joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404b04
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
mov eax, 0x485053
call fcn.004847e4
sub esp, 0x58
xor edx, edx
push ebx
push esi
push edi
push ecx
push 0xa
pop ecx
mov esi, 0x8e
mov edi, str.BlackBoneDrv7.sys
call fcn.00404a00
pop ecx
test al, al
je 0x404b38
mov edi, str.BlackBoneDrv10.sys
add esi, 9
jmp 0x404b70
push ecx
push 3
pop edx
push 6
pop ecx
call fcn.00404a00
pop ecx
test al, al
je 0x404b55
mov edi, str.BlackBoneDrv81.sys
mov esi, 0x95
jmp 0x404b70
push ecx
push 2
pop edx
push 6
pop ecx
call fcn.00404a00
pop ecx
test al, al
je 0x404b70
mov edi, str.BlackBoneDrv8.sys
mov esi, 0x93
push str.Driver
movzx eax, si
xor esi, esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x404c2f
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x18], eax
call fcn.004168c0
push 0x4a2248
mov edx, eax
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x48]
call fcn.00406af8
pop ecx
push edi
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x30]
call fcn.00406af8
pop ecx
cmp dword [eax + 0x14], 8
jb 0x404bd1
mov eax, dword [eax]
xor edi, edi
push edi
push edi
push 2
push edi
push edi
push 0x120116
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push edi
push 1
lea ecx, [ebp - 0x30]
mov esi, eax
call fcn.00402c21
push edi
push 1
lea ecx, [ebp - 0x48]
call fcn.00402c21
push edi
push 1
lea ecx, [ebp - 0x60]
call fcn.00402c21
cmp esi, 0xffffffff
je 0x404c2f
push edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], edi
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push dword [ebp - 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x404c40
Capabilities:
Delete file

Disassembly:
mov eax, 0x48506d
call fcn.004847e4
sub esp, 0x4c
xor edx, edx
push esi
push edi
push ecx
push 0xa
pop ecx
mov edi, str.BlackBoneDrv7.sys
call fcn.00404a00
pop ecx
test al, al
je 0x404c6b
mov esi, str.BlackBoneDrv10.sys
jmp 0x404c9d
push ecx
push 3
pop edx
push 6
pop esi
mov ecx, esi
call fcn.00404a00
pop ecx
test al, al
je 0x404c85
mov esi, str.BlackBoneDrv81.sys
jmp 0x404c9d
push ecx
mov dx, 2
mov cx, si
call fcn.00404a00
test al, al
mov esi, str.BlackBoneDrv8.sys
pop ecx
cmove esi, edi
lea ecx, [ebp - 0x58]
call fcn.004168c0
xor edi, edi
lea ecx, [ebp - 0x40]
push 0x4a2248
mov edx, eax
mov dword [ebp - 4], edi
call fcn.00406af8
pop ecx
push esi
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.00406af8
pop ecx
cmp dword [eax + 0x14], 8
jb 0x404cd2
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
push 1
lea ecx, [ebp - 0x28]
call fcn.00402c21
push edi
push 1
lea ecx, [ebp - 0x40]
call fcn.00402c21
push edi
push 1
lea ecx, [ebp - 0x58]
call fcn.00402c21
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x405e24
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
lea esi, [edi + 8]
mov dword [edi], 0x4043b0
mov ecx, esi
mov dword [edi + 4], eax
call fcn.00406250
and dword [ebp + 0xc], 0
lea eax, [ebp + 0xc]
push eax
push 0x40
push 0x12
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [esi + 1], edi
mov eax, edi
pop edi
mov dword [esi + 0xc], 0x4063b7
pop esi
pop ebp
ret 8

Function at 0x408086
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
lea ecx, [esp]
call fcn.0040cd36
cmp dword [eax + 0x14], 0x10
jb 0x40809f
mov eax, dword [eax]
push eax
call fcn.0046da40
pop ecx
push 0
push 1
lea ecx, [esp + 8]
call fcn.00402cee
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x408286
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
mov byte [0x4b3b98], 1
push edi
push 0x495234
mov ecx, 0x4b3bb0
mov dword [0x4b3b94], esi
mov edi, 0x4b3b94
mov dword [0x4b3b9c], esi
mov dword [0x4b3ba0], esi
mov dword [0x4b3ba4], esi
mov dword [0x4b3ba8], esi
mov dword [0x4b3bac], esi
call fcn.00406124
push esi
push esi
push edi
push 0x408384
push esi
push esi
mov dword [0x4b3bc8], esi
mov dword [0x4b3ba8], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4b3ba4], eax
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4083b4
Capabilities:
Terminate process

Disassembly:
mov eax, 0x48543d
call fcn.004847e4
sub esp, 0x30
push esi
push edi
xor edi, edi
mov esi, ecx
push edi
push edi
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
call fcn.00402c21
push edi
mov dword [ebp - 4], edi
lea ecx, [ebp - 0x3c]
push edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
call fcn.00402c21
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x24]
mov ecx, esi
push eax
call fcn.004084d3
test byte [esi + 8], 2
je 0x408410
push 0x47
lea eax, [ebp - 0x24]
mov ecx, esi
push eax
call fcn.00408451
test byte [esi + 8], 1
je 0x408422
push edi
lea eax, [ebp - 0x3c]
mov ecx, esi
push eax
call fcn.00408451
mov ecx, dword [esi + 0x34]
test ecx, ecx
je 0x408442
cmp dword [ebp - 0x10], 8
lea eax, [ebp - 0x24]
push 1
push dword [esi + 0x14]
cmovae eax, dword [ebp - 0x24]
push dword [esi + 0x18]
push eax
call ecx
add esp, 0x10
push 0x1337
mov dword [esi + 0x10], edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x408451
Capabilities:
Create process memory minidump

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
cmp dword [eax + 0x14], 8
push edi
mov edi, ecx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
jb 0x408472
mov eax, dword [eax]
push ebx
push ebx
push 2
push ebx
push ebx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [edi + 0xc]
mov esi, eax
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + 0x14]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 1
cmp esi, 0xffffffff
je 0x4084ca
push ebx
push ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.dbghelp.dll_MiniDumpWriteDump]
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x409c3c
Capabilities:
Resolve function by parsing pe exports
Resume thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, dword [ebp + 8]
xorps xmm0, xmm0
push esi
mov esi, ecx
push edi
cmp dword [ebx + 0x78], 0
mov dword [esp + 0x14], esi
movups xmmword [esp + 0x18], xmm0
jne 0x409c71
cmp dword [ebx + 0x90], 0
jne 0x409c71
mov eax, dword [ebx + 0x6c]
mov dword [ebx + 0x90], eax
lea eax, [ebx + 0x54]
cmp dword [eax + 0x14], 8
jb 0x409c7c
mov eax, dword [eax]
lea ecx, [ebx + 0x3c]
cmp dword [ecx + 0x14], 8
jb 0x409c87
mov ecx, dword [ecx]
push eax
movzx eax, byte [ebx + 0x88]
push ecx
push eax
movzx eax, byte [ebx + 0x89]
push eax
movzx eax, byte [ebx + 0x8a]
push eax
push dword [ebx + 0x70]
push dword [ebx + 0x90]
push dword [ebx + 0x74]
push dword [ebx + 0x78]
push str.Injection_initiated._Mode:__d__process_type:__d__pid:__d__mmap_flags:_0x_X__erasePE:__d__unlink:__d__thread_hijack:__d__init_routine:__s__init_arg:__ls
call fcn.00408972
add esp, 0x28
lea eax, [esp + 0x18]
mov ecx, esi
push eax
push ebx
call fcn.00408bcb
mov dword [esp + 0x10], eax
test eax, eax
jne 0x409da2
cmp dword [ebx + 0x7c], eax
je 0x409ce4
push dword [ebx + 0x7c]
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [ebx + 0x98]
mov esi, dword [ebx + 0x94]
jmp 0x409d16
push dword [esi]
mov ecx, dword [esp + 0x18]
push ebx
call fcn.00409dab
or dword [esp + 0x10], eax
mov eax, dword [ebx + 0x80]
test eax, eax
je 0x409d13
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
add esi, 8
cmp esi, edi
jne 0x409cf2
mov eax, dword [esp + 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x10]
test eax, eax
je 0x409d3e
test esi, esi
jne 0x409d3b
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [esp + 0x1c]
push eax
call edi
cmp dword [esp + 0x18], 0
je 0x409d4b
push dword [esp + 0x18]
call edi
test esi, esi
jne 0x409d8f
test byte [ebx + 0x70], 0x10
je 0x409d8f
cmp dword [ebx + 0x78], 1
je 0x409d61
cmp dword [ebx + 0x78], 4
jne 0x409d8f
mov eax, dword [esp + 0x14]
mov edi, dword [eax + 0xc]
lea esi, [eax + 0x2a8]
mov eax, dword [esi + 4]
cmp eax, dword [esi + 8]
jne 0x409d7e
push ecx
mov ecx, esi
call fcn.0040b116
mov eax, dword [esi + 4]
test eax, eax
je 0x409d87
mov dword [eax], edi
add dword [esi + 4], 4
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
add ecx, 8
cmp dword [ecx], 0
je 0x409da0
call fcn.0041eba0
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40c61d
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 0x14], 8
mov eax, dword [ecx + 0x10]
jb 0x40c62e
mov ecx, dword [ecx]
mov edx, dword [ebp + 8]
cmp dword [edx + 0x14], 8
jb 0x40c639
mov edx, dword [edx]
add eax, eax
push eax
push ecx
push 1
push dword [ebp + 0x10]
push edx
push closesocket
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
pop ebp
ret 0xc

Function at 0x40c652
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [ebp - 4]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
xor esi, esi
mov ebx, eax
inc esi
cmp dword [ebp - 4], esi
jle 0x40c6b6
push 2
pop edi
push str.__load
push dword [ebx + esi*4]
call fcn.0046dfb1
pop ecx
pop ecx
test eax, eax
jne 0x40c697
cmp edi, dword [ebp - 4]
jl 0x40c6bf
push str.__run
push dword [ebx + esi*4]
call fcn.0046dfb1
pop ecx
pop ecx
test eax, eax
jne 0x40c6af
cmp edi, dword [ebp - 4]
jl 0x40c6db
inc esi
inc edi
cmp esi, dword [ebp - 4]
jl 0x40c67f
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebx + esi*4 + 4]
call fcn.0040145e
pop ecx
mov ecx, dword [ebp - 8]
push eax
push dword [ebx + esi*4 + 4]
call fcn.00402c75
xor eax, eax
inc eax
jmp 0x40c6b8
push dword [ebx + esi*4 + 4]
call fcn.0040145e
pop ecx
mov ecx, dword [ebp - 8]
push eax
push dword [ebx + esi*4 + 4]
call fcn.00402c75
push 2
pop eax
jmp 0x40c6b8
Function at 0x40c6f7
Capabilities:
Access peb ldr_data
Get system information on windows
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x5832c
call fcn.0044e630
push ebx
push esi
push edi
lea ecx, [esp + 0x3c]
call fcn.0040c1b0
mov esi, eax
cmp dword [esi + 0x14], 0x10
jb 0x40c71d
mov esi, dword [esi]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x40c720
sub esi, ecx
lea ecx, [esp + 0x24]
call fcn.0040c1b0
mov ecx, eax
cmp dword [ecx + 0x14], 0x10
jb 0x40c73c
mov ecx, dword [ecx]
lea eax, [esi + 1]
push eax
push ecx
lea eax, [esp + 0x3c0]
push eax
call fcn.0046df67
add esp, 0xc
lea ecx, [esp + 0x24]
xor ebx, ebx
push ebx
push 1
call fcn.00402cee
push ebx
push 1
lea ecx, [esp + 0x44]
call fcn.00402cee
push 0x104
lea eax, [esp + 0x1b4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0x1b0]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x40c789
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 1]
push eax
lea eax, [esp + 0x1b4]
push eax
lea eax, [esp + 0xb0]
push eax
call fcn.0046e7b4
