joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401200
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, edx
mov ebx, ecx
mov dword [ebp - 8], esi
test esi, esi
je 0x40135f
lea ecx, [esi*8]
mov eax, 0x2aaaaaab
imul ecx
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [esi*8]
lea eax, [ecx + ecx*2]
add eax, eax
sub edx, eax
sub edx, 2
je 0x401249
sub edx, 2
jne 0x40124c
add ecx, 2
jmp 0x40124c
add ecx, 3
mov eax, dword [ebp + 0xc]
inc ecx
cmp dword [eax], ecx
jge 0x401261
pop esi
mov dword [eax], ecx
mov eax, 0xfffffff0
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x55555556
imul esi
push edi
mov edi, dword [ebp + 8]
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
xor eax, eax
test ecx, ecx
jle 0x4012f6
dec ecx
mov eax, 0xaaaaaaab
mul ecx
mov eax, edx
shr eax, 1
inc eax
mov dword [ebp - 4], eax
lea eax, [eax + eax*2]
mov dword [ebp - 0xc], eax
movzx ecx, byte [ebx]
movzx edx, byte [ebx + 1]
mov eax, ecx
movzx esi, byte [ebx + 2]
add ebx, 3
shr eax, 2
shl ecx, 4
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_0123456789abcdef]
mov byte [edi], al
mov eax, edx
shr eax, 4
add eax, ecx
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_0123456789abcdef]
mov byte [edi + 1], al
mov eax, esi
shr eax, 6
and esi, 0x3f
lea eax, [eax + edx*4]
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_0123456789abcdef]
mov byte [edi + 2], al
movzx eax, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_0123456789abcdef]
mov byte [edi + 3], al
add edi, 4
sub dword [ebp - 4], 1
jne 0x401292
mov esi, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
cmp eax, esi
jge 0x401351
movzx edx, byte [ebx]
inc eax
mov dword [ebp - 0xc], eax
cmp eax, esi
jge 0x40130b
movzx ecx, byte [ebx + 1]
jmp 0x40130d
xor ecx, ecx
mov eax, edx
shl edx, 4
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_0123456789abcdef]
mov byte [edi], al
mov eax, ecx
shr eax, 4
add eax, edx
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_0123456789abcdef]
mov byte [edi + 1], al
cmp dword [ebp - 0xc], esi
jge 0x401346
and ecx, 0xf
mov al, byte [ecx*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_0123456789abcdef]
mov byte [edi + 2], al
jmp 0x40134a
mov byte [edi + 2], 0x3d
mov byte [edi + 3], 0x3d
add edi, 4
mov ecx, dword [ebp + 0xc]
mov eax, edi
sub eax, dword [ebp + 8]
mov dword [ecx], eax
mov byte [edi], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402530
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x627a40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0x210]
push ebx
push esi
push edi
mov dword [ebp - 0x124], ecx
mov dword [ecx + 0x214], eax
call fcn.004366a0
test al, al
je 0x402575
inc esi
inc eax
mov esi, 0x191fab1b
or ah, ah
mov ch, 0x1c
pop eax
adc ebx, ecx
cmp eax, 0x91986e7
insd dword es:[edi], dx
call fcn.00436400
test al, al
je 0x40259c
and al, 0xb
sbb byte [ecx + 0x21], dh
sbb esi, esi
into
invalid
call fcn.004364e0
test al, al
je 0x4025c4
sbb dword [ebx], ecx
invalid
push 0x114
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.00576f50
add esp, 0xc
mov dword [ebp - 0x120], 0x114
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x110], 2
mov edi, dword [ebp - 0x124]
jne 0x402609
mov ecx, edi
call fcn.00401b50
jmp 0x402621
xor esi, esi
xor eax, eax
nop dword [eax]
test eax, eax
jne 0x402621
mov ecx, edi
call fcn.00401f30
inc esi
cmp esi, 0xa
jl 0x402610
mov ecx, dword [edi + 0x214]
mov eax, 0x4bda12f7
sub ecx, dword [edi + 0x210]
imul ecx
mov ecx, dword [ebp - 4]
sar edx, 7
xor ecx, ebp
pop edi
mov eax, edx
shr eax, 0x1f
pop esi
add eax, edx
pop ebx
call fcn.00570ea9
mov esp, ebp
pop ebp
ret
Function at 0x402650
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, ecx
push ebx
lea ecx, [eax + 0x210]
mov dword [ebp - 0x10], eax
push esi
mov esi, dword [ecx]
xor bl, bl
push edi
mov byte [ebp - 1], bl
mov dword [ebp - 0x14], ecx
cmp esi, dword [eax + 0x214]
je 0x402752
mov ecx, dword [ebp + 8]
lea edi, [esi + 0x28]
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add ecx, 0xa8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edi
push ecx
call ebx
push 0x619470
call ebx
sub edi, 0xffffff80
push edi
call ebx
push 0x619470
call ebx
mov ecx, dword [ebp + 8]
lea eax, [ecx + 0x28]
push eax
call ebx
push 0x619470
call ebx
push dword [ebp - 8]
call ebx
push 0x619470
call ebx
mov eax, dword [ebp - 0xc]
mov cl, byte [eax]
cmp cl, byte [edi]
jne 0x4026e8
test cl, cl
je 0x4026e4
mov cl, byte [eax + 1]
cmp cl, byte [edi + 1]
jne 0x4026e8
add eax, 2
add edi, 2
test cl, cl
jne 0x4026c8
xor eax, eax
jmp 0x4026ed
sbb eax, eax
or eax, 1
mov edi, dword [ebp - 8]
test eax, eax
jne 0x402729
mov edx, dword [ebp + 8]
mov ecx, edi
lea eax, [edx + 0x28]
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x402720
test dl, dl
je 0x40271c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x402720
add eax, 2
add ecx, 2
test dl, dl
jne 0x402700
xor eax, eax
jmp 0x402725
sbb eax, eax
or eax, 1
test eax, eax
je 0x40274b
mov eax, dword [ebp - 0x10]
add esi, 0x1b0
add edi, 0x1b0
mov dword [ebp - 8], edi
cmp esi, dword [eax + 0x214]
je 0x40274f
mov ecx, dword [ebp - 0xc]
jmp 0x402692
mov bl, 1
jmp 0x402752
mov bl, byte [ebp - 1]
call fcn.00436160
test al, al
je 0x40276b
adc byte [edi + ebp*8], ch
sub al, 0xef
neg dword [esi + 0x68]
leave
jae 0x40275a
mov byte [0xc5f6e027], al
das
pop ebp
test bl, bl
jne 0x40279f
mov ecx, dword [ebp + 8]
lea edx, [ecx + 0xa8]
lea esi, [edx + 1]
nop dword [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x402780
sub edx, esi
je 0x40279f
push ecx
mov ecx, dword [ebp - 0x14]
call fcn.00402830
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x405460
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
push str.kernel32.dll
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi], eax
call fcn.00435f30
test al, al
je 0x405493
or al, byte [ebx]
add byte [eax + eax*8 - 0x3b0bee8c], al
sub dword [ebx], esi
invalid
hlt
call fcn.00436550
test al, al
je 0x4054bb
into
or al, 0xd3
sub eax, dword [eax - 0x1efa9530]
aam 0xfe
mov byte [0x7f6a7fc], al
mov esp, 0xc06f268c
xchg edi, eax
cmp dword [eax + 0x19b6c15f], 0x23
and eax, 0x30df0e8
add byte [eax + eax*8 + 0x7baa1674], al
mov ah, 0x80
cmpsb byte [esi], byte es:[edi]
xor byte [edi - 0x227f79de], ah
lea edi, [eax]
outsb dx, byte gs:[esi]
cmp byte [edx + 5], bl
call fcn.004362b0
test al, al
je 0x4054da
stosb byte es:[edi], al
jnp 0x40547b
and byte [esi - 0x79dd58d0], 0x80
fisttp qword [ebp - 0xc919ac8]
cmp byte [edx + 5], bl
push ebx
test eax, 0xfc5d8b93
mov ebx, dword [ebp - 4]
mov eax, dword [ebx]
test eax, eax
jne 0x4054ec
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x6194fc
push eax
call esi
push str.IsWow64Process
push dword [ebx]
mov dword [ebx + 8], eax
call esi
push str.Wow64DisableWow64FsRedirection
push dword [ebx]
mov dword [ebx + 0xc], eax
call esi
push str.Wow64RevertWow64FsRedirection
push dword [ebx]
mov dword [ebx + 0x18], eax
call esi
push str.GetSystemWow64DirectoryW
push dword [ebx]
mov dword [ebx + 0x14], eax
call esi
push str.advapi32.dll
mov dword [ebx + 0x10], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebx + 4], eax
call fcn.00436550
test al, al
je 0x40555f
sub byte [ebx - 0x328fe231], al
and al, ch
in al, 0xd4
cmp al, byte [eax + edi*8 + 0x33047971]
fbld tbyte [eax - 0x3b02a471]
add al, 0xac
lodsd eax, dword [esi]
dec esi
call fcn.00436390
test al, al
je 0x405586
fdivr qword [ebx + 0x60]
insd dword es:[edi], dx
test eax, 0xde3f4541
mov ecx, 0xe0ee5fc1
pop edi
sub eax, 0x5f411a5c
pop esi
cwde
push ebx
and al, 0x3f
xor dl, byte [esi]
xchg ecx, eax
fimul word gs:[ebx + 0x468bfc75]
add al, 0x85
ror byte [edi], 0x84
dec edi
invalid
mov esi, dword [ebp - 4]
mov eax, dword [esi + 4]
test eax, eax
je 0x4054e3
push str.Wow64RevertWow64FsRedirection
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Wow64RevertWow64FsRedirection
push dword [esi + 4]
mov dword [esi + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
pop edi
mov dword [esi + 0x1c], eax
mov eax, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407e90
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x627a40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x20
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x1c]
push str.bea7c6963deb46f081eaf1a0607baba0
mov dword [ebp - 0x20], eax
mov dword [ebp - 8], 0xf
mov dword [ebp - 0xc], 0
mov byte [ebp - 0x1c], 0
call fcn.00407270
cmp dword [ebp - 0xc], 0x100
mov eax, dword [ebp - 8]
jbe 0x407f08
cmp eax, 0x10
jb 0x407eeb
inc eax
lea ecx, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
call fcn.00407760
retf
cmp eax, 0x10
jb 0x407f1a
inc eax
lea ecx, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
call fcn.00407760
push 0x20
push str.a33466410fea7987d8e4508243907c45
lea ecx, [ebp - 0x1c]
mov dword [ebp - 8], 0xf
mov dword [ebp - 0xc], 0
mov byte [ebp - 0x1c], 0
call fcn.00407270
cmp dword [ebp - 0xc], 0x100
mov eax, dword [ebp - 8]
jbe 0x407f79
cmp eax, 0x10
jb 0x407f59
inc eax
lea ecx, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
call fcn.00407760
xchg esi, eax
wait
inc byte [ebx - 0x53f927d3]
in al, dx
pop ss
and dword [esi], esi
push cs
mov ecx, 0x348e3ba
sub ch, byte [edi]
push 0x2ee39db4
test al, 0x5d
lcall 0xf883, 0x12eb3fe0
adc byte [edx + 0xd], dh
cmp eax, 0x10
jb 0x407f8b
inc eax
lea ecx, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
call fcn.00407760
push dword [ebp - 0x20]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, dword [ebp - 0x24]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0xb7
pop edi
sete cl
mov dword [esi + 4], ecx
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00570ea9
mov esp, ebp
pop ebp
ret 4
Function at 0x4082e0
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6a4
mov eax, dword [0x627a40]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x18], ax
xorps xmm0, xmm0
mov word [ebp - 6], ax
lea eax, [ebp - 0x284]
push eax
mov dword [ebp - 0x6a4], 0
movups xmmword [ebp - 0x16], xmm0
call fcn.00576f50
add esp, 0xc
lea eax, [ebp - 0x284]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 3
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0057db90
push 0x208
lea eax, [ebp - 0x694]
push 0
push eax
call fcn.00576f50
push 0x208
lea eax, [ebp - 0x48c]
push 0
push eax
call fcn.00576f50
push 0x64
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x698], 0
push 0
push eax
mov dword [ebp - 0x6a0], 0
mov dword [ebp - 0x69c], 0
call fcn.00576f50
add esp, 0x30
lea eax, [ebp - 0x48c]
push 0x104
push eax
lea eax, [ebp - 0x69c]
push eax
lea eax, [ebp - 0x6a0]
push eax
lea eax, [ebp - 0x698]
push eax
push 0x104
lea eax, [ebp - 0x694]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x4083f1
push dword [ebp - 0x698]
lea eax, [ebp - 0x7c]
push str._08X
push eax
call fcn.004017c0
add esp, 0xc
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
cmp byte [ebp - 0x7c], 0
jne 0x40840c
xor eax, eax
jmp 0x40841b
lea eax, [ebp - 0x7c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408412
sub eax, edx
push eax
lea eax, [ebp - 0x7c]
mov ecx, esi
push eax
call fcn.00407270
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00570ea9
mov esp, ebp
pop ebp
ret 4
Function at 0x40a5f0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4c
mov eax, dword [0x627a40]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
lea eax, [ebp - 0x210]
mov esi, ecx
push 0
push eax
call fcn.00576f50
lea eax, [esi + 0x2c]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x40a627
mov eax, dword [eax]
push str.Config
push eax
lea eax, [ebp - 0x210]
push 0x6197c0
push eax
call fcn.00408f60
add esp, 0x10
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40a65d
lea ecx, [ebp - 0x210]
call fcn.00423740
push 0x208
lea eax, [ebp - 0x418]
push 0
push eax
call fcn.00576f50
add esp, 0xc
lea eax, [ebp - 0x210]
push str.UseVestige.ini
push eax
lea eax, [ebp - 0x418]
push str._s_s
push eax
call fcn.00408f60
add esp, 0x10
cmp word [ebp - 0x418], 0
jne 0x40a6a1
xor ecx, ecx
jmp 0x40a6bf
lea ecx, [ebp - 0x418]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40a6b0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x418]
push eax
lea ecx, [esi + 0x8c]
call fcn.00403d10
push 0x208
lea eax, [ebp - 0x620]
push 0
push eax
call fcn.00576f50
add esp, 0xc
lea eax, [ebp - 0x210]
push str.Cache.ini
push eax
lea eax, [ebp - 0x620]
push str._s_s
push eax
call fcn.00408f60
add esp, 0x10
cmp word [ebp - 0x620], 0
jne 0x40a716
xor ecx, ecx
jmp 0x40a72f
lea ecx, [ebp - 0x620]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40a720
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x620]
push eax
lea ecx, [esi + 0xa4]
call fcn.00403d10
push 0x208
lea eax, [ebp - 0x828]
push 0
push eax
call fcn.00576f50
add esp, 0xc
lea ecx, [ebp - 0xa48]
mov edx, str.ShxlPath
call fcn.00423ab0
cmp dword [eax + 0x14], 8
jb 0x40a770
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x828]
push 0x619814
push eax
call fcn.00408f60
mov eax, dword [ebp - 0xa34]
add esp, 0xc
cmp eax, 8
jb 0x40a7a3
inc eax
lea ecx, [ebp - 0xa48]
push eax
push dword [ebp - 0xa48]
call fcn.00404090
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40a7bf
lea ecx, [ebp - 0x828]
call fcn.00423740
push 0x208
lea eax, [ebp - 0xa30]
push 0
push eax
call fcn.00576f50
add esp, 0xc
lea eax, [ebp - 0x828]
push str.Cache.ini
push eax
lea eax, [ebp - 0xa30]
push str._s_s
push eax
call fcn.00408f60
add esp, 0x10
cmp word [ebp - 0xa30], 0
jne 0x40a803
xor ecx, ecx
jmp 0x40a81f
lea ecx, [ebp - 0xa30]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40a810
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0xa30]
push eax
lea ecx, [esi + 0xbc]
call fcn.00403d10
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00570ea9
mov esp, ebp
pop ebp
ret
Function at 0x40b750
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59d17e
mov eax, dword fs:[0]
push eax
sub esp, 0x828
mov eax, dword [0x627a40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x810]
push 0x800
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x830], esi
mov dword [ebp - 0x82c], 0
call fcn.00576f50
lea eax, [edi + 0x8c]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x40b7bd
mov eax, dword [eax]
push eax
push 0x400
lea eax, [ebp - 0x810]
push eax
push str.guanf
push str.Spreader
push str.AppInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x40b805
mov eax, dword [esi]
jmp 0x40b807
mov eax, esi
xor ecx, ecx
mov word [eax], cx
cmp word [ebp - 0x810], cx
je 0x40b82f
lea ecx, [ebp - 0x810]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40b820
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x810]
mov ecx, esi
push eax
call fcn.00403d10
mov dword [ebp - 4], 0
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x82c], 1
jb 0x40b859
mov eax, dword [esi]
jmp 0x40b85b
mov eax, esi
mov ecx, str.guanf
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40b886
test dx, dx
je 0x40b882
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40b886
add eax, 4
add ecx, 4
test dx, dx
jne 0x40b860
xor eax, eax
jmp 0x40b88b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40b968
cmp byte [edi + 5], 0
lea eax, [ebp - 0x828]
push str.guanf
push str.Spreader
push str.AppInfo
push eax
je 0x40b905
mov ecx, edi
call fcn.0040bb70
mov edi, eax
cmp esi, edi
je 0x40b8f6
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x40b8cf
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.00404090
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x40b8e7
mov eax, dword [esi]
jmp 0x40b8e9
mov eax, esi
xor ecx, ecx
mov word [eax], cx
mov ecx, esi
push edi
call fcn.00403f30
mov ecx, dword [ebp - 0x814]
cmp ecx, 8
jb 0x40b968
inc ecx
push ecx
jmp 0x40b957
call fcn.0040bb40
mov edi, eax
cmp esi, edi
je 0x40b94a
mov ecx, dword [esi + 0x14]
cmp ecx, 8
jb 0x40b923
inc ecx
push ecx
push dword [esi]
mov ecx, esi
call fcn.00404090
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x40b93b
mov eax, dword [esi]
jmp 0x40b93d
mov eax, esi
xor ecx, ecx
mov word [eax], cx
mov ecx, esi
push edi
call fcn.00403f30
mov eax, dword [ebp - 0x814]
cmp eax, 8
jb 0x40b968
inc eax
push eax
push dword [ebp - 0x828]
lea ecx, [ebp - 0x828]
call fcn.00404090
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00570ea9
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40b990
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59d1c7
mov eax, dword fs:[0]
push eax
sub esp, 0x834
mov eax, dword [0x627a40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0xa0], 8
lea eax, [esi + 0x8c]
jb 0x40b9cf
mov eax, dword [eax]
push eax
push 0
push str.09e8a
push str.Setting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
jne 0x40bb1c
push eax
push 0x619488
lea ecx, [ebp - 0x828]
mov dword [ebp - 0x814], 7
mov dword [ebp - 0x818], eax
mov word [ebp - 0x828], ax
call fcn.00403d10
push 0x800
lea eax, [ebp - 0x810]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.00576f50
push 0
lea eax, [ebp - 0x810]
push 0x6198b4
push eax
call fcn.00408f60
add esp, 0x18
lea eax, [ebp - 0x810]
cmp byte [esi + 5], 0
push eax
push str.09e8a
lea eax, [ebp - 0x840]
push str.Setting
push eax
je 0x40ba6b
mov ecx, esi
call fcn.0040bb70
mov esi, eax
jmp 0x40ba72
call fcn.0040bb40
mov esi, eax
lea eax, [ebp - 0x828]
cmp eax, esi
je 0x40babf
mov eax, dword [ebp - 0x814]
cmp eax, 8
jb 0x40ba9a
inc eax
lea ecx, [ebp - 0x828]
push eax
push dword [ebp - 0x828]
call fcn.00404090
xor eax, eax
mov dword [ebp - 0x814], 7
push esi
lea ecx, [ebp - 0x828]
mov dword [ebp - 0x818], eax
mov word [ebp - 0x828], ax
call fcn.00403f30
mov eax, dword [ebp - 0x82c]
cmp eax, 8
jb 0x40badd
inc eax
lea ecx, [ebp - 0x840]
push eax
push dword [ebp - 0x840]
call fcn.00404090
cmp dword [ebp - 0x814], 8
lea eax, [ebp - 0x828]
cmovae eax, dword [ebp - 0x828]
push eax
call fcn.0057e886
mov esi, eax
add esp, 4
mov eax, dword [ebp - 0x814]
cmp eax, 8
jb 0x40bb1a
inc eax
lea ecx, [ebp - 0x828]
push eax
push dword [ebp - 0x828]
call fcn.00404090
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00570ea9
mov esp, ebp
pop ebp
ret 0xc
Function at 0x412ee0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, edx
mov dword [esp + 0xc], ecx
test edi, edi
jle 0x412ff9
lea eax, [ecx + 0x80]
mov dword [esp + 0x1c], eax
lea edx, [ebx + 2]
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], edx
lea esi, [eax + 2]
sub eax, ebx
lea ecx, [eax - 2]
lea eax, [edi - 1]
mov dword [esp + 0x18], ecx
shr eax, 3
inc eax
mov dword [esp + 0x14], eax
movzx eax, byte [edx - 2]
add ecx, edx
push ecx
mov byte [ecx], al
movzx eax, byte [edx - 1]
mov byte [esi - 1], al
movzx eax, byte [edx]
mov byte [esi], al
movzx eax, byte [edx + 1]
mov byte [esi + 1], al
movzx eax, byte [edx + 2]
mov byte [esi + 2], al
movzx eax, byte [edx + 3]
mov byte [esi + 3], al
movzx eax, byte [edx + 4]
mov byte [esi + 4], al
movzx eax, byte [edx + 5]
mov byte [esi + 5], al
mov edi, dword [edx - 2]
mov ebx, dword [edx + 2]
mov edx, ecx
mov ecx, dword [esp + 0x20]
call fcn.004125a0
mov ecx, dword [esp + 0x10]
lea esi, [esi + 8]
mov edx, dword [esp + 0x14]
add esp, 4
movzx eax, byte [ecx + 0x100]
mov ecx, dword [esp + 0x18]
xor byte [edx + ecx], al
add edx, 8
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x10], edx
movzx eax, byte [ecx + 0x101]
xor byte [esi - 9], al
movzx eax, byte [ecx + 0x102]
xor byte [esi - 8], al
movzx eax, byte [ecx + 0x103]
xor byte [esi - 7], al
movzx eax, byte [ecx + 0x104]
xor byte [esi - 6], al
movzx eax, byte [ecx + 0x105]
xor byte [esi - 5], al
movzx eax, byte [ecx + 0x106]
xor byte [esi - 4], al
movzx eax, byte [ecx + 0x107]
xor byte [esi - 3], al
sub dword [esp + 0x14], 1
mov dword [ecx + 0x100], edi
mov dword [ecx + 0x104], ebx
mov ecx, dword [esp + 0x18]
jne 0x412f28
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x413b00
Capabilities:
Get system information on windows
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
mov dword [ebp - 8], edi
xor ebx, ebx
mov dword [ebp - 4], esi
call fcn.00436550
Function at 0x418080
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x627a40]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x418]
mov dword [ebp - 0x428], ecx
push eax
push 9
xor esi, esi
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
push reloc.WS2_32.dll_accept
mov dword [ebp - 0x418], esi
mov dword [ebp - 0x41c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4180d7
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00570ea9
mov esp, ebp
pop ebp
ret
push ebx
push edi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00576f50
add esp, 0xc
lea eax, [ebp - 0x20c]
xor edi, edi
push 0x104
push eax
push edi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4181e4
nop dword [eax + eax]
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4181c2
push 0x208
push eax
lea eax, [ebp - 0x414]
mov dword [ebp - 0x420], 0x104
push eax
call fcn.00576f50
add esp, 0xc
mov dword [ebp - 0x424], 1
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x424]
push eax
push 0
push str.DisplayName
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4181b6
push dword [ebp - 0x428]
lea eax, [ebp - 0x414]
push eax
call fcn.0057612d
add esp, 8
test eax, eax
mov eax, 1
cmovne esi, eax
push dword [ebp - 0x41c]
call ebx
test esi, esi
jne 0x4181e4
push 0x104
lea eax, [ebp - 0x20c]
inc edi
push eax
push edi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x418120
push dword [ebp - 0x418]
call ebx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop ebx
xor ecx, ebp
pop esi
call fcn.00570ea9
mov esp, ebp
pop ebp
ret