joyce8/EMBER2024-capa huggingface dataset:
Function at 0x606905
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 4], ecx
jmp 0x6064f7
mov dword [esp + 4], ecx
call fcn.00606418
lea esp, [esp + 2]
mov dword [esp + 0x4c], esi
call fcn.00606573
add ebx, 0x3d4beeb5
jmp 0x607a48
add ebx, 0xa5a85c23
jmp 0x607a98
push esp
mov dword [esp], ecx
mov byte [esp + 1], bl
push dword [esp + 1]
jns 0x6064f3
js 0x60642e
push ecx
mov byte [esp + 1], ch
mov byte [esp], ah
mov word [esp + 1], dx
mov dword [esp], eax
jmp 0x60664c
neg edx
jo 0x607fd8
clc
mov dx, 0x32bd
pushfd
jmp 0x607a88
adc al, 0x24
call fcn.00607ab1
jo 0x607a69
add ax, si
inc ebp
outsb dx, byte [esi]
in eax, dx
jge 0x607a85
div dword [eax]
jl 0x607ad4
salc
inc ecx
ret
mov ebx, dword [ebx - reloc.WINMM.dll_midiStreamOut]
clc
jne 0x607a72
je 0x607a72
jmp 0x606563
not dl
lea edx, reloc.WINMM.dll_midiStreamOut
jmp 0x607ac2
mov esp, edi
mov dl, 0xb9
mov dx, si
mov dx, 0x5675
pushal
jmp 0x607d9b
mov ebp, 0x7bc7342d
or ecx, dword [esi + reloc.WINMM.dll_midiStreamOut]
lahf
out 0x11, al
nop
adc ecx, dword [edx - reloc.WINMM.dll_midiStreamOut]
xor bl, byte [ebx + ebp*8 + 0x2d20eb9b]
movsd dword es:[edi], dword [esi]
xor eax, 0x5d1aaf5c
salc
inc esp
and ebx, esi
outsd dx, dword [esi]
int 0x4b
fstp xword [esi + 0x796efb4d]
clc
mov dx, 0x32bd
pushfd
jmp 0x607a88
push ebx
ret
jmp 0x607ae5

Function at 0x6087c8
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg cl
rdtsc
and bp, si
lea edx, [edi - 0x3b]
lea ebx, [ebx - 0x1e]
xchg ecx, eax
jmp 0x6087eb
mov esi, ebp
mov bl, 0x12
rdtsc
xchg ecx, eax
xchg dword [esp], ebx
jmp 0x6087ac
sub esp, 0x13
add esp, 8
mov ch, 0x6a
add esp, 6
lea esp, [esp + 1]
xchg dword [esp + 4], ebx
call fcn.006087d5

Function at 0x60a61d
Capabilities:
Check for software breakpoints

Disassembly:
push 0xf05f7e08
jmp 0x60a691
call fcn.0060a607
push word [esp + 3]
mov dword [esp + 0x24], esi
push bx
lea esp, [esp]
mov byte [esp], ch
mov word [esp], sp
jmp 0x60a6a7
rcl dl, cl
jmp 0x60a6b9
lea esp, [esp + 2]
mov dword [esp + 0x20], edi
lea esp, [esp + 0x20]
pushfd
jmp 0x60a42e
jb 0x60a6cf
mov eax, edi
jmp 0x60a6d1
mov eax, edi
mov ebp, dword [esp + 0x2c]
mov ecx, dword [esp]
jmp 0x60a6de
lea esi, [ebx*4]
lea esi, [esp]
cpuid
neg ax
js 0x60a7b7
mov ebx, 0x775ce146
cpuid
jmp 0x60a74c

Function at 0x60a640
Capabilities:
Check for software breakpoints

Disassembly:
mov dword [esp], eax
push word [esp + 2]
jbe 0x60a622
ja 0x60a654
mov byte [edi - 0x29], 0xb2
inc ecx
sti
jp 0x60a6a9
push word [esp + 3]
mov dword [esp + 0x24], esi
push bx
jmp 0x60a665
lea esp, [esp]
mov byte [esp], ch
jmp 0x60a633
and al, 2