add esp, 0xc
lea ecx, [esp + 0x54]
call fcn.0040c1b0
cmp dword [eax + 0x14], 0x10
jb 0x40c7c5
mov eax, dword [eax]
push eax
lea eax, [esp + 0xac]
push eax
call fcn.0046e3a0
pop ecx
pop ecx
push ebx
push 1
lea ecx, [esp + 0x5c]
mov esi, eax
call fcn.00402cee
test esi, esi
jne 0x40c7f3
push str.Error_deleting_file
call fcn.0046e14a
jmp 0x40c7fd
push str.File_successfully_deleted
call fcn.0046e2c1
pop ecx
lea ecx, [esp + 0x6c]
call fcn.004168c0
mov edi, eax
call fcn.004082f6
mov esi, eax
cmp dword [esi], ebx
jne 0x40c842
lea ecx, [esi + 0x1c]
mov dword [esi + 8], 2
mov dword [esi + 0x18], ebx
cmp ecx, edi
je 0x40c82e
push 0xffffffffffffffff
push ebx
push edi
call fcn.0040355a
push 0x40833f
mov dword [esi + 0x34], 0x40c2b2
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov dword [esi], eax
push ebx
push 1
lea ecx, [esp + 0x74]
call fcn.00402c21
call fcn.0040c354
push ebx
push ebx
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
call fcn.00402c21
lea ecx, [esp + 0xc]
call fcn.0040c652
mov ebx, eax
lea ecx, [esp + 0x5c0]
lea eax, [esp + 0xc]
push eax
push ebx
call fcn.0040f45e
push 9
xor eax, eax
lea edi, [esp + 0x88]
pop ecx
rep stosd dword es:[edi], eax
mov eax, dword fs:[0x18]
mov edi, dword [eax + 0x30]
lea eax, [esp + 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [esp + 0x84], 0
mov eax, 0x496be8
mov esi, 0x496bec
cmovne esi, eax
call fcn.00404983
push dword [eax + 4]
movzx eax, word [edi + 0xac]
push esi
push eax
movzx eax, byte [edi + 0xaf]
push eax
push dword [edi + 0xa8]
push dword [edi + 0xa4]
push str.Started_on_Windows__d._d._d._d__s._Driver_status:_0x_X
call fcn.004089ae
add esp, 0x1c
cmp ebx, 2
je 0x40c90c
push 0x8d
push 0
lea ecx, [esp + 0x5c8]
call fcn.00404295
mov esi, eax
jmp 0x40c927
push ecx
lea ecx, [esp + 0x5c4]
call fcn.00413058
lea ecx, [esp + 0x5c0]
call fcn.0041352c
xor esi, esi
lea ecx, [esp + 0x5c0]
call fcn.0040f952
push 0
push 1
lea ecx, [esp + 0x14]
call fcn.00402c21
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40d725
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x280
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push 0xf
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
push 0x228
mov edi, eax
lea eax, [ebp - 0x27c]
push ebx
push eax
call fcn.004663d0
add esp, 0xc
mov dword [ebp - 0x280], 0x22c
lea eax, [ebp - 0x280]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x40d75d
lea eax, [ebp - 0x25c]
push str.exeinfope.exe
push eax
call fcn.0046dfb1
mov esi, eax
lea eax, [ebp - 0x25c]
push str.lua53_64.dll
push eax
call fcn.0046dfb1
add esp, 0x10
test esi, esi
je 0x40d7c0
test eax, eax
je 0x40d7c0
lea eax, [ebp - 0x280]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x40d76f
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x278]
push ebx
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, 0x4973c0
lea ecx, [ebp - 0x19]
push 0x10
sub eax, 0x2a906b22
push eax
call fcn.0041218d
push eax
mov eax, 0x4973dc
lea ecx, [ebp - 0x54]
sub eax, 0x4c43b38e
push eax
call fcn.0041214f
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x40d87b
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
lea ecx, [ebp - 0x24]
mov eax, 0x497438
push ebx
push esi
mov esi, 0x6ce5808
sub eax, esi
push eax
call fcn.004121cb
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40d89e
sub eax, edx
lea ecx, [ebp - 0x40]
inc eax
push eax
mov eax, str.aDM__B_U_
sub eax, esi
push eax
call fcn.004121cb
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.0046df67
mov eax, dword [ebp + 0xc]
add esp, 0xc
xor ebx, ebx
push ebx
push ebx
push ebx
mov byte [eax], bl
lea eax, [ebp - 0x248]
push ebx
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [ebp - 8], eax
test eax, eax
je 0x40d929
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 8]
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov esi, eax
test esi, esi
je 0x40d920
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov byte [ecx + eax], bl
mov ebx, dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40dc07
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.USER32.dll_GetDlgItemTextA]
push edi
mov edi, ecx
push 0x800
lea eax, [edi + 0x23f4]
push eax
push 0x40e
push ebx
mov dword [ebp - 0xc], eax
call esi
push 0x800
lea eax, [edi + 0x2bf4]
push eax
push 0x40f
push ebx
mov dword [ebp + 8], eax
call esi
lea ecx, [ebp - 0x34]
call fcn.0040cf4e
push 0x7a5c897d
lea ecx, [ebp - 0x11]
mov esi, eax
call fcn.00412319
push 0x4bfa8e23
lea ecx, [ebp - 0x1c]
mov dword [ebp - 8], eax
call fcn.004122db
cmp dword [esi + 0x14], 0x10
mov ecx, eax
jb 0x40dc7a
mov esi, dword [esi]
push esi
push 0x20
lea eax, [edi + 0x23f4]
push eax
push eax
push dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
lea ecx, [ebp - 0x34]
stosd dword es:[edi], eax
stosb byte es:[edi], al
xor eax, eax
push eax
push 1
mov dword [ebp - 0x11], eax
mov byte [ebp - 0xd], al
call fcn.00402cee
lea ecx, [ebp - 0x34]
call fcn.0040cf4e
push 0x5e426c73
lea ecx, [ebp - 0x13]
mov esi, eax
call fcn.00412355
push 0x4bfa8e37
lea ecx, [ebp - 0x1c]
mov edi, eax
call fcn.004122db
cmp dword [esi + 0x14], 0x10
mov ecx, eax
jb 0x40dcda
mov esi, dword [esi]
mov eax, dword [ebp + 8]
push esi
push 0x20
push eax
push eax
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
lea ecx, [ebp - 0x34]
push 0
push 1
stosd dword es:[edi], eax
stosb byte es:[edi], al
xor eax, eax
lea edi, [ebp - 0x13]
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00402cee
push dword [ebp - 0xc]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x40e
push ebx
call edi
mov esi, dword [sym.imp.USER32.dll_SetWindowTextA]
push eax
call esi
push dword [ebp + 8]
push 0x40f
push ebx
call edi
push eax
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40de43
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ecx
call fcn.0040e84f
cmp eax, 1
jne 0x40de5c
xor eax, eax
mov esp, ebp
pop ebp
ret 4
push 0x4d
pop ecx
xor edx, edx
mov al, byte [edx + 0x4975d4]
xor al, cl
inc ecx
mov byte [ebp + edx - 0xc], al
and ecx, 0x800000ff
jns 0x40de7e
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 7
jl 0x40de61
mov byte [ebp - 5], 0
mov ecx, 0x9e
xor edx, edx
mov al, byte [edx + 0x4975dc]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x25], al
and ecx, 0x800000ff
jns 0x40deac
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x18
jl 0x40de8f
push 0x10
lea eax, [ebp - 0xc]
mov byte [ebp - 0xd], 0
push eax
lea eax, [ebp - 0x25]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x41240f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov edx, 0xeb
xor esi, esi
mov al, byte [edi + esi - 0x5051ea51]
xor al, dl
inc edx
mov byte [esi + ecx], al
and edx, 0x800000ff
jns 0x41243b
dec edx
or edx, 0xffffff00
inc edx
inc esi
cmp esi, 2
jl 0x41241e
pop edi
mov byte [ecx + 2], 0
mov eax, ecx
pop esi
pop ebp
ret 4

Function at 0x413aca
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push 6
push 1
push 2
pop ebx
push ebx
