joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411560
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x584209
mov eax, dword fs:[0]
push eax
sub esp, 0x41c
mov eax, dword [0x5ea6c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x424], esi
mov dword [ebp - 0x428], esi
mov dword [ebp - 4], 0
call fcn.0040a770
mov ecx, eax
test ecx, ecx
je 0x41171d
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], 1
mov byte [ebp - 4], 2
call fcn.0040a770
mov ecx, eax
test ecx, ecx
je 0x411727
mov eax, dword [ecx]
call dword [eax + 0xc]
lea ecx, [eax + 0x10]
mov dword [esi + 4], ecx
mov eax, dword [esi]
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov byte [ebp - 4], 3
cmp dword [eax - 0xc], 0
jne 0x411662
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.005536e0
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x597fa0
lea eax, [ebp - 0x420]
push eax
call edi
lea ecx, [ebp - 0x420]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x411641
sub ecx, edx
lea eax, [ebp - 0x420]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.0040d340
mov ecx, dword [esi + 4]
cmp dword [ecx - 0xc], 0
jne 0x4116ff
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.005536e0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.LdsSecurity
lea eax, [ebp - 0x218]
push eax
call edi
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4116c3
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push 0x597fa0
lea eax, [ebp - 0x218]
push eax
call edi
lea edx, [ebp - 0x218]
lea edi, [edx + 2]
nop word [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4116e0
sub edx, edi
lea eax, [ebp - 0x218]
sar edx, 1
lea ecx, [esi + 4]
push edx
push eax
call fcn.0040d340
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512634
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00409c80
push 0x80004005
call fcn.00409c80
int3
Function at 0x412220
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58437b
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x5ea6c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
push 0
push eax
mov dword [ebp - 0x21c], edi
call fcn.005536e0
add esp, 0xc
lea eax, [ebp - 0x218]
push dword [esi]
push 0x104
push eax
push 0x597944
push str.alert_url
push str.test
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
call fcn.0040a770
mov ecx, eax
test ecx, ecx
je 0x41230d
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
test eax, 0xffff0000
jne 0x4122c7
movzx eax, ax
mov ecx, edi
push eax
call fcn.00412860
jmp 0x4122ee
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4122d0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.0040d340
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512634
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00409c80
int3

Function at 0x4123a0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5843b8
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x5ea6c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x54]
push 0x42
push 0
push eax
mov dword [ebp - 0x58], edi
call fcn.005536e0
add esp, 0xc
lea eax, [ebp - 0x54]
push dword [esi + 4]
push 0x21
push eax
push 0
push str.LastLicenseMd5
push 0x598078
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
call fcn.0040a770
mov ecx, eax
test ecx, ecx
je 0x412470
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x54]
mov dword [ebp - 4], 0
test eax, 0xffff0000
jne 0x412430
movzx eax, ax
mov ecx, edi
push eax
call fcn.00412860
jmp 0x412451
lea ecx, [ebp - 0x54]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x412436
sub ecx, edx
lea eax, [ebp - 0x54]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.0040d340
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512634
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00409c80
int3
Function at 0x4124d0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58437b
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x5ea6c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
push 0
push eax
mov dword [ebp - 0x21c], edi
call fcn.005536e0
add esp, 0xc
lea eax, [ebp - 0x218]
push dword [esi]
push 0x104
push eax
push 0x597944
push str.main_url
push str.test
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
call fcn.0040a770
mov ecx, eax
test ecx, ecx
je 0x4125bd
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
test eax, 0xffff0000
jne 0x412577
movzx eax, ax
mov ecx, edi
push eax
call fcn.00412860
jmp 0x41259e
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x412580
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.0040d340
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512634
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00409c80
int3

Function at 0x4125f0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5ea6c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
lea eax, [ebp - 0x20c]
mov esi, ecx
push 0
push eax
call fcn.005536e0
add esp, 0xc
lea eax, [ebp - 0x20c]
push dword [esi + 4]
push 0x104
push eax
push 0x598060
push str.os_t
push str.General
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x20c]
push eax
call fcn.0055c430
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop esi
call fcn.00512634
mov esp, ebp
pop ebp
ret

Function at 0x412660
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5843eb
mov eax, dword fs:[0]
push eax
sub esp, 0x108
mov eax, dword [0x5ea6c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x110]
push 0x100
push 0
push eax
mov dword [ebp - 0x114], edi
call fcn.005536e0
add esp, 0xc
lea eax, [ebp - 0x110]
push dword [esi + 4]
push 0x80
push eax
push 0
push str.SrInfo
push 0x598078
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
call fcn.0040a770
mov ecx, eax
test ecx, ecx
je 0x41274d
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x110]
mov dword [ebp - 4], 0
test eax, 0xffff0000
jne 0x412705
movzx eax, ax
mov ecx, edi
push eax
call fcn.00412860
jmp 0x41272e
lea ecx, [ebp - 0x110]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x412710
sub ecx, edx
lea eax, [ebp - 0x110]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.0040d340
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512634
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00409c80
int3
Function at 0x412760
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5ea6c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x20a
lea eax, [ebp - 0x210]
mov esi, ecx
push 0
push eax
call fcn.005536e0
add esp, 0xc
lea eax, [ebp - 0x210]
push dword [esi + 4]
push 0x104
push eax
push 0x598060
push 0x598048
push str.Page
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
call fcn.0055c430
push 0
mov esi, eax
mov edi, edx
call fcn.0055c5ae
add esp, 8
mov ecx, eax
sub ecx, esi
sbb edx, edi
mov eax, edx
cdq
xor eax, edx
xor ecx, edx
sub ecx, edx
push 0
push 0x15180
sbb eax, edx
push eax
push ecx
call fcn.00512670
mov ecx, eax
mov eax, edx
cdq
xor eax, edx
xor ecx, edx
sub ecx, edx
pop edi
sbb eax, edx
mov edx, eax
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00512634
mov esp, ebp
pop ebp
ret

Function at 0x414d20
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4010
call fcn.00512720
mov eax, dword [0x5ea6c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x4004]
push edi
mov edi, dword [ebp + 0xc]
push 0x4000
push 0
push eax
call fcn.005536e0
add esp, 0xc
mov dword [ebp - 0x4008], 0
test esi, esi
je 0x414e16
test edi, edi
je 0x414e16
lea eax, [ebp - 0x4008]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x414e16
cmp eax, 0x3fff
ja 0x414e16
lea ecx, [ebp - 0x4004]
push ecx
push eax
push 0
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x414e16
lea eax, [ebp - 0x4010]
push eax
lea eax, [ebp - 0x400c]
push eax
push 0x597940
lea eax, [ebp - 0x4004]
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x414e16
