joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405454
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x405557
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x40db64
call sub.kernel32.dll_EnterCriticalSection
cmp bx, word [0x40db7c]
jne 0x4054a0
mov eax, esi
mov edx, 0x40db7e
mov ecx, 0x55
call fcn.0040492c
push 0x40db64
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x405541
push 0x40db64
call sub.kernel32.dll_LeaveCriticalSection
mov eax, esi
call fcn.0040434c
push 2
movzx eax, bx
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40550f
cmp byte [0x40db60], 0
je 0x4054d4
mov edx, esi
mov eax, ebx
call fcn.00405338
jmp 0x40550f
mov edx, esi
mov eax, ebx
call fcn.0040513c
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp bx, ax
je 0x40550f
cmp dword [esi], 0
je 0x4054f8
mov eax, esi
mov edx, 0x405570
call fcn.004049f4
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.0040513c
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.004049f4
push 0x40db64
call sub.kernel32.dll_EnterCriticalSection
mov word [0x40db7c], bx
push 0xaa
mov eax, dword [esi]
call fcn.00404898
push eax
push 0x40db7e
call sub.kernel32.dll_lstrcpynW
push 0x40db64
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40555e
lea eax, [ebp - 4]
call fcn.0040434c
ret
Function at 0x40578c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004043c4
xor eax, eax
push ebp
push 0x4059b1
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x4057cc
push 0x105
lea eax, [ebp - 0x21a]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
jmp 0x4057e6
push 0x105
mov eax, dword [ebp - 4]
call fcn.00404898
push eax
lea eax, [ebp - 0x21a]
push eax
call sub.kernel32.dll_lstrcpynW
cmp word [ebp - 0x21a], 0
je 0x40599b
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x4059c0
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x4058b5
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x4059c0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x4058b5
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x4059fc
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x4058b5
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x4059fc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x4058b5
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x405a30
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x4058b5
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x405a64
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x40599b
xor eax, eax
push ebp
push 0x405994
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x21a]
mov edx, 0x105
call fcn.00405598
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x405924
mov eax, dword [ebp - 0x10]
call fcn.00402d18
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.004048f0
jmp 0x40596f
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0x405aa4
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x40596f
mov eax, dword [ebp - 0x10]
call fcn.00402d18
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push 0x405aa4
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.004048f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40599b
cmp dword [ebp - 8], 0
je 0x40598a
mov eax, dword [ebp - 8]
call fcn.00402d34
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4059b8
lea eax, [ebp - 4]
call fcn.0040434c
ret
Function at 0x405c94
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004043c4
xor eax, eax
push ebp
push 0x405d54
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
lea eax, [ebp - 0xc]
push eax
push 3
call sub.kernel32.dll_GetUserDefaultUILanguage
movzx eax, ax
push eax
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.0040492c
mov ecx, dword [ebp - 0x10]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00404a4c
mov eax, dword [ebx]
call fcn.00405b5c
test al, al
jne 0x405d31
mov word [ebp - 8], 0
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.0040492c
mov ecx, dword [ebp - 0x14]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00404a4c
mov eax, dword [ebx]
call fcn.00405b5c
test al, al
jne 0x405d31
mov eax, ebx
call fcn.0040434c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405d5b
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00404394
lea eax, [ebp - 4]
call fcn.0040434c
ret

Function at 0x4060d8
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret

Function at 0x406b74
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404898
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x406b8d
test al, 0x10
je 0x406b91
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x406d40
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
push 0x208
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
mov eax, ebx
mov edx, esp
mov ecx, 0x104
call fcn.0040492c
add esp, 0x208
pop ebx
ret

Function at 0x406d70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404898
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
setne al
pop ebx
ret

Function at 0x406eb8
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
mov esi, eax
call sub.kernel32.dll_GetCommandLineW_1
mov ebx, eax
xor eax, eax
movzx edx, word [ebx]
sub dx, 1
jb 0x406eeb
sub dx, 0x20
jb 0x406edb
dec dx
je 0x406ee1
jmp 0x406ee3
test al, al
je 0x406eeb
jmp 0x406ee3
xor al, 1
add ebx, 2
jmp 0x406ec5
add ebx, 2
movzx eax, word [ebx]
dec eax
sub ax, 0x20
jb 0x406ee8
mov eax, esi
mov edx, ebx
call fcn.004048f0
pop esi
pop ebx
ret
Function at 0x407058
Capabilities:
Encrypt data using rc6

