joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4188df
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x481b90]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41891f
cmp byte [ebx], 0xa
jne 0x41891f
or byte [eax + edi + 0x28], 4
jmp 0x418924
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x418a22
mov al, byte [edx]
cmp al, 0x1a
je 0x418a04
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x418953
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x418978
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x418982
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x418935
jmp 0x418a22
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4189ff
cmp dword [ebp - 0xc], 0
je 0x4189ff
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x481b90]
test byte [eax + edi + 0x28], 0x48
je 0x4189d9
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x4189c4
mov byte [esi], dl
jmp 0x4189d5
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x481b90]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x418a22
cmp byte [ebp - 1], 0xa
jne 0x4189e8
cmp esi, ebx
jne 0x4189e8
mov byte [esi], 0xa
jmp 0x418a21
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0041945f
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x418a22
mov byte [esi], 0xd
jmp 0x418a21
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x481b90]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x418a1e
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x418a22
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x418a2b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x481b90]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x418a6e
cmp word [esi], dx
jne 0x418a6e
or byte [edi + eax + 0x28], 4
jmp 0x418a73
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x418bc6
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x418ba6
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x418ab5
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x418aeb
cmp eax, edx
jae 0x418af7
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x418a8d
jmp 0x418bc6
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x418ba2
cmp dword [ebp - 0x14], 0
je 0x418ba2
mov eax, dword [ebx*4 + 0x481b90]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x418b7a
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x418b43
mov word [esi], cx
jmp 0x418b76
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x481b90]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x481b90]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x481b90]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x418bc6
pop ebx
cmp word [ebp - 4], bx
jne 0x418b8b
cmp esi, dword [ebp + 0xc]
jne 0x418b8b
mov word [esi], bx
jmp 0x418bc3
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0041945f
add esp, 0x10
cmp word [ebp - 4], bx
je 0x418bc6
push 0xd
jmp 0x418bbf
mov ecx, dword [ebx*4 + 0x481b90]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x418bbd
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x418bc6
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x41ad45
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x41ade2
push ebx
push esi
call fcn.0041ad0e
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0041997a
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x41ad8f
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41ade1
push edi
push eax
call fcn.004152da
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x41adaf
call fcn.00414896
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41ade0
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0041997a
add esp, 0x20
test eax, eax
jne 0x41adce
push edi
call fcn.00414896
jmp 0x41add6
push ebx
call fcn.00414896
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x4216d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4216fd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4216fd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
mov ecx, 0x56be60e7
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
mov ecx, 0x39ee56e2
nop
nop
nop
nop
test eax, eax
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x4020e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
lea eax, [ebp - 0x210]
push eax
push 0x20019
push 0
mov ecx, dword [ebp + 8]
push ecx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
je 0x40211c
xor eax, eax
jmp 0x4021ff
mov dword [ebp - 0x214], 0x200
lea edx, [ebp - 0x214]
push edx
lea eax, [ebp - 0x208]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push 0
mov edx, dword [ebp - 0x210]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x20c], eax
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x20c], 0
je 0x40216c
xor eax, eax
jmp 0x4021ff
push str.ScriptEngine
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [ebp - 0x210]
push edx
push 0x20019
push 0
lea eax, [ebp - 0x208]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
je 0x4021b1
xor eax, eax
jmp 0x4021ff
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x214], ecx
lea edx, [ebp - 0x214]
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push 0
mov edx, dword [ebp - 0x210]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x20c], eax
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x20c], 0
jne 0x4021fd
mov eax, 1
jmp 0x4021ff
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x403800
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx]
cmp edx, 0x22
jne 0x40386d
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx]
test edx, edx
je 0x403854
mov eax, dword [ebp - 4]
movsx ecx, byte [eax]
cmp ecx, 0x22
jne 0x403849
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 8], edx
jmp 0x403854
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
jmp 0x403829
mov ecx, dword [ebp - 8]
movsx edx, byte [ecx]
cmp edx, 0x20
jne 0x403868
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x403898
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx]
test edx, edx
je 0x403895
mov eax, dword [ebp - 4]
movsx ecx, byte [eax]
cmp ecx, 0x20
jne 0x40388a
mov eax, dword [ebp - 4]
add eax, 1
jmp 0x403898
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
jmp 0x40386d
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x43b650
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x43b3c1
add ecx, 0x386f6b93
add esi, 0xa563acb5
and esi, ecx
call fcn.0043b694
sub ecx, 1
xor dword [edi], edx
sub esp, 4
mov dword [esp], esi
pop ecx
add ecx, 0x786e418b
inc edi
dec ecx
add esi, 0x804ceada
cmp edi, eax
jne fcn.0043b650
mov esi, ecx
ret

Function at 0x438ca1
Capabilities:
Encode data using xor

Disassembly:
push 0x438a14
pop eax
mov ebx, 0xc0ac18b
and ebx, ebx
call fcn.00438cd8
add ebx, edi
mov ebx, edi
xor dword [ecx], eax
mov edi, edi
or ebx, ebx
dec ebx
add ecx, 1
add edi, ebx
and ebx, ebx
cmp ecx, edx
jne fcn.00438ca1
mov ebx, 0x908c0bee
ret
Function at 0x403670
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x444380]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov eax, dword [0x462938]
and eax, 4
jne 0x403694
xor eax, eax
jmp 0x4038d4
mov dword [ebp - 4], 1
movzx ecx, byte [0x443008]
test ecx, ecx
je 0x40388e
mov edx, dword [0x46f008]
push edx
push 0x400
push 0x445938
push 0x43b687
push str.value_init
push 0x43b75c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x445938
call fcn.00403d40
add esp, 4
mov eax, dword [0x46f008]
push eax
push 0x64
push 0x4458d0
push 0x43b693
push str.value_end
push 0x43b770
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [0x46f008]
push ecx
push 0x1e
push 0x4458ac
push 0x43b69f
push str.value_cancel
push 0x43b788
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov edx, dword [0x46f008]
push edx
push 0x64
push 0x445848
push 0x43b790
push 0x43b794
push 0x43b79c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x445848
call fcn.00415491
add esp, 4
mov dword [0x46f010], eax
cmp dword [0x46f010], 0
je 0x403887
xor ecx, ecx
mov eax, dword [0x46f010]
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00414364
add esp, 4
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp - 0x41c]
mov dword [0x46f00c], eax
mov dword [ebp - 8], 0
jmp 0x4037a5
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp edx, dword [0x46f010]
jge 0x4037c2
mov eax, dword [ebp - 8]
mov ecx, dword [0x46f00c]
mov dword [ecx + eax*4], 0
jmp 0x40379c
mov dword [ebp - 8], 0
jmp 0x4037d4
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp eax, dword [0x46f010]
jge 0x403887
mov ecx, dword [ebp - 8]
push ecx
push 0x43b7a4
push 0xa
lea edx, [ebp - 0x18]
push edx
call fcn.00414a51
add esp, 0x10
mov eax, dword [0x46f008]
push eax
push 0x400
lea ecx, [ebp - 0x418]
push ecx
push 0x43b6ed
lea edx, [ebp - 0x18]
push edx
push str.TEXTS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x418]
push eax
call fcn.00414830
add esp, 4
add eax, 1
push eax
call fcn.00414364
add esp, 4
mov dword [ebp - 0x420], eax
mov ecx, dword [ebp - 8]
mov edx, dword [0x46f00c]
mov eax, dword [ebp - 0x420]
mov dword [edx + ecx*4], eax
lea ecx, [ebp - 0x418]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [0x46f00c]
mov ecx, dword [eax + edx*4]
push ecx
call fcn.00414b50
add esp, 8
mov edx, dword [ebp - 8]
mov eax, dword [0x46f00c]
mov ecx, dword [eax + edx*4]
push ecx
call fcn.00403d40
add esp, 4
jmp 0x4037cb
mov byte [0x443008], 0
xor edx, edx
jne 0x403694
cmp dword [ebp + 0xc], 0
je 0x4038a3
mov eax, 0x4458ac
jmp 0x4038d4
cmp dword [ebp + 8], 0x6f
jne 0x4038b0
mov eax, 0x4458d0
jmp 0x4038d4
cmp dword [ebp + 8], 0
jl 0x4038cf
mov eax, dword [ebp + 8]
cmp eax, dword [0x46f010]
jge 0x4038cf
mov ecx, dword [ebp + 8]
mov edx, dword [0x46f00c]
mov eax, dword [edx + ecx*4]
jmp 0x4038d4
mov eax, 0x445938
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004148bb
mov esp, ebp
pop ebp
ret
Function at 0x404bb0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 1
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
jne 0x404be9
mov dword [ebp - 8], 6
jmp 0x404c82
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
and ecx, 0xffff
movzx edx, cx
and edx, 0xff
movzx eax, dl
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
and ecx, 0xffff
movzx edx, cx
shr edx, 8
movzx eax, dl
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 0
je 0x404c33
cmp dword [ebp - 0x18], 1
je 0x404c63
jmp 0x404c7a
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], 3
jb 0x404c61
cmp dword [ebp - 0x1c], 4
jbe 0x404c4d
cmp dword [ebp - 0x1c], 5
je 0x404c58
jmp 0x404c61
mov eax, dword [ebp + 0xc]
mov dword [eax], 0x43b9fc
jmp 0x404c61
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0x43ba08
jmp 0x404c7a
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], 4
je 0x404c71
jmp 0x404c7a
mov eax, dword [ebp + 0xc]
mov dword [eax], 0x43ba14
xor ecx, ecx
jne 0x404bce
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 8
Function at 0x404c90
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb0
mov eax, dword [0x444380]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0xac], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 1
push 0x94
push 0
lea eax, [ebp - 0xa8]
push eax
call fcn.00415190
add esp, 0xc
mov dword [ebp - 0xa8], 0x94
lea ecx, [ebp - 0xa8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x404d14
mov dword [ebp - 0xa8], 0x94
lea edx, [ebp - 0xa8]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x404d14
mov dword [ebp - 4], 2
jmp 0x404e2f
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0
je 0x404e1e
cmp dword [ebp - 0xb0], 1
je 0x404dc7
cmp dword [ebp - 0xb0], 2
je 0x404d48
jmp 0x404e27
cmp dword [ebp - 0xa4], 4
ja 0x404d5c
mov ecx, dword [ebp + 8]
mov dword [ecx], 0x43ba24
jmp 0x404dc5
cmp dword [ebp - 0xa4], 5
jne 0x404d79
cmp dword [ebp - 0xa0], 0
jne 0x404d79
mov edx, dword [ebp + 8]
mov dword [edx], 0x43ba30
jmp 0x404dc5
cmp dword [ebp - 0xa4], 5
jne 0x404d96
cmp dword [ebp - 0xa0], 1
jne 0x404d96
mov eax, dword [ebp + 8]
mov dword [eax], 0x43ba3c
jmp 0x404dc5
cmp dword [ebp - 0xa4], 5
jne 0x404db3
cmp dword [ebp - 0xa0], 2
jne 0x404db3
mov ecx, dword [ebp + 8]
mov dword [ecx], str.WindowsXP
jmp 0x404dc5
cmp dword [ebp - 0xa4], 6
jne 0x404dc5
mov edx, dword [ebp + 8]
mov dword [edx], str.WindowsVista
jmp 0x404e27
cmp dword [ebp - 0xa4], 4
jne 0x404de4
cmp dword [ebp - 0xa0], 0
jne 0x404de4
mov eax, dword [ebp + 8]
mov dword [eax], 0x43ba64
jmp 0x404e1c
cmp dword [ebp - 0xa4], 4
jne 0x404e01
cmp dword [ebp - 0xa0], 0xa
jne 0x404e01
mov ecx, dword [ebp + 8]
mov dword [ecx], 0x43ba70
jmp 0x404e1c
cmp dword [ebp - 0xa4], 4
jne 0x404e1c
cmp dword [ebp - 0xa0], 0x5a
jne 0x404e1c
mov edx, dword [ebp + 8]
mov dword [edx], 0x43ba7c
jmp 0x404e27
mov eax, dword [ebp + 8]
mov dword [eax], 0x43ba88
xor ecx, ecx
jne 0x404cb0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004148bb
mov esp, ebp
pop ebp
ret 4

Function at 0x4056d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x444380]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x410], ecx
mov dword [ebp - 4], 2
push 0x46c8e8
call fcn.00414830
add esp, 4
test eax, eax
je 0x405793
mov dword [ebp - 4], 1
mov byte [ebp - 0x408], 0
push 0x3ff
push 0
lea eax, [ebp - 0x407]
push eax
call fcn.00415190
add esp, 0xc
mov ecx, dword [0x459f14]
push ecx
push 0x46f3b8
push str.999999999999999
push 0x46c8e8
push str._s_Serial_sCid_sBrandId_dplatformCLIENTEvent3
push 0x400
lea edx, [ebp - 0x408]
push edx
call fcn.00414a51
add esp, 0x1c
push 0
push 0
lea eax, [ebp - 0x408]
push eax
push str.iexplore
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], 0x20
jg 0x40578b
mov dword [ebp - 4], 2
xor ecx, ecx
jne 0x405705
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004148bb
mov esp, ebp
pop ebp
ret
Function at 0x406770
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push 0x44
push 0
lea eax, [ebp - 0x60]
push eax
call fcn.00415190
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.0040daf0
add esp, 8
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x60]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
mov edx, dword [ebp - 0x18]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 4], eax
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x4067cd
mov ecx, dword [ebp - 0x14]
mov dword [0x46e408], ecx
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x64], edx
mov eax, dword [ebp - 0x64]
push eax
call fcn.004149b2
add esp, 4
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4081a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x46ec34], eax
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x46ec38], eax
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x4084f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x46ec3c], eax
xor ecx, ecx
jne 0x4081ad
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x408740
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx]
shl eax, 0x10
mov ecx, dword [ebp + 8]
xor eax, dword [ecx]
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
and ecx, 0xbfffffff
mov edx, dword [ebp + 8]
mov dword [edx], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
and ecx, 0x7fffffff
mov edx, dword [ebp + 8]
mov dword [edx], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov dword [eax], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call fcn.00403d00
add esp, 4
xor edx, edx
jne 0x408744
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x40a410
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 1
push str.999999999999999
call fcn.00405d00
add esp, 4
add eax, 0x32
mov dword [ebp - 0x50], eax
mov eax, dword [0x45a564]
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0x64
ja case.0x40a45d.3
mov ecx, dword [ebp - 0x60]
movzx edx, byte [ecx + 0x40a600]
jmp dword [edx*4 + 0x40a5f0]
mov eax, 1
jmp 0x40a5eb
mov dword [0x45a564], 0
mov dword [ebp - 0xc], 0x46d0e8
mov eax, dword [ebp - 0xc]
push eax
call fcn.00414830
add esp, 4
test eax, eax
je 0x40a4f0
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00405d00
add esp, 4
add eax, dword [ebp - 0x50]
mov dword [ebp - 0x50], eax
mov edx, dword [ebp - 0x50]
push edx
call fcn.00414364
add esp, 4
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40a4c8
mov dword [ebp - 4], 2
jmp 0x40a56e
push str.666666666666666
push 0x445e74
push str.999999999999999
mov ecx, dword [ebp - 0xc]
push ecx
push str._ssr_slang_ss_s
mov edx, dword [ebp - 0x50]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.00414a51
add esp, 0x1c
jmp 0x40a56e
mov dword [ebp - 0xc], 0x46c850
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00414830
add esp, 4
test eax, eax
je 0x40a56e
mov edx, dword [ebp - 0xc]
push edx
call fcn.00405d00
add esp, 4
add eax, dword [ebp - 0x50]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
push eax
call fcn.00414364
add esp, 4
mov dword [ebp - 0x58], eax
mov ecx, dword [ebp - 0x58]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
jne 0x40a53f
mov dword [ebp - 4], 2
jmp 0x40a56e
push str.666666666666666
push 0x445e74
push str.999999999999999
mov edx, dword [0x45a564]
push edx
mov eax, dword [ebp - 0xc]
push eax
push str._smode_dsr_slang_ss_s
mov ecx, dword [ebp - 0x50]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.00414a51
add esp, 0x20
mov eax, dword [ebp - 0xc]
push eax
call fcn.00414830
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x40a585
jmp 0x40a5c9
push 0x3c
push 0
lea ecx, [ebp - 0x4c]
push ecx
call fcn.00415190
add esp, 0xc
mov dword [ebp - 0x4c], 0x3c
mov dword [ebp - 0x48], 0x100
mov dword [ebp - 0x44], 0
mov edx, dword [ebp - 8]
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x30], 1
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
xor ecx, ecx
jne 0x40a42b
cmp dword [ebp - 8], 0
je 0x40a5e8
mov edx, dword [ebp - 8]
mov dword [ebp - 0x5c], edx
mov eax, dword [ebp - 0x5c]
push eax
call fcn.004149b2
add esp, 4
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret