joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4034f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [esp + 0x28]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.WSOCK32.DLL_recv]
sub esp, 0x10
mov ebx, eax
cmp eax, 0xffffffff
je 0x403530
add esp, 0x14
mov eax, ebx
pop ebx
pop esi
ret
call dword [sym.imp.msvcrt.dll__errno]
mov esi, eax
call dword [sym.imp.WSOCK32.DLL_WSAGetLastError]
mov dword [esi], eax
add esp, 0x14
mov eax, ebx
pop ebx
pop esi
ret

Function at 0x403550
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [esp + 0x28]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.WSOCK32.DLL_send]
sub esp, 0x10
mov ebx, eax
cmp eax, 0xffffffff
je 0x403590
add esp, 0x14
mov eax, ebx
pop ebx
pop esi
ret
call dword [sym.imp.msvcrt.dll__errno]
mov esi, eax
call dword [sym.imp.WSOCK32.DLL_WSAGetLastError]
mov dword [esi], eax
add esp, 0x14
mov eax, ebx
pop ebx
pop esi
ret

Function at 0x403870
Capabilities:
Get hostname
Resolve dns

Disassembly:
push esi
push ebx
sub esp, 0x14
mov ebx, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
mov dword [esp], ebx
mov dword [esp + 4], esi
call dword [sym.imp.WSOCK32.DLL_gethostname]
sub esp, 8
mov dword [esp], ebx
call dword [sym.imp.WSOCK32.DLL_gethostbyname]
sub esp, 4
test eax, eax
je 0x4038b4
mov dword [esp + 8], esi
mov eax, dword [eax]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_strncpy
mov byte [ebx + esi - 1], 0
add esp, 0x14
pop ebx
pop esi
ret
Function at 0x403ac0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns

Disassembly:
push esi
xor eax, eax
mov edx, 2
push ebx
sub esp, 0x24
mov word [esp + 0x1e], ax
movzx eax, word [esp + 0x34]
mov word [esp + 0x10], dx
mov ebx, dword [esp + 0x30]
mov dword [esp + 0x12], 0
mov dword [esp + 0x16], 0
mov dword [esp + 0x1a], 0
mov dword [esp], eax
call dword [sym.imp.WSOCK32.DLL_htons]
sub esp, 4
mov word [esp + 0x12], ax
mov dword [esp], ebx
call dword [sym.imp.WSOCK32.DLL_inet_addr]
sub esp, 4
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x403b70
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 2
call dword [sym.imp.WSOCK32.DLL_socket]
sub esp, 0xc
mov ebx, eax
mov esi, eax
cmp eax, 0xffffffff
je 0x403b90
lea eax, [esp + 0x10]
mov dword [esp + 8], 0x10
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.WSOCK32.DLL_connect]
sub esp, 0xc
cmp eax, 0xffffffff
je 0x403ba1
add esp, 0x24
mov eax, esi
pop ebx
pop esi
ret
mov dword [esp], ebx
call dword [sym.imp.WSOCK32.DLL_gethostbyname]
sub esp, 4
test eax, eax
je 0x403bb9
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [esp + 0x14], eax
jmp 0x403b1d
mov dword [0x54b338], 0
mov esi, 0xffffffff
jmp 0x403b67
mov dword [0x54b338], 5
mov dword [esp], ebx
call dword [sym.imp.WSOCK32.DLL_closesocket]
sub esp, 4
jmp 0x403b9a
mov dword [0x54b338], 3
jmp 0x403b9a

Function at 0x403c40
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x2c
lea eax, [esp + 0x34]
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 8], 1
mov dword [esp + 4], 6
mov dword [esp], eax
call dword [sym.imp.WSOCK32.DLL_setsockopt]
sub esp, 0x14
add esp, 0x2c
ret

Function at 0x403c80
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp + 4], 0
mov dword [esp], 0x54b340
call sub.msvcrt.dll__setjmp3
mov edi, dword [sym.imp.WSOCK32.DLL_recv]
mov ebx, eax
test eax, eax
je 0x403d05
jmp 0x403d18
mov dword [esp + 4], 0x402910
mov dword [esp], 0x125
call sub.msvcrt.dll_signal
mov dword [esp + 0xc], 0
mov eax, dword [ebp + 0x10]
sub eax, ebx
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
add eax, ebx
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call edi
sub esp, 0x10
mov esi, eax
mov dword [esp + 4], 0
add ebx, esi
mov dword [esp], 0x125
call sub.msvcrt.dll_signal
test esi, esi
jle 0x403d0a
cmp ebx, dword [ebp + 0x10]
jl 0x403cb0
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], 0
mov ebx, 0xffffffff
mov dword [esp], 0x125
call sub.msvcrt.dll_signal
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x404ea0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x1c
mov dword [esp], str.TEMP
call sub.msvcrt.dll_getenv
test eax, eax
je 0x404ed0
mov dword [esp + 4], eax
mov dword [esp], 0x54b3c0
call sub.msvcrt.dll_strcpy
add esp, 0x1c
ret
mov dword [esp], 0x504942
call sub.msvcrt.dll_getenv
test eax, eax
jne 0x404eb3
mov dword [esp], str.TEMPDIR
call sub.msvcrt.dll_getenv
test eax, eax
jne 0x404eb3
mov dword [esp], str.TMPDIR
call sub.msvcrt.dll_getenv
test eax, eax
jne 0x404eb3
mov eax, 0x2e
mov word [0x54b3c0], ax
jmp 0x404ec3

Function at 0x404f10
Capabilities:
Delete file
Execute command

Disassembly:
push edi
push esi
push ebx
sub esp, 0x520
lea ebx, [esp + 0x20]
mov dword [esp + 0x1c], 0x50496b
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 9
mov dword [esp + 0xc], 4
mov dword [esp + 8], str.TomeNET
mov dword [esp + 4], str._s__d._d._d._d_s
mov dword [esp], ebx
call fcn.00404d70
mov dword [esp], ebx
call fcn.00401bb0
cmp byte [0x502750], 0
mov edx, str.client
mov dword [esp + 0x10], str.WINDOWS
mov dword [0x54b3a0], eax
mov eax, str.server
cmovne eax, edx
mov dword [esp + 0xc], str.10:48:03
mov dword [esp + 8], str.Jul__1_2024
mov dword [esp + 4], eax
mov dword [esp], str.__s__Compiled__s__s_for__s_
call fcn.00402550
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_strcat
mov dword [esp], ebx
call fcn.00401bb0
mov dword [esp + 4], 0x504934
mov dword [esp], str.__osname
mov dword [0x54b3a8], eax
call fcn.004015d0
test al, al
jne 0x404fe4
cmp byte [0x54b3c0], 0
jne 0x4050b0
lea edi, [esp + 0x120]
mov dword [esp + 0xc], str.__osname
mov dword [esp + 8], 0x504931
mov dword [esp + 4], 0x400
mov dword [esp], edi
call fcn.004024f0
mov dword [esp + 4], edi
mov dword [esp], str.cmd__c_ver____s
call fcn.00402550
mov dword [esp], eax
call sub.msvcrt.dll_system
mov dword [esp + 4], 0x5049c6
mov dword [esp], edi
call fcn.00445e10
mov esi, eax
test eax, eax
je 0x405110
mov dword [esp + 8], eax
mov dword [esp + 4], 0x100
mov dword [esp], ebx
call sub.msvcrt.dll_fgets
cmp ebx, eax
je 0x405120
mov dword [0x54b3a4], str._empty_
cmp byte [esp + 0x20], 0
jne 0x4050f0
mov dword [esp + 8], esi
mov dword [esp + 4], 0x100
mov dword [esp], ebx
call sub.msvcrt.dll_fgets
mov edx, eax
mov eax, str._empty_
cmp ebx, edx
je 0x4050f0
mov dword [esp], esi
mov dword [0x54b3a4], eax
call sub.msvcrt.dll_fclose
mov dword [esp], edi
call sub.msvcrt.dll_remove
add esp, 0x520
pop ebx
pop esi
pop edi
ret
lea edi, [esp + 0x120]
mov dword [esp + 0x14], str.__osname
mov dword [esp + 0x10], 0x504934
mov dword [esp + 0xc], 0x54b3c0
mov dword [esp + 8], 0x504936
mov dword [esp + 4], 0x400
mov dword [esp], edi
call fcn.004024f0
jmp 0x40500b
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov byte [esp + eax + 0x1f], 0
mov dword [esp], ebx
call fcn.00401bb0
jmp 0x40508d
mov dword [0x54b3a4], 0x5049c8
jmp 0x40509a
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov byte [esp + eax + 0x1f], 0
jmp 0x405063
Function at 0x40ef90
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x13c
mov dword [esp], 0
mov ebx, dword [esp + 0x150]
movzx ebp, byte [esp + 0x154]
call dword [sym.imp.USER32.dll_OpenClipboard]
sub esp, 4
test eax, eax
jne 0x40efd0
add esp, 0x13c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
sub esp, 4
mov esi, eax
test eax, eax
je 0x40efbd
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
test eax, eax
je 0x40efbd
lea edi, [esp + 0x21]
mov dword [esp + 8], 0xdf
mov dword [esp + 4], eax
mov dword [esp], edi
call sub.msvcrt.dll_strncpy
movzx eax, byte [esp + 0x21]
mov byte [esp + 0x100], 0
test al, al
je 0x40f064
xor ecx, ecx
mov edx, edi
mov edi, esi
mov dword [esp + 0x18], ecx
lea esi, [esi]
add edx, 1
cmp al, 0x1f
jle 0x40f05b
cmp al, 0x3a
je 0x40f090
cmp al, 0x7b
jne 0x40f050
mov esi, 0x7b
mov ecx, esi
add ebx, 1
mov byte [ebx - 1], cl
lea esi, [esi]
add dword [esp + 0x18], 1
add ebx, 1
mov byte [ebx - 1], al
movzx eax, byte [edx]
test al, al
jne 0x40f030
mov esi, edi
mov byte [ebx], 0
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
sub esp, 4
call dword [sym.imp.USER32.dll_CloseClipboard]
add esp, 0x13c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, dword [esp + 0x18]
test esi, esi
setne byte [esp + 0x1f]
cmp esi, 0x14
setle cl
test byte [esp + 0x1f], cl
je 0x40f050
mov ecx, ebp
mov esi, 0x3a
test cl, cl
je 0x40f050
jmp 0x40f044
Function at 0x416740
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x503538], 1
push ebp
push edi
push esi
push ebx
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
jle 0x41680f
test ebx, ebx
jle 0x41680f
mov edi, edx
mov esi, 5
lea ebp, [ebx - 1]
neg edi
mov eax, edi
and eax, 3
lea ecx, [eax + 3]
cmp ecx, esi
cmovb ecx, esi
cmp ebp, ecx
jb 0x416814
xor esi, esi
test eax, eax
je 0x4167ac
xor byte [edx], 0x2a
and edi, 2
mov esi, 1
je 0x4167ac
xor byte [edx + 1], 0x2a
mov esi, 2
cmp eax, 3
jne 0x4167ac
xor byte [edx + 2], 0x2a
mov esi, 3
mov edi, ebx
sub edi, eax
add eax, edx
mov ecx, edi
and ecx, 0xfffffffc
lea ebp, [eax + ecx]
lea esi, [esi]
xor dword [eax], 0x2a2a2a2a
add eax, 4
cmp eax, ebp
jne 0x4167c0
lea eax, [ecx + esi]
cmp edi, ecx
je 0x41680f
lea ecx, [eax + 1]
xor byte [edx + eax], 0x2a
cmp ebx, ecx
jle 0x41680f
xor byte [edx + ecx], 0x2a
lea ecx, [eax + 2]
cmp ebx, ecx
jle 0x41680f
xor byte [edx + ecx], 0x2a
lea ecx, [eax + 3]
cmp ebx, ecx
jle 0x41680f
xor byte [edx + ecx], 0x2a
lea ecx, [eax + 4]
cmp ebx, ecx
jle 0x41680f
add eax, 5
xor byte [edx + ecx], 0x2a
cmp ebx, eax
jle 0x41680f
xor byte [edx + eax], 0x2a
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
jmp 0x4167d4
Function at 0x446310
Capabilities:
Create directory
Execute command
Query environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x82c
mov eax, dword [0xde84b8]
mov esi, dword [esp + 0x840]
mov dword [esp], eax
call fcn.00401b10
mov eax, dword [0xde84b4]
mov dword [esp], eax
call fcn.00401b10
mov eax, dword [0xde84b0]
mov dword [esp], eax
call fcn.00401b10
mov eax, dword [0xde84ac]
mov dword [esp], eax
call fcn.00401b10
mov eax, dword [0xde84a8]
mov dword [esp], eax
call fcn.00401b10
mov eax, dword [0xde84a4]
mov dword [esp], eax
call fcn.00401b10
mov dword [esp], esi
call fcn.00401bb0
mov dword [esp], esi
mov dword [0xde84b8], eax
call sub.msvcrt.dll_strlen
lea ebx, [esi + eax]
mov dword [ebx], 0x74786574
mov byte [ebx + 4], 0
mov dword [esp], esi
call fcn.00401bb0
mov byte [ebx + 4], 0
mov dword [0xde84b0], eax
mov dword [ebx], 0x61727478
mov dword [esp], esi
call fcn.00401bb0
mov byte [ebx + 4], 0
mov dword [0xde84a8], eax
mov dword [ebx], 0x656d6167
mov dword [esp], esi
call fcn.00401bb0
cmp byte [0xd67a86], 0
mov dword [0xde84a4], eax
jne 0x446500
mov dword [esp], 0x515567
call sub.msvcrt.dll_getenv
test eax, eax
je 0x446500
mov dword [esp], 0x515571
call sub.msvcrt.dll_getenv
test eax, eax
je 0x446500
mov dword [esp], 0x515567
lea edi, [esp + 0x20]
call sub.msvcrt.dll_getenv
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_strcpy
mov dword [esp], 0x515571
call sub.msvcrt.dll_getenv
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_strcat
mov dword [esp], edi
call sub.msvcrt.dll_strlen
mov edx, 0x74
lea esi, [edi + eax]
mov dword [esi], 0x6d6f545c
mov dword [esi + 4], 0x54454e65
mov dword [esi + 8], 0x7063732d
mov word [esi + 0xc], dx
mov dword [esp], edi
call fcn.00401bb0
mov dword [esp], eax
mov dword [0xde84b4], eax
call fcn.0045a740
test al, al
je 0x446540
mov eax, 0x72
mov dword [esi], 0x6d6f545c
mov dword [esi + 4], 0x54454e65
mov dword [esi + 8], 0x6573752d
mov word [esi + 0xc], ax
mov dword [esp], edi
call fcn.00401bb0
mov dword [esp], eax
mov dword [0xde84ac], eax
call fcn.0045a740
test al, al
jne 0x44652e
mov eax, dword [0xde84ac]
lea esi, [esp + 0x420]
mov dword [esp], eax
call sub.msvcrt.dll__mkdir
mov eax, dword [0xde84ac]
mov dword [esp + 0xc], str.user
mov dword [esp + 4], str.xcopy__I__E__Q__Y__H__C__s_s___s_
mov dword [esp + 0x10], eax
mov eax, dword [0xde84b8]
mov dword [esp], esi
mov dword [esp + 8], eax
call fcn.00445a40
mov dword [esp], esi
call sub.msvcrt.dll_system
jmp 0x44652e
mov dword [ebx], 0x74706373
mov byte [ebx + 4], 0
mov dword [esp], esi
call fcn.00401bb0
mov byte [ebx + 4], 0
mov dword [0xde84b4], eax
mov dword [ebx], 0x72657375
mov dword [esp], esi
call fcn.00401bb0
mov dword [0xde84ac], eax
mov byte [ebx], 0
add esp, 0x82c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [0xde84b4]
lea ebp, [esp + 0x420]
mov dword [esp], eax
call sub.msvcrt.dll__mkdir
mov eax, dword [0xde84b4]
mov dword [esp + 0xc], str.scpt
mov dword [esp + 4], str.xcopy__I__E__Q__Y__H__C__s_s___s_
mov dword [esp + 0x10], eax
mov eax, dword [0xde84b8]
mov dword [esp], ebp
mov dword [esp + 8], eax
call fcn.00445a40
mov dword [esp], ebp
call sub.msvcrt.dll_system
jmp 0x44647a
Function at 0x4589a0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, eax
push edi
push esi
push ebx
mov ebx, edx
sub esp, 0xbc
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 0x1162fe0
je 0x4589e8
mov eax, dword [0x1162e44]
mov dword [esp + 0xc], eax
movzx eax, byte [ebp + 0xc8]
mov dword [esp + 4], str.Visible
mov dword [esp + 8], eax
mov dword [esp], edx
call esi
sub esp, 0x10
test eax, eax
setne byte [ebp + 0xc8]
mov eax, dword [0x1162e44]
lea edi, [esp + 0x30]
mov dword [esp + 0x10], 0x7f
mov dword [esp + 0xc], edi
mov dword [esp + 0x14], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [esp + 8], str.9X15.FON
mov dword [esp + 4], str.Font
mov dword [esp], ebx
mov dword [esp + 0x2c], eax
call eax
sub esp, 0x18
mov dword [esp], edi
call sub.msvcrt.dll_strlen
lea edx, [edi + eax - 1]
cmp edx, edi
jae 0x458a4d
jmp 0x458bf9
cmp al, 0x5c
je 0x458a54
lea eax, [edx - 1]
cmp eax, edi
jb 0x458a57
mov edx, eax
movzx eax, byte [edx]
cmp al, 0x3a
jne 0x458a40
add edx, 1
mov dword [esp], edx
call fcn.00401bb0
mov dword [ebp + 0xcc], eax
mov eax, dword [0x1162e44]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x9c]
mov dword [esp + 4], str.Columns
mov dword [esp + 8], eax
mov dword [esp], ebx
call esi
mov dword [ebp + 0x9c], eax
mov eax, dword [0x1162e44]
sub esp, 0x10
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x98]
mov dword [esp + 4], str.Rows
mov dword [esp + 8], eax
mov dword [esp], ebx
call esi
mov edx, dword [ebp + 0x9c]
sub esp, 0x10
test edx, edx
jne 0x458ac5
mov dword [ebp + 0x9c], 0x50
test eax, eax
mov edx, 0x18
cmove eax, edx
mov dword [ebp + 0x98], eax
cmp ebp, 0x1162fe0
je 0x458bc0
mov eax, dword [0x1162e44]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xa0]
mov dword [esp + 4], str.PositionX
mov dword [esp + 8], eax
mov dword [esp], ebx
call esi
mov dword [ebp + 0xa0], eax
mov eax, dword [0x1162e44]
sub esp, 0x10
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xa4]
mov dword [esp + 4], str.PositionY
mov dword [esp + 8], eax
mov dword [esp], ebx
call esi
mov dword [ebp + 0xa4], eax
mov eax, dword [0x1162e44]
sub esp, 0x10
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 4], str.WindowNumber
mov dword [esp], ebx
call esi
sub esp, 0x10
test eax, eax
jne 0x458b68
add esp, 0xbc
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [eax + eax*4]
mov dword [esp + 0xc], edi
lea esi, [eax*8 + 0x5023e0]
mov eax, dword [0x1162e44]
mov dword [esp], ebx
mov dword [esp + 8], esi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x10], 0x7f
mov dword [esp + 4], str.WindowTitle
call eax
sub esp, 0x18
mov dword [esp], edi
call fcn.00401bb0
mov dword [esp], esi
mov dword [esp + 4], eax
call sub.msvcrt.dll_strcpy
add esp, 0xbc
pop ebx
pop esi
pop edi
pop ebp
ret
cmp dword [0x116307c], 0x50
je 0x458bd3
mov dword [0x116307c], 0x50
mov eax, dword [0x1163078]
mov dword [0x5029b0], 0x42
sub eax, 2
cmp eax, 0x16
mov dword [0x5029ac], eax
setg byte [0xde82d4]
jmp 0x458ae1
lea edx, [edi + eax]
jmp 0x458a57
Function at 0x45a740
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
sub esp, 0x418
mov eax, dword [esp + 0x420]
lea ebx, [esp + 0x10]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_strcpy
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
test eax, eax
je 0x45a771
cmp byte [esp + eax + 0xf], 0x5c
je 0x45a7a0
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
shr eax, 4
sub esp, 4
mov edx, eax
xor eax, eax
and edx, 1
cmp ecx, 0xffffffff
cmovne eax, edx
add esp, 0x418
pop ebx
ret
mov byte [esp + eax + 0xf], 0
jmp 0x45a771
Function at 0x45e320
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push edi
xor eax, eax
mov ecx, 0x20
push esi
push ebx
sub esp, 0x90
lea ebx, [esp + 0x10]
mov esi, dword [esp + 0xa0]
mov edi, ebx
rep stosd dword es:[edi], eax
mov eax, dword [0x11630b0]
test eax, eax
je 0x45e428
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.msvcrt.dll_strcpy
cmp esi, 0xffffffff
je 0x45e388
cmp esi, 2
je 0x45e460
jg 0x45e4d8
test esi, esi
je 0x45e590
cmp esi, 1
je 0x45e3a0
add esp, 0x90
pop ebx
pop esi
pop edi
ret
mov dword [esp + 4], str.8X13
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
je 0x45e448
mov edx, str.10X14X.FON
mov eax, 0x1162fe0
call fcn.00459260
mov edx, str.8X13.FON
mov eax, 0x11630c0
call fcn.00459260
mov edx, str.8X13.FON
mov eax, 0x11631a0
call fcn.00459260
mov edx, str.6X10.FON
mov eax, 0x1163280
call fcn.00459260
mov edx, str.8X13.FON
mov eax, 0x1163360
call fcn.00459260
mov edx, str.6X10.FON
mov eax, 0x1163440
call fcn.00459260
mov edx, str.6X10.FON
mov eax, 0x1163520
call fcn.00459260
mov edx, str.6X10.FON
add esp, 0x90
mov eax, 0x1163600
pop ebx
pop esi
pop edi
jmp fcn.00459260
mov dword [esp + 0x10], 0x35315839
mov dword [esp + 0x14], 0x4e4f462e
mov byte [esp + 0x18], 0
jmp 0x45e358
mov dword [esp + 4], str.10X14
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
je 0x45e558
mov edx, str.12X18X.FON
mov eax, 0x1162fe0
call fcn.00459260
mov edx, str.9X15.FON
mov eax, 0x11630c0
call fcn.00459260
mov edx, str.9X15.FON
mov eax, 0x11631a0
call fcn.00459260
mov edx, str.8X13.FON
mov eax, 0x1163280
call fcn.00459260
mov edx, str.9X15.FON
mov eax, 0x1163360
call fcn.00459260
mov edx, str.8X13.FON
mov eax, 0x1163440
call fcn.00459260
mov edx, str.8X13.FON
mov eax, 0x1163520
call fcn.00459260
mov edx, str.8X13.FON
jmp 0x45e40e
cmp esi, 3
jne 0x45e379
mov edx, str.16X24X.FON
mov eax, 0x1162fe0
call fcn.00459260
mov edx, str.12X18X.FON
mov eax, 0x11630c0
call fcn.00459260
mov edx, str.12X18X.FON
mov eax, 0x11631a0
call fcn.00459260
mov edx, str.9X15.FON
mov eax, 0x1163280
call fcn.00459260
mov edx, str.12X18X.FON
mov eax, 0x1163360
call fcn.00459260
mov edx, str.9X15.FON
mov eax, 0x1163440
call fcn.00459260
mov edx, str.9X15.FON
mov eax, 0x1163520
call fcn.00459260
mov edx, str.9X15.FON
jmp 0x45e40e
mov dword [esp + 4], str.12X18
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x45e4e1
mov dword [esp + 4], str.16X24
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
je 0x45e379
lea esi, [esi]
nop
mov edx, str.8X13.FON
mov eax, 0x1162fe0
call fcn.00459260
mov edx, str.8X13.FON
mov eax, 0x11630c0
call fcn.00459260
mov edx, str.8X13.FON
mov eax, 0x11631a0
call fcn.00459260
mov edx, str.5X8.FON
mov eax, 0x1163280
call fcn.00459260
mov edx, str.6X10.FON
mov eax, 0x1163360
call fcn.00459260
mov edx, str.6X10.FON
mov eax, 0x1163440
call fcn.00459260
mov edx, str.5X8.FON
mov eax, 0x1163520
call fcn.00459260
mov edx, str.5X8.FON
jmp 0x45e40e
Function at 0x47b3b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
sub esp, 0x38
cmp byte [esp + 0x40], 0
mov eax, dword [esp + 0x44]
mov edx, dword [esp + 0x48]
jne 0x47b470
test al, al
jne 0x47b450
test dl, dl
je 0x47b4a0
mov dword [esp + 0x20], 0x74736552
mov dword [esp + 0x24], 0x20676e69
mov dword [esp + 0x28], 0x20202020
mov byte [esp + 0x2c], 0
mov ebx, 1
lea eax, [esp + 0x1c]
mov dword [esp + 4], eax
lea eax, [esp + 0x18]
mov dword [esp], eax
call fcn.004093d0
mov eax, dword [0x5029ac]
mov dword [esp], ebx
mov dword [esp + 0xc], 0x27
add eax, 1
mov dword [esp + 8], eax
lea eax, [esp + 0x20]
mov dword [esp + 4], eax
call fcn.00412680
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.004086f0
add esp, 0x38
pop ebx
ret
mov dword [esp + 0x20], 0x72616553
mov dword [esp + 0x24], 0x6e696863
mov dword [esp + 0x28], 0x20202067
mov byte [esp + 0x2c], 0
jmp 0x47b3f4
mov dword [esp + 0x20], 0x61726150
mov ebx, 4
mov dword [esp + 0x24], 0x657a796c
mov dword [esp + 0x28], 0x20202164
mov byte [esp + 0x2c], 0
jmp 0x47b3f9
mov dword [esp + 0x20], 0x20202020
mov dword [esp + 0x24], 0x20202020
mov dword [esp + 0x28], 0x20202020
mov byte [esp + 0x2c], 0
jmp 0x47b3f4