joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1e023408
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
movzx eax, byte [ebp + 8]
dec eax
push esi
push edi
je 0x1e023436
dec eax
jne 0x1e02346c
push dword [0x1e02cc7c]
mov edi, 0x1e030b08
push edi
mov esi, 0x1e030b00
call fcn.1e01d8b9
push 0x1e002204
jmp 0x1e023451
push dword [0x1e02cc7c]
mov edi, 0x1e030c28
push edi
mov esi, 0x1e030c20
call fcn.1e01d8b9
push 0x1e0021f8
push edi
call fcn.1e01bdc6
push eax
call fcn.1e01d8b9
push 1
lea edi, [esi + 8]
push edi
call fcn.1e0231c4
test eax, eax
jne 0x1e023473
xor eax, eax
jmp 0x1e02351b
push ebx
xor ebx, ebx
push edi
mov dword [esi + 4], ebx
mov dword [esi + 0x10c], ebx
call fcn.1e01b4fd
cmp eax, ebx
mov dword [esi], eax
je 0x1e023518
push 0x10000
push dword [ebp + 8]
call fcn.1e0232d5
test eax, eax
je 0x1e023509
mov eax, dword [esi + 0x10c]
cmp eax, ebx
je 0x1e023509
mov dword [eax + 4], ebx
mov eax, dword [esi + 0x10c]
or ebx, 0xffffffff
mov dword [eax + 8], ebx
mov eax, dword [esi + 0x10c]
mov dword [eax + 0xc], ebx
mov eax, dword [esi + 0x10c]
mov dword [eax + 0x10], ebx
mov eax, dword [esi + 0x10c]
mov dword [eax + 0x14], ebx
mov eax, dword [esi + 0x10c]
mov dword [eax + 0x18], ebx
call fcn.1e026510
mov ecx, dword [esi + 0x10c]
mov dword [ecx + 0x20], eax
mov edi, dword [esi + 0x10c]
xor eax, eax
add edi, 0x24
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [esi + 0x10c]
mov dword [eax + 0x38], ebx
xor eax, eax
inc eax
jmp 0x1e02351a
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret 4

Function at 0x1e023526
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
movzx eax, byte [ebp + 8]
dec eax
push edi
je 0x1e02353d
dec eax
jne 0x1e023594
mov edi, 0x1e030b00
jmp 0x1e023542
mov edi, 0x1e030c20
push esi
lea esi, [edi + 0x10c]
mov eax, dword [esi]
test eax, eax
je 0x1e023562
push dword [eax + 0x20]
call fcn.1e026184
mov eax, dword [esi]
add eax, 0x24
push eax
call fcn.1e01ef12
push edi
call fcn.1e023193
mov eax, dword [edi]
test eax, eax
pop esi
je 0x1e023579
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [edi], 0
lea eax, [edi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x44
xor eax, eax
pop ecx
rep stosd dword es:[edi], eax
movzx eax, byte [ebp + 8]
dec eax
je 0x1e0235aa
dec eax
je 0x1e023598
xor eax, eax
jmp 0x1e0235d6
mov eax, dword [0x1e030d2c]
test eax, eax
je 0x1e0235c1
mov byte [0x1e02cc78], 1
jmp 0x1e0235c8
cmp dword [0x1e030d2c], 0
je 0x1e0235c1
mov eax, dword [0x1e030c0c]
mov byte [0x1e02cc78], 2
jmp 0x1e0235c8
xor eax, eax
mov byte [0x1e02cc78], al
xor ecx, ecx
test eax, eax
setne cl
mov dword [0x1e02cc74], eax
mov eax, ecx
pop edi
pop ebp
ret 4

Function at 0x1e023693
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1e0235e0
Function at 0x1e026869
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x274
mov eax, dword [0x1e02c028]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, esi
push edi
mov dword [ebp - 0x274], esi
mov dword [ebp - 0x26c], 1
lea edi, [eax + 1]
xor ebx, ebx
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1e026899
sub eax, edi
push eax
push esi
call fcn.1e01db7c
push 0x1e002210
mov edi, eax
push esi
push edi
call fcn.1e01fc87
push ebx
mov esi, 0x1e001384
push esi
push edi
push ebx
call fcn.1e01db38
add esp, 0x10
push edi
push ebx
mov dword [ebp - 0x270], eax
call fcn.1e01bf2c
push ebx
push esi
push dword [ebp - 0x270]
call fcn.1e01fe79
push ebx
push ebx
push 0xffffffffffffffff
push 1
push ebx
push ebx
push 1
mov esi, eax
push ebx
push esi
lea eax, [ebp - 0x268]
push eax
call fcn.1e02777a
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
je 0x1e02695d
test byte [ebp - 0x50], 0x10
lea eax, [ebp - 0x25c]
je 0x1e026917
push eax
call edi
jmp 0x1e026930
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], ebx
lea eax, [ebp - 0x268]
push eax
je 0x1e026950
call fcn.1e0273d6
test eax, eax
jne 0x1e026906
jmp 0x1e026955
call fcn.1e026df0
cmp dword [ebp - 0x26c], ebx
je 0x1e026970
cmp dword [ebp + 0xc], ebx
je 0x1e026970
push dword [ebp - 0x274]
call edi
mov dword [ebp - 0x26c], eax
push esi
call fcn.1e01f8e4
push dword [ebp - 0x270]
push ebx
call fcn.1e01bf2c
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x26c]
pop edi
pop esi
pop ebx
call fcn.1e01ab9b
leave
ret 8

Function at 0x1e026c15
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x224]
test byte [eax + 0x20], 0x10
je 0x1e026c37
mov eax, dword [eax + 4]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 4]
mov eax, dword [eax + 4]
jmp 0x1e026c3c
mov eax, 0x1e001384
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0
push eax
push dword [esi]
push 0
call fcn.1e01db38
add esp, 0x10
lea edi, [esi + 0x10]
mov ebx, eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push ebx
push 0
mov dword [esi + 0xc], eax
call fcn.1e01bf2c
cmp dword [esi + 0xc], 0xffffffff
je 0x1e026c96
jmp 0x1e026c7f
push edi
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x1e026c89
test byte [edi], 0x10
jne 0x1e026c71
xor eax, eax
inc eax
jmp 0x1e026c98
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_FindClose]
and dword [esi + 0xc], 0
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x1e026d25
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0
push 0x1e001384
push dword [esi]
push 0
call fcn.1e01db38
add esp, 0x10
lea edi, [esi + 0x10]
mov ebx, eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push ebx
push 0
mov dword [esi + 0xc], eax
call fcn.1e01bf2c
cmp dword [esi + 0xc], 0xffffffff
je 0x1e026d8e
test byte [edi], 0x10
je 0x1e026d73
lea eax, [esi + 0x3c]
push eax
call fcn.1e026ca4
test eax, eax
je 0x1e026d97
push edi
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1e026d61
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_FindClose]
and dword [esi + 0xc], 0
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
xor eax, eax
inc eax
jmp 0x1e026d90

Function at 0x1e026e5c
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
inc edi
mov eax, dword [esi]
test eax, eax
jne 0x1e026e74
mov eax, dword [esi + 8]
jmp 0x1e026e80
push 0
push eax
call dword [sym.imp.msvcrt.dll_strchr]
pop ecx
pop ecx
inc eax
mov dword [esi], eax
cmp byte [eax], 0
je 0x1e026ef1
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [esi + 4], eax
sub eax, 0
je 0x1e026ede
dec eax
je 0x1e026ed5
dec eax
je 0x1e026ecc
dec eax
je 0x1e026ec3
dec eax
je 0x1e026eba
dec eax
je 0x1e026eb1
dec eax
jne 0x1e026ede
mov dword [esi + 4], 0x40
jmp 0x1e026ee1
mov dword [esi + 4], 0x20
jmp 0x1e026ee1
mov dword [esi + 4], 0x10
jmp 0x1e026ee1
mov dword [esi + 4], 8
jmp 0x1e026ee1
mov dword [esi + 4], 4
jmp 0x1e026ee1
mov dword [esi + 4], 2
jmp 0x1e026ee1
mov dword [esi + 4], edi
mov eax, dword [esi + 0xc]
test dword [esi + 4], eax
je 0x1e026e69
mov eax, edi
pop edi
pop esi
pop ebp
ret 4
push esi
call fcn.1e0269ec
xor eax, eax
jmp 0x1e026eeb
Function at 0x1e026f00
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
cmp dword [ebp + 0xc], esi
push edi
mov dword [ebp - 4], esi
push esi
je 0x1e026f36
push esi
push dword [ebp + 0xc]
push dword [0x1e030d78]
call fcn.1e01d9a6
push 0x5c
push eax
mov dword [ebp + 8], eax
call fcn.1e01d28d
mov edi, dword [ebp + 0x10]
jmp 0x1e026fa6
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
lea ecx, [eax + 0x3c]
push ecx
push dword [eax]
push dword [0x1e030d78]
call fcn.1e01db38
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x224]
mov eax, dword [eax]
add esp, 0x10
cmp eax, esi
je 0x1e0270d8
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 4]
cmp dword [esi], 1
jne 0x1e026fa4
push dword [esi + 8]
push dword [esi + 4]
call fcn.1e009e24
push eax
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.msvcrt.dll__mbsnicmp]
add esp, 0xc
test eax, eax
je 0x1e026fa4
push dword [ebp + 8]
push dword [0x1e030d78]
call fcn.1e01bcb8
mov eax, dword [ebp + 0x14]
test eax, eax
jmp 0x1e0270eb
xor esi, esi
test byte [ebx + 0x228], 8
je 0x1e026fca
mov eax, dword [ebx + 0x224]
push dword [eax + 0x10]
push dword [ebp + 8]
push 2
call fcn.1e0209ab
test eax, eax
jne 0x1e0270d8
cmp edi, esi
je 0x1e026fd9
mov eax, dword [edi]
sub eax, dword [ebx + 0x238]
mov dword [ebp - 4], eax
lea eax, [ebx + 0x238]
push 0x15c
push eax
call fcn.1e01ee7a
mov esi, eax
test esi, esi
jne 0x1e027026
push dword [ebp + 8]
push dword [0x1e030d78]
call fcn.1e01bcb8
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x1e0270f3
mov ebx, dword [ebx + 0x234]
test ebx, ebx
je 0x1e02701e
push 0
call ebx
mov dword [esi], eax
jmp 0x1e0270f3
and dword [esi], 0
jmp 0x1e0270f3
test edi, edi
je 0x1e02703f
mov eax, dword [ebx + 0x238]
mov edx, dword [edi]
mov ecx, dword [ebp - 4]
sub edx, eax
cmp ecx, edx
je 0x1e02703f
add eax, ecx
mov dword [edi], eax
push 0x57
xor eax, eax
pop ecx
mov edi, esi
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
xor edi, edi
cmp dword [ebp + 0xc], edi
mov dword [esi], eax
je 0x1e02707d
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [esi + 4], eax
mov eax, dword [ebx + 0x224]
cmp dword [eax + 0x10], edi
jne 0x1e02708f
cmp dword [eax + 8], edi
je 0x1e02708f
push dword [eax]
call fcn.1e01c99d
test eax, eax
jne 0x1e02708f
jmp 0x1e027088
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
mov dword [esi + 4], eax
or dword [esi + 0x154], 1
mov dword [esi + 0x150], edi
mov ebx, dword [ebx + 0x224]
test byte [ebx + 0x20], 3
jne 0x1e0270af
push dword [ebp + 8]
push dword [ebx]
call fcn.1e01eb93
test eax, eax
je 0x1e0270b6
or dword [esi + 0x154], 2
mov eax, dword [ebp + 0x10]
cmp eax, edi
je 0x1e0270ce
mov eax, dword [eax]
mov eax, dword [eax + 0x158]
inc eax
mov dword [esi + 0x158], eax
jmp 0x1e0270d4
mov dword [esi + 0x158], edi
mov eax, esi
jmp 0x1e0270f5
push dword [ebp + 8]
push dword [0x1e030d78]
call fcn.1e01bcb8
mov eax, dword [ebp + 0x14]
cmp eax, esi
je 0x1e0270f3
mov dword [eax], 1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x1e0275f6
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
xor esi, esi
push esi
push esi
call edi
mov ebx, eax
cmp ebx, esi
je 0x1e02763f
push esi
lea eax, [ebx + 1]
push eax
push dword [0x1e030d78]
call fcn.1e01f6fa
test eax, eax
mov esi, dword [ebp + 8]
mov dword [esi + 8], eax
je 0x1e02763f
push eax
push ebx
call edi
mov eax, dword [ebp + 0xc]
and dword [esi], 0
push esi
mov dword [esi + 0xc], eax
call fcn.1e026e5c
jmp 0x1e027641
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x1e027883
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edi
lea eax, [ebp - 4]
push eax
xor edi, edi
push edi
lea eax, [ebp - 8]
push eax
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
push dword [ebp + 8]
call esi
cmp eax, edi
je 0x1e0278b1
push eax
jmp 0x1e027901
mov eax, dword [ebp + 0x10]
cmp eax, edi
jbe 0x1e0278cb
cmp eax, 2
ja 0x1e0278cb
cmp dword [ebp - 8], 1
je 0x1e0278d0
cmp dword [ebp - 8], 2
je 0x1e0278d0
jmp 0x1e027907
cmp dword [ebp - 8], eax
jne 0x1e027907
mov eax, dword [ebp - 4]
add eax, 2
push eax
call dword [ebp + 0x14]
mov ebx, eax
lea eax, [ebp - 4]
push eax
push ebx
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
mov esi, eax
cmp esi, edi
jne 0x1e0278fc
mov eax, dword [ebp - 4]
mov word [ebx + eax], di
mov eax, ebx
jmp 0x1e027909
push ebx
call dword [ebp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x14

Function at 0x1e0286a1
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor ebx, ebx
push ebx
push ebx
neg ecx
lea edx, [esi + 0x20]
sbb ecx, ecx
and ecx, edx
push ecx
lea edi, [esi + 0x10]
push edi
lea eax, [esi + 8]
push eax
push ebx
lea eax, [esi + 0x2c]
push eax
lea eax, [esi + 0x24]
push eax
push ebx
push ebx
push ebx
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x1e0286e2
xor eax, eax
jmp 0x1e028750
cmp dword [esi + 0x24], ebx
je 0x1e028710
lea eax, [esi + 0x2c]
mov ecx, dword [eax]
cmp ecx, ebx
je 0x1e0286f5
inc ecx
mov dword [eax], ecx
jmp 0x1e0286fb
mov dword [eax], 0x800
mov eax, dword [eax]
push ebx
shl eax, 2
push eax
push dword [0x1e030d7c]
call fcn.1e01f6fa
mov dword [esi + 0x28], eax
cmp dword [esi + 8], ebx
je 0x1e02874d
inc dword [edi]
mov edi, dword [edi]
push ebx
mov eax, edi
shl eax, 2
push eax
push dword [0x1e030d7c]
call fcn.1e01f6fa
cmp dword [ebp + 0xc], ebx
mov dword [esi + 0xc], eax
je 0x1e028749
inc dword [esi + 0x20]
mov eax, dword [esi + 0x20]
push ebx
push eax
push dword [0x1e030d7c]
call fcn.1e01f6fa
mov dword [esi + 0x18], eax
or dword [esi + 0x3c], 0xc
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x1e02889d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x34]
test eax, eax
jne 0x1e0288b0
push eax
jmp 0x1e028907
mov ecx, dword [esi + 0x10]
dec eax
cmp dword [ebp + 0xc], 0
mov dword [esi + 0x34], eax
mov dword [ebp + 8], ecx
je 0x1e0288cb
mov ecx, dword [esi + 0x20]
mov dword [esi + 0x1c], ecx
mov ecx, dword [esi + 0x18]
jmp 0x1e0288cd
xor ecx, ecx
mov edx, dword [ebp + 0xc]
push ebx
neg edx
sbb edx, edx
lea ebx, [esi + 0x1c]
and edx, ebx
push edx
push ecx
lea ecx, [esi + 0x14]
push ecx
push 0
lea ecx, [ebp + 8]
push ecx
push dword [esi + 0xc]
push eax
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
pop ebx
je 0x1e028911
mov ecx, eax
sub ecx, 0x103
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1e028927
and dword [esi + 0x3c], 0xfffffffb
cmp dword [ebp + 0xc], 0
mov eax, dword [esi + 0x3c]
je 0x1e028924
and eax, 0xfffffff7
mov dword [esi + 0x3c], eax
xor eax, eax
inc eax
pop esi
pop ebp
ret 8

Function at 0x1e028951
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
inc dword [esi + 0x30]
push dword [esi + 0x2c]
mov eax, dword [esi + 0x30]
push dword [esi + 0x28]
dec eax
push eax
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
cmp eax, 0x103
je 0x1e0289b0
cmp eax, 0xea
jne 0x1e0289bc
mov eax, dword [esi + 0x28]
test eax, eax
je 0x1e028992
push eax
push dword [0x1e030d7c]
call fcn.1e01f7b4
mov eax, dword [esi + 0x2c]
shl eax, 1
mov dword [esi + 0x2c], eax
push 0
shl eax, 2
push eax
push dword [0x1e030d7c]
call fcn.1e01f6fa
mov dword [esi + 0x28], eax
jmp 0x1e02895d
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1e0289c5
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
pop esi
pop ebp
ret 4
Function at 0x401e50
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], str.MakeSureDirectoryPathExists
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], str.imagehlp.dll
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], 0x401ebc
cmp dword [0x40cd60], 0
jne 0x401e9d
pushal
push dword [ebp - 0x18]
push dword [ebp - 0x10]
call dword [ebp - 8]
add esp, 8
mov dword [0x40cd60], eax
popal
cmp dword [0x40cd60], 0
je 0x401eb2
push dword [ebp + 8]
call dword [0x40cd60]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403250
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], str.setsockopt
mov dword [ebp - 0xc], 0x40a674
mov dword [ebp - 8], fcn.00403707
cmp dword [0x40ce10], 0
jne 0x40329f
pushal
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call dword [ebp - 8]
add esp, 8
mov dword [0x40ce10], eax
popal
cmp dword [0x40ce10], 0
je 0x4032c0
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x40ce10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4032ca
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], str.socket
mov dword [ebp - 0xc], 0x40a688
mov dword [ebp - 8], fcn.00403707
cmp dword [0x40ce14], 0
jne 0x403319
pushal
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call dword [ebp - 8]
add esp, 8
mov dword [0x40ce14], eax
popal
cmp dword [0x40ce14], 0
je 0x403334
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x40ce14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40333e
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], str.closesocket
mov dword [ebp - 0xc], 0x40a6a0
mov dword [ebp - 8], fcn.00403707
cmp dword [0x40ce18], 0
jne 0x40338d
pushal
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call dword [ebp - 8]
add esp, 8
mov dword [0x40ce18], eax
popal
cmp dword [0x40ce18], 0
je 0x4033a2
push dword [ebp + 8]
call dword [0x40ce18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4033ac
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 4], fcn.00403707
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], str.connect
mov dword [ebp - 8], 0x40a6b4
cmp dword [0x40ce1c], 0
jne 0x4033f6
pushal
push dword [ebp - 0xc]
push dword [ebp - 8]
mov eax, dword [ebp - 4]
call eax
add esp, 8
mov dword [0x40ce1c], eax
popal
cmp dword [0x40ce1c], 0
je 0x403410
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x40ce1c]
jmp 0x403413
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409fa0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x624
mov eax, dword [0x45a074]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x620], 0x44fc38
mov dword [ebp - 0x624], 0x44fc54
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str....._bin
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov edx, dword [ebp - 0x620]
push edx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x61c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov edx, dword [ebp - 0x624]
push edx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x414]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea edx, [ebp - 0x61c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40a045
