joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44dec0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
or dword [ebp + 0xc], 0xc11c
cmp byte [0x4cc534], 0
je 0x44dee6
or dword [ebp + 0xc], 0x80000
push 1
xor eax, eax
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x2c]
push eax
push 1
push 0x44dfa8
push 1
push 0x44dfb0
push 1
lea ecx, [ebp - 0x24]
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.0044de54
push 0
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0
mov eax, dword [ebp + 8]
push eax
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push esi
lea eax, [ebx + 0x44]
push eax
mov eax, dword [ebx + 8]
call dword [eax + 0x18]
mov esi, eax
mov eax, esi
call fcn.00431d54
test al, al
jne 0x44df50
cmp esi, 0x80090318
jne 0x44df58
test edi, edi
je 0x44df58
mov byte [ebx + 0x5c], 1
mov edi, dword [ebp - 0x1c]
test edi, edi
je 0x44df88
cmp dword [ebp - 0x24], 0
je 0x44df88
push 0
mov eax, dword [ebp - 0x24]
push eax
push edi
mov eax, dword [ebx + 0x50]
push eax
call sub.wsock32.dll_send
test eax, eax
jg 0x44df7e
mov esi, 0x80090304
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebx + 8]
call dword [eax + 0x40]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x44df9c
cmp dword [ebp - 0x18], 0
je 0x44df9c
push eax
mov eax, dword [ebx + 8]
call dword [eax + 0x40]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x44dfb8
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffeb4
mov edi, edx
mov ebx, eax
mov byte [esp], 0
xor esi, esi
xor eax, eax
mov dword [esp + 8], eax
test edi, edi
je 0x44e03d
mov dword [esp + 0x38], 1
mov eax, dword [ebx + 0x50]
mov dword [esp + 0x3c], eax
mov eax, dword [0x4cc548]
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
lea eax, [esp + 0x44]
push eax
push 0
call sub.wsock32.dll_select
test eax, eax
jle 0x44e160
push 0
mov eax, dword [ebx + 0x74]
sub eax, esi
push eax
mov eax, dword [ebx + 0x78]
add eax, esi
push eax
mov eax, dword [ebx + 0x50]
push eax
call sub.wsock32.dll_recv
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
jle 0x44e160
mov eax, dword [esp + 4]
add esi, eax
test esi, esi
sete al
neg al
sbb edi, edi
push 1
mov eax, dword [ebx + 0x78]
mov dword [esp + 0x140], eax
xor eax, eax
mov dword [esp + 0x144], eax
lea eax, [esp + 0x140]
push eax
push 1
mov dword [esp + 0x150], esi
xor eax, eax
mov dword [esp + 0x154], eax
lea eax, [esp + 0x150]
push eax
push 1
push 0x44e170
push 1
lea ecx, [esp + 0x3c]
lea edx, [esp + 0x30]
mov eax, ebx
call fcn.0044de54
push 0
mov eax, dword [esp + 0xc]
push eax
lea eax, [esp + 0x1c]
push eax
lea edx, [ebx + 0x54]
xor ecx, ecx
mov eax, ebx
call fcn.0044dec0
mov ebp, eax
sub ebp, 0x80090318
je 0x44e158
sub ebp, 0x7ff6fce8
je 0x44e0d5
sub ebp, 0x90312
je 0x44e11d
sub ebp, 0xe
je 0x44e149
jmp 0x44e160
cmp dword [esp + 0x30], 5
jne 0x44e117
mov eax, dword [esp + 0x2c]
push eax
push 0x40
call fcn.00403198
mov dword [ebx + 0x84], eax
mov edx, dword [ebx + 0x84]
mov eax, dword [ebx + 0x78]
add eax, esi
sub eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x2c]
call sub.rtl250.bpl__System_Move_qqrpxvpvi
mov eax, dword [esp + 0x2c]
mov dword [ebx + 0x7c], eax
mov dword [ebx + 0x80], 2
mov byte [esp], 1
jmp 0x44e160
cmp dword [esp + 0x30], 5
jne 0x44e142
mov edx, dword [ebx + 0x78]
mov eax, dword [ebx + 0x78]
add eax, esi
sub eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x2c]
call sub.rtl250.bpl__System_Move_qqrpxvpvi
mov esi, dword [esp + 0x2c]
jmp 0x44dfd2
