joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40bfc0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x529474]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x114], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x118], eax
mov byte [ebp - 0x109], 0
test eax, eax
jne 0x40c000
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004123d1
mov esp, ebp
pop ebp
ret
push ebx
push 0x103
lea ecx, [ebp - 0x107]
push 0
push ecx
mov byte [ebp - 0x108], 0
call fcn.00416190
push 0x53717c
push 0x537344
lea edx, [ebp - 0x108]
push 0x104
push edx
call fcn.004139a5
add esp, 0x1c
push 0
push 0x80
push 3
push 0
push 1
push bind
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov ebx, eax
test ebx, ebx
je 0x40c116
cmp ebx, 0xffffffff
je 0x40c116
mov eax, dword [0x539a70]
inc eax
mov dword [0x539a70], eax
cmp eax, 0x22dc
jbe 0x40c084
xor eax, eax
mov dword [0x539a70], eax
push edi
and eax, 0x189
push 0
or eax, 0x24
push ebx
mov dword [0x53e928], eax
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov edi, eax
mov dword [ebp - 0x110], edi
test edi, edi
je 0x40c10e
push esi
push edi
call fcn.00412a53
mov esi, eax
add esp, 4
test esi, esi
je 0x40c10d
push edi
push 0
push esi
call fcn.00416190
mov edx, dword [ebp - 0x110]
add esp, 0xc
push 0
lea ecx, [ebp - 0x110]
push ecx
push edx
push esi
push ebx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x40c0f0
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push esi
call fcn.00412a19
add esp, 4
jmp 0x40c10d
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x118]
mov dword [eax], esi
mov dword [edx], ecx
mov byte [ebp - 0x109], 1
pop esi
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x109]
xor ecx, ebp
pop ebx
call fcn.004123d1
mov esp, ebp
pop ebp
ret
Function at 0x40c130
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
xor esi, esi
mov dword [ebp - 0xc], esi
mov byte [ebp - 1], 0
cmp dword [ebp + 0xc], esi
jne 0x40c14c
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xc]
push eax
push 0x20019
push esi
push 0x5375d0
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40c21b
mov eax, dword [ebp - 0xc]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp - 8]
push ecx
push esi
lea edx, [ebp - 0x10]
push edx
push esi
push 0x5375e8
push eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], esi
call ebx
cmp dword [ebp - 0x10], 3
jne 0x40c208
push edi
mov edi, dword [ebp - 8]
cmp edi, esi
jbe 0x40c207
push edi
call fcn.00412a53
mov esi, eax
add esp, 4
test esi, esi
je 0x40c207
push edi
push 0
push esi
call fcn.00416190
mov eax, dword [ebp - 0xc]
add esp, 0xc
lea ecx, [ebp - 8]
push ecx
push esi
lea edx, [ebp - 0x10]
push edx
push 0
push 0x5375e8
push eax
call ebx
test eax, eax
jne 0x40c1f8
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [ecx], esi
mov ecx, dword [ebp - 0xc]
pop edi
push ecx
mov dword [eax], edx
mov byte [ebp - 1], 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 1]
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
push esi
call fcn.00412a19
add esp, 4
call dword [sym.imp.KERNEL32.DLL_GetLastError]
pop edi
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 1]
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov al, byte [ebp - 1]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40c230
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x529474]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push esi
call fcn.0040c130
add esp, 8
test al, al
jne 0x40c269
push edi
push esi
call fcn.0040bfc0
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004123d1
mov esp, ebp
pop ebp
ret
push 0x103
