joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46df20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], ecx
call fcn.004671f0
movzx eax, al
test eax, eax
je 0x46df42
mov ecx, dword [ebp + 8]
call fcn.00402730
jmp 0x46e15e
mov ecx, dword [ebp - 0xc]
call fcn.0046d690
movzx ecx, al
test ecx, ecx
jne 0x46df89
mov ecx, dword [ebp - 0xc]
call fcn.0046d2f0
movzx edx, al
test edx, edx
jne 0x46df89
mov ecx, dword [ebp - 0xc]
call fcn.00468b10
push eax
push 0x493ff4
mov ecx, dword [ebp + 8]
call fcn.00402740
mov ecx, eax
call fcn.0046c360
mov ecx, eax
call fcn.00403140
jmp 0x46e15e
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp - 0xc]
call fcn.00468ae0
push eax
push 0x494008
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x20
jg 0x46e156
mov ecx, dword [ebp - 0xc]
call fcn.00468b10
push eax
push 0x494024
mov ecx, dword [ebp - 8]
push ecx
push 0x494014
mov ecx, dword [ebp + 8]
call fcn.00402740
mov ecx, eax
call fcn.0046c3a0
mov ecx, eax
call fcn.0046c360
mov ecx, eax
call fcn.0046c360
mov edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0x20
ja case.0x46e00f.1
mov eax, dword [ebp - 0x10]
movzx ecx, byte [eax + 0x46e19c]
jmp dword [ecx*4 + 0x46e164]
push 0x494030
mov ecx, dword [ebp + 8]
call fcn.00402740
mov ecx, eax
call fcn.00403140
jmp 0x46e15e
push 0x494098
mov ecx, dword [ebp + 8]
call fcn.00402740
mov ecx, eax
call fcn.00403140
jmp 0x46e15e
push 0x494118
mov ecx, dword [ebp + 8]
call fcn.00402740
mov ecx, eax
call fcn.00403140
jmp 0x46e15e
push 0x494170
mov ecx, dword [ebp + 8]
call fcn.00402740
mov ecx, eax
call fcn.00403140
jmp 0x46e15e
push 0x494208
mov ecx, dword [ebp + 8]
call fcn.00402740
mov ecx, eax
call fcn.00403140
jmp 0x46e15e
push 0x494288
mov ecx, dword [ebp + 8]
call fcn.00402740
mov ecx, eax
call fcn.00403140
jmp 0x46e15e
push 0x4942f0
mov ecx, dword [ebp + 8]
call fcn.00402740
mov ecx, eax
call fcn.00403140
jmp 0x46e15e
push 0x4943e0
mov ecx, dword [ebp + 8]
call fcn.00402740
mov ecx, eax
call fcn.00403140
jmp 0x46e15e
push 0x494418
mov ecx, dword [ebp + 8]
call fcn.00402740
mov ecx, eax
call fcn.00403140
jmp 0x46e15e
push 0x4944e8
mov ecx, dword [ebp + 8]
call fcn.00402740
mov ecx, eax
call fcn.00403140
jmp 0x46e15e
push 0x494558
mov ecx, dword [ebp + 8]
call fcn.00402740
mov ecx, eax
call fcn.00403140
jmp 0x46e15e
push 0x4946a8
mov ecx, dword [ebp + 8]
call fcn.00402740
mov ecx, eax
call fcn.00403140
jmp 0x46e15e
push 0x4940dc
mov ecx, dword [ebp + 8]
call fcn.00402740
mov ecx, eax
call fcn.00403140
jmp 0x46e15e
mov ecx, dword [ebp + 8]
call fcn.00403140
jmp 0x46e15e
mov ecx, dword [ebp + 8]
call fcn.00402730
mov esp, ebp
pop ebp
ret 0x14
Function at 0x46e300
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x34], ecx
push 0x80
mov ecx, dword [ebp - 0x34]
call fcn.00468ae0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
movzx eax, byte [ebp + 0x10]
test eax, eax
jne 0x46e39e
mov ecx, dword [ebp - 0x34]
call fcn.00468ae0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x46e399
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
movzx ecx, byte [ebp + 0xc]
test ecx, ecx
jne 0x46e365
mov ecx, dword [ebp - 0x34]
call fcn.0046d2f0
movzx edx, al
test edx, edx
jne 0x46e365
mov ecx, dword [ebp + 8]
call fcn.00402730
jmp 0x46e52d
mov ecx, dword [ebp - 0x34]
call fcn.00468b10
push eax
push 0x493ec4
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
call fcn.0046c520
mov ecx, eax
call fcn.0046c360
mov ecx, eax
call fcn.0046c360
mov ecx, eax
call fcn.00403140
jmp 0x46e52d
jmp 0x46e525
movzx ecx, byte [ebp + 0xc]
test ecx, ecx
jne 0x46e3c2
mov ecx, dword [ebp - 0x34]
call fcn.0046d2f0
movzx edx, al
test edx, edx
jne 0x46e3c2
mov ecx, dword [ebp + 8]
call fcn.00402730
jmp 0x46e52d
mov ecx, dword [ebp - 0x34]
call fcn.00468bf0
add eax, 2
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
shl eax, 1
push eax
call fcn.0044674b
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x46e410
mov ecx, dword [ebp - 0x34]
call fcn.00468b10
push eax
push 0x493ed4
mov ecx, dword [ebp + 8]
call fcn.00402740
mov ecx, eax
call fcn.0046c360
mov ecx, eax
call fcn.00403140
jmp 0x46e52d
mov ecx, dword [ebp - 0x34]
call fcn.00468b10
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.00447193
add esp, 0xc
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
mov word [ecx + eax*2 - 2], 0
mov dword [ebp - 0x30], 0
xor edx, edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov word [ebp - 0x14], dx
mov dword [ebp - 0x30], 0
mov eax, dword [ebp - 8]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x2c], 3
mov word [ebp - 0x20], 0x454
lea ecx, [ebp - 0x30]
push ecx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 8]
push edx
call fcn.0044666e
add esp, 4
cmp dword [ebp - 0xc], 0
je 0x46e525
cmp dword [ebp - 0xc], 0x402
jne 0x46e4e8
mov eax, dword [ebp - 0xc]
push eax
push 0x493f04
mov ecx, dword [ebp - 0x34]
call fcn.00468b10
push eax
push 0x493eec
mov ecx, dword [ebp + 8]
call fcn.0046c4e0
mov ecx, eax
call fcn.0046c360
mov ecx, eax
call fcn.0046c360
mov ecx, eax
call fcn.0046c360
mov ecx, eax
call fcn.0046c3a0
mov ecx, eax
call fcn.00403140
jmp 0x46e52d
mov ecx, dword [ebp - 0xc]
push ecx
push 0x493f20
mov ecx, dword [ebp - 0x34]
call fcn.00468b10
push eax
push 0x493f08
mov ecx, dword [ebp + 8]
call fcn.00402740
mov ecx, eax
call fcn.0046c360
mov ecx, eax
call fcn.0046c360
mov ecx, eax
call fcn.0046c3a0
mov ecx, eax
call fcn.00403140
jmp 0x46e52d
mov ecx, dword [ebp + 8]
call fcn.00402730
mov esp, ebp
pop ebp
ret 0xc
Function at 0x46ec40
Capabilities:
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472337
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4a7534]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x20]
call fcn.0046da70
mov dword [ebp - 4], 0
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.0046e1f0
movzx ecx, al
test ecx, ecx
je 0x46ecc1
push 0
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x20]
call fcn.0046e8f0
movzx eax, al
test eax, eax
jne 0x46ecc1
mov ecx, dword [ebp + 8]
call fcn.00403140
mov byte [ebp - 0x21], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.0046d3c0
mov al, byte [ebp - 0x21]
jmp 0x46ed8a
mov dword [ebp - 0x10], 0xa
movzx ecx, byte [ebp + 0x10]
test ecx, ecx
jne 0x46ecd9
mov edx, dword [ebp - 0x10]
or edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.0046d380
push eax
mov ecx, dword [ebp - 0x28]
call fcn.00468ae0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x46ed59
mov ecx, dword [ebp - 0x28]
call fcn.00468b10
push eax
push 0x493fd0
mov ecx, dword [ebp + 8]
call fcn.0046c4e0
mov ecx, eax
call fcn.0046c360
mov ecx, eax
call fcn.0046c360
mov ecx, dword [ebp + 0xc]
call fcn.0046d380
push eax
push str.______
mov ecx, dword [ebp + 8]
call fcn.00402740
mov ecx, eax
call fcn.0046c360
mov ecx, dword [ebp + 8]
call fcn.00403140
mov byte [ebp - 0x22], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.0046d3c0
mov al, byte [ebp - 0x22]
jmp 0x46ed8a
push 0x80
mov ecx, dword [ebp + 0xc]
call fcn.0046d380
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, dword [ebp + 8]
call fcn.00402730
mov byte [ebp - 0x23], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.0046d3c0
mov al, byte [ebp - 0x23]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x46eda0
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47235a
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x4a7534]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x1c]
call fcn.0046da70
mov dword [ebp - 4], 0
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.0046e1f0
