joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4145b0
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
mov edx, dword [esp + 4]
push ebp
push esi
xor eax, eax
xor ecx, ecx
xor esi, esi
mov ebp, edx
cmp byte [edx], al
je 0x41464c
push ebx
push edi
mov edi, dword [esp + 0x18]
lea esp, [esp]
movsx edx, byte [ebp]
mov edx, dword [edx*4 + 0x53a250]
cmp edx, 0xffffffff
je 0x414643
cmp esi, 3
ja case.default.0x4145e5
jmp dword [esi*4 + 0x414650]
mov esi, 1
jmp case.default.0x4145e5
cmp eax, dword [esp + 0x1c]
jge 0x41460b
mov ebx, edx
sar ebx, 4
add cl, cl
and bl, 3
add cl, cl
or bl, cl
mov byte [eax + edi], bl
inc eax
mov esi, 2
jmp case.default.0x4145e5
cmp eax, dword [esp + 0x1c]
jge 0x414629
mov ebx, edx
sar ebx, 2
and bl, 0xf
shl cl, 4
or bl, cl
mov byte [eax + edi], bl
inc eax
mov esi, 3
jmp case.default.0x4145e5
cmp eax, dword [esp + 0x1c]
jge 0x41463f
shl cl, 6
or cl, dl
mov byte [eax + edi], cl
inc eax
xor esi, esi
mov ecx, edx
inc ebp
cmp byte [ebp], 0
jne 0x4145d0
pop edi
pop ebx
pop esi
pop ebp
ret

Function at 0x414660
Capabilities:
Encode data using base64

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x14]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x20]
lea eax, [edi + ecx - 1]
mov dword [esp + 0x20], eax
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
lea edx, [eax + eax*2]
sub ecx, edx
neg ecx
sbb ecx, ecx
and ecx, 4
lea eax, [ecx + eax*4 + 1]
push eax
mov byte [esp + 0x14], 0
mov byte [esp + 0x15], 0
mov byte [esp + 0x16], 0
mov dword [esp + 0x1c], eax
call fcn.004cd70c
mov ebp, dword [esp + 0x2c]
xor ebx, ebx
add esp, 4
xor esi, esi
mov dword [ebp], eax
mov dword [esp + 0x24], ebx
mov ecx, edi
mov dword [esp + 0x28], edi
cmp edi, dword [esp + 0x20]
ja 0x4147ab
mov eax, 0x55555556
imul ebx
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dl, byte [ecx]
lea eax, [eax + eax*2]
mov edi, ebx
sub edi, eax
mov byte [esp + edi + 0x10], dl
cmp edi, 2
je 0x4146fa
cmp ecx, dword [esp + 0x20]
jne 0x414797
mov al, byte [esp + 0x10]
mov cl, byte [esp + 0x11]
mov dl, al
and al, 3
shl al, 4
mov bl, cl
shr bl, 4
or al, bl
mov bl, byte [esp + 0x12]
mov byte [esp + 0x15], al
and cl, 0xf
shr dl, 2
add cl, cl
mov al, bl
shr al, 6
movzx edx, dl
mov dl, byte [edx + 0x4f64b8]
add cl, cl
or cl, al
mov eax, dword [ebp]
mov byte [esi + eax], dl
movzx eax, byte [esp + 0x15]
movzx eax, byte [eax + 0x4f64b8]
mov edx, dword [ebp]
inc esi
mov byte [esi + edx], al
and bl, 0x3f
inc esi
test edi, edi
jne 0x414757
mov al, 0x3d
jmp 0x414760
movzx ecx, cl
mov al, byte [ecx + 0x4f64b8]
mov edx, dword [ebp]
mov byte [esi + edx], al
inc esi
cmp edi, 2
jge 0x414770
mov al, 0x3d
jmp 0x414779
movzx eax, bl
mov al, byte [eax + 0x4f64b8]
mov ecx, dword [ebp]
mov ebx, dword [esp + 0x24]
mov byte [esi + ecx], al
mov ecx, dword [esp + 0x28]
inc esi
mov byte [esp + 0x12], 0
mov byte [esp + 0x11], 0
mov byte [esp + 0x10], 0
inc ecx
inc ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ecx
cmp ecx, dword [esp + 0x20]
jbe 0x4146d0
mov edx, dword [ebp]
mov eax, dword [esp + 0x18]
pop edi
mov byte [esi + edx], 0
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x4150f0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push eax
push ebx
rdtsc
mov dword [ebp - 0xc], eax
mov ebx, eax
rdtsc
mov dword [ebp - 0x10], eax
sub eax, ebx
mov dword [ebp - 8], eax
pop eax
pop ebx
cmp dword [ebp - 8], 0x200
jae 0x415160
mov byte [ebp - 1], 0
pushal
pushfd
pop eax
or eax, 0x200000
push eax
popfd
pushfd
pop eax
and eax, 0x200000
je 0x41514d
xor eax, eax
xor edx, edx
xor ecx, ecx
xor ebx, ebx
inc eax
cpuid
test ecx, 0x80000000
jne 0x415147
mov byte [ebp - 1], 0
jmp 0x415151
mov byte [ebp - 1], 1
jmp 0x415151
mov byte [ebp - 1], 2
popal
cmp byte [ebp - 1], 1
sete al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x417d60
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x4f0a8b
mov eax, dword fs:[0]
push eax
sub esp, 0x1c0
mov eax, dword [0x542c54]
xor eax, esp
mov dword [esp + 0x1bc], eax
push edi
mov eax, dword [0x542c54]
xor eax, esp
push eax
lea eax, [esp + 0x1c8]
mov dword fs:[0], eax
push 0x104
lea eax, [esp + 0xc4]
push eax
push 0
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0xc0]
push ecx
call fcn.004cc253
lea edx, [esp + 0xc4]
dec edx
add eax, edx
lea ecx, [esp + 0xc4]
add esp, 4
cmp eax, ecx
jbe 0x417df2
mov cl, byte [eax]
cmp cl, 0x5c
je 0x417dee
cmp cl, 0x2f
je 0x417dee
dec eax
lea edx, [esp + 0xc0]
cmp eax, edx
ja 0x417dd4
jmp 0x417df2
inc eax
mov byte [eax], 0
push 0x9c
lea eax, [esp + 0x28]
push 0
push eax
call fcn.004cb5a0
add esp, 0xc
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x28], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x28], 5
jne 0x417e3b
cmp dword [esp + 0x2c], 1
jne 0x417e3b
push str.ktbsol1.pem
push 0x104
lea edx, [esp + 0xc8]
push edx
jmp 0x417e4d
push str.ktbsol2.pem
push 0x104
lea eax, [esp + 0xc8]
push eax
call fcn.004cc2ce
add esp, 0xc
mov dword [esp + 0x20], 0xf
mov dword [esp + 0x1c], 0
mov byte [esp + 0xc], 0
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0xc4]
push edx
mov ecx, edi
mov dword [esp + 0x1d8], 0
call fcn.004168a0
cmp dword [esp + 0x20], 0x10
mov eax, dword [esp + 0xc]
jae 0x417e98
lea eax, [esp + 0xc]
push 1
push eax
mov ecx, edi
call fcn.004162c0
cmp dword [esp + 0x20], 0x10
jb 0x417eb6
mov eax, dword [esp + 0xc]
push eax
call fcn.004bf5d1
add esp, 4
mov ecx, dword [esp + 0x1c8]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x1bc]
xor ecx, esp
call fcn.004cb553
add esp, 0x1cc
ret 8
Function at 0x418490
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14c
mov eax, dword [0x542c54]
xor eax, esp
mov dword [esp + 0x148], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0
push 2
mov dword [esp + 0x1c], esi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
jne 0x4184e0
push str.CreateToolhelp32Snapshot_error__n
call fcn.004cb644
add esp, 4
push 1
call fcn.004cedd4
lea ecx, [esp + 0x28]
push ecx
push eax
mov dword [esp + 0x30], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x418524
push str.Process32First_error____n
call fcn.004cb644
mov edx, dword [esp + 0x14]
add esp, 4
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
call fcn.004cedd4
jmp 0x418520
mov esi, dword [esp + 0x14]
mov ecx, dword [esi + 8]
lea eax, [esp + 0x4c]
push eax
push ecx
mov ecx, esi
call fcn.004c0c41
mov ecx, dword [edi + 0xc]
mov edx, dword [esp + 0x30]
mov dword [esp + 0xc], edx
test ecx, ecx
jne 0x418547
xor eax, eax
jmp 0x41854f
mov eax, dword [edi + 0x14]
sub eax, ecx
sar eax, 2
mov esi, dword [edi + 0x10]
mov edx, esi
sub edx, ecx
sar edx, 2
cmp edx, eax
jae 0x41856b
mov eax, dword [esp + 0x30]
mov dword [esi], eax
add esi, 4
mov dword [edi + 0x10], esi
jmp 0x418589
cmp ecx, esi
jbe 0x418574
call fcn.004cc9ff
mov eax, dword [edi]
lea ecx, [esp + 0xc]
push ecx
push esi
push eax
lea edx, [esp + 0x24]
push edx
mov ecx, edi
call fcn.00417ee0
mov ecx, dword [ebx + 0xc]
mov eax, dword [esp + 0x40]
mov dword [esp + 0xc], eax
test ecx, ecx
jne 0x41859c
xor eax, eax
jmp 0x4185a4
mov eax, dword [ebx + 0x14]
sub eax, ecx
sar eax, 2
mov esi, dword [ebx + 0x10]
mov edx, esi
sub edx, ecx
sar edx, 2
cmp edx, eax
jae 0x4185c0
mov eax, dword [esp + 0x40]
mov dword [esi], eax
add esi, 4
mov dword [ebx + 0x10], esi
jmp 0x4185de
cmp ecx, esi
jbe 0x4185c9
call fcn.004cc9ff
mov eax, dword [ebx]
lea ecx, [esp + 0xc]
push ecx
push esi
push eax
lea edx, [esp + 0x2c]
push edx
mov ecx, ebx
call fcn.00417ee0
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x28]
push eax
push ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x418520
mov ecx, dword [esp + 0x154]
mov eax, dword [esp + 0x28]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004cb553
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41f5f0
Capabilities:
Read file via mapping

Disassembly:
sub esp, 0x28
push ebx
push ebp
mov ebp, dword [esp + 0x38]
push esi
mov esi, dword [esp + 0x38]
push edi
xor eax, eax
lea ecx, [esp + 0x18]
push 0x4f862c
mov edx, ecx
mov dword [esi], eax
push edx
xor edi, edi
mov dword [esp + 0x28], 0x18
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], 0x40
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [ebp], eax
call dword [0x545474]
lea eax, [esp + 0x20]
push eax
push 4
push esi
call dword [0x545468]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea ecx, [esp + 0x10]
push ecx
push 0x28
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadSelectorEntry]
mov ebx, dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x41f6a5
mov ecx, dword [esp + 0x14]
movzx edx, word [esp + 0x12]
movzx eax, cl
shl eax, 0x10
and ecx, 0xff000000
add eax, ecx
add eax, edx
and eax, 0x7fffffff
push 0x1000
and eax, 0xfffff000
push eax
mov eax, dword [esi]
push edi
push 4
push eax
call ebx
test eax, eax
je 0x41f69e
mov edi, dword [eax + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test edi, 0xfff
je 0x41f6af
xor edi, edi
mov ecx, dword [esi]
push 0x1000
push edi
push 0
push 4
push ecx
call ebx
pop edi
pop esi
mov dword [ebp], eax
pop ebp
pop ebx
add esp, 0x28
ret

Function at 0x41f700
Capabilities:
Read file via mapping

Disassembly:
push ecx
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x20]
mov dword [esp + 0x24], eax
lea eax, [edi + ecx]
mov dword [esp + 0x20], 0
mov dword [esp + 0x10], eax
cmp edi, eax
jae 0x41f7ff
lea esp, [esp]
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov edx, edi
shr edx, 0x16
mov eax, dword [ecx + edx*4]
test al, 1
je 0x41f80a
test al, al
js 0x41f78c
mov edx, dword [esp + 0x18]
push 0x1000
and eax, 0xfffff000
push eax
mov eax, dword [edx]
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, edi
shr ecx, 0xc
and ecx, 0x3ff
mov ebx, dword [eax + ecx*4]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test bl, 1
je 0x41f80a
and ebx, 0xfffff000
jmp 0x41f79b
mov ebx, edi
and ebx, 0x3ff000
and eax, 0xfffff000
add ebx, eax
mov esi, dword [esp + 0x28]
sub esi, dword [esp + 0x20]
mov ebp, edi
and ebp, 0xfff
mov eax, 0x1000
sub eax, ebp
cmp esi, eax
jbe 0x41f7b8
mov esi, eax
mov edx, dword [esp + 0x18]
mov eax, dword [edx]
push 0x1000
push ebx
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
push esi
add ebp, ebx
push ebp
mov ebp, dword [esp + 0x2c]
push ebp
call fcn.004cee70
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
add dword [esp + 0x20], esi
add ebp, esi
add edi, esi
mov dword [esp + 0x24], ebp
cmp edi, dword [esp + 0x10]
jb 0x41f730
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x41fe10
Capabilities:
Check if file exists
Get disk information

Disassembly:
sub esp, 0x408
mov eax, dword [0x542c54]
xor eax, esp
mov dword [esp + 0x404], eax
push ebx
mov ebx, dword [esp + 0x420]
push ebp
mov ebp, dword [esp + 0x41c]
push esi
mov esi, dword [esp + 0x418]
push edi
push 0x200
lea eax, [esp + 0x18]
push eax
push esi
mov dword [esp + 0x1c], 0
mov dword [ebx], 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
jne 0x41feb4
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 2
jne 0x41feac
push str.Device_
lea ecx, [esp + 0x18]
push 0x200
push ecx
call fcn.004cc266
push esi
lea edx, [esp + 0x24]
push 0x200
push edx
call fcn.004cc2ce
add esp, 0x18
lea eax, [esp + 0x14]
push eax
push esi
push 1
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceA]
test eax, eax
jne 0x41ff45
call edi
test eax, eax
jne 0x41ff60
push str.._
lea ecx, [esp + 0x218]
push 0x200
push ecx
call fcn.004cc266
push esi
lea edx, [esp + 0x224]
push 0x200
push edx
call fcn.004cc2ce
add esp, 0x18
push 0xffffffffffffffff
push 0
push 3
push 0
push 1
push 0
lea eax, [esp + 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x41ff24
mov ecx, dword [esp + 0x428]
push 0
push ebx
push ecx
push ebp
push 4
lea edx, [esp + 0x434]
push edx
push 0x170002
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp dword [esp + 0x10], 0
je 0x41ff52
lea eax, [esp + 0x14]
push eax
push esi
push 7
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceA]
test eax, eax
jne 0x41ff52
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x41ff60
mov dword [esp + 0x10], 1
jmp 0x41feb4
cmp edi, 0xffffffff
je 0x41ff5e
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0x414]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004cb553
add esp, 0x408
ret 0x14
Function at 0x4214d0
Capabilities:
Check os version

Disassembly:
sub esp, 0xa4
mov eax, dword [0x542c54]
xor eax, esp
mov dword [esp + 0xa0], eax
push esi
mov esi, ecx
call fcn.00420c20
push 0x9c
lea eax, [esp + 0xc]
push 0
push eax
call fcn.004cb5a0
add esp, 0xc
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x42152f
xor al, al
pop esi
mov ecx, dword [esp + 0xa0]
xor ecx, esp
call fcn.004cb553
add esp, 0xa4
ret
cmp dword [esp + 0x18], 2
jne 0x421517
mov eax, dword [esp + 0xc]
cmp eax, 5
setae dl
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov byte [esi + 0x38], dl
mov dword [esp + 8], 0
cmp eax, 6
jb 0x4215a0
cmp dword [esp + 0x14], 1
jb 0x4215a0
push edi
push str.IsWow64Process
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x421595
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
test eax, eax
je 0x42159f
cmp dword [esp + 0xc], 0
je 0x42159f
push str.Kernel32.dll
call ebx
mov dword [esi + 0x1c], eax
pop edi
cmp dword [esi + 0x18], 0
jne 0x4215b0
push str.iphlpapi.dll
call ebx
mov dword [esi + 0x18], eax
mov ecx, esi
call fcn.004214c0
mov ecx, dword [esp + 0xa8]
test al, al
pop ebx
setne al
pop esi
xor ecx, esp
call fcn.004cb553
add esp, 0xa4
ret
Function at 0x424400
Capabilities:
Get routing table

Disassembly:
push 0xffffffffffffffff
push 0x4f24fb
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x542c54]
xor eax, esp
mov dword [esp + 0x84], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x542c54]
xor eax, esp
push eax
lea eax, [esp + 0x9c]
mov dword fs:[0], eax
xor ebx, ebx
push ebx
lea eax, [esp + 0x18]
push eax
push ebx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x20], ebx
call sub.IPHLPAPI.DLL_GetIpForwardTable
cmp eax, 0x7a
jne 0x424482
mov eax, dword [esp + 0x14]
cmp eax, ebx
jbe 0x424482
push eax
call fcn.004bf5dc
add esp, 4
push ebx
lea ecx, [esp + 0x18]
mov ebp, eax
push ecx
push ebp
call sub.IPHLPAPI.DLL_GetIpForwardTable
test eax, eax
je 0x424489
push ebp
call fcn.004bf5d1
add esp, 4
xor al, al
jmp 0x424566
cmp dword [ebp], ebx
mov dword [esp + 0x18], ebx
jle 0x42455b
lea esi, [ebp + 0x12]
mov edi, 0xf
mov edi, edi
cmp dword [esi - 0xe], ebx
jne 0x424546
movzx edx, byte [esi + 1]
movzx eax, byte [esi]
movzx ecx, byte [esi - 1]
push edx
movzx edx, byte [esi - 2]
push eax
push ecx
push edx
push str._d._d._d._d
lea eax, [esp + 0x8c]
push 0x20
push eax
call fcn.004cd853
add esp, 0x1c
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
mov dword [esp + 0x54], edi
mov dword [esp + 0x50], ebx
mov byte [esp + 0x40], bl
mov dword [esp + 0x70], edi
mov dword [esp + 0x6c], ebx
mov byte [esp + 0x5c], bl
lea eax, [esp + 0x78]
mov dword [esp + 0xa4], ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x424505
sub eax, edx
push eax
lea ecx, [esp + 0x7c]
push ecx
lea ecx, [esp + 0x44]
call fcn.00403330
mov edx, dword [esi + 2]
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x78], edx
call fcn.00424210
lea ecx, [esp + 0x20]
mov dword [esp + 0xa4], 0xffffffff
call fcn.00421740
mov eax, dword [esp + 0x18]
inc eax
add esi, 0x38
cmp eax, dword [ebp]
mov dword [esp + 0x18], eax
jl 0x4244a0
push ebp
call fcn.004bf5d1
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x9c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x84]
xor ecx, esp
call fcn.004cb553
add esp, 0x94
ret
Function at 0x425390
Capabilities:
Check os version

Disassembly:
sub esp, 0xa4
mov eax, dword [0x542c54]
xor eax, esp
mov dword [esp + 0xa0], eax
push ebx
mov ebx, dword [esp + 0xac]
push esi
push edi
push 0x9c
lea eax, [esp + 0x14]
push 0
push eax
mov esi, ecx
call fcn.004cb5a0
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x14], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x4253df
xor eax, eax
jmp 0x425452
cmp dword [esp + 0x20], 2
jne 0x4253db
cmp dword [esp + 0x14], 6
mov ecx, esi
setae dl
mov byte [esi + 0xcc], dl
call fcn.00424400
mov ecx, esi
call fcn.00424590
lea edi, [esi + 0x18]
push edi
mov ecx, esi
call fcn.00421890
push edi
mov ecx, esi
call fcn.00421b10
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x24], esp
push esi
call fcn.00422a70
push edi
mov ecx, esi
call fcn.00422e20
mov ecx, esi
call fcn.00424a90
push ebx
mov ecx, esi
call fcn.00424d10
mov ecx, dword [ebx + 0x10]
sub ecx, dword [ebx + 0xc]
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, dword [esp + 0xac]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004cb553
add esp, 0xa4
ret 4

Function at 0x425510
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x12c
mov eax, dword [0x542c54]
xor eax, esp
mov dword [esp + 0x128], eax
push esi
push edi
mov edi, dword [esp + 0x138]
push 0x103
lea eax, [esp + 0x31]
push 0
push eax
mov esi, ecx
mov byte [esp + 0x38], 0
call fcn.004cb5a0
add esp, 0xc
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x30]
push ecx
mov ecx, dword [esi + 4]
push edi
push 0
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x54]
push eax
push ecx
mov dword [esp + 0x38], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov ecx, dword [esp + 0x130]
neg eax
pop edi
sbb eax, eax
pop esi
xor ecx, esp
inc eax
call fcn.004cb553
add esp, 0x12c
ret 4
Function at 0x4255b0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push esi
push edi
lea eax, [esp + 0x1c]
push eax
xor esi, esi
push esi
mov edi, ecx
mov edx, dword [edi + 4]
lea ecx, [esp + 0x18]
push ecx
push esi
push ebx
push edx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], 1
call ebp
test eax, eax
jne 0x425677
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x425601
pop edi
lea eax, [esi + 1]
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
inc eax
push eax
call fcn.004bf5dc
mov esi, eax
mov eax, dword [esp + 0x20]
inc eax
push eax
push 0
push esi
call fcn.004cb5a0
mov eax, dword [edi + 4]
add esp, 0x10
lea ecx, [esp + 0x1c]
push ecx
push esi
lea edx, [esp + 0x18]
push edx
push 0
push ebx
push eax
call ebp
test eax, eax
jne 0x42565e
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push esi
push ecx
push edx
lea edi, [eax + 1]
call fcn.004cc266
add esp, 0xc
push esi
call fcn.004bf5d1
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
mov edi, dword [esp + 0x14]
push esi
call fcn.004bf5d1
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc

Function at 0x425690
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push esi
mov eax, 4
mov dword [esp + 8], eax
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 4]
push edx
mov edx, dword [esp + 0x14]
push eax
xor esi, esi
mov dword [eax], esi
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
lea eax, [esi + 1]
je 0x4256cd
mov eax, esi
pop esi
add esp, 8
ret 8

Function at 0x425700
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0xc
push ebx
push esi
push edi
push 0x104
mov edi, ecx
xor ebx, ebx
call fcn.004bf5dc
push 0x104
mov esi, eax
push ebx
push esi
call fcn.004cb5a0
mov edx, dword [esp + 0x2c]
add esp, 0x10
lea eax, [esp + 0x10]
push eax
mov eax, dword [edi + 4]
push ebx
push ebx
push ebx
lea ecx, [esp + 0x1c]
push ecx
push esi
push edx
push eax
mov dword [esp + 0x2c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x425765
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push esi
push ecx
push edx
call fcn.004cc266
mov ebx, 1
jmp 0x425779
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push 0x4f4b88
push eax
push ecx
call fcn.004cc266
add esp, 0xc
push esi
call fcn.004bf5d1
add esp, 4
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0xc
ret 0xc
Function at 0x425930
Capabilities:
Create process on windows
Terminate process

Disassembly:
sub esp, 0x58
push ebx
push ebp
push esi
push edi
push 0x3c
xor esi, esi
lea eax, [esp + 0x30]
push esi
push eax
call fcn.004cb5a0
mov ecx, dword [esp + 0x78]
add esp, 0xc
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x30], 0x3c
mov dword [esp + 0x3c], str.open
mov dword [esp + 0x40], str.cmd.exe
mov dword [esp + 0x44], ecx
mov dword [esp + 0x4c], esi
mov dword [esp + 0x34], 0x140
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
mov dword [esp + 0x6c], esi
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
lea esp, [esp]
mov eax, dword [esp + 0x64]
push 0x1f4
push eax
call ebp
test eax, eax
je 0x4259f8
cmp eax, 0x102
jne 0x4259bb
inc dword [esp + 0x6c]
cmp dword [esp + 0x6c], 5
jg 0x4259f8
push 1
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
call esi
test eax, eax
je 0x4259a0
lea edx, [esp + 0x10]
push edx
call edi
lea eax, [esp + 0x10]
push eax
call ebx
push 1
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
call esi
test eax, eax
jne 0x4259d5
jmp 0x4259a0
mov edx, dword [esp + 0x64]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [esp + 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret 4

Function at 0x425b50
Capabilities:
Check os version

Disassembly:
sub esp, 0x98
mov eax, dword [0x542c54]
xor eax, esp
mov dword [esp + 0x94], eax
push ebx
push esi
mov esi, dword [esp + 0xa4]
push edi
mov edi, dword [esp + 0xac]
push 0x90
lea eax, [esp + 0x14]
push 0
push eax
mov ebx, ecx
mov dword [esp + 0x18], 0x94
call fcn.004cb5a0
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x425baa
mov byte [esi], 1
mov byte [edi], 0
jmp 0x425bc9
mov eax, dword [esp + 0x10]
cmp eax, 6
jb 0x425bb8
mov byte [esi], 0
jmp 0x425bc9
mov byte [esi], 1
cmp eax, 5
jb 0x425ba5
mov ecx, ebx
call fcn.00425a20
mov byte [edi], al
mov ecx, dword [esp + 0xa0]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004cb553
add esp, 0x98
ret 8