joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409a1c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x409a55
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404390
jmp 0x409a5e
mov eax, ebx
mov edx, esi
call fcn.004042f4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x409a68
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x409a8a
movzx eax, byte [esp]
jmp 0x409a8c
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40a11c
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x409f94
mov eax, dword [0x413bec]
cmp byte [eax], 0
je 0x40a198
mov eax, dword [0x413b08]
call fcn.004030a4
call fcn.00402eac
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00407358
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40a1e0
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40a1ce
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x413ae8]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4167f0]
call fcn.004051c0
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret

Function at 0x410d7c
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov eax, ebx
mov edx, esp
mov ecx, 0x104
call fcn.00404510
add esp, 0x104
pop ebx
ret

Function at 0x410dac
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004046a4
xor eax, eax
push ebp
push 0x410df4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004046b4
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
setne bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x410dfb
lea eax, [ebp - 4]
call fcn.004042a0
ret
Function at 0x411490
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004046a4
xor eax, eax
push ebp
push 0x411560
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
xor ecx, ecx
mov edx, 0xc
call fcn.00403108
mov dword [ebp - 0x14], 0xc
mov dword [ebp - 0xc], 0xffffffff
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x58]
xor ecx, ecx
mov edx, 0x44
call fcn.00403108
mov dword [ebp - 0x58], 0x44
mov dword [ebp - 0x2c], 1
mov word [ebp - 0x28], 0
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x58]
push eax
push 0
push 0
push 0x20
push 0xffffffffffffffff
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
call fcn.004046b4
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x41154a
push 0xffffffffffffffff
mov eax, dword [ebp - 0x68]
push eax
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x68]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x68]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x411567
lea eax, [ebp - 4]
call fcn.004042a0
ret
Function at 0x412294
Capabilities:
Delete file
Set environment variable
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x41229c
push ebx
push esi
push edi
mov eax, 0x411684
call fcn.00405a14
xor eax, eax
push ebp
push 0x4124d3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x413a88]
xor edx, edx
mov dword [eax], edx
lea eax, [ebp - 0x14]
call fcn.00410e04
mov edx, dword [ebp - 0x14]
mov eax, 0x418b28
call fcn.004042f4
lea edx, [ebp - 0x18]
mov eax, dword [0x418b28]
call fcn.00410d18
mov edx, dword [ebp - 0x18]
mov eax, 0x418b28
call fcn.004042f4
mov bl, 1
xor eax, eax
push ebp
push 0x41239e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x40f5a4]
call fcn.004036d4
mov esi, eax
mov edx, esi
mov eax, 0x4124ec
call fcn.00411570
mov edx, 0x418a98
mov ecx, 0x90
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, esi
call fcn.0041066c
mov edx, esi
mov eax, 0x4124fc
call fcn.00411570
lea eax, [ebp - 0x20]
mov edx, 0x418a98
call fcn.00404504
mov edx, dword [ebp - 0x20]
lea ecx, [ebp - 0x1c]
mov eax, dword [0x418b28]
call fcn.004113cc
mov edx, dword [ebp - 0x1c]
mov eax, 0x418b30
call fcn.004042f4
mov edx, dword [0x418b30]
mov eax, esi
call fcn.004105e8
mov eax, esi
call fcn.00403704
push 2
mov eax, dword [0x418b30]
call fcn.004046b4
push eax
call sub.kernel32.dll_SetFileAttributesA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4123aa
test bl, bl
je 0x4124b8
lea eax, [ebp - 0x24]
call fcn.00410f14
mov eax, dword [ebp - 0x24]
call fcn.004046b4
push eax
push 0x412504
call sub.kernel32.dll_SetEnvironmentVariableA
mov eax, 0x418b2c
call fcn.004042a0
mov eax, dword [0x418b28]
test eax, eax
je 0x4123e5
sub eax, 4
mov eax, dword [eax]
mov esi, eax
dec esi
test esi, esi
jl 0x41242a
inc esi
xor edi, edi
mov eax, dword [0x418b28]
movzx ebx, byte [eax + edi - 1]
cmp bl, 0x26
je 0x412417
lea eax, [ebp - 0x28]
mov edx, ebx
call main
mov edx, dword [ebp - 0x28]
mov eax, 0x418b2c
call fcn.00404548
jmp 0x412426
mov eax, 0x418b2c
mov edx, 0x412514
call fcn.00404548
inc edi
dec esi
jne 0x4123ef
mov eax, 0x418b28
mov edx, dword [0x418b2c]
call fcn.004042f4
cmp dword [0x418aa0], 0x8000
jne 0x412459
push 0x30
push 0x412518
push 0x412528
push 0
call sub.user32.dll_MessageBoxA_1
mov eax, 0x418b2c
mov edx, dword [0x413bb0]
mov edx, dword [edx]
call fcn.00404498
push 0x4125e0
push dword [0x418b30]
push 0x4125f8
push dword [0x418b2c]
push 0x412604
mov eax, 0x418b34
mov edx, 5
call fcn.00404610
mov eax, dword [0x418b34]
call fcn.00411490
mov ebx, eax
mov eax, dword [0x418b30]
call fcn.004046b4
push eax
call sub.kernel32.dll_DeleteFileA
mov eax, dword [0x413a88]
mov dword [eax], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4124da
lea eax, [ebp - 0x28]
mov edx, 6
call fcn.004042c4
ret
Function at 0x561141
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0x56124a
mov dword [esi], eax
pop esi
call fcn.00561108
mov byte [esp + 1], bh
push edx
pop word [esp + 1]
jmp 0x56116a
lea esp, [esp + 0x14]
cmp dword [ebp - 4], ebx
call 0x561141
lea esp, [esp + 2]
lea esp, [esp + 4]
jl 0x533245
jge 0x5611dc
btr dword [ebx], esp
inc esi
mov ch, 0x34
and dword ss:[eax - 0x5d], esp
fidiv dword [reloc.MSVFW32.dll_DrawDibDraw]
sub edx, 0x10
clc
sub esp, 0x18
pop dword [esp + 0xc]
jmp 0x56115e
mov eax, dword [ebp - 8]
jmp 0x533212
push esi
mov esi, ecx
lea esi, [esi + 4]
jmp 0x561139

Function at 0x5611b6
Capabilities:
Encrypt data using aes

Disassembly:
jle 0x5332ab
setns bh
neg edi
xchg bl, bh
mov cx, sp
jmp 0x561197
bsf dx, si
xchg bx, di
jmp 0x561206
jmp 0x5618a3
lea ecx, [eax - 1]
push esp
mov dword [ebp - 4], ecx
lea ecx, [ebx + ebx]
jmp 0x5611c6
pop word [esp]
lea esp, [esp + 2]
cmp eax, 1
jmp 0x533217
mov cl, 0x32
not ebx
jmp 0x561233
mov edi, 0x56df8dc8
inc dx
mov di, word [esp]
lea esp, [esp + 4]
add esi, 0x10
jmp 0x561219
movzx ebx, byte [esi + 0x11]
push edx
mov ebx, dword [ebx*4 + reloc.MSVFW32.dll_DrawDibDraw]
mov edi, 0x5d0d3fc4
jmp 0x5611e4
sub esp, 8
mov byte [esp + 2], dh
call fcn.00561270
in eax, dx
push 0xad6899fe
or eax, 0x8f7c1585
dec esi
mov ah, 0xa7
lea esp, [esp + 4]
mov ecx, 0xff
jmp 0x533290
pop edi
xchg bl, bh
pop esi
mov bx, 0x74f5
jmp 0x5618ed
pop ebx
call 0x5618d3
lea esp, [esp + 8]

Function at 0x561378
Capabilities:
Encrypt data using aes

Disassembly:
and ebx, ecx
lea esp, [esp + 0x40]
xor edi, dword [ebx*4 + reloc.MSVFW32.dll_DrawDibDraw]
stc
jmp 0x561318
mov edi, dword [edi*4 + reloc.MSVFW32.dll_DrawDibDraw]
sub esp, 4
sub esp, 8
mov word [esp], di
stc
jmp 0x56129d
mov word [esp], di
jmp 0x5612b6
push edx
mov dword [esp], esi
sub esp, 0
and edi, ecx
push edx
jmp 0x5612ce
mov dword [esp], eax
and ebx, ecx
call 0x5612fd
out dx, al
sub esp, 0
sub esp, 0xc
push dword [esp + 6]
jmp 0x56138e
shr ebx, 9
movzx ebx, byte [esi + 2]
mov ebx, dword [ebx*4 + reloc.MSVFW32.dll_DrawDibDraw]
push esp
jmp 0x5612f2
push edi
mov edi, edx
lea edi, [edi*4]
jmp 0x561367
sub esp, 4
lea esp, [esp + 3]
lea esp, [esp + 1]
jmp 0x561329
movzx ebx, byte [esi + 5]
push esp
and edx, ecx
clc
jmp 0x561346
lea edi, reloc.MSVFW32.dll_DrawDibDraw
mov edx, dword [edi]
pop edi
and edx, ecx
call 0x561378
and ch, cl
movsb byte es:[edi], byte [esi]
add byte [eax], al
add byte [ecx - 0x23], cl
dec ebp
adc al, 0xe7
push eax
mov ecx, 0x36dbbc2e
cmp dword [edi + reloc.MSVFW32.dll_DrawDibDraw], 0xffffff8d
and al, 0x18
lea esp, [esp + 0x18]
xor edi, dword [ebx*4 + reloc.MSVFW32.dll_DrawDibDraw]
mov bl, 0xf2
jmp 0x56135d
push esp
mov edi, dword [edi*4 + reloc.MSVFW32.dll_DrawDibDraw]
jmp 0x5612e6

Function at 0x561524
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
add esp, 1
lea esp, [esp + 3]
jmp 0x561550
Function at 0x5615e1
Capabilities:
Encrypt data using aes

Disassembly:
mov ebx, dword [ebx*4 + reloc.MSVFW32.dll_DrawDibDraw]
jmp 0x561591
mov edx, dword [esi + 8]
stc
call fcn.00561524
mov dword [esi + 4], edi
mov di, word [esp]
inc edi
jmp 0x56152d
push edx
and edx, ecx
lea esp, [esp + 0xc]
xor edi, dword [edx*4 + reloc.MSVFW32.dll_DrawDibDraw]
jmp 0x561547
push edx
mov dword [esp], esi
jmp 0x5615bf
mov edi, edx
shr edi, 0x18
mov edi, dword [edi*4 + reloc.MSVFW32.dll_DrawDibDraw]
jmp 0x561579
and ebx, ecx
lea esp, [esp + 4]
xor edi, dword [ebx*4 + reloc.MSVFW32.dll_DrawDibDraw]
call fcn.005615cb
arpl ax, si
add ax, si
xor edi, dword [edi - 0x13]
jge 0x5615bf
div dword [esi]
jl 0x56160e
and edi, ecx
mov edi, dword [edi*4 + reloc.MSVFW32.dll_DrawDibDraw]
stc
jmp 0x56159f
mov edx, dword [edx*4 + reloc.MSVFW32.dll_DrawDibDraw]
jmp 0x561569
popfd
push esp
fist dword [ebx]
rol ebx, 0x19
jmp 0x56165b
movzx ebx, byte [esi + 0xd]
push edx
and edx, ecx
sub esp, 0x18
jmp 0x561745
clc
mov edx, dword [esi + 0xc]
call fcn.005616a4
shr edi, 0x18
call fcn.005616d8
mov word [esp], di
mov dword [esp], eax
lea esp, [esp + 0x24]
xor edi, dword [edx*4 + reloc.MSVFW32.dll_DrawDibDraw]
btc edx, ebx
jmp 0x5616ef
mov edx, dword [edx*4 + reloc.MSVFW32.dll_DrawDibDraw]
push edx
and edx, ecx
push esp
jmp 0x56171e

Function at 0x561635
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 0x10]
xor edi, dword [ebx*4 + reloc.MSVFW32.dll_DrawDibDraw]
and ebx, ecx
sub esp, 8
jmp 0x561608
stc
mov ebx, dword [ebx*4 + reloc.MSVFW32.dll_DrawDibDraw]
jmp 0x56161e

Function at 0x5616a4
Capabilities:
Encrypt data using aes

Disassembly:
mov di, 0xef25
shr edi, 1
sub esp, 8
push dword [esp + 2]
mov ebx, dword [ebx*4 + reloc.MSVFW32.dll_DrawDibDraw]
jmp 0x5616c5
mov dword [esp], eax
mov dword [esi + 8], edi
jmp 0x56167f
lea esp, [esp + 7]
lea esp, [esp + 4]
popal
sub esp, 0x10
mov word [esp + 4], di
call fcn.005616d5
cmc
in al, 0x17
bsf di, si
pushal
mov dword [esp], edx
sub esp, 0x14
add esp, 9
jmp 0x5616ac
Function at 0x561700
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push edx
push word [esp + 0xb]
lea esp, [esp + 2]
jmp 0x56176a
push esi
pushal
mov ecx, ebp
bswap ecx
jmp 0x561777
mov edi, dword [edi*4 + reloc.MSVFW32.dll_DrawDibDraw]
and edi, ecx
push esp
push edx
jmp 0x561752
mov dword [esp + 4], edi
sub esp, 0x10
push esp
lea esp, [esp + 0x14]
popal
jmp 0x561b35
movzx ebx, byte [esi + 0xe]
sub esp, 0x10
mov byte [esp + 2], dh
mov byte [esp + 0xe], bh
jmp 0x5619a4
xor edi, dword [ebx*4 + reloc.MSVFW32.dll_DrawDibDraw]
lea ebx, [edx + ebx]
jmp 0x56179d
add esp, 5
pop word [esp + 2]
push esp
lea esp, [esp + 1]
lea esp, [esp + 0x44]
jmp 0x5617b4
push esp
mov dword [esp], esi
and ebx, ecx
call fcn.0056180b
dec dword [ebp - 4]
call fcn.00561878
cmp dh, byte [edx + ebp + 0x2c0fbc4d]
mov eax, dword [reloc.MSVFW32.dll_DrawDibDraw]
pushal
mov dword [reloc.MSVFW32.dll_DrawDibDraw], eax
lea esp, [esp + 0x24]
xor edi, dword [edx*4 + reloc.MSVFW32.dll_DrawDibDraw]
jmp 0x561835
push esp
mov word [esp], di
push dword [esp + 2]
cmc
mov edx, dword [edx*4 + reloc.MSVFW32.dll_DrawDibDraw]
jmp 0x56182a
lea esi, reloc.MSVFW32.dll_DrawDibDraw
mov ebx, dword [esi]
pop esi
clc
and edx, ecx
jmp 0x561890
push esi
mov esi, ebx
lea esi, [esi*4]
jmp 0x561918
mov word [esp], di
cmc
sub esp, 0
and ebx, ecx
sub esp, 0xc
jmp 0x5617cb
lea esi, [esi*4]
lea esi, reloc.MSVFW32.dll_DrawDibDraw
mov edi, dword [esi]
pop esi
push edx
jmp 0x5619ee

Function at 0x56180b
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 0x20]
xor edi, dword [ebx*4 + reloc.MSVFW32.dll_DrawDibDraw]
sub esp, 0x10
jmp 0x561868
cmc
lea esp, [esp + 1]
jmp 0x5617de
push word [esp + 3]
lea esp, [esp + 1]
jmp 0x5617f4
lea esp, [esp + 1]
sub esp, 0x14
and edx, ecx
push edx
push word [esp + 3]
add esp, 5
jmp 0x56184b

Function at 0x561878
Capabilities:
Encrypt data using aes

Disassembly:
push word [esp + 3]
push word [esp + 1]
push esp
jmp 0x5618bf
mov dword [esi + 0xc], edi
push esp
lea esp, [esp + 0x10]
jne 0x533290
je 0x5332ab
push esp
mov byte [esp + 2], dh
jmp 0x5618f3

Function at 0x667612
Capabilities:
Check for peb beingdebugged flag
Parse pe header

Disassembly:
call fcn.0066605f
mov byte [esp + 7], ah
push cx
push dword [esp + 5]
mov byte [esp + 5], bh
push word [esp + 0xe]
jmp 0x66763d
pop dword [esp + 4]
lea esp, [esp + 2]
mov dword [esp + 0x2c], edi
lea esp, [esp + 0x2c]
mov eax, dword fs:[0x30]
jmp 0x667692
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x66605a
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x667675
Function at 0x4018bf
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
shr edi, 2
xor ebx, ebx
mov eax, edi
mov dword [ebp - 4], 1
shr eax, 1
mov ecx, ebx
add eax, 3
mov dword [esi], eax
add esi, 0x10
test edi, edi
je 0x4018f6
mov eax, dword [edx]
lea edx, [edx + 4]
mov dword [esi + ecx*4], eax
inc ecx
cmp ecx, edi
jb 0x4018e9
mov edx, dword [esi + edi*4 - 4]
imul eax, edi, 0xc
add eax, 0x70
add eax, esi
mov dword [ebp + 8], eax
test ebx, ebx
jne 0x401964
movzx eax, dl
mov ebx, dword [ebp - 4]
push 0x1b
movzx ecx, byte [eax + 0x106a5c0]
mov eax, edx
shr eax, 0x18
shl ecx, 8
movzx eax, byte [eax + 0x106a5c0]
or ecx, eax
mov eax, edx
shr eax, 0x10
movzx eax, al
shr edx, 8
shl ecx, 8
movzx eax, byte [eax + 0x106a5c0]
or ecx, eax
movzx eax, dl
shl ecx, 8
movzx edx, byte [eax + 0x106a5c0]
xor edx, ebx
add ebx, ebx
or edx, ecx
test ebx, 0x100
pop eax
cmovne ebx, eax
mov dword [ebp - 4], ebx
mov ebx, edi
jmp 0x4019b1
cmp ebx, 4
jne 0x4019b4
cmp edi, 6
jbe 0x4019b4
mov eax, edx
shr eax, 0x10
movzx eax, al
movzx ecx, byte [eax + 0x106a5c0]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax + 0x106a5c0]
shl eax, 8
or ecx, eax
mov eax, edx
shr eax, 8
movzx eax, al
shl ecx, 8
movzx eax, byte [eax + 0x106a5c0]
or ecx, eax
movzx eax, dl
shl ecx, 8
movzx edx, byte [eax + 0x106a5c0]
or edx, ecx
mov eax, dword [ebp + 8]
xor edx, dword [esi]
dec ebx
mov dword [esi + edi*4], edx
add esi, 4
cmp esi, eax
jne 0x401905
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x402534
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
push edi
xor edi, edi
mov edx, dword [edx]
and edx, 7
cmp eax, 5
jae 0x402552
xor eax, eax
jmp 0x402678
add dword [ebp + 0x10], 5
lea ecx, [eax - 4]
push ebx
mov ebx, dword [ebp + 8]
add ecx, ebx
push esi
mov dword [ebp + 0xc], ecx
lea esi, [edi + ebx]
jmp 0x402571
mov al, byte [esi]
and al, 0xfe
cmp al, 0xe8
je 0x402575
inc esi
cmp esi, ecx
jb 0x402568
mov ecx, esi
sub ecx, edi
mov edi, esi
sub ecx, ebx
sub edi, ebx
cmp esi, dword [ebp + 0xc]
jae 0x402665
cmp ecx, 2
jbe 0x4025ff
xor edx, edx
movzx ecx, byte [esi + 4]
lea eax, [ecx + 1]
test al, 0xfe
jne 0x402659
movzx eax, byte [esi + 3]
mov ebx, dword [ebp + 0x10]
shl ecx, 8
add ebx, edi
or ecx, eax
movzx eax, byte [esi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 1]
shl ecx, 8
or ecx, eax
mov eax, ecx
add ecx, ebx
sub eax, ebx
cmp dword [ebp + 0x18], 0
cmove ecx, eax
mov dword [ebp - 4], ecx
mov ebx, ecx
test edx, edx
je 0x402633
and edx, 6
mov eax, ecx
shl edx, 2
mov ecx, edx
shr eax, cl
inc eax
test al, 0xfe
jne 0x402631
mov eax, dword [ebp + 0x10]
mov ebx, 0x100
shl ebx, cl
add eax, edi
dec ebx
xor ebx, dword [ebp - 4]
cmp dword [ebp + 0x18], 0
je 0x40262f
add ebx, eax
jmp 0x402631
shr edx, cl
test edx, edx
je 0x40258f
cmp edx, 4
ja 0x402621
cmp edx, 3
je 0x402621
mov eax, edx
shr eax, 1
movzx eax, byte [eax + esi + 1]
inc eax
test al, 0xfe
jne 0x40258f
or edx, 8
shr edx, 1
inc edi
mov ecx, dword [ebp + 0xc]
jmp 0x402563
sub ebx, eax
xor edx, edx
mov eax, ebx
mov byte [esi + 1], bl
shr eax, 8
mov byte [esi + 2], al
mov eax, ebx
shr ebx, 0x18
shr eax, 0x10
and bl, 1
neg bl
mov byte [esi + 3], al
push 5
mov byte [esi + 4], bl
mov ebx, dword [ebp + 8]
pop eax
jmp 0x402661
or edx, 8
xor eax, eax
shr edx, 1
inc eax
add edi, eax
jmp 0x402627
xor eax, eax
shr edx, cl
cmp ecx, 2
pop esi
cmova edx, eax
mov eax, dword [ebp + 0x14]
pop ebx
mov dword [eax], edx
mov eax, edi
pop edi
leave
ret 0x14
Function at 0x402b17
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x368
mov eax, dword [0x10b906c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x368]
mov dword [ebp - 0x368], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x402b57
cmp dword [ebp - 0x364], 6
jne 0x402b57
cmp dword [ebp - 0x360], 0
je 0x402b81
push str.SetDefaultDllDirectories
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x402b81
push 0xc00
call eax
test eax, eax
jne 0x402c16
push 0x106
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x402c16
cmp eax, 0x104
ja 0x402c16
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x5c
pop ecx
cmp word [ebp + eax*2 - 0x2d6], cx
je 0x402bc1
mov word [ebp + eax*2 - 0x2d4], cx
inc eax
cmp byte [str.UXTHEME], 0
push esi
mov esi, str.UXTHEME
je 0x402c15
push edi
lea edi, [ebp - 0x2d4]
lea edi, [edi + eax*2]
mov edx, edi
mov cl, byte [esi]
inc esi
movzx eax, cl
mov word [edx], ax
lea edx, [edx + 2]
test cl, cl
jne 0x402bdc
push str..dll
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 8
push 0
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
cmp byte [esi], 0
jne 0x402bda
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00fee415
leave
ret
Function at 0x405f99
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
xor eax, eax
push ebx
push esi
mov esi, dword [ebp + 8]
inc eax
push edi
push 0x20
pop ecx
or dword [esi + 0x90], 0xffffffff
or dword [esi + 0x94], 0xffffffff
mov dword [esi + 0x30], eax
mov dword [esi + 0x44], eax
mov eax, dword [esi + 4]
cmp eax, ecx
mov dword [esi + 0x78], edx
cmova eax, ecx
mov dword [esi + 0x7c], edx
mov dword [esi + 0x54], eax
mov eax, dword [esi]
mov dword [esi + 0x34], edx
mov dword [esi + 0x38], edx
mov dword [esi + 0x3c], edx
mov dword [esi + 0x40], edx
mov dword [esi + 0x70], edx
mov dword [esi + 0x88], edx
mov dword [esi + 0x68], edx
mov dword [esi + 0x6c], edx
mov dword [esi + 0x48], edx
mov dword [esi + 0x4c], edx
mov dword [esi + 0x50], edx
mov dword [esi + 0x60], edx
mov dword [esi + 0x64], edx
mov dword [esi + 0x80], edx
mov dword [esi + 0x84], edx
mov dword [esi + 0x58], edx
cmp eax, dword [esi + 0x20]
je 0x406043
lea edi, [esi + 0xc8]
mov ebx, ecx
cmp dword [edi + 8], edx
je 0x406024
push edi
call fcn.00405f6e
xor edx, edx
add edi, 0x28
sub ebx, 1
jne 0x406017
cmp dword [esi + 0x5c], ebx
je 0x40603e
mov eax, dword [esi + 0x14]
push dword [esi + 0x5c]
push eax
call dword [eax + 4]
and dword [esi + 0x5c], ebx
mov eax, dword [esi]
mov dword [esi + 0x20], eax
push dword [esi + 0x10]
lea eax, [esi + 0x98]
push eax
call fcn.00406472
mov ecx, dword [esi + 0x58]
and dword [esi + 0x24], 0
and dword [esi + 0x28], 0
lea eax, [ecx + 5]
imul ebx, eax, 0x28
lea eax, [ecx + 1]
mov dword [esi + 0x58], eax
add ebx, esi
push ebx
call fcn.00405f30
mov edi, eax
test edi, edi
jne 0x4060bf
lea eax, [ebx + 0x20]
push eax
call fcn.00408cf6
mov edi, eax
test edi, edi
jne 0x4060bf
lea eax, [ebx + 0x1c]
push eax
call fcn.00408cf6
mov edi, eax
test edi, edi
jne 0x4060bf
push ebx
call fcn.00406e70
mov edi, eax
test edi, edi
je 0x4060bf
and dword [esi + 0x44], 0
lea ebx, [esi + 0xc8]
push 0x20
pop esi
push ebx
call fcn.00405eb2
add ebx, 0x28
sub esi, 1
jne 0x4060ae
mov esi, dword [ebp + 8]
movzx eax, di
or eax, 0x80070000
test edi, edi
cmovle eax, edi
test eax, eax
je 0x4060d3
mov dword [esi + 0x40], eax
xor edx, edx
cmp dword [esi + 0x38], edx
jne 0x4060e7
cmp dword [esi + 0x40], edx
jne 0x4060e7
cmp dword [esi + 0x3c], edx
jne 0x4060e7
mov dword [esi + 0x44], edx
xor ecx, ecx
cmp dword [esi + 0x44], edx
pop edi
pop esi
cmovne eax, ecx
pop ebx
pop ebp
ret 4

Function at 0x4087ed
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 8], 0
and dword [eax + 0xc], 0
mov dword [eax + 0x20], 0x6a09e667
mov dword [eax + 0x24], 0xbb67ae85
mov dword [eax + 0x28], 0x3c6ef372
mov dword [eax + 0x2c], 0xa54ff53a
mov dword [eax + 0x30], 0x510e527f
mov dword [eax + 0x34], 0x9b05688c
mov dword [eax + 0x38], 0x1f83d9ab
mov dword [eax + 0x3c], 0x5be0cd19
pop ebp
ret 4