joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e0c5
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov eax, 0x4014
call fcn.0040ff60
mov eax, dword [0x4525e4]
xor eax, esp
mov dword [esp + 0x4010], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x4024]
lea eax, [esp + 0x1c]
push edi
mov ebp, 0x1000
mov dword [esp + 0x1c], esi
xor ebx, ebx
push ebp
push ebx
push eax
mov edi, ebx
call fcn.00411e00
push ebp
lea eax, [esp + 0x1030]
push ebx
push eax
call fcn.00411e00
add esp, 0x18
mov dword [esp + 0x10], 0x800
lea eax, [esp + 0x18]
push eax
push 0x20019
push ebx
push 0x440080
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40e244
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [esp + 0x10]
push ebx
push ebx
push ebx
push ebx
push eax
lea eax, [esp + 0x34]
push eax
push ebx
push dword [esp + 0x34]
call ebp
test eax, eax
jne 0x40e244
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x20]
push eax
push 0x4400d8
push 0x440130
lea eax, [esp + 0x102c]
push 0x800
push eax
call fcn.004099fb
add esp, 0x14
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
lea eax, [esp + 0x102c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40e21c
push 0x1000
push eax
lea eax, [esp + 0x2028]
push eax
call fcn.00411e00
add esp, 0xc
mov dword [esp + 0x10], 0x800
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x2024]
push eax
lea eax, [esp + 0x24]
push eax
push 0
push 0x44013c
push dword [esp + 0x28]
call ebx
test eax, eax
jne 0x40e21c
cmp dword [esp + 0x10], eax
jbe 0x40e21c
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x800
push eax
lea eax, [esp + 0x3024]
push eax
lea eax, [esp + 0x24]
push eax
push 0
push 0x440154
push dword [esp + 0x28]
call ebx
xor eax, eax
mov dword [esp + 0x10], 0x800
push eax
push eax
push eax
push eax
lea eax, [esp + 0x20]
inc edi
push eax
lea eax, [esp + 0x34]
push eax
push edi
push dword [esp + 0x34]
call ebp
test eax, eax
je 0x40e167
lea eax, [esp + 0x3020]
mov ecx, esi
push eax
call fcn.0040d414
mov ecx, dword [esp + 0x4020]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040ff49
add esp, 0x4014
ret

Function at 0x40e841
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
push edi
mov dword [ebp - 4], esi
call fcn.0040eb6c
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax*2 + 2]
lea eax, [ebp - 4]
push eax
push 0x20006
push esi
push dword [0x4525dc]
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40e884
xor eax, eax
jmp 0x40e8a9
push edi
push dword [ebp + 0xc]
push 1
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x40e89e
xor esi, esi
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
leave
ret
Function at 0x40e8ad
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov eax, 0x2010
call fcn.0040ff60
mov eax, dword [0x4525e4]
xor eax, esp
mov dword [esp + 0x200c], eax
push ebx
mov ebx, dword [esp + 0x2018]
lea eax, [esp + 0x10]
push ebp
push esi
push edi
mov edi, dword [esp + 0x2028]
mov ebp, 0x1000
xor esi, esi
mov dword [esp + 0x18], 1
push ebp
push esi
push eax
mov dword [esp + 0x1c], esi
call fcn.00411e00
push ebp
lea eax, [esp + 0x102c]
push esi
push eax
call fcn.00411e00
push ebx
call fcn.0041f5c5
add esp, 0x1c
test eax, eax
je 0x40e946
push eax
push dword [esp + 0x2030]
push edi
call fcn.004239e2
add esp, 0xc
test eax, eax
je 0x40eadf
xor eax, eax
mov ecx, dword [esp + 0x201c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040ff49
add esp, 0x2010
ret
lea eax, [esp + 0x10]
push eax
push 0x20019
push esi
push dword [0x4525d8]
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40e92b
lea eax, [esp + 0x202c]
push eax
push edi
lea eax, [esp + 0x20]
push eax
push esi
push ebx
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x40eac3
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x800
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
push esi
push 0x4406dc
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40e9c1
xor esi, esi
inc esi
jmp 0x40eac3
push dword [esp + 0x10]
call ebp
lea eax, [esp + 0x10]
push eax
push 0x20019
push esi
push str.SOFTWAREOracleJavaDeploy
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40e9b9
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x800
push eax
lea eax, [esp + 0x1020]
push eax
lea eax, [esp + 0x20]
push eax
push esi
push str.deployment.modified.timestamp
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40e9b9
mov dword [esp + 0x14], 0x800
lea ecx, [esp + 0x1c]
lea eax, [esp + 0x101c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40ea4d
test dx, dx
je 0x40ea49
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40ea4d
add eax, 4
add ecx, 4
test dx, dx
jne 0x40ea27
mov eax, esi
jmp 0x40ea52
sbb eax, eax
or eax, 1
test eax, eax
js 0x40eadf
lea eax, [esp + 0x14]
push eax
push edi
lea eax, [esp + 0x20]
push eax
push esi
push ebx
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40e9b9
push dword [esp + 0x10]
call ebp
call fcn.0040cba0
test eax, eax
jne 0x40eadf
lea eax, [esp + 0x10]
push eax
push 0x20006
push esi
push dword [0x4525d8]
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40e92b
push dword [esp + 0x14]
push edi
push 1
push esi
push ebx
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x40ead0
push dword [esp + 0x10]
call ebp
mov eax, esi
jmp 0x40e92d
push dword [esp + 0x10]
call ebp
push edi
push ebx
call fcn.0040e841
pop ecx
pop ecx
xor eax, eax
inc eax
jmp 0x40e92d
Function at 0x40eae7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push dword [ebp + 8]
xor edi, edi
xor esi, esi
inc edi
mov dword [ebp - 4], esi
mov dword [ebp - 8], edi
call fcn.0041f5c5
pop ecx
test eax, eax
je 0x40eb1d
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.004239e2
add esp, 0xc
test eax, eax
jne 0x40eb3c
mov eax, edi
jmp 0x40eb68
lea eax, [ebp - 4]
push eax
push 0x20019
push esi
push dword [0x4525dc]
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40eb40
xor eax, eax
jmp 0x40eb68
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
test eax, eax
cmove esi, edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
leave
ret
Function at 0x40ecae
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov eax, 0x3014
call fcn.0040ff60
mov eax, dword [0x4525e4]
xor eax, esp
mov dword [esp + 0x3010], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x3024]
lea eax, [esp + 0x1c]
push edi
mov ebp, 0x1000
xor ebx, ebx
push ebp
push ebx
push eax
mov edi, ebx
call fcn.00411e00
push ebp
lea eax, [esp + 0x1030]
push ebx
push eax
call fcn.00411e00
add esp, 0x18
mov dword [esp + 0x10], 0x800
lea eax, [esp + 0x18]
push eax
push 0x20019
push ebx
push 0x440510
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40ee27
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [esp + 0x10]
push ebx
push ebx
push ebx
push ebx
push eax
lea eax, [esp + 0x34]
push eax
push ebx
push dword [esp + 0x34]
call ebp
test eax, eax
jne 0x40ee27
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x20]
push eax
push 0x440568
push 0x4405c0
lea eax, [esp + 0x102c]
push 0x800
push eax
call fcn.004099fb
add esp, 0x14
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
lea eax, [esp + 0x102c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40edfd
push 0x1000
push eax
lea eax, [esp + 0x2028]
push eax
call fcn.00411e00
add esp, 0xc
mov dword [esp + 0x10], 0x800
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x2024]
push eax
lea eax, [esp + 0x24]
push eax
push 0
push str.RuntimeLib
push dword [esp + 0x28]
call ebx
test eax, eax
jne 0x40edfd
cmp dword [esp + 0x10], eax
jbe 0x40edfd
mov eax, dword [esp + 0x302c]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push esi
lea eax, [esp + 0x24]
push eax
push 0
push 0x4405e4
push dword [esp + 0x28]
call ebx
xor eax, eax
mov dword [esp + 0x10], 0x800
push eax
push eax
push eax
push eax
lea eax, [esp + 0x20]
inc edi
push eax
lea eax, [esp + 0x34]
push eax
push edi
push dword [esp + 0x34]
call ebp
test eax, eax
je 0x40ed4c
xor ebx, ebx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, bx
jne 0x40ee2a
sub esi, ecx
xor eax, eax
mov ecx, dword [esp + 0x3020]
sar esi, 1
cmp eax, esi
pop edi
pop esi
pop ebp
sbb eax, eax
pop ebx
xor ecx, esp
neg eax
call fcn.0040ff49
add esp, 0x3014
ret
Function at 0x40ee5a
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x22c]
sub esp, 0x2ac
mov eax, dword [0x4525e4]
xor eax, ebp
mov dword [ebp + 0x228], eax
push ebx
push 0x208
xor ebx, ebx
lea eax, [ebp + 0x20]
push ebx
push eax
call fcn.00411e00
add esp, 0xc
lea eax, [ebp + 0x20]
push eax
push ebx
push ebx
push 0x2c
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x40eea4
xor eax, eax
jmp 0x40efb4
xor eax, eax
mov dword [ebp + 0x18], ebx
push esi
mov word [ebp + 8], ax
lea ecx, [ebp + 8]
push edi
lea eax, [ebp + 0x20]
mov dword [ebp + 0x1c], 7
push eax
call fcn.0040f81f
push str.JavaJava_Updatejucheck.exe
lea ecx, [ebp + 8]
call fcn.0040f79c
push eax
lea ecx, [ebp - 0x28]
call fcn.0040f555
lea ecx, [ebp + 8]
call fcn.0040f722
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp + 8]
push 0x22
push eax
call fcn.0040f10e
add esp, 0xc
mov esi, eax
mov ecx, esi
push 0x22
call fcn.0040f892
push esi
lea ecx, [ebp - 0x10]
call fcn.0040f555
lea ecx, [ebp + 8]
call fcn.0040f722
push 0x44
pop esi
push esi
lea eax, [ebp - 0x80]
push ebx
push eax
call fcn.00411e00
xor eax, eax
mov dword [ebp - 0x80], esi
lea edi, [ebp - 0x3c]
mov dword [ebp + 0x14], ebx
stosd dword es:[edi], eax
lea ecx, [ebp - 0x10]
add esp, 0xc
mov dword [ebp + 0x18], ebx
cmp dword [ebp + 4], 8
mov dword [ebp + 0x1c], ebx
cmovae ecx, dword [ebp - 0x10]
push dword [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp]
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x10]
cmovae ecx, dword [ebp - 0x10]
push eax
push ecx
lea ecx, [ebp + 0x14]
call fcn.0040f28e
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], ebx
push eax
lea ecx, [ebp + 0x14]
call fcn.0040f530
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x3c]
push ecx
lea ecx, [ebp - 0x80]
push ecx
push ebx
push ebx
push 0x8000000
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push 1
push ebx
push ebx
push dword [ebp + 0x14]
push eax
call fcn.0040c0e4
add esp, 0x28
lea ecx, [ebp + 0x14]
neg eax
sbb esi, esi
neg esi
call fcn.0040f6fc
lea ecx, [ebp - 0x10]
call fcn.0040f722
lea ecx, [ebp - 0x28]
call fcn.0040f722
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp + 0x228]
xor ecx, ebp
pop ebx
call fcn.0040ff49
add ebp, 0x22c
leave
ret

Function at 0x40efca
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.0040ff60
mov eax, dword [0x4525e4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0x400
lea eax, [ebp - 0x804]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
test eax, eax
je 0x40f039
push str.DeploymentRuleSet.jar
lea eax, [ebp - 0x804]
push eax
push str._sSunJavaDeployment_s
lea eax, [ebp - 0x1004]
push esi
push eax
call fcn.0040f50f
add esp, 0x14
test eax, eax
jle 0x40f039
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40f039
test al, 0x10
jne 0x40f039
xor eax, eax
inc eax
jmp 0x40f03b
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040ff49
leave
ret
Function at 0x42b2bb
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042ae0e

Function at 0x42fdfc
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042faad

Function at 0x42fe07
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042fc37
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x7fe83efb
test eax, eax
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x42e024
nop
nop
nop
nop
nop
mov eax, section..tls
nop
mov ebx, 0x42cd70
mov ecx, 0x23057c9a
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x40313b
Capabilities:
Print debug messages

Disassembly:
push 0x18c
push 0x4f6a58
call fcn.004bff10
mov dword [ebp - 0x134], ecx
xor ebx, ebx
mov byte [ebp - 0x11d], bl
mov esi, ebx
mov dword [ebp - 0x144], esi
mov dword [ebp - 0x130], ebx
mov dword [ebp - 0x128], ebx
mov edi, ebx
mov dword [ebp - 0x138], edi
mov dword [ebp - 0x12c], ebx
mov dword [ebp - 0x13c], ebx
mov dword [ebp - 0x140], ebx
mov dword [ebp - 0x124], ebx
mov dword [ebp - 4], ebx
call fcn.00402d67
test al, al
je 0x40339a
push str.Mssign32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
mov dword [ebp - 0x144], esi
test esi, esi
jne 0x4031c3
push str.CodeSignFile:_LoadLibrary_failed
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x40339a
push str.SignerSignEx
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x148], eax
test eax, eax
je 0x40339a
push str.SignerFreeSignerContext
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x130], eax
test eax, eax
je 0x40339a
push ebx
push 0x80
push 3
push ebx
push ebx
push 0xc0000000
push dword [ebp - 0x134]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x128], eax
test eax, eax
jne 0x403223
push str.CodeSignFile:_CreateFile_failed
jmp 0x4031b8
push str.Root
push 0x20000
push ebx
push ebx
push 0xa
call dword [sym.imp.CRYPT32.dll_CertOpenStore]
mov edi, eax
mov dword [ebp - 0x138], edi
test edi, edi
jne 0x40324d
push str.CodeSignFile:_Open_store_failed
jmp 0x4031b8
push ebx
push str.64Signer.4
push 0x80007
push ebx
push 0x10001
push edi
call dword [sym.imp.CRYPT32.dll_CertFindCertificateInStore]
mov dword [ebp - 0x12c], eax
test eax, eax
jne 0x403279
push str.CodeSignFile:_find_certification_failed
jmp 0x4031b8
push eax
call dword [sym.imp.CRYPT32.dll_CertDuplicateCertificateContext]
mov ecx, eax
mov dword [ebp - 0x13c], ecx
mov dword [ebp - 0x154], 0xc
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x150], eax
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x14c], eax
push 0x10
pop edx
mov dword [ebp - 0x164], edx
mov dword [ebp - 0x140], ebx
lea eax, [ebp - 0x140]
mov dword [ebp - 0x160], eax
mov dword [ebp - 0x15c], 1
lea eax, [ebp - 0x154]
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x184], edx
mov dword [ebp - 0x180], ecx
mov dword [ebp - 0x17c], 2
mov dword [ebp - 0x178], ebx
mov dword [ebp - 0x174], edx
mov dword [ebp - 0x170], 2
lea eax, [ebp - 0x184]
mov dword [ebp - 0x16c], eax
mov dword [ebp - 0x168], ebx
mov dword [ebp - 0x19c], 0x18
mov dword [ebp - 0x198], 0x8004
mov dword [ebp - 0x194], ebx
mov dword [ebp - 0x190], ebx
mov dword [ebp - 0x18c], ebx
mov dword [ebp - 0x188], ebx
lea eax, [ebp - 0x124]
push eax
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x19c]
push eax
lea eax, [ebp - 0x174]
push eax
lea eax, [ebp - 0x164]
push eax
push ebx
call dword [ebp - 0x148]
test eax, eax
je 0x403392
push eax
push str.CodeSignFile:_sign_failed__0x_x_
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x11c]
push eax
jmp 0x4031b8
mov bl, 1
mov byte [ebp - 0x11d], bl
mov dword [ebp - 4], 0xfffffffe
call fcn.004033c0
mov al, bl
call fcn.004bff58
ret
Function at 0x4034bc
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push 0xc
mov eax, 0x4c0707
call fcn.004ab9ba
mov edi, ecx
mov dword [ebp - 0x18], edi
xor ebx, ebx
mov dword [edi], ebx
push ebx
push ebx
push ebx
push 3
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
jns 0x4034f0
cmp eax, 0x80010119
jne 0x403566
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 0x10]
push eax
push 0x4dcc28
push 0x17
push ebx
push 0x4dc45c
mov byte [ebp - 4], 1
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x403556
mov esi, dword [ebp - 0x10]
push str.rootWMI
lea ecx, [ebp - 0x14]
call fcn.00403421
push edi
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
mov byte [ebp - 4], 2
push dword [eax]
mov ecx, dword [esi]
push esi
call dword [ecx + 0xc]
push dword [ebp - 0x14]
mov esi, eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test esi, esi
js 0x403556
push ebx
push ebx
push 3
push 3
push ebx
push ebx
push 0xa
push dword [edi]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x403566
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, edi
call fcn.004ab988
ret 8
Function at 0x403cb4
Capabilities:
Identify system language via api

Disassembly:
push 0x28
mov eax, 0x4c0835
call fcn.004ab9ba
mov esi, ecx
mov dword [ebp - 0x14], esi
push str.64Signer_V1.2
lea ecx, [ebp - 0x10]
call fcn.0040b4ef
push 1
push 7
push 0x508cf8
lea eax, [ebp - 0x10]
xor ebx, ebx
push eax
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.00496262
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.0040b44b
push ecx
push ecx
lea ecx, [esi + 0x10c]
mov dword [esi], vtable.HelloWorldWindow.0
call fcn.0049746f
lea ecx, [ebp - 0x34]
call fcn.0041a3be
mov edi, 0x4dcc38
push edi
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
call fcn.0040b4ef
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x34]
call fcn.0040b4c1
lea ecx, [ebp - 0x10]
call fcn.0040b44b
push edi
lea ecx, [ebp - 0x10]
call fcn.0040b4ef
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040b4c1
lea ecx, [ebp - 0x10]
call fcn.0040b44b
push str..settings
lea ecx, [ebp - 0x10]
call fcn.0040b4ef
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x30]
call fcn.0040b4c1
lea ecx, [ebp - 0x10]
call fcn.0040b44b
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 0x24], 1
mov dword [ebp - 0x1c], 2
call fcn.0041a12d
push str.Language
lea ecx, [ebp - 0x10]
call fcn.0040b529
push ebx
lea eax, [ebp - 0x10]
push eax
push ecx
mov byte [ebp - 4], 5
call fcn.0041a314
mov ecx, eax
call fcn.00404941
lea ecx, [ebp - 0x10]
mov edi, eax
mov byte [ebp - 4], 4
call fcn.0040b44b
cmp edi, 1
jne 0x403dc9
mov byte [0x504798], 1
jmp 0x403e35
cmp edi, 2
jne 0x403dd6
mov byte [0x504798], bl
jmp 0x403e06
mov edi, dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
call edi
mov ecx, 0x804
cmp ax, cx
je 0x403dfb
call edi
mov ecx, 0x404
cmp ax, cx
je 0x403dfb
mov al, byte [0x504798]
jmp 0x403e02
mov al, bl
mov byte [0x504798], al
test al, al
jne 0x403e35
push 0x4dcc5c
lea ecx, [ebp - 0x10]
call fcn.0040b529
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
mov byte [ebp - 4], 6
call fcn.00463127
mov ecx, eax
call fcn.0047b297
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
call fcn.0040b44b
push 1
mov ecx, esi
call fcn.00497e4a
push ecx
mov ecx, esi
call fcn.00463127
mov ecx, eax
call fcn.0047bf2d
push 0x80
call fcn.004a5065
pop ecx
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 7
test eax, eax
je 0x403e6c
mov ecx, eax
call fcn.004a3a7f
jmp 0x403e6e
mov eax, ebx
push 1
mov byte [ebp - 4], 4
push eax
mov ecx, esi
mov dword [esi + 0x108], eax
call fcn.00496c73
mov eax, dword [esi + 0x108]
mov ecx, esi
push dword [eax + 0x1c]
push dword [eax + 0x18]
call fcn.00462121
push 1
mov ecx, esi
call fcn.004614c1
push ebx
call dword [sym.imp.KERNEL32.dll_Wow64EnableWow64FsRedirection]
lea ecx, [ebp - 0x34]
call fcn.00404001
mov eax, esi
call fcn.004ab988
ret
Function at 0x40dd71
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4c1c46
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x503298]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov ebx, ecx
xor edi, edi
cmp byte [ebx + 0x38], 0
jne 0x40df00
lea esi, [ebx + 0x54]
lea ecx, [esp + 0x24]
call fcn.004096e7
mov ecx, esi
call fcn.004166ee
cmp dword [ebx + 0x74], 0
jle 0x40ddd3
lea eax, [edi + 1]
cdq
idiv dword [ebx + 0x74]
mov edi, edx
mov dword [esp + 0x14], edx
jmp 0x40ddd9
xor edi, edi
mov dword [esp + 0x14], edi
push edi
mov ecx, ebx
call fcn.0040dd02
test eax, eax
je 0x40ddf2
add eax, 8
push eax
lea ecx, [esp + 0x28]
call fcn.0040e194
mov ecx, esi
call fcn.004166f6
lea ecx, [esp + 0x2c]
call fcn.0040e279
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x24]
call fcn.0040e402
test al, al
je 0x40de4e
mov eax, edx
mov edx, ecx
push eax
lea ecx, [esp + 0x38]
call fcn.0040e3b2
pop ecx
mov ecx, eax
call fcn.0040df5b
test edx, edx
jg 0x40de3f
jl 0x40de36
cmp eax, 0x1f4
jae 0x40de3f
mov dword [esp + 0x20], edx
jmp 0x40deea
and dword [esp + 0x20], 0
mov eax, 0x1f4
jmp 0x40deea
xor eax, eax
test edi, edi
sete al
lea edi, [ebx + 0x3c]
mov ecx, edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], eax
call fcn.004166ee
and dword [esp + 0x50], 0
mov ecx, esi
call fcn.004166ee
push dword [esp + 0x14]
mov ecx, ebx
call fcn.0040dd02
mov ecx, esi
mov dword [ebx + 0x78], eax
call fcn.004166f6
mov ecx, dword [ebx + 0x78]
test ecx, ecx
je 0x40ded6
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, esi
mov dword [esp + 0x18], eax
call fcn.004166ee
mov eax, dword [esp + 0x18]
test eax, eax
js 0x40dec0
mov edx, eax
lea ecx, [esp + 0x3c]
call fcn.0040df1e
mov ecx, dword [ebx + 0x78]
push eax
add ecx, 8
call fcn.0040e371
jmp 0x40decb
push dword [ebx + 0x78]
lea ecx, [ebx + 0x6c]
call fcn.00416ec1
and dword [ebx + 0x78], 0
mov ecx, esi
call fcn.004166f6
or dword [esp + 0x50], 0xffffffff
mov ecx, edi
call fcn.004166f6
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x14]
test eax, eax
jle 0x40def6
push eax
mov ecx, ebx
call fcn.0040db01
cmp byte [ebx + 0x38], 0
je 0x40ddae
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4103bc
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x4103c7
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.004103cd