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
lea edx, [esp + 4]
mov eax, dword [0x40dd00]
mov ecx, 0x40
call fcn.00402e70
mov dword [0x40dc4c], 0xb7e15163
mov ebx, 0x2b
mov eax, 0x40dc4c
mov edx, dword [eax]
add edx, 0x9e3779b9
mov dword [eax + 4], edx
add eax, 4
dec ebx
jne 0x407086
xor ebx, ebx
xor edi, edi
xor esi, esi
xor ebp, ebp
mov dword [esp], 0x84
mov eax, dword [ebx*4 + 0x40dc4c]
add eax, esi
add eax, ebp
mov edx, 3
call fcn.00406f04
mov esi, eax
mov dword [ebx*4 + 0x40dc4c], esi
lea edx, [ebp + esi]
mov eax, dword [esp + edi*4 + 4]
add eax, esi
add eax, ebp
call fcn.00406f04
mov ebp, eax
mov dword [esp + edi*4 + 4], ebp
lea eax, [ebx + 1]
mov ecx, 0x2c
cdq
idiv ecx
mov ebx, edx
inc edi
and edi, 0x8000000f
jns 0x4070f6
dec edi
or edi, 0xfffffff0
inc edi
dec dword [esp]
jne 0x4070a6
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x407148
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov eax, dword [0x40dcf8]
sub dword [ebx + 8], eax
mov eax, dword [0x40dcf4]
sub dword [ebx], eax
mov esi, 0x14
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 8]
mov dword [ebx + 0xc], edx
mov edx, dword [ebx + 4]
mov dword [ebx + 8], edx
mov edx, dword [ebx]
mov dword [ebx + 4], edx
mov dword [ebx], eax
mov eax, dword [ebx + 0xc]
mov edx, eax
add eax, eax
inc eax
imul edx, eax
mov eax, edx
mov edx, 5
call fcn.00406f04
mov ebp, eax
mov eax, dword [ebx + 4]
mov edx, eax
add eax, eax
inc eax
imul edx, eax
mov eax, edx
mov edx, 5
call fcn.00406f04
mov edi, eax
mov eax, dword [ebx + 8]
mov edx, esi
add edx, edx
sub eax, dword [edx*4 + 0x40dc50]
mov edx, edi
call fcn.00406f24
xor eax, ebp
mov dword [ebx + 8], eax
mov eax, dword [ebx]
mov edx, esi
add edx, edx
sub eax, dword [edx*4 + 0x40dc4c]
mov edx, ebp
call fcn.00406f24
xor edi, eax
mov dword [ebx], edi
dec esi
test esi, esi
jne 0x407162
mov eax, dword [0x40dc50]
sub dword [ebx + 0xc], eax
mov eax, dword [0x40dc4c]
sub dword [ebx + 4], eax
mov al, 1
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4072f8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x68], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4073f0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
xor ecx, ecx
mov edx, 0xc
call fcn.00403428
lea eax, [ebp - 0x54]
xor ecx, ecx
mov edx, 0x44
call fcn.00403428
mov dword [ebp - 0x10], 0xc
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x54], 0x44
mov dword [ebp - 0x28], 1
mov word [ebp - 0x24], 0
xor eax, eax
mov dword [ebp - 8], eax
xor ebx, ebx
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 0x20
cmp bl, 1
cmc
sbb eax, eax
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, esi
call fcn.00404898
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x4073b0
lea edx, [ebp - 0x68]
mov eax, 0x40725c
call fcn.00406024
mov edx, dword [ebp - 0x68]
mov eax, dword [0x40aa50]
call fcn.00403880
call fcn.00403980
call fcn.00402e40
jmp 0x4073da
push 0xffffffffffffffff
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x60]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4073f7
lea eax, [ebp - 0x68]
call fcn.0040434c
ret

Function at 0x407400
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, 0x40dd54
mov esi, 0x40dd4c
mov edi, 0x40dd50
mov ebp, 0x40dd68
mov eax, 0x407514
call fcn.00407104
call fcn.00407058
mov eax, dword [0x40dd40]
push eax
call sub.kernel32.dll_LockResource
mov dword [0x40dd44], eax
mov eax, dword [0x40dd3c]
push eax
mov eax, dword [0x40dc2c]
push eax
call sub.kernel32.dll_SizeofResource
xor edx, edx
mov dword [0x40dd70], eax
mov dword [0x40dd74], edx
mov eax, dword [0x40dd70]
call fcn.00402d18
mov dword [0x40dd48], eax
mov eax, dword [0x40dd44]
mov dword [esi], eax
mov eax, dword [0x40dd48]
mov dword [edi], eax
mov dword [ebp], 0
mov dword [ebp + 4], 0
jmp 0x4074b5
mov edx, ebx
mov eax, dword [esi]
mov ecx, 0x10
call fcn.00402e70
mov eax, ebx
call fcn.00407148
mov edx, dword [edi]
mov eax, ebx
mov ecx, 0x10
call fcn.00402e70
add dword [ebp], 0x10
adc dword [ebp + 4], 0
add dword [esi], 0x10
add dword [edi], 0x10
mov eax, dword [0x40dd70]
mov edx, dword [0x40dd74]
sub eax, dword [ebp]
sbb edx, dword [ebp + 4]
cmp edx, 0
jne 0x4074d3
cmp eax, 0x10
jae 0x407484
jmp 0x4074d5
jge 0x407484
call fcn.0040713c
mov eax, dword [0x40dd70]
add eax, dword [0x40dd48]
dec eax
mov dword [esi], eax
mov eax, dword [esi]
movzx eax, byte [eax]
mov byte [0x40dd7c], al
xor eax, eax
mov eax, dword [0x40dd40]
push eax
call sub.kernel32.dll_FreeResource
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x415680
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, dword [0x4240bc]
mov ebx, ecx
push edi
mov edi, dword [esp + 0x10]
test edi, edi
jne 0x4156f2
test esi, esi
jne 0x4156f2
call fcn.00415740
mov esi, eax
mov ecx, ebx
lea eax, [esp + 0x10]
push eax
call fcn.00415740
mov ecx, eax
call fcn.00410d90
mov ecx, eax
call dword [sym.imp.Qt5Core.dll_public:_char____thiscall_QByteArray::data_void_]
push eax
push dword [esi]
lea ecx, [ebx + 0x10]
call fcn.00415760
mov ecx, eax
call dword [sym.imp.Qt5Core.dll_public:_char_const____thiscall_QByteArray::constData_void_const]
push eax
push str._s__d_:_Parse_error_at___s__n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.0040ee70
add esp, 0x14
lea ecx, [esp + 0x10]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QByteArray::destructor_void_]
jmp 0x415729
call fcn.00415740
test edi, edi
lea ecx, [ebx + 0x10]
cmovne esi, edi
push esi
push dword [eax]
call fcn.00415760
mov ecx, eax
call dword [sym.imp.Qt5Core.dll_public:_char_const____thiscall_QByteArray::constData_void_const]
push eax
push str._s__d_:_Error:__s_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.0040ee70
add esp, 0x14
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
pop edi
pop esi
pop ebx
int3
Function at 0x417510
Capabilities:
Terminate process

Disassembly:
push str.Usage:_qdbuscpp2xml__options...___files...__nParses_the_C_source_or_header_file_containing_a_QObject_derived_class_and_nproduces_the_D_Bus_Introspection_XML._nOptions:_n___p_s_m_______Only_parse_scriptable_Properties__Signals_and_Methods__slots__n___P_S_M_______Parse_all_Properties__Signals_and_Methods__slots__n___a_____________Output_all_scriptable_contents__equivalent_to__psm__n___A_____________Output_all_contents__equivalent_to__PSM__n___o__filename___Write_the_output_to_file__filename__n___h_____________Show_this_information_n___V_____________Show_the_program_version_and_quit._n_n
push 0x4206ec
call fcn.00417e10
add esp, 8
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x417530
Capabilities:
Terminate process

Disassembly:
push 0x420ce8
push str.qdbuscpp2xml
push str._s_version__s_n
call fcn.00417e10
push str.D_Bus_QObject_to_XML_converter_n
call fcn.00417e10
add esp, 0x10
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x40812b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x417400]
jne 0x408135
repz ret
jmp fcn.0040deca

Function at 0x40af51
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x417400]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00406450
and dword [ebp - 0x14], 0
cmp dword [0x445d94], 0
mov dword [ebp - 0x18], eax
jne 0x40b004
push 0x402238
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40b0ac
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40222c
push ebx
call edi
test eax, eax
je 0x40b0ac
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x40221c
push ebx
mov dword [0x445d94], eax
call edi
push eax
call esi
push 0x402208
push ebx
mov dword [0x445d98], eax
call edi
push eax
call esi
push 0x4021ec
push ebx
mov dword [0x445d9c], eax
call edi
push eax
call esi
mov dword [0x445da4], eax
test eax, eax
je 0x40b004
push 0x4021d4
push ebx
call edi
push eax
call esi
mov dword [0x445da0], eax
mov eax, dword [0x445da0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40b05d
cmp dword [0x445da4], ecx
je 0x40b05d
push eax
call esi
push dword [0x445da4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40b05d
test ebx, ebx
je 0x40b05d
call edi
test eax, eax
je 0x40b054
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40b054
test byte [ebp - 8], 1
jne 0x40b05d
or dword [ebp + 0x10], 0x200000
jmp 0x40b090
mov eax, dword [0x445d98]
cmp eax, dword [ebp - 0x18]
je 0x40b090
push eax
call esi
test eax, eax
je 0x40b090
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40b090
mov eax, dword [0x445d9c]
cmp eax, dword [ebp - 0x18]
je 0x40b090
push eax
call esi
test eax, eax
je 0x40b090
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x445d94]
call esi
test eax, eax
je 0x40b0ac
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40b0ae
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040812b
leave
ret
Function at 0x4149e0
Capabilities:
Access the windows event log
Connect pipe
Delete directory
Delete file
Get common file path
Get uefi variable
Read pipe
Write pipe

Disassembly:
mov eax, 0x1404
call fcn.0040eda0
cmp dword [0x2b6f8f4], 0x37
jne 0x414abe
push 0x4035a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetLocaleInfoW]
push 0
lea eax, [esp + 0x808]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push 0
lea ecx, [esp + 4]
push ecx
push 0
lea edx, [esp + 0x10]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CallNamedPipeA]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x403620
push 0x403660
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
push 0x403574
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0
lea eax, [esp + 0x408]
push eax
push 0x403584
push 0x4036c0
call dword [sym.imp.KERNEL32.dll_GetFirmwareEnvironmentVariableA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDevicePowerState]
push 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push 0
lea ecx, [esp + 0xc08]
push ecx
push 0x4036dc
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
mov edx, dword [0x2b6fd08]
mov ecx, dword [0x2b6f3d8]
mov al, byte [edx + esi + 0x38d6]
mov byte [ecx + esi], al
add esp, 0x1404
ret
Function at 0x401240
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebx
push ebp
xor ecx, ecx
mov ebp, dword [eax + 4]
mov eax, dword [eax]
mov dword [esp + 8], 0
mov cx, word [eax + 0x14]
cmp word [eax + 6], 0
lea ebx, [ecx + eax + 0x18]
jbe 0x401301
push esi
push edi
add ebx, 0x10
cmp dword [ebx], 0
jne 0x4012ab
mov edx, dword [esp + 0x1c]
mov esi, dword [edx + 0x38]
test esi, esi
jle 0x4012df
mov eax, dword [ebx - 4]
push 4
push 0x1000
add eax, ebp
push esi
push eax
call dword [0x406234]
mov ecx, esi
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [ebx - 8], edi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
jmp 0x4012df
mov ecx, dword [ebx - 4]
mov eax, dword [ebx]
push 4
push 0x1000
add ecx, ebp
push eax
push ecx
call dword [0x406234]
mov ecx, dword [ebx]
mov esi, dword [ebx + 4]
mov edi, dword [esp + 0x18]
mov edx, ecx
add esi, edi
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebx - 8], eax
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
inc eax
add ebx, 0x28
mov edx, dword [ecx]
xor ecx, ecx
mov dword [esp + 0x10], eax
mov cx, word [edx + 6]
cmp eax, ecx
jl 0x40126e
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x401310
Capabilities:
Contain obfuscated stackstrings
Enumerate pe sections

