joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4013c5
Capabilities:
Encode data using xor

Disassembly:
jmp 0x4159d0
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x415b7a
push ebx
mov ebx, dword [esp + 0x10]
nop word [eax + eax]
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
sub byte [esi + ebx], 0x3a
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0xb7
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
xor byte [esi + ebx], 0x2d
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x7c
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x69
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
add esp, 0x44
push eax
call fcn.0040616d
add byte [esi + ebx], 0xba
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x9d
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0xbe
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x38
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x50
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x49
add esp, 0x40
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0xc6
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
xor byte [esi + ebx], 0xf7
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x49
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0xca
add esp, 0x30
inc esi
cmp esi, edi
jb 0x4159f0
pop ebx
pop edi
pop esi
ret

Function at 0x4035f3
Capabilities:
Terminate process

Disassembly:
jmp 0x453df9
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x453e0a
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405948
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x40371f
Capabilities:
Query environment variable

Disassembly:
jmp 0x49c842
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49c853
pop esi
ret
push ebx
push edi
push esi
call fcn.0049c729
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fe4
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49c87b
push ebx
push esi
push edi
call fcn.0040572c
add esp, 0xc
push 0
call fcn.004062b2
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x4013c0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x412d00
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x412eaa
push ebx
mov ebx, dword [esp + 0x10]
nop word [eax + eax]
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
sub byte [esi + ebx], 0x7b
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xb2
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0xd2
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xa0
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 5
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
add esp, 0x44
push eax
call fcn.004013a7
add byte [esi + ebx], 0x59
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xf8
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x85
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x97
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xe9
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x4a
add esp, 0x40
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x2b
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0x44
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xf2
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x3d
add esp, 0x30
inc esi
cmp esi, edi
jb 0x412d20
pop ebx
pop edi
pop esi
ret

Function at 0x4035da
Capabilities:
Terminate process

Disassembly:
jmp 0x451ba9
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x451bba
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405907
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x40370b
Capabilities:
Query environment variable

Disassembly:
jmp 0x49b052
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49b063
pop esi
ret
push ebx
push edi
push esi
call fcn.0049af39
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fda
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49b08b
push ebx
push esi
push edi
call fcn.004056fa
add esp, 0xc
push 0
call fcn.00406244
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x40c630
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xa000]
push edi
or ebp, 0xffffffff
jmp 0x40c652
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40c659
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40c648
mov eax, 1
add ebx, ebx
jne 0x40c66b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40c660
jne 0x40c67c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40c660
xor ecx, ecx
sub eax, 3
jb 0x40c690
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40c702
mov ebp, eax
add ebx, ebx
jne 0x40c69b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40c6a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40c6cc
inc ecx
add ebx, ebx
jne 0x40c6b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40c6ad
jne 0x40c6c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40c6ad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40c6ec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40c6dd
jmp 0x40c64e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40c6ec
add edi, ecx
jmp 0x40c64e
pop esi
lea edi, [esi + 0xa000]
mov eax, dword [edi]
or eax, eax
je 0x40c74b
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xc000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xc03c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40c709
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xc040]
or eax, eax
je 0x40c745
mov dword [ebx], eax
add ebx, 4
jmp 0x40c726
call dword [esi + 0xc050]
mov ebp, dword [esi + 0xc044]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40c77f
sub esp, 0xffffff80
jmp 0x40a71c

Function at 0x405d20
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.00405eb9
test eax, eax
jne 0x935e30
sub dword [edi - 0x24], 8
dec ebx
add byte [edi + ecx], dl
mov esi, gs
add dl, al
push esp
mov eax, dword [0xd5410384]
test eax, eax
bts dword [eax], edi
add byte [eax], al
add bh, al
fld dword [ebx + 0x100410d]
add byte [edi + 0x3e], ch
push esi
adc eax, sym.imp.KERNEL32.dll_GetCommandLineW
cld
invalid

Function at 0x406810
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push esi
mov al, byte [0xe0767875]
sub al, 0x40
add bh, bh
mov eax, dword [esi]
push eax
call fcn.00405640
push esi
call fcn.004066d3
add esp, 4
lea ebx, [ebp + 0x57]
and ebp, dword [edi]
nop
nop
nop
nop
mov byte [0x9090b590], al
popal
nop
nop
nop
Function at 0x43b64e
Capabilities:
Encode data using xor

Disassembly:
push 0x43b3c1
mov ebx, dword [esp]
add esp, 4
sub edi, 1
add edi, esi
sub edi, 1
call fcn.0043b6a9
sub esi, 0xfcd467ac
sub esp, 4
mov dword [esp], 0xc9a95c7a
pop edi
xor dword [eax], ebx
sub edi, 0x8b60815b
push 0x3865efa6
mov esi, dword [esp]
add esp, 4
inc eax
and esi, esi
sub esi, 0x1f2e494b
cmp eax, edx
jne fcn.0043b64e
and esi, edi
ret
Function at 0x4056f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp dword [eax - 0x42], edi
jne 0x405667
idiv dh
or byte [edx + ecx - 0x75], dh
enter 0x8b, 6
mov ecx, eax
mov eax, dword [eax]
push es
sal byte [ebp - 0x12], 0xeb
or al, 0x8b
fimul word [ecx + 0x144a8b19]
or dword [eax], 0xffffffe3
inc edx
adc al, 0x8b
pushfd
cmp byte [ebp - 0x3f7a62b3], cl
leave
and eax, 0x42047839
add eax, 0x74b07039
mov edx, 0x288bc802
int3
stc
or al, 0
push ebx
nop
nop
nop
nop
nop
imul edx, dword [eax - 0x6f6f6f70], 0xdf8bfb90
stosd dword es:[edi], eax
inc ebp
or ah, ah
sub dh, byte [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
push esi
out dx, eax
push eax
call 0x45640
jle 0x4056d7
push dword [edx - 0x7d]
jb 0x40565d
les eax, [esp + ecx]
pop esi
pop ebp
ret 0xc6
push ebp
mov ebp, esp
push esi
lcall 0xc085, 0x68bed75
je 0x405711
mov ecx, dword [eax]
mov dword [esi], ecx
mov edx, dword [eax + 4]
push edx
push eax
or byte [ebx + 0x4c48306], cl
test eax, eax
jne 0x4056df
test byte [ebp - 0x3d], bl
nop
nop
ficom dword [eax - 0x4b6f6f70]
nop
nop
loopne 0x4056b0
xchg eax, eax
js 0x40579a
nop
nop
nop
jmp 0x47d0e7bc

Function at 0x405890
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
xor edx, edx
test edi, edi
je 0x4058c7
invalid

Function at 0x40a2d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
adc dword [eax + 4], ecx
test dword [edx - 0x5a], ecx
adc byte [ebx - 0xaff340], al
adc eax, sym.imp.KERNEL32.dll_EnterCriticalSection
xor ebx, dword [ebp + ebx*2 - 0x74fffb3e]
inc eax
fsubp st(3)
popal
push eax
cmp dword [sym.imp.KERNEL32.dll_WaitForSingleObject], edx
test eax, eax
je 0x40a2e7
cmp eax, 0x3580
je 0x40a2e7
add byte [ebx + 0x29], dh
add al, byte [ecx]
add dl, bh
sub dword [edx], eax
add dword [eax], eax
cli
push esi
jne 0x40a33d
mov eax, 0x58011189
pop esi
pop ebp
ret 0x9d04
nop
sbb eax, 0x8ba49090
in al, dx
mov ecx, dword [ebp - 0xe]
push esi
mov eax, dword [ecx + 4]
test eax, eax
jne 0x40a35f
add ecx, 0xc
push ecx
call dword [0x6ec02c]
xor esi, ecx
pop esi
pop ebp
ret 4
cmp eax, 1
jne 0x40a370
add eax, dword [ecx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x40a37f
cmp eax, 2
pushal
jecxz 0x40a301
dec ecx
or byte [ecx - 0x36], dl
adc eax, sym.imp.KERNEL32.dll_ReleaseMutex
test eax, eax
jne 0x40a33c
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
mov ecx, 0xc2d6ffc9
Function at 0x4738c6
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x4735cc
mov esi, 0xf6c7daaf
add esi, ecx
dec ecx
call fcn.00473903
dec ecx
xor dword [ebx], edi
or esi, esi
add esi, 0x2c2dce1d
add ebx, 2
or ecx, ecx
or ecx, esi
or esi, esi
cmp ebx, eax
jl fcn.004738c6
sub ecx, 0x2eb06052
ret

Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40501c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x405028
push 0x405024
push 0x405020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x405028]
push dword [0x405024]
push dword [0x405020]
mov dword [0x405014], esp
call fcn.004014fb
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret

Function at 0x401a29
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x404038]
xor eax, ebp
mov dword [ebp + 0x88], eax
push esi
push 0x103
lea eax, [ebp - 0x7b]
push 0
push eax
mov byte [ebp - 0x7c], 0
call fcn.00401ce4
add esp, 0xc
push 0x104
lea eax, [ebp - 0x7c]
push eax
call dword [0x403054]
lea eax, [ebp - 0x7c]
push 0x4032ac
push eax
call fcn.00401cc8
and dword [ebp - 0x80], 0
lea eax, [ebp - 0x80]
push eax
push 0x4032a0
push 0x66
call fcn.00401756
mov esi, eax
add esp, 0x14
test esi, esi
je 0x401ac6
xor eax, eax
cmp dword [ebp - 0x80], eax
jle 0x401aa7
xor byte [eax + esi], 0x99
inc eax
cmp eax, dword [ebp - 0x80]
jl 0x401a9d
push dword [ebp - 0x80]
lea eax, [ebp - 0x7c]
push esi
push eax
call fcn.00401655
lea eax, [ebp - 0x7c]
push eax
call section..text
push esi
call fcn.00401d9a
add esp, 0x14
mov ecx, dword [ebp + 0x88]
xor ecx, ebp
xor eax, eax
pop esi
call int.00401cd4
add ebp, 0x8c
leave
ret
Function at 0x4056e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x405739
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x405739
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x40572a
cmp esi, edx
jae 0x405739
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x405718
cmp esi, edx
jae 0x405739
cmp word [esi], 0
je 0x405739
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x40bef0
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x5181f0
push 0x4b1520
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x524a60]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x28], 0
xor edi, edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 4], edi
mov dword [eax], edi
mov dword [ecx], edi
lea eax, [ebp - 0x28]
push eax
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
je 0x40bf6a
cmp dword [ebp - 0x28], edi
je 0x40bf6a
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40bfa2
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x3f0
jne 0x40c084
lea eax, [ebp - 0x28]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40c084
cmp dword [ebp - 0x28], 0
je 0x40c084
mov dword [ebp - 0x2c], 0
lea eax, [ebp - 0x2c]
push eax
push 0
push 0
push 2
push dword [ebp - 0x28]
mov ebx, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call ebx
test eax, eax
jne 0x40c084
cmp dword [ebp - 0x2c], eax
jbe 0x40c084
call esi
cmp eax, 0x7a
jne 0x40c084
push dword [ebp - 0x2c]
call fcn.004b7a8d
add esp, 4
mov edi, eax
mov dword [ebp - 0x38], edi
test edi, edi
je 0x40c084
mov dword [ebp - 0x34], 0
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x2c]
push edi
push 2
push dword [ebp - 0x28]
call ebx
test eax, eax
je 0x40c084
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x2c]
jne 0x40c084
mov dword [ebp - 0x24], 0
mov word [ebp - 0x20], 0x500
lea eax, [ebp - 0x30]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x40c084
cmp dword [ebp - 0x30], 0
je 0x40c084
xor esi, esi
mov dword [ebp - 0x3c], esi
cmp esi, dword [edi]
jae 0x40c084
lea ebx, [edi + esi*8]
push dword [ebp - 0x30]
push dword [ebx + 4]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x40c06d
inc esi
jmp 0x40c050
mov eax, dword [ebp - 0x40]
mov dword [eax], 1
mov eax, dword [ebx + 8]
shr eax, 2
and eax, 1
mov ecx, dword [ebp - 0x44]
mov dword [ecx], eax
mov dword [ebp - 4], 0xfffffffe
call fcn.0040c0b1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004a1588
mov esp, ebp
pop ebp
ret 8
Function at 0x40c8c0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ddc58
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x524a60]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x10]
push eax
call fcn.0042ecf0
add esp, 4
push 0xe
push 0x4eacd4
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0
call fcn.0040c0e0
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40c91a
mov esi, 1
jmp 0x40c92d
lea eax, [ebp - 0x10]
push eax
push 0x83
call fcn.00413120
add esp, 8
mov esi, eax
mov edx, dword [ebp - 0x10]
or ecx, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x40c94f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40dca0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x524a60]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x110
lea eax, [ebp - 0x114]
push 0
push eax
call fcn.004b1030
add esp, 0xc
mov dword [ebp - 0x118], 0x114
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40dd00
cmp dword [ebp - 0x114], 6
jb 0x40dd00
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a1588
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.004a1588
mov esp, ebp
pop ebp
ret
Function at 0x40def0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x5181b0
push 0x4b1520
mov eax, dword fs:[0]
push eax
sub esp, 0x42c
mov eax, dword [0x524a60]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x43c], esi
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
push 0x200
push 0
lea eax, [ebp - 0x42c]
push eax
call fcn.004b1030
push edi
push str.SYSTEMCurrentControlSetServices_sParameters
push 0xff
lea eax, [ebp - 0x42c]
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x1c
lea eax, [ebp - 0x430]
push eax
push 0x20219
push 0
lea eax, [ebp - 0x42c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40e009
mov dword [ebp - 0x438], eax
push 0x210
push eax
lea eax, [ebp - 0x22c]
push eax
call fcn.004b1030
add esp, 0xc
mov dword [ebp - 0x434], 0x210
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x438]
push eax
push 0
push str.ServiceDll
push dword [ebp - 0x430]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40e009
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp + 0x10]
cmp ecx, eax
jle 0x40e009
push ecx
lea eax, [ebp - 0x22c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov dword [ebp - 4], 0xfffffffe
call fcn.0040e03b
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004a1588
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40fb60
Capabilities:
Check if file exists
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4def06
mov eax, dword fs:[0]
push eax
sub esp, 0xa18
mov eax, dword [0x524a60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x18]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
push esi
mov dword [ebp - 0xa24], eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40fd73
mov dword [ebp - 0xa1c], 0
lea eax, [ebp - 0xa1c]
mov dword [ebp - 4], 0
push eax
push 0x4ecb3c
push 0x17
push 0
push 0x4f2454
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x40fd58
mov eax, dword [ebp - 0xa1c]
test eax, eax
je 0x40fd5e
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x50]
test eax, eax
jne 0x40fd58
test edi, edi
je 0x40fc19
mov eax, dword [ebp - 0xa1c]
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
test eax, eax
jne 0x40fd58
mov eax, dword [ebp - 0xa1c]
push 5
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
test eax, eax
jne 0x40fd58
push 0x800
push eax
lea eax, [ebp - 0xa18]
push eax
call fcn.004b1030
push 0x400
lea eax, [ebp - 0xa18]
push esi
push eax
call fcn.004b7e14
add esp, 0x18
lea eax, [ebp - 0xa18]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov esi, dword [ebp + 0x1c]
test esi, esi
js 0x40fcac
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004b1030
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push dword [ebp - 0xa24]
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov eax, dword [ebp - 0xa1c]
lea edx, [ebp - 0x218]
push esi
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0xa1c]
lea edx, [ebp - 0xa18]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
test eax, eax
jne 0x40fd58
xor ecx, ecx
mov dword [ebp - 0xa20], ecx
mov eax, dword [ebp - 0xa1c]
mov byte [ebp - 4], 1
test eax, eax
je 0x40fd40
mov ecx, dword [eax]
lea edx, [ebp - 0xa20]
push edx
push 0x4eb5dc
push eax
call dword [ecx]
test eax, eax
jns 0x40fcfc
xor ecx, ecx
mov dword [ebp - 0xa20], ecx
jmp 0x40fd3a
mov ecx, dword [ebp - 0xa20]
test ecx, ecx
je 0x40fd3a
mov eax, dword [ecx]
push 1
push ebx
push ecx
call dword [eax + 0x18]
test eax, eax
jne 0x40fd34
push ebx
push str._CreateShortcut__create__s_success
call fcn.00433e30
mov eax, dword [ebp - 0xa1c]
add esp, 8
mov ecx, dword [ebp - 0xa20]
mov esi, 1
jmp 0x40fd42
mov ecx, dword [ebp - 0xa20]
mov eax, dword [ebp - 0xa1c]
xor esi, esi
mov byte [ebp - 4], 0
test ecx, ecx
je 0x40fd60
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [ebp - 0xa1c]
jmp 0x40fd60
mov eax, dword [ebp - 0xa1c]
xor esi, esi
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x40fd71
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a1588
mov esp, ebp
pop ebp
ret