Function at 0x60a680
Capabilities:
Check for software breakpoints

Disassembly:
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ecx
jmp 0x60a599
mov word [esp + 0x1c], cx
pop dword [esp + 0x15]
lea esp, [esp + 2]
jmp 0x60a538
mov word [esp + 0x1c], cx
push word [esp + 7]
js 0x60a584
jns 0x60a54e
Function at 0x60a702
Capabilities:
Check for software breakpoints

Disassembly:
pushal
call fcn.0060a680
mov eax, ebp
lea ecx, [eax + ecx]
mov dx, 0xa35d
push ecx
add esp, 3
jmp 0x60a783
mov edi, esp
lea ebx, [eax + ecx]
bswap edx
mov bx, si
xchg ah, dh
jmp 0x60a708
lea esp, [esp + 1]
mov cx, word [esp]
sub esp, 0x17
mov dword [esp + 8], eax
xchg bx, cx
jmp 0x60a754
mov ebx, 0x775ce146
cpuid
sub esp, 0xc0
jmp 0x60a71e
xchg dword [esp + 0xf], edx
lea esp, [esp + 0x10]
mov dword [esp], esp
lea esp, [esp + 5]
jmp 0x60a78f
sub esp, 0x17
mov dword [esp + 8], eax
xchg bx, cx
jmp 0x60a754
jp 0x60a72c
lea esp, [esp + 1]
mov cx, word [esp]
jmp 0x60a76a
mov cl, bh
lea esp, [esp + 2]
sub ebp, 0x55fc2c20
bswap ebx
push edi
jmp 0x60a8be
mov ds, word cs:[ecx]
jmp 0x60a745
lea edx, [esi + ebp]
xchg dh, ch
lea ebx, [edi + ebp]
xchg dx, cx
jmp 0x60a7d5
ror ebp, 0
pushal
jmp 0x60a7b9
lea esp, [esp + 0x20]
neg ebp
adc bl, 0x90
js 0x60a87d
jns 0x60a837
test al, 0x3e
lodsb al, byte [esi]
retf
mov bl, dl
stc
jne 0x60a7cf
je 0x60a7cf
mov word [esp], bp
jmp 0x60a817
bts ecx, edx
mov cx, 0x69b1
jmp 0x60a88f
lea esp, [esp + 4]
not ebp
btr bx, si
jle 0x60a85a
jg 0x60a844
pop ds
mov bl, byte [eax]
jg 0x60a7b4
cmp dword [ebx + reloc.WINMM.dll_midiStreamOut], esi
mov dl, al
jge 0x60a880
fbld tbyte [esi]
push ecx
lea edx, reloc.WINMM.dll_midiStreamOut
sbb bl, bh
xor bx, ax
jmp 0x60a80e
mov cx, word [esp]
mov dx, 0x5911
mov ecx, 0xf91c48ba
jmp 0x60a867
mov cx, word [esp]
mov dx, 0x5911
mov ecx, 0xf91c48ba
jmp 0x60a894
lea edx, reloc.WINMM.dll_midiStreamOut
sbb bl, bh
xor bx, ax
bts ecx, edx
mov cx, 0x69b1
and al, 6
fistp dword [edx]
fbld tbyte [esi + 0x33]
fmul dword [edi]
stosd dword es:[edi], eax
shl dword [esi - 0x47], 1
mov cl, 0x69
call 0x60a7f8
add ebp, dword [esi]
and ecx, edx
jmp 0x60a8ea
lea edx, reloc.WINMM.dll_midiStreamOut
lea ecx, [ebp*4]
xchg ebx, ecx
jmp fcn.0060ad6e
pop bx
mov dh, al
lea esp, [esp]
lea esp, [esp + 2]
add ebp, 0x2e3823b4
jmp 0x60a7f1
xchg ebx, ecx
jmp fcn.0060ad6e
jge 0x60a89e
lea edx, reloc.WINMM.dll_midiStreamOut
lea ecx, [ebp*4]
jmp 0x60a8d4

Function at 0x62e5fa
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x62e618
bsf edx, edx
jns 0x62e666
js 0x62e666
mov cl, 0x51
setle cl
jmp 0x62e62a
mov edx, dword [esp + 2]
jmp 0x62e650
mov dx, di
cmp esi, ebx
ja 0x62e66e
mov cl, byte [esp]
setae dh
jmp 0x62e76e
lea ebx, [edi + 0x50]
call 0x62e61f
mov cl, byte [esp]
jmp 0x62e76b
mov ecx, edi
mov ebx, 0x82079b93
bsr dx, bx
jmp 0x62e6b0
jl 0x62e6bb
test byte [eax + 0x7f], 0x46
int1
mov dx, word [esp]
lea ebx, [ecx + esi]
mov dh, ch
jmp 0x62e68f
jb 0x62e6c6
mov bl, cl
adc edx, ecx
call fcn.0062e6e1
bnd jb 0x62e69e
xchg dword [edx - 0x39], esi
ljmp 0x11d9
mov bl, cl
adc edx, ecx
jmp 0x62e70d
jmp 0x62e6a5
lea ebx, [edi + 0x40]
mov dx, ax
call fcn.0062e7c1
salc
push ebp
lds ebp, [edi + ebx*2 - 0x2108bb68]
sub dword [eax - 0x78], ecx
mov byte [esp], ch
push dword [esp]
xchg dword [esp + 0xc], edx
jmp 0x62e741
sub esp, 0xb
setbe dh
lea esp, [esp + 3]
push dword [esp + 0x14]
ret 0x18
setae dh
ja fcn.0060c024
dec edx
jp 0x62e6df
mov dx, word [esp]
lea ebx, [ecx + esi]
mov dh, ch
jmp 0x62e68f
Function at 0x62e61f
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x62e618
bsf edx, edx
jns 0x62e666
js 0x62e666
mov cl, 0x51
setle cl
jmp 0x62e62a
mov edx, dword [esp + 2]
jmp 0x62e650
mov dx, di
cmp esi, ebx
ja 0x62e66e
mov cl, byte [esp]
setae dh
jmp 0x62e76e
lea ebx, [edi + 0x50]
call 0x62e61f
mov cl, byte [esp]
jmp 0x62e76b
mov ecx, edi
mov ebx, 0x82079b93
bsr dx, bx
jmp 0x62e6b0
jl 0x62e6bb
test byte [eax + 0x7f], 0x46
int1
mov dx, word [esp]
lea ebx, [ecx + esi]
mov dh, ch
jmp 0x62e68f
jb 0x62e6c6
mov bl, cl
adc edx, ecx
call fcn.0062e6e1
bnd jb 0x62e69e
xchg dword [edx - 0x39], esi
ljmp 0x11d9
mov bl, cl
adc edx, ecx
jmp 0x62e70d
jmp 0x62e6a5
lea ebx, [edi + 0x40]
mov dx, ax
call fcn.0062e7c1
salc
push ebp
lds ebp, [edi + ebx*2 - 0x2108bb68]
sub dword [eax - 0x78], ecx
mov byte [esp], ch
push dword [esp]
xchg dword [esp + 0xc], edx
jmp 0x62e741
sub esp, 0xb
setbe dh
lea esp, [esp + 3]
push dword [esp + 0x14]
ret 0x18
setae dh
ja fcn.0060c024
dec edx
jp 0x62e6df
mov dx, word [esp]
lea ebx, [ecx + esi]
mov dh, ch
jmp 0x62e68f