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40a04c
mov eax, 0x80004005
jmp 0x40a066
lea ecx, [ebp - 0x414]
push ecx
lea edx, [ebp - 0x61c]
push edx
push 1
call fcn.00409dd0
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00421c00
mov esp, ebp
pop ebp
ret

Function at 0x40c3c0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x45a074]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x28], ecx
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x24], 0xc
mov dword [ebp - 0x1c], 0
lea edx, [ebp - 0x18]
mov dword [ebp - 0x20], edx
push 1
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
lea ecx, [ebp - 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov edx, dword [ebp + 8]
push edx
push 1
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ecx, dword [ebp - 0x28]
mov dword [ecx], eax
mov edx, dword [ebp - 0x28]
cmp dword [edx], 0
je 0x40c45e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40c45e
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x28]
mov dword [edx], 0
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00421c00
mov esp, ebp
pop ebp
ret 4
Function at 0x40c920
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x474
mov eax, dword [0x45a074]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x458], eax
mov dword [ebp - 0x454], eax
mov dword [ebp - 0x450], eax
mov dword [ebp - 0x44c], eax
mov dword [ebp - 0x45c], 0
mov dword [ebp - 0x448], 0x44
push 0x40
push 0
lea ecx, [ebp - 0x444]
push ecx
call fcn.00423e70
add esp, 0xc
push 0x400
push 0
lea edx, [ebp - 0x404]
push edx
call fcn.00423e70
add esp, 0xc
push str.byod_agent
push str.__s.exe_
push 0x400
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.libnac_base.dll_str_snprintf]
add esp, 0x10
mov dword [ebp - 0x41c], 1
xor ecx, ecx
mov word [ebp - 0x418], cx
cmp dword [0x45be6c], 0
jne 0x40c9d7
mov edx, dword [ebp - 0x45c]
or edx, 0x8000000
mov dword [ebp - 0x45c], edx
mov dword [ebp - 0x464], 0x44ffc0
push 0x5c
mov eax, dword [ebp - 0x464]
push eax
call fcn.00423700
add esp, 8
mov dword [ebp - 0x460], eax
cmp dword [ebp - 0x460], 0
je 0x40ca12
mov ecx, dword [ebp - 0x460]
add ecx, 1
mov dword [ebp - 0x468], ecx
jmp 0x40ca1e
mov edx, dword [ebp - 0x464]
mov dword [ebp - 0x468], edx
lea eax, [ebp - 0x404]
push eax
push str.create_process_cmd:_s_n
push 0xb9
mov ecx, dword [ebp - 0x468]
push ecx
push 2
call dword [sym.imp.libnac_base.dll_error_output]
add esp, 0x14
xor edx, edx
jne 0x40c9d7
lea eax, [ebp - 0x458]
push eax
lea ecx, [ebp - 0x448]
push ecx
push 0
push 0
mov edx, dword [ebp - 0x45c]
push edx
push 0
push 0
push 0
lea eax, [ebp - 0x404]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40caf0
mov dword [ebp - 0x470], 0x450058
push 0x5c
mov ecx, dword [ebp - 0x470]
push ecx
call fcn.00423700
add esp, 8
mov dword [ebp - 0x46c], eax
cmp dword [ebp - 0x46c], 0
je 0x40cab2
mov edx, dword [ebp - 0x46c]
add edx, 1
mov dword [ebp - 0x474], edx
jmp 0x40cabe
mov eax, dword [ebp - 0x470]
mov dword [ebp - 0x474], eax
lea ecx, [ebp - 0x404]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4500bc
push 0xbb
mov edx, dword [ebp - 0x474]
push edx
push 1
call dword [sym.imp.libnac_base.dll_error_output]
add esp, 0x18
xor eax, eax
jne 0x40ca77
xor eax, eax
jmp 0x40cb0d
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x458]
mov dword [ecx], edx
mov eax, dword [ebp - 0x454]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00421c00
mov esp, ebp
pop ebp
ret