joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47ad64
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x6a9a60]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x18]
xor esi, esi
push eax
push 0x28
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x47addb
lea eax, [ebp - 0x10]
push eax
push 0x620fb0
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x47addb
push esi
push esi
push esi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 1
push eax
push esi
push dword [ebp - 0x18]
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x47addb
push 0x40000
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
cmp dword [ebp - 0x18], 0
pop esi
je 0x47adeb
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.004b3004
leave
ret

Function at 0x47b127
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
push edi
push 0x44
pop esi
xor ebx, ebx
lea eax, [ebp - 0x5c]
push esi
push ebx
push eax
mov dword [ebp - 8], ebx
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov dword [ebp - 0x5c], esi
lea edi, [ebp - 0x18]
mov dword [ebp - 0x30], 1
stosd dword es:[edi], eax
lea ecx, [ebp - 4]
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00404190
push dword [ebp + 0xc]
lea eax, [ebp - 4]
push dword [ebp + 8]
push str.__s___s
push eax
call fcn.0040c593
add esp, 0x10
cmp dword [ebp + 0x14], ebx
je 0x47b182
push 0xa
pop eax
jmp 0x47b184
xor eax, eax
mov esi, dword [ebp - 4]
mov word [ebp - 0x2c], ax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x5c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, dword [ebp + 0x18]
test eax, eax
je 0x47b1c6
push dword [ebp + 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 8], 1
test edi, edi
je 0x47b1c6
mov eax, dword [ebp - 0x18]
mov dword [edi], eax
jmp 0x47b1c9
mov eax, dword [ebp - 0x18]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x47b1dd
test edi, edi
jne 0x47b1dd
push eax
call ebx
and dword [ebp - 0x18], edi
cmp dword [ebp - 0x14], 0
je 0x47b1ec
push dword [ebp - 0x14]
call ebx
and dword [ebp - 0x14], 0
lea ecx, [esi - 0x10]
call fcn.004023e0
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x47b403
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor ebx, ebx
lea ecx, [ebp - 8]
cmp dword [ebp + 0x10], ebx
mov edi, str.SOFTWAREKingsoftAntiviruscfg
mov eax, edi
mov esi, ebx
cmovne eax, dword [ebp + 0x10]
push eax
call fcn.004040f0
lea eax, [ebp - 0xc]
mov dword [ebp + 0x10], ebx
push eax
lea eax, [ebp + 0x10]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x47b476
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
push 4
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 4
push ebx
push dword [ebp + 8]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test esi, esi
je 0x47b476
push esi
call edi
mov esi, ebx
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.004023e0
test esi, esi
je 0x47b488
push esi
call edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x47b9be
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor ecx, ecx
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
mov dword [ebp - 4], ecx
push eax
push ecx
push 0x2001f
push ecx
push ecx
push ecx
push str.SoftwareKingsoftAntivirus
push reloc.OLEAUT32.dll_SysReAllocString
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, dword [ebp + 8]
test eax, eax
jne 0x47ba1e
mov esi, dword [ebp - 4]
lea eax, [ebp - 8]
push 4
push eax
push 4
push 0
push str.AllowProductRecommend
push esi
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test esi, esi
je 0x47ba1e
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
push 0
push ebx
push str.receive_spread_notification
call fcn.0047b403
add esp, 0xc
test esi, esi
je 0x47ba39
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
leave
ret
Function at 0x47c07b
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
mov eax, dword [0x6a9a60]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x258]
push ebx
push esi
push edi
push eax
xor edi, edi
call fcn.004040f0
push 0x61693c
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x25c]
push eax
call fcn.00413eaa
add esp, 0xc
lea ecx, [ebp - 0x254]
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, dword [ebp - 0x25c]
mov ebx, eax
lea ecx, [ecx - 0x10]
call fcn.004023e0
cmp ebx, 0xffffffff
jne 0x47c0e7
inc edi
jmp 0x47c246
test byte [ebp - 0x254], 0x10
lea eax, [ebp - 0x228]
je 0x47c18c
push 0x612f98
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x47c229
push 0x613490
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x47c229
push 0x613008
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x264]
push eax
call fcn.00413eaa
add esp, 0xc
push eax
lea eax, [ebp - 0x260]
push eax
call fcn.00413eaa
push dword [eax]
call fcn.0047c07b
mov ecx, dword [ebp - 0x260]
add esp, 0x10
mov esi, eax
lea ecx, [ecx - 0x10]
call fcn.004023e0
mov ecx, dword [ebp - 0x264]
lea ecx, [ecx - 0x10]
call fcn.004023e0
test esi, esi
je 0x47c242
jmp 0x47c229
push eax
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x268]
push eax
call fcn.00413eaa
add esp, 0xc
push edi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, dword [ebp - 0x268]
lea ecx, [ecx - 0x10]
call fcn.004023e0
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x26c]
push eax
call fcn.00413eaa
add esp, 0xc
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x26c]
mov esi, eax
lea ecx, [ecx - 0x10]
call fcn.004023e0
test esi, esi
jne 0x47c229
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x270]
push eax
call fcn.00413eaa
add esp, 0xc
push 4
push edi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [ebp - 0x270]
lea ecx, [ecx - 0x10]
call fcn.004023e0
lea eax, [ebp - 0x254]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x47c0e7
xor edi, edi
inc edi
test ebx, ebx
je 0x47c24d
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [ebp - 0x258]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [esi - 0x10]
call fcn.004023e0
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b3004
leave
ret
Function at 0x47c899
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x6a9a60]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x404]
push esi
push edi
push 0x400
push 0
push eax
mov esi, str.https:__wpa1.qq.com_5ciKQjBf__typewpaqidiantrue
mov edi, str.MarketQQLink
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
call fcn.004444f9
mov ecx, eax
call fcn.0047cb14
test al, al
je 0x47c8ec
mov esi, str.https:__wpa1.qq.com_FDdK6y0s__typewpaqidiantrue
mov edi, str.VipMarketQQLink
lea eax, [ebp - 0x408]
push 0
push eax
call fcn.00413a13
lea eax, [ebp - 0x408]
push eax
call fcn.00413b37
push 0x621578
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 0x10
lea ecx, [ebp - 0x408]
push eax
push 0x621578
call fcn.0040c36b
push dword [ebp - 0x408]
lea eax, [ebp - 0x404]
push 0x200
push eax
push esi
push edi
push str.FeedBack
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x404]
mov ecx, ebx
push eax
call fcn.004040f0
mov ecx, dword [ebp - 0x408]
add ecx, 0xfffffff0
call fcn.004023e0
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b3004
leave
ret 4

Function at 0x47e4f3
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x6a9a60]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
cmp byte [esi + 0x44], 0
je 0x47e513
mov al, 1
jmp 0x47e584
cmp dword [esi + 0x40], 0xffffffff
push ebx
mov bl, 1
jne 0x47e520
xor al, al
jmp 0x47e583
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push dword [ebp + 0xc]
push eax
push dword [esi + 0x40]
call dword [sym.imp.WS2_32.dll_WSAConnect]
test eax, eax
je 0x47e57e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x47e579
push dword [esi + 0x4c]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x47e57c
push 0x2c
push eax
lea eax, [ebp - 0x30]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x30]
push eax
push 0
push dword [esi + 0x40]
call dword [sym.imp.WS2_32.dll_WSAEnumNetworkEvents]
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x47e57e
mov dword [esi + 0x48], eax
xor bl, bl
mov byte [esi + 0x44], bl
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004b3004
leave
ret 8

Function at 0x47ebc1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x47ec1a
push ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x47ec19
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x47ec18
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
pop ecx
mov ecx, eax
xor eax, eax
mov dword [ebp - 8], ecx
mov dword [ebp + 8], eax
test ecx, ecx
jle 0x47ec18
sub esi, edi
lea ecx, [eax + edi]
mov dword [ebp - 4], 5
xor edx, edx
div dword [ebp - 4]
mov al, byte [ebx + edx*4]
xor al, byte [esi + ecx]
mov byte [ecx], al
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp + 8], eax
cmp eax, dword [ebp - 8]
jl 0x47ebf5
pop edi
pop ebx
pop esi
leave
ret
Function at 0x47eee7
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
lea esi, [ecx + 4]
cmp dword [esi], 0
je 0x47ef01
push dword [esi]
call dword [sym.imp.WS2_32.dll_FreeAddrInfoW]
and dword [esi], 0
push 0x20
lea eax, [ebp - 0x20]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov eax, dword [ebp + 0x10]
add esp, 0xc
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x1c]
push esi
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_GetAddrInfoW]
pop esi
leave
ret 0x18

Function at 0x47f3b7
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x6a9a60]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, 0x9b
lea eax, [ebp - 0xa0]
push edi
xor esi, esi
push esi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0xa0]
push edi
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x47f40e
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x47f40e
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov esi, dword [eax]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.004b3004
leave
ret

Function at 0x47f50e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
mov ecx, esi
call fcn.00404190
cmp dword [ebp - 4], 0
je 0x47f535
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push str.CLSID9B7A98EC_7EF9_468c_ACC8_37C793DBD7E0Implemented_CategoriesA5F7140E_4311_4ef9_AABC_F55941B5EBE5
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x47f5c7
xor ecx, ecx
mov dword [ebp + 8], ecx
cmp dword [ebp - 4], ecx
je 0x47f5c7
lea eax, [ebp + 8]
push eax
push ecx
lea eax, [ebp - 8]
push eax
push ecx
push 0x613e34
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 8], 1
je 0x47f57b
cmp dword [ebp - 8], 2
jne 0x47f5c7
mov ecx, esi
call fcn.004041c0
mov eax, dword [ebp + 8]
mov ecx, esi
shr eax, 1
inc eax
push eax
call fcn.004047c0
lea ecx, [ebp + 8]
mov dword [ebp - 0xc], eax
push ecx
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x613e34
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x47f5c7
mov eax, dword [ebp + 8]
xor edx, edx
mov ecx, dword [ebp - 0xc]
shr eax, 1
push 0xffffffffffffffff
mov word [ecx + eax*2], dx
mov ecx, esi
call fcn.0040e311
push dword [esi]
mov ecx, ebx
call fcn.00481fb4
test eax, eax
jne 0x47f5e4
mov ecx, esi
call fcn.004041c0
push dword [esi]
mov ecx, ebx
call fcn.00481cd9
cmp dword [ebp - 4], 0
je 0x47f5f3
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x47f5fb
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
cmp dword [ebp + 0xc], 8
mov ebx, esi
jl 0x47f6b3
mov eax, 0x288
mov dword [ebp - 4], esi
mov dword [ebp + 0xc], eax
push edi
push eax
call fcn.004b2ff6
mov edi, eax
pop ecx
test edi, edi
je 0x47f650
push dword [ebp + 0xc]
push esi
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp + 0xc]
push eax
push edi
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
mov ebx, eax
cmp ebx, 0x6f
jne 0x47f661
push edi
call fcn.004b2fff
pop ecx
mov edi, esi
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp eax, 2
jge 0x47f661
mov eax, dword [ebp + 0xc]
jmp 0x47f61b
test ebx, ebx
jne 0x47f6a7
mov ebx, edi
test edi, edi
je 0x47f6b2
push 6
lea eax, [ebx + 0x10c]
push str.vmware
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strnicmp]
add esp, 0xc
test eax, eax
jne 0x47f68e
mov ebx, dword [ebx]
test ebx, ebx
jne 0x47f66b
jmp 0x47f6ab
push 8
lea eax, [ebx + 0x194]
push eax
push dword [ebp + 8]
call sub.VCRUNTIME140.dll_memcpy
xor esi, esi
add esp, 0xc
inc esi
jmp 0x47f6ab
test edi, edi
je 0x47f6b2
push edi
call fcn.004b2fff
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x47f722
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1ac
mov eax, dword [0x6a9a60]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x198], eax
mov eax, dword [ebp + 0x14]
push edi
mov edi, ecx
mov dword [ebp - 0x1ac], eax
mov eax, dword [ebp + 0x18]
mov ecx, ebx
mov dword [ebp - 0x1a8], eax
call fcn.00404190
lea ecx, [ebp - 0x19c]
call fcn.00404190
lea ecx, [ebp - 0x1a0]
call fcn.00404190
push 0x190
lea eax, [ebp - 0x194]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x1a4]
mov ecx, edi
push eax
call fcn.0047f50e
push eax
mov ecx, ebx
call fcn.004048f0
mov ecx, dword [ebp - 0x1a4]
lea ecx, [ecx - 0x10]
call fcn.004023e0
mov eax, dword [ebx]
cmp dword [eax - 0xc], 0
jne 0x47f874
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x47f874
push dword [ebp - 0x1a8]
lea eax, [ebp - 0x198]
mov ecx, edi
push dword [ebp - 0x1ac]
push dword [ebp - 0x198]
push esi
push eax
call fcn.0047effd
push eax
lea ecx, [ebp - 0x19c]
call fcn.004048f0
mov ecx, dword [ebp - 0x198]
lea ecx, [ecx - 0x10]
call fcn.004023e0
mov esi, dword [ebp - 0x19c]
cmp dword [esi - 0xc], 0
je 0x47f87a
lea eax, [ebp - 0x1a0]
mov ecx, edi
push eax
push esi
call fcn.004806d6
test eax, eax
jne 0x47f87a
push dword [ebp - 0x1a0]
lea eax, [ebp - 0x198]
mov ecx, edi
push eax
call fcn.0048060b
push eax
mov ecx, ebx
call fcn.004048f0
mov ecx, dword [ebp - 0x198]
lea ecx, [ecx - 0x10]
call fcn.004023e0
mov eax, dword [ebx]
cmp dword [eax - 0xc], 0
je 0x47f87a
push eax
mov ecx, edi
call fcn.00481cd9
call dword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x47f87a
mov esi, dword [ebp - 0x19c]
mov ecx, dword [ebp - 0x1a0]
add ecx, 0xfffffff0
call fcn.004023e0
lea ecx, [esi - 0x10]
call fcn.004023e0
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b3004
leave
ret 0x14

Function at 0x47fa40
Capabilities:
Initialize winsock library

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x190]
test eax, eax
je 0x47fa5e
push esi
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [esi + 0x190], eax
test eax, eax
sete al
pop esi
ret
Function at 0x480ba5
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi + 0x4c]
push dword [esi + 0xc]
call edi
test eax, eax
je 0x480bcf
mov dword [esi + 0x48], 0x2749
xor al, al
jmp 0x480c96
push ebx
xor ebx, ebx
push ebx
push dword [esi + 4]
call edi
cmp eax, 0x80
jne 0x480bed
mov dword [esi + 0x48], 0x2734
xor al, al
jmp 0x480c95
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
push 0x14
mov eax, dword [ecx]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x20]
push ebx
push eax
mov dword [ecx], ebx
mov dword [ebp - 4], ebx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esi + 0x10]
mov dword [ebp + 8], eax
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 4]
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.WS2_32.dll_WSAResetEvent]
push ebx
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0xc]
push 1
push eax
push dword [esi + 0x40]
call dword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
je 0x480c55
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
jne 0x480c87
push dword [esi + 0x4c]
push dword [ebp - 0x10]
call edi
test eax, eax
jne 0x480c8a
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push ebx
push dword [ebp + 0xc]
lea eax, [ebp - 0x20]
push eax
push dword [esi + 0x40]
call dword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
test eax, eax
je 0x480c81
mov bl, 1
jmp 0x480c8a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x48], eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
pop ebx
pop edi
pop esi
leave
ret 8
Function at 0x481fe3
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi + 0x4c]
push dword [esi + 0xc]
call edi
test eax, eax
je 0x48200d
mov dword [esi + 0x48], 0x2749
xor al, al
jmp 0x4820b4
push ebx
xor ebx, ebx
push ebx
push dword [esi + 8]
call edi
cmp eax, 0x102
jne 0x48202b
mov dword [esi + 0x48], 0x2734
xor al, al
jmp 0x4820b3
mov eax, dword [ebp + 0x10]
mov dword [eax], ebx
lea eax, [esi + 0x28]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 8]
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.WS2_32.dll_WSAResetEvent]
push ebx
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x40]
call dword [sym.imp.WS2_32.dll_WSASend]
test eax, eax
je 0x482073
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
jne 0x4820a5
push dword [esi + 0x4c]
push dword [esi + 8]
call edi
test eax, eax
jne 0x4820a8
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], ebx
push eax
push ebx
push dword [ebp + 0x10]
lea eax, [ebp - 0x18]
push eax
push dword [esi + 0x40]
call dword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
test eax, eax
je 0x48209f
mov bl, 1
jmp 0x4820a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x48], eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
pop ebx
pop edi
pop esi
leave
ret 0xc

Function at 0x483202
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push ecx
push 0x482ea9
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
ret

Function at 0x483cfe
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x483d49
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x483d42
cmp dword [ebp + 8], 0x1b
jne 0x483d2a
push 0
push 2
jmp 0x483d34
cmp dword [ebp + 8], 0xd
jne 0x483d42
push 0
push 1
push 0x111
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
and dword [esi + 0x520], 0
pop esi
pop ebp
ret 0xc
Function at 0x48433c
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5e4
mov eax, dword [0x6a9a60]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
lea ecx, [ebp - 0x5d8]
push edi
mov dword [ebp - 0x5dc], ebx
call fcn.00404190
lea eax, [ebp - 0x5e4]
push str.duba_10_23.exe
push eax
call fcn.00479a8d
pop ecx
push eax
lea eax, [ebp - 0x5e0]
push eax
call fcn.00413eaa
add esp, 0xc
lea ecx, [ebp - 0x5d8]
push eax
call fcn.004048f0
mov ecx, dword [ebp - 0x5e0]
lea ecx, [ecx - 0x10]
call fcn.004023e0
mov ecx, dword [ebp - 0x5e4]
lea ecx, [ecx - 0x10]
call fcn.004023e0
mov esi, dword [ebp - 0x5d8]
lea eax, [ebx + 0x524]
xor edi, edi
mov ecx, ebx
neg ecx
push edi
sbb ecx, ecx
and ecx, eax
push ecx
push esi
push str.http:__cd001.www.duba.net_duba_install_2013_ever_duba_10_23.exe
lea ecx, [ebx + 0x534]
call fcn.00482eb8
test eax, eax
jne 0x484433
push edi
push 0x80
push 3
push edi
push edi
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x484484
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
cmp eax, 0x900000
jb 0x48442b
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebx + 0x59c]
xor edi, edi
push eax
push edi
push edi
push edi
push esi
call fcn.0047b127
add esp, 0x14
jmp 0x484486
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
push edi
push 1
push edi
push 2
push 2
push 0x621ea0
push edi
push edi
push 0x621ea8
lea ecx, [ebp - 0x5d4]
call fcn.0048274a
push edi
push edi
lea ecx, [ebp - 0x5d4]
call fcn.00482d36
lea ecx, [ebp - 0x5d4]
mov ebx, eax
call fcn.004829dc
test bl, 2
je 0x48447c
push str.http:__www.ijinshan.com_
call fcn.00446def
pop ecx
mov ebx, dword [ebp - 0x5dc]
jmp 0x484486
xor edi, edi
push edi
mov ecx, ebx
call fcn.00482fae
lea ecx, [esi - 0x10]
call fcn.004023e0
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.004b3004
leave
ret

Function at 0x484d83
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xc
call fcn.004b2fb8
pop ecx
mov ecx, eax
test ecx, ecx
jne 0x484d96
pop ebp
ret
mov eax, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp + 0x10]
mov dword [ecx + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ecx + 4], eax
xor eax, eax
push eax
push eax
push ecx
push 0x475f7f
push eax
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
pop ebp
ret