xor esi, esi
jmp 0x44dfd2
or dword [esp + 8], 0x80
xor edi, edi
jmp 0x44dfd2
or edi, 0xffffffff
jmp 0x44dfd2
movzx eax, byte [esp]
add esp, 0x14c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x44e178
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff9c
mov esi, edx
mov ebp, eax
mov bl, 1
mov eax, esi
call sub.rtl250.bpl__System__LStrToPChar_qqrx27System__AnsiStringT_us_i0__
mov dword [esp], eax
mov eax, esi
call sub.rtl250.bpl__System__LStrLen_qqrx31System__AnsiStringT_us_i65535__
mov edi, eax
mov dword [esp + 4], 0x400
cmp dword [ebp + 8], 0
je 0x44e2a6
mov eax, dword [ebp + 0x68]
cmp eax, dword [esp + 4]
jae 0x44e2a6
mov eax, dword [ebp + 0x68]
mov dword [esp + 4], eax
jmp 0x44e2a6
cmp edi, dword [esp + 4]
jbe 0x44e1cf
mov esi, dword [esp + 4]
jmp 0x44e1d1
mov esi, edi
cmp dword [ebp + 8], 0
je 0x44e28b
mov edx, dword [ebp + 0x78]
add edx, dword [ebp + 0x60]
mov eax, dword [esp]
mov ecx, esi
call sub.rtl250.bpl__System_Move_qqrpxvpvi
push 3
mov eax, dword [ebp + 0x78]
mov dword [esp + 0x48], eax
mov eax, dword [ebp + 0x78]
add eax, dword [ebp + 0x60]
mov dword [esp + 0x4c], eax
mov eax, dword [ebp + 0x78]
add eax, dword [ebp + 0x60]
add eax, esi
mov dword [esp + 0x50], eax
xor eax, eax
mov dword [esp + 0x54], eax
lea eax, [esp + 0x48]
push eax
push 3
mov eax, dword [ebp + 0x60]
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], esi
mov eax, dword [ebp + 0x64]
mov dword [esp + 0x68], eax
xor eax, eax
mov dword [esp + 0x6c], eax
lea eax, [esp + 0x60]
push eax
push 3
push 0x44e2bc
push 3
lea ecx, [esp + 0x30]
lea edx, [esp + 0x24]
mov eax, ebp
call fcn.0044de54
push 0
lea eax, [esp + 0xc]
push eax
push 0
lea eax, [ebp + 0x54]
push eax
mov eax, dword [ebp + 8]
call dword [eax + 0x64]
test eax, eax
jne 0x44e283
push 0
mov eax, dword [esp + 0x18]
add eax, dword [esp + 0x24]
add eax, dword [esp + 0x30]
push eax
mov eax, dword [ebp + 0x78]
push eax
mov eax, dword [ebp + 0x50]
push eax
call sub.wsock32.dll_send
test eax, eax
jg 0x44e287
xor ebx, ebx
jmp 0x44e2a1
mov bl, 1
jmp 0x44e2a1
push 0
push esi
mov eax, dword [esp + 8]
push eax
mov eax, dword [ebp + 0x50]
push eax
call sub.wsock32.dll_send
test eax, eax
setg bl
add dword [esp], esi
sub edi, esi
test bl, bl
je 0x44e2b2
test edi, edi
ja 0x44e1c3
mov eax, ebx
add esp, 0x64
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x48f910
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x48fa1b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebx], edx
lea eax, [ebx + 4]
mov edx, esi
call sub.rtl250.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
lea eax, [ebx + 0xc]
mov edx, dword [0x431c24]
call sub.rtl250.bpl__System__FinalizeRecord_qqrpvt1
mov edi, eax
xor eax, eax
mov ecx, 8
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
call sub.rtl250.bpl__System_Variants_Null_qqrv
lea edx, [ebp - 0x10]
lea eax, [ebx + 0x30]
call sub.rtl250.bpl__System_Variants__OleVarFromVar_qqrr8TVarDatarx8TVarData
xor eax, eax
mov dword [ebx + 0x40], eax
xor eax, eax
mov dword [ebx + 0x44], eax
mov eax, dword [ebp + 8]
call sub.rtl250.bpl__System__DynArrayLength_qqrpxv
dec eax
jle 0x48f9ec
mov eax, dword [ebp + 8]
call sub.rtl250.bpl__System__DynArrayLength_qqrpxv
dec eax
push eax
lea eax, [ebx + 8]
mov ecx, 1
mov edx, dword [0x48f584]
call sub.rtl250.bpl__System__DynArraySetLength_qqrv
add esp, 4
mov eax, dword [ebx + 8]
call sub.rtl250.bpl__System__DynArrayLength_qqrpxv
mov edi, eax
dec edi
test edi, edi
jl 0x48f9fa
inc edi
