joyce8/EMBER2024-capa huggingface dataset:
Function at 0x713e7440
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x713e755c
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 1
je 0x713e74d5
cmp cl, 2
je 0x713e747d
cmp cl, 3
jne 0x713e7545
mov byte [eax + 8], 1
jmp 0x713e7541
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.713ec670
nop
lea eax, [0x7154b898]
mov dword [esp], eax
call fcn.713c9ad0
nop
mov eax, dword [0x7154b864]
sub eax, dword [0x7154b848]
mov dword [0x7154b864], eax
mov eax, dword [0x7154b854]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x7154b854], ecx
nop
lea eax, [0x7154b898]
mov dword [esp], eax
call fcn.713c9cd0
jmp 0x713e7541
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.713d3830
nop
lea eax, [0x7154b898]
mov dword [esp], eax
call fcn.713c9ad0
nop
mov eax, dword [0x7154b83c]
sub eax, dword [0x7154b820]
mov dword [0x7154b83c], eax
mov eax, dword [0x7154b82c]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x7154b82c], ecx
nop
nop
lea eax, [0x7154b898]
mov dword [esp], eax
call fcn.713c9cd0
add esp, 0x14
ret
lea eax, [0x7149741d]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.713f4a70
nop
call fcn.7141e910
jmp fcn.713e7440
Function at 0x7140f9c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x7140fb47
sub esp, 0x10
mov ecx, dword [esp + 0x18]
test ecx, ecx
jbe 0x7140fb3d
mov edx, dword [esp + 0x14]
movzx ebx, byte [edx]
test ebx, ebx
jne 0x7140fa1c
movzx ebp, byte [esp + 0x28]
xchg ebp, eax
test al, al
xchg ebp, eax
jne 0x7140fa1c
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov byte [esp + 0x38], 0
add esp, 0x10
ret
test ebx, 0x80
je 0x7140fa2f
xor eax, eax
xor ebx, ebx
xor ebp, ebp
jmp 0x7140fb12
mov eax, 1
mov ebp, ebx
and ebx, 1
neg ebx
shr ebp, 1
xor ebx, ebp
mov ebp, dword [esp + 0x24]
add dword [ebp], ebx
cmp ecx, eax
jb 0x7140fb04
sub ecx, eax
mov ebx, dword [esp + 0x1c]
sub ebx, eax
mov ebp, ebx
neg ebx
sar ebx, 0x1f
and eax, ebx
lea ebx, [edx + eax]
test ecx, ecx
jbe 0x7140fafb
movzx edx, byte [edx + eax]
test edx, 0x80
je 0x7140fa86
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ebp
xor eax, eax
xor edx, edx
xor esi, esi
jmp 0x7140facf
mov eax, 1
cmp eax, ecx
ja 0x7140fabd
mov esi, dword [esp + 0x20]
add dword [esi], edx
sub ebp, eax
mov edx, ebp
xchg ebp, ebx
neg ebx
xchg ebp, ebx
sar ebp, 0x1f
and ebp, eax
add ebx, ebp
mov dword [esp + 0x2c], ebx
sub ecx, eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
mov byte [esp + 0x38], 1
add esp, 0x10
ret
call fcn.7141fe30
lea esi, [ecx + 7]
mov ecx, dword [esp + 8]
mov eax, ebp
mov ebp, dword [esp + 0xc]
cmp eax, ecx
jae 0x7140faf6
movzx edi, byte [eax + ebx]
lea ebp, [eax + 1]
mov eax, edi
and edi, 0x7f
mov ecx, esi
shl edi, cl
or edx, edi
test al, 0x80
jne 0x7140fac2
mov ecx, dword [esp + 8]
mov eax, ebp
mov ebp, dword [esp + 0xc]
jmp 0x7140fa8b
call fcn.7141fdd0
xor eax, eax
mov ecx, eax
call fcn.7141fdc0
call fcn.7141fe30
lea ebp, [ecx + 7]
mov ecx, dword [esp + 0x18]
mov eax, edi
cmp ecx, eax
jbe 0x7140fb38
movzx esi, byte [eax + edx]
lea edi, [eax + 1]
mov eax, esi
and esi, 0x7f
mov ecx, ebp
shl esi, cl
or ebx, esi
test al, 0x80
jne 0x7140fb09
mov ecx, dword [esp + 0x18]
mov eax, edi
jmp 0x7140fa34
call fcn.7141fdd0
xor eax, eax
mov ecx, eax
call fcn.7141fdc0
nop
call fcn.7141e910
jmp fcn.7140f9c0
Function at 0x71413bb0
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x71413cb0
sub esp, 0x28
mov eax, dword [esp + 0x2c]
mov dword [eax + 0x8c], 0
mov dword [eax + 0x90], 0
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0x58]
mov dword [eax + 0x94], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp], ecx
call fcn.71414440
mov eax, dword [esp + 4]
mov dword [esp + 0x14], eax
lea ecx, [0x71485ea0]
mov dword [esp], ecx
call fcn.713cbb70
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x14]
inc ecx
mov dword [eax], ecx
lea ecx, [0x7154b930]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 1
mov dword [esp + 0xc], 1
call fcn.71413430
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx + 0x50]
mov ecx, dword [ecx + 0x54]
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
mov byte [esp], 0xd
mov dword [esp + 4], 2
lea eax, [esp + 0x18]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], 2
call fcn.71412850
add esp, 0x28
ret
call fcn.7141e910
jmp fcn.71413bb0
Function at 0x71417220
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x714172bf
sub esp, 0x30
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.7141ff57
lea ecx, [0x714172d0]
mov dword [esp + 0xc], ecx
lea ecx, [esp + 4]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 8]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.7141e800
mov ecx, dword [esp + 4]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call fcn.7141e910
jmp fcn.71417220
Function at 0x7141fbd0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x71567540]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x7141e3bb
je 0x7141e40e
cmp ebx, 0x20
jbe 0x7141e414
cmp ebx, 0x40
jbe 0x7141e45a
jmp 0x7141e4fb
test ebx, ebx
je 0x7141e404
add eax, 0x10
test ax, 0xff0
je 0x7141e3f0
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x714b7be0]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x714b7ce0]
jmp 0x7141e3d8
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x7141e3d8
pxor xmm1, xmmword [0x71567550]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x71567550]
pxor xmm2, xmmword [0x71567560]
pxor xmm3, xmmword [0x71567570]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x71567550]
pxor xmm2, xmmword [0x71567560]
pxor xmm3, xmmword [0x71567570]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x7141e55a
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x7156724a], 0
je 0x7141fbea
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x7141e380
jmp fcn.713c8680
Function at 0x7141fbf0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x713c2d2e
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.713c8680
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
add esp, 0x10
ret
call fcn.7141e910
jmp 0x713c2cf0
cmp byte [0x7156724a], 0
je 0x7141fc0b
mov eax, dword [esp + 4]
mov ebx, dword [eax + 4]
mov eax, dword [eax]
lea edx, [esp + 0xc]
jmp 0x7141e380
jmp 0x713c2cf0
Function at 0x7142f030
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x7142f265
sub esp, 0x64
mov eax, 0
mov dword [esp + 0x60], eax
mov byte [esp + 0x23], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
mov dword [esp + 0x80], 0
mov eax, dword [esp + 0x68]
mov ecx, dword [eax + 0x1c]
mov dword [esp], 0
mov dword [esp + 4], ecx
call fcn.713c60d0
movzx eax, byte [esp + 8]
test al, al
jne 0x7142f0e0
mov eax, dword [esp + 0x68]
mov dword [esp], eax
call fcn.71424a40
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
lea eax, [0x7142f270]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 0x40], eax
lea ecx, [esp + 0x3c]
mov dword [esp + 0x60], ecx
mov byte [esp + 0x23], 1
mov ecx, 1
mov edx, dword [esp + 0x70]
mov ebx, dword [esp + 0x74]
mov ebp, dword [esp + 0x6c]
jmp 0x7142f142
mov eax, dword [esp + 0x68]
mov dword [esp], eax
call fcn.7142f400
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], ecx
add esp, 0x64
ret
sub ecx, eax
test ecx, ecx
xchg esi, ebx
setne bl
xchg esi, ebx
add dword [esp + 0x78], eax
mov dword [esp + 0x2c], ecx
mov ebx, dword [esp + 0x28]
sub ebx, eax
mov edi, ebx
neg ebx
sar ebx, 0x1f
and eax, ebx
mov edx, esi
mov esi, dword [esp + 0x38]
lea ebp, [esi + eax]
mov eax, dword [esp + 0x68]
mov ebx, edi
mov esi, ecx
mov ecx, edx
mov edx, esi
test cl, cl
je 0x7142f232
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], edx
mov dword [esp + 0x38], ebp
mov ecx, dword [eax + 8]
mov dword [esp + 0x44], ebp
mov dword [esp + 0x48], edx
mov dword [esp + 0x4c], ebx
mov esi, dword [eax + 0x1c]
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x50], ecx
lea ecx, [esp + 0x44]
mov dword [esp + 0x54], ecx
mov dword [esp + 0x58], esi
lea ecx, [esp + 0x50]
mov dword [esp], ecx
lea ecx, [esp + 0x30]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 1
mov byte [esp + 0x14], 1
call fcn.714059c0
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x7142f202
mov dword [esp + 0x2c], 0
mov eax, dword [esp + 0x68]
mov ecx, dword [eax + 0xc]
mov dword [esp], ecx
lea ecx, [esp + 0x2c]
mov dword [esp + 4], ecx
call fcn.713c5900
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
cmp ecx, eax
jae 0x7142f10b
jmp 0x7142f256
mov eax, dword [esp + 0x68]
mov dword [esp], eax
call fcn.7142f400
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], ecx
mov byte [esp + 0x23], 0
mov edx, dword [esp + 0x60]
mov eax, dword [edx]
call eax
add esp, 0x64
ret
mov dword [esp + 0x7c], 0
mov dword [esp + 0x80], 0
mov byte [esp + 0x23], 0
mov edx, dword [esp + 0x60]
mov eax, dword [edx]
call eax
add esp, 0x64
ret
call fcn.7141fe20
nop
call fcn.713f38f0
add esp, 0x64
ret
call fcn.7141e910
jmp fcn.7142f030
Function at 0x71460730
Capabilities:
Hash data with md5

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 0x20]
cmp eax, dword [ecx + 8]
jbe 0x714608f9
sub esp, 0xa0
lea edi, [esp + 0x3c]
xor eax, eax
call fcn.7141ff49
nop
mov dword [esp + 0x3c], 0x67452301
mov dword [esp + 0x40], 0xefcdab89
mov dword [esp + 0x44], 0x98badcfe
mov dword [esp + 0x48], 0x10325476
mov dword [esp + 0x8c], 0
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 0
lea ecx, [esp + 0x1c]
mov dword [esp], ecx
mov ecx, dword [esp + 0xa4]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0xa8]
mov dword [esp + 8], ecx
call fcn.7140cb50
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
lea ebp, [esp + 0x3c]
mov dword [esp], ebp
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
call fcn.71442030
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
test ecx, ecx
je 0x7146083d
mov dword [esp + 0x98], 0
mov dword [esp + 0x9c], 0
test edx, edx
je 0x71460810
mov edx, dword [edx + 4]
mov dword [esp + 0x98], edx
mov dword [esp + 0x9c], ebx
lea eax, [esp + 0x98]
mov dword [esp], eax
mov dword [esp + 4], 1
mov dword [esp + 8], 1
call fcn.7145ff00
lea eax, [esp + 0x3c]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call fcn.71442200
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x98], 0
mov dword [esp + 0x9c], 0
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
call fcn.713c9680
mov eax, dword [esp + 0xc]
lea ecx, [0x71485200]
mov dword [esp + 0x98], ecx
mov dword [esp + 0x9c], eax
lea eax, [0x71495072]
mov dword [esp], eax
mov dword [esp + 4], 2
lea eax, [esp + 0x98]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 1
call fcn.71452800
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0xac], eax
mov dword [esp + 0xb0], ecx
add esp, 0xa0
ret
call fcn.7141e910
jmp fcn.71460730
Function at 0x4013b4
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x4013c6
mov eax, dword [0x4a808b]
shl eax, 2
mov dword [0x4a808f], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.00485c40
pop edx
call fcn.00485ba4
call fcn.00485c80
push 0
call fcn.00487270
pop ecx
push 0x4a8034
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x4a8093], eax
push 0
jmp fcn.0048d720

Function at 0x411dfc
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
test dl, dl
push ebx
push esi
mov byte [ebp - 0x14], dl
jle 0x411e10
call fcn.00493110
mov ebx, ecx
mov byte [ebp - 0x35], dl
mov dword [ebp - 4], eax
lea esi, [ebp - 0x34]
mov eax, 0x4bb4b0
call fcn.004865d0
mov word [esi + 0x10], 8
mov ecx, ebx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00434c38
add dword [esi + 0x1c], 2
mov eax, dword [ebp - 4]
xor edx, edx
add eax, 0x30
mov dword [eax], edx
xor edx, edx
inc dword [esi + 0x1c]
mov eax, dword [ebp - 4]
add eax, 0x34
mov dword [eax], edx
xor edx, edx
inc dword [esi + 0x1c]
mov eax, dword [ebp - 4]
add eax, 0x38
mov dword [eax], edx
lea eax, [ebp - 8]
inc dword [esi + 0x1c]
mov edx, 0x4bb2cb
mov word [esi + 0x10], 0x14
call fcn.00491ec0
inc dword [esi + 0x1c]
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
add eax, 0x30
call fcn.00492034
dec dword [esi + 0x1c]
lea eax, [ebp - 8]
mov edx, 2
call fcn.00492004
mov word [esi + 0x10], 0x20
mov edx, 0x4bb2cb
lea eax, [ebp - 0xc]
call fcn.00491ec0
inc dword [esi + 0x1c]
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
add eax, 0x34
call fcn.00492034
dec dword [esi + 0x1c]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00492004
mov word [esi + 0x10], 0x2c
mov edx, 0x4bb2cb
lea eax, [ebp - 0x10]
call fcn.00491ec0
inc dword [esi + 0x1c]
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00492034
dec dword [esi + 0x1c]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00492004
mov ecx, dword [esi]
mov dword fs:[0], ecx
mov eax, dword [ebp - 4]
cmp byte [ebp - 0x35], 0
je 0x411f15
call fcn.0049311d
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x416740
Capabilities:
Query environment variable

Disassembly:
push esi
push edi
add esp, 0xfffffc00
cmp byte [0x4bcf78], 0
jne 0x4167dd
mov esi, 0x4bd379
mov edi, esp
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
push 0x400
lea eax, [esp + 4]
push eax
push str.374DE290_123F_4565_9164_39C4925E467B
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerUser_Shell_Folders
push SysReAllocStringLen
call fcn.004187d8
add esp, 0x14
cmp byte [esp], 0
jne 0x4167ab
push 0x400
lea edx, [esp + 4]
push edx
push str.Desktop
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerUser_Shell_Folders
push SysReAllocStringLen
call fcn.004187d8
add esp, 0x14
cmp byte [esp], 0
jne 0x4167c9
push 0x400
call fcn.00416720
push eax
lea ecx, [esp + 8]
push ecx
call fcn.00417ef0
add esp, 0xc
push 0x400
push 0x4bcf78
lea eax, [esp + 8]
push eax
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
mov eax, 0x4bcf78
add esp, 0x400
pop edi
pop esi
ret

Function at 0x4172bc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push esi
call fcn.004861d0
pop ecx
mov edi, eax
xor ecx, ecx
mov eax, dword [ebp + 8]
mov ebx, eax
cmp ecx, dword [ebp + 0xc]
jge 0x4172eb
mov eax, ecx
inc ecx
cdq
idiv edi
mov al, byte [esi + edx]
xor byte [ebx], al
inc ebx
cmp ecx, dword [ebp + 0xc]
jl 0x4172da
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x417bf8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
test esi, esi
je 0x417c25
test ebx, ebx
je 0x417c25
cmp byte [esi], 0
je 0x417c25
cmp byte [ebx], 0
je 0x417c25
push ebx
call sub.KERNEL32.DLL_DeleteFileA
push ebx
push esi
call fcn.00417964
add esp, 8
pop esi
pop ebx
pop ebp
ret
Function at 0x4187d8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
test eax, eax
je 0x418805
test edx, edx
je 0x418805
cmp edi, 0x4d2850
je 0x418805
test esi, esi
je 0x418805
cmp dword [ebp + 0x18], 1
jae 0x418809
xor eax, eax
jmp 0x418850
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 4], ecx
mov byte [esi], 0
lea ecx, [ebp - 4]
push ecx
push 0x20019
push 0
push edx
push eax
call fcn.00418780
add esp, 0x14
test eax, eax
jne 0x41884e
lea eax, [ebp + 0x18]
push eax
push esi
push 0
push 0
push edi
mov edx, dword [ebp - 4]
push edx
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x418845
mov bl, 1
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x418858
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
test eax, eax
je 0x418877
test edx, edx
je 0x418877
cmp esi, 0x4d2850
jne 0x41887b
xor eax, eax
jmp 0x4188be
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 4], ecx
lea ecx, [ebp - 4]
push ecx
push 0x20019
push 0
push edx
push eax
call fcn.00418780
add esp, 0x14
test eax, eax
jne 0x4188bc
push 0
push 0
push 0
push 0
push esi
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x4188b3
mov bl, 1
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x418d24
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x418e73
cmp dword [ebp + 0xc], 1
jb 0x418e73
mov byte [ebx], 0
mov dword [ebp - 8], 0x280
mov eax, dword [ebp - 8]
push eax
call fcn.00485ab4
pop ecx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x418d88
lea edx, [ebp - 8]
push edx
mov ecx, dword [ebp - 4]
push ecx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
jne 0x418d88
mov eax, dword [ebp - 4]
push eax
call fcn.00485ac4
pop ecx
mov edx, dword [ebp - 8]
push edx
call fcn.00485ab4
pop ecx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x418e57
lea ecx, [ebp - 8]
push ecx
mov eax, dword [ebp - 4]
push eax
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x418e3f
mov edi, dword [ebp - 4]
test edi, edi
je 0x418e3f
xor eax, eax
lea esi, [edi + 0x194]
mov dword [ebp - 0xc], eax
jmp 0x418e2a
push esi
push edi
mov esi, 0x4d196d
lea edi, [ebp - 0x20]
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [edi + 0x190]
dec eax
cmp eax, dword [ebp - 0xc]
jne 0x418dfd
push 0x4d2b4c
xor edx, edx
mov dl, byte [esi]
push edx
push str._.2X_s
push 0x14
lea ecx, [ebp - 0x20]
push ecx
call fcn.00488dd0
add esp, 0x14
jmp 0x418e15
xor eax, eax
mov al, byte [esi]
push eax
push str._.2X:
push 0x14
lea edx, [ebp - 0x20]
push edx
call fcn.00488dd0
add esp, 0x10
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x20]
push ecx
push eax
push ebx
call fcn.00417f30
add esp, 0xc
inc dword [ebp - 0xc]
inc esi
mov edx, dword [edi + 0x190]
cmp edx, dword [ebp - 0xc]
ja 0x418dbf
mov edi, dword [edi]
test edi, edi
jne 0x418db2
mov ecx, dword [ebp - 4]
push ecx
call fcn.00485ac4
pop ecx
jmp 0x418e57
push ebx
call fcn.004861d0
pop ecx
mov byte [ebx + eax - 1], 0
push ebx
call fcn.004861d0
pop ecx
test eax, eax
jbe 0x418e73
push ebx
call fcn.004861d0
pop ecx
movzx eax, byte [ebx + eax - 1]
cmp eax, 0x3b
je 0x418e4b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x419140
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbfc
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
test esi, esi
je 0x41920c
cmp edi, 1
jb 0x41920c
xor eax, eax
mov dword [ebp - 4], eax
mov byte [esi], 0
test ebx, ebx
jne 0x4191d3
push esi
push edi
mov esi, 0x4d1d83
lea edi, [ebp - 0x404]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push 0x400
lea eax, [ebp - 0x404]
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryA
cmp byte [ebp - 0x404], 0
je 0x4191f9
push 0x4d2bf0
call fcn.004861d0
pop ecx
lea edx, [ebp - 4]
mov byte [ebp + eax - 0x404], 0
push 0
push 0
push 0
push 0
push edx
push 0
lea ecx, [ebp - 0x404]
push 0
push ecx
call sub.KERNEL32.DLL_GetVolumeInformationA
jmp 0x4191f9
cmp byte [ebx], 0
je 0x41920c
push ebx
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, 3
jne 0x41920c
push 0
push 0
push 0
lea eax, [ebp - 4]
push 0
push eax
push 0
push 0
push ebx
call sub.KERNEL32.DLL_GetVolumeInformationA
mov edx, dword [ebp - 4]
push edx
push str._08X
push edi
push esi
call fcn.00488dd0
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret