joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407c71
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push ebx
push esi
push edi
mov word [ebp - 0x10], 0
lea eax, [ebp - 0xe]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov word [eax + 0xc], 0
mov eax, dword [ebp + 0x10]
mov dword [eax], 0x3e7
cmp dword [0x461134], 0
jne 0x407cbd
xor eax, eax
jmp 0x407e81
mov eax, dword [ebp + 8]
movsx eax, byte [eax]
test eax, eax
je 0x407e7a
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffff
jne 0x407ceb
xor eax, eax
jmp 0x407e81
mov word [ebp - 0x10], 2
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x407d2f
cmp dword [0x45e03c], 0
je 0x407d2a
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
push str._r_nBUSTALTNICTEST:Failure_Override_inet_addr_returned_invalid___s_:__s_
call fcn.00452380
add esp, 0xc
jmp 0x407e7a
push 0x10
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x407d72
cmp dword [0x45e03c], 0
je 0x407d6d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
mov eax, dword [ebp + 8]
push eax
push str._n_rBUSTALTNICTEST:Unable_to_bind_to___s____d_
call fcn.00452380
add esp, 0xc
jmp 0x407e7a
mov word [ebp - 0x20], 2
mov eax, dword [0x461134]
mov dword [ebp - 0x1c], eax
push 0xf2c
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x1e], ax
push 0x10
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x407dc4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov eax, dword [ebp - 0x24]
push eax
call fcn.004096a2
add esp, 4
jmp 0x407e7a
mov eax, dword [ebp - 0x24]
push eax
call fcn.004096a2
add esp, 4
cmp dword [0x45e03c], 0
je 0x407df2
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
push str._r_nBUST_SUCCESS_ALTNICTEST:BIND_OVERRIDE_HAS_SELECTED_LOCAL_IPv4___s_:__s_
call fcn.00452380
add esp, 0xc
mov edi, dword [ebp + 8]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, 0xb60500
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 0xc]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, 0xb60580
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
push str.BUST_SUCCESS_ALTNICTEST:4BX:BIND_TO_LOCAL_ADAPTER___s_:__s_
push 0xfa
lea eax, [ebp - 0x120]
push eax
call fcn.00452660
add esp, 0x14
lea eax, [ebp - 0x120]
push eax
call fcn.004097a0
add esp, 4
mov eax, 1
jmp 0x407e81
xor eax, eax
jmp 0x407e81
pop edi
pop esi
pop ebx
leave
ret
Function at 0x408445
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x1c], 1
mov edi, dword [ebp + 8]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x14], eax
jle 0x4084d3
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
movsx eax, byte [eax + ecx]
cmp eax, 0x2e
jne 0x40849e
inc dword [ebp - 8]
jmp 0x4084cb
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
movsx eax, byte [eax + ecx]
cmp eax, 0x30
jl 0x4084c4
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
movsx eax, byte [eax + ecx]
cmp eax, 0x39
jle 0x4084cb
mov dword [ebp - 0x1c], 0
inc dword [ebp - 0x10]
jmp 0x408477
cmp dword [ebp - 0x1c], 0
je 0x408523
cmp dword [ebp - 0x14], 0x10
jge 0x408523
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x18], eax
cmp dword [0x45e03c], 0
je 0x408516
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp + 8]
push eax
push str._n_rHost_Lookup_is_fixed_IPv4___s__x
call fcn.00452380
add esp, 0xc
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
jmp 0x408585
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 4], eax
cmp dword [0x45e03c], 0
je 0x408558
cmp dword [ebp - 4], 0
jne 0x408558
mov eax, dword [ebp + 8]
push eax
push str._n_rFAILED_GET_IP_ADD_FOR___s_
call fcn.00452380
add esp, 8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jne 0x408585
cmp dword [ebp - 4], 0
je 0x408585
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ecx], eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4097a0
Capabilities:
Delete file
Move file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64c
push ebx
push esi
push edi
cmp dword [0x4622c8], 0
je 0x4097be
jmp 0x40999f
mov edi, 0x9a3940
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
mov dword [ebp - 0x32c], eax
dec dword [ebp - 0x32c]
mov eax, 0x46bd74
mov ecx, 0x46bd78
mov edx, dword [ebp - 0x32c]
movsx edx, byte [edx + 0x9a3940]
xor ebx, ebx
cmp edx, 0x5c
setne bl
dec ebx
sub ecx, eax
and ebx, ecx
add ebx, eax
push ebx
push 0x9a3940
push str._s_sSTLWA_NT_nce_.LOG
push 0x2fc
lea eax, [ebp - 0x628]
push eax
call fcn.00452660
add esp, 0x14
lea eax, [ebp - 0x64c]
push eax
lea eax, [ebp - 0x628]
push eax
call fcn.00452b10
add esp, 8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4098bd
cmp dword [ebp - 0x638], 0xa00000
jle 0x4098bd
mov eax, 0x46bd94
mov ecx, 0x46bd98
mov edx, dword [ebp - 0x32c]
movsx edx, byte [edx + 0x9a3940]
xor ebx, ebx
cmp edx, 0x5c
setne bl
dec ebx
sub ecx, eax
and ebx, ecx
add ebx, eax
push ebx
push 0x9a3940
push str._s_sSTLWA_NT_nce_.000
push 0x2fc
lea eax, [ebp - 0x328]
push eax
call fcn.00452660
add esp, 0x14
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 3
lea eax, [ebp - 0x328]
push eax
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 0
push 0
push 4
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
je 0x40999f
push 2
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x28]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
and eax, 0xffff
push eax
xor eax, eax
mov ax, word [ebp - 6]
push eax
mov eax, dword [ebp - 8]
and eax, 0xffff
push eax
mov eax, dword [ebp - 0x10]
and eax, 0xffff
push eax
xor eax, eax
mov ax, word [ebp - 0xa]
push eax
xor eax, eax
mov ax, word [ebp - 0xe]
mov eax, dword [eax*4 + 0x4620a8]
push eax
push 0x46bdb4
push str.__s___s__d___d____d:_02d:_02d_:__s_r_n
push 0x2fc
lea eax, [ebp - 0x628]
push eax
call fcn.00452660
add esp, 0x2c
push 0
lea eax, [ebp - 0x2c]
push eax
lea edi, [ebp - 0x628]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
push eax
lea eax, [ebp - 0x628]
push eax
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4099a4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x710
push ebx
push esi
push edi
cmp dword [0x4622c8], 0
je 0x4099c2
jmp 0x409b06
mov edi, 0x9a3940
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
mov dword [ebp - 0x2c], eax
dec dword [ebp - 0x2c]
mov eax, 0x46bde4
mov ecx, 0x46bde8
mov edx, dword [ebp - 0x2c]
movsx edx, byte [edx + 0x9a3940]
xor ebx, ebx
cmp edx, 0x5c
setne bl
dec ebx
sub ecx, eax
and ebx, ecx
add ebx, eax
push ebx
push 0x9a3940
push str._s_sSTLWA_NT_idle_.LOG
push 0x6e4
lea eax, [ebp - 0x710]
push eax
call fcn.00452660
add esp, 0x14
push 0
push 0
push 4
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x710]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
je 0x409b06
push 2
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x24]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
and eax, 0xffff
push eax
xor eax, eax
mov ax, word [ebp - 6]
push eax
mov eax, dword [ebp - 8]
and eax, 0xffff
push eax
mov eax, dword [ebp - 0x10]
and eax, 0xffff
push eax
xor eax, eax
mov ax, word [ebp - 0xa]
push eax
xor eax, eax
mov ax, word [ebp - 0xe]
mov eax, dword [eax*4 + 0x4620a8]
push eax
push str.__s__d___d____d:_02d:_02d_:__s___x__pid__d___s_r_n
push 0x6e4
lea eax, [ebp - 0x710]
push eax
call fcn.00452660
add esp, 0x34
push 0
lea eax, [ebp - 0x28]
push eax
lea edi, [ebp - 0x710]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
push eax
lea eax, [ebp - 0x710]
push eax
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x409b16
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0x14]
push eax
push 0xf003f
push 0
push 0x46be38
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x409b7a
cmp dword [0x45e03c], 0
je 0x409b73
mov eax, dword [ebp - 4]
push eax
push str._nERR__d_ON_938_SET
call fcn.00452380
add esp, 8
xor eax, eax
jmp 0x409bf9
cmp dword [ebp + 8], 0
jne 0x409ba5
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push 0x46be88
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
jmp 0x409bc5
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.LinkH
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
cmp dword [0x45e03c], 0
je 0x409be7
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push eax
push str._n_rCSET_938_Flag__d_value__d
call fcn.00452380
add esp, 0xc
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
jmp 0x409bf9
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40a3da
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
cmp dword [0x462148], 0
jne 0x40a458
push 0x46bf40
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x462148], eax
push 0x46bf50
mov eax, dword [0x462148]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5ad4e0], eax
push 0x46bf60
mov eax, dword [0x462148]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5dfaac], eax
push 0x46bf70
mov eax, dword [0x462148]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x46209c], eax
push 0x46bf8c
mov eax, dword [0x462148]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4620a0], eax
mov edi, dword [ebp + 8]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, 0x99ea80
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
mov dword [0x99e994], eax
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 4]
push eax
push 0x40a4da
push 0x4000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [ebp - 4], 0
jne 0x40a4d5
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x4622c8], 0
je 0x40a4d0
mov dword [ebp - 4], 1
jmp 0x40a4aa
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40b4f6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
mov dword [ebp - 0xd4], ecx
mov eax, dword [0x4620e4]
push eax
call fcn.00437f47
add esp, 4
push 0x46c44c
call fcn.00409bfe
add esp, 4
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0xffffffff
jne 0x40b563
cmp dword [0x45e03c], 0
je 0x40b55e
push str._r_nUNABLE_TO_SAVE_AuditL
call fcn.00452380
add esp, 4
jmp 0x40b627
mov eax, dword [ebp - 0xd4]
add eax, 0xc8
mov dword [ebp - 0xd8], eax
push 0
lea eax, [ebp - 0xd0]
push eax
push 4
lea eax, [ebp - 0xd8]
push eax
mov eax, dword [ebp - 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea edi, [ebp - 0xc8]
xor eax, eax
mov ecx, 0x32
rep stosd dword es:[edi], eax
mov byte [ebp - 0xc8], 0x65
mov byte [ebp - 0xc7], 0x70
mov edi, 0x9854e0
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
lea edi, [ebp - 0x64]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0
lea eax, [ebp - 0xd0]
push eax
push pe_nt_image_headers32
lea eax, [ebp - 0xc8]
push eax
mov eax, dword [ebp - 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0xd0]
push eax
mov eax, dword [ebp - 0xd4]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x4620e4]
push eax
call fcn.00437f6e
add esp, 4
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b63a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
push edi
mov eax, dword [0x4620e4]
push eax
call fcn.00437f47
add esp, 4
push 0x46c468
call fcn.00409bfe
add esp, 4
mov dword [ebp - 4], eax
lea edi, [ebp - 0xd0]
xor eax, eax
mov ecx, 0x32
rep stosd dword es:[edi], eax
mov byte [ebp - 0xd0], 0x55
mov byte [ebp - 0xcf], 0x70
mov edi, dword [ebp + 0xc]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
lea edi, [ebp - 0xce]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 8]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
lea edi, [ebp - 0x6c]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 0x10]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
lea edi, [ebp - 0x4e]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0xd4], 0xa4
cmp dword [ebp - 4], 0xffffffff
jne 0x40b72c
cmp dword [0x45e03c], 0
je 0x40b727
push str._r_nUNABLE_TO_SAVE_SIrec
call fcn.00452380
add esp, 4
jmp 0x40b779
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0xd8], eax
push 0
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 0xd8]
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xd4]
push eax
lea eax, [ebp - 0xd0]
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x4620e4]
push eax
call fcn.00437f6e
add esp, 4
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b78c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4620e4]
push eax
call fcn.00437f47
add esp, 4
push 0x46c484
call fcn.00409bfe
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x40b7cd
push 0x46c488
call fcn.00409bfe
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x40b7e7
push 0x46c48c
call fcn.00409bfe
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x40b801
push 0x46c490
call fcn.00409bfe
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x40b81b
push 0x46c494
call fcn.00409bfe
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x40b84d
cmp dword [0x45e03c], 0
je 0x40b848
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cx, word [eax]
push ecx
push 0x46c498
call fcn.00452380
add esp, 8
jmp 0x40b88b
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x4620e4]
push eax
call fcn.00437f6e
add esp, 4
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40b89e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4620e4]
push eax
call fcn.00437f47
add esp, 4
push 0x46c4b0
call fcn.00409bfe
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x40b8f7
cmp dword [0x45e03c], 0
je 0x40b8f2
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cx, word [eax]
push ecx
push 0x46c4b4
call fcn.00452380
add esp, 8
jmp 0x40b935
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x4620e4]
push eax
call fcn.00437f6e
add esp, 4
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b948
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4620e4]
push eax
call fcn.00437f47
add esp, 4
push 0x46c4cc
call fcn.00409bfe
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x40b9a1
cmp dword [0x45e03c], 0
je 0x40b99c
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cx, word [eax]
push ecx
push str._r_nUNABLE_TO_SAVE___X_
call fcn.00452380
add esp, 8
jmp 0x40b9df
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x4620e4]
push eax
call fcn.00437f6e
add esp, 4
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40e0ac
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
lea eax, [ebp - 0x1c]
push eax
push 0xf003f
push 0
push 0x46cb94
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40e0e2
jmp 0x40e146
cmp dword [ebp + 8], 0
jne 0x40e117
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0x10
lea eax, [ebp - 0x18]
push eax
push 3
push 0
push 0x46cbd0
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 4], eax
jmp 0x40e13c
mov dword [ebp - 8], 0x10
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push eax
push 0
push 0
push str.ADSILOSTM
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40e174
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a8
push ebx
push esi
push edi
mov dword [ebp - 0x208], 0
mov dword [ebp - 0x2a8], 0
cmp dword [ebp + 0x14], 0
je 0x40e1eb
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 0x224]
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
mov dword [ebp - 0x20c], 0x10
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x204], eax
mov eax, dword [ebp - 0x20c]
mov ecx, dword [ebp - 0x204]
movsx eax, byte [eax + ecx]
mov dword [ebp - 0x208], eax
jmp 0x40e201
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x208], eax
cmp dword [ebp + 8], 0
je 0x40e238
mov edi, dword [ebp + 0xc]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
lea edi, [ebp - 0x200]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x40e256
mov eax, dword [ebp + 0xc]
push eax
push 0x9a3740
push 0x46cbf0
lea eax, [ebp - 0x200]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0
push 0
push 2
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x200]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0xffffffff
je 0x40e381
lea eax, [ebp - 0x2a4]
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
mov byte [ebp - 0x2a4], 0x82
mov byte [ebp - 0x2a3], 0x70
push 0
lea eax, [ebp - 0x210]
push eax
push 0xa
lea eax, [ebp - 0x2a4]
push eax
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0x210]
push eax
push 0x10
push 0x9854e0
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
call fcn.0040e14b
mov dword [ebp - 0x2a8], eax
mov ax, word [ebp - 0x2a8]
mov word [ebp - 0x2a2], ax
push 0
lea eax, [ebp - 0x210]
push eax
push 4
lea eax, [ebp - 0x2a2]
push eax
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x20c], 0x10
mov eax, dword [ebp - 0x20c]
lea esi, [ebp - 0x224]
mov ecx, dword [ebp - 0x20c]
inc ecx
add ecx, dword [ebp + 0x1c]
mov edi, ecx
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0
lea eax, [ebp - 0x210]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp + 0x1c]
push eax
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40e3a9
cmp dword [0x45e03c], 0
je 0x40e3a9
lea eax, [ebp - 0x200]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._r_nFailure__d_CR___s_
call fcn.00452380
add esp, 0xc
pop edi
pop esi
pop ebx
leave
ret