joyce8/EMBER2024-capa huggingface dataset:
Function at 0x300010cc
Capabilities:
Terminate process

Disassembly:
call 0x300010d6
jmp 0x300011b3
push 0x58
push 0x300012c8
call fcn.300012f0
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x30003044
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
jne 0x3000175b
xor esi, esi
inc esi
mov eax, dword [0x30003040]
cmp eax, esi
je 0x30001779
mov eax, dword [0x30003040]
test eax, eax
jne 0x30001568
mov dword [0x30003040], esi
push 0x300012c0
push 0x300012b8
call sub.MSVCR80.dll__initterm_e
pop ecx
pop ecx
test eax, eax
jne 0x3000181b
mov eax, dword [0x30003040]
cmp eax, esi
jne 0x3000125f
push 0x300012b4
push 0x300012ac
call sub.MSVCR80.dll__initterm
pop ecx
pop ecx
mov dword [0x30003040], 2
test ebx, ebx
jne 0x3000126b
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x30003050], 0
jne 0x30001786
mov eax, dword [sym.imp.MSVCR80.dll__acmdln]
mov esi, dword [eax]
nop
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
jbe 0x30001528
cmp al, 0x22
je 0x30001518
movzx eax, al
push eax
call dword [sym.imp.MSVCR80.dll__ismbblead]
pop ecx
test eax, eax
jne 0x300017bf
inc esi
jmp 0x30001280
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
jmp 0x30001295
test al, al
je 0x30001536
cmp dword [ebp - 0x1c], 0
jne 0x3000128d
mov al, byte [esi]
test al, al
je 0x30001546
cmp al, 0x20
ja 0x30001546
inc esi
mov dword [ebp - 0x20], esi
jmp 0x30001536
test byte [ebp - 0x3c], 1
jne 0x30001562
push 0xa
pop eax
push eax
push esi
push 0
push 0x30000000
call fcn.30001573
jmp 0x300017aa
movzx eax, word [ebp - 0x38]
jmp 0x3000154f
mov dword [0x30003058], esi
jmp 0x3000123b
cmp eax, esi
jne 0x30001769
xor esi, esi
inc esi
mov ebx, esi
jmp 0x30001202
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x300011ed
push 0x1f
call sub.MSVCR80.dll__amsg_exit
pop ecx
jmp 0x3000123b
push 0x30003050
call fcn.30001d69
pop ecx
test eax, eax
je 0x30001278
push 0
push 2
push 0
call dword [0x30003050]
jmp 0x30001278
mov dword [0x30003054], eax
cmp dword [0x30003020], 0
jne 0x300017f7
push eax
call dword [sym.imp.MSVCR80.dll_exit]
inc esi
mov dword [ebp - 0x20], esi
jmp 0x300012a8
cmp dword [0x30003058], 0
jne 0x30001806
call dword [sym.imp.MSVCR80.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x30003054]
jmp 0x30001827
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.30001504
ret
Function at 0x10001055
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0xc], ebx
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x10001078
mov eax, str.Admin
jmp 0x10001215
lea eax, [ebp - 0xc]
push eax
push ebx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x100010b1
lea eax, [ebp - 0xc]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x100010b1
mov eax, 0x100020a8
jmp 0x10001215
push esi
mov byte [ebp - 0x28], bl
mov byte [ebp - 0x27], bl
mov byte [ebp - 0x26], bl
mov byte [ebp - 0x25], bl
mov byte [ebp - 0x24], bl
mov byte [ebp - 0x23], 5
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], ebx
cmp dword [ebp + 8], ebx
je 0x100010f0
push str.CheckTokenMembership
push str.ADVAPI32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10003020], eax
cmp eax, ebx
jne 0x10001142
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push 2
push dword [ebp - 0xc]
call esi
test eax, eax
jne 0x10001142
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x10001142
push dword [ebp - 0x10]
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x10001142
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
push dword [ebp - 4]
push 2
push dword [ebp - 0xc]
call esi
test eax, eax
je 0x10001142
mov dword [ebp - 0x1c], 1
jmp 0x10001157
cmp dword [ebp + 8], ebx
je 0x100011fa
cmp dword [0x10003020], ebx
je 0x100011fa
mov dword [ebp - 8], ebx
push edi
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [eax + section..data]
lea eax, [ebp - 0x28]
push 0x20
push 2
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x100011eb
mov dword [ebp - 0x14], ebx
cmp dword [ebp + 8], ebx
je 0x1000119d
mov eax, dword [0x10003020]
cmp eax, ebx
je 0x1000119d
lea ecx, [ebp - 0x14]
push ecx
push dword [ebp - 0x18]
push ebx
call eax
jmp 0x100011d1
cmp dword [ebp - 0x1c], ebx
je 0x100011e2
mov eax, dword [ebp - 4]
xor edi, edi
cmp dword [eax], ebx
jbe 0x100011e2
mov esi, eax
add esi, 4
push dword [ebp - 0x18]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x100011c6
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 4]
inc edi
add esi, 8
cmp edi, dword [eax]
jb 0x100011b0
cmp dword [ebp - 0x14], ebx
je 0x100011e2
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10003004]
mov dword [ebp - 0x20], eax
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
add dword [ebp - 8], 8
cmp dword [ebp - 8], 0x20
jb 0x1000115b
pop edi
pop esi
cmp dword [ebp - 4], ebx
je 0x10001209
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x20]
pop ebx
leave
ret
Function at 0x40451d
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
push ebx
push esi
push edi
je 0x404572
push dword [esp + 0x10]
push 0x40449c
call dword [sym.imp.USER32.DLL_EnumWindows]
mov esi, dword [0x41bf58]
test esi, esi
je 0x4045cb
xor edi, edi
mov ebx, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 8], eax
jne 0x40456a
cmp byte [esi + 0x10], 0
je 0x40456a
push 3
push edi
push edi
push edi
push edi
push 0xfffffffffffffffe
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
mov esi, ebx
test ebx, ebx
jne 0x404546
jmp 0x4045cb
mov esi, dword [0x41bf58]
test esi, esi
je 0x4045cb
xor edi, edi
push ebp
mov ebx, dword [esi]
lea ebp, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp], eax
jne 0x4045c4
cmp byte [esi + 0x11], 0
je 0x4045a0
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_EnableWindow]
cmp byte [esi + 0x10], 0
je 0x4045b7
push 3
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
push ebp
push 0x41bf58
call fcn.0040f8ef
pop ecx
pop ecx
mov esi, ebx
test ebx, ebx
jne 0x40457f
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x406442
Capabilities:
Check os version

Disassembly:
sub esp, 0x114
push ebx
push ebp
push esi
push edi
push dword [0x41c248]
call fcn.0040f18f
xor ebp, ebp
mov esi, eax
cmp dword [0x41c028], ebp
jne 0x40651e
xor ebx, ebx
inc ebx
mov dword [0x41c028], ebx
call fcn.0040699a
mov edi, 0xa4
push edi
push ebp
push 0x41c030
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [0x41c030], 0x13
lea eax, [esp + 0x10]
mov dword [0x41c034], edi
mov dword [0x41c040], 0x40638d
mov dword [0x41c044], 0x4066b8
push eax
mov dword [0x41c098], 0x406368
mov dword [0x41c09c], 0x406603
mov dword [0x41c03c], 0x406343
mov dword [0x41c0c0], 0x4063a8
mov dword [0x41c0d4], ebx
mov dword [esp + 0x14], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40651e
cmp dword [esp + 0x20], ebx
je 0x406506
cmp dword [esp + 0x20], 2
jne 0x40651e
cmp dword [esp + 0x14], 5
jae 0x40650e
mov dword [0x41c0d4], ebp
jmp 0x40651e
jne 0x40651e
mov eax, dword [esp + 0x18]
neg eax
sbb eax, eax
and dword [0x41c0d4], eax
lea eax, [esp + 0x138]
push eax
lea eax, [esp + 0x138]
push eax
lea eax, [esp + 0x138]
push eax
lea eax, [esp + 0x138]
push eax
call fcn.0040805f
mov eax, dword [esp + 0x140]
push ebp
push dword [0x41befc]
or eax, 0x50010000
push 0xffffffffffffffff
push dword [esi]
push dword [esp + 0x148]
push dword [esp + 0x148]
push dword [esp + 0x148]
push dword [esp + 0x148]
push eax
push ebp
push str.BUTTON
push ebp
call dword [sym.imp.USER32.DLL_CreateWindowExW]
mov ebx, eax
test ebx, ebx
je 0x4065f4
push dword [esp + 0x128]
push dword [0x41c264]
call fcn.0040f220
mov edi, dword [esp + 0x13c]
mov esi, eax
mov dword [esi + 0x10], edi
test edi, edi
je 0x4065c3
push edi
call fcn.0040a9c0
test eax, eax
je 0x4065c3
push ebp
push ebp
push edi
call fcn.0040a60a
mov dword [esi + 0x18], eax
jmp 0x4065c6
mov dword [esi + 0x18], ebp
push 0x406092
push 0xfffffffffffffffc
push ebx
mov dword [esi + 0x14], ebp
mov dword [esi + 0x1c], ebp
call dword [sym.imp.USER32.DLL_SetWindowLongW]
push 0x41c030
push ebx
push esi
push dword [esp + 0x134]
mov dword [0x41c02c], eax
call fcn.004068e8
mov ebx, eax
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x114
ret 0x1c
Function at 0x406e1c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
push dword [0x41c270]
call fcn.0040f1f8
mov esi, eax
test esi, esi
je 0x406ef6
cmp dword [ebp + 0xc], 0
je 0x406e68
push 4
push dword [esi]
call dword [sym.imp.USER32.DLL_GetWindow]
test eax, eax
je 0x406e59
cmp dword [esi + 0x1c], 0
jne 0x406e59
push eax
call dword [sym.imp.USER32.DLL_SetActiveWindow]
push 0
push dword [esi]
call dword [sym.imp.USER32.DLL_ShowWindow]
jmp 0x406ef6
test byte [ebp + 0x10], 3
je 0x406e83
push 4
push dword [esi]
call dword [sym.imp.USER32.DLL_GetWindow]
push eax
push dword [ebp + 0x10]
push dword [esi]
call fcn.004073e4
cmp dword [esi + 0x3c], 0xffffffff
push ebx
je 0x406ea8
xor ebx, ebx
cmp dword [esi + 0x3c], 0x1000000
sete bl
xor ecx, ecx
cmp dword [esi + 0x3c], 0x20000000
sete cl
or dword [esi + 0x3c], 0xffffffff
jmp 0x406ebc
push dword [esi]
call dword [sym.imp.USER32.DLL_IsZoomed]
push dword [esi]
mov ebx, eax
call dword [sym.imp.USER32.DLL_IsIconic]
mov ecx, eax
test dword [ebp + 0x10], 0x2000000
je 0x406ed9
test ebx, ebx
je 0x406ecd
push 8
jmp 0x406edf
neg ecx
sbb ecx, ecx
and ecx, 3
add ecx, 4
jmp 0x406eec
test ebx, ebx
je 0x406ee2
push 3
pop ecx
jmp 0x406eec
xor eax, eax
test ecx, ecx
setne al
lea ecx, [eax + 1]
push ecx
push dword [esi]
call dword [sym.imp.USER32.DLL_ShowWindow]
pop ebx
pop esi
pop ebp
ret 0xc

Function at 0x407577
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
call dword [sym.imp.USER32.DLL_GetFocus]
mov esi, dword [sym.imp.USER32.DLL_GetKeyState]
mov ebx, eax
test ebx, ebx
je 0x40760a
push 9
call esi
test al, al
jns 0x40760a
push 0x11
call esi
test al, al
js 0x40760a
push 0x10
call esi
test al, al
js 0x40760a
push 0x12
call esi
test al, al
js 0x40760a
push 0x10
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.USER32.DLL_GetClassNameW]
push 5
lea eax, [ebp - 0x24]
push str.RichE
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
je 0x4075ec
push 4
lea eax, [ebp - 0x24]
push str.RICHE
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
jne 0x40760a
push 0
push 0
push 0x44e
push ebx
call dword [sym.imp.USER32.DLL_SendMessageW]
test eax, 0x800
jne 0x40760a
xor eax, eax
jmp 0x40768b
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x407632
push 0x11
call esi
test al, al
js 0x40762a
push 0x10
call esi
test al, al
js 0x40762a
push 0x12
call esi
test al, al
jns 0x407632
push 1
push edi
call fcn.00407693
mov esi, dword [sym.imp.USER32.DLL_GetPropW]
test ebx, ebx
je 0x407648
push str.PB_Hotkey
push ebx
call esi
test eax, eax
jne 0x407688
push str.PB_WindowID
push edi
call esi
mov esi, eax
test esi, esi
je 0x407688
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.USER32.DLL_GetWindowThreadProcessId]
test eax, eax
je 0x407688
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 4], eax
jne 0x407688
lea eax, [esi - 1]
push eax
push dword [0x41c270]
call fcn.0040f1f8
test eax, eax
je 0x407688
mov eax, dword [eax + 8]
jmp 0x40768a
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x408280
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [esi + 0x14], 0
jne 0x4082bc
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 4
xor eax, eax
pop esi
pop ecx
ret 4

Function at 0x4085b0
Capabilities:
Write file on windows

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
mov dword [esp], 0
test edx, edx
je 0x4086b8
cmp word [edx], 0
je 0x4086b8
mov ecx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
test ecx, ecx
jne 0x4085de
mov ecx, dword [esi + 0x18]
push edi
cmp ecx, 0x19
jne 0x40863d
cmp dword [esi + 4], 0
mov ecx, edx
lea edi, [ecx + 2]
je 0x408610
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4085f0
sub ecx, edi
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push edx
push esi
call fcn.004086f0
pop edi
pop esi
pop ecx
ret 0xc
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x408610
sub ecx, edi
lea eax, [esp + 8]
push 0
sar ecx, 1
push eax
lea eax, [ecx + ecx]
push eax
push edx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
xor eax, eax
cmp ecx, 2
lea ecx, [esp + 0x14]
setne al
push ecx
dec eax
and eax, 0xfde9
push edx
push eax
call fcn.00408800
mov edi, eax
test edi, edi
je 0x408633
cmp dword [esi + 4], 0
je 0x40868b
push dword [esp + 0x14]
push edi
push esi
call fcn.004086f0
push edi
push 0
push dword [0x41bef8]
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
push 0
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x1c]
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
push 0
push dword [0x41bef8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
xor eax, eax
pop ecx
ret 0xc
Function at 0x4086f0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
mov dword [esp + 4], 0
cmp dword [esi + 0x1c], 0
jne 0x4087f7
cmp dword [esi + 0x14], 1
jne 0x40873b
mov eax, dword [esi + 0xc]
lea ecx, [esp + 0xc]
push 1
neg eax
cdq
push ecx
push eax
push dword [esi]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esi + 8]
mov dword [esi + 0x14], 0
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
push edi
mov edi, dword [esp + 0x20]
cmp eax, edi
jle 0x4087b8
mov ecx, dword [esi + 8]
add ecx, dword [esi + 4]
sub ecx, eax
mov eax, edi
dec eax
je 0x4087a3
dec eax
je 0x40878c
sub eax, 2
je 0x408777
push edi
push dword [esp + 0x20]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov ax, word [eax]
mov word [ecx], ax
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov al, byte [eax]
mov byte [ecx], al
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
push esi
call fcn.00408280
mov eax, dword [esi + 8]
cmp edi, eax
jl 0x4087e5
push 0
lea eax, [esp + 0xc]
push eax
push edi
push dword [esp + 0x28]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
add esp, 0xc
ret 0xc
mov ecx, dword [esi + 4]
sub ecx, dword [esi + 0xc]
push edi
push dword [esp + 0x20]
add ecx, eax
jmp 0x408761
xor eax, eax
pop esi
add esp, 0xc
ret 0xc

Function at 0x409496
Capabilities:
Set thread local storage value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
xor ebx, ebx
push edi
mov edi, ebx
test esi, esi
je 0x4094f3
push esi
call dword [esi + 0x58]
mov ecx, dword [esi + 0x80]
mov edi, eax
mov dword [esi + 0x94], ecx
mov ecx, dword [esi + 0x84]
mov dword [esi + 0x98], ecx
test edi, edi
jne 0x4094f3
mov eax, dword [esi + 0x70]
test eax, eax
je 0x4094d2
push ebx
push esi
call eax
push esi
push ebx
push dword [0x41bef8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push ebx
push dword [0x41c2b4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [0x41c2b8], ebx
mov eax, edi
pop edi
pop esi
pop ebx
ret 4
Function at 0x40ab1e
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push str.msimg32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x41c10c], eax
test eax, eax
je 0x40ab4c
push str.AlphaBlend
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x41c108], eax
lea eax, [ebp - 0x114]
mov dword [0x41c110], 1
push eax
mov dword [ebp - 0x114], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40abae
cmp dword [ebp - 0x104], 1
jne 0x40ab83
and dword [0x41c110], 0
jmp 0x40abc6
cmp dword [ebp - 0x104], 2
jne 0x40abae
cmp dword [ebp - 0x110], 5
jb 0x40ab7a
jne 0x40abae
mov eax, dword [ebp - 0x10c]
neg eax
sbb eax, eax
and eax, dword [0x41c110]
mov dword [0x41c110], eax
jmp 0x40abb3
mov eax, dword [0x41c110]
test eax, eax
je 0x40abc6
call fcn.0040a561
neg eax
sbb eax, eax
and dword [0x41c110], eax
mov esp, ebp
pop ebp
ret

Function at 0x40bc30
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x40bc62
push 0
lea ecx, [esp + 0x10]
push ecx
push esi
push dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40bc5d
cmp dword [esp + 0xc], esi
je 0x40bc79
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [edi + 4]
add eax, dword [edi + 8]
push esi
push dword [esp + 0x14]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add dword [edi + 8], esi
pop edi
mov eax, 1
pop esi
ret

Function at 0x410839
Capabilities:
Set thread local storage value

Disassembly:
push esi
push 0x184
push 8
push dword [0x41bef8]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
push esi
push dword [0x41c2b4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push dword [esp + 8]
mov dword [0x41c2b8], esi
and dword [esi + 0xa8], 0
or dword [esi + 0xac], 0xffffffff
or dword [esi + 0xb0], 0xffffffff
push esi
mov dword [esi + 0xa4], 0xffffff
mov dword [esi + 0x74], 2
mov dword [esi + 0x78], 0x3f
call fcn.00413435
mov dword [esi + 0x58], 0x41144c
mov eax, esi
mov dword [esi + 0x5c], 0x411498
mov dword [esi + 0x10], fcn.00410fed
mov dword [esi + 0x30], 0x410edf
mov dword [esi + 0x64], 0x411522
mov dword [esi + 0x60], 0x4114da
mov dword [esi + 0x34], 0x410b8f
mov dword [esi + 0x24], 0x410b66
mov dword [esi + 0x28], 0x410b3b
mov dword [esi + 0x2c], 0x410a8d
mov dword [esi + 0x44], 0x411252
pop esi
ret 4
Function at 0x4166c9
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
mov edx, dword [esp + 0x2c]
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [esi + 0xd4]
mov dword [esp + 4], eax
test edx, edx
je 0x41677f
imul eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
imul ecx, dword [esp + 0x28]
push ebx
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x1c]
neg eax
add ecx, dword [esp + 0x18]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x28]
push ebp
push edi
lea edi, [ecx + eax*4]
mov eax, dword [esp + 0x28]
mov ecx, dword [esi + 0xcc]
mov ebp, edi
imul ecx, ebx
add ecx, dword [esi + 0xc8]
add ecx, eax
cmp dword [esp + 0x38], 0
jle 0x41675f
mov edx, dword [esp + 0x38]
mov esi, dword [esp + 0x10]
mov al, byte [ebp + 2]
xor byte [ecx + 2], al
mov al, byte [ebp + 1]
xor byte [ecx + 1], al
mov al, byte [ebp]
lea ebp, [ebp + 4]
xor byte [ecx], al
add ecx, esi
dec edx
jne 0x41673a
mov edx, dword [esp + 0x3c]
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
dec edx
inc ebx
cmp dword [esi + 0xe8], 0
mov dword [esp + 0x3c], edx
jne 0x416774
add edi, dword [esp + 0x14]
jmp 0x416778
add edi, dword [esp + 0x24]
test edx, edx
jne 0x416718
pop edi
pop ebp
pop ebx
pop esi
pop ecx
pop ecx
ret 0x24

Function at 0x416a8a
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
push ecx
imul edx, dword [esp + 0x28], 3
push ebx
mov ebx, dword [esp + 0x30]
mov dword [esp + 8], edx
test ebx, ebx
je 0x416b64
imul eax, dword [esp + 0x1c], 3
mov ecx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x24]
neg ecx
push esi
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x20]
imul eax, dword [esp + 0x30]
push edi
imul edi, dword [esp + 0x30], 3
mov dword [esp + 0x10], ecx
add eax, dword [esp + 0x20]
add edi, eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x38], edi
mov esi, dword [eax + 0xcc]
imul esi, ebp
mov dword [esp + 0x34], edi
add esi, dword [eax + 0xc8]
add esi, dword [esp + 0x28]
test edx, edx
jle 0x416b3a
mov ebp, dword [esp + 0x34]
mov ebx, 0xff
sub ebx, dword [esp + 0x40]
mov edi, edx
movzx eax, byte [esi]
movzx ecx, byte [ebp]
imul ecx, dword [esp + 0x40]
imul eax, ebx
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
inc ebp
mov byte [esi], al
inc esi
dec edi
jne 0x416b02
mov edi, dword [esp + 0x38]
mov ebx, dword [esp + 0x3c]
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
dec ebx
inc ebp
cmp dword [eax + 0xe8], 0
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x2c], ebp
jne 0x416b51
add edi, ecx
jmp 0x416b55
add edi, dword [esp + 0x24]
mov dword [esp + 0x38], edi
test ebx, ebx
jne 0x416ad8
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 0x28
Function at 0x417184
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
push esi
mov esi, dword [esp + 0x30]
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi + 0xd4]
mov dword [esp + 8], eax
test esi, esi
je 0x417239
imul eax, dword [esp + 0x20]
imul edx, dword [esp + 0x28], 3
push ebx
mov ebx, dword [esp + 0x28]
push ebp
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x24]
neg eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
imul eax, dword [esp + 0x34]
add eax, dword [esp + 0x20]
add edx, eax
mov eax, dword [esp + 0x28]
mov ecx, dword [edi + 0xcc]
mov ebp, edx
imul ecx, ebx
add ecx, dword [edi + 0xc8]
add ecx, eax
cmp dword [esp + 0x38], 0
jle 0x41721a
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x10]
mov al, byte [ebp + 2]
xor byte [ecx + 2], al
mov al, byte [ebp + 1]
xor byte [ecx + 1], al
mov al, byte [ebp]
lea ebp, [ebp + 3]
xor byte [ecx], al
add ecx, edi
dec esi
jne 0x4171f5
mov esi, dword [esp + 0x3c]
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
dec esi
inc ebx
cmp dword [edi + 0xe8], 0
mov dword [esp + 0x3c], esi
jne 0x41722f
add edx, dword [esp + 0x14]
jmp 0x417233
add edx, dword [esp + 0x24]
test esi, esi
jne 0x4171d3
pop ebp
pop ebx
pop edi
pop esi
pop ecx
pop ecx
ret 0x24
Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43300c
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219