joyce8/EMBER2024-capa huggingface dataset:
Function at 0x111cfd90
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x11279148]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
mov esi, ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x111cfeae
push ebx
push edi
push 8
xor edi, edi
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x111cfdeb
push 8
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, eax
test ebx, ebx
je 0x111cfdeb
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push edi
push eax
call fcn.11146da0
add esp, 8
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
xor ebx, ebx
cmp edi, ebx
je 0x111cfeac
mov eax, dword [esi + 0x1e4]
push ebx
push 0x2f3b
push 0x111
push eax
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
push 1
mov ecx, esi
call fcn.111cf670
push 1
push 1
mov ecx, esi
call fcn.111cf7f0
mov ecx, dword [esi + 0x1c8]
mov edx, dword [esi + 0x1cc]
mov eax, dword [esi]
mov dword [ebp - 0xc], ecx
lea ecx, [ebp - 0x14]
mov dword [ebp - 8], edx
mov edx, dword [eax + 0x178]
push ecx
mov ecx, esi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call edx
lea eax, [ebp - 0x2c]
push eax
push 0x18
push edi
mov dword [esi + 0x238], edi
call dword [sym.imp.GDI32.dll_GetObjectW]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
mov edi, dword [esi]
mov eax, dword [edi + 0x20]
push ebx
push ecx
push edx
push ebx
push ebx
mov ecx, esi
call eax
mov edx, dword [edi + 0x17c]
push eax
mov ecx, esi
call edx
mov eax, dword [esi + 0x1e4]
push ebx
push 0x2f3b
push 0x111
push eax
mov dword [esi + 0x148], 0x2f3b
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.111d9022
mov esp, ebp
pop ebp
ret
Function at 0x111d27d0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
push edi
mov dword [esi], vtable.CWifiWrapper.0
xor edi, edi
push 0x30
mov dword [esi + 0x10], edi
call fcn.111709c0
add esp, 4
cmp eax, edi
je 0x111d2883
mov dword [esi + 0xc], eax
mov dword [eax], eax
mov eax, dword [esi + 0xc]
mov dword [eax + 4], eax
mov eax, dword [esi + 0xc]
mov dword [eax + 8], eax
mov ecx, dword [esi + 0xc]
mov al, 1
mov byte [ecx + 0x2c], al
mov edx, dword [esi + 0xc]
push str.wlanapi.dll
mov byte [edx + 0x2d], al
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi + 4], eax
cmp eax, edi
je 0x111d287b
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.WlanOpenHandle
push eax
call edi
mov dword [0x112806c0], eax
mov eax, dword [esi + 4]
push str.WlanCloseHandle
push eax
call edi
mov dword [0x112806c4], eax
mov ecx, dword [esi + 4]
push str.WlanEnumInterfaces
push ecx
call edi
mov dword [0x112806b8], eax
mov edx, dword [esi + 4]
push str.WlanGetAvailableNetworkList
push edx
call edi
mov dword [0x112806bc], eax
mov eax, dword [esi + 4]
push str.WlanFreeMemory
push eax
call edi
mov dword [0x112806c8], eax
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], edi
call dword [sym.imp.MSVCR100.dll_public:_void___thiscall_std::exception::constructor_char_const__const_const__]
push 0x1126446c
lea edx, [ebp - 0x10]
push edx
mov dword [ebp - 0x10], vtable.std::bad_alloc.0
call sub.MSVCR100.dll__CxxThrowException
int3

Function at 0x111d2ad0
Capabilities:
Get graphical window text

Disassembly:
push esi
push edi
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea esi, [eax + 1]
xor ecx, ecx
lea eax, [esi + 4]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.11170a40
add esp, 4
push esi
mov edi, eax
push edi
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp esi, 0x80
jle 0x111d2b2f
mov eax, str._...
lea edx, [edi + 0x102]
sub edx, eax
jmp 0x111d2b20
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x111d2b20
mov eax, edi
pop edi
pop esi
ret
Function at 0x111d3b80
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x111ed046
mov eax, dword fs:[0]
push eax
sub esp, 0xa24
mov eax, dword [0x11279148]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
push edi
push edi
push edi
push 3
push 2
push edi
push edi
push 0xffffffffffffffff
xor ebx, ebx
push edi
mov dword [ebp - 0xa24], ebx
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
lea eax, [ebp - 0xa1c]
push eax
push 0x11247dac
push 0x17
push edi
push 0x11247e7c
mov dword [ebp - 0xa1c], edi
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x111d3d74
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
lea ecx, [ebp - 0x218]
push str.rootCIMV2
push ecx
call ebx
add esp, 8
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
push 0x112806fc
push edi
push edi
push edi
push edi
push edi
mov ecx, eax
mov eax, dword [ebp - 0xa1c]
mov edx, dword [eax]
push edi
push ecx
push eax
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xa30], ecx
call eax
test eax, eax
js 0x111d3d61
mov eax, dword [0x112806fc]
lea edx, [ebp - 0xa20]
push edx
mov dword [ebp - 0xa20], edi
mov ecx, dword [eax]
push 0x11247c3c
push eax
mov eax, dword [ecx]
call eax
mov eax, dword [ebp - 0xa20]
cmp eax, edi
je 0x111d3d61
mov edx, dword [0x112806fc]
mov ecx, dword [eax]
push edi
push edi
push 3
push 2
push edi
push edi
push 0xa
push edx
push eax
mov eax, dword [ecx + 0x10]
call eax
cmp eax, edi
jl 0x111d3d53
xor ecx, ecx
mov eax, esi
mov dword [0x112806f8], edi
mov word [ebp - 0xa18], cx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x111d3ca4
sub eax, edx
sar eax, 1
cmp eax, 0xc8
jae 0x111d3ccc
push esi
lea edx, [ebp - 0xa18]
push str.SELECT__FROM__s
push edx
call ebx
add esp, 0xc
lea eax, [ebp - 0xa18]
push eax
lea ecx, [ebp - 0xa2c]
call fcn.110ff710
mov esi, eax
push 0x11246e14
lea ecx, [ebp - 0xa28]
mov dword [ebp - 4], edi
call fcn.110ff710
mov ecx, dword [esi]
mov ebx, 1
mov byte [ebp - 4], bl
cmp ecx, edi
je 0x111d3d05
mov ecx, dword [ecx]
jmp 0x111d3d07
xor ecx, ecx
mov eax, dword [eax]
cmp eax, edi
je 0x111d3d11
mov edx, dword [eax]
jmp 0x111d3d13
xor edx, edx
mov eax, dword [0x112806fc]
mov esi, dword [eax]
push 0x112806f8
push edi
push 0x20
push ecx
mov ecx, dword [esi + 0x50]
push edx
push eax
call ecx
lea ecx, [ebp - 0xa28]
mov esi, eax
call fcn.110ff7d0
lea ecx, [ebp - 0xa2c]
mov dword [ebp - 4], 0xffffffff
call fcn.110ff7d0
cmp esi, edi
jl 0x111d3d53
mov dword [ebp - 0xa24], ebx
mov eax, dword [ebp - 0xa20]
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov ecx, dword [ebp - 0xa30]
push ecx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ebx, dword [ebp - 0xa24]
mov eax, dword [ebp - 0xa1c]
cmp eax, edi
je 0x111d3d86
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.111d9022
mov esp, ebp
pop ebp
ret
Function at 0x111d53c0
Capabilities:
Check os version
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x111ed1d0
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push ebx
push esi
push edi
mov eax, dword [0x11279148]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
mov eax, 7
xor edi, edi
xor ecx, ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], edi
mov word [esi], cx
xor edx, edx
mov dword [esi + 0x30], eax
mov dword [esi + 0x2c], edi
mov dword [ebp - 4], edi
mov word [esi + 0x1c], dx
mov dword [esi + 0x4c], eax
mov dword [esi + 0x48], edi
mov word [esi + 0x38], cx
mov dword [esi + 0x68], eax
mov dword [esi + 0x64], edi
mov word [esi + 0x54], dx
mov dword [esi + 0x84], eax
mov dword [esi + 0x80], edi
mov word [esi + 0x70], cx
mov dword [esi + 0xa0], eax
mov dword [esi + 0x9c], edi
mov word [esi + 0x8c], dx
mov dword [esi + 0xbc], eax
xor eax, eax
mov dword [esi + 0xb8], edi
mov word [esi + 0xa8], ax
mov dword [esi + 0xc4], edi
mov dword [esi + 0xc8], edi
mov dword [esi + 0xcc], edi
mov dword [esi + 0xd4], edi
mov dword [esi + 0xd8], edi
mov dword [esi + 0xdc], edi
mov dword [esi + 0xe4], edi
mov dword [esi + 0xe8], edi
mov dword [esi + 0xec], edi
mov dword [esi + 0xf4], edi
mov dword [esi + 0xf8], edi
mov dword [esi + 0xfc], edi
mov byte [ebp - 4], 0xa
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jae 0x111d5510
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x10], edi
call fcn.11030fd0
mov byte [ebp - 4], 0xb
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ebx, dword [ebp - 0x70]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x3c]
cmp eax, edi
jne 0x111d54e5
push str.IsWow64Process
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x3c], eax
cmp eax, edi
je 0x111d54f1
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
push ecx
push edx
call eax
jmp 0x111d54f9
push 0x78
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [ebp - 0x10], edi
jne 0x111d5505
mov ecx, esi
call fcn.111d4840
cmp ebx, edi
je 0x111d5510
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x111d5d80
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
call fcn.111d5d20
test eax, eax
je 0x111d5e1b
push esi
push edi
push 0x44
lea eax, [ebp - 0x54]
push 0
push eax
call sub.MSVCR100.dll_memset
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
add esp, 0xc
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x54]
push edx
push 0
push 0
push 0
push 1
push 0
push 0
push edi
push 0
push eax
mov dword [ebp - 0x54], 0x44
call fcn.111d5c20
add esp, 4
push eax
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov esi, eax
test esi, esi
jne 0x111d5e01
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 1
push edi
call fcn.111b88e0
add esp, 8
mov ecx, 0x1f
cmp ecx, eax
sbb eax, eax
pop edi
neg eax
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call edi
mov eax, dword [ebp - 0xc]
push eax
call edi
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
push 1
push ecx
call fcn.111b88e0
add esp, 8
mov edx, 0x1f
cmp edx, eax
sbb eax, eax
neg eax
mov esp, ebp
pop ebp
ret
Function at 0x111d7660
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0
push 0
mov edi, ecx
mov eax, dword [edi + 0xc]
push 0xe
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, eax
lea eax, [ebx + ebx + 2]
push eax
call dword [sym.imp.MSVCR100.dll_malloc]
mov ecx, dword [edi + 0xc]
add esp, 4
inc ebx
push ebx
mov esi, eax
push esi
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 8]
push esi
call fcn.1113dbf0
push esi
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x111d855a
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x11279148]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x110], eax
lea eax, [ebp - 0x10c]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x111d862f
push edi
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x114]
push eax
push esi
push esi
push dword [ebp - 0x10c]
mov edi, 0x104
mov dword [ebp - 0x118], edi
mov dword [ebp - 0x114], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x111d861e
cmp dword [ebp - 0x114], 2
mov byte [ebp - 5], al
lea eax, [ebp - 0x108]
jne 0x111d8608
push edi
push dword [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
dec eax
lea ecx, [edi - 1]
cmp ecx, eax
sbb esi, esi
inc esi
jmp 0x111d861e
push eax
push edi
push dword [ebp - 0x110]
call fcn.111d84f7
xor ecx, ecx
test eax, eax
setge cl
mov esi, ecx
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
jmp 0x111d8631
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.111d9022
leave
ret 4

Function at 0x111d9022
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x11279148]
jne 0x111d902c
repz ret
jmp fcn.111d9933
Function at 0x111d9f14
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x11280abc], 0
push esi
push edi
jne 0x111d9e8a
call fcn.111d9df6
test eax, eax
je 0x111d9ecf
mov eax, dword [0x11280abc]
cmp eax, 1
jne 0x111d9eab
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x111d9ecf
jmp 0x111d9f11
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x111d9f11
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x111d9ed3
xor eax, eax
jmp 0x111d9f11
mov eax, dword [esi]
push dword [0x11280abc]
call edi
mov edi, eax
test edi, edi
je 0x111d9ef5
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x111d9f11
lea edi, [esi + 0xff0]
push esi
push dword [0x11280abc]
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x111d9efb
mov eax, esi
pop edi
pop esi
ret
jmp 0x111d9e76
Function at 0x404120
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x40427e
lea ecx, [esi*8]
mov eax, 0x2aaaaaab
imul ecx
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [esi*8]
lea eax, [ecx + ecx*2]
add eax, eax
sub edx, eax
sub edx, 2
je 0x404164
sub edx, 2
jne 0x404167
add ecx, 2
jmp 0x404167
add ecx, 3
mov eax, dword [ebp + 0x14]
inc ecx
cmp dword [eax], ecx
jge 0x40417b
mov dword [eax], ecx
mov eax, 0xfffffff0
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0x55555556
imul esi
push ebx
mov ebx, dword [ebp + 8]
mov eax, edx
shr eax, 0x1f
add eax, edx
push edi
mov edi, dword [ebp + 0x10]
lea ecx, [eax + eax*2]
xor eax, eax
test ecx, ecx
jle 0x404214
dec ecx
mov eax, 0xaaaaaaab
mul ecx
mov eax, edx
shr eax, 1
inc eax
mov dword [ebp - 4], eax
lea eax, [eax + eax*2]
mov dword [ebp - 8], eax
movzx ecx, byte [ebx]
movzx edx, byte [ebx + 1]
mov eax, ecx
movzx esi, byte [ebx + 2]
add ebx, 3
shr eax, 2
shl ecx, 4
movzx eax, byte [eax + 0x609650]
mov byte [edi], al
mov eax, edx
shr eax, 4
add eax, ecx
and eax, 0x3f
movzx eax, byte [eax + 0x609650]
mov byte [edi + 1], al
mov eax, esi
shr eax, 6
and esi, 0x3f
lea eax, [eax + edx*4]
and eax, 0x3f
movzx eax, byte [eax + 0x609650]
mov byte [edi + 2], al
movzx eax, byte [esi + 0x609650]
mov byte [edi + 3], al
add edi, 4
sub dword [ebp - 4], 1
jne 0x4041b0
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
cmp eax, esi
jge 0x40426f
movzx edx, byte [ebx]
inc eax
mov dword [ebp + 0xc], eax
cmp eax, esi
jge 0x404229
movzx ecx, byte [ebx + 1]
jmp 0x40422b
xor ecx, ecx
mov eax, edx
shl edx, 4
shr eax, 2
movzx eax, byte [eax + 0x609650]
mov byte [edi], al
mov eax, ecx
shr eax, 4
add eax, edx
and eax, 0x3f
movzx eax, byte [eax + 0x609650]
mov byte [edi + 1], al
cmp dword [ebp + 0xc], esi
jge 0x404264
and ecx, 0xf
mov al, byte [ecx*4 + 0x609650]
mov byte [edi + 2], al
jmp 0x404268
mov byte [edi + 2], 0x3d
mov byte [edi + 3], 0x3d
add edi, 4
mov ecx, dword [ebp + 0x14]
mov eax, edi
sub eax, dword [ebp + 0x10]
mov dword [ecx], eax
mov byte [edi], 0
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x404350
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, ecx
mov byte [ebp - 1], 0
push ebx
lea ecx, [eax + 0x210]
mov dword [ebp - 0x10], eax
push esi
mov esi, dword [ecx]
push edi
mov dword [ebp - 0x14], ecx
cmp esi, dword [eax + 0x214]
je 0x40444f
mov ecx, dword [ebp + 8]
lea edi, [esi + 0x28]
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add ecx, 0xa8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edi
push ecx
call ebx
push 0x6097d0
call ebx
sub edi, 0xffffff80
push edi
call ebx
push 0x6097d0
call ebx
mov ecx, dword [ebp + 8]
lea eax, [ecx + 0x28]
push eax
call ebx
push 0x6097d0
call ebx
push dword [ebp - 8]
call ebx
push 0x6097d0
call ebx
mov eax, dword [ebp - 0xc]
mov cl, byte [eax]
cmp cl, byte [edi]
jne 0x4043e7
test cl, cl
je 0x4043e3
mov cl, byte [eax + 1]
cmp cl, byte [edi + 1]
jne 0x4043e7
add eax, 2
add edi, 2
test cl, cl
jne 0x4043c7
xor eax, eax
jmp 0x4043ec
sbb eax, eax
or eax, 1
mov edi, dword [ebp - 8]
test eax, eax
jne 0x404429
mov edx, dword [ebp + 8]
mov ecx, edi
lea eax, [edx + 0x28]
nop dword [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x404420
test dl, dl
je 0x40441c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x404420
add eax, 2
add ecx, 2
test dl, dl
jne 0x404400
xor eax, eax
jmp 0x404425
sbb eax, eax
or eax, 1
test eax, eax
je 0x40444b
mov eax, dword [ebp - 0x10]
add esi, 0x1b0
add edi, 0x1b0
mov dword [ebp - 8], edi
cmp esi, dword [eax + 0x214]
je 0x40444f
mov ecx, dword [ebp - 0xc]
jmp 0x404391
mov byte [ebp - 1], 1
call fcn.0048c3f0
test al, al
je 0x404472
push edi
pop esp
push esp
pop edi
push esi
pop edx
push ecx
pop edx
push esi
pop edx
push esi
push eax
push esp
pop ebx
pop ebp
push ebx
pop ebx
push edx
push esp
pop ebp
push ebp
push edi
push ebp
pop esi
push ebx
pop ebx
call fcn.0048c230
test al, al
je 0x40448c
pop ebp
push esi
pop eax
pop esp
push ecx
pop ebp
push ebx
pop ebp
pop ecx
pop edi
push edi
pop ecx
push ecx
pop eax
pop ebx
push esp
pop edx
call fcn.0048bd60
test al, al
je 0x4044a7
pop ecx
push esp
pop ebp
push esi
pop esp
pop eax
pop edi
push ebp
push esp
pop edi
push ecx
pop ecx
push edx
push ecx
pop ecx
push eax
push esp
push ecx
cmp byte [ebp - 1], 0
jne 0x4044df
mov ecx, dword [ebp + 8]
lea edx, [ecx + 0xa8]
lea esi, [edx + 1]
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x4044c0
sub edx, esi
je 0x4044df
push ecx
mov ecx, dword [ebp - 0x14]
call fcn.004054d0
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4053e0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x69def4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x11c], edi
mov eax, dword [edi + 0x210]
mov dword [edi + 0x214], eax
call fcn.0048bd60
test al, al
je 0x405438
push edi
pop ecx
push esi
push ebx
push edi
push ebp
push ebp
push esp
pop eax
pop edi
pop ecx
pop ebp
pop ecx
pop esp
push esi
pop eax
pop ebp
push ebp
push ebp
push eax
pop edi
push edx
push eax
push eax
pop ebp
push ebx
pop edx
push ebp
pop esi
mov edi, dword [ebp - 0x11c]
push 0x114
lea eax, [ebp - 0x118]
push 0
push eax
call fcn.005d4b40
add esp, 0xc
mov dword [ebp - 0x118], 0x114
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x108], 2
jne 0x405477
mov ecx, edi
call fcn.00404a10
jmp 0x405493
xor esi, esi
nop dword [eax]
test ebx, ebx
jne 0x405493
mov ecx, edi
call fcn.004048b0
inc esi
mov ebx, eax
cmp esi, 0xa
jl 0x405480
mov ecx, dword [edi + 0x214]
mov eax, 0x4bda12f7
sub ecx, dword [edi + 0x210]
imul ecx
mov ecx, dword [ebp - 4]
sar edx, 7
xor ecx, ebp
pop edi
mov eax, edx
shr eax, 0x1f
pop esi
add eax, edx
pop ebx
call fcn.005cabbc
mov esp, ebp
pop ebp
ret
Function at 0x407ec0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
mov byte [esi + 0x89], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
cmp dword [eax + 0x14], 0x10
mov ecx, dword [eax + 0x10]
jb 0x407f04
mov eax, dword [eax]
push ecx
push eax
mov ecx, esi
call fcn.0040a1a0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x407f20
Capabilities:
Hash data with md5

Disassembly:
mov byte [ecx + 0x89], 0
mov eax, ecx
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x10], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret

Function at 0x40a2e0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
call fcn.0048beb0
test al, al
je 0x40a308
pop esi
pop ecx
pop edi
push ebx
pop ecx
push edi
push eax
pop edi
push ebp
push edi
push eax
pop eax
push esp
push edx
push ebx
pop eax
pop edi
push ebp
pop ebp
push ecx
pop edx
call fcn.0048c5b0
test al, al
je 0x40a324
push esp
pop esp
push edi
pop ecx
pop ebp
push esp
push esp
pop eax
push esi
push esi
push ebp
pop esp
pop ebx
pop ebx
push edi
pop esp
push esp
pop edi
push edx
call fcn.0048c0e0
test al, al
je 0x40a34b
push edx
push edi
pop eax
pop esp
push edi
pop ebx
pop esi
pop ebp
push esi
pop edi
push esp
push ecx
pop eax
push eax
push ecx
push ebp
push ecx
push ebp
pop esp
push esp
pop edx
pop esp
pop ebp
pop eax
pop esp
pop ebx
pop esi
push edi
push edi
pop ebp
push dword [ebp + 8]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, dword [ebp - 4]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0xb7
pop edi
sete cl
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40a7d0
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6a4
mov eax, dword [0x69def4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x18], ax
xorps xmm0, xmm0
mov word [ebp - 6], ax
lea eax, [ebp - 0x284]
push eax
mov dword [ebp - 0x6a4], 0
movups xmmword [ebp - 0x16], xmm0
call fcn.005d4b40
add esp, 0xc
lea eax, [ebp - 0x284]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 3
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.005de04f
push 0x208
lea eax, [ebp - 0x694]
push 0
push eax
call fcn.005d4b40
push 0x208
lea eax, [ebp - 0x48c]
push 0
push eax
call fcn.005d4b40
push 0x64
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x698], 0
push 0
push eax
mov dword [ebp - 0x6a0], 0
mov dword [ebp - 0x69c], 0
call fcn.005d4b40
add esp, 0x30
lea eax, [ebp - 0x48c]
push 0x104
push eax
lea eax, [ebp - 0x69c]
push eax
lea eax, [ebp - 0x6a0]
push eax
lea eax, [ebp - 0x698]
push eax
push 0x104
lea eax, [ebp - 0x694]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x40a8e1
push dword [ebp - 0x698]
lea eax, [ebp - 0x7c]
push str._08X
push eax
call fcn.004056a0
add esp, 0xc
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
cmp byte [ebp - 0x7c], 0
jne 0x40a8fc
xor eax, eax
jmp 0x40a90b
lea eax, [ebp - 0x7c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40a902
sub eax, edx
push eax
lea eax, [ebp - 0x7c]
mov ecx, esi
push eax
call fcn.00409100
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.005cabbc
mov esp, ebp
pop ebp
ret 4