Disassembly:
sub esp, 0x24
mov eax, dword [esp + 0x28]
xor ecx, ecx
mov dword [esp], 0
mov eax, dword [eax]
mov cx, word [eax + 0x14]
cmp word [eax + 6], 0
lea ecx, [ecx + eax + 0x18]
jbe 0x401493
push ebx
push ebp
push esi
push edi
lea ebp, [ecx + 0x24]
mov eax, dword [ebp]
lea edx, [esp + 0x18]
mov esi, eax
mov edi, eax
shr eax, 0x1f
mov ebx, eax
mov eax, dword [0x406ed0]
shr esi, 0x1d
shr edi, 0x1e
push edx
push eax
and esi, 1
and edi, 1
mov byte [esp + 0x20], 0x56
mov byte [esp + 0x21], 0x69
mov byte [esp + 0x22], 0x72
mov byte [esp + 0x23], 0x74
mov byte [esp + 0x24], 0x75
mov byte [esp + 0x25], 0x61
mov byte [esp + 0x26], 0x6c
mov byte [esp + 0x27], 0x46
mov byte [esp + 0x28], 0x72
mov byte [esp + 0x29], 0x65
mov byte [esp + 0x2a], 0x65
mov byte [esp + 0x2b], 0
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov ecx, dword [ebp]
test ecx, 0x2000000
je 0x4013c1
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x1c]
push 0x4000
push ecx
push edx
call eax
jmp 0x40146f
lea eax, [edi + esi*2]
test ecx, 0x4000000
lea edx, [ebx + eax*2]
mov edi, dword [edx*4 + 0x406010]
je 0x4013dc
or edi, 0x200
mov esi, dword [ebp - 0x14]
test esi, esi
jne 0x401401
test cl, 0x40
je 0x4013f3
mov eax, dword [esp + 0x38]
mov ecx, dword [eax]
mov esi, dword [ecx + 0x20]
jmp 0x401401
test cl, 0x80
je 0x401401
mov edx, dword [esp + 0x38]
mov eax, dword [edx]
mov esi, dword [eax + 0x24]
mov edx, dword [0x406ed0]
lea ecx, [esp + 0x24]
push ecx
push edx
mov byte [esp + 0x2c], 0x56
mov byte [esp + 0x2d], 0x69
mov byte [esp + 0x2e], 0x72
mov byte [esp + 0x2f], 0x74
mov byte [esp + 0x30], 0x75
mov byte [esp + 0x31], 0x61
mov byte [esp + 0x32], 0x6c
mov byte [esp + 0x33], 0x50
mov byte [esp + 0x34], 0x72
mov byte [esp + 0x35], 0x6f
mov byte [esp + 0x36], 0x74
mov byte [esp + 0x37], 0x65
mov byte [esp + 0x38], 0x63
mov byte [esp + 0x39], 0x74
mov byte [esp + 0x3a], 0
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test esi, esi
jbe 0x40146f
mov edx, dword [ebp - 0x1c]
lea ecx, [esp + 0x14]
push ecx
push edi
push esi
push edx
call eax
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x10]
inc eax
add ebp, 0x28
mov edx, dword [ecx]
xor ecx, ecx
mov dword [esp + 0x10], eax
mov cx, word [edx + 6]
cmp eax, ecx
jl 0x40133d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret