joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b310
Capabilities:
Connect to http server
Create http request
Parse url
Send data
Send http request

Disassembly:
mov eax, 0x40a8
call fcn.00412600
mov eax, dword [0x431034]
xor eax, esp
mov dword [esp + 0x40a4], eax
mov eax, dword [esp + 0x40ac]
push ebx
push esi
push edi
mov ebx, ecx
mov ecx, 0x18
mov esi, str.Content_Type:_application_x_www_form_urlencoded
lea edi, [esp + 0x50]
rep movsd dword es:[edi], dword [esi]
push 0x3c
xor esi, esi
lea ecx, [esp + 0x18]
push esi
push ecx
mov dword [esp + 0x18], eax
call fcn.00411d90
lea eax, [esp + 0x20bc]
mov dword [esp + 0x4c], eax
mov eax, 0x1000
lea edx, [esp + 0xbc]
mov dword [esp + 0x34], eax
mov dword [esp + 0x50], eax
mov eax, ebx
mov dword [esp + 0x30], edx
add esp, 0xc
mov dword [esp + 0x14], 0x3c
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40b390
lea ecx, [esp + 0x14]
push ecx
sub eax, edx
push 0
sar eax, 1
push eax
push ebx
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x40b4b3
mov eax, dword [esp + 0x20]
movzx edi, word [esp + 0x2c]
cmp eax, 3
jne 0x40b3cb
mov ebx, 0x84200000
jmp 0x40b3d9
cmp eax, 4
jne 0x40b4b3
mov ebx, 0x84a03000
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [esp + 0x10], eax
test eax, eax
je 0x40b499
push ebp
push 0
push 0
push 3
push 0
push 0
push edi
lea edx, [esp + 0xcc]
push edx
push eax
call dword [sym.imp.WININET.dll_InternetConnectW]
mov ebp, eax
test ebp, ebp
je 0x40b48d
push 0
push ebx
push 0
push 0
push 0
lea eax, [esp + 0x20c8]
push eax
push str.POST
push ebp
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov edi, eax
test edi, edi
je 0x40b486
mov ebx, dword [esp + 0x10]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40b442
sub eax, edx
mov edx, eax
lea eax, [esp + 0x54]
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40b454
push edx
sub eax, esi
push ebx
sar eax, 1
push eax
lea ecx, [esp + 0x60]
push ecx
push edi
call dword [sym.imp.WININET.dll_HttpSendRequestW]
mov esi, eax
test esi, esi
je 0x40b47f
call fcn.0040b160
mov esi, eax
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push ebp
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
pop ebp
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 0x40a4]
xor ecx, esp
call fcn.0040ff55
add esp, 0x40a8
ret
mov ecx, dword [esp + 0x40b0]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0040ff55
add esp, 0x40a8
ret
Function at 0x40b4d0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10c
mov eax, dword [0x431034]
xor eax, esp
mov dword [esp + 0x108], eax
push ebx
push ebp
mov ebp, dword [esp + 0x118]
push esi
mov esi, dword [esp + 0x120]
push esi
call fcn.0040f900
push eax
lea eax, [esp + 0x18]
push 0x429920
push eax
call fcn.0040b140
push 0x4293a0
lea ecx, [esp + 0x20]
push esi
xor ebx, ebx
push ecx
mov dword [esp + 0x28], ebx
call fcn.004117a3
add esp, 0x1c
test eax, eax
jne 0x40b58b
mov edx, dword [esp + 0xc]
push edi
push edx
call fcn.0040a800
mov edi, eax
add esp, 4
cmp edi, ebx
