joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4027c1
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push str.extract_resource_file
call fcn.004072ab
mov ecx, eax
call fcn.004072b1
push dword [ebp + 8]
call fcn.004072ab
mov ecx, eax
call fcn.004072b1
movzx eax, word [ebp + 0xc]
push dword [ebp + 0x10]
xor ebx, ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov esi, eax
cmp esi, ebx
je 0x40286f
push esi
push ebx
call dword [sym.imp.KERNEL32.DLL_LoadResource]
push esi
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
push ebx
push ebx
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp + 8]
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x10], ebx
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x402850
lea eax, [ebp + 0x10]
push ebx
push eax
push dword [ebp + 0xc]
push edi
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x402847
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x402880
push str.Cant_create_file
call fcn.004072ab
mov ecx, eax
call fcn.004072c2
call fcn.004072ab
mov ecx, eax
call fcn.004072d3
jmp 0x402880
push str.Resource_file_is_not_found
call fcn.004072ab
mov ecx, eax
call fcn.004072c2
pop edi
mov al, bl
pop esi
pop ebx
pop ebp
ret

Function at 0x4028c1
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1400
call fcn.0040bd10
lea eax, [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x14]
push eax
push dword [ebp + 0xc]
and word [esi], 0
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x402967
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0x400
push eax
lea eax, [ebp - 0x400]
push eax
lea eax, [ebp + 8]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40295e
mov eax, dword [ebp + 8]
cmp eax, 1
je 0x402929
cmp eax, 2
je 0x40292e
cmp eax, 7
je 0x402929
cmp eax, 3
jne 0x40295e
cmp eax, 2
jne 0x40294f
lea eax, [ebp - 0x1400]
push 0x1000
push eax
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x1400]
jmp 0x402955
lea eax, [ebp - 0x400]
push eax
push esi
call fcn.0040b80d
pop ecx
pop ecx
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
leave
ret

Function at 0x4029a5
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
lea eax, [ebp + 0xc]
push esi
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4029f2
push dword [ebp + 0x14]
call fcn.0040b7c6
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 0x14]
push 1
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
ret
Function at 0x4029f5
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
lea eax, [ebp + 0xc]
push esi
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x402a37
lea eax, [ebp + 0x14]
push 4
push eax
push 4
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
ret

Function at 0x402a3a
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x402a66
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
ret

Function at 0x402ada
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
mov word [eax], bx
lea eax, [ebp - 0x804]
push edi
push eax
push 0x400
call dword [sym.imp.KERNEL32.DLL_GetLogicalDriveStringsW]
cmp word [ebp - 0x802], bx
lea esi, [ebp - 0x804]
mov dword [ebp - 4], ebx
je 0x402b57
push esi
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeW]
cmp eax, 3
jne 0x402b42
push esi
call fcn.00402a88
mov edi, eax
pop ecx
cmp edi, dword [ebp - 4]
jbe 0x402b42
push esi
mov dword [ebp - 4], edi
push dword [ebp + 8]
call fcn.0040b80d
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0xc]
pop ecx
pop ecx
mov dword [eax], edi
inc esi
inc esi
cmp word [esi], bx
jne 0x402b42
add esi, 2
cmp word [esi], bx
je 0x402b57
cmp word [esi + 2], bx
jne 0x402b12
pop edi
pop esi
pop ebx
leave
ret

Function at 0x402b5c
Capabilities:
Persist via run registry key

Disassembly:
push dword [esp + 4]
push str.Personal
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push SysReAllocString
call fcn.004028c1
add esp, 0x10
ret

Function at 0x402bb6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402bcd
test al, 0x10
jne 0x402bcd
push 1
pop eax
ret
xor eax, eax
ret
Function at 0x402fe1
Capabilities:
Create directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x403014
push esi
call fcn.00402bb6
test al, al
pop ecx
je 0x40300b
push esi
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
push esi
lea eax, [ebp - 0x208]
push str._sutils.jar
push eax
call fcn.0040bd3f
lea eax, [ebp - 0x208]
push eax
call fcn.00402bb6
add esp, 0x10
test al, al
pop esi
jne 0x403066
push str.utils.jar_is_not_found__extract_him
call fcn.004072ab
mov ecx, eax
call fcn.004072b1
push 0x418030
lea eax, [ebp - 0x208]
push 0x8c
push eax
call fcn.004027c1
add esp, 0xc
leave
ret
push str.utils.jar_is_found
call fcn.004072ab
mov ecx, eax
call fcn.004072b1
leave
ret

Function at 0x403079
Capabilities:
Create directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x4030ad
push edi
call fcn.00402bb6
test al, al
pop ecx
je 0x4030a4
push edi
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
push 0
push edi
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
push edi
lea eax, [ebp - 0x208]
push str._sLicense_ru.rtf
push eax
call fcn.0040bd3f
mov esi, 0x4180c8
lea eax, [ebp - 0x208]
push esi
push 0xa0
push eax
call fcn.004027c1
push edi
lea eax, [ebp - 0x208]
push str._sLicense_uk.rtf
push eax
call fcn.0040bd3f
push esi
lea eax, [ebp - 0x208]
push 0xa2
push eax
call fcn.004027c1
push edi
lea eax, [ebp - 0x208]
push str._sLicense_en.rtf
push eax
call fcn.0040bd3f
push esi
lea eax, [ebp - 0x208]
push 0xa1
push eax
call fcn.004027c1
add esp, 0x48
pop edi
pop esi
leave
ret

Function at 0x4031e3
Capabilities:
Check mutex on windows

Disassembly:
push str.zona_web_setup_mutex
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateMutexW]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
sub eax, 0xb7
neg eax
sbb eax, eax
inc eax
ret
Function at 0x403391
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x308
push ebx
push esi
push edi
push dword [ebp + 0xc]
call fcn.00402bb6
xor edi, edi
pop ecx
test al, al
je 0x403425
push edi
push edi
push 3
push edi
push edi
push SysReAllocString
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40349c
lea eax, [ebp + 0xc]
push edi
push eax
mov esi, 0x100
lea eax, [ebp - 0x308]
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea eax, [ebp - 0x208]
push esi
push eax
lea eax, [ebp - 0x308]
push dword [ebp + 0xc]
push eax
push edi
push 0xfde9
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
mov eax, dword [ebp + 0xc]
mov word [ebp + eax*2 - 0x208], di
lea eax, [ebp - 0x208]
push eax
call fcn.0040c1df
test eax, eax
pop ecx
jne 0x403462
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemTimeAsFileTime]
lea eax, [ebp - 0x208]
push eax
push 1
push edi
push edi
push dword [ebp - 4]
call fcn.0040c300
mov ecx, dword [ebp - 8]
xor esi, esi
add eax, ecx
push edi
adc edx, esi
push 0x2710
push edx
push eax
call fcn.0040c210
push edx
push eax
call fcn.00403340
add esp, 0xc
push 0x208
call fcn.0040b832
push dword [ebp + 8]
mov esi, eax
push str.Software_s
push esi
call fcn.0040bd3f
lea eax, [ebp - 0x208]
push eax
push str.installDate
push esi
push SysReAllocString
call fcn.004029a5
push esi
call fcn.0040b5d6
add esp, 0x24
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40394d
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x444
push ebx
push esi
lea eax, [ebp - 0x444]
push 0x104
xor ebx, ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
call fcn.00403a48
mov esi, dword [sym.imp.USER32.dll_MessageBoxW]
test al, al
jne 0x403994
call fcn.00403b3f
test eax, eax
jne 0x403994
push 0x30
push str.Zona
push 0x418784
push ebx
call esi
push edi
push 0xe
pop ecx
xor eax, eax
lea edi, [ebp - 0x38]
mov dword [ebp - 0x3c], 0x3c
rep stosd dword es:[edi], eax
call fcn.00403a48
test al, al
pop edi
jne 0x4039c0
call fcn.00403b3f
test eax, eax
mov dword [ebp - 0x30], str.open
jne 0x4039c7
mov dword [ebp - 0x30], str.runas
lea eax, [ebp - 0x444]
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x28], str._asService
mov dword [ebp - 0x38], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x403a42
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x4c7
jne 0x403a0a
push str.User_did_not_allow_elevation
jmp 0x403a32
push eax
lea eax, [ebp - 0x23c]
push 0x418710
push eax
call fcn.0040bd3f
add esp, 0xc
lea eax, [ebp - 0x23c]
push ebx
push ebx
push eax
push ebx
call esi
lea eax, [ebp - 0x23c]
push eax
call fcn.004072ab
mov ecx, eax
call fcn.00407354
xor al, al
jmp 0x403a44
mov al, 1
pop esi
pop ebx
leave
ret
Function at 0x403a48
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push edi
push 0x44
pop ecx
xor eax, eax
lea edi, [ebp - 0x110]
mov dword [ebp - 0x114], 0x114
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExW]
cmp dword [ebp - 0x110], 6
pop edi
sbb eax, eax
inc eax
leave
ret

Function at 0x403b3f
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
push ebx
push esi
push edi
push 0x44
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x12c]
mov dword [ebp - 0x130], 0x114
push ebx
rep stosd dword es:[edi], eax
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.DLL_SetLastError]
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExW]
cmp dword [ebp - 0x120], 2
mov dword [ebp - 4], ebx
je 0x403b93
mov dword [ebp - 8], 1
jmp 0x403c3d
lea eax, [ebp - 4]
push eax
push 8
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x403c3d
lea eax, [ebp - 0xc]
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push eax
push ebx
push ebx
push 2
push dword [ebp - 4]
mov dword [ebp - 0x1c], 0x201
mov dword [ebp - 0x18], 0x5000000
mov dword [ebp - 0x14], 0x20
mov dword [ebp - 0x10], 0x220
call edi
test eax, eax
jne 0x403c3d
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x7a
jne 0x403c3d
push dword [ebp - 0xc]
push 0x40
call dword [sym.imp.KERNEL32.DLL_LocalAlloc]
mov esi, eax
cmp esi, ebx
je 0x403c3d
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push esi
push 2
push dword [ebp - 4]
call edi
test eax, eax
je 0x403c36
cmp dword [esi], ebx
jbe 0x403c36
lea edi, [esi + 4]
lea eax, [ebp - 0x1c]
push eax
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x403c2e
mov dword [ebp - 8], 1
inc ebx
add edi, 8
cmp ebx, dword [esi]
jb 0x403c17
push esi
call dword [sym.imp.KERNEL32.DLL_LocalFree]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403c4e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x59284
call fcn.0040bd10
push ebx
push esi
lea eax, [ebp - 0x6c]
push edi
push eax
call fcn.00405722
pop ecx
lea ecx, [ebp - 0x19284]
call fcn.004020ea
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x274]
xor edi, edi
push 0x104
lea esi, [ebx + 0x19dc]
push eax
push edi
mov word [esi], di
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
test eax, eax
je 0x403d88
push edi
push edi
push 3
push edi
push edi
lea eax, [ebp - 0x274]
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x403d7b
lea eax, [ebp + 8]
push edi
push eax
lea eax, [ebp - 0x59284]
push 0x40000
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x403d10
cmp dword [ebp + 8], edi
je 0x403d1f
push dword [ebp + 8]
lea eax, [ebp - 0x59284]
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.0040574a
add esp, 0xc
lea eax, [ebp - 0x59284]
lea ecx, [ebp - 0x19284]
push dword [ebp + 8]
push eax
call fcn.00402139
jmp 0x403cc0
push ebx
push str.readFileForMD5
call fcn.004023ab
pop ecx
pop ecx
jmp 0x403d70
lea ecx, [ebp - 0x19284]
call fcn.0040216d
test al, al
je 0x403d43
mov eax, dword [ebp + 0xc]
push ebx
lea ecx, [ebp - 0x19284]
mov dword [eax], 1
call fcn.00402179
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00405800
pop ecx
mov word [esi], di
pop ecx
movzx eax, byte [ebp + edi - 0x14]
push eax
push esi
push str._s_02x
push esi
call fcn.0040bd3f
add esp, 0x10
inc edi
cmp edi, 0x10
jb 0x403d55
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x403d88
push ebx
push str.openFileForMD5AndTail
call fcn.004023ab
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404143
Capabilities:
Create directory
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push dword [ebp + 0xc]
lea eax, [ebp - 0x410]
push str._szona.ru
push eax
call fcn.0040bd3f
push dword [ebp + 0xc]
lea eax, [ebp - 0x208]
push str._szona.ruzona.sol
push eax
call fcn.0040bd3f
add esp, 0x18
xor eax, eax
cmp byte [ebp + 8], al
push eax
je 0x4041ba
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
push 0x418930
lea eax, [ebp - 0x208]
push 0xaa
push eax
call fcn.004027c1
add esp, 0xc
test al, al
je 0x4041e1
lea eax, [ebp - 0x208]
push 1
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
leave
ret
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
leave
ret

Function at 0x4041e3
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x660
lea eax, [ebp - 0x660]
push esi
push eax
push dword [ebp + 0xc]
call fcn.00402b78
push dword [ebp + 0x10]
lea eax, [ebp - 0x660]
push eax
call fcn.0040b7e3
lea eax, [ebp - 0x660]
push 0x418984
push eax
lea eax, [ebp - 0x458]
push eax
call fcn.0040bd3f
add esp, 0x1c
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x458]
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4042ad
lea eax, [ebp - 0x224]
push 0x418980
push eax
call fcn.0040b840
pop ecx
test eax, eax
pop ecx
je 0x40429b
lea eax, [ebp - 0x224]
push 0x418978
push eax
call fcn.0040b840
pop ecx
test eax, eax
pop ecx
je 0x40429b
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x660]
push eax
lea eax, [ebp - 0x458]
push eax
call fcn.0040bd3f
lea eax, [ebp - 0x458]
push eax
push dword [ebp + 8]
call fcn.00404143
add esp, 0x14
lea eax, [ebp - 0x250]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x404241
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
pop esi
leave
ret
Function at 0x4042db
Capabilities:
Get common file path
Get disk information
Write file on windows

Disassembly:
mov eax, 0x4138b8
call fcn.0040bc4c
sub esp, 0x420
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x224]
mov dword [ebp - 0x10], esp
xor ebx, ebx
push eax
push 0x104
mov word [edi], bx
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x224]
push str._shd.vbs
push eax
call fcn.0040bd3f
add esp, 0xc
lea eax, [ebp - 0x224]
push ebx
push ebx
push 2
push ebx
push ebx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x11], bl
mov dword [ebp - 4], ebx
je 0x404428
lea eax, [ebp - 0x1c]
push ebx
mov esi, str.Set_objWMIService__GetObject__winmgmts:._rootcimv2____n_Set_colItems__objWMIService.ExecQuery____n___Select__from_Win32_DiskDrive___n_For_Each_objItem_in_colItems__n_Wscript.Echo_objItem.SerialNumber__n_exit_for___do_the_first_cpu_only___n_Next
push eax
push esi
call fcn.0040c340
pop ecx
push eax
push esi
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push dword [ebp - 0x18]
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp esi, ebx
je 0x404428
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x42c]
push str.cscript___NoLogo__s
push eax
call fcn.0040bd3f
mov esi, dword [ebp + 0xc]
push esi
call fcn.0040b832
add esp, 0x10
mov dword [ebp + 0xc], eax
push esi
push eax
lea eax, [ebp - 0x42c]
push 1
push eax
call fcn.00402726
add esp, 0x10
cmp eax, ebx
jne 0x40440d
add esi, esi
push esi
push ebx
push edi
call fcn.0040c160
add esp, 0xc
push esi
push edi
push dword [ebp + 0xc]
call fcn.0040c340
pop ecx
push eax
push dword [ebp + 0xc]
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
push edi
call fcn.00402425
cmp eax, ebx
pop ecx
jle 0x40440d
push edi
call fcn.0040b7c6
cmp eax, 5
pop ecx
jbe 0x40440d
push edi
push str.Volume
call fcn.00402489
pop ecx
test al, al
pop ecx
jne 0x40440d
mov byte [ebp - 0x11], 1
push dword [ebp + 0xc]
call fcn.0040b5d6
pop ecx
jmp 0x404423
cmp byte [ebp - 0x11], bl
jne 0x40444f
push ebx
push ebx
push ebx
lea eax, [ebp + 8]
push ebx
push eax
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationW]
mov word [edi], 0x5f
add edi, 2
push 0xa
push edi
push dword [ebp + 8]
call fcn.0040bcd8
add esp, 0xc
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x405339
Capabilities:
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2070
call fcn.0040bd10
push ebx
push esi
push edi
mov esi, ecx
lea eax, [ebp - 0x70]
xor edi, edi
mov ebx, dword [esi]
push eax
mov dword [ebp - 4], edi
call fcn.00405722
pop ecx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x2070]
push 0x2000
push eax
push dword [ebp + 0xc]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x4053f0
cmp dword [ebp - 4], 0
je 0x4053f7
lea eax, [ebp - 8]
push 0
push eax
lea eax, [ebp - 0x2070]
push dword [ebp - 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x405437
mov eax, dword [ebp - 8]
cmp dword [ebp - 4], eax
jne 0x405437
push eax
lea eax, [ebp - 0x2070]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.0040574a
add edi, dword [ebp - 4]
add esp, 0xc
push dword [esi + 4]
push 0x64
push edi
call dword [sym.imp.KERNEL32.DLL_MulDiv]
cmp eax, 0x64
je 0x40535c
cmp eax, dword [esi + 0xc]
je 0x40535c
mov dword [esi + 0xc], eax
mov ecx, dword [ebx + 0x1c]
test ecx, ecx
je 0x40535c
push ebx
push eax
call ecx
jmp 0x40535c
push str.InternetReadFile
jmp 0x40543c
cmp edi, dword [esi + 4]
jne 0x405456
lea eax, [ebp - 0x70]
mov byte [esi + 8], 1
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00405800
mov eax, dword [esi + 0x14]
pop ecx
xor edi, edi
pop ecx
mov word [eax], di
movzx ecx, byte [ebp + edi - 0x18]
mov eax, dword [esi + 0x14]
push ecx
push eax
push str._s_02x
push eax
call fcn.0040bd3f
add esp, 0x10
inc edi
cmp edi, 0x10
jb 0x405417
jmp 0x405456
push str.WriteFile
call fcn.004072ab
mov ecx, eax
call fcn.004072c2
mov ecx, esi
call fcn.00404fb9
mov ecx, esi
call fcn.004055c1
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x40545d
Capabilities:
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov dx, word [0x41b944]
push ebx
push esi
push edi
mov ebx, ecx
push 0x7f
pop ecx
xor eax, eax
lea edi, [ebp - 0x406]
mov word [ebp - 0x408], dx
rep stosd dword es:[edi], eax
mov esi, 0x200
push 0x7f
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
pop ecx
xor esi, esi
push esi
push 0x84400000
stosw word es:[edi], ax
push esi
push esi
xor eax, eax
lea edi, [ebp - 0x206]
push esi
mov word [ebp - 0x208], dx
push dword [ebp + 0xc]
rep stosd dword es:[edi], eax
push esi
push dword [ebp + 8]
stosw word es:[edi], ax
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov edi, eax
cmp edi, esi
mov dword [ebp + 0xc], edi
jne 0x4054d4
push str.HttpOpenRequest
jmp 0x405581
push esi
push esi
push esi
push esi
push edi
call dword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
jne 0x4054ed
push str.HttpSendRequest
jmp 0x405581
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x408]
push eax
push 5
push edi
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x405575
push esi
lea eax, [ebp - 0x408]
push esi
push eax
call fcn.0040c562
mov dword [ebx + 4], eax
mov edi, str.Content_MD5
lea eax, [ebp - 0x208]
push edi
push eax
call fcn.0040b80d
add esp, 0x14
lea eax, [ebp - 4]
push esi
push eax
lea eax, [ebp - 0x208]
push eax
push 0xffff
push dword [ebp + 0xc]
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
mov eax, dword [ebx + 0x10]
mov word [eax], si
lea eax, [ebp - 0x208]
push eax
push edi
call fcn.0040b840
pop ecx
test eax, eax
pop ecx
je 0x405570
lea eax, [ebp - 0x208]
push eax
push dword [ebx + 0x10]
call fcn.0040b80d
pop ecx
pop ecx
mov eax, dword [ebp + 0xc]
jmp 0x40559d
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push str.HttpQueryInfo
call fcn.004072ab
mov ecx, eax
call fcn.004072c2
mov ecx, ebx
call fcn.00404fb9
mov ecx, ebx
call fcn.004055c1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x405688
Capabilities:
Create thread

Disassembly:
mov eax, 0x413946
call fcn.0040bc4c
push ecx
push esi
push str.httpget_start_asynch_loading
call fcn.004072ab
mov ecx, eax
call fcn.004072b1
mov esi, dword [ebp + 8]
push dword [esi + 4]
call fcn.004072ab
mov ecx, eax
call fcn.004072b1
push 0x18
call fcn.0040b832
pop ecx
mov ecx, eax
mov dword [ebp + 8], ecx
and dword [ebp - 4], 0
test ecx, ecx
je 0x4056d4
push esi
call fcn.00404f4c
jmp 0x4056d6
xor eax, eax
lea ecx, [ebp - 0x10]
push ecx
push 0
push eax
push 0x405668
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x405722
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x10], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret