joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4042f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
movzx eax, ax
mov dword [esp + 4], eax
jmp fcn.004a795a

Function at 0x4044b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push dword [esp + 8]
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4044c3
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x404504
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x404500
jmp 0x4044f0
cmp esi, edx
jae 0x404504
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x4044f0
cmp esi, edx
jb 0x404508
xor eax, eax
pop esi
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
ret

Function at 0x405aa0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5faccb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x42c
push esi
push edi
xor eax, eax
mov edi, ecx
push 0x3fe
push eax
mov word [esp + 0x38], ax
lea eax, [esp + 0x3a]
push eax
call fcn.005d9ee0
add esp, 0xc
lea eax, [esp + 0x30]
mov ecx, 0x6b4f34
push 0x200
push eax
push str.ALActivated
call fcn.00439d00
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x10]
call fcn.00404720
mov dword [esp + 0x43c], 0
lea ecx, [esp + 0xc]
mov eax, dword [edi + 0x46c]
push ecx
lea ecx, [edi + 0x46c]
call dword [eax + 0x170]
lea ecx, [esp + 0xc]
mov dword [esp + 0x43c], 0xffffffff
call fcn.00404e10
push 0
lea ecx, [edi + 0xd90]
call fcn.004a976c
push 0
lea ecx, [edi + 0xa34]
call fcn.004a976c
push 0
lea ecx, [edi + 0xbdc]
call fcn.004a976c
push 0
lea ecx, [edi + 0x1a8]
call fcn.004a976c
push 0
lea ecx, [edi + 0x294]
call fcn.004a976c
push 0
lea ecx, [edi + 0x380]
call fcn.004a976c
push 0
lea ecx, [edi + 0x594]
call fcn.004a976c
push 0
lea ecx, [edi + 0x6bc]
call fcn.004a976c
push 0
lea ecx, [edi + 0x90c]
call fcn.004a976c
push 0
lea ecx, [edi + 0x7e4]
call fcn.004a976c
lea eax, [esp + 0x10]
push eax
lea ecx, [edi + 0x46c]
call fcn.00404a00
lea eax, [esp + 0x10]
mov ecx, edi
push eax
call fcn.004a711e
add dword [esp + 0x14], 0x96
lea edx, [esp + 0x10]
add dword [esp + 0x1c], 0x96
add dword [esp + 0x10], 0x96
add dword [esp + 0x18], 0x96
push ecx
mov ecx, dword [edi + 0x48c]
call fcn.0048cc20
add esp, 4
lea eax, [esp + 0x20]
lea ecx, [edi + 0xbc]
push eax
call fcn.00404a00
lea eax, [esp + 0x20]
mov ecx, edi
push eax
call fcn.004a711e
add dword [esp + 0x24], 0x96
lea edx, [esp + 0x20]
add dword [esp + 0x2c], 0x96
add dword [esp + 0x20], 0x96
add dword [esp + 0x28], 0x96
push ecx
mov ecx, dword [edi + 0xdc]
call fcn.0048cc20
mov ecx, dword [esp + 0x438]
add esp, 4
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x405d80
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5fad08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [esp + 0x30]
push ebx
push esi
mov esi, ecx
lea ecx, [esp + 0xc]
movdqu xmm0, xmmword [eax]
push edi
movdqu xmmword [esp + 0x18], xmm0
call fcn.004043a0
mov ecx, 0xffffff
mov dword [esp + 0x34], 0
call fcn.0048e0e0
push eax
lea ecx, [esp + 0x14]
call fcn.004a6a9f
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x1c]
lea edi, [esi + 0xa0]
push eax
mov ecx, edi
call fcn.00404350
lea ecx, [esi + 0x46c]
call fcn.00407680
test eax, eax
je 0x405e07
push esi
mov edx, edi
lea ecx, [esi + 0x46c]
call fcn.00402150
add esp, 4
lea ecx, [esi + 0x594]
call fcn.00407680
test eax, eax
je 0x405e27
push esi
mov edx, edi
lea ecx, [esi + 0x594]
call fcn.00402150
add esp, 4
lea ecx, [esi + 0x6bc]
call fcn.00407680
test eax, eax
je 0x405e47
push esi
mov edx, edi
lea ecx, [esi + 0x6bc]
call fcn.00402150
add esp, 4
lea ecx, [esi + 0x7e4]
call fcn.00407680
test eax, eax
je 0x405e67
push esi
mov edx, edi
lea ecx, [esi + 0x7e4]
call fcn.00402150
add esp, 4
lea ecx, [esi + 0x90c]
call fcn.00407680
test eax, eax
je 0x405e87
push esi
mov edx, edi
lea ecx, [esi + 0x90c]
call fcn.00402150
add esp, 4
lea ecx, [esi + 0xa34]
call fcn.00407680
test eax, eax
je 0x405ea7
push esi
mov edx, edi
lea ecx, [esi + 0xa34]
call fcn.00404f10
add esp, 4
lea ecx, [esi + 0xbdc]
call fcn.00407680
test eax, eax
je 0x405ec7
push esi
mov edx, edi
lea ecx, [esi + 0xbdc]
call fcn.00404f10
add esp, 4
push 1
lea ecx, [esi + 0xbc]
call fcn.00404330
lea ecx, [esp + 0x10]
mov dword [esp + 0x34], 0xffffffff
call fcn.00404370
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x2c
ret 4
Function at 0x4085c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5fb060
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
push edi
mov dword [esp + 0x14], 0
push 0x651e48
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0
call fcn.00404720
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], 1
call fcn.00404880
lea edx, [esp + 0xc]
mov ecx, eax
call fcn.0048b0e0
mov edi, eax
test edi, edi
je 0x40868e
push edi
call fcn.005d4b4d
mov esi, eax
add esp, 4
test esi, esi
je 0x40868e
push esi
push edi
lea ecx, [esp + 0x38]
call fcn.00404880
mov edx, dword [esp + 0x14]
mov ecx, eax
call fcn.0048b2f0
add esp, 8
test eax, eax
je 0x408685
lea eax, [esp + 0x18]
mov ecx, esi
push eax
lea eax, [esp + 0x14]
push eax
call fcn.0048ba10
add esp, 8
test eax, eax
je 0x408685
mov ecx, dword [esp + 0x10]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
lea eax, [esp + 0x18]
push str._d._d._d._d
push eax
call fcn.00404860
add esp, 0x18
push esi
call fcn.005d4b15
add esp, 4
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 8]
push eax
call fcn.00407790
lea ecx, [esp + 8]
call fcn.00404e10
lea ecx, [esp + 0x30]
call fcn.00404e10
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 8

Function at 0x4099c0
Capabilities:
Resume thread

Disassembly:
push dword [ecx + 0x2c]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
ret
jmp 0x4099b0

Function at 0x4099f0
Capabilities:
Terminate thread

Disassembly:
push edi
mov edi, ecx
mov eax, dword [edi]
test eax, eax
je 0x409a48
cmp byte [eax + 0x45], 0
je 0x409a35
mov eax, dword [edi]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push esi
mov byte [eax + 0x44], 1
xor esi, esi
nop
mov eax, esi
inc esi
cmp eax, 0x1e
jg 0x409a26
push 0x64
call ebx
mov eax, dword [edi]
cmp byte [eax + 0x45], 0
jne 0x409a10
jmp 0x409a33
mov eax, dword [edi]
push 0
push dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop esi
pop ebx
mov ecx, dword [edi]
test ecx, ecx
je 0x409a42
mov eax, dword [ecx]
push 1
call dword [eax + 4]
mov dword [edi], 0
pop edi
ret

Function at 0x409f20
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x13c]
test eax, eax
je 0x409f3d
push eax
call fcn.0040aea0
mov dword [esi + 0x13c], 0
mov eax, dword [esi + 0x154]
test eax, eax
je 0x409f59
push eax
mov ecx, esi
call fcn.0040aea0
mov dword [esi + 0x154], 0
cmp dword [esi + 0x98], 0
je 0x409fcb
cmp dword [esi + 0x9c], 0
jne 0x409fc1
mov dword [esi + 0x9c], 2
cmp dword [esi + 0x9c], 1
push edi
mov edi, 0x258
je 0x409fa3
dec edi
test edi, edi
jle 0x409f9c
mov ecx, 0x64
call fcn.0048a950
cmp dword [esi + 0x9c], 1
jne 0x409f84
cmp dword [esi + 0x9c], 1
pop edi
je 0x409fc1
mov eax, dword [esi + 0x98]
push 0
push dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [esi + 0x9c], 1
mov dword [esi + 0x98], 0
pop esi
ret
Function at 0x40e710
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x40e743
mov ecx, esi
call fcn.0048a660
test eax, eax
jne 0x40e72f
mov ecx, esi
call fcn.00488780
test eax, eax
jne 0x40e743
sub esp, 0x14
mov ecx, esi
call fcn.004887f0
mov esi, eax
add esp, 0x14
cmp esi, 0xffffffff
jne 0x40e74a
or eax, 0xffffffff
pop esi
ret 8
push ebx
push ebp
push edi
mov ecx, esi
call fcn.0048e490
mov ebx, eax
lea ebp, [ebx + 1]
push ebp
call fcn.005d4b4d
mov edi, eax
add esp, 4
test edi, edi
je 0x40e78a
push ebp
push 0
push edi
call fcn.005d9ee0
add esp, 0xc
lea eax, [esp + 0x14]
push 0
push eax
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0x14], ebx
je 0x40e794
pop edi
pop ebp
pop ebx
or eax, 0xffffffff
pop esi
ret 8
mov ecx, esi
call fcn.0048cd10
mov eax, dword [esp + 0x18]
mov dword [eax], edi
mov eax, dword [esp + 0x14]
pop edi
pop ebp
pop ebx
pop esi
ret 8
Function at 0x4129d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5fbb40
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
mov esi, ecx
lea ecx, [esp + 0xc]
push edi
push dword [esp + 0x2c]
lea eax, [esi + 0xec]
push ecx
mov ecx, eax
mov dword [esp + 0x20], eax
call fcn.004b4aae
lea ecx, [esp + 8]
mov dword [esp + 0x24], 0
call fcn.00404ef0
lea ecx, [esp + 0xc]
call fcn.00404ef0
lea ecx, [esi + 0x74]
mov byte [esp + 0x24], 2
xor edi, edi
call fcn.004130f0
test eax, eax
jle 0x412ae3
push ebx
mov ebx, dword [esp + 0x34]
push ebp
mov ebp, dword [esp + 0x3c]
push 9
push edi
lea ecx, [esp + 0x20]
call fcn.00404880
push eax
lea eax, [esp + 0x20]
push eax
call fcn.004afffc
cmp edi, ebx
je 0x412a88
push 0x65827c
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x44]
push eax
call fcn.0040ab80
add esp, 0xc
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 3
call fcn.00412ef0
lea ecx, [esp + 0x3c]
jmp 0x412ac6
push ebp
lea ecx, [esp + 0x20]
call fcn.00404720
push 0x65827c
push eax
lea eax, [esp + 0x40]
mov byte [esp + 0x34], 4
push eax
call fcn.0040ab80
add esp, 0xc
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 5
call fcn.00412ef0
lea ecx, [esp + 0x38]
call fcn.00404e10
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2c], 2
call fcn.00404e10
lea ecx, [esi + 0x74]
inc edi
call fcn.004130f0
cmp edi, eax
jl 0x412a41
pop ebp
pop ebx
lea ecx, [esp + 8]
call fcn.00404880
mov ecx, dword [esp + 0x18]
push eax
push dword [esp + 0x30]
call fcn.00412fd0
lea ecx, [esp + 0xc]
call fcn.00404e10
lea ecx, [esp + 8]
call fcn.00404e10
lea ecx, [esp + 0x10]
call fcn.00404e10
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
Function at 0x414610
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
lea ebp, [esp - 0x2c]
sub esp, 0x2c
push 0xffffffffffffffff
push 0x5fbce9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc64
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], 0
push 0x651e48
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x6c], 0
call fcn.00404720
mov dword [ebp - 4], 0
mov eax, 0x43
mov word [ebp - 0x2c], ax
mov edi, 0x6f
mov eax, 0x52
mov dword [ebp - 0x6c], 1
mov word [ebp - 0x5c], ax
mov edx, 0x72
mov eax, 0x4d
mov dword [ebp - 0x2a], 0x720075
mov word [ebp - 0x56], ax
lea ecx, [edi + 5]
mov eax, 0x65
mov dword [ebp - 0x42], 0x690057
push 0x7fc
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0xc6c]
push 0
push eax
mov dword [ebp - 0x54], 0x630069
mov dword [ebp - 0x60], 0x410057
mov dword [ebp - 0x5a], 0x5c0045
mov dword [ebp - 0x68], 0x4f0053
mov dword [ebp - 0x4e], 0x73006f
mov dword [ebp - 0x4a], 0x66006f
mov dword [ebp - 0x1a], 0x730072
mov dword [ebp - 0x64], 0x540046
mov dword [ebp - 0x34], 0x4e0020
mov dword [ebp - 0x24], 0x6e0065
mov dword [ebp - 0x16], 0x6f0069
mov dword [ebp - 0x46], 0x5c0074
mov dword [ebp - 0x30], 0x5c0054
mov dword [ebp - 0x20], 0x560074
mov dword [ebp - 0x38], 0x730077
mov dword [ebp - 0x3e], 0x64006e
mov word [ebp - 0x26], dx
mov word [ebp - 0x50], dx
mov dword [ebp - 0x12], 0x6e
mov word [ebp - 0x3a], di
mov dword [ebp + 0x12], 0x64006f
mov dword [ebp + 0x16], 0x630075
mov dword [ebp + 0xc], 0x50006c
mov dword [ebp + 8], 0x610074
mov dword [ebp + 0x1a], 0x490074
mov dword [ebp + 4], 0x690067
mov dword [ebp + 0x1e], 0x64
mov dword [ebp], 0x690044
mov word [ebp + 0x10], dx
mov dword [ebp - 0xc70], 0
call fcn.005d9ee0
add esp, 0xc
mov dword [ebp + 0x24], 0x800
lea eax, [ebp + 0x28]
lea edx, [ebp - 0x68]
push eax
push 0x101
push ecx
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.0048a380
add esp, 0xc
test eax, eax
jne 0x414851
lea eax, [ebp + 0x24]
push eax
lea eax, [ebp - 0xc70]
push eax
push 0
push ecx
mov ecx, dword [ebp + 0x28]
lea edx, [ebp]
call fcn.0048af90
add esp, 0x10
test eax, eax
jne 0x414849
push 0x3ff
push eax
mov byte [ebp - 0x470], al
lea eax, [ebp - 0x46f]
push eax
call fcn.005d9ee0
push dword [ebp + 0x24]
lea edx, [ebp - 0x470]
lea ecx, [ebp - 0xc70]
call fcn.00413c10
lea eax, [ebp - 0x470]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x414804
sub eax, edx
lea edi, [eax + 1]
cmp edi, 0x3fffffff
jle 0x41481c
xor eax, eax
jmp 0x41483a
lea eax, [edi + edi]
call fcn.005dcf20
mov esi, esp
call fcn.004099a0
push eax
push edi
lea eax, [ebp - 0x470]
push eax
push esi
call fcn.004098c0
push eax
push 0x657524
push ebx
call fcn.00404860
add esp, 0xc
mov ecx, dword [ebp + 0x28]
call fcn.0048c9b0
mov eax, ebx
lea esp, [ebp - 0xc7c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
lea esp, [ebp + 0x2c]
pop ebp
ret
Function at 0x418770
Capabilities:
Terminate thread

Disassembly:
push edi
mov edi, ecx
cmp dword [edi], 0
mov word [edi + 0x14], 0x101
je 0x4187ab
push esi
xor esi, esi
cmp byte [edi + 0x16], 0
jne 0x4187aa
inc esi
cmp esi, 0x28
jg 0x4187a0
mov ecx, 0x32
call fcn.0048a950
cmp byte [edi + 0x16], 0
je 0x418787
pop esi
pop edi
ret
push 0
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop esi
pop edi
ret
Function at 0x418fc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5fbf71
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push esi
push edi
mov dword [esp + 8], 0
mov edi, dword [esp + 0x48]
mov ecx, edi
call fcn.00404ef0
mov dword [esp + 0x40], 0
lea ecx, [esp + 0x10]
mov dword [esp + 8], 1
call fcn.004b523a
push 0
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x30]
mov dword [esp + 0x4c], 1
call fcn.00419940
lea eax, [esp + 0xc]
mov byte [esp + 0x40], 2
push eax
call fcn.00418800
lea ecx, [esp + 0x24]
mov byte [esp + 0x40], 3
push ecx
push 0
mov ecx, eax
call fcn.00404880
push eax
lea ecx, [esp + 0x1c]
call fcn.004b56da
lea ecx, [esp + 0xc]
mov byte [esp + 0x40], 2
mov esi, eax
call fcn.00404e10
test esi, esi
je 0x41908e
lea ecx, [esp + 0x10]
call fcn.004b55f9
mov esi, eax
mov ecx, edi
push eax
shr esi, 1
push esi
call fcn.00404c30
push eax
lea ecx, [esp + 0x18]
call fcn.004b58af
push esi
mov ecx, edi
call fcn.00409390
lea ecx, [esp + 0x10]
call fcn.004b548f
lea ecx, [esp + 0x24]
call fcn.00419910
lea ecx, [esp + 0x10]
mov byte [esp + 0x40], 0
call fcn.004b5261
mov ecx, dword [esp + 0x38]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x3c
ret 4

Function at 0x419600
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x30
xor eax, eax
mov dword [esp + 0x24], 0x64002e
push esi
mov word [esp + 0x30], ax
mov esi, edx
lea eax, [esp + 4]
mov dword [esp + 0x18], 0x65004b
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x24], 0x6c0065
push eax
mov dword [esp + 0x34], 0x6c006c
mov dword [esp + 0x2c], 0x320033
mov dword [esp + 0x24], 0x6e0072
mov word [esp + 0x1a], 0x6d61
mov dword [esp + 0xf], 0x75646f4d
mov word [esp + 0x14], 0x4665
mov word [esp + 0xd], 0x7465
mov word [esp + 0x1d], 0x57
mov word [esp + 0x17], 0x656c
mov byte [esp + 0x19], 0x4e
mov byte [esp + 0xc], 0x47
mov byte [esp + 0x13], 0x6c
mov byte [esp + 0x16], 0x69
mov byte [esp + 0x1c], 0x65
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4196ab
push 0x104
push esi
push 0
call eax
pop esi
add esp, 0x30
ret
xor eax, eax
pop esi
add esp, 0x30
ret
Function at 0x4196c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x5fc022
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x248
push ebx
push esi
push edi
mov esi, ecx
mov dword [esp + 0x25c], 0
push 0x651e48
mov dword [esp + 0x4c], esi
mov dword [esp + 0x48], 0
call fcn.00404720
xor eax, eax
mov dword [esp + 0x25c], 0
push 0x206
push eax
mov word [esp + 0x54], ax
lea eax, [esp + 0x56]
push eax
mov dword [esp + 0x50], 1
call fcn.005d9ee0
add esp, 8
lea edx, [esp + 0x50]
call fcn.00419600
xor eax, eax
mov dword [esp + 0x3a], 0x690070
mov word [esp + 0x46], ax
add esp, 4
mov eax, 0x61
mov dword [esp + 0x3e], 0x6c006c
mov word [esp + 0x34], ax
lea eax, [esp + 0x2c]
mov dword [esp + 0x3a], 0x64002e
push eax
mov dword [esp + 0x34], 0x77006c
mov dword [esp + 0x30], 0x680053
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x419809
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x68746150
push eax
push edi
mov word [esp + 0x23], 0x5765
mov byte [esp + 0x25], 0
mov dword [esp + 0x18], 0x646e6946
mov dword [esp + 0x1e], 0x614e656c
mov byte [esp + 0x22], 0x6d
mov word [esp + 0x1c], 0x6946
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x419802
lea ecx, [esp + 0x4c]
push ecx
call eax
push eax
mov ecx, esi
call fcn.00404df0
mov eax, 0x78
mov dword [esp + 0x20], 0x65002e
mov word [esp + 0x24], ax
mov ecx, esi
push 0x651e48
lea eax, [esp + 0x24]
mov dword [esp + 0x2a], 0x65
push eax
call fcn.004095d0
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x254]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x254
ret
Function at 0x419da0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5fc171
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x148
push esi
push edi
mov dword [esp + 0x158], 0
mov edi, ecx
mov dword [esp + 0x34], 0
lea ecx, [esp + 0x3c]
mov dword [esp + 0x3c], 0x114
call fcn.0048a3f0
mov esi, dword [esp + 0x160]
mov ecx, esi
call fcn.00404ef0
mov dword [esp + 0x158], 0
lea ecx, [edi + 0x28]
mov dword [esp + 0x34], 1
call fcn.00404880
mov edx, eax
lea ecx, [esp + 0x28]
call fcn.00421ed0
push 0x658b94
push 0x657520
lea ecx, [esp + 0x30]
mov dword [esp + 0x160], 1
call fcn.004095d0
push dword [esp + 0x28]
push str.devid_s
push esi
call fcn.00409980
add esp, 0xc
lea ecx, [esp + 0xc]
call fcn.00404ef0
mov byte [esp + 0x158], 2
mov eax, dword [esp + 0x40]
cmp eax, 5
ja 0x419e68
push str.5678
jmp 0x419ea5
cmp eax, 6
jne 0x419ea0
mov eax, dword [esp + 0x44]
test eax, eax
jne 0x419e7c
push 0x658bb4
jmp 0x419ea5
cmp eax, 1
jne 0x419e88
push 0x658bb8
jmp 0x419ea5
cmp eax, 2
jne 0x419e94
push 0x658bbc
jmp 0x419ea5
cmp eax, 3
jne 0x419ea0
push 0x658bc0
jmp 0x419ea5
push 0x658bc8
lea ecx, [esp + 0x10]
call fcn.00404df0
push dword [esp + 0xc]
push str.OS_s
push esi
call fcn.00409980
add esp, 0xc
mov dword [esp + 0x10], 0x640026
cmp byte [edi], 0
mov eax, 0x69
mov ecx, esi
je 0x419f0e
mov word [esp + 0x14], ax
mov eax, 0x3d
mov word [esp + 0x20], ax
xor eax, eax
mov word [esp + 0x26], ax
mov eax, 0x74
mov dword [esp + 0x16], 0x690067
mov dword [esp + 0x1c], 0x73004f
mov dword [esp + 0x22], 0x340036
mov word [esp + 0x1a], ax
jmp 0x419f3d
mov word [esp + 0x18], ax
mov eax, 0x73
mov dword [esp + 0x1a], 0x4f0074
mov dword [esp + 0x20], 0x33003d
mov dword [esp + 0x14], 0x670069
mov dword [esp + 0x24], 0x32
mov word [esp + 0x1e], ax
lea eax, [esp + 0x10]
push eax
call fcn.00409220
lea eax, [edi + 0x24]
push eax
lea ecx, [esp + 0xc]
call fcn.00407790
lea ecx, [esp + 8]
mov byte [esp + 0x158], 3
call fcn.00404a70
cmp eax, 4
jle 0x41a01e
push 4
lea ecx, [esp + 0xc]
call fcn.00404a70
sub eax, 4
lea ecx, [esp + 0xc]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.0041a110
push 0x6587f4
push eax
lea eax, [esp + 0x40]
mov byte [esp + 0x160], 4
push eax
call fcn.0040ab80
lea ecx, [esp + 0x14]
mov byte [esp + 0x164], 5
push ecx
push eax
lea eax, [esp + 0x40]
push eax
call fcn.0041a1c0
add esp, 0x18
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x15c], 6
call fcn.00409ad0
lea ecx, [esp + 0x2c]
call fcn.00404e10
lea ecx, [esp + 0x38]
call fcn.00404e10
lea ecx, [esp + 0x30]
mov byte [esp + 0x158], 3
call fcn.00404e10
push 5
lea ecx, [esp + 0xc]
call fcn.00404a70
sub eax, 5
lea ecx, [esp + 0xc]
push eax
call fcn.00409830
push 0x6587f4
push 0x658be0
lea ecx, [esp + 0x10]
call fcn.004095d0
push dword [esp + 8]
push str.date_s
push esi
call fcn.00409980
push dword [edi + 0x20]
push str.version_s
push esi
call fcn.00409980
add esp, 0x18
lea ecx, [esp + 8]
call fcn.00404e10
lea ecx, [esp + 0xc]
call fcn.00404e10
lea ecx, [esp + 0x28]
call fcn.00404e10
mov ecx, dword [esp + 0x150]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x154
ret 4
Function at 0x41bf50
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x5fc5c3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x64
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], edi
call fcn.00404ef0
lea ecx, [edi + 4]
mov dword [esp + 0x7c], 0
call fcn.00404ef0
mov byte [esp + 0x7c], 1
mov eax, 0x6f
mov word [esp + 0x6c], ax
mov ecx, edi
mov dword [edi + 8], 0
mov dword [esp + 0x5e], 0x690066
lea ebp, [eax - 0xb]
mov dword [esp + 0x6e], 0x6d
mov eax, 0x78
mov dword [esp + 0x64], 0x720065
mov word [esp + 0x62], ax
lea eax, [esp + 0x40]
push eax
mov dword [esp + 0x52], 0x64002e
mov dword [esp + 0x6c], 0x63002e
mov dword [esp + 0x44], 0x610062
mov dword [esp + 0x5a], 0x650076
mov dword [esp + 0x48], 0x6b0063
mov dword [esp + 0x5e], 0x2d0072
mov dword [esp + 0x56], 0x690072
mov dword [esp + 0x4c], 0x6e0065
mov word [esp + 0x50], bp
call fcn.00404df0
lea eax, [esp + 0x14]
mov dword [esp + 0x28], 0x640070
lea edx, [ebp + 0xc]
mov dword [esp + 0x3a], 0x3f
push eax
lea ecx, [edi + 4]
mov dword [esp + 0x34], 0x2e0065
mov dword [esp + 0x18], 0x64002f
mov dword [esp + 0x24], 0x730072
mov dword [esp + 0x1c], 0x690072
mov dword [esp + 0x30], 0x740061
mov dword [esp + 0x28], 0x75002f
mov dword [esp + 0x20], 0x650076
mov dword [esp + 0x38], 0x680070
mov word [esp + 0x3c], dx
call fcn.00404df0
mov ecx, dword [esp + 0x74]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x70
ret

Function at 0x41c0b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5fc5e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
push edi
lea ecx, [esp + 0x38]
mov dword [esp + 0x30], 0
call fcn.00408160
push eax
lea ecx, [esp + 0x10]
call fcn.0041d2d0
push ecx
push 0x658fe4
lea ecx, [esp + 0x14]
mov byte [esp + 0x38], 1
call fcn.0041d340
push ecx
push 0x658fe8
lea ecx, [esp + 0x14]
call fcn.0041d340
lea ecx, [esp + 0xc]
call fcn.0041d010
push eax
lea ecx, [esp + 0x14]
call fcn.00410fe0
push eax
lea ecx, [esp + 0x3c]
call fcn.0041d020
lea ecx, [esp + 0x10]
call fcn.004093c0
lea ecx, [esp + 0x38]
call fcn.0041d0b0
cmp eax, 0x24
je 0x41c16a
cmp eax, 0x20
jne 0x41c1b7
xor esi, esi
push esi
lea ecx, [esp + 0x3c]
call fcn.00420ab0
mov al, byte [eax]
movsx eax, al
push eax
call fcn.005d59b4
add esp, 4
test eax, eax
je 0x41c1b7
inc esi
cmp esi, 0x20
jl 0x41c144
mov bl, 1
jmp 0x41c1b9
movdqa xmm0, xmmword [0x664500]
lea edi, [esp + 0x10]
movdqu xmmword [esp + 0x10], xmm0
xor esi, esi
mov edi, edi
push esi
lea ecx, [esp + 0x3c]
call fcn.00420ab0
mov cl, byte [eax]
mov eax, dword [edi]
dec eax
cmp esi, eax
jne 0x41c19d
cmp cl, 0x2d
jne 0x41c1b7
add edi, 4
jmp 0x41c1ad
movsx eax, cl
push eax
call fcn.005d59b4
add esp, 4
test eax, eax
je 0x41c1b7
inc esi
cmp esi, 0x24
jl 0x41c180
mov bl, 1
jmp 0x41c1b9
xor bl, bl
lea ecx, [esp + 0xc]
call fcn.0041d330
lea ecx, [esp + 0x38]
call fcn.004093c0
mov ecx, dword [esp + 0x28]
mov al, bl
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x28
ret 0x18