joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1065a745
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x11c
cmp dword [esp + 0x128], 0
je 0x1065a90a
push ebp
push esi
mov esi, dword [esp + 0x12c]
xor ebp, ebp
mov dword [esp + 0x14], ebp
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x1065a908
push ebx
mov edx, esi
push edi
mov eax, dword [edx]
mov ebx, dword [esp + 0x130]
add eax, ebx
mov dword [esp + 0x18], eax
mov eax, dword [edx + 0x10]
add eax, ebx
lea edi, [ecx + ebx]
mov dword [esp + 0x20], eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
mov dword [esp + 0x10], ebx
test ebx, ebx
jne 0x1065a7b0
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
mov dword [esp + 0x10], eax
push 0x104
lea eax, [esp + 0x2c]
push 0
push eax
call fcn.10652f12
add esp, 0xc
test ebx, ebx
je 0x1065a8b0
mov eax, dword [esp + 0x18]
and dword [esp + 0x14], 0
mov eax, dword [eax]
test eax, eax
je 0x1065a899
mov esi, dword [esp + 0x10]
xor edi, edi
mov ebp, dword [esp + 0x130]
test eax, eax
jns 0x1065a7f5
movzx ebx, ax
jmp 0x1065a7fa
lea ebx, [ebp + 2]
add ebx, eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [esp + 0x20]
mov dword [edi + ecx], eax
test eax, eax
jne 0x1065a871
cmp dword [0x106615f0], 1
jne 0x1065a871
push 0x104
push eax
lea eax, [esp + 0x30]
push eax
call fcn.10652f12
lea eax, [esp + 0x34]
push eax
call fcn.1065a9ee
lea eax, [esp + 0x38]
push 0x10651fa4
push eax
call fcn.10652f40
lea eax, [esp + 0x40]
push ebx
push eax
call fcn.10652f40
add esp, 0x20
lea eax, [esp + 0x24]
push 0
push eax
lea eax, [esp + 0x30]
push eax
call fcn.10652f67
pop ecx
push eax
lea eax, [esp + 0x34]
push eax
push dword [0x10661590]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
inc ecx
mov edi, ecx
mov dword [esp + 0x14], ecx
shl edi, 2
mov eax, dword [edi + eax]
test eax, eax
jne 0x1065a7ee
mov esi, dword [esp + 0x134]
mov ebp, dword [esp + 0x1c]
inc ebp
imul edx, ebp, 0x14
mov dword [esp + 0x1c], ebp
add edx, esi
mov ecx, dword [edx + 0xc]
test ecx, ecx
jne 0x1065a777
jmp 0x1065a906
lea eax, [esp + 0x28]
push eax
call fcn.1065a9ee
lea eax, [esp + 0x2c]
mov dword [esp], 0x10651f88
push eax
call fcn.10652f40
lea eax, [esp + 0x30]
push edi
push eax
call fcn.10652f40
add esp, 0x10
cmp dword [0x106615f0], 1
jne 0x1065a906
push 0
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
call fcn.10652f67
pop ecx
push eax
lea eax, [esp + 0x34]
push eax
push dword [0x10661590]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop ebx
pop esi
pop ebp
xor eax, eax
add esp, 0x11c
ret
Function at 0x1065a940
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push 0x208
lea eax, [ebp - 0x410]
push eax
call fcn.1065a9bc
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x10661460], eax
push 0
push 0
push 0
push 2
push 0
push dword [0x10661460]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [0x10661464], eax
push 0
push 0
push 0
push 4
push dword [0x10661464]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
add eax, dword [0x106615f8]
leave
ret
Function at 0x1065aa44
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
cmp dword [ebp + 0x14], 0
jne 0x1065aa57
xor eax, eax
jmp 0x1065abdb
mov eax, dword [ebp + 0xc]
add eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
and dword [ebp - 0x24], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 8]
movzx eax, word [eax + 4]
cmp eax, 0x14c
jne 0x1065aa95
mov eax, dword [ebp - 8]
add eax, 0xf8
mov dword [ebp - 0xc], eax
jmp 0x1065aaae
mov eax, dword [ebp - 8]
movzx eax, word [eax + 4]
cmp eax, 0x8664
jne 0x1065aaae
mov eax, dword [ebp - 8]
add eax, 0x108
mov dword [ebp - 0xc], eax
and dword [ebp - 0x10], 0
jmp 0x1065aabb
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x10], eax
je 0x1065aaf4
imul eax, dword [ebp - 0x10], 0x28
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax + 0xc]
mov dword [ebp - 0x28], edx
lea eax, [ebp - 0x24]
push eax
push 0x40
imul eax, dword [ebp - 0x10], 0x28
mov ecx, dword [ebp - 0xc]
push dword [ecx + eax + 8]
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x1065aab4
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 0x2c]
jae 0x1065ab94
mov eax, dword [ebp + 0xc]
add eax, 8
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
sub eax, 8
shr eax, 1
mov dword [ebp - 0x30], eax
and dword [ebp - 4], 0
jmp 0x1065ab24
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x30]
je 0x1065ab83
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
movzx eax, word [ecx + eax*2]
test eax, eax
jne 0x1065ab3c
jmp 0x1065ab1d
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
movzx eax, word [ecx + eax*2]
and eax, 0xfff
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx]
add ecx, eax
add ecx, dword [ebp + 8]
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
movzx eax, word [ecx + eax*2]
sar eax, 0xc
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
je 0x1065ab74
jmp 0x1065ab81
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
add eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x20]
mov dword [ecx], eax
jmp 0x1065ab1d
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax + 4]
mov dword [ebp + 0xc], ecx
jmp 0x1065aaf4
and dword [ebp - 0x14], 0
jmp 0x1065aba1
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x14], eax
je 0x1065abd9
imul eax, dword [ebp - 0x14], 0x28
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax + 0xc]
mov dword [ebp - 0x38], edx
push 0
push dword [ebp - 0x24]
imul eax, dword [ebp - 0x14], 0x28
mov ecx, dword [ebp - 0xc]
push dword [ecx + eax + 8]
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x1065ab9a
xor eax, eax
leave
ret
Function at 0x1065ad7e
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x68
mov eax, dword [esp + 0x6c]
push ebx
push esi
push edi
mov esi, dword [eax]
xor edi, edi
call fcn.1065ad41
push esi
call fcn.1065af2c
push dword [esp + 0x80]
mov esi, eax
call fcn.1065af2c
push 0x58
mov dword [esp + 0x20], eax
lea eax, [esp + 0x28]
push edi
push eax
call fcn.10652f12
lea eax, [esp + 0x30]
push eax
push 5
push esi
call fcn.1065ac5b
mov ebx, eax
add esp, 0x20
cmp ebx, 5
jb 0x1065af13
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push esi
call fcn.1065af61
mov edi, eax
add esp, 0x14
test edi, edi
je 0x1065af13
push ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
and dword [esp + 0x14], 0
mov ebp, eax
and dword [esp + 0x10], 0
lea eax, [esp + 0x14]
push eax
push 0x40
push ebx
push esi
push ebp
mov dword [esp + 0x30], ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x1065aef6
lea eax, [esp + 0x10]
push eax
push 0x40
push 0x6c
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x1065aedb
lea eax, [edi + 0x2c]
mov ebp, esi
xor ecx, ecx
mov edx, eax
sub ebp, eax
mov al, byte [edx + ebp]
mov byte [edx], al
mov byte [edi + ecx + 0x4c], al
inc ecx
inc edx
cmp ecx, ebx
jb 0x1065ae47
lea eax, [ebx + esi]
push eax
lea eax, [ebx + 0x2c]
add eax, edi
push eax
call fcn.1065acfc
mov edx, dword [esp + 0x20]
mov eax, edx
mov ebp, dword [esp + 0x24]
sub eax, esi
pop ecx
pop ecx
mov ecx, esi
sub ecx, edx
cmp edx, esi
cmovb eax, ecx
cmp eax, 0x7fff0000
jbe 0x1065aea5
lea eax, [edi + 0xc]
push edx
push eax
call fcn.1065acfc
pop ecx
sub eax, edi
pop ecx
sub eax, 0xc
push eax
lea eax, [edi + 0xc]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [edi + 0xc]
jmp 0x1065aea7
mov eax, edx
push eax
push esi
call fcn.1065acfc
mov eax, dword [esp + 0x20]
pop ecx
pop ecx
mov dword [edi + 8], eax
lea eax, [edi + 0x2c]
push ebx
push eax
push ebp
mov dword [edi + 4], ebx
mov dword [edi], esi
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push 0x6c
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push ebx
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x18]
push ebx
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
cmp dword [edi], 0
pop ebp
je 0x1065af07
mov ecx, dword [esp + 0x78]
lea eax, [edi + 0x2c]
mov dword [ecx], eax
jmp 0x1065af13
push 1
push edi
call fcn.1065b055
pop ecx
pop ecx
xor edi, edi
push 0x1066146c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
test edi, edi
pop edi
pop esi
setne al
pop ebx
add esp, 0x68
ret
Function at 0x1065af61
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x40
push ebx
xor ebx, ebx
cmp dword [0x10661484], 0x40
jae 0x1065b04e
mov ecx, dword [esp + 0x48]
push ebp
push esi
mov esi, dword [esp + 0x54]
mov ebp, 0xfff80000
add esi, ecx
add ecx, dword [esp + 0x5c]
push edi
cmp ecx, 0x80000000
lea edi, [esp + 0x2c]
push 9
lea eax, [ecx + 0x7ff80000]
cmovb ebp, eax
xor eax, eax
pop ecx
rep stosd dword es:[edi], eax
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor eax, eax
lea edi, [esi - 0x7fff0000]
inc eax
cmp esi, 0x80000000
cmovb edi, eax
cmp edi, ebp
jae 0x1065b04b
push 0x1c
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1065b026
cmp dword [esp + 0x20], 0x10000
jne 0x1065b018
mov eax, dword [esp + 0x1c]
cmp eax, 0x6c
jb 0x1065b01c
mov ecx, dword [esp + 0x48]
cmp eax, ecx
jb 0x1065b01c
lea eax, [ecx - 1]
xor edx, edx
add eax, edi
div ecx
push 0x20
imul eax, ecx
push 0x3000
push 0x6c
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, eax
test ebx, ebx
jne 0x1065b02a
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x10]
add edi, eax
cmp edi, ebp
jb 0x1065afc9
test ebx, ebx
je 0x1065b04b
xor eax, eax
cmp dword [eax*4 + 0x10661488], 0
je 0x1065b03e
inc eax
cmp eax, 0x40
jb 0x1065b02c
jmp 0x1065b04b
inc dword [0x10661484]
mov dword [eax*4 + 0x10661488], ebx
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x40
ret
Function at 0x1065cae0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x10c
push ebx
push ebp
mov ebp, dword [esp + 0x11c]
push esi
push edi
lea ebx, [eax + ebp]
cmp eax, 8
jbe 0x1065cc97
mov edi, dword [esp + 0x120]
lea esi, [ebp + 8]
push 0x800
lea eax, [edi + 0x5410]
push eax
mov eax, ebx
sub eax, esi
push eax
lea eax, [edi + 0x140c]
push esi
push eax
call fcn.10660110
add esp, 0x14
cmp eax, 0xffffff88
ja 0x1065cc97
add esi, eax
mov dword [esp + 0x14], 0x1c
mov eax, ebx
sub eax, esi
push eax
push esi
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.1065cce0
add esp, 0x14
mov dword [esp + 0x10], eax
cmp eax, 0xffffff88
ja 0x1065cc97
mov eax, dword [esp + 0x1c]
cmp eax, 8
ja 0x1065cc97
push eax
push dword [esp + 0x18]
lea eax, [esp + 0x34]
push eax
lea eax, [edi + 0x804]
push eax
call fcn.1065d110
add esp, 0x10
cmp eax, 0xffffff88
ja 0x1065cc97
add esi, dword [esp + 0x10]
mov eax, ebx
sub eax, esi
mov dword [esp + 0x18], 0x34
push eax
push esi
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0xc0]
push eax
call fcn.1065cce0
add esp, 0x14
mov dword [esp + 0x10], eax
cmp eax, 0xffffff88
ja 0x1065cc97
mov eax, dword [esp + 0x20]
cmp eax, 9
ja 0x1065cc97
push eax
push dword [esp + 0x1c]
lea eax, [esp + 0xb8]
push eax
lea eax, [edi + 0xc08]
push eax
call fcn.1065d110
add esp, 0x10
cmp eax, 0xffffff88
ja 0x1065cc97
add esi, dword [esp + 0x10]
mov eax, ebx
sub eax, esi
mov dword [esp + 0x10], 0x23
push eax
push esi
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x78]
push eax
call fcn.1065cce0
add esp, 0x14
mov dword [esp + 0x28], eax
cmp eax, 0xffffff88
ja 0x1065cc97
mov eax, dword [esp + 0x24]
cmp eax, 9
ja 0x1065cc97
push eax
push dword [esp + 0x14]
lea eax, [esp + 0x70]
push eax
push edi
call fcn.1065d110
add esp, 0x10
cmp eax, 0xffffff88
ja 0x1065cc97
add esi, dword [esp + 0x28]
lea eax, [esi + 0xc]
cmp eax, ebx
ja 0x1065cc97
sub ebx, esi
xor edx, edx
sub ebx, 0xc
add edi, 0x5c10
nop
mov ecx, dword [esi]
add esi, 4
test ecx, ecx
je 0x1065cc97
cmp ecx, ebx
jae 0x1065cc97
mov dword [edi], ecx
inc edx
add edi, 4
cmp edx, 3
jl 0x1065cc70
sub esi, ebp
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret
pop edi
pop esi
pop ebp
mov eax, 0xffffffe2
pop ebx
add esp, 0x10c
ret
Function at 0x1065fd40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx]
shr eax, 8
test al, al
je 0x1065fd56
mov dword [esp + 0x14], ecx
jmp fcn.1065ef60
mov dword [esp + 0x14], ecx
jmp fcn.1065e320
Function at 0x401407
Capabilities:
Terminate process

Disassembly:
push ebx
mov eax, 0x4f2f3d
mov ebx, 0x12345678
mov ecx, 0x12345678
mov edx, 0x12345678
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [section..data], eax
jmp loc.0047b432
Function at 0x4015b8
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x4015ca
mov eax, dword [0x52809f]
shl eax, 2
mov dword [0x5280a3], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleW
mov edx, eax
call fcn.00518e70
pop edx
call fcn.00518a70
call fcn.0051938c
push 0
call fcn.0051a908
pop ecx
push 0x528048
push 0
call sub.KERNEL32.DLL_GetModuleHandleW
mov dword [0x5280a7], eax
push 0
jmp fcn.005228c4
Function at 0x404188
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
mov dword [ebp - 0x34], eax
mov eax, 0x52990c
call fcn.00519d2c
push 0
call sub.OLE32.DLL_CoInitialize
test eax, eax
jl 0x404325
lea edx, [ebp - 0x38]
push edx
push 0x536694
push 1
push 0
push 0x5366a4
call sub.OLE32.DLL_CoCreateInstance
test eax, eax
jl 0x404320
mov word [ebp - 0x20], 0x18
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x34]
call fcn.00525e48
inc dword [ebp - 0x14]
mov word [ebp - 0x20], 0xc
lea eax, [ebp - 4]
call fcn.004040e4
push eax
mov edx, dword [ebp - 0x38]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x50]
mov eax, dword [ebp - 0x34]
add eax, 8
call fcn.00404098
test al, al
jne 0x404224
mov edx, dword [ebp - 0x34]
add edx, 8
lea eax, [ebp - 4]
call fcn.00525fb0
lea eax, [ebp - 4]
call fcn.004040e4
push eax
mov edx, dword [ebp - 0x38]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x34]
add eax, 0xc
call fcn.00404098
test al, al
jne 0x404255
mov edx, dword [ebp - 0x34]
add edx, 0xc
lea eax, [ebp - 4]
call fcn.00525fb0
push 0
lea eax, [ebp - 4]
call fcn.004040e4
push eax
mov edx, dword [ebp - 0x38]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x44]
push 5
mov eax, dword [ebp - 0x38]
push eax
mov edx, dword [eax]
call dword [edx + 0x3c]
mov word [ebp - 0x20], 0x24
lea eax, [ebp - 8]
call fcn.00403990
mov edx, eax
inc dword [ebp - 0x14]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ecx + 4]
call fcn.004504e8
mov word [ebp - 0x20], 0xc
mov eax, dword [ebp - 8]
call sym.Setup.exe__MakeDirEx_qqr20System_UnicodeString
lea edx, [ebp - 0x3c]
push edx
push 0x5366b4
mov ecx, dword [ebp - 0x38]
push ecx
mov eax, dword [ecx]
call dword [eax]
test eax, eax
jl 0x4042f1
mov word [ebp - 0x20], 0x30
mov edx, dword [ebp - 0x34]
add edx, 4
lea eax, [ebp - 0xc]
call fcn.00525b78
inc dword [ebp - 0x14]
mov word [ebp - 0x20], 0x3c
push 1
lea eax, [ebp - 0xc]
call fcn.00404334
push eax
mov edx, dword [ebp - 0x3c]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x18]
mov eax, dword [ebp - 0x3c]
push eax
mov edx, dword [eax]
call dword [edx + 8]
dec dword [ebp - 0x14]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00525bd8
mov word [ebp - 0x20], 0xc
mov ecx, dword [ebp - 0x38]
push ecx
mov eax, dword [ecx]
call dword [eax + 8]
dec dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, 2
call fcn.00525f88
dec dword [ebp - 0x14]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00525f88
mov word [ebp - 0x20], 0
call sub.OLE32.DLL_CoUninitialize
mov ecx, dword [ebp - 0x30]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x40bd30
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc4
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 0x30], eax
mov eax, 0x52c8e4
call fcn.00519d2c
mov esi, 0x52c606
lea edi, [ebp - 0x23c]
mov ecx, 0x82
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x30]
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
lea edx, [ebp - 0x23c]
push edx
push dword [ebp - 0x34]
call sub.SHELL32.DLL_SHGetPathFromIDListW
mov word [ebp - 0x1c], 0x18
lea edx, [ebp - 0x23c]
lea eax, [ebp - 4]
call fcn.00525f24
mov edx, eax
inc dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00525fb0
mov eax, dword [ebp - 8]
mov word [ebp - 0x1c], 0x24
push eax
dec dword [ebp - 0x10]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00525f88
pop eax
mov word [ebp - 0x1c], 0x18
inc dword [ebp - 0x10]
mov edx, dword [ebp - 0x2c]
mov dword fs:[0], edx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40d39c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec0
push esi
push edi
mov eax, 0x52d4f8
call fcn.00519d2c
mov esi, 0x52d00c
lea edi, [ebp - 0x140]
mov ecx, 0x45
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x140], 0x114
lea eax, [ebp - 0x140]
push eax
call sub.KERNEL32.DLL_GetVersionExW
test eax, eax
jne 0x40d46d
mov word [ebp - 0x1c], 0x24
lea eax, [ebp - 8]
call fcn.00403990
push eax
inc dword [ebp - 0x10]
call sub.KERNEL32.DLL_GetLastError
pop edx
call fcn.0044f978
lea ecx, [ebp - 8]
push ecx
lea eax, [ebp - 4]
call fcn.00403990
mov ecx, eax
inc dword [ebp - 0x10]
mov eax, 0x52d3d0
pop edx
call fcn.00526410
dec dword [ebp - 0x10]
lea eax, [ebp - 8]
mov edx, 2
call fcn.00525f88
mov word [ebp - 0x1c], 0x18
push 0x40
push 0x52d3f0
lea eax, [ebp - 4]
call fcn.004040e4
push eax
push 0
call sub.USER32.DLL_MessageBoxW
xor eax, eax
push eax
dec dword [ebp - 0x10]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00525f88
pop eax
mov edx, dword [ebp - 0x2c]
mov dword fs:[0], edx
jmp 0x40d484
cmp dword [ebp - 0x13c], 6
setae al
and eax, 1
mov edx, dword [ebp - 0x2c]
mov dword fs:[0], edx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40d4d4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
push esi
push edi
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], eax
mov eax, 0x52d528
call fcn.00519d2c
mov esi, 0x52d120
lea edi, [ebp - 0x68]
mov ecx, 0xf
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x68], 0x3c
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0x5c], str.runas
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x58], eax
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x54], edx
lea ecx, [ebp - 0x68]
push ecx
call sub.SHELL32.DLL_ShellExecuteExW
test eax, eax
setne al
and eax, 1
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40e8c4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
push ebx
mov dword [ebp - 0x34], eax
mov eax, 0x52debc
call fcn.00519d2c
mov word [ebp - 0x20], 0x18
lea eax, [ebp - 8]
call fcn.00403990
mov ecx, eax
inc dword [ebp - 0x14]
mov eax, 0x52de44
mov edx, dword [sym.Setup.exe__InstallPath]
call fcn.00526410
lea ecx, [ebp - 8]
push ecx
lea eax, [ebp - 4]
call fcn.00403990
push eax
inc dword [ebp - 0x14]
mov edx, str.xblive.exe___setup
lea eax, [ebp - 0xc]
call fcn.00525e08
inc dword [ebp - 0x14]
lea edx, [ebp - 0xc]
pop ecx
pop eax
call fcn.00525fd8
dec dword [ebp - 0x14]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00525f88
dec dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, 2
call fcn.00525f88
mov word [ebp - 0x20], 0xc
mov ecx, dword [ebp - 0x34]
xor ebx, ebx
mov dword [ecx + 0x40], ebx
xor eax, eax
mov dword [ebp - 0x38], eax
push 0x44
push 0
lea edx, [ebp - 0x84]
push edx
call fcn.0051960f
add esp, 0xc
mov dword [ebp - 0x84], 0x44
push 0x10
push 0
lea ecx, [ebp - 0x94]
push ecx
call fcn.0051960f
add esp, 0xc
mov dword [ebp - 0x58], 1
mov word [ebp - 0x54], 0
mov dword [ebp - 0x3c], 3
xor eax, eax
mov dword [ebp - 0x40], eax
mov word [ebp - 0x20], 0xc
mov edx, dword [ebp - 0x40]
cmp edx, dword [ebp - 0x3c]
jge 0x40ea0b
lea ecx, [ebp - 0x94]
push ecx
lea eax, [ebp - 0x84]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 4]
call fcn.004040e4
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessW
test eax, eax
je 0x40ea00
mov edx, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x94]
mov dword [edx + 0x40], ecx
push dword [ebp - 0x90]
call sub.KERNEL32.DLL_CloseHandle
mov dword [ebp - 0x38], 1
jmp 0x40ea0b
inc dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x3c]
jl 0x40e9b2
mov eax, dword [ebp - 0x38]
push eax
dec dword [ebp - 0x14]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00525f88
pop eax
mov edx, dword [ebp - 0x30]
mov dword fs:[0], edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x410b34
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0x67452301
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0x10325476
mov edx, dword [ebp + 8]
xor ecx, ecx
mov dword [edx], ecx
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 4], edx
pop ebp
ret

Function at 0x412190
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 0x30], edx
mov ecx, dword [ebp + 8]
xor ebx, ebx
mov dword [ecx + 0x4c], ebx
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 0x20], edx
push dword [ebp + 8]
call fcn.0041101e
pop ecx
xor ecx, ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
xor edx, edx
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp - 8]
shr ecx, 1
mov ebx, dword [ebp - 8]
and ebx, 1
dec ebx
not ebx
and ebx, 0xedb88320
xor ecx, ebx
mov dword [ebp - 8], ecx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 8
jl 0x4121c8
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [eax + edx*4 + 0x6c], ecx
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x100
jb 0x4121bd
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4153a4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0x100
or dword [ebp + 0x10], 0x100
shl dword [ebp + 0x14], 1
mov eax, dword [ebp + 0x10]
shr eax, 7
and eax, 1
push eax
mov edx, dword [ebp + 0x14]
and edx, dword [ebp - 4]
add edx, dword [ebp - 4]
mov ecx, dword [ebp + 0x10]
shr ecx, 8
add edx, ecx
add edx, edx
add edx, dword [ebp + 0xc]
push edx
push dword [ebp + 8]
call fcn.004152e9
add esp, 0xc
shl dword [ebp + 0x10], 1
mov eax, dword [ebp + 0x14]
xor eax, dword [ebp + 0x10]
not eax
and dword [ebp - 4], eax
cmp dword [ebp + 0x10], 0x10000
jb 0x4153b6
pop ecx
pop ebp
ret

Function at 0x4153ff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
mov dword [ebp - 4], eax
or dword [ebp + 0xc], 0x100
mov edx, dword [ebp + 0xc]
shr edx, 8
mov ecx, dword [ebp + 8]
movzx eax, word [ecx + edx*2]
mov edx, dword [ebp + 0xc]
shr edx, 7
and edx, 1
neg edx
and edx, 0x7ff
xor eax, edx
sar eax, 4
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx + eax*4]
add dword [ebp - 4], eax
shl dword [ebp + 0xc], 1
cmp dword [ebp + 0xc], 0x10000
jb 0x41540f
mov eax, dword [ebp - 4]
pop ecx
pop ebp
ret