joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4089e8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, 0x416188
push ebp
mov ebp, edx
cmp dword [edi + 4], 0
mov esi, ecx
mov ebx, eax
jne 0x408a02
call fcn.004089b0
mov eax, ebp
jmp 0x408a1a
mov edx, ebx
xor ecx, ecx
xor dl, byte [eax]
dec esi
mov cl, dl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
inc eax
mov ebx, edx
test esi, esi
jbe 0x408a22
test al, 7
jne 0x408a06
cmp esi, 8
jb 0x408aab
xor ebx, dword [eax]
xor ecx, ecx
mov cl, bl
sub esi, 8
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
xor ebx, dword [eax + 4]
add eax, 8
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
cmp esi, 8
mov ebx, edx
jae 0x408a2b
xor edx, edx
jmp 0x408ac5
mov ecx, ebx
xor cl, byte [eax + edx]
and ecx, 0xff
shr ebx, 8
mov ecx, dword [edi + ecx*4]
xor ecx, ebx
mov ebx, ecx
inc edx
cmp esi, edx
ja 0x408aaf
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x409160
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
test ebx, ebx
je 0x409177
test esi, esi
jg 0x40917e
xor eax, eax
jmp 0x409230
mov edx, dword [ebp - 4]
add edx, 4
lea eax, [ebp - 0x2c]
mov ecx, 0x10
call fcn.0040f62c
test esi, esi
jns 0x409198
add esi, 0xf
sar esi, 4
mov dword [ebp - 8], esi
mov edx, dword [ebp - 8]
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0
jle 0x409217
lea ecx, [ebp - 0x1c]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004094ec
lea edx, [ebp - 0x2c]
mov eax, edx
mov ecx, dword [eax]
xor dword [ebp - 0x1c], ecx
mov ecx, dword [eax + 4]
xor dword [ebp - 0x18], ecx
mov ecx, dword [eax + 8]
xor dword [ebp - 0x14], ecx
mov eax, dword [eax + 0xc]
xor dword [ebp - 0x10], eax
mov eax, edx
mov edx, ebx
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov edx, dword [edx + 0xc]
mov dword [eax + 0xc], edx
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x1c]
mov dword [eax], edx
mov ecx, dword [ebp - 0x18]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 0x14]
mov dword [eax + 8], edx
mov ecx, dword [ebp - 0x10]
mov dword [eax + 0xc], ecx
add ebx, 0x10
add dword [ebp + 8], 0x10
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0
jg 0x4091aa
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 4]
add eax, 4
mov ecx, 0x10
call fcn.0040f62c
mov eax, dword [ebp - 8]
shl eax, 4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x409454
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov dword [esp], eax
mov esi, 1
xor eax, eax
xor ecx, ecx
mov edx, esi
mov ebx, ecx
shl edx, 4
add edx, dword [esp]
shl ebx, 2
add edx, ebx
xor ebx, ebx
add edx, 0x14
movzx edi, byte [edx + 1]
mov bl, byte [edx]
lea edi, [edi*4 + 0x418e4e]
lea ebx, [ebx*4 + 0x418a4e]
mov bl, byte [ebx + eax]
xor bl, byte [edi + eax]
movzx edi, byte [edx + 2]
movzx edx, byte [edx + 3]
lea edi, [edi*4 + 0x41924e]
lea edx, [edx*4 + 0x41964e]
xor bl, byte [edi + eax]
xor bl, byte [edx + eax]
lea edx, [esp + ecx*4 + 4]
mov byte [edx + eax], bl
inc ecx
cmp ecx, 4
jl 0x409466
inc eax
cmp eax, 4
jl 0x409464
mov eax, esi
lea edx, [esp + 4]
shl eax, 4
mov ecx, 0x10
add eax, dword [esp]
add eax, 0x14
call fcn.0040f62c
inc esi
cmp esi, 0xa
jl 0x409462
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x40a780
Capabilities:
Hash data using sha1

Disassembly:
mov dword [eax], 0x67452301
xor edx, edx
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x18], edx
mov dword [eax + 0x14], edx
ret
Function at 0x40dfb8
Capabilities:
Move file

Disassembly:
push ebx
push esi
push edi
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x40dfc1
mov eax, dword [esp + 0x2000]
add esp, 0xfffffb30
mov ebx, edx
mov esi, eax
lea edi, [esp + 0x10b4]
lea eax, [esp + 0xc14]
call fcn.00406440
lea eax, [esp + 0xc40]
call fcn.00406440
lea eax, [esp + 0xc6c]
call fcn.00406440
push 0
lea ecx, [esp + 4]
mov edx, ebx
mov eax, esi
call fcn.00405770
test al, al
jne 0x40e021
xor eax, eax
jmp 0x40e16e
cmp byte [esp], 0
je 0x40e031
cmp byte [esp + 0xc98], 0
jne 0x40e038
xor eax, eax
jmp 0x40e16e
mov eax, esp
call fcn.00405b80
lea edx, [esp + 0xc98]
call fcn.00406ba8
test eax, eax
je 0x40e066
mov eax, esi
call fcn.00405b80
lea edx, [esp + 0xc98]
call fcn.00406ba8
test eax, eax
je 0x40e06d
xor eax, eax
jmp 0x40e16e
xor ebx, ebx
mov eax, edi
mov ecx, 0x400
mov edx, esi
call fcn.0040f728
push ebx
push str.rtmp_d
mov eax, edi
call fcn.00405b80
push eax
call fcn.0040f810
add esp, 0xc
mov eax, edi
xor edx, edx
call fcn.00406a2c
test al, al
je 0x40e0ab
add ebx, 0x7b
cmp ebx, 0x2710
jl 0x40e06f
mov eax, edi
xor edx, edx
call fcn.00406a2c
test al, al
je 0x40e0bf
xor eax, eax
jmp 0x40e16e
lea eax, [esp + 0x14b4]
mov ecx, 0x400
mov edx, esi
call fcn.0040f728
mov eax, esp
call fcn.00405b80
push eax
lea eax, [esp + 0x14b8]
call fcn.00405b80
pop edx
call fcn.0040f718
push edi
lea ecx, [esp + 0x14b8]
push ecx
call sub.KERNEL32.DLL_MoveFileA
test eax, eax
jne 0x40e102
xor eax, eax
jmp 0x40e16e
lea eax, [esp + 0x18b4]
call fcn.0040e178
xor ebx, ebx
xor edx, edx
mov eax, esi
call fcn.00406a2c
test al, al
jne 0x40e12f
lea eax, [esp + 0x18b4]
xor ecx, ecx
mov edx, esi
call fcn.0040e364
mov ebx, eax
lea eax, [esp + 0x14b4]
push eax
push edi
call sub.KERNEL32.DLL_MoveFileA
test bl, bl
je 0x40e159
lea eax, [esp + 0x18b4]
call fcn.0040e468
lea eax, [esp + 0x18b4]
call fcn.0040e4f0
mov al, 1
push eax
lea eax, [esp + 0x18b8]
mov edx, 2
call fcn.0040e1cc
pop eax
add esp, 0x24d4
pop edi
pop esi
pop ebx
ret
Function at 0x40e214
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov ebx, eax
push edi
mov dword [ebp - 4], edx
xor edx, edx
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0xc18], edx
cmp byte [ebx + 0x16], 0
mov esi, ecx
je 0x40e237
mov al, 1
cmp byte [ebp + 8], 0
mov edi, 0x80000000
je 0x40e248
or edi, 0x40000000
mov dword [ebp - 8], 1
test al, al
je 0x40e257
or dword [ebp - 8], 2
cmp byte [ebx + 0x15], 0
je 0x40e261
xor eax, eax
jmp 0x40e266
mov eax, 0x8000000
mov dword [ebp - 0xc], eax
call fcn.00405314
test eax, eax
je 0x40e293
test esi, esi
je 0x40e293
cmp word [esi], 0
je 0x40e293
push 0
push dword [ebp - 0xc]
push 3
push 0
push dword [ebp - 8]
push edi
push esi
call sub.KERNEL32.DLL_CreateFileW
mov edi, eax
jmp 0x40e2aa
push 0
push dword [ebp - 0xc]
push 3
push 0
push dword [ebp - 8]
push edi
push dword [ebp - 4]
call sub.KERNEL32.DLL_CreateFileA
mov edi, eax
cmp edi, 0xffffffff
jne 0x40e2c3
call sub.KERNEL32.DLL_GetLastError
cmp eax, 2
jne 0x40e2c3
mov dword [ebx + 0xc18], 1
xor edx, edx
cmp edi, 0xffffffff
mov byte [ebx + 0x12], 0
setne cl
mov dword [ebx + 0xc], edx
and ecx, 1
mov byte [ebx + 0x10], 0
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x40e32d
mov dword [ebx + 4], edi
test esi, esi
je 0x40e2f8
lea eax, [ebx + 0x418]
mov edx, esi
call fcn.0040fef0
jmp 0x40e301
mov word [ebx + 0x418], 0
cmp dword [ebp - 4], 0
je 0x40e314
lea eax, [ebx + 0x17]
mov edx, dword [ebp - 4]
call fcn.0040f718
jmp 0x40e323
lea edx, [ebx + 0x17]
mov ecx, 0x10000000
mov eax, esi
call fcn.0040fcd0
mov edx, dword [ebx + 4]
mov eax, ebx
call fcn.0040e414
mov al, byte [ebp - 0xd]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40e520
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov esi, ecx
test esi, esi
mov edi, eax
mov dword [esp], edx
je 0x40e643
mov eax, dword [edi + 0xc]
test eax, eax
je 0x40e55b
dec eax
je 0x40e545
dec eax
je 0x40e551
jmp 0x40e55b
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
mov dword [edi + 4], eax
jmp 0x40e55b
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0x40e5ad
xor ebp, ebp
cmp esi, ebp
jle 0x40e5c9
push 0
lea eax, [esp + 8]
push eax
mov edx, esi
sub edx, ebp
cmp edx, 0x4000
jge 0x40e580
mov ecx, esi
sub ecx, ebp
jmp 0x40e585
mov ecx, 0x4000
push ecx
mov eax, dword [esp + 0xc]
add eax, ebp
push eax
push dword [edi + 4]
call sub.KERNEL32.DLL_WriteFile
test eax, eax
setne bl
and ebx, 1
test bl, bl
je 0x40e5c9
add ebp, 0x4000
cmp esi, ebp
jg 0x40e567
jmp 0x40e5c9
push 0
lea eax, [esp + 8]
push eax
push esi
push dword [esp + 0xc]
push dword [edi + 4]
call sub.KERNEL32.DLL_WriteFile
test eax, eax
setne bl
and ebx, 1
test bl, bl
jne 0x40e63f
cmp byte [edi + 0x14], 0
je 0x40e63f
cmp dword [edi + 0xc], 0
jne 0x40e63f
lea edx, [edi + 0x17]
mov eax, 0x41a4d4
call fcn.0040c708
test al, al
je 0x40e629
mov ecx, dword [esp + 4]
cmp ecx, esi
jae 0x40e55b
cmp dword [esp + 4], 0
jbe 0x40e55b
mov eax, edi
call fcn.0040e868
push edx
push eax
mov eax, dword [esp + 0xc]
xor edx, edx
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
push edx
push eax
xor edx, edx
mov eax, edi
call fcn.0040e7b0
jmp 0x40e55b
lea ecx, [edi + 0x17]
mov eax, 0x41a4d4
xor edx, edx
call fcn.0040c6f0
jmp 0x40e63f
mov byte [edi + 8], 1
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40e730
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, eax
push esi
push edi
push ecx
mov edi, edx
cmp dword [ebx + 0xc], 1
mov esi, ecx
jne 0x40e757
cmp esi, 0x4e20
jle 0x40e74d
mov esi, 0x4e20
push 0xfffffffffffffff6
call sub.KERNEL32.DLL_GetStdHandle
mov dword [ebx + 4], eax
push 0
lea eax, [esp + 4]
push eax
push esi
push edi
push dword [ebx + 4]
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x40e7a8
mov eax, ebx
call fcn.0040ea70
test al, al
je 0x40e78f
cmp esi, 0x4e20
jle 0x40e78f
mov ecx, 0x4e20
mov edx, edi
mov eax, ebx
call fcn.0040e730
jmp 0x40e7ab
cmp dword [ebx + 0xc], 1
jne 0x40e7a3
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x6d
jne 0x40e7a3
xor eax, eax
jmp 0x40e7ab
or eax, 0xffffffff
jmp 0x40e7ab
mov eax, dword [esp]
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40fc60
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp byte [0x414744], 0
jne 0x40fc79
call fcn.0040f8b4
mov dword [0x414740], eax
inc byte [0x414744]
call fcn.0040f8b4
sub eax, dword [0x414740]
cmp eax, 0x64
jle 0x40fcb5
cmp dword [0x4148c4], 0
je 0x40fcb0
mov eax, 0x41a4d4
mov edx, 0xff
call fcn.0040c8a4
mov eax, 0x41a4d4
mov edx, 0xff
call fcn.0040c89c
call fcn.004029bc
ret
Function at 0x100141b
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1054
call fcn.01001650
push ebx
push esi
xor ebx, ebx
xor esi, esi
call fcn.01001706
test al, al
je 0x1001447
push 0xc2000000
call fcn.010013e0
inc esi
jmp 0x10014cf
lea eax, [ebp - 1]
push eax
call fcn.01001844
cmp byte [ebp - 1], bl
je 0x10014be
push 0x10010e0
lea eax, [ebp - 0x1054]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 8]
push eax
push 0x20019
push ebx
push 0x1001190
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10014b0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1054]
push eax
push ebx
push ebx
push 0x1001188
push dword [ebp - 8]
mov dword [ebp - 0xc], 0x1048
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x1054]
push eax
call fcn.01001871
jmp 0x10014cf
push 1
push ebx
push ebx
push 0x1001138
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x1001706
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
lea eax, [ebp - 4]
push eax
push 1
xor ebx, ebx
push ebx
push 0x1001260
push 0x80000001
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1001766
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push 0x10012d8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100175d
cmp dword [ebp - 0xc], 4
jne 0x100175d
cmp dword [ebp - 0x10], ebx
je 0x100175d
mov bl, 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
leave
ret

Function at 0x10017b3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
lea eax, [ebp - 8]
push eax
xor ebx, ebx
push 1
push ebx
push 0x10012f8
push 0x80000001
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], 4
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1001822
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0x1001354
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1001819
cmp dword [ebp - 4], 4
je 0x1001812
cmp dword [ebp - 4], 3
jne 0x1001817
cmp dword [ebp - 0xc], ebx
je 0x1001819
mov bl, 1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
leave
ret

Function at 0x1001827
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
mov eax, dword [ebp - 4]
shr eax, 1
and al, 1
leave
ret
Function at 0x1001871
Capabilities:
Initialize iwebbrowser2

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push esi
push 2
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov esi, eax
test esi, esi
jl 0x100193a
lea eax, [ebp - 4]
push eax
push 0x10013a8
push 4
push 0
push 0x1001398
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
jl 0x1001934
push dword [ebp + 8]
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
and dword [ebp - 0x1c], 0
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x14]
push eax
mov word [ebp - 0x34], 8
mov word [ebp - 0x24], 3
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 0x14]
push edx
lea edx, [ebp - 0x14]
push edx
lea edx, [ebp - 0x14]
push edx
lea edx, [ebp - 0x24]
push edx
lea edx, [ebp - 0x34]
push edx
push eax
call dword [ecx + 0xd0]
mov esi, eax
test esi, esi
jl 0x100192b
mov eax, dword [ebp - 4]
and dword [ebp + 8], 0
mov ecx, dword [eax]
lea edx, [ebp + 8]
push edx
push eax
call dword [ecx + 0x94]
test eax, eax
jl 0x100191b
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0xa4]
mov esi, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, esi
pop esi
leave
ret 4
Function at 0x4040e0
Capabilities:
Get common file path
Get disk information
Get hostname
Manipulate console buffer
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1cc8
call fcn.0040f7a0
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [0x496588]
push ebx
push esi
mov dword [ebp - 8], ecx
mov ecx, dword [0x49658c]
mov dword [ebp - 0x18], eax
push edi
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x1c], ecx
call fcn.004040d0
mov ebx, dword [ebp - 0xc]
mov edx, dword [0x496590]
mov eax, dword [0x496594]
mov edi, dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
add ebx, 0x23f
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], 0x20
jmp 0x404150
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov esi, dword [ebp - 8]
mov eax, dword [0x49dd1c]
shl esi, 4
add esi, dword [ebp - 0x20]
cmp eax, 0xfa9
jne 0x40417c
mov dword [0x49dd18], 0xedeb2e40
jmp 0x404197
cmp eax, 0x3eb
jne 0x404197
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [0x49d7a8], 0
mov ecx, dword [ebp - 8]
add ecx, ebx
mov eax, dword [ebp - 8]
shr eax, 5
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x24]
add dword [ebp - 4], edx
xor esi, ecx
cmp dword [0x49dd1c], 0x9e6
mov dword [0x49dd14], 0xf4ea3dee
jne 0x4041cf
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommConfig]
xor dword [ebp - 4], esi
cmp dword [0x49dd1c], 0x213
jne 0x40426b
push 0
lea eax, [ebp - 0x14c8]
push eax
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrencyFormatW]
lea ecx, [ebp - 0x4c8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
lea edx, [ebp - 0x34]
push edx
lea eax, [ebp - 0xcc8]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0
call dword [sym.imp.KERNEL32.dll_ClearCommBreak]
push 0
push 0
push 0
call edi
push 0
push 0
lea ecx, [ebp - 0x1cc8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0
push 0
push 0
call edi
lea edx, [ebp - 0x2c]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
lea eax, [ebp - 0xc8]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea ecx, [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov esi, dword [ebp - 0x10]
sub esi, dword [ebp - 4]
cmp dword [0x49dd1c], 0xc
mov dword [ebp - 0x10], esi
jne 0x404285
push 0
call dword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov edx, esi
shr edx, 5
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
mov eax, esi
shl eax, 4
add eax, dword [ebp - 0x18]
lea ecx, [ebx + esi]
xor eax, ecx
xor eax, dword [ebp - 4]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
sub dword [ebp - 8], eax
add ebx, 0x61c88647
sub dword [ebp - 0x14], 1
jne 0x404150
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
pop edi
pop esi
mov dword [eax], edx
mov dword [eax + 4], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4042e0
Capabilities:
Connect pipe
Create process on windows
Create reverse shell
Read pipe
Set environment variable
Set thread local storage value
Write pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1408
call fcn.0040f7a0
mov eax, dword [0x49dd1c]
mov ecx, dword [0x49d7ac]
shr eax, 3
test eax, eax
jbe 0x4043fa
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTimeFormatA]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
mov edi, edi
cmp dword [0x49dd1c], 0x959
jne 0x4043e0
push 0
lea eax, [ebp - 0x408]
push eax
push 0
push 0
push 0
push 0
call ebx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenJobObjectA]
push 0
lea ecx, [ebp - 0xc08]
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CallNamedPipeA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0
push 0
push 0
push 0
push 0
push 0
call esi
push 0
push 0
push 0
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
lea edx, [ebp - 0x808]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0
push 0
push 0
push 0
push 0
push 0
call esi
push 0
lea eax, [ebp - 0x1408]
push eax
push 0
call edi
mov ecx, dword [ebp - 4]
push ecx
call fcn.004040e0
add dword [ebp - 4], 8
sub dword [ebp - 8], 1
jne 0x404320
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4058d0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4950d8]
jne 0x4058da
repz ret
jmp fcn.00408eae

Function at 0x408ad4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00407a3f
and dword [ebp - 4], 0
cmp dword [0x49b750], 0
mov ebx, eax
jne 0x408b85
push 0x401b10
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408c36
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401b04
push edi
call esi
test eax, eax
je 0x408c36
push eax
call fcn.004079cd
mov dword [esp], 0x401af4
push edi
mov dword [0x49b750], eax
call esi
push eax
call fcn.004079cd
mov dword [esp], 0x401ae0
push edi
mov dword [0x49b754], eax
call esi
push eax
call fcn.004079cd
mov dword [esp], 0x401ac4
push edi
mov dword [0x49b758], eax
call esi
push eax
call fcn.004079cd
pop ecx
mov dword [0x49b760], eax
test eax, eax
je 0x408b85
push 0x401aac
push edi
call esi
push eax
call fcn.004079cd
pop ecx
mov dword [0x49b75c], eax
mov eax, dword [0x49b75c]
cmp eax, ebx
je 0x408bdd
cmp dword [0x49b760], ebx
je 0x408bdd
push eax
call fcn.00407a48
push dword [0x49b760]
mov esi, eax
call fcn.00407a48
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x408bdd
test edi, edi
je 0x408bdd
call esi
test eax, eax
je 0x408bd4
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x408bd4
test byte [ebp - 0xc], 1
jne 0x408bdd
or dword [ebp + 0x10], 0x200000
jmp 0x408c16
mov eax, dword [0x49b754]
cmp eax, ebx
je 0x408c16
push eax
call fcn.00407a48
pop ecx
test eax, eax
je 0x408c16
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x408c16
mov eax, dword [0x49b758]
cmp eax, ebx
je 0x408c16
push eax
call fcn.00407a48
pop ecx
test eax, eax
je 0x408c16
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x49b750]
call fcn.00407a48
pop ecx
test eax, eax
je 0x408c36
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408c38
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401a50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401a69
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x401a7d
pop esi
pop edi
xor eax, eax
pop ebx
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x401a9e
cmp esi, eax
jae 0x401a77
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401a90
cmp esi, eax
jae 0x401a77
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret