joyce8/EMBER2024-capa huggingface dataset:
Function at 0x546c60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa4
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
lea edx, [eax + 0x50]
lea ecx, [eax + 8]
push edi
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 0x3ff00000
mov dword [esp + 0x80], 0
mov dword [esp + 0x84], 0x3ff00000
xor eax, eax
fld qword [ecx]
fadd qword [edx]
add eax, 8
add ecx, 8
sub edx, 8
cmp eax, 0x20
fsub qword [esp + eax + 0x48]
fstp qword [esp + eax + 0x50]
fld qword [ecx - 8]
fsub qword [edx + 8]
fadd qword [esp + eax + 0x78]
fstp qword [esp + eax + 0x80]
jle 0x546ca2
mov eax, dword [0x5f9808]
mov ecx, dword [0x5f980c]
mov dword [esp + 0x10], eax
lea edx, [esp + 0x50]
mov dword [esp + 0x14], ecx
push 5
mov eax, ecx
mov ecx, dword [esp + 0x14]
push edx
push eax
push ecx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x44], ebx
lea edi, [esp + 0x60]
call fcn.00546e90
mov edx, dword [ebp + 0xc]
add esp, 0x10
mov dword [esp + 0x44], edx
mov esi, 0x5f9808
cmp esi, 0x5f9998
jge 0x546e5d
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esi + 8]
add esi, 8
fstp qword [esp + 0x28]
mov dword [esp + 0x38], eax
mov eax, dword [esi + 4]
mov dword [esp + 0x3c], ecx
push 5
mov ecx, eax
push edi
push ecx
push edx
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
call fcn.00546e90
fst qword [esp + 0x58]
fld qword [esp + 0x38]
fmul st(1)
add esp, 0x10
fcomp qword [0x59a3c8]
fnstsw ax
test ah, 0x41
je 0x546e4b
fstp st(0)
sub esi, 8
mov ebx, 2
fld qword [esp + 0x38]
fadd qword [esp + 0x10]
push 5
push edi
fmul qword [0x599a38]
fstp qword [esp + 0x28]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push eax
push ecx
call fcn.00546e90
fld st(0)
fmul qword [esp + 0x58]
add esp, 0x10
fcomp qword [0x59a3c8]
fnstsw ax
test ah, 0x41
je 0x546dc4
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
fstp qword [esp + 0x28]
mov dword [esp + 0x38], edx
mov dword [esp + 0x3c], eax
jmp 0x546dd8
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
fstp qword [esp + 0x48]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
dec ebx
jne 0x546d74
fld qword [esp + 0x38]
fsub qword [esp + 0x10]
mov eax, dword [esp + 0x44]
mov edi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x34]
add eax, 8
fmul qword [esp + 0x48]
fld qword [esp + 0x28]
fsub qword [esp + 0x48]
mov dword [esp + 0x44], eax
inc edi
mov dword [esp + 0x1c], edi
lea edi, [esp + 0x80]
fdivp st(1)
fsubr qword [esp + 0x10]
fst qword [esp + 0x28]
fld st(0)
fstp qword [eax - 8]
mov eax, 1
sub eax, ecx
mov dword [esp + 0x34], eax
jne 0x546e2e
lea edi, [esp + 0x50]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
fstp qword [esp + 0x10]
push 5
push edi
push ecx
push edx
call fcn.00546e90
mov ebx, dword [esp + 0x2c]
add esp, 0x10
cmp ebx, 0xa
jl 0x546d0f
fstp st(0)
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ebx, 0xa
fstp st(0)
jge 0x546e83
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
sub ecx, eax
mov edx, 0xa
mov esi, dword [ecx + eax]
mov dword [eax], esi
mov esi, dword [ecx + eax + 4]
mov dword [eax + 4], esi
add eax, 8
dec edx
jne 0x546e71
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x563040
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.00550870
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x56310b
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x56310b
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x5630be
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x5630c9
or bh, 8
and edi, 0x8000000
je 0x5630e4
mov eax, dword [0x60743c]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x56310b
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5634e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x56350b
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x56352f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x56354a
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
Function at 0x567d11
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov eax, ebx
push edi
mov edi, ecx
shr eax, 0x10
test ax, ax
mov dword [edi + 0x40], ebx
jne 0x567d33
cmp dword [edi + 0x3c], 0
jne 0x567d33
movzx eax, bx
mov dword [edi + 0x3c], eax
call fcn.00578d59
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov ecx, edi
push dword [esp + 0x18]
push eax
call fcn.00567d60
pop edi
pop esi
pop ebx
ret 8

Function at 0x569bb3
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x569beb
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00568bb3
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00568b8b
jmp 0x569bf7
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x56b5d7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x56b619
call fcn.00578d59
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x56b619
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x56b610
xor eax, eax
jmp 0x56b621
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0056b627
pop edi
pop esi
pop ebx
ret 4

Function at 0x5776ea
Capabilities:
Create http request

Disassembly:
mov eax, 0x596088
call fcn.00553178
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 0xc]
and dword [ebp - 4], 0
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
test eax, eax
mov dword [esi], vtable.CInternetSession.0
jne 0x577722
call fcn.00578d59
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
mov dword [esi + 8], eax
jne 0x577747
push eax
push dword [esi + 4]
call fcn.00578369
jmp 0x577753
push esi
push eax
mov ecx, 0x605840
call fcn.00577764
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 0x18
Function at 0x577a15
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
mov eax, 0x5960e7
call fcn.00553178
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.0056e0d5
mov eax, dword [ebp + 0x18]
lea ebx, [esi + 0x24]
mov dword [esi + 0x1c], eax
mov eax, dword [0x5f9f88]
xor edi, edi
mov dword [ebx], eax
mov dword [ebp - 4], edi
push dword [ebp + 0x10]
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 1
mov dword [esi], vtable.CInternetFile.0
call fcn.00568895
push dword [ebp + 0x14]
mov ecx, ebx
call fcn.00568895
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [esi + 0x18], eax
mov dword [esi + 0x3c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x40], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x18

Function at 0x57c564
Capabilities:
Receive data
Receive data on socket

Disassembly:
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [ecx + 4]
call sub.WSOCK32.dll_recv
ret 0xc

Function at 0x57c57b
Capabilities:
Send data
Send data on socket

Disassembly:
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [ecx + 4]
call sub.WSOCK32.dll_send
ret 0xc

Function at 0x6d96ff
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x60778dd0
call fcn.006daf68
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x607796c8
mov dword [esi + 4], 0x607796a4
mov dword [esi + 8], 0x60779688
mov dword [esi + 0xc], 0x60779628
mov dword [esi + 0x10], 0x60779600
mov dword [esi + 0x14], 0x607795c4
mov dword [esi + 0x18], 0x60779598
mov dword [esi + 0x1c], 0x60779588
mov dword [esi + 0x20], 0x60779560
mov dword [esi + 0x24], 0x60779550
mov dword [esi + 0x28], 0x60779538
mov dword [esi + 0x2c], 0x60779508
mov dword [esi + 0x30], 0x607794f4
mov dword [esi + 0x34], 0x607794e4
mov dword [esi + 0x7c], 0x607794d8
and dword [ebp - 4], 0
mov dword [esi + 0x9c], 1
call fcn.006d3da9
push 0x6077c57c
call dword [0x60779120]
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.006d3b03
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0xd68b5d
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0xd68886
and ebx, esi
mov esi, esi
sub ebx, 0x106263ae
call fcn.00d68bac
or esi, esi
push 0xb81a17d8
pop ebx
xor dword [edx], ecx
sub esi, ebx
add esi, 0x185eae16
add edx, 2
and esi, esi
cmp edx, edi
jl fcn.00d68b5d
sub esi, 1
sub ebx, 1
sub ebx, ebx
ret
Function at 0x401363
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.ADVAPI32.dll_RegOpenKeyExA
mov edi, eax
or edi, edi
je 0x401388
xor eax, eax
jmp 0x4013c2
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x1c]
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegQueryValueExA
mov edi, eax
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegCloseKey
cmp edi, 0xea
jne 0x4013b7
mov eax, 3
jmp 0x4013c2
or edi, edi
je 0x4013bf
xor eax, eax
jmp 0x4013c2
xor eax, eax
inc eax
pop edi
leave
ret

Function at 0x4013c5
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push eax
push edi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.ADVAPI32.dll_RegCreateKeyExA
mov edi, eax
or edi, edi
je 0x4013f5
xor eax, eax
jmp 0x40142d
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x1c]
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegSetValueExA
mov edi, eax
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegCloseKey
or edi, edi
je 0x40141d
xor eax, eax
jmp 0x40142d
cmp dword [ebp - 8], 1
jne 0x40142a
mov eax, 2
jmp 0x40142d
xor eax, eax
inc eax
pop edi
leave
ret

Function at 0x401430
Capabilities:
Get disk information
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
push esi
push edi
mov edi, dword [ebp + 8]
mov byte [edi], 0
mov dword [ebp - 0x193], 0x94
lea eax, [ebp - 0x193]
push eax
call sub.KERNEL32.dll_GetVersionExA
push 0x4062bd
push edi
call fcn.00402c14
push dword [ebp - 0x187]
push dword [ebp - 0x18b]
push dword [ebp - 0x18f]
push 0x4062b4
lea eax, [ebp - 0xff]
push eax
call sub.msvcrt.dll_sprintf
lea eax, [ebp - 0xff]
push eax
push edi
call sub.msvcrt.dll_strcat
push 0
push 0
lea eax, [ebp - 0x19c]
push eax
lea eax, [ebp - 0x19c]
push eax
lea eax, [ebp - 0x198]
push eax
push 0xff
lea eax, [ebp - 0xff]
push eax
push 0x4062b0
call sub.KERNEL32.dll_GetVolumeInformationA
push dword [ebp - 0x198]
push 0x4062ab
lea eax, [ebp - 0xff]
push eax
call sub.msvcrt.dll_sprintf
lea eax, [ebp - 0xff]
push eax
push edi
call sub.msvcrt.dll_strcat
push 0xff
lea eax, [ebp - 0xff]
push eax
push 3
push 0x400
call sub.KERNEL32.dll_GetLocaleInfoA
lea eax, [ebp - 0xff]
push eax
push edi
call sub.msvcrt.dll_strcat
push 0x4062a9
push edi
call sub.msvcrt.dll_strcat
lea eax, [ebp - 0x1a4]
push eax
lea eax, [ebp - 0x1a0]
push eax
lea eax, [ebp - 0xff]
push eax
push 0x40629f
push dword [0x406094]
push 0x80000002
call fcn.00401363
add esp, 0x58
mov esi, eax
cmp esi, 1
jne 0x401559
lea eax, [ebp - 0xff]
push eax
push edi
call sub.msvcrt.dll_strcat
add esp, 8
push 0x406298
push edi
call sub.msvcrt.dll_strcat
add esp, 8
pop edi
pop esi
leave
ret
Function at 0x40156b
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
mov edi, eax
push dword [ebp + 8]
call sub.WSOCK32.dll_gethostbyname
mov esi, eax
or esi, esi
jne 0x401593
xor eax, eax
jmp 0x4015cf
mov word [ebp - 0x10], 2
mov eax, dword [esi + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
push 0x50
call sub.WSOCK32.dll_htons
mov ebx, eax
mov word [ebp - 0xe], bx
push 0x10
lea eax, [ebp - 0x10]
push eax
push edi
call sub.WSOCK32.dll_connect
mov esi, eax
push edi
call sub.WSOCK32.dll_closesocket
or esi, esi
je 0x4015cc
xor eax, eax
jmp 0x4015cf
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4015f6
Capabilities:
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00402bf4
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
and dword [ebp - 0x100c], 0
lea eax, [ebp - 0x101c]
push eax
call sub.KERNEL32.dll_GetSystemTime
xor esi, esi
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push ebx
call sub.WININET.dll_InternetReadFile
mov edi, eax
cmp dword [ebp - 4], 0
jne 0x40164c
or edi, edi
jne 0x40164c
mov eax, esi
inc esi
cmp eax, 0xa
jne 0x40161e
cmp dword [ebp - 4], 0
je 0x4016a4
and dword [ebp - 0x1008], 0
push 0
lea eax, [ebp - 0x1008]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x1004]
push eax
push dword [ebp + 0xc]
call sub.KERNEL32.dll_WriteFile
mov edi, eax
or edi, edi
je 0x40168a
mov eax, dword [ebp - 0x1008]
cmp dword [ebp - 4], eax
jne 0x40168a
xor eax, eax
inc eax
jmp 0x40168c
xor eax, eax
mov edi, eax
or eax, eax
je 0x4016a0
mov eax, dword [ebp - 0x1008]
add dword [ebp - 0x100c], eax
jmp 0x4016a4
and dword [ebp - 4], 0
cmp dword [ebp - 4], 0
jne 0x40161c
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401725
Capabilities:
Create process on windows
Delete file
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1494
call fcn.00402bf4
push ebx
push esi
push edi
push 0xff
lea eax, [ebp - 0x12fc]
push eax
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
mov dword [ebp - 0x1390], 0x94
lea eax, [ebp - 0x1390]
push eax
call sub.KERNEL32.dll_GetVersionExA
cmp dword [ebp - 0x1380], 2
jne 0x4017be
push 0xff
lea eax, [ebp - 0xff]
push eax
call sub.KERNEL32.dll_GetSystemDirectoryA
lea eax, [ebp - 0xff]
push eax
push 0x406269
lea eax, [ebp - 0x11fd]
push eax
call sub.msvcrt.dll_sprintf
lea eax, [ebp - 0xff]
push eax
push 0x40625e
lea eax, [ebp - 0x148f]
push eax
call sub.msvcrt.dll_sprintf
push 0x406255
lea eax, [ebp - 0xff]
push eax
call sub.msvcrt.dll_strcat
add esp, 0x20
jmp 0x401813
push 0xff
lea eax, [ebp - 0xff]
push eax
call sub.KERNEL32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0xff]
push eax
push 0x406269
lea eax, [ebp - 0x11fd]
push eax
call sub.msvcrt.dll_sprintf
lea eax, [ebp - 0xff]
push eax
push 0x406246
lea eax, [ebp - 0x148f]
push eax
call sub.msvcrt.dll_sprintf
push 0x406239
lea eax, [ebp - 0xff]
push eax
call sub.msvcrt.dll_strcat
add esp, 0x20
lea eax, [ebp - 0x148f]
push eax
call sub.KERNEL32.dll_DeleteFileA
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x11fd]
push eax
call sub.KERNEL32.dll_CreateFileA
mov edi, eax
lea eax, [ebp - 0x11fd]
push eax
lea eax, [ebp - 0x12fc]
push eax
lea eax, [ebp - 0x12fc]
push eax
push 0x4061ff
lea eax, [ebp - 0x10fe]
push eax
call sub.msvcrt.dll_sprintf
add esp, 0x14
lea ecx, [ebp - 0x10fe]
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x401871
push 0
lea ebx, [ebp - 0x1494]
push ebx
push eax
lea esi, [ebp - 0x10fe]
push esi
push edi
call sub.KERNEL32.dll_WriteFile
push edi
call sub.KERNEL32.dll_CloseHandle
lea eax, [ebp - 0x11fd]
push eax
lea eax, [ebp - 0xff]
push eax
push 0x4061f6
lea eax, [ebp - 0x10fe]
push eax
call sub.msvcrt.dll_sprintf
add esp, 0x10
push 0
lea eax, [ebp - 0x10fe]
push eax
call sub.KERNEL32.dll_WinExec
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401945
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push eax
push ebx
push esi
push edi
and dword [ebp - 4], 0
xor edi, edi
push dword [ebp + 8]
push dword [ebp + 0xc]
call fcn.004016b3
add esp, 8
or eax, eax
je 0x401a6f
call fcn.004018ca
mov dword [ebp - 4], eax
test eax, eax
je 0x4019fb
mov eax, dword [ebp + 8]
mov ecx, eax
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x401981
mov esi, eax
mov ebx, dword [ebp - 4]
lea ecx, [ebx]
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x401992
mov ebx, eax
lea esi, [esi + ebx + 2]
push esi
call sub.msvcrt.dll_malloc
add esp, 4
mov edi, eax
cmp edi, 0
je 0x4019f2
mov eax, dword [ebp - 4]
lea ecx, [eax]
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x4019b7
mov dword [ebp - 8], eax
push dword [ebp - 8]
push dword [ebp - 4]
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 8]
mov dl, byte [0x4060a5]
mov byte [edi + eax], dl
mov eax, dword [ebp - 8]
add eax, 1
mov byte [edi + eax], 0
push dword [ebp + 8]
push edi
call sub.msvcrt.dll_strcat
add esp, 8
push dword [ebp - 4]
call sub.msvcrt.dll_free
pop ecx
or edi, edi
je 0x401a35
mov ecx, edi
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x401a04
mov esi, eax
push 1
push esi
push edi
push dword [0x4060a0]
push dword [0x406094]
push 0x80000002
call fcn.004013c5
add esp, 0x18
push edi
call sub.msvcrt.dll_free
add esp, 4
jmp 0x401a65
mov eax, dword [ebp + 8]
mov ecx, eax
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x401a3d
mov edi, eax
push 1
push edi
push dword [ebp + 8]
push dword [0x4060a0]
push dword [0x406094]
push 0x80000002
call fcn.004013c5
add esp, 0x18
push 5
push dword [ebp + 8]
call sub.KERNEL32.dll_WinExec
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402b90
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
call sub.KERNEL32.dll_GetCommandLineA
mov edi, eax
cmp byte [edi], 0x22
jne 0x402bc4
push 0x22
mov eax, edi
inc eax
push eax
call sub.CRTDLL.dll_strchr
add esp, 8
mov dword [ebp - 4], eax
test eax, eax
je 0x402bdf
mov edi, eax
inc edi
jmp 0x402bbc
inc edi
cmp byte [edi], 0x20
je 0x402bbb
jmp 0x402bdf
inc edi
movsx eax, byte [edi]
or eax, eax
je 0x402bd0
cmp eax, 0x20
jne 0x402bc3
jmp 0x402bd3
inc edi
movsx eax, byte [edi]
or eax, eax
je 0x402bdf
cmp eax, 0x20
je 0x402bd2
push 0
call sub.KERNEL32.dll_GetModuleHandleA
push 1
push edi
push 0
push eax
call fcn.00401ea9
pop edi
leave
ret