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call fcn.00416190
push 0x53717c
push 0x537344
lea ecx, [ebp - 0x108]
push 0x104
push ecx
call fcn.004139a5
add esp, 0x1c
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov al, 1
call fcn.004123d1
mov esp, ebp
pop ebp
ret
Function at 0x40c2c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
mov byte [ebp - 1], 0
cmp dword [ebp + 8], esi
je 0x40c421
cmp dword [ebp + 0xc], 1
jl 0x40c421
push esi
call fcn.0041413d
push eax
call fcn.004140d4
mov eax, dword [0x53e978]
add esp, 8
cmp eax, esi
je 0x40c30d
push eax
call fcn.00412a19
add esp, 4
mov dword [0x53e978], esi
mov dword [0x53e974], esi
call fcn.004140e6
cdq
mov ecx, 0xfa
idiv ecx
mov eax, 0x537650
inc dl
mov byte [ebp - 2], dl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c327
push ebx
sub eax, edx
mov ebx, eax
push edi
movzx edi, bl
push edi
mov dword [ebp - 0xc], ebx
call fcn.00412a53
add esp, 4
mov dword [ebp - 8], eax
cmp eax, esi
jne 0x40c353
pop edi
pop ebx
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
test bl, bl
je 0x40c36d
mov esi, 0x537650
sub esi, eax
mov ecx, edi
mov dl, byte [esi + eax]
xor dl, byte [ebp - 2]
inc eax
dec ecx
mov byte [eax - 1], dl
jne 0x40c360
mov eax, dword [ebp + 0xc]
lea ebx, [eax + edi + 0xe]
push ebx
call fcn.00412a53
mov esi, eax
add esp, 4
mov dword [0x53e978], esi
test esi, esi
je 0x40c40b
mov ecx, dword [0x534fe0]
mov edx, dword [ebp + 0xc]
mov dword [esi], ecx
mov cl, byte [ebp - 0xc]
mov dword [esi + 4], edx
mov eax, dword [0x534fe8]
mov dl, byte [ebp - 2]
mov dword [esi + 8], eax
mov eax, dword [ebp - 8]
mov byte [esi + 0xc], cl
push edi
push eax
lea ecx, [esi + 0xe]
push ecx
mov dword [0x53e974], ebx
mov byte [esi + 0xd], dl
call fcn.0041c370
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push edx
push eax
lea ecx, [edi + esi + 0xe]
push ecx
call fcn.0041c370
push ebx
push esi
mov edi, esi
call fcn.0040bf30
add esp, 0x20
test al, al
jne 0x40c407
push ebx
call fcn.0040be00
mov edx, dword [ebp - 8]
add esp, 4
push edx
mov byte [ebp - 1], al
call fcn.00412a19
mov al, byte [ebp - 1]
add esp, 4
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
mov byte [ebp - 1], 1
mov edx, dword [ebp - 8]
push edx
call fcn.00412a19
mov al, byte [ebp - 1]
add esp, 4
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
xor al, al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40c710
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x529474]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x103
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call fcn.00416190
push 0x5371a8
push 0x537344
lea ecx, [ebp - 0x108]
push 0x104
push ecx
call fcn.004139a5
add esp, 0x1c
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004123d1
mov esp, ebp
pop ebp
ret
Function at 0x40c780
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x529474]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x48]
push eax
push 0x20019
push 0
push 0x53735c
push reloc.WS2_32.dll_accept
mov dword [ebp - 0x48], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40c80b
push 0x3f
push eax
lea ecx, [ebp - 0x43]
push ecx
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x44], al
call fcn.00416190
add esp, 0xc
lea edx, [ebp - 0x50]
push edx
mov edx, dword [ebp - 0x48]
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x4c]
push ecx
push 0
push 0x537368
push edx
mov dword [ebp - 0x50], 0x40
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40c801
cmp dword [ebp - 0x4c], 4
jne 0x40c801
mov eax, dword [ebp - 0x44]
mov dword [0x534fe4], eax
mov ecx, dword [ebp - 0x48]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004123d1
mov esp, ebp
pop ebp
ret

Function at 0x40cec0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1ac
mov eax, dword [0x529474]
xor eax, esp
mov dword [esp + 0x1a8], eax
push esi
lea eax, [esp + 0x18]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x40cf0a
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov al, 1
pop esi
mov ecx, dword [esp + 0x1a8]
xor ecx, esp
call fcn.004123d1
mov esp, ebp
pop ebp
ret
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
push str.127.0.0.1
mov esi, eax
call dword [sym.imp.WS2_32.dll_inet_addr]
movzx edx, word [0x534fe0]
mov ecx, 2
push edx
mov dword [esp + 0x10], eax
mov word [esp + 0xc], cx
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0xa], ax
mov eax, dword [0x539a88]
inc eax
mov dword [0x539a88], eax
cmp eax, 0x22dc
jbe 0x40cf5d
xor eax, eax
mov dword [0x539a88], eax
and eax, 0x189
or eax, 0x24
mov dword [0x53e928], eax
cmp esi, 0xffffffff
je 0x40ceef
push 0x10
lea eax, [esp + 0xc]
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
mov ecx, dword [esp + 0x1ac]
test eax, eax
sete al
pop esi
xor ecx, esp
call fcn.004123d1
mov esp, ebp
pop ebp
ret
Function at 0x40f940
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
lea esi, [eax + 4]
mov al, byte [esi + 0xd]
test al, al
je 0x40f94f
xor al, al
pop esi
ret
cmp dword [esi + 4], 0
jne 0x40f96e
lea ecx, [esi + 8]
push ecx
push 4
push esi
push 0x4042d0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [esi + 4], eax
mov edx, dword [esi + 4]
push edx
mov dword [0x53e928], 0x3ff1
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
cmp eax, 0xffffffff
setne al
mov byte [esi + 0xc], al
pop esi
ret

Function at 0x40fac0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x24], 0
call dword [sym.imp.KERNEL32.DLL_GetNativeSystemInfo]
mov eax, dword [0x539af0]
inc eax
mov dword [0x539af0], eax
cmp eax, 0x22dc
jbe 0x40fb0a
xor eax, eax
mov dword [0x539af0], eax
and eax, 0x189
or eax, 0x24
mov dword [0x53e928], eax
mov eax, dword [ebp - 0x24]
mov ecx, 9
cmp cx, ax
je 0x40fb34
mov edx, 6
cmp dx, ax
je 0x40fb34
xor eax, eax
mov esp, ebp
pop ebp
ret
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x40fb40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e85cb
mov eax, dword fs:[0]
push eax
sub esp, 0x12c
mov eax, dword [0x529474]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 0x134], ebx
mov eax, 0x537558
mov dword [ebp - 0x118], 0xf
mov dword [ebp - 0x11c], ebx
mov byte [ebp - 0x12c], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40fb93
sub eax, edx
push eax
push 0x537558
lea ecx, [ebp - 0x12c]
call fcn.00402650
mov dword [ebp - 4], ebx
mov edi, 0xf003f
call fcn.0040fac0
cmp eax, 1
jne 0x40fbc4
mov edi, 0xf013f
lea eax, [ebp - 0x130]
push eax
push edi
push ebx
push 0x537390
push reloc.WS2_32.dll_bind
mov dword [0x53e928], 0x3ff1
mov dword [ebp - 0x130], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40fd3c
mov edi, dword [ebp - 0x130]
cmp edi, ebx
je 0x40fd3c
mov eax, dword [0x539af4]
inc eax
mov dword [0x539af4], eax
cmp eax, 0x22dc
jbe 0x40fc1c
xor eax, eax
mov dword [0x539af4], eax
push 0xfe
and eax, 0x189
lea ecx, [ebp - 0x10f]
or eax, 0x24
push ebx
push ecx
mov dword [0x53e928], eax
mov byte [ebp - 0x110], bl
call fcn.00416190
add esp, 0xc
lea edx, [ebp - 0x138]
push edx
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x134]
push ecx
push ebx
push 0x525b3c
push edi
mov dword [ebp - 0x138], 0xff
mov dword [ebp - 0x134], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40fcdd
mov eax, dword [0x539af8]
inc eax
mov dword [0x539af8], eax
cmp eax, 0x22dc
jbe 0x40fc97
xor eax, eax
mov dword [0x539af8], eax
and eax, 0x189
lea edx, [ebp - 0x110]
or eax, 0x24
push 0xff
push edx
mov dword [0x53e928], eax
call fcn.0041441d
lea eax, [ebp - 0x110]
add esp, 8
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40fcc1
sub eax, edx
push eax
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x12c]
call fcn.00402650
mov eax, dword [0x539afc]
inc eax
mov dword [0x539afc], eax
cmp eax, 0x22dc
jbe 0x40fcf6
xor eax, eax
mov dword [0x539afc], eax
mov ecx, dword [ebp - 0x130]
and eax, 0x189
or eax, 0x24
push ecx
mov dword [0x53e928], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x12c]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
push edx
mov ecx, esi
mov byte [esi], bl
call fcn.00402120
cmp dword [ebp - 0x118], 0x10
jb 0x40fd6e
mov eax, dword [ebp - 0x12c]
push eax
jmp 0x40fd66
lea ecx, [ebp - 0x12c]
push ecx
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov ecx, esi
mov byte [esi], bl
call fcn.00402120
cmp dword [ebp - 0x118], 0x10
jb 0x40fd6e
mov edx, dword [ebp - 0x12c]
push edx
call fcn.0041293d
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004123d1
mov esp, ebp
pop ebp
ret
Function at 0x40fd90
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e858b
mov eax, dword fs:[0]
push eax
sub esp, 0x128
mov eax, dword [0x529474]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 1
xor edi, edi
push 0x525b40
lea ecx, [ebp - 0x12c]
mov dword [ebp - 0x130], edi
mov dword [ebp - 0x118], 0xf
mov dword [ebp - 0x11c], edi
mov byte [ebp - 0x12c], 0
call fcn.00402650
push 0x288
mov dword [ebp - 4], edi
call fcn.00412999
mov esi, eax
add esp, 4
cmp esi, edi
je 0x40ffbf
push 0x288
push edi
push esi
call fcn.00416190
mov edi, dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
add esp, 0xc
lea edx, [ebp - 0x134]
push edx
push esi
mov dword [ebp - 0x130], esi
mov dword [ebp - 0x134], 0x288
call edi
mov dword [0x53e928], 0x3ff1
cmp eax, 0x6f
jne 0x40fe9b
push esi
call fcn.00413bc8
mov eax, dword [ebp - 0x134]
push eax
call fcn.004123c6
mov esi, eax
add esp, 8
test esi, esi
je 0x40ff6b
mov dword [ebp - 0x130], eax
mov eax, dword [0x539b00]
inc eax
mov dword [0x539b00], eax
cmp eax, 0x22dc
jbe 0x40fe84
xor eax, eax
mov dword [0x539b00], eax
and eax, 0x189
or eax, 0x24
mov dword [0x53e928], eax
lea eax, [ebp - 0x134]
push eax
push esi
call edi
test eax, eax
jne 0x40ff5c
push 0xfe
push eax
lea ecx, [ebp - 0x10f]
push ecx
mov byte [ebp - 0x110], al
call fcn.00416190
mov edx, dword [0x539b04]
add esp, 0xc
inc edx
cmp edx, 0x22dc
jbe 0x40fecf
xor edx, edx
mov eax, edx
and eax, 0x189
or eax, 0x24
mov dword [0x53e928], eax
mov al, byte [esi + 0x195]
cmp byte [esi + 0x194], al
jne 0x40ffec
mov cl, byte [esi + 0x196]
cmp al, cl
jne 0x40ffec
mov al, byte [esi + 0x197]
cmp cl, al
jne 0x40ffec
mov cl, byte [esi + 0x198]
cmp al, cl
jne 0x40ffec
cmp cl, byte [esi + 0x199]
jne 0x40ffec
mov esi, dword [esi]
test esi, esi
jne 0x40fec4
mov dword [0x539b04], edx
lea eax, [ebp - 0x110]
lea edx, [eax + 1]
jmp 0x40ff40
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40ff40
sub eax, edx
push eax
lea edx, [ebp - 0x110]
push edx
lea ecx, [ebp - 0x12c]
call fcn.00402650
mov eax, dword [ebp - 0x130]
push eax
call fcn.00413bc8
add esp, 4
lea ecx, [ebp - 0x12c]
push ecx
mov dword [ebx + 0x14], 0xf
mov dword [ebx + 0x10], 0
mov ecx, ebx
mov byte [ebx], 0
call fcn.00402120
cmp dword [ebp - 0x118], 0x10
jb 0x40ffa2
mov edx, dword [ebp - 0x12c]
push edx
call fcn.0041293d
add esp, 4
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004123d1
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x12c]
mov dword [ebx + 0x14], 0xf
mov dword [ebx + 0x10], edi
push eax
mov ecx, ebx
mov byte [ebx], 0
call fcn.00402120
cmp dword [ebp - 0x118], 0x10
jb 0x40ffa2
mov ecx, dword [ebp - 0x12c]
push ecx
jmp 0x40ff9a
movzx ecx, byte [esi + 0x199]
movzx eax, byte [esi + 0x197]
push ecx
movzx ecx, byte [esi + 0x196]
mov dword [0x539b04], edx
movzx edx, byte [esi + 0x198]
push edx
movzx edx, byte [esi + 0x195]
push eax
movzx eax, byte [esi + 0x194]
push ecx
push edx
push eax
lea ecx, [ebp - 0x110]
push 0x537584
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x20
jmp 0x40ff32
Function at 0x410040
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e854b
mov eax, dword fs:[0]
push eax
sub esp, 0x124
mov eax, dword [0x529474]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
push 0xfe
lea eax, [ebp - 0x10f]
push ebx
mov dword [ebp - 0x130], ebx
push eax
mov byte [ebp - 0x110], bl
call fcn.00416190
add esp, 0xc
push 1
push 0x525b40
lea ecx, [ebp - 0x12c]
mov dword [ebp - 0x130], 0xff
mov dword [ebp - 0x118], 0xf
mov dword [ebp - 0x11c], ebx
mov byte [ebp - 0x12c], bl
call fcn.00402650
lea ecx, [ebp - 0x130]
push ecx
lea edx, [ebp - 0x110]
push edx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.DLL_GetComputerNameA]
test eax, eax
jne 0x410104
mov eax, dword [0x539b08]
inc eax
mov dword [0x539b08], eax
cmp eax, 0x22dc
jbe 0x4100f5
xor eax, eax
mov dword [0x539b08], eax
and eax, 0x189
or eax, 0x24
mov dword [0x53e928], eax
jmp 0x41012c
lea eax, [ebp - 0x110]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x410110
sub eax, edx
push eax
lea edx, [ebp - 0x110]
push edx
lea ecx, [ebp - 0x12c]
call fcn.00402650
lea eax, [ebp - 0x12c]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
push eax
mov ecx, esi
mov byte [esi], bl
call fcn.00402120
cmp dword [ebp - 0x118], 0x10
jb 0x41015e
mov ecx, dword [ebp - 0x12c]
push ecx
call fcn.0041293d
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004123d1
mov esp, ebp
pop ebp
ret
Function at 0x4102a0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e850b
mov eax, dword fs:[0]
push eax
sub esp, 0x238
mov eax, dword [0x529474]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
push 0x110
lea eax, [ebp - 0x23c]
push ebx
push eax
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x240], ebx
call fcn.00416190
add esp, 0xc
push 1
push 0x525b40
lea ecx, [ebp - 0x12c]
mov dword [ebp - 0x118], 0xf
mov dword [ebp - 0x11c], ebx
mov byte [ebp - 0x12c], bl
call fcn.00402650
push 0xfe
lea ecx, [ebp - 0x10f]
push ebx
mov dword [ebp - 4], ebx
push ecx
mov byte [ebp - 0x110], bl
call fcn.00416190
add esp, 0xc
lea edx, [ebp - 0x240]
push edx
mov dword [ebp - 0x240], 0x114
call dword [sym.imp.KERNEL32.DLL_GetVersionExW]
test eax, eax
jne 0x410383
lea eax, [ebp - 0x12c]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
push eax
mov ecx, esi
mov byte [esi], bl
call fcn.00402120
cmp dword [ebp - 0x118], 0x10
jb 0x41042e
mov ecx, dword [ebp - 0x12c]
push ecx
jmp 0x410426
mov eax, dword [ebp - 0x23c]
cmp eax, 6
jb 0x4103a8
cmp dword [ebp - 0x238], 2
jb 0x4103a8
mov eax, 0xa
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x238], ebx
lea edx, [eax + eax*4]
mov eax, dword [ebp - 0x238]
lea ecx, [eax + edx*2]
push ecx
lea edx, [ebp - 0x110]
push 0x525b54
push edx
mov dword [0x53e928], 0x3ff1
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x110]
add esp, 0xc
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4103e0
sub eax, edx
push eax
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x12c]
call fcn.00402650
lea ecx, [ebp - 0x12c]
push ecx
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov ecx, esi
mov byte [esi], bl
call fcn.00402120
cmp dword [ebp - 0x118], 0x10
jb 0x41042e
mov edx, dword [ebp - 0x12c]
push edx
call fcn.0041293d
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004123d1
mov esp, ebp
pop ebp
ret

Function at 0x4111f0
Capabilities:
Create thread
Resume thread

Disassembly:
mov ecx, esi
call fcn.00410450
test al, al
jne 0x4111fe
xor al, al
ret
mov eax, dword [0x539b3c]
inc eax
mov dword [0x539b3c], eax
cmp eax, 0x22dc
jbe 0x411217
xor eax, eax
mov dword [0x539b3c], eax
and eax, 0x189
or eax, 0x24
mov dword [0x53e928], eax
mov al, byte [esi + 0xd]
test al, al
jne 0x4111fb
cmp dword [esi + 4], 0
jne 0x41124a
lea ecx, [esi + 8]
push ecx
push 4
push esi
push 0x4042d0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [esi + 4], eax
mov edx, dword [esi + 4]
push edx
mov dword [0x53e928], 0x3ff1
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
cmp eax, 0xffffffff
setne al
mov byte [esi + 0xc], al
ret

Function at 0x4123d1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x529474]
jne 0x4123db
repz ret
jmp fcn.00414614
Function at 0x413b31
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x413b58
call fcn.0041343a
mov dword [eax], esi
call fcn.00413427
push 0x16
pop esi
mov dword [eax], esi
call fcn.004157b3
mov eax, esi
jmp 0x413bad
test dword [ebp + 0xc], 0xfffffff9
jne 0x413b3e
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x413b85
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
call fcn.0041344d
pop ecx
call fcn.00413427
mov eax, dword [eax]
jmp 0x413bad
test al, 0x10
jne 0x413bab
test al, 1
je 0x413bab
test byte [ebp + 0xc], 2
je 0x413bab
call fcn.0041343a
mov dword [eax], 5
call fcn.00413427
mov dword [eax], 0xd
jmp 0x413b7c
xor eax, eax
pop esi
pop ebp
ret

Function at 0x41ac0c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x529474]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00416bf4
and dword [ebp - 0x14], 0
cmp dword [0x53a810], 0
mov dword [ebp - 0x18], eax
jne 0x41acbf
push 0x4ebae4
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41ad67
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x41ad67
mov esi, dword [sym.imp.KERNEL32.DLL_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x53a810], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x53a814], eax
call edi
push eax
call esi
push 0x4eba98
push ebx
mov dword [0x53a818], eax
call edi
push eax
call esi
mov dword [0x53a820], eax
test eax, eax
je 0x41acbf
push 0x4eba80
push ebx
call edi
push eax
call esi
mov dword [0x53a81c], eax
mov eax, dword [0x53a81c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.DLL_DecodePointer]
cmp eax, ecx
je 0x41ad18
cmp dword [0x53a820], ecx
je 0x41ad18
push eax
call esi
push dword [0x53a820]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41ad18
test ebx, ebx
je 0x41ad18
call edi
test eax, eax
je 0x41ad0f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41ad0f
test byte [ebp - 8], 1
jne 0x41ad18
or dword [ebp + 0x10], 0x200000
jmp 0x41ad4b
mov eax, dword [0x53a814]
cmp eax, dword [ebp - 0x18]
je 0x41ad4b
push eax
call esi
test eax, eax
je 0x41ad4b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41ad4b
mov eax, dword [0x53a818]
cmp eax, dword [ebp - 0x18]
je 0x41ad4b
push eax
call esi
test eax, eax
je 0x41ad4b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x53a810]
call esi
test eax, eax
je 0x41ad67
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41ad69
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004123d1
leave
ret