joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406fd3
Capabilities:
Read file on windows

Disassembly:
push ebp
sub esp, 0x46c
lea ebp, [esp - 4]
mov eax, dword [0x452c60]
xor eax, ebp
mov dword [ebp + 0x46c], eax
push 0x10
mov eax, 0x438e92
call fcn.00424c64
mov eax, dword [ebp + 0x478]
mov dword [ebp - 0x14], eax
xor edi, edi
lea eax, [ebp]
mov esi, ecx
mov ebx, edx
mov dword [ebp - 0x18], edi
call fcn.00402f15
mov dword [ebx], edi
mov dword [ebp - 4], edi
xor eax, eax
cmp eax, 0x100
jge 0x407026
mov dword [ebp + eax*4 + 0x6c], edi
inc eax
jmp 0x407018
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x1c], eax
cmp eax, 0xffffffff
je 0x40709f
push edi
lea eax, [ebp - 0x18]
push eax
push 0x400
lea eax, [ebp + 0x6c]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x407077
mov eax, dword [ebp - 0x18]
cmp eax, edi
je 0x407077
add dword [ebx], eax
lea ecx, [ebp + 0x6c]
push ecx
lea esi, [ebp]
call fcn.004070cc
jmp 0x407045
lea ecx, [ebp]
call fcn.00407160
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x14]
lea ebx, [ebp + 0x58]
call fcn.00406ef0
mov eax, dword [ebp - 0x14]
pop ecx
jmp 0x4070a9
mov esi, dword [ebp - 0x14]
call fcn.0040265f
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x46c]
xor ecx, ebp
call fcn.00421987
add ebp, 0x470
leave
ret

Function at 0x4078c4
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [edi + 4]
and dword [ebp - 8], 0
mov dword [ebp - 4], eax
mov eax, dword [edi]
movzx ecx, word [eax + 0x14]
push ebx
push esi
lea esi, [ecx + eax + 0x18]
xor ecx, ecx
cmp cx, word [eax + 6]
jae 0x40798e
add esi, 0x10
mov eax, dword [esi]
test eax, eax
jne 0x40792e
mov eax, dword [ebp + 0x10]
mov ebx, dword [eax + 0x38]
test ebx, ebx
jle 0x407979
push dword [edi + 0x34]
mov eax, dword [esi - 4]
add eax, dword [ebp - 4]
push 4
push 0x1000
push ebx
push eax
call dword [edi + 0x1c]
add esp, 0x14
test eax, eax
je 0x407995
mov eax, dword [esi - 4]
add eax, dword [ebp - 4]
push ebx
push 0
push eax
mov dword [esi - 8], eax
call fcn.00425210
jmp 0x407976
mov ecx, dword [esi + 4]
add ecx, eax
mov eax, dword [ebp + 0xc]
push ecx
call fcn.004078af
pop ecx
test eax, eax
je 0x407995
push dword [edi + 0x34]
mov eax, dword [esi - 4]
add eax, dword [ebp - 4]
push 4
push 0x1000
push dword [esi]
push eax
call dword [edi + 0x1c]
add esp, 0x14
test eax, eax
je 0x407995
mov eax, dword [esi + 4]
push dword [esi]
mov ebx, dword [esi - 4]
add eax, dword [ebp + 8]
add ebx, dword [ebp - 4]
push eax
push ebx
call fcn.004277b0
mov dword [esi - 8], ebx
add esp, 0xc
mov eax, dword [edi]
movzx eax, word [eax + 6]
inc dword [ebp - 8]
add esi, 0x28
cmp dword [ebp - 8], eax
jl 0x4078ee
xor eax, eax
inc eax
pop esi
pop ebx
leave
ret
xor eax, eax
jmp 0x407991
Function at 0x4084de
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
fld1
fstp dword [ebp - 4]
call fcn.004081ea
cmp eax, 0x90
jne 0x4084fd
fld dword [0x44b248]
fstp dword [ebp - 4]
push esi
push edi
push 0x400
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
fld dword [ebp - 4]
fmul qword [0x44b240]
mov esi, eax
xor eax, eax
mov word [esi + 8], ax
call fcn.004273e0
fld dword [ebp - 4]
fmul qword [0x44b238]
mov word [esi + 0xe], ax
call fcn.004273e0
mov word [esi + 0x10], ax
xor eax, eax
mov dword [esi], 0x80c80880
mov word [esi + 0xa], ax
mov word [esi + 0xc], ax
mov word [esi + 0x12], ax
push edi
mov word [esi + 0x14], ax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea eax, [ebp - 8]
push eax
xor esi, esi
push esi
push dword [ebp + 0xc]
push 0x408197
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push esi
push 0x408299
push dword [ebp + 0xc]
mov dword [0x457350], eax
push edi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamA]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x409379
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
lea ebp, [esp - 0x384]
sub esp, 0x404
mov eax, dword [0x452c60]
xor eax, ebp
mov dword [ebp + 0x380], eax
push 0x3ff
lea eax, [ebp - 0x7f]
push 0
push eax
call fcn.00425210
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
push 1
push 0
mov byte [ebp - 0x80], 0x43
mov byte [ebp - 0x73], 0x6c
mov byte [ebp - 0x7b], 0x6c
mov byte [ebp - 0x6d], 0x72
mov byte [ebp - 0x72], 0x65
mov byte [ebp - 0x76], 0x74
mov byte [ebp - 0x79], 0x49
mov byte [ebp - 0x6b], 0x75
mov byte [ebp - 0x6e], 0x61
mov byte [ebp - 0x70], 0x53
mov byte [ebp - 0x7d], 0x65
mov byte [ebp - 0x6c], 0x74
mov byte [ebp - 0x74], 0x6c
mov byte [ebp - 0x77], 0x73
mov byte [ebp - 0x7c], 0x6c
mov byte [ebp - 0x7f], 0x61
mov byte [ebp - 0x7e], 0x70
mov byte [ebp - 0x75], 0x61
mov byte [ebp - 0x7a], 0x61
mov byte [ebp - 0x78], 0x6e
mov byte [ebp - 0x6a], 0x70
mov byte [ebp - 0x71], 0x72
mov byte [ebp - 0x6f], 0x74
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x458b58], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x458b58], 0
je 0x409430
cmp eax, 0xb7
je 0x409430
mov al, 1
jmp 0x409432
xor al, al
mov ecx, dword [ebp + 0x380]
xor ecx, ebp
call fcn.00421987
add ebp, 0x384
leave
ret
Function at 0x409afb
Capabilities:
Create process on windows
Get comspec environment variable
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc34
mov eax, dword [0x452c60]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push 0x3ff
lea eax, [ebp - 0x433]
push ebx
push eax
mov byte [ebp - 0x434], bl
call fcn.00425210
push 0x7ff
lea eax, [ebp - 0xc33]
push ebx
push eax
mov byte [ebp - 0xc34], bl
call fcn.00425210
add esp, 0x18
push 0x400
lea eax, [ebp - 0x434]
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jbe 0x409baa
push esi
push edi
push 0xb
pop ecx
mov esi, str._d__c_timeout_5__cmd__d__c_rmdir__s__q___s_
lea edi, [ebp - 0x34]
rep movsd dword es:[edi], dword [esi]
push 0x458b60
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0xc34]
push 0x800
push eax
movsb byte es:[edi], byte [esi]
call fcn.004227dc
add esp, 0x10
push ebx
push ebx
lea eax, [ebp - 0xc34]
push eax
lea eax, [ebp - 0x434]
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00421987
leave
ret
Function at 0x40a6e7
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
xor ebx, ebx
push 0x8e
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call fcn.00402672
add esp, 0xc
test al, al
je 0x40a755
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40a74a
push ebx
lea eax, [ebp + 8]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
push dword [ebp - 4]
call fcn.00412d7f
pop ecx
mov al, bl
pop esi
pop ebx
leave
ret 4

Function at 0x40a75b
Capabilities:
Create directory
Get common file path
Get program files directory

Disassembly:
push 0x75c
mov eax, 0x43951f
call fcn.00424c9a
xor ebx, ebx
mov esi, ecx
mov dword [ebp - 0x74c], esi
cmp dword [0x458f70], ebx
je 0x40a7a6
push 5
call dword [0x458f58]
pop ecx
cmp eax, ebx
jne 0x40a8e3
cmp dword [0x458f70], ebx
je 0x40a7a6
push 0x1c
call dword [0x458f58]
pop ecx
cmp eax, ebx
jne 0x40a8e3
cmp byte [esi + 0x94], 1
je 0x40a8e3
push 0x43fecb
mov esi, 0x45a178
push 0x440d2c
lea edi, [ebp - 0x748]
mov ecx, esi
call fcn.0040348b
push 0x43fff4
mov eax, edi
mov dword [ebp - 4], ebx
call fcn.00403e68
test eax, eax
jne 0x40a8d5
mov eax, dword [ebp - 0x74c]
push 0x84e
push esi
xor ecx, ecx
lea edi, [ebp - 0x768]
mov byte [eax + 0x97], 1
call fcn.004033b1
push ebx
push 1
mov ecx, edi
call fcn.00402614
push ebx
push 0x2a
lea eax, [ebp - 0x11c]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x32c]
push eax
call esi
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendA]
push str.BetelgeuseDirectory
lea eax, [ebp - 0x11c]
push eax
call edi
push ebx
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x224]
push eax
call esi
push str.SpratLighten
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x224]
push str._s_s.exe
push eax
call fcn.0040c4b3
add esp, 0x10
lea eax, [ebp - 0x224]
push eax
call fcn.0040a6e7
test al, al
je 0x40a8d5
push str.DependencyScrubR4
lea eax, [ebp - 0x32c]
push eax
call edi
lea eax, [ebp - 0x32c]
push eax
lea eax, [ebp - 0x72c]
push str._p__s_
push eax
call fcn.00402efa
add esp, 0xc
lea eax, [ebp - 0x72c]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.00404363
push ebx
push 1
lea ecx, [ebp - 0x748]
call fcn.00402614
call fcn.00424d1d
ret
Function at 0x40c0e8
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, eax
add esi, 0x11b8
mov eax, dword [esi]
push edi
test eax, eax
je 0x40c10d
push 0x249f00
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
and dword [esi], 0
push 0x604
mov esi, 0x45a178
push esi
xor ecx, ecx
lea edi, [ebp - 0x1c]
call fcn.004033b1
push 0
push 1
mov ecx, edi
call fcn.00402614
call fcn.0040c009
push 0x456f40
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0x72b
push esi
xor ecx, ecx
lea edi, [ebp - 0x1c]
call fcn.004033b1
push 0
push 1
mov ecx, edi
call fcn.00402614
pop edi
pop esi
leave
ret

Function at 0x40c15c
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x490]
sub esp, 0x510
mov eax, dword [0x452c60]
xor eax, ebp
mov dword [ebp + 0x48c], eax
mov eax, 0x458c68
mov dword [0x458f80], 2
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40c189
push ebx
xor ebx, ebx
push esi
sub eax, ecx
inc ebx
push edi
mov edi, str.25b8df9ddd1d463ba23e9fb44a316f89
mov esi, 0x458d70
cmp eax, 0x2a
jne 0x40c1ba
push edi
push esi
call fcn.00423f1d
pop ecx
pop ecx
test eax, eax
je 0x40c1ba
mov dword [0x458f80], ebx
xor eax, eax
cmp dword [0x458f80], ebx
push str..txt
sete al
push eax
push esi
push str._s__d_s
lea eax, [ebp + 0x388]
push 0x104
push eax
call fcn.004227dc
add esp, 0x18
xor esi, esi
push esi
push 0x80
push 2
push esi
push ebx
push 0x40000000
lea eax, [ebp + 0x388]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x7c], eax
cmp eax, 0xffffffff
je 0x40c26c
push 0x3ff
lea eax, [ebp - 0x77]
push esi
push eax
mov byte [ebp - 0x78], 0
call fcn.00425210
xor eax, eax
cmp dword [0x458f80], ebx
sete al
push eax
push edi
push str._s____d_n
lea eax, [ebp - 0x78]
push 0x400
push eax
call fcn.004227dc
lea eax, [ebp - 0x78]
add esp, 0x20
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40c247
sub eax, ecx
push esi
lea ecx, [ebp - 0x80]
push ecx
push eax
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x48c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00421987
add ebp, 0x490
leave
ret

Function at 0x40c901
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [edi + 0x6bc]
test eax, eax
je 0x40c91d
mov ecx, 0xb0
push ecx
push eax
push ecx
push edi
call fcn.004219e7
add esp, 0x10
ret
push esi
push 0
lea esi, [edi + 0x6c4]
push 0
push dword [esi]
call fcn.00422e23
push dword [esi]
push 1
push 0xb0
push edi
call fcn.00424371
add esp, 0x1c
pop esi
ret
Function at 0x40c943
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, eax
mov ecx, dword [edi + 0x6bc]
test ecx, ecx
je 0x40c979
mov eax, dword [edi + 0x30]
mov ebx, dword [edi + 0x34]
add eax, ecx
push ebx
mov dword [ebp - 4], eax
call fcn.00412d8a
push ebx
push dword [ebp - 4]
mov esi, eax
push ebx
push esi
call fcn.004219e7
add esp, 0x14
jmp 0x40c9a6
push 0
push dword [edi + 0x30]
push dword [edi + 0x6c4]
call fcn.00422e23
mov ebx, dword [edi + 0x34]
push ebx
call fcn.00412d8a
push dword [edi + 0x6c4]
mov esi, eax
push 1
push ebx
push esi
call fcn.00424371
add esp, 0x20
xor eax, eax
test ebx, ebx
jbe 0x40c9c5
mov dl, byte [esi + eax]
mov ecx, eax
shr ecx, 1
add ecx, esi
mov byte [ecx], dl
mov dl, byte [esi + eax + 1]
add eax, 4
mov byte [ecx + 1], dl
cmp eax, ebx
jb 0x40c9ac
push ebx
push esi
lea eax, [edi + 0x2bc]
call fcn.0040ca16
mov edi, dword [esi]
push edi
mov dword [ebp - 4], eax
call fcn.00412d8a
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
push edi
lea ecx, [esi + 8]
push ecx
push edi
push eax
call fcn.004219e7
mov eax, dword [ebp + 0xc]
add esp, 0x14
mov dword [eax], edi
mov ecx, ebx
mov eax, esi
test ebx, ebx
je 0x40ca05
mov byte [eax], 0
inc eax
dec ecx
jne 0x40c9fe
push esi
call fcn.00412d7f
mov eax, dword [ebp - 4]
pop ecx
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x40d27e
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x598]
sub esp, 0x618
mov eax, dword [0x452c60]
xor eax, ebp
mov dword [ebp + 0x594], eax
push esi
push edi
push 0x3ff
xor esi, esi
lea eax, [ebp - 0x73]
mov edi, ecx
push esi
push eax
mov dword [ebp - 0x80], edi
mov byte [ebp - 0x74], 0
call fcn.00425210
push edi
lea eax, [ebp - 0x74]
push 0x400
push eax
call fcn.00423114
add esp, 0x18
push 5
push esi
push esi
lea eax, [ebp - 0x74]
push eax
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [ebp - 0x7c], eax
cmp eax, 0x20
ja 0x40d3bb
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x78]
push eax
push 1
push esi
push str..htm
push 0x80000000
call ebx
cmp eax, esi
jne 0x40d3ba
lea eax, [ebp - 0x78]
push eax
lea edi, [ebp + 0x38c]
call fcn.0040d109
cmp eax, esi
jne 0x40d3ba
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push str._shellopencommand
mov eax, edi
push eax
call esi
lea eax, [ebp - 0x78]
push eax
push 1
push 0
mov eax, edi
push eax
push 0x80000000
call ebx
test eax, eax
jne 0x40d3ba
lea eax, [ebp - 0x78]
push eax
call fcn.0040d109
test eax, eax
jne 0x40d3ba
mov eax, edi
push str.__1_
push eax
call fcn.00423f1d
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x40d397
lea eax, [ebp + 0x38c]
push 0x441f38
push eax
call fcn.00423f1d
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x40d397
lea eax, [ebp + 0x38c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edi, [ebp + eax + 0x38b]
jmp 0x40d39a
mov byte [edi], 0
push 0x441f3c
push edi
call esi
push dword [ebp - 0x80]
push edi
call esi
push 5
lea eax, [ebp + 0x38c]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov dword [ebp - 0x7c], eax
pop ebx
mov ecx, dword [ebp + 0x594]
mov eax, dword [ebp - 0x7c]
pop edi
xor ecx, ebp
pop esi
call fcn.00421987
add ebp, 0x598
leave
ret

Function at 0x40dcbc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x790]
sub esp, 0x810
mov eax, dword [0x452c60]
xor eax, ebp
mov dword [ebp + 0x78c], eax
push esi
push edi
push 0x7ff
lea eax, [ebp - 0x73]
push 0
push eax
mov edi, ecx
mov esi, edx
mov dword [ebp - 0x7c], 0xffff
mov byte [ebp - 0x74], 0
call fcn.00425210
mov esi, dword [esi]
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x78]
push eax
push 0
push edi
push esi
mov dword [ebp - 0x80], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40dd27
cmp dword [ebp - 0x78], 4
mov edi, dword [ebp - 0x74]
je 0x40dd2a
mov edi, dword [ebp - 0x7c]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x78c]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.00421987
add ebp, 0x790
leave
ret
Function at 0x40dd4a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x800
lea ebp, [esp - 4]
mov eax, dword [0x452c60]
xor eax, ebp
mov dword [ebp + 0x800], eax
push 0x14
mov eax, 0x438878
call fcn.00424c31
mov eax, dword [ebp + 0x80c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x810]
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], ebx
call fcn.0040265f
lea eax, [ebp - 0x18]
push eax
push 1
push ebx
mov dword [ebp - 4], ebx
push dword [ebp - 0x10]
mov dword [ebp - 0x1c], 1
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40de0b
push 0x7ff
lea eax, [ebp + 1]
push ebx
push eax
mov byte [ebp], bl
call fcn.00425210
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push dword [ebp - 0x14]
mov dword [ebp - 0x10], 0x800
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40de02
cmp dword [ebp - 0x14], 1
jne 0x40de02
lea eax, [ebp]
push eax
mov ecx, esi
mov byte [ebp + 0x7ff], bl
call fcn.0040227b
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x800]
xor ecx, ebp
call fcn.00421987
add ebp, 0x804
leave
ret 8
Function at 0x40e0e0
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x40
mov eax, 0x439d6a
call fcn.00424c31
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0x20], 0x10
mov ecx, dword [ebp + 0xc]
mov eax, 0x80000002
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ebx
jae 0x40e108
lea ecx, [ebp + 0xc]
lea edx, [ebp - 0x14]
push edx
push 0x20019
push ebx
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor edi, edi
inc edi
test eax, eax
jne 0x40e1bd
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x40e1bd
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x38]
push 0x580
push 0x28e44000
lea esi, [ebp - 0x34]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ecx
call fcn.0040e0b8
push 0x1792
push 0xf8648000
lea esi, [ebp - 0x2c]
call fcn.0040e0b8
push 0x2f25
push 0xf0c90000
lea esi, [ebp - 0x24]
call fcn.0040e0b8
mov esi, dword [sym.imp.KERNEL32.dll_CompareFileTime]
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x1c]
push eax
call esi
cmp eax, edi
jne 0x40e1c2
mov dword [ebp - 0x10], edi
mov esi, dword [ebp - 0x10]
jmp 0x40e212
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
call esi
cmp eax, edi
jne 0x40e1d9
mov dword [ebp - 0x10], 2
jmp 0x40e1bd
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x1c]
push eax
call esi
cmp eax, edi
jne 0x40e1f0
mov dword [ebp - 0x10], 3
jmp 0x40e206
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x1c]
push eax
call esi
cmp eax, 0xffffffff
jne 0x40e1bd
mov dword [ebp - 0x10], 4
call fcn.0040defc
test al, al
jne 0x40e1bd
push 4
pop esi
push ebx
push edi
lea ecx, [ebp + 8]
call fcn.00402614
mov eax, esi
call fcn.00424d09
ret 0x1c
Function at 0x4107b6
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
mov esi, ecx
call fcn.0040b9d1
cmp byte [esi + 0x94], 0
jne 0x4107e4
cmp byte [esi + 0x95], 0
jne 0x4107e4
cmp dword [esi + 0x11b0], 1
je 0x4107e4
push ebx
mov ebx, esi
call fcn.004107ec
pop ebx
pop esi
ret
mov ecx, esi
pop esi
jmp fcn.0040b1c2

Function at 0x410cc4
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [0x458d6c]
push esi
push edi
mov esi, 0x458e78
mov edi, 0x458e79
xor edx, edx
sub esi, ecx
lea eax, [ecx + 2]
sub edi, ecx
mov cl, byte [eax - 2]
mov byte [edx*4 + 0x458e78], cl
mov cl, byte [eax - 1]
mov byte [edx*4 + 0x458e79], cl
mov cl, byte [eax]
mov byte [esi + eax], cl
mov cl, byte [eax + 1]
mov byte [edi + eax], cl
inc edx
add eax, 4
cmp edx, 4
jb 0x410ce4
cmp edx, 0x2c
jae 0x410da4
lea eax, [edx*4 + 0x458e68]
push ebx
lea esi, [eax + 0xc]
lea edi, [ebp - 4]
movsd dword es:[edi], dword [esi]
test dl, 3
jne 0x410d71
movzx esi, byte [ebp - 2]
mov bl, byte [esi + 0x43f920]
movzx ecx, byte [ebp - 4]
movzx esi, byte [ebp - 1]
mov dword [ebp - 8], ecx
movzx ecx, byte [ebp - 3]
mov cl, byte [ecx + 0x43f920]
mov byte [ebp - 3], bl
mov bl, byte [esi + 0x43f920]
movzx esi, byte [ebp - 8]
mov byte [ebp - 2], bl
mov bl, byte [esi + 0x43f920]
mov esi, edx
shr esi, 2
xor cl, byte [esi + 0x43fb20]
mov byte [ebp - 1], bl
mov byte [ebp - 4], cl
jmp 0x410d74
mov cl, byte [ebp - 4]
mov bl, byte [eax]
xor bl, cl
mov cl, byte [eax + 1]
xor cl, byte [ebp - 3]
mov byte [eax + 0x10], bl
mov byte [eax + 0x11], cl
mov cl, byte [eax + 2]
xor cl, byte [ebp - 2]
add eax, 4
mov byte [eax + 0xe], cl
mov cl, byte [eax - 1]
xor cl, byte [ebp - 1]
inc edx
mov byte [eax + 0xf], cl
cmp edx, 0x2c
jb 0x410d1d
pop ebx
pop edi
pop esi
leave
ret
Function at 0x411108
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov ecx, dword [0x458e74]
push esi
push edi
push 4
pop edi
push 4
mov eax, ecx
pop esi
movzx edx, byte [eax]
mov dl, byte [edx + 0x43fa20]
mov byte [eax], dl
add eax, 4
dec esi
jne 0x411118
inc ecx
dec edi
jne 0x411113
pop edi
pop esi
ret

Function at 0x41117e
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [0x458e74]
push esi
movzx eax, al
push edi
shl eax, 4
push 4
add eax, 0x458e78
pop edi
push 4
pop esi
mov dl, byte [eax]
xor byte [ecx], dl
inc eax
inc ecx
dec esi
jne 0x410dc1
dec edi
jne 0x410dbe
pop edi
pop esi
ret
push ebx
mov al, 0xa
call 0x410da8
mov bl, 9
call fcn.00411130
call fcn.00411108
mov al, bl
call 0x410da8
call fcn.00410dd0
dec bl
jne 0x411188
call fcn.00411130
call fcn.00411108
xor al, al
pop ebx
jmp 0x410da8
Function at 0x41236a
Capabilities:
Check http status code
Contain obfuscated stackstrings
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x452c60]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 1
push 0x50
sub esp, 0x1c
lea eax, [ebp - 0x10]
xor ebx, ebx
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
mov byte [ebp - 0x11], bl
mov byte [ebp - 0xc], 0x6c
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 7], 0x6d
mov byte [ebp - 8], 0x6f
mov byte [ebp - 0xd], 0x67
mov byte [ebp - 0xa], 0x2e
mov byte [ebp - 6], bl
mov byte [ebp - 9], 0x63
mov byte [ebp - 0xe], 0x6f
mov byte [ebp - 0x10], 0x67
mov byte [ebp - 0xf], 0x6f
call fcn.0040229e
mov esi, edi
call fcn.00411753
cmp byte [edi + 0x1c], bl
je 0x412453
xor eax, eax
lea esi, [ebp - 0x38]
call fcn.00411915
cmp dword [eax + 0x18], 0x10
jb 0x4123e6
mov eax, dword [eax + 4]
jmp 0x4123e9
add eax, 4
push ebx
push ebx
push ebx
push ebx
push str.HTTP_1.0
push 0x44b200
push eax
push dword [edi + 0x440]
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
push ebx
push 1
lea ecx, [ebp - 0x38]
mov esi, eax
call fcn.00402614
cmp esi, ebx
je 0x41244c
push ebx
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
push ebx
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x20000013
push esi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
cmp dword [ebp - 0x1c], 0xc8
jne 0x41244c
mov byte [ebp - 0x11], 1
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov esi, edi
call fcn.004117c2
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x11]
pop esi
xor ecx, ebp
pop ebx
call fcn.00421987
leave
ret