joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405334
Capabilities:
Check for peb beingdebugged flag
Get common file path

Disassembly:
push ebx
push esi
push edi
mov edi, dword fs:[0x30]
push 0x104
mov esi, 0x42a580
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.explorer.exe
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
call dword [sym.imp.ntdll.dll_RtlAcquirePebLock]
mov eax, dword [edi + 0x10]
mov ecx, esi
lea edx, [ecx + 2]
mov bx, word [ecx]
add ecx, 2
test bx, bx
jne 0x405369
sub ecx, edx
sar ecx, 1
add ecx, ecx
mov word [eax + 0x38], cx
add ecx, 2
mov word [eax + 0x3a], cx
push 0x18
mov dword [eax + 0x3c], esi
mov eax, dword [edi + 0x10]
pop ecx
push 0x1a
mov word [eax + 0x40], cx
pop ecx
mov word [eax + 0x42], cx
mov dword [eax + 0x44], 0x407dfc
call dword [sym.imp.ntdll.dll_RtlReleasePebLock]
push 0
push 0x4052cc
push 0
call dword [sym.imp.ntdll.dll_LdrEnumerateLoadedModules]
pop edi
pop esi
pop ebx
ret

Function at 0x405569
Capabilities:
Create thread

Disassembly:
push ebx
xor ebx, ebx
cmp byte [0x40a35c], bl
je 0x4055c1
call fcn.00405cd5
test al, al
je 0x4055c1
push esi
call dword [sym.imp.ole32.dll_CoUninitialize]
push ebx
push ebx
push ebx
push 0x405439
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
push ebx
push ebx
push ebx
push 3
push 6
push ebx
push ebx
push 0xffffffffffffffff
push ebx
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
pop esi
pop ebx
ret
Function at 0x4055ef
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
push esi
push edi
mov edi, 0xfffe
call fcn.00402307
mov esi, eax
xor edi, edi
mov dword [ebp - 4], esi
cmp esi, edi
je 0x4057a5
cmp dword [ebp + 0x10], edi
je 0x40579c
cmp dword [ebp + 8], edi
je 0x40579c
cmp dword [ebp + 0xc], edi
je 0x40579c
cmp dword [ebp + 0x18], edi
je 0x40579c
push dword [ebp + 8]
mov eax, 0x4080a0
push esi
call fcn.004055c3
pop ecx
pop ecx
test al, al
je 0x40579c
push 0x250
lea eax, [ebp - 0x258]
push edi
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x258]
push eax
push esi
mov dword [ebp - 0x25c], 1
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x40579c
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
mov ebx, dword [ebp + 0x14]
cmp word [ebp - 0x22c], 0x2e
jne 0x4056c2
cmp word [ebp - 0x22a], 0
je 0x405771
cmp word [ebp - 0x22a], 0x2e
jne 0x4056c2
cmp word [ebp - 0x228], 0
je 0x405771
mov eax, dword [ebp - 0x258]
and eax, 0x10
je 0x4056d2
test bl, 2
jne 0x4056db
test eax, eax
jne 0x405723
test bl, 4
je 0x405723
xor esi, esi
cmp dword [ebp + 0x10], esi
jbe 0x405723
mov eax, dword [ebp + 0xc]
push dword [eax + esi*4]
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
jne 0x405701
inc esi
cmp esi, dword [ebp + 0x10]
jb 0x4056e2
jmp 0x405723
push dword [ebp + 0x1c]
lea eax, [ebp - 0x25c]
push eax
push dword [ebp + 8]
call dword [ebp + 0x18]
add esp, 0xc
test eax, eax
je 0x40578b
cmp dword [ebp + 0x24], 0
je 0x405723
push dword [ebp + 0x24]
call edi
test byte [ebp - 0x258], 0x10
je 0x405771
test bl, 1
je 0x405771
push dword [ebp + 8]
lea eax, [ebp - 0x22c]
push dword [ebp - 4]
call fcn.004055c3
pop ecx
pop ecx
test al, al
je 0x405771
cmp dword [ebp + 0x20], 0
je 0x405753
push dword [ebp + 0x20]
call edi
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.004055ef
add esp, 0x20
lea eax, [ebp - 0x258]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x405692
jmp 0x405792
and dword [ebp - 0x25c], 0
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebx
push dword [ebp - 4]
call fcn.004023f0
pop ecx
pop edi
pop esi
leave
ret
Function at 0x4057a9
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
mov edi, 0xfffe
xor ebx, ebx
call fcn.00402307
mov esi, eax
cmp esi, ebx
je 0x405828
push ebx
push esi
push 0x7fff
push ebx
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
je 0x405821
push ebx
push ebx
lea eax, [ebp - 0xc]
push eax
push esi
call dword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
test al, al
je 0x405821
lea eax, [ebp - 0xc]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x24], 0x18
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], 0x40
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ntdll.dll_ZwDeleteFile]
test eax, eax
lea eax, [ebp - 0xc]
push eax
setns bl
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
push esi
call fcn.004023f0
pop ecx
pop edi
pop esi
mov al, bl
pop ebx
leave
ret

Function at 0x40582f
Capabilities:
Set file attributes

Disassembly:
push edi
push 0x80
push esi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x405860
mov ecx, edi
inc edi
cmp ecx, 0x14
jg 0x405874
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 2
neg eax
sbb eax, eax
inc eax
jne 0x405874
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call fcn.004057a9
pop ecx
xor ecx, ecx
test al, al
setne cl
mov eax, ecx
test eax, eax
je 0x405840
pop edi
ret

Function at 0x405876
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1414
call fcn.00406000
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
xor ebx, ebx
call fcn.00402307
mov edi, eax
cmp edi, esi
je 0x405916
push edi
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0x4080ac
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov esi, dword [sym.imp.VERSION.dll_VerQueryValueW]
push edi
call esi
cmp dword [ebp - 4], 4
jb 0x40590f
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 2]
movzx eax, word [eax]
push 0x4080e0
push ecx
push eax
lea eax, [ebp - 0x1414]
push str.StringFileInfo_04x_04x_s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1414]
push eax
push edi
call esi
test eax, eax
je 0x40590f
push dword [ebp - 0xc]
call fcn.00402966
pop ecx
mov ebx, eax
push edi
call fcn.004023f0
pop ecx
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x405967
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
xor eax, eax
push esi
push edi
cmp dword [ebp + 8], eax
jne 0x40597e
xor eax, eax
jmp 0x405a00
cmp dword [ebp + 0xc], eax
je 0x405977
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
mov edi, 0x2000000
push edi
push 3
push eax
push 1
push closesocket
push dword [ebp + 8]
mov dword [ebp - 4], eax
call esi
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4059fd
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileTime]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
xor eax, eax
push eax
push edi
push 3
push eax
push eax
push 0x100
push dword [ebp + 0xc]
call esi
mov esi, eax
cmp esi, 0xffffffff
je 0x4059fd
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
neg eax
sbb eax, eax
neg eax
push esi
mov dword [ebp - 4], eax
call ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x405a6a
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
push esi
push edi
lea eax, [ebp - 0x428]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x405b2b
lea eax, [ebp - 0x218]
push eax
push 0
push 0x4080a4
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x405b2b
lea esi, [ebp - 0x218]
call fcn.0040582f
mov eax, esi
push eax
call fcn.00402966
mov esi, eax
pop ecx
mov dword [ebp - 4], esi
test esi, esi
je 0x405b2b
push 0
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x405b24
push 2
push 0
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
je 0x405b1c
push 1
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov edi, eax
test edi, edi
