joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411900
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47c088
mov eax, dword fs:[0]
push eax
sub esp, 0x118
mov eax, dword [0x4ade78]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x120], 0
mov ecx, dword [0x4af2c0]
mov ebx, dword [ebp + 8]
lea edx, [ecx + 2]
lea eax, [ecx + 1]
imul eax, edx
imul eax, ecx
cdq
mov ecx, 0x14
idiv ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x124], ebx
cmp edx, 7
jne 0x41199b
push 0x28
call fcn.004601e0
add esp, 4
mov edi, eax
xor esi, esi
call fcn.00461e71
add eax, dword [0x4af2c0]
inc esi
mov dword [edi + esi*4 - 4], eax
cmp esi, 0xa
jl 0x411975
mov eax, dword [edi + 0x24]
push edi
mov dword [0x4af2c0], eax
call fcn.0046208f
add esp, 4
mov eax, dword [0x4adbb8]
mov ecx, 0x4adbb8
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
push 0x103
lea eax, [ebp - 0x113]
push 0
push eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x120], 1
mov byte [ebp - 0x114], 0
call fcn.00462e00
add esp, 0xc
call fcn.0041bee0
mov esi, dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test al, al
je 0x4119ff
lea eax, [ebp - 0x114]
push eax
push 0
push 0
push 0x2a
push 0
call esi
test eax, eax
jns 0x411a18
lea eax, [ebp - 0x114]
push eax
push 0
push 0
push 0x26
push 0
call esi
test eax, eax
js 0x411b19
mov eax, dword [0x4adbb8]
mov ecx, 0x4adbb8
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x118], esi
lea eax, [ebp - 0x114]
mov dword [ebp - 4], 1
test eax, 0xffff0000
jne 0x411a63
movzx edi, ax
push 0
push edi
call fcn.00403750
add esp, 8
test eax, eax
je 0x411a92
push edi
push eax
lea ecx, [ebp - 0x118]
call fcn.00405c50
jmp 0x411a8c
lea ecx, [ebp - 0x114]
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x411a70
sub ecx, edx
push ecx
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x118]
call fcn.00408620
mov esi, dword [ebp - 0x118]
mov edi, dword [ebx]
lea ecx, [esi - 0x10]
sub edi, 0x10
or edx, 0xffffffff
mov dword [ebp - 4], 2
mov dword [ebp - 0x11c], ecx
cmp ecx, edi
je 0x411afc
cmp dword [edi + 0xc], 0
jl 0x411ae8
mov eax, dword [ecx]
cmp eax, dword [edi]
jne 0x411ae8
push ecx
call fcn.00403ee0
or edx, 0xffffffff
mov esi, eax
add esp, 4
mov eax, edx
lea ecx, [edi + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x411ae1
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
or edx, 0xffffffff
lea eax, [esi + 0x10]
mov dword [ebx], eax
jmp 0x411af6
push dword [esi - 0xc]
mov ecx, ebx
push esi
call fcn.00408620
or edx, 0xffffffff
mov ecx, dword [ebp - 0x11c]
mov byte [ebp - 4], 0
lea eax, [ecx + 0xc]
lock xadd dword [eax], edx
dec edx
test edx, edx
jg 0x411b19
mov ecx, dword [ecx]
push dword [ebp - 0x11c]
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00461234
mov esp, ebp
pop ebp
ret
Function at 0x411b40
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
mov eax, dword [0x4ade78]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push edi
push 0
push 0
push 3
push 0
push 0
push SysReAllocStringLen
push eax
mov dword [ebp - 0xb8], ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, dword [0x4af2c0]
mov edi, eax
lea ecx, [esi + 1]
lea eax, [esi + 2]
imul eax, ecx
imul eax, esi
cdq
mov ecx, 0xf
idiv ecx
cmp edx, 4
jne 0x411baf
lea eax, [ebp - 0xb0]
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov esi, dword [0x4af2c0]
cmp edi, 0xffffffff
jne 0x411bfc
lea eax, [esi + 1]
imul eax, esi
cdq
mov ecx, 0x12
idiv ecx
cmp edx, 0xa
jne 0x411cac
push 4
call fcn.00460a63
mov esi, eax
call fcn.00461e71
mov dword [esi], eax
push esi
mov dword [0x4af2c0], eax
call fcn.00460a34
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00461234
mov esp, ebp
pop ebp
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [0x4af2c0]
lea esi, [edx + 1]
lea ecx, [edx + 2]
imul ecx, esi
imul ecx, edx
and ecx, 0x80000003
jns 0x411c24
dec ecx
or ecx, 0xfffffffc
inc ecx
cmp ecx, 3
jne 0x411c4f
sub edx, 0
je 0x411c45
dec edx
je 0x411c39
mov dword [0x4af2c0], esi
jmp 0x411c4f
mov dword [0x4af2c0], 0
jmp 0x411c4f
mov dword [0x4af2c0], 2
cmp eax, 0xffffffff
je 0x411ca5
cmp eax, dword [ebp + 0x10]
ja 0x411ca5
push 0
lea ecx, [ebp - 0xb4]
push ecx
push eax
push dword [ebp - 0xb8]
mov dword [ebp - 0xb4], 0
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x411cac
mov eax, dword [ebp - 0xb4]
pop edi
mov dword [ebx], eax
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00461234
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00461234
mov esp, ebp
pop ebp
ret
Function at 0x412500
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47c158
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x4ade78]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
push dword [eax]
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x412554
xor bl, bl
jmp 0x4125b6
push 0
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp + 0xc]
mov dword [ebp + 8], 0
mov ecx, dword [eax - 8]
mov esi, dword [eax - 0xc]
mov edx, 1
sub edx, dword [eax - 4]
or ecx, edx
jge 0x41258a
push 0
lea ecx, [ebp + 0xc]
call fcn.00407d40
mov eax, dword [ebp + 0xc]
push 0
lea ecx, [ebp + 8]
push ecx
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 1
sete bl
mov esi, dword [ebp + 0xc]
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4125da
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x412fd0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8ea8
call fcn.00462c30
mov eax, dword [0x4ade78]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0x38
mov dword [ebp - 0x8e6c], eax
lea eax, [ebp - 0x8ea4]
push 0
push eax
call fcn.00462e00
push 0x800
mov dword [ebp - 0x8ea8], 0x3c
call fcn.004601e0
push 0x800
mov dword [ebp - 0x8e98], eax
mov dword [ebp - 0x8e94], 0x800
call fcn.004601e0
add esp, 0x14
mov dword [ebp - 0x8e7c], eax
push str.Wininet.dll
mov dword [ebp - 0x8e78], 0x800
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x413092
push dword [ebp - 0x8e98]
call fcn.0046208f
push dword [ebp - 0x8e7c]
mov dword [ebp - 0x8e98], 0
call fcn.0046208f
add esp, 8
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00461234
mov esp, ebp
pop ebp
ret
push str.InternetCrackUrlA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
test ecx, ecx
jne 0x41311e
call fcn.00416de0
test al, al
jne 0x4130cc
mov eax, dword [0x4af2c0]
xor esi, esi
test eax, eax
je 0x4130c6
mov ecx, eax
cdq
and ecx, 1
sub eax, edx
add esi, ecx
sar eax, 1
jne 0x4130b8
mov dword [0x4af2c0], esi
push dword [ebp - 0x8e98]
call fcn.0046208f
add esp, 4
call fcn.00416de0
test al, al
jne 0x4130f3
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
push dword [ebp - 0x8e7c]
mov dword [ebp - 0x8e98], 0
call fcn.0046208f
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00461234
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
lea edx, [ebp - 0x8ea8]
push edx
push 0
push dword [eax - 0xc]
push eax
call ecx
push dword [ebp - 0x8e98]
test eax, eax
jne 0x4131e2
call fcn.0046208f
push dword [ebp - 0x8e7c]
mov dword [ebp - 0x8e98], 0
call fcn.0046208f
add esp, 8
call fcn.00416e40
test al, al
jne 0x4131cf
xor eax, eax
push 0x8e60
push eax
mov word [ebp - 0x8e68], ax
lea eax, [ebp - 0x8e66]
push eax
call fcn.00462e00
add esp, 0xc
xor edi, edi
xor esi, esi
xor eax, eax
test edi, edi
je 0x4131af
test eax, eax
je 0x4131af
lea ecx, [esi + eax]
lea edx, [ebp - 0x8e68]
lea edx, [edx + ecx*2]
lea ecx, [esi + eax]
mov cx, word [ebp + ecx*2 - 0x8f76]
inc cx
add cx, word [edx - 2]
mov word [edx], cx
inc eax
cmp eax, 0x87
jl 0x413187
add esi, 0x87
inc edi
cmp esi, 0x4731
jl 0x413185
movsx eax, word [ebp - 8]
mov dword [0x4af2c0], eax
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00461234
mov esp, ebp
pop ebp
ret
mov ecx, edi
call fcn.004029e0
push dword [ebp - 0x8e7c]
mov ecx, ebx
call fcn.004029e0
movzx eax, word [ebp - 0x8e90]
mov ecx, dword [ebp - 0x8e6c]
push dword [ebp - 0x8e98]
mov dword [ecx], eax
call fcn.0046208f
push dword [ebp - 0x8e7c]
mov dword [ebp - 0x8e98], 0
call fcn.0046208f
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
pop edi
pop esi
mov al, 1
pop ebx
call fcn.00461234
mov esp, ebp
pop ebp
ret
Function at 0x416350
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47c7ce
mov eax, dword fs:[0]
push eax
sub esp, 0xac0
mov eax, dword [0x4ade78]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
test edi, edi
je 0x416483
push 0xc
call fcn.00460a63
mov esi, eax
add esp, 4
mov dword [ebp - 0xac8], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x4163cb
mov eax, dword [0x4adbb8]
mov ecx, 0x4adbb8
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov dword [esi + 4], 0
mov dword [esi + 8], 0
jmp 0x4163cd
xor esi, esi
push ebx
mov ecx, esi
mov dword [ebp - 4], 0xffffffff
call fcn.00402970
mov ecx, dword [0x4af2c0]
lea eax, [ecx + 1]
imul eax, ecx
cdq
mov ecx, 0x13
idiv ecx
cmp edx, 7
jne 0x416405
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
mov eax, dword [ebp + 0x14]
push esi
push dword [ebp + 0xc]
mov dword [esi + 4], eax
mov eax, dword [ebp + 0x18]
push 0x408
push edi
mov dword [esi + 8], eax
call dword [sym.imp.USER32.dll_PostMessageA]
call fcn.00416eb0
test al, al
jne 0x416483
mov eax, dword [0x4af2c0]
xor edx, edx
mov dword [ebp - 0xac4], edx
lea edi, [ebp - 0xabc]
lea ecx, [ecx]
xor ebx, ebx
inc ebx
cdq
xor ecx, ecx
idiv ebx
mov dword [ebp - 0xac8], ebx
mov dword [ebp - 0xacc], edx
lea esi, [ecx + 1]
mov ecx, esi
cmp ecx, 0xd
jl 0x416454
mov ebx, dword [ebp - 0xac8]
mov eax, dword [0x4af2c0]
add edi, 0xd
cmp ebx, 0xe
jl 0x416442
mov edx, dword [ebp - 0xac4]
inc edx
mov dword [ebp - 0xac4], edx
cmp edx, 0xf
jl 0x416440
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00461234
mov esp, ebp
pop ebp
ret
Function at 0x4170e0
Capabilities:
Acquire debug privileges
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47c948
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4ade78]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push str.ProcessKiller
lea ecx, [ebp - 0x28]
call fcn.00401b30
lea eax, [ebp - 0x28]
push eax
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.00417020
mov edx, dword [ebp - 0x28]
add edx, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [edx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41714f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x24]
push eax
push 0x20
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [ebp - 0x24], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4171f9
call fcn.004177b0
mov ecx, dword [0x4af9a4]
test al, al
lea eax, [ebp - 0x30]
push eax
mov edx, 0x4cd3ffff
push str.SeDebugPrivilege
cmove ecx, edx
push 0
mov dword [0x4af9a4], ecx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x4171f9
mov eax, dword [ebp - 0x30]
push 0
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x2c]
push 0
push 0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
push eax
push 0
push dword [ebp - 0x24]
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x14], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x4171f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.Kernel32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x10], eax
test eax, eax
je 0x41723f
push str.CreateToolhelp32Snapshot
push eax
call edi
push str.Process32First
push dword [esi + 0x10]
mov dword [esi + 0x14], eax
call edi
push str.Process32Next
push dword [esi + 0x10]
mov dword [esi + 0x18], eax
call edi
mov dword [esi + 0x1c], eax
cmp dword [esi + 0x14], 0
je 0x417251
cmp dword [esi + 0x18], 0
je 0x417251
cmp dword [esi + 0x1c], 0
jne 0x41729b
cmp dword [esi + 0x10], 0
je 0x41729b
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esi + 0xc], eax
test eax, eax
je 0x41729b
push str.ZwQuerySystemInformation
push eax
call edi
push 0x491e30
push dword [esi + 0x10]
mov dword [esi + 0x20], eax
call edi
push 0x491e40
push dword [esi + 0x10]
mov dword [esi + 0x24], eax
call edi
push 0x491e4c
push dword [esi + 0x10]
mov dword [esi + 0x28], eax
call edi
mov dword [esi + 0x2c], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00461234
mov esp, ebp
pop ebp
ret
Function at 0x417470
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov eax, dword [0x4ade78]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x128
mov dword [ebp - 0x138], eax
lea eax, [ebp - 0x12c]
mov ebx, ecx
push 0
push eax
mov dword [ebp - 0x134], ebx
call fcn.00462e00
mov eax, dword [ebx + 0x14]
add esp, 0xc
mov dword [ebp - 0x12c], 0x128
push 0
push 2
call eax
mov esi, dword [0x4af2c0]
mov edi, eax
lea ecx, [esi + 1]
lea eax, [esi + 2]
imul eax, ecx
imul eax, esi
cdq
mov ecx, 0x16
idiv ecx
cmp edx, 0xd
jne 0x41756a
xor edx, edx
mov ecx, edx
and ecx, 1
dec ecx
not ecx
and ecx, esi
mov eax, edx
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, esi
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
sar eax, 1
not ecx
and ecx, esi
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, esi
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
sar eax, 1
not ecx
and ecx, esi
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, esi
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
sar eax, 1
not ecx
and ecx, esi
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, esi
sar ecx, 1
xor eax, ecx
inc edx
add esi, eax
cmp edx, 0x100
jl 0x4174e7
mov dword [0x4af2c0], esi
cmp edi, 0xffffffff
jne 0x417584
or eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00461234
mov esp, ebp
pop ebp
ret 4
xor ebx, ebx
call fcn.00417800
test al, al
jne 0x417618
xor edx, edx
mov ecx, edx
and ecx, 1
dec ecx
not ecx
and ecx, esi
mov eax, edx
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, esi
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
sar eax, 1
not ecx
and ecx, esi
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, esi
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
sar eax, 1
not ecx
and ecx, esi
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, esi
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
sar eax, 1
not ecx
and ecx, esi
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, esi
sar ecx, 1
xor eax, ecx
inc edx
add esi, eax
cmp edx, 0x100
jl 0x417595
mov dword [0x4af2c0], esi
call fcn.00417850
test al, al
jne 0x417628
inc esi
mov dword [0x4af2c0], esi
mov esi, dword [ebp - 0x134]
mov al, 1
test al, al
lea eax, [ebp - 0x12c]
push eax
push edi
je 0x417641
mov eax, dword [esi + 0x18]
jmp 0x417644
mov eax, dword [esi + 0x1c]
call eax
test eax, eax
je 0x41768d
lea eax, [ebp - 0x108]
push 0x5c
push eax
mov byte [ebp - 0x12d], 0
call fcn.00463581
add esp, 8
test eax, eax
jne 0x41766e
lea eax, [ebp - 0x108]
jmp 0x41766f
inc eax
mov ecx, dword [ebp - 0x138]
push dword [ecx]
push eax
call fcn.0046244a
add esp, 8
test eax, eax
mov al, byte [ebp - 0x12d]
jne 0x417630
inc ebx
jmp 0x417630
test edi, edi
je 0x417698
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.00461234
mov esp, ebp
pop ebp
ret 4
Function at 0x41afb0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47cf39
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4ade78]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x1c], 0
push eax
push str.iexplore.exe
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edx, dword [0x4adbb8]
mov ecx, 0x4adbb8
mov ebx, eax
call dword [edx + 0xc]
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 1
call fcn.0041c470
test al, al
jne 0x41b03e
inc dword [0x4af2c0]
test ebx, ebx
je 0x41b0f1
push ebx
call fcn.004601e0
add esp, 4
mov edi, eax
push edi
push ebx
push dword [ebp - 0x10]
push str.iexplore.exe
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x41b0e8
call fcn.0041c390
test al, al
jne 0x41b09e
mov eax, dword [0x4af2c0]
mov ecx, eax
sub ecx, 0
je 0x41b094
dec ecx
je 0x41b088
inc eax
mov dword [0x4af2c0], eax
jmp 0x41b09e
mov dword [0x4af2c0], 0
jmp 0x41b09e
mov dword [0x4af2c0], 2
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x4918d4
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x41b0e8
cmp dword [ebp - 0x14], 0
je 0x41b0e8
mov ecx, dword [ebp - 0x18]
cmp dword [ecx], 0xfeef04bd
jne 0x41b0e8
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push str._d._d._d._d
push esi
call fcn.00404500
add esp, 0x18
push edi
call fcn.0046208f
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41b9d0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47d028
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4ade78]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], 0
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, eax
shr ecx, 8
movzx edi, al
movzx ebx, cl
cmp eax, 0x80000000
jae 0x41ba1e
mov esi, eax
shr esi, 0x10
cmp edi, 6
jb 0x41ba48
cmp ebx, 2
jb 0x41ba48
mov esi, dword [ebp + 8]
push esi
call fcn.0041bac0
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x4adbb8]
mov ecx, 0x4adbb8
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push esi
push ebx
push edi
lea eax, [ebp - 0x10]
push str._d._d___d_
push eax
mov dword [ebp - 4], 0
call fcn.00404500
mov esi, dword [ebp - 0x10]
add esi, 0xfffffff0
push esi
call fcn.00403ee0
mov edi, dword [ebp + 8]
add eax, 0x10
mov dword [edi], eax
add esp, 0x18
mov dword [ebp - 4], 0xffffffff
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41baa8
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41c1b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
mov dword [edi], 0
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41c211
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x41c1ed
cmp eax, 2
jne 0x41c1ff
mov eax, dword [ebp + 0x10]
test esi, esi
je 0x41c20d
test eax, eax
je 0x41c20a
cmp byte [eax + esi - 1], 0
je 0x41c20d
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
mov byte [esi], 0
mov dword [edi], eax
xor eax, eax
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x41c540
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [0x4af2c0]
push ebx
push esi
lea eax, [ecx + 1]
lea esi, [ecx + 2]
imul esi, eax
imul esi, ecx
mov eax, esi
push edi
cdq
mov edi, 0x16
idiv edi
mov bl, 1
cmp edx, 0x13
jne 0x41c609
mov eax, esi
cdq
mov esi, 0x12
idiv esi
cmp edx, 9
jne 0x41c603
xor esi, esi
nop
mov edx, esi
and edx, 1
dec edx
not edx
and edx, ecx
mov eax, esi
sar eax, 1
xor edx, eax
mov eax, edx
and eax, 1
dec eax
not eax
and eax, ecx
sar edx, 1
xor eax, edx
mov edx, eax
and edx, 1
dec edx
sar eax, 1
not edx
and edx, ecx
xor edx, eax
mov eax, edx
and eax, 1
dec eax
not eax
and eax, ecx
sar edx, 1
xor eax, edx
mov edx, eax
and edx, 1
dec edx
sar eax, 1
not edx
and edx, ecx
xor edx, eax
mov eax, edx
and eax, 1
dec eax
not eax
and eax, ecx
sar edx, 1
xor eax, edx
mov edx, eax
and edx, 1
dec edx
sar eax, 1
not edx
and edx, ecx
xor edx, eax
mov eax, edx
and eax, 1
dec eax
not eax
and eax, ecx
sar edx, 1
xor eax, edx
inc esi
add ecx, eax
cmp esi, 0x100
jl 0x41c580
mov dword [0x4af2c0], ecx
pop edi
pop esi
xor al, al
pop ebx
ret
pop edi
pop esi
mov al, bl
pop ebx
ret