movzx ecx, al
test ecx, ecx
je 0x46ee21
push 0
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x1c]
call fcn.0046e8f0
movzx eax, al
test eax, eax
jne 0x46ee21
mov ecx, dword [ebp + 8]
call fcn.00403140
mov byte [ebp - 0x1d], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0046d3c0
mov al, byte [ebp - 0x1d]
jmp 0x46eef7
push 0x80
mov ecx, dword [ebp + 0xc]
call fcn.0046d380
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
movzx ecx, byte [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.0046d380
push eax
mov ecx, dword [ebp - 0x24]
call fcn.00468ae0
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x46eeb6
mov ecx, dword [ebp - 0x24]
call fcn.00468b10
push eax
push 0x493fac
mov ecx, dword [ebp + 8]
call fcn.0046c4e0
mov ecx, eax
call fcn.0046c360
mov ecx, eax
call fcn.0046c360
mov ecx, dword [ebp + 0xc]
call fcn.0046d380
push eax
push 0x493fbc
mov ecx, dword [ebp + 8]
call fcn.00402740
mov ecx, eax
call fcn.0046c360
mov ecx, dword [ebp + 8]
call fcn.00403140
mov byte [ebp - 0x1e], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0046d3c0
mov al, byte [ebp - 0x1e]
jmp 0x46eef7
push 0x80
mov ecx, dword [ebp + 0xc]
call fcn.0046d380
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, dword [ebp + 0xc]
call fcn.0046d210
mov ecx, dword [ebp + 0xc]
call fcn.0046e7a0
mov ecx, dword [ebp + 8]
call fcn.00402730
mov byte [ebp - 0x1f], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0046d3c0
mov al, byte [ebp - 0x1f]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4709e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], 0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x470ab9
cmp dword [ebp + 0x14], 0
je 0x470a32
mov ecx, dword [ebp + 0x14]
movzx edx, word [ecx]
test edx, edx
jne 0x470a6b
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.00468b10
push eax
push 0x492d2c
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
call fcn.0046c520
mov ecx, eax
call fcn.0046c360
mov ecx, eax
call fcn.0046c360
mov ecx, eax
call fcn.00403140
jmp 0x470b53
mov ecx, dword [ebp + 0x14]
push ecx
push 0x492d4c
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.00468b10
push eax
push 0x492d3c
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
call fcn.0046c520
mov ecx, eax
call fcn.0046c360
mov ecx, eax
call fcn.0046c360
mov ecx, eax
call fcn.0046c360
mov ecx, eax
call fcn.0046c360
mov ecx, eax
call fcn.00403140
jmp 0x470b53
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x18]
je 0x470b4b
cmp dword [ebp + 0x14], 0
je 0x470ad5
mov ecx, dword [ebp + 0x14]
movzx edx, word [ecx]
test edx, edx
jne 0x470b00
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.00468b10
push eax
push 0x492d50
mov ecx, dword [ebp + 8]
call fcn.00402740
mov ecx, eax
call fcn.0046c360
mov ecx, eax
call fcn.00403140
jmp 0x470b53
mov eax, dword [ebp + 0x14]
push eax
push 0x492d80
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.00468b10
push eax
push 0x492d68
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0046c520
mov ecx, eax
call fcn.0046c360
mov ecx, eax
call fcn.0046c360
mov ecx, eax
call fcn.0046c360
mov ecx, eax
call fcn.0046c360
mov ecx, eax
call fcn.00403140
jmp 0x470b53
mov ecx, dword [ebp + 8]
call fcn.00402730
mov esp, ebp
pop ebp
ret 0x14

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0xf2d2e0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x690015
lea edi, [esi - 0x28f015]
push edi
or ebp, 0xffffffff
jmp 0xf2d302
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xf2d309
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xf2d2f8
mov eax, 1
add ebx, ebx
jne 0xf2d31b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xf2d32c
jne 0xf2d34b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xf2d34b
dec eax
add ebx, ebx
jne 0xf2d338
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xf2d310
add ebx, ebx
jne 0xf2d347
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xf2d39d
xor ecx, ecx
sub eax, 3
jb 0xf2d363
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xf2d3d2
sar eax, 1
mov ebp, eax
jmp 0xf2d36e
add ebx, ebx
jne 0xf2d36e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xf2d33c
inc ecx
add ebx, ebx
jne 0xf2d37c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xf2d33c
add ebx, ebx
jne 0xf2d389
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xf2d37e
jne 0xf2d39a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xf2d37e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xf2d3bc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xf2d3ae
jmp 0xf2d2fe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xf2d3bc
add edi, ecx
jmp 0xf2d2fe
pop esi
mov edi, esi
mov ecx, 0xac6b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xf2d3da
cmp byte [edi], 0x15
jne 0xf2d3da
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xf2d3df
lea edi, [esi + 0xab8000]
mov eax, dword [edi]
or eax, eax
je 0xf2d44e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xb2d000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xb2d028]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xf2d40c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xb2d030]
or eax, eax
je 0xf2d448
mov dword [ebx], eax
add ebx, 4
jmp 0xf2d429
call dword [esi + 0xb2d02c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0xf2d488
cmp al, 0xef
ja 0xf2d472
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0xf2d454
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
or eax, eax
jne 0xf2d461
mov eax, dword [edi]
add edi, 4
jmp 0xf2d461
mov ebp, dword [esi + 0xb2d034]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xf2d4bc
sub esp, 0xffffff80
jmp 0x45f9f0
Function at 0x401ef1
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.WS2_32.dll_gethostbyname]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x401f33
push 6
call fcn.0052f61d
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x402067
fild dword [ebp - 4]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
fadd qword [0x557331]
fstp qword [ebp - 0x1c]
push 0x80000301
push 0
push 2
fld qword [ebp - 0x1c]
call fcn.00401eca
push 0x80000301
push 0
push eax
push 2
mov ebx, 0x910
call fcn.005300b0
add esp, 0x1c
mov dword [ebp - 0x20], eax
push 0
push 0
push 0
push 0x80000301
push 0
push 2
push VariantCopy
push 0
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x401fa8
mov eax, 0x557339
push eax
push 3
mov ebx, 0x19c
call fcn.00530200
add esp, 0x28
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], ecx
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x401fd4
push ebx
call fcn.0052f617
add esp, 4
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
cmp ecx, 0x80000101
jne 0x401fec
and eax, 0xff
jmp 0x402034
cmp ecx, 0x80000201
je 0x402034
cmp ecx, 0x80000301
je 0x402034
cmp ecx, 0x80000401
je 0x402034
mov dword [ebp - 0x34], eax
cmp ecx, 0x80000501
je 0x402024
cmp ecx, 0x80000601
je 0x402029
push 2
call fcn.0052f61d
add esp, 4
fld dword [ebp - 0x34]
jmp 0x40202f
mov dword [ebp - 0x30], edx
fld qword [ebp - 0x34]
call fcn.00401eca
mov word [ebp - 8], ax
fild dword [ebp - 4]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
fadd qword [0x557341]
fstp qword [ebp - 0x1c]
fld qword [ebp - 0x1c]
call fcn.00401eca
push eax
call fcn.00402075
push eax
call fcn.00402075
push eax
call fcn.00402075
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
jmp 0x40206f
mov esp, ebp
pop ebp
ret 4

Function at 0x4ffd85
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x80000301
push 0
push dword [ebp + 0x10]
push 1
mov ebx, 0x1bc
call fcn.00530060
add esp, 0x10
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
mov ebx, dword [ebp + 0xc]
mov ebx, dword [ebx]
test ebx, ebx
je 0x4ffdc3
push ebx
call fcn.0052f617
add esp, 4
pop eax
mov ebx, dword [ebp + 0xc]
mov dword [ebx], eax
mov dword [ebp - 4], esp
push 0
push dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
test eax, eax
je 0x4ffde0
add eax, 8
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_recv]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x4ffe00
push 6
call fcn.0052f61d
add esp, 4
jmp 0x4ffe05
mov esp, ebp
pop ebp
ret 0xc
Function at 0x50096e
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.00500b1e
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x500a6c
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x500a0f
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x500a52
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x500a26
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x500a41
test al, 0x40
je 0x500a38
mov ecx, dword [edi + 0x20]
jmp 0x500a3f
test al, 0x80
je 0x500a52
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x500a52
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x5009de
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x502317
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
push VariantCopy
push 0
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
test eax, eax
jne 0x502351
mov eax, 0x557339
push eax
push 1
mov ebx, 0x194
call fcn.00530940
add esp, 0x10
mov dword [ebp - 4], eax
push VariantCopy
push 0
push dword [ebp + 0xc]
push 1
mov ebx, 0xc
mov eax, 0x535220
call fcn.0052fa00
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
cmp dword [ebp - 0xc], eax
jge 0x502457
fild dword [ebp - 8]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
fild dword [ebp - 0xc]
fstp qword [ebp - 0x20]
fadd qword [ebp - 0x20]
fstp qword [ebp - 0x28]
fild dword [ebp - 4]
fstp qword [ebp - 0x30]
fld qword [ebp - 0x30]
fild dword [ebp - 0xc]
fstp qword [ebp - 0x38]
fsub qword [ebp - 0x38]
fstp qword [ebp - 0x40]
mov dword [ebp - 0x44], esp
push 0
fld qword [ebp - 0x40]
call fcn.00401eca
push eax
fld qword [ebp - 0x28]
call fcn.00401eca
push eax
push dword [0x63a3e8]
call dword [sym.imp.WS2_32.dll_send]
nop
nop
nop
nop
cmp dword [ebp - 0x44], esp
je 0x5023fd
push 6
call fcn.0052f61d
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x502412
mov eax, dword [ebp - 0x10]
jmp 0x50245f
fild dword [ebp - 0xc]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
fild dword [ebp - 0x10]
fstp qword [ebp - 0x20]
fadd qword [ebp - 0x20]
fstp qword [ebp - 0x28]
fld qword [ebp - 0x28]
call fcn.00401eca
mov dword [ebp - 0xc], eax
fild dword [ebp - 4]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
fild dword [ebp - 0x10]
fstp qword [ebp - 0x20]
fsub qword [ebp - 0x20]
fstp qword [ebp - 0x28]
fld qword [ebp - 0x28]
call fcn.00401eca
mov dword [ebp - 4], eax
jmp 0x50238b
mov eax, dword [ebp - 0xc]
jmp 0x50245f
mov esp, ebp
pop ebp
ret 8
Function at 0x503581
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], esp
push 1
push 0x557300
push 0x557300
mov ebx, dword [ebp + 8]
push dword [ebx]
push 0x57a96f
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x5035c7
push 6
call fcn.0052f61d
add esp, 4
mov esp, ebp
pop ebp
ret 4
Function at 0x5099cb
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
push dword [ebp + 0x14]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x509a0b
push 6
call fcn.0052f61d
add esp, 4
jmp 0x509a10
mov esp, ebp
pop ebp
ret 0x14

Function at 0x509a16
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
push dword [ebp + 0x14]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x509a56
push 6
call fcn.0052f61d
add esp, 4
jmp 0x509a5b
mov esp, ebp
pop ebp
ret 0x14