je 0x405b15
push edi
push 0x405a05
push 0xa
push esi
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [ebp - 4]
call fcn.0040582f
push esi
call fcn.004023f0
pop ecx
pop edi
pop esi
leave
ret

Function at 0x405c06
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 0x24], 0
push edi
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor eax, eax
cmp word [ebp - 0x24], 9
pop edi
sete al
leave
ret
Function at 0x405e1c
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, 0x40a360
push edi
xor bl, bl
call dword [sym.imp.SHLWAPI.dll_PathSkipRootW]
mov esi, eax
test esi, esi
jne 0x405e36
mov esi, edi
movzx eax, word [esi]
cmp eax, 0x5c
je 0x405e48
cmp eax, 0x2f
je 0x405e48
test ax, ax
jne 0x405e74
mov ebp, eax
xor eax, eax
push edi
mov word [esi], ax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x405e68
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jmp 0x405e6a
test al, 0x10
je 0x405e7b
test bp, bp
je 0x405e79
mov word [esi], bp
add esi, 2
jmp 0x405e36
mov bl, 1
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
ret
Function at 0x4011a2
Capabilities:
Compiled with perl2exe
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
lea eax, [ebp - 0x104]
push esi
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push eax
call section..text
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x4011d3
lea eax, [ebp - 0x104]
push eax
jmp 0x4011d8
push str.p2xlib.dll
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x4011f4
push str.ERROR:_LoadLibrary_p2xlib.dll_failed_n
call dword [sym.imp.MSVCRT.dll_printf]
pop ecx
push 1
jmp 0x401217
push str.RunPerl
push esi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
mov dword [0x403404], eax
jne 0x40121a
push str.ERROR:_GetProcAddress_p2xlib.dll_failed_n
call dword [sym.imp.MSVCRT.dll_printf]
pop ecx
push 2
pop eax
jmp 0x401247
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
add esp, 0xc
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
test ebx, ebx
je 0x401244
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.MSVCRT.dll_remove]
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401258
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x180
push ebx
push esi
push edi
push 0x8000
push dword [ebp + 0xc]
call dword [sym.imp.MSVCRT.dll__open]
mov esi, dword [ebp + 8]
pop ecx
cmp eax, 0xffffffff
pop ecx
mov dword [esi], eax
jne 0x40128d
push str.Error:_Cant_open_archive_file_n
call fcn.00401873
jmp 0x4013a6
mov ebx, dword [sym.imp.MSVCRT.dll__lseek]
push 2
push 0xffffff00
push eax
call ebx
mov edi, 0x100
lea eax, [ebp - 0x100]
push edi
push eax
push dword [esi]
call dword [sym.imp.MSVCRT.dll__read]
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0x100]
push edi
push eax
call fcn.00401c02
lea eax, [ebp - 0x100]
push str.NAMEP2X_V06.TOC
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 0x2c
lea edx, [ebp - 0x100]
cmp eax, edx
push 6
pop ecx
jne 0x4012ed
mov dword [esi + 0x10], ecx
jmp 0x4012f1
and dword [esi + 0x10], 0
cmp dword [esi + 0x10], ecx
jne 0x401351
push 2
push 0
push dword [esi]
call ebx
mov ebx, eax
lea eax, [ebp - 0x100]
push str.SIZE
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
lea ecx, [ebp + 0xc]
add eax, 5
push ecx
push 0x403160
push eax
call dword [sym.imp.MSVCRT.dll_sscanf]
sub ebx, dword [ebp + 0xc]
push 0
push dword [ebp + 0xc]
sub ebx, edi
push ebx
push esi
call fcn.00401787
push eax
mov dword [esi + 0x14], eax
push dword [ebp + 0xc]
push eax
call fcn.00401c02
mov eax, dword [esi + 0x14]
add esp, 0x3c
mov dword [esi + 0x18], eax
jmp 0x40145c
push 0
push 0
push dword [esi]
call ebx
lea eax, [ebp - 0x180]
push str.dbload_1.0
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x180]
push str._signature_r_n
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x180]
push eax
call sub.MSVCRT.dll_strlen
push eax
lea eax, [ebp - 0x180]
push eax
push dword [esi]
call fcn.00401969
add esp, 0x2c
cmp eax, 0xffffffff
jne 0x4013ae
push dword [esi]
call dword [sym.imp.MSVCRT.dll__close]
pop ecx
xor eax, eax
jmp 0x40145f
and byte [ebp - 0x100], 0
lea eax, [ebp - 0x100]
push edi
push eax
push dword [esi]
call fcn.00401a2e
lea eax, [ebp - 0x100]
push eax
call sub.MSVCRT.dll_strlen
mov ebx, dword [sym.imp.MSVCRT.dll_malloc]
inc eax
push eax
call ebx
lea ecx, [ebp - 0x100]
mov dword [esi + 4], eax
push ecx
push eax
call sub.MSVCRT.dll_strcpy
and byte [ebp - 0x100], 0
lea eax, [ebp - 0x100]
push edi
push eax
push dword [esi]
call fcn.00401a2e
lea eax, [ebp - 0x100]
push eax
call sub.MSVCRT.dll_strlen
inc eax
push eax
call ebx
lea ecx, [ebp - 0x100]
mov dword [esi + 8], eax
push ecx
push eax
call sub.MSVCRT.dll_strcpy
and byte [ebp - 0x100], 0
lea eax, [ebp - 0x100]
push edi
push eax
push dword [esi]
call fcn.00401a2e
add esp, 0x44
lea eax, [ebp - 0x100]
push eax
call sub.MSVCRT.dll_strlen
inc eax
push eax
call ebx
lea ecx, [ebp - 0x100]
mov dword [esi + 0xc], eax
push ecx
push eax
call sub.MSVCRT.dll_strcpy
add esp, 0x10
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401618
Capabilities:
Query environment variable
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
push edi
push dword [ebp + 0x18]
call dword [sym.imp.MSVCRT.dll_malloc]
mov edi, dword [ebp + 8]
mov esi, dword [sym.imp.MSVCRT.dll__lseek]
push 0
mov dword [ebp - 4], eax
push dword [ebp + 0x14]
push dword [edi]
call esi
push dword [ebp + 0xc]
mov ebx, eax
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x108]
push 0x403238
push eax
call sub.MSVCRT.dll_strcat
push dword [ebp + 0x10]
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_strcat
push 0x1ff
lea eax, [ebp - 0x108]
push 0x8302
push eax
call dword [sym.imp.MSVCRT.dll__open]
mov ecx, dword [ebp + 0x18]
add esp, 0x34
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
mov dword [ebp + 0x14], ecx
je 0x401709
test ecx, ecx
je 0x4016fd
mov eax, dword [ebp + 0x14]
cmp eax, dword [ebp + 0x18]
jle 0x4016aa
mov eax, dword [ebp + 0x18]
mov ebx, dword [ebp - 4]
push eax
push ebx
push dword [edi]
call dword [sym.imp.MSVCRT.dll__read]
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
je 0x4016fd
cmp dword [ebp + 0x1c], 0
je 0x4016d2
push ebx
push esi
push ebx
call fcn.00401c02
add esp, 0xc
push esi
push ebx
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll__write]
add esp, 0xc
cmp eax, 0xffffffff
je 0x4016ea
sub dword [ebp + 0x14], esi
jmp 0x40169d
lea eax, [ebp - 0x108]
push eax
push str.ERROR:_Cant_write_to__s_n
call fcn.00401873
pop ecx
pop ecx
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll__close]
pop ecx
jmp 0x40176f
lea eax, [ebp - 0x108]
push eax
call fcn.004017ec
test eax, eax
pop ecx
jne 0x401760
lea eax, [ebp - 0x108]
push eax
push str.ERROR:_Cant_create__s_n
call fcn.00401873
cmp dword [0x4030a0], 0
pop ecx
pop ecx
je 0x401758
push str.SERVER_SOFTWARE
call dword [sym.imp.MSVCRT.dll_getenv]
test eax, eax
pop ecx
je 0x401758
and dword [0x4030a0], 0
push str._br_Try_building_your_application_with_a__tiny_option_n
call fcn.00401873
pop ecx
push 1
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp + 0x18]
push 0
add ebx, eax
push ebx
push dword [edi]
call esi
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.MSVCRT.dll_free]
mov eax, dword [ebp + 0x14]
pop ecx
neg eax
sbb eax, eax
pop edi
pop esi
and al, 0xfe
pop ebx
leave
ret

Function at 0x401787
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x14]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
mov ebx, eax
pop ecx
test ebx, ebx
je 0x4017e9
and byte [ebx + esi], 0
push edi
mov edi, dword [esp + 0x10]
push 0
push dword [esp + 0x18]
push dword [edi]
call dword [sym.imp.MSVCRT.dll__lseek]
push esi
push ebx
push dword [edi]
call dword [sym.imp.MSVCRT.dll__read]
add esp, 0x18
cmp eax, esi
pop edi
je 0x4017d5
push eax
push str.P2X:_I_O_error_1___d__n
call dword [sym.imp.MSVCRT.dll_printf]
pop ecx
pop ecx
cmp dword [esp + 0x18], 0
je 0x4017e7
push ebx
push esi
push ebx
call fcn.00401c02
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x401873
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1100
call fcn.00401ce0
push ebx
push esi
lea eax, [ebp + 0xc]
push edi
push eax
lea eax, [ebp - 0x1100]
push dword [ebp + 8]
xor ebx, ebx
mov byte [ebp - 0x1100], bl
push eax
call sub.MSVCRT.dll_strlen
pop ecx
lea eax, [ebp + eax - 0x1100]
push eax
call dword [sym.imp.MSVCRT.dll_vsprintf]
mov esi, dword [sym.imp.MSVCRT.dll_getenv]
add esp, 0xc
cmp dword [0x4030ac], ebx
mov edi, str.SERVER_SOFTWARE
je 0x4018ed
lea eax, [ebp - 0x1100]
mov dword [0x4030ac], ebx
push eax
call sub.MSVCRT.dll_strlen
test eax, eax
pop ecx
jbe 0x4018ed
push edi
call esi
test eax, eax
pop ecx
je 0x4018ed
push str.Content_type:_text_html_n_n
call fcn.00401873
pop ecx
push ebx
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push edi
call esi
test eax, eax
pop ecx
jne 0x401932
lea eax, [ebp - 0x100]
push 0x100
push eax
call dword [sym.imp.KERNEL32.DLL_GetConsoleTitleA]
test eax, eax
jne 0x401932
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
je 0x401932
push ebx
lea eax, [ebp - 0x1100]
push str.Perl2Exe
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x401950
lea eax, [ebp - 0x1100]
push eax
call dword [sym.imp.MSVCRT.dll_printf]
mov eax, dword [sym.imp.MSVCRT.dll__iob]
add eax, 0x20
push eax
call dword [sym.imp.MSVCRT.dll_fflush]
pop ecx
pop ecx
push edi
call esi
pop ecx
pop edi
pop esi
pop ebx
test eax, eax
je 0x401967
push str._br__n
call dword [sym.imp.MSVCRT.dll_printf]
pop ecx
leave
ret

Function at 0x401969
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
push edi
mov edi, 0xc800
push edi
call dword [sym.imp.MSVCRT.dll_malloc]
test eax, eax
pop ecx
mov dword [ebp - 8], eax
jne 0x401990
or eax, 0xffffffff
jmp 0x401a2b
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
push dword [ebp - 8]
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll__read]
or esi, 0xffffffff
add esp, 0xc
cmp eax, esi
mov dword [ebp - 0xc], eax
je 0x401a13
cmp eax, ebx
jbe 0x401a13
mov dword [ebp + 0x10], eax
xor esi, esi
sub dword [ebp + 0x10], ebx
je 0x4019d9
mov eax, dword [ebp - 8]
push ebx
push dword [ebp + 0xc]
add eax, esi
push eax
call sub.MSVCRT.dll_memcmp
add esp, 0xc
test eax, eax
je 0x4019fa
inc esi
cmp esi, dword [ebp + 0x10]
jb 0x4019bd
cmp dword [ebp - 0xc], edi
jne 0x401995
push 1
push 0xfffffc18
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll__lseek]
add esp, 0xc
add dword [ebp - 4], 0xc418
jmp 0x401995
mov eax, dword [ebp - 4]
push 0
add esi, eax
lea eax, [esi + ebx]
push eax
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll__lseek]
add esp, 0xc
jmp 0x401a1d
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll__close]
pop ecx
push dword [ebp - 8]
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
mov eax, esi
pop esi
pop ebx
pop edi
leave
ret
Function at 0x401a2e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [sym.imp.MSVCRT.dll__lseek]
push 1
push 0
push dword [ebp + 8]
call esi
push dword [ebp + 0x10]
mov ebx, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll__read]
add esp, 0x18
cmp eax, 0xffffffff
jne 0x401a5f
or eax, eax
jmp 0x401aa3
push edi
push 0x4032b4
push dword [ebp + 0xc]
call dword [sym.imp.MSVCRT.dll_strstr]
mov edi, eax
pop ecx
test edi, edi
pop ecx
je 0x401a90
sub eax, dword [ebp + 0xc]
push 0
mov dword [ebp + 0xc], eax
lea eax, [eax + ebx + 2]
push eax
push dword [ebp + 8]
call esi
add esp, 0xc
and byte [edi], 0
jmp 0x401a9f
push 0
push ebx
push dword [ebp + 8]
call esi
add esp, 0xc
and dword [ebp + 0xc], 0
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x401ad3
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
xor edx, edx
xor eax, eax
mov ecx, edi
mov byte [ecx], al
inc eax
inc ecx
cmp ax, 0x100
jl 0x401ae3
mov byte [edi + 0x100], dl
mov byte [edi + 0x101], dl
xor ebx, ebx
mov dword [ebp + 0x10], edi
mov dword [ebp - 4], 0x100
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
movzx esi, dl
movzx edx, byte [esi + eax]
movzx eax, byte [ecx]
add ebx, edx
add eax, ebx
mov ebx, 0x100
cdq
idiv ebx
movzx ebx, dl
lea eax, [ebx + edi]
push eax
push ecx
call fcn.00401b44
lea eax, [esi + 1]
pop ecx
cdq
idiv dword [ebp + 0xc]
inc dword [ebp + 0x10]
dec dword [ebp - 4]
pop ecx
jne 0x401b05
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401b57
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 8], 0
cmp dword [ebp + 0xc], 0
push esi
mov esi, dword [ebp + 0x10]
mov al, byte [esi + 0x100]
mov cl, byte [esi + 0x101]
jle 0x401bf3
push ebx
push edi
movzx ebx, al
movzx ecx, cl
jmp 0x401b84
mov ecx, dword [ebp - 0xc]
lea eax, [ebx + 1]
mov edi, 0x100
cdq
idiv edi
movzx ebx, dl
movzx eax, byte [ebx + esi]
lea edi, [ebx + esi]
add eax, ecx
mov byte [ebp + 0x13], dl
mov ecx, 0x100
cdq
idiv ecx
movzx eax, dl
mov dword [ebp - 0xc], eax
add eax, esi
push eax
push edi
mov byte [ebp - 1], dl
mov dword [ebp - 0x10], eax
call fcn.00401b44
mov eax, dword [ebp + 8]
pop ecx
pop ecx
mov ecx, dword [ebp - 8]
movzx edx, byte [edi]
add ecx, eax
mov eax, dword [ebp - 0x10]
mov edi, 0x100
movzx eax, byte [eax]
add eax, edx
cdq
idiv edi
movzx eax, dl
mov al, byte [eax + esi]
xor byte [ecx], al
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
jl 0x401b81
mov al, byte [ebp + 0x13]
mov cl, byte [ebp - 1]
pop edi
pop ebx
mov byte [esi + 0x100], al
mov byte [esi + 0x101], cl
pop esi
leave
ret
Function at 0x401d16
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4020e0
push 0x401e50
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 4], 0
push 1
call dword [sym.imp.MSVCRT.dll___set_app_type]
pop ecx
or dword [0x403408], 0xffffffff
or dword [0x40340c], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x403400]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0x4033fc]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x403410], eax
call fcn.00401e47
cmp dword [0x4032d0], 0
jne 0x401d99
push 0x401e44
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
call fcn.00401e32
push 0x40300c
push 0x403008
call sub.MSVCRT.dll__initterm
mov eax, dword [0x4033f8]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x4033f4]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.MSVCRT.dll___getmainargs]
push 0x403004
push section..data
call sub.MSVCRT.dll__initterm
call dword [sym.imp.MSVCRT.dll___p___initenv]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
push dword [ebp - 0x20]
push dword [ebp - 0x2c]
push dword [ebp - 0x1c]
call fcn.004011a2
add esp, 0x30
mov dword [ebp - 0x24], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x30], ecx
push eax
push ecx
call sub.MSVCRT.dll__XcptFilter
pop ecx
pop ecx
ret