joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49bb94
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x20
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [esp], edi
call fcn.004209f0
mov dword [ebp - 0xc], eax
test esi, esi
mov dword [ebp - 0x10], 0
je 0x49bbc3
mov dword [esp], esi
call fcn.004209f0
mov dword [ebp - 0x10], eax
mov dword [esp + 4], esi
mov dword [esp], edi
call sub.KERNEL32.dll_SetEnvironmentVariableA
sub esp, 8
test eax, eax
jne 0x49bbf2
test esi, esi
jne 0x49bbe6
call sub.KERNEL32.dll_GetLastError
cmp eax, 0xcb
je 0x49bc20
mov eax, 0xffffffff
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
test esi, esi
je 0x49bc20
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x49bc58
mov dword [ebp + 0xc], 0
mov edx, dword [ebp - 0xc]
mov eax, edi
mov dword [ebp + 8], 0x56903b
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
jmp fcn.0049b9f0
mov dword [esp], edi
call sub.msvcrt.dll__putenv
mov dword [esp], edi
call sub.msvcrt.dll_getenv
test eax, eax
jne 0x49bc3d
xor eax, eax
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0
xor eax, eax
mov dword [esp + 4], eax
mov edx, dword [ebp - 0xc]
mov eax, edi
call fcn.0049b9f0
xor eax, eax
jmp 0x49bc36
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
lea eax, [edx + ecx + 2]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov ecx, eax
test ecx, ecx
mov eax, 0xffffffff
je 0x49bbeb
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], esi
mov dword [esp + 8], eax
mov edx, dword [ebp - 0xc]
mov eax, ecx
mov dword [esp], edx
mov edx, edi
call fcn.0049b990
mov dword [ebp + 8], eax
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
jmp sub.msvcrt.dll__putenv

Function at 0x49d3c8
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x10
mov edi, dword [ebp + 0x10]
lea esi, [esi]
lea edi, [edi]
mov dword [esp + 8], edi
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.WS2_32.DLL_connect
sub esp, 0xc
test eax, eax
mov esi, eax
jns 0x49d40b
call sub.WS2_32.DLL_WSAGetLastError
cmp eax, 0x2714
je 0x49d3e0
lea esp, [ebp - 8]
mov eax, esi
pop esi
pop edi
pop ebp
ret
Function at 0x49da94
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
push esi
sub esp, 0x40
movzx esi, dx
call fcn.0049d414
test al, al
je 0x49dad4
mov dword [esp], edi
call sub.WS2_32.DLL_inet_addr
sub esp, 4
cmp eax, 0xffffffff
mov edx, eax
je 0x49dad4
cld
mov ecx, 4
lea edi, [ebp - 0x18]
xor eax, eax
rep stosd dword es:[edi], eax
mov word [ebp - 0x18], 2
mov dword [ebp - 0x14], edx
jmp 0x49db1a
mov dword [esp], edi
call sub.WS2_32.DLL_gethostbyname
sub esp, 4
test eax, eax
mov edx, eax
je 0x49dbb9
movzx eax, word [eax + 8]
cmp ax, 0x17
je 0x49db50
cmp ax, 2
jne 0x49dba3
cld
xor eax, eax
lea edi, [ebp - 0x18]
mov ecx, 4
rep stosd dword es:[edi], eax
mov word [ebp - 0x18], 2
mov eax, dword [edx + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov dword [esp], esi
call sub.WS2_32.DLL_htons
mov word [ebp - 0x16], ax
mov eax, dword [ebp + 0xc]
sub esp, 4
mov dword [esp + 8], eax
mov eax, 0x10
mov dword [esp + 4], eax
lea eax, [ebp - 0x18]
mov dword [esp], eax
call dword [ebp + 8]
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
cld
xor eax, eax
lea edi, [ebp - 0x38]
mov ecx, 7
rep stosd dword es:[edi], eax
mov word [ebp - 0x38], 0x17
mov eax, dword [edx + 0xc]
mov edx, dword [eax]
mov eax, dword [edx]
mov dword [ebp - 0x30], eax
mov eax, dword [edx + 4]
mov dword [ebp - 0x2c], eax
mov eax, dword [edx + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [edx + 0xc]
mov dword [esp], esi
mov dword [ebp - 0x24], eax
call sub.WS2_32.DLL_htons
mov word [ebp - 0x36], ax
mov eax, dword [ebp + 0xc]
sub esp, 4
mov dword [esp + 8], eax
mov eax, 0x1c
mov dword [esp + 4], eax
lea eax, [ebp - 0x38]
jmp 0x49db3c
mov dword [esp], 0x2739
call sub.WS2_32.DLL_WSASetLastError
sub esp, 4
mov eax, 0xffffffff
jmp 0x49db42
mov dword [esp], 0x2726
jmp 0x49dbaa

Function at 0x49dcc0
Capabilities:
Get hostname
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov dword [ebp - 8], esi
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], edi
add eax, 0x1770
movzx esi, ax
cmp byte [ecx], 0
jne 0x49dd0d
mov dword [0x698fa0], ebx
mov eax, 0x40
lea edi, [ebp - 0x58]
mov dword [esp + 4], eax
mov dword [esp], edi
call sub.WS2_32.DLL_gethostname
sub esp, 8
test eax, eax
js 0x49dd2d
mov byte [ebp - 0x18], 0
xor eax, eax
mov ecx, edi
mov dword [0x698fa0], eax
mov dword [esp], 0x49dbc4
xor eax, eax
mov edx, esi
mov dword [esp + 4], eax
mov eax, ecx
call fcn.0049da94
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
call fcn.00439708
nop
Function at 0x49dd34
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
cld
mov ebp, esp
push edi
mov ecx, 7
push esi
sub esp, 0x70
mov esi, edx
mov dword [esp], eax
xor edx, edx
lea edi, [ebp - 0x28]
mov dword [ebp - 0x2c], 0x1c
mov eax, edx
lea edx, [ebp - 0x2c]
rep stosd dword es:[edi], eax
mov dword [esp + 8], edx
lea edx, [ebp - 0x28]
mov dword [esp + 4], edx
call sub.WS2_32.DLL_getsockname
sub esp, 0xc
xor edx, edx
test eax, eax
js 0x49dd9d
movzx eax, word [ebp - 0x28]
cmp eax, 2
je 0x49dda6
cmp eax, 0x17
je 0x49ddd7
mov dword [esi], 0x61636f6c
mov dword [esi + 4], 0x736f686c
mov word [esi + 8], 0x74
mov dword [esi + 0x70], 0
mov edx, esi
lea esp, [ebp - 8]
mov eax, edx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sub.WS2_32.DLL_inet_ntoa
sub esp, 4
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.msvcrt.dll_strcpy
movzx eax, word [ebp - 0x26]
mov dword [esp], eax
call sub.WS2_32.DLL_ntohs
movzx eax, ax
sub esp, 4
mov dword [esi + 0x70], eax
jmp 0x49dd9b
movzx eax, word [ebp - 0x12]
mov dword [esp], eax
call sub.WS2_32.DLL_ntohs
movzx eax, ax
sub esp, 4
mov dword [ebp - 0x30], eax
movzx eax, word [ebp - 0x14]
mov dword [esp], eax
call sub.WS2_32.DLL_ntohs
movzx eax, ax
sub esp, 4
mov dword [ebp - 0x34], eax
movzx eax, word [ebp - 0x16]
mov dword [esp], eax
call sub.WS2_32.DLL_ntohs
movzx eax, ax
sub esp, 4
mov dword [ebp - 0x38], eax
movzx eax, word [ebp - 0x18]
mov dword [esp], eax
call sub.WS2_32.DLL_ntohs
movzx eax, ax
sub esp, 4
mov dword [ebp - 0x3c], eax
movzx eax, word [ebp - 0x1a]
mov dword [esp], eax
call sub.WS2_32.DLL_ntohs
movzx eax, ax
sub esp, 4
mov dword [ebp - 0x40], eax
movzx eax, word [ebp - 0x1c]
mov dword [esp], eax
call sub.WS2_32.DLL_ntohs
movzx eax, ax
sub esp, 4
mov dword [ebp - 0x44], eax
movzx eax, word [ebp - 0x1e]
mov dword [esp], eax
call sub.WS2_32.DLL_ntohs
movzx edi, ax
movzx eax, word [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call sub.WS2_32.DLL_ntohs
mov edx, dword [ebp - 0x30]
sub esp, 4
movzx eax, ax
mov dword [esp + 8], eax
mov eax, str._x:_x:_x:_x:_x:_x:_x:_x
mov dword [esp + 0x24], edx
mov edx, dword [ebp - 0x34]
mov dword [esp + 0xc], edi
mov dword [esp + 4], eax
mov dword [esp + 0x20], edx
mov edx, dword [ebp - 0x38]
mov dword [esp], esi
mov dword [esp + 0x1c], edx
mov edx, dword [ebp - 0x3c]