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x413aeb
xor eax, eax
jmp 0x413b65
push edi
push dword [ebp + 8]
mov edi, dword [sym.imp.WS2_32.dll_inet_addr]
call edi
push dword [ebp + 8]
cmp eax, 0xffffffff
jne 0x413b07
call dword [sym.imp.WS2_32.dll_gethostbyname]
jmp 0x413b19
call edi
push ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push 4
push eax
call dword [sym.imp.WS2_32.dll_gethostbyaddr]
test eax, eax
je 0x413b57
mov eax, 0x498570
lea ecx, [ebp - 0x13]
sub eax, 0x37a4b193
push eax
call fcn.0041244d
push eax
call edi
push 0x50
mov dword [ebp - 0x20], eax
mov word [ebp - 0x24], bx
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x22], ax
lea eax, [ebp - 0x24]
push 0x10
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x413b62
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x413b64
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x413f4d
Capabilities:
Initialize winsock library
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x164
push ebx
push esi
push edi
mov esi, ecx
lea ecx, [esp + 0x2c]
push 0x6b46d6ff
call fcn.00414d37
push eax
lea eax, [esp + 0x6c]
push 0x4985f8
push eax
call fcn.00412ff0
add esp, 0xc
lea eax, [esi + 0x244]
xor ebx, ebx
mov dword [esp + 0x10], ebx
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x413fa5
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x70]
push eax
call fcn.00413b6d
mov edi, eax
cmp dword [esp + 0xc], ebx
je 0x414025
lea ecx, [esp + 0x14]
call fcn.0040cd36
cmp dword [eax + 0x14], 0x10
jb 0x413fd2
mov eax, dword [eax]
push 0x4985f4
push eax
call fcn.0046edc8
pop ecx
pop ecx
push ebx
xor ebx, ebx
lea ecx, [esp + 0x18]
inc ebx
mov esi, eax
push ebx
call fcn.00402cee
push esi
push dword [esp + 0x10]
push ebx
push edi
call fcn.00469a73
push esi
call fcn.004692c1
add esp, 0x14
push ebx
push edi
call fcn.0044d8a2
push ebx
push dword [esp + 0x1c]
call fcn.0044d8a2
add esp, 0x10
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x413f9e
push 0x58
pop ecx
mov edx, ebx
mov al, byte [edx + str._b5_:_8]
xor al, cl
inc ecx
mov byte [esp + edx + 0x2c], al
and ecx, 0x800000ff
jns 0x414047
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x38
jl 0x41402a
push 0x10
push 0x494822
lea eax, [esp + 0x34]
mov byte [esp + 0x6c], bl
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x41406d
Capabilities:
Set file attributes

Disassembly:
mov eax, 0x486068
call fcn.004847e4
sub esp, 0x238
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [ebp - 0x24]
call fcn.0040cd36
mov esi, eax
cmp dword [esi + 0x14], 0x10
jb 0x414094
mov esi, dword [esi]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x414097
sub esi, ecx
lea ecx, [ebp - 0x3c]
call fcn.0040cd36
mov ecx, eax
cmp dword [ecx + 0x14], 0x10
jb 0x4140b2
mov ecx, dword [ecx]
lea eax, [esi + 1]
push eax
push ecx
lea eax, [ebp - 0x244]
push eax
call fcn.0046df67
add esp, 0xc
lea ecx, [ebp - 0x3c]
xor esi, esi
xor ebx, ebx
inc ebx
push esi
push ebx
call fcn.00402cee
push esi
push ebx
lea ecx, [ebp - 0x24]
call fcn.00402cee
lea ecx, [ebp - 0x24]
mov dword [edi + 0x3dc], ebx
call fcn.0040cd36
mov dword [ebp - 4], esi
cmp dword [eax + 0x14], 0x10
jb 0x4140f8
mov eax, dword [eax]
push eax
call fcn.00413865
mov bl, al
lea ecx, [ebp - 0x24]
neg bl
push esi
sbb bl, bl
or dword [ebp - 4], 0xffffffff
push 1
call fcn.00402cee
add bl, 1
je 0x414132
mov ecx, edi
call fcn.00413f4d
test eax, eax
jne 0x414132
push 2
lea eax, [ebp - 0x244]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4