joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4069db
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x40c570]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040421f
and dword [ebp - 0x14], 0
cmp dword [0x423e4c], 0
mov dword [ebp - 0x18], eax
jne 0x406a8e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x406b36
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x406b36
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x423e4c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x423e50], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x423e54], eax
call edi
push eax
call esi
mov dword [0x423e5c], eax
test eax, eax
je 0x406a8e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x423e58], eax
mov eax, dword [0x423e58]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x406ae7
cmp dword [0x423e5c], ecx
je 0x406ae7
push eax
call esi
push dword [0x423e5c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x406ae7
test ebx, ebx
je 0x406ae7
call edi
test eax, eax
je 0x406ade
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x406ade
test byte [ebp - 8], 1
jne 0x406ae7
or dword [ebp + 0x10], 0x200000
jmp 0x406b1a
mov eax, dword [0x423e50]
cmp eax, dword [ebp - 0x18]
je 0x406b1a
push eax
call esi
test eax, eax
je 0x406b1a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x406b1a
mov eax, dword [0x423e54]
cmp eax, dword [ebp - 0x18]
je 0x406b1a
push eax
call esi
test eax, eax
je 0x406b1a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x423e4c]
call esi
test eax, eax
je 0x406b36
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x406b38
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405712
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x402d70
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x14c
mov eax, dword [esp + 0x158]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [esp + 0x154]
mov dword [esp], eax
call fcn.0041a59f
mov eax, dword [esp + 0x158]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x41eae1
mov eax, dword [esp + 0x154]
mov dword [esp], eax
call fcn.00419918
mov dword [esp + 4], 0
mov dword [esp], 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
sub esp, 8
mov dword [esp + 0x13c], eax
cmp dword [esp + 0x13c], 0
je 0x402e71
mov dword [esp + 0x14], 0x128
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x13c]
mov dword [esp], eax
call sub.KERNEL32.dll_Process32First
sub esp, 8
test eax, eax
je 0x402e5e
mov eax, dword [esp + 0x1c]
cmp eax, dword [esp + 0x150]
jne 0x402e40
mov eax, dword [esp + 0x158]
mov dword [esp + 8], eax
lea eax, [esp + 0x14]
add eax, 0x24
mov dword [esp + 4], eax
mov eax, dword [esp + 0x154]
mov dword [esp], eax
call fcn.00419918
jmp 0x402e5e
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x13c]
mov dword [esp], eax
call sub.KERNEL32.dll_Process32Next
sub esp, 8
test eax, eax
jne 0x402e0c
mov eax, dword [esp + 0x13c]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
nop
nop
add esp, 0x14c
ret
Function at 0x408b4b
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x1ac
lea eax, [esp + 0x10]
mov dword [esp + 4], eax
mov dword [esp], 0x202
call sub.WS2_32.dll_WSAStartup
sub esp, 8
test eax, eax
je 0x408b78
mov dword [esp], 0
call sub.KERNEL32.dll_ExitProcess
mov dword [esp], 0x42430c
call sub.KERNEL32.dll_InitializeCriticalSection
sub esp, 4
nop
add esp, 0x1ac
ret

Function at 0x408b8f
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x4c
mov dword [esp + 0x3c], 0xffffffff
cmp dword [esp + 0x58], 0
jne 0x408bab
mov dword [esp + 0x5c], 0
jmp 0x408bc2
cmp dword [esp + 0x5c], 0xffffffff
jne 0x408bc2
mov eax, dword [esp + 0x58]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x5c]
add eax, 5
mov dword [esp + 0x30], eax
mov dword [esp + 0x38], 0
mov eax, dword [esp + 0x30]
mov dword [esp + 0x34], eax
mov dword [esp], 0x42430c
call sub.KERNEL32.dll_EnterCriticalSection
sub esp, 4
mov dword [esp + 4], 0x2d
mov eax, dword [esp + 0x50]
mov dword [esp], eax
call fcn.00408dd9
test al, al
je 0x408d53
mov eax, dword [0x424324]
cmp dword [esp + 0x30], eax
jbe 0x408c42
mov eax, dword [0x424328]
test eax, eax
je 0x408c28
mov dword [esp], 0x424328
call fcn.0040b4bf
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [0x424328], eax
mov eax, dword [esp + 0x30]
mov dword [0x424324], eax
mov eax, dword [0x424328]
test eax, eax
je 0x408d53
cmp dword [esp + 0x5c], 0
jle 0x408cbd
mov eax, dword [0x41e7c8]
cmp dword [esp + 0x50], eax
jne 0x408c9c
mov eax, dword [esp + 0x5c]
mov edx, dword [0x424328]
add edx, 5
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0x58]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x427280
mov dword [esp], 0x4272a0
call fcn.004057d1
jmp 0x408cbd
mov eax, dword [esp + 0x5c]
mov edx, dword [0x424328]
add edx, 5
mov dword [esp + 8], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.0041a5e1
mov eax, dword [0x424328]
mov edx, dword [esp + 0x5c]
add edx, 1
mov dword [eax], edx
mov eax, dword [0x424328]
lea edx, [eax + 4]
mov eax, dword [esp + 0x54]
mov byte [edx], al
jmp 0x408d46
mov edx, dword [esp + 0x34]
mov ecx, dword [0x424328]
mov eax, dword [esp + 0x38]
add ecx, eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
mov dword [esp + 0x3c], eax
cmp dword [esp + 0x3c], 0xffffffff
jne 0x408d36
call fcn.00407c84
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x2c], 0x2733
jne 0x408d52
mov dword [esp], 1
call fcn.0040b294
jmp 0x408d46
mov eax, dword [esp + 0x3c]
add dword [esp + 0x38], eax
mov eax, dword [esp + 0x3c]
sub dword [esp + 0x34], eax
mov eax, dword [esp + 0x38]
cmp eax, dword [esp + 0x30]
jb 0x408cdb
jmp 0x408d53
nop
mov dword [esp], 0x42430c
call sub.KERNEL32.dll_LeaveCriticalSection
sub esp, 4
cmp dword [esp + 0x38], 0
jne 0x408d70
mov eax, 0xffffffff
jmp 0x408d86
cmp dword [esp + 0x3c], 0xffffffff
je 0x408d80
mov eax, dword [esp + 0x38]
sub eax, 5
jmp 0x408d85
mov eax, 0xffffffff
nop
add esp, 0x4c
ret
Function at 0x409508
Capabilities:
Get disk information

Disassembly:
push ebx
mov eax, 0x1028
call fcn.0041ce38
sub esp, eax
lea eax, [esp + 0x1c]
mov dword [esp + 4], eax
mov dword [esp], 0x1000
call sub.KERNEL32.dll_GetLogicalDriveStringsA
sub esp, 8
test eax, eax
jne 0x40955c
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xa5
mov eax, dword [esp + 0x1030]
mov dword [esp], eax
call fcn.00408b8f
jmp 0x4095e5
mov dword [esp + 0x101c], 0
jmp 0x4095a6
mov eax, dword [esp + 0x101c]
lea ebx, [eax + 2]
lea edx, [esp + 0x1c]
mov eax, dword [esp + 0x101c]
add eax, edx
mov dword [esp], eax
call sub.KERNEL32.dll_GetDriveTypeA
sub esp, 4
mov byte [esp + ebx + 0x1c], al
mov eax, dword [esp + 0x101c]
add eax, 3
mov byte [esp + eax + 0x1c], 7
add dword [esp + 0x101c], 4
lea edx, [esp + 0x1c]
mov eax, dword [esp + 0x101c]
add eax, edx
movzx eax, byte [eax]
test al, al
jne 0x409569
mov eax, dword [esp + 0x101c]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 4], 0xa4
mov eax, dword [esp + 0x1030]
mov dword [esp], eax
call fcn.00408b8f
nop
add esp, 0x1028
pop ebx
ret
Function at 0x409f53
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x8dc
mov eax, dword [esp + 0x8e8]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x41ecc3
mov eax, dword [esp + 0x8e4]
mov dword [esp], eax
call fcn.00419918
mov dword [esp + 4], 0x41ecc5
mov eax, dword [esp + 0x8e0]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov dword [esp + 0x8c4], eax
cmp dword [esp + 0x8c4], 0
je 0x40a13f
lea eax, [esp + 0x14]
mov dword [esp], eax
call fcn.0040fec8
jmp 0x409fd7
mov eax, dword [esp + 0x8c0]
mov dword [esp + 8], eax
lea eax, [esp + 0xae]
mov dword [esp + 4], eax
lea eax, [esp + 0x14]
mov dword [esp], eax
call fcn.0040ff0b
mov eax, dword [esp + 0x8c4]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x800
mov dword [esp + 4], 1
lea eax, [esp + 0xae]
mov dword [esp], eax
call sub.msvcrt.dll_fread
mov dword [esp + 0x8c0], eax
cmp dword [esp + 0x8c0], 0
je 0x40a01b
mov eax, dword [0x424330]
test eax, eax
jne 0x409fb5
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
lea eax, [esp + 0x8ae]
mov dword [esp], eax
call fcn.00410066
mov dword [esp + 0x8cc], 0
mov dword [esp + 0x8c8], 0
jmp 0x40a10b
lea edx, [esp + 0x8ae]
mov eax, dword [esp + 0x8cc]
add eax, edx
movzx eax, byte [eax]
shr al, 4
mov byte [esp + 0x8bf], al
lea edx, [esp + 0x8ae]
mov eax, dword [esp + 0x8cc]
add eax, edx
movzx eax, byte [eax]
and eax, 0xf
mov byte [esp + 0x8be], al
mov eax, dword [esp + 0x8c8]
lea edx, [eax + 1]
mov dword [esp + 0x8c8], edx
mov edx, eax
mov eax, dword [esp + 0x8e4]
add edx, eax
cmp byte [esp + 0x8bf], 9
ja 0x40a0b4
mov eax, 0x30
jmp 0x40a0b9
mov eax, 0x37
movzx ecx, byte [esp + 0x8bf]
add eax, ecx
mov byte [edx], al
mov eax, dword [esp + 0x8c8]
lea edx, [eax + 1]
mov dword [esp + 0x8c8], edx
mov edx, eax
mov eax, dword [esp + 0x8e4]
add edx, eax
cmp byte [esp + 0x8be], 9
ja 0x40a0f2
mov eax, 0x30
jmp 0x40a0f7
mov eax, 0x37
movzx ecx, byte [esp + 0x8be]
add eax, ecx
mov byte [edx], al
add dword [esp + 0x8cc], 1
cmp dword [esp + 0x8cc], 0xf
jle 0x40a04d
mov eax, dword [esp + 0x8e8]
lea edx, [eax - 1]
mov eax, dword [esp + 0x8e4]
add eax, edx
mov byte [eax], 0
mov eax, dword [esp + 0x8c4]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
nop
add esp, 0x8dc
ret
Function at 0x40a8af
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x9c
mov dword [esp + 0x8c], 0
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
lea eax, [esp + 0x48]
mov dword [esp], eax
call fcn.0041a59f
mov dword [esp + 0x48], 0x44
cmp dword [esp + 0xa8], 0
jne 0x40a908
mov dword [esp + 0x74], 1
mov word [esp + 0x78], 0
mov dword [esp + 0x8c], 0x8000000
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
lea eax, [esp + 0x38]
mov dword [esp], eax
call fcn.0041a59f
mov eax, dword [esp + 0x8c]
lea edx, [esp + 0x38]
mov dword [esp + 0x24], edx
lea edx, [esp + 0x48]
mov dword [esp + 0x20], edx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 0xa4]
mov dword [esp + 4], eax
mov eax, dword [esp + 0xa0]
mov dword [esp], eax
call sub.KERNEL32.dll_CreateProcessA
sub esp, 0x28
test eax, eax
je 0x40a9a7
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
nop
nop
add esp, 0x9c
ret

Function at 0x40a9af
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x2c
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call sub.KERNEL32.dll_GetFileAttributesA
sub esp, 4
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], 0xffffffff
je 0x40a9f9
mov eax, dword [esp + 0x1c]
and eax, 4
test eax, eax
jne 0x40a9e2
mov eax, dword [esp + 0x1c]
and eax, 2
test eax, eax
je 0x40a9f9
mov dword [esp + 4], pe_nt_image_headers32
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call sub.KERNEL32.dll_SetFileAttributesA
sub esp, 8
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call sub.KERNEL32.dll_DeleteFileA
sub esp, 4
test eax, eax
setne al
add esp, 0x2c
ret

Function at 0x40aa11
Capabilities:
Move file

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sub.KERNEL32.dll_MoveFileA
sub esp, 8
test eax, eax
setne al
add esp, 0x1c
ret

Function at 0x40aa34
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x2c
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call sub.KERNEL32.dll_GetFileAttributesA
sub esp, 4
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], 0xffffffff
je 0x40aa63
mov eax, dword [esp + 0x1c]
and eax, 0x10
test eax, eax
jne 0x40aa63
mov eax, 1
jmp 0x40aa68
mov eax, 0
and eax, 1
add esp, 0x2c
ret

Function at 0x40aa6f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x2c
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call sub.KERNEL32.dll_GetFileAttributesA
sub esp, 4
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], 0xffffffff
je 0x40aa9e
mov eax, dword [esp + 0x1c]
and eax, 0x10
test eax, eax
je 0x40aa9e
mov eax, 1
jmp 0x40aaa3
mov eax, 0
and eax, 1
add esp, 0x2c
ret
Function at 0x40aaaa
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x24
mov dword [esp + 0x1c], 0
mov byte [esp + 0x1b], 0
mov dword [esp + 4], 0x41ecc5
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], 0
jne 0x40aae5
mov eax, 0
jmp 0x40abff
mov dword [esp + 4], 0x41eccd
mov eax, dword [esp + 0x34]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], 0
je 0x40abd6
mov dword [esp + 0x1c], 0x8000
jmp 0x40abbf
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.msvcrt.dll_calloc
mov ebx, eax
test ebx, ebx
je 0x40abbb
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call sub.msvcrt.dll_fread
mov esi, eax
test esi, esi
jg 0x40ab8c
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0xc]
and eax, 0x20
test eax, eax
jne 0x40ab7c
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0xc]
and eax, 0x10
test eax, eax
je 0x40ab7c
mov eax, 1
jmp 0x40ab81
mov eax, 0
mov byte [esp + 0x1b], al
and byte [esp + 0x1b], 1
jmp 0x40abb1
mov eax, esi
mov edx, dword [esp + 0x10]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call sub.msvcrt.dll_fwrite
cmp eax, esi
jne 0x40abb0
jmp 0x40ab33
nop
mov dword [esp], ebx
call sub.msvcrt.dll_free
jmp 0x40abca
sar dword [esp + 0x1c], 1
cmp dword [esp + 0x1c], 0x7f
jg 0x40ab15
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
movzx eax, byte [esp + 0x1b]
xor eax, 1
test al, al
je 0x40abfa
mov eax, dword [esp + 0x34]
mov dword [esp], eax
call fcn.0040a9af
movzx eax, byte [esp + 0x1b]
add esp, 0x24
pop ebx
pop esi
ret

Function at 0x40acbe
Capabilities:
Create directory

Disassembly:
sub esp, 0x1c
mov dword [esp + 4], 0
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sub.KERNEL32.dll_CreateDirectoryA
sub esp, 8
test eax, eax
setne al
add esp, 0x1c
ret
Function at 0x40afc7
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x42c
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0
lea eax, [esp + 0x14]
mov dword [esp], eax
call fcn.0041a59f
mov eax, dword [esp + 0x438]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [esp + 0x434]
mov dword [esp], eax
call fcn.0041a59f
call sub.KERNEL32.dll_GetCommandLineA
mov dword [esp + 8], 0x400
mov dword [esp + 4], eax
lea eax, [esp + 0x14]
mov dword [esp], eax
call fcn.00419918
mov dword [esp + 0x41c], 0
mov dword [esp + 0x418], 0
mov dword [esp + 0x414], 0
jmp 0x40b1e9
lea edx, [esp + 0x14]
mov eax, dword [esp + 0x41c]
add eax, edx
movzx eax, byte [eax]
cmp al, 0x22
jne 0x40b11c
add dword [esp + 0x41c], 1
jmp 0x40b0a5
mov eax, dword [esp + 0x418]
lea edx, [eax + 1]
mov dword [esp + 0x418], edx
mov edx, eax
mov eax, dword [esp + 0x434]
lea ecx, [edx + eax]
mov eax, dword [esp + 0x41c]
lea edx, [eax + 1]
mov dword [esp + 0x41c], edx
movzx eax, byte [esp + eax + 0x14]
mov byte [ecx], al
lea edx, [esp + 0x14]
mov eax, dword [esp + 0x41c]
add eax, edx
movzx eax, byte [eax]
cmp al, 0x22
je 0x40b0cd
lea edx, [esp + 0x14]
mov eax, dword [esp + 0x41c]
add eax, edx
movzx eax, byte [eax]
test al, al
jne 0x40b070
mov edx, dword [esp + 0x418]
mov eax, dword [esp + 0x434]
add eax, edx
mov byte [eax], 0
mov eax, dword [esp + 0x414]
lea edx, [eax + 1]
mov dword [esp + 0x414], edx
cmp eax, dword [esp + 0x430]
jne 0x40b104
mov eax, 1
jmp 0x40b206
add dword [esp + 0x41c], 1
mov dword [esp + 0x418], 0
jmp 0x40b1e9
lea edx, [esp + 0x14]
mov eax, dword [esp + 0x41c]
add eax, edx
movzx eax, byte [eax]
cmp al, 0x20
jne 0x40b17a
add dword [esp + 0x41c], 1
add dword [esp + 0x430], 1
jmp 0x40b1e9
mov eax, dword [esp + 0x418]
lea edx, [eax + 1]
mov dword [esp + 0x418], edx
mov edx, eax
mov eax, dword [esp + 0x434]
lea ecx, [edx + eax]
mov eax, dword [esp + 0x41c]
lea edx, [eax + 1]
mov dword [esp + 0x41c], edx
movzx eax, byte [esp + eax + 0x14]
mov byte [ecx], al
lea edx, [esp + 0x14]
mov eax, dword [esp + 0x41c]
add eax, edx
movzx eax, byte [eax]
cmp al, 0x20
je 0x40b1a2
lea edx, [esp + 0x14]
mov eax, dword [esp + 0x41c]
add eax, edx
movzx eax, byte [eax]
test al, al
jne 0x40b145
mov edx, dword [esp + 0x418]
mov eax, dword [esp + 0x434]
add eax, edx
mov byte [eax], 0
mov eax, dword [esp + 0x414]
lea edx, [eax + 1]
mov dword [esp + 0x414], edx
cmp eax, dword [esp + 0x430]
jne 0x40b1d6
mov eax, 1
jmp 0x40b206
add dword [esp + 0x41c], 1
mov dword [esp + 0x418], 0
lea edx, [esp + 0x14]
mov eax, dword [esp + 0x41c]
add eax, edx
movzx eax, byte [eax]
test al, al
jne 0x40b04e
mov eax, 0
add esp, 0x42c
ret
Function at 0x40b20d
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x2c
mov dword [esp + 4], 0x41ecc5
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], 0
jne 0x40b236
mov eax, 0
jmp 0x40b28d
mov eax, dword [esp + 0x1c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 4
mov dword [esp + 4], 1
lea eax, [esp + 0x18]
mov dword [esp], eax
call sub.msvcrt.dll_fread
cmp eax, 4
je 0x40b272
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov eax, 0
jmp 0x40b28d
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov eax, dword [esp + 0x18]
movzx eax, ax
cmp eax, 0x5a4d
sete al
add esp, 0x2c
ret

Function at 0x40b2ab
Capabilities:
Create thread

Disassembly:
sub esp, 0x3c
lea eax, [esp + 0x28]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x44]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.msvcrt.dll__beginthreadex
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x2c], 0
jne 0x40b2f4
mov eax, 0
jmp 0x40b308
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov eax, 1
add esp, 0x3c
ret
Function at 0x40b30c
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x3c
mov dword [esp + 0x2c], 0
mov dword [esp + 0x1c], 0
mov eax, dword [esp + 0x48]
mov dword [eax], 0
mov dword [esp + 4], 0x41ecd4
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov dword [esp + 0x28], eax
cmp dword [esp + 0x28], 0
jne 0x40b352
mov eax, 0
jmp 0x40b4bb
mov dword [esp + 0xc], 2
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.0040b542
test eax, eax
jne 0x40b48c
mov eax, dword [esp + 0x28]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sub.msvcrt.dll_fgetpos
test eax, eax
jne 0x40b3a8
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
jmp 0x40b3b2
mov eax, 0xffffffff
mov edx, 0xffffffff
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x2c], 0
jle 0x40b48f
mov eax, dword [esp + 0x44]
cmp eax, dword [esp + 0x2c]
jge 0x40b3da
cmp dword [esp + 0x44], 0
je 0x40b3da
mov eax, dword [esp + 0x44]
mov dword [esp + 0x2c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.0040b542
test eax, eax
jne 0x40b492
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x40b495
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.msvcrt.dll_fread
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
cmp eax, dword [esp + 0x2c]
je 0x40b470
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_realloc
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov eax, dword [esp + 0x48]
mov edx, dword [esp + 0x2c]
mov dword [eax], edx
mov eax, dword [esp + 0x1c]
jmp 0x40b4bb
nop
jmp 0x40b496
nop
jmp 0x40b496
nop
jmp 0x40b496
nop
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x40b4b6
lea eax, [esp + 0x1c]
mov dword [esp], eax
call fcn.0040b4bf
mov eax, 0
add esp, 0x3c
ret
Function at 0x40b7f8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push edi
push esi
push ebx
sub esp, 0x70
mov eax, dword [esp + 0x88]
mov byte [esp + 0x3c], al
mov eax, dword [esp + 0x84]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [esp + 0x80]
mov dword [esp], eax
call fcn.0041a59f
cmp byte [esp + 0x3c], 0
je 0x40b843
lea eax, [esp + 0x60]
mov dword [esp], eax
call sub.KERNEL32.dll_GetSystemTime
sub esp, 4
jmp 0x40b852
lea eax, [esp + 0x60]
mov dword [esp], eax
call sub.KERNEL32.dll_GetLocalTime
sub esp, 4
mov byte [esp + 0x42], 0x25
mov byte [esp + 0x43], 0x2e
mov byte [esp + 0x44], 0x34
mov byte [esp + 0x45], 0x64
mov byte [esp + 0x46], 0x2d
mov byte [esp + 0x47], 0x25
mov byte [esp + 0x48], 0x2e
mov byte [esp + 0x49], 0x32
mov byte [esp + 0x4a], 0x64
mov byte [esp + 0x4b], 0x2d
mov byte [esp + 0x4c], 0x25
mov byte [esp + 0x4d], 0x2e
mov byte [esp + 0x4e], 0x32
mov byte [esp + 0x4f], 0x64
mov byte [esp + 0x50], 0x20
mov byte [esp + 0x51], 0x25
mov byte [esp + 0x52], 0x2e
mov byte [esp + 0x53], 0x32
mov byte [esp + 0x54], 0x64
mov byte [esp + 0x55], 0x3a
mov byte [esp + 0x56], 0x25
mov byte [esp + 0x57], 0x2e
mov byte [esp + 0x58], 0x32
mov byte [esp + 0x59], 0x64
mov byte [esp + 0x5a], 0x3a
mov byte [esp + 0x5b], 0x25
mov byte [esp + 0x5c], 0x2e
mov byte [esp + 0x5d], 0x32
mov byte [esp + 0x5e], 0x64
mov byte [esp + 0x5f], 0
movzx eax, word [esp + 0x6c]
movzx edi, ax
movzx eax, word [esp + 0x6a]
movzx esi, ax
movzx eax, word [esp + 0x68]
movzx ebx, ax
movzx eax, word [esp + 0x66]
movzx ecx, ax
movzx eax, word [esp + 0x62]
movzx edx, ax
movzx eax, word [esp + 0x60]
movzx eax, ax
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
lea eax, [esp + 0x42]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x84]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x80]
mov dword [esp], eax
call fcn.00419fa8
add esp, 0x70
pop ebx
pop esi
pop edi
ret