jbe 0x40b57d
lea eax, [edi + 1]
push eax
call fcn.00411613
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x40b57d
mov ecx, dword [esp + 0x10]
push ecx
push 1
push edi
push esi
call fcn.004115a7
add esp, 0x10
cmp eax, 1
jne 0x40b574
push esi
mov ecx, ebp
mov byte [esi + edi], bl
call fcn.0040b310
add esp, 4
mov ebx, eax
push esi
call fcn.00410fa2
add esp, 4
mov edx, dword [esp + 0x10]
push edx
call fcn.004110a7
add esp, 4
pop edi
mov ecx, dword [esp + 0x114]
pop esi
pop ebp
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.0040ff55
add esp, 0x10c
ret

Function at 0x40b5b0
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x431034]
xor eax, esp
mov dword [esp + 0x114], eax
lea eax, [esp]
push eax
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [esp + 4]
cmp eax, 5
jbe 0x40b5f9
mov eax, 1
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.0040ff55
add esp, 0x118
ret
jne 0x40b606
mov eax, 1
cmp dword [esp + 8], eax
jae 0x40b608
xor eax, eax
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.0040ff55
add esp, 0x118
ret
Function at 0x40b710
Capabilities:
Read .ini file

Disassembly:
mov ecx, dword [esp + 4]
xor eax, eax
mov word [0x52d380], ax
lea eax, [ecx - 0x1f7]
cmp eax, 0xe5
ja case.0x40b734.511
movzx edx, byte [eax + 0x40b98c]
jmp dword [edx*4 + 0x40b8fc]
mov eax, str.TITLE
jmp 0x40b85e
mov eax, str.ERROR_ACCESS
jmp 0x40b85e
mov eax, str.ERROR_OTHER
jmp 0x40b85e
mov eax, str.ERROR_WINVER
jmp 0x40b85e
mov eax, str.REMOVE_OK
jmp 0x40b85e
mov eax, str.REMOVE_NG
jmp 0x40b85e
mov eax, str.REMOVE_RETRY
jmp 0x40b85e
mov eax, str.REMOVE_RETRY1
jmp 0x40b85e
mov eax, str.ERROR_721
jmp 0x40b85e
mov eax, str.ERROR_732
jmp 0x40b85e
mov eax, str.SUPPORT_NUMBER
jmp 0x40b85e
mov eax, 0x429c88
jmp 0x40b85e
mov eax, str.ERRORINFO_SAVE
jmp 0x40b85e
mov eax, 0x429c38
jmp 0x40b85e
mov eax, str.ERRORINFO_OK
jmp 0x40b85e
mov eax, str.ERRORINFO_CANCEL
jmp 0x40b85e
mov eax, str.ERRORINFO_VERCHECK
jmp 0x40b85e
mov eax, str.ERRORINFO_SAVEOK
jmp 0x40b85e
mov eax, str.ERRORINFO_SAVENG
jmp 0x40b85e
mov eax, str.ERRORINFO_SENDOK
jmp 0x40b85e
mov eax, str.ERRORINFO_SENDNG
jmp 0x40b85e
mov eax, str.ERRORINFO_SENDING
jmp 0x40b85e
mov eax, str.ERRORINFO_CONTACT
jmp 0x40b85e
mov eax, str.ERRORINFO_CONTACTMSG
jmp 0x40b85e
mov eax, str.CAUTION_MSG
jmp 0x40b85e
mov eax, str.CAUTION_ADVICE
jmp 0x40b85e
mov eax, str.CAUTION_ADVICE1
jmp 0x40b85e
mov eax, str.CAUTION_ADVICE2
jmp 0x40b85e
mov eax, str.CAUTION_ADVICE3
jmp 0x40b85e
mov eax, str.CAUTION_OK
jmp 0x40b85e
mov eax, str.CAUTION_REPORT
jmp 0x40b85e
mov eax, str.REMOVE_CONFIRM
jmp 0x40b85e
mov eax, str.BUTTON_OK
jmp 0x40b85e
mov eax, str.BUTTON_CANCEL
jmp 0x40b85e
mov eax, str.LANGUAGE
cmp dword [0x52d378], 0
je 0x40b88f
add ecx, 0xfffffe0c
shl ecx, 0xb
add ecx, 0x433378
push ecx
push 0x400
push 0x52d380
call fcn.004105bc
add esp, 0xc
mov eax, 0x52d380
ret
push 0x52e380
push 0x400
push 0x52d380
push 0x429358
push eax
push 0x42992c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x429924
push 0x52d380
call fcn.0041262b
add esp, 8
test eax, eax
je case.0x40b734.511
jmp 0x40b8d0
mov ecx, 0xd
mov edx, 0xa
mov word [eax], cx
mov word [eax + 2], dx
add eax, 4
push 0x429924
push eax
call fcn.0041262b
add esp, 8
test eax, eax
jne 0x40b8d0
mov eax, 0x52d380
ret
Function at 0x40bd30
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
sub esp, 0x660
mov eax, dword [0x431034]
xor eax, esp
mov dword [esp + 0x65c], eax
lea eax, [esp + 0x24c]
push eax
push 0x104
call fcn.0040afe0
add esp, 8
test eax, eax
jne 0x40bd77
mov eax, 0x385
mov ecx, dword [esp + 0x65c]
xor ecx, esp
call fcn.0040ff55
add esp, 0x660
ret
push str._USBREMOVE_EXE
lea ecx, [esp + 0x250]
push 0x429f2c
push ecx
call fcn.0040f3c0
add esp, 0xc
test eax, eax
jne 0x40bdaf
mov eax, 0x386
mov ecx, dword [esp + 0x65c]
xor ecx, esp
call fcn.0040ff55
add esp, 0x660
ret
push esi
lea edx, [esp + 0x250]
push edx
lea eax, [esp + 0x45c]
push str._sUsbRemove.exe
push eax
call fcn.0040a9e0
add esp, 0xc
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [esp + 4], 2
mov esi, eax
mov edx, dword [esi + 4]
lea eax, [esp + 0x48]
jne 0x40be00
push edx
push str._s__S
push eax
call fcn.0040a9e0
add esp, 0xc
jmp 0x40be13
mov ecx, dword [esi + 8]
push ecx
push edx
push str._s__s
push eax
call fcn.0040a9e0
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x3c
lea ecx, [esp + 0x10]
push 0
push ecx
call fcn.00411d90
add esp, 0xc
lea ecx, [esp + 0xc]
lea edx, [esp + 0x458]
lea eax, [esp + 0x48]
push ecx
mov dword [esp + 0x10], 0x3c
mov dword [esp + 0x14], 0x440
mov dword [esp + 0x1c], str.open
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x40be8a
mov esi, 0x34d
mov eax, esi
pop esi
mov ecx, dword [esp + 0x65c]
xor ecx, esp
call fcn.0040ff55
add esp, 0x660
ret
mov edx, dword [esp + 0x44]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0x44]
lea eax, [esp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edx, dword [esp + 0x44]
mov esi, dword [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x660]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0040ff55
add esp, 0x660
ret
Function at 0x40bfb0
Capabilities:
Accept command line arguments
Check mutex on windows

Disassembly:
push ecx
call fcn.0040f640
push 0
push 0x52e380
call fcn.00408f50
push eax
call fcn.0040ad10
add esp, 0xc
call fcn.0040b6c0
test eax, eax
jne 0x40bfd8
pop ecx
ret 0x10
push esi
push str.UsbRemove_Mutex
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40bffe
xor eax, eax
pop esi
pop ecx
ret 0x10
push edi
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [esp + 8], 1
jne 0x40c0b7
push 0x429358
push 0
call fcn.0041188a
push str._USBREMOVE_EXE
push 0x429f2c
call fcn.0040fb20
mov edi, eax
add esp, 0x10
cmp edi, 0x1f5
je 0x40c09f
call fcn.0040bed0
test eax, eax
jne 0x40c061
push esi
call fcn.0040bc50
add esp, 4
test eax, eax
jne 0x40c0af
call fcn.0040bcc0
test eax, eax
jne 0x40c09f
call fcn.00409290
cmp eax, 0x3e9
jne 0x40c09f
push edi
call fcn.0040ba80
push eax
call fcn.00409660
add esp, 8
call fcn.004092d0
push eax
push edi
call fcn.0040ba80
add esp, 4
push eax
push 0
call fcn.0040a430
add esp, 0xc
cmp esi, 0xffffffff
je 0x40c0af
test esi, esi
je 0x40c0af
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
pop ecx
ret 0x10
call fcn.0040bd30
mov edi, eax
cmp esi, 0xffffffff
je 0x40c0ce
test esi, esi
je 0x40c0ce
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ecx
ret 0x10

Function at 0x40c170
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x40c1b7
push 0x68
push 0
push esi
call fcn.00411d90
add esp, 0xc
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0x67452301
mov dword [esi + 0x5c], 0xefcdab89
mov dword [esi + 0x60], 0x98badcfe
mov dword [esi + 0x64], 0x10325476
mov eax, 1
pop esi
ret
mov eax, 2
pop esi
ret
Function at 0x40c9e0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x54
mov eax, dword [0x431034]
xor eax, esp
mov dword [esp + 0x50], eax
mov ecx, dword [esp + 0x5c]
mov eax, dword [esp + 0x60]
push ebx
mov ebx, dword [esp + 0x68]
push esi
mov esi, dword [esp + 0x60]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
test ebx, ebx
jle 0x40cb7f
push edi
mov edi, dword [esi + 0x50]
mov edx, ebx
sar edx, 0x1d
add dword [esi + 0x54], edx
mov edx, dword [esi + 0x54]
shr edi, 3
lea eax, [ebx*8]
add dword [esi + 0x50], eax
and edi, 0x3f
cmp dword [esi + 0x50], eax
jae 0x40ca38
inc edx
mov dword [esi + 0x54], edx
push ebp
cmp ecx, 0xffffffff
je 0x40caf9
test edi, edi
jle 0x40ca8b
lea eax, [edi + ebx]
cmp eax, 0x40
jle 0x40ca57
mov ebp, 0x40
sub ebp, edi
jmp 0x40ca59
mov ebp, ebx
push 0
lea edx, [esp + 0x1c]
push edx
push ebp
lea eax, [esi + edi + 0x10]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
lea ecx, [edi + ebp]
cmp ecx, 0x40
jl 0x40cb7d
lea eax, [esi + 0x10]
push esi
sub ebx, ebp
call fcn.0040c260
mov ecx, dword [esp + 0x18]
add esp, 4
cmp ebx, 0x40
jl 0x40cacb
mov edi, ebx
shr edi, 6
mov edx, edi
neg edx
shl edx, 6
add ebx, edx
mov edi, edi
push 0
lea eax, [esp + 0x1c]
push eax
push 0x40
lea edx, [esp + 0x28]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
lea eax, [esp + 0x20]
call fcn.0040c260
mov ecx, dword [esp + 0x18]
add esp, 4
sub edi, 1
jne 0x40caa0
test ebx, ebx
jle 0x40cb7d
push 0
lea eax, [esp + 0x1c]
push eax
push ebx
add esi, 0x10
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
pop ebp
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.0040ff55
add esp, 0x54
ret
test edi, edi
jle 0x40cb3d
lea ecx, [edi + ebx]
cmp ecx, 0x40
jle 0x40cb0e
mov ebp, 0x40
sub ebp, edi
jmp 0x40cb10
mov ebp, ebx
mov edx, dword [esp + 0x10]
push ebp
push edx
lea eax, [esi + edi + 0x10]
push eax
call fcn.0040ff70
lea ecx, [edi + ebp]
add esp, 0xc
cmp ecx, 0x40
jl 0x40cb7d
add dword [esp + 0x10], ebp
lea eax, [esi + 0x10]
push esi
sub ebx, ebp
call fcn.0040c260
add esp, 4
cmp ebx, 0x40
jl 0x40cb67
mov edi, ebx
shr edi, 6
mov edx, edi
neg edx
shl edx, 6
add ebx, edx
mov eax, dword [esp + 0x10]
push esi
call fcn.0040c260
add dword [esp + 0x14], 0x40
add esp, 4
sub edi, 1
jne 0x40cb50
test ebx, ebx
jle 0x40cb7d
mov eax, dword [esp + 0x10]
push ebx
push eax
add esi, 0x10
push esi
call fcn.0040ff70
add esp, 0xc
pop ebp
pop edi
mov ecx, dword [esp + 0x58]
pop esi
pop ebx
xor ecx, esp
call fcn.0040ff55
add esp, 0x54
ret
Function at 0x40cdb0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x90
mov eax, dword [0x431034]
xor eax, esp
mov dword [esp + 0x8c], eax
push esi
xor esi, esi
push 0x80
lea eax, [esp + 0x14]
push esi
push eax
mov dword [esp + 0x10], esi
call fcn.00411d90
add esp, 0xc
lea ecx, [esp + 4]
push ecx
push 0x20119
push esi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40ce3b
lea edx, [esp + 8]
push edx
mov edx, dword [esp + 8]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
push esi
push str.ProductId
push edx
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40ce30
lea esi, [eax + 1]
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x10]
push ecx
push 0x429fe8
push edi
call fcn.004117f6
mov ecx, dword [esp + 0x9c]
add esp, 0xc
mov eax, esi
pop esi
xor ecx, esp
call fcn.0040ff55
add esp, 0x90
ret
Function at 0x40ce70
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x34
mov eax, dword [0x431034]
xor eax, esp
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x38]
push ebx
lea ecx, [esp + 4]
push ecx
push 0x20119
xor ebx, ebx
push ebx
mov dword [esp + 0x20], eax
xor eax, eax
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x18], ebx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov word [esp + 0x44], ax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40cfe5
mov ecx, dword [esp + 4]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [esp + 0xc]
push edx
push ebx
lea eax, [esp + 0x18]
push eax
push ebx
push 0x42a068
push ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
call esi
test eax, eax
jne 0x40cfd9
mov edx, dword [esp + 0xc]
push edi
push edx
push 1
call fcn.00411c26
mov edi, eax
add esp, 8
cmp edi, ebx
je 0x40cfd8
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
push edi
lea ecx, [esp + 0x1c]
push ecx
push ebx
push 0x42a068
push edx
call esi
test eax, eax
jne 0x40cfcf
mov cl, byte [edi + 0x42]
movzx edx, cl
mov eax, 0x2aaaaaab
imul edx
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
and bl, 1
and cl, 0xf7
push ebp
mov ebp, dword [0x431024]
mov byte [edi + 0x42], cl
mov dword [esp + 0x1c], 0x18
lea ecx, [ebp + 0xe]
xor esi, esi
cmp ecx, ebp
jl 0x40cf97
nop
movzx edx, byte [ecx + edi]
shl esi, 8
or esi, edx
mov eax, 0x2aaaaaab
imul esi
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [ecx + edi], al
imul eax, eax, 0xffffffe8
dec ecx
add esi, eax
cmp ecx, ebp
jge 0x40cf70
mov eax, dword [esp + 0x1c]
mov cl, byte [esi + str.BCDFGHJKMPQRTVWXY2346789]
mov byte [esp + eax + 0x24], cl
sub eax, 1
mov dword [esp + 0x1c], eax
jns 0x40cf66
pop ebp
cmp bl, 1
jne 0x40cfcf
lea edx, [esi + esi]
push edx
lea eax, [esp + 0x25]
push eax
lea ecx, [esp + 0x28]
push ecx
call fcn.00412720
add esp, 0xc
mov byte [esp + esi + 0x20], 0x4e
push edi
call fcn.00410fa2
add esp, 4
pop edi
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
push 0x42a064
push ecx
call fcn.00411c66
mov ecx, dword [esp + 0x40]
add esp, 0xc
pop ebx
xor ecx, esp
call fcn.0040ff55
add esp, 0x34
ret

Function at 0x40d010
Capabilities:
Get hostname

Disassembly:
sub esp, 0x108
mov eax, dword [0x431034]
xor eax, esp
mov dword [esp + 0x104], eax
push 0xff
lea eax, [esp + 9]
push 0
push eax
mov byte [esp + 0x10], 0
call fcn.00411d90
add esp, 0xc
lea ecx, [esp]
push ecx
lea edx, [esp + 8]
push edx
mov dword [esp + 8], 0x100
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea eax, [esp + 4]
push eax
push 0x42a064
push esi
call fcn.00411c66
mov ecx, dword [esp + 0x110]
add esp, 0xc
xor ecx, esp
call fcn.0040ff55
add esp, 0x108
ret
Function at 0x40dda0
Capabilities:
Delete file
Get common file path

Disassembly:
sub esp, 0x820
mov eax, dword [0x431034]
xor eax, esp
mov dword [esp + 0x81c], eax
mov eax, dword [esp + 0x828]
push ebp
mov ebp, dword [esp + 0x828]
lea ecx, [esp + 0x618]
push ecx
push 0x104
mov dword [esp + 0x14], eax
call fcn.0040afe0
add esp, 8
test eax, eax
jne 0x40ddf8
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x81c]
xor ecx, esp
call fcn.0040ff55
add esp, 0x820
ret
lea edx, [esp + 0x10]
push edx
push 0
push 0x42a2dc
lea eax, [esp + 0x624]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x40dde0
push 0x42a2d4
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x10], 0
call fcn.004117a3
add esp, 0xc
test eax, eax
jne 0x40dde0
mov eax, dword [esp + 4]
push esi
push edi
push eax
call fcn.0040da80
mov edi, dword [esp + 0x10]
call fcn.0040cdb0
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0040ce70
mov esi, dword [esp + 0x14]
call fcn.0040d010
mov edx, dword [esp + 0x14]
push edx
call fcn.004110a7
lea eax, [esp + 0x24]
push ebp
push eax
mov dword [esp + 0x24], 0
call fcn.0040c0e0
add esp, 0x14
test eax, eax
je 0x40de8d
mov dword [esp + 0x10], 1
mov edi, dword [esp + 0x14]
test edi, edi
je 0x40df7b
push 0x400
lea ecx, [esp + 0x224]
push 0
push ecx
call fcn.00411d90
push 0x42a2c8
lea edx, [esp + 0x230]
push 0x400
push edx
call fcn.00412a85
push 0x4293a0
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x2c]
push ecx
call fcn.004117a3
add esp, 0x24
test eax, eax
jne 0x40df3f
lea eax, [esp + 0x220]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40def0
sub eax, edx
mov edx, dword [esp + 0xc]
push edx
mov esi, eax
call fcn.00412aed
add esp, 4
cmp eax, 0xffffffff
je 0x40df2a
lea ecx, [ecx]
mov byte [esp + esi + 0x220], al
mov eax, dword [esp + 0xc]
push eax
inc esi
call fcn.00412aed
add esp, 4
cmp eax, 0xffffffff
jne 0x40df10
mov ecx, dword [esp + 0xc]
push ecx
mov byte [esp + esi + 0x224], 0
call fcn.004110a7
add esp, 4
push str._r_n_MD5
lea edx, [esp + 0x224]
push 0x400
push edx
call fcn.00412588
push ebp
lea eax, [esp + 0x230]
push 0x400
push eax
call fcn.00412588
add esp, 0x18
lea ecx, [esp + 0x220]
push ecx
push edi
call dword [sym.imp.USER32.dll_SetWindowTextA]
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x828]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0040ff55
add esp, 0x820
ret
Function at 0x40e5a0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push eax
push ecx
push esi
call fcn.0040e0c0
lea edi, [eax*4]
add esp, 0xc
xor ebx, ebx
mov dword [esp + 0xc], eax
test edi, edi
jle 0x40e615
lea edx, [esi + edi*4 + 8]
lea ecx, [esi + 8]
push ebp
mov eax, dword [edx - 8]
mov ebp, dword [ecx - 8]
mov dword [ecx - 8], eax
mov dword [edx - 8], ebp
mov ebp, dword [edx - 4]
mov eax, dword [ecx - 4]
mov dword [ecx - 4], ebp
mov ebp, dword [edx]
mov dword [edx - 4], eax
mov eax, dword [ecx]
mov dword [ecx], ebp
mov ebp, dword [edx + 4]
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [ecx + 4], ebp
mov dword [edx + 4], eax
add ebx, 4
sub edi, 4
add ecx, 0x10
sub edx, 0x10
cmp ebx, edi
jl 0x40e5d4
mov eax, dword [esp + 0x10]
pop ebp
cmp eax, 1
jle 0x40e7d0
lea edx, [eax - 1]
mov ecx, dword [esi + 0x10]
movzx ebx, byte [esi + 0x11]
mov ebx, dword [ebx*4 + str.ccccwwww]
add esi, 0x10
mov edi, ecx
shr edi, 0x18
mov edi, dword [edi*4 + str.ccccwwww]
and edi, 0xff
mov edi, dword [edi*4 + 0x42b6f8]
and ebx, 0xff
xor edi, dword [ebx*4 + 0x42bef8]
movzx ebx, byte [esi + 2]
mov ebx, dword [ebx*4 + str.ccccwwww]
and ebx, 0xff
xor edi, dword [ebx*4 + 0x42baf8]
movzx ebx, byte [esi + 5]
and ecx, 0xff
mov ecx, dword [ecx*4 + str.ccccwwww]
and ecx, 0xff
xor edi, dword [ecx*4 + 0x42c2f8]
mov ecx, dword [esi + 4]
mov dword [esi], edi
mov ebx, dword [ebx*4 + str.ccccwwww]
mov edi, ecx
shr edi, 0x18
mov edi, dword [edi*4 + str.ccccwwww]
and edi, 0xff
mov edi, dword [edi*4 + 0x42b6f8]
and ebx, 0xff
xor edi, dword [ebx*4 + 0x42bef8]
movzx ebx, byte [esi + 6]
mov ebx, dword [ebx*4 + str.ccccwwww]
and ebx, 0xff
xor edi, dword [ebx*4 + 0x42baf8]
movzx ebx, byte [esi + 9]
and ecx, 0xff
mov ecx, dword [ecx*4 + str.ccccwwww]
and ecx, 0xff
xor edi, dword [ecx*4 + 0x42c2f8]
mov ecx, dword [esi + 8]
mov dword [esi + 4], edi
mov ebx, dword [ebx*4 + str.ccccwwww]
mov edi, ecx
shr edi, 0x18
mov edi, dword [edi*4 + str.ccccwwww]
and edi, 0xff
mov edi, dword [edi*4 + 0x42b6f8]
and ebx, 0xff
xor edi, dword [ebx*4 + 0x42bef8]
movzx ebx, byte [esi + 0xa]
mov ebx, dword [ebx*4 + str.ccccwwww]
and ebx, 0xff
xor edi, dword [ebx*4 + 0x42baf8]
movzx ebx, byte [esi + 0xd]
and ecx, 0xff
mov ecx, dword [ecx*4 + str.ccccwwww]
and ecx, 0xff
xor edi, dword [ecx*4 + 0x42c2f8]
mov ecx, dword [esi + 0xc]
mov dword [esi + 8], edi
mov ebx, dword [ebx*4 + str.ccccwwww]
mov edi, ecx
shr edi, 0x18
mov edi, dword [edi*4 + str.ccccwwww]
and edi, 0xff
mov edi, dword [edi*4 + 0x42b6f8]
and ebx, 0xff
xor edi, dword [ebx*4 + 0x42bef8]
movzx ebx, byte [esi + 0xe]
mov ebx, dword [ebx*4 + str.ccccwwww]
and ecx, 0xff
mov ecx, dword [ecx*4 + str.ccccwwww]
and ebx, 0xff
xor edi, dword [ebx*4 + 0x42baf8]
and ecx, 0xff
xor edi, dword [ecx*4 + 0x42c2f8]
sub edx, 1
mov dword [esi + 0xc], edi
jne 0x40e621
pop edi
pop esi
pop ebx
pop ecx
ret