joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406cd4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x74
push ebx
push esi
mov esi, ecx
lea eax, [esp + 8]
lea ecx, [esp + 8]
lea edx, [esp + 8]
sub eax, ecx
mov cl, 0x33
lea eax, [esp + 8]
mov byte [esp + 0x1d], cl
add eax, edx
mov byte [esp + 0x1f], cl
mov al, 0x2d
mov byte [esp + 0x2d], cl
mov byte [esp + 0x21], al
mov byte [esp + 0x26], al
mov byte [esp + 0x2b], al
mov byte [esp + 0x30], al
mov dl, 0x42
mov bl, 0x37
lea ecx, [esp + 8]
lea eax, [esp + 8]
push edi
mov byte [esp + 0x1e], dl
mov byte [esp + 0x24], dl
mov byte [esp + 0x28], bl
mov byte [esp + 0x29], bl
mov byte [esp + 0x30], dl
add ecx, eax
lea edi, [esp + 0xc]
mov bl, 0x34
mov dl, 0x46
xor eax, eax
cmp ecx, edi
mov dword [esi], 0x429080
mov byte [esp + 0x1c], 0x7b
mov byte [esp + 0x1d], 0x41
mov byte [esp + 0x1f], 0x38
mov byte [esp + 0x20], 0x44
mov byte [esp + 0x22], 0x39
mov byte [esp + 0x26], 0x39
mov byte [esp + 0x27], 0x31
mov byte [esp + 0x2b], bl
mov byte [esp + 0x2c], bl
mov byte [esp + 0x2d], 0x30
mov byte [esp + 0x2e], 0x64
mov byte [esp + 0x32], dl
mov byte [esp + 0x33], 0x38
jne 0x406dc9
push ebp
mov edi, 1
mov dword [esp + 0x18], eax
lea ebp, [esp + 0x18]
test eax, eax
je 0x406da5
lea ecx, [esp + 0x10]
dec ecx
mov bl, byte [ecx + edi]
cmp bl, byte [ecx + eax]
je 0x406da5
mov eax, dword [esp + eax*4 + 0x14]
jmp 0x406dc3
inc edi
add ebp, 4
lea ecx, [esp + 0x10]
inc eax
dec ecx
mov bl, byte [ecx + edi]
cmp bl, byte [ecx + eax]
je 0x406dbc
mov dword [ebp], eax
jmp 0x406dc3
mov ecx, dword [esp + eax*4 + 0x14]
mov dword [ebp], ecx
cmp edi, 0xa
jl 0x406d8e
pop ebp
mov byte [esp + 0x38], dl
mov byte [esp + 0x3c], dl
lea edx, [esp + 0x1c]
mov al, 0x43
xor ebx, ebx
push edx
mov byte [esp + 0x3a], al
mov byte [esp + 0x3f], al
mov eax, dword [0x42f190]
push ebx
push 1
push ebx
mov byte [esp + 0x45], 0x31
mov byte [esp + 0x47], 0x31
mov byte [esp + 0x49], 0x45
mov byte [esp + 0x4a], 0x30
mov byte [esp + 0x4d], 0x39
mov byte [esp + 0x4e], 0x36
mov byte [esp + 0x4f], 0x39
mov byte [esp + 0x50], 0x32
mov byte [esp + 0x51], 0x7d
mov byte [esp + 0x52], bl
call dword [eax + 0x68]
mov dword [esi + 4], eax
mov ecx, dword [0x42f190]
call dword [ecx + 0xd0]
cmp dword [esi + 4], ebx
je 0x406e4a
cmp eax, 0xb7
jne 0x406e4a
mov dword [esi + 8], 1
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x74
ret
mov dword [esi + 8], ebx
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x74
ret
Function at 0x40ac20
Capabilities:
Hash data with md5

Disassembly:
lea eax, [esp - 0xdc]
lea ecx, [esp - 0xdc]
sub eax, ecx
lea edx, [esp - 0xdc]
sub esp, 0xdc
cmp eax, edx
jne 0x40adf2
push ebx
push esi
push edi
mov ebx, 1
lea esi, [esp + 0x10]
cmp ebx, 0xa
jge 0x40ac72
mov edi, 0xa
lea eax, [esi + 4]
sub edi, ebx
mov ecx, dword [esi]
mov edx, dword [eax]
cmp ecx, edx
jle 0x40ac6c
mov dword [eax], ecx
mov dword [esi], edx
add eax, 4
dec edi
jne 0x40ac60
inc ebx
add esi, 4
cmp ebx, 0xb
jl 0x40ac51
mov esi, 1
mov ecx, 2
mov eax, esi
cdq
idiv ecx
test edx, edx
jne 0x40ac94
inc ecx
cmp ecx, 0x32
jl 0x40ac85
cmp esi, ecx
je 0x40ac9e
inc esi
cmp esi, 0x64
jle 0x40ac80
mov ecx, 0xa
mov eax, 3
lea edi, [esp + 0x10]
mov ebx, 1
rep stosd dword es:[edi], eax
lea esi, [esp + 0x10]
cmp ebx, 0xa
jge 0x40acd8
mov edi, 0xa
lea eax, [esi + 4]
sub edi, ebx
mov ecx, dword [esi]
mov edx, dword [eax]
cmp ecx, edx
jle 0x40acd2
mov dword [eax], ecx
mov dword [esi], edx
add eax, 4
dec edi
jne 0x40acc6
inc ebx
add esi, 4
lea eax, [ebx - 1]
cmp eax, 0xa
jl 0x40acb7
xor ecx, ecx
xor edx, edx
cmp byte [ecx], 0
je 0x40acf5
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x40aced
mov al, byte [edx]
test al, al
je 0x40ad06
mov byte [ecx], al
mov al, byte [edx + 1]
inc ecx
inc edx
test al, al
jne 0x40acfb
xor eax, eax
lea ecx, [esp + 0x20]
inc eax
mov dword [ecx], eax
add ecx, 4
cmp eax, 0xa
jl 0x40ad0c
xor ecx, ecx
xor eax, eax
mov edx, 0xa
mov esi, dword [esp + eax*4 + 0x20]
test esi, esi
je 0x40ad29
inc ecx
cmp ecx, 3
jne 0x40ad39
dec edx
mov dword [esp + eax*4 + 0x20], 0
xor ecx, ecx
inc eax
cmp eax, 0xa
jne 0x40ad41
xor eax, eax
cmp edx, 1
jg 0x40ad20
mov al, byte [esp + 0xc]
test al, al
je 0x40ad81
lea esi, [esp + 0xd]
lea edi, [esp + 0xd]
xor ecx, ecx
mov al, byte [esp + ecx + 0xc]
test al, al
je 0x40ad81
mov dl, byte [esp + ecx + 0xc]
cmp dl, al
jg 0x40ad81
jl 0x40ad81
jne 0x40ad76
cmp byte [esi], 0
jne 0x40ad76
cmp byte [edi], 0
jne 0x40ad81
mov al, byte [esp + ecx + 0xd]
inc esi
inc ecx
inc edi
test al, al
jne 0x40ad58
mov ebx, dword [esp + 0xc]
push ebp
mov edi, 1
mov ecx, 1
xor ebp, ebp
cmp edi, ecx
jle 0x40adb0
lea esi, [esp + ebx*4 + 0x14]
mov eax, edi
cdq
idiv ecx
test edx, edx
jne 0x40adab
add ebp, ecx
mov dword [esi], ecx
inc ebx
add esi, 4
inc ecx
cmp ecx, edi
jl 0x40ad9a
xor ebx, ebx
inc edi
cmp edi, 0x3e8
jle 0x40ad8b
mov ebx, 1
lea esi, [esp + 0x14]
pop ebp
cmp ebx, 0xa
jge 0x40ade6
mov edi, 0xa
lea eax, [esi + 4]
sub edi, ebx
mov ecx, dword [esi]
mov edx, dword [eax]
cmp ecx, edx
jle 0x40ade0
mov dword [eax], ecx
mov dword [esi], edx
add eax, 4
dec edi
jne 0x40add4
inc ebx
add esi, 4
cmp ebx, 0xb
jl 0x40adc5
pop edi
pop esi
pop ebx
mov eax, dword [esp + 0xe0]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
add esp, 0xdc
ret 4
Function at 0x40cf80
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov edi, ecx
lea eax, [esp + 0x24]
lea ecx, [esp + 0x24]
lea edx, [esp + 0x24]
imul eax, ecx
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], edi
add edx, ecx
xor ecx, ecx
cmp edx, eax
mov dword [edi], 0x4290a4
jne 0x40cff7
xor eax, eax
xor edx, edx
cmp byte [eax], cl
je 0x40cfbf
mov bl, byte [eax + 1]
inc eax
inc edx
cmp bl, cl
jne 0x40cfb6
cmp byte [esp + 0x24], cl
je 0x40cff7
lea esi, [esp + 0x25]
lea ebp, [esp + 0x25]
xor edx, edx
mov al, byte [esp + edx + 0x24]
cmp al, cl
je 0x40cff7
mov bl, byte [esp + edx + 0x24]
cmp bl, al
jg 0x40cff7
jl 0x40cff7
jne 0x40cfec
cmp byte [esi], cl
jne 0x40cfec
cmp byte [ebp], cl
jne 0x40cff7
mov al, byte [esp + edx + 0x25]
inc esi
inc edx
inc ebp
cmp al, cl
jne 0x40cfcf
add edi, 4
xor eax, eax
mov edx, edi
mov byte [edx], al
inc eax
inc edx
cmp ax, 0x100
jl 0x40cffe
mov byte [edi + 0x100], cl
mov byte [edi + 0x101], cl
mov byte [esp + 0x10], cl
xor esi, esi
mov ebx, edi
mov dword [esp + 0x14], 0x100
mov eax, dword [esp + 0x10]
mov ebp, dword [esp + 0x24]
mov cl, byte [ebx]
and eax, 0xff
xor edx, edx
mov dl, byte [eax + ebp]
mov ebp, ecx
and ebp, 0xff
add esi, edx
add ebp, esi
mov edx, ebp
and edx, 0x800000ff
jns 0x40d056
dec edx
or edx, 0xffffff00
inc edx
mov byte [esp + 0x18], dl
mov esi, dword [esp + 0x18]
and esi, 0xff
inc eax
mov dl, byte [esi + edi]
mov byte [ebx], dl
mov byte [esi + edi], cl
cdq
idiv dword [esp + 0x28]
mov eax, dword [esp + 0x14]
inc ebx
dec eax
mov dword [esp + 0x14], eax
mov byte [esp + 0x10], dl
jne 0x40d024
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
Function at 0x41410f
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x427a83
call fcn.00426b14
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.0041533c
xor edi, edi
mov dword [esi + 0x1c], 0xa
mov dword [ebp - 4], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0xc], edi
mov dword [esi + 8], edi
mov dword [esi + 0x18], edi
mov ebx, dword [ebp + 8]
mov byte [ebp - 4], 1
mov dword [esi], 0x4290d0
mov dword [esi + 0x30], ebx
call fcn.0041ce20
push edi
mov dword [esi + 4], eax
push dword [ebp + 0xc]
push ebx
push eax
call fcn.0041ce47
push 8
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov dword [esi + 0x24], eax
mov ecx, dword [0x42f1dc]
mov dword [eax], ecx
mov eax, dword [esi + 0x24]
mov ecx, dword [ebp - 0xc]
add esp, 0x14
mov dword [eax + 4], esi
mov dword [esi + 0x20], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x41c58b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
lea eax, [ebp - 4]
lea ecx, [ebp - 4]
imul eax, ecx
push ebx
lea ecx, [ebp - 4]
xor ebx, ebx
cmp eax, ecx
push esi
mov byte [ebp - 0x68], 0x57
mov byte [ebp - 0x67], 0x69
mov byte [ebp - 0x66], 0x6e
mov byte [ebp - 0x65], 0x56
mov byte [ebp - 0x64], 0x4e
mov byte [ebp - 0x63], 0x43
mov byte [ebp - 0x62], 0x20
mov byte [ebp - 0x61], 0x54
mov byte [ebp - 0x60], 0x72
mov byte [ebp - 0x5f], 0x61
mov byte [ebp - 0x5e], 0x79
mov byte [ebp - 0x5d], 0x20
mov byte [ebp - 0x5c], 0x49
mov byte [ebp - 0x5b], 0x63
mov byte [ebp - 0x5a], 0x6f
mov byte [ebp - 0x59], 0x6e
mov byte [ebp - 0x58], bl
jne 0x41c607
push 1
pop esi
push 2
pop ecx
mov eax, esi
cdq
idiv ecx
test edx, edx
jne 0x41c5fd
inc ecx
cmp ecx, 0x32
jl 0x41c5ee
cmp esi, ecx
je 0x41c607
inc esi
cmp esi, 0x64
jle 0x41c5eb
lea eax, [ebp - 0x68]
push ebx
push eax
mov eax, dword [0x42f190]
call dword [eax + 0x1c0]
cmp eax, ebx
je 0x41c637
push ebx
push ebx
push 0x10
push eax
mov eax, dword [0x42f190]
call dword [eax + 0x1bc]
mov eax, dword [0x42f190]
push 1
call dword [eax + 0x3c]
jmp 0x41c607
pop esi
pop ebx
leave
ret
Function at 0x426ecb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4ec
push ebx
push esi
lea eax, [ebp - 0x14]
push edi
push eax
lea eax, [ebp - 0xdc]
xor edi, edi
push eax
mov word [ebp - 0xdc], 0x69
mov word [ebp - 0xda], 0x6d
mov word [ebp - 0xd8], 0x61
mov word [ebp - 0xd6], 0x67
mov word [ebp - 0xd4], 0x65
mov word [ebp - 0xd2], 0x2f
mov word [ebp - 0xd0], 0x6a
mov word [ebp - 0xce], 0x70
mov word [ebp - 0xcc], 0x65
mov word [ebp - 0xca], 0x67
mov word [ebp - 0xc8], di
call fcn.00426e3a
mov eax, dword [0x42f190]
pop ecx
pop ecx
mov esi, 0x104
lea ecx, [ebp - 0x2e4]
push esi
push ecx
lea ebx, [eax + 0x98]
push dword [ebp + 8]
call dword [eax + 0x1f0]
pop ecx
inc eax
push eax
push dword [ebp + 8]
push edi
push edi
call dword [ebx]
mov eax, dword [0x42f190]
lea ecx, [ebp - 0x4ec]
push esi
push ecx
push dword [ebp + 0xc]
lea ebx, [eax + 0x98]
call dword [eax + 0x1f0]
pop ecx
inc eax
push eax
push dword [ebp + 0xc]
push edi
push edi
call dword [ebx]
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
lea eax, [ebp - 0x2e4]
push eax
mov eax, dword [0x42f190]
call dword [eax + 0x198]
lea eax, [ebp - 0x14]
push edi
push eax
lea eax, [ebp - 0x4ec]
push eax
mov eax, dword [0x42f190]
push dword [ebp - 4]
call dword [eax + 0x194]
push dword [ebp - 4]
mov eax, dword [0x42f190]
call dword [eax + 0x190]
pop edi
pop esi
pop ebx
leave
ret
Function at 0xd68b77
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0xd68886
add eax, 0x3d1921e4
call fcn.00d68baf
mov esi, esi
xor dword [ebx], ecx
mov esi, esi
add eax, eax
sub eax, 0xcce35bcd
add ebx, 2
or eax, esi
push esi
pop esi
cmp ebx, edx
jl fcn.00d68b77
add eax, eax
mov esi, 0x7460ee23
ret

Function at 0x405600
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x405657
nop
inc esi
adc al, 0x85
sal byte [edi + eax - 0x75], 0x22
dec esi
adc al, 0xeb
push es
xchg dword [eax], edx
push esi
call 0xffc94a60
enter 0xc55, 0xffffffffffffff8b
dec ebp
adc byte [ecx + 0x55130450], cl
xchg esi, eax
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
mov ecx, dword [esi + 0x46]
mov dword [eax], ebp
mov dword [esi + 0x23], eax
pop esi
pop ebp
sti
adc byte [eax], al
dec edx
adc byte [eax + eax*8 + 0x74], al
and byte [edi + 0x78], bl
add al, 0x75
add eax, 0x7408a639
or al, byte [ebx - 0x7aff7438]
sal byte [ebp - 0x12], 0xeb
or eax, 0xffffff8b
add byte [ebp - 0x14118a40], al
xor eax, 0x1995188b
push edi
lcall 0x1442, 0x22088914
mov eax, edx
cmp byte [ebp - 0x3f7ac7b6], cl
je 0x405667
sub al, 0x2c
add al, 0x75
add eax, 0xb10870c5
jnp 0x8540e25e
sal byte [ebp - 0x7c], 0x5f
pop esi
pop ebx
pop ebp
ret 0xf80c
Function at 0x40ad00
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x421db0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x42a520]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
lea eax, [ebp - 0x18]
push reloc.comctl32.dll_PropertySheetA
xor edi, edi
push eax
xor esi, esi
mov dword [ebp - 4], edi
call fcn.004097b0
mov ecx, dword [ebp - 0x18]
add esp, 8
cmp dword [ecx - 0xc], edi
je 0x40add5
cmp edi, 2
jge 0x40add5
lea edx, [ebp - 0x1c]
push edx
lea edx, [ebp - 0x14]
push edx
push 0
xor eax, eax
push 2
test edi, edi
push 0
setne al
push 0
push 0
push ecx
mov dword [ebp - 0x14], 0
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40adcc
mov esi, dword [ebp - 0x14]
mov ecx, esi
mov dword [ebp - 0x28], ecx
test ebx, ebx
jne 0x40ad98
lea eax, [ebx + 0xd]
jmp 0x40adb8
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push ebx
push 1
push 0
push 0x42692c
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0x28]
xor edx, edx
test eax, eax
sete dl
mov esi, edx
test ecx, ecx
je 0x40adcc
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x18]
inc edi
jmp 0x40ad51
lea eax, [ecx - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ae15
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401293
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x618
push ebx
push esi
mov edx, 0x81
push edi
xor esi, esi
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x206]
mov word [ebp - 0x208], si
mov word [ebp - 0x410], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x40e]
mov word [ebp - 0x618], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x616]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [ebp + 8]
cmp edi, esi
je 0x401383
push 0x25
pop ebx
push ebx
push edi
call fcn.0040d437
pop ecx
test eax, eax
pop ecx
jne 0x401317
push dword [ebp + 0x10]
push edi
push dword [ebp + 0xc]
call fcn.0040cb55
add esp, 0xc
push 1
pop eax
jmp 0x4013bf
mov eax, edi
push ebx
push eax
call fcn.0040d437
pop ecx
test eax, eax
pop ecx
je 0x40132c
add eax, 2
inc esi
jmp 0x401319
mov eax, esi
push 2
cdq
pop ecx
idiv ecx
cmp edx, 1
je 0x401383
mov esi, 0x104
lea eax, [ebp - 0x208]
push esi
push edi
push eax
call fcn.0040cb55
lea eax, [ebp - 0x208]
push ebx
push eax
call fcn.0040d437
and word [eax], 0
lea edi, [eax + 2]
push ebx
push edi
call fcn.0040d437
add esp, 0x1c
mov ebx, eax
lea eax, [ebp - 0x410]
and word [ebx], 0
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x401387
xor eax, eax
jmp 0x4013bf
add ebx, 2
lea eax, [ebp - 0x410]
push ebx
push eax
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x618]
push str._s_s_s
push eax
call fcn.0040d3c8
push dword [ebp + 0x10]
lea eax, [ebp - 0x618]
push dword [ebp + 0xc]
push eax
call fcn.00401293
add esp, 0x20
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4013c4
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
and word [ebp - 0x208], 0
push ebx
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x206]
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x208]
push eax
push dword [ebp + 8]
call fcn.00401293
add esp, 0xc
test eax, eax
je 0x4014b4
push 0x5c
push dword [ebp + 8]
call fcn.0040d437
pop ecx
test eax, eax
pop ecx
je 0x4014b8
lea eax, [ebp - 0x208]
push 0x5c
push eax
call fcn.0040d460
cmp byte [ebp + 0xc], 1
pop ecx
pop ecx
mov ebx, eax
jne 0x401438
and word [ebx], 0
lea eax, [ebp - 0x208]
push eax
call fcn.004014c0
test al, al
pop ecx
jne 0x4014b8
mov word [ebx], 0x5c
lea edi, [ebp - 0x208]
test edi, edi
je 0x4014b8
push 0x5c
push edi
call fcn.0040d437
mov esi, eax
pop ecx
test esi, esi
pop ecx
jne 0x4014a4
cmp byte [ebp + 0xc], al
jne 0x4014b8
xor edi, edi
lea eax, [ebp - 0x208]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40148f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4014b4
test esi, esi
je 0x401498
mov word [esi], 0x5c
cmp byte [ebp + 0xc], 1
jne 0x401454
cmp esi, ebx
je 0x4014b8
jmp 0x401454
cmp word [esi - 2], 0x3a
lea edi, [esi + 2]
je 0x401454
and word [esi], 0
jmp 0x40146f
xor eax, eax
jmp 0x4014bb
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401d3b
Capabilities:
Get local ipv4 addresses

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov ax, word [ebp + 0x222e]
push ebx
cmp word [ebp + 0x222c], ax
push esi
push edi
mov dword [ebp - 8], 0x280
je 0x401e79
test ax, ax
jbe 0x401e7e
mov esi, dword [ebp + 0x2230]
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x20]
mov dword [ebp - 0xc], esi
call fcn.0040c016
lea eax, [ebp - 0x30]
push eax
call fcn.0040bf83
test esi, esi
pop ecx
je 0x401da5
mov ecx, dword [eax + 0xc]
cmp ecx, dword [ebp - 0x14]
jl 0x401da5
jg 0x401e7e
mov eax, dword [eax + 8]
cmp eax, dword [ebp - 0x18]
ja 0x401e7e
cmp dword [ebp + 0x1e28], 0
je 0x401e79
and dword [ebp - 0xc], 0
lea eax, [ebp + 0x1e2c]
mov dword [ebp - 4], eax
mov eax, 0x80
cmp dword [ebp + 0x1e28], eax
jge 0x401dd2
mov eax, dword [ebp + 0x1e28]
cmp dword [ebp - 0xc], eax
jge 0x401e7e
push 0x280
call fcn.0040d969
mov ebx, eax
pop ecx
test ebx, ebx
je 0x401e7e
lea eax, [ebp - 8]
push eax
push ebx
call fcn.00404bc8
cmp eax, 0x6f
jne 0x401e15
push ebx
call fcn.0040d9f5
push dword [ebp - 8]
call fcn.0040d969
mov ebx, eax
pop ecx
test ebx, ebx
pop ecx
je 0x401e7e
lea eax, [ebp - 8]
push eax
push ebx
call fcn.00404bc8
test eax, eax
jne 0x401e5b
test ebx, ebx
mov esi, ebx
je 0x401e66
mov eax, dword [ebp - 4]
mov edi, dword [eax + 4]
and edi, dword [eax]
lea eax, [esi + 0x1b0]
push eax
call sub.WS2_32.dll_inet_addr
mov dword [ebp - 0x10], eax
lea eax, [esi + 0x1c0]
push eax
call sub.WS2_32.dll_inet_addr
and eax, edi
and eax, dword [ebp - 0x10]
cmp eax, edi
je 0x401e72
mov esi, dword [esi]
test esi, esi
jne 0x401e31
test ebx, ebx
je 0x401e66
push ebx
call fcn.0040d9f5
pop ecx
inc dword [ebp - 0xc]
add dword [ebp - 4], 8
jmp 0x401dbf
push ebx
call fcn.0040d9f5
pop ecx
push 1
pop eax
jmp 0x401e80
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401f71
Capabilities:
Create thread
Terminate thread

Disassembly:
sub esp, 0x318
push ebx
push ebp
push esi
push edi
push 0x40
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x122]
cmp dword [esp + 0x32c], ebx
mov word [esp + 0x120], bx
mov dword [esp + 0x10], 1
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
jbe 0x4020da
push 0x6f
mov esi, 0x104
pop edi
mov eax, dword [esp + 0x10]
push 2
cdq
pop ecx
idiv ecx
push esi
lea eax, [esp + 0x20]
push ebx
push eax
test edx, edx
jne 0x40200a
call fcn.0040cba0
push 0x6d
push edi
push 0x63
push 0x2e
push 0x65
push 0x6c
push 0x67
push edi
push edi
push 0x67
push 0x2e
push 0x77
push 0x77
push 0x77
lea eax, [esp + 0x60]
push 0xe
push eax
call fcn.00401031
add esp, 0x4c
jmp 0x402056
call fcn.0040cba0
push 0x6d
push edi
push 0x63
push 0x2e
push 0x74
push 0x66
push edi
push 0x73
push edi
push 0x72
push 0x63
push 0x69
push 0x6d
push 0x2e
push 0x65
push 0x74
push 0x61
push 0x64
push 0x70
push 0x75
push 0x73
push 0x77
push edi
push 0x64
push 0x6e
push 0x69
push 0x77
lea eax, [esp + 0x94]
push 0x1b
push eax
call fcn.00401031
add esp, 0x80
lea eax, [esp + 0x120]
push esi
push eax
lea eax, [esp + 0x24]
push esi
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x20]
push ebx
push eax
push 0x401f4f
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebp, eax
cmp ebp, ebx
je 0x4020c5
push 0x2710
push ebp
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, ebx
jne 0x4020b6
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ebx
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push 1
pop eax
cmp dword [esp + 0x14], eax
je 0x4020dc
jmp 0x4020c5
cmp eax, 0x102
jne 0x4020c5
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esp + 0x10]
inc dword [esp + 0x10]
cmp eax, dword [esp + 0x32c]
jb 0x401fc6
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x318
ret
Function at 0x403505
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
push esi
push edi
push 0x44
xor edi, edi
pop esi
lea eax, [ebp - 0x54]
push esi
push edi
push eax
call fcn.0040cba0
push 0x10
lea eax, [ebp - 0x10]
push edi
push eax
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x28], 1
mov word [ebp - 0x24], 5
call fcn.0040cba0
add esp, 0x18
lea eax, [ebp - 0x25c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp - 0x25c]
push eax
call esi
cmp word [ebp + eax*2 - 0x25e], 0x5c
jne 0x40357c
lea eax, [ebp - 0x25c]
push eax
call esi
mov word [ebp + eax*2 - 0x25e], di
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x25c]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 5
pop edi
neg eax
sbb eax, eax
pop esi
inc eax
leave
ret
Function at 0x404a1d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [ecx + 4], 0
push esi
jne 0x404a45
push 0x422a74
lea ecx, [ebp - 0xc]
call fcn.0040ddbc
lea eax, [ebp - 0xc]
push 0x420c48
push eax
call fcn.0040de66
xor esi, esi
cmp dword [ecx + 0x3cc], esi
jle 0x404a66
mov eax, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dl, byte [edi]
xor byte [eax], dl
inc edi
inc eax
inc esi
cmp esi, dword [ecx + 0x3cc]
jl 0x404a56
pop edi
pop esi
leave
ret 8

Function at 0x404bce
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
cmp word [eax], 0x5a4d
jne 0x404ce3
mov esi, dword [eax + 0x3c]
add esi, eax
cmp dword [esi], 0x4550
jne 0x404ce3
mov edi, 0x2000
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 4
push edi
push dword [esi + 0x50]
push dword [esi + 0x34]
call ebx
test eax, eax
mov dword [ebp - 4], eax
jne 0x404c26
push 4
push edi
push dword [esi + 0x50]
push eax
call ebx
test eax, eax
mov dword [ebp - 4], eax
je 0x404ce3
push 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov eax, dword [ebp - 4]
xor ecx, ecx
push 4
push 0x1000
mov dword [edi + 4], eax
mov dword [edi + 0xc], ecx
mov dword [edi + 8], ecx
mov dword [edi + 0x10], ecx
push dword [esi + 0x50]
push eax
call ebx
push 4
push 0x1000
push dword [esi + 0x54]
push dword [ebp - 4]
call ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebx + 0x3c]
add ecx, dword [esi + 0x54]
push ecx
push ebx
push eax
call fcn.0040cff0
mov eax, dword [ebx + 0x3c]
mov ecx, dword [ebp - 8]
add eax, ecx
mov ecx, dword [ebp - 4]
push edi
push esi
mov dword [edi], eax
push ebx
mov dword [eax + 0x34], ecx
call fcn.00404cf1
mov ebx, dword [ebp - 4]
add esp, 0x18
mov eax, ebx
sub eax, dword [esi + 0x34]
je 0x404ca8
push eax
push edi
call fcn.00404e5b
pop ecx
pop ecx
push edi
call fcn.00404ed5
test eax, eax
pop ecx
je 0x404cdc
push edi
call fcn.00404d9e
mov eax, dword [edi]
pop ecx
mov eax, dword [eax + 0x28]
test eax, eax
je 0x404cea
add eax, ebx
test eax, eax
je 0x404cdc
cmp byte [ebp + 0xc], 0
push 1
pop esi
je 0x404ce7
push 0
push esi
push ebx
call eax
test eax, eax
jne 0x404ce7
push edi
call fcn.0040505b
pop ecx
xor eax, eax
jmp 0x404cec
mov dword [edi + 0x10], esi
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret