joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46924c
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Print debug messages
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004054d0
xor eax, eax
push ebp
push 0x46932e
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebp - 0x18], 2
push ebx
call sub.wsock32.dll_htons
mov word [ebp - 0x16], ax
mov eax, dword [ebp - 4]
call fcn.004054e0
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x14], eax
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4692ab
xor ebx, ebx
jmp 0x469310
mov dword [ebp - 8], 0x1388
push 4
lea eax, [ebp - 8]
push eax
push 0x1005
push 0xffff
push ebx
call sub.wsock32.dll_setsockopt
push 4
lea eax, [ebp - 8]
push eax
push 0x1006
push 0xffff
push ebx
call sub.wsock32.dll_setsockopt
push 0x10
lea eax, [ebp - 0x18]
push eax
push ebx
call sub.wsock32.dll_connect
mov esi, eax
test esi, esi
je 0x469310
lea edx, [ebp - 0x1c]
mov eax, esi
call fcn.0040ca18
mov eax, dword [ebp - 0x1c]
call fcn.004054e0
push eax
call sub.kernel32.dll_OutputDebugStringA
push ebx
call sub.wsock32.dll_closesocket
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x469335
lea eax, [ebp - 0x1c]
call fcn.00405050
lea eax, [ebp - 4]
call fcn.00405050
ret
Function at 0x46944c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x410], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004054d0
xor eax, eax
push ebp
push 0x4695b1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x40c]
xor ecx, ecx
mov edx, 0x400
call fcn.00403970
lea eax, [ebp - 0x40c]
mov edx, 0x4695c8
call fcn.0040a180
push 0
lea eax, [ebp - 0x40c]
call fcn.0040a0c0
push eax
lea eax, [ebp - 0x40c]
push eax
push ebx
call sub.wsock32.dll_send
lea edx, [ebp - 8]
mov eax, ebx
call fcn.00469238
mov eax, dword [ebp - 8]
cmp byte [eax], 0x32
je 0x4694d6
xor esi, esi
jmp 0x46958b
mov dl, 1
mov eax, dword [0x416ec8]
call fcn.00404120
mov ebx, eax
mov dl, 0x2c
mov eax, ebx
call fcn.0041a8b8
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0041a6a0
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x14]
cmp eax, 2
jg 0x46950e
xor esi, esi
mov eax, ebx
call fcn.00404150
jmp 0x46958b
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x14]
mov edx, eax
dec edx
lea ecx, [ebp - 0xc]
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 0xc]
mov eax, 0x4695d8
call fcn.0040562c
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00405548
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x14]
mov edx, eax
sub edx, 2
lea ecx, [ebp - 0x410]
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x410]
call fcn.004099b0
mov esi, eax
shl esi, 8
mov eax, dword [ebp - 0xc]
call fcn.004099b0
add esi, eax
mov eax, esi
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.0046924c
mov esi, eax
mov eax, ebx
call fcn.00404150
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4695b8
lea eax, [ebp - 0x410]
call fcn.00405050
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405074
ret
Function at 0x46993c
Capabilities:
Print debug messages
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7e8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x818], ebx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004054d0
mov eax, dword [ebp + 8]
call fcn.004054d0
xor eax, eax
push ebp
push 0x469b65
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, dword [ebp + 8]
call fcn.00409d40
test al, al
je 0x46999b
push 2
mov ecx, dword [ebp + 8]
mov dl, 1
mov eax, dword [0x4170c8]
call fcn.0041b540
mov dword [ebp - 0x14], eax
jmp 0x4699b2
push 0xffff
mov ecx, dword [ebp + 8]
mov dl, 1
mov eax, dword [0x4170c8]
call fcn.0041b540
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x469b35
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x469b78
call sub.kernel32.dll_OutputDebugStringA
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx]
mov esi, eax
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0046968c
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x818]
mov eax, dword [ebp - 0x10]
call fcn.00409874
mov eax, dword [ebp - 0x818]
call fcn.004054e0
push eax
call sub.kernel32.dll_OutputDebugStringA
cmp dword [ebp - 0x10], 0
jle 0x469aa4
cmp esi, dword [ebp - 0x10]
jl 0x469a1c
mov byte [ebp - 9], 1
call fcn.00404a70
jmp 0x469b3c
test esi, esi
jle 0x469a37
push 0
push 0
mov dl, 2
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov edx, esi
mov eax, ebx
call fcn.004697c8
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00469884
cmp esi, dword [ebp - 0x10]
jge 0x469a95
lea eax, [ebp - 0x814]
xor ecx, ecx
mov edx, 0x800
call fcn.00403970
push 0
push 0x800
lea eax, [ebp - 0x814]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wsock32.dll_recv
mov ebx, eax
test ebx, ebx
jle 0x469a87
lea edx, [ebp - 0x814]
mov ecx, ebx
mov eax, dword [ebp - 0x14]
call fcn.0041b2f0
add esi, ebx
cmp byte [0x4818e4], 1
je 0x469a95
cmp esi, dword [ebp - 0x10]
jl 0x469a46
cmp esi, dword [ebp - 0x10]
jne 0x469b1f
mov byte [ebp - 9], 1
jmp 0x469b1f
cmp dword [ebp - 0x10], 0xfffffffe
jne 0x469b1f
test esi, esi
jle 0x469ac5
push 0
push 0
mov dl, 2
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov edx, esi
mov eax, ebx
call fcn.004697c8
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00469884
lea eax, [ebp - 0x814]
xor ecx, ecx
mov edx, 0x800
call fcn.00403970
push 0
push 0x800
lea eax, [ebp - 0x814]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wsock32.dll_recv
mov ebx, eax
test ebx, ebx
jle 0x469b0e
lea edx, [ebp - 0x814]
mov ecx, ebx
mov eax, dword [ebp - 0x14]
call fcn.0041b2f0
cmp byte [0x4818e4], 1
je 0x469b1b
test ebx, ebx
jg 0x469acf
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x469b3c
mov eax, dword [ebp - 0x14]
call fcn.00404150
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x469b6c
lea eax, [ebp - 0x818]
call fcn.00405050
lea eax, [ebp - 4]
call fcn.00405050
lea eax, [ebp + 8]
call fcn.00405050
ret
Function at 0x46a1f0
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 8], ecx
test dl, dl
je 0x46a209
add esp, 0xfffffff0
call fcn.00404474
mov byte [ebp - 1], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x46a2c7
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, ebx
call fcn.00404120
mov dword [ebx + 4], 0xffffffff
mov dword [ebx + 8], 0xffffffff
mov byte [ebx + 0xc], 0
cmp dword [ebx + 4], 0xffffffff
jne 0x46a24b
push ebx
push 0x46a458
call fcn.004209c0
mov dword [ebx + 4], eax
mov byte [ebx + 0xc], 0
push 0
push 2
push 2
call sub.ws2_32.dll_socket_1
mov esi, eax
mov dword [ebx + 8], esi
cmp esi, 0xffffffff
jne 0x46a27a
mov ecx, 0x46a2f8
mov dl, 1
mov eax, dword [0x408454]
call fcn.0040d238
call fcn.004049c4
push 1
push 0x1a5a
mov eax, dword [ebx + 4]
push eax
mov eax, dword [ebx + 8]
push eax
call sub.ws2_32.dll_WSAAsyncSelect
test eax, eax
je 0x46a2b1
cmp word [ebx + 0x1a], 0
je 0x46a2b1
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 8]
call fcn.0040ca18
mov ecx, dword [ebp - 8]
mov edx, ebx
mov eax, dword [ebx + 0x1c]
call dword [ebx + 0x18]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46a2ce
lea eax, [ebp - 8]
call fcn.00405050
ret

Function at 0x46a33c
Capabilities:
Print debug messages
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff9a0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x660], edx
mov dword [ebp - 0x65c], edx
mov dword [ebp - 0x658], edx
mov esi, eax
xor eax, eax
push ebp
push 0x46a44b
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x640
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x654]
push eax
push 0
push ebx
lea eax, [ebp - 0x644]
push eax
mov eax, dword [esi + 8]
push eax
call sub.ws2_32.dll_recvfrom
mov ebx, eax
test ebx, ebx
jl 0x46a3e3
cmp word [esi + 0x12], 0
je 0x46a42d
push dword [ebp - 0x650]
call sub.ws2_32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 0x658]
call fcn.00405248
mov eax, dword [ebp - 0x658]
push eax
movzx eax, word [ebp - 0x652]
push eax
call sub.ws2_32.dll_ntohs
push eax
lea edx, [ebp - 0x644]
mov ecx, ebx
mov eax, dword [esi + 0x14]
call dword [esi + 0x10]
jmp 0x46a42d
call sub.kernel32.dll_GetLastError_1
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x65c]
call fcn.00409960
mov eax, dword [ebp - 0x65c]
call fcn.004054e0
push eax
call sub.kernel32.dll_OutputDebugStringA
cmp word [esi + 0x1a], 0
je 0x46a42d
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x660]
call fcn.0040ca18
mov ecx, dword [ebp - 0x660]
mov edx, esi
mov eax, dword [esi + 0x1c]
call dword [esi + 0x18]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46a452
lea eax, [ebp - 0x660]
mov edx, 3
call fcn.00405074
ret
Function at 0x46a4cc
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp + 0xc]
call fcn.004054d0
xor eax, eax
push ebp
push 0x46a53f
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebp - 0x10], 2
movzx eax, word [ebp + 8]
push eax
call sub.ws2_32.dll_htons_1
mov word [ebp - 0xe], ax
mov eax, dword [ebp + 0xc]
call fcn.004054e0
push eax
call sub.ws2_32.dll_inet_addr_1
mov dword [ebp - 0xc], eax
push 0x10
lea eax, [ebp - 0x10]
push eax
push 0
push edi
push esi
mov eax, dword [ebx + 8]
push eax
call sub.ws2_32.dll_sendto
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46a546
lea eax, [ebp + 0xc]
call fcn.00405050
ret
Function at 0x46e490
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x407e60]
call fcn.00405a94
xor eax, eax
push ebp
push 0x46e631
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x48195c], 0
jne 0x46e4eb
mov ecx, dword [0x482278]
mov dl, 1
mov eax, dword [0x408454]
call fcn.0040d2f4
call fcn.004049c4
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x10
call fcn.00403970
mov eax, ebx
call fcn.00405964
mov dword [ebp - 0x24], eax
mov esi, 0x46e640
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x38]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.00406a2c
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
call fcn.00405974
test eax, eax
jle 0x46e5d4
mov dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x46e5c0
lea eax, [ebp - 0x4c]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.004052c0
mov edi, dword [ebp - 0x4c]
test edi, edi
je 0x46e566
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x50]
mov edx, ebx
call fcn.004052d8
mov esi, dword [ebp - 0x50]
test esi, esi
je 0x46e57c
sub esi, 4
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x54]
mov edx, ebx
call fcn.004052d8
mov eax, dword [ebp - 0x54]
call fcn.004054e0
push eax
push edi
lea eax, [ebp - 0x58]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.004052c0
mov eax, dword [ebp - 0x58]
call fcn.004054e0
push eax
push 1
push 0x400
call sub.kernel32.dll_CompareStringA_1
sub eax, 2
test eax, eax
sete al
jmp 0x46e5c2
xor eax, eax
test al, al
je 0x46e5cd
mov ebx, 0x15
jmp 0x46e5d9
mov ebx, 0x10
jmp 0x46e5d9
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x28]
push eax
push ebx
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [0x48195c]
call fcn.0046e310
mov eax, dword [ebp - 4]
call fcn.0046e310
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.00406a44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46e638
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.00405074
lea eax, [ebp - 0xc]
mov edx, dword [0x407e60]
call fcn.00405b64
ret
Function at 0x474f38
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
xor edx, edx
mov dword [ebp - 0x118], edx
mov dword [ebp - 0x114], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47501b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00405050
lea eax, [ebp - 8]
push eax
push 0x23
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x474fc2
lea eax, [ebp - 0x10d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
test eax, eax
je 0x474fc2
lea edx, [ebp - 0x114]
lea eax, [ebp - 0x10d]
call fcn.0040a300
push dword [ebp - 0x114]
push 0x475030
push 0x47503c
push 0x475030
lea eax, [ebp - 4]
mov edx, 4
call fcn.004053e4
mov eax, dword [ebp - 4]
call fcn.00409d64
test al, al
jne 0x474feb
lea edx, [ebp - 0x118]
mov eax, dword [ebp - 4]
call fcn.00409f08
mov eax, dword [ebp - 0x118]
call fcn.00409d88
test al, al
je 0x474ff5
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.004050a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x475022
lea eax, [ebp - 0x118]
mov edx, 2
call fcn.00405074
lea eax, [ebp - 4]
call fcn.00405050
ret

Function at 0x4755a4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x108], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x47561c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00405050
push 0
push esi
lea eax, [ebp - 0x104]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathA
test eax, eax
je 0x475603
lea edx, [ebp - 0x108]
lea eax, [ebp - 0x104]
call fcn.0040a300
mov eax, dword [ebp - 0x108]
mov edx, ebx
call fcn.0040df6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x475623
lea eax, [ebp - 0x108]
call fcn.00405050
ret
Function at 0x475d04
Capabilities:
Acquire debug privileges

Disassembly:
push ebx
push ecx
push esp
push 0x20
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
mov cl, 1
mov edx, 0x475d3c
mov eax, dword [esp]
call fcn.00475c6c
mov ebx, eax
mov eax, dword [esp]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, ebx
pop edx
pop ebx
ret

Function at 0x475d50
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
xor esi, esi
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov ebx, eax
test ebx, ebx
je 0x475d74
push 0
push ebx
call sub.kernel32.dll_TerminateProcess
mov esi, eax
push ebx
call sub.kernel32.dll_CloseHandle_1
mov eax, esi
pop esi
pop ebx
ret

Function at 0x477bf0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov eax, 1
call fcn.00478144
mov ecx, dword [0x48259c]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x477858]
call fcn.0045d0f0
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x477cd5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3c0]
xor edx, edx
call fcn.00438130
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3bc]
mov dl, 1
call fcn.00447d0c
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3b0]
xor edx, edx
call fcn.00447d0c
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3b4]
mov edx, 0x477cec
call fcn.00447e1c
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3b4]
mov edx, 0x5a
call fcn.004474a8
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3b8]
xor edx, edx
call fcn.00447d0c
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0xfc]
dec eax
sete byte [ebp - 1]
cmp byte [ebp - 1], 0
je 0x477cbf
push 5
push 0
push 0
push 0x477d1c
push 0x477d44
mov eax, dword [ebp - 8]
call fcn.0044fed0
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x477cdc
mov eax, dword [ebp - 8]
call fcn.00404150
ret
Function at 0x477d4c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov eax, 1
call fcn.00478144
mov ecx, dword [0x48259c]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x477858]
call fcn.0045d0f0
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x477e41
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3c0]
xor edx, edx
call fcn.00438130
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3b0]
xor edx, edx
call fcn.00447d0c
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3bc]
xor edx, edx
call fcn.00447d0c
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3cc]
mov dl, 1
call fcn.00447d0c
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3b4]
mov edx, 0x477e58
call fcn.00447e1c
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3b4]
mov edx, 0x5a
call fcn.004474a8
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3b8]
xor edx, edx
call fcn.00447d0c
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0xfc]
dec eax
sete byte [ebp - 1]
cmp byte [ebp - 1], 0
je 0x477e2b
push 5
push 0
push 0
push 0x477e80
push 0x477ea8
mov eax, dword [ebp - 8]
call fcn.0044fed0
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x477e48
mov eax, dword [ebp - 8]
call fcn.00404150
ret

Function at 0x47cf08
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x47cf11
mov eax, dword [ebp - 4]
add esp, 4
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004054d0
xor eax, eax
push ebp
push 0x47d007
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x482648]
mov byte [eax], 0
mov dword [ebp - 8], 0xffffffff
xor ebx, ebx
push ebp
push 0x47cfe7
push dword fs:[ebx]
mov dword fs:[ebx], esp
mov eax, dword [ebp - 4]
call fcn.00409d40
test al, al
je 0x47cf7a
push 0x40
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x4170c8]
call fcn.0041b540
mov dword [ebp - 0xc], eax
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.0041b0ac
lea edx, [ebp - 0xfffd]
mov ecx, 0xfff1
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, eax
mov edx, ecx
test dx, dx
jbe 0x47cfce
lea eax, [ebp - 0xfffd]
movzx ebx, byte [eax]
mov esi, dword [ebp - 8]
and esi, 0xff
xor ebx, esi
mov ebx, dword [ebx*4 + 0x481e40]
mov esi, dword [ebp - 8]
shr esi, 8
xor ebx, esi
mov dword [ebp - 8], ebx
inc eax
dec dx
jne 0x47cfa8
test ecx, ecx
jne 0x47cf86
mov eax, dword [ebp - 0xc]
call fcn.00404150
not dword [ebp - 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47cff1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47d00e
lea eax, [ebp - 4]
call fcn.00405050
ret
Function at 0x47d128
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor edx, edx
mov dword [ebp - 0x24], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47d1ab
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1e]
xor ecx, ecx
mov edx, 0x1e
call fcn.00403970
xor eax, eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], 3
lea eax, [ebp - 0x24]
mov ecx, 0x47d1c4
mov edx, ebx
call fcn.00405368
mov eax, dword [ebp - 0x24]
call fcn.004054e0
mov dword [ebp - 0x16], eax
mov eax, 0x47d1c8
mov dword [ebp - 0x12], eax
mov word [ebp - 0xe], 0x14
lea eax, [ebp - 0x1e]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47d1b2
lea eax, [ebp - 0x24]
call fcn.00405050
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
nop
mov ecx, 0x6cc87b8d
test eax, eax
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x431024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x7e620456
nop
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43106c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x401c20
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x433640
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x442630]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.00407d23
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x401c63
push 0x80004005
call fcn.00402fa0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
mov dword [esp + 0x30], 0
call fcn.00407d23
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x401c95
push 0x80004005
call fcn.00402fa0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [esp + 0x24], edi
push 0x3f
mov byte [esp + 0x34], 1
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths_netcard.exe
lea ecx, [esp + 0x1c]
mov dword [esp + 0x24], 0x104
call fcn.00402e50
mov ebp, dword [esp + 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea ecx, [esp + 0x18]
push ecx
push ebp
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x401d2e
push 0x48
push str.SoftwareMicrosoftWindowsCurrentVersionApp_PathsSKYLINK_3G_MODEM.exe
lea ecx, [esp + 0x1c]
call fcn.00402e50
mov ebp, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
push ebp
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x401d06
xor esi, esi
jmp 0x401d54
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x1c]
push eax
push ebx
lea ecx, [esp + 0x28]
push ecx
push 0
push str.Path
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor ecx, ecx
test eax, eax
sete cl
mov esi, ecx
jmp 0x401d54
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x1c]
push edx
push ebx
lea eax, [esp + 0x28]
push eax
push 0
push str.Path
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor edx, edx
test eax, eax
sete dl
mov esi, edx
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
lea eax, [edi - 0x10]
setne bl
mov byte [esp + 0x30], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401d85
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebp - 0x10]
mov dword [esp + 0x30], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401da9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, bl
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret