joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409530
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x158
push edi
xor eax, eax
push str._addtap.bat
mov dword [esp + 0x1c], 0x44
mov ecx, 0x10
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
push 0x503948
mov word [esp + 0x50], ax
lea eax, [esp + 0x64]
push 0x47c2e8
push eax
mov dword [esp + 0x54], 1
call fcn.0044dd9b
add esp, 0x10
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x7c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
pop edi
je 0x4095d0
mov ecx, dword [esp + 4]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 4]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 4]
lea eax, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edx, dword [esp + 4]
push edx
call esi
pop esi
mov al, 1
add esp, 0x158
ret

Function at 0x4095e0
Capabilities:
Set registry value

Disassembly:
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0x10]
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftDriver_Signing
push reloc.WS2_32.dll_accept
mov byte [esp + 0x23], 1
call edi
test eax, eax
jne 0x409614
push str.RegOpenKey_sucess_n
jmp 0x409619
push str.RegOpenKey_failure_n
call fcn.0044ee3f
mov edx, dword [esp + 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
add esp, 4
push 1
lea ecx, [esp + 0x13]
push ecx
push 3
push 0
push 0x47c054
push edx
call esi
test eax, eax
jne 0x409649
push str.RegSetValueEx_sucess_n
jmp 0x40964e
push str.RegSetValueEx_failure_n
call fcn.0044ee3f
mov eax, dword [esp + 0x14]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 4
test eax, eax
je 0x409667
push eax
call ebx
lea eax, [esp + 0x10]
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftDriver_Signing
push reloc.WS2_32.dll_bind
call edi
test eax, eax
jne 0x40968a
push str.RegOpenKey_sucess_n
jmp 0x40968f
push str.RegOpenKey_failure_n
call fcn.0044ee3f
mov edx, dword [esp + 0x14]
add esp, 4
push 1
lea ecx, [esp + 0x13]
push ecx
push 3
push 0
push 0x47c054
push edx
call esi
test eax, eax
jne 0x4096b9
push str.RegSetValueEx_sucess_n
jmp 0x4096be
push str.RegSetValueEx_failure_n
call fcn.0044ee3f
mov eax, dword [esp + 0x14]
add esp, 4
test eax, eax
je 0x4096e2
push eax
call ebx
test eax, eax
je 0x4096e2
push str.Error_in_RegCloseKey._n
call fcn.0044ee3f
add esp, 4
pop edi
pop esi
mov al, 1
pop ebx
add esp, 8
ret
Function at 0x409a00
Capabilities:
Set registry value

Disassembly:
sub esp, 8
lea eax, [esp + 4]
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftDriver_Signing
push reloc.WS2_32.dll_bind
mov byte [esp + 0x17], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409a2f
push str.RegOpenKey_sucess_n
jmp 0x409a34
push str.RegOpenKey_failure_n
call fcn.0044ee3f
mov edx, dword [esp + 8]
add esp, 4
push 1
lea ecx, [esp + 7]
push ecx
push 3
push 0
push 0x47c054
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x409a62
push str.RegSetValueEx_sucess_n
jmp 0x409a67
push str.RegSetValueEx_failure_n
call fcn.0044ee3f
mov eax, dword [esp + 8]
add esp, 4
test eax, eax
je 0x409a8f
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x409a8f
push str.Error_in_RegCloseKey._n
call fcn.0044ee3f
add esp, 4
mov al, 1
add esp, 8
ret

Function at 0x409aa0
Capabilities:
Set registry value

Disassembly:
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0x10]
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftDriver_Signing
push reloc.WS2_32.dll_accept
mov byte [esp + 0x23], 0
call edi
test eax, eax
jne 0x409ad4
push str.RegOpenKey_sucess_n
jmp 0x409ad9
push str.RegOpenKey_failure_n
call fcn.0044ee3f
mov edx, dword [esp + 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
add esp, 4
push 1
lea ecx, [esp + 0x13]
push ecx
push 3
push 0
push 0x47c054
push edx
call esi
test eax, eax
jne 0x409b09
push str.RegSetValueEx_sucess_n
jmp 0x409b0e
push str.RegSetValueEx_failure_n
call fcn.0044ee3f
mov eax, dword [esp + 0x14]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 4
test eax, eax
je 0x409b27
push eax
call ebx
lea eax, [esp + 0x10]
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftDriver_Signing
push reloc.WS2_32.dll_bind
call edi
test eax, eax
jne 0x409b4a
push str.RegOpenKey_sucess_n
jmp 0x409b4f
push str.RegOpenKey_failure_n
call fcn.0044ee3f
mov edx, dword [esp + 0x14]
add esp, 4
push 1
lea ecx, [esp + 0x13]
push ecx
push 3
push 0
push 0x47c054
push edx
call esi
test eax, eax
jne 0x409b79
push str.RegSetValueEx_sucess_n
jmp 0x409b7e
push str.RegSetValueEx_failure_n
call fcn.0044ee3f
mov eax, dword [esp + 0x14]
add esp, 4
test eax, eax
je 0x409b91
push eax
call ebx
lea eax, [esp + 0x10]
push eax
push 0x20006
push 0
push str.SoftwarePoliciesMicrosoftWindows_NTDriver_Signing
push reloc.WS2_32.dll_bind
call edi
test eax, eax
jne 0x409bb4
push str.RegOpenKey_sucess_n
jmp 0x409bb9
push str.RegOpenKey_failure_n
call fcn.0044ee3f
mov edx, dword [esp + 0x14]
add esp, 4
push 1
lea ecx, [esp + 0x13]
push ecx
push 3
push 0
push str.BehaviorOnFailedVerify
push edx
call esi
test eax, eax
jne 0x409be3
push str.RegSetValueEx_sucess_n
jmp 0x409be8
push str.RegSetValueEx_failure_n
call fcn.0044ee3f
mov eax, dword [esp + 0x14]
add esp, 4
test eax, eax
je 0x409bfb
push eax
call ebx
pop edi
pop esi
mov al, 1
pop ebx
add esp, 8
ret
Function at 0x409c10
Capabilities:
Set registry value

Disassembly:
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0x10]
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftDriver_Signing
push reloc.WS2_32.dll_accept
mov byte [esp + 0x23], 1
call edi
test eax, eax
jne 0x409c44
push str.RegOpenKey_sucess_n
jmp 0x409c49
push str.RegOpenKey_failure_n
call fcn.0044ee3f
mov edx, dword [esp + 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
add esp, 4
push 1
lea ecx, [esp + 0x13]
push ecx
push 3
push 0
push 0x47c054
push edx
call esi
test eax, eax
jne 0x409c79
push str.RegSetValueEx_sucess_n
jmp 0x409c7e
push str.RegSetValueEx_failure_n
call fcn.0044ee3f
mov eax, dword [esp + 0x14]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 4
test eax, eax
je 0x409c97
push eax
call ebx
lea eax, [esp + 0x10]
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftDriver_Signing
push reloc.WS2_32.dll_bind
call edi
test eax, eax
jne 0x409cba
push str.RegOpenKey_sucess_n
jmp 0x409cbf
push str.RegOpenKey_failure_n
call fcn.0044ee3f
mov edx, dword [esp + 0x14]
add esp, 4
push 1
lea ecx, [esp + 0x13]
push ecx
push 3
push 0
push 0x47c054
push edx
call esi
test eax, eax
jne 0x409ce9
push str.RegSetValueEx_sucess_n
jmp 0x409cee
push str.RegSetValueEx_failure_n
call fcn.0044ee3f
mov eax, dword [esp + 0x14]
add esp, 4
test eax, eax
je 0x409d01
push eax
call ebx
lea eax, [esp + 0x10]
push eax
push 0x20006
push 0
push str.SoftwarePoliciesMicrosoftWindows_NTDriver_Signing
push reloc.WS2_32.dll_bind
call edi
test eax, eax
jne 0x409d24
push str.RegOpenKey_sucess_n
jmp 0x409d29
push str.RegOpenKey_failure_n
call fcn.0044ee3f
mov edx, dword [esp + 0x14]
add esp, 4
push 1
lea ecx, [esp + 0x13]
push ecx
push 3
push 0
push str.BehaviorOnFailedVerify
push edx
call esi
test eax, eax
jne 0x409d53
push str.RegSetValueEx_sucess_n
jmp 0x409d58
push str.RegSetValueEx_failure_n
call fcn.0044ee3f
mov eax, dword [esp + 0x14]
add esp, 4
test eax, eax
je 0x409d6b
push eax
call ebx
pop edi
pop esi
mov al, 1
pop ebx
add esp, 8
ret
Function at 0x409d80
Capabilities:
Get common file path
Get program files directory
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x204
push ebx
push esi
push edi
push 0
push 0x26
push 0x503948
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov edi, 0x503948
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x409da6
mov eax, dword [str.SAGNC]
mov ecx, dword [0x47c380]
mov edx, dword [ebp + 8]
mov dword [edi], eax
mov dword [edi + 4], ecx
xor eax, eax
mov byte [esp + 0x10], 0
mov ecx, 0x7f
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
push 0x503948
stosb byte es:[edi], al
lea eax, [esp + 0x18]
push 0x47c374
push eax
call fcn.0044dd9b
add esp, 0x10
push 0
push 0x80
push 2
push 0
push 3
push 0xc0000000
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x409e1b
or eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0xc]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x409e23
push 0
lea ecx, [esp + 0x10]
push ecx
sub eax, edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
push edx
push esi
call edi
push 0
lea edx, [esp + 0x10]
push edx
push 2
push 0x47ad4c
push esi
call edi
mov ecx, dword [ebp + 0x10]
mov eax, ecx
lea edx, [eax + 1]
mov bl, byte [eax]
inc eax
test bl, bl
jne 0x409e57
push 0
sub eax, edx
lea edx, [esp + 0x10]
push edx
push eax
push ecx
push esi
call edi
push 0
lea eax, [esp + 0x10]
push eax
push 2
push 0x47ad4c
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409e90
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa80
push ebx
push ebp
push esi
push edi
push 0x503948
lea eax, [esp + 0x94]
push str._sipconf.dat
push eax
call fcn.0044dd9b
push 0x503948
lea ecx, [esp + 0x1a0]
push str._sipconf.bat
push ecx
call fcn.0044dd9b
add esp, 0x18
lea edx, [esp + 0x10]
push edx
xor eax, eax
mov ecx, 0x20
lea edi, [esp + 0x14]
push 0x80
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov ebp, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 0x503948
call ebp
push 0
lea eax, [esp + 0x194]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xbb8
call ebx
lea ecx, [esp + 0x90]
push 0x47a858
push ecx
call fcn.0044dd88
mov esi, eax
add esp, 8
test esi, esi
jne 0x409f6a
xor edi, edi
push 0x3e8
call ebx
lea edx, [esp + 0x90]
push 0x47a858
push edx
inc edi
call fcn.0044dd88
mov esi, eax
add esp, 8
test esi, esi
jne 0x409f6a
cmp edi, 0x14
jl 0x409f35
mov eax, 3
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push esi
lea eax, [esp + 0x294]
push 0x400
push eax
call fcn.0044ef88
mov al, byte [esi + 0xc]
mov bl, 0x10
add esp, 0xc
test bl, al
jne 0x409fe8
lea esp, [esp]
push esi
lea ecx, [esp + 0x694]
push 0x400
push ecx
call fcn.0044ef88
lea edx, [esp + 0x69c]
push str.TAP_Win32_Adapter_V8
push edx
call fcn.0044e010
add esp, 0x14
test eax, eax
jne 0x40a005
mov ecx, 0x100
lea edi, [esp + 0x290]
rep stosd dword es:[edi], eax
lea ebx, [ebx]
mov cl, byte [esp + eax + 0x690]
mov byte [esp + eax + 0x290], cl
inc eax
test cl, cl
jne 0x409fd0
test byte [esi + 0xc], bl
je 0x409f90
push esi
call fcn.0044dc7d
add esp, 4
lea edx, [esp + 0x10]
push edx
call ebp
mov eax, 2
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x290]
push str.disconnected
push eax
call fcn.0044e010
add esp, 8
test eax, eax
jne 0x40a04a
lea ecx, [esp + 0x290]
push str.Disconnected
push ecx
call fcn.0044e010
add esp, 8
test eax, eax
jne 0x40a04a
push esi
call fcn.0044dc7d
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call fcn.0044dc7d
add esp, 4
pop edi
mov eax, 1
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a360
Capabilities:
Enumerate process modules

Disassembly:
mov eax, 0x210c
call fcn.0044e0a0
lea eax, [esp]
push eax
push 0x1000
lea ecx, [esp + 0x114]
push ecx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x40a38b
add esp, 0x210c
ret
mov edx, dword [esp]
push ebx
push ebp
push esi
push edi
shr edx, 2
xor edi, edi
test edx, edx
jle 0x40a411
mov ebx, dword [esp + 0x2120]
mov ebp, dword [sym.imp.KERNEL32.dll_OpenProcess]
jmp 0x40a3b0
mov eax, dword [esp + edi*4 + 0x11c]
push eax
push 0
push 0x410
call ebp
lea ecx, [esp + 0x14]
push ecx
push 0x1000
lea edx, [esp + 0x1124]
mov esi, eax
push edx
push esi
call sub.PSAPI.DLL_EnumProcessModules
mov ecx, dword [esp + 0x111c]
push 0x104
lea eax, [esp + 0x1c]
push eax
push ecx
push esi
call sub.PSAPI.DLL_GetModuleFileNameExA
lea edx, [esp + 0x18]
push ebx
push edx
call fcn.0044e010
add esp, 8
test eax, eax
jne 0x40a41e
mov eax, dword [esp + 0x10]
inc edi
shr eax, 2
cmp edi, eax
jl 0x40a3b0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x210c
ret
mov eax, dword [esp + edi*4 + 0x11c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x210c
ret

Function at 0x40a430
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push eax
push 0
push 0x411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
jne 0x40a447
ret
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
ret
Function at 0x40a520
Capabilities:
Set tcp connection state

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x498
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
mov byte [esp + 0xa8], 0
xor eax, eax
mov ecx, 0xff
lea edi, [esp + 0xa9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x18
push 0
mov dword [esp + 0x18], 0
stosb byte es:[edi], al
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call ebx
mov ebp, eax
test ebp, ebp
je 0x40a5a8
push 1
lea eax, [esp + 0x14]
push eax
push ebp
mov dword [esp + 0x1c], 0x18
call sub.iphlpapi.dll_GetTcpTable
cmp eax, 0x7a
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
jne 0x40a5c0
push ebp
push 0
call esi
push eax
call edi
mov ecx, dword [esp + 0x10]
push ecx
push 0
call esi
push eax
call ebx
mov ebp, eax
test ebp, ebp
jne 0x40a5c0
push str.SSLTray:_Error_allocating_memory.
call fcn.00402a90
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push 1
lea edx, [esp + 0x14]
push edx
push ebp
call sub.iphlpapi.dll_GetTcpTable
test eax, eax
lea ecx, [esp + 0xa8]
jne 0x40a6fa
mov eax, dword [ebp]
push eax
push str.SSLTray:_Number_of_entries:__d
push ecx
call fcn.0044dd9b
lea edx, [esp + 0xb4]
push edx
call fcn.00402a90
mov eax, dword [ebp]
add esp, 0x10
xor ebx, ebx
test eax, eax
jle 0x40a6f0
lea esi, [ebp + 0x10]
jmp 0x40a610
xor eax, eax
mov byte [esp + 0x28], 0
mov ecx, 0x1f
lea edi, [esp + 0x29]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esi]
push 0x80
push eax
call sub.WS2_32.dll_inet_ntoa
push eax
lea eax, [esp + 0x30]
push eax
call fcn.0044f1f0
lea ecx, [esp + 0x34]
push ecx
push str.0.0.0.0
call fcn.0044f17a
add esp, 0x14
test eax, eax
je 0x40a6e1
lea edx, [esp + 0x28]
push edx
push str.127.0.0.1
call fcn.0044f17a
add esp, 8
test eax, eax
je 0x40a6e1
lea eax, [esp + 0x28]
push eax
push 0x4d3ed0
call fcn.0044f17a
add esp, 8
test eax, eax
je 0x40a6e1
mov edx, dword [esi - 4]
mov ecx, dword [esi - 8]
mov eax, dword [esi]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], ecx
mov ecx, dword [esi + 4]
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x18], 0xc
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
call sub.iphlpapi.dll_SetTcpEntry
test eax, eax
je 0x40a6e1
cmp eax, 0x57
je 0x40a6e1
lea ecx, [esp + 0x28]
push ecx
push eax
lea edx, [esp + 0xb0]
push str.SSLTray:_SetTcpEntry_failed_with__d__Remote_Address:__s
push edx
call fcn.0044dd9b
lea eax, [esp + 0xb8]
push eax
call fcn.00402a90
add esp, 0x14
mov eax, dword [ebp]
inc ebx
add esi, 0x14
cmp ebx, eax
jl 0x40a610
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push eax
push str.SSLTray:_GetTcpTable_failed_with__d
push ecx
call fcn.0044dd9b
lea edx, [esp + 0xb4]
push edx
call fcn.00402a90
add esp, 0x10
push ebp
push 0
call esi
push eax
call edi
pop edi
or eax, 0xffffffff
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a730
Capabilities:
Terminate process

Disassembly:
push str.SecTun.exe
call fcn.0040a360
add esp, 4
test eax, eax
jbe 0x40a75c
push eax
push 0
push 0x411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x40a75c
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x5039cc], 0
xor eax, eax
ret

Function at 0x40a770
Capabilities:
Delete file
Terminate process

Disassembly:
sub esp, 0x80
push str.SecTun.exe
call fcn.0040a360
add esp, 4
test eax, eax
jbe 0x40a7a6
push eax
push 0
push 0x411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x40a7a6
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x40a7d5
mov eax, dword [0x49f060]
mov ecx, dword [0x4ac7a4]
push 0x4ac568
push 0x45
push 0x4ac7c8
push eax
push 0x4d3ed0
push ecx
call fcn.00402150
add esp, 0x18
xor eax, eax
add esp, 0x80
ret
push 0x503948
lea edx, [esp + 4]
push str._sca.crt
push edx
call fcn.0044dd9b
add esp, 0xc
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [0x49f060]
mov edx, dword [0x4ac7a4]
push 0x4ac568
push 0x53
push 0x4ac7c8
push ecx
push 0x4d3ed0
push edx
mov dword [0x5039cc], 0
call fcn.00402150
add esp, 0x18
xor eax, eax
add esp, 0x80
ret
Function at 0x40b4e0
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x474
push ebx
push esi
push edi
xor ebx, ebx
push ebx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x2c], 0xc
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], 1
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x40b535
push str.SSLTray:_CreatePipe_for_cmdline_Failed_
call fcn.00402a90
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x2c], 0x44
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x68], eax
mov dword [esp + 0x64], eax
mov byte [esp + 0x80], bl
xor eax, eax
mov ecx, 0xff
lea edi, [esp + 0x81]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 8]
push ecx
stosw word es:[edi], ax
lea edx, [esp + 0x84]
push 0x47b42c
push edx
mov word [esp + 0x64], bx
mov dword [esp + 0x60], 0x101
stosb byte es:[edi], al
call fcn.0044dd9b
add esp, 0xc
lea eax, [esp + 0x70]
push eax
lea ecx, [esp + 0x2c]
push ecx
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
lea edx, [esp + 0xa0]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40b5db
push str.SSLTray:_CreateProcess_for_cmdline_Failed_
call fcn.00402a90
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
lea ecx, [esp + 0x1c]
push ecx
push 1
lea edx, [esp + 0x18]
push edx
push eax
mov word [esp + 0x20], bx
call esi
test eax, eax
je 0x40b64a
mov edi, dword [ebp + 0xc]
lea esp, [esp]
lea eax, [esp + 0xc]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40b617
sub eax, edx
push eax
lea ecx, [esp + 0x10]
push ecx
mov ecx, edi
call fcn.0040b060
mov ecx, dword [esp + 0x10]
push ebx
lea edx, [esp + 0x1c]
push edx
push 1
lea eax, [esp + 0x18]
push eax
push ecx
mov word [esp + 0x20], bx
call esi
test eax, eax
jne 0x40b610
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c580
Capabilities:
Create process on windows
Get common file path
Set current directory
Terminate process

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x594
push eax
call fcn.0040a060
add esp, 4
cmp eax, 0xffffffff
jne 0x40c5a1
or eax, eax
add esp, 0x594
ret
push str.SecTun.exe
call fcn.0040a360
add esp, 4
test eax, eax
jbe 0x40c5cd
push eax
push 0
push 0x411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x40c5cd
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
push edi
push str.client.bat
push 0x503948
lea ecx, [esp + 0xa4]
push 0x47c2e8
push ecx
call fcn.0044dd9b
add esp, 0x10
lea edx, [esp + 0x1c]
push edx
xor eax, eax
mov ecx, 0x20
lea edi, [esp + 0x20]
push 0x80
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 0x503948
call edi
cmp word [0x5039c8], 0
jle 0x40c62e
push 5
lea eax, [esp + 0xa0]
push eax
jmp 0x40c638
push 0
lea ecx, [esp + 0xa0]
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
lea edx, [esp + 0x1c]
push edx
mov esi, eax
call edi
cmp esi, 0x1f
jg 0x40c65a
pop edi
mov eax, 0x3ed
pop esi
add esp, 0x594
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call ebx
call fcn.00409e90
mov esi, eax
push esi
lea eax, [esp + 0x1a4]
push str.SSLTray:_ifconnect_return:__d.
push eax
call fcn.0044dd9b
lea ecx, [esp + 0x1ac]
push ecx
call fcn.00402a90
add esp, 0x10
cmp esi, 2
jne 0x40c6ad
call fcn.0040bb40
test al, al
jne 0x40c6ad
push str.SSLTray:_install_tap_failed.
call fcn.00402a90
add esp, 4
xor edi, edi
cmp esi, 1
jne 0x40c6f2
mov edx, edi
inc edi
cmp edx, 5
jge 0x40c6f2
push 0x1388
call ebx
call fcn.00409e90
mov esi, eax
push esi
lea eax, [esp + 0x1a4]
push str.SSLTray:_ifconnect_return_TAP_STATUS_DISCONNECT___:__d.
push eax
call fcn.0044dd9b
lea ecx, [esp + 0x1ac]
push ecx
call fcn.00402a90
add esp, 0x10
cmp esi, 1
je 0x40c6b4
test esi, esi
jne 0x40c7ac
xor edx, edx
mov dword [esp + 0xd], edx
mov dword [esp + 0x11], edx
mov dword [esp + 0x15], edx
mov dword [esp + 0x19], edx
mov word [esp + 0x1d], dx
mov byte [esp + 0xc], 0
mov byte [esp + 0x1f], dl
lea ebx, [ebx]
mov eax, dword [0x5039cc]
test eax, eax
je 0x40c74a
push eax
call sub.WS2_32.dll_htonl
push eax
call sub.WS2_32.dll_inet_ntoa
lea edx, [esp + 0xc]
lea esp, [esp]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
test cl, cl
jne 0x40c740
mov al, byte [esp + 0xc]
test al, al
je 0x40c768
lea eax, [esp + 0xc]
push str.0.0.0.0
push eax
call fcn.0044f17a
add esp, 8
test eax, eax
jne 0x40c775
push 0x3e8
inc esi
call ebx
cmp esi, 0x1e
jl 0x40c720
mov edx, dword [0x49f060]
mov eax, dword [0x4ac7a4]
lea ecx, [esp + 0xc]
push ecx
push 0x4ac568
push 0x43
push 0x4ac7c8
push edx
push 0x4d3ed0
push eax
call fcn.00402340
add esp, 0x1c
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x594
ret
mov ecx, dword [0x49f060]
mov edx, dword [0x4ac7a4]
push 0x4ac568
push 0x46
push 0x4ac7c8
push ecx
push 0x4d3ed0
push edx
call fcn.00402150
push str.SecTun.exe
call fcn.0040a360
add esp, 0x1c
test eax, eax
jbe 0x40c7ea
push eax
call fcn.0040a430
add esp, 4
pop ebx
pop edi
mov eax, 0x3f0
pop esi
add esp, 0x594
ret
Function at 0x40ca90
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 4]
push eax
push 0
push esi
push 0x40ca70
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x40cac1
push str.SSLTray:_Create_Oracle_command_thread_failed.
call fcn.00402a90
add esp, 4
pop esi
pop ecx
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push ecx
push edx
push eax
push esi
call fcn.0040c800
mov ecx, dword [esi + 4]
add esp, 0x10
push 2
push ecx
call dword [sym.imp.WS2_32.dll_shutdown]
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [esi + 8]
push eax
call fcn.0041bb80
add esp, 4
pop esi
pop ecx
ret