joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426a43
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041d35c
and dword [ebp - 4], 0
cmp dword [0x432be4], 0
mov ebx, eax
jne 0x426af4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x426ba5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x42bcb0
push edi
call esi
test eax, eax
je 0x426ba5
push eax
call fcn.0041d2ea
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x432be4], eax
call esi
push eax
call fcn.0041d2ea
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x432be8], eax
call esi
push eax
call fcn.0041d2ea
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x432bec], eax
call esi
push eax
call fcn.0041d2ea
pop ecx
mov dword [0x432bf4], eax
test eax, eax
je 0x426af4
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041d2ea
pop ecx
mov dword [0x432bf0], eax
mov eax, dword [0x432bf0]
cmp eax, ebx
je 0x426b4c
cmp dword [0x432bf4], ebx
je 0x426b4c
push eax
call fcn.0041d365
push dword [0x432bf4]
mov esi, eax
call fcn.0041d365
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x426b4c
test edi, edi
je 0x426b4c
call esi
test eax, eax
je 0x426b43
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x426b43
test byte [ebp - 0xc], 1
jne 0x426b4c
or dword [ebp + 0x10], 0x200000
jmp 0x426b85
mov eax, dword [0x432be8]
cmp eax, ebx
je 0x426b85
push eax
call fcn.0041d365
pop ecx
test eax, eax
je 0x426b85
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x426b85
mov eax, dword [0x432bec]
cmp eax, ebx
je 0x426b85
push eax
call fcn.0041d365
pop ecx
test eax, eax
je 0x426b85
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x432be4]
call fcn.0041d365
pop ecx
test eax, eax
je 0x426ba5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x426ba7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404643
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x22c
mov eax, dword [0x473084]
xor eax, esp
mov dword [esp + 0x228], eax
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [edi + 4]
push ecx
push dword [edi]
xor esi, esi
or eax, 0x2001f
lea ebx, [esp + 0x18]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
call fcn.004048b3
mov ebx, eax
cmp ebx, esi
je 0x4046a5
cmp dword [esp + 0x10], esi
je 0x4046a1
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x40471b
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x4046c3
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x14]
call fcn.00404643
mov dword [esp + 0x24], eax
cmp eax, esi
jne 0x404732
lea eax, [esp + 0x28]
push eax
push esi
push esi
push esi
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x44]
push eax
push esi
push dword [esp + 0x2c]
mov dword [esp + 0x3c], 0x100
call ebx
test eax, eax
je 0x4046ad
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x10], esi
je 0x4046fe
push dword [esp + 0x10]
call ebx
mov dword [esp + 0x10], esi
push dword [esp + 0x20]
mov dword [esp + 0x18], esi
call fcn.004045d5
mov edi, eax
cmp dword [esp + 0x10], esi
je 0x404719
push dword [esp + 0x10]
call ebx
mov eax, edi
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041042f
mov esp, ebp
pop ebp
ret 4
cmp dword [esp + 0x10], esi
je 0x404742
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x24]
jmp 0x40471b
Function at 0x407280
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x45058e
call fcn.00449dcb
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
xor esi, esi
mov edi, edx
mov dword [ebp - 0x430], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], esi
mov dword [ebp - 0x418], esi
push 2
push esi
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x41c], eax
cmp eax, esi
jne 0x4072d8
call fcn.0040603a
mov esi, eax
jmp 0x4073e2
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, esi
jne 0x4072f1
call fcn.0040603a
jmp 0x4073d4
push edi
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x420], eax
cmp eax, esi
je 0x4072e7
push edi
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
lea eax, [edi + 1]
mov dword [ebp - 0x424], edi
cmp eax, edi
jae 0x40732e
mov esi, 0x8007000e
jmp 0x4073d6
xor ecx, ecx
shld ecx, eax, 1
add eax, eax
mov byte [ebp - 4], 2
cmp ecx, esi
ja 0x407343
cmp eax, 0xffffffff
jbe 0x40734d
push 0x80070216
call fcn.00404edf
cmp eax, 0x400
jbe 0x40737a
push eax
lea eax, [ebp - 0x418]
push eax
call fcn.004064db
jmp 0x407386
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
mov dword [ebp - 4], 1
cmp dword [ebp - 0x418], esi
je 0x407324
push edi
push dword [ebp - 0x418]
push edi
push dword [ebp - 0x420]
push esi
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, esi
je 0x4072e7
mov edx, dword [ebp - 0x418]
push dword [ebp + 0x10]
xor ecx, ecx
mov word [edx + eax*2], cx
mov ecx, dword [ebp - 0x418]
lea edx, [ebp - 0x42c]
call fcn.00407120
mov esi, eax
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x4073fb
lea eax, [ebp - 0x418]
call fcn.004064b0
mov eax, esi
call fcn.00449e27
ret 0xc

Function at 0x4075df
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [0x474108], 0
push ebx
push esi
push edi
mov esi, 0x474108
je 0x40768e
and dword [ebp - 4], 0
push 0x3310
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edx, dword [ebp - 4]
mov ecx, dword [esi]
sar edx, 2
and edx, 0x3f
mov edi, eax
lea edx, [edx + 0x4740c8]
mov al, byte [edx]
xor al, byte [ecx]
mov byte [edi], al
je 0x407634
mov ebx, edi
sub ebx, ecx
mov al, byte [edx]
inc ecx
xor al, byte [ecx]
mov byte [ebx + ecx], al
jne 0x40762a
fld qword [0x46d920]
fstp qword [ebp - 0x10]
fld qword [0x46d918]
fstp qword [ebp - 0x10]
fld qword [0x46d910]
fstp qword [ebp - 0x10]
fld qword [0x46d908]
fstp qword [ebp - 0x10]
fld qword [0x46d900]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
fld qword [ebp - 0x10]
fucompp
fnstsw ax
test ah, 0x44
jnp 0x40767c
fld qword [ebp - 0x10]
fsub qword [0x46d8f8]
fstp qword [ebp - 0x10]
add dword [ebp - 4], 4
mov dword [esi], edi
add esi, 4
cmp dword [esi], 0
jne 0x4075fe
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407693
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [0x474868], 0
push ebx
push esi
push edi
mov esi, 0x474868
je 0x407752
and dword [ebp - 4], 0
push 0x6620
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, dword [ebp - 4]
sar ecx, 2
and ecx, 0x3f
mov edi, eax
mov eax, dword [esi]
lea ecx, [ecx + 0x4740c8]
mov dl, byte [ecx]
xor dl, byte [eax]
movzx edx, dl
mov word [edi], dx
test dx, dx
je 0x4076f8
mov ebx, edi
sub ebx, eax
mov dl, byte [ecx]
add eax, 2
xor dl, byte [eax]
movzx edx, dl
mov word [ebx + eax], dx
test dx, dx
jne 0x4076e5
fld qword [0x46d920]
fstp qword [ebp - 0x10]
fld qword [0x46d918]
fstp qword [ebp - 0x10]
fld qword [0x46d910]
fstp qword [ebp - 0x10]
fld qword [0x46d908]
fstp qword [ebp - 0x10]
fld qword [0x46d900]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
fld qword [ebp - 0x10]
fucompp
fnstsw ax
test ah, 0x44
jnp 0x407740
fld qword [ebp - 0x10]
fsub qword [0x46d8f8]
fstp qword [ebp - 0x10]
add dword [ebp - 4], 4
mov dword [esi], edi
add esi, 4
cmp dword [esi], 0
jne 0x4076b2
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40a5f9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40a65d
cmp dword [ebp + 0xc], 1
je 0x40a635
cmp dword [ebp + 0xc], 2
je 0x40a635
push 0xd
pop eax
jmp 0x40a65d
mov eax, dword [ebp - 4]
test edi, edi
je 0x40a657
test eax, eax
je 0x40a652
test al, 1
jne 0x40a630
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x40a657
jmp 0x40a630
xor ecx, ecx
mov word [edi], cx
shr eax, 1
mov dword [esi], eax
xor eax, eax
leave
ret 8

Function at 0x410102
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x475100], 0
push esi
push edi
jne 0x410078
call fcn.0040ffe4
test eax, eax
je 0x4100bd
mov eax, dword [0x475100]
cmp eax, 1
jne 0x410099
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x4100bd
jmp 0x4100ff
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x4100ff
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x4100c1
xor eax, eax
jmp 0x4100ff
mov eax, dword [esi]
push dword [0x475100]
call edi
mov edi, eax
test edi, edi
je 0x4100e3
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x4100ff
lea edi, [esi + 0xff0]
push esi
push dword [0x475100]
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x4100e9
mov eax, esi
pop edi
pop esi
ret
jmp 0x410064

Function at 0x41042f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x473084]
jne 0x410439
repz ret
jmp fcn.004136c2
Function at 0x41ddcb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x473084]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004167c8
and dword [ebp - 0x14], 0
cmp dword [0x475f44], 0
mov dword [ebp - 0x18], eax
jne 0x41de7e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41df26
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x41df26
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x475f44], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x475f48], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x475f4c], eax
call edi
push eax
call esi
mov dword [0x475f54], eax
test eax, eax
je 0x41de7e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x475f50], eax
mov eax, dword [0x475f50]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41ded7
cmp dword [0x475f54], ecx
je 0x41ded7
push eax
call esi
push dword [0x475f54]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41ded7
test ebx, ebx
je 0x41ded7
call edi
test eax, eax
je 0x41dece
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41dece
test byte [ebp - 8], 1
jne 0x41ded7
or dword [ebp + 0x10], 0x200000
jmp 0x41df0a
mov eax, dword [0x475f48]
cmp eax, dword [ebp - 0x18]
je 0x41df0a
push eax
call esi
test eax, eax
je 0x41df0a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41df0a
mov eax, dword [0x475f4c]
cmp eax, dword [ebp - 0x18]
je 0x41df0a
push eax
call esi
test eax, eax
je 0x41df0a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x475f44]
call esi
test eax, eax
je 0x41df26
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41df28
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041042f
leave
ret
Function at 0x420429
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, edx
not eax
mov edx, 0xff
cmp edi, 8
jb 0x4204e5
mov esi, edi
shr esi, 3
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x453c70]
movzx ebx, byte [ecx + 1]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x453c70]
movzx ebx, byte [ecx + 2]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x453c70]
movzx ebx, byte [ecx + 3]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x453c70]
movzx ebx, byte [ecx + 4]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x453c70]
movzx ebx, byte [ecx + 5]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x453c70]
movzx ebx, byte [ecx + 6]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x453c70]
movzx ebx, byte [ecx + 7]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x453c70]
add ecx, 8
sub edi, 8
dec esi
jne 0x420449
fld qword [0x46d940]
fstp qword [ebp - 0x10]
fld qword [0x46d938]
fstp qword [ebp - 8]
fld qword [0x46d930]
fstp qword [ebp - 0x10]
fld qword [0x46d928]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x10]
fmul qword [ebp - 8]
fstp qword [ebp - 8]
test edi, edi
je 0x42052b
movzx esi, byte [ecx]
xor esi, eax
and esi, edx
shr eax, 8
xor eax, dword [esi*4 + 0x453c70]
inc ecx
dec edi
jne 0x420516
pop edi
pop esi
not eax
pop ebx
leave
ret
Function at 0x423536
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
fld qword [0x46d920]
mov dword [ebp - 0x38], 0xc
fstp qword [ebp - 0x24]
push esi
fld qword [0x46d918]
push edi
fstp qword [ebp - 0x2c]
fld qword [0x46d910]
fstp qword [ebp - 0x2c]
fld qword [0x46d908]
fstp qword [ebp - 0x2c]
fld qword [0x46d900]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fld qword [ebp - 0xc]
fucompp
fnstsw ax
fld qword [0x46d8f8]
test ah, 0x44
jnp 0x42358f
fld qword [ebp - 0xc]
fsub st(1)
fstp qword [ebp - 0x24]
fld qword [0x46da18]
mov dword [ebp - 0x30], 1
xor edi, edi
mov dword [ebp - 0x34], edi
fstp qword [ebp - 0x24]
fld qword [0x46da10]
mov dword [ebp - 8], ecx
fstp qword [ebp - 0x1c]
fld qword [0x46d9d0]
fstp qword [ebp - 0x2c]
fld qword [0x46da20]
fstp qword [ebp - 0x2c]
fld qword [0x46d9c8]
fstp qword [ebp - 0x2c]
fld qword [0x46d9c0]
fstp qword [ebp - 0x14]
fstp qword [ebp - 0x2c]
fld qword [0x46d9b8]
fstp qword [ebp - 0x2c]
fld qword [0x46d9b0]
fstp qword [ebp - 0x2c]
fld qword [ebp - 0x2c]
fadd qword [0x46d9a8]
fstp qword [ebp - 0x2c]
fld qword [ebp - 0x14]
fadd qword [0x46da08]
fadd qword [ebp - 0x1c]
fadd qword [0x46d9a0]
fstp qword [ebp - 0x2c]
fld qword [ebp - 0x1c]
fmul qword [0x46d998]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
fadd qword [0x46d990]
fsub qword [ebp - 0x24]
fstp qword [ebp - 0x24]
cmp word [ecx], di
je 0x423634
cmp word [ecx + 2], 0x3a
jne 0x423634
add ecx, 4
cmp word [ecx], 0x5c
jne 0x423688
add ecx, 2
jmp 0x423688
call fcn.00420238
mov esi, eax
cmp esi, edi
jne 0x423656
cmp dword [ebp + 8], edi
jne 0x42365b
xor eax, eax
inc eax
pop edi
pop esi
leave
ret
xor eax, eax
mov word [esi], ax
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x42367b
call fcn.00439592
call dword [eax + 0x48]
cmp eax, 0xb7
jne 0x42368f
cmp esi, edi
je 0x42364f
push 0x5c
pop eax
mov word [esi], ax
lea ecx, [esi + 2]
cmp word [ecx], di
jne 0x42363f
jmp 0x42364f
cmp esi, edi
je 0x423699
push 0x5c
pop eax
mov word [esi], ax
xor eax, eax
jmp 0x423652
Function at 0x436923
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
mov esi, eax
push edi
lea eax, [ebp - 8]
push eax
mov eax, esi
mov dword [ebp - 8], 0x25
call fcn.00408309
cmp eax, 0xffffffff
je 0x436a63
cmp dword [esi + 0x14], 8
jb 0x436953
mov eax, dword [esi]
jmp 0x436955
mov eax, esi
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0
push 0
push eax
call edi
mov ebx, eax
test ebx, ebx
je 0x436a44
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041033c
fld qword [0x46da18]
fstp qword [ebp - 0x20]
pop ecx
fld qword [0x46da10]
mov dword [ebp - 4], eax
fstp qword [ebp - 0x18]
fld qword [0x46d9d0]
fstp qword [ebp - 0x28]
fld qword [0x46da20]
fstp qword [ebp - 0x28]
fld qword [0x46d9c8]
fstp qword [ebp - 0x28]
fld qword [0x46d9c0]
fstp qword [ebp - 0x10]
fld qword [0x46d8f8]
fstp qword [ebp - 0x28]
fld qword [0x46d9b8]
fstp qword [ebp - 0x28]
fld qword [0x46d9b0]
fstp qword [ebp - 0x28]
fld qword [ebp - 0x28]
fadd qword [0x46d9a8]
fstp qword [ebp - 0x28]
fld qword [ebp - 0x10]
fadd qword [0x46da08]
fadd qword [ebp - 0x18]
fadd qword [0x46d9a0]
fstp qword [ebp - 0x28]
fld qword [ebp - 0x18]
fmul qword [0x46d998]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
fadd qword [0x46d990]
fsub qword [ebp - 0x20]
cmp dword [esi + 0x14], 8
fstp qword [ebp - 0x20]
jb 0x436a1b
mov eax, dword [esi]
jmp 0x436a1d
mov eax, esi
push ebx
push dword [ebp - 4]
push eax
call edi
test eax, eax
je 0x436a39
push dword [ebp - 4]
call fcn.00411ccf
pop ecx
mov ecx, dword [ebp - 4]
call fcn.00404d11
push dword [ebp - 4]
call fcn.00411acd
pop ecx
jmp 0x436a63
call fcn.00439592
call dword [eax + 0x48]
push eax
push dword [0x474250]
push dword [0x47422c]
push 1
call fcn.00438c8f
add esp, 0x10
pop edi
pop esi
pop ebx
leave
ret
Function at 0x439411
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 3
mov dword [ebp - 0x10], 0x51
mov dword [ebp - 4], 0x4b
mov dword [ebp - 0xc], 0x1c
mov eax, dword [ebp - 4]
add eax, 0x4d
mov dword [ebp - 0xc], eax
shl dword [ebp - 4], 1
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
imul ecx, eax
mov eax, dword [ebp - 8]
push esi
cdq
push 0x18
pop esi
idiv esi
push dword [ebp + 8]
sub ecx, eax
add ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
lea eax, [ecx + eax + 6]
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop esi
leave
ret 4

Function at 0x43bd38
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 4], 0x5c
mov dword [ebp - 0xc], 0x3a
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
imul eax, ecx
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
imul ecx, edx
add eax, ecx
mov ecx, dword [ebp - 0xc]
sub eax, ecx
add eax, 0x2b
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
sub eax, 0x25
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0xc]
push 0x50
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cdq
pop ecx
idiv ecx
mov ecx, dword [ebp - 4]
shl ecx, 5
sub ecx, eax
add ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
imul eax, ecx
sub eax, 0x58
mov dword [ebp - 4], eax
mov eax, 0x5a4d
cmp word [esi], ax
je 0x43bdb1
xor eax, eax
leave
ret
mov ecx, dword [esi + 0x3c]
cmp dword [ecx + esi], 0x4550
jne 0x43bdad
cmp dword [ecx + esi + 0x98], 0
je 0x43bdad
fld1
fst qword [ebp - 8]
fld qword [0x46d988]
fstp qword [ebp - 0x30]
fld qword [0x46d980]
fstp qword [ebp - 0x30]
fstp qword [ebp - 0x10]
fld qword [0x46d978]
fstp qword [ebp - 0x28]
fld qword [0x46d930]
fstp qword [ebp - 0x20]
fld qword [0x46d970]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x20]
fsub qword [0x46d968]
fstp qword [ebp - 0x30]
fld qword [ebp - 8]
fld qword [0x46d908]
fadd st(1), st(0)
fmul qword [ebp - 0x10]
fsubp st(1)
fadd qword [ebp - 8]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x18]
fadd qword [ebp - 0x10]
fld qword [ebp - 0x10]
fmul qword [ebp - 0x10]
fsubp st(1)
fstp qword [ebp - 8]
fld qword [ebp - 0x20]
fcomp qword [ebp - 8]
fnstsw ax
test ah, 1
jne 0x43be8c
fld qword [ebp - 8]
fsub qword [ebp - 0x10]
fstp qword [ebp - 8]
fld qword [ebp - 0x18]
fld qword [ebp - 0x20]
fmul qword [0x46d960]
fsubp st(1)
fsub qword [ebp - 0x28]
fsub qword [ebp - 0x18]
fadd qword [ebp - 0x28]
fadd qword [ebp - 0x10]
fsub qword [0x46da00]
fsub qword [ebp - 0x18]
fsub qword [ebp - 0x18]
fadd qword [0x46d958]
fadd qword [ebp - 0x18]
fstp qword [ebp - 0x30]
fld qword [ebp - 8]
fsub qword [0x46d950]
fsub qword [ebp - 0x18]
fadd qword [0x46d948]
fstp qword [ebp - 0x20]
mov eax, dword [ecx + esi + 0x98]
add eax, esi
leave
ret
Function at 0x401000
Capabilities:
Download and write a file
Receive and write data from server to client
Receive data
Receive data on socket
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0x4041f8
push dword [ebp + 0xc]
xor eax, eax
xor edi, edi
mov word [ebp - 4], ax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x401029
push 0xfffffffffffffff8
pop eax
jmp 0x401065
push ebx
jmp 0x401043
push 1
lea eax, [ebp - 4]
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
mov byte [ebp - 4], 0
add edi, ebx
push 0
push 1
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_recv]
mov ebx, eax
push esi
test ebx, ebx
jg 0x40102c
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
pop ecx
mov eax, edi
pop ebx
pop edi
pop esi
leave
ret

Function at 0x401069
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Reference http user-agent string
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4063c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push str.Mozilla_5.0
push esi
push eax
push str.GET___s_HTTP_1.1_r_nHost:__s_r_nUser_Agent:__s_r_nKeep_Alive:_300_r_nConnection:_keep_alive_r_n_r_n
lea eax, [ebp - 0x204]
push 0x1ff
push eax
call fcn.0040156f
push esi
call fcn.00402cd6
add esp, 0x1c
test eax, eax
jne 0x4010b9
push 0xfffffffffffffffc
pop eax
jmp 0x40114f
push edi
push 2
pop esi
push 0x50
mov dword [ebp - 0x210], eax
mov word [ebp - 0x214], si
call dword [sym.imp.WS2_32.dll_htons]
push 6
push 1
push esi
mov word [ebp - 0x212], ax
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4010ef
push 0xfffffffffffffffb
jmp 0x401106
push 0x10
lea eax, [ebp - 0x214]
push eax
push edi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x401109
push 0xfffffffffffffffa
pop eax
jmp 0x40114e
lea ecx, [ebp - 0x204]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401112
push 0
sub ecx, edx
lea eax, [ebp - 0x204]
push ecx
push eax
push edi
call dword [sym.imp.WS2_32.dll_send]
push str.C:_a.zip
push 3
push ebx
call fcn.0040156f
push ebx
push edi
call fcn.00401228
add esp, 0x14
mov esi, eax
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, esi
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004030c5
leave
ret