joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c81d
Capabilities:
Prepare http request

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov esi, eax
call fcn.0041cc0e
xor ecx, ecx
cmp dword [ebp + 8], ecx
je 0x41c88f
cmp dword [ebp + 0xc], ecx
je 0x41c88f
mov eax, dword [esi + 8]
cmp eax, ecx
je 0x41c88f
xor edx, edx
mov edi, 0x1bb
cmp dword [esi + 0x220], edi
setne dl
dec edx
and edx, 0x800000
add edx, 0x100
push edx
push 0x44070c
push ecx
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov dword [esi + 0xc], eax
test eax, eax
jne 0x41c897
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.request_opening_failed___d_
lea eax, [esi + 0x46c]
call fcn.0040179f
pop ecx
pop ecx
xor al, al
pop edi
pop esi
leave
ret 8
cmp dword [esi + 0x458], 0
je 0x41c8e4
cmp dword [esi + 0x45c], 0
je 0x41c8e4
mov edx, dword [esi + 0x460]
test edx, edx
je 0x41c8e4
mov ecx, dword [esi + 0x464]
test ecx, ecx
je 0x41c8e4
push ecx
push edx
push dword [esi + 0x45c]
push dword [esi + 0x458]
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpSetTimeouts]
test eax, eax
jne 0x41c8e4
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.timeout_setting_failed___d_
jmp 0x41c882
cmp byte [esi + 0x224], 0
je 0x41c93d
lea eax, [esi + 0x338]
call fcn.0040ada0
test al, al
jne 0x41c93d
lea eax, [esi + 0x3c8]
call fcn.0040ada0
test al, al
jne 0x41c93d
mov eax, dword [esi + 0x3cc]
mov ecx, dword [esi + 0x33c]
push 0
push eax
push ecx
push 1
push 1
push dword [esi + 0xc]
call dword [sym.imp.WINHTTP.dll_WinHttpSetCredentials]
test eax, eax
jne 0x41c93d
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.setting
jmp 0x41c882
push str.HEAD
push dword [ebp + 8]
call fcn.004228a5
pop ecx
pop ecx
test eax, eax
jne 0x41c957
mov al, 1
jmp 0x41c891
cmp dword [esi + 0x220], edi
mov edi, dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
jne 0x41c98e
push 4
lea eax, [ebp - 4]
push eax
push 0x1f
push dword [esi + 0xc]
mov dword [ebp - 4], 0x100
call edi
test eax, eax
jne 0x41c98e
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.setting_ignore_unknown_CA_failed___d_
jmp 0x41c882
cmp byte [esi + 0x468], 0
jne 0x41c950
push 4
lea eax, [ebp - 4]
push eax
push 0x3f
push dword [esi + 0xc]
mov dword [ebp - 4], 2
call edi
test eax, eax
jne 0x41c950
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.setting_disable_redirects_failed___d_
jmp 0x41c882
Function at 0x41c9c0
Capabilities:
Read http header
Receive http response
Set http header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [esi + 0xc]
push edi
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], 4
cmp eax, edi
jne 0x41c9e0
xor eax, eax
jmp 0x41ca83
mov edx, dword [ecx + 8]
mov ecx, dword [ecx + 4]
push 0xa0000000
push edx
push ecx
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
test eax, eax
jne 0x41ca13
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.cannot_add_header__d_
lea eax, [esi + 0x46c]
call fcn.0040179f
pop ecx
pop ecx
jmp 0x41c9d9
push edi
push dword [ebp + 0xc]
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
push edi
push dword [esi + 0xc]
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
jne 0x41ca3a
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.cannot_send_request___d_
jmp 0x41ca04
push edi
push dword [esi + 0xc]
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
jne 0x41ca56
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.cannot_receive_response___d_
jmp 0x41ca04
push edi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push edi
push 0x20000013
push dword [esi + 0xc]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x41ca80
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.cannot_query_status___d_
jmp 0x41ca04
mov eax, dword [ebp - 4]
pop edi
leave
ret 8

Function at 0x41cc21
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
lea edi, [eax + 0x46c]
and dword [edi + 8], 0
mov esi, ecx
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x41cc3f
xor edx, edx
mov word [ecx], dx
mov eax, dword [eax + 0xc]
test eax, eax
je 0x41cc84
mov ecx, dword [esi + 0xc]
push 0
lea ecx, [ecx + ecx - 2]
lea edx, [ebp - 4]
push edx
mov dword [ebp - 4], ecx
mov ecx, dword [esi + 4]
push ecx
push str.Content_Length
push 0xffff
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x41cc8a
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.get_header_failed___d_
mov eax, edi
call fcn.0040179f
pop ecx
pop ecx
xor al, al
pop edi
pop esi
leave
ret
call fcn.00406409
mov al, 1
jmp 0x41cc86

Function at 0x41ccd0
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x41cd13
cmp dword [ebp + 0xc], 1
jb 0x41cd13
mov eax, dword [esi + 0xc]
test eax, eax
je 0x41cd13
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
jne 0x41cd19
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.read_failed___d_
lea eax, [esi + 0x46c]
call fcn.0040179f
pop ecx
pop ecx
xor al, al
pop ebp
ret 0xc
mov al, 1
jmp 0x41cd15
Function at 0x41d55f
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
xor eax, eax
push esi
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
mov esi, 0x100
push esi
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
test eax, eax
je 0x41d5d1
push 3
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x14]
push 4
push eax
call fcn.004215a3
add esp, 0x10
xor eax, eax
mov word [ebp - 0xe], ax
push esi
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationW]
mov eax, dword [ebp - 4]
pop esi
leave
ret

Function at 0x41d5d4
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd84
push esi
push edi
lea eax, [ebp - 0x210]
call fcn.0040e41f
mov eax, dword [ebp + 8]
call fcn.0040bbcd
lea eax, [ebp - 0x210]
push eax
call fcn.0041d4ce
pop ecx
movzx eax, al
test eax, eax
je 0x41d614
lea edi, [ebp - 0x210]
mov esi, dword [ebp + 8]
call fcn.0041d94a
lea eax, [ebp - 0x210]
push eax
call fcn.0041d515
pop ecx
movzx eax, al
test eax, eax
je 0x41d636
lea edi, [ebp - 0x210]
mov esi, dword [ebp + 8]
call fcn.0041d94a
call fcn.0041d55f
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
je 0x41d670
push dword [ebp - 0x214]
push 0x43a764
lea eax, [ebp - 0x210]
call fcn.0040179f
pop ecx
pop ecx
lea edi, [ebp - 0x210]
mov esi, dword [ebp + 8]
call fcn.0041d94a
mov eax, dword [ebp + 8]
call fcn.0040ada0
movzx eax, al
test eax, eax
jne 0x41d68f
lea eax, [ebp - 0x210]
call fcn.0040e410
jmp 0x41d735
and dword [ebp - 0x238], 0
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x234]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemInfo]
movzx eax, word [ebp - 0x218]
test eax, eax
je 0x41d704
movzx eax, word [ebp - 0x216]
test eax, eax
je 0x41d704
movzx eax, word [ebp - 0x216]
push eax
movzx eax, word [ebp - 0x218]
push eax
push str._u._u
lea eax, [ebp - 0x210]
call fcn.0040179f
add esp, 0xc
lea edi, [ebp - 0x210]
mov esi, dword [ebp + 8]
call fcn.0041d94a
lea eax, [ebp - 0x210]
call fcn.0040e410
jmp 0x41d735
call fcn.00419417
push eax
push 0x43a764
lea eax, [ebp - 0x210]
call fcn.0040179f
pop ecx
pop ecx
lea edi, [ebp - 0x210]
mov esi, dword [ebp + 8]
call fcn.0041d94a
lea eax, [ebp - 0x210]
call fcn.0040e410
pop edi
pop esi
leave
ret
Function at 0x41d98a
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x334
push ebx
push esi
push edi
push 0x118
mov edi, eax
lea eax, [ebp - 0x11c]
push 0
push eax
mov esi, ecx
call fcn.004237a0
add esp, 0xc
lea eax, [ebp - 0x330]
call fcn.0040e41f
mov eax, dword [esi + 4]
and dword [esi + 8], 0
test eax, eax
je 0x41d9cb
xor ecx, ecx
mov word [eax], cx
mov ebx, dword [sym.imp.KERNEL32.DLL_GetVersionExW]
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x11c
call ebx
test eax, eax
jne 0x41da06
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x114
call ebx
test eax, eax
jne 0x41da06
xor al, al
jmp 0x41db41
mov edx, dword [ebp - 0x118]
mov ecx, dword [ebp - 0x11c]
test edi, edi
je 0x41da1f
mov eax, ecx
imul eax, eax, 0x64
add eax, edx
mov dword [edi], eax
mov eax, dword [ebp - 0x110]
dec eax
je 0x41db23
dec eax
je 0x41da39
push str.Microsoft_Win32s
jmp 0x41db3a
cmp ecx, 4
ja 0x41da45
push str.Microsoft_Windows_NT
jmp 0x41da87
cmp ecx, 5
jne 0x41da6a
mov eax, edx
sub eax, 0
je 0x41da63
dec eax
je 0x41da5c
push str.Windows_2003
dec eax
jmp 0x41da87
push str.Windows_XP
jmp 0x41da87
push str.Windows_2000
jmp 0x41da87
cmp ecx, 6
jne 0x41da82
cmp edx, 1
jae 0x41da7b
push str.Windows_Vista
jmp 0x41da87
push str.Windows_7
jmp 0x41da87
push str.Windows
call fcn.0040adba
cmp byte [ebp - 6], 1
jne 0x41da9c
push str._Professional
call fcn.0041631e
cmp byte [ebp - 6], 3
jne 0x41daac
push str._Server
call fcn.0041631e
cmp byte [ebp - 6], 2
jne 0x41dabc
push str._Domain
call fcn.0041631e
cmp word [ebp - 0x10c], 0
movzx eax, word [ebp - 0x114]
push eax
jne 0x41dae2
push str.__Build__d_
lea eax, [ebp - 0x330]
call fcn.0040179f
pop ecx
pop ecx
jmp 0x41dafc
lea eax, [ebp - 0x10c]
push eax
push str.__s__Build__d_
lea eax, [ebp - 0x330]
call fcn.0040179f
add esp, 0xc
lea edi, [ebp - 0x330]
call fcn.0041d94a
mov eax, edi
call fcn.0041d8df
test al, al
je 0x41db3f
push str._on
call fcn.0041631e
call fcn.0041d94a
jmp 0x41db3f
cmp ecx, 4
ja 0x41db35
jne 0x41db2e
test edx, edx
ja 0x41db35
push str.Microsoft_Windows_95
jmp 0x41db3a
push str.Microsoft_Windows_98
call fcn.0041631e
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41fcd6
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
push ebx
push esi
xor esi, esi
cmp dword [edi + 0x86c], esi
je 0x41fd96
cmp dword [edi + 0x870], 1
jl 0x41fd96
push 0x88
lea eax, [ebp - 0x94]
push esi
push eax
call fcn.004237a0
add esp, 0xc
push dword [ebp + 8]
lea eax, [ebp - 0x8c]
push 0x3f
push eax
mov dword [ebp - 0x98], esi
call fcn.0040a93d
add esp, 0xc
push dword [edi + 0x864]
lea eax, [ebp - 0x98]
push eax
mov esi, edi
call fcn.0042068c
mov ebx, dword [sym.imp.KERNEL32.DLL_GetTickCount]
call ebx
mov esi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, edi
call fcn.0041fd9e
test al, al
je 0x41fd96
cmp dword [edi + 0x828], 5
mov eax, str._files_mt5_cdn.txt
je 0x41fd6b
mov eax, str._files_mt4_cdn.txt
push eax
lea ecx, [edi + 4]
call fcn.0041ca88
cmp eax, 0xc8
jne 0x41fd96
call ebx
sub eax, dword [ebp - 4]
mov ecx, esi
lea ecx, [ecx + 0x84]
mov dword [ecx], eax
jne 0x41fd92
mov dword [ecx], 1
mov al, 1
jmp 0x41fd98
xor al, al
pop esi
pop ebx
leave
ret 4

Function at 0x4207e5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
cmp byte [ebp + 0x10], 0
push esi
push edi
je 0x420838
mov ecx, dword [ebx + 0x878]
cmp ecx, 0x2b1
jg 0x42080b
xor al, al
jmp 0x420963
mov eax, dword [ebx + 0x874]
add ecx, 0xfffffd4f
push ecx
lea ecx, [eax + 0x2b1]
push ecx
push dword [ebx + 0x87c]
push eax
call fcn.00423585
add esp, 0x10
add dword [ebx + 0x878], 0xfffffd4f
push dword [ebx + 0x878]
mov ecx, dword [ebx + 0x874]
call fcn.00420969
mov byte [ebp - 5], al
test al, al
nop
nop
nop
nop
nop
nop
push dword [ebx + 0x874]
mov edi, dword [ebx + 0x878]
mov esi, dword [ebp + 8]
push 5
pop eax
call fcn.0041bcc5
mov byte [ebp - 5], al
test al, al
nop
nop
nop
nop
nop
nop
cmp byte [ebp + 0x10], 0
nop
nop
nop
nop
nop
nop
lea eax, [ebp - 0x434]
call fcn.00406448
xor eax, eax
push 0x206
mov word [ebp - 0x21c], ax
xor esi, esi
lea eax, [ebp - 0x21a]
push esi
push eax
call fcn.004237a0
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push esi
push esi
push 0x23
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jge 0x4208c8
mov al, 1
jmp 0x420963
lea eax, [ebp - 0x21c]
push eax
push str._sMetaQuotesWebInstall
lea eax, [ebp - 0x434]
call fcn.0040179f
lea eax, [ebp - 0x434]
call fcn.0040d8f5
push dword [ebp + 0xc]
lea eax, [ebp - 0x21c]
push eax
or edi, 0xffffffff
push str._sMetaQuotesWebInstall_s
lea eax, [ebp - 0x434]
mov dword [ebp - 0x10], 0x437584
mov dword [ebp - 0xc], edi
call fcn.0040179f
add esp, 0x14
push 2
push 3
push 0x40000000
push dword [ebp - 0x430]
lea eax, [ebp - 0x10]
call fcn.00401877
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
test al, al
je 0x420956
push dword [ebx + 0x878]
lea eax, [ebp - 0x10]
push dword [ebx + 0x874]
call fcn.0040a8d5
cmp dword [ebp - 0xc], edi
je 0x420960
push dword [ebp - 0xc]
call esi
mov dword [ebp - 0xc], edi
cmp dword [ebp - 0xc], edi
je 0x420960
push dword [ebp - 0xc]
call esi
mov al, byte [ebp - 5]
pop edi
pop esi
leave
ret 0xc
Function at 0x420a8b
Capabilities:
Get proxy
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, eax
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x420aba
xor al, al
jmp 0x420b3b
mov eax, dword [esi + 0xc]
add eax, eax
mov dword [ebp - 8], eax
mov eax, dword [esi + 4]
lea ecx, [ebp - 8]
push ecx
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push str.ProxyServer
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
test eax, eax
je 0x420aed
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x420ab3
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00406409
cmp dword [ebp - 0xc], 1
jne 0x420ab3
push 0x43ae20
call fcn.004161f4
test eax, eax
jl 0x420b16
lea edx, [eax + 1]
mov eax, esi
call fcn.00412a49
push 0x43ae24
call fcn.004161f4
test eax, eax
jl 0x420b39
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x420b39
cmp eax, dword [esi + 8]
jae 0x420b39
xor edx, edx
mov dword [esi + 8], eax
mov word [ecx + eax*2], dx
mov al, 1
pop esi
leave
ret

Function at 0x420b5f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0
push esi
mov esi, eax
jne 0x420b77
xor eax, eax
pop esi
leave
ret 4
push 3
push 3
push SysReAllocStringLen
push dword [ebp + 8]
call fcn.00401877
test al, al
je 0x420b70
push esi
call fcn.0040e446
mov dword [edi], eax
test eax, eax
jne 0x420b9f
call fcn.0040197e
jmp 0x420b70
push ebx
add eax, 0x10
push 0x4407c8
push eax
call fcn.00421e0b
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
jne 0x420bc2
xor ebx, ebx
call fcn.0040197e
mov eax, ebx
pop ebx
jmp 0x420b72
mov eax, dword [edi]
test eax, eax
jbe 0x420bb8
push 0
lea ecx, [ebp - 4]
push ecx
push eax
push ebx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x420bb8
push ebx
call fcn.00421976
pop ecx
jmp 0x420bb6
Function at 0x420be6
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 8]
push ebx
xor ebx, ebx
push edi
xor edi, edi
xor eax, eax
mov dword [ebp - 8], ebx
cmp ecx, ebx
je 0x420cec
cmp esi, ebx
je 0x420cec
mov byte [esi], bl
cmp dword [ebp + 0xc], ebx
jbe 0x420ce6
jmp 0x420c19
mov ecx, dword [ebp + 8]
cmp eax, 0x3f8
jae 0x420ce6
mov dl, byte [edi + ecx]
inc edi
cmp edi, dword [ebp + 0xc]
jb 0x420c3a
mov byte [ebp - 2], 0
mov dword [ebp - 8], 2
jmp 0x420c56
mov bl, byte [edi + ecx]
inc edi
mov byte [ebp - 2], bl
cmp edi, dword [ebp + 0xc]
jae 0x420c4f
mov cl, byte [edi + ecx]
mov byte [ebp - 1], cl
inc edi
jmp 0x420c5a
mov dword [ebp - 8], 1
mov byte [ebp - 1], 0
mov cl, byte [ebp - 2]
mov bl, byte [ebp - 1]
shr bl, 6
and cl, 0xf
shl cl, 2
or cl, bl
movzx ebx, dl
shr ebx, 2
mov bl, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
and dl, 3
mov byte [eax + esi], bl
movzx ebx, byte [ebp - 2]
shl dl, 4
movzx edx, dl
shr ebx, 4
or edx, ebx
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc eax
mov byte [eax + esi], dl
mov edx, dword [ebp - 8]
xor ebx, ebx
inc eax
sub edx, ebx
je 0x420cbf
dec edx
je 0x420cb1
dec edx
jne 0x420cdd
mov byte [eax + esi], 0x3d
inc eax
mov byte [eax + esi], 0x3d
jmp 0x420cdc
movzx ecx, cl
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi], cl
jmp 0x420caa
movzx ecx, cl
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi], cl
movzx ecx, byte [ebp - 1]
inc eax
and ecx, 0x3f
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi], cl
inc eax
cmp edi, dword [ebp + 0xc]
jb 0x420c16
mov byte [eax + esi], bl
inc eax
jmp 0x420cee
xor eax, eax
pop edi
pop ebx
leave
ret

Function at 0x420ec7
Capabilities:
Terminate thread

Disassembly:
push edi
push 0
lea edi, [esi + 4]
push edi
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
cmp dword [esi], 0
je 0x420f03
push 0x1388
mov eax, esi
call fcn.00416589
test al, al
jne 0x420f03
mov eax, dword [esi]
test eax, eax
je 0x420f03
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
and dword [esi], 0
call fcn.0041f171
pop edi
ret
Function at 0x421455
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x4407ac], 0
push esi
jne 0x4213c8
call fcn.004212ee
test eax, eax
je 0x42140b
mov eax, dword [0x4407ac]
cmp eax, 1
jne 0x4213e9
push 0xd
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
test eax, eax
je 0x42140b
pop esi
ret
push eax
call dword [0x4407b4]
test eax, eax
jne 0x421453
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x42140f
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x4407ac]
call dword [0x4407b4]
mov edi, eax
test edi, edi
je 0x421434
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_VirtualFree]
jmp 0x421450
mov edi, esi
add esi, 0xff0
push edi
push dword [0x4407ac]
call dword [0x4407b0]
add edi, 0x10
cmp edi, esi
jb 0x42143c
mov eax, edi
pop edi
pop esi
ret
jmp 0x4213b5

Function at 0x427d00
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43e788]
jne 0x427d0a
repz ret
jmp fcn.0042e34c

Function at 0x42c35b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00423a7e
and dword [ebp - 4], 0
cmp dword [0x440fe4], 0
mov ebx, eax
jne 0x42c40c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x42c4bd
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x42c4bd
push eax
call fcn.00423a0c
mov dword [esp], 0x432f84
push edi
mov dword [0x440fe4], eax
call esi
push eax
call fcn.00423a0c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x440fe8], eax
call esi
push eax
call fcn.00423a0c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x440fec], eax
call esi
push eax
call fcn.00423a0c
pop ecx
mov dword [0x440ff4], eax
test eax, eax
je 0x42c40c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00423a0c
pop ecx
mov dword [0x440ff0], eax
mov eax, dword [0x440ff0]
cmp eax, ebx
je 0x42c464
cmp dword [0x440ff4], ebx
je 0x42c464
push eax
call fcn.00423a87
push dword [0x440ff4]
mov esi, eax
call fcn.00423a87
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x42c464
test edi, edi
je 0x42c464
call esi
test eax, eax
je 0x42c45b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x42c45b
test byte [ebp - 0xc], 1
jne 0x42c464
or dword [ebp + 0x10], 0x200000
jmp 0x42c49d
mov eax, dword [0x440fe8]
cmp eax, ebx
je 0x42c49d
push eax
call fcn.00423a87
pop ecx
test eax, eax
je 0x42c49d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x42c49d
mov eax, dword [0x440fec]
cmp eax, ebx
je 0x42c49d
push eax
call fcn.00423a87
pop ecx
test eax, eax
je 0x42c49d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x440fe4]
call fcn.00423a87
pop ecx
test eax, eax
je 0x42c4bd
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x42c4bf
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40367c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 4]
mov edx, dword [eax]
mov dword [0x51239c], edx
mov ecx, dword [eax]
test ecx, ecx
jb 0x40f52e
je 0x4036a5
jne 0x40369e
test ebx, ebp
lodsb al, byte [esi]
dec eax
mov dword [ebp - 8], 1
shl ah, 0x20
push eax
call edi
mov eax, dword [ebp - 8]
test eax, eax
jb 0x43ee94
mov di, di
jne 0x43b959
shl ebp, 0x20
je 0x4036c8
sbb esp, dword [eax - 0x3e990ab2]
out dx, eax
inc eax

Function at 0x40aa1e
Capabilities:
Check os version
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 4]
mov byte [esi + 0xba], bl
shr cl, 0x40
mov byte [esi + 0xbb], dl
xchg ebp, edx
shr ebx, 0x40
xchg edx, ebp
mov word [esi + 0xbc], di
mov cx, cx
call fcn.0042575f
mov cl, byte [ebp + 0xc]
mov di, di
shl ch, 0x20
xchg bl, ch
mov bx, bx
xchg ch, bl
mov dx, word [ebp + 0x10]
jne 0x42bca5
je 0x40aa66
mov cl, 0xe8
jg 0x40aa76
je 0x42bca5
test byte [ecx], bh
adc al, byte [edx]
add byte [esp + esi*8], dh
xor al, 0xf4
adc cl, dh
inc edx
add byte [eax], al
inc eax
add byte [eax], al
sub byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ecx], ah
cmp byte [eax + eax], 0
add byte [ecx], al
popal
add byte [eax + 0x2c], al
add byte [ecx], ah
add byte [eax], al
push cs
add byte [eax], al
add byte [esi], dh
sub al, 0x42
add byte [edx], bl
daa
inc edx
add byte [eax + eax], bh
add byte [eax], al
xchg edx, eax
stc
inc eax
add byte [esi + 0x69], dh
inc ebx
add al, bl
pop edi
push eax
mov eax, eax
jne 0x43cac8

Function at 0x40bc9a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dl, dl
push ebp
mov ebp, esp
mov cl, byte [ebp + 8]
xor eax, eax
jb 0x434328
cmp cl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__n_r]
mov cl, cl
je 0x438714
shl ah, 0x20
jne 0x40bcc3
movsb byte es:[edi], byte [esi]
sbb al, 0x6b
invalid
inc eax
jne 0x4386f5
je 0x40bcd1
aas
cmp dword [esp + ebp*2], edx
iretd
je 0x4386f5
add eax, 0x113ae831
add eax, dword [eax]
lea ebp, [ebp]
mov eax, 1
jmp 0x41f6da
pop ebp
shr edx, 0x40
ret
cmp eax, 0x43
jb 0x40bcaa
jae 0x438708
scasd eax, dword es:[edi]
add ch, bl
mov eax, dword [0xc031c598]
xor eax, eax
jb 0x434330
pop ebp
ret
jne 0x4143be
je 0x438720
cpuid
mov edx, 0x98840fc3
mov esp, 0x2405fffd
je 0x4143be
add eax, 0x1c3f624

Function at 0x40c0c6
Capabilities:
Check os version
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
add esi, 0
jno 0x40a871
xchg ebp, esi
pop esp
lea esp, [esp + 4]
add dx, 0
cmp al, 2
jne 0x40a866
xchg ebp, edx
shr ecx, 0x40
xchg edx, ebp
je 0x40c0e5
ret 0xdf65
shl bh, 0x20
mov ebp, ebp
mov ax, dx
clc
add edx, 0
add ecx, 0x47
shr ax, 0xe
shr ah, 0x40
xchg edx, ebx
xchg ebx, edx
shl edx, 2
or eax, edx
jb 0x4334c3
stc
jb 0x40c118
popal
int3
jb 0x435006
sub byte [edx - 0x73], 0x64
and al, 4
push ds
call 0x1030be2f
lea ecx, [0x7c000000]
add al, 0xa0
add byte [ecx + 0x68], dl
lea esi, [esi + 8]
jmp dword [esi]