joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d7bea
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x804580]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
xor ecx, ecx
lea edx, [ebp - 0x10]
inc ecx
mov eax, ecx
xor eax, esi
shl eax, 4
add eax, dword [ebp + 8]
inc ecx
mov dword [edx], eax
lea edx, [edx + 4]
cmp ecx, 4
jl 0x6d7c08
xor ecx, ecx
cmp ecx, 3
jge 0x6d7d4a
mov eax, dword [ebp + ecx*4 - 0x10]
inc ecx
mov dword [ebp - 0x18], ecx
movsd xmm3, qword [eax]
movsd xmm4, qword [eax + 8]
xor eax, eax
cmp ecx, 3
movsd qword [ebp - 0x30], xmm3
movsd qword [ebp - 0x38], xmm4
cmovne eax, ecx
mov eax, dword [ebp + eax*4 - 0x10]
movsd xmm0, qword [eax]
movsd xmm2, qword [eax + 8]
subsd xmm0, xmm3
subsd xmm2, xmm4
ucomisd xmm0, qword [0x7239c0]
movsd qword [ebp - 0x40], xmm0
movsd qword [ebp - 0x28], xmm2
lahf
test ah, 0x44
jp 0x6d7c86
ucomisd xmm2, qword [0x7239c0]
lahf
test ah, 0x44
jnp 0x6d7c1f
movsd xmm1, qword [edi + 8]
subsd xmm1, xmm4
push ecx
push ecx
mulsd xmm1, xmm0
movsd xmm0, qword [edi]
subsd xmm0, xmm3
mulsd xmm0, xmm2
subsd xmm1, xmm0
movsd qword [ebp - 0x20], xmm1
movsd qword [esp], xmm1
call fcn.0067d9a0
pop ecx
pop ecx
test al, al
jne 0x6d7d39
mov ebx, dword [ebp + 0xc]
xor eax, eax
movsd xmm1, qword [ebp - 0x20]
movsd xmm3, qword [ebp - 0x28]
movsd xmm4, qword [ebp - 0x30]
mov dword [ebp - 0x14], eax
movsd xmm2, qword [ebx + 8]
movsd xmm0, qword [ebx]
subsd xmm2, qword [ebp - 0x38]
subsd xmm0, xmm4
mulsd xmm2, qword [ebp - 0x40]
mulsd xmm0, xmm3
subsd xmm2, xmm0
movaps xmm0, xmm2
mulsd xmm0, xmm1
comisd xmm0, xmmword [0x7239c0]
jbe 0x6d7d25
push ecx
push ecx
movsd qword [esp], xmm2
call fcn.00687718
pop ecx
pop ecx
test al, al
je 0x6d7d39
movsd xmm1, qword [ebp - 0x20]
movsd xmm3, qword [ebp - 0x28]
movsd xmm4, qword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
inc eax
add ebx, 0x10
mov dword [ebp - 0x14], eax
cmp eax, 4
jl 0x6d7cd1
mov ecx, dword [ebp - 0x18]
jmp 0x6d7c1f
inc esi
add edi, 0x10
cmp esi, 4
jl 0x6d7c02
xor al, al
jmp 0x6d7d4c
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00438587
mov esp, ebp
pop ebp
ret

Function at 0x6db184
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
xor ecx, ecx
push ebx
mov ebx, edx
push esi
shr ebx, 4
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
test ebx, ebx
je 0x6db1be
rol esi, 0xf
xor esi, dword [edi]
rol esi, 0xf
xor esi, dword [edi + 4]
rol esi, 0xf
xor esi, dword [edi + 8]
rol esi, 0xf
xor esi, dword [edi + 0xc]
add edi, 0x10
sub ebx, 1
jne 0x6db19d
xor ecx, ecx
shr edx, 2
xor ebx, ebx
and edx, 3
lea eax, [edi + edx*4]
lea edx, [edx*4 + 3]
shr edx, 2
cmp edi, eax
cmova edx, ebx
test edx, edx
je 0x6db1e9
rol esi, 0xf
xor esi, dword [edi]
inc ecx
lea edi, [edi + 4]
cmp ecx, edx
jb 0x6db1dc
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
Function at 0x6f287f
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push dword [ebp + 0x18]
xor edi, edi
xor esi, esi
push dword [ebp + 0x1c]
inc edi
mov dword [ebp - 8], esi
push edi
call fcn.006fe289
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], esi
jne 0x6f28ac
xor eax, eax
jmp 0x6f29a8
mov eax, dword [ebp - 4]
mov ecx, bind
push 0x40
push 0x4c553b
mov dword [eax + 0x2a4], ecx
mov eax, dword [ebp - 4]
push dword [ebp - 4]
mov dword [eax + 0x2a8], ecx
call fcn.006f392a
push esi
push eax
call fcn.004c5550
add esp, 0x14
test eax, eax
je 0x6f28e7
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp - 4]
call fcn.006fe434
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.006f390c
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.006f502b
add esp, 0x28
test eax, eax
jne 0x6f291e
mov dword [ebp - 8], edi
mov eax, dword [ebp - 4]
mov dword [eax + 0xb4], 0x2000
cmp dword [ebp - 8], esi
jne 0x6f295f
mov eax, dword [ebp - 4]
push dword [eax + 0xb4]
push dword [ebp - 4]
call fcn.006fe405
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xb0], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xb0], esi
jne 0x6f295a
mov dword [ebp - 8], edi
cmp dword [ebp - 8], esi
je 0x6f298f
mov eax, dword [ebp - 4]
push dword [eax + 0xb0]
push dword [ebp - 4]
call fcn.006fe35a
push dword [ebp + 0x18]
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
push dword [ebp - 4]
mov dword [eax + 0xb0], esi
call fcn.006fe312
add esp, 0x14
jmp 0x6f28a5
push esi
push esi
push esi
push dword [ebp - 4]
call fcn.006fe1d8
push dword [ebp - 4]
call fcn.006f2a52
mov eax, dword [ebp - 4]
add esp, 0x14
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x6f4dd1
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
test eax, eax
je 0x6f4e07
push edi
mov edi, 0x10c
cmp dword [ebp + 0xc], edi
jae 0x6f4dfa
push eax
call fcn.006fe2fe
push 2
call fcn.006fe275
pop ecx
pop ecx
mov dword [esi], eax
push edi
push 0
push eax
call fcn.004c3e70
add esp, 0xc
pop edi
pop esi
pop ebp
ret
Function at 0x6f61fc
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push dword [ebp + 0x18]
xor edi, edi
xor esi, esi
push dword [ebp + 0x1c]
inc edi
mov dword [ebp - 8], esi
push edi
call fcn.006fe289
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], esi
jne 0x6f6229
xor eax, eax
jmp 0x6f63cd
mov eax, dword [ebp - 4]
mov ecx, bind
push 0x40
push 0x4c553b
mov dword [eax + 0x2a4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x2a8], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x2ac], esi
mov eax, dword [ebp - 4]
push dword [ebp - 4]
mov dword [eax + 0x2b0], esi
call fcn.006f392a
push esi
push eax
call fcn.004c5550
add esp, 0x14
test eax, eax
je 0x6f6276
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp - 4]
call fcn.006fe434
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.006f390c
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.006f502b
add esp, 0x28
test eax, eax
jne 0x6f62ad
mov dword [ebp - 8], edi
cmp dword [ebp - 8], esi
jne 0x6f62e9
mov eax, dword [ebp - 4]
mov dword [eax + 0xb4], 0x2000
mov eax, dword [ebp - 4]
push dword [eax + 0xb4]
push dword [ebp - 4]
call fcn.006fe405
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xb0], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xb0], esi
jne 0x6f62e9
mov dword [ebp - 8], edi
mov eax, dword [ebp - 4]
mov dword [eax + 0x98], 0x6f50fd
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov dword [eax + 0x9c], fcn.006f514c
mov eax, dword [ebp - 4]
mov dword [eax + 0xa0], ecx
cmp dword [ebp - 8], esi
jne 0x6f6369
mov eax, dword [ebp - 4]
push 0x38
add eax, 0x78
push str.1.2.5
push eax
call fcn.0070587a
add esp, 0xc
cmp eax, 0xfffffffa
je 0x6f6352
cmp eax, 0xfffffffc
je 0x6f634b
cmp eax, 0xfffffffe
je 0x6f6344
test eax, eax
je 0x6f6364
push str.Unknown_zlib_error
jmp 0x6f6357
push str.zlib_stream_error
jmp 0x6f6357
push str.zlib_memory_error
jmp 0x6f6357
push str.zlib_version_error
push dword [ebp - 4]
call fcn.006f3946
pop ecx
mov dword [ebp - 8], edi
pop ecx
cmp dword [ebp - 8], esi
je 0x6f6399
mov eax, dword [ebp - 4]
push dword [eax + 0xb0]
push dword [ebp - 4]
call fcn.006fe35a
push dword [ebp + 0x18]
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
push dword [ebp - 4]
mov dword [eax + 0xb0], esi
call fcn.006fe312
add esp, 0x14
jmp 0x6f6222
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
push esi
push esi
mov eax, dword [eax + 0xb0]
mov dword [ecx + 0x84], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
push dword [ebp - 4]
mov eax, dword [eax + 0xb4]
mov dword [ecx + 0x88], eax
call fcn.006fb1d0
mov eax, dword [ebp - 4]
add esp, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x703e7f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 0x2c]
mov eax, dword [edi + 0x2c]
mov edx, dword [edi + 0x3c]
add eax, 0xfffffefa
sub edx, dword [edi + 0x74]
add eax, ebx
sub edx, dword [edi + 0x6c]
mov dword [ebp - 8], edx
cmp dword [edi + 0x6c], eax
jb 0x703f1b
mov ecx, dword [edi + 0x38]
push ebx
lea eax, [ecx + ebx]
push eax
push ecx
call fcn.004c3370
mov ecx, dword [edi + 0x4c]
add esp, 0xc
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
sub dword [edi + 0x5c], ebx
mov edi, ecx
mov dword [ebp - 4], ecx
lea esi, [eax + ecx*2]
lea esi, [esi - 2]
xor ecx, ecx
movzx edx, word [esi]
mov eax, edx
sub eax, ebx
cmp edx, ebx
movzx eax, ax
cmovae ecx, eax
mov word [esi], cx
sub edi, 1
jne 0x703ed0
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x40]
mov edi, ebx
lea esi, [eax + ebx*2]
lea esi, [esi - 2]
xor ecx, ecx
movzx edx, word [esi]
mov eax, edx
sub eax, ebx
cmp edx, ebx
movzx eax, ax
cmovae ecx, eax
mov word [esi], cx
sub edi, 1
jne 0x703ef7
mov edx, dword [ebp - 8]
mov edi, dword [ebp + 8]
add edx, ebx
mov esi, dword [edi]
cmp dword [esi + 4], 0
je 0x704040
mov eax, dword [edi + 0x74]
add eax, dword [edi + 0x6c]
add eax, dword [edi + 0x38]
mov dword [ebp - 8], eax
mov eax, dword [esi + 4]
cmp eax, edx
mov ecx, eax
cmova ecx, edx
mov dword [ebp - 4], ecx
test ecx, ecx
jne 0x703f48
xor eax, eax
jmp 0x703f94
sub eax, ecx
mov dword [esi + 4], eax
mov eax, dword [esi + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x703f65
push ecx
push dword [esi]
push dword [esi + 0x30]
call fcn.00707535
jmp 0x703f75
cmp eax, 2
jne 0x703f7e
push ecx
push dword [esi]
push dword [esi + 0x30]
call fcn.00705a4b
mov ecx, dword [ebp - 4]
add esp, 0xc
mov dword [esi + 0x30], eax
push ecx
push dword [esi]
push dword [ebp - 8]
call fcn.004c3370
mov eax, dword [ebp - 4]
add esp, 0xc
add dword [esi], eax
add dword [esi + 8], eax
add dword [edi + 0x74], eax
cmp dword [edi + 0x74], 3
jb 0x703fbc
mov edx, dword [edi + 0x6c]
mov eax, dword [edi + 0x38]
mov ecx, dword [edi + 0x58]
movzx esi, byte [edx + eax]
mov dword [edi + 0x48], esi
movzx eax, byte [edx + eax + 1]
shl esi, cl
xor esi, eax
and esi, dword [edi + 0x54]
mov dword [edi + 0x48], esi
cmp dword [edi + 0x74], 0x106
jae 0x703fd1
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x703e8d
mov ecx, dword [edi + 0x16c0]
mov ebx, dword [edi + 0x3c]
cmp ecx, ebx
jae 0x704040
mov esi, dword [edi + 0x6c]
add esi, dword [edi + 0x74]
cmp ecx, esi
jae 0x704010
mov eax, 0x102
sub ebx, esi
cmp ebx, eax
cmova ebx, eax
mov eax, dword [edi + 0x38]
push ebx
add eax, esi
push 0
push eax
call fcn.004c3e70
lea eax, [ebx + esi]
add esp, 0xc
mov dword [edi + 0x16c0], eax
jmp 0x704040
lea eax, [esi + 0x102]
cmp ecx, eax
jae 0x704040
mov eax, dword [edi + 0x38]
sub esi, ecx
sub ebx, ecx
add esi, 0x102
cmp esi, ebx
cmova esi, ebx
add eax, ecx
push esi
push 0
push eax
call fcn.004c3e70
add esp, 0xc
add dword [edi + 0x16c0], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x705a4b
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x705a58
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.00705a5e
Function at 0x401500
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401519
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x40152d
pop esi
pop edi
xor eax, eax
pop ebx
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x40154e
cmp esi, eax
jae 0x401527
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401540
cmp esi, eax
jae 0x401527
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x4016b0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x22c
push ebx
push esi
push edi
push 0x104
lea eax, [esp + 0x138]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
xor ebx, ebx
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x138]
push edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
call fcn.00416e1f
mov esi, dword [esp + 0xc]
lea edi, [esp + 0x134]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x401704
mov eax, dword [str.IMEROVASOfT]
mov ecx, dword [0x4237c8]
mov edx, dword [0x4237cc]
mov dword [edi], eax
mov ax, word [0x4237d0]
mov dword [edi + 4], ecx
mov dword [edi + 8], edx
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x138]
push edx
mov word [edi + 0xc], ax
call fcn.00416e1f
movzx eax, word [esp + 0xc]
not esi
movzx ecx, si
shl eax, 0x10
or eax, ecx
and eax, 0x7fffffff
push eax
push str.BookID
push str.SOFTWAREROVASOFT
push 0x80000002
call fcn.004045d0
add esp, 0x10
pop edi
pop esi
pop ebx
add esp, 0x22c
ret

Function at 0x401780
Capabilities:
Get common file path

Disassembly:
sub esp, 0x230
push esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
lea eax, [esp + 4]
push eax
push 0x42c27c
push str.SOFTWAREROVASOFT
push 0x80000002
call fcn.00404570
add esp, 0x10
test eax, eax
jne 0x401818
push 0x104
lea ecx, [esp + 0x134]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
xor eax, eax
lea edx, [esp + 8]
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
push edx
lea eax, [esp + 0x134]
push eax
call fcn.00416e1f
mov eax, dword [esp + 8]
shl eax, 0x16
xor eax, esi
and eax, 0x7fffffff
push eax
push 0x42c27c
push str.SOFTWAREROVASOFT
push 0x80000002
mov dword [esp + 0x14], eax
call fcn.004045d0
add esp, 0x10
pop esi
add esp, 0x230
ret
Function at 0x401820
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4216e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
movzx eax, word [ebp + 0xc]
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push 0x4237fc
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4018a9
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4018a9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4018a9
mov edi, dword [esi + 8]
lea ecx, [ebp - 0x28]
call fcn.004176ec
mov ecx, dword [ebp + 8]
push 0
push 0x9001
push ecx
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.0041793d
test eax, eax
jne 0x4018bc
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
call fcn.0041772b
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x18]
mov ebx, 1
call fcn.00416697
push edi
push esi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.00417439
jmp 0x4018fd
mov dword [ebp - 4], 0
call fcn.004166ad
lea ecx, [ebp - 0x28]
call fcn.0041751f
lea ecx, [ebp - 0x28]
call fcn.0041768a
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
call fcn.0041772b
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, ebx
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402b30
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
call fcn.00402250
test eax, eax
jne 0x402b91
push edi
push 0x104
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edi, [esp + 4]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402b55
mov ecx, dword [str.pyjju.ime]
mov edx, dword [0x423870]
mov ax, word [0x423874]
mov dword [edi], ecx
mov cl, byte [0x423876]
mov dword [edi + 4], edx
push 0x423848
lea edx, [esp + 8]
mov word [edi + 8], ax
push edx
mov byte [edi + 0xa], cl
call sub.IMM32.dll_ImmInstallIMEA
pop edi
add esp, 0x104
ret
Function at 0x403091
Capabilities:
Check os version

Disassembly:
push ebp
push esi
mov esi, ecx
push edi
lea edi, [esi + 0xe8]
mov dword [edi], 0x94
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
xor ebp, ebp
push edi
mov word [esi + 0x190], ax
mov dword [esi + 0x17c], ebp
mov dword [esi + 0x180], ebp
mov dword [esi + 0x184], ebp
mov dword [esi + 0x188], ebp
mov dword [esi + 0x18c], ebp
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x40319b
mov ecx, dword [esi + 0xf8]
xor eax, eax
cmp ecx, 2
sete al
mov edi, eax
mov eax, 1
cmp ecx, eax
mov dword [esi + 0x17c], edi
jne 0x403115
mov edx, dword [esi + 0xec]
cmp edx, 4
ja 0x403111
jne 0x403115
cmp dword [esi + 0xf0], ebp
jbe 0x403115
mov edx, eax
jmp 0x403117
xor edx, edx
cmp edx, ebp
mov dword [esi + 0x184], edx
jne 0x403130
push ebx
xor ebx, ebx
cmp ecx, eax
sete bl
mov dword [esi + 0x188], ebx
pop ebx
cmp edi, ebp
jne 0x403150
cmp edx, ebp
jne 0x403178
cmp dword [esi + 0x188], ebp
jne 0x403178
pop edi
mov dword [esi + 0xe4], 0x69
pop esi
xor eax, eax
pop ebp
ret
mov ecx, dword [esi + 0xec]
cmp ecx, 4
jae 0x40316b
pop edi
mov dword [esi + 0xe4], 0x68
pop esi
xor eax, eax
pop ebp
ret
cmp ecx, 5
jne 0x403176
mov dword [esi + 0x180], eax
ja 0x40319b
mov cx, word [esi + 0x190]
cmp cx, 0x804
je 0x40318d
cmp cx, 0x404
jne 0x403193
mov dword [esi + 0x18c], eax
cmp dword [esi + 0x18c], ebp
jne 0x4031a7
mov dword [esi + 0xe4], 0x69
xor eax, eax
pop edi
pop esi
pop ebp
ret

Function at 0x403290
Capabilities:
Copy file
Create directory
Get common file path

Disassembly:
sub esp, 0x22c
push ebx
push edi
push 0x104
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edi, [esp + 8]
dec edi
xor ebx, ebx
nop
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x4032b0
mov ecx, dword [str.IME]
mov dl, byte [0x423a3c]
push esi
mov dword [edi], ecx
lea eax, [esp + 0x110]
push eax
lea ecx, [esp + 0x10]
push ecx
mov byte [edi + 4], dl
mov dword [esp + 0x118], ebx
mov dword [esp + 0x11c], ebx
mov dword [esp + 0x120], ebx
mov dword [esp + 0x124], ebx
mov dword [esp + 0x128], ebx
mov dword [esp + 0x12c], ebx
call fcn.00416e1f
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jne 0x403318
push ebx
lea edx, [esp + 0x10]
push edx
call esi
lea edi, [esp + 0xc]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x403320
mov eax, dword [0x423a2c]
mov ecx, dword [0x423a30]
mov dx, word [0x423a34]
mov dword [edi], eax
mov dword [edi + 4], ecx
lea eax, [esp + 0x110]
push eax
lea ecx, [esp + 0x10]
push ecx
mov word [edi + 8], dx
call fcn.00416e1f
test eax, eax
jne 0x403361
push ebx
lea edx, [esp + 0x10]
push edx
call esi
lea edi, [esp + 0xc]
dec edi
pop esi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x403367
mov eax, dword [str.PYSET.EXE]
mov ecx, dword [0x423a24]
mov dx, word [0x423a28]
mov dword [edi], eax
mov al, byte [0x423a2a]
mov dword [edi + 4], ecx
push ebx
mov word [edi + 8], dx
mov edx, dword [esp + 0x23c]
lea ecx, [esp + 0xc]
push ecx
push edx
mov byte [edi + 0xa], al
call dword [sym.imp.KERNEL32.dll_CopyFileA]
pop edi
pop ebx
add esp, 0x22c
ret
Function at 0x4033cb
Capabilities:
Create directory
Get common file path
Persist via run registry key

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x42182b
push eax
mov dword fs:[0], esp
sub esp, 0x108
push esi
mov esi, ecx
mov eax, dword [esi + 0x17c]
test eax, eax
push edi
mov edi, str.SoftwareMicrosoftWindows_NTCurrentVersion
jne 0x4033e3
mov edi, str.SoftwareMicrosoftWindowsCurrentVersion
lea eax, [esi + 0xc4]
push eax
push str.RegisteredOwner
push edi
push 0x80000002
call fcn.00404670
lea ecx, [esi + 0xbc]
push ecx
push str.RegisteredOrganization
push edi
push 0x80000002
call fcn.00404670
lea edx, [esi + 0xd0]
push edx
push str.ProgramFilesDir
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.00404670
lea eax, [esi + 0xd4]
push eax
push str.Programs
push 0x42c150
push 0x80000001
call fcn.00404670
add esp, 0x40
lea ecx, [esi + 0xd8]
push ecx
push str.Common_Desktop
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000002
call fcn.00404670
add esp, 0x10
lea edx, [esp + 0xc]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [esp + 0xc]
lea edi, [esi + 0xdc]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403485
sub eax, edx
push eax
lea eax, [esp + 0x10]
push eax
mov ecx, edi
call fcn.00401d00
mov eax, str.PYJJ_
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4034a3
sub eax, ecx
push eax
push str.PYJJ_
mov ecx, edi
call fcn.00401f00
mov edi, dword [edi]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x104
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [esp + 0xc]
push edx
lea ecx, [esp + 0xc]
call fcn.004021c0
lea edi, [esp + 0xc]
mov dword [esp + 0x118], 0
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4034f2
mov eax, dword [str.IMERovasoft_]
mov ecx, dword [0x423a44]
mov edx, dword [0x423a48]
mov dword [edi], eax
mov ax, word [0x423a4c]
mov dword [edi + 4], ecx
mov cl, byte [0x423a4e]
mov dword [edi + 8], edx
mov word [edi + 0xc], ax
mov byte [edi + 0xe], cl
lea eax, [esp + 0xc]
lea ecx, [esi + 0xcc]
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x403533
sub eax, esi
push eax
lea edx, [esp + 0x10]
push edx
call fcn.00401d00
mov eax, dword [esp + 8]
add eax, 0xfffffff0
mov dword [esp + 0x118], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
pop edi
pop esi
jg 0x403572
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x108]
mov dword fs:[0], ecx
add esp, 0x114
ret