joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4118c0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.00429400
mov eax, dword [ebp + 8]
test eax, eax
jne 0x4118e5
mov eax, dword [ebp + 0xc]
push eax
push 0x4116e0
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x4118f5
mov ecx, dword [ebp + 0xc]
push ecx
push 0x4116e0
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
push edi
push str.psapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
mov dword [ebp - 0xc], edi
test edi, edi
jne 0x411912
lea eax, [edi + 0x50]
pop edi
mov esp, ebp
pop ebp
ret
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.EnumProcessModules
push edi
call esi
push str.GetModuleBaseNameA
mov ebx, eax
push edi
mov dword [ebp - 8], ebx
call esi
push str.GetModuleFileNameExA
push edi
mov dword [ebp + 8], eax
call esi
mov dword [ebp - 4], eax
test ebx, ebx
je 0x4119c8
cmp dword [ebp + 8], 0
je 0x4119c8
test eax, eax
je 0x4119c8
mov edx, dword [ebp + 0xc]
mov ebx, dword [edx]
test ebx, ebx
je 0x4119b8
mov edi, dword [ebx + 8]
mov eax, dword [edi + 4]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4119ae
lea ecx, [ebp - 0x10]
push ecx
push 0x1000
lea edx, [ebp - 0x1010]
push edx
push esi
call dword [ebp - 8]
test eax, eax
jle 0x4119a7
test dword [ebp - 0x10], 0xfffffffc
jbe 0x4119a7
mov eax, dword [ebp - 0x1010]
push 0x401
add edi, 8
push edi
push eax
push esi
call dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebx + 0x18]
test ebx, ebx
jne 0x411958
mov edi, dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
pop ebx
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
pop ebx
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x411be0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x4ae7ec]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x114
lea eax, [ebp - 0x118]
push 0
push eax
call fcn.004219f0
add esp, 0xc
lea ecx, [ebp - 0x118]
push ecx
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x411c56
cmp dword [ebp - 0x108], 2
jne 0x411c56
mov eax, dword [ebp - 0x114]
cmp eax, 5
ja 0x411c43
jne 0x411c56
cmp dword [ebp - 0x110], 1
jb 0x411c56
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004171f3
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.004171f3
mov esp, ebp
pop ebp
ret
Function at 0x411c70
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x4ae7ec]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x114
lea eax, [ebp - 0x234]
push 0
push eax
call fcn.004219f0
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0xc
lea ecx, [ebp - 0x234]
push ecx
mov dword [ebp - 0x234], 0x114
call esi
test eax, eax
je 0x411d27
cmp dword [ebp - 0x224], 2
jne 0x411d27
cmp dword [ebp - 0x230], 5
jb 0x411d27
push 0x11c
lea edx, [ebp - 0x120]
push 0
push edx
call fcn.004219f0
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x11c
call esi
test eax, eax
je 0x411d27
mov eax, dword [ebp - 0x11c]
cmp eax, 5
jb 0x411d27
jne 0x411d13
cmp dword [ebp - 0x118], 1
jne 0x411d27
cmp word [ebp - 0xc], 2
jb 0x411d27
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004171f3
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop esi
call fcn.004171f3
mov esp, ebp
pop ebp
ret

Function at 0x411d40
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x4ae7ec]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x114
lea eax, [ebp - 0x118]
push 0
push eax
call fcn.004219f0
add esp, 0xc
lea ecx, [ebp - 0x118]
push ecx
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x411da9
cmp dword [ebp - 0x108], 2
jne 0x411da9
cmp dword [ebp - 0x114], 5
jb 0x411da9
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004171f3
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.004171f3
mov esp, ebp
pop ebp
ret

Function at 0x411f00
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x45c
mov eax, dword [0x4ae7ec]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
xor eax, eax
push 0x40
push eax
mov dword [ebp - 0x414], eax
mov dword [ebp - 0x410], eax
mov dword [ebp - 0x40c], eax
lea eax, [ebp - 0x458]
push eax
mov dword [ebp - 0x418], 0
call fcn.004219f0
push esi
push edi
push str.RUNDLL32.EXE_SETUPAPI.DLL_InstallHinfSection__s_132__s
lea edx, [ebp - 0x408]
xor ecx, ecx
push 0x401
push edx
mov dword [ebp - 0x430], 1
mov word [ebp - 0x42c], cx
mov dword [ebp - 0x45c], 0x44
call sym.SelectBehaviorsExe.exe_TM_FormatString
add esp, 0x20
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x45c]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x408]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x411fbd
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004171f3
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x414]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [ebp - 0x418]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 0x418]
push edx
call esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 1
pop esi
call fcn.004171f3
mov esp, ebp
pop ebp
ret
Function at 0x412000
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
mov eax, dword [0x4ae7ec]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x41202d
lea eax, [esi + 0x51]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004171f3
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x408]
push 0x401
push eax
call sym.SelectBehaviorsExe.exe_TM_GetSystemRootDirectory
add esp, 8
test eax, eax
jne 0x412094
push 0x401
lea ecx, [ebp - 0x80c]
push ecx
lea edx, [ebp - 0x818]
push edx
lea eax, [ebp - 0x814]
push eax
lea ecx, [ebp - 0x810]
push ecx
push 0
push 0
lea edx, [ebp - 0x408]
push edx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x412094
mov eax, dword [ebp - 0x810]
mov dword [esi], eax
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004171f3
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov dword [esi], 0
xor ecx, ebp
mov eax, 1
pop esi
call fcn.004171f3
mov esp, ebp
pop ebp
ret
Function at 0x414b20
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x182c
call fcn.00429400
mov eax, dword [0x4ae7ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [ebp - 0x1828], eax
mov dword [ebp - 0x182c], esi
test esi, esi
jne 0x414b5f
lea eax, [ecx + 1]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004171f3
mov esp, ebp
pop ebp
ret
cmp word [esi], 0
mov dword [ebp - 0x1814], 0
je 0x414d4e
push ebx
push edi
lea edi, [esi + 0x1008]
xor ecx, ecx
test edi, edi
je 0x414bb3
cmp word [edi], cx
je 0x414ba9
lea edx, [ebp - 0x1810]
mov eax, edi
sub edx, edi
cmp ecx, 0x400
jae 0x414ba9
mov bx, word [eax]
mov word [edx + eax], bx
add eax, 2
inc ecx
cmp word [eax], 0
jne 0x414b90
xor edx, edx
mov word [ebp + ecx*2 - 0x1810], dx
xor ecx, ecx
test esi, esi
je 0x414beb
cmp word [esi], cx
je 0x414be1
lea edx, [ebp - 0x808]
mov eax, esi
sub edx, esi
cmp ecx, 0x400
jae 0x414be1
mov bx, word [eax]
mov word [edx + eax], bx
add eax, 2
inc ecx
cmp word [eax], 0
jne 0x414bc8
xor eax, eax
mov word [ebp + ecx*2 - 0x808], ax
lea eax, [esi + 0x802]
xor ecx, ecx
test eax, eax
je 0x414c27
cmp word [eax], cx
je 0x414c1d
lea edx, [ebp - 0x100c]
sub edx, eax
cmp ecx, 0x400
jae 0x414c1d
mov bx, word [eax]
mov word [edx + eax], bx
add eax, 2
inc ecx
cmp word [eax], 0
jne 0x414c04
xor edx, edx
mov word [ebp + ecx*2 - 0x100c], dx
mov ebx, dword [ebp - 0x1828]
mov esi, dword [esi + 0x1004]
lea eax, [ebp - 0x1820]
push eax
lea ecx, [ebp - 0x808]
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x414c59
mov edx, dword [ebp - 0x1820]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
dec eax
je 0x414cc0
sub eax, 3
jne 0x414d25
push edi
call fcn.0041b47f
add esp, 4
mov dword [ebp - 0x1824], eax
lea eax, [ebp - 0x181c]
push eax
push 2
push 0
lea ecx, [ebp - 0x808]
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x414d25
mov ecx, dword [ebp - 0x181c]
push 4
lea edx, [ebp - 0x1824]
push edx
push 4
push eax
lea eax, [ebp - 0x100c]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 0x181c]
push edx
jmp 0x414d1f
lea eax, [ebp - 0x1818]
push eax
push 2
push 0
lea ecx, [ebp - 0x808]
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x414d25
lea eax, [ebp - 0x1810]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x414ce6
sub eax, edx
sar eax, 1
lea edx, [eax + eax]
push edx
mov edx, dword [ebp - 0x1818]
lea eax, [ebp - 0x1810]
push eax
push 1
push 0
lea ecx, [ebp - 0x100c]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x1818]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x1814]
mov ecx, dword [ebp - 0x182c]
inc eax
mov dword [ebp - 0x1814], eax
imul eax, eax, 0x180c
cmp word [eax + ecx], 0
lea esi, [eax + ecx]
jne 0x414b75
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop esi
call fcn.004171f3
mov esp, ebp
pop ebp
ret
Function at 0x414d60
Capabilities:
Persist via run registry key

Disassembly:
push 0x80000002
mov ecx, str.SoftwareMicrosoftWindowsCurrentVersionRun
call fcn.00414b20
push 0x80000001
mov ecx, str.SoftwareMicrosoftWindowsCurrentVersionRun
call fcn.00414b20
add esp, 8
xor eax, eax
ret

Function at 0x414df0
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1024
call fcn.00429400
mov eax, dword [0x4ae7ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x4af358]
cmp word [eax], 0
mov dword [ebp - 0x1018], 0
je 0x414fd8
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push edi
mov dword [ebp - 0x1010], 0x4af358
mov ecx, dword [str.Norton]
xor edi, edi
cmp word [ecx], di
je 0x414faa
mov esi, 0x4af368
lea esp, [esp]
mov edx, dword [ebp - 0x1010]
mov eax, dword [edx]
xor ecx, ecx
test eax, eax
je 0x414e99
cmp word [eax], cx
je 0x414e8f
lea edx, [ebp - 0x808]
sub edx, eax
jmp 0x414e70
cmp ecx, 0x400
jae 0x414e8f
mov bx, word [eax]
mov word [edx + eax], bx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add eax, 2
inc ecx
cmp word [eax], 0
jne 0x414e70
xor eax, eax
mov word [ebp + ecx*2 - 0x808], ax
mov eax, dword [esi]
xor ecx, ecx
test eax, eax
je 0x414ed3
cmp word [eax], cx
je 0x414ec9
lea edx, [ebp - 0x100c]
sub edx, eax
mov edi, edi
cmp ecx, 0x400
jae 0x414ec9
mov si, word [eax]
mov word [edx + eax], si
add eax, 2
inc ecx
cmp word [eax], 0
jne 0x414eb0
xor edx, edx
mov word [ebp + ecx*2 - 0x100c], dx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
lea eax, [ebp - 0x1024]
push eax
lea ecx, [ebp - 0x808]
push ecx
push 0x80000002
call esi
test eax, eax
jne 0x414efb
mov edx, dword [ebp - 0x1024]
push edx
call ebx
lea eax, [ebp - 0x1014]
push eax
lea ecx, [ebp - 0x808]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x414f35
mov eax, dword [ebp - 0x1014]
lea edx, [ebp - 0x100c]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [ebp - 0x1014]
push ecx
call ebx
lea edx, [ebp - 0x1020]
push edx
lea eax, [ebp - 0x808]
push eax
push 0x80000001
call esi
test eax, eax
jne 0x414f57
mov ecx, dword [ebp - 0x1020]
push ecx
call ebx
lea edx, [ebp - 0x101c]
push edx
lea eax, [ebp - 0x808]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x414f91
mov edx, dword [ebp - 0x101c]
lea ecx, [ebp - 0x100c]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x101c]
push eax
call ebx
inc edi
mov ecx, dword [edi*4 + 0x4af368]
cmp word [ecx], 0
lea esi, [edi*4 + 0x4af368]
jne 0x414e50
mov eax, dword [ebp - 0x1018]
inc eax
mov edx, dword [eax*4 + 0x4af358]
cmp word [edx], 0
mov dword [ebp - 0x1018], eax
lea eax, [eax*4 + 0x4af358]
mov dword [ebp - 0x1010], eax
jne 0x414e33
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.004171f3
mov esp, ebp
pop ebp
ret
Function at 0x415020
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x181c
call fcn.00429400
mov eax, dword [0x4ae7ec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push edi
xor edi, edi
mov dword [ebp - 0x1818], edi
mov eax, str.CLSID11111111_2222_3333_4444_555555555555InprocServer32
lea ecx, [ecx]
lea ecx, [edi + 0x48db74]
xor edx, edx
test ecx, ecx
je 0x415099
cmp word [ecx], dx
je 0x415089
lea esi, [ebp - 0x100c]
sub esi, ecx
lea esp, [esp]
cmp edx, 0x400
jae 0x415089
mov bx, word [ecx]
mov word [esi + ecx], bx
add ecx, 2
inc edx
cmp word [ecx], 0
jne 0x415070
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
mov word [ebp + edx*2 - 0x100c], cx
xor ecx, ecx
test eax, eax
je 0x4150d3
cmp word [eax], cx
je 0x4150c9
lea edx, [ebp - 0x1810]
sub edx, eax
lea esp, [esp]
cmp ecx, 0x400
jae 0x4150c9
mov si, word [eax]
mov word [edx + eax], si
add eax, 2
inc ecx
cmp word [eax], 0
jne 0x4150b0
xor edx, edx
mov word [ebp + ecx*2 - 0x1810], dx
lea eax, [edi + 0x48d36e]
xor ecx, ecx
test eax, eax
je 0x415113
cmp word [eax], cx
je 0x415109
lea edx, [ebp - 0x808]
sub edx, eax
lea esp, [esp]
cmp ecx, 0x400
jae 0x415109
mov si, word [eax]
mov word [edx + eax], si
add eax, 2
inc ecx
cmp word [eax], 0
jne 0x4150f0
xor eax, eax
mov word [ebp + ecx*2 - 0x808], ax
mov esi, dword [edi + 0x48cb68]
lea ecx, [ebp - 0x181c]
push ecx
lea edx, [ebp - 0x1810]
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x41513b
mov eax, dword [ebp - 0x181c]
push eax
call ebx
lea ecx, [ebp - 0x1814]
push ecx
push 2
push 0
lea edx, [ebp - 0x1810]
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41519b
lea eax, [ebp - 0x100c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x415161
sub eax, edx
sar eax, 1
add eax, eax
push eax
mov eax, dword [ebp - 0x1814]
lea ecx, [ebp - 0x100c]
push ecx
push 1
push 0
lea edx, [ebp - 0x808]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0x1814]
push ecx
call ebx
mov edi, dword [ebp - 0x1818]
inc edi
mov dword [ebp - 0x1818], edi
imul edi, edi, 0x1810
cmp word [edi + str.CLSID11111111_2222_3333_4444_555555555555InprocServer32], 0
lea eax, [edi + str.CLSID11111111_2222_3333_4444_555555555555InprocServer32]
jne 0x415050
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.004171f3
mov esp, ebp
pop ebp
ret
Function at 0x415330
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movzx ecx, word [ebp + 8]
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
push esi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
push ebx
push eax
mov dword [ebp + 8], eax
call fcn.00422e00
mov edx, dword [ebp + 0x10]
add esp, 0xc
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4153cb
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
push 0
lea eax, [ebp - 4]
push eax
push esi
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x415860
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
push edi
push ebx
push ebx
push ebx
push ebx
push 0x434ed4
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.WININET.dll_InternetOpenW]
mov edi, eax
cmp edi, ebx
je 0x4158e3
mov eax, dword [str.1234567890]
push esi
push ebx
push ebx
push 3
push eax
push eax
mov eax, dword [str.http:__www.sample.com]
push 0x50
push eax
push edi
call dword [sym.imp.WININET.dll_InternetConnectW]
mov esi, eax
cmp esi, ebx
mov ebx, dword [sym.imp.WININET.dll_InternetCloseHandle]
je 0x4158df
mov eax, dword [str.1234567890]
lea ecx, [ebp - 4]
push ecx
push 0x400000
lea edx, [ebp - 0xc]
push edx
push eax
push eax
mov eax, dword [str.http:__www.sample.com]
push eax
push 0x4a7c60
push esi
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
test eax, eax
je 0x4158dc
push eax
call ebx
push esi
call ebx
push edi
call ebx
pop esi
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x415950
Capabilities:
Create process on windows
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
xor eax, eax
xor esi, esi
push 0x40
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x50]
push esi
push eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x54], esi
call fcn.004219f0
mov ecx, dword [str.C:Sample.txt]
mov edx, dword [str.http:__www.sample.com_sample]
add esp, 0xc
push esi
push esi
push ecx
push edx
push esi
call dword [sym.imp.urlmon.dll_URLDownloadToFileW]
lea ecx, [ebp - 0x10]
push ecx
mov ecx, dword [str.C:Program_FilesInternet_Exploreriexplore.exe]
lea edx, [ebp - 0x54]
push edx
push esi
push esi
push esi
push esi
xor eax, eax
push esi
mov word [ebp - 0x24], ax
mov eax, dword [str.iexplore.exe_www.sample.com]
push esi
push eax
push ecx
mov dword [ebp - 0x54], 0x44
mov dword [ebp - 0x28], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4159db
mov edx, dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [ebp - 0xc]
push eax
call esi
call fcn.00415860
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x416050
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x4ae7ec]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x1fc
mov esi, ecx
push eax
lea ecx, [ebp - 0x202]
push ecx
mov dword [ebp - 0x208], 0
mov word [ebp - 0x204], ax
call fcn.004219f0
add esp, 0xc
push 0
push 0x80
push 2
push 0
push 1
push 0x10000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4160e8
push 0
lea edx, [ebp - 0x208]
push edx
push 0x1d
push str.qwertyuiopasdfghjkl1234567890
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0x208]
push eax
push 0xff
lea ecx, [ebp - 0x204]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004171f3
mov esp, ebp
pop ebp
ret

Function at 0x416100
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4ae7ec]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x1fc
mov esi, ecx
push eax
lea ecx, [ebp - 0x202]
push ecx
mov dword [ebp - 0x20c], 0
mov dword [ebp - 0x208], 0
mov word [ebp - 0x204], ax
call fcn.004219f0
add esp, 0xc
push 0
push 0x80
push 3
push 0
push 1
push 0x10000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4161a9
push 0
lea edx, [ebp - 0x208]
push edx
push 0xff
lea eax, [ebp - 0x204]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [ebp - 0x208]
push 0
lea ecx, [ebp - 0x20c]
push ecx
push edx
lea eax, [ebp - 0x204]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004171f3
mov esp, ebp
pop ebp
ret
Function at 0x416b70
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 8
call fcn.0041b588
mov esi, eax
add esp, 4
test esi, esi
je 0x416be3
mov eax, dword [ebp + 8]
mov dword [esi], eax
test edi, edi
je 0x416bac
push edi
call fcn.0041b588
add esp, 4
mov dword [esi + 4], eax
test eax, eax
je 0x416be3
mov ecx, dword [ebp + 0xc]
push edi
push ecx
push eax
call fcn.00422e00
add esp, 0xc
push 0x4b24d4
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea edx, [ebp - 4]
push edx
push 0
push esi
push 0x416b20
push 0
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x416bed
push 0x4b24d4
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4171f3
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4ae7ec]
jne 0x4171fd
repz ret
jmp fcn.0041b608

Function at 0x417aed
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
jne 0x417b15
call fcn.0041dceb
and dword [eax], 0
call fcn.0041dcd8
mov dword [eax], 0x16
call fcn.0041dc86
or eax, 0xffffffff
pop ebp
ret
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x417b32
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0041dcfe
pop ecx
jmp 0x417b10
test byte [ebp + 0xc], 0x80
je 0x417b3d
and eax, 0xfffffffe
jmp 0x417b40
or eax, 1
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x417b23
xor eax, eax
pop ebp
ret

Function at 0x41867e
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
jne 0x4186a6
call fcn.0041dceb
and dword [eax], 0
call fcn.0041dcd8
mov dword [eax], 0x16
call fcn.0041dc86
or eax, 0xffffffff
pop ebp
ret
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4186c3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0041dcfe
pop ecx
jmp 0x4186a1
test byte [ebp + 0xc], 0x80
je 0x4186ce
and eax, 0xfffffffe
jmp 0x4186d1
or eax, 1
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x4186b4
xor eax, eax
pop ebp
ret