joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407310
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe64
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x19c], ecx
mov dword [ebp - 0x198], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404c20
xor eax, eax
push ebp
push 0x407457
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.004047d8
lea eax, [ebp - 0x194]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
xor edx, edx
push ebp
push 0x407422
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.00404c30
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x407418
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x40740e
cmp dword [ebp - 4], 0
jne 0x4073fa
mov eax, dword [esi + ebx*4]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 0x198]
call fcn.00405090
mov edx, dword [ebp - 0x198]
mov eax, 0x40746c
call fcn.004050cc
dec eax
je 0x40740d
mov eax, dword [esi + ebx*4]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 0x19c]
call fcn.00405090
mov edx, dword [ebp - 0x19c]
mov eax, 0x407478
call fcn.004050cc
dec eax
je 0x40740d
mov eax, dword [esi + ebx*4]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, edi
call fcn.004049d0
jmp 0x407418
mov eax, dword [esi + ebx*4]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, edi
call fcn.004049d0
inc ebx
cmp dword [esi + ebx*4], 0
jne 0x40738b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40742c
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40745e
lea eax, [ebp - 0x19c]
mov edx, 2
call fcn.00404f94
lea eax, [ebp - 4]
call fcn.004047d8
ret

Function at 0x407480
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404c30
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x407499
test al, 0x10
jne 0x40749d
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x408a04
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor ecx, ecx
mov dword [ebp - 0x10c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404c20
xor eax, eax
push ebp
push 0x408a93
push dword fs:[eax]
mov dword fs:[eax], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
mov ecx, 0x101
call fcn.00404a48
push dword [ebp - 0x10c]
push 0x408aa8
push dword [ebp - 4]
mov eax, ebx
mov edx, 3
call fcn.00404b34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408a9a
lea eax, [ebp - 0x10c]
call fcn.004047d8
lea eax, [ebp - 4]
call fcn.004047d8
ret
Function at 0x408aac
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404c20
mov eax, dword [ebp - 8]
call fcn.00404c20
xor eax, eax
push ebp
push 0x408b89
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 1
mov eax, dword [ebp - 8]
call fcn.00404c30
push eax
push 0
push 0
call fcn.00405aa4
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
jne 0x408b03
mov ebx, 2
cmp ebx, 1
jne 0x408b6e
push 0
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00408a04
mov eax, dword [ebp - 0xc]
call fcn.00404c30
push eax
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.00402fd4
mov eax, dword [ebp - 0x10]
call fcn.00404c30
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
jne 0x408b3c
xor ebx, ebx
cmp ebx, 1
jne 0x408b6e
push 0x408b98
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 4]
mov edx, 0x408bac
call fcn.00404ab8
mov eax, dword [ebp - 0x14]
call fcn.00404c30
push eax
push 0x408bbc
push 0x408bc4
call sub.kernel32.dll_WritePrivateProfileStringA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408b90
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.004047fc
ret

