joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100f235d
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push 0x1016ace0
call dword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x100f2384
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x100f2387
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.100f2339
pop esi
leave
ret 8
Function at 0x10001050
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push 0
push 4
push eax
push dword [0x1000df2c]
mov byte [ebp - 4], cl
mov ebx, edx
mov byte [ebp - 3], 2
mov word [ebp - 2], di
xor dword [ebp - 4], 0xf6fc61e8
call dword [0x1000e9c8]
test ebx, ebx
je 0x1000112d
test edi, edi
je 0x1000112d
lea edx, [edi - 4]
mov dword [ebp + 8], 0
add edx, ebx
mov eax, ebx
mov ecx, edx
sub ecx, ebx
add ecx, 4
shr ecx, 2
cmp ebx, edx
push esi
cmova ecx, dword [ebp + 8]
mov esi, 1
cmp ecx, esi
jb 0x10001104
cmp ecx, 0x10
jb 0x10001104
movaps xmm1, xmmword [0x1000ded0]
and ecx, 0xfffffff0
nop dword [eax + eax]
movups xmm0, xmmword [eax]
add esi, 0x10
xorps xmm0, xmm1
movups xmmword [eax], xmm0
movups xmm0, xmmword [eax + 0x10]
xorps xmm0, xmm1
movups xmmword [eax + 0x10], xmm0
movups xmm0, xmmword [eax + 0x20]
xorps xmm0, xmm1
movups xmmword [eax + 0x20], xmm0
movups xmm0, xmmword [eax + 0x30]
xorps xmm0, xmm1
movups xmmword [eax + 0x30], xmm0
add eax, 0x40
cmp esi, ecx
jbe 0x100010d0
pop esi
cmp eax, edx
ja 0x1000111d
nop dword [eax]
xor dword [eax], 0x3db6cc5c
add eax, 4
cmp eax, edx
jbe 0x10001110
push 0
push edi
push ebx
push dword [0x1000df2c]
call dword [0x1000e9c8]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10006f30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
mov edi, edx
mov eax, dword [ebx + 0x3c]
mov eax, dword [eax + ebx + 0x78]
add eax, ebx
mov ecx, dword [eax + 0x1c]
mov edx, dword [eax + 0x24]
add ecx, ebx
mov dword [ebp - 0x10], ecx
add edx, ebx
mov ecx, dword [eax + 0x20]
mov eax, dword [eax + 0x18]
add ecx, ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
test eax, eax
je 0x10006fb0
mov dh, byte [edi]
xor esi, esi
mov eax, edi
test dh, dh
je 0x10006f8d
mov ecx, dword [ecx + esi*4]
mov dl, dh
sub ecx, edi
add ecx, ebx
nop dword [eax + eax]
cmp byte [ecx + eax], dl
jne 0x10006fa3
mov dl, byte [eax + 1]
inc eax
test dl, dl
jne 0x10006f80
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
pop edi
movzx eax, word [eax + esi*2]
pop esi
mov eax, dword [ecx + eax*4]
add eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
inc esi
cmp esi, dword [ebp - 4]
je 0x10006fb0
mov ecx, dword [ebp - 8]
mov eax, edi
jmp 0x10006f72
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x691c23d2
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x69ad3014]
mov dword [ebp - 0xc], eax
jmp 0x691c240a
jmp 0x691c2434
jmp 0x691c245e
jmp 0x691c2488
jmp 0x691c24b2
jmp 0x691c24dc
jmp 0x691c2506
jmp 0x691c2530
jmp 0x691c255a
jmp 0x691c2584
jmp 0x691c25ae
cmp dword [ebp - 0xc], 0
je 0x691c2d42
mov eax, dword [0x69ad3014]
mov dword [0x69ad300c], eax
jmp 0x691c25ec
jmp 0x691c2616
jmp 0x691c2640
jmp 0x691c266a
jmp 0x691c2694
jmp 0x691c26be
jmp 0x691c26e8
jmp 0x691c2712
jmp 0x691c273c
jmp 0x691c2766
jmp 0x691c2790
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x3c]
mov eax, dword [ebp - 0xc]
add eax, edx
mov dword [0x69ad3008], eax
jmp 0x691c27ca
jmp 0x691c27f4
jmp 0x691c281e
jmp 0x691c2848
jmp 0x691c2872
jmp 0x691c289c
jmp 0x691c28c6
jmp 0x691c28f0
jmp 0x691c291a
jmp 0x691c2944
jmp 0x691c296e
mov eax, dword [0x69ad3008]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x10], eax
jmp 0x691c29a3
jmp 0x691c29cd
jmp 0x691c29f7
jmp 0x691c2a21
jmp 0x691c2a4b
jmp 0x691c2a75
jmp 0x691c2a9f
jmp 0x691c2ac9
jmp 0x691c2af3
jmp 0x691c2b1d
jmp 0x691c2b47
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x3000
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
call eax
sub esp, 0x10
mov dword [0x69ad3004], eax
jmp 0x691c2b9e
jmp 0x691c2bc8
jmp 0x691c2bf2
jmp 0x691c2c1c
jmp 0x691c2c46
jmp 0x691c2c70
jmp 0x691c2c9a
jmp 0x691c2cc4
jmp 0x691c2cee
jmp 0x691c2d18
jmp 0x691c2d42
nop
leave
ret

Function at 0x691c9a30
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], 0x69ad2040
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.691c9a90
Function at 0x691c9a90
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x69ad3378]
test esi, esi
jle 0x691c9b7d
mov edi, dword [0x69ad337c]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x691c9ac4
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x691c9b76
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x691c9ab0
mov dword [esp], eax
mov esi, eax
call fcn.691ca230
test eax, eax
mov edi, eax
je 0x691c9bba
mov esi, dword [0x69ad337c]
lea ebx, [ebx + ebx*2]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call fcn.691ca340
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x69ad337c]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x691c9b9a
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x691c9b6f
sub eax, 0x40
and eax, 0xffffffbf
je 0x691c9b6f
mov eax, dword [esp + 0x20]
add ebx, dword [0x69ad337c]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x691c9b84
add dword [0x69ad3378], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor ebx, ebx
jmp 0x691c9ace
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.691c9a30
mov eax, dword [0x69ad337c]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.691c9a30
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call fcn.691c9a30
lea esi, [esi]

Function at 0x691c9ea0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x69ad3388
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x69ad3380]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x691c9ef5
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x691c9eee
test esi, esi
je 0x691c9eee
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x691c9ed0
mov dword [esp], 0x69ad3388
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x401061
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x828
mov eax, dword [0x487f50]
and dword [ebp - 8], 0
mov dword [ebp - 0x1c], eax
mov eax, dword [0x487f54]
push esi
mov esi, dword [ebx]
push edi
mov edi, dword [ebx + 4]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x10], esi
call fcn.0040105a
mov eax, dword [0x487f58]
add dword [ebp - 8], 0x23f
mov dword [ebp - 0x18], eax
mov eax, dword [0x487f5c]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], 0x20
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov eax, dword [0x24a595c]
mov ecx, esi
shl ecx, 4
add ecx, dword [ebp - 0x18]
cmp eax, 0xfa9
jne 0x4010d7
mov dword [0x24a5958], 0xedeb2e40
cmp eax, 0x3eb
jne 0x4010e5
and dword [0x24a53e4], 0
mov eax, dword [ebp - 0x10]
shr eax, 5
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x20]
mov edx, dword [ebp - 8]
add edx, esi
xor eax, edx
xor eax, ecx
sub edi, eax
cmp dword [0x24a595c], 0xc
mov dword [0x24a5954], 0xf4ea3dee
mov dword [ebp - 4], eax
jne 0x401135
lea eax, [ebp - 0x28]
push eax
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
push 0
lea eax, [ebp - 0x828]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
mov eax, edi
shr eax, 5
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
add dword [ebp - 8], 0x61c88647
mov eax, edi
shl eax, 4
add eax, dword [ebp - 0x1c]
add ecx, edi
xor eax, ecx
xor eax, dword [ebp - 4]
sub esi, eax
dec dword [ebp - 0x14]
mov dword [ebp - 0x10], esi
jne 0x4010ae
mov dword [ebx + 4], edi
pop edi
mov dword [ebx], esi
pop esi
leave
ret

Function at 0x401173
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.004070e0
mov eax, dword [0x24a595c]
mov ecx, dword [0x24a53e8]
push esi
shr eax, 3
xor esi, esi
cmp eax, esi
jbe 0x401232
push ebx
push edi
mov ebx, ecx
mov edi, eax
cmp dword [0x24a595c], 0x959
jne 0x401221
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
push esi
push esi
lea eax, [ebp - 0x800]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsExA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push str.Mokigehate_xolega_viricuh_mazu_fiboy
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push str.Yimu_givexohipalipen
push esi
call dword [sym.imp.KERNEL32.dll_FatalAppExitA]
push str.Hipejes_joh_jagibavicedok_lozofowegad_dinomebaxedidox
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
push esi
lea eax, [ebp - 0x1000]
push eax
push esi
push str.pajebipew
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call fcn.00401061
add ebx, 8
dec edi
jne 0x40119f
pop edi
pop ebx
pop esi
leave
ret
Function at 0x401517
Capabilities:
Clear file content
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
push esi
xor esi, esi
cmp dword [0x24a595c], 0x400
push edi
jne 0x401575
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_DrawStateA]
push esi
push esi
call fcn.00402a66
push esi
push esi
call fcn.0040235d
push esi
call fcn.00402a01
push esi
push esi
call fcn.0040284c
push esi
call fcn.00402b64
push esi
push esi
call fcn.00402261
add esp, 0x28
xor edi, edi
cmp edi, 0x16cda
jge 0x40158d
push esi
lea eax, [ebp - 4]
push eax
push esi
push esi
push esi
call dword [sym.imp.GDI32.dll_GetCharABCWidthsI]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_LocalCompact]
cmp edi, 0x12e5bee
jg 0x4015b2
inc edi
cmp edi, 0x30053
jl 0x401577
mov eax, dword [0x48839c]
mov dword [0x24a595c], eax
call fcn.00401235
mov edi, 0x3078f
cmp dword [0x24a595c], 0x51f
jne 0x4015e0
push esi
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
dec edi
jne 0x4015c6
pop edi
xor eax, eax
pop esi
leave
ret 0x10

Function at 0x406e1e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4876d8]
jne 0x406e28
repz ret
jmp fcn.0040877a
Function at 0x40802d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4876d8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00405a6d
and dword [ebp - 0x14], 0
cmp dword [0x492f20], 0
mov dword [ebp - 0x18], eax
jne 0x4080e0
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x408188
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x408188
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x492f20], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x492f24], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x492f28], eax
call edi
push eax
call esi
mov dword [0x492f30], eax
test eax, eax
je 0x4080e0
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x492f2c], eax
mov eax, dword [0x492f2c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x408139
cmp dword [0x492f30], ecx
je 0x408139
push eax
call esi
push dword [0x492f30]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x408139
test ebx, ebx
je 0x408139
call edi
test eax, eax
je 0x408130
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x408130
test byte [ebp - 8], 1
jne 0x408139
or dword [ebp + 0x10], 0x200000
jmp 0x40816c
mov eax, dword [0x492f24]
cmp eax, dword [ebp - 0x18]
je 0x40816c
push eax
call esi
test eax, eax
je 0x40816c
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40816c
mov eax, dword [0x492f28]
cmp eax, dword [ebp - 0x18]
je 0x40816c
push eax
call esi
test eax, eax
je 0x40816c
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x492f20]
call esi
test eax, eax
je 0x408188
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40818a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406e1e
leave
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x24356752
nop
nop
nop
test eax, eax
nop
nop
je 0x43204e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
mov ecx, 0x741414c6
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x4012d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x4371c0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x820
lea eax, [ebp - 0x824]
push 0
push eax
call fcn.00414300
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x824]
push 0x410
push 0x410
push eax
call fcn.00411cfb
add esp, 0x20
cmp word [ebp - 0x824], 0
je 0x40132d
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041153d
mov esp, ebp
pop ebp
ret
Function at 0x401830
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x4371c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0x210], edx
xor esi, esi
call fcn.0040f6f0
mov edi, eax
test edi, edi
je 0x401974
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401861
sub ecx, edx
sar ecx, 1
je 0x401974
push edi
lea eax, [ebp - 0x218]
mov dword [ebp - 0x218], esi
push 0x4323d8
push eax
call fcn.0040fe50
xor eax, eax
mov dword [ebp - 0x214], esi
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.00414300
add esp, 0x18
mov dword [ebp - 0x21c], 0x206
lea eax, [ebp - 0x214]
mov dword [ebp - 0x220], 1
push eax
push 0x20019
push 0
push dword [ebp - 0x218]
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40195b
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x220]
push eax
push 0
push 0x432460
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40194f
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x210]
push str._sTemp
push eax
call fcn.0040fe50
mov esi, dword [ebp - 0x210]
add esp, 0xc
lea ecx, [esi + 2]
lea esp, [esp]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x401940
sub esi, ecx
sar esi, 1
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041153d
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x210]
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0041153d
mov esp, ebp
pop ebp
ret
Function at 0x404690
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x429dfe
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4371c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x10]
mov dword [edi], 0
push eax
push 0
lea ecx, [edi + 4]
mov dword [ebp - 0x10], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
call fcn.004049f0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10]
mov dword [edi + 0x20], 0
lea ecx, [edi + 0x24]
push eax
push 0
mov dword [ebp - 0x10], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
call fcn.004049f0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
lea ecx, [edi + 0x40]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov edx, dword [ebp + 0x14]
mov byte [ebp - 4], 2
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x54], eax
mov eax, dword [ebp + 0x1c]
mov dword [edi + 0x5c], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x68], eax
mov dword [edi + 0x58], edx
mov dword [edi + 0x60], 0
mov byte [edi + 0x64], 0
movsx eax, byte [edx + 8]
and eax, 8
shr eax, 3
mov byte [edi + 0x6c], al
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x70], eax
push dword [edx + 0x18]
call fcn.004047e0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x405e50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x405e81
lea esp, [esp]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x405e70
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x40c310
Capabilities:
Check os version
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x944
mov eax, dword [0x4371c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x114
xor edi, edi
mov dword [ebp - 0x93c], edx
lea eax, [ebp - 0x938]
mov dword [ebp - 0x940], 0x104
mov ebx, ecx
push edi
push eax
mov dword [ebp - 0x944], ebx
call fcn.00414300
add esp, 0xc
mov dword [ebp - 0x938], 0x114
lea eax, [ebp - 0x938]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x928], 2
jne 0x40c3cd
cmp dword [ebp - 0x934], 6
jb 0x40c3cd
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x43285c
call esi
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40c419
push str.QueryFullProcessImageNameW
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40c3c4
lea ecx, [ebp - 0x940]
push ecx
push dword [ebp - 0x93c]
push edi
push dword [ebp - 0x944]
call eax
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x40c419
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str.Window_is_XP_n
call esi
push dword [ebp - 0x940]
push dword [ebp - 0x93c]
push 0
push ebx
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
mov edi, eax
test edi, edi
jne 0x40c419
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x824]
push str.GetModulePathWrap___:_GetModuleFileNameEx___err___d_n
push eax
call fcn.0040b470
add esp, 0xc
lea eax, [ebp - 0x824]
push eax
call esi
push edi
push dword [ebp - 0x93c]
lea eax, [ebp - 0x824]
push str.GetModulePathWrap___Out_:_lpszModPath___s__ret__int____d_n
push eax
call fcn.0040b470
add esp, 0x10
lea eax, [ebp - 0x824]
push eax
call esi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041153d
mov esp, ebp
pop ebp
ret
Function at 0x40c6e0
Capabilities:
Check mutex on windows
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x82c
mov eax, dword [0x4371c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push esi
xor esi, esi
push edi
push str.IsMSISrvFree___In
mov dword [ebp - 0x828], esi
lea edi, [esi + 0xa]
call ebx
push str.Global_MSIExecute
push esi
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [ebp - 0x82c], eax
test eax, eax
je 0x40c821
push esi
push str.IsMSISrvFree___:_Mutex_is_opened__GetLastError_____d_n
lea eax, [ebp - 0x824]
push 0x104
push eax
call fcn.00412a6b
add esp, 0x10
lea eax, [ebp - 0x824]
push eax
call ebx
push 0x4e20
push dword [ebp - 0x82c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, eax
cmp esi, 0x102
ja 0x40c7b0
je 0x40c7a7
test esi, esi
je 0x40c796
cmp esi, 0x80
jne 0x40c7d9
push str.IsMSISrvFree___:_WAIT_ABANDONED__iCount_set_to_0._n
lea eax, [ebp - 0x824]
xor edi, edi
push 0x104
push eax
call fcn.00412a6b
add esp, 0xc
jmp 0x40c7d9
mov dword [ebp - 0x828], 1
push str.IsMSISrvFree___:_Mutex_is_closed__iCount_set_to_0._n
jmp 0x40c77e
dec edi
push edi
push str.IsMSISrvFree___:_WAIT_TIMEOUT__iCount___d_n
jmp 0x40c7c5
cmp esi, 0xffffffff
jne 0x40c7d9
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push str.IsMSISrvFree___:_WAIT_FAILED__iCount_set_to_0__ret___d_n
lea eax, [ebp - 0x824]
push 0x104
push eax
call fcn.00412a6b
add esp, 0x10
lea eax, [ebp - 0x824]
push eax
call ebx
test edi, edi
jne 0x40c750
push esi
push str._nIsMSISrvFree___:_Do_not_wait_any_more._n_n
lea eax, [ebp - 0x824]
push 0x104
push eax
call fcn.00412a6b
add esp, 0x10
lea eax, [ebp - 0x824]
push eax
call ebx
push dword [ebp - 0x82c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x828]
jmp 0x40c84f
mov esi, 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.IsMSISrvFree___:_OpenMutex___err_ret___d_n
lea eax, [ebp - 0x824]
push 0x104
push eax
call fcn.00412a6b
add esp, 0x10
lea eax, [ebp - 0x824]
push eax
call ebx
push esi
push str.IsMSISrvFree___Out_ret___d_n
lea eax, [ebp - 0x824]
push 0x104
push eax
call fcn.00412a6b
add esp, 0x10
lea eax, [ebp - 0x824]
push eax
call ebx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041153d
mov esp, ebp
pop ebp
ret