joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406020
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
mov eax, dword [0x5053a4]
xor eax, esp
mov dword [esp + 0x48], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x406120
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x406045
sub ecx, edx
sar ecx, 1
je 0x406120
push 0
call fcn.004ab675
add esp, 4
sub eax, 0x278d00
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
sbb edx, 0
mov dword [esp + 0x24], edx
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.004ab941
add esp, 8
test eax, eax
jne 0x4060db
mov eax, dword [esp + 0x3c]
add eax, 0x76c
mov word [esp + 0x10], ax
mov eax, dword [esp + 0x38]
inc eax
mov word [esp + 0x12], ax
movzx eax, word [esp + 0x40]
mov word [esp + 0x14], ax
movzx eax, word [esp + 0x34]
mov word [esp + 0x16], ax
movzx eax, word [esp + 0x30]
mov word [esp + 0x18], ax
movzx eax, word [esp + 0x2c]
mov word [esp + 0x1a], ax
movzx eax, word [esp + 0x28]
mov word [esp + 0x1c], ax
xor eax, eax
mov word [esp + 0x1e], ax
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000100
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x406120
lea eax, [esp + 8]
push eax
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x4c]
pop esi
xor ecx, esp
call fcn.004a4bf6
mov esp, ebp
pop ebp
ret 4
Function at 0x406140
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5053a4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x20000000
push 0
push 0
mov byte [ebp - 0x21], 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
jne 0x40617b
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a4bf6
mov esp, ebp
pop ebp
ret
push esi
push 0x34
push str.jijianbianqian_server
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x4061a9
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a4bf6
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x4061cd
cmp dword [ebp - 0x1c], 1
jne 0x40623d
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x4061eb
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a4bf6
mov esp, ebp
pop ebp
ret
push edi
lea eax, [ebp - 0x20]
xor edi, edi
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x40623c
nop dword [eax]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x1c], 4
je 0x40622c
inc edi
cmp edi, 0xa
je 0x406226
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x406200
jmp 0x40623c
mov byte [ebp - 0x21], 0
jmp 0x40623c
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call edi
push ebx
call edi
mov byte [ebp - 0x21], 1
pop edi
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x21]
xor ecx, ebp
pop esi
pop ebx
call fcn.004a4bf6
mov esp, ebp
pop ebp
ret
Function at 0x406260
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5053a4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x20000000
push 0
push 0
mov byte [ebp - 0x21], 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
jne 0x40629b
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a4bf6
mov esp, ebp
pop ebp
ret
push esi
push 0x34
push str.jijianbianqian_server
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x4062c9
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a4bf6
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x4062f6
mov ecx, dword [ebp - 0x1c]
cmp ecx, 4
je 0x4062e5
cmp ecx, 2
jne 0x406363
lea eax, [ebp - 0x20]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x406314
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a4bf6
mov esp, ebp
pop ebp
ret
push edi
lea eax, [ebp - 0x20]
xor edi, edi
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x406362
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x1c], 1
je 0x406352
inc edi
cmp edi, 0xa
je 0x40634c
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x406326
jmp 0x406362
mov byte [ebp - 0x21], 0
jmp 0x406362
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call edi
push ebx
call edi
mov byte [ebp - 0x21], 1
pop edi
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x21]
xor ecx, ebp
pop esi
pop ebx
call fcn.004a4bf6
mov esp, ebp
pop ebp
ret

Function at 0x408190
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4081a9
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4081e6
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x4081e2
nop word [eax + eax]
cmp esi, edx
jae 0x4081e6
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x4081d0
cmp esi, edx
jb 0x4081ed
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x408d90
Capabilities:
Encrypt data using rc4 prga
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x5053a4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor edx, edx
push edi
mov edi, dword [ebp + 8]
lea eax, [esi + 0x16]
nop dword [eax]
movzx ecx, byte [eax - 2]
lea eax, [eax + 4]
mov byte [ebp + edx - 0xc], cl
movzx ecx, byte [eax - 5]
mov byte [ebp + edx - 0xb], cl
movzx ecx, byte [eax - 4]
mov byte [ebp + edx - 0xa], cl
movzx ecx, byte [eax - 3]
mov byte [ebp + edx - 9], cl
add edx, 4
cmp edx, 8
jb 0x408db0
mov edx, dword [esi + 0x14]
lea ebx, [esi + 0x5c]
shr edx, 3
mov ecx, 0x38
and edx, 0x3f
mov eax, 0x78
sub ecx, edx
sub eax, edx
cmp edx, 0x38
cmovb eax, ecx
mov ecx, esi
push eax
push ebx
call fcn.00408cc0
push 8
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
call fcn.00408cc0
lea ecx, [edi + 1]
mov edi, 4
lea edx, [esi + 6]
nop dword [eax]
movzx eax, byte [edx - 2]
lea edx, [edx + 4]
mov byte [ecx - 1], al
lea ecx, [ecx + 4]
movzx eax, byte [edx - 5]
mov byte [ecx - 4], al
movzx eax, byte [edx - 4]
mov byte [ecx - 3], al
movzx eax, byte [edx - 3]
mov byte [ecx - 2], al
sub edi, 1
jne 0x408e20
xor eax, eax
mov edi, esi
xorps xmm0, xmm0
mov ecx, 0x27
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 4]
mov dword [esi + 0x18], eax
xor ecx, ebp
mov dword [esi + 0x14], eax
mov dword [esi + 4], 0x67452301
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
movups xmmword [ebx], xmm0
pop edi
movups xmmword [ebx + 0x10], xmm0
pop esi
movups xmmword [ebx + 0x20], xmm0
movups xmmword [ebx + 0x30], xmm0
mov byte [ebx], 0x80
pop ebx
call fcn.004a4bf6
mov esp, ebp
pop ebp
ret 4
Function at 0x409650
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cf3c3
mov eax, dword fs:[0]
push eax
sub esp, 0xb8
mov eax, dword [0x5053a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0xc0], edi
mov dword [ebp - 0xc4], 0
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x60], xmm0
mov dword [ebp - 0xbc], vtable.MD5_CTX.0
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xb8], 0x67452301
mov dword [ebp - 0xb4], 0xefcdab89
mov dword [ebp - 0xb0], 0x98badcfe
mov dword [ebp - 0xac], 0x10325476
movups xmmword [ebp - 0x50], xmm0
mov byte [ebp - 0x60], 0x80
movups xmmword [ebp - 0x40], xmm0
movups xmmword [ebp - 0x30], xmm0
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
mov esi, dword [eax - 0xc]
test esi, esi
jns 0x40970b
push 0x80070057
call fcn.00408740
mov ecx, dword [eax - 8]
mov edx, 1
sub edx, dword [eax - 4]
sub ecx, esi
or ecx, edx
jge 0x409728
push esi
lea ecx, [ebp + 8]
call fcn.004073f0
mov eax, dword [ebp + 8]
push esi
push eax
lea ecx, [ebp - 0xbc]
call fcn.00408cc0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0xbc]
call fcn.00408d90
push ecx
lea edx, [ebp - 0x20]
mov dword [edi], 0
mov ecx, edi
call fcn.004095b0
mov dword [ebp - 4], 0xffffffff
add esp, 4
mov esi, dword [ebp + 8]
or eax, 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40977a
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a4bf6
mov esp, ebp
pop ebp
ret
Function at 0x40d3d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cf892
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5053a4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, edx
mov esi, ecx
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x40d52c
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
push esi
call fcn.0041e2de
add esp, 4
mov dword [ebp - 4], 0
push 0x4f66b8
push 0x86
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x40d52c
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov edi, eax
call fcn.0041e2de
add esp, 4
push dword [ebp - 0x14]
push edi
call fcn.0041e50a
add esp, 8
push 0x4ac
call fcn.004a5103
mov esi, eax
add esp, 4
mov dword [ebp - 0x14], esi
push 0x4ac
push 0
push esi
mov byte [ebp - 4], 1
call fcn.004a7a60
add esp, 0xc
mov ecx, esi
push ebx
call fcn.00401c10
mov byte [ebp - 4], 0
mov esi, eax
mov ecx, esi
push 0
push accept
push accept
push accept
push accept
test bl, bl
jne 0x40d4e6
push 0x100
push 0x96c80000
push 0x4f61c8
push 0
call fcn.0041fc6d
push 0x6b
mov ecx, esi
call fcn.00420046
mov ecx, esi
call fcn.0041fb19
push 1
jmp 0x40d50e
push 0x81
push 0x96c80000
push 0x4f61c8
push 0
call fcn.0041fc6d
push 0x6b
mov ecx, esi
