joyce8/EMBER2024-capa huggingface dataset:
Function at 0x546000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
push ecx
push edx
push ebx
push ebp
push esi
push edi
call 0x54600c
pop ecx
sub ecx, 0x8d00c
mov edx, 0
push ecx
Function at 0x403380
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov byte [ebp - 1], 0
mov eax, 1
imul ecx, eax, 0
mov dl, byte [ebp + 0xc]
mov byte [ebp + ecx - 0xc], dl
mov dword [ebp - 8], 1
jmp 0x4033ae
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 4
jge 0x4033e9
mov ecx, dword [ebp - 8]
movzx edx, byte [ebp + ecx - 0xd]
shl edx, 1
mov eax, dword [ebp - 8]
mov byte [ebp + eax - 0xc], dl
mov ecx, dword [ebp - 8]
movzx edx, byte [ebp + ecx - 0xd]
and edx, 0x80
je 0x4033e7
mov eax, dword [ebp - 8]
movzx ecx, byte [ebp + eax - 0xc]
xor ecx, 0x1b
mov edx, dword [ebp - 8]
mov byte [ebp + edx - 0xc], cl
jmp 0x4033a5
mov dword [ebp - 8], 0
jmp 0x4033fb
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 4
jge 0x403422
movzx edx, byte [ebp + 8]
mov ecx, dword [ebp - 8]
sar edx, cl
and edx, 1
je 0x403420
mov eax, dword [ebp - 8]
movzx ecx, byte [ebp + eax - 0xc]
movzx edx, byte [ebp - 1]
xor edx, ecx
mov byte [ebp - 1], dl
jmp 0x4033f2
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret 8

Function at 0x4073f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x407414
xor eax, eax
jmp 0x407494
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40742b
xor eax, eax
jmp 0x407494
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x407477
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jae 0x407477
mov edx, dword [ebp - 4]
movzx eax, word [edx]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x40744e
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x407483
xor eax, eax
jmp 0x407494
mov edx, dword [ebp - 4]
movzx eax, word [edx]
test eax, eax
jne 0x407491
xor eax, eax
jmp 0x407494
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x407e50
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x6a56e8]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
mov ecx, 1
imul edx, ecx, 0
mov al, byte [ebp + 8]
mov byte [ebp + edx - 8], al
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 8], 0x3a
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 8], 0x5c
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
mov eax, dword [ebp - 0xc]
imul eax, dword [ebp - 0x10]
mul dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006158c5
mov esp, ebp
pop ebp
ret
Function at 0x408380
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x645240
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x60
mov eax, dword [0x6a56e8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 1
mov byte [ebp - 4], 2
mov dword [ebp - 0x18], 1
lea eax, [ebp + 8]
push eax
push 0x681078
lea ecx, [ebp - 0x6c]
push ecx
call fcn.0040a770
add esp, 0xc
mov dword [ebp - 0x58], eax
mov edx, dword [ebp - 0x58]
mov dword [ebp - 0x5c], edx
mov byte [ebp - 4], 3
push 0x681074
mov eax, dword [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x68]
push ecx
call fcn.0040a830
add esp, 0xc
mov dword [ebp - 0x60], eax
mov edx, dword [ebp - 0x60]
mov dword [ebp - 0x64], edx
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x64]
push eax
lea ecx, [ebp + 8]
call fcn.0040af10
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x68]
call fcn.0040af30
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x6c]
call fcn.0040af30
push 0x3c
push 0
lea ecx, [ebp - 0x54]
push ecx
call fcn.00619ac0
add esp, 0xc
mov dword [ebp - 0x54], 0x3c
movzx edx, byte [ebp + 0x1c]
test edx, edx
je 0x408451
mov dword [ebp - 0x50], 0x440
jmp 0x408458
mov dword [ebp - 0x50], 0x40
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
lea ecx, [ebp + 8]
call fcn.0040b0c0
mov dword [ebp - 0x44], eax
lea ecx, [ebp + 0xc]
call fcn.0040b0c0
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 0
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x408494
mov dword [ebp - 0x38], 5
jmp 0x40849b
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 0x54]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp dword [ebp + 0x14], 0
je 0x4084c1
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcessId]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
movzx edx, byte [ebp + 0x10]
test edx, edx
je 0x4084e5
mov eax, dword [ebp + 0x20]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x70], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.0040af30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.0040af30
mov eax, dword [ebp - 0x70]
jmp 0x40853c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.006158c5
mov esp, ebp
pop ebp
ret
Function at 0x409000
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x6a56e8]
xor eax, ebp
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x20]
call fcn.00404d20
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x2c], 0
push 0
push 0x80
push 2
push 0
push 3
push 0xc0000000
lea ecx, [ebp + 8]
call fcn.0040b0c0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffff
jne 0x409052
jmp 0x409097
mov dword [ebp - 8], 0
push 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00404a50
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00404a70
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x409091
mov ecx, dword [ebp + 0xc]
call fcn.00404a50
cmp dword [ebp - 8], eax
je 0x409093
jmp 0x409097
xor edx, edx
jne 0x409026
cmp dword [ebp - 0x24], 0xffffffff
je 0x4090a7
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x20]
call fcn.00404be0
lea ecx, [ebp + 8]
call fcn.0040af30
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006158c5
mov esp, ebp
pop ebp
ret
Function at 0x4090d0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x645320
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x6a56e8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x44], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.00404d20
mov byte [ebp - 4], 1
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
lea ecx, [ebp + 0xc]
call fcn.0040b0c0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xffffffff
jne 0x40914f
jmp 0x4091d6
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x38]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jne 0x40916f
jmp 0x4091d6
mov edx, dword [ebp - 0x3c]
push edx
call fcn.00615dd1
add esp, 4
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x40918c
jmp 0x4091d6
mov dword [ebp - 0x14], 0
push 0
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x3c]
push edx
mov eax, dword [ebp - 0x34]
push eax
mov ecx, dword [ebp - 0x38]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
je 0x4091bc
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0x3c]
je 0x4091be
jmp 0x4091d6
mov eax, dword [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x30]
call fcn.00404af0
xor edx, edx
jne 0x409120
cmp dword [ebp - 0x38], 0xffffffff
je 0x4091e6
mov eax, dword [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x34], 0
je 0x40921a
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x40], ecx
mov edx, dword [ebp - 0x40]
push edx
call fcn.00615907
add esp, 4
cmp dword [ebp - 0x40], 0
jne 0x40920d
mov dword [ebp - 0x50], 0
jmp 0x40921a
mov dword [ebp - 0x34], 0x8123
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x50], eax
lea ecx, [ebp - 0x30]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00404c30
mov edx, dword [ebp - 0x44]
or edx, 1
mov dword [ebp - 0x44], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.00404be0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.0040af30
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006158c5
mov esp, ebp
pop ebp
ret
Function at 0x409270
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
mov eax, dword [0x6a56e8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x250], 0xffffffff
mov byte [ebp - 0x232], 1
cmp dword [ebp + 8], 0
jne 0x4092b4
mov byte [ebp - 0x233], 0
lea ecx, [ebp + 0xc]
call fcn.0040a0a0
mov al, byte [ebp - 0x233]
jmp 0x4094c7
mov dword [ebp - 0x270], 0
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x24c], eax
mov dword [ebp - 0x230], 0x22c
lea eax, [ebp - 0x230]
push eax
mov ecx, dword [ebp - 0x24c]
push ecx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0
je 0x409480
mov edx, dword [ebp + 8]
mov dword [ebp - 0x240], edx
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x23c], eax
mov ecx, dword [ebp - 0x23c]
mov dx, word [ecx]
mov word [ebp - 0x246], dx
mov eax, dword [ebp - 0x240]
cmp dx, word [eax]
jne 0x40937a
cmp word [ebp - 0x246], 0
je 0x40936e
mov ecx, dword [ebp - 0x23c]
mov dx, word [ecx + 2]
mov word [ebp - 0x248], dx
mov eax, dword [ebp - 0x240]
cmp dx, word [eax + 2]
jne 0x40937a
add dword [ebp - 0x23c], 4
add dword [ebp - 0x240], 4
cmp word [ebp - 0x248], 0
jne 0x409314
mov dword [ebp - 0x254], 0
jmp 0x409385
sbb ecx, ecx
or ecx, 1
mov dword [ebp - 0x254], ecx
mov edx, dword [ebp - 0x254]
mov dword [ebp - 0x260], edx
cmp dword [ebp - 0x260], 0
jne 0x409461
mov byte [ebp - 0x231], 0
lea eax, [ebp + 0xc]
mov dword [ebp - 0x258], eax
mov ecx, dword [ebp - 0x258]
call fcn.0040a080
mov dword [ebp - 0x244], eax
mov ecx, dword [ebp - 0x258]
call fcn.0040a060
mov dword [ebp - 0x264], eax
jmp 0x4093e1
mov ecx, dword [ebp - 0x244]
add ecx, 4
mov dword [ebp - 0x244], ecx
mov edx, dword [ebp - 0x244]
cmp edx, dword [ebp - 0x264]
je 0x409416
mov eax, dword [ebp - 0x244]
mov dword [ebp - 0x268], eax
mov ecx, dword [ebp - 0x268]
mov edx, dword [ecx]
cmp edx, dword [ebp - 0x228]
jne 0x409414
mov byte [ebp - 0x231], 1
jmp 0x409416
jmp 0x4093d2
movzx eax, byte [ebp - 0x231]
test eax, eax
jne 0x409461
mov ecx, dword [ebp - 0x228]
mov dword [ebp - 0x250], ecx
mov edx, dword [ebp - 0x250]
push edx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x26c], eax
push 1
mov eax, dword [ebp - 0x26c]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp eax, 1
je 0x409461
mov byte [ebp - 0x232], 0
jmp 0x409480
lea ecx, [ebp - 0x230]
push ecx
mov edx, dword [ebp - 0x24c]
push edx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
mov dword [ebp - 0x25c], eax
jmp 0x4092f2
mov eax, dword [ebp - 0x24c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x250], 0xffffffff
jne 0x4094ad
mov byte [ebp - 0x234], 0
lea ecx, [ebp + 0xc]
call fcn.0040a0a0
mov al, byte [ebp - 0x234]
jmp 0x4094c7
mov cl, byte [ebp - 0x232]
mov byte [ebp - 0x235], cl
lea ecx, [ebp + 0xc]
call fcn.0040a0a0
mov al, byte [ebp - 0x235]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006158c5
mov esp, ebp
pop ebp
ret
Function at 0x4094e0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x6a56e8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x248], 0xffffffff
mov byte [ebp - 0x231], 1
cmp dword [ebp + 8], 0
jne 0x409511
xor al, al
jmp 0x409676
mov dword [ebp - 0x25c], 0
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x230], 0x22c
lea eax, [ebp - 0x230]
push eax
mov ecx, dword [ebp - 0x244]
push ecx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0
je 0x409656
mov edx, dword [ebp + 8]
mov dword [ebp - 0x23c], edx
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x238], eax
mov ecx, dword [ebp - 0x238]
mov dx, word [ecx]
mov word [ebp - 0x23e], dx
mov eax, dword [ebp - 0x23c]
cmp dx, word [eax]
jne 0x4095d7
cmp word [ebp - 0x23e], 0
je 0x4095cb
mov ecx, dword [ebp - 0x238]
mov dx, word [ecx + 2]
mov word [ebp - 0x240], dx
mov eax, dword [ebp - 0x23c]
cmp dx, word [eax + 2]
jne 0x4095d7
add dword [ebp - 0x238], 4
add dword [ebp - 0x23c], 4
cmp word [ebp - 0x240], 0
jne 0x409571
mov dword [ebp - 0x24c], 0
jmp 0x4095e2
sbb ecx, ecx
or ecx, 1
mov dword [ebp - 0x24c], ecx
mov edx, dword [ebp - 0x24c]
mov dword [ebp - 0x254], edx
cmp dword [ebp - 0x254], 0
jne 0x409637
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x248], eax
mov ecx, dword [ebp - 0x248]
push ecx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x258], eax
push 1
mov edx, dword [ebp - 0x258]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp eax, 1
je 0x409637
mov byte [ebp - 0x231], 0
jmp 0x409656
lea eax, [ebp - 0x230]
push eax
mov ecx, dword [ebp - 0x244]
push ecx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
mov dword [ebp - 0x250], eax
jmp 0x40954f
mov edx, dword [ebp - 0x244]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x248], 0xffffffff
jne 0x409670
xor al, al
jmp 0x409676
mov al, byte [ebp - 0x231]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006158c5
mov esp, ebp
pop ebp
ret
Function at 0x4097d0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6453c0
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x6a56e8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0xc
lea ecx, [ebp - 0x20]
call fcn.00405ed0
lea ecx, [ebp - 0x20]
call fcn.0040a020
mov dword [ebp - 4], 0
push ecx
mov ecx, esp
mov dword [ebp - 0x3c], esp
push 0x68130c
call fcn.0040af50
mov dword [ebp - 0x40], eax
mov byte [ebp - 4], 1
lea eax, [ebp - 0x20]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x44], esp
mov edx, dword [ebp + 8]
push edx
call fcn.0040b050
mov byte [ebp - 4], 0
call fcn.00409690
add esp, 0xc
lea ecx, [ebp - 0x20]
call fcn.00409df0
mov dword [ebp - 0x2c], eax
push 4
lea ecx, [ebp - 0x14]
call fcn.00405ed0
lea ecx, [ebp - 0x14]
call fcn.0040b070
mov byte [ebp - 4], 2
mov dword [ebp - 0x24], 0
jmp 0x40987a
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
cmp ecx, dword [ebp - 0x2c]
jae 0x40993b
mov edx, dword [ebp - 0x24]
push edx
lea ecx, [ebp - 0x20]
call fcn.00409dd0
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x24], 0
jne 0x40990c
push 1
mov ecx, dword [ebp - 0x28]
call fcn.0040b150
movzx eax, ax
cmp eax, 0x3a
je 0x4098cd
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.0040af30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00409fe0
jmp 0x409956
push 0x681310
mov ecx, dword [ebp - 0x28]
push ecx
lea edx, [ebp - 0x38]
push edx
call fcn.0040a830
add esp, 0xc
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x14]
call fcn.0040ae50
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x38]
call fcn.0040af30
jmp 0x409871
mov edx, dword [ebp - 0x28]
push edx
lea ecx, [ebp - 0x14]
call fcn.0040ae50
push 0
lea ecx, [ebp - 0x14]
call fcn.0040b0c0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x681314
lea ecx, [ebp - 0x14]
call fcn.0040ae30
jmp 0x409871
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.0040af30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00409fe0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006158c5
mov esp, ebp
pop ebp
ret
Function at 0x40f300
Capabilities:
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a0
mov eax, dword [0x6a56e8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x198], ecx
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp eax, 0xffffffff
jne 0x40f337
xor eax, eax
jmp 0x40f3dc
push 0
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 0x19c], eax
mov ecx, dword [ebp - 0x198]
mov edx, dword [ebp - 0x19c]
mov dword [ecx + 4], edx
cmp dword [ebp - 0x19c], 0xffffffff
jne 0x40f365
xor eax, eax
jmp 0x40f3dc
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
mov ecx, dword [ebp - 0x198]
mov dword [ecx + 8], eax
push 1
mov edx, dword [ebp - 0x198]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0x198]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
push 0x674f8d
push 0x10f
call fcn.00616073
add esp, 8
mov dword [ebp - 0x1a0], eax
mov eax, dword [ebp - 0x198]
mov ecx, dword [ebp - 0x1a0]
mov dword [eax + 0x10], ecx
mov edx, dword [ebp - 0x198]
cmp dword [edx + 0x10], 0
jne 0x40f3c7
xor eax, eax
jmp 0x40f3dc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [ebp - 0x198]
mov word [ecx + 0xc], ax
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006158c5
mov esp, ebp
pop ebp
ret
Function at 0x4139a0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x6a56e8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x22c], 0xffffffff
lea eax, [ebp - 0x224]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x413bcc
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x210]
push ecx
push 0
push 0
push 0
mov edx, dword [ebp - 0x224]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x413a2d
mov dword [ebp - 0x210], 0x64
mov dword [ebp - 0x228], 0
jmp 0x413a48
mov eax, dword [ebp - 0x228]
add eax, 1
mov dword [ebp - 0x228], eax
mov ecx, dword [ebp - 0x228]
cmp ecx, dword [ebp - 0x210]
jae 0x413bcc
mov dword [ebp - 0x220], 0
push 0x104
push 0
lea edx, [ebp - 0x20c]
push edx
call fcn.00619ac0
add esp, 0xc
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x214], 0x104
push 0x104
push 0
lea eax, [ebp - 0x108]
push eax
call fcn.00619ac0
add esp, 0xc
mov ecx, dword [ebp - 0x228]
push ecx
push str._04u
push 0x104
lea edx, [ebp - 0x108]
push edx
call fcn.00414ca0
add esp, 0x10
lea eax, [ebp - 0x220]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x108]
push ecx
mov edx, dword [ebp - 0x224]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x413af9
jmp 0x413a39
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x218]
push edx
push 0
push str.NetCfgInstanceId
mov eax, dword [ebp - 0x220]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x413b38
mov ecx, dword [ebp - 0x220]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x413a39
lea edx, [ebp - 0x20c]
push edx
mov ecx, dword [ebp + 8]
call fcn.00404a70
push eax
call fcn.00624db4
add esp, 8
test eax, eax
je 0x413b66
mov eax, dword [ebp - 0x220]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x413a39
mov dword [ebp - 0x214], 4
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x21c]
push edx
lea eax, [ebp - 0x218]
push eax
push 0
push str.Characteristics
mov ecx, dword [ebp - 0x220]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x413bba
mov edx, dword [ebp - 0x21c]
mov dword [ebp - 0x22c], edx
mov eax, dword [ebp - 0x220]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x413bcc
mov ecx, dword [ebp - 0x220]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x413a39
mov edx, dword [ebp - 0x224]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006158c5
mov esp, ebp
pop ebp
ret
Function at 0x434f20
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x647d68
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x6a56e8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
cmp dword [ebp + 0xc], 0x84c
jne 0x43509c
push 0x84c
mov ecx, dword [ebp - 0x10]
call fcn.00417590
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x798]
call fcn.0059a520
cmp eax, 4
jne 0x435094
push 0x10
call fcn.00615b07
add esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x434fa0
mov ecx, dword [ebp - 0x18]
call fcn.004350b0
mov dword [ebp - 0x1c], eax
jmp 0x434fa7
mov dword [ebp - 0x1c], 0
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x14], ecx
lea edx, [ebp - 0x28]
push edx
call fcn.00407ef0
add esp, 4
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x24]
push ecx
mov ecx, dword [ebp - 0x14]
add ecx, 4
call fcn.0040af10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040af30
push 0x6855e0
call fcn.00403a00
add esp, 4
push eax
mov edx, dword [ebp - 0x10]
add edx, 0x780
push edx
call fcn.00414c40
add esp, 8
movzx eax, al
test eax, eax
je 0x435027
push 0x6855cc
call fcn.00403a00
add esp, 4
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 8
call fcn.0040aef0
push 0x685600
call fcn.00403a00
add esp, 4
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x780
push ecx
call fcn.00414c40
add esp, 8
movzx edx, al
test edx, edx
je 0x435067
push 0x6855f0
call fcn.00403a00
add esp, 4
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 8
call fcn.0040aef0
mov ecx, dword [ebp - 0x10]
call fcn.00417590
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
push 0
push 0
mov edx, dword [ebp - 0x14]
push edx
push 0x416500
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x43509c
mov ecx, dword [ebp - 0x10]
call fcn.00434ed0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x10