joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a8c58
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x4a8cc3
cmp byte [ebx + 0xd3], 0
jne 0x4a8cc3
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x170]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00406a18
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x4a8cb0
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4a8cd0
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00406c70
jmp 0x4a8cd0
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00406c70
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x4aa498
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4aa506
mov eax, esi
call fcn.00474af0
test al, al
je 0x4aa506
mov eax, dword [ebx + 0x84]
call fcn.00474770
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4aa506
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xfc]
test al, al
je 0x4aa4fa
push 0
mov eax, dword [ebx + 0x84]
call fcn.00474770
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.0046b7a4
jmp 0x4aa506
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.004aa2d0
pop esi
pop ebx
ret

Function at 0x401dd0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x3c
mov eax, dword [esp + 0x48]
push ebp
mov ebp, dword [esp + 0x44]
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x50]
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0x10], 0x3c
mov dword [esp + 0x14], 0x440
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], str.open
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x401e60
test edi, edi
jne 0x401e30
mov edi, str.NULL
push edi
push ebp
push str.ShellExecuteEx__s___s_
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [esp + 0x5c]
push eax
push edx
call fcn.00401fb0
mov eax, dword [eax]
add esp, 0x14
lea ecx, [esp + 0x4c]
mov dword [esp + 0x4c], eax
push 0x4033e8
push ecx
call sub.MSVCRT.dll__CxxThrowException
mov edx, dword [esp + 0x44]
push 0x104
lea eax, [esi + 4]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpynA]
push eax
mov dword [esi], edx
call ebp
test edi, edi
je 0x401e94
push 0x400
add esi, 0x108
push edi
push esi
call ebp
pop edi
pop esi
pop ebp
add esp, 0x3c
ret 0xc
mov byte [esi + 0x108], 0
pop edi
pop esi
pop ebp
add esp, 0x3c
ret 0xc
Function at 0x40326f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 2]
push esi
push eax
lea eax, [ebp - 8]
mov esi, ecx
push eax
call fcn.0041be10
pop ecx
test eax, eax
pop ecx
jne 0x4032e4
xor ebx, ebx
cmp dword [ebp - 8], ebx
je 0x4032fe
cmp word [ebp - 2], bx
jbe 0x4032e4
push edi
lea edi, [esi + 0xa0]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movzx eax, word [ebp - 2]
cmp eax, dword [0x44b0dc]
jge 0x4032da
sub dword [0x44b0dc], 0xf0
cmp dword [0x44b0dc], eax
jg 0x4032b2
add esi, 0xb8
push esi
push ebx
push eax
push 0x4034cd
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
jmp 0x4032fe
or dword [0x452de0], 0xffffffff
push 0x9400
lea eax, [ebp - 8]
push 0x43
push eax
call fcn.0042f0a0
add esp, 0xc
pop esi
pop ebx
leave
ret
Function at 0x40384d
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
call fcn.0040e507
mov eax, dword [esp + 8]
push 0xfffffffffffffff1
push dword [esi + 0x54]
mov dword [esi + 0x5c], eax
mov eax, dword [esp + 0x14]
mov dword [esi], 0x4413c0
mov dword [esi + 0x60], eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push dword [esi + 0x54]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, esi
pop esi
ret 8
Function at 0x407692
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ebx
jne 0x4076ac
xor esi, esi
jmp 0x4076da
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax + eax + 2]
mov eax, edi
add eax, 3
and al, 0xfc
call fcn.0042f1b0
mov esi, esp
push ebx
push ebx
push edi
push esi
push 0xffffffffffffffff
push dword [ebp + 8]
mov byte [esi], bl
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 2
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov edi, eax
cmp edi, ebx
mov dword [ebp - 4], edi
jne 0x407715
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
je 0x40770e
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x4077aa
xor esi, esi
jmp 0x4077aa
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
cmp esi, ebx
jne 0x407738
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jne 0x40774b
xor esi, esi
jmp 0x4077a1
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
cmp edi, ebx
mov dword [ebp + 8], edi
jne 0x40775d
jmp 0x407728
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x4077a1
push esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov eax, dword [ebp + 8]
cmp byte [esi + eax], bl
je 0x407793
lea eax, [esi + 1]
add eax, 3
and al, 0xfc
call fcn.0042f1b0
lea eax, [esi + 1]
mov edi, esp
push eax
push dword [ebp + 8]
push edi
call fcn.0042ff20
add esp, 0xc
mov byte [edi + esi], bl
push dword [ebp + 0x14]
lea ecx, [ebp - 0xc]
push edi
call fcn.00407871
mov esi, eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea esp, [ebp - 0x18]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x40829d
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov eax, 0x43ff50
call fcn.0042f618
sub esp, 0x114
push ebx
push esi
xor esi, esi
push edi
mov ebx, ecx
mov dword [ebp - 0x10], esi
push 0x2001f
lea ecx, [ebp - 0x10]
push dword [ebp + 8]
mov dword [ebp - 4], esi
push dword [ebx]
call fcn.0040825f
mov edi, eax
cmp edi, esi
je 0x4082e7
cmp dword [ebp - 0x10], esi
je 0x4082e0
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x408384
lea eax, [ebp - 0x20]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push eax
push esi
push esi
lea eax, [ebp - 0x14]
push esi
push eax
lea eax, [ebp - 0x120]
mov dword [ebp - 0x14], 0x100
push eax
push esi
push dword [ebp - 0x10]
call edi
test eax, eax
jne 0x408358
lea eax, [ebp - 0x120]
lea ecx, [ebp - 0x10]
push eax
call fcn.0040829d
cmp eax, esi
mov dword [ebp - 0x18], eax
jne 0x408345
lea eax, [ebp - 0x20]
mov dword [ebp - 0x14], 0x100
push eax
push esi
push esi
lea eax, [ebp - 0x14]
push esi
push eax
lea eax, [ebp - 0x120]
push eax
push esi
push dword [ebp - 0x10]
jmp 0x40830a
cmp dword [ebp - 0x10], esi
je 0x408353
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x18]
jmp 0x408384
cmp dword [ebp - 0x10], esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x40836b
push dword [ebp - 0x10]
call edi
mov dword [ebp - 0x10], esi
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cmp dword [ebp - 0x10], esi
mov ebx, eax
je 0x408382
push dword [ebp - 0x10]
call edi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x408395
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2014
call fcn.0042f1b0
push ebx
push esi
lea eax, [ebp - 0x2014]
push edi
mov esi, ecx
push eax
mov dword [ebp - 0x14], esi
call fcn.004079ca
xor edi, edi
cmp eax, edi
jl 0x40854d
lea eax, [ebp - 0xa]
push eax
lea eax, [ebp - 0x2014]
push eax
call fcn.0040855a
pop ecx
test eax, eax
pop ecx
jne 0x4083e0
mov eax, 0x80020009
jmp 0x40854d
mov ecx, esi
call fcn.004079a2
lea eax, [ebp - 0x1014]
mov ecx, esi
push eax
call fcn.004079ca
cmp eax, edi
jl 0x40854d
movzx eax, word [ebp - 0xa]
sub eax, 8
je 0x408515
sub eax, 9
je 0x40847a
dec eax
dec eax
jne 0x40853c
lea eax, [ebp - 0x1014]
test eax, eax
jne 0x408425
xor ebx, ebx
jmp 0x40845a
lea eax, [ebp - 0x1014]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and al, 0xfc
call fcn.0042f1b0
mov ebx, esp
push esi
push ebx
lea eax, [ebp - 0x1014]
push 0xffffffffffffffff
push eax
push edi
push edi
mov word [ebx], di
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x10]
push eax
push edi
push edi
push ebx
call dword [sym.imp.OLEAUT32.dll_VarUI4FromDisp]
mov eax, dword [ebp - 0x10]
push 4
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 4
jmp 0x40852d
lea eax, [ebp - 0x1014]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test al, 1
mov dword [ebp - 8], eax
jne 0x4084b6
cdq
sub eax, edx
mov ebx, eax
sar ebx, 1
mov eax, ebx
add eax, 3
and al, 0xfc
call fcn.0042f1b0
mov dword [ebp - 4], esp
push ebx
push edi
push dword [ebp - 4]
call fcn.0042f0a0
add esp, 0xc
cmp dword [ebp - 4], edi
jne 0x4084c0
mov eax, 0x80004005
jmp 0x40854d
cmp dword [ebp - 8], 0
jle 0x4084fa
mov ecx, dword [ebp - 4]
mov eax, edi
cdq
sub eax, edx
sar eax, 1
lea esi, [eax + ecx]
mov al, byte [ebp + edi - 0x1014]
push eax
call fcn.004085e1
pop ecx
mov ecx, edi
push 4
and ecx, 1
shl ecx, 2
mov edx, ecx
pop ecx
sub ecx, edx
shl al, cl
or byte [esi], al
inc edi
cmp edi, dword [ebp - 8]
jl 0x4084c6
mov eax, dword [ebp + 8]
push ebx
push dword [ebp - 4]
mov eax, dword [eax]
push 3
push 0
push dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor edi, edi
jmp 0x40853c
lea eax, [ebp - 0x1014]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x1014]
push eax
push 1
mov eax, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 0x10]
mov ecx, dword [ebp - 0x14]
call fcn.004079ca
cmp eax, edi
jl 0x40854d
xor eax, eax
lea esp, [ebp - 0x2020]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x409532
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x440041
call fcn.0042f618
push ecx
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push esi
mov esi, ecx
push edi
xor edi, edi
lea eax, [esi + 0xc]
mov dword [ebp - 0x14], esi
push eax
mov dword [esi + 8], edi
call ebx
mov dword [ebp - 4], edi
mov dword [esi + 0x24], edi
mov al, byte [ebp - 0xd]
and byte [esi + 0x38], 0
lea edi, [esi + 0x30]
mov byte [ebp - 4], 1
mov ecx, edi
mov byte [edi], al
mov al, byte [ebp - 0xd]
mov byte [edi + 1], al
call fcn.00409df7
xor eax, eax
mov ecx, edi
mov byte [ebp - 4], 2
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x58], eax
call fcn.004097ae
lea eax, [esi + 0x40]
push eax
call ebx
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40bf94
Capabilities:
Delete file
Enumerate files on windows
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x340
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
mov eax, dword [esi]
push dword [eax + edi*4]
lea eax, [ebp - 0x340]
push str._s.
push eax
call fcn.0042f1df
add esp, 0xc
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x340]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40c0a4
test byte [ebp - 0x140], 0x10
jne 0x40c074
push dword [esi + 0x14]
lea eax, [ebp - 0x114]
push eax
call fcn.0040bae7
pop ecx
cmp eax, 1
pop ecx
jne 0x40c074
lea eax, [ebp - 0x114]
push eax
mov eax, dword [esi]
push dword [eax + edi*4]
lea eax, [ebp - 0x340]
push 0x44b22c
push eax
call fcn.0042f1df
add esp, 0x10
lea eax, [ebp - 0x114]
push eax
mov eax, dword [esi]
push dword [eax + edi*4]
lea eax, [ebp - 0x240]
push str._s_scanned_s
push eax
call fcn.0042f1df
add esp, 0x10
lea eax, [ebp - 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x340]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
je 0x40c08b
lea eax, [ebp - 0x240]
push edi
push eax
mov ecx, esi
call fcn.0040c0ad
lea eax, [ebp - 0x140]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x40c09d
jmp 0x40bfdd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40c09d
mov eax, dword [esi + 4]
mov byte [eax + edi], 2
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 4

Function at 0x40c574
Capabilities:
Create thread

Disassembly:
xor eax, eax
push esi
mov esi, ecx
push eax
push eax
push esi
push 0x40bad9
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x10], eax
xor eax, eax
pop esi
ret

Function at 0x40c5a5
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x104
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebp
push esi
push edi
mov esi, ecx
mov eax, dword [esi + 0x2c]
mov edi, 0x3e8
xor edx, edx
mov ecx, edi
div ecx
xor ebp, ebp
test eax, eax
jbe 0x40c5ea
cmp dword [esi + 0x30], 1
je 0x40c65d
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esi + 0x2c]
xor edx, edx
mov ecx, edi
inc ebp
div ecx
cmp ebp, eax
jb 0x40c5cb
call ebx
lea edi, [esi + 0x14]
mov ebp, eax
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 4]
mov ecx, dword [eax]
cmp ecx, eax
mov dword [esp + 0x10], ecx
je 0x40c625
cmp dword [esi + 0x30], 1
je 0x40c653
mov ecx, dword [ecx + 0x10]
call fcn.0040bf6d
lea ecx, [esp + 0x10]
call fcn.0040cead
mov ecx, dword [esp + 0x10]
cmp ecx, dword [esi + 4]
jne 0x40c605
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call ebx
sub eax, ebp
push eax
lea eax, [esp + 0x18]
push str.Scan_Dir__d_n
push eax
call fcn.0042f1df
add esp, 0xc
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x40c5b7
add esi, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
Function at 0x40e507
Capabilities:
Create thread

Disassembly:
mov eax, 0x4404c4
call fcn.0042f618
push ecx
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x14], esi
mov dword [esi + 4], 1
mov dword [esi], 0x441e78
lea eax, [ebp - 0xd]
xor edi, edi
push eax
lea ecx, [esi + 0x20]
mov dword [ebp - 4], edi
call fcn.0040e68a
lea eax, [esi + 8]
mov dword [esi], 0x441e64
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0x58], eax
lea eax, [esi + 0x50]
push eax
push 4
push esi
push 0x40e46c
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x54], eax
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x41bc40
Capabilities:
Create thread

Disassembly:
push ecx
mov eax, dword [0x453458]
push ebx
xor ebx, ebx
push ebp
push esi
cmp eax, ebx
push edi
je 0x41bc65
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x2710
call esi
cmp dword [0x453458], ebx
jne 0x41bc56
mov ecx, dword [esp + 0x1c]
mov eax, 1
cmp ecx, eax
jne 0x41bc77
mov dword [0x45345c], eax
call fcn.0041b6c0
mov esi, eax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], ebx
call fcn.0041b710
mov ebp, eax
mov ecx, 0xc
xor eax, eax
mov edi, ebp
rep stosd dword es:[edi], eax
add esp, 4
mov ecx, esi
call fcn.0041c1f0
mov edi, eax
cmp edi, ebx
jle 0x41bcc3
test edi, edi
je 0x41bcc7
mov ecx, esi
call fcn.0041c870
mov ecx, esi
call fcn.0041c1f0
inc ebx
mov edi, eax
cmp ebx, 0xa
jl 0x41bca9
test edi, edi
jne 0x41bd40
lea ecx, [esp + 0x10]
push ecx
push ebp
mov ecx, esi
call fcn.0041d0f0
call fcn.0041b730
mov ecx, esi
mov ebx, eax
call fcn.0041eed0
mov dword [ebx], eax
mov eax, dword [esp + 0x18]
test eax, eax
mov dword [0x453458], 0
je 0x41bd23
push 0
push 0
push 0
push 0x41b740
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x452e38
mov dword [0x44d50c], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0x452e38
mov dword [0x44d50c], 0xffffffff
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
cmp edi, 0xffffffff
jne 0x41bd47
xor edi, edi
push 0x452e38
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x41fb40
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push 0
push 0
mov eax, dword [esi + 4]
mov edx, dword [esi]
shl eax, 8
or eax, edx
mov edx, dword [esp + 0x10]
shl eax, 0x10
or eax, edx
push eax
push 0x41fad0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 8], eax
xor eax, eax
pop esi
ret 4
Function at 0x41fcb0
Capabilities:
Encrypt data using blowfish

Disassembly:
push ebx
push ebp
mov ebx, ecx
push esi
push edi
mov eax, ebx
mov esi, 4
mov ecx, 0x44623c
mov edx, 0x100
sub ecx, ebx
mov edi, dword [ecx + eax]
mov dword [eax], edi
add eax, 4
dec edx
jne 0x41fcc9
dec esi
jne 0x41fcbd
mov edi, dword [esp + 0x18]
xor eax, eax
mov edx, 0x4461f4
lea esi, [ebx + 0x1000]
xor ecx, ecx
mov dword [esp + 0x18], 4
mov ebp, dword [esp + 0x14]
movsx ebp, byte [eax + ebp]
or ebp, ecx
shl ebp, 8
inc eax
mov ecx, ebp
cmp eax, edi
jl 0x41fd08
xor eax, eax
mov ebp, dword [esp + 0x18]
dec ebp
mov dword [esp + 0x18], ebp
jne 0x41fcf2
mov ebp, dword [edx]
add edx, 4
xor ebp, ecx
mov dword [esi], ebp
add esi, 4
cmp edx, 0x44623c
jl 0x41fce8
xor eax, eax
xor edx, edx
lea esi, [ebx + 0x1004]
mov edi, 9
push edx
push eax
mov ecx, ebx
call fcn.0041fe60
mov dword [esi - 4], eax
mov dword [esi], edx
add esi, 8
dec edi
jne 0x41fd36
lea esi, [ebx + 4]
mov ebp, 4
mov edi, 0x80
push edx
push eax
mov ecx, ebx
call fcn.0041fe60
mov dword [esi - 4], eax
mov dword [esi], edx
add esi, 8
dec edi
jne 0x41fd57
dec ebp
jne 0x41fd52
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x42a8e0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28c
push ebx
push esi
push edi
mov dword [ebp - 0x190], 0x104
mov dword [ebp - 0x274], 1
mov eax, dword [ebp - 0x190]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
lea eax, [ebp - 0x18c]
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_OpenFile]
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 0xffffffff
jne 0x42a949
mov eax, 1
jmp 0x42aa77
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp - 0x288]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 0
je 0x42aa5f
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 0x284]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 0
je 0x42aa52
push 0
mov eax, dword [ebp - 0x288]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x278], eax
mov dword [ebp - 0x27c], 0
mov eax, dword [ebp - 0x280]
push eax
call fcn.0042a783
add esp, 4
cmp eax, 0x4550
jne 0x42aa52
lea eax, [ebp - 0x270]
push eax
mov eax, dword [ebp - 0x280]
push eax
call fcn.0042a82e
add esp, 8
test eax, eax
jne 0x42aa52
mov eax, dword [ebp - 0x22c]
and eax, 0xffff
mov dword [ebp - 0x28c], eax
jmp 0x42aa26
mov dword [ebp - 0x274], 0
jmp 0x42aa52
mov dword [ebp - 0x274], 1
jmp 0x42aa52
cmp dword [ebp - 0x28c], 3
je 0x42aa08
cmp dword [ebp - 0x28c], 5
je 0x42aa08
cmp dword [ebp - 0x28c], 7
je 0x42aa08
jmp 0x42aa17
mov eax, dword [ebp - 0x284]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x288]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x274]
jmp 0x42aa77
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42b2b5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x14], 0x54
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x12], 0x72
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x10], 0x69
mov byte [ebp - 0xf], 0x6e
mov byte [ebp - 0xe], 0x61
mov byte [ebp - 0xd], 0x6c
mov byte [ebp - 0xc], 0x20
mov byte [ebp - 0xb], 0x53
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 9], 0x72
mov byte [ebp - 8], 0x76
mov byte [ebp - 7], 0x65
mov byte [ebp - 6], 0x72
mov byte [ebp - 5], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 4], eax
test byte [ebp - 1], 0x80
jne 0x42b349
xor eax, eax
mov al, byte [ebp - 4]
cmp eax, 4
jle 0x42b33a
lea eax, [ebp - 0x14]
push eax
call fcn.0042b356
add esp, 4
mov dword [ebp - 0x18], eax
jmp 0x42b349
lea eax, [ebp - 0x14]
push eax
call fcn.0042b356
add esp, 4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
jmp 0x42b351
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42b356
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x1c], 0
lea eax, [ebp - 0x14]
push eax
push str.SystemCurrentControlSetControlProductOptions
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x42b3a8
jmp 0x42b47f
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0x44edf8
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x42b3da
cmp dword [ebp - 0xc], 0
jne 0x42b3df
jmp 0x42b47f
mov eax, dword [ebp - 0xc]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x42b3fd
jmp 0x42b47f
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x1c]
push eax
lea eax, [ebp - 4]
push eax
push 0
push str.ProductSuite
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x42b431
cmp dword [ebp - 4], 7
je 0x42b436
jmp 0x42b47f
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movsx eax, byte [eax]
test eax, eax
je 0x42b47f
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x42b46c
mov dword [ebp - 0x10], 1
jmp 0x42b47f
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
add dword [ebp - 8], eax
jmp 0x42b43c
cmp dword [ebp - 0x1c], 0
je 0x42b493
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x14], 0
je 0x42b4a7
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
jmp 0x42b4af
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42b6fd
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0x10
push 0x4e8
push 5
push 6
call fcn.0042be4a
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x42b7a0
mov eax, dword [ebp - 4]
push eax
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0042f0a0
add esp, 0xc
mov word [ebp - 0x18], 6
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.WSOCK32.dll_bind
cmp eax, 0xffffffff
je 0x42b7a0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.WSOCK32.dll_getsockname
cmp eax, 0xffffffff
je 0x42b7a0
lea eax, [ebp - 0x18]
push eax
call fcn.0042b649
add esp, 4
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.0042f1df
add esp, 8
mov eax, dword [ebp - 8]
push eax
call sub.WSOCK32.dll_closesocket
xor eax, eax
jmp 0x42b7bb
push str.00_00_00_00_FF_FF_FF_FF_FF_FF
mov eax, dword [ebp + 8]
push eax
call fcn.0042f1df
add esp, 8
mov eax, 1
jmp 0x42b7bb
pop edi
pop esi
pop ebx
leave
ret