joyce8/EMBER2024-capa huggingface dataset:
Function at 0x30fc60b
Capabilities:
Terminate process

Disassembly:
call fcn.030fc618
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
Function at 0x444920
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0433d5c
jmp 0x444a1a
push dword [esp]
jb 0x444952
mov dword [esp + 0xc], ebx
jmp 0x44493c
push bx
mov word [esp], ax
lea esp, [esp + 1]
jmp 0x444a43
mov dword [esp + 0xc], ebx
push bx
mov word [esp], ax
lea esp, [esp + 1]
lea esp, [esp]
lea esp, [esp]
jmp 0x4449d3
mov dword [esp + 8], ebp
push bp
mov byte [esp], ch
jmp 0x4449ad
mov dword [esp + 8], ebp
push bp
mov byte [esp], ch
push word [esp + 1]
jmp 0x444a07
push word [esp + 1]
pop word [esp]
jmp 0x444a0b
lea esp, [esp + 1]
mov dword [esp + 8], esp
push bx
push word [esp]
je 0x444999
jne 0x444983
lea esp, [esp + 2]
mov dword [esp + 4], edi
lea esp, [esp + 4]
pushfd
jmp 0x4443a4
pop word [esp]
push di
mov byte [esp + 2], dh
mov dword [esp + 8], esi
call fcn.004449b8
shr ebp, 0xf
jmp 0x444a61
dec dl
mov ebp, dword [esp + 0x2c]
sub esp, 8
jmp 0x444a7d
lea esp, [esp]
jmp 0x444963
mov esi, 0xf5dabad0
pop dword [esp]
pop ecx
jmp 0x444a89
jbe 0x444a23
dec dl
jmp 0x444a25
pop ecx
jmp 0x444a89
jp 0x444a4b
mov esi, 0xf5dabad0
pop dword [esp]
jmp 0x444a67
lea esi, [esp]
rdtsc
not ecx
lea ebx, [edx + 7]
xchg ebx, eax
jmp 0x444b52
sub esp, 0xc0
mov edi, esp
mov ebx, dword [esp]
mov ecx, edx
call fcn.00444afa
mov dh, bl
lea edx, [edi + edi]
add dl, 0x2e
jle 0x444b89
xchg ah, ch
neg cx
jmp 0x444b94
xchg ah, ch
jmp 0x444b91
neg cx
neg ebp
mov dl, byte [esp]
adc al, 0x24
rdtsc
jmp 0x444bc2
and dx, 0x6b55
jmp 0x444ffe
lea eax, [eax + edi]
mov dl, 0x82
xchg dh, ch
bts ax, dx
jb 0x444bac
jae 0x44504a
fiadd dword [edx + ebx*8 - 0x43]
dec esp
cli
insb byte es:[edi], dx
int1
popal
add bl, dh
xor ebp, dword [esi - 0xe]
pushal
pop es
inc edi
jae 0x444b97
sub dword [eax - reloc.USER32.dll_MessageBoxA], ecx
fsubr st(2)
add cl, byte [ebx - 0x785e5328]
fdiv dword [ebx + reloc.USER32.dll_MessageBoxA]
popal
mov al, bl
and al, 0x8a
fsub dword [ebx]
sub cl, byte [ecx - 0x74b8f228]
fsub dword [ecx - reloc.USER32.dll_MessageBoxA]
aam 0x87
fdiv st(4)
sub byte [edx - 0x76cc2128], cl
fadd dword [eax - 0x32777c2]
fmul qword [eax - 0x77b02228]
fdiv st(5)
add dword [eax - reloc.USER32.dll_MessageBoxA], ecx
fdivr st(1)
ljmp 0xd888
mov dx, word [esp]
jmp 0x445023
dec ebp
and eax, eax
jno 0x444fe8
mov dx, word [esp]
lea ecx, [eax + esi]
xchg dl, al
mov dx, word [esp]
lea eax, [esi*4]
call fcn.00445067
cmp byte [edx + 0xfba4f28], bh
sbb ecx, dword [ebp - 0x3d79cff4]
lea ecx, [eax + esi]
xchg dl, al
mov dx, word [esp]
jmp 0x445032
lea eax, [esi*4]
jmp 0x4450b0
and dx, 0x6b55
jmp 0x444ffe
add ebp, 0x1baa536a
jmp 0x4450bc
mov edx, 0xc3a79158
inc edx
jge 0x4450fd
not ax
jmp 0x445100
add ebp, dword [esi]
mov ecx, 0xb074a5dd
not ax
btc dx, bp
jmp 0x445118
not ax
jmp 0x4450e7
jmp 0x4451c6
ja 0x445102
jbe 0x4451c6
sbb al, 0x9b
or ebp, dword [esi - 0x63]
popfd
pop ebp
jb 0x445124
xchg edx, eax
cmc
add al, 0xb7
dec ecx
call 0x8bab1dbd
salc
Function at 0x44904f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, 0x79ed7313
mov bh, ch
pop ebx
jmp 0x4495c9
mov ebx, dword [esp]
mov ah, 0x10
mov dx, bp
jmp 0x449126
neg ebp
dec dh
jmp 0x4490af
js 0x44908f
mov ebx, dword [esp]
mov ah, 0x10
jmp 0x449201
not al
bsr dx, ax
jp 0x4490a5
jnp 0x4490a5
xchg dword [esp], ecx
pushal
mov bh, ch
rdtsc
lea edx, [ebx + ebp]
lea ecx, [ecx - 0xe3]
jmp 0x449184
xor ebp, 0x7a91f0d3
jmp 0x449161
mov bx, word [esp]
mov ah, al
mov al, ah
mov bh, byte [esp]
bsr ebx, ebx
jge 0x4491d4
xchg dx, ax
lea eax, [ecx + ebp]
jmp 0x4491ac
lea eax, [ecx + ecx]
dec dx
not eax
call fcn.00449152
mov bh, ah
clc
jae 0x4491af
bts dx, cx
jmp 0x4491b3
xchg dx, ax
lea eax, [ecx + ebp]
inc ebp
jmp 0x449190
bts dx, cx
jmp 0x4491d6
rdtsc
shr dl, 2
jmp 0x4491e9
jmp 0x4491a6
not ebp
setge bl
mov ebx, 0x616d039c
add ebp, dword [edi]
cmp dx, 0xf2e3
jmp 0x449246
mov dx, bp
call fcn.004490f6
jo 0x4491b5
rdtsc
shr dl, 2
jmp 0x4491e9
neg ebp
mov bh, byte [esp]
xchg al, bl
jmp 0x4490ca
add eax, 0x453bd6f
js 0x44927a
jns 0x44927a
xor bl, 0x19
mov ax, bx
jmp 0x449614
bswap eax
lea edx, reloc.USER32.dll_MessageBoxA
bswap edx
rdtsc
mov ah, 0x55
jmp 0x4496c6
mov ax, word [esp]
lea eax, [esp + edi]
jmp 0x449683
jmp 0x449644
xchg dword [esp + 0xc], edx
jmp 0x4496a6
xchg dword [esp + 0xc], edx
sub esp, 5
rol dx, 0
pop dword [esp + 2]
jmp 0x449690
sub bl, 0x19
mov dx, di
sub esp, 0x1b
ja 0x44965c
jbe 0x449666
lea esp, [esp + 0x1c]
sub bl, 0x2b
sub edx, 0x8adcff28
jmp 0x4496db
sub esp, 5
rol dx, 0
pop dword [esp + 2]
jmp 0x449690
xor bl, 0x1e
bswap edx
mov dh, 0x1b
bsr edx, edx
js 0x44965a
mov ax, word [esp]
lea eax, [esp + edi]
jmp 0x449683
jb 0x4496f1
dec eax
dec dx
jmp 0x449b51
dec eax
dec dx
inc dl
call fcn.00449b24
add byte [ebx + 0x13a55633], ah
inc esi
in al, 0x7a
sbb eax, 0x11916bec
and eax, 0x3c10a413
xchg ebp, eax
invalid
inc dl
jmp 0x4496f6

Function at 0x4490f6
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [ebx*4]
lea ebx, reloc.USER32.dll_MessageBoxA
shr ax, 0xb
rdtsc
lea edx, [eax*4]
jmp 0x4490d4
Function at 0x474783
Capabilities:
Encrypt data using aes

Disassembly:
and edi, esi
bswap ebp
jmp 0x474785
jmp 0x47476d
push ebx
mov ebx, edi
lea ebx, [ebx*4]
jmp 0x4747c7
lea ebx, reloc.USER32.dll_MessageBoxA
mov edi, dword [ebx]
pop ebx
lea ebp, [ebp*4]
mov ebx, edx
mov ebp, dword [esp]
jmp 0x4747b1
Function at 0x4748c3
Capabilities:
Encrypt data using aes

Disassembly:
mov dword [esp], ebp
call fcn.00474900
and al, byte [eax + 0x7807116]
mov ebp, 0x47b4ad3d
invalid
Function at 0x474900
Capabilities:
Encrypt data using aes

Disassembly:
add byte [eax], al
and edi, ebp
call 0x4748ea
push cs
mov byte [esi], bl
jns 0x474894
aas
mov al, byte [0x2fdcb525]
pushfd
rcl byte [esi - 0x3c], cl
mov dword [reloc.USER32.dll_MessageBoxA], eax

Function at 0x474a69
Capabilities:
Encrypt data using aes

Disassembly:
pop dword [esp + 4]
jmp 0x474a73
pop dword [esp + 1]
shr edi, 0x10
and edi, esi
jmp 0x474b01
xor ecx, edi
rol di, cl
mov di, dx
btr edi, edx
jmp 0x474aa5
mov edi, dword [edi*4 + reloc.USER32.dll_MessageBoxA]
lea esp, [esp + 0x44]
and ecx, 0xff0000
and edi, 0xff000000
jmp 0x474abb

Function at 0x474c34
Capabilities:
Encrypt data using aes

Disassembly:
xor edx, ecx
jmp 0x474c68
mov dword [eax + 0x1c], edx
stc
lea esp, [esp + 0x30]
cmp ebx, 0x44158c
jmp 0x474c52

Function at 0x474e9b
Capabilities:
Encrypt data using aes

Disassembly:
add ebp, 4
mov dword [ebp], edi
pop ebp
jmp 0x474e41
pushal
push ebp
mov ebp, edx
jmp 0x474e25
lea esp, [esp + 0x2c]
sub ebx, 4
add ecx, 0x10
pushal
jmp 0x474e7a
mov dword [ecx + 4], eax
jmp 0x474e3b
mov word [esp + 6], bp
jmp 0x474e8d
pop word [esp + 0x1a]
lea esp, [esp + 2]
lea esp, [esp + 0x1c]
sub edx, 0x10
pushal
jmp 0x474e64
lea esp, [esp + 0x20]
cmp dword [ebp - 4], ebx
push eax
call 0x474e9b
sub byte [ebp - 0x14f7db9c], cl
xor al, 0x4c
iretd
Function at 0x474f2d
Capabilities:
Encrypt data using aes

Disassembly:
call int.00474f2d
cmp eax, 1
push edi
pop word [esp]
lea esp, [esp + 2]
jmp 0x474f14
mov bh, cl
jmp 0x474f3f
cmp bh, byte [ebx]
mov word [ecx], fs
lea esp, [ecx - 5]
out dx, eax
neg byte [edi + ebp*8 + 0x5351e1f6]
pushal
pop word [esp + 0x18]
jmp 0x435297
call fcn.00475558
leave
sub al, 0x95
sahf
inc ecx
jle 0x435246
adc dword fs:[ebp - reloc.USER32.dll_MessageBoxA], ebp
sti
ror byte [ebp - 0x73], cl
and al, 0x18
lea esp, [esp + 0x18]
push edi
lea esi, [ebx*4]
jmp 0x4352ee
lea esp, [esp + 2]
mov dword [esp + 0x18], esi
jmp 0x435281
jmp 0x474da8
and dword [ebp - 4], 0
push si
adc bx, 0x500
mov word [esp], si
lea esp, [esp + 2]
jmp 0x435310
mov si, 0x49d9
lea esi, reloc.USER32.dll_MessageBoxA
mov esi, ecx
call fcn.00451725
jmp 0x4352c7
mov ebx, eax
clc
shl ebx, 2
jmp 0x474d13
push edi
jmp 0x474d44
mov dword [edi], eax
pop edi
jmp 0x474d77
pushal
mov dword [esp], ebp
popal
add edi, 0xfffffff8
jmp 0x474d2e
test ebx, ebx
jle 0x4351bd
mov dx, word [esp]
shl ah, cl
jmp 0x474dc9
xchg edi, eax
adc edi, eax
mov eax, dword [edx - 8]
mov edi, esi
bswap edi
jmp 0x47514c
lea edx, [esi + ebx*4 + 8]
mov eax, dword [esp]
mov eax, dword [esp]
lea ecx, [esi + 8]
jmp 0x4352b1
mov dword [ecx], eax
bswap eax
mov eax, edi
rcl ah, cl
jmp 0x474eb4
mov eax, dword [edx]
mov dword [edx - 4], edi
mov edi, dword [ecx]
jmp 0x474ddb
shr edi, cl
lea edi, [esi*4]
mov edi, dword [ecx + 4]
call int.00474e5f
ljmp 0x65cf
mov eax, dword [ecx]
pop ecx
pushfd
clc
mov dword [edx], edi
jmp 0x474dfa
push ecx
mov ecx, edx
add ecx, 4
jmp 0x474e1c
mov dword [edx - 8], edi
mov edi, dword [ecx - 4]
mov dword [ecx - 4], eax
jmp 0x474df1
lea ecx, [eax - 1]
lea edx, [edx + ebp]
cmc
lea edx, [ecx + edx]
bswap ebx
jmp 0x474f55
jle 0x43526b
jg 0x474efe
test al, 0x3a
test al, 0xcf
cmp cl, byte [ebp - 0x1570e076]
sbb ecx, esp
in eax, dx
cld
iretd
push word [esp + 2]
lea esp, [esp + 2]
lea esp, [esp + 4]
jmp 0x4351c2
mov ebx, 0x453cd252
jmp 0x474f7a
mov dword [ebp - 4], ecx
xchg dl, bl
mov ecx, 0xff
jmp 0x43520a
sub esp, 0xc
xchg dword [esp + 2], edx
jmp 0x474fa3
movzx ebx, byte [esi + 0x11]
mov ebx, dword [ebx*4 + reloc.USER32.dll_MessageBoxA]
neg dl
mov di, 0xedc7
jmp 0x474f64
mov edx, dword [esi]
call fcn.004750c0
aas
test eax, 0x1aab5839
pop edi
retf 0x3f58
lea esp, [esp + 0xc]
add esi, 0x10
jmp 0x474f8d
mov dword [ecx - 8], eax
mov ax, 0x3575
not ax
mov eax, dword [edx - 4]
jmp 0x474ef0
mov edi, dword [ecx - 8]
add dword [ebp - 4], 4
pushfd
jmp 0x474fba
Function at 0x47504e
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
lea esp, [esp + 0x18]
xor edi, dword [ebx*4 + reloc.USER32.dll_MessageBoxA]
cmp ebx, 0xdd03182f
btc bx, si
lea ebx, reloc.USER32.dll_MessageBoxA
jmp 0x47502a
mov edi, dword [edi*4 + reloc.USER32.dll_MessageBoxA]
sub esp, 8
mov byte [esp + 4], dh
and ebx, ecx
jmp 0x474ff5
movzx ebx, byte [esi + 2]
mov ebx, dword [ebx*4 + reloc.USER32.dll_MessageBoxA]
cmc
jmp 0x475091
and edx, ecx
sub esp, 0xe
sub esp, 2
jmp 0x475071
sub esp, 5
mov byte [esp + 4], al
lea esp, [esp + 1]
jmp 0x475018
lea esp, [esp + 0x30]
xor edi, dword [edx*4 + reloc.USER32.dll_MessageBoxA]
stc
jmp 0x4750a1
mov edx, dword [edx*4 + reloc.USER32.dll_MessageBoxA]
and edx, ecx
cmc
jmp 0x47505b
and ebx, ecx
xor edi, dword [ebx*4 + reloc.USER32.dll_MessageBoxA]
movzx ebx, byte [esi + 5]
pushal
jmp 0x475038
lea edx, [ebx*4]
bsf dx, sp
jmp 0x4750e3
mov ebx, dword [ebx*4 + reloc.USER32.dll_MessageBoxA]
jmp 0x475118
mov edx, dword [esi + 4]
mov dword [esi], edi
mov edi, 0x6b0c932e
cmc
jmp 0x4750cd
shr edi, 0x18
sub esp, 0xe
lea esp, [esp + 2]
push ebp
jmp 0x475123
pushfd
and edi, ecx
stc
mov edi, dword [edi*4 + reloc.USER32.dll_MessageBoxA]
jmp 0x4751cb
pushal
bsr bp, sp
mov dword [esp], edx
popal
jmp 0x4750f0
mov ebp, edi
lea ebp, [ebp*4]
lea ebp, reloc.USER32.dll_MessageBoxA
mov edi, dword [ebp]
pop ebp
jmp 0x4750fd
push eax
jmp 0x47519e
lea esp, [esp + 0x1c]
xor edi, dword [ebx*4 + reloc.USER32.dll_MessageBoxA]
setb bh
xchg bl, bh
lea ebx, [ecx*4]
jmp 0x475159
push bx
push word [esp]
push si
pop word [esp]
jmp 0x4751a9
mov eax, esi
add eax, 6
movzx ebx, byte [eax]
pop eax
jmp 0x475188
mov ebx, dword [ebx*4 + reloc.USER32.dll_MessageBoxA]
and ebx, ecx
lea esp, [esp + 4]
jmp 0x475200
push dx
lea esp, [esp + 2]
and ebx, ecx
sub esp, 0xc
jmp 0x47516f
cmc
and edx, ecx
cmc
push eax
jmp 0x4751e3
mov eax, edx
lea eax, [eax*4]
lea eax, reloc.USER32.dll_MessageBoxA
mov edx, dword [eax]
jmp 0x47524a
xor edi, dword [ebx*4 + reloc.USER32.dll_MessageBoxA]
neg ebx
mov bx, word [esp]
lea ebx, [eax + edx]
movzx ebx, byte [esi + 9]
jmp 0x4751d8
lea esp, [esp + 0x10]
xor edi, dword [edx*4 + reloc.USER32.dll_MessageBoxA]
mov dh, ch
not edx
jmp 0x4752ba
pushfd
lea esp, [esp + 3]
lea esp, [esp + 1]
jmp 0x475216
pop eax
sub esp, 0xe
mov byte [esp + 1], al
push word [esp + 8]
and edx, ecx
jmp 0x47522c
mov edi, dword [esp]
setge bh
bt bp, ax
mov dword [esp + 0x18], esi
call fcn.00475271
btr edi, ecx
mov edi, edx
jmp 0x4752d9
mov edx, dword [esi + 8]
push ecx
pushal
jmp 0x47528e
shr edi, 0x18
call fcn.004752c1
and ebx, ecx
sub esp, 5
mov word [esp], bx
lea esp, [esp + 2]
jmp 0x475cb3
lea esp, [esp + 3]
lea esp, [esp + 0x24]
xor edi, dword [ebx*4 + reloc.USER32.dll_MessageBoxA]
pushal

Function at 0x4750c0
Capabilities:
Encrypt data using aes

Disassembly:
and edi, ecx
call fcn.0047504e
or dl, byte [edx + 0x22926700]
mov byte [edi], dl
xchg edx, esp
adc dword [eax - reloc.USER32.dll_MessageBoxA], ebp
les eax, [esi]
add esp, 6
lea esp, [esp + 3]
shr edi, 0x18
mov edi, dword [edi*4 + reloc.USER32.dll_MessageBoxA]
jmp 0x474fcc
mov edi, dword [esp]
mov edi, edx
sub esp, 0xd
jmp 0x474fe2
Function at 0x4ea337
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
in eax, dx
mov si, word [esp + 1]
mov dh, 0xd6
mov edx, dword [esp + 4]
sub esp, 0x1b
inc edi
jmp 0x4ea6fb
setp dh
mov si, word [esp + 2]
jmp 0x4ea282
xchg esi, eax
invalid
call 0x4ea2c7
mov dword [esp], esp
call 0x4ea316
push eax
rcl byte [esi + 0x31], 0xc0
out dx, al
jge 0x4ea2e0
invalid
je 0x4ea27c
je 0x4ea2c3
pop edi
mov dword [esp], ebx
call 0x4ea2e2
pushfd
mov byte [esp + 2], cl
push ax
mov dword [esp], eax
mov word [esp], bx
jmp 0x4ea327
mov byte [esp], ah
lea esp, [esp + 2]
mov dword [esp], esi
call 0x4ea337
adc al, 0x88
and al, 1
pop word [esp]
lea esp, [esp + 2]
jmp 0x4ea372
mov eax, dword [eax + 0x1c]
jmp 0x4ea37e
push edi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x4ea35c
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0x4ea3e6
not si
mov esi, dword [esp + 0x28]
lea esp, [esp + 0x2c]
popfd
lea esp, [esp + 4]
jmp 0x4ea2dd
mov si, word [esp]
inc esi
rcl esi, cl
std
mov esi, dword [esp]
mov si, word [esp]
jmp 0x4ea540
mov di, word [esp + 0x13]
push dword [esp + 8]
mov word [esp + 0xc], di
lea esp, [esp + 3]
mov edi, dword [esp + 0x24]
mov si, ax
jmp 0x4ea6a2

Function at 0x4ea422
Capabilities:
Parse pe header

Disassembly:
push dx
lea esp, [esp + 3]
push edx
call fcn.004ea34f
lea esp, [esp + 3]
mov byte [esp], cl
jmp 0x4ea396

Function at 0x401000
Capabilities:
Execute command

Disassembly:
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.00401020
push str.pause
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
xor eax, eax
ret

Function at 0x401aef
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401b2e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401b2e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401b2e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401b2e
cmp dword [ecx + 0x74], 0xe
jbe 0x401b2e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x40d060], 1
mov dword [0x40d05c], 1
mov dword [0x40d058], 1
mov dword [0x40d050], 1
jne 0x401060
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010c0
mov dword [0x40d014], eax
mov eax, dword [0x40d06c]
test eax, eax
je 0x4010b0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x40d080]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x40d068]
mov dword [eax], edx
call sym.__setargv
cmp dword [0x409020], 1
je 0x4010f0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x40107a
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x401108
cmp dx, 0x20b
jne 0x401060
cmp dword [ecx + 0x84], 0xe
jbe 0x401060
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401060
mov dword [esp], sym.__matherr
call sym.___mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401060
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401060

Function at 0x4015d0
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x214
call sym.___main
lea eax, [ebp - 0x1a0]
mov dword [esp + 4], eax
mov dword [esp], 0x202
mov eax, dword [sym.imp.WS2_32.dll_WSAStartup]
call eax
sub esp, 8
mov dword [esp + 4], 0x64
lea eax, [ebp - 0x204]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_gethostname]
call eax
sub esp, 8
lea eax, [ebp - 0x204]
mov dword [esp + 4], eax
mov dword [esp], str.Hostname:__s_n
call dbg.printf(char const*, ::)
lea eax, [ebp - 0x204]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_gethostbyname]
call eax
sub esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_inet_ntoa]
call eax
sub esp, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov dword [esp], str.Local_IP_Address:__s_n
call dbg.printf(char const*, ::)
mov dword [esp], 0x40a068
call dbg.printf(char const*, ::)
mov eax, dword [sym.imp.WS2_32.dll_WSACleanup]
call eax
mov eax, 0
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret

Function at 0x401910
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call sym.___acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call sym.___acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]
Function at 0x401970
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x40d074]
test esi, esi
jle 0x401a90
mov eax, dword [0x40d078]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x4019a4
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x401a27
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x401990
mov dword [esp], ebx
call sym.___mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x401ab7
mov eax, dword [0x40d078]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call sym.__GetPEImageBase
mov edx, dword [0x40d078]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401a97
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x401a20
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x401a30
add dword [0x40d074], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x40d078]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x401a20
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call sym.___report_error
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x4019ae
mov eax, dword [0x40d078]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call sym.___report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call sym.___report_error
lea esi, [esi]
nop

Function at 0x401f70
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x40d090
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x40d088]
sub esp, 4
test ebx, ebx
je 0x401fc5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x401fbe
test esi, esi
je 0x401fbe
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401fa0
mov dword [esp], 0x40d090
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4010a5
Capabilities:
Create process on windows

Disassembly:
call fcn.004015ed
mov ecx, 0xa
push ecx
push 0x64
call sub.kernel32.dll_Sleep
pop ecx
loop 0x4010af
jmp 0x4010c6
push str.05387337392A1344752065696CECC1696B3E2A69B6E885652347206E6174206D6561722073A5866785
push 0
push dword [0x4053e6]
call sub.kernel32.dll_OpenMutexA
cmp eax, 0
je 0x4010e4
push 0
call sub.kernel32.dll_ExitProcess
call fcn.004013e3
call fcn.0040164f
cmp byte [0x403c9a], 0
jbe 0x4010f9
jmp 0x401110
push 5
push 0
push 0
push 0x405f47
push str.open
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x4010aa
Function at 0x4013e3
Capabilities:
Set registry value

Disassembly:
push 0x405f47
call fcn.00401b70
mov dword [0x403f84], eax
push 0x406347
push 0xf003f
push 0
push str.1A2466363E2F7236296D0C0A1E4353060D54373E074E000A57347C2D100652080B15244501160E080B1539550C356E2047332065686C2C20686B206B5B6E206454617514585347165E20533417415651555C
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
push dword [0x403f84]
push 0x405f47
push 1
push 0
push str.1919490C1D4E73031A4F090C1E2C67696B206B690E868665A09A616E6574206D296530207BFFB96705
push dword [0x406347]
call sub.advapi32.dll_RegSetValueExA
push dword [0x406347]
call sub.advapi32.dll_RegCloseKey
jmp 0x401443
push 0x405e47
call fcn.00401b70
mov dword [0x403f84], eax
push 0x406347
push str.1A2466363E2F7236296D0C0A1E4353060D54373E074E000A57347C2D100652080B15244501160E080B151B4F0E000D4916067C20111C404F1B0E52373B1B4E6465204720EE40AA208D1EBD72800EB967071A
push 0x80000002
call sub.advapi32.dll_RegCreateKeyA
push dword [0x403f84]
push 0x405e47
push 1
push 0
push str.05044303053D451000520C1D156D551D034F19001A5937104234591D11114D6D656172207365676765
push dword [0x406347]
call sub.advapi32.dll_RegSetValueExA
push dword [0x406347]
call sub.advapi32.dll_RegCloseKey
call fcn.0040159c
call fcn.004014f3
push 0x405e47
push 0x40654f
call fcn.00401aa0
cmp eax, 0
jbe 0x4014b5
call fcn.004014d2
jmp 0x4014c6
call fcn.004014c7
jmp 0x4014c6
ret

Function at 0x4014f3
Capabilities:
Set registry value

Disassembly:
push 0x406347
push 0xf003f
push 0
push str.1A2466363E2F7236296D0C0A1E4353060D54373E074E000A57340020312863181713174E073302151620044E3E20034114100023000049002C1345081C1A490B0B0008501A0C1B4E1E3961721036555F5727
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
jmp 0x40151a
push 0x40634b
push str.3D0A53090409525D1058006935EB80698B5BF0690E5FFF65803ABB6E015474081D1548209AA2C76715
push dword [0x406347]
call sub.advapi32.dll_RegCreateKeyA
push 2
push 0x403c97
push 1
push 0
push str.0D0E42170E09450175205F696CEC80696B3E2A69AEE8C4652347206E6174206D6561722073A5C76785
push dword [0x40634b]
call sub.advapi32.dll_RegSetValueExA
push dword [0x40634b]
call sub.advapi32.dll_RegCloseKey
push 0x40634b
push str.3B0E47070D07545D10580069E5EB80698B5BF069CE5DFF65E052BA6EC5F5BE6D65617220D2A2C76765
push dword [0x406347]
call sub.advapi32.dll_RegCreateKeyA
push 2
push 0x403c97
push 1
push 0
push str.0D0E42170E09450175205F696CEC80696B3E2A69AEE8C4652347206E6174206D6561722073A5C76785
push dword [0x40634b]
call sub.advapi32.dll_RegSetValueExA
push dword [0x40634b]
call sub.advapi32.dll_RegCloseKey
push dword [0x406347]
call sub.advapi32.dll_RegCloseKey
ret

Function at 0x4015ff
Capabilities:
Set registry value

Disassembly:
mov ecx, 0x22
mov ebx, ecx
push ecx
sub ebx, 1
imul ebx, ebx, 4
add ebx, 0x404146
push 0x405947
push dword [ebx]
call fcn.004019e4
push 4
push 0x405a47
push 0x405947
call fcn.00401bc0
push 4
push 0x403f9c
push 4
push 0
push 0x405a47
push dword [0x406347]
call sub.advapi32.dll_RegSetValueExA
pop ecx
loop 0x401604
ret