Function at 0x68c40f
Capabilities:
Execute anti-debugging instructions

Disassembly:
sete ch
call fcn.0062e5fa
lea ebx, [ebx + ebp]
bsf edx, ebx
xchg bx, dx
setne dh
bswap edx
jmp 0x68c43b
xchg dword [esp], ebp
clc
call fcn.0068c4a1
mov byte [0xe8492e8f], al
pop es
in eax, dx
cmp eax, 0x5df94f1c
add byte [ebx - 6], 0xd5
setbe dl
mov dh, dl
jmp 0x68c4b5
pushal
mov ecx, 0x49709aa7
sub esp, 2
jp 0x68c4d2
mov word [esp], di
jmp 0x68c4d7
jmp 0x68c567
btr ecx, ecx
lea esp, [esp + 2]
mov dword [esp + 0x10], esi
jmp 0x68c51e
xchg ch, bh
jmp 0x62e610
lea edx, [eax + ebx]
jmp 0x68c579
mov word [esp], di
btr ecx, ecx
lea esp, [esp + 2]
mov dword [esp + 0x10], esi
lea edx, [eax + ebx]
mov dx, word [esp]
setge dh
popal
mov word [ebx], cx
lea ebx, [edi*4]
jmp 0x68c508
Function at 0x68c843
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ebx, reloc.WINMM.dll_midiStreamOut
bsr edx, esp
jle 0x68c455
setbe dl
call fcn.0068c40f
not edx
btr dx, dx
jmp 0x68c6a5
not edx
btr dx, dx
lea esp, [esp + 0x20]
neg cx
jmp 0x68c4f1
mov dx, word [esp]
mov bl, cl
xchg dx, bx
stc
jnp 0x68c69f
jp 0x68c626
lea edx, reloc.WINMM.dll_midiStreamOut
sub esp, 5
jno 0x68c7fa
lea esp, [esp + 1]
jmp 0x68c7fc
lea esp, [esp + 1]
jmp 0x68c7fc
jmp 0x68c7e4
sub esi, 2
not dl
lea ecx, [esi*4]
jmp 0x68c8cd
mov cx, bx
btr ebx, edx
jp 0x68c85b
xchg bx, cx
jmp 0x68c845
jmp 0x68c82d
lea ebx, [edi*4]
stc
jmp 0x68c866
xchg bx, cx
lea ebx, [edi*4]
stc
add dl, al
lea ecx, [edi*4]
jmp 0x68c875
mov ebx, 0xa6e70d2d
mov ecx, ebp
push esp
jmp 0x68c8aa
xchg cx, bx
call fcn.0068c843
inc cl
bsr ebx, ecx
jne 0x68c95b
shl bx, 7
jmp 0x68c8f1
mov cl, dl
mov bx, sp
mov bl, dh
mov bx, dx
mov bx, cx
jmp 0x68c894
mov ebx, ebp
movzx edx, byte [ebx]
neg ecx
jnp 0x68c88c
xchg cx, bx
jmp 0x68c88f
setle bl
mov bx, 0xa313
setl bh
call fcn.0068c8db
iretd
setle bl
mov bx, 0xa313
setl bh
jmp 0x68c999
shl bx, 7
jmp 0x68c913
neg cl
sub esp, 0xe
jmp 0x68c9ee
pop ebx
bswap ebx
add bl, 0x54
not bl
pop bx
jmp 0x68ca0b
add bl, 0x54
not bl
pop bx
jmp 0x68ca0b
jno 0x68c9a4
pop ebx
bswap ebx
jmp 0x68c9d2
bsf ebx, ebp
inc bx
mov bh, 0x73
inc ebx
jmp 0x68cb3c
lea esp, [esp + 8]
xor cl, 0x9d
btr ebx, esp
jno 0x68c9f5
jo 0x68cc86
fisub word [ebx - 0xd]
xchg esi, eax
aad 0x26
push ecx
rol byte [edi - 0x7899dbec], 1
xchg dword [esp], edx
xchg word [esp], bx
pop ebx
rol cx, 0
jmp 0x68c7ae
lea ebx, [ebp*4]
push word [esp + 1]
bts ebx, edi
jmp 0x68cac5
push sp
lea ebx, [ebp*4]
push word [esp + 1]
bts ebx, edi
rcl ebx, cl
lea ebx, [edx*4]
setb bh
lea esp, [esp + 2]
lea ebx, [edi*4]
lea esp, [esp + 2]
jmp 0x68caa0
mov bx, 0x1802
lea ebx, reloc.WINMM.dll_midiStreamOut
mov ebx, dword [esp]
bt bx, bx
call fcn.0068cac9
pop es
scasb al, byte es:[edi]
mov ecx, 0xc9c098
ror cl, 0
setno bh
dec ebx
jp 0x68ca86
jnp 0x68cadf
bt bx, bx
jmp 0x68ca97
rcl ebx, cl
jmp 0x68ca6b
mov bx, 0x1802
lea ebx, reloc.WINMM.dll_midiStreamOut
mov ebx, dword [esp]
jmp 0x68caab
rol cl, 0
jns 0x68ca58
push sp
jmp 0x68ca37
inc ebx
jmp 0x68cb3c
bsf ebx, ebp
inc bx
mov bh, 0x73
jmp 0x68cb99
Function at 0x735f82
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg edx, esi
pop si
mov al, ch
pop dword [esp + 8]
stc
mov ah, cl
jmp 0x735e3e
pop esi
push dword [esp + 2]
shr al, 6
xchg edx, esi
inc eax
lea edx, [ecx + ebp]
jmp 0x735e02
std
pop esi
pop ax
pop dx
xchg byte [esp], dl
xchg si, ax
jmp 0x735e4d
mov ax, 0xca62
not si
pop esi
mov eax, ecx
xor al, 0x41
inc edx
jmp 0x735e28
shl eax, cl
add ax, si
bswap esi
cld
shl al, cl
mov byte [esp], al
jmp 0x735ef9
and si, 0xf09a
bt eax, ebx
mov dx, 0xb452
mov si, word [esp + 0xd]
mov ax, 0x90c2
push dword [esp + 0xe]
jmp 0x735e18
xor eax, 0xef77e37d
add esp, 2
mov al, byte [esp]
mov dl, byte [esp]
btr esi, eax
rdtsc
jmp 0x735ed2
xchg byte [esp], ah
mov esi, ebx
push cx
lea eax, [ebp*4]
lea edx, [ebx*4]
bts edx, esi
jmp 0x735e89
mov si, word [esp]
mov eax, dword [esp]
not ax
lea esi, reloc.WINMM.dll_midiStreamOut
jmp 0x735f54
lea eax, [eax + edx]
lea eax, reloc.WINMM.dll_midiStreamOut
xchg si, ax
setle dh
bswap eax
lea esp, [esp]
jmp 0x735ebc
mov dx, 0x7d5d
xchg ah, dl
xchg dx, ax
stc
xor ax, sp
mov esi, 0x91ad9eed
jmp 0x735ea2
dec dx
mov ax, si
neg dl
btr eax, esp
not esi
pushal
jmp 0x735f3a
not ax
lea eax, [ebp + 0xc6]
neg si
mov ax, sp
lea esi, [ecx + esi]
bswap eax
jmp 0x735f0d
bswap esi
lea edx, [eax + ebp]
mov byte [esp + 0x17], cl
lea eax, [esi*4]
mov dl, byte [esp + 0x17]
jmp 0x735f65
mov dh, cl
lea esp, [esp]
lea esp, [esp]
clc
ror eax, 0x10
sub esp, 0
jmp 0x735f24
clc
mov edx, ebp
mov si, bx
pop dx
lea edx, [edx + ebp]
setb al
jmp 0x735fb8
jmp 0x735e6e
xchg byte [esp + 0x14], dl
mov si, cx
shr esi, cl
pop word [esp + 6]
cld
jmp 0x735fdf
pop esi
mov eax, 0x9b330f8f
xchg dword [esp + 4], esi
mov byte [esp + 2], ch
bts ax, bx
setp al
jmp 0x735f87
sub esp, 1
rdtsc
dec dh
push word [esp + 0x1f]
cld
pop dx
jmp 0x735f9d
push dword [esp + 0x19]
sub al, 0x78
neg al
lea eax, reloc.WINMM.dll_midiStreamOut
xchg dx, ax
call fcn.00735fc9
mov eax, dword [esp + 0x19]
pop dword [esp + 5]
call fcn.0073601c
push edi
dec ecx
dec esi
dec ebp
dec ebp
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [edi], cl
bsf eax, esi
pop word [esp + 0xb]
bswap eax
mov word [esp + 0x1f], di
jmp 0x735ff4

Function at 0x736149
Capabilities:
Execute anti-debugging instructions

Disassembly:
not al
neg eax
xchg dh, al
clc
cmc
mov al, byte [esp + 2]
jmp 0x736164
mov dl, 0x70
pop esi
rdtsc
not dh
lea esp, [esp + 6]
xchg word [esp], dx
jmp 0x736113
lea esi, [edx + ebx]
jmp 0x736129
rcl dl, cl
sub esp, 0
rcl dl, 3
shr si, cl
neg dl
xchg dx, si
jmp 0x736177
mov esi, edx
lea esp, [esp]
cld
bts dx, cx
mov dl, byte [esp + 2]
mov ax, dx
jmp 0x73614e
lea eax, reloc.WINMM.dll_midiStreamOut
bts ax, bp
mov byte [esp], bh
neg dx
mov ax, 0xc622
pushfd
jmp 0x736235
mov ax, word [esp]
btr edx, edx
rdtsc
lea esp, [esp]
not eax
pop word [esp + 2]
jmp 0x7361ad
mov dh, byte [esp + 3]
or ax, cx
lea esi, reloc.WINMM.dll_midiStreamOut
btr eax, ebx
add dh, cl
bswap eax
jmp 0x7361c6
Function at 0x7362ea
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dx, 0xf7d
mov esi, eax
lea eax, [edi*4]
xchg ah, al
stc
jmp 0x73630b
rdtsc
lea esp, [esp + 5]
neg ax
jmp 0x7362d4
add esp, 1
shr dx, cl
bswap esi
mov ax, 0x3e93
call fcn.00736398
daa
dec esi
fnstcw word [eax]
sbb ecx, dword [edi]
xor esi, esi
sar byte [esi - 0x6f291d02], 1
rdtsc
not al
mov esi, 0x90d6e2fe
mov edx, ecx
bts dx, sp
add esp, 1
jmp 0x7362f5

Function at 0x736398
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg word [esp + 1], si
mov eax, dword [esp + 2]
mov al, 0xbc
pop word [esp]
pop dx
mov ax, word [esp]
jmp 0x73633a
mov dword [esp], ebx
mov si, 0x5c40
jmp 0x736350

Function at 0x736afa
Capabilities:
Execute anti-debugging instructions

Disassembly:
sets dl
mov si, sp
jmp 0x736b37
push dword [esp + 0x16]
lea esp, [esp + 0x42]
sub al, 0x5d
mov si, ax
bt ax, bx
lea eax, reloc.WINMM.dll_midiStreamOut
jmp 0x736b21

Function at 0x736e26
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x736eb1
push 0
pushal
mov edx, dword [esp]
lea ecx, [edi + edi]
mov bh, dl
mov bp, 0xc9a4
jmp 0x736e79
cpuid
pushfd
push dword [esp + 2]
not di
lea edx, reloc.WINMM.dll_midiStreamOut
setnp ah
jmp 0x736e51
pushfd
push word [esp + 0x15]
push word [esp + 0x16]
mov byte [esp + 0x17], ah
lea esp, [esp + 0x38]
jmp 0x736e2b
Function at 0x40148c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
test esi, esi
je 0x4014b0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4014b0
test al, 0x10
jne 0x4014b0
push esi
call fcn.0040145f
test al, al
push esi
jne 0x4014b3
call fcn.00401472
xor eax, eax
ret
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
ret

Function at 0x4016b4
Capabilities:
Check os version

Disassembly:
push ebp
sub esp, 0x114
lea ebp, [esp - 4]
mov eax, dword [0x412034]
xor eax, ebp
mov dword [ebp + 0x114], eax
push 0x20
mov eax, 0x40de44
call fcn.0040cdbf
lea eax, [edi + 0x1048]
push 7
xor ebx, ebx
pop ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x14], ebx
mov dword [ebp - 0x2c], edi
mov word [eax + 4], bx
lea eax, [edi + 0x1064]
mov dword [ebp - 4], ebx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x14], ebx
mov word [eax + 4], bx
lea eax, [edi + 0x1080]
mov dword [eax + 0x18], ecx
mov dword [eax + 0x14], ebx
mov word [eax + 4], bx
lea eax, [edi + 0x10a0]
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
lea eax, [edi + 0x10b0]
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov esi, 0x410
push esi
mov byte [ebp - 4], 4
push ebx
push edi
mov dword [edi + 0x103c], ebx
mov dword [edi + 0x1040], ebx
mov dword [edi + 0x1044], ebx
call fcn.00406040
push esi
lea eax, [edi + 0x410]
push ebx
push eax
call fcn.00406040
push 0x400
lea eax, [edi + 0x820]
push ebx
push eax
call fcn.00406040
push esi
lea eax, [edi + 0xc20]
push ebx
push eax
call fcn.00406040
push 0x110
lea eax, [ebp + 4]
push ebx
push eax
mov byte [edi + 0x1030], bl
mov byte [edi + 0x1031], bl
mov dword [edi + 0x1034], ebx
mov byte [edi + 0x1032], bl
mov byte [edi + 0x1038], 1
mov byte [edi + 0x10c0], bl
mov byte [edi + 0x109c], bl
mov dword [ebp], 0x114
call fcn.00406040
add esp, 0x3c
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp eax, ebx
je 0x4017e1
cmp dword [ebp + 4], 6
jb 0x4017e1
mov byte [edi + 0x1032], 1
mov eax, str._nNwmteRQ
lea esi, [ebp - 0x28]
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x14], ebx
mov word [ebp - 0x24], bx
call fcn.00403698
mov eax, esi
push eax
lea esi, [edi + 0x10a0]
mov byte [ebp - 4], 5
call fcn.00403373
push ebx
push 1
lea esi, [ebp - 0x28]
mov byte [ebp - 4], 4
call fcn.00403704
mov eax, 0x40fc00
lea esi, [ebp - 0x28]
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x14], ebx
mov word [ebp - 0x24], bx
call fcn.00403698
mov eax, esi
push eax
lea esi, [edi + 0x10a0]
mov byte [ebp - 4], 6
call fcn.00403373
push ebx
push 1
lea esi, [ebp - 0x28]
mov byte [ebp - 4], 4
call fcn.00403704
mov ebx, edi
call fcn.0040264e
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x114]
xor ecx, ebp
call fcn.004058de
add ebp, 0x118
leave
ret
Function at 0x40264e
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x430
mov eax, dword [0x412034]
xor eax, esp
mov dword [esp + 0x42c], eax
push esi
push edi
lea esi, [ebx + 0xc20]
push esi
mov byte [ebx + 0x10c0], 0
call fcn.00405963
test eax, eax
pop ecx
jbe 0x4027c1
lea eax, [ebx + 0x10b0]
push eax
push esi
call fcn.004027d5
and word [esp + 0x220], 0
mov esi, 0x208
push esi
lea eax, [esp + 0x226]
push 0
push eax
call fcn.00406040
add esp, 0xc
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x224]
mov edi, 0x104
push eax
mov dword [esp + 0x14], edi
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
xor eax, eax
push esi
push eax
mov word [esp + 0x42e], ax
mov word [esp + 0x18], ax
lea eax, [esp + 0x1a]
push eax
call fcn.00406040
mov dword [esp + 0x18], edi
lea esi, [ebx + 0x1044]
xor edi, edi
add esp, 0xc
cmp dword [esi], edi
jne 0x40270b
push str.AdvApi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi], eax
push str.GetUserNameW
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x402728
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
push ecx
call eax
lea esi, [ebx + 0x10b0]
mov eax, esi
mov word [esp + 0x216], di
call fcn.004033d1
test eax, eax
je 0x40278b
push edi
call fcn.004033e9
mov edi, eax
cmp byte [edi + 0x69c], 1
jne 0x40277d
lea eax, [esp + 0x220]
push eax
push edi
call fcn.004066c8
test eax, eax
pop ecx
pop ecx
jne 0x40277d
lea eax, [esp + 0x10]
push eax
add edi, 0x280
push edi
call fcn.004066c8
test eax, eax
pop ecx
pop ecx
je 0x40278b
mov eax, esi
call fcn.0040340b
mov byte [ebx + 0x10c0], 1
mov eax, esi
call fcn.004033d1
test eax, eax
jne 0x4027c1
lea eax, [esp + 0x10]
push 1
push eax
call fcn.00405963
pop ecx
inc eax
push eax
lea eax, [esp + 0x228]
push eax
push 0
mov edi, esi
lea ecx, [esp + 0x20]
call fcn.00402451
mov byte [ebx + 0x10c0], 1
mov ecx, dword [esp + 0x434]
pop edi
pop esi
xor ecx, esp
call fcn.004058de
mov esp, ebp
pop ebp
ret
Function at 0x4027d5
Capabilities:
Read file on windows

Disassembly:
push 0x704
mov eax, 0x40ddd0
call fcn.0040cdbf
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x40299c
push ebx
push 0x80
push 3
push ebx
push ebx
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x3c], eax
je 0x40299c
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 4], ebx
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x48]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
call fcn.004023ca
test al, al
jne 0x40284d
xor edi, edi
mov dword [ebp - 0x24], ebx
jmp 0x402850
mov edi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov ecx, edi
add ecx, 0xffffffff
adc eax, 0xffffffff
cmp eax, ebx
ja 0x4028a6
jb 0x402869
cmp ecx, 0xffffe
ja 0x4028a6
push edi
lea eax, [ebp - 0x1c]
call fcn.0040345c
push ebx
lea eax, [ebp + 8]
push eax
push edi
lea esi, [ebp - 0x1c]
mov dword [ebp + 8], ebx
call fcn.004034ff
push eax
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor eax, eax
cmp eax, dword [ebp - 0x24]
ja 0x4028a6
jb 0x40289b
cmp dword [ebp + 8], edi
jae 0x4028a6
push dword [ebp + 8]
lea eax, [ebp - 0x1c]
call fcn.0040345c
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x18], ebx
je 0x402994
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x18]
je 0x402994
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
lea esi, [ebp - 0x70]
mov byte [ebp - 4], 1
call fcn.00405193
cmp dword [ebp - 0x18], ebx
jne 0x4028e2
xor edi, edi
jmp 0x4028e8
mov edi, dword [ebp - 0x14]
sub edi, dword [ebp - 0x18]
lea esi, [ebp - 0x1c]
call fcn.004034ff
push eax
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x38]
mov edx, edi
call fcn.00405227
test al, al
je 0x40298c
cmp dword [ebp - 0x34], ebx
mov ecx, dword [ebp - 0x30]
jne 0x402913
xor eax, eax
jmp 0x402918
mov eax, ecx
sub eax, dword [ebp - 0x34]
mov esi, 0x69d
xor edx, edx
mov edi, esi
div edi
test edx, edx
jne 0x40298c
cmp dword [ebp - 0x34], ebx
jne 0x402930
xor ecx, ecx
jmp 0x402933
sub ecx, dword [ebp - 0x34]
xor edx, edx
mov eax, ecx
div esi
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x40298c
lea esi, [ebp - 0x70d]
call fcn.0040165c
mov edx, dword [ebp + 0xc]
sub esp, 0x6a0
mov esi, eax
mov edi, esp
mov ecx, 0x1a7
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.004037fd
imul esi, esi, 0x69d
push esi
lea esi, [ebp - 0x38]
call fcn.004034ff
mov esi, dword [ebp + 0xc]
push eax
push ebx
call fcn.004033e9
push eax
call fcn.00406140
add esp, 0xc
lea esi, [ebp - 0x38]
call fcn.00403441
lea esi, [ebp - 0x1c]
call fcn.00403441
call fcn.0040ce97
ret 8
Function at 0x404b6e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp esi, ebx
je 0x404bd0
cmp dword [ebp + 8], ebx
je 0x404bd0
cmp dword [ebp + 0xc], ebx
je 0x404bd0
lea eax, [ebp - 4]
push eax
push esi
push str.Path
push dword [ebp + 8]
mov word [esi], bx
push 0x80000002
mov dword [ebp - 4], 0x104
call fcn.00404ac0
add esp, 0x14
test al, al
je 0x404bcd
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x40fae0
push esi
call edi
push dword [ebp + 0xc]
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
pop edi
jne 0x404bd0
mov word [esi], bx
pop ebx
leave
ret

Function at 0x404c1c
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x412034]
xor eax, ebp
mov dword [ebp + 0x9c], eax
push ebx
push edi
push 0x110
lea eax, [ebp - 0x74]
push 0
push eax
call fcn.00406040
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
mov dword [ebp - 0x78], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov edi, 0x104
mov ebx, 0x80000001
je 0x404c9a
cmp dword [ebp - 0x74], 6
jb 0x404c9a
lea eax, [ebp - 0x80]
push eax
push esi
push str.Progid
push str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
push ebx
mov dword [ebp - 0x80], edi
call fcn.00404ac0
add esp, 0x14
test al, al
je 0x404c9a
cmp word [esi], 0
je 0x404c9a
mov al, 1
jmp 0x404ce4
lea eax, [ebp - 0x7c]
push eax
push esi
push 0
push str.http_shellopencommand
push 0x80000000
mov dword [ebp - 0x7c], edi
call fcn.00404ac0
add esp, 0x14
test al, al
je 0x404cc0
cmp word [esi], 0
jne 0x404c96
lea eax, [ebp - 0x7c]
push eax
push esi
push 0
push str.SoftwareClasses.html
push ebx
mov dword [ebp - 0x7c], edi
call fcn.00404ac0
add esp, 0x14
test al, al
je 0x404ce2
cmp word [esi], 0
jne 0x404c96
xor al, al
mov ecx, dword [ebp + 0x9c]
pop edi
xor ecx, ebp
pop ebx
call fcn.004058de
add ebp, 0xa0
leave
ret