joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004b13
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x1001990
call fcn.01004d78
xor ebx, ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x1004b50
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1004b50
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x1004b68
cmp eax, 0x20b
je 0x1004b55
mov dword [ebp - 0x1c], ebx
jmp 0x1004b7c
cmp dword [ecx + 0x84], 0xe
jbe 0x1004b50
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x1004b76
cmp dword [ecx + 0x74], 0xe
jbe 0x1004b50
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x10102d8], 0xffffffff
or dword [0x10102dc], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x10102c4]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x10102c0]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x10102e0], eax
call fcn.01004d70
cmp dword [0x1006170], ebx
jne 0x1004bd7
push fcn.01004d70
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.01004d59
push 0x1006010
push 0x100600c
call sub.msvcrt.dll__initterm
mov eax, dword [0x10102bc]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x10102b8]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x38], eax
push 0x1006008
push section..data
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
cmp byte [esi], 0x22
jne 0x1004c6d
inc esi
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, bl
je 0x1004c41
cmp al, 0x22
jne 0x1004c33
cmp byte [esi], 0x22
jne 0x1004c4a
inc esi
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, bl
je 0x1004c54
cmp al, 0x20
jbe 0x1004c46
mov dword [ebp - 0x54], ebx
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x54], 1
je 0x1004c78
movzx eax, word [ebp - 0x50]
jmp 0x1004c7b
cmp byte [esi], 0x20
jbe 0x1004c4a
inc esi
mov dword [ebp - 0x20], esi
jmp 0x1004c6d
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call main
mov esi, eax
mov dword [ebp - 0x3c], esi
cmp dword [ebp - 0x1c], ebx
jne 0x1004c98
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x1004ccd
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.01004db3
ret
Function at 0x1004f01
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push 0x10019a8
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1004f59
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x10019e4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1004f4c
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x1004f5b
xor eax, eax
pop esi
leave
ret 4
Function at 0x41a630
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x41a683
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x41a66a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x544059ba
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
mov ecx, 0x57c07ecc
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x532f2442
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
mov eax, section..text_1
nop
nop
cmp eax, 0
nop
nop
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x67e63d0f
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x406de0
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80
push eax
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_SetWindowLongA
push 5
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x40103b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc00
lea eax, [ebp - 0x800]
push 0x400
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0xc00]
push eax
lea eax, [ebp - 0x800]
push eax
call entry0
lea eax, [ebp - 0xc00]
push eax
lea eax, [ebp - 0x400]
push str.rundll32.exe_shell32.dll_Control_RunDLL___sjpicpl32.cpl_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0x400]
push 1
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x20
jae 0x4010b6
push 0x10
lea eax, [ebp - 0x400]
push str.Unable_to_Start_Java_TM__Plug_in_Control_Panel
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
pop eax
jmp 0x4010b8
xor eax, eax
leave
ret 0x10
Function at 0x401ac5
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push edi
xor edi, edi
mov esi, ecx
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
cmp eax, edi
mov dword [esi + 0x88], eax
jne 0x401ae4
xor al, al
jmp 0x401afe
lea eax, [esp + 8]
push eax
push edi
push esi
push 0x401b02
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
pop ecx
ret

Function at 0x401b51
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0
push 0
mov dword [ebp + 0x10], eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
push dword [ebp + 8]
mov ebx, 0x434858
mov dword [0x4348c8], 0x42f0a8
mov dword [0x434850], ebx
push 0x42f060
push ebx
mov dword [0x434858], 0x84
mov dword [0x4348bc], 0x300
call dword [sym.imp.ATL.DLL_AtlModuleInit]
mov eax, 0x4272d8
mov ecx, eax
test ecx, ecx
je 0x401bc0
push 0x10
push eax
push 0x434840
call fcn.00409460
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, 0x42f0d0
lea edi, [ebp - 4]
movsw word es:[edi], word [esi]
mov dword [0x4348dc], eax
lea eax, [ebp - 4]
movsb byte es:[edi], byte [esi]
xor esi, esi
push eax
push dword [ebp + 0x10]
mov dword [ebp + 8], esi
call fcn.00401b10
mov edi, eax
pop ecx
cmp edi, esi
pop ecx
je 0x401c4a
push str.UnregServer
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x401c16
push 0x42f0b8
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x401c31
lea eax, [ebp - 4]
push eax
push edi
jmp 0x401be2
push esi
push esi
push esi
push 0x64
push ebx
call dword [sym.imp.ATL.DLL_AtlModuleUpdateRegistryFromResourceD]
push esi
push 1
push ebx
call dword [sym.imp.ATL.DLL_AtlModuleUnregisterServerEx]
mov dword [ebp + 8], eax
jmp 0x401c9a
push esi
push esi
push 1
push 0x64
push ebx
call dword [sym.imp.ATL.DLL_AtlModuleUpdateRegistryFromResourceD]
push esi
push 1
push ebx
call dword [sym.imp.ATL.DLL_AtlModuleRegisterServer]
jmp 0x401c2c
mov ecx, ebx
call fcn.00401ac5
push 5
push 4
push ebx
call dword [sym.imp.ATL.DLL_AtlModuleRegisterClassObjects]
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov edi, dword [sym.imp.USER32.dll_GetMessageA]
push esi
push esi
lea eax, [ebp - 0x20]
push esi
push eax
call edi
test eax, eax
je 0x401c88
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push esi
push esi
lea eax, [ebp - 0x20]
push esi
push eax
jmp 0x401c6f
push ebx
call dword [sym.imp.ATL.DLL_AtlModuleRevokeClassObjects]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
call dword [sym.imp.ATL.DLL_AtlModuleTerm]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x402688
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
lea eax, [ebp - 8]
push ebx
push eax
xor ebx, ebx
push str.softwareFounderelecroc
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x4026b3
xor eax, eax
jmp 0x402723
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x104
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push 0x42f138
mov dword [ebp - 0x10], 1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x114]
push eax
call fcn.004048e0
test eax, eax
pop ecx
jne 0x4026af
push ebx
push ebx
call fcn.00404900
pop ecx
test eax, eax
pop ecx
jne 0x4026af
lea eax, [ebp - 4]
push 3
push eax
mov byte [ebp - 4], 0xc
mov byte [ebp - 3], 1
mov byte [ebp - 2], bl
call fcn.00404ac0
neg eax
pop ecx
sbb eax, eax
pop ecx
inc eax
pop ebx
leave
ret

Function at 0x4033ab
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov eax, 0x42614c
call fcn.00409b88
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.0040a820
mov edi, eax
pop ecx
lea ebx, [edi + 1]
lea eax, [ebx + 1]
add eax, 3
and al, 0xfc
call fcn.0040a620
mov esi, esp
push ebx
push dword [ebp + 8]
push esi
call fcn.00409460
add esp, 0xc
cmp edi, 1
jbe 0x4034a7
cmp byte [esi], 0x5c
jne 0x4034a7
cmp byte [esi + 1], 0x5c
jne 0x4034a7
lea eax, [esi + 2]
mov cl, byte [eax]
test cl, cl
je 0x403415
cmp cl, 0x5c
je 0x403415
push eax
call fcn.00409d78
pop ecx
jmp 0x403401
cmp byte [eax], 0
je 0x403421
push eax
call fcn.00409d78
pop ecx
mov cl, byte [eax]
test cl, cl
je 0x40342c
cmp cl, 0x5c
jne 0x40341a
cmp byte [eax], 0
je 0x403435
and byte [eax + 1], 0
lea eax, [ebx + 1]
add eax, 3
and al, 0xfc
call fcn.0040a620
mov edi, esp
push ebx
push dword [ebp + 8]
push edi
call fcn.00409460
push esi
call fcn.0040a7dc
add eax, edi
mov edi, 0x42f268
push edi
push eax
call fcn.0040a740
add esp, 0x18
test eax, eax
je 0x4034cb
push eax
push esi
call fcn.0040a660
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x403482
test al, 0x10
jne 0x40348f
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x4034c7
push 0x42f264
push esi
call fcn.0040a660
push edi
push 0
call fcn.0040a740
add esp, 0x10
jmp 0x403465
mov cl, byte [esi]
mov eax, esi
test cl, cl
je 0x40342c
cmp cl, 0x5c
je 0x40342c
push eax
call fcn.00409d78
pop ecx
mov cl, byte [eax]
jmp 0x4034ab
xor esi, esi
jmp 0x4034ce
push 1
pop esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401162
mov ecx, dword [ebp - 0xc]
lea esp, [ebp - 0x18]
mov eax, esi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x404900
Capabilities:
Create thread

Disassembly:
push ecx
mov eax, dword [0x434f08]
push ebx
xor ebx, ebx
push ebp
push esi
cmp eax, ebx
push edi
je 0x404925
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x2710
call esi
cmp dword [0x434f08], ebx
jne 0x404916
mov ecx, dword [esp + 0x1c]
mov eax, 1
cmp ecx, eax
jne 0x404937
mov dword [0x434f0c], eax
call fcn.00404380
mov esi, eax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], ebx
call fcn.004043d0
mov ebp, eax
mov ecx, 0xc
xor eax, eax
mov edi, ebp
rep stosd dword es:[edi], eax
add esp, 4
mov ecx, esi
call fcn.00404dd0
mov edi, eax
cmp edi, ebx
jle 0x404983
test edi, edi
je 0x404987
mov ecx, esi
call fcn.00405450
mov ecx, esi
call fcn.00404dd0
inc ebx
mov edi, eax
cmp ebx, 0xa
jl 0x404969
test edi, edi
jne 0x404a00
lea ecx, [esp + 0x10]
push ecx
push ebp
mov ecx, esi
call fcn.00405cd0
call fcn.004043f0
mov ecx, esi
mov ebx, eax
call fcn.00407ab0
mov dword [ebx], eax
mov eax, dword [esp + 0x18]
test eax, eax
mov dword [0x434f08], 0
je 0x4049e3
push 0
push 0
push 0
push 0x404400
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x4348e8
mov dword [0x42f28c], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0x4348e8
mov dword [0x42f28c], 0xffffffff
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
cmp edi, 0xffffffff
jne 0x404a07
xor edi, edi
push 0x4348e8
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x4086c0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push 0
push 0
mov eax, dword [esi + 4]
mov edx, dword [esi]
shl eax, 8
or eax, edx
mov edx, dword [esp + 0x10]
shl eax, 0x10
or eax, edx
push eax
push 0x408650
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 8], eax
xor eax, eax
pop esi
ret 4

Function at 0x408840
Capabilities:
Encrypt data using blowfish

Disassembly:
push ebx
push ebp
mov ebx, ecx
push esi
push edi
mov eax, ebx
mov esi, 4
mov ecx, 0x42b2dc
mov edx, 0x100
sub ecx, ebx
mov edi, dword [ecx + eax]
mov dword [eax], edi
add eax, 4
dec edx
jne 0x408859
dec esi
jne 0x40884d
mov edi, dword [esp + 0x18]
xor eax, eax
mov edx, 0x42b294
lea esi, [ebx + 0x1000]
xor ecx, ecx
mov dword [esp + 0x18], 4
mov ebp, dword [esp + 0x14]
movsx ebp, byte [eax + ebp]
or ebp, ecx
shl ebp, 8
inc eax
mov ecx, ebp
cmp eax, edi
jl 0x408898
xor eax, eax
mov ebp, dword [esp + 0x18]
dec ebp
mov dword [esp + 0x18], ebp
jne 0x408882
mov ebp, dword [edx]
add edx, 4
xor ebp, ecx
mov dword [esi], ebp
add esi, 4
cmp edx, 0x42b2dc
jl 0x408878
xor eax, eax
xor edx, edx
lea esi, [ebx + 0x1004]
mov edi, 9
push edx
push eax
mov ecx, ebx
call fcn.004089f0
mov dword [esi - 4], eax
mov dword [esi], edx
add esi, 8
dec edi
jne 0x4088c6
lea esi, [ebx + 4]
mov ebp, 4
mov edi, 0x80
push edx
push eax
mov ecx, ebx
call fcn.004089f0
mov dword [esi - 4], eax
mov dword [esi], edx
add esi, 8
dec edi
jne 0x4088e7
dec ebp
jne 0x4088e2
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x41c780
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28c
push ebx
push esi
push edi
mov dword [ebp - 0x190], 0x104
mov dword [ebp - 0x274], 1
mov eax, dword [ebp - 0x190]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
lea eax, [ebp - 0x18c]
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_OpenFile]
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 0xffffffff
jne 0x41c7e9
mov eax, 1
jmp 0x41c917
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp - 0x288]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 0
je 0x41c8ff
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 0x284]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 0
je 0x41c8f2
push 0
mov eax, dword [ebp - 0x288]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x278], eax
mov dword [ebp - 0x27c], 0
mov eax, dword [ebp - 0x280]
push eax
call fcn.0041c623
add esp, 4
cmp eax, 0x4550
jne 0x41c8f2
lea eax, [ebp - 0x270]
push eax
mov eax, dword [ebp - 0x280]
push eax
call fcn.0041c6ce
add esp, 8
test eax, eax
jne 0x41c8f2
mov eax, dword [ebp - 0x22c]
and eax, 0xffff
mov dword [ebp - 0x28c], eax
jmp 0x41c8c6
mov dword [ebp - 0x274], 0
jmp 0x41c8f2
mov dword [ebp - 0x274], 1
jmp 0x41c8f2
cmp dword [ebp - 0x28c], 3
je 0x41c8a8
cmp dword [ebp - 0x28c], 5
je 0x41c8a8
cmp dword [ebp - 0x28c], 7
je 0x41c8a8
jmp 0x41c8b7
mov eax, dword [ebp - 0x284]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x288]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x274]
jmp 0x41c917
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41d155
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x14], 0x54
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x12], 0x72
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x10], 0x69
mov byte [ebp - 0xf], 0x6e
mov byte [ebp - 0xe], 0x61
mov byte [ebp - 0xd], 0x6c
mov byte [ebp - 0xc], 0x20
mov byte [ebp - 0xb], 0x53
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 9], 0x72
mov byte [ebp - 8], 0x76
mov byte [ebp - 7], 0x65
mov byte [ebp - 6], 0x72
mov byte [ebp - 5], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 4], eax
test byte [ebp - 1], 0x80
jne 0x41d1e9
xor eax, eax
mov al, byte [ebp - 4]
cmp eax, 4
jle 0x41d1da
lea eax, [ebp - 0x14]
push eax
call fcn.0041d1f6
add esp, 4
mov dword [ebp - 0x18], eax
jmp 0x41d1e9
lea eax, [ebp - 0x14]
push eax
call fcn.0041d1f6
add esp, 4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
jmp 0x41d1f1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41d1f6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x1c], 0
lea eax, [ebp - 0x14]
push eax
push str.SystemCurrentControlSetControlProductOptions
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x41d248
jmp 0x41d31f
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0x433880
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x41d27a
cmp dword [ebp - 0xc], 0
jne 0x41d27f
jmp 0x41d31f
mov eax, dword [ebp - 0xc]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x41d29d
jmp 0x41d31f
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x1c]
push eax
lea eax, [ebp - 4]
push eax
push 0
push str.ProductSuite
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x41d2d1
cmp dword [ebp - 4], 7
je 0x41d2d6
jmp 0x41d31f
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movsx eax, byte [eax]
test eax, eax
je 0x41d31f
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x41d30c
mov dword [ebp - 0x10], 1
jmp 0x41d31f
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
add dword [ebp - 8], eax
jmp 0x41d2dc
cmp dword [ebp - 0x1c], 0
je 0x41d333
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x14], 0
je 0x41d347
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
jmp 0x41d34f
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41d59d
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0x10
push 0x4e8
push 5
push 6
call fcn.0041dcea
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x41d640
mov eax, dword [ebp - 4]
push eax
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00409d20
add esp, 0xc
mov word [ebp - 0x18], 6
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.WSOCK32.dll_bind
cmp eax, 0xffffffff
je 0x41d640
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.WSOCK32.dll_getsockname
cmp eax, 0xffffffff
je 0x41d640
lea eax, [ebp - 0x18]
push eax
call fcn.0041d4e9
add esp, 4
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.0040ab00
add esp, 8
mov eax, dword [ebp - 8]
push eax
call sub.WSOCK32.dll_closesocket
xor eax, eax
jmp 0x41d65b
push str.00_00_00_00_FF_FF_FF_FF_FF_FF
mov eax, dword [ebp + 8]
push eax
call fcn.0040ab00
add esp, 8
mov eax, 1
jmp 0x41d65b
pop edi
pop esi
pop ebx
leave
ret
Function at 0x420230
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 4], 0
call fcn.0041cd0d
test eax, eax
jne 0x420279
mov eax, dword [ebp + 8]
push eax
push 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x420274
mov eax, 1
jmp 0x420311
jmp 0x42029e
mov eax, dword [ebp + 8]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x42029e
mov eax, 1
jmp 0x420311
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4202c8
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
xor eax, eax
jmp 0x420311
cmp dword [ebp - 8], 0x102
jne 0x4202f8
inc dword [ebp - 4]
mov eax, dword [ebp + 0x18]
cmp dword [ebp - 4], eax
jle 0x4202ee
jmp 0x420307
jmp 0x42029e
mov eax, 0x73
jmp 0x420311
mov eax, 1
jmp 0x420311
pop edi
pop esi
pop ebx
leave
ret

Function at 0x420316
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
call fcn.0041cd0d
test eax, eax
jne 0x420358
mov eax, dword [ebp + 8]
push eax
push 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x420353
mov eax, 1
jmp 0x4203c3
jmp 0x42037d
mov eax, dword [ebp + 8]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x42037d
mov eax, 1
jmp 0x4203c3
push 0xffffffffffffffff
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4203aa
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
xor eax, eax
jmp 0x4203c3
mov eax, 0x73
jmp 0x4203c3
pop edi
pop esi
pop ebx
leave
ret