joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403043
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [0x417044]
sub esi, dword [0x40afb0]
push edi
add esi, dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor ebx, ebx
add eax, 0x1f4
cmp esi, ebx
mov dword [0x423eac], eax
jle 0x4031ad
push dword [0x41f054]
call fcn.004031f1
push ebx
push ebx
push dword [0x40afb0]
push dword [0x409018]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [0x41f050], esi
mov dword [0x417040], ebx
mov ebp, 0x40b040
mov eax, dword [0x417048]
mov edi, 0x4000
sub eax, dword [0x41f054]
cmp eax, edi
jg 0x4030b8
mov edi, eax
mov esi, 0x413040
push edi
push esi
call fcn.004031bf
test eax, eax
je 0x40319f
add dword [0x41f054], edi
mov dword [0x40afd0], esi
mov dword [0x40afd4], edi
cmp dword [0x423eb0], ebx
je 0x40310f
cmp dword [0x423f40], ebx
jne 0x40310f
mov eax, dword [0x41f050]
push ebx
sub eax, dword [0x417044]
sub eax, dword [esp + 0x1c]
add eax, dword [0x40afb0]
mov dword [0x417040], eax
call fcn.00402bd3
pop ecx
mov ecx, 0x40afb8
mov dword [0x40afd8], ebp
mov dword [0x40afdc], 0x8000
call fcn.00405f82
test eax, eax
jl 0x4031a8
mov esi, dword [0x40afd8]
sub esi, ebp
je 0x403169
lea eax, [esp + 0x10]
push ebx
push eax
push esi
push ebp
push dword [0x409018]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4031a4
cmp esi, dword [esp + 0x10]
jne 0x4031a4
add dword [0x40afb0], esi
cmp dword [0x40afd4], ebx
jne 0x4030de
jmp 0x403175
cmp dword [0x40afd4], ebx
jne 0x4031a8
cmp edi, ebx
je 0x4031a8
mov eax, dword [0x417044]
mov ecx, eax
sub ecx, dword [0x40afb0]
add ecx, dword [esp + 0x18]
test ecx, ecx
jg 0x4030a2
push ebx
push ebx
push eax
push dword [0x409018]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x4031ad
or eax, 0xffffffff
jmp 0x4031b7
push 0xfffffffffffffffe
jmp 0x4031aa
push 0xfffffffffffffffd
pop eax
jmp 0x4031b7
push 1
call fcn.00402bd3
pop ecx
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
Function at 0x4053c6
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [0x4224a8], 0x44
push eax
xor eax, eax
push 0x4224a8
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x405401
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x40548b
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.0040573a
test byte [ebp + 0xc], 8
mov dword [ebp - 8], eax
je 0x4054bf
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x423f28], eax
jmp 0x405653
push ebx
mov ebx, dword [ebp + 0xc]
and ebx, 1
mov dword [ebp - 4], ebx
je 0x4054dd
test eax, eax
je 0x4055fe
test byte [ebp + 0xc], 2
je 0x4055fe
mov esi, 0x4214a8
push edi
push esi
call fcn.00405b66
test ebx, ebx
je 0x4054fa
push str..
push esi
call sub.KERNEL32.dll_lstrcatA
jmp 0x405500
push edi
call fcn.004056a0
cmp byte [edi], 0
jne 0x40550e
cmp byte [0x4214a8], 0x5c
jne 0x405519
push 0x409010
push edi
call sub.KERNEL32.dll_lstrcatA
push edi
call sub.KERNEL32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x148]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x4055f4
lea eax, [ebp - 0x11c]
push 0x3f
push eax
lea esi, [ebp - 0x11c]
call fcn.00405684
cmp byte [eax], 0
je 0x40555f
cmp byte [ebp - 0x18], 0
je 0x40555f
lea esi, [ebp - 0x18]
cmp byte [esi], 0x2e
jne 0x405575
mov al, byte [esi + 1]
test al, al
je 0x4055d3
cmp al, 0x2e
jne 0x405575
cmp byte [esi + 2], 0
je 0x4055d3
push esi
push ebx
call fcn.00405b66
test byte [ebp - 0x148], 0x10
je 0x40559a
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x4055d3
push dword [ebp + 0xc]
push edi
call fcn.0040548b
jmp 0x4055d3
push edi
call fcn.0040581e
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4055cb
test byte [ebp + 0xc], 4
je 0x4055c3
push edi
push 0xfffffffffffffff1
call fcn.00404f04
push 0
push edi
call fcn.004058b4
jmp 0x4055d3
inc dword [0x423f28]
jmp 0x4055d3
push edi
push 0xfffffffffffffff2
call fcn.00404f04
lea eax, [ebp - 0x148]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40553d
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 4], 0
je 0x4055fe
and byte [ebx - 1], 0
xor esi, esi
pop ebx
cmp dword [ebp - 4], esi
je 0x405653
cmp dword [ebp - 8], esi
jne 0x405613
inc dword [0x423f28]
jmp 0x405653
push edi
call fcn.00405e61
test eax, eax
je 0x405653
push edi
call fcn.00405659
push edi
call fcn.0040581e
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x40564b
test byte [ebp + 0xc], 4
je 0x40560b
push edi
push 0xfffffffffffffff1
call fcn.00404f04
push esi
push edi
call fcn.004058b4
jmp 0x405653
push edi
push 0xffffffffffffffe5
call fcn.00404f04
pop edi
pop esi
leave
ret 8
Function at 0x40573a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x4218a8
push esi
call fcn.00405b66
push esi
call fcn.004056ed
mov edi, eax
test edi, edi
jne 0x40575b
xor eax, eax
jmp 0x4057ad
push edi
call fcn.00405dc8
test byte [0x423eb8], 0x80
je 0x405774
mov al, byte [edi]
test al, al
je 0x405757
cmp al, 0x5c
je 0x405757
sub edi, esi
jmp 0x40578c
call fcn.00405e61
test eax, eax
je 0x405786
test byte [eax], 0x10
je 0x405757
push esi
call fcn.004056a0
push esi
call sub.KERNEL32.dll_lstrlenA
cmp eax, edi
push esi
jg 0x405778
call fcn.00405659
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x40581e
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40583a
and al, 0xfe
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret 4

Function at 0x40583d
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x40586c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x4058b0
test edi, edi
jne 0x405877
and byte [esi], 0
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x4058aa
Function at 0x4058b4
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push 1
call fcn.00405e88
test eax, eax
mov esi, dword [esp + 0x18]
je 0x4058d8
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x405a11
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [0x422630], 0x4c554e
test esi, esi
mov edi, 0x400
mov ebp, 0x422630
je 0x40591c
push 1
push 0
push esi
call fcn.0040583d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x405a17
cmp eax, edi
jg 0x405a17
mov esi, 0x4220a8
push edi
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x405a17
cmp eax, edi
jg 0x405a17
push esi
push ebp
push str._s_s_r_n
push 0x421ca8
call dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, eax
mov eax, dword [0x423eb0]
add esp, 0x10
push dword [eax + 0x128]
push esi
call fcn.00405b88
push 4
push 0xc0000000
push esi
call fcn.0040583d
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x14], ebp
je 0x405a11
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x405a0a
lea eax, [esp + 0x18]
push 0
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x405a0a
cmp edi, dword [esp + 0x18]
jne 0x405a0a
push str._Rename__r_n
push esi
call fcn.004057b2
test eax, eax
jne 0x405a1e
lea eax, [esi + edi]
push str._Rename__r_n
push eax
call fcn.00405b66
add edi, 0xa
mov eax, edi
push ebx
add eax, esi
push 0x421ca8
push eax
call fcn.004057fe
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 0x18]
push 0
add edi, ebx
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x423f30]
pop edi
pop esi
pop ebp
pop ebx
ret 8
add eax, 0xa
push 0x409350
push eax
call fcn.004057b2
test eax, eax
je 0x4059d5
inc eax
lea ecx, [esi + edi]
cmp eax, ecx
mov ebp, eax
jae 0x405a45
mov dl, byte [ebp]
mov byte [ebx + ebp], dl
inc ebp
cmp ebp, ecx
jb 0x405a3a
mov ebp, dword [esp + 0x14]
sub eax, esi
jmp 0x4059d7
Function at 0x405a4d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 0x18]
push esi
push eax
mov eax, dword [ebp + 0x18]
xor ebx, ebx
neg eax
sbb eax, eax
mov esi, dword [ebp + 0x14]
and eax, 0x100
or eax, 0x20019
mov byte [esi], bl
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405abe
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0x400
push eax
lea eax, [ebp + 0x14]
push esi
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405aad
cmp dword [ebp + 0x14], 1
je 0x405aaf
cmp dword [ebp + 0x14], 2
je 0x405aaf
mov byte [esi], bl
push dword [ebp + 0x18]
mov byte [esi + 0x3ff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x405ef4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a34], 0
push esi
jne 0x405f2b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f05
mov dword [ecx*4 + 0x422a30], eax
inc ecx
cmp ecx, 0x100
jl 0x405f00
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f5c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a30]
xor eax, esi
inc ecx
dec edx
jne 0x405f3e
pop edi
not eax
pop esi
ret 0xc

Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x4018f0
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp]
push eax
push ecx
mov dword [esp + 8], 0
call fcn.00401790
add esp, 8
xor ecx, ecx
test eax, eax
jle 0x401938
push ebx
mov edx, dword [esp + 4]
mov bl, byte [ecx + edx]
add bl, 0x38
mov byte [ecx + edx], bl
mov edx, dword [esp + 4]
mov bl, byte [ecx + edx]
xor bl, 0x7b
mov byte [ecx + edx], bl
inc ecx
cmp ecx, eax
jl 0x401912
mov eax, dword [esp + 4]
pop ebx
pop ecx
ret
mov eax, dword [esp]
pop ecx
ret

Function at 0x401940
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push dword [esp + 0x10]
push dword [esp + 0x10]
push eax
push eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
ret 8
Function at 0x402446
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
mov ebx, dword [ebp + 0x10]
push esi
xor esi, esi
test ebx, ebx
jne 0x40245f
push 1
pop eax
jmp 0x4024d4
mov eax, dword [0x409498]
push 0
mov dword [ebp - 0x100], eax
push 0
lea eax, [ebp - 0x104]
push 0
push eax
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp - 0x104], 1
push eax
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x4024cd
test eax, eax
je 0x40245f
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x40245f
mov eax, ebx
push 0
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x4024cd
cmp eax, 0xffffffff
je 0x4024cd
add esi, eax
cmp esi, ebx
jb 0x40245f
xor eax, eax
cmp esi, ebx
sete al
pop esi
pop ebx
leave
ret

Function at 0x402c2e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
push esi
push ebx
push 0x80
push 4
push ebx
push 2
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x402ca3
push edi
push 2
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
xor eax, eax
lea edi, [ebp - 0xb]
mov byte [ebp - 0xc], bl
mov dword [ebp + 8], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosb byte es:[edi], al
mov edi, dword [ebp + 0xc]
cmp edi, ebx
jbe 0x402c9b
lea eax, [ebp - 0xc]
push 0xa
push eax
call fcn.00401bc2
pop ecx
lea eax, [ebp + 8]
pop ecx
push ebx
push eax
lea eax, [ebp - 0xc]
push 0xa
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
dec edi
jne 0x402c79
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x402ca7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b8
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
push edi
mov ebx, 0x408144
push str.WinExec
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push eax
call edi
push str.GetWindowsDirectoryA
push ebx
mov dword [ebp - 0x1c], eax
call esi
push eax
call edi
push str.GetModuleFileNameA
push ebx
mov dword [ebp - 4], eax
call esi
push eax
call edi
push str.CopyFileA
push ebx
mov dword [ebp - 0x24], eax
call esi
push eax
call edi
mov dword [ebp - 0x20], eax
mov esi, 0x104
lea eax, [ebp - 0x2b8]
push esi
push eax
push 0
call dword [ebp - 0x24]
lea eax, [ebp - 0x164]
push esi
push eax
call dword [ebp - 4]
and byte [ebp - 0xa], 0
push 0x1a
mov byte [ebp - 0x18], 0x25
mov byte [ebp - 0x17], 0x63
mov byte [ebp - 0x16], 0x25
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x14], 0x25
mov byte [ebp - 0x13], 0x63
mov byte [ebp - 0x12], 0x68
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xe], 0x2e
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x78
mov byte [ebp - 0xb], 0x65
call fcn.00403c60
pop ecx
add eax, 0x61
push eax
push 0x1a
jmp loc.004102c0
Function at 0x403061
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
push edi
mov ebx, str.ADVAPI32.dll
push str.RegCloseKey
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push eax
call edi
push str.RegOpenKeyExA
push ebx
mov dword [ebp - 0x28], eax
call esi
push eax
call edi
push 0x40
mov dword [ebp - 0x30], eax
xor edx, edx
pop ecx
xor eax, eax
lea edi, [ebp - 0x133]
mov byte [ebp - 0x134], dl
mov byte [ebp - 0x24], 0x53
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edi, [ebp - 0x24]
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp - 0x23], 0x59
mov byte [ebp - 0x22], 0x53
mov byte [ebp - 0x21], 0x54
mov byte [ebp - 0x20], 0x45
mov byte [ebp - 0x1f], 0x4d
mov byte [ebp - 0x1e], 0x5c
mov byte [ebp - 0x1d], 0x43
mov byte [ebp - 0x1c], 0x75
mov byte [ebp - 0x1b], 0x72
mov byte [ebp - 0x1a], 0x72
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x6e
mov byte [ebp - 0x17], 0x74
mov byte [ebp - 0x16], 0x43
mov byte [ebp - 0x15], 0x6f
mov byte [ebp - 0x14], 0x6e
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x72
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0x10], 0x6c
mov byte [ebp - 0xf], 0x53
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 0xc], 0x5c
mov byte [ebp - 0xb], 0x53
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 9], 0x72
mov byte [ebp - 8], 0x76
mov byte [ebp - 7], 0x69
mov byte [ebp - 6], 0x63
mov byte [ebp - 5], 0x65
mov byte [ebp - 4], 0x73
mov byte [ebp - 3], 0x5c
mov byte [ebp - 2], dl
lea ebx, [ebp - 0x134]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
lea ebx, [ebp - 0x134]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x2c]
mov ecx, ebx
push eax
push 0xf003f
lea eax, [ebp - 0x134]
and ecx, 3
push edx
push eax
rep movsb byte es:[edi], byte [esi]
push connect
call dword [ebp - 0x30]
pop edi
pop esi
test eax, eax
pop ebx
jne 0x4031bc
push dword [ebp - 0x2c]
call dword [ebp - 0x28]
push 1
pop eax
leave
ret
xor eax, eax
leave
ret
Function at 0x4039cf
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push esi
push edi
push str.StartServiceCtrlDispatcherA
push str.ADVAPI32.dll
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov esi, str.Serpiei
mov edi, eax
push esi
call fcn.00403061
test eax, eax
pop ecx
je 0x403a23
and dword [ebp - 8], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
mov dword [ebp - 0xc], 0x403756
call edi
pop edi
xor eax, eax
pop esi
leave
ret 0x10
and byte [ebp - 0x114], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x113]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x114]
push eax
call fcn.00402ca7
lea eax, [ebp - 0x114]
push 1
push eax
push str.Microsoft_.NET_COM_Integration_with_SOAP
push str.Microsoft_.Net_Frameworek_COMi_Suppoot
push esi
call fcn.004031c0
add esp, 0x18
call fcn.00402217
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
Function at 0x40120e
Capabilities:
Create process on windows

Disassembly:
push esi
push edi
call fcn.00408b97
test eax, eax
je 0x401260
mov edi, dword [esp + 0xc]
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
push 0x34
push dword [0x415b64]
push 0x4120e8
push edi
call esi
cmp eax, 6
jne 0x401260
push 1
xor eax, eax
push eax
push eax
push str.http:__www.webtech.co.jp_exepress_
push eax
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
ja 0x401260
push 0x30
push dword [0x415b64]
push 0x4120a4
push edi
call esi
pop edi
pop esi
ret

Function at 0x4020c2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov ax, word [ebp + 0x10]
jecxz 0x4020eb
xor ebx, ebx
mov bl, al
mov al, ah
xor bl, byte [esi]
xor ah, ah
inc esi
xor ax, word [ebx*2 + 0x412150]
loop 0x4020d8
mov dword [ebp - 4], eax
mov ax, word [ebp - 4]
pop esi
pop ebx
leave
ret

Function at 0x40251a
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x31c
push ebx
push esi
push edi
lea eax, [ebp - 0x31c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov ecx, dword [ebp + 0xc]
cmp byte [ecx + 1], 0x3a
lea eax, [ecx + 1]
mov esi, ecx
lea edi, [ebp - 0x114]
jne 0x402579
mov dl, byte [ecx]
mov esi, eax
mov al, byte [esi]
inc esi
cmp byte [esi], 0x5c
mov byte [ebp - 0x114], dl
mov byte [ebp - 0x113], al
lea edi, [ebp - 0x112]
jne 0x402597
mov byte [ebp - 0x112], 0x5c
lea edi, [ebp - 0x111]
jmp 0x402596
cmp byte [ecx], 0x5c
jne 0x40258d
mov byte [ebp - 0x114], 0x5c
lea edi, [ebp - 0x113]
mov esi, eax
cmp byte [esi], 0x5c
jne 0x402597
mov byte [edi], 0x5c
inc edi
inc esi
mov ebx, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov dword [ebp - 4], 1
cmp byte [esi], 0x5c
jne 0x4025b9
push esi
push ecx
call fcn.0040968b
test eax, eax
pop ecx
pop ecx
je 0x4025c3
mov ecx, dword [ebp + 0xc]
mov al, byte [esi]
test al, al
jne 0x402673
and byte [edi], 0
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40264b
push 0xc
pop edi
push edi
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.00409240
and dword [ebp - 0xc], 0
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x114]
push eax
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], 1
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x114]
push eax
call ebx
cmp dword [ebp - 4], 0
je 0x40267c
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x218]
push eax
call fcn.0040878e
lea eax, [ebp - 0x218]
push eax
push dword [ebp + 8]
call fcn.00403e15
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x40267c
lea eax, [ebp - 0x114]
push eax
call ebx
cmp byte [esi], 0
je 0x40267c
inc esi
cmp byte [esi], 0
je 0x40267c
mov ecx, dword [ebp + 0xc]
lea edi, [ebp - 0x114]
jmp 0x4025a4
mov byte [edi], al
inc edi
inc esi
jmp 0x4025a4
lea eax, [ebp - 0x31c]
push eax
call ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4026ae
Capabilities:
Get file size

Disassembly:
push esi
push edi
push 0x138
xor edi, edi
push 0x40
mov dword [0x415b48], edi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
cmp esi, edi
je 0x4026f4
push edi
push 0x80
push 3
push edi
push 3
push 0x80000000
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
jne 0x4026f8
push esi
call fcn.00402a3c
pop ecx
xor eax, eax
jmp 0x402708
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0x10], eax
mov dword [esi + 0xc], edi
mov eax, esi
pop edi
pop esi
ret