joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10024730
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get local ipv4 addresses
Get socket information
Initialize winsock library
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b8
mov eax, dword [0x10042074]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x1a4]
push esi
mov esi, dword [ebp + 0x10]
push eax
push 0x202
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
je 0x10024775
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100337f6
mov esp, ebp
pop ebp
ret 0x10
push edi
push 0
push 1
push 2
call dword [sym.imp.WSOCK32.dll_socket]
mov edi, eax
cmp edi, 0xffffffff
je 0x10024839
xorps xmm0, xmm0
mov eax, 2
movups xmmword [ebp - 0x14], xmm0
push ebx
mov word [ebp - 0x14], ax
call dword [sym.imp.WSOCK32.dll_inet_addr]
push dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
call dword [sym.imp.WSOCK32.dll_htons]
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x14]
push 0x10
push eax
push edi
call dword [sym.imp.WSOCK32.dll_connect]
cmp eax, 0xffffffff
je 0x10024832
lea eax, [ebp - 0x1b8]
mov dword [ebp - 0x1b8], 0x10
push eax
lea eax, [ebp - 0x1b4]
push eax
push edi
call dword [sym.imp.WSOCK32.dll_getsockname]
cmp eax, 0xffffffff
je 0x10024832
push dword [ebp - 0x1b0]
call dword [sym.imp.WSOCK32.dll_inet_ntoa]
test eax, eax
je 0x10024832
sub esi, eax
nop dword [eax]
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [esi + eax - 1], cl
test cl, cl
jne 0x10024800
push edi
call dword [sym.imp.WSOCK32.dll_closesocket]
call dword [sym.imp.WSOCK32.dll_WSACleanup]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100337f6
mov esp, ebp
pop ebp
ret 0x10
push edi
call dword [sym.imp.WSOCK32.dll_closesocket]
call dword [sym.imp.WSOCK32.dll_WSACleanup]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100337f6
mov esp, ebp
pop ebp
ret 0x10

Function at 0x10026fd0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push edi
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
jne 0x10027008
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x14
push ebx
push esi
call sub.mfc140.dll_Ordinal_265
add esp, 4
mov ebx, eax
push ebx
push esi
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoA
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0x10039050
push ebx
call sub.VERSION.dll_VerQueryValueA
mov eax, dword [ebp - 4]
push ebx
mov esi, dword [eax + 8]
mov edi, dword [eax + 0xc]
call sub.mfc140.dll_Ordinal_266
mov eax, dword [ebp + 0xc]
mov ecx, esi
shr ecx, 0x10
add esp, 4
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
movzx ecx, si
pop ebx
mov dword [eax], ecx
mov ecx, edi
mov eax, dword [ebp + 0x14]
shr ecx, 0x10
mov dword [eax], ecx
mov eax, dword [ebp + 0x18]
movzx ecx, di
pop edi
pop esi
mov dword [eax], ecx
mov eax, 1
mov esp, ebp
pop ebp
ret 0x14
Function at 0x1002d8b0
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1274
call fcn.10033810
mov eax, dword [0x10042074]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
mov ecx, edx
mov dword [ebp - 0x122c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1230], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1234], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x1238], eax
lea eax, [ebp - 0x224]
mov dword [ebp - 0x1264], eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x1270], eax
lea eax, [ebp - 0xa4]
mov dword [ebp - 0x1258], eax
lea eax, [ebp - 0x124]
mov dword [ebp - 0x1250], eax
lea eax, [ebp - 0xa24]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x1248], eax
lea eax, [ebp - 0x1224]
mov esi, dword [ebp + 0x20]
mov dword [ebp - 0x1240], eax
lea eax, [ecx + 1]
mov edi, dword [ebp + 0x1c]
mov dword [ebp - 0x1268], 0
mov dword [ebp - 0x125c], 0
mov dword [ebp - 0x1274], 0x3c
mov dword [ebp - 0x1260], 0x100
mov dword [ebp - 0x126c], 0x20
mov dword [ebp - 0x1254], 0x80
mov dword [ebp - 0x124c], 0x80
mov dword [ebp - 0x1244], 0x800
mov dword [ebp - 0x123c], 0x800
mov dword [ebp - 0x1228], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002d9a4
sub ecx, dword [ebp - 0x1228]
lea eax, [ebp - 0x1274]
push eax
push closesocket
push ecx
push edx
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
test eax, eax
je 0x1002dab8
test ebx, ebx
je 0x1002d9ed
mov ecx, dword [ebp - 0x1270]
sub ebx, ecx
nop dword [eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [ebx + ecx - 1], al
test al, al
jne 0x1002d9e0
mov edx, dword [ebp - 0x122c]
test edx, edx
je 0x1002da0d
mov ecx, dword [ebp - 0x1264]
sub edx, ecx
nop
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x1002da00
mov edx, dword [ebp - 0x1230]
test edx, edx
je 0x1002da2d
mov ecx, dword [ebp - 0x1248]
sub edx, ecx
nop
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x1002da20
mov edx, dword [ebp - 0x1234]
test edx, edx
je 0x1002da4d
mov ecx, dword [ebp - 0x1258]
sub edx, ecx
nop
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x1002da40
test edi, edi
je 0x1002da6d
mov ecx, dword [ebp - 0x1250]
sub edi, ecx
nop dword [eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edi + ecx - 1], al
test al, al
jne 0x1002da60
test esi, esi
je 0x1002da8d
mov ecx, dword [ebp - 0x1240]
sub esi, ecx
nop dword [eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [esi + ecx - 1], al
test al, al
jne 0x1002da80
mov ecx, dword [ebp - 0x1238]
test ecx, ecx
je 0x1002daa0
movzx eax, word [ebp - 0x125c]
mov dword [ecx], eax
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100337f6
mov esp, ebp
pop ebp
ret 0x20
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100337f6
mov esp, ebp
pop ebp
ret 0x20
Function at 0x1002e660
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x37f0
call fcn.10033810
mov eax, dword [0x10042074]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x37c4], 0
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x37dc], ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x37d8], edi
test ecx, ecx
jne 0x1002e708
lea eax, [ebp - 0x188]
push 0x104
push eax
call fcn.1001eb60
add esp, 8
test eax, eax
je 0x1002e9dc
lea eax, [ebp - 0x188]
push 0x5c
push eax
call dword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsrchr]
add esp, 8
test eax, eax
je 0x1002e6ef
lea ecx, [eax + 1]
lea edx, [ebp - 0x84]
sub edx, ecx
nop word [eax + eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x1002e6e0
jmp 0x1002e71d
xor ecx, ecx
mov al, byte [ebp + ecx - 0x188]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x85], al
test al, al
jne 0x1002e6f1
jmp 0x1002e71d
lea edx, [ebp - 0x84]
sub edx, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x1002e710
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsupr]
lea eax, [ebp - 0x37e4]
push eax
lea eax, [ebp - 0x37e0]
push eax
call fcn.1001e100
mov eax, dword [ebp - 0x37e0]
add esp, 0xc
mov dword [ebp - 0x3720], 0x94
lea ecx, [eax + eax*4]
mov eax, dword [ebp - 0x37e4]
lea esi, [eax + ecx*2]
lea eax, [ebp - 0x3720]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x1002ec8e
cmp dword [ebp - 0x3710], 2
jne 0x1002ec8e
cmp esi, 0x33
jae 0x1002e9f1
push str.PSAPI.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
mov dword [ebp - 0x37bc], ebx
test ebx, ebx
je 0x1002e9dc
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.EnumProcesses
push ebx
call esi
push str.EnumProcessModules
push ebx
mov edi, eax
call esi
push str.GetModuleFileNameExA
push ebx
mov dword [ebp - 0x37c8], eax
call esi
mov dword [ebp - 0x37cc], eax
test edi, edi
je 0x1002e9d5
cmp dword [ebp - 0x37c8], 0
je 0x1002e9d5
test eax, eax
je 0x1002e9d5
lea eax, [ebp - 0x37d4]
push eax
push 0x2000
lea eax, [ebp - 0x368c]
push eax
call edi
xor edi, edi
cmp dword [ebp - 0x37d4], edi
jle 0x1002e9b5
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
invalid
Function at 0x407281
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x461124], 0
jne 0x4072bf
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x407295
mov dword [ecx*4 + 0x461120], eax
inc ecx
cmp ecx, 0x100
jl 0x407290
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x4072ec
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x461120]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4072cd
not eax
pop ebp
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x42dbd0
Capabilities:
Encode data using xor

Disassembly:
cmp dword [edx + 0x55], ecx
push eax
cmp ecx, dword [ecx - 0x3378f536]
sbb dword [esi], edx
pop es
push es
mov ebx, eax
add al, byte [edx]
add eax, 0x8b150605
adc cl, byte [edi]
push es
push es
sal byte [ecx + 6], 6
push es
insb byte es:[edi], dx
invalid

Function at 0x4312c0
Capabilities:
Encode data using xor

Disassembly:
clc
pop ebp
push edi
pop es
push es
pushal
pop ebp
pop ecx
mov edx, ecx
or al, byte [edi + 0x73007f5]
pop es
xor byte [edi], al
push es
xchg ebp, esi
add eax, 0x6506073c
mov ebx, eax
loop 0x4312cd
add eax, 0x157b0605
int 0x8b
xor al, byte [eax]
add eax, 0x6060605
push es
out dx, eax
ret 0x608

Function at 0x436170
Capabilities:
Encode data using xor

Disassembly:
xor al, byte [ecx]
add eax, 0x8f7ef05
push es
push es
xchg ecx, eax
wait
invalid
inc dword [0x32938f05]
add dword [0x8cfef05], eax
push es
push es
ror byte [esi], 6
push es
push es
jno 0x43614d
push es
xchg ecx, eax
xchg ebx, eax
out dx, al
invalid

Function at 0x438e20
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3a8
mov eax, dword [0x594ccc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
xor ecx, ecx
push 0x18e
push ecx
lea edx, [ebp - 0x3a2]
push edx
mov dword [ebp - 0x3a8], eax
mov word [ebp - 0x3a4], cx
call fcn.0051d250
add esp, 0xc
lea eax, [ebp - 0x3a4]
push eax
push 0xc7
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
jne 0x438e83
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051d23b
mov esp, ebp
pop ebp
ret
push edi
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x212]
push edx
mov word [ebp - 0x214], cx
call fcn.0051d250
mov eax, dword [0x561044]
mov cx, word [0x561048]
add esp, 0xc
mov dword [ebp - 0xc], eax
mov word [ebp - 8], cx
lea edi, [ebp - 0x3a4]
push esi
lea esp, [esp]
mov dx, word [edi]
push 0x104
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0xc]
push ecx
mov word [ebp - 0xc], dx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x438f30
lea eax, [ebp - 0x214]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x438ef0
sub eax, edx
sar eax, 1
mov esi, eax
mov edx, 0x5c
mov word [ebp + esi*2 - 0x214], dx
inc esi
push esi
lea ecx, [ebp - 0x214]
push ecx
xor eax, eax
push ebx
mov word [ebp + esi*2 - 0x214], ax
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
je 0x438f53
lea esp, [esp]
mov dx, word [edi]
add edi, 2
test dx, dx
jne 0x438f30
cmp word [edi], dx
jne 0x438ec0
pop esi
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051d23b
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0x10]
lea eax, [ebx + esi*2]
push eax
mov eax, dword [ebp - 0x3a8]
lea ecx, [ebp - 0xc]
push ecx
push 0x561038
push edx
push eax
call fcn.00436ed0
mov ecx, dword [ebp - 4]
add esp, 0x14
pop esi
pop edi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0051d23b
mov esp, ebp
pop ebp
ret
Function at 0x441530
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x594ccc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x8c]
push ecx
push edi
mov dword [ebp - 0x90], eax
mov byte [ebp - 0x85], 0
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
jne 0x44157d
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051d23b
mov esp, ebp
pop ebp
ret
push ebx
push esi
call fcn.0051e9bc
add esp, 4
mov ebx, eax
push ebx
push esi
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x441625
lea edx, [ebp - 0x8c]
push edx
lea eax, [ebp - 0x98]
push eax
push str.VarFileInfoTranslation
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x441625
mov esi, dword [ebp - 0x90]
test esi, esi
je 0x441625
mov eax, dword [ebp - 0x98]
movzx ecx, word [eax + 2]
movzx edx, word [eax]
push ecx
push edx
push str.StringFileInfo_04x_04xFileDescription
lea eax, [ebp - 0x84]
push 0x80
push eax
call fcn.00436fa0
add esp, 0x14
lea ecx, [ebp - 0x8c]
push ecx
lea edx, [ebp - 0x94]
push edx
lea eax, [ebp - 0x84]
push eax
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x441625
mov ecx, dword [ebp - 0x94]
mov edx, dword [ebp + 0x10]
push ecx
push edx
push esi
call fcn.00436bb0
test eax, eax
jl 0x441625
mov byte [ebp - 0x85], 1
push ebx
call fcn.0051e865
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x85]
add esp, 4
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.0051d23b
mov esp, ebp
pop ebp
ret

Function at 0x441e30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
push esi
xor esi, esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
cmp eax, esi
je 0x441e93
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 8]
or ecx, 0x20019
push ecx
push eax
push edx
lea ecx, [ebp - 0xc]
call fcn.00415210
mov esi, dword [ebp - 0xc]
test eax, eax
jne 0x441e93
mov ecx, dword [ebp + 0x14]
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 8]
push edx
push 0
push eax
push esi
mov dword [ebp - 4], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x441e93
cmp dword [ebp - 8], 4
jne 0x441e93
mov bl, 1
jmp 0x441e95
xor bl, bl
test esi, esi
je 0x441ea0
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x441fe0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x594ccc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
xor eax, eax
push 0x208
mov esi, ecx
push eax
lea ecx, [ebp - 0x20e]
push ecx
mov word [ebp - 0x210], ax
call fcn.0051d250
mov eax, dword [ebx]
add esp, 0xc
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x210]
push ecx
push 0
push 0
push eax
push edi
mov dword [ebp - 0x218], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, dword [esi]
xor edx, edx
mov word [ebp - 8], dx
mov ecx, dword [esi - 0xc]
lea edx, [ecx + ecx + 2]
mov dword [ebp - 0x214], edx
test eax, eax
jne 0x4420a1
mov ecx, esi
lea eax, [ebp - 0x210]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x442086
test dx, dx
je 0x442082
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x442086
add eax, 4
add ecx, 4
test dx, dx
jne 0x442060
xor eax, eax
jmp 0x44208b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4420a1
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051d23b
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebx]
push eax
push esi
push 1
push 0
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.0051d23b
mov esp, ebp
pop ebp
ret
Function at 0x4b42b0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x594ccc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x583328]
test eax, eax
jl 0x4b42e3
xor ecx, ecx
test eax, eax
setne cl
mov al, cl
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051d23b
mov esp, ebp
pop ebp
ret
xor eax, eax
push esi
push 0x11c
push eax
lea edx, [ebp - 0x120]
push edx
mov dword [0x583328], 0
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x124], eax
call fcn.0051d250
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x11c
call esi
test eax, eax
jne 0x4b436f
lea ecx, [ebp - 0x120]
push ecx
mov dword [ebp - 0x120], 0x114
call esi
test eax, eax
je 0x4b43be
push str.GetNativeSystemInfo
push 0x55ff94
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4b43be
lea edx, [ebp - 0x144]
push edx
call eax
mov eax, dword [ebp - 0x144]
cmp ax, 9
je 0x4b43a5
cmp ax, 6
jne 0x4b43be
mov eax, 1
mov dword [0x583328], eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051d23b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor al, al
pop esi
call fcn.0051d23b
mov esp, ebp
pop ebp
ret

Function at 0x4b4d70
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x5979d8]
test eax, eax
jne 0x4b4d86
call fcn.0044ef40
mov dword [0x5979d8], eax
mov eax, dword [eax + 0x140]
cmp eax, 2
jne 0x4b4da6
mov eax, dword [0x5979d8]
mov ecx, dword [eax + 0x140]
cmp ecx, 2
jne 0x4b4da6
mov eax, dword [eax + 0x50]
jmp 0x4b4da8
xor eax, eax
test eax, eax
je 0x4b4daf
pop ebp
jmp eax
pop ebp
jmp dword [sym.imp.KERNEL32.dll_DeleteFileW]
Function at 0x103cb1d0
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x103cb3bd
pushal
mov esi, section.UPX1
lea edi, [esi - 0x239000]
push edi
or ebp, 0xffffffff
jmp 0x103cb1fa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x103cb201
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x103cb1f0
mov eax, 1
add ebx, ebx
jne 0x103cb213
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x103cb224
jne 0x103cb243
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x103cb243
dec eax
add ebx, ebx
jne 0x103cb230
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x103cb208
add ebx, ebx
jne 0x103cb23f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x103cb295
xor ecx, ecx
sub eax, 3
jb 0x103cb25b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x103cb2ca
sar eax, 1
mov ebp, eax
jmp 0x103cb266
add ebx, ebx
jne 0x103cb266
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x103cb234
inc ecx
add ebx, ebx
jne 0x103cb274
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x103cb234
add ebx, ebx
jne 0x103cb281
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x103cb276
jne 0x103cb292
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x103cb276
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x103cb2b4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x103cb2a6
jmp 0x103cb1f6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x103cb2b4
add edi, ecx
jmp 0x103cb1f6
pop esi
mov edi, esi
mov ecx, 0xdcc8
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x103cb2d2
cmp byte [edi], 0x2f
jne 0x103cb2d2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x103cb2d7
lea edi, [esi + 0x3bc000]
mov eax, dword [edi]
or eax, eax
je 0x103cb34f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x3cf800]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x3cf954]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x103cb304
mov ecx, edi
jns 0x103cb333
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x3cf958]
or eax, eax
je 0x103cb349
mov dword [ebx], eax
add ebx, 4
jmp 0x103cb321
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x103cb380
cmp al, 0xef
ja 0x103cb373
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x103cb355
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x103cb362
mov ebp, dword [esi + 0x3cf95c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x103cb3b4
sub esp, 0xffffff80
jmp 0x1014b9be
Function at 0x412678
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x412687
pop dword [ebp - 0x50]
mov eax, 0x412687
sub dword [ebp - 0x50], eax
push 0x40
push 0x1000
push 0x38316
push 0
mov eax, 0x93b776e0
add eax, 0x6c89e9ec
add eax, dword [ebp - 0x50]
call dword [eax]
mov ecx, 0x47e5ecd0
add ecx, 0xb81a6078
mov esi, eax
mov edx, 0xc4ef6d62
add edx, 0x3b54fa9e
add edx, dword [ebp - 0x50]
mov edi, 0x41c3e39
sub edi, 0xa2983948
mov ebx, dword [edx]
xor dword [ebp - 0x1c], 0xc67e0034
sub ebx, edi
xor dword [ebp - 0x4c], edi
mov dword [esi], ebx
add dword [ebp - 4], edx
add esi, 0xd51c4312
add esi, 0x2ae3bcf2
add edx, 4
loop 0x4126e1
add eax, 0x127f3
mov ebx, eax
add eax, 0x9c707b0c
sub eax, 0x9c707b07
mov ecx, 0x82904988
add ecx, 0x7dafb678
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x18003370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x180033c6
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x180033c6
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 8]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x180033b8
cmp esi, ecx
jae 0x180033c6
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edx, 1
jne 0x180033a6
cmp esi, ecx
jae 0x180033c6
cmp word [esi], 0
je 0x180033c6
mov eax, esi
jmp 0x180033c8
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret