov al, byte [ebp - 0x13]
mov byte [ebp - 0xf], al
mov al, byte [ebp - 0xb]
mov byte [ebp - 0xe], al
mov al, byte [ebp - 0x13]
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
mov dword [eax*4 + 0x6c5778], ecx
mov al, byte [ebp - 8]
mov byte [ebp - 0x10], al
mov al, byte [ebp - 0xc]
mov byte [ebp - 0xf], al
mov al, byte [ebp - 0x14]
mov byte [ebp - 0xe], al
mov al, byte [ebp - 8]
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
mov dword [eax*4 + 0x6c5b78], ecx
jmp 0x55003a
and dword [0x6bea90], 0
leave
ret
Function at 0x555443
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 4], 0
mov eax, dword [ebp + 8]
and dword [eax], 0
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0xefcdab89
mov eax, dword [ebp + 8]
mov dword [eax + 0x10], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0x10325476
mov eax, dword [ebp + 8]
mov dword [eax + 0x18], 0xc3d2e1f0
pop ebp
ret
Function at 0x55b4f2
Capabilities:
Read file on windows

Disassembly:
push 0xc
mov eax, 0x5afab1
call fcn.00595e20
mov edi, ecx
mov dword [ebp - 0x18], edi
xor ebx, ebx
cmp dword [ebp + 8], ebx
jne 0x55b51b
push ebx
push ebx
push ebx
push 2
call fcn.0055c3f5
xor al, al
jmp 0x55b67e
call fcn.0055aaf7
or dword [edi + 8], 0xffffffff
or dword [edi + 4], 0xffffffff
push 2
push ebx
push dword [ebp + 8]
call fcn.0058fe44
push dword [ebp + 8]
call fcn.00595aea
push ebx
push ebx
push dword [ebp + 8]
mov esi, eax
call fcn.0058fe44
add esp, 0x1c
cmp esi, ebx
jg 0x55b557
push ebx
push ebx
push ebx
push 0xd
mov ecx, edi
jmp 0x55b50f
mov edi, 0x6c6868
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], ebx
push esi
lea ecx, [ebp - 0x10]
call fcn.0055a895
lea eax, [esi + 1]
push eax
call fcn.00565bb9
push dword [ebp + 8]
mov dword [ebp - 0x14], eax
push 1
push esi
push eax
mov byte [eax], bl
call fcn.00595e05
add esp, 0x14
cmp eax, 1
je 0x55b5be
push dword [ebp - 0x14]
call fcn.00565be4
pop ecx
mov ecx, dword [ebp - 0x18]
push ebx
push ebx
push ebx
push 2
call fcn.0055c3f5
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10], edi
je 0x55b514
push dword [ebp - 0x10]
call fcn.00565be4
pop ecx
jmp 0x55b514
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov byte [ecx + esi], bl
cmp byte [ecx], bl
mov edi, eax
je 0x55b625
mov cl, byte [edi]
cmp cl, 0xa
jne 0x55b5e5
mov ecx, edi
sub ecx, eax
inc ecx
push ecx
push eax
lea ecx, [ebp - 0x10]
call fcn.0055a988
inc edi
jmp 0x55b61c
cmp cl, 0xd
jne 0x55b620
mov ecx, edi
sub ecx, eax
cmp ecx, ebx
jle 0x55b5fc
push ecx
push eax
lea ecx, [ebp - 0x10]
call fcn.0055a988
push 1
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp + 8], 0xa
call fcn.0055a988
lea eax, [edi + 1]
cmp byte [eax], 0xa
jne 0x55b61a
inc edi
inc edi
jmp 0x55b61c
mov edi, eax
mov eax, edi
jmp 0x55b621
inc edi
cmp byte [edi], bl
jne 0x55b5cc
sub edi, eax
je 0x55b633
push edi
push eax
lea ecx, [ebp - 0x10]
call fcn.0055a988
push dword [ebp - 0x14]
call fcn.00565be4
mov esi, dword [ebp - 0x18]
mov eax, dword [esi]
pop ecx
push dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
add ecx, 8
push ebx
push ecx
mov ecx, esi
call dword [eax + 8]
cmp byte [esi + 0x2c], bl
je 0x55b666
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10], 0x6c6868
jmp 0x55b5aa
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10], 0x6c6868
je 0x55b67c
push dword [ebp - 0x10]
call fcn.00565be4
pop ecx
mov al, 1
call fcn.00595ef8
ret 8

Function at 0x55d750
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5afd70
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x6c0bc0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esp + 0x14], 0
lea eax, [esp + 0x1c]
push eax
call fcn.0055d6e0
mov byte [esp + 0x14], 1
mov ecx, dword [esp + 0x4c]
mov dword [esi + 0x30], ecx
mov dword [esp + 0x14], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.004102b9
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x34
Function at 0x55fbe0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5b06b8
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push esi
mov eax, dword [0x6c0bc0]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x74]
push eax
lea ecx, [esp + 0xc]
call fcn.0055d570
mov dword [esp + 0x40], 0
add esi, 0x20
mov ecx, esi
call fcn.0055d550
push eax
lea ecx, [esp + 0xc]
call fcn.0055d5f0
push 1
mov ecx, esi
call fcn.0055dc80
cmp dword [esp + 0x30], 3
lea ecx, [esp + 8]
je 0x55fc59
call fcn.00562ef0
neg eax
push str.unary__
push eax
mov ecx, esi
call fcn.0055d870
jmp 0x55fc71
call fcn.00563100
fmul qword [0x63cf60]
sub esp, 8
mov ecx, esi
fstp qword [esp]
call fcn.0055d910
mov dword [esp + 0x40], 0xffffffff
lea ecx, [esp + 8]
call fcn.004102b9
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x3c
ret

Function at 0x5609f0
Capabilities:
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x5b0430
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6c0bc0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov dword [esp + 0x1c], ecx
mov ebx, dword [esp + 0x34]
mov eax, dword [ebx + 0x28]
cmp eax, 3
mov ecx, dword [esp + 0x30]
mov byte [esp + 0x14], 0
lea edi, [ecx + 0x18]
ja case.default.0x560a37
jmp dword [eax*4 + 0x560b48]
call fcn.005631e0
mov ecx, ebx
mov byte [esp + 0x34], al
call fcn.005631e0
mov cl, byte [esp + 0x34]
cmp al, cl
sete al
mov byte [esp + 0x14], al
jmp case.default.0x560a37
xor esi, esi
cmp dword [edi], esi
jbe case.default.0x560a37
lea ebx, [ebx]
push esi
mov ecx, edi
call fcn.0055fd60
mov ecx, ebx
mov ebp, eax
call fcn.00562ef0
cmp ebp, eax
jne 0x560a8a
mov byte [esp + 0x14], 1
add esi, 1
cmp esi, dword [edi]
jb 0x560a70
jmp case.default.0x560a37
xor ebp, ebp
cmp dword [edi], ebp
jbe case.default.0x560a37
jmp 0x560aa6
mov ebx, dword [esp + 0x34]
lea ecx, [esp + 0x18]
push ecx
mov ecx, ebx
call fcn.00562fc0
mov esi, eax
mov dword [esp + 0x28], 0
push ebp
lea edx, [esp + 0x34]
push edx
mov ecx, edi
call fcn.0055fca0
mov byte [esp + 0x28], 1
push esi
push eax
call fcn.0055e080
add esp, 8
mov bl, al
mov byte [esp + 0x28], 0
mov eax, dword [esp + 0x30]
cmp eax, 0x6c6868
je 0x560af3
push eax
call fcn.00565be4
add esp, 4
mov dword [esp + 0x28], 0xffffffff
mov eax, dword [esp + 0x18]
cmp eax, 0x6c6868
je 0x560b0f
push eax
call fcn.00565be4
add esp, 4
test bl, bl
je 0x560b18
mov byte [esp + 0x14], 1
add ebp, 1
cmp ebp, dword [edi]
jb 0x560aa2
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
push eax
add ecx, 0x20
call fcn.0055da50
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 8
Function at 0x5671ff
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.0056eb95
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x567236
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.00566e21
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x56728e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test ebx, 0xffff0000
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
jne 0x5672ae
cmp dword [edi + 0x54], 0
jne 0x5672ae
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.0056eb95
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [esp + 0x18]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.00567255
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
ret 8

Function at 0x56b46b
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x56b4a4
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00472e83
push eax
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00411b03
pop esi
ret 4
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
pop esi
jmp dword [eax + 0x8c]

Function at 0x56d1a3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x56d1e6
call fcn.0056eb95
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x56d1e6
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x56d201
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.0056cd5a
test ebx, ebx
mov esi, eax
je 0x56d1ff
test edi, edi
je 0x56d1ff
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x588be7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
je 0x588c2d
call fcn.0056eb95
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x588c2d
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x588c70
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
je 0x588c59
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x588c59
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x588c6d
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x58cc82
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6c0bc0]
jne 0x58cc8c
repz ret
jmp fcn.00596d65
Function at 0x5a56a1
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0059755b
xor ebx, ebx
cmp dword [0x6c9164], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x5a5776
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x5a56e1
xor eax, eax
jmp 0x5a583a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x61a448
push edi
call esi
cmp eax, ebx
je 0x5a56da
push eax
call fcn.005974f8
mov dword [esp], 0x61a438
push edi
mov dword [0x6c9164], eax
call esi
push eax
call fcn.005974f8
mov dword [esp], 0x61a424
push edi
mov dword [0x6c9168], eax
call esi
push eax
call fcn.005974f8
mov dword [0x6c916c], eax
lea eax, [ebp - 8]
push eax
call fcn.0058d808
test eax, eax
pop ecx
pop ecx
je 0x5a5744
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0059152d
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x5a5776
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.005974f8
cmp eax, ebx
pop ecx
mov dword [0x6c9174], eax
je 0x5a5776
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.005974f8
pop ecx
mov dword [0x6c9170], eax
mov eax, dword [0x6c9170]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x5a57ef
cmp dword [0x6c9174], esi
je 0x5a57ef
push eax
call fcn.00597564
pop ecx
call eax
cmp eax, ebx
je 0x5a57bc
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x6c9174]
call fcn.00597564
pop ecx
call eax
test eax, eax
je 0x5a57bc
test byte [ebp - 0x18], 1
jne 0x5a57ef
lea eax, [ebp - 0xc]
push eax
call fcn.0058d83f
test eax, eax
pop ecx
je 0x5a57d7
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0059152d
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x5a57e6
or dword [ebp + 0x10], 0x200000
jmp 0x5a5820
or dword [ebp + 0x10], 0x40000
jmp 0x5a5820
mov eax, dword [0x6c9168]
cmp eax, esi
je 0x5a5820
push eax
call fcn.00597564
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x5a5820
mov eax, dword [0x6c916c]
cmp eax, esi
je 0x5a5820
push dword [ebp - 4]
push eax
call fcn.00597564
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x6c9164]
call fcn.00597564
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5a9985
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x6c0bc0]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.005a991a
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.0058ee10
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x5a99d4
cmp dword [ebp - 0x1c], 5
jb 0x5a99ec
jmp 0x5a99e8
cmp dword [ebp - 0x10], 1
jne 0x5a99ec
cmp dword [ebp - 0x1c], 4
ja 0x5a99e8
jne 0x5a99ec
cmp dword [ebp - 0x18], 0
jbe 0x5a99ec
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x61ad0c
call fcn.005a980b
test eax, eax
jge 0x5a9a0d
mov byte [0x6cab30], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0058cc82
add ebp, 0x78
leave
ret
Function at 0x4018f0
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp]
push eax
push ecx
mov dword [esp + 8], 0
call fcn.00401790
add esp, 8
xor ecx, ecx
test eax, eax
jle 0x401938
push ebx
mov edx, dword [esp + 4]
mov bl, byte [ecx + edx]
add bl, 0x38
mov byte [ecx + edx], bl
mov edx, dword [esp + 4]
mov bl, byte [ecx + edx]
xor bl, 0x7b
mov byte [ecx + edx], bl
inc ecx
cmp ecx, eax
jl 0x401912
mov eax, dword [esp + 4]
pop ebx
pop ecx
ret
mov eax, dword [esp]
pop ecx
ret

Function at 0x401940
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push dword [esp + 0x10]
push dword [esp + 0x10]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret 8

Function at 0x401c64
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
mov ebx, 0x407164
push 0x407180
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push 0x407188
push ebx
mov dword [ebp - 4], eax
call esi
push eax
call edi
cmp dword [0x407464], 0
mov dword [ebp - 8], eax
jne 0x401e1a
and byte [ebp - 0xd8], 0
push 0x1f
pop ecx
xor eax, eax
lea edi, [ebp - 0xd7]
push str.3d3d3R3m1h3c0eQJEhYQFxRD
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
jmp loc.0040fd54
push 0x50
mov word [ebp - 0x18], 2
call dword [ebp - 4]
mov word [ebp - 0x16], ax
push str.www.baidu.com
call fcn.00403b30
pop ecx
mov dword [ebp - 0x14], eax
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
lea eax, [ebp - 0x18]
push 0x10
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x401e60
push esi
call dword [ebp - 8]
or eax, 0xffffffff
jmp 0x401e62
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x406860
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x47accb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0046fc1e
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x4068e2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0046db30
mov eax, dword [eax]
push 0x499c28
push eax
call fcn.00460844
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0046fea9
test bl, bl
je 0x4068e2
push 0x499c28
lea ecx, [esp + 0xc]
call fcn.00470239
push 0x499c34
lea ecx, [esp + 0xc]
call fcn.00470239
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40691e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0046fea9
jmp 0x4069e9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x4069a2
lea edx, [esp + 0x7c]
push 0x499c30
push edx
call fcn.00460844
add esp, 8
test eax, eax
je 0x4069a2
lea eax, [esp + 0x7c]
push 0x499c2c
push eax
call fcn.00460844
add esp, 8
test eax, eax
je 0x4069a2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x406932
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0046fea9
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x4071f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x407252
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc