joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6780a690
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.678192d0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.678192d0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x6780a6f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x67927054]
test esi, esi
jle 0x6780a810
mov eax, dword [0x67927058]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x6780a724
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x6780a7a7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x6780a710
mov dword [esp], ebx
call fcn.6780aee0
mov edi, eax
test eax, eax
je 0x6780a837
mov eax, dword [0x67927058]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.6780b020
mov edx, dword [0x67927058]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x6780a817
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x6780a7a0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x6780a7b0
add dword [0x67927054], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x67927058]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x6780a7a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.6780a690
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x6780a72e
mov eax, dword [0x67927058]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.6780a690
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.6780a690
lea esi, [esi]
nop
Function at 0x6780ab50
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x67927064
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x6792705c]
sub esp, 4
test ebx, ebx
je 0x6780aba5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x6780ab9e
test esi, esi
je 0x6780ab9e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x6780ab80
mov dword [esp], 0x67927064
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x6780aee0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x67800000], 0x5a4d
jne 0x6780af05
mov ecx, dword [0x6780003c]
cmp dword [ecx + 0x67800000], 0x4550
lea edx, [ecx + 0x67800000]
je 0x6780af10
ret
cmp word [ecx + 0x67800018], 0x10b
jne 0x6780af05
push esi
movzx eax, word [ecx + 0x67800014]
push ebx
movzx esi, word [ecx + 0x67800006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x67800000
test si, si
je 0x6780af58
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x6780af4e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x6780af5a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x6780af40
xor eax, eax
pop ebx
pop esi
ret

Function at 0x67810290
Capabilities:
Allocate thread local storage

Disassembly:
sub esp, 0x1c
mov dword [0x679270c0], 0xffffffff
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0xffff
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
sub esp, 0x10
mov dword [0x679270c4], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x67810300
mov dword [esp + 4], 0x678101a0
mov dword [esp], eax
mov dword [0x679270bc], eax
call fcn.67819b50
test eax, eax
jne 0x678d6d79
add esp, 0x1c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x678102ea
Function at 0x6781c3c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ecx, 0x1a
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x80]
mov esi, 0x678e0df5
push ebx
sub esp, 0x9c
mov eax, dword [str.not_enough_space_for_format_expansion__Please_submit_full_bug_report_at_https:__gcc.gnu.org_bugs__:_n]
mov dword [ebp - 0x81], eax
mov eax, dword [0x678e0e59]
mov dword [ebp - 0x1c], eax
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp + 8]
lea eax, [edx + 0x84]
and eax, 0xfffffff0
call fcn.6780b1c0
mov ecx, 0x1a
sub esp, eax
lea esi, [ebp - 0x81]
lea ebx, [esp + 0x1b]
and ebx, 0xfffffff0
mov edi, ebx
lea eax, [ebx + 0x68]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 8], edx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x8c], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x8c]
mov byte [ebx + edx + 0x68], 0
mov dword [esp], ebx
call fcn.678d5980
nop
nop
nop
nop
nop
nop
nop
push edi
push esi
push ebx
sub esp, 0x20
cmp byte [0x678de248], 0
jne 0x6781c4e6
mov byte [0x678de248], 1
call fcn.678d37f0
test eax, eax
je 0x6781c4b4
mov ebx, dword [eax + 4]
xor eax, eax
cmp byte [ebx], 0x2a
mov dword [esp + 8], 0
sete al
mov dword [esp + 4], 0
add ebx, eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call fcn.6780a340
mov dword [esp], 2
mov esi, dword [fcn.678192d0]
mov edi, eax
call esi
mov dword [esp + 8], 0x30
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
call sub.msvcrt.dll_fwrite
mov edx, dword [esp + 0x1c]
mov dword [esp], 2
test edx, edx
je 0x6781c4a4
call esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
mov dword [esp], 2
call esi
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x678e15f9
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x678d6164
jmp 0x678d615c
call esi
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
jmp 0x6781c46a
mov dword [esp], 2
call dword [0x678dd0a0]
mov dword [esp + 8], 0x2d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
call sub.msvcrt.dll_fwrite
jmp 0x678d6157
mov dword [esp], 2
call dword [0x678dd0a0]
mov dword [esp + 8], 0x1d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x678e15a8
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
call sub.msvcrt.dll_abort
mov dword [esp], edi
call fcn.67819a38
call fcn.678d3b20
call fcn.678d36e0
call fcn.678d3820
jmp 0x678d6157
Function at 0x4040a2
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00402fcf
xor ebx, ebx
cmp dword [0x40d97c], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x404177
push str.USER32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x4040e2
xor eax, eax
jmp 0x40423b
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x4040db
push eax
call fcn.00402f6c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40d97c], eax
call esi
push eax
call fcn.00402f6c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40d980], eax
call esi
push eax
call fcn.00402f6c
mov dword [0x40d984], eax
lea eax, [ebp - 8]
push eax
call fcn.00402395
test eax, eax
pop ecx
pop ecx
je 0x404145
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040398b
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x404177
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00402f6c
cmp eax, ebx
pop ecx
mov dword [0x40d98c], eax
je 0x404177
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402f6c
pop ecx
mov dword [0x40d988], eax
mov eax, dword [0x40d988]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x4041f0
cmp dword [0x40d98c], esi
je 0x4041f0
push eax
call fcn.00402fd8
pop ecx
call eax
cmp eax, ebx
je 0x4041bd
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x40d98c]
call fcn.00402fd8
pop ecx
call eax
test eax, eax
je 0x4041bd
test byte [ebp - 0x18], 1
jne 0x4041f0
lea eax, [ebp - 0xc]
push eax
call fcn.004023cc
test eax, eax
pop ecx
je 0x4041d8
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040398b
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x4041e7
or dword [ebp + 0x10], 0x200000
jmp 0x404221
or dword [ebp + 0x10], 0x40000
jmp 0x404221
mov eax, dword [0x40d980]
cmp eax, esi
je 0x404221
push eax
call fcn.00402fd8
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x404221
mov eax, dword [0x40d984]
cmp eax, esi
je 0x404221
push dword [ebp - 4]
push eax
call fcn.00402fd8
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x40d97c]
call fcn.00402fd8
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x405f0b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40d008]
jne 0x405f15
repz ret
jmp fcn.00407545
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x425008]
jne 0x40100a
repz ret
jmp fcn.00401cf1

