joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43d8ac
Capabilities:
Get hostname
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
xor edx, edx
mov dword [ebp - 0x200], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
mov edx, dword [0x43d334]
call fcn.0040535c
xor eax, eax
push ebp
push 0x43da1d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, dword [0x48c29c]
mov edx, dword [edx]
call fcn.00404a90
lea eax, [ebp - 0x1fc]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
push 0x40
lea eax, [ebp - 0x6c]
push eax
call sub.wsock32.dll_gethostname
inc eax
je 0x43d91e
lea eax, [ebp - 8]
lea edx, [ebp - 0x6c]
mov ecx, 0x40
call fcn.00404c68
cmp dword [ebp - 8], 0
jne 0x43d931
lea eax, [ebp - 8]
mov edx, 0x43da30
call fcn.00404a90
mov eax, dword [0x48bf58]
cmp byte [eax], 0
jne 0x43d9ee
mov eax, dword [0x48bf50]
cmp byte [eax], 0
jne 0x43d9ee
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 8]
call fcn.00404a90
lea eax, [ebp - 0x24]
mov edx, 0x43da40
call fcn.00404a90
lea eax, [ebp - 0x20]
mov edx, dword [0x48c29c]
mov edx, dword [edx]
call fcn.00404a90
mov byte [ebp - 0x1c], 0
lea eax, [ebp - 0x18]
mov edx, dword [0x489b94]
call fcn.00404a90
mov eax, dword [0x489b98]
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov byte [ebp - 0x2c], 1
lea edx, [ebp - 0x200]
mov eax, dword [0x48f830]
call fcn.004087cc
mov eax, dword [ebp - 0x200]
mov edx, dword [0x489ba8]
call fcn.00404e04
sete byte [ebp - 9]
cmp byte [ebp - 9], 0
je 0x43d9e3
lea eax, [ebp - 0x24]
mov edx, dword [0x489ba8]
call fcn.00404a90
mov byte [ebp - 0x1c], 1
lea eax, [ebp - 0x18]
mov edx, dword [0x489b94]
call fcn.00404a90
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 4]
call fcn.0043da50
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43da24
lea eax, [ebp - 0x200]
call fcn.004049f8
lea eax, [ebp - 0x2c]
mov edx, dword [0x43d334]
call fcn.00405420
lea eax, [ebp - 8]
call fcn.004049f8
ret
Function at 0x43f0fc
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x43f222
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
xor eax, eax
push ebp
push 0x43f1fd
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x41d670]
call fcn.0041d770
mov dword [ebp - 8], eax
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call fcn.0041d810
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 0x20019
mov eax, dword [0x48c3c4]
cmp dword [eax], 2
jne 0x43f18d
lea edx, [ebp - 0x10]
mov eax, dword [0x48c1d0]
mov eax, dword [eax]
call fcn.00409014
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 0x43f23c
call fcn.00404d04
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.0041dfd4
test al, al
je 0x43f1eb
mov byte [ebp - 1], 1
jmp 0x43f1eb
xor eax, eax
push ebp
push 0x43f1e1
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, 0x43f268
mov eax, dword [ebp - 8]
call fcn.0041d874
lea edx, [ebp - 0x14]
mov eax, 0x7d0
call fcn.00409014
lea eax, [ebp - 0x14]
mov edx, 0x43f2a8
call fcn.00404cc0
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.0041df2c
test al, al
je 0x43f1d7
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43f1eb
mov eax, dword [ebp - 8]
call fcn.00403ce8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43f207
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43f229
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404a1c
ret
Function at 0x43f2b0
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov byte [ebp - 1], 0
xor eax, eax
push ebp
push 0x43f41f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x48c3c4]
cmp dword [eax], 2
je 0x43f2e6
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43f429
mov byte [ebp - 1], 0
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], 0
jne 0x43f337
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x3f0
jne 0x43f337
lea eax, [ebp - 8]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], 0
je 0x43f415
xor eax, eax
push ebp
push 0x43f40e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x400
call fcn.004026f4
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 0x400
mov eax, dword [ebp - 0xc]
push eax
push 2
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_GetTokenInformation
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x19], al
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
cmp byte [ebp - 0x19], 0
je 0x43f3f8
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x489bcc]
push eax
mov eax, dword [0x489bc8]
push eax
push 2
push 0x489bc0
call sub.advapi32.dll_AllocateAndInitializeSid
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
dec eax
test eax, eax
jl 0x43f3ef
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x18]
mov eax, dword [eax + edx*8 + 4]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x43f3e7
mov byte [ebp - 1], 1
jmp 0x43f3ef
inc dword [ebp - 0x18]
dec dword [ebp - 0x20]
jne 0x43f3c9
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_FreeSid
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43f415
mov eax, dword [ebp - 0xc]
call fcn.00402714
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43f429
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x443910
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x2001f
push 0
push 0x4439a4
push 0
mov eax, ebx
call fcn.00404eb8
push eax
mov eax, dword [ebp + 8]
push eax
call sub.advapi32.dll_RegCreateKeyExA
mov ebx, eax
test ebx, ebx
jne 0x44397f
mov eax, esi
call fcn.00404cb8
inc eax
push eax
mov eax, esi
call fcn.00404eb8
push eax
push 1
push 0
mov eax, edi
call fcn.00404eb8
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
test ebx, ebx
je 0x44399a
mov ecx, dword [0x48bff0]
mov dl, 1
mov eax, dword [0x442630]
call fcn.0040c9f4
call fcn.004043b4
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x447514
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404eb8
push eax
call sub.kernel32.dll_GetFileAttributesA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x44753a
test byte [ebp - 0xc], 0x10
jne 0x44753e
xor eax, eax
jmp 0x447540
mov al, 1
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret
Function at 0x44a1a4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 4]
cmp dword [eax + 0x12c], 0
jne 0x44a1da
cmp dword [eax + 0x128], 0
jne 0x44a1da
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 4]
mov dword [eax + 0x84], 0x5000
jmp 0x44a2db
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 4]
cmp dword [eax + 0x12c], 0
jne 0x44a1fb
cmp dword [eax + 0x128], 0
jbe 0x44a2db
jmp 0x44a201
jle 0x44a2db
call sub.kernel32.dll_GetTickCount_1
xor edx, edx
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 8]
mov ecx, dword [ecx - 4]
sub eax, dword [ecx + 0x128]
sbb edx, dword [ecx + 0x12c]
cmp edx, 0
jne 0x44a22b
cmp eax, 0x3e8
jbe 0x44a26f
jmp 0x44a22d
jle 0x44a26f
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 4]
cmp dword [eax + 0x84], 0x1f4
jle 0x44a26f
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 4]
fild dword [eax + 0x84]
fld xword [0x44a358]
fmulp st(1)
call fcn.00402b40
mov edx, dword [ebp + 8]
mov edx, dword [edx + 8]
mov edx, dword [edx - 4]
mov dword [edx + 0x84], eax
jmp 0x44a2db
call sub.kernel32.dll_GetTickCount_1
xor edx, edx
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 8]
mov ecx, dword [ecx - 4]
sub eax, dword [ecx + 0x128]
sbb edx, dword [ecx + 0x12c]
cmp edx, 0
jne 0x44a299
cmp eax, 0x3e8
jae 0x44a2db
jmp 0x44a29b
jge 0x44a2db
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 4]
cmp dword [eax + 0x84], 0x1400000
jge 0x44a2db
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 4]
fild dword [eax + 0x84]
fld xword [0x44a364]
fmulp st(1)
call fcn.00402b40
mov edx, dword [ebp + 8]
mov edx, dword [edx + 8]
mov edx, dword [edx - 4]
mov dword [edx + 0x84], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x84]
cdq
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 8]
mov ecx, dword [ecx - 4]
cmp edx, dword [ecx + 0x15c]
jne 0x44a306
cmp eax, dword [ecx + 0x158]
jbe 0x44a339
jmp 0x44a308
jle 0x44a339
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x84]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 4]
add eax, 0x160
mov ecx, 1
mov edx, dword [0x448318]
call fcn.00405df8
add esp, 4
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 4]
mov dword [eax + 0x128], 0xffffffff
mov dword [eax + 0x12c], 0xffffffff
pop ebp
ret
Function at 0x44f700
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x11c], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44f836
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x44f7f6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.00404bf0
mov eax, dword [ebp - 0x14]
call fcn.00404cb8
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x50]
lea eax, [edx + eax + 1]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x118]
mov edx, dword [ebp - 8]
call fcn.004037d8
lea edx, [ebp - 0x118]
lea eax, [ebp - 0x18]
call fcn.00404c5c
push dword [ebp - 0x18]
push 0x44f84c
lea eax, [ebp - 0x11c]
mov edx, dword [ebp - 0xc]
call fcn.00404bf0
push dword [ebp - 0x11c]
mov eax, dword [ebp - 4]
add eax, 0x7c
mov edx, 3
call fcn.00404d78
mov eax, dword [ebp - 4]
add eax, 0x78
call fcn.004049f8
mov eax, dword [ebp - 4]
call fcn.0044ec14
test al, al
jne 0x44f7d7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x44f810
push 1
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x44f810
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44f83d
lea eax, [ebp - 0x11c]
call fcn.004049f8
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00404a1c
ret
Function at 0x4584d4
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x458542
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 0xfd
lea eax, [ebp - 8]
mov edx, 0xfe
call fcn.00404fe8
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404eb8
push eax
call sub.advapi32.dll_GetUserNameA
lea eax, [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.00404fe8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00404a4c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x458549
lea eax, [ebp - 8]
call fcn.004049f8
ret
Function at 0x458938
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe58
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1a8], ebx
mov dword [ebp - 0x1a0], ebx
mov dword [ebp - 0x1a4], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404ea8
mov eax, dword [ebp - 8]
call fcn.00404ea8
xor eax, eax
push ebp
push 0x458b39
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x458b04
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 2
call fcn.004413c0
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x148], 0x128
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 0x14]
call fcn.004413e0
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x458a20
lea eax, [ebp - 0x1a4]
lea edx, [ebp - 0x124]
mov ecx, 0x104
call fcn.00404c68
mov eax, dword [ebp - 0x1a4]
lea edx, [ebp - 0x1a0]
call fcn.004087cc
mov eax, dword [ebp - 0x1a0]
mov edx, 0x458b50
call fcn.00404e04
jne 0x458a0f
mov eax, dword [ebp - 0x140]
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 0x1c], eax
jmp 0x458a26
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 0x14]
call fcn.00441400
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4589be
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle_1
cmp dword [ebp - 0x1c], 0
jne 0x458a42
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x458b0e
lea eax, [ebp - 0x19c]
push eax
call sub.kernel32.dll_GetStartupInfoA_1
lea eax, [ebp - 0x18]
push eax
push 0xb
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_OpenProcessToken
mov dword [ebp - 0x20], eax
cmp dword [ebp - 4], 0
jne 0x458a99
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_ImpersonateLoggedOnUser
cmp eax, 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x458a92
lea eax, [ebp - 0x1a8]
call fcn.004584d4
mov edx, dword [ebp - 0x1a8]
mov eax, dword [ebp - 0xc]
call fcn.00404a4c
call sub.advapi32.dll_RevertToSelf
jmp 0x458af1
cmp dword [ebp - 0x20], 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x458af1
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x19c]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00404eb8
push eax
mov eax, dword [ebp - 4]
call fcn.00404eb8
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_CreateProcessAsUserA
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
sbb eax, eax
inc eax
test al, al
jne 0x458af1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x458b0e
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x458b0e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x458b40
lea eax, [ebp - 0x1a8]
mov edx, 3
call fcn.00404a1c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404a1c
ret
Function at 0x458bf0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404ea8
mov eax, dword [ebp - 8]
call fcn.00404ea8
xor eax, eax
push ebp
push 0x458d22
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 1
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.00404a90
lea eax, [ebp - 0x10]
mov ecx, 0x458d38
mov edx, dword [ebp - 0x14]
call fcn.00404d04
mov eax, dword [ebp - 4]
call fcn.004091b8
test al, al
jne 0x458c55
mov byte [ebp - 9], 0
jmp 0x458cfa
call fcn.0042caec
cmp al, 6
jb 0x458cd4
call fcn.0042afdc
test al, al
je 0x458cd4
call fcn.0042caec
cmp al, 6
jbe 0x458ca2
push 0x458d44
push dword [ebp - 0x14]
push 0x458d50
push dword [ebp - 8]
push 0x458d44
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00404d78
mov edx, dword [ebp - 0x1c]
lea ecx, [ebp - 0x18]
mov eax, dword [ebp - 0x10]
call fcn.00458590
jmp 0x458cfa
push 0x458d44
push dword [ebp - 0x14]
push 0x458d50
push dword [ebp - 8]
push 0x458d44
lea eax, [ebp - 0x20]
mov edx, 5
call fcn.00404d78
mov edx, dword [ebp - 0x20]
lea ecx, [ebp - 0x18]
mov eax, dword [ebp - 0x10]
call fcn.00458938
jmp 0x458cfa
push 1
push 0
lea eax, [ebp - 8]
call fcn.00404f10
push eax
lea eax, [ebp - 0x10]
call fcn.00404f10
push eax
push 0x458d54
mov eax, dword [0x48fb7c]
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x458d29
lea eax, [ebp - 0x20]
mov edx, 5
call fcn.00404a1c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404a1c
ret

Function at 0x4595d8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov byte [ebp - 1], al
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [0x48fd74]
cmp eax, 0x64
jbe 0x45966a
call sub.kernel32.dll_GetTickCount_1
mov dword [0x48fd74], eax
test byte [ebp - 1], 1
jbe 0x45962b
xor eax, eax
push ebp
push 0x459621
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, 1
call fcn.0045950c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45962b
test byte [ebp - 1], 2
jbe 0x45966a
xor eax, eax
push ebp
push 0x459660
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
push 0xf170
push 0x112
mov eax, dword [0x48fb7c]
push eax
call sub.user32.dll_PostMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45966a
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4596f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404ea8
xor eax, eax
push ebp
push 0x4597e9
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4597c4
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.00402a68
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.004094f8
push dword [ebp - 0xc]
push 0x459800
push 0x45980c
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404d78
mov eax, dword [ebp - 8]
call fcn.004091b8
test al, al
jne 0x459792
push 0x10
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov edx, 0x459828
call fcn.00404d04
mov ecx, dword [ebp - 0x14]
mov dl, 1
mov eax, dword [0x440d64]
call fcn.00440de8
push 0x64
call sub.kernel32.dll_Sleep_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4597ce
push 1
push dword [ebp - 8]
push 0x459844
push dword [ebp - 4]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404d78
mov eax, dword [ebp - 0x18]
call fcn.00404eb8
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4597ce
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4597f0
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.00404a1c
ret

Function at 0x459d10
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x28c], 0
je 0x459e04
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x290]
call fcn.0041d5c8
xor eax, eax
push ebp
push 0x459dfd
push dword fs:[eax]
mov dword fs:[eax], esp
push 9
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0045a568
cmp dword [ebp - 0xc], 9
jbe 0x459d82
mov eax, dword [ebp - 0xc]
sub eax, 9
push eax
mov eax, dword [ebp - 8]
lea ecx, [eax + 9]
mov eax, dword [ebp - 8]
lea edx, [eax + 9]
mov eax, dword [ebp - 4]
call fcn.0045a568
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
jmp 0x459dcc
push 0
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x18]
mov edx, dword [ebp - 8]
lea eax, [edx + eax]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x298]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jg 0x459dbe
mov dword [ebp - 0x10], 0xffffffff
jmp 0x459de1
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x18]
jge 0x459de1
mov eax, dword [ebp - 0x14]
sub dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0xd], 0
jne 0x459de1
mov eax, dword [ebp - 4]
cmp byte [eax + 0x28c], 0
jne 0x459d8a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459e04
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x290]
call fcn.0041d5d0
ret
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x459e0c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 0xc], ecx
mov word [ebp - 6], dx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x28c], 0
je 0x459f1a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x290]
call fcn.0041d5c8
xor eax, eax
push ebp
push 0x459f13
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
call fcn.00405c44
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp + 8]
mov ax, word [ebp - 6]
call fcn.0043cd88
push 9
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0045a568
cmp dword [ebp + 8], 0
jbe 0x459e94
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
lea ecx, [eax + 9]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0045a568
add dword [ebp + 8], 9
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
jmp 0x459ee2
push 0
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp + 8]
sub eax, dword [ebp - 0x18]
mov edx, dword [ebp + 0xc]
lea eax, [edx + eax]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x298]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jg 0x459ed4
mov dword [ebp - 0x10], 0xffffffff
jmp 0x459ef7
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x18]
jge 0x459ef7
mov eax, dword [ebp - 0x14]
sub dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0xd], 0
jne 0x459ef7
mov eax, dword [ebp - 4]
cmp byte [eax + 0x28c], 0
jne 0x459ea0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459f1a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x290]
call fcn.0041d5d0
ret
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 8
Function at 0x45b670
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x45b676
ret

Function at 0x45d48c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x45d4dd
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x45d4c4
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x45d4b4
jmp 0x45d4dd
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x45d4c5
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4607f4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x30], 0
jne 0x460864
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
push eax
call sub.advapi32.dll_RegCloseKey_1
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x460868
push 0x80000006
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x460864
mov dword [ebp - 0x10], 4
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
add eax, 0x34
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x46087c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov esp, ebp
pop ebp
ret