Function at 0x408cdc
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe68
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x198], edx
mov dword [ebp - 0x194], edx
mov edi, eax
xor eax, eax
push ebp
push 0x408dfa
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x190]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
xor edx, edx
push ebp
push 0x408dcd
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x408dc3
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x408db9
mov eax, dword [esi + ebx*4]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 0x194]
call fcn.00405090
mov edx, dword [ebp - 0x194]
mov eax, 0x408e0c
call fcn.004050cc
dec eax
je 0x408db8
mov eax, dword [esi + ebx*4]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 0x198]
call fcn.00405090
mov edx, dword [ebp - 0x198]
mov eax, 0x408e18
call fcn.004050cc
dec eax
je 0x408db8
mov eax, dword [esi + ebx*4]
movzx eax, byte [eax]
mov byte [edi + 4], al
mov eax, dword [esi + ebx*4]
movzx eax, byte [eax + 1]
mov byte [edi + 5], al
mov eax, dword [esi + ebx*4]
movzx eax, byte [eax + 2]
mov byte [edi + 6], al
mov eax, dword [esi + ebx*4]
movzx eax, byte [eax + 3]
mov byte [edi + 7], al
jmp 0x408dc3
inc ebx
cmp dword [esi + ebx*4], 0
jne 0x408d3b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x408dd7
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408e01
lea eax, [ebp - 0x198]
mov edx, 2
call fcn.00404f94
ret
Function at 0x408e48
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, edx
mov eax, ebx
call fcn.00404c30
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x408e65
and eax, 0x10
cmp eax, 0x10
je 0x408e69
xor eax, eax
jmp 0x408e6b
mov al, 1
neg al
sbb eax, eax
pop ebx
ret
Function at 0x409ca8
Capabilities:
Act as tcp client
Check internet connectivity via wininet
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov ebx, eax
xor ebp, ebp
xor edi, edi
lea eax, [ebx + 0x10]
call fcn.004047d8
jmp 0x409cc9
push 0x3e8
call sub.kernel32.dll_Sleep_1
push 0
push 0
call sub.wininet.dll_InternetGetConnectedState
test eax, eax
je 0x409cbf
cmp ebp, 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x409d2a
mov eax, dword [ebx + 0x10]
mov edx, 0x409e00
call fcn.00404bc8
jne 0x409cf9
lea eax, [ebx + 0x10]
call fcn.004047d8
jmp 0x409d32
mov eax, dword [ebx + 0x10]
mov edx, 0x409e0c
call fcn.00404bc8
jne 0x409d15
lea eax, [ebx + 0x10]
mov edx, 0x409e00
call fcn.0040482c
cmp dword [ebx + 0x10], 0
jne 0x409d32
lea eax, [ebx + 0x10]
mov edx, 0x409e0c
call fcn.0040482c
jmp 0x409d32
lea eax, [ebx + 0x10]
call fcn.004047d8
mov eax, ebx
call fcn.00409af4
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
mov word [esp], 2
push 0x8b
call sub.wsock32.dll_htons
mov word [esp + 2], ax
mov eax, dword [ebx + 0x10]
call fcn.00404c30
push eax
call sub.wsock32.dll_inet_addr
mov dword [esp + 4], eax
push 0x10
lea eax, [esp + 4]
push eax
push esi
call sub.wsock32.dll_connect
inc eax
je 0x409d82
or edi, 0xffffffff
jmp 0x409dbc
mov word [esp], 2
push 0x1bd
call sub.wsock32.dll_htons
mov word [esp + 2], ax
mov eax, dword [ebx + 0x10]
call fcn.00404c30
push eax
call sub.wsock32.dll_inet_addr
mov dword [esp + 4], eax
push 0x10
lea eax, [esp + 4]
push eax
push esi
call sub.wsock32.dll_connect
inc eax
je 0x409dbc
or edi, 0xffffffff
test edi, edi
je 0x409ddf
push esi
call sub.wsock32.dll_closesocket
lea eax, [ebx + 0x14]
mov ecx, dword [ebx + 0x10]
mov edx, 0x409e18
call fcn.00404ab8
mov eax, ebx
call fcn.004099cc
mov ebp, eax
push 0x200
call sub.kernel32.dll_Sleep_1
jmp 0x409cc9
Function at 0x40a054
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffa88
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x578], ebx
mov dword [ebp - 0x568], ebx
mov dword [ebp - 0x56c], ebx
mov dword [ebp - 0x570], ebx
mov dword [ebp - 0x574], ebx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404c20
lea edi, [ebp - 8]
xor eax, eax
push ebp
push 0x40a25e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xde
call fcn.0040305c
inc eax
lea edx, [ebp - 0x568]
call fcn.004082ec
push dword [ebp - 0x568]
push 0x40a274
mov eax, 0xff
call fcn.0040305c
inc eax
lea edx, [ebp - 0x56c]
call fcn.004082ec
push dword [ebp - 0x56c]
push 0x40a274
mov eax, 0xff
call fcn.0040305c
inc eax
lea edx, [ebp - 0x570]
call fcn.004082ec
push dword [ebp - 0x570]
push 0x40a274
mov eax, 0xff
call fcn.0040305c
inc eax
lea edx, [ebp - 0x574]
call fcn.004082ec
push dword [ebp - 0x574]
lea eax, [esi + 0xc]
mov edx, 7
call fcn.00404b34
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov ebx, eax
mov word [ebp - 0x164], 2
mov eax, dword [esi + 0xc]
call fcn.00404c30
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x160], eax
push 0xc37
call sub.wsock32.dll_htons
mov word [ebp - 0x162], ax
test ebx, ebx
jle 0x40a238
push 0x10
lea eax, [ebp - 0x164]
push eax
push ebx
call sub.wsock32.dll_connect
test eax, eax
jne 0x40a238
push 0
push 5
push 0x40d9d4
push ebx
call sub.wsock32.dll_send
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x154]
call fcn.00403340
mov eax, dword [0x40d9f0]
mov byte [eax], 0
mov edx, 1
lea eax, [ebp - 0x154]
call fcn.0040392c
call fcn.00402d7c
push edi
lea edx, [ebp - 0x564]
mov ecx, 0x400
lea eax, [ebp - 0x154]
call fcn.004034a0
call fcn.00402d7c
cmp dword [edi], 0
jle 0x40a1fd
push 0
mov eax, dword [edi]
push eax
lea eax, [ebp - 0x564]
push eax
push ebx
call sub.wsock32.dll_send
test eax, eax
jle 0x40a1fd
cmp dword [edi], 0x400
je 0x40a1be
push ebx
call sub.wsock32.dll_closesocket
lea eax, [ebp - 0x154]
call fcn.004034c0
call fcn.00402d7c
mov ecx, dword [esi + 0xc]
lea eax, [ebp - 0x578]
mov edx, 0x40a280
call fcn.00404ab8
mov edx, dword [ebp - 0x578]
mov eax, dword [0x40d9ec]
mov eax, dword [eax]
call fcn.00406768
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a265
lea eax, [ebp - 0x578]
mov edx, 5
call fcn.004047fc
lea eax, [ebp - 4]
call fcn.004047d8
ret

Function at 0x40a288
Capabilities:
Check internet connectivity via wininet
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe6c
push ebx
xor edx, edx
mov dword [ebp - 0x194], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40a311
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x40a2b6
push 0x3e8
call sub.kernel32.dll_Sleep_1
push 0
push 0
call sub.wininet.dll_InternetGetConnectedState
test eax, eax
je 0x40a2ac
lea eax, [ebp - 0x190]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
lea edx, [ebp - 0x194]
xor eax, eax
call fcn.00402fd4
mov edx, dword [ebp - 0x194]
mov ecx, dword [ebx + 0xc]
mov eax, ebx
call fcn.0040a054
call sub.wsock32.dll_WSACleanup
jmp 0x40a2b6
Function at 0x40a374
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404c20
xor eax, eax
push ebp
push 0x40a3c7
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, bl
push eax
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404c30
push eax
push 0x40a3d4
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a3ce
lea eax, [ebp - 4]
call fcn.004047d8
ret

Function at 0x40a430
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe64
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x19c], ecx
mov dword [ebp - 0x198], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404c20
xor eax, eax
push ebp
push 0x40a577
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.004047d8
lea eax, [ebp - 0x194]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
xor edx, edx
push ebp
push 0x40a542
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.00404c30
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x40a538
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x40a52e
cmp dword [ebp - 4], 0
jne 0x40a51a
mov eax, dword [esi + ebx*4]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 0x198]
call fcn.00405090
mov edx, dword [ebp - 0x198]
mov eax, 0x40a58c
call fcn.004050cc
dec eax
je 0x40a52d
mov eax, dword [esi + ebx*4]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 0x19c]
call fcn.00405090
mov edx, dword [ebp - 0x19c]
mov eax, 0x40a598
call fcn.004050cc
dec eax
je 0x40a52d
mov eax, dword [esi + ebx*4]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, edi
call fcn.004049d0
jmp 0x40a538
mov eax, dword [esi + ebx*4]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, edi
call fcn.004049d0
inc ebx
cmp dword [esi + ebx*4], 0
jne 0x40a4ab
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40a54c
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a57e
lea eax, [ebp - 0x19c]
mov edx, 2
call fcn.00404f94
lea eax, [ebp - 4]
call fcn.004047d8
ret

Function at 0x40a704
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebx
push ecx
mov ebx, eax
mov dword [esp], 2
push 0
lea eax, [esp + 4]
push eax
call sub.wininet.dll_InternetGetConnectedState
test eax, eax
je 0x40a736
mov eax, dword [esp]
and eax, 2
cmp eax, 2
jne 0x40a736
mov eax, ebx
mov edx, 0x40a770
call fcn.0040482c
mov dword [esp], 1
push 0
lea eax, [esp + 4]
push eax
call sub.wininet.dll_InternetGetConnectedState
test eax, eax
je 0x40a764
mov eax, dword [esp]
and eax, 1
cmp eax, 1
jne 0x40a764
mov eax, ebx
mov edx, 0x40a77c
call fcn.0040482c
pop edx
pop ebx
ret
Function at 0x40a784
Capabilities:
Check os version

Disassembly:
push ebx
add esp, 0xffffff6c
mov ebx, eax
mov eax, ebx
mov edx, 0x40a8b4
call fcn.0040482c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x40a896
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x10]
dec ecx
je 0x40a81e
dec ecx
jne 0x40a888
cmp eax, 4
jg 0x40a7da
mov eax, ebx
mov edx, 0x40a8c4
call fcn.0040482c
jmp 0x40a8a2
cmp eax, 5
jne 0x40a7f4
test edx, edx
jne 0x40a7f4
mov eax, ebx
mov edx, 0x40a8d4
call fcn.0040482c
jmp 0x40a8a2
cmp eax, 5
jne 0x40a80d
dec edx
jne 0x40a80d
mov eax, ebx
mov edx, 0x40a8e4
call fcn.0040482c
jmp 0x40a8a2
mov eax, ebx
mov edx, 0x40a8b4
call fcn.0040482c
jmp 0x40a8a2
cmp eax, 4
jne 0x40a835
test edx, edx
jne 0x40a835
mov eax, ebx
mov edx, 0x40a8f4
call fcn.0040482c
jmp 0x40a8a2
cmp eax, 4
jne 0x40a862
cmp edx, 0xa
jne 0x40a862
cmp byte [esp + 0x15], 0x41
jne 0x40a854
mov eax, ebx
mov edx, 0x40a904
call fcn.0040482c
jmp 0x40a8a2
mov eax, ebx
mov edx, 0x40a914
call fcn.0040482c
jmp 0x40a8a2
cmp eax, 4
jne 0x40a87a
cmp edx, 0x5a
jne 0x40a87a
mov eax, ebx
mov edx, 0x40a924
call fcn.0040482c
jmp 0x40a8a2
mov eax, ebx
mov edx, 0x40a8b4
call fcn.0040482c
jmp 0x40a8a2
mov eax, ebx
mov edx, 0x40a8b4
call fcn.0040482c
jmp 0x40a8a2
mov eax, ebx
mov edx, 0x40a8b4
call fcn.0040482c
add esp, 0x94
pop ebx
ret
Function at 0x40b1f8
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe58
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1a8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404c20
lea edi, [ebp - 0x14]
xor eax, eax
push ebp
push 0x40b2c6
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x1a8]
mov eax, dword [ebp - 4]
call fcn.0040a430
mov edx, dword [ebp - 0x1a8]
lea eax, [ebp - 4]
call fcn.00404870
lea eax, [ebp - 0x1a4]
push eax
push 0x102
call sub.wsock32.dll_WSAStartup
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov ebx, eax
mov word [edi], 2
push esi
call sub.wsock32.dll_htons
mov word [edi + 2], ax
mov eax, dword [ebp - 4]
call fcn.00404c30
push eax
call sub.wsock32.dll_inet_addr
mov dword [edi + 4], eax
push 0x10
push edi
push ebx
call sub.wsock32.dll_connect
inc eax
jle 0x40b29e
mov eax, dword [0x40d9ec]
mov dword [eax], ebx
mov eax, ebx
call fcn.0040aa80
call sub.wsock32.dll_WSACleanup
jmp 0x40b246

Function at 0x40c0d4
Capabilities:
Check internet connectivity via wininet
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, 0x40b370
call fcn.00405a30
mov ebx, 0x42e4ec
xor eax, eax
push ebp
push 0x40c253
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x40c268
mov eax, 0x40c280
call fcn.00408aac
sub eax, 1
jb 0x40c116
dec eax
je 0x40c11f
jmp 0x40c126
push 0
call sub.kernel32.dll_ExitProcess_1
push 0
call sub.kernel32.dll_ExitProcess_1
mov eax, dword [0x40d9e4]
xor ecx, ecx
mov edx, 0x2710
call fcn.004035b8
mov eax, dword [0x40d9e0]
xor ecx, ecx
mov edx, 0x2710
call fcn.004035b8
mov eax, dword [0x40d9f4]
xor ecx, ecx
mov edx, 0x2710
call fcn.004035b8
jmp 0x40c165
push 0x3e8
call sub.kernel32.dll_Sleep_1
push 0
push 0
call sub.wininet.dll_InternetGetConnectedState
test eax, eax
je 0x40c15b
mov eax, dword [0x40d9e8]
mov edx, 0x40c294
call fcn.0040482c
mov eax, dword [0x40d9e8]
add eax, 4
mov edx, 0x40c2a0
call fcn.0040482c
mov eax, dword [0x40d9e8]
add eax, 8
mov edx, 0x40c2ac
call fcn.0040482c
push 0x42e4e8
push 0
mov eax, dword [0x40d9e8]
push eax
push fcn.004084ac
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov eax, dword [0x40d9f8]
mov edx, 0x40c2b8
call fcn.0040482c
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.00408a04
mov edx, dword [ebp - 0x14]
mov eax, dword [0x40d9f8]
add eax, 4
call fcn.0040482c
push 0x42e4e8
push 0
mov eax, dword [0x40d9f8]
push eax
push 0x407c3c
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov ax, 0xff
call fcn.00409f44
mov ax, 0xff
call fcn.0040a334
mov edx, 0x1a0b
mov eax, 0x40c2d0
call fcn.0040b1f8
jmp 0x40c22d
push ebx
call sub.user32.dll_DispatchMessageA
push 0
push 0
push 0
push ebx
call sub.user32.dll_GetMessageA
test eax, eax
jne 0x40c227
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c25a
lea eax, [ebp - 0x14]
call fcn.004047d8
ret
Function at 0x401ad0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._vfprintf
call sym._abort
jmp dbg.mark_section_writable

Function at 0x401b30
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x406054]
test esi, esi
jle 0x401c1d
mov edi, dword [0x406058]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x401b64
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x401c16
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x401b50
mov dword [esp], eax
mov ebx, eax
call dbg.__mingw_GetSectionForAddress
test eax, eax
mov edi, eax
je 0x401c5a
lea ebx, [esi + esi*2]
mov esi, dword [0x406058]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call dbg._GetPEImageBase
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x406058]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401c3a
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x401c0f
sub eax, 0x40
and eax, 0xffffffbf
je 0x401c0f
mov eax, dword [esp + 0x20]
add ebx, dword [0x406058]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x401c24
add dword [0x406054], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor esi, esi
jmp 0x401b6e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
mov eax, dword [0x406058]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
Function at 0x402120
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x406408
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x406400]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x402175
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40216e
test esi, esi
je 0x40216e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402150
mov dword [esp], 0x406408
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x402390
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x4023c8
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp edx, ebx
ja 0x4023be
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x4023ca
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x4023b0
xor eax, eax
pop ebx
pop esi
ret

Function at 0x402b80
Capabilities:
Resume thread
Suspend thread

Disassembly:
push esi
push ebx
mov esi, eax
sub esp, 0x2e4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
sub esp, 4
cmp eax, 0xffffffff
jne 0x402bb0
add esp, 0x2e4
mov eax, 0xffffffff
pop ebx
pop esi
ret
lea eax, [esp + 0x14]
mov dword [esp], esi
mov dword [esp + 0x14], 0x10003
mov ebx, 0xffffffff
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
sub esp, 8
test eax, eax
cmovne ebx, dword [esp + 0xcc]
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
sub esp, 4
add esp, 0x2e4
mov eax, ebx
pop ebx
pop esi
ret
Function at 0x430001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408ecc
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x7dae5440
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x16d36144
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219