mov dword [esp + 0x18], edx
mov edx, dword [ebp - 0x40]
mov dword [esp + 0x14], edx
mov edx, dword [ebp - 0x44]
mov dword [esp + 0x10], edx
call fcn.0049cfc0
jmp 0x49ddc0

Function at 0x49e618
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
movzx edx, word [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp + 0xc], ecx
mov dword [ebp + 8], 0x49e4b4
pop ebp
jmp fcn.0049da94
Function at 0x4b7270
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ecx, eax
mov ebp, esp
push edi
lea eax, [ebp - 0xc]
push esi
sub esp, 0x30
mov byte [ebp - 0x11], dl
xor esi, esi
mov dword [esp + 8], eax
lea eax, [ebp - 0x10]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0044c2b8
mov edx, dword [ebp - 0x10]
mov ecx, eax
test edx, edx
je 0x4b7300
mov eax, dword [eax + 3]
cmp al, 0x20
je 0x4b738b
movsx eax, al
sub eax, 0x11
sar eax, 1
jne 0x4b7310
mov edi, dword [ebp - 0xc]
add ecx, edi
add ecx, 7
mov dword [ebp - 0x18], ecx
mov edi, edx
jmp 0x4b72ca
movzx eax, al
xor esi, eax
dec edi
je 0x4b7300
shl esi, 5
mov edx, dword [ebp - 0x18]
mov eax, esi
shr eax, 0x18
add esi, eax
movzx eax, byte [edx]
inc edx
cmp byte [ebp - 0x11], 0
mov dword [ebp - 0x18], edx
je 0x4b72c2
movzx eax, al
mov dword [esp], eax
call fcn.0044ead0
xor esi, eax
dec edi
jne 0x4b72ca
lea esi, [esi]
lea edi, [edi]
add esp, 0x30
and esi, 0xffffff
mov eax, esi
pop esi
pop edi
pop ebp
ret
cmp eax, 1
je 0x4b7352
cmp eax, 2
jne 0x4b7390
mov eax, dword [ebp - 0xc]
mov edi, edx
lea ecx, [ecx + eax*4 + 7]
mov dword [ebp - 0x20], ecx
jmp 0x4b732d
xor esi, eax
dec edi
je 0x4b7300
shl esi, 5
mov edx, dword [ebp - 0x20]
mov eax, esi
shr eax, 0x18
add esi, eax
mov eax, dword [edx]
add edx, 4
cmp byte [ebp - 0x11], 0
mov dword [ebp - 0x20], edx
je 0x4b7328
mov dword [esp], eax
call fcn.0044ead0
jmp 0x4b7328
mov eax, dword [ebp - 0xc]
mov edi, edx
lea ecx, [ecx + eax*2 + 7]
mov dword [ebp - 0x1c], ecx
jmp 0x4b7365
xor esi, eax
dec edi
je 0x4b7300
shl esi, 5
mov edx, dword [ebp - 0x1c]
mov eax, esi
shr eax, 0x18
add esi, eax
movzx eax, word [edx]
add edx, 2
cmp byte [ebp - 0x11], 0
mov dword [ebp - 0x1c], edx
je 0x4b7360
mov dword [esp], eax
call fcn.0044ead0
jmp 0x4b7360
call fcn.0042a3f0
mov dword [esp], str.c:_usr_work_edrive_w32texsrc_clisp249_clisp_2.49_src_package.d
mov ecx, 0x58
mov dword [esp + 4], ecx
call fcn.00420a64
lea esi, [esi]
Function at 0x4d1a34
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, edx
and eax, 3
dec eax
je 0x4d1a60
mov eax, edx
and eax, 0x27
cmp eax, 7
je case.0x4d1a69.26
mov dword [ebp + 8], edx
pop ebp
jmp fcn.004d0f18
mov dword [ebp + 8], edx
pop ebp
jmp fcn.004d1100
movsx eax, byte [edx + 3]
cmp eax, 0x24
ja case.0x4d1a69.0
jmp dword [eax*4 + 0x56d07c]
pop ebp
mov eax, edx
jmp fcn.004d1740
pop ebp
mov eax, edx
jmp fcn.004d139c
pop ebp
mov eax, edx
jmp fcn.004d147c
Function at 0x4d52b8
Capabilities:
Encode data using xor

Disassembly:
push esi
mov edx, dword [esp + 8]
mov esi, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
sub esi, edx
jecxz 0x4d52d4
mov eax, dword [edx + esi]
xor dword [edx], eax
lea edx, [edx + 4]
dec ecx
jne 0x4d52c9
pop esi
ret

Function at 0x4d52f8
Capabilities:
Encode data using xor

Disassembly:
push esi
mov edx, dword [esp + 8]
mov esi, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
sub esi, edx
jecxz 0x4d5318
mov eax, dword [edx]
xor eax, dword [edx + esi]
not eax
mov dword [edx], eax
lea edx, [edx + 4]
dec ecx
jne 0x4d5309
pop esi
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x49af40
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x65000]
push edi
or ebp, 0xffffffff
jmp 0x49af62
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x49af69
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x49af58
mov eax, 1
add ebx, ebx
jne 0x49af7b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x49af8c
jne 0x49afab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x49afab
dec eax
add ebx, ebx
jne 0x49af98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x49af70
add ebx, ebx
jne 0x49afa7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x49affd
xor ecx, ecx
sub eax, 3
jb 0x49afc3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x49b032
sar eax, 1
mov ebp, eax
jmp 0x49afce
add ebx, ebx
jne 0x49afce
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x49af9c
inc ecx
add ebx, ebx
jne 0x49afdc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x49af9c
add ebx, ebx
jne 0x49afe9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x49afde
jne 0x49affa
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x49afde
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x49b01c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x49b00e
jmp 0x49af5e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x49b01c
add edi, ecx
jmp 0x49af5e
pop esi
mov edi, esi
mov ecx, 0x45d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x49b03a
cmp byte [edi], 5
jne 0x49b03a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x49b03f
lea edi, [esi + 0x98000]
mov eax, dword [edi]
or eax, eax
je 0x49b0ae
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x9b594]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x9b638]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x49b06c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x9b640]
or eax, eax
je 0x49b0a8
mov dword [ebx], eax
add ebx, 4
jmp 0x49b089
call dword [esi + 0x9b63c]
mov ebp, dword [esi + 0x9b644]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x49b0e2
sub esp, 0xffffff80
jmp 0x403d3d
Function at 0x401b10
Capabilities:
Delete file
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.00409fd7
push 0x59e52c
push 0x82
mov eax, dword [eax + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
call fcn.00409fd7
push edi
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
call fcn.00409fd7
push edi
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
mov ebx, eax
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test ebx, ebx
je 0x401ba9
cmp ebx, 0xffffffff
je 0x401ba9
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4027d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4027e5
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402826
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x402822
nop word [eax + eax]
cmp esi, edx
jae 0x402826
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x402810
cmp esi, edx
jb 0x40282b
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret

Function at 0x403790
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
xorps xmm0, xmm0
mov dword [ebp - 4], 0
push 0x5a07dc
movups xmmword [ebp - 0x24], xmm0
xor bl, bl
movups xmmword [ebp - 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x4037e0
push str.GetNativeSystemInfo
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4037d5
lea ecx, [ebp - 0x24]
push ecx
call eax
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test bl, bl
jne 0x4037ea
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx ecx, word [ebp - 0x24]
pop esi
pop ebx
test ecx, ecx
je 0x403815
cmp ecx, 6
je 0x40380c
xor eax, eax
cmp ecx, 9
setne al
lea eax, [eax*2 + 1]
mov esp, ebp
pop ebp
ret
mov eax, 2
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x403820
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
mov dword [ebp - 8], 0
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftNET_Framework_SetupNDP_v4Full
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc], 4
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40388a
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.Install
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
test eax, eax
je 0x403890
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 1
jne 0x40388a
sub esp, 0x18
call fcn.004038c0
test al, al
je 0x40388a
push ecx
call fcn.00403a60
test al, al
je 0x40388a
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x4038c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x5bee64]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x110], 0
push edi
mov dword [ebp - 0x114], eax
xor edi, edi
mov dword [ebp - 0x118], eax
xor esi, esi
mov dword [ebp - 0x120], eax
xor ebx, ebx
mov dword [ebp - 0x10c], eax
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push edi
push str.SoftwareMicrosoftNET_Framework_SetupNDP_v4Full
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x11c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x403a2e
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x120]
push eax
push edi
push str.Version
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x10c]
test eax, eax
je 0x40396b
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x403a2e
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x108]
push 0x5a0850
push eax
call fcn.005552c7
mov ecx, eax
add esp, 0xc
test ecx, ecx
je 0x403a2e
mov eax, esi
inc esi
cmp eax, 3
ja case.default.0x40399e
jmp dword [eax*4 + 0x403a44]
push ecx
call fcn.0054c9bd
mov dword [ebp - 0x114], eax
jmp 0x4039d3
push ecx
call fcn.0054c9bd
mov ebx, eax
jmp 0x4039d3
push ecx
call fcn.0054c9bd
mov edi, eax
jmp 0x4039d3
push ecx
call fcn.0054c9bd
mov dword [ebp - 0x118], eax
add esp, 4
lea eax, [ebp - 0x110]
push eax
push 0x5a0850
push 0
call fcn.005552c7
mov ecx, eax
add esp, 0xc
test ecx, ecx
jne 0x403996
mov eax, dword [ebp - 0x114]
cmp eax, 4
jle 0x403a12
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00540bb6
mov esp, ebp
pop ebp
ret 0x18
jne 0x403a2e
test ebx, ebx
jg 0x4039fd
jne 0x403a2e
cmp edi, 0x766f
jg 0x4039fd
jne 0x403a2e
mov eax, dword [ebp - 0x118]
test eax, eax
jns 0x4039fd
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00540bb6
mov esp, ebp
pop ebp
ret 0x18
Function at 0x404590
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x560d82
mov eax, dword fs:[0]
push eax
sub esp, 0x410
mov eax, dword [0x5bee64]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x418], esi
mov dword [ebp - 4], 0
lea eax, [ebp - 0x410]
push 0x400
push 0
push eax
mov dword [ebp - 0x41c], esi
mov dword [ebp - 0x414], 0
call fcn.00545c00
add esp, 0xc
lea eax, [ebp - 0x410]
push eax
push 0x3ff
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x410]
mov ecx, esi
push eax
call fcn.00402bd0
mov dword [ebp - 4], 0
lea ecx, [esi + 4]
mov eax, dword [ecx]
mov dword [ebp - 0x414], 1
mov eax, dword [eax - 0xc]
test eax, eax
je 0x404655
add eax, 0xffffffff
js 0x404671
mov edx, dword [ecx]
cmp eax, dword [edx - 0xc]
jg 0x404671
cmp byte [edx + eax], 0x2f
je 0x404655
test eax, eax
js 0x404671
cmp eax, dword [edx - 0xc]
jg 0x404671
cmp byte [edx + eax], 0x5c
je 0x404655
push ecx
call fcn.00402150
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00540bb6
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00403290
int3

Function at 0x40ac80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
dec ebp
push eax
dec ebx
add esp, 4
pop esi
mov eax, dword [ebp - 0x45c]
sub eax, dword [ebp - 0x414]
cmp eax, 0xffffffff
jb 0x40aa24
push edi
push edi
add esp, 4
xor edi, 0x123d7
add edi, 0x14be2
add edi, 0x1443f
pop edi
push esi
xor esi, 0x3eb5
sub esi, 0x11d60
or esi, 0xe79
into
jns 0x40aa24
add byte [eax], al
add esi, 0x11f45
pop esi
jmp 0x40ac52
mov dword [ebp - 0xca4], 7
mov ecx, dword [ebp - 0x45c]
mov dword [ebp - 0xae0], ecx
push eax
push ecx
add esp, 4
add eax, 0x143de
pop eax
push ecx
push eax
push eax
add esp, 4
sub eax, 0x1c13
pop eax
push edi
xor edi, 0x1837a
and edi, 0x146d7
sub edi, 0xc118
call 0x40ac80
add byte [ebp + 0x36], cl
xor esi, dword [ebx]
inc ebx
xor al, byte [esi + 0x45]
cmp al, 0x83
les eax, [edi + ebx*2]
mov dword [ebp - 0xae8], 0
Function at 0x40b26b
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
push ebx
add esp, 4
call 0x40b25a
add byte [edx + 0x34], cl
xor eax, 0x83444e50
les eax, [eax + ebp*8]
or dword [eax], eax
add byte [eax], al
add byte [edi + 0x39], cl
inc ebx
inc eax
cmp bh, byte [ebx]
inc ecx
inc esp
add esp, 4
add ecx, 0x16f3d
sub ecx, 0x2849
pop ecx
mov byte [ebp - 0x8bc], 0x4c
mov byte [ebp - 0x8bb], 0x6f
mov byte [ebp - 0x8ba], 0x61
mov byte [ebp - 0x8b9], 0x64
mov byte [ebp - 0x8b8], 0x4c
mov byte [ebp - 0x8b7], 0x69
mov byte [ebp - 0x8b6], 0x62
mov byte [ebp - 0x8b5], 0x72
mov byte [ebp - 0x8b4], 0x61
mov byte [ebp - 0x8b3], 0x72
mov byte [ebp - 0x8b2], 0x79
mov byte [ebp - 0x8b1], 0x57
mov byte [ebp - 0x8b0], 0
mov eax, dword fs:[0x18]
mov dword [ebp - 0x1990], eax
mov ecx, dword [ebp - 0x1990]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x1994], edx
mov eax, dword [ebp - 0x1994]
mov dword [ebp - 0x1604], eax
push ecx
call 0x40b30d
add byte [eax + 0x47], cl
inc ebp
cmp edi, dword [ecx]
inc esp
inc eax
inc eax
dec eax
add esp, 4
pop ecx
push esi
push eax
add esp, 4
sub esi, 0xc8b9
and esi, 0xe7cd
xor esi, 0xb147
add esi, 0x1855b
pop esi
invalid
invalid
cld
invalid

Function at 0x40b686
Capabilities:
Resolve function by parsing pe exports

Disassembly:
dec ecx
dec edi
cmp bh, byte [esi]
call 0x40b604
add byte [ebx], bh
push eax
cmp dword [edi], esi
inc esi
xor al, 0x83
les eax, [edx + ebx*2]
push ecx
push ebx
add esp, 4
add ecx, 0x70c3
xor ecx, 0x11486
xor ecx, 0x102e2
int1
loop 0x40b61f
add dword [eax], eax
pop ecx
cmp dword [ebp - 0x760], 0
jne 0x40b66a
push edi
push edi
add esp, 4
or edi, 0xf7d8
xor edi, 0x14a8
pop edi
push eax
jmp 0x40b642
call 0x40b651
add byte [ebx + 0x41], al
inc esp
inc edx
dec ebx
dec eax
dec eax
cmp ecx, dword [ebp - 0x7d]
les eax, [ecx + eax*4]
enter 0x348f, 0
add byte [eax - 0x39], bl
test dword [eax + edi*8 - 1], edx
inc dword [eax]
add byte [eax], al
add cl, ch
daa
or eax, dword [eax]
add byte [edx - 0x7f], dl
ret 0x8c3
push edx
add edx, 0x8c3
add edx, 0x6ea2
call 0x40b686
add byte [ebx], bh
xor cl, byte [ebx + 0x34]
cmp bh, byte [edi]
inc ebx
inc ecx
dec edx
add esp, 4
xor edx, 0x3b3
pop edx
push ecx
push ebx
mov eax, dword [ebp - 0x79c]
add eax, 1
mov dword [ebp - 0x79c], eax
mov edx, dword [ebp - 0x158]
invalid