call fcn.00420046
mov ecx, esi
call fcn.0041fb19
push 0
mov ecx, esi
call fcn.004200d9
test edi, edi
je 0x40d520
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
call dword [sym.imp.ole32.dll_OleUninitialize]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40d550
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cf8bb
mov eax, dword fs:[0]
push eax
sub esp, 0xa10
mov eax, dword [0x5053a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov esi, ecx
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
push 0
push eax
call fcn.004a7a60
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push ecx
lea edx, [ebp - 0x218]
mov ecx, esi
call fcn.0040d750
add esp, 4
call fcn.00408990
mov ecx, eax
test ecx, ecx
jne 0x40d5d3
push 0x80004005
call fcn.00408740
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xa1c], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0xa1c]
push str._smain.ini
push eax
call fcn.00407520
mov esi, dword [ebp - 0xa1c]
mov ecx, 1
add esp, 0xc
sub ecx, dword [esi - 4]
mov eax, dword [esi - 8]
or eax, ecx
jge 0x40d62b
push 0
lea ecx, [ebp - 0xa1c]
call fcn.00408460
mov esi, dword [ebp - 0xa1c]
mov ecx, esi
call fcn.0040d930
test eax, eax
je 0x40d714
push 0x800
lea eax, [ebp - 0xa18]
push 0
push eax
call fcn.004a7a60
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
add esp, 0xc
or eax, ecx
jge 0x40d672
push 0
lea ecx, [ebp - 0xa1c]
call fcn.00408460
mov esi, dword [ebp - 0xa1c]
push esi
push 0x400
lea eax, [ebp - 0xa18]
push eax
push 0x4f61c8
push 0x4f66d4
push 0x4f5a48
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test ebx, ebx
je 0x40d6b2
lea ecx, [ebp - 0xa18]
mov eax, ecx
sub ebx, eax
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [ebx + ecx - 2], ax
test ax, ax
jne 0x40d6a2
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
or eax, ecx
jge 0x40d6d4
push 0
lea ecx, [ebp - 0xa1c]
call fcn.00408460
mov esi, dword [ebp - 0xa1c]
push esi
push 0x400
lea eax, [ebp - 0xa18]
push eax
push 0x4f61c8
push 0x4f66dc
push 0x4f5a48
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test edi, edi
je 0x40d714
lea ecx, [ebp - 0xa18]
mov eax, ecx
sub edi, eax
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edi + ecx - 2], ax
test ax, ax
jne 0x40d704
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40d733
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a4bf6
mov esp, ebp
pop ebp
ret
Function at 0x40d750
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x23c
mov eax, dword [0x5053a4]
xor eax, esp
mov dword [esp + 0x238], eax
push ebx
push esi
push edi
push str.DATA
mov edi, ecx
mov dword [esp + 0x10], edx
push 0x84
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x40d841
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
sub esp, 8
mov edx, esi
mov ecx, eax
call fcn.00416640
mov esi, eax
add esp, 8
test esi, esi
je 0x40d830
cmp dword [esi], 1
je 0x40d7c6
mov dword [0x508bc4], 0x80000
jmp 0x40d7d7
push dword [esp + 0xc]
mov ecx, dword [esi + 4]
call fcn.004159b0
mov dword [0x508bc4], eax
cmp dword [esi], 1
mov dword [esp + 0xc], 0xffffffff
jne 0x40d80c
mov ecx, dword [esi + 4]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
push eax
sub esp, 8
call fcn.00416060
mov dword [0x508bc4], eax
mov eax, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x40d83a
cmp dword [esi], 1
je 0x40d818
mov dword [0x508bc4], 0x80000
jmp 0x40d83a
sub esp, 8
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esi + 4]
push eax
call fcn.00416280
mov dword [0x508bc4], eax
jmp 0x40d83a
mov dword [0x508bc4], 0x10000
mov ecx, esi
call fcn.00416760
mov ecx, dword [esp + 0x244]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004a4bf6
mov esp, ebp
pop ebp
ret

Function at 0x40d860
Capabilities:
Create shortcut via ishelllink
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x5053a4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
mov esi, edx
mov edi, ecx
call dword [sym.imp.ole32.dll_CoInitialize]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 1
je 0x40d894
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 8]
push eax
push 0x4d47c0
push 1
push 0
push 0x4d4800
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x40d8c2
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a4bf6
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, dword [ebp - 8]
lea edx, [ebp - 0xc]
push edx
push 0x4d4820
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
js 0x40d8b0
mov eax, dword [ebp - 8]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 0xc]
push 2
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop esi
call fcn.004a4bf6
mov esp, ebp
pop ebp
ret
Function at 0x40eb40
Capabilities:
Access peb ldr_data
Check os version
Get process heap force flags
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cfb69
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x5053a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 4], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x48], ebx
mov dword [ebx], 0
call fcn.00408990
mov ecx, eax
test ecx, ecx
jne 0x40eb9f
push 0x80004005
call fcn.00408740
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x44], 1
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x3c], 0
pushal
mov ebx, dword fs:[0x18]
mov eax, dword fs:[0x30]
mov ebx, dword [eax + 0xa8]
mov eax, dword [eax + 0xa4]
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], eax
popal
cmp dword [ebp - 0x38], 5
jl 0x40ec4d
push str.GetNativeSystemInfo
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40ec0f
lea ecx, [ebp - 0x34]
push ecx
call eax
jmp 0x40ec19
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ax, word [ebp - 0x34]
cmp ax, 9
je 0x40ec2e
cmp ax, 6
mov eax, 0x20
jne 0x40ec33
mov eax, 0x40
mov esi, dword [ebp - 0x40]
push eax
push dword [ebp - 0x3c]
push dword [ebp - 0x38]
push str.w_02d_02dx_d
push esi
call fcn.00407520
add esp, 0x14
jmp 0x40ec50
mov esi, dword [ebp - 0x40]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a4bf6
mov esp, ebp
pop ebp
ret
Function at 0x413c00
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x413c0b
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x413cc7
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4f3fd0]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4f3fd0]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4f3fd0]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4f3fd0]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4f3fd0]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4f3fd0]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4f3fd0]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4f3fd0]
sub edi, 1
jne 0x413c20
pop edi
test esi, esi
je 0x413cea
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4f3fd0]
sub esi, 1
jne 0x413cd0
not ecx
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x4143c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x5053a4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, edx
mov esi, ebx
mov eax, ecx
imul esi, dword [ebp + 8]
mov dword [ebp - 8], eax
cmp byte [edi], 0
je 0x414406
push 0
lea ecx, [ebp - 8]
push ecx
push esi
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x414401
mov byte [edi + 8], 1
mov eax, dword [ebp - 8]
jmp 0x41442e
mov edx, dword [edi + 0x1c]
mov ecx, dword [edi + 0x18]
lea eax, [edx + esi]
cmp eax, ecx
jbe 0x414417
mov esi, ecx
sub esi, edx
mov ecx, dword [edi + 0x14]
push esi
add ecx, edx
push ecx
push dword [ebp - 8]
call fcn.004a8230
add esp, 0xc
mov eax, esi
add dword [edi + 0x1c], esi
mov ecx, dword [ebp - 4]
xor edx, edx
pop edi
div ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.004a4bf6
mov esp, ebp
pop ebp
ret
Function at 0x414450
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x5053a4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov dword [ebp - 0xc], ebx
mov edi, 1
cmp byte [esi], 0
je 0x414495
push 0
lea eax, [ebp - 0xc]
push eax
push edi
lea eax, [ebp - 5]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x414490
mov byte [esi + 8], 1
mov edi, dword [ebp - 0xc]
jmp 0x4144c2
mov ebx, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
lea eax, [ebx + 1]
cmp eax, ecx
jbe 0x4144a6
mov edi, ecx
sub edi, ebx
mov eax, dword [esi + 0x14]
add eax, ebx
push edi
push eax
lea eax, [ebp - 5]
push eax
call fcn.004a8230
lea eax, [ebx + edi]
add esp, 0xc
mov ebx, dword [ebp - 0xc]
mov dword [esi + 0x1c], eax
cmp edi, 1
jne 0x4144e0
movzx eax, byte [ebp - 5]
mov dword [ebx], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a4bf6
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0
je 0x4144cd
cmp byte [esi + 8], 0
je 0x4144cd
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a4bf6
mov esp, ebp
pop ebp
ret