Function at 0x40773b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402a1a
and dword [ebp - 4], 0
cmp dword [0x427008], 0
mov ebx, eax
jne 0x4077ec
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40789d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40789d
push eax
call fcn.004029a8
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x427008], eax
call esi
push eax
call fcn.004029a8
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x42700c], eax
call esi
push eax
call fcn.004029a8
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x427010], eax
call esi
push eax
call fcn.004029a8
pop ecx
mov dword [0x427018], eax
test eax, eax
je 0x4077ec
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004029a8
pop ecx
mov dword [0x427014], eax
mov eax, dword [0x427014]
cmp eax, ebx
je 0x407844
cmp dword [0x427018], ebx
je 0x407844
push eax
call fcn.00402a23
push dword [0x427018]
mov esi, eax
call fcn.00402a23
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x407844
test edi, edi
je 0x407844
call esi
test eax, eax
je 0x40783b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40783b
test byte [ebp - 0xc], 1
jne 0x407844
or dword [ebp + 0x10], 0x200000
jmp 0x40787d
mov eax, dword [0x42700c]
cmp eax, ebx
je 0x40787d
push eax
call fcn.00402a23
pop ecx
test eax, eax
je 0x40787d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40787d
mov eax, dword [0x427010]
cmp eax, ebx
je 0x40787d
push eax
call fcn.00402a23
pop ecx
test eax, eax
je 0x40787d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x427008]
call fcn.00402a23
pop ecx
test eax, eax
je 0x40789d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40789f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41e6f0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
cmp edi, 0x19f
jne 0x41e709
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor edx, edx
test edi, edi
jle 0x41e751
nop
lea ecx, [esp + 8]
mov dword [esp], 5
mov dword [esp + 8], 0
call fcn.0041e6e0
mov eax, dword [esp + 8]
add eax, 0x46
mov dword [esp], eax
sub dword [esp], 0x46
movsx eax, byte [edx + esi]
mov dword [esp + 4], eax
mov eax, dword [esp]
xor dword [esp + 4], eax
mov cl, byte [esp + 4]
mov byte [edx + esi], cl
inc edx
cmp edx, edi
jl 0x41e710
cmp edi, 0x2d
jne 0x41e76a
mov dword [0x2b25220], 0xa62e7790
mov dword [0x2b25224], 0xffffffff
add esp, 0xc
ret
Function at 0x401000
Capabilities:
Contain obfuscated stackstrings
Get hostname
Get networking interfaces
Identify system language via api
Link many functions at runtime
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x344
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push 0x407020
push 0x407088
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.GetVersionExA
push 0x407078
mov dword [esp + 0x88], eax
call esi
push eax
call edi
push 0x407010
push 0x407088
mov ebx, eax
call esi
push eax
call edi
push str.GetSystemInfo
push 0x407078
mov dword [esp + 0x74], eax
call esi
push eax
call edi
push str.GlobalMemoryStatusEx
push 0x407078
mov dword [esp + 0x90], eax
call esi
push eax
call edi
push str.RegQueryValueExA
push 0x407088
mov dword [esp + 0x94], eax
call esi
push eax
call edi
mov dword [esp + 0x7c], eax
jmp loc.0040b52e

Function at 0x4018f0
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp]
push eax
push ecx
mov dword [esp + 8], 0
jmp loc.0040b3c7

Function at 0x401bc2
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
push 0xf
pop ecx
mov esi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789
jmp loc.0040b945

Function at 0x401c64
Capabilities:
Act as tcp client
Connect tcp socket
Connect udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
mov ebx, 0x407164
push 0x407180
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push 0x407188
push ebx
mov dword [ebp - 4], eax
call esi
push eax
call edi
cmp dword [0x407464], 0
mov dword [ebp - 8], eax
jmp loc.0040c41e
Function at 0x401dd0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xd8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0xd8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 0x4077d8
push esi
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 0xc
mov ebx, 0x4074ec
test eax, eax
je 0x401e03
push 0x20
xor eax, eax
pop ecx
mov edi, ebx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xd8]
push esi
push eax
call dword [sym.imp.MSVCRT.dll_strcspn]
push eax
lea eax, [ebp - 0xd8]
push eax
push ebx
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0x14
cmp dword [0x40777c], 1
jne 0x401ddf
and byte [ebp - 0x58], 0
push 0xf
pop ecx
xor eax, eax
lea edi, [ebp - 0x57]
push 0xa
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x58]
push eax
call fcn.00401bc2
pop ecx
mov edi, 0x4077d4
pop ecx
xor eax, eax
or ecx, 0xffffffff
lea edx, [ebp - 0x58]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [ebp - 0x58]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x58]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 0x4077d8
lea eax, [ebp - 0xd8]
push esi
push eax
call dword [sym.imp.MSVCRT.dll_strcspn]
lea eax, [ebp + eax - 0xd7]
push eax
call dword [sym.imp.MSVCRT.dll_atoi]
add esp, 0xc
mov dword [0x40756c], eax
mov ax, word [0x40756c]
mov word [ebp - 0x18], 2
push eax
call dword [ebp - 4]
mov word [ebp - 0x16], ax
push ebx
jmp loc.00401e2e

Function at 0x401e67
Capabilities:
Packed with generic packer
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp + 0xc]
push 4
push eax
push 8
push 0xffff
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne fcn.00401eb8
push eax
lea ecx, [ebp + 0xc]
push eax
push ecx
push eax
push eax
lea eax, [ebp - 0xc]
push 0xc
push eax
push 0x98000004
push dword [ebp + 8]
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 0x2bf20
mov dword [ebp - 4], 0x2710
jmp loc.0040bdc2
Function at 0x401eba
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
mov ebx, str.ADVAPI32.dll
push str.OpenSCManagerA
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.OpenServiceA
push ebx
mov dword [ebp - 4], eax
call esi
push eax
call edi
push str.DeleteService
push ebx
jmp loc.0040b8a5

Function at 0x402130
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Link many functions at runtime
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x384
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
mov ebx, 0x407144
push str.GetShortPathNameA
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.GetEnvironmentVariableA
push ebx
mov dword [ebp - 0x2c], eax
call esi
push eax
call edi
push 0x407304
push ebx
mov dword [ebp - 0x30], eax
call esi
push eax
call edi
push 0x4071e0
push ebx
mov dword [ebp - 0x38], eax
call esi
push eax
call edi
push str.SetPriorityClass
push ebx
mov dword [ebp - 0x24], eax
call esi
push eax
call edi
push str.SetThreadPriority
push ebx
mov dword [ebp - 0x28], eax
call esi
push eax
call edi
push str.WinExec
push ebx
mov dword [ebp - 0x3c], eax
call esi
push eax
call edi
push str.SetFileAttributesA
push ebx
call esi
push eax
call edi
push 0x40
mov dword [ebp - 0x34], eax
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x17b]
mov byte [ebp - 0x17c], bl
push 0x40
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x383]
mov byte [ebp - 0x384], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x27f]
mov byte [ebp - 0x280], bl
mov esi, 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push esi
lea eax, [ebp - 0x17c]
push eax
push ebx
call dword [ebp - 0x38]
lea eax, [ebp - 0x17c]
push esi
push eax
jmp loc.0040c002

Function at 0x40235f
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
mov ebx, dword [ebp + 0x10]
push esi
xor esi, esi
test ebx, ebx
jne 0x402378
push 1
pop eax
jmp fcn.004023ed
mov eax, dword [0x408488]
push 0
mov dword [ebp - 0x100], eax
push 0
lea eax, [ebp - 0x104]
push 0
push eax
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp - 0x104], 1
push eax
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x4023e6
test eax, eax
je 0x402378
jmp loc.0040b028
xor eax, eax
jmp loc.0040b244
Function at 0x402b47
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
push esi
push ebx
push 0x80
push 4
push ebx
push 2
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x402bbc
push edi
push 2
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor eax, eax
lea edi, [ebp - 0xb]
mov byte [ebp - 0xc], bl
mov dword [ebp + 8], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosb byte es:[edi], al
mov edi, dword [ebp + 0xc]
cmp edi, ebx
jbe 0x402bb4
lea eax, [ebp - 0xc]
push 0xa
push eax
call fcn.00401bc2
pop ecx
lea eax, [ebp + 8]
pop ecx
push ebx
push eax
lea eax, [ebp - 0xc]
push 0xa
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
dec edi
jne 0x402b92
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x402bc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x278
push ebx
push esi
jmp loc.0040b58b
Function at 0x402ee5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
mov ebx, str.ADVAPI32.dll
push str.RegCloseKey
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.RegOpenKeyExA
push ebx
mov dword [ebp - 0x28], eax
call esi
push eax
call edi
push 0x40
mov dword [ebp - 0x30], eax
xor edx, edx
pop ecx
xor eax, eax
lea edi, [ebp - 0x133]
mov byte [ebp - 0x134], dl
mov byte [ebp - 0x24], 0x53
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edi, [ebp - 0x24]
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp - 0x23], 0x59
mov byte [ebp - 0x22], 0x53
mov byte [ebp - 0x21], 0x54
mov byte [ebp - 0x20], 0x45
mov byte [ebp - 0x1f], 0x4d
mov byte [ebp - 0x1e], 0x5c
mov byte [ebp - 0x1d], 0x43
mov byte [ebp - 0x1c], 0x75
mov byte [ebp - 0x1b], 0x72
mov byte [ebp - 0x1a], 0x72
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x6e
mov byte [ebp - 0x17], 0x74
mov byte [ebp - 0x16], 0x43
mov byte [ebp - 0x15], 0x6f
mov byte [ebp - 0x14], 0x6e
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x72
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0x10], 0x6c
mov byte [ebp - 0xf], 0x53
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 0xc], 0x5c
mov byte [ebp - 0xb], 0x53
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 9], 0x72
mov byte [ebp - 8], 0x76
mov byte [ebp - 7], 0x69
mov byte [ebp - 6], 0x63
mov byte [ebp - 5], 0x65
mov byte [ebp - 4], 0x73
mov byte [ebp - 3], 0x5c
mov byte [ebp - 2], dl
lea ebx, [ebp - 0x134]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
lea ebx, [ebp - 0x134]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x2c]
mov ecx, ebx
push eax
push 0xf003f
lea eax, [ebp - 0x134]
and ecx, 3
push edx
push eax
rep movsb byte es:[edi], byte [esi]
push connect
call dword [ebp - 0x30]
pop edi
pop esi
test eax, eax
pop ebx
jne 0x403040
push dword [ebp - 0x2c]
call dword [ebp - 0x28]
push 1
pop eax
leave
ret
xor eax, eax
leave
ret

Function at 0x403044
Capabilities:
Contain obfuscated stackstrings
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x406160
push 0x403940
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2dc
push ebx
push esi
push edi
push str.RegCloseKey
mov ebx, str.ADVAPI32.dll
push ebx
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call esi
push eax
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call edi
mov dword [ebp - 0x260], eax
jmp loc.0040c614