joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40654c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4065b2
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.0040465c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00403108
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x40659c
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4065b9
lea eax, [ebp - 0x10]
call fcn.004043ec
ret

Function at 0x40b550
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b589
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004044dc
jmp 0x40b592
mov eax, ebx
mov edx, esi
call fcn.00404440
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b59c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b5bd
mov al, byte [esp]
jmp 0x40b5bf
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40bc54
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40babc
mov eax, dword [0x463b40]
cmp byte [eax], 0
je 0x40bcd0
mov eax, dword [0x4638dc]
call fcn.00402f1c
call fcn.00402b78
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408d58
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40bd18
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40bd06
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x463884]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x464668]
call fcn.004059ac
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40cbb8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40cc1c
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.0040465c
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.0040869c
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cc23
lea eax, [ebp - 0xc]
call fcn.004043ec
ret

Function at 0x40de54
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, eax
xor ebx, ebx
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x40deb9
push 1
call sub.user32.dll_GetClipboardData
mov esi, eax
test esi, esi
je 0x40deb4
push esi
call sub.kernel32.dll_GlobalLock
mov dword [esp], eax
cmp dword [esp], 0
je 0x40deb4
push esi
call sub.kernel32.dll_GlobalSize
mov esi, eax
test esi, esi
je 0x40deab
mov eax, edi
mov edx, esi
call fcn.004049f8
mov eax, edi
call fcn.00404920
mov ecx, esi
mov edx, dword [esp]
call fcn.00406f0c
mov bl, 1
mov eax, dword [esp]
push eax
call sub.kernel32.dll_GlobalUnlock
call sub.user32.dll_CloseClipboard
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x418bdc
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.00418a08
dec esi
jne 0x418bfe
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret

Function at 0x419280
Capabilities:
Hash data with md5

Disassembly:
push ebx
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
mov edx, 0x40
lea ecx, [eax + 0x18]
mov byte [ecx], 0
inc ecx
dec edx
jne 0x419293
mov edx, 0x10
lea ecx, [eax + 0x58]
xor ebx, ebx
mov dword [ecx], ebx
add ecx, 4
dec edx
jne 0x4192a2
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebx
ret

Function at 0x41a16c
Capabilities:
Hash data with md5

Disassembly:
push ebx
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
mov edx, 0x40
lea ecx, [eax + 0x18]
mov byte [ecx], 0
inc ecx
dec edx
jne 0x41a17f
mov edx, 0x10
lea ecx, [eax + 0x58]
xor ebx, ebx
mov dword [ecx], ebx
add ecx, 4
dec edx
jne 0x41a18e
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebx
ret
Function at 0x425258
Capabilities:
Reference http user-agent string

Disassembly:
push ebx
push esi
push edi
test dl, dl
je 0x425267
add esp, 0xfffffff0
call fcn.00403938
mov ebx, edx
mov edi, eax
xor edx, edx
mov eax, edi
call fcn.004249a0
mov dl, 1
mov eax, dword [0x4149d4]
call fcn.00403680
mov dword [edi + 0x2c], eax
mov dl, 1
mov eax, dword [0x4149d4]
call fcn.00403680
mov dword [edi + 0x64], eax
mov dl, 1
mov eax, dword [0x414d18]
call fcn.00403680
mov dword [edi + 0x30], eax
mov dl, 1
mov eax, dword [0x41f5d8]
call fcn.00423eb8
mov esi, eax
mov dword [edi + 0x1c], esi
mov dword [esi + 0x1c4], edi
mov byte [esi + 0x88], 1
mov eax, esi
mov edx, 0x10000
call fcn.004222bc
mov eax, dword [edi + 0x1c]
mov edx, 0x10000
call fcn.004222e4
mov dword [edi + 0x10], 0x15f90
lea eax, [edi + 8]
mov edx, 0x425384
call fcn.00404440
lea eax, [edi + 0x48]
call fcn.004043ec
lea eax, [edi + 0x4c]
mov edx, 0x425390
call fcn.00404440
lea eax, [edi + 0x50]
call fcn.004043ec
lea eax, [edi + 0x54]
call fcn.004043ec
lea eax, [edi + 0x24]
call fcn.004043ec
lea eax, [edi + 0x28]
call fcn.004043ec
lea eax, [edi + 0x38]
mov edx, 0x4253a0
call fcn.00404440
mov byte [edi + 0x3c], 1
mov byte [edi + 0x44], 0
lea eax, [edi + 0x60]
mov edx, 0x4253ac
call fcn.00404440
xor eax, eax
mov dword [edi + 0x68], eax
xor eax, eax
mov dword [edi + 0x6c], eax
mov byte [edi + 0x78], 1
mov dword [edi + 0x40], 0x12c
mov eax, edi
call fcn.00425464
mov eax, edi
test bl, bl
je 0x425374
call fcn.00403990
pop dword fs:[0]
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x426e90
Capabilities:
Enumerate pe sections
Get file size
Read file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe8
xor edx, edx
mov dword [esp], edx
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push eax
call sub.kernel32.dll_CreateFileW
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x426ecb
push 0
push 0x426fc4
push 0x426fc8
push 0
call sub.user32.dll_MessageBoxA_1
push 0
push ebp
call sub.kernel32.dll_GetFileSize
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
call fcn.00402a18
mov ebx, eax
push 0
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push eax
push ebx
push ebp
call sub.kernel32.dll_ReadFile
test eax, eax
jne 0x426f0c
push 0
push 0x426fc4
push 0x426fcc
push 0
call sub.user32.dll_MessageBoxA_1
mov dword [esp + 0xc], ebx
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 0x3c]
add eax, ebx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0x50]
call fcn.00402a18
mov dword [esp], eax
mov eax, dword [esp + 0x10]
mov edx, dword [eax + 0x50]
mov eax, dword [esp]
call fcn.00406f14
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x54]
mov edx, ebx
mov eax, dword [esp]
call fcn.00406f0c
mov eax, dword [esp + 0x10]
mov si, word [eax + 6]
dec esi
test si, si
jb 0x426fa5
inc esi
xor edi, edi
mov edx, dword [esp + 0xc]
mov edx, dword [edx + 0x3c]
mov eax, ebx
add edx, eax
add edx, 0xf8
movzx ecx, di
shl ecx, 3
lea ecx, [ecx + ecx*4]
add edx, ecx
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x14]
mov ecx, dword [edx + 0x10]
mov edx, dword [esp + 0x14]
mov edx, dword [edx + 0x14]
add edx, eax
push edx
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 0xc]
add eax, dword [esp + 4]
pop edx
call fcn.00406f0c
inc edi
dec si
jne 0x426f5d
mov edx, dword [esp + 4]
mov eax, ebx
call fcn.00402a48
push ebp
call sub.kernel32.dll_CloseHandle
mov eax, dword [esp]
add esp, 0x18
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x42703c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
add esp, 0xffffffd8
mov dword [esp], edx
mov esi, eax
xor eax, eax
mov dword [esp + 4], eax
mov edx, dword [esi + 0x3c]
mov eax, esi
add edx, eax
mov dword [esp + 8], edx
mov edx, dword [esp + 8]
add edx, 0x78
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0xc]
mov edx, dword [edx]
add edx, eax
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x10]
mov edx, dword [edx + 0x1c]
add edx, eax
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x10]
mov edx, dword [edx + 0x20]
add edx, eax
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x10]
mov edx, dword [edx + 0x24]
add edx, eax
mov dword [esp + 0x20], edx
mov eax, dword [esp + 0x18]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
mov ebx, dword [eax + 0x18]
dec ebx
test ebx, ebx
jb 0x427126
inc ebx
mov eax, dword [esp + 0x20]
movzx edx, word [eax]
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x18], ecx
cmp edx, eax
jbe 0x4270c9
add dword [esp + 0x18], 4
inc eax
cmp edx, eax
ja 0x4270bf
mov edx, dword [esp + 0xc]
mov edx, dword [edx]
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
cmp edx, eax
ja 0x4270e4
mov ecx, dword [esp + 0xc]
add edx, dword [ecx + 4]
cmp eax, edx
jb 0x427119
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
add eax, esi
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
call fcn.00426d7c
mov ecx, eax
mov edx, dword [esp + 0x24]
xor eax, eax
call fcn.00426d90
cmp eax, dword [esp]
jne 0x427119
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
add eax, esi
mov dword [esp + 4], eax
jmp 0x427126
add dword [esp + 0x20], 2
add dword [esp + 0x1c], 4
dec ebx
jne 0x4270aa
mov eax, dword [esp + 4]
add esp, 0x28
pop esi
pop ebx
ret
Function at 0x42c904
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x42c9ce
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [0x463808]
mov ecx, dword [ecx]
lea eax, [ebp - 0xc]
mov edx, 0x42c9e4
call fcn.00404714
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
call fcn.00404c0c
push 0x208
call sub.ole32.dll_CoTaskMemAlloc
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x42c9a1
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 7
mov eax, dword [ebp - 4]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.00404bb4
push dword [ebp - 0x10]
push dword [ebp - 8]
push 0x42c9ec
mov eax, ebx
mov edx, 3
call fcn.00404d00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42c9a8
mov eax, dword [ebp - 4]
push eax
call sub.ole32.dll_CoTaskMemFree
ret

Function at 0x42c9f8
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x42cac3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.00432dd0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov ecx, 0x42cad8
call fcn.00404714
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004342c8
test al, al
jne 0x42caa8
push 0x208
call sub.ole32.dll_CoTaskMemAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x42ca89
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 7
mov eax, dword [ebp - 8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.004053c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42ca90
mov eax, dword [ebp - 8]
push eax
call sub.ole32.dll_CoTaskMemFree
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42caca
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404410
ret

Function at 0x42cbf8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor edx, edx
mov dword [ebp - 0x24], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42cc71
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1e]
mov edx, 0x1e
call fcn.00406f14
xor eax, eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], 3
lea eax, [ebp - 0x24]
mov ecx, 0x42cc84
mov edx, ebx
call fcn.00404c98
mov eax, dword [ebp - 0x24]
call fcn.00404c1c
mov dword [ebp - 0x16], eax
mov word [ebp - 0xe], 0xc14
lea eax, [ebp - 0x1e]
push eax
call sub.shell32.dll_SHFileOperationW
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42cc78
lea eax, [ebp - 0x24]
call fcn.00404a8c
ret
Function at 0x42cc8c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor edx, edx
mov dword [ebp - 0x24], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42cd05
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1e]
mov edx, 0x1e
call fcn.00406f14
xor eax, eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], 3
lea eax, [ebp - 0x24]
mov ecx, 0x42cd1c
mov edx, ebx
call fcn.00404714
mov eax, dword [ebp - 0x24]
call fcn.004048c8
mov dword [ebp - 0x16], eax
mov word [ebp - 0xe], 0xc14
lea eax, [ebp - 0x1e]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42cd0c
lea eax, [ebp - 0x24]
call fcn.004043ec
ret

Function at 0x42cd20
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42cdbe
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1e]
mov edx, 0x1e
call fcn.00406f14
xor eax, eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], 2
lea eax, [ebp - 0x24]
mov ecx, 0x42cdd8
mov edx, ebx
call fcn.00404714
mov eax, dword [ebp - 0x24]
call fcn.004048c8
mov dword [ebp - 0x16], eax
lea eax, [ebp - 0x28]
mov ecx, 0x42cdd8
mov edx, esi
call fcn.00404714
mov eax, dword [ebp - 0x28]
call fcn.004048c8
mov dword [ebp - 0x12], eax
mov word [ebp - 0xe], 0x614
lea eax, [ebp - 0x1e]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42cdc5
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00404410
ret

Function at 0x42cddc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x42ce94
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, 0x42cea8
call fcn.00434528
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004342c8
test al, al
jne 0x42ce66
push 0x208
call sub.ole32.dll_CoTaskMemAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x42ce5f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 5
mov eax, dword [ebp - 8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.004053c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42ce66
mov eax, dword [ebp - 8]
push eax
call sub.ole32.dll_CoTaskMemFree
ret
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040c960
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00404440
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42ce9b
lea eax, [ebp - 0xc]
call fcn.004043ec
ret
Function at 0x42d0bc
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.004048b8
mov eax, dword [ebp - 8]
call fcn.004048b8
xor eax, eax
push ebp
push 0x42d2a5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x463b78]
cmp byte [eax], 0
jne 0x42d0fd
call fcn.004271e0
test bl, bl
je 0x42d191
cmp dword [ebp - 4], 0
jne 0x42d118
lea eax, [ebp - 4]
mov edx, 0x42d2c0
call fcn.00404484
lea eax, [ebp - 0x6c]
mov edx, 0x44
call fcn.00406f14
lea eax, [ebp - 0x28]
mov edx, 0x10
call fcn.00406f14
mov dword [ebp - 0x6c], 0x44
mov word [ebp - 0x3c], 0
mov dword [ebp - 0x40], 1
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x6c]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004048c8
mov esi, eax
push esi
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x42d18c
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x6c]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0
push esi
call sub.kernel32.dll_CreateProcessA
mov esi, dword [ebp - 0x28]
jmp 0x42d1b4
mov byte [ebp - 9], 0
test esi, esi
je 0x42d28a
push esi
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov esi, eax
test esi, esi
je 0x42d28a
push 0x40
push 0x1000
mov eax, dword [ebp - 8]
call fcn.004046c8
push eax
push 0
push esi
call fcn.00427b38
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x42d1f0
push 0x40
push 0x1000
mov eax, dword [ebp - 8]
call fcn.004046c8
push eax
push 0
push esi
call sub.kernel32.dll_VirtualAllocEx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x42d28a
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
call fcn.004046c8
push eax
lea eax, [ebp - 8]
call fcn.00404920
push eax
mov eax, dword [ebp - 0x10]
push eax
push esi
call fcn.00427bd0
mov eax, dword [ebp - 8]
call fcn.004046c8
sub eax, 2
cdq
push edx
push eax
mov eax, dword [ebp - 0x14]
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x42d23c
cmp eax, dword [esp]
pop edx
pop eax
jae 0x42d260
jmp 0x42d240
pop edx
pop eax
jge 0x42d260
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
call fcn.004046c8
push eax
lea eax, [ebp - 8]
call fcn.00404920
push eax
mov eax, dword [ebp - 0x10]
push eax
push esi
call sub.kernel32.dll_WriteProcessMemory
lea eax, [ebp - 0x18]
push eax
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
push 0
push 0
push esi
call sub.kernel32.dll_CreateRemoteThread
mov edi, eax
test bl, bl
jne 0x42d282
push esi
call sub.kernel32.dll_CloseHandle
test edi, edi
jbe 0x42d28a
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42d2ac
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404410
ret
Function at 0x43050c
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret

Function at 0x430634
Capabilities:
Get session user name

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
lea eax, [esp + 4]
mov edx, 0x202
call fcn.00406f14
mov dword [esp], 0x202
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameW
test eax, eax
je 0x43066e
mov edx, dword [esp]
dec edx
mov eax, ebx
call fcn.00404ef8
jmp 0x430675
mov eax, ebx
call fcn.00404a8c
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x101
call fcn.00404bf0
add esp, 0x208
pop ebx
ret

Function at 0x430690
Capabilities:
Get session user name

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
lea eax, [esp + 4]
mov edx, 0x101
call fcn.00406f14
mov dword [esp], 0x101
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x4306ca
mov edx, dword [esp]
dec edx
mov eax, ebx
call fcn.004049f8
jmp 0x4306d1
mov eax, ebx
call fcn.004043ec
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x101
call fcn.0040465c
add esp, 0x108
pop ebx
ret

Function at 0x4306ec
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor edx, edx
mov dword [ebp - 0x2c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x430768
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x26]
xor ecx, ecx
mov edx, 0x22
call fcn.004030cc
mov dword [ebp - 4], 0x11
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x26]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x43074b
lea eax, [ebp - 0x2c]
lea edx, [ebp - 0x26]
mov ecx, 0x11
call fcn.00404bf0
mov eax, dword [ebp - 0x2c]
mov edx, ebx
call fcn.004332c0
jmp 0x430752
mov eax, ebx
call fcn.004043ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43076f
lea eax, [ebp - 0x2c]
call fcn.00404a8c
ret

Function at 0x430b5c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov edi, edx
mov ebp, eax
mov eax, ebp
call fcn.004046c8
mov edx, eax
mov eax, dword [esp]
call fcn.004049f8
mov eax, ebp
call fcn.004046c8
mov esi, eax
test esi, esi
jle 0x430bb8
mov ebx, 1
mov eax, edi
call fcn.004046c8
push eax
mov eax, ebx
dec eax
pop edx
mov ecx, edx
cdq
idiv ecx
mov al, byte [edi + edx]
mov dl, byte [ebp + ebx - 1]
xor al, dl
push eax
mov eax, dword [esp + 4]
call fcn.00404920
pop edx
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x430b8b
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430c3c
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, esi
call fcn.004048c8
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x430c6a
test bl, 2
jne 0x430c6a
or ebx, 2
push ebx
mov eax, esi
call fcn.004048c8
push eax
call sub.kernel32.dll_SetFileAttributesA
pop esi
pop ebx
ret