joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4199d0
Capabilities:
Persist via run registry key

Disassembly:
sub esp, 0x310
push ebp
push esi
push edi
mov edi, dword [esp + 0x320]
xor esi, esi
mov eax, str.Gator
test edi, edi
mov dword [esp + 0x14], esi
jne 0x4199f4
mov eax, str.Offers
push eax
push str.FixSwwApp__s_:
call fcn.0040a040
add esp, 8
mov ebp, str.Gator
test edi, edi
jne 0x419a10
mov ebp, str.Offers
lea eax, [esp + 0xc]
push 0
push eax
push ebp
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.WSOCK32.dll_bind
mov dword [esp + 0x20], 0
call fcn.0040a980
mov eax, dword [esp + 0x20]
add esp, 0x14
test eax, eax
je 0x419c0b
push eax
push str.Setting__s__
call fcn.0040a040
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0040c2a0
add esp, 0xc
test eax, eax
jne 0x419bf2
push str.File_does_NOT_exist_
call fcn.0040a040
lea edx, [esp + 0x14]
push 0
push edx
push str.ProgramFilesDir
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.WSOCK32.dll_bind
mov dword [esp + 0x28], 0
call fcn.0040a980
mov eax, dword [esp + 0x28]
add esp, 0x18
test eax, eax
je 0x419bd9
push eax
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x18]
push 0x104
push ecx
call fcn.0040c710
add esp, 8
mov eax, str.Gator.comGator
test edi, edi
jne 0x419ac6
mov eax, str.Gator.comOfferCompanion
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x18]
push eax
push edx
call esi
lea eax, [esp + 0x18]
push 0x104
push eax
call fcn.0040c710
add esp, 8
mov eax, str.Gator
test edi, edi
jne 0x419af4
mov eax, str.Offers
lea ecx, [esp + 0x18]
push eax
push ecx
call esi
lea edx, [esp + 0x18]
push str..exe
push edx
call esi
mov eax, dword [esp + 0xc]
push eax
call fcn.0040c1c0
mov esi, eax
add esp, 4
test esi, esi
jne 0x419b20
mov eax, 0x431aa4
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.0041b580
add esp, 8
test eax, eax
je 0x419bab
lea edx, [esp + 0x18]
push edx
push str.Correct_path_is___s__
call fcn.0040a040
lea eax, [esp + 0x20]
push eax
call fcn.0040c2a0
add esp, 0xc
test eax, eax
je 0x419ba4
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x11d]
mov byte [esp + 0x11c], 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x11c]
push 0x200
stosw word es:[edi], ax
push ecx
lea edx, [esp + 0x20]
push 0
push edx
push ebp
stosb byte es:[edi], al
call fcn.004241b0
add esp, 0x14
test eax, eax
je 0x419b9d
mov dword [esp + 0x14], 1
push str.Path_FIXED.
jmp 0x419bb0
push str.RegistryWriteString___FAILED.
jmp 0x419bb0
push str.Correct_exe_not_found.
jmp 0x419bb0
push str.VALID__path_is_correct_.
call fcn.0040a0b0
add esp, 4
push esi
call fcn.0041a842
mov eax, dword [esp + 0x14]
push eax
call fcn.0041a842
mov eax, dword [esp + 0x1c]
add esp, 8
pop edi
pop esi
pop ebp
add esp, 0x310
ret
push str.Couldnt_locate_PROGFILES_dir.
call fcn.0040a0b0
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
add esp, 0x310
ret
push str.VALID__file_exists_.
call fcn.0040a0b0
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
add esp, 0x310
ret
push str.SWW_setting_not_present.
call fcn.0040a0b0
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
add esp, 0x310
ret
Function at 0x419fc0
Capabilities:
Get file version info

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
push edi
xor edi, edi
test ebx, ebx
mov dword [esp + 0x10], edi
je 0x41a0b5
cmp byte [ebx], 0
je 0x41a0b5
lea eax, [esp + 0x20]
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
je 0x41a0b5
push esi
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
je 0x41a0b5
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
test edi, edi
je 0x41a0a2
mov ecx, dword [esp + 0x20]
push edi
push esi
push ecx
push ebx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x41a09b
lea edx, [esp + 0x18]
lea eax, [esp + 0x14]
push edx
push eax
push 0x42b398
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x41a09b
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
mov edx, dword [ecx + 8]
shr edx, 0x10
mov byte [eax + 0x20], dl
mov dl, byte [ecx + 8]
mov byte [eax + 0x21], dl
mov edx, dword [ecx + 0xc]
shr edx, 0x10
mov byte [eax + 0x22], dl
mov cx, word [ecx + 0xc]
mov byte [eax + 0x23], cl
and ecx, 0xff
push ecx
xor ecx, ecx
mov cl, dl
xor edx, edx
mov dl, byte [eax + 0x21]
push ecx
xor ecx, ecx
push edx
mov cl, byte [eax + 0x20]
push ecx
push str._d._d._d._d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
mov dword [esp + 0x10], 1
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x41a430
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x84
push ebx
push ebp
push esi
push edi
push str._tUpdating_directories...
call fcn.0040a0b0
mov eax, str.Gator.com
add esp, 4
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov ecx, 1
mov eax, str.softwareGator.comGator_statGMTSettings
xor ebx, ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], str.SoftwareMicrosoftWindowsCurrentVersion
mov dword [esp + 0x20], str.ProgramFilesDir
mov byte [esp + 0x2c], 0
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], str.WorkingDir
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], 0x42a214
mov byte [esp + 0x40], bl
mov dword [esp + 0x44], str.softwareGator.comCMEII
mov dword [esp + 0x48], str.appPath
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], 0x42b4e4
mov byte [esp + 0x54], cl
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], str.GatorExe
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], str.Gator
mov byte [esp + 0x68], bl
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], str.OCExe
mov dword [esp + 0x74], ebx
mov dword [esp + 0x78], 0x42e680
mov byte [esp + 0x7c], bl
mov dword [esp + 0x80], str.softwareGator.comDate_Manager
mov dword [esp + 0x84], str.AppPath
mov dword [esp + 0x88], ebx
mov dword [esp + 0x8c], 0x42e65c
mov byte [esp + 0x90], bl
lea esi, [esp + 0x24]
mov dword [esp + 0x14], 6
mov eax, dword [esi + 4]
push eax
push str._t_t_s:
call fcn.0040a040
mov edi, dword [esi - 4]
mov ebp, dword [esi - 8]
lea ecx, [esp + 0x18]
push ebx
push ecx
push edi
push ebp
push reloc.WSOCK32.dll_bind
mov dword [esp + 0x2c], ebx
call fcn.0040a980
mov eax, dword [esp + 0x2c]
add esp, 0x1c
cmp eax, ebx
je 0x41a63a
mov edi, dword [esi]
cmp edi, ebx
je 0x41a5b5
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
call ebx
mov edx, dword [esp + 0x10]
mov ebp, eax
push edx
call ebx
lea ebp, [eax + ebp + 0xa]
push ebp
call fcn.0041a915
mov ebx, eax
mov eax, dword [esp + 0x14]
push edi
push eax
push ebp
push ebx
call fcn.0040c810
add esp, 0x14
test eax, eax
je 0x41a5ac
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0041a842
add esp, 4
mov dword [esp + 0x10], ebx
jmp 0x41a5b3
mov edx, dword [esp + 0x10]
mov byte [edx], 0
xor ebx, ebx
mov eax, dword [esp + 0x10]
push eax
call fcn.0040c2a0
add esp, 4
test eax, eax
je 0x41a5d3
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0040c7a0
add esp, 4
mov edx, dword [esp + 0x10]
push edx
push str.dir_is___s_...
call fcn.0040a040
mov eax, dword [esp + 0x18]
push eax
call fcn.0040c270
add esp, 0xc
test eax, eax
je 0x41a61e
mov cl, byte [esi + 8]
mov edx, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x9c]
push edx
call fcn.0040e4c0
test eax, eax
je 0x41a613
push 0x429458
jmp 0x41a623
mov dword [esp + 0x18], ebx
push str.FAILED
jmp 0x41a623
push str.doesnt_exist__OK_.
call fcn.0040a0b0
mov eax, dword [esp + 0x14]
add esp, 4
push eax
call fcn.0041a842
add esp, 4
jmp 0x41a649
push edi
push ebp
push str.Didnt_find__HKLM_s_____s___OK_
call fcn.0040a0b0
add esp, 0xc
mov eax, dword [esp + 0x14]
add esi, 0x14
dec eax
mov dword [esp + 0x14], eax
jne 0x41a528
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x84
ret
Function at 0x41f859
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x42eeb0
cmp edx, dword [eax]
je 0x41f87b
add eax, 8
inc ecx
cmp eax, 0x42ef40
jl 0x41f86c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x42eeb0]
jne 0x41f9a9
mov eax, dword [0x434f10]
cmp eax, 1
je 0x41f983
test eax, eax
jne 0x41f8ac
cmp dword [0x42e7d4], 1
je 0x41f983
cmp edx, 0xfc
je 0x41f9a9
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x41f8e3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00422fc0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00420860
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x41f926
lea eax, [ebp - 0x1a4]
push eax
call fcn.00420860
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x426918
push edi
call fcn.0041b9a0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00422fc0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00422fd0
lea eax, [ebp - 0xa0]
push 0x4268f8
push eax
call fcn.00422fd0
push dword [esi + 0x42eeb4]
lea eax, [ebp - 0xa0]
push eax
call fcn.00422fd0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004234a6
add esp, 0x2c
pop edi
jmp 0x41f9a9
lea eax, [ebp + 8]
lea esi, [esi + 0x42eeb4]
push 0
push eax
push dword [esi]
call fcn.00420860
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4241b0
Capabilities:
Persist via run registry key

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
push edi
mov edi, dword [esp + 0x24]
push 0x431aa4
xor esi, esi
push ebp
push edi
mov dword [esp + 0x1c], esi
call fcn.00424320
mov eax, dword [esp + 0x24]
add esp, 0xc
test eax, eax
je 0x424304
cmp byte [eax], 0
je 0x424304
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x424304
push ebx
call fcn.0040c2a0
add esp, 4
test eax, eax
je 0x4242ec
mov edi, dword [esp + 0x20]
test edi, edi
je 0x424215
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [eax + esi + 0xa]
push eax
call fcn.0041a915
mov esi, eax
add esp, 4
test esi, esi
je 0x4242cf
push ebx
push 0x42b2f4
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
test edi, edi
je 0x42425f
mov al, byte [edi]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp al, 0x20
je 0x42425b
push 0x429bb4
push esi
call ebx
push edi
push esi
call ebx
mov edi, dword [esp + 0x18]
push esi
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.WSOCK32.dll_bind
call fcn.0040ad40
add esp, 0x10
test eax, eax
je 0x4242a5
mov ecx, dword [esp + 0x24]
push esi
push edi
push 1
push 1
push ebp
push ecx
call fcn.00424370
add esp, 0x18
mov edi, 1
push esi
call fcn.0041a842
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov edx, dword [esp + 0x24]
push 0
push edi
push 1
push 0
push ebp
push edx
call fcn.00424370
mov edi, dword [esp + 0x28]
add esp, 0x18
push esi
call fcn.0041a842
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov eax, dword [esp + 0x24]
push str.Failed_to_alloc_path_buf
push ebp
push eax
call fcn.00424320
mov eax, dword [esp + 0x1c]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push ebx
push str.Cant_find___s_
push ebp
push edi
call fcn.00424320
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push str.Invalid_arg_s_
push ebp
push edi
call fcn.00424320
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x424530
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x350
push ebx
push ebp
push esi
mov esi, dword [esp + 0x360]
push edi
xor edi, edi
mov dword [esp + 0x14], ecx
push esi
mov dword [esp + 0x14], edi
call fcn.0040c270
add esp, 4
test eax, eax
je 0x4246fe
mov ebx, dword [esp + 0x368]
test ebx, ebx
je 0x4246fe
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x18]
push esi
push eax
call edi
lea ecx, [esp + 0x18]
push 0x104
push ecx
call fcn.0040c710
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatA]
add esp, 8
lea edx, [esp + 0x18]
push ebx
push edx
call ebp
lea eax, [esp + 0x220]
lea ecx, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x424627
call fcn.00424bd0
lea edx, [esp + 0x11c]
push esi
push edx
call edi
lea eax, [esp + 0x11c]
push 0x104
push eax
call fcn.0040c710
add esp, 8
lea ecx, [esp + 0x24c]
lea edx, [esp + 0x11c]
push ecx
push edx
call ebp
test byte [esp + 0x220], 0x10
jne 0x42460d
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x11c]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test eax, eax
jl 0x42460d
inc dword [esp + 0x10]
lea eax, [esp + 0x220]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4245b3
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esp + 0x18]
push esi
push ecx
call edi
lea edx, [esp + 0x18]
push 0x104
push edx
call fcn.0040c710
add esp, 8
lea eax, [esp + 0x18]
push 0x42b0ec
push eax
call ebp
lea ecx, [esp + 0x220]
lea edx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4246ed
call fcn.00424bd0
test byte [esp + 0x220], 0x10
je 0x4246d3
cmp byte [esp + 0x24c], 0x2e
je 0x4246d3
lea eax, [esp + 0x11c]
push esi
push eax
call edi
lea ecx, [esp + 0x11c]
push 0x104
push ecx
call fcn.0040c710
add esp, 8
lea edx, [esp + 0x24c]
lea eax, [esp + 0x11c]
push edx
push eax
call ebp
mov ecx, dword [esp + 0x368]
lea edx, [esp + 0x11c]
push ecx
mov ecx, dword [esp + 0x18]
push edx
call fcn.00424530
add dword [esp + 0x10], eax
lea eax, [esp + 0x220]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x42466b
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x350
ret 8
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x350
ret 8
Function at 0x424c50
Capabilities:
Persist via run registry key

Disassembly:
sub esp, 0x408
lea eax, [esp + 4]
push 0
push eax
push str.Cache
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push closesocket
mov dword [esp + 0x18], 0
call fcn.0040a980
mov eax, dword [esp + 0x18]
add esp, 0x14
test eax, eax
je 0x424ca2
push 0x104
push eax
push 0x4353d4
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov ecx, dword [esp + 4]
push ecx
call fcn.0041a842
add esp, 4
mov al, byte [0x4352d0]
test al, al
jne 0x424d4f
lea edx, [esp]
push 0
push edx
push str.ActiveXCache
push str.softwaremicrosoftwindowscurrentversioninternet_settings
push reloc.WSOCK32.dll_bind
mov dword [esp + 0x14], 0
call fcn.0040a980
add esp, 0x14
test eax, eax
je 0x424d42
mov eax, dword [esp]
test eax, eax
je 0x424d4f
push eax
lea eax, [esp + 0xc]
push str.found___s_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x14]
push ecx
call fcn.00425890
mov edx, dword [esp + 0x10]
push edx
call fcn.0040c270
add esp, 0x14
test eax, eax
je 0x424d29
mov eax, dword [esp]
push eax
push 0x4352d0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [esp]
push ecx
call fcn.0041a842
jmp 0x424d4c
push str.ERROR:_Dir_doesnt_exist.
call fcn.00425890
mov ecx, dword [esp + 4]
add esp, 4
push ecx
call fcn.0041a842
jmp 0x424d4c
push str.ERROR:_Unable_to_retrieve_dir.
call fcn.00425890
add esp, 4
mov cl, byte [0x4352d0]
xor eax, eax
test cl, cl
setne al
add esp, 0x408
ret
Function at 0x4050e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
push ebp
push 0x4051e5
push dword fs:[ebx]
mov dword fs:[ebx], esp
xor ebx, ebx
mov dword [ebp - 4], ebx
xor ebx, ebx
mov dword [0x41369c], ebx
xor ebx, ebx
mov dword [0x413698], ebx
mov dword [0x413688], eax
mov dword [0x41368c], edx
cmp dword [0x413688], 0
je 0x4051d7
mov eax, dword [0x413688]
mov dword [ecx], eax
mov edi, dword [0x413688]
mov ax, word [edi]
not ax
cmp ax, 0x5a4d
je 0x4051d7
mov esi, dword [edi + 0x3c]
add esi, edi
push 0xf8
push esi
call fcn.00404424
test eax, eax
jne 0x4051d7
cmp dword [esi], 0x4550
jne 0x4051d7
mov eax, esi
call fcn.004050c8
test al, al
jne 0x4051d7
mov ebx, esi
add ebx, 0xf8
mov ax, word [esi + 6]
cmp ax, 0x64
jae 0x4051d7
movzx eax, ax
dec eax
test eax, eax
jl 0x4051d7
inc eax
mov esi, eax
mov edx, 0x4051f8
mov eax, ebx
mov ecx, 8
call fcn.00404640
test eax, eax
jne 0x4051d1
mov eax, dword [ebx + 0x14]
add eax, edi
mov dword [0x413690], eax
mov eax, dword [0x413690]
call fcn.004050c8
test al, al
jne 0x4051d7
mov eax, dword [0x413690]
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0xc]
mov dword [0x413694], eax
mov eax, dword [ebp + 8]
mov edx, dword [0x413694]
mov dword [eax], edx
jmp 0x4051d7
add ebx, 0x28
dec esi
jne 0x405187
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4051ec
ret
Function at 0x40a370
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [esp + 0x20]
mov ebp, dword [esp + 0x1c]
cmp esi, 0xffffffff
je 0x40a3ac
test esi, esi
je 0x40a474
xor eax, eax
xor ebx, ebx
movzx edx, byte [ebp + eax]
test edx, edx
je 0x40a465
imul ebx, ebx, 0x1003f
add ebx, edx
inc eax
cmp esi, eax
jne 0x40a390
jmp 0x40a3d5
movzx eax, byte [ebp]
test al, al
je 0x40a472
xor ebx, ebx
xor esi, esi
nop dword [eax]
movzx eax, al
imul ebx, ebx, 0x1003f
add ebx, eax
movzx eax, byte [ebp + esi + 1]
inc esi
test al, al
jne 0x40a3c0
test esi, esi
je 0x40a472
mov edx, dword [esp + 0x24]
xor eax, eax
cmp edx, 0xffffffff
cmovne eax, edx
xor ebx, eax
mov eax, ebx
mov dword [esp + 4], ecx
mul dword [ecx + 0xc4]
mov dword [esp], edx
movzx ecx, byte [ecx + 0xc8]
mov edx, dword [esp]
shr edx, cl
mov edi, dword [esp]
shrd eax, edi, cl
test cl, 0x20
cmovne eax, edx
mov ecx, dword [esp + 4]
imul eax, dword [ecx + 0xbc]
sub ebx, eax
mov eax, dword [ecx + 0xb4]
mov ebx, dword [eax + ebx*4]
test ebx, ebx
je 0x40a45e
mov edi, dword [esp + 0x24]
jmp 0x40a44a
mov eax, dword [ebx + 0x2c]
push esi
push ebp
push eax
call sub.VCRUNTIME140.dll_memcmp
add esp, 0xc
test eax, eax
je 0x40a480
mov ebx, dword [ebx]
test ebx, ebx
je 0x40a45e
cmp dword [ebx + 0x28], esi
jne 0x40a444
cmp dword [ebx + 0x10], edi
jne 0x40a444
cmp esi, 0x1c
jae 0x40a432
lea eax, [ebx + 0x2c]
jmp 0x40a435
mov esi, 0xffffffff
jmp 0x40a474
mov ebx, 0x11
test esi, esi
jne 0x40a3dd
xor esi, esi
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov esi, dword [ebx + 8]
jmp 0x40a474
Function at 0x40e2f0
Capabilities:
Read file via mapping

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebp, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov dword [ebx], 0
mov dword [ebx + 4], 0
test ebp, ebp
je 0x40e381
sub esp, 0x18
mov dword [esp + 0x10], ebp
movaps xmm0, xmmword [0x791a40]
movups xmmword [esp], xmm0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test eax, eax
je 0x40e388
mov esi, eax
mov eax, dword [esp + 0x1c]
and eax, 4
lea eax, [eax*8 + 4]
push ebp
push 0
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test eax, eax
je 0x40e38f
xor eax, eax
mov ecx, dword [esp + 0x1c]
test cl, 2
sete al
lea eax, [eax*2 + 2]
push ebp
push 0
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x40e396
mov dword [ebx], edi
mov dword [ebx + 4], eax
xor edi, edi
jmp 0x40e39b
mov edi, 2
jmp 0x40e3a2
mov edi, 1
jmp 0x40e3a2
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x40e400
Capabilities:
Get system information on windows

Disassembly:
push edi
push esi
sub esp, 0x28
mov eax, dword [0x8af4c0]
xor eax, esp
mov dword [esp + 0x24], eax
cmp dword [0x8afd58], 0
jne 0x40e464
mov eax, esp
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x1c]
dec ecx
mov edx, ecx
shr edx, 1
or edx, ecx
mov ecx, edx
shr ecx, 2
or ecx, edx
mov edx, ecx
shr edx, 4
or edx, ecx
mov ecx, edx
shr ecx, 8
or ecx, edx
mov edx, ecx
shr edx, 0x10
or edx, ecx
inc edx
mov dword [0x8afd64], eax
mov dword [0x8afd60], edx
mov eax, 1
xchg dword [0x8afd58], eax
mov esi, dword [0x8afd60]
mov edi, dword [0x8afd64]
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0055e764
mov eax, esi
mov edx, edi
add esp, 0x28
pop esi
pop edi
ret

Function at 0x412dc0
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
mov esi, dword [ecx + 0x10]
test esi, esi
je 0x412ded
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0xc]
cmp eax, 0xffffffff
jne 0x412ddf
push edi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
push esi
push eax
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
xor eax, eax
pop esi
pop edi
ret 8
Function at 0x419a00
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1398
call fcn.0055fbf0
mov eax, dword [0x8af4c0]
xor eax, esp
mov dword [esp + 0x1394], eax
lea ecx, [esp]
call fcn.004181f0
mov dword [esp + 0x138c], 0xffffffff
mov ecx, 1
mov edx, dword [eax]
mov dword [esp + 0xc], edx
nop dword [eax]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [esp + ecx*4 + 0xc], edx
inc ecx
cmp ecx, 0x270
jb 0x419a40
lea eax, [esp + 8]
mov dword [esp + 8], 0x270
push eax
lea ecx, [esp + 4]
mov dword [esp + 4], 0x40000
call fcn.004387b0
cwde
cmp eax, 4
ja case.default.0x419a80
jmp dword [eax*4 + 0x419b10]
mov eax, 0x7a3534
mov ecx, dword [esp + 0x1394]
xor ecx, esp
call fcn.0055e764
mov esp, ebp
pop ebp
ret
mov eax, 0x7a3524
mov ecx, dword [esp + 0x1394]
xor ecx, esp
call fcn.0055e764
mov esp, ebp
pop ebp
ret
mov eax, 0x7a3554
mov ecx, dword [esp + 0x1394]
xor ecx, esp
call fcn.0055e764
mov esp, ebp
pop ebp
ret
mov eax, 0x7a35a4
mov ecx, dword [esp + 0x1394]
xor ecx, esp
call fcn.0055e764
mov esp, ebp
pop ebp
ret
mov eax, 0x7a3584
mov ecx, dword [esp + 0x1394]
xor ecx, esp
call fcn.0055e764
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x1394]
xor eax, eax
xor ecx, esp
call fcn.0055e764
mov esp, ebp
pop ebp
ret
Function at 0x41a140
Capabilities:
Allocate or change rwx memory

Disassembly:
push esi
mov esi, edx
push 0x8b0640
push 0x40
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x41a1a6
mov ecx, dword [esi + 4]
push edi
call fcn.00419e90
mov edi, eax
test edi, edi
je 0x41a17d
push dword [esi + 4]
push edi
push dword [esi]
call sub.VCRUNTIME140.dll_memcpy
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 0x10
push 0x8b0640
push dword [0x8b0640]
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
test eax, eax
je 0x41a1a6
mov dword [0x8b0640], 0
mov al, 1
pop esi
ret
xor al, al
pop esi
ret