joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43e5d0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x238
push esi
mov esi, ecx
mov ecx, dword [0x4c8410]
push edi
call fcn.004131c0
test esi, esi
je 0x43e749
cmp word [esi], 0
je 0x43e749
push 0x104
lea eax, [esp + 0x34]
push esi
push eax
call fcn.00490864
add esp, 0xc
xor ecx, ecx
lea eax, [esp + 0x30]
mov word [esp + 0x238], cx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x43e621
sub eax, edx
sar eax, 1
cmp word [esp + eax*2 + 0x2e], 0x5c
je 0x43e658
lea edx, [eax + 1]
cmp edx, 0x105
jae 0x43e749
mov ecx, 0x5c
xor edx, edx
mov word [esp + eax*2 + 0x30], cx
mov word [esp + eax*2 + 0x32], dx
test byte [0x4cbe54], 1
jne 0x43e686
or dword [0x4cbe54], 1
push str.GetDiskFreeSpaceExW
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4cbe50], eax
jmp 0x43e68b
mov eax, dword [0x4cbe50]
test eax, eax
je 0x43e6d7
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x24]
push edx
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x3c]
push edx
call eax
test eax, eax
je 0x43e749
test bl, bl
je 0x43e6c4
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
shrd esi, eax, 0x14
shr eax, 0x14
mov edi, eax
jmp 0x43e717
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
shrd esi, eax, 0x14
shr eax, 0x14
mov edi, eax
jmp 0x43e717
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x43e749
mov eax, dword [esp + 0x14]
test bl, bl
jne 0x43e706
mov eax, dword [esp + 0x10]
imul eax, dword [esp + 0xc]
imul eax, dword [esp + 8]
shr eax, 0x14
mov esi, eax
xor edi, edi
mov edx, dword [0x4c8cc4]
push 1
push 0
push 0xffffffffffffffff
push 0x4a1910
push edx
call fcn.004774a0
mov eax, dword [0x4c8410]
push 0x18
push edi
push esi
call fcn.004010e0
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [0x4c48ec]
cmp byte [eax + 0x108], 0
jne 0x43e776
mov ecx, dword [0x4c8cc4]
push 1
push 0
push 0xffffffffffffffff
push 0x4a432c
push ecx
call fcn.004774a0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp + 8]
push 0x4ac0f0
push 0
push 0x4a432c
call fcn.0042dea0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x453c50
Capabilities:
Check if file exists
Copy file
Get file attributes
Move file

Disassembly:
sub esp, 0x43c
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0x2c]
push ecx
push 0x104
push edx
call esi
lea eax, [esp + 0x28]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x453c76
sub eax, edx
sar eax, 1
je 0x453c98
cmp word [esp + eax*2 + 0x26], 0x5c
lea eax, [esp + eax*2 + 0x26]
jne 0x453c98
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [esp + 0x444]
lea edx, [esp + 4]
push edx
lea eax, [esp + 0x238]
push eax
push 0x104
push ecx
call esi
lea eax, [esp + 0x234]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x453cc0
sub eax, edx
sar eax, 1
je 0x453ce8
cmp word [esp + eax*2 + 0x232], 0x5c
lea eax, [esp + eax*2 + 0x232]
jne 0x453ce8
xor edx, edx
mov word [eax], dx
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [esp + 0x28]
push eax
call esi
cmp eax, 0xffffffff
je 0x453d1b
test al, 0x10
je 0x453d1b
lea ecx, [esp + 0x234]
push ecx
call esi
cmp eax, 0xffffffff
je 0x453d25
test al, 0x10
je 0x453d25
cmp byte [esp + 0x448], 0
jne 0x453d41
xor al, al
pop esi
add esp, 0x43c
ret
lea edx, [esp + 0x234]
push edx
call fcn.004547a0
add esp, 4
test al, al
jne 0x453d41
pop esi
add esp, 0x43c
ret
lea eax, [esp + 0x28]
add eax, 0xfffffffe
jmp 0x453d50
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x453d50
mov ecx, dword [str..]
mov edx, dword [0x4ac084]
mov dword [eax], ecx
mov cx, word [0x4ac088]
mov dword [eax + 4], edx
mov word [eax + 8], cx
lea eax, [esp + 0x28]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x453d80
sub eax, edx
sar eax, 1
xor edx, edx
mov word [esp + eax*2 + 0x2a], dx
lea eax, [esp + 0x234]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x453da0
sub eax, edx
sar eax, 1
xor ecx, ecx
mov word [esp + eax*2 + 0x236], cx
xor eax, eax
mov dword [esp + 0x10], eax
lea edx, [esp + 0x28]
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], edx
mov dword [esp + 8], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov word [esp + 0x24], ax
lea edx, [esp + 8]
lea eax, [esp + 0x234]
mov ecx, 0x614
push edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], 2
mov word [esp + 0x1c], cx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
neg eax
sbb eax, eax
inc eax
pop esi
add esp, 0x43c
ret
Function at 0x470d50
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x20214
call fcn.00499360
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
je 0x470d6a
cmp word [esi], 0
jne 0x470d6f
mov esi, str.ERROR
xor eax, eax
push 0x1fffc
push eax
lea ecx, [esp + 0x226]
push ecx
mov word [esp + 0x228], ax
call fcn.00496a40
add esp, 0xc
lea eax, [esp + 0xc]
push eax
xor edx, edx
lea ecx, [esp + 0x14]
push ecx
mov word [esp + 0x10], dx
mov edx, dword [esp + 0x20228]
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp word [ebx], 0
je 0x470e02
cmp word [edi], 0
jne 0x470dc3
lea edi, [esp + 8]
lea eax, [esp + 0x10]
push eax
push 0xffff
lea ecx, [esp + 0x224]
push ecx
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, dword [0x4c8410]
push 1
push 0
push 0xffffffffffffffff
lea edx, [esp + 0x228]
push edx
push eax
call fcn.004774a0
pop edi
pop esi
add esp, 0x20214
ret 4
cmp word [edi], 0
je 0x470e23
lea edx, [esp + 0x10]
push edx
push 0xffff
lea eax, [esp + 0x224]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
jmp 0x470e3b
lea ecx, [esp + 0x10]
push ecx
push 0xffff
lea edx, [esp + 0x224]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
test eax, eax
je 0x470dde
lea eax, [esp + 0x21c]
cmp word [eax], 0
jne 0x470e5b
cmp word [eax + 2], 0
je 0x470dde
mov ecx, 0xa
mov word [eax], cx
add eax, 2
jmp 0x470e46
Function at 0x494206
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4c3d70]
jne 0x494210
repz ret
jmp fcn.00498d8f

Function at 0x497120
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4c3d70]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004915f2
and dword [ebp - 0x14], 0
cmp dword [0x4c6c1c], 0
mov dword [ebp - 0x18], eax
jne 0x4971d3
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x49727b
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4a0fd0
push ebx
call edi
test eax, eax
je 0x49727b
mov esi, dword [fcn.0048d880]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4c6c1c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4c6c20], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4c6c24], eax
call edi
push eax
call esi
mov dword [0x4c6c2c], eax
test eax, eax
je 0x4971d3
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4c6c28], eax
mov eax, dword [0x4c6c28]
mov ecx, dword [ebp - 0x18]
mov esi, dword [fcn.0048d884]
cmp eax, ecx
je 0x49722c
cmp dword [0x4c6c2c], ecx
je 0x49722c
push eax
call esi
push dword [0x4c6c2c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x49722c
test ebx, ebx
je 0x49722c
call edi
test eax, eax
je 0x497223
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x497223
test byte [ebp - 8], 1
jne 0x49722c
or dword [ebp + 0x10], 0x200000
jmp 0x49725f
mov eax, dword [0x4c6c20]
cmp eax, dword [ebp - 0x18]
je 0x49725f
push eax
call esi
test eax, eax
je 0x49725f
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x49725f
mov eax, dword [0x4c6c24]
cmp eax, dword [ebp - 0x18]
je 0x49725f
push eax
call esi
test eax, eax
je 0x49725f
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4c6c1c]
call esi
test eax, eax
je 0x49727b
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x49727d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00494206
leave
ret
Function at 0x5fcec0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1a8000]
mov dword [edi + 0x1d909c], 0xda775c5
push edi
or ebp, 0xffffffff
jmp 0x5fceea
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5fcef1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5fcee0
mov eax, 1
add ebx, ebx
jne 0x5fcf03
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5fcf14
jne 0x5fcf24
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5fcf24
dec eax
add ebx, ebx
jne 0x5fcf20
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5fcef8
xor ecx, ecx
sub eax, 3
jb 0x5fcf3c
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5fcfae
sar eax, 1
mov ebp, eax
jmp 0x5fcf47
add ebx, ebx
jne 0x5fcf47
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x5fcf54
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x5fcf78
inc ecx
add ebx, ebx
jne 0x5fcf64
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x5fcf59
jne 0x5fcf75
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5fcf59
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5fcf98
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5fcf89
jmp 0x5fcee6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5fcf98
add edi, ecx
jmp 0x5fcee6
pop esi
mov edi, esi
mov ecx, 0x5946
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5fcfb6
cmp byte [edi], 0x23
jne 0x5fcfb6
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x5fcfbb
lea edi, [esi + 0x1f9000]
mov eax, dword [edi]
or eax, eax
je 0x5fd033
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1fda88]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1fdbb4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5fcfe8
mov ecx, edi
jns 0x5fd017
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1fdbb8]
or eax, eax
je 0x5fd02d
mov dword [ebx], eax
add ebx, 4
jmp 0x5fd005
call dword [esi + 0x1fdbbc]
popal
jmp section.UPX0
Function at 0x401006
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x438004]
jne 0x401010
repz ret
jmp fcn.004013fc

Function at 0x40703b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004028fd
and dword [ebp - 4], 0
cmp dword [0x43c798], 0
mov ebx, eax
jne 0x4070ec
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40719d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40719d
push eax
call fcn.0040288b
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43c798], eax
call esi
push eax
call fcn.0040288b
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43c79c], eax
call esi
push eax
call fcn.0040288b
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43c7a0], eax
call esi
push eax
call fcn.0040288b
pop ecx
mov dword [0x43c7a8], eax
test eax, eax
je 0x4070ec
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040288b
pop ecx
mov dword [0x43c7a4], eax
mov eax, dword [0x43c7a4]
cmp eax, ebx
je 0x407144
cmp dword [0x43c7a8], ebx
je 0x407144
push eax
call fcn.00402906
push dword [0x43c7a8]
mov esi, eax
call fcn.00402906
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x407144
test edi, edi
je 0x407144
call esi
test eax, eax
je 0x40713b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40713b
test byte [ebp - 0xc], 1
jne 0x407144
or dword [ebp + 0x10], 0x200000
jmp 0x40717d
mov eax, dword [0x43c79c]
cmp eax, ebx
je 0x40717d
push eax
call fcn.00402906
pop ecx
test eax, eax
je 0x40717d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40717d
mov eax, dword [0x43c7a0]
cmp eax, ebx
je 0x40717d
push eax
call fcn.00402906
pop ecx
test eax, eax
je 0x40717d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43c798]
call fcn.00402906
pop ecx
test eax, eax
je 0x40719d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40719f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4313d0
Capabilities:
Get hostname

Disassembly:
sub esp, 0x414
mov eax, dword [0x438004]
xor eax, esp
mov dword [esp + 0x410], eax
push ebp
mov ebp, dword [esp + 0x41c]
push edi
cmp ebx, 0x182
jne 0x43140f
push 0
push 0
push 0
push str.sukeje
push str.nakefajijihi
push 0
call dword [sym.imp.KERNEL32.dll_UpdateResourceA]
jmp 0x431439
cmp ebx, 0x19f
jne 0x431439
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 0
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
xor edi, edi
test ebx, ebx
jle 0x4314b3
push esi
lea esi, [esp + 0x14]
mov dword [esp + 0x10], 5
mov dword [esp + 0x14], 0
call fcn.004313c0
mov eax, dword [esp + 0x14]
add eax, 0x46
mov dword [esp + 0x10], eax
sub dword [esp + 0x10], 0x46
movsx eax, byte [edi + ebp]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x10]
xor dword [esp + 0xc], eax
mov cl, byte [esp + 0xc]
mov byte [edi + ebp], cl
cmp ebx, 0xf
jne 0x4314ad
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoA]
inc edi
cmp edi, ebx
jl 0x431440
pop esi
pop edi
pop ebp
cmp ebx, 0x2d
jne 0x4314ce
mov dword [0x2b3a9c0], 0xa62e7790
mov dword [0x2b3a9c4], 0xffffffff
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.00401006
add esp, 0x414
ret
Function at 0x401308
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x40500c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4013a0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x401380
xor eax, eax
push ebp
push 0x401379
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4013bc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x401380
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x40500c]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x40500c], ax
mov esp, ebp
pop ebp
ret

Function at 0x401a58
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x406034], 0
je 0x401ab9
cmp word [0x406208], 0xd7b2
jne 0x401a81
cmp dword [0x406210], 0
jbe 0x401a81
mov eax, 0x406204
call dword [0x406220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x405040
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x401ae0
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x405018], 0
jne 0x401ad5
push 0
push 0x405060
push 0x405040
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x40244c
Capabilities:
Enumerate processes

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffed8
mov ebx, edx
mov esi, eax
xor edi, edi
push 0
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov ebp, eax
mov dword [esp], 0x128
push esp
push ebp
call sub.kernel32.dll_Process32First
jmp 0x402495
lea eax, [esp + 0x24]
push eax
push esi
call sub.kernel32.dll_lstrcmpiA
test eax, eax
jne 0x40248e
mov edi, dword [esp + 8]
test bl, bl
je 0x40249f
push esp
push ebp
call sub.kernel32.dll_Process32Next
cmp eax, 1
sbb eax, eax
inc eax
cmp al, 1
je 0x402477
push ebp
call sub.kernel32.dll_CloseHandle
mov eax, edi
add esp, 0x128
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4024b4
Capabilities:
Enumerate process modules

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffddc
mov edi, ecx
mov ebx, edx
mov esi, eax
xor ebp, ebp
test edi, edi
je 0x4024d5
push 0x104
push edi
call sub.kernel32.dll_RtlZeroMemory
push esi
push 8
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [esp], 0x224
push esp
push esi
call sub.kernel32.dll_Module32First
cmp eax, 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x402533
test ebx, ebx
je 0x40250a
lea eax, [esp + 0x20]
push eax
push ebx
call sub.kernel32.dll_lstrcmpiA
test eax, eax
jne 0x402522
test edi, edi
je 0x40251c
lea eax, [esp + 0x120]
push eax
push edi
call sub.kernel32.dll_lstrcpyA
mov ebp, dword [esp + 0x14]
jmp 0x402533
push esp
push esi
call sub.kernel32.dll_Module32Next
cmp eax, 1
sbb eax, eax
inc eax
cmp al, 1
je 0x4024f7
push esi
call sub.kernel32.dll_CloseHandle
mov eax, ebp
add esp, 0x224
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x402604
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebx
push esi
mov esi, eax
xor ebx, ebx
push 0x80
push esi
call sub.kernel32.dll_SetFileAttributesA
push esi
call sub.kernel32.dll_DeleteFileA
mov eax, esi
call fcn.004025d4
test al, al
jne 0x402628
mov bl, 1
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x402630
Capabilities:
Create process on windows
Get common file path
Self delete
Set file attributes

Disassembly:
push ebx
push esi
add esp, 0xfffff9f8
mov esi, eax
xor ebx, ebx
mov eax, esi
call fcn.004025d4
cmp al, 1
jne 0x40279b
lea eax, [esp + 0x104]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
push 0x4027a8
lea eax, [esp + 0x108]
push eax
call sub.kernel32.dll_lstrcatA
call sub.kernel32.dll_GetTickCount
mov dword [esp], eax
push esp
push 0x4027b0
lea eax, [esp + 0xc]
push eax
call sub.user32.dll_wvsprintfA
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x108]
push eax
call sub.kernel32.dll_lstrcatA
push 0x4027b4
lea eax, [esp + 0x108]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [esp + 0x104]
call fcn.00402604
cmp al, 1
jne 0x40279b
push 0x4027bc
lea eax, [esp + 0x20c]
push eax
call sub.kernel32.dll_lstrcpyA
push 0x4027c8
lea eax, [esp + 0x20c]
push eax
call sub.kernel32.dll_lstrcatA
push 0x4027d0
lea eax, [esp + 0x20c]
push eax
call sub.kernel32.dll_lstrcatA
push esi
lea eax, [esp + 0x20c]
push eax
call sub.kernel32.dll_lstrcatA
push 0x4027d8
lea eax, [esp + 0x20c]
push eax
call sub.kernel32.dll_lstrcatA
push 0x4027dc
lea eax, [esp + 0x20c]
push eax
call sub.kernel32.dll_lstrcatA
push esi
lea eax, [esp + 0x20c]
push eax
call sub.kernel32.dll_lstrcatA
push 0x4027e8
lea eax, [esp + 0x20c]
push eax
call sub.kernel32.dll_lstrcatA
push 0x4027f8
lea eax, [esp + 0x20c]
push eax
call sub.kernel32.dll_lstrcatA
push 0x80
push esi
call sub.kernel32.dll_SetFileAttributesA
push 0
push 1
lea eax, [esp + 0x210]
push eax
call sub.kernel32.dll_lstrlenA
mov ecx, eax
lea edx, [esp + 0x210]
lea eax, [esp + 0x10c]
call fcn.00402864
push 0
lea eax, [esp + 0x108]
push eax
call sub.kernel32.dll_WinExec
mov bl, 1
mov eax, ebx
add esp, 0x608
pop esi
pop ebx
ret

Function at 0x40282c
Capabilities:
Get file size

Disassembly:
push ebx
push esi
xor esi, esi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call sub.kernel32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x402859
push 0
push ebx
call sub.kernel32.dll_GetFileSize
mov esi, eax
push ebx
call sub.kernel32.dll_CloseHandle
mov eax, esi
pop esi
pop ebx
ret
Function at 0x402864
Capabilities:
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
push 0x80
push ebx
call sub.kernel32.dll_SetFileAttributesA
push 0
push 0x80
push 4
push 0
push 2
push 0x40000000
push ebx
call sub.kernel32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4028d2
cmp byte [ebp + 8], 1
jne 0x4028b6
push 2
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call sub.kernel32.dll_SetFilePointer
jmp 0x4028c4
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 4]
push eax
push edi
push esi
push ebx
call sub.kernel32.dll_WriteFile_1
push ebx
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x4028e4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
mov dword [ebp - 4], edx
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call sub.kernel32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x402945
cmp byte [ebp + 8], 1
jne 0x402929
push 2
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call sub.kernel32.dll_SetFilePointer
jmp 0x402937
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 4]
push eax
push edi
push esi
push ebx
call sub.kernel32.dll_ReadFile
push ebx
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x402958
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 8]
push 0x80
push ebx
call sub.kernel32.dll_SetFileAttributesA
push ebx
mov eax, dword [ebp - 4]
push eax
push edi
push esi
call sub.kernel32.dll_WritePrivateProfileStringA
cmp eax, 1
sbb eax, eax
inc eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 4

Function at 0x4029d8
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 4]
push ecx
push edx
push eax
call sub.advapi32.dll_RegCreateKeyA
push ebx
call sub.kernel32.dll_lstrlenA
push eax
push ebx
push 1
push 0
push esi
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret 4

Function at 0x402c40
Capabilities:
Resolve dns

Disassembly:
push ebx
xor ebx, ebx
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x402c54
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ebx, dword [eax]
mov eax, ebx
pop ebx
ret