joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bb20c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404a3c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4bb229
and eax, 0x10
cmp eax, 0x10
je 0x4bb22d
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x4bc06c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404a2c
mov eax, dword [ebp - 8]
call fcn.00404a2c
xor eax, eax
push ebp
push 0x4bc0df
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push dword [ebp - 4]
push 0x4bc0f4
push dword [ebp - 8]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404904
mov eax, dword [ebp - 0xc]
call fcn.00404a3c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bc0e6
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004045b0
ret
Function at 0x401000
Capabilities:
Encode data using base64
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea edx, [ecx + 1]
push ebx
push esi
push edi
mov edi, ecx
xor bl, bl
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401010
sub ecx, edx
mov eax, 0xaaaaaaab
shl ecx, 2
mul ecx
xor eax, eax
shr edx, 1
add edx, 4
setb al
neg eax
or eax, edx
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edx, eax
add esp, 4
mov dword [ebp - 8], edx
test edx, edx
jne 0x40104b
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov cl, byte [edi]
xor esi, esi
test cl, cl
je 0x40112b
movsx eax, bl
inc bl
mov byte [ebp + eax - 4], cl
mov bh, byte [ebp - 3]
cmp bl, 3
jne 0x4010c5
movsx ecx, byte [ebp - 4]
mov eax, ecx
and ecx, 3
sar eax, 2
add ecx, ecx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_S]
mov byte [esi + edx], al
movsx edx, bh
mov eax, edx
and edx, 0xf
sar eax, 4
movzx eax, byte [eax + ecx*8 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_S]
mov ecx, dword [ebp - 8]
mov byte [esi + ecx + 1], al
movsx ecx, byte [ebp - 2]
mov eax, ecx
and ecx, 0x3f
sar eax, 6
movzx eax, byte [eax + edx*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_S]
mov edx, dword [ebp - 8]
mov byte [esi + edx + 2], al
movzx eax, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_S]
mov byte [esi + edx + 3], al
add esi, 4
xor bl, bl
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x401057
test bl, bl
jle 0x40112b
movsx edi, byte [ebp - 4]
mov eax, edi
and edi, 3
sar eax, 2
shl edi, 4
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_S]
mov byte [esi + edx], al
lea eax, [edx + 1]
add eax, esi
mov dword [ebp - 8], eax
cmp bl, 1
jne 0x401101
mov cl, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_S]
mov al, 0x3d
jmp 0x40111a
movsx ecx, bh
mov eax, ecx
and eax, 0xf
sar ecx, 4
mov al, byte [eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_S]
mov cl, byte [ecx + edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_S]
mov edi, dword [ebp - 8]
mov byte [edi], cl
mov byte [esi + edx + 2], al
mov byte [esi + edx + 3], 0x3d
add esi, 4
pop edi
mov byte [esi + edx], 0
mov eax, edx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40223e
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40227d
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40227d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40227d
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40227d
cmp dword [ecx + 0x74], 0xe
jbe 0x40227d
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x403770
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x1ac
mov eax, dword [str.SoftwareCsss]
push ebx
mov ebx, ecx
mov dword [esp + 0xc], eax
mov ecx, dword [0x41d258]
mov ax, word [0x41d260]
push esi
push edi
mov dword [esp + 0x18], ecx
mov word [esp + 0x20], ax
mov ecx, 0x32
xor eax, eax
lea edi, [esp + 0x28]
mov edx, dword [0x41d25c]
rep stosd dword es:[edi], eax
mov ecx, 0x32
lea edi, [esp + 0xf0]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x28]
push 0xc8
push ecx
push eax
mov dword [esp + 0x28], edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x28]
push 0x5c
push edx
call fcn.00407870
mov edi, eax
or ecx, 0xffffffff
inc edi
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xf8]
mov eax, ecx
mov esi, edi
mov edi, edx
push str.CSSSServer.exe
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xfc]
push ecx
call fcn.0040f0a0
add esp, 0x10
test eax, eax
jne 0x403827
mov dword [ebx + 0x114], 1
jmp 0x403831
mov dword [ebx + 0x114], 3
mov eax, dword [ebx + 0x114]
dec eax
jne 0x40390c
lea edx, [esp + 0xc]
lea eax, [esp + 0x14]
push edx
push 0xf003f
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x403889
lea ecx, [esp + 0x24]
lea edx, [ebx + 0x118]
push ecx
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push eax
push 0
push str.SQLServerIP
push ecx
mov dword [esp + 0x28], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, str.Server
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebx + 0x128]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebx + 0x148]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x41d310
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebx + 0x168]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.76ice19761001
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x1ac
ret 4
Function at 0x403ac0
Capabilities:
Enumerate process modules

Disassembly:
mov eax, 0x2178
call fcn.00407920
lea eax, [esp + 8]
lea ecx, [esp + 0x1178]
push eax
push 0x1000
push ecx
mov dword [esp + 0xc], 0
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x403af4
add esp, 0x2178
ret
mov eax, dword [esp + 8]
shr eax, 2
je 0x403bc3
push ebx
mov ebx, dword [esp + 0x2184]
push ebp
push esi
push edi
lea ebp, [esp + 0x1188]
mov dword [esp + 0x14], eax
mov edi, dword [ebp]
push edi
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x403ba6
lea edx, [esp + 0x1c]
lea eax, [esp + 0x188]
push edx
push 0x1000
push eax
push esi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x403ba6
mov edx, dword [esp + 0x188]
lea ecx, [esp + 0x84]
push 0x104
push ecx
push edx
push esi
call sub.PSAPI.DLL_GetModuleFileNameExA
mov ecx, dword [esp + 0x188]
lea eax, [esp + 0x20]
push 0x64
push eax
push ecx
push esi
call sub.PSAPI.DLL_GetModuleBaseNameA
mov edx, dword [esp + 0x218c]
lea eax, [esp + 0x20]
push edx
push eax
call fcn.0040f0a0
add esp, 8
test eax, eax
jne 0x403ba6
mov ecx, dword [esp + 0x10]
mov dword [ebx], esi
inc ecx
mov dword [ebx + 4], edi
mov dword [esp + 0x10], ecx
add ebx, 8
jmp 0x403bad
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x14]
add ebp, 4
dec eax
mov dword [esp + 0x14], eax
jne 0x403b17
pop edi
pop esi
pop ebp
pop ebx
mov eax, dword [esp]
add esp, 0x2178
ret

Function at 0x403c40
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov ecx, dword [0x41d258]
mov eax, dword [str.SoftwareCsss]
mov edx, dword [0x41d25c]
push ebx
mov ebx, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x24]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
mov ax, word [0x41d260]
mov ecx, dword [esi]
mov dword [esp + 0x10], edx
mov edx, ecx
push edi
mov word [esp + 0x18], ax
xor eax, eax
mov edi, ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 0x28]
lea ecx, [esp + 0xc]
push eax
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x403cac
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x28]
push esi
push ebx
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x403cda
mov ecx, dword [esp + 0x28]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
mov edx, dword [esp + 0x28]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x10
ret
Function at 0x4043c0
Capabilities:
Check mutex on windows
Print debug messages

Disassembly:
sub esp, 0x104
lea eax, [esp]
push ebx
push esi
push edi
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x4044b2
xor ecx, ecx
test eax, eax
jle 0x4043fa
cmp byte [esp + ecx + 0xc], 0x5c
jne 0x4043f5
mov byte [esp + ecx + 0xc], 0x5f
inc ecx
cmp ecx, eax
jl 0x4043e9
mov ebx, dword [esp + 0x114]
test ebx, ebx
je 0x404436
lea ecx, [esp + 0xc]
push 0x5f
push ecx
call fcn.00407870
lea edx, [eax + 1]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [esp + 0xc]
push ecx
call edi
lea edx, [esp + 0xc]
push edx
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
jne 0x404484
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x10]
push str.IsProcessExists_CreateMutex_ec_d
push eax
call fcn.00407763
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
call edi
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x104
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4044a7
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x104
ret
test ebx, ebx
je 0x4044b2
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x104
ret

Function at 0x4044c0
Capabilities:
Enumerate process modules

Disassembly:
mov eax, 0x2170
call fcn.00407920
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
lea ecx, [esp + 0x1184]
push 0x1000
push ecx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x40458e
mov ebp, dword [esp + 0x10]
mov ebx, 0
shr ebp, 2
je 0x40458e
lea edi, [esp + 0x1180]
mov eax, dword [edi]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x40457b
lea edx, [esp + 0x14]
lea eax, [esp + 0x180]
push edx
push 0x1000
push eax
push esi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x40457b
mov edx, dword [esp + 0x180]
lea ecx, [esp + 0x7c]
push 0x104
push ecx
push edx
push esi
call sub.PSAPI.DLL_GetModuleFileNameExA
mov ecx, dword [esp + 0x180]
lea eax, [esp + 0x18]
push 0x64
push eax
push ecx
push esi
call sub.PSAPI.DLL_GetModuleBaseNameA
lea edx, [esp + 0x18]
push str.explorer.exe
push edx
call fcn.0040f0a0
add esp, 8
test eax, eax
je 0x40459b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
add edi, 4
cmp ebx, ebp
jb 0x404506
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2170
ret
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2170
ret
Function at 0x4045b0
Capabilities:
Get common file path
Print debug messages
Query or enumerate registry value

Disassembly:
sub esp, 0x110
push ebx
push ebp
mov ebp, dword [esp + 0x11c]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push edi
push 0x104
push ebp
call esi
test eax, eax
jne 0x404604
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ReleaseFile:GetPath_GetSystemDirectory1_ec_d
lea eax, [esp + 0x24]
push eax
call fcn.00407763
add esp, 0xc
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret
lea edx, [ebp + 0x104]
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x404628
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ReleaseFile:GetPath_GetWindowsDirectory_ec_d
jmp 0x4045df
lea ebx, [ebp + 0x30c]
push 0x104
push ebx
call esi
test eax, eax
jne 0x404648
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ReleaseFile:GetPath_GetSystemDirectory2_ec_d
jmp 0x40469d
mov edi, str.drivers
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [str.SOFTWARECsss]
push 1
push 0
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4046c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ReleaseFile:GetPath_RegOpenKeyEx_ec_d
lea edx, [esp + 0x24]
push edx
call fcn.00407763
add esp, 0xc
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret
lea ecx, [esp + 0x14]
lea edx, [ebp + 0x208]
push ecx
mov ecx, dword [str.AppPath]
lea eax, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x18]
push eax
push 0
push ecx
push edx
mov dword [esp + 0x2c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x40472f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x20]
push str.ReleaseFile:GetPath_RegQueryValueEx_ec_d
push eax
call fcn.00407763
add esp, 0xc
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, ebp
mov ebx, 4
mov edi, 0x41d374
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
add edx, 0x104
and ecx, 3
dec ebx
rep movsb byte es:[edi], byte [esi]
jne 0x404741
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x110
ret
Function at 0x404790
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4178d3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1bc
push ebx
push esi
push edi
lea ecx, [ebp - 0x1c8]
mov dword [ebp - 0x10], esp
push str.param.ini
call section..text
lea ecx, [ebp - 0x1c8]
mov dword [ebp - 4], 0
call fcn.00401240
test eax, eax
jne 0x404809
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.local
call fcn.004125fe
lea ecx, [ebp - 0x1c8]
call fcn.00401170
test eax, eax
jne 0x404809
push str.ReleaseFile:l
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x404aa1
push str.select__from_ClientfilesDestDir
lea ecx, [ebp - 0x14]
call fcn.004125fe
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x1c8]
push eax
mov byte [ebp - 4], 1
call fcn.00402180
test eax, eax
je 0x404a8a
lea ecx, [ebp - 0x1c8]
call fcn.00401cb0
test eax, eax
je 0x404a8a
mov ebx, dword [ebp + 8]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1c8]
call fcn.00402120
test eax, eax
jne 0x404964
lea ecx, [ebp - 0x18]
push ecx
push str.FileType
lea ecx, [ebp - 0x1c8]
call fcn.004016a0
cmp dword [ebp - 0x18], 1
je 0x404887
push 3
lea ecx, [ebp - 0x1c8]
call fcn.00401e20
jmp 0x40484b
mov edx, dword [0x41da5c]
mov dword [ebp + 8], edx
lea eax, [ebp + 8]
lea ecx, [ebp - 0x1c8]
push eax
push str.FileName
mov byte [ebp - 4], 3
call fcn.00401940
mov ecx, dword [ebp + 8]
mov eax, dword [ecx - 8]
inc eax
push eax
call fcn.00412315
add esp, 4
lea ecx, [ebp + 8]
mov dword [ebp - 0x2c], eax
push 1
call fcn.00412947
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea eax, [ebp - 0x28]
mov edx, ecx
mov esi, edi
mov edi, dword [ebp - 0x2c]
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push str.OSVersion
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x1c8]
call fcn.004016a0
lea ecx, [ebp - 0x24]
push ecx
push str.DestDir
lea ecx, [ebp - 0x1c8]
call fcn.004016a0
lea edx, [ebp - 0x20]
lea ecx, [ebp - 0x1c8]
push edx
push str.FileLen
call fcn.004016a0
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x1c8]
push eax
push str.FileOffset
call fcn.004016a0
mov eax, dword [ebx + 8]
lea ecx, [ebp - 0x2c]
push ecx
push 1
push eax
mov ecx, ebx
call fcn.004052a0
push 3
lea ecx, [ebp - 0x1c8]
call fcn.00401e20
lea ecx, [ebp + 8]
mov byte [ebp - 4], 2
call fcn.004125d4
jmp 0x40484b
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0
call fcn.004125d4
lea ecx, [ebp - 0x1c8]
mov dword [ebp - 4], 0xffffffff
call fcn.004010f0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x41d4a8
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call fcn.004125d4
lea ecx, [ebp - 0x1c8]
mov dword [ebp - 4], 0xffffffff
call fcn.004010f0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404ad0
Capabilities:
Copy file
Get common file path
Print debug messages
Query or enumerate registry value

Disassembly:
sub esp, 0x318
lea eax, [esp + 0x214]
push ebx
push esi
push edi
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, str.DBAK.dat
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x220]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [str.SOFTWARECsss]
push 1
push 0
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x404b6c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [esp + 0x1c]
push str.ReleaseFile:GetPath_RegOpenKeyEx_ec_d
push edx
call fcn.00407763
add esp, 0xc
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x318
ret
lea ecx, [esp + 0x10]
lea edx, [esp + 0x11c]
push ecx
mov ecx, dword [str.AppPath]
lea eax, [esp + 0x18]
push edx
mov edx, dword [esp + 0x14]
push eax
push 0
push ecx
push edx
mov dword [esp + 0x28], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x404bd9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x1c]
push str.ReleaseFile:GetPath_RegQueryValueEx_ec_d
push eax
call fcn.00407763
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x318
ret
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, 0x41d59c
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x11c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x11c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x224]
lea edx, [esp + 0x1c]
push ecx
push 0x41d580
push edx
call fcn.00407763
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x10
lea eax, [esp + 0x18]
push eax
call edi
push 0
push 0
push 0
lea ecx, [esp + 0x128]
push 0
lea edx, [esp + 0x230]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileExA]
mov esi, eax
test esi, esi
jne 0x404c88
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x1c]
push 0x41d560
push eax
call fcn.00407763
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
call edi
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x318
ret
Function at 0x404ca0
Capabilities:
Print debug messages
Read file on windows
Write file on windows

Disassembly:
mov eax, 0x10008
call fcn.00407920
push esi
mov esi, dword [esp + 0x1001c]
push edi
push str..mdb
push esi
call fcn.00407d90
add esp, 8
test eax, eax
je 0x404cde
push 0x41d5c0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call fcn.00404ad0
pop edi
pop esi
add esp, 0x10008
ret
push 0
push 0x80
push 4
push 0
push 3
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x404d09
pop edi
xor eax, eax
pop esi
add esp, 0x10008
ret
mov eax, dword [esp + 0x10018]
push ebx
mov ebx, dword [esp + 0x10018]
push 0
push 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov esi, dword [esp + 0x10020]
test esi, esi
je 0x404d74
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
cmp esi, 0x10000
mov eax, 0x10000
ja 0x404d45
mov eax, esi
lea ecx, [esp + 0x14]
push 0
push ecx
lea edx, [esp + 0x20]
push eax
push edx
push ebx
call ebp
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push 0
push eax
lea edx, [esp + 0x20]
push ecx
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esi, dword [esp + 0x10]
jne 0x404d36
pop ebp
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 0x10008
ret

Function at 0x404d90
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
lea eax, [esp]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x404db4
or eax, 0xffffffff
add esp, 0x104
ret
push ebx
push esi
push edi
mov edi, dword [str.WINBAK.DAT]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xc]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push eax
push 0x80
mov ecx, ebx
push 3
push eax
and ecx, 3
push 1
lea eax, [esp + 0x20]
push SysReAllocString
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
pop edi
pop esi
pop ebx
add esp, 0x104
ret

Function at 0x4055a0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
xor eax, eax
push esi
mov dword [esp + 4], eax
push edi
mov dword [esp + 0xc], eax
mov ecx, 0x11
mov dword [esp + 0x10], eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea ecx, [esp + 8]
lea edx, [esp + 0x18]
push ecx
push edx
push eax
push eax
push 0x20
push 1
push eax
mov dword [esp + 0x30], eax
push eax
mov eax, dword [esp + 0x80]
push eax
push 0
mov dword [esp + 0x40], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call esi
mov ecx, dword [esp + 0x64]
push str.mailmonitor.exe
push ecx
call fcn.0040f0a0
add esp, 8
test eax, eax
jne 0x405616
push 0x3e8
call esi
mov eax, dword [esp + 8]
pop edi
pop esi
add esp, 0x54
ret