joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4026e0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call fcn.00402530
add esp, 4
test eax, eax
js 0x4028cc
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [eax + 0xf0]
xor ebx, ebx
shl edi, 2
test edi, edi
jle 0x402754
lea esi, [eax + 8]
add eax, 8
lea esi, [esi + edi*4]
mov edx, dword [eax - 8]
lea eax, [eax + 0x10]
mov ecx, dword [esi - 8]
lea esi, [esi - 0x10]
mov dword [eax - 0x18], ecx
add ebx, 4
mov ecx, dword [esi + 0xc]
sub edi, 4
mov dword [esi + 8], edx
mov edx, dword [eax - 0x14]
mov dword [eax - 0x14], ecx
mov ecx, dword [esi + 0x10]
mov dword [esi + 0xc], edx
mov edx, dword [eax - 0x10]
mov dword [eax - 0x10], ecx
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x10], edx
mov edx, dword [eax - 0xc]
mov dword [eax - 0xc], ecx
mov dword [esi + 0x14], edx
cmp ebx, edi
jl 0x402714
mov ebx, dword [ebp + 8]
mov edi, 1
cmp dword [ebx + 0xf0], edi
jle 0x4028c7
lea esi, [ebx + 2]
jmp 0x402770
mov edx, dword [esi + 0xe]
lea esi, [esi + 0x10]
mov eax, edx
inc edi
shr eax, 0x18
movzx ecx, byte [eax*4 + 0x6040a0]
movzx eax, byte [esi - 1]
mov ecx, dword [ecx*4 + 0x6034a0]
movzx eax, byte [eax*4 + 0x6040a0]
xor ecx, dword [eax*4 + 0x602ca0]
movzx eax, dl
mov edx, dword [esi + 2]
movzx eax, byte [eax*4 + 0x6040a0]
xor ecx, dword [eax*4 + 0x6028a0]
movzx eax, byte [esi]
movzx eax, byte [eax*4 + 0x6040a0]
xor ecx, dword [eax*4 + 0x6030a0]
mov eax, edx
shr eax, 0x18
mov dword [esi - 2], ecx
movzx ecx, byte [eax*4 + 0x6040a0]
movzx eax, byte [esi + 3]
mov ecx, dword [ecx*4 + 0x6034a0]
movzx eax, byte [eax*4 + 0x6040a0]
xor ecx, dword [eax*4 + 0x602ca0]
movzx eax, byte [esi + 4]
movzx eax, byte [eax*4 + 0x6040a0]
xor ecx, dword [eax*4 + 0x6030a0]
movzx eax, dl
mov edx, dword [esi + 6]
movzx eax, byte [eax*4 + 0x6040a0]
xor ecx, dword [eax*4 + 0x6028a0]
mov eax, edx
shr eax, 0x18
mov dword [esi + 2], ecx
movzx ecx, byte [eax*4 + 0x6040a0]
movzx eax, byte [esi + 7]
mov ecx, dword [ecx*4 + 0x6034a0]
movzx eax, byte [eax*4 + 0x6040a0]
xor ecx, dword [eax*4 + 0x602ca0]
movzx eax, byte [esi + 8]
movzx eax, byte [eax*4 + 0x6040a0]
xor ecx, dword [eax*4 + 0x6030a0]
movzx eax, dl
mov edx, dword [esi + 0xa]
movzx eax, byte [eax*4 + 0x6040a0]
xor ecx, dword [eax*4 + 0x6028a0]
mov eax, edx
shr eax, 0x18
mov dword [esi + 6], ecx
movzx ecx, byte [eax*4 + 0x6040a0]
movzx eax, byte [esi + 0xb]
mov ecx, dword [ecx*4 + 0x6034a0]
movzx eax, byte [eax*4 + 0x6040a0]
xor ecx, dword [eax*4 + 0x602ca0]
movzx eax, byte [esi + 0xc]
movzx eax, byte [eax*4 + 0x6040a0]
xor ecx, dword [eax*4 + 0x6030a0]
movzx eax, dl
movzx eax, byte [eax*4 + 0x6040a0]
xor ecx, dword [eax*4 + 0x6028a0]
mov dword [esi + 0xa], ecx
cmp edi, dword [ebx + 0xf0]
jl 0x402770
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x403990
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b394a
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x630490]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x18], esi
call fcn.005993e8
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x403a36
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], str.bad_locale_name
push eax
lea ecx, [ebp - 0x24]
call fcn.0057797e
push 0x62abb4
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], vtable.std::runtime_error.0
push eax
call fcn.0057cdb5
push edi
push esi
call fcn.0059967e
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005778cb
mov esp, ebp
pop ebp
ret 4

Function at 0x403fd0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5b39d8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x630490]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
sub esp, 0x18
mov ecx, esp
push 0xffffffffffffffff
push 0
push dword [ebp + 0x10]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
call fcn.004047d0
push dword [ebp + 0xc]
lea eax, [esp + 0x28]
push dword [ebp + 8]
push eax
call fcn.00403f00
add esp, 0x24
mov dword [esp + 0x30], 0
cmp dword [eax + 0x14], 0x10
jb 0x404041
mov eax, dword [eax]
mov dword [esp + 8], eax
mov ecx, esi
lea eax, [esp + 8]
push eax
call fcn.0057797e
cmp dword [esp + 0x20], 0x10
mov dword [esi], vtable.std::runtime_error.0
jb 0x40406a
push dword [esp + 0xc]
call fcn.0044f9f1
add esp, 4
mov eax, dword [ebp + 8]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x10], eax
mov eax, esi
mov dword [esi], vtable.std::_System_error.0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x406020
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5b3bb8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x630490]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov eax, dword [0x630490]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
lea edx, [edi + 0x10]
lea ecx, [esp + 0x18]
call fcn.00425080
mov dword [esp + 0x40], 0
mov eax, dword [esp + 0x28]
add eax, 0xa
mov dword [edi], eax
add eax, 4
push eax
call fcn.0044f9e8
mov esi, eax
mov dword [esp + 0x14], 0xe
mov eax, dword [edi]
sub esp, 0x14
mov ecx, esp
mov dword [esi], eax
movzx eax, byte [edi + 4]
mov byte [esi + 4], al
movzx eax, byte [edi + 5]
mov byte [esi + 5], al
mov eax, dword [edi + 8]
mov dword [esi + 6], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xa], eax
lea eax, [esp + 0x30]
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.004047d0
lea eax, [esp + 0x28]
mov ecx, esi
push eax
call fcn.00405f80
mov ecx, dword [edi]
add esp, 0x1c
add ecx, 4
mov dword [ebx], esi
cmp dword [esp + 0x2c], 0x10
mov dword [ebx + 4], ecx
jb 0x4060fa
push dword [esp + 0x18]
call fcn.0044f9f1
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.005778cb
mov esp, ebp
pop ebp
ret 4

Function at 0x4071d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b3d88
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x630490]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
call fcn.00599d92
mov esi, dword [ebp + 8]
lea ecx, [edi + 0x28]
mov dword [ebp - 4], 0
mov dword [edi], vtable.std::_LaunchPad_class_std::_Bind_1__void__void____cdecl__const__struct_AgentPack::CreateAgentAppLinkPack___struct_AgentPack::CreateAgentAppLinkPack__.0
push 0xffffffffffffffff
mov eax, dword [esi]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 4]
mov dword [edi + 0x14], eax
movzx eax, byte [esi + 8]
mov byte [edi + 0x18], al
movzx eax, byte [esi + 9]
mov byte [edi + 0x19], al
mov eax, dword [esi + 0xc]
mov dword [edi + 0x1c], eax
movzx eax, byte [esi + 0x10]
mov byte [edi + 0x20], al
mov eax, dword [esi + 0x14]
mov dword [edi + 0x24], eax
lea eax, [esi + 0x18]
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.004047d0
mov ax, word [esi + 0x30]
mov word [edi + 0x40], ax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x40bbd0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5b453b
mov eax, dword fs:[0]
push eax
sub esp, 0x1a8
mov eax, dword [0x630490]
xor eax, esp
mov dword [esp + 0x1a0], eax
push ebx
push esi
push edi
mov eax, dword [0x630490]
xor eax, esp
push eax
lea eax, [esp + 0x1b8]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.0046595b
push 0
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_GetSystemMenu]
push eax
call fcn.0046a2a4
mov edi, eax
mov dword [esp + 0x14], edi
test edi, edi
je 0x40bcd3
call fcn.004668b8
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x40bc52
push 0x80004005
call fcn.0040cf30
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [esp + 0x18], esi
push 0x65
mov dword [esp + 0x1c4], 0
call fcn.00469bae
test eax, eax
je 0x40bc86
push 0x65
push eax
lea ecx, [esp + 0x20]
call fcn.0040c8c0
mov esi, dword [esp + 0x18]
cmp dword [esi - 0xc], 0
je 0x40bcae
push 0
push 0
push 0x800
push dword [edi + 4]
mov edi, dword [sym.imp.USER32.dll_AppendMenuW]
call edi
mov eax, dword [esp + 0x14]
push esi
push 0x10
push 0
push dword [eax + 4]
call edi
add esi, 0xfffffff0
mov dword [esp + 0x1c0], 0xffffffff
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40bcd3
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx + 0xbc]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 1
push 0x80
push dword [ebx + 0x20]
call esi
push dword [ebx + 0xbc]
push 0
push 0x80
push dword [ebx + 0x20]
call esi
lea eax, [esp + 0x1c]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ecx, ebx
call fcn.0040ba90
mov eax, 1
mov ecx, dword [esp + 0x1b8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1a0]
xor ecx, esp
call fcn.005778cb
mov esp, ebp
pop ebp
ret

Function at 0x40c550
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
movzx eax, ax
mov dword [ebp + 8], eax
pop ebp
jmp fcn.00465263

Function at 0x40c790
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40c7a5
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40c7e4
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x40c7e0
lea ebx, [ebx]
cmp esi, edx
jae 0x40c7e4
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x40c7d0
cmp esi, edx
jb 0x40c7e9
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret
Function at 0x40f640
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b49fb
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x630490]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea edx, [edi + 0x30]
mov byte [edi + 0x1c], 0
mov dword [edx + 0x14], 0xf
mov dword [edx + 0x10], 0
mov byte [edx], 0
mov dword [ebp - 4], 0
mov esi, dword [ebp + 8]
mov ecx, esi
mov dword [ebp + 8], 0x2c
mov eax, dword [esi]
mov dword [edi], eax
movzx eax, byte [esi + 4]
mov byte [edi + 4], al
movzx eax, byte [esi + 5]
mov byte [edi + 5], al
movzx eax, word [esi + 6]
mov word [edi + 6], ax
movzx eax, word [esi + 8]
mov word [edi + 8], ax
movzx eax, word [esi + 0xa]
mov word [edi + 0xa], ax
movzx eax, word [esi + 0xc]
mov word [edi + 0xc], ax
movzx eax, word [esi + 0xe]
mov word [edi + 0xe], ax
movzx eax, word [esi + 0x10]
mov word [edi + 0x10], ax
movzx eax, word [esi + 0x12]
mov word [edi + 0x12], ax
movzx eax, word [esi + 0x14]
mov word [edi + 0x14], ax
movzx eax, word [esi + 0x16]
mov word [edi + 0x16], ax
movzx eax, word [esi + 0x18]
mov word [edi + 0x18], ax
movzx eax, word [esi + 0x1a]
mov word [edi + 0x1a], ax
movzx eax, byte [esi + 0x1c]
mov byte [edi + 0x1c], al
mov eax, dword [esi + 0x1d]
mov dword [edi + 0x20], eax
mov eax, dword [esi + 0x21]
mov dword [edi + 0x24], eax
movzx eax, byte [esi + 0x25]
mov byte [edi + 0x28], al
movzx eax, byte [esi + 0x26]
mov byte [edi + 0x29], al
movzx eax, byte [esi + 0x27]
mov byte [edi + 0x2a], al
mov eax, dword [esi + 0x28]
push eax
mov dword [edi + 0x2c], eax
lea eax, [ebp + 8]
push edx
push eax
call fcn.004082d0
mov ecx, dword [ebp + 8]
add esp, 0xc
mov eax, dword [ecx + esi]
mov dword [edi + 0x48], eax
movzx eax, word [ecx + esi + 4]
mov word [edi + 0x4c], ax
movzx eax, byte [ecx + esi + 6]
mov byte [edi + 0x4e], al
mov eax, dword [ecx + esi + 7]
mov dword [edi + 0x50], eax
mov eax, dword [ecx + esi + 0xb]
mov dword [edi + 0x54], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x418f80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5b5738
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x630490]
xor eax, esp
mov dword [esp + 0x50], eax
push esi
mov eax, dword [0x630490]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x40]
mov dword [esp + 0xc], 0
call fcn.004444f0
push str.pro.nlp
lea edx, [esp + 0x44]
mov dword [esp + 0x6c], 0
lea ecx, [esp + 0x2c]
call fcn.004099a0
add esp, 4
mov byte [esp + 0x68], 1
lea edx, [esp + 0x28]
cmp dword [esp + 0x3c], 0x10
lea ecx, [esp + 0x10]
cmovae edx, dword [esp + 0x28]
call fcn.00430700
mov byte [esp + 0x68], 2
lea ecx, [esp + 0x10]
cmp dword [esp + 0x24], 0x10
mov edx, 0x602695
push 0
cmovae ecx, dword [esp + 0x14]
call fcn.00405ee0
add esp, 4
test eax, eax
jne 0x41904d
cmp dword [esp + 0x20], eax
setne al
test eax, eax
jne 0x41904d
push eax
mov dword [esi + 0x14], 0xf
mov ecx, esi
mov dword [esi + 0x10], eax
push 0x602695
mov byte [esi], al
call fcn.00404c00
jmp 0x419085
cmp dword [esp + 0x24], 0x10
lea eax, [esp + 0x10]
cmovae eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x419079
test al, 0x10
je 0x419079
lea eax, [esp + 0x10]
mov ecx, esi
push eax
call fcn.004044f0
jmp 0x419085
push 0x602695
mov ecx, esi
call fcn.00404490
cmp dword [esp + 0x24], 0x10
jb 0x419098
push dword [esp + 0x10]
call fcn.0044f9f1
add esp, 4
cmp dword [esp + 0x3c], 0x10
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
jb 0x4190c0
push dword [esp + 0x28]
call fcn.0044f9f1
add esp, 4
cmp dword [esp + 0x54], 0x10
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], 0
mov byte [esp + 0x28], 0
jb 0x4190e8
push dword [esp + 0x40]
call fcn.0044f9f1
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.005778cb
mov esp, ebp
pop ebp
ret
Function at 0x41a9c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b5a78
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x630490]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0
call fcn.00445060
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
test eax, 0xfffffffc
jne 0x41aa50
test ecx, ecx
je 0x41aa37
push ecx
call fcn.0044f9f1
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005778cb
mov esp, ebp
pop ebp
ret
cmp dword [0x6316dc], 1
jne 0x41aa5e
call fcn.0041a120
cmp dword [0x6402e0], 0
je 0x41aa6c
call fcn.00418a20
push 0
call fcn.00578f42
int3
Function at 0x41d5a0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b5f99
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x630490]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
push 0
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
push 0x602695
mov dword [ebp - 0x1c], esi
mov byte [esi], 0
call fcn.00404c00
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0
push eax
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [ebp - 0x14], 2
jl 0x41d671
mov edx, dword [eax + 4]
lea ecx, [ebp - 0x34]
call fcn.004257a0
mov edi, eax
cmp esi, edi
je 0x41d660
cmp dword [esi + 0x14], 0x10
jb 0x41d647
push dword [esi]
call fcn.0044f9f1
add esp, 4
mov dword [esi + 0x14], 0xf
mov ecx, esi
mov dword [esi + 0x10], 0
push edi
mov byte [esi], 0
call fcn.004045c0
cmp dword [ebp - 0x20], 0x10
jb 0x41d671
push dword [ebp - 0x34]
call fcn.0044f9f1
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005778cb
mov esp, ebp
pop ebp
ret
Function at 0x41ff40
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [ecx + 0x130]
sub eax, dword [ecx + 0x134]
cmp eax, 0x28
jge 0x41ff66
cmp byte [ecx + 0x61], 0
jne 0x41ff66
cmp byte [ecx + 0x60], 0
je 0x41ff66
mov byte [ecx + 0x60], 0
jmp fcn.0044a2b0
ret
Function at 0x4247c0
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b6672
mov eax, dword fs:[0]
push eax
sub esp, 0x14c
mov eax, dword [0x630490]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x154], 0
push 0
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
push 0x602695
mov dword [ebp - 0x158], esi
mov byte [esi], 0
call fcn.00404c00
lea eax, [ebp - 0x34]
mov dword [ebp - 4], 0
push eax
mov dword [ebp - 0x154], 1
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x18
push str.unknown_OperatingSystem.
mov ecx, esi
mov dword [ebp - 0x150], 0x11c
call fcn.00404c00
lea eax, [ebp - 0x150]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x424986
mov eax, dword [ebp - 0x14c]
sub eax, 4
je 0x424941
dec eax
je 0x4248e4
dec eax
jne 0x424986
mov eax, dword [ebp - 0x148]
sub eax, 0
je 0x4248c8
dec eax
je 0x4248ac
dec eax
jne 0x424986
cmp byte [ebp - 0x36], 1
jne 0x424986
push str.Microsoft_Windows_10
jmp 0x42497f
cmp byte [ebp - 0x36], 1
mov ecx, esi
jne 0x4248be
push str.Microsoft_Windows_7
jmp 0x424981
push str.Microsoft_Windows_Server_2008_R2
jmp 0x424981
cmp byte [ebp - 0x36], 1
mov ecx, esi
jne 0x4248da
push str.Microsoft_Windows_Vista
jmp 0x424981
push str.Microsoft_Windows_Server_2008
jmp 0x424981
mov eax, dword [ebp - 0x148]
sub eax, 0
je 0x42493a
dec eax
je 0x424933
dec eax
jne 0x424986
cmp byte [ebp - 0x36], 1
jne 0x42490d
cmp word [ebp - 0x34], 9
jne 0x42490d
push str.Microsoft_Windows_XP_Professional_x64_Edition
jmp 0x42497f
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x424920
push str.Microsoft_Windows_Server_2003
jmp 0x42497f
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x424986
push str.Microsoft_Windows_Server_2003_R2
jmp 0x42497f
push str.Microsoft_Windows_XP
jmp 0x42497f
push str.Microsoft_Windows_2000
jmp 0x42497f
mov eax, dword [ebp - 0x148]
test eax, eax
je 0x424963
cmp eax, 0xa
je 0x42495c
cmp eax, 0x5a
jne 0x424986
push str.Microsoft_Windows_Me
jmp 0x42497f
push str.Microsoft_Windows_98
jmp 0x42497f
mov eax, dword [ebp - 0x140]
cmp eax, 2
jne 0x424975
push str.Microsoft_Windows_NT_4.0
jmp 0x42497f
cmp eax, 1
jne 0x424986
push str.Microsoft_Windows_95
mov ecx, esi
call fcn.00405a30
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005778cb
mov esp, ebp
pop ebp
ret
Function at 0x424d20
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push edi
xor edi, edi
mov dword [ebp - 0x14], edx
cmp byte [ecx], 0
je 0x424e5d
push esi
lea esi, [ecx + 2]
mov dword [ebp - 4], esi
push ebx
lea ecx, [ecx]
mov bl, byte [esi - 2]
xor al, al
mov dword [ebp - 8], 0xffffffff
mov esi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov dl, byte [ebp - 8]
cmp byte [esi], bl
lea esi, [esi + 1]
movzx ecx, al
movzx edx, dl
cmove edx, ecx
inc al
cmp al, 0x40
jb 0x424d54
mov eax, dword [ebp - 4]
xor bl, bl
mov cl, byte [ebp - 7]
mov esi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov dword [ebp - 0x10], edx
mov bh, byte [eax - 1]
jmp 0x424d80
cmp byte [esi], bh
lea esi, [esi + 1]
movzx eax, bl
movzx ecx, cl
cmove ecx, eax
inc bl
cmp bl, 0x40
jb 0x424d80
mov eax, dword [ebp - 4]
mov esi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov bl, byte [ebp - 6]
mov dword [ebp - 0xc], ecx
xor cl, cl
mov ch, byte [eax]
cmp byte [esi], ch
lea esi, [esi + 1]
movzx eax, cl
movzx ebx, bl
cmove ebx, eax
inc cl
cmp cl, 0x40
jb 0x424da7
mov esi, dword [ebp - 4]
xor cl, cl
mov dl, byte [ebp - 5]
mov ch, byte [esi + 1]
mov esi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
lea esp, [esp]
cmp byte [esi], ch
lea esi, [esi + 1]
movzx eax, cl
movzx edx, dl
cmove edx, eax
inc cl
cmp cl, 0x40
jb 0x424dd0
mov ecx, dword [ebp - 0xc]
mov al, cl
mov esi, dword [ebp - 4]
mov dword [ebp - 8], edx
mov edx, dword [ebp - 0x10]
shr al, 4
shl dl, 2
and al, 3
or al, dl
mov edx, dword [ebp - 0x14]
mov byte [edi + edx], al
cmp byte [esi], 0x3d
je 0x424e53
mov al, bl
shl cl, 4
shr al, 2
and al, 0xf
or al, cl
mov byte [edi + edx + 1], al
cmp byte [esi + 1], 0x3d
je 0x424e49
mov ecx, dword [ebp - 8]
add esi, 4
and cl, 0x3f
shl bl, 6
or cl, bl
mov dword [ebp - 4], esi
mov byte [edi + edx + 2], cl
add edi, 3
cmp byte [esi - 2], 0
jne 0x424d40
pop ebx
pop esi
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
pop ebx
pop esi
lea eax, [edi + 2]
pop edi
mov esp, ebp
pop ebp
ret
pop ebx
pop esi
lea eax, [edi + 1]
pop edi
mov esp, ebp
pop ebp
ret
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x429fb0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b6b90
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x630490]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push 0
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
push 0x602695
mov byte [esi], 0
call fcn.00404c00
lea ecx, [esi + 0x18]
mov dword [ebp - 4], 0
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push 0x602695
mov byte [ecx], 0
call fcn.00404c00
mov byte [ebp - 4], 1
lea ecx, [esi + 0x40]
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push 0x602695
mov byte [ecx], 0
call fcn.00404c00
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 2
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push 0x602695
mov byte [ecx], 0
call fcn.00404c00
lea ecx, [esi + 0x70]
mov byte [ebp - 4], 3
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push 0x602695
mov byte [ecx], 0
call fcn.00404c00
lea ecx, [esi + 0x88]
mov byte [ebp - 4], 4
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push 0x602695
mov byte [ecx], 0
call fcn.00404c00
lea ecx, [esi + 0xa0]
mov byte [ebp - 4], 5
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push 0x602695
mov byte [ecx], 0
call fcn.00404c00
lea ecx, [esi + 0xb8]
mov byte [ebp - 4], 6
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push 0x602695
mov byte [ecx], 0
call fcn.00404c00
mov word [esi + 0xd0], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret