joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403260
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get socket status
Set socket configuration

Disassembly:
sub esp, 0x124
xor eax, eax
push esi
mov dword [esp + 0x10], eax
push edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call fcn.00403010
test eax, eax
jne 0x403396
mov cx, word [0x41e45c]
mov word [esp + 0x14], 2
push ecx
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [0x41e458]
push 0
push 1
push 2
mov word [esp + 0x22], ax
mov dword [esp + 0x24], edx
call dword [sym.imp.WS2_32.dll_socket]
mov esi, dword [esp + 0x130]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x4032d3
pop edi
mov eax, 2
pop esi
add esp, 0x124
ret
mov edi, dword [sym.imp.WS2_32.dll_ioctlsocket]
lea ecx, [esp + 0x10]
push ecx
push 0x8004667e
push eax
mov dword [esp + 0x1c], 1
call edi
cmp eax, 0xffffffff
jne 0x403301
pop edi
mov eax, 1
pop esi
add esp, 0x124
ret
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0x10
push edx
push eax
call dword [sym.imp.WS2_32.dll_connect]
xor ecx, ecx
mov edx, dword [esi]
mov dword [esp + 8], ecx
lea eax, [esp + 8]
mov dword [esp + 0xc], ecx
push eax
mov dword [esp + 0x10], ecx
push ecx
lea ecx, [esp + 0x30]
mov dword [esp + 0x34], edx
push ecx
push 0
push 0
mov dword [esp + 0x3c], 1
mov dword [esp + 0x1c], 5
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jg 0x40335c
pop edi
mov eax, 0xc
pop esi
add esp, 0x124
ret
mov eax, dword [esi]
lea edx, [esp + 0x24]
push edx
push 0x8004667e
push eax
mov dword [esp + 0x30], 0
call edi
cmp eax, 0xffffffff
jne 0x403386
pop edi
mov eax, 0xc
pop esi
add esp, 0x124
ret
mov ecx, dword [esi]
push 0xea60
push ecx
call fcn.00402690
add esp, 8
pop edi
pop esi
add esp, 0x124
ret
Function at 0x4033a0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get socket status
Set socket configuration

Disassembly:
sub esp, 0x144
xor eax, eax
push esi
mov dword [esp + 0xc], eax
push edi
mov dword [esp + 0x14], eax
mov ecx, 8
mov dword [esp + 0x18], eax
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x154]
lea ecx, [esp + 0x28]
push edi
push ecx
mov dword [esp + 0x24], eax
call fcn.00403600
add esp, 8
test al, al
jne 0x4033ec
pop edi
mov eax, 0x15
pop esi
add esp, 0x144
ret
lea edx, [esp + 0x28]
push edx
call dword [sym.imp.WS2_32.dll_inet_addr]
mov esi, eax
mov ax, word [edi + 0x3c]
push eax
mov word [esp + 0x14], 2
call dword [sym.imp.WS2_32.dll_htons]
push 0
push 1
push 2
mov word [esp + 0x1e], ax
mov dword [esp + 0x20], esi
call dword [sym.imp.WS2_32.dll_socket]
mov esi, dword [esp + 0x150]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x40343c
pop edi
mov eax, 2
pop esi
add esp, 0x144
ret
mov edi, dword [sym.imp.WS2_32.dll_ioctlsocket]
lea ecx, [esp + 0x24]
push ecx
push 0x8004667e
push eax
mov dword [esp + 0x30], 1
call edi
cmp eax, 0xffffffff
jne 0x40346a
pop edi
mov eax, 1
pop esi
add esp, 0x144
ret
mov eax, dword [esi]
lea edx, [esp + 0x10]
push 0x10
push edx
push eax
call dword [sym.imp.WS2_32.dll_connect]
xor ecx, ecx
mov edx, dword [esi]
mov dword [esp + 8], ecx
lea eax, [esp + 8]
mov dword [esp + 0xc], ecx
push eax
mov dword [esp + 0x10], ecx
push ecx
lea ecx, [esp + 0x50]
mov dword [esp + 0x54], edx
push ecx
push 0
push 0
mov dword [esp + 0x5c], 1
mov dword [esp + 0x1c], 5
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jg 0x4034c5
pop edi
mov eax, 0xc
pop esi
add esp, 0x144
ret
mov eax, dword [esi]
lea edx, [esp + 0x20]
push edx
push 0x8004667e
push eax
mov dword [esp + 0x2c], 0
call edi
cmp eax, 0xffffffff
jne 0x4034ef
pop edi
mov eax, 0xc
pop esi
add esp, 0x144
ret
mov ecx, dword [esi]
push 0xea60
push ecx
call fcn.00402690
add esp, 8
pop edi
pop esi
add esp, 0x144
ret

Function at 0x403600
Capabilities:
Resolve dns

Disassembly:
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x403649
mov eax, dword [eax + 0xc]
test eax, eax
je 0x403649
mov ecx, dword [eax]
push esi
push edi
mov edx, dword [ecx]
push edx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov al, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret
xor al, al
ret
Function at 0x403bc0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ecx
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
test eax, eax
push edi
mov dword [esp + 0x10], 0
jne 0x403bdd
mov ebp, dword [esp + 0x20]
mov ebx, ebp
jmp 0x403bfd
mov ecx, dword [esp + 0x20]
mov eax, ecx
shr eax, 3
lea edx, [eax*8]
cmp edx, ecx
jae 0x403bf2
inc eax
mov ebp, dword [esp + 0x20]
lea ebx, [eax*8]
lea esi, [ebx + 1]
push esi
call fcn.004071e0
mov edi, eax
add esp, 4
test edi, edi
mov dword [esp + 0x10], edi
jne 0x403c1e
pop edi
pop esi
pop ebp
mov eax, 5
pop ebx
pop ecx
ret
mov ecx, esi
xor eax, eax
mov edx, ecx
xor esi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
test ebx, ebx
rep stosb byte es:[edi], al
jbe 0x403c65
mov edi, dword [esp + 0x18]
mov ebp, dword [sym.imp.WS2_32.dll_recv]
mov ecx, dword [esp + 0x10]
mov eax, ebx
sub eax, esi
push 0
lea edx, [esi + ecx]
push eax
push edx
push edi
call ebp
cmp eax, 0xffffffff
je 0x403cb8
test eax, eax
je 0x403cb8
add esi, eax
cmp esi, ebx
jb 0x403c40
mov ebp, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x403cd0
mov edx, dword [esp + 0x1c]
mov ecx, ebp
mov esi, ecx
xor eax, eax
mov edi, dword [edx]
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, esi
and ecx, 3
rep stosb byte es:[edi], al
mov esi, dword [esp + 0x10]
mov edi, dword [edx]
mov ecx, ebp
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [edx]
push ecx
call fcn.00403dd0
lea edx, [esp + 0x14]
push edx
call sym.MPSVC1.exe_mp110036_0019
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
lea eax, [esp + 0x10]
push eax
call sym.MPSVC1.exe_mp110036_0019
add esp, 4
mov eax, 7
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov eax, dword [esp + 0x10]
push 0
push ebx
push eax
mov ecx, 0x41d2e8
call fcn.00401b70
mov edx, dword [esp + 0x1c]
mov ecx, ebp
mov esi, ecx
xor eax, eax
mov edi, dword [edx]
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, esi
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [edx]
mov esi, dword [esp + 0x10]
mov ecx, ebp
lea eax, [esp + 0x10]
mov edx, ecx
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call sym.MPSVC1.exe_mp110036_0019
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x404310
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x14
xor eax, eax
push esi
mov esi, dword [esp + 0x28]
mov dword [esp + 4], eax
mov dword [esp + 8], eax
push str.File
mov dword [esp + 0x10], eax
push esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
call fcn.0040f380
add esp, 8
test eax, eax
jne 0x404362
mov ecx, dword [esp + 0x24]
lea edx, [esp + 4]
inc ecx
push ecx
push str.File
push str._s_d
push edx
call fcn.004074dc
add esp, 0x10
jmp 0x4043ed
push 0x41719c
push esi
call fcn.0040f380
add esp, 8
test eax, eax
jne 0x404393
mov eax, dword [esp + 0x24]
lea ecx, [esp + 4]
inc eax
push eax
push 0x41719c
push str._s_d
push ecx
call fcn.004074dc
add esp, 0x10
jmp 0x4043ed
push str.FileName
push esi
call fcn.0040f380
add esp, 8
test eax, eax
jne 0x4043c4
mov edx, dword [esp + 0x24]
lea eax, [esp + 4]
inc edx
push edx
push str.FileName
push str._s_d
push eax
call fcn.004074dc
add esp, 0x10
jmp 0x4043ed
push str.TrojanName
push esi
call fcn.0040f380
add esp, 8
test eax, eax
jne 0x4043ed
push str.TrojanName
lea ecx, [esp + 8]
push 0x417064
push ecx
call fcn.004074dc
add esp, 0xc
mov edx, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
push edx
push 0x208
push esi
lea eax, [esp + 0x10]
push str.NULL
push eax
push str.UPLOADFILE
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push str.NULL
push esi
call fcn.0040f380
add esp, 8
neg eax
sbb eax, eax
pop esi
and al, 0xec
add eax, 0x14
add esp, 0x14
ret

Function at 0x404f00
Capabilities:
Delete file

Disassembly:
sub esp, 0x410
push ebx
push ebp
mov ebp, dword [esp + 0x41c]
push esi
test ebp, ebp
push edi
je 0x404fd5
mov esi, dword [esp + 0x42c]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call ebx
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x218]
push 0x5c
rep stosd dword es:[edi], eax
push esi
call fcn.00407900
add esp, 8
test eax, eax
je 0x404fd5
sub eax, esi
inc eax
push eax
lea eax, [esp + 0x21c]
push esi
push eax
call fcn.00407530
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x1c]
add esp, 0xc
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x428]
test eax, eax
jbe 0x404fd5
lea esi, [ebp + 0x208]
mov ebp, eax
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea ecx, [esi - 0x208]
push ecx
call ebx
push esi
call ebx
push 0x5c
push esi
call fcn.00407900
add esp, 8
test eax, eax
je 0x404fcc
inc eax
lea edx, [esp + 0x218]
push eax
push edx
lea eax, [esp + 0x18]
push str._s_s
push eax
call fcn.004074dc
add esp, 0x10
lea ecx, [esp + 0x10]
push ecx
call ebx
add esi, 0x614
dec ebp
jne 0x404f81
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x410
ret
Function at 0x405740
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Terminate process

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
push str.F55C06C8_601A_469d_9C78_9DD03B0A9A8E
push 0
push 0
call esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4057ee
cmp eax, 5
je 0x4057ee
push str.F55C06C8_601A_469d_9C78_9DD03B0A9A8E
push 0
push 0
call esi
call fcn.00403010
xor eax, eax
mov dword [0x41e4e8], eax
mov dword [0x41e4ec], eax
mov dword [0x41e4f0], eax
mov dword [0x41e4f4], eax
call fcn.00402b40
test eax, eax
je 0x4057a4
mov eax, 5
pop esi
ret 0x10
call fcn.00402bc0
test eax, eax
jne 0x4057a0
push edi
mov ecx, 0x80
mov edi, 0x41e520
rep stosd dword es:[edi], eax
call fcn.00401dd0
test al, al
pop edi
jne 0x4057cd
mov eax, 1
pop esi
ret 0x10
call fcn.00405ad0
mov esi, eax
test esi, esi
je 0x4057e3
call sub.WS2_32.dll_WSACleanup
mov eax, esi
pop esi
ret 0x10
call sub.WS2_32.dll_WSACleanup
xor eax, eax
pop esi
ret 0x10
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x406f70
Capabilities:
Check os version

Disassembly:
sub esp, 0x80
call dword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0xff
cmp eax, 5
jb 0x406f9a
mov eax, dword [esp + 0x84]
lea ecx, [esp]
push eax
push str.._s
push ecx
jmp 0x406fac
mov edx, dword [esp + 0x84]
lea eax, [esp]
push edx
push str.._s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push str.mp110008
push 1
call fcn.00407060
add esp, 8
lea ecx, [esp]
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x40700d
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [esp]
push eax
push edx
lea eax, [esp + 0x48]
push str._s___d
push eax
call fcn.004074dc
add esp, 0x10
xor eax, eax
add esp, 0x80
ret
mov ecx, dword [esp + 0x88]
test ecx, ecx
je 0x407026
mov dword [ecx], eax
mov eax, 1
add esp, 0x80
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add esp, 0x80
ret

Function at 0x407060
Capabilities:
Start service
Stop service

Disassembly:
sub esp, 0x5c
push ebx
push ebp
mov ebp, dword [esp + 0x68]
or ebx, 0xffffffff
push esi
mov esi, dword [esp + 0x70]
test ebp, ebp
push edi
je 0x4070bc
push esi
lea eax, [esp + 0x30]
push str.._s
push eax
call fcn.004074dc
add esp, 0xc
lea ecx, [esp + 0x2c]
push 0
push 0x40000080
push 3
push 0
push 3
push 0xc0000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x4070bc
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x5c
ret
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
jne 0x4070dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5c
ret
push 0xf01ff
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x407108
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5c
ret
test ebp, ebp
je 0x40711d
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
je 0x407138
jmp 0x407136
lea edx, [esp + 0x10]
push edx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x407138
cmp dword [esp + 0x14], 1
jne 0x407138
xor ebx, ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x5c
ret
Function at 0x40b90c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x417b10
cmp edx, dword [eax]
je 0x40b92e
add eax, 8
inc ecx
cmp eax, 0x417ba0
jl 0x40b91f
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x417b10]
jne 0x40ba5c
mov eax, dword [0x41f828]
cmp eax, 1
je 0x40ba36
test eax, eax
jne 0x40b95f
cmp dword [0x417364], 1
je 0x40ba36
cmp edx, 0xfc
je 0x40ba5c
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40b996
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00408c60
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0040c5c0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40b9d9
lea eax, [ebp - 0x1a4]
push eax
call fcn.0040c5c0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4155f8
push edi
call fcn.00407530
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00408c60
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00408c70
lea eax, [ebp - 0xa0]
push 0x4155d8
push eax
call fcn.00408c70
push dword [esi + 0x417b14]
lea eax, [ebp - 0xa0]
push eax
call fcn.00408c70
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0040dc46
add esp, 0x2c
pop edi
jmp 0x40ba5c
lea eax, [ebp + 8]
lea esi, [esi + 0x417b14]
push 0
push eax
push dword [esi]
call fcn.0040c5c0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x40fd20
Capabilities:
Get common file path
Get disk information

Disassembly:
sub esp, 0x108
lea eax, [esp + 4]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x40fd62
push esi
push edi
mov edi, 0x418310
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xc]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push 0
push 0
push 0
lea ecx, [esp + 0xc]
push 0
push ecx
push 0
lea edx, [esp + 0x1c]
push 0
push edx
mov byte [esp + 0x27], 0
mov dword [esp + 0x20], 0x12345678
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov ecx, dword [esp]
mov al, cl
mov cl, ch
xor eax, ecx
mov cx, word [esp + 2]
xor eax, ecx
mov cl, ch
xor eax, ecx
add esp, 0x108
ret
Function at 0x40fdb0
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [esp + 8]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x40fdc7
pop ebx
ret
push esi
push edi
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [ecx + ebx - 1], 0x5c
je 0x40fe06
mov edi, 0x418354
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x18]
mov edi, str.system32drivers_roothook.sys
test eax, eax
jne 0x40fe18
mov edi, str.system32drivershookidle.sys
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
ret

Function at 0x40fe50
Capabilities:
Copy file

Disassembly:
sub esp, 0x208
lea eax, [esp]
push 0
push 0x104
push eax
call fcn.0040fdb0
add esp, 0xc
test eax, eax
je 0x40fec8
push 1
lea ecx, [esp + 0x108]
push 0x104
push ecx
call fcn.0040fdb0
add esp, 0xc
test eax, eax
je 0x40fec8
mov eax, dword [esp + 0x20c]
push 0
test eax, eax
je 0x40feb5
lea edx, [esp + 0x108]
lea eax, [esp + 4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, 1
add esp, 0x208
ret
lea ecx, [esp + 4]
lea edx, [esp + 0x108]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, 1
add esp, 0x208
ret
Function at 0x410a60
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0x14]
mov eax, 4
mov dword [esp + 4], eax
mov dword [esp], eax
lea eax, [esp]
lea edx, [esp + 4]
push eax
mov eax, dword [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
neg eax
sbb eax, eax
neg eax
add esp, 8
ret

Function at 0x410aa0
Capabilities:
Set registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
lea eax, [esp + 0xc]
push 4
push eax
push 4
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
neg eax
sbb eax, eax
neg eax
ret

Function at 0x410b90
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, eax
dec eax
test edx, edx
je 0x410bcf
push esi
lea esi, [eax + 1]
mov eax, dword [esp + 8]
push edi
xor edx, edx
mov edi, eax
mov dl, byte [ecx]
and edi, 0xff
xor edx, edi
shr eax, 8
mov edx, dword [edx*4 + 0x4183c0]
xor eax, edx
inc ecx
dec esi
jne 0x410ba8
mov ecx, dword [esp + 0x18]
pop edi
pop esi
mov dword [ecx], eax
ret
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 4]
mov dword [edx], eax
ret
Function at 0x413550
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
xor eax, eax
xor ecx, ecx
xor edx, edx
mov cl, byte [esi]
mov dl, ah
and ecx, 0xff
inc esi
xor edx, ecx
xor ecx, ecx
mov cx, word [edx*2 + 0x415910]
mov edx, ecx
xor ecx, ecx
mov ch, al
and ecx, 0xffff
xor edx, ecx
dec edi
mov eax, edx
jne 0x41355c
pop edi
pop esi
ret
Function at 0x410160
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push esp
pop ebp
push ecx
mov eax, dword [edi]
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [ebp + 8]
push esi
add eax, eax
lea edx, [ebp + 0xc]
push edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push 0
mov dword [edi], 0
mov edx, dword [ecx]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
or eax, eax
jne 0x4101ce
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x41019d
cmp eax, 2
jne 0x4101b8
mov eax, dword [ebp - 4]
or esi, esi
je 0x4101c8
test eax, eax
je 0x4101c3
test al, 1
jne 0x4101b8
push eax
pop ecx
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x4101c8
push 0xd
pop eax
push ebx
pop ebx
mov esp, ebp
pop ebp
ret 8
sub edx, edx
mov word [esi], dx
shr eax, 1
mov dword [edi], eax
xor eax, eax
push ebp
pop esp
pop ebp
ret 8

Function at 0x4113b6
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x58
push 0x427f00
call fcn.004172f0
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
sub esi, esi
cmp dword [0x45ac08], esi
jne 0x411274
push esi
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
mov eax, 0x5a4d
cmp word [sym.imp.comctl32.dll_CreateMappedBitmap], ax
je 0x411287
mov dword [ebp - 0x1c], esi
jmp 0x4112bd
mov eax, dword [sym.imp.advapi32.dll_RegFlushKey]
cmp dword [eax + sym.imp.comctl32.dll_CreateMappedBitmap], 0x4550
jne 0x411282
mov ecx, 0x10b
cmp word [eax + sym.imp.advapi32.dll_RegCreateKeyExA], cx
jne 0x411282
cmp dword [eax + 0x400074], 0xe
jbe 0x411282
sub ecx, ecx
cmp dword [eax + 0x4000e8], esi
setne cl
mov dword [ebp - 0x1c], ecx
call fcn.004172c6
or eax, eax
jne 0x4112ce
push 0x1c
call fcn.00411220
pop ecx
call 0x41714b
test eax, eax
jne 0x4112df
push 0x10
call fcn.00411220
pop ecx
call fcn.00416e06
mov dword [ebp - 4], esi
call fcn.00416bc1
test eax, eax
jns 0x4112f8
push 0x1b
call fcn.004164cd
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [0x45ac04], eax
call fcn.00416b69
mov dword [0x458c88], eax
call fcn.00416abb
or eax, eax
jns 0x41131e
push 8
call fcn.004164cd
pop ecx
call fcn.00416889
or eax, eax
jns 0x41132f
push 9
call fcn.004164cd
pop ecx
push 1
call fcn.004162ac
pop ecx
cmp eax, esi
je 0x411342
push eax
call fcn.004164cd
pop ecx
call fcn.00416843
test byte [ebp - 0x3c], 1
je 0x411353
movzx ecx, word [ebp - 0x38]
jmp 0x411356
push 0xa
pop ecx
push ecx
push eax
push esi
push sym.imp.comctl32.dll_CreateMappedBitmap
call main
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], esi
jne 0x411371
push eax
call 0x416483
call fcn.004164af
jmp 0x4113a6
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.00417335
ret
call fcn.004174df
jmp 0x411249

Function at 0x4113cb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42b520]
jne 0x4113d5
repz ret
jmp fcn.0041757a