joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4058f0
Capabilities:
Create process on windows

Disassembly:
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
mov eax, 0x30c30c31
imul ecx
sub esp, 0x30
sar edx, 4
push ebx
mov eax, edx
shr eax, 0x1f
push ebp
xor ebx, ebx
add eax, edx
push edi
je 0x405b1f
xor edi, edi
mov dword [esp + 0xc], edi
jmp 0x405924
mov edi, dword [esp + 0xc]
cmp edi, 0x1a4
jae 0x405b1f
cmp ebx, eax
jb 0x405939
call fcn.005e0402
mov eax, dword [esi + 0xc]
lea eax, [edi + eax + 0x38]
mov ebp, 0x10
cmp dword [eax + 0x18], ebp
jb 0x40594f
mov eax, dword [eax + 4]
jmp 0x405952
add eax, 4
fld dword [esp + 0x44]
mov edx, dword [0x8f5db8]
push eax
lea ecx, [esp + 0x20]
push ecx
sub esp, 8
fstp dword [esp + 4]
mov dword [esp + 0x2c], 0xfff3b656
fld dword [esp + 0x50]
fadd qword [0x6e18e8]
fstp dword [esp + 0x28]
fld dword [esp + 0x28]
fstp dword [esp]
push edx
call fcn.005c29b0
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
mov eax, 0x30c30c31
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
add esp, 0x14
cmp ebx, eax
jb 0x4059af
call fcn.005e0402
mov eax, dword [esi + 0xc]
add eax, edi
cmp dword [eax + 0x18], ebp
jb 0x4059be
mov ebp, dword [eax + 4]
jmp 0x4059c1
lea ebp, [eax + 4]
mov edi, dword [0x8f5db8]
push ebp
call fcn.00404020
fld dword [esp + 0x44]
fstp dword [esp + 0x2c]
mov dword [esp + 0x24], eax
fld dword [esp + 0x48]
mov dword [esp + 0x28], edx
fstp dword [esp + 0x30]
add esp, 4
fild dword [esp + 0x20]
lea ecx, [esp + 0x28]
mov dword [esp + 0x10], 0xffffffff
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
fstp dword [esp + 0x30]
fild dword [esp + 0x24]
fstp dword [esp + 0x18]
fld dword [esp + 0x18]
fstp dword [esp + 0x34]
call fcn.00402ea0
test al, al
je 0x405ac0
fld1
push 0
push 0
lea ecx, [esp + 0x18]
push ecx
sub esp, 0x10
fstp dword [esp + 0xc]
mov dword [esp + 0x2c], 0xffffd800
fld dword [esp + 0x30]
fstp dword [esp + 8]
fld dword [esp + 0x34]
fadd dword [esp + 0x60]
fstp dword [esp + 0x34]
fld dword [esp + 0x34]
fstp dword [esp + 4]
fld dword [esp + 0x5c]
fstp dword [esp]
call fcn.005c6b20
add esp, 0x1c
cmp dword [0x8f5dcc], 0
je 0x405ac0
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
mov eax, 0x30c30c31
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jb 0x405a8f
call fcn.005e0402
mov ecx, dword [esi + 0xc]
mov edx, dword [esp + 0xc]
cmp dword [edx + ecx + 0x34], 0x10
lea eax, [edx + ecx + 0x1c]
jb 0x405aa6
mov eax, dword [eax + 4]
jmp 0x405aa9
add eax, 4
push 5
push 0
push 0x6df002
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
fld dword [esp + 0x44]
mov ecx, dword [0x8f5db8]
push ebp
push 0x6d4ce0
lea eax, [esp + 0x18]
push eax
sub esp, 8
fstp dword [esp + 4]
fld dword [esp + 0x54]
fstp dword [esp]
push ecx
call fcn.005c29b0
fld dword [esp + 0x5c]
mov ecx, dword [esi + 0x10]
fadd qword [0x6e18e0]
sub ecx, dword [esi + 0xc]
add dword [esp + 0x24], 0x54
mov eax, 0x30c30c31
fstp dword [esp + 0x5c]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
inc ebx
add eax, edx
add esp, 0x18
cmp ebx, eax
jb 0x405920
pop edi
pop ebp
pop ebx
add esp, 0x30
ret
Function at 0x405e10
Capabilities:
Set registry value

Disassembly:
sub esp, 0x28
push esi
push edi
push 0
lea eax, [esp + 0xc]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
mov edi, 0x7a4b8b0b
lea esi, [esp + 0x28]
call fcn.00406f70
push eax
push bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
pop edi
pop esi
test eax, eax
je 0x405e4f
xor al, al
add esp, 0x28
ret
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x405e54
mov ecx, dword [esp]
sub eax, edx
inc eax
push eax
push ebx
push 1
push 0
push str.LoginToken
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x405e49
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
add esp, 0x28
ret

Function at 0x405e90
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x24
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
lea eax, [esp + 0xc]
push eax
push 0x20
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea ecx, [esp + 0x10]
push ecx
push 0x6def40
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
push 0
push 0
push 0
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x2c], edx
mov edx, dword [esp + 0x1c]
push 0
push edx
mov dword [esp + 0x30], 1
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x405eff
push eax
call fcn.005e01d9
mov eax, dword [esp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
push esi
call edi
pop edi
pop esi
add esp, 0x24
ret

Function at 0x405f20
Capabilities:
Acquire debug privileges
Terminate process

Disassembly:
sub esp, 0x24
lea eax, [esp + 4]
push eax
push 0x20
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x405fa4
lea ecx, [esp + 8]
push ecx
push 0x6def40
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x405fa4
mov edx, dword [esp + 8]
mov eax, dword [esp + 0xc]
push 0
push 0
push 0
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0x14]
push 0
push edx
mov dword [esp + 0x28], 1
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x405fa4
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x24
ret
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40a8f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6315a0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x70ee84]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
cmp dword [esi + 0x20dec], 0
je 0x40a947
push 0
push 0x34b
push str..Updater.cpp
push str.status___STATUS_Checking
call fcn.005b9260
add esp, 0x10
mov ecx, esi
call fcn.00408f90
call fcn.00409180
test al, al
je 0x40a972
mov ecx, esi
call fcn.004091f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, esi
mov byte [esi + 0x98], 1
call fcn.00409480
mov dword [esi + 0x20dec], eax
lea eax, [esi + 0x20df5]
push 0x6df002
push eax
call fcn.00401ac0
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 8
mov ebx, 5
jmp 0x40a9b0
cmp dword [esi + 0x20dec], ebx
jne 0x40aab0
mov ecx, dword [esi + 0x217d0]
mov eax, dword [0x8f68c8]
or eax, dword [0x8f68cc]
mov dword [0x8f68b8], ecx
mov edx, dword