xor esi, esi
mov eax, dword [ebx + 8]
call sub.rtl250.bpl__System__DynArrayLength_qqrpxv
sub eax, esi
add eax, eax
mov edx, dword [ebx + 8]
lea eax, [edx + eax*8 - 0x10]
push eax
lea eax, [esi + esi*2]
mov edx, dword [ebp + 8]
lea eax, [edx + eax*8 + 0x18]
lea edx, [ebp - 0x20]
call sub.rtl250.bpl__System_Rtti_TValue_AsVariant_qqrv
lea edx, [ebp - 0x20]
pop eax
call sub.rtl250.bpl__System_Variants__OleVarFromVar_qqrr8TVarDatarx8TVarData
inc esi
dec edi
jne 0x48f9b7
jmp 0x48f9fa
lea eax, [ebx + 8]
mov edx, dword [0x48f584]
call sub.rtl250.bpl__System__DynArrayClear_qqrrpvpv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48fa22
lea eax, [ebp - 0x20]
mov edx, dword [sym.imp.rtl250.bpl___xp_14System_Variant]
mov ecx, 2
call sub.rtl250.bpl__System__FinalizeArray_qqrpvt1ui
ret
Function at 0x401fd0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x405ec0
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x409008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
mov esi, dword [ebp + 8]
xor edx, edx
mov dword [ebp - 0x18], 0
mov ebx, 7
mov dword [ebp - 0x18], edx
xor eax, eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x14], ebx
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
test esi, esi
je 0x40204f
mov ecx, esi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x402030
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.00402840
mov ebx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
cmp ebx, 8
push 0xe
cmovae ecx, edi
push ecx
call fcn.00402990
add esp, 8
test eax, eax
je 0x402074
mov esi, 1
jmp 0x402162
push str.D41CCB83_DD39_44DC_B7B2_8565A98334B6
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ecx, dword [ebp - 0x2c]
mov dword [ecx + 8], eax
test eax, eax
jne 0x402095
or esi, 0xffffffff
jmp 0x402162
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4020bc
mov esi, dword [ebp - 0x2c]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0
xor esi, esi
jmp 0x402162
mov edx, esi
mov dword [ebp - 0x34], 0
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 7
mov word [ebp - 0x44], ax
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4020e3
sub edx, ecx
lea ecx, [ebp - 0x44]
sar edx, 1
push edx
push esi
call fcn.00402840
mov byte [ebp - 4], 1
lea eax, [ebp - 0x44]
mov ecx, dword [ebp - 0x2c]
push eax
call fcn.004021e0
mov esi, eax
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x30]
cmp edx, 8
jb 0x40214e
mov ecx, dword [ebp - 0x44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x402144
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x402144
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.0040494f
add esp, 8
xor eax, eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 7
mov word [ebp - 0x44], ax
mov dword [ebp - 4], 0xffffffff
cmp ebx, 8
jb 0x40219f
lea ecx, [ebx*2 + 2]
mov eax, edi
cmp ecx, 0x1000
jb 0x402195
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x402195
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edi
call fcn.0040494f
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
mov eax, esi
mov dword [ebp - 0x14], 7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040490e
mov esp, ebp
pop ebp
ret 4
Function at 0x83ab80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x268000]
push edi
jmp 0x83ab9a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x83aba1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x83ab90
mov eax, 1
add ebx, ebx
jne 0x83abb3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x83abc4
jne 0x83abe3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x83abe3
dec eax
add ebx, ebx
jne 0x83abd0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x83aba8
add ebx, ebx
jne 0x83abdf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x83ac35
xor ecx, ecx
sub eax, 3
jb 0x83abfb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x83ac6a
sar eax, 1
mov ebp, eax
jmp 0x83ac06
add ebx, ebx
jne 0x83ac06
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x83abd4
inc ecx
add ebx, ebx
jne 0x83ac14
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x83abd4
add ebx, ebx
jne 0x83ac21
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x83ac16
jne 0x83ac32
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x83ac16
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x83ac54
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x83ac46
jmp 0x83ab96
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x83ac54
add edi, ecx
jmp 0x83ab96
pop esi
mov edi, esi
mov ecx, 0x970a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x83ac72
cmp byte [edi], 0x24
jne 0x83ac72
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x83ac77
lea edi, [esi + 0x428000]
mov eax, dword [edi]
or eax, eax
je 0x83acef
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x47de14]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x47dfa4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x83aca4
mov ecx, edi
jns 0x83acd3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x47dfa8]
or eax, eax
je 0x83ace9
mov dword [ebx], eax
add ebx, 4
jmp 0x83acc1
call dword [esi + 0x47dfb8]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x83ad20
cmp al, 0xef
ja 0x83ad13
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x83acf5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x83ad02
mov ebp, dword [esi + 0x47dfac]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x83ad54
sub esp, 0xffffff80
jmp 0x50fe4f
Function at 0x403e02
Capabilities:
Hash data using sha256
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x180
lea eax, [esp + 0xe8]
xorps xmm0, xmm0
mov dword [esp + 0xc], ecx
movsd qword [eax + 0x38], xmm0
movsd qword [eax + 0x30], xmm0
movsd qword [eax + 0x28], xmm0
movsd qword [eax + 0x20], xmm0
movsd qword [eax + 0x18], xmm0
movsd qword [eax + 0x10], xmm0
movsd qword [eax + 8], xmm0
movsd qword [eax], xmm0
push 8
pop ecx
lea eax, [esp + 0xc0]
mov esi, 0x42ba10
mov ebx, dword [ebp + 8]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x50], eax
and dword [eax + 0x24], 0
and dword [eax + 0x20], 0
mov byte [eax + 0x68], 0
cmp ebx, 0x3f
ja 0x403eb0
mov edi, edx
xor ecx, ecx
lea edx, [esp + 0xe8]
push 0x42b4ec
push 0x40
call fcn.0040129f
pop ecx
pop ecx
mov esi, edx
mov ecx, ebx
mov edx, eax
push 0x42b4fc
push esi
call fcn.004010ef
pop ecx
pop ecx
mov ecx, eax
push 0x42b50c
push ebx
push edi
call fcn.0040a453
add esp, 0xc
jmp 0x403ef4
mov edi, ebx
mov esi, ebx
shr ebx, 6
lea ecx, [esp + 0x50]
and edi, 0xffffffc0
and esi, 0x3f
add edi, edx
push ebx
call fcn.00403137
pop eax
mov ecx, esi
lea edx, [esp + 0xe8]
push 0x42b4cc
push 0x40
call fcn.004010ef
pop ecx
pop ecx
mov ecx, eax
push 0x42b4dc
push esi
push edi
call fcn.0040a453
add esp, 0xc
mov ebx, esi
lea esi, [esp + 0xc0]
mov byte [esi + 0x68], bl
push 0x1c
pop ecx
lea eax, [esp + 0x50]
xorps xmm0, xmm0
mov edi, eax
rep movsd dword es:[edi], dword [esi]
lea esi, [esp + 0x78]
mov dword [esp], eax
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
movaps xmmword [esp + 0x40], xmm0
movaps xmmword [esp + 0x30], xmm0
movzx eax, byte [esi + 0x40]
mov ebx, dword [esi - 8]
mov edi, dword [esi - 4]
mov edx, esi
lea ecx, [eax*8]
mov byte [esp + eax + 0x78], 0x80
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
lea ecx, [eax + 1]
push 0x42b51c
push 0x40
call fcn.0040129f
pop ecx
pop ecx
test edx, edx
je 0x403f63
mov byte [eax], 0
inc eax
dec edx
jmp 0x403f58
shld edi, ebx, 9
shl ebx, 9
mov eax, dword [esp + 8]
or ebx, dword [esp + 4]
bswap edi
not eax
bswap ebx
test al, 0x38
jne 0x403fac
mov ecx, esp
mov edx, esi
call fcn.0040314c
xorps xmm0, xmm0
lea edx, [esp + 0x130]
mov ecx, esp
movsd qword [edx + 0x30], xmm0
xorps xmm0, xmm0
movaps xmmword [edx + 0x20], xmm0
movaps xmmword [edx + 0x10], xmm0
movaps xmmword [edx], xmm0
mov dword [edx + 0x3c], ebx
mov dword [edx + 0x38], edi
jmp 0x403fbe
mov dword [esp + 0xb0], edi
mov dword [esp + 0xb4], ebx
mov ecx, esp
mov edx, esi
call fcn.0040314c
mov byte [esp + 0xb8], 0
push 0xffffffffffffffe0
pop eax
mov ecx, dword [esp]
test eax, eax
je 0x403fe4
mov edx, dword [ecx + eax + 0x20]
bswap edx
mov dword [esp + eax + 0x50], edx
add eax, 4
jmp 0x403fd1
movaps xmm0, xmmword [esp + 0x30]
movaps xmm1, xmmword [esp + 0x40]
mov eax, dword [esp + 0xc]
movaps xmmword [esp + 0x10], xmm0
movaps xmmword [esp + 0x20], xmm1
movsd xmm0, qword [esp + 0x10]
movsd xmm1, qword [esp + 0x18]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x404c58
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x58
lea esi, [ebp - 0x18]
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp + 8]
mov dword [esi - 4], esp
or dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0x41b5c0
mov ecx, dword fs:[0]
mov dword [esi], ecx
mov dword fs:[0], esi
and dword [ebp - 0x34], 0
lea ecx, [ebp - 0x58]
push eax
call fcn.0040405b
pop eax
and dword [esi + 8], 0
sub esp, 4
and dword [esp], 0
xor edx, edx
lea ecx, [ebp - 0x4c]
inc edx
call fcn.0040405b
pop eax
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x10], 1
lea ecx, [ebp - 0x40]
push eax
call fcn.0040405b
pop eax
mov ecx, dword [ebp - 0x54]
lea eax, [ebp - 0x34]
mov dword [ebp - 0x10], 2
push 0
push eax
push 0
push 0x20106
push 0
push 0
push 0
mov dword [ebp - 0x30], ecx
push ecx
push 0x80000001
call sub.advapi32.dll_RegCreateKeyExW
test eax, eax
je 0x404d23
sub esp, 4
and dword [esp], 0
xor edx, edx
lea ecx, [ebp - 0x64]
inc edx
call fcn.00409c4b
pop eax
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x24]
movsd xmm0, qword [ebp - 0x64]
mov edx, dword [ebp - 0x3c]
mov esi, dword [ebp - 0x48]
mov dword [ecx + 8], eax
movsd qword [ecx], xmm0
jmp 0x404dac
mov eax, dword [ebp - 0x38]
mov esi, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x48]
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x10], 3
add eax, eax
push eax
mov dword [ebp - 0x28], edx
push edx
push 1
push 0
mov dword [ebp - 0x2c], ecx
push ecx
mov dword [ebp - 0x20], esi
push esi
call sub.advapi32.dll_RegSetValueExW
test eax, eax
je 0x404d8e
sub esp, 4
and dword [esp], 0
xor edx, edx
lea ecx, [ebp - 0x64]
inc edx
call fcn.00409c4b
pop eax
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x24]
movsd xmm0, qword [ebp - 0x64]
mov dword [ebp - 0x10], 2
mov dword [ecx + 8], eax
movsd qword [ecx], xmm0
push dword [ebp - 0x20]
call sub.advapi32.dll_RegCloseKey
mov esi, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x28]
jmp 0x404dac
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], 2
mov dword [eax], 0x80000000
push dword [ebp - 0x20]
call sub.advapi32.dll_RegCloseKey
mov esi, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x40]
call fcn.004133b5
mov ecx, dword [ebp - 0x4c]
mov edx, esi
call fcn.004133b5
mov ecx, dword [ebp - 0x58]
mov edx, dword [ebp - 0x30]
call fcn.004133b5
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x58
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x404e33
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x150
lea eax, [ebp - 0x18]
lea esi, [ebp - 0x158]
mov dword [eax - 4], esp
or dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x41b5d0
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
push 0xc8
push 0
push esi
call fcn.0041cb50
add esp, 0xc
xorps xmm0, xmm0
lea eax, [0x421418]
lea edx, [ebp - 0x40]
mov dword [esi - 4], 0xcc
mov dword [esi + 0x28], 1
mov dword [edx], eax
movups xmmword [ebp - 0x5c], xmm0
lea eax, [ebp - 0x40]
mov ecx, dword [edx]
mov dword [edx], 0x494584bc
mov edx, dword [eax]
call fcn.004029aa
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [ebp - 0x90], xmm0
movups xmmword [ebp - 0x80], xmm0
movups xmmword [ebp - 0x70], xmm0
cmp ecx, 0x2f
ja 0x404ed5
mov edx, dword [ecx + 0x42bbe9]
xor edx, dword [eax + ecx]
mov dword [ebp + ecx - 0x90], edx
add ecx, 4
jmp 0x404ebb
movzx ecx, byte [eax + 0x32]
movzx eax, word [eax + 0x30]
or dword [ebp - 0x10], 0xffffffff
lea edx, [ebp - 0x90]
lea esi, [ebp - 0x4c]
xor eax, 0x9d23
xor cl, 0x64
mov word [edx + 0x30], ax
mov byte [edx + 0x32], cl
mov ecx, esi
push 0x33
call fcn.00409c4b
pop eax
mov ecx, dword [esi + 4]
mov eax, dword [esi + 8]
lea edx, [ebp - 0x40]
and dword [ebp - 0x10], 0
add eax, ecx
mov dword [edx + 4], ecx
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x30]
mov dword [edx + 8], eax
and word [edx + 0xc], 0
mov dword [edx], 1
call fcn.00401fbe
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x10], 1
lea ecx, [ebp - 0x15c]
push eax
push ecx
push 0
push 0
push 0x8000000
push 0
push 0
push 0
mov dword [ebp - 0x20], edx
push edx
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x404f8b
push dword [ebp - 0x5c]
call sub.kernel32.dll_CloseHandle
push dword [ebp - 0x58]
call sub.kernel32.dll_CloseHandle
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x20]
call fcn.004133b5
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x24]
call fcn.00409bc0
xor esi, esi
jmp 0x404fd4
sub esp, 4
and dword [esp], 0
xor edx, edx
lea ecx, [ebp - 0x40]
inc edx
call fcn.00409c4b
pop eax
push 4
pop ecx
push 0xc
pop edx
call fcn.00409aed
test eax, eax
je 0x404fea
mov ecx, dword [ebp - 0x38]
mov esi, eax
mov dword [esi + 8], ecx
movsd xmm0, qword [ebp - 0x40]
movsd qword [esi], xmm0
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
call fcn.004133b5
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x48]
call fcn.00409bc0
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x150
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 2
push 4
pop ecx
push 0xc
pop edx
call fcn.00429e6b
ud2

Function at 0x405043
Capabilities:
Check os version

Disassembly:
push esi
sub esp, 0x11c
lea esi, [esp + 4]
push 0x118
push 0
push esi
call fcn.0041cb50
add esp, 0xc
mov eax, esp
mov dword [esi - 4], 0x11c
push eax
call sub.kernel32.dll_GetVersionExW
test eax, eax
je 0x40508b
mov ecx, dword [esp + 4]
mov al, 1
cmp ecx, 5
jbe 0x40508d
cmp ecx, 6
jne 0x40508b
cmp dword [esp + 8], 2
setb al
jmp 0x40508d
xor eax, eax
add esp, 0x11c
pop esi
ret