joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407682
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
mov esi, ecx
push edi
xor ebx, ebx
lea eax, [esi + 0x18]
mov dword [ebp - 4], ebx
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esi + 4], ebx
jne 0x4076b0
mov dword [ebp + 8], 0x45a
jmp 0x40779c
cmp dword [esi + 8], ebx
jne 0x407795
cmp dword [esi + 0x54], ebx
jne 0x407795
cmp word [ebp + 0xc], bx
movzx eax, word [ebp + 0xc]
jne 0x4076d1
mov eax, 0x400
push eax
mov ecx, esi
call fcn.004078cd
mov eax, dword [ebp + 8]
cmp eax, ebx
jg 0x407704
push 8
xor eax, eax
pop ecx
lea edi, [ebp - 0x28]
mov dword [ebp - 0x2c], ebx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2c]
mov ecx, esi
push eax
call fcn.004073ac
mov eax, dword [ebp - 0x18]
cmp eax, ebx
jne 0x407702
push 1
pop eax
add eax, eax
mov dword [esi + 0xc], eax
shl eax, 2
push eax
call sub.MFC42.DLL_operatornew
cmp eax, ebx
pop ecx
mov dword [esi + 0x10], eax
jne 0x407721
mov dword [ebp + 8], 0xe
jmp 0x40779c
mov ecx, dword [esi + 0xc]
shl ecx, 2
push ecx
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push ebx
push ebx
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
cmp eax, ebx
mov dword [esi + 8], eax
jne 0x40774f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 8], eax
jmp 0x40779c
xor edi, edi
cmp dword [esi + 0xc], ebx
jle 0x407784
lea eax, [ebp - 4]
push eax
push ebx
push esi
push 0x4074a7
push ebx
push ebx
call dword [sym.imp.MSVCRT.dll__beginthreadex]
mov ecx, dword [esi + 0x10]
add esp, 0x18
mov dword [ecx + edi*4], eax
mov eax, dword [esi + 0x10]
cmp dword [eax + edi*4], ebx
je 0x407780
inc edi
cmp edi, dword [esi + 0xc]
jl 0x407756
cmp edi, ebx
jne 0x40778d
mov dword [ebp + 8], 0xa4
jmp 0x40779c
push 1
pop ebx
jmp 0x40782d
mov dword [ebp + 8], 0x4df
cmp dword [esi + 0x10], ebx
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x4077ef
cmp dword [esi + 0xc], ebx
mov dword [ebp + 0xc], ebx
jle 0x4077e3
mov eax, dword [esi + 0x10]
mov ecx, dword [ebp + 0xc]
mov eax, dword [eax + ecx*4]
cmp eax, ebx
je 0x4077d8
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi + 0x10]
mov ecx, dword [ebp + 0xc]
push dword [eax + ecx*4]
call edi
mov eax, dword [esi + 0x10]
mov ecx, dword [ebp + 0xc]
mov dword [eax + ecx*4], ebx
inc dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
cmp eax, dword [esi + 0xc]
jl 0x4077af
push dword [esi + 0x10]
call sub.MFC42.DLL_operatordelete
pop ecx
mov dword [esi + 0x10], ebx
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x4077fc
push eax
call edi
mov dword [esi + 8], ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi + 0x50]
cmp eax, ebx
je 0x407813
push eax
call sub.MFC42.DLL_operatordelete
pop ecx
mov eax, dword [esi + 0x54]
mov dword [esi + 0x50], ebx
cmp eax, ebx
je 0x407824
push eax
call sub.MFC42.DLL_operatordelete
pop ecx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret 8
Function at 0x407dab
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
xor ebx, ebx
xor eax, eax
lea edi, [ebp - 7]
mov byte [ebp - 8], bl
mov word [ebp - 0x18], bx
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
lea edi, [ebp - 0x16]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp + 8]
xor edi, edi
cmp eax, ebx
mov dword [ebp - 4], ecx
je 0x407ea6
cmp byte [eax], bl
je 0x407ea6
cmp word [ebp + 0xc], bx
je 0x407ea6
lea edx, [ebp - 8]
push edx
push eax
call fcn.0040741b
mov esi, eax
cmp esi, ebx
jne 0x407ebf
mov ecx, dword [ebp - 4]
call fcn.00407a0f
mov edi, eax
cmp edi, ebx
je 0x407ebf
mov ecx, dword [ebp - 4]
push edi
call fcn.00407cd7
mov ecx, dword [ebp - 4]
push ebx
push ebx
mov esi, eax
push ebx
push ebx
push esi
call fcn.00408274
mov eax, dword [ebp + 0x10]
cmp dword [esi + 8], ebx
mov dword [esi + 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x24], eax
jne 0x407e4a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
jmp 0x407ea9
mov eax, dword [ebp - 8]
push dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
call dword [sym.imp.WS2_32.dll_htons]
push ebx
push ebx
mov word [ebp - 0x16], ax
push ebx
push ebx
lea eax, [ebp - 0x18]
push 0x10
push eax
mov word [ebp - 0x18], 2
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_WSAConnect]
cmp eax, 0xffffffff
je 0x407e40
mov ecx, dword [ebp - 4]
push 1
push esi
call fcn.00408629
test eax, eax
jne 0x407e92
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x407e46
mov ecx, dword [ebp - 4]
push edi
call fcn.00407d47
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
jmp 0x407ec8
push 0x57
pop esi
cmp edi, ebx
je 0x407ebf
mov ecx, dword [ebp - 4]
push edi
call fcn.00407d47
mov ecx, dword [ebp - 4]
push edi
call fcn.00407b65
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x407f27
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
xor edi, edi
mov dword [ebp - 0x10], ecx
cmp dword [ebp + 8], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
je 0x4080ef
cmp dword [ebp + 0x14], edi
jne 0x407f51
cmp dword [ebp + 0xc], edi
je 0x4080ef
cmp dword [ebp + 0x18], edi
jne 0x407f5f
cmp dword [ebp + 0x10], edi
je 0x4080ef
cmp dword [ecx + 4], edi
je 0x4080e8
cmp dword [ecx + 8], edi
je 0x4080e8
push dword [ebp + 8]
call fcn.00407cd7
mov esi, eax
cmp esi, edi
je 0x4080ef
push ebx
jmp 0x407f88
xor edi, edi
cmp dword [ebp + 0xc], edi
jne 0x407f96
cmp dword [ebp + 0x14], edi
je 0x4080c9
cmp dword [esi + 0x2c], edi
jne 0x407fe3
mov ebx, 0x8024
push ebx
call sub.MFC42.DLL_operatornew
mov edi, eax
push ebx
push 0
push edi
mov dword [esi + 0x2c], edi
call sub.MSVCRT.dll_memset
lea eax, [edi + 0x18]
mov dword [edi + 0x14], 2
mov dword [edi + 0x801c], eax
mov eax, 0x8000
mov dword [edi + 0x8018], eax
add esp, 0x10
add edi, 0x8020
inc dword [esi + 0x34]
inc dword [esi + 0x38]
mov dword [esi + 0x30], edi
jmp 0x407fe8
mov eax, 0x8000
mov ebx, dword [esi + 0x2c]
mov ecx, dword [ebp + 0xc]
and dword [ebx + 0x8018], 0
lea edi, [ebx + 0x8018]
test ecx, ecx
je 0x408031
cmp ecx, eax
mov dword [ebp - 4], ecx
jl 0x408009
mov dword [ebp - 4], eax
push dword [ebp - 4]
lea eax, [ebx + 0x18]
push dword [ebp + 0x10]
push eax
call sub.MSVCRT.dll_memcpy
mov eax, dword [ebp - 4]
add esp, 0xc
sub dword [ebp + 0xc], eax
add dword [ebp + 0x10], eax
cmp dword [ebp + 0xc], 0
mov dword [edi], eax
jne 0x408068
mov eax, 0x8000
mov ecx, dword [edi]
cmp ecx, eax
jae 0x408068
mov edx, dword [ebp + 0x14]
test edx, edx
je 0x408068
sub eax, ecx
mov dword [ebp - 4], edx
cmp edx, eax
jl 0x40804a
mov dword [ebp - 4], eax
push dword [ebp - 4]
lea eax, [ecx + ebx + 0x18]
push dword [ebp + 0x18]
push eax
call sub.MSVCRT.dll_memcpy
mov eax, dword [ebp - 4]
add esp, 0xc
sub dword [ebp + 0x14], eax
add dword [ebp + 0x18], eax
add dword [edi], eax
push 0x14
push 0
push ebx
call sub.MSVCRT.dll_memset
add esp, 0xc
xor eax, eax
mov dword [ebp - 0xc], eax
push eax
push ebx
push eax
lea eax, [ebp - 0xc]
push eax
push 1
push edi
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0xffffffff
jne 0x4080a6
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
mov dword [ebp - 8], eax
jne 0x4080c7
and dword [ebp - 8], 0
inc dword [esi + 0x40]
mov ecx, dword [ebx + 0x8020]
dec dword [esi + 0x38]
lea eax, [esi + 0x2c]
test ecx, ecx
mov dword [eax], ecx
jne 0x407f86
mov dword [esi + 0x30], eax
jmp 0x407f86
xor edi, edi
push dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
call fcn.00407d47
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
cmp dword [ebp - 8], edi
pop ebx
sete al
jmp 0x4080f9
push 0x45a
jmp 0x4080f1
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
leave
ret 0x14
Function at 0x4080ff
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
xor edi, edi
mov dword [ebp - 0x10], ecx
cmp dword [ebp + 8], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
je 0x40825b
cmp dword [ebp + 0xc], edi
je 0x40825b
cmp dword [ebp + 0x10], edi
je 0x40825b
cmp dword [ecx + 4], edi
je 0x408254
cmp dword [ecx + 8], edi
je 0x408254
push dword [ebp + 8]
call fcn.00407cd7
mov esi, eax
cmp esi, edi
je 0x40825b
push ebx
jmp 0x408156
xor edi, edi
cmp dword [esi + 0x2c], edi
jne 0x4081a0
mov ebx, 0x8024
push ebx
call sub.MFC42.DLL_operatornew
mov edi, eax
push ebx
push 0
push edi
mov dword [esi + 0x2c], edi
call sub.MSVCRT.dll_memset
lea eax, [edi + 0x18]
mov dword [edi + 0x14], 2
mov dword [edi + 0x801c], eax
mov dword [edi + 0x8018], 0x8000
add esp, 0x10
add edi, 0x8020
inc dword [esi + 0x34]
inc dword [esi + 0x38]
mov dword [esi + 0x30], edi
mov eax, dword [ebp + 0xc]
mov edi, dword [esi + 0x2c]
mov ecx, 0x8000
mov dword [ebp - 4], eax
cmp eax, ecx
jl 0x4081b5
mov dword [ebp - 4], ecx
push dword [ebp - 4]
lea eax, [edi + 0x18]
push dword [ebp + 0x10]
push eax
call sub.MSVCRT.dll_memcpy
mov eax, dword [ebp - 4]
lea ebx, [edi + 0x8018]
sub dword [ebp + 0xc], eax
add dword [ebp + 0x10], eax
push 0x14
push 0
push edi
mov dword [ebx], eax
call sub.MSVCRT.dll_memset
add esp, 0x18
xor eax, eax
mov dword [ebp - 8], eax
push eax
push edi
push eax
lea eax, [ebp - 8]
push eax
push 1
push ebx
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0xffffffff
jne 0x408213
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp ebx, 0x3e5
jne 0x408238
and dword [ebp - 0xc], 0
inc dword [esi + 0x40]
mov ecx, dword [edi + 0x8020]
dec dword [esi + 0x38]
lea eax, [esi + 0x2c]
test ecx, ecx
mov dword [eax], ecx
jne 0x40822b
mov dword [esi + 0x30], eax
cmp dword [ebp + 0xc], 0
jne 0x408154
mov ebx, dword [ebp - 0xc]
push dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
call fcn.00407d47
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
test ebx, ebx
sete al
pop ebx
jmp 0x408265
push 0x45a
jmp 0x40825d
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
leave
ret 0xc

Function at 0x408274
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
test edx, edx
mov ebx, ecx
jle 0x40829f
mov ecx, dword [ebp + 0x14]
test ecx, ecx
jle 0x40829f
mov ax, word [ebp + 0x18]
test ax, ax
je 0x40829f
mov dword [esi + 0x10], edx
mov dword [esi + 0x18], ecx
mov word [esi + 0xc], ax
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4082ab
mov dword [esi + 8], eax
jmp 0x4082d5
push 1
push 0
push 0
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_WSASocketA]
cmp eax, 0xffffffff
mov dword [esi + 8], eax
jne 0x4082cd
and dword [esi + 8], 0
xor eax, eax
jmp 0x4082d8
push eax
mov ecx, ebx
call fcn.004082de
push 1
pop eax
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x408348
Capabilities:
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], esi
mov eax, dword [edi + 0x18]
mov dword [ebp - 8], esi
cmp eax, esi
jne 0x408374
push 1
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x408464
cmp dword [ebp + 0xc], esi
jg 0x40837f
mov ecx, dword [edi + 0x10]
mov dword [ebp + 0xc], ecx
mov ecx, dword [edi + 0x1c]
add ecx, dword [edi + 0x14]
add ecx, dword [ebp + 0xc]
cmp ecx, eax
jle 0x408398
mov dword [ebp - 4], 0x57
jmp 0x408453
cmp dword [ebp + 0xc], esi
mov dword [ebp + 8], esi
jle 0x40845c
push ebx
jmp 0x4083a9
xor esi, esi
push 1
push esi
push esi
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_WSASocketA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40843c
push 0x60
call sub.MFC42.DLL_operatornew
mov esi, eax
push 0x60
push 0
push esi
call sub.MSVCRT.dll_memset
mov ecx, dword [ebp - 0xc]
add esp, 0x10
mov dword [esi + 0x14], 1
mov dword [esi + 0x18], ebx
push ebx
call fcn.004082de
lea eax, [ebp - 8]
push esi
push eax
and dword [ebp - 8], 0
push 0x20
push 0x20
lea eax, [esi + 0x20]
push 0
push eax
push ebx
push dword [edi + 8]
call sub.MSWSOCK.dll_AcceptEx
test eax, eax
jne 0x408426
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
mov dword [ebp - 4], eax
jne 0x40841f
and dword [ebp - 4], 0
jmp 0x408426
push esi
call sub.MFC42.DLL_operatordelete
pop ecx
inc dword [edi + 0x14]
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0xc]
jl 0x4083a7
xor esi, esi
jmp 0x40844d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push 0xffffffffffffffff
mov dword [ebp - 4], eax
call dword [sym.imp.WS2_32.dll_closesocket]
cmp dword [ebp - 4], esi
pop ebx
je 0x40845c
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
cmp dword [ebp - 4], esi
sete al
pop edi
pop esi
leave
ret 8
Function at 0x408629
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov dword [ebp - 8], ecx
cmp dword [esi + 0x28], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
je 0x40864f
push 0x4df
jmp 0x408664
mov edi, 0x8024
push edi
call sub.MFC42.DLL_operatornew
cmp eax, ebx
pop ecx
mov dword [esi + 0x28], eax
jne 0x408671
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x408712
push edi
push ebx
push eax
call sub.MSVCRT.dll_memset
mov eax, dword [esi + 0x28]
add esp, 0xc
cmp dword [ebp + 0xc], ebx
mov dword [eax + 0x14], 3
mov eax, dword [esi + 0x28]
lea ecx, [eax + 0x18]
mov dword [eax + 0x801c], ecx
mov eax, dword [esi + 0x28]
mov dword [eax + 0x8018], 0x8000
je 0x4086b6
mov eax, dword [ebp - 8]
push ebx
push dword [esi]
push dword [eax + 8]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov eax, dword [esi + 0x28]
push ebx
lea ecx, [ebp - 0xc]
push eax
push ecx
lea ecx, [ebp - 0x10]
push ecx
add eax, 0x8018
push 1
push eax
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_WSARecv]
cmp eax, 0xffffffff
jne 0x4086fc
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
mov dword [ebp - 4], eax
jne 0x4086ec
mov dword [ebp - 4], ebx
cmp dword [ebp - 4], ebx
je 0x4086fc
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x40870a
push dword [esi + 8]
mov ecx, dword [ebp - 8]
inc dword [esi + 0x40]
call fcn.004082de
xor eax, eax
cmp dword [ebp - 4], ebx
sete al
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x408719
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
and dword [ebp - 8], ebx
and dword [ebp - 4], ebx
mov eax, dword [esi + 0x28]
test eax, eax
jne 0x408744
push 0x45a
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x4087d1
mov edx, dword [ecx]
add eax, 0x18
push eax
push dword [ebp + 0xc]
push dword [esi]
call dword [edx + 8]
push 0x14
push 0
push dword [esi + 0x28]
call sub.MSVCRT.dll_memset
mov eax, dword [esi + 0x28]
add esp, 0xc
mov dword [eax + 0x14], 3
mov eax, dword [esi + 0x28]
push 0
lea ecx, [eax + 0x18]
mov dword [eax + 0x801c], ecx
mov eax, dword [esi + 0x28]
lea ecx, [ebp - 4]
mov dword [eax + 0x8018], 0x8000
mov eax, dword [esi + 0x28]
push eax
push ecx
lea ecx, [ebp - 8]
add eax, 0x8018
push ecx
push 1
push eax
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_WSARecv]
cmp eax, 0xffffffff
jne 0x4087c7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp ebx, 0x3e5
jne 0x4087ba
xor ebx, ebx
test ebx, ebx
je 0x4087c7
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4087ca
inc dword [esi + 0x40]
xor eax, eax
test ebx, ebx
sete al
pop esi
pop ebx
leave
ret 8
Function at 0x4096f1
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1120
call fcn.0040a2a0
push ebx
push esi
push edi
xor esi, esi
mov ecx, 0x3ff
xor eax, eax
and byte [ebp - 0x120], al
lea edi, [ebp - 0x111c]
mov dword [ebp - 0x1120], esi
push 0x40
rep stosd dword es:[edi], eax
pop ecx
lea edi, [ebp - 0x11f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], esi
push eax
lea eax, [ebp - 0x1120]
push 0x1000
push eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x40975e
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x10], esi
shr ecx, 2
mov dword [ebp - 0x18], ecx
je 0x409757
lea eax, [ebp - 0x1120]
push 4
mov dword [ebp - 0xc], eax
pop edi
mov ebx, 0x104
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
cmp eax, esi
je 0x40983d
cmp eax, edi
je 0x40983d
push eax
push esi
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x4097b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x409838
push ebx
lea eax, [ebp - 0x120]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x120]
push ebx
push eax
push 0
push esi
call sub.PSAPI.DLL_GetModuleBaseNameA
test eax, eax
jne 0x4097de
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x409831
push dword [ebp + 8]
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.MSVCRT.dll__mbsicmp]
pop ecx
test eax, eax
pop ecx
jne 0x409831
lea eax, [ebp - 4]
push eax
push 8
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4097d6
lea eax, [ebp - 0x1c]
and dword [ebp - 8], 0
push eax
lea eax, [ebp - 8]
push edi
push eax
push 0xc
mov dword [ebp - 0x1c], edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
je 0x409851
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x18]
xor esi, esi
inc dword [ebp - 0x10]
add dword [ebp - 0xc], edi
cmp dword [ebp - 0x10], ecx
jb 0x40977d
jmp 0x409757
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
jmp 0x409759
Function at 0x4034e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov ecx, 5
mov esi, str.fegConnectRegistryA
lea edi, [ebp - 0x14]
rep movsd dword es:[edi], dword [esi]
mov byte [ebp - 0x14], 0x52
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [0x42f100]
push ecx
call dword [sym.imp.kernel32.dll_GetProcAddress_1]
mov dword [0x42f118], eax
push str.AecivreSnepO
call fcn.00403250
add esp, 4
push eax
mov edx, dword [0x42f100]
push edx
call dword [sym.imp.kernel32.dll_GetProcAddress_1]
mov dword [0x42f10c], eax
mov dword [ebp - 0x20], 0
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], 0x4e72454b
mov dword [ebp - 0x1c], 0x32336c65
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x403e50
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x63c
push edi
mov byte [ebp - 0x240], 0
mov ecx, 0x8e
xor eax, eax
lea edi, [ebp - 0x23f]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
jmp 0x403e8f
mov ecx, dword [ebp - 4]
push ecx
call fcn.00401840
add esp, 4
mov edx, dword [ebp - 4]
lea eax, [edx + eax + 1]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx]
test edx, edx
je 0x403ffd
mov eax, dword [ebp - 4]
movsx ecx, byte [eax + 1]
test ecx, ecx
je 0x403ffd
mov edx, dword [ebp - 4]
push edx
call fcn.00403210
add esp, 4
push 0
mov eax, dword [ebp - 4]
push eax
call fcn.00401840
add esp, 4
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00402800
add esp, 0xc
mov dword [ebp - 0x634], eax
cmp dword [ebp - 0x634], 0x5cf345ca
je 0x403efd
cmp dword [ebp - 0x634], 0x642d3b30
je 0x403efd
cmp dword [ebp - 0x634], 0x8a705f51
jne 0x403f02
jmp 0x403e79
mov edx, dword [str.SYSTEMCurrentControlSet_seRviCes_]
push edx
lea eax, [ebp - 0x240]
push eax
call fcn.00401e80
add esp, 8
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x240]
push edx
call fcn.004027b0
add esp, 8
mov dword [ebp - 0x638], 0x3e8
lea eax, [ebp - 0x638]
push eax
lea ecx, [ebp - 0x62c]
push ecx
push 0
push str.ImagePath
lea edx, [ebp - 0x240]
push edx
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov dword [ebp - 0x63c], eax
cmp dword [ebp - 0x63c], 0
jne 0x403f70
jmp 0x403e79
lea eax, [ebp - 0x240]
push eax
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
push 0x42f724
push 0x120
push str.netsvcs
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004011e0
add esp, 0x1c
mov dword [ebp - 0x630], eax
cmp dword [ebp - 0x630], 0
je 0x403ff8
mov edx, dword [ebp - 0x630]
push edx
call fcn.004037f0
add esp, 4
and eax, 0xff
test eax, eax
je 0x403fd4
mov al, 1
jmp 0x403fff
push 0x3e8
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov eax, dword [ebp - 0x630]
push eax
call dword [0x42eccc]
mov ecx, dword [ebp + 0x14]
push ecx
call fcn.004016e0
add esp, 4
jmp 0x403e79
xor al, al
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x432000
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x843f9d1
mov edi, 0x432020
nop
nop
mov esi, 0x598
push dword [esi + edi]
xor dword [esp], ebx
pop dword [esi + edi]
dec esi
sub esi, 3
nop
nop
jne 0x432011
nop
nop
cmp dword [edx + eax*2 + 0x43f9d108], eax
or cl, dl
stc
add ecx, dword [eax]
inc ecx
rol byte [ebx + 8], cl
shr ecx, 1
inc eax
or byte [ebx], cl
in al, dx
inc eax
or cl, dl
dec ecx
inc ecx
or cl, dl
stc
inc ebx
or cl, dl
jmp 0xe999284d
Function at 0xeef30c
Capabilities:
Encode data using xor

Disassembly:
jmp 0xeef316
pushal
call 0xeef31c
pop ebp
sub ebp, 0x10
sub ebp, 0xaef30c
jmp 0xeef332
mov eax, 0xaef30c
add eax, ebp
add eax, 0x4c
mov ecx, 0x5bb
mov edx, 0x7a3ea016
xor byte [eax], dl
inc eax
dec ecx
jne 0xeef349
jmp 0xeef35c
popfd
fistp dword [ebp + 0x16162a9f]
push ss
xchg edi, eax
xlatb
out dx, al
push ss
push ss
push ss
adc eax, 0x1610aedb
scasb al, byte es:[edi]
adc byte [esi], dl
push ss
push ss
lodsb al, byte [esi]
push ss
push ss
push ss
loope 0xeef36c
adc eax, 0x1a979dde
push ss
push ss
push ss
adc eax, 0x32729bd3
ljmp 0x3272