mov esi, dword [ebp + 0x10]
lea eax, [esi + esi]
push eax
push 0
push edi
call fcn.005536e0
mov ecx, dword [ebp - 0x400c]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push str._d._d._d._d
lea eax, [esi - 1]
push eax
push edi
call fcn.00413050
add esp, 0x28
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00512634
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.00512634
mov esp, ebp
pop ebp
ret
Function at 0x414fa0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x415011
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x415011
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x415011
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x415011
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push 0x40
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x41500b
push esi
push ebx
push edi
call fcn.00552be0
add esp, 0xc
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x41500b
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x416050
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf0
push ebx
push esi
push edi
mov dword [ebp - 0xf0], 0x740068
mov dword [ebp - 0xec], 0x700074
mov dword [ebp - 0xe8], 0x2f003a
mov dword [ebp - 0xe4], 0x61002f
mov dword [ebp - 0xe0], 0x690070
mov dword [ebp - 0xdc], 0x6c002e
mov dword [ebp - 0xd8], 0x640075
mov dword [ebp - 0xd4], 0x730061
mov dword [ebp - 0xd0], 0x690068
mov dword [ebp - 0xcc], 0x63002e
mov dword [ebp - 0xc8], 0x6d006f
mov dword [ebp - 0xc4], 0x67002f
mov dword [ebp - 0xc0], 0x2f006d
mov dword [ebp - 0xbc], 0x6e0061
mov dword [ebp - 0xb8], 0x690074
mov dword [ebp - 0xb4], 0x690076
mov dword [ebp - 0xb0], 0x750072
mov dword [ebp - 0xac], 0x3f0073
mov dword [ebp - 0xa8], 0x690070
mov dword [ebp - 0xa4], 0x3d0064
mov dword [ebp - 0xa0], 0x70007b
mov dword [ebp - 0x9c], 0x640069
mov dword [ebp - 0x98], 0x26007d
mov dword [ebp - 0x94], 0x700061
mov dword [ebp - 0x90], 0x3d0070
mov dword [ebp - 0x8c], 0x61007b
mov dword [ebp - 0x88], 0x700070
mov dword [ebp - 0x84], 0x26007d
mov dword [ebp - 0x80], 0x69006d
mov dword [ebp - 0x7c], 0x3d0064
mov dword [ebp - 0x78], 0x6d007b
mov dword [ebp - 0x74], 0x640069
mov dword [ebp - 0x70], 0x26007d
mov dword [ebp - 0x6c], 0x69006d
mov dword [ebp - 0x68], 0x320064
mov dword [ebp - 0x64], 0x7b003d
mov dword [ebp - 0x60], 0x69006d
mov dword [ebp - 0x5c], 0x320064
mov dword [ebp - 0x58], 0x26007d
mov dword [ebp - 0x54], 0x6f006d
mov dword [ebp - 0x50], 0x760064
mov dword [ebp - 0x4c], 0x720065
mov dword [ebp - 0x48], 0x7b003d
mov dword [ebp - 0x44], 0x6f006d
mov dword [ebp - 0x40], 0x760064
mov dword [ebp - 0x3c], 0x720065
mov dword [ebp - 0x38], 0x26007d
mov dword [ebp - 0x34], 0x700061
mov dword [ebp - 0x30], 0x760070
mov dword [ebp - 0x2c], 0x720065
mov dword [ebp - 0x28], 0x7b003d
mov dword [ebp - 0x24], 0x700061
mov dword [ebp - 0x20], 0x760070
mov dword [ebp - 0x1c], 0x720065
mov dword [ebp - 0x18], 0x26007d
mov dword [ebp - 0x14], 0x5f0070
mov dword [ebp - 0x10], 0x3d0061
mov dword [ebp - 0xc], 0x70007b
mov dword [ebp - 8], 0x61005f
mov dword [ebp - 4], 0x7d
call fcn.0040a770
mov ecx, eax
test ecx, ecx
je 0x4162bb
mov eax, dword [ecx]
push 2
push 0x77
call dword [eax]
test eax, eax
je 0x4162c5
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x77
jl 0x4162b1
mov dword [eax - 0xc], 0x77
xor eax, eax
mov ecx, dword [esi]
push 0xee
mov word [ecx + 0xee], ax
lea eax, [ebp - 0xf0]
push eax
push 0xee
push dword [esi]
call fcn.00410270
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.00409c80
push 0x80004005
call fcn.00409c80
call fcn.0040d420
int3
Function at 0x418b80
Capabilities:
Check if file exists
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5ea6c0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
cmp dword [edi + 0x1c], 0
je 0x418bb2
mov eax, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00512634
mov esp, ebp
pop ebp
ret 4
push ebx
push esi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.005536e0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0x400000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x20c]
push eax
call ebx
mov esi, dword [ebp + 8]
test esi, esi
je 0x418c05
lea eax, [ebp - 0x20c]
push eax
call ebx
sub esi, 1
jne 0x418bf7
push 0x598620
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x418cc2
mov dword [edi + 0x1c], 1
cmp dword [edi], 0
jne 0x418c98
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi], eax
test eax, eax
je 0x418cc2
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.HttpInit
push eax
call esi
push str.HttpUninit
push dword [edi]
mov dword [edi + 4], eax
call esi
push str.zlib_uncompress
push dword [edi]
mov dword [edi + 8], eax
call esi
push str.zlib_compress
push dword [edi]
mov dword [edi + 0x10], eax
call esi
push str.zlib_compressBound
push dword [edi]
mov dword [edi + 0x14], eax
call esi
mov dword [edi + 0x18], eax
mov eax, dword [edi + 4]
test eax, eax
je 0x418c98
call eax
mov dword [edi + 0xc], eax
cmp dword [edi + 8], 0
je 0x418cc2
cmp dword [edi + 4], 0
je 0x418cc2
cmp dword [edi + 0xc], 0
je 0x418cc2
pop esi
pop ebx
mov eax, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00512634
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
pop ebx
xor ecx, ebp
pop edi
call fcn.00512634
mov esp, ebp
pop ebp
ret 4
Function at 0x41a950
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x44], 0x390038
push edi
mov dword [ebp - 0x40], 0x390046
mov dword [ebp - 0x3c], 0x410031
mov dword [ebp - 0x38], 0x380039
mov dword [ebp - 0x34], 0x300042
mov dword [ebp - 0x30], 0x460044
mov dword [ebp - 0x2c], 0x410034
mov dword [ebp - 0x28], 0x430031
mov dword [ebp - 0x24], 0x450038
mov dword [ebp - 0x20], 0x460035
mov dword [ebp - 0x1c], 0x300041
mov dword [ebp - 0x18], 0x320032
mov dword [ebp - 0x14], 0x300032
mov dword [ebp - 0x10], 0x450031
mov dword [ebp - 0xc], 0x430033
mov dword [ebp - 8], 0x410043
mov word [ebp - 4], ax
call fcn.0040a770
mov ecx, eax
test ecx, ecx
je 0x41aa2a
mov eax, dword [ecx]
push 2
push 0x20
call dword [eax]
test eax, eax
je 0x41aa34
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x20
jl 0x41aa20
mov dword [eax - 0xc], 0x20
xor eax, eax
mov ecx, dword [esi]
push 0x40
mov word [ecx + 0x40], ax
lea eax, [ebp - 0x44]
push eax
push 0x40
push dword [esi]
call fcn.00410270
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.00409c80
push 0x80004005
call fcn.00409c80
call fcn.0040d420
int3

Function at 0x41aa40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], 0x300036
mov dword [ebp - 0x20], 0x310032
mov dword [ebp - 0x1c], 0x40002d
mov dword [ebp - 0x18], 0x300023
mov dword [ebp - 0x14], 0x61002e
mov dword [ebp - 0x10], 0x2d0073
mov dword [ebp - 0xc], 0x580044
mov dword [ebp - 8], 0x530046
mov dword [ebp - 4], 0x58
call fcn.0040a770
mov ecx, eax
test ecx, ecx
je 0x41aadf
mov eax, dword [ecx]
push 2
push 0x11
call dword [eax]
test eax, eax
je 0x41aae9
push esi
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x11
jl 0x41aad5
mov dword [eax - 0xc], 0x11
xor eax, eax
mov ecx, dword [esi]
push 0x22
mov word [ecx + 0x22], ax
lea eax, [ebp - 0x24]
push eax
push 0x22
push dword [esi]
call fcn.00410270
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.00409c80
push 0x80004005
call fcn.00409c80
call fcn.0040d420
int3
Function at 0x41e5f0
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x5d49a0
push 0x553980
mov eax, dword fs:[0]
push eax
sub esp, 0x850
mov eax, dword [0x5ea6c0]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 8]
mov dword [ebp - 0x824], esi
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x820], eax
mov ebx, dword [ebp + 0x20]
mov dword [ebp - 4], 0
test edi, edi
je 0x41e813
cmp word [edi], 0
je 0x41e813
mov ecx, edi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41e660
sub ecx, edx
sar ecx, 1
cmp ecx, 0x104
jbe 0x41e68b
test esi, esi
je 0x41e813
push 0
push str.path_too_long
jmp 0x41e80c
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41e6a9
test esi, esi
je 0x41e813
push eax
push str.path_not_exist
jmp 0x41e80c
push 0x800
push 0
lea eax, [ebp - 0x81c]
push eax
call fcn.005536e0
push edi
push str.__s_
push 0x3ff
lea eax, [ebp - 0x81c]
push eax
call fcn.00413050
push 0x3c
push 0
lea eax, [ebp - 0x860]
push eax
call fcn.005536e0
add esp, 0x28
mov dword [ebp - 0x860], 0x3c
lea eax, [ebp - 0x81c]
mov dword [ebp - 0x850], eax
mov dword [ebp - 0x854], 0x598020
mov eax, dword [ebp - 0x820]
mov dword [ebp - 0x84c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x844], eax
mov dword [ebp - 0x85c], 0x440
test esi, esi
je 0x41e737
push 0
push str.run_sh_begin
mov ecx, esi
call fcn.0041e5c0
lea eax, [ebp - 0x860]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov edi, eax
test edi, edi
je 0x41e757
test esi, esi
je 0x41e76e
push 0
push str.run_sh_suc
jmp 0x41e767
test esi, esi
je 0x41e76e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.run_sh_fail
mov ecx, esi
call fcn.0041e5c0
test edi, edi
je 0x41e7ab
cmp dword [ebp + 0x1c], 0
je 0x41e7ab
test esi, esi
je 0x41e78a
push 0
push str.run_sh_wait
mov ecx, esi
call fcn.0041e5c0
push dword [ebp + 0x24]
push dword [ebp - 0x828]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test esi, esi
je 0x41e7ab
push 0
push str.run_sh_wait_end
mov ecx, esi
call fcn.0041e5c0
test ebx, ebx
je 0x41e7c0
test edi, edi
je 0x41e7d0
push ebx
push dword [ebp - 0x828]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test edi, edi
je 0x41e7d0
push dword [ebp - 0x828]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x41e7e2
push 0
push str.run_sh_end
mov ecx, esi
call fcn.0041e5c0
mov dword [ebp - 4], 0xfffffffe
mov eax, edi
jmp 0x41e81c
mov ecx, esi
call fcn.0041e5c0
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00512634
mov esp, ebp
pop ebp
ret 0x20
Function at 0x41ef20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58583b
mov eax, dword fs:[0]
push eax
sub esp, 0x81c
mov eax, dword [0x5ea6c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov dword [ebp - 0x828], edi
cmp word [0x5f40a0], 0
jne 0x41f05a
push 0x20219
push str.SOFTWARELdsSecurity
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x824]
mov dword [ebp - 0x824], 0
mov dword [ebp - 0x820], 0
mov dword [ebp - 0x81c], 0
call fcn.0041f8c0
mov ebx, dword [ebp - 0x824]
test eax, eax
jne 0x41f04f
lea eax, [ebp - 0x814]
mov dword [ebp - 0x814], 0x800
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x818]
push eax
push 0
push str.FROM
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41f04f
mov eax, dword [ebp - 0x818]
cmp eax, 1
je 0x41efec
cmp eax, 2
jne 0x41f04f
mov eax, dword [ebp - 0x814]
test eax, eax
je 0x41f009
test al, 1
jne 0x41f04f
shr eax, 1
cmp word [ebp + eax*2 - 0x812], 0
je 0x41f012
jmp 0x41f04f
xor eax, eax
mov word [ebp - 0x810], ax
mov ecx, 0x5f40a0
lea esi, [ebp - 0x810]
mov edx, 0x3ff
sub esi, ecx
lea eax, [edx + 0x7ffffbff]
test eax, eax
je 0x41f042
movzx eax, word [esi + ecx]
test ax, ax
je 0x41f042
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x41f024
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
test ebx, ebx
je 0x41f05a
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0040a770
mov ecx, eax
test ecx, ecx
je 0x41f0ca
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
push 0x5f40a0
mov ecx, edi
mov dword [ebp - 4], 0
call fcn.0040a080
test al, al
jne 0x41f0ac
mov ecx, 0x5f40a0
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41f090
sub ecx, edx
sar ecx, 1
push ecx
push 0x5f40a0
mov ecx, edi
call fcn.0040d340
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512634
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00409c80
int3