joyce8/EMBER2024-capa huggingface dataset:
Function at 0x510f20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56b403
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x5ba278]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x8c], 0
mov dword [ebx], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 0
push 0x201
push dword [0x5bb960]
lea ecx, [ebp - 0x8c]
mov dword [ebp - 4], 0
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00510e70
mov edi, dword [ebp - 0x8c]
test eax, eax
jne 0x511101
push 0x64
lea eax, [ebp - 0x74]
push 0
push eax
call fcn.00513be0
add esp, 0xc
mov dword [ebp - 0x78], 0x64
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0
push 0x58baa8
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x511101
mov eax, dword [ebp - 0x7c]
cmp eax, 1
je 0x510ff5
cmp eax, 2
jne 0x511101
mov ecx, dword [ebp - 0x78]
test ecx, ecx
je 0x511016
test cl, 1
jne 0x511101
mov eax, ecx
shr eax, 1
cmp word [ebp + eax*2 - 0x76], 0
je 0x51101c
jmp 0x511101
xor eax, eax
mov word [ebp - 0x74], ax
shr ecx, 1
cmp ecx, 0x2d
jne 0x511101
call fcn.00413510
mov ecx, eax
test ecx, ecx
je 0x51112c
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x78]
call fcn.0050f480
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x7c], 0
push eax
lea eax, [ebp - 0x20]
push 0x58bab0
push eax
call fcn.00511440
mov esi, dword [ebp - 0x78]
push 0x2a
push esi
call fcn.0050f810
movzx eax, al
add esp, 0x14
cmp dword [ebp - 0x7c], eax
jne 0x5110e5
lea edx, [ebp - 0x74]
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x511086
sub edx, ecx
lea eax, [ebp - 0x74]
mov ecx, dword [ebp - 0x80]
sar edx, 1
push edx
push eax
call fcn.004185c0
push dword [0x5bb968]
lea eax, [ebp - 0x74]
push dword [0x5bb964]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x5110c2
mov dword [ebx], 1
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x5110de
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, 1
jmp 0x511103
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x511101
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
xor esi, esi
test edi, edi
je 0x51110e
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00469a1d
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.0040bcc0
int3
Function at 0x511140
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56b438
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x5ba278]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
push 0x202
push dword [0x5bb960]
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00510e70
test eax, eax
je 0x511268
mov esi, dword [ebp - 0x18]
mov edi, dword [0x5bb960]
mov dword [ebp - 0x10], 0
test esi, esi
je 0x511213
cmp dword [esi], 0
je 0x511206
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x5111d3
mov eax, 1
jmp 0x511234
push str.RegCreateKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x51120c
push 0
push dword [esi]
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0x20206
push 0
push 0
push 0
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call eax
jmp 0x511234
cmp dword [esi + 4], 0
jne 0x511213
mov eax, 1
jmp 0x511234
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x20206
push 0
push 0
push 0
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x51125e
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x511246
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], 0x200
test eax, eax
je 0x51126b
xor ebx, ebx
jmp 0x51130f
mov esi, dword [ebp - 0x20]
xor ebx, ebx
jmp 0x51130f
mov esi, dword [ebp - 0x20]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
je 0x5112c8
mov ecx, dword [ebx]
test ecx, ecx
je 0x51132e
push ecx
push eax
call fcn.0051ec19
add esp, 8
test eax, eax
je 0x5112c8
mov edx, dword [edi]
test edx, edx
je 0x5112c8
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5112a0
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push str.m2_old
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebx]
test edx, edx
jne 0x5112d3
lea eax, [edx + 0xd]
jmp 0x511308
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5112e0
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push 0x58baa8
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ebx, ebx
test eax, eax
sete bl
test esi, esi
je 0x51131a
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.0040bcc0
int3
Function at 0x5129c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x512a31
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x5129ff
cmp eax, 2
jne 0x512a1b
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x512a2b
test ecx, ecx
je 0x512a26
test cl, 1
jne 0x512a1b
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x512a2b
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x53665b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005364da

Function at 0x539410
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005390d0

Function at 0x54413c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x1000b6d5
Capabilities:
Get common file path

Disassembly:
sub esp, 0x108
mov eax, dword [0x1001ff00]
xor eax, esp
mov dword [esp + 0x104], eax
push ebp
push esi
push edi
mov edi, dword [esp + 0x118]
lea eax, [esp + 0xc]
mov ebp, 0x104
xor esi, esi
push ebp
push eax
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1000b738
lea eax, [esp + 0xc]
push 0x10017e60
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
lea eax, [esp + 0x14]
push edi
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
add esp, 0x10
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x1000b772
push ebp
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x1000b772
lea eax, [esp + 0xc]
push 0x10017e60
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
lea eax, [esp + 0x14]
push edi
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
add esp, 0x10
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov esi, eax
mov ecx, dword [esp + 0x110]
mov eax, esi
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.10014785
add esp, 0x108
ret

Function at 0x1000b9b2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x1000b9c1
pop dword [ebp - 0x28]
mov eax, 0xd3ba2b
sub eax, 0xf0d3006a
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0xfe4192fe
add dword [ebp - 0x38], 0x5010b24d
mov dword [ebp - 0x34], 0x274cd03c
add dword [ebp - 0x34], 0xae67c09
mov dword [ebp - 0x30], 0xc19b8e66
sub dword [ebp - 0x30], 0x754f4a38
mov dword [ebp - 0x2c], 0x736c0837
add dword [ebp - 0x2c], 0x8c93f7c9
lea eax, [ebp - 0x38]
push eax
mov eax, 0xfadceba4
sub eax, 0xeadb8b44
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x79b2d996
sub dword [ebp - 0x38], 0x5407040
mov dword [ebp - 0x34], 0xc8c19c7b
sub dword [ebp - 0x34], 0x87553b06
mov dword [ebp - 0x30], 0xf8e2c115
sub dword [ebp - 0x30], 0x957354a9
mov dword [ebp - 0x2c], 0x88dad817
sub dword [ebp - 0x2c], 0x88dad817
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x1fffe351
add eax, 0xf0017d13
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3a6e8
push 0
call eax
mov ecx, 0x4152f159
sub ecx, 0x41529df0
xor edx, edx
add edx, eax
mov ebx, 0x5e5126d
add ebx, 0xa1d2393
add ebx, dword [ebp - 0x28]
mov esi, 0xf613d723
sub esi, 0x3d26cdfa
xor dword [ebp - 0x14], 0xe0a8d7c1
mov edi, dword [ebx]
sub dword [ebp - 0xc], 0x8ce73dd1
add edi, esi
add dword [ebp - 4], 0xd99e1084
mov dword [edx], edi
sub dword [ebp - 0x24], ecx
add edx, 4
add ebx, 0x6e50712c
sub ebx, 0x6e507128
loop 0x1000bae5
add eax, 0x14077
mov ebx, eax
add eax, 0x6dfa278
sub eax, 0x6dfa273
mov ecx, 0x10000000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x4045dc
Capabilities:
Hide graphical window

Disassembly:
push 0x98
mov eax, 0x4b9e1c
call fcn.00431d3b
mov ebx, ecx
push 0
call fcn.0040501a
push 1
mov ecx, ebx
call fcn.0040556f
lea eax, [ebp - 0x1c]
push 0x198
push eax
call fcn.0040394b
pop ecx
pop ecx
push dword [eax]
push 2
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push dword [ebp - 0x1c]
call fcn.00431e17
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
pop ecx
push 1
push 1
push 0xf4
push 2
push dword [ebx + 4]
call edi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x1bc
push dword [ebx + 4]
call edi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push eax
call esi
push 0x1be
push dword [ebx + 4]
call edi
push 0
push eax
call esi
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x38]
lea ecx, [ebp - 0xa4]
call fcn.00403bb7
and dword [ebp - 4], 0
lea esi, [ebx + 0x280]
push esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [ebx + 0x1d4]
lea eax, [ebx + 0x1e0]
push eax
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 1
call fcn.00403d4f
push esi
mov byte [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0x94], 0
je 0x4046ea
cmp dword [ebp - 0xa0], 0
mov byte [ebx + 0x29b], 1
jne 0x4046da
push str.PuddingZip
lea ecx, [ebp - 0xa4]
call fcn.0040e6f4
push 0x10
push dword [ebp - 0xa4]
push dword [ebp - 0x98]
jmp 0x404714
test edi, edi
jne 0x404721
mov byte [ebx + 0x29b], 1
cmp dword [ebp - 0x70], edi
je 0x40471d
cmp dword [ebp - 0x7c], edi
jne 0x40470c
push str.PuddingZip
lea ecx, [ebp - 0x80]
call fcn.0040e6f4
push 0
push dword [ebp - 0x80]
push dword [ebp - 0x74]
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
test edi, edi
je 0x40473a
cmp byte [ebx + 0x136], 0
jne 0x40473a
mov ecx, ebx
mov byte [ebx + 0x135], 1
call fcn.0040542a
jmp 0x404745
push 0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_EndDialog]
lea ecx, [ebp - 0x80]
call fcn.00402b96
lea ecx, [ebp - 0xa4]
call fcn.00402b96
mov al, 1
call fcn.00431d04
ret
Function at 0x406009
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0x44
mov eax, 0x4b9f6a
call fcn.00431da6
mov edi, ecx
mov dword [ebp - 0x14], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x18], eax
call fcn.0040e66f
and dword [ebp - 4], 0
mov dword [ebp - 0x1c], edi
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 1
call fcn.0040e66f
mov eax, dword [edi]
mov ecx, edi
mov byte [ebp - 4], 3
call dword [eax + 0x3c]
mov dword [edi + 0x3b8], eax
jmp 0x406065
mov eax, dword [edi + 0x3b8]
mov dword [ebp - 4], 2
cmp eax, 0x80004004
je 0x4060b5
cmp dword [ebp - 0x34], 0
jne 0x4060b5
test eax, eax
je 0x4060b5
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.00405f97
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 6
call fcn.0040e693
push dword [ebp - 0x50]
mov byte [ebp - 4], 2
call fcn.00431e17
pop ecx
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x38]
call fcn.0040e693
lea eax, [edi + 0x33c]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.00405eb6
xor esi, esi
pop ecx
pop ecx
cmp dword [edi + 0x324], esi
jbe 0x4060f3
cmp esi, 0x20
jae 0x4060f3
mov eax, dword [edi + 0x320]
push dword [eax + esi*4]
lea eax, [ebp - 0x38]
push eax
call fcn.00405eb6
inc esi
pop ecx
pop ecx
cmp esi, dword [edi + 0x324]
jb 0x4060d1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x18]
cmp eax, 0x3e8
ja 0x40611d
cmp byte [edi + 0x318], 0
jne 0x406112
cmp dword [ebp - 0x40], 0
je 0x40611d
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea esi, [edi + 0x280]
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [edi + 0x378]
mov byte [ebp - 4], 7
push eax
lea ecx, [edi + 0x1e0]
call fcn.00405ee0
mov ecx, edi
call fcn.00402d7e
cmp dword [ebp - 0x34], 0
jne 0x4061f3
cmp dword [edi + 0x364], 0
je 0x4062b2
lea eax, [edi + 0x354]
push eax
lea ecx, [edi + 0x204]
call fcn.00403d80
jmp 0x4062b2
lea ecx, [ebp - 0x50]
call fcn.0040e66f
xor ebx, ebx
mov byte [ebp - 4], 8
cmp dword [edi + 0x1d4], ebx
jbe 0x406223
mov eax, dword [edi + 0x1d0]
lea ecx, [ebp - 0x50]
push dword [eax + ebx*4]
call fcn.0040e837
inc ebx
cmp ebx, dword [edi + 0x1d4]
jb 0x406209
cmp dword [ebp - 0x4c], 0
lea ebx, [edi + 0x1ec]
mov ecx, ebx
lea eax, [ebp - 0x44]
je 0x406237
lea eax, [ebp - 0x50]
push eax
call fcn.0040e693
cmp dword [edi + 0x324], 0
jbe 0x406282
lea eax, [edi + 0x33c]
mov ecx, ebx
push eax
call fcn.0040e837
push 0x4c1c38
mov ecx, ebx
call fcn.0040e8c4
mov eax, dword [edi + 0x320]
mov ecx, ebx
push dword [eax]
call fcn.0040e837
mov eax, dword [edi + 0x320]
lea ecx, [edi + 0x1f8]
push dword [eax]
call fcn.0040e693
cmp dword [edi + 0x1f0], 0
jne 0x406296
lea eax, [ebp - 0x38]
mov ecx, ebx
push eax
call fcn.0040e693
cmp dword [edi + 0x3b8], 0
jne 0x4062a9
mov dword [edi + 0x3b8], 0x80004005
push dword [ebp - 0x50]
call fcn.00431e17
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [ebp - 0x38]
call fcn.00431e17
pop ecx
mov eax, dword [edi]
mov ecx, edi
mov byte [ebp - 4], 9
call dword [eax + 0x34]
push dword [ebp - 0x44]
call fcn.00431e17
pop ecx
call fcn.00431d04
ret
Function at 0x40637c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x228
mov eax, 0x4b9f90
call fcn.00431d6f
mov edi, ecx
mov dword [ebp - 0x224], edi
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x228], eax
call fcn.004062dc
push 0x208
xor ebx, ebx
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.00476e90
push esi
lea eax, [ebp - 0x218]
push str.LANG__s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea eax, [ebp - 0x218]
push 0x4c1c60
push eax
push dword [0x4f3b4c]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x4063f3
xor al, al
jmp 0x4064df
push esi
push dword [0x4f3b4c]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push dword [0x4f3b4c]
mov dword [ebp - 0x220], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
cmp dword [ebp - 0x220], ebx
je 0x4063ec
cmp esi, 0x100000
ja 0x4063ec
lea ecx, [ebp - 0x234]
call fcn.0040e4a7
push esi
lea ecx, [ebp - 0x234]
mov dword [ebp - 4], ebx
call fcn.00406358
push esi
push dword [ebp - 0x220]
mov dword [ebp - 0x21c], eax
push eax
call fcn.00475f50
mov edx, dword [ebp - 0x21c]
add esp, 0xc
mov eax, edx
mov ecx, ebx
test esi, esi
je 0x40648c
mov edi, eax
mov dl, byte [ecx + edi]
test dl, dl
je 0x406480
cmp dl, 0xd
je 0x40647b
mov byte [eax], dl
inc eax
inc ecx
cmp ecx, esi
jb 0x40646c
mov edi, dword [ebp - 0x224]
mov edx, dword [ebp - 0x21c]
mov byte [eax], bl
mov ecx, edi
sub eax, edx
mov dword [ebp - 0x230], eax
lea eax, [ebp - 0x234]
push eax
call fcn.004064e7
test al, al
je 0x4064ca
push ebx
mov ecx, edi
call fcn.00406328
test eax, eax
je 0x4064ca
push dword [ebp - 0x228]
push eax
call fcn.0040f15e
pop ecx
pop ecx
test al, al
je 0x4064ca
mov bl, 1
jmp 0x4064d1
mov ecx, edi
call fcn.004062dc
push dword [ebp - 0x234]
call fcn.00431e17
pop ecx
mov al, bl
call fcn.00431d19
ret 8
Function at 0x406cd3
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
xor esi, esi
lea ecx, [edi + 0x1c]
shr edi, 2
mov eax, edi
mov dword [ebp - 0xc], ecx
shr eax, 1
add eax, 3
mov dword [ebx], eax
add ebx, 0x10
test edi, edi
je 0x406d09
mov eax, dword [edx]
lea edx, [edx + 4]
mov dword [ebx + esi*4], eax
inc esi
cmp esi, edi
jb 0x406cfc
cmp esi, ecx
jae 0x406dec
mov eax, esi
sub eax, edi
lea eax, [ebx + eax*4]
mov dword [ebp - 4], eax
xor edx, edx
mov ecx, dword [ebx + esi*4 - 4]
mov eax, esi
mov dword [ebp + 8], ecx
div edi
mov dword [ebp - 8], eax
test edx, edx
jne 0x406d82
movzx ecx, cl
movzx edx, byte [ecx + str.cw]
mov ecx, dword [ebp + 8]
shr ecx, 0x18
shl edx, 8
movzx eax, byte [ecx + str.cw]
mov ecx, dword [ebp + 8]
or edx, eax
mov eax, ecx
shl edx, 8
shr eax, 0x10
movzx eax, al
shr ecx, 8
movzx eax, byte [eax + str.cw]
or edx, eax
movzx eax, cl
shl edx, 8
movzx ecx, byte [eax + str.cw]
mov eax, dword [ebp - 8]
movzx eax, byte [eax + 0x4c1d88]
xor ecx, eax
or ecx, edx
jmp 0x406dd2
cmp edi, 6
jbe 0x406dd2
cmp edx, 4
jne 0x406dd2
mov edx, dword [ebp + 8]
mov eax, ecx
shr eax, 0x10
movzx eax, al
movzx ecx, byte [eax + str.cw]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax + str.cw]
shl eax, 8
or ecx, eax
mov eax, edx
shr eax, 8
movzx eax, al
shl ecx, 8
movzx eax, byte [eax + str.cw]
or ecx, eax
movzx eax, dl
shl ecx, 8
movzx eax, byte [eax + str.cw]
or ecx, eax
mov edx, dword [ebp - 4]
mov eax, dword [edx]
add edx, 4
xor eax, ecx
mov dword [ebp - 4], edx
mov dword [ebx + esi*4], eax
inc esi
cmp esi, dword [ebp - 0xc]
jb 0x406d1b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40821d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
push edi
xor edi, edi
mov edx, dword [edx]
and edx, 7
cmp eax, 5
jae 0x40823a
xor eax, eax
jmp 0x408357
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [eax - 4]
add ecx, ebx
push esi
mov dword [ebp + 0xc], ecx
lea esi, [edi + ebx]
jmp 0x408255
mov al, byte [esi]
and al, 0xfe
cmp al, 0xe8
je 0x408259
inc esi
cmp esi, ecx
jb 0x40824c
mov ecx, esi
sub ecx, edi
mov edi, esi
sub ecx, ebx
sub edi, ebx
cmp esi, dword [ebp + 0xc]
jae 0x408344
cmp ecx, 2
jbe 0x4082af
xor edx, edx
movzx ebx, byte [esi + 4]
lea eax, [ebx + 1]
test al, 0xfe
jne 0x408335
movzx eax, byte [esi + 3]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 2]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
mov eax, dword [ebp + 0x10]
add eax, 5
add eax, edi
cmp dword [ebp + 0x18], 0
je 0x4082db
add ebx, eax
jmp 0x4082dd
shr edx, cl
test edx, edx
je 0x408273
cmp edx, 4
ja 0x4082cd
cmp edx, 3
je 0x4082cd
mov eax, edx
shr eax, 1
movzx eax, byte [eax + esi + 1]
inc eax
test al, 0xfe
jne 0x408273
or edx, 8
shr edx, 1
inc edi
mov ecx, dword [ebp + 0xc]
jmp 0x408247
sub ebx, eax
test edx, edx
je 0x408312
and edx, 6
mov eax, ebx
shl edx, 2
mov ecx, edx
shr eax, cl
inc eax
test al, 0xfe
jne 0x408310
mov eax, 0x100
shl eax, cl
dec eax
xor ebx, eax
mov eax, dword [ebp + 0x10]
add eax, 5
add eax, edi
cmp dword [ebp + 0x18], 0
je 0x40830e
add ebx, eax
jmp 0x408310
sub ebx, eax
xor edx, edx
mov eax, ebx
mov byte [esi + 1], bl
shr eax, 8
mov byte [esi + 2], al
mov eax, ebx
shr ebx, 0x18
shr eax, 0x10
and bl, 1
neg bl
mov byte [esi + 3], al
push 5
mov byte [esi + 4], bl
pop eax
jmp 0x40833d
or edx, 8
xor eax, eax
shr edx, 1
inc eax
mov ebx, dword [ebp + 8]
add edi, eax
jmp 0x4082d3
xor eax, eax
shr edx, cl
cmp ecx, 2
pop esi
cmova edx, eax
mov eax, dword [ebp + 0x14]
pop ebx
mov dword [eax], edx
mov eax, edi
pop edi
pop ebp
ret

Function at 0x408446
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x4ed290]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x118]
mov dword [ebp - 0x118], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4084a1
cmp dword [ebp - 0x114], 5
sbb eax, eax
add eax, 1
je 0x4084a1
lea eax, [ebp - 0x13c]
push eax
call fcn.0040859e
pop ecx
test eax, eax
je 0x4084a1
mov eax, dword [ebp - 0x124]
shr eax, 0x19
and eax, 1
jmp 0x4084a3
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00431cf3
mov esp, ebp
pop ebp
ret
Function at 0x40875a
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3e8
mov eax, dword [0x4ed290]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x3e8]
mov dword [ebp - 0x3e8], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40879a
cmp dword [ebp - 0x3e4], 6
jne 0x40879a
cmp dword [ebp - 0x3e0], 0
je 0x4087c4
push str.SetDefaultDllDirectories
push 0x4c1c68
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4087c4
push 0xc00
call eax
test eax, eax
jne 0x408859
push 0x106
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x408859
cmp eax, 0x104
ja 0x408859
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x5c
pop ecx
cmp word [ebp + eax*2 - 0x2d6], cx
je 0x408804
mov word [ebp + eax*2 - 0x2d4], cx
inc eax
cmp byte [0x4c1dd8], 0
push esi
mov esi, 0x4c1dd8
je 0x408858
push edi
lea edi, [ebp - 0x2d4]
lea edi, [edi + eax*2]
mov edx, edi
mov cl, byte [esi]
inc esi
movzx eax, cl
mov word [edx], ax
lea edx, [edx + 2]
test cl, cl
jne 0x40881f
push str..dll
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 8
push 0
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
cmp byte [esi], 0
jne 0x40881d
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00431cf3
mov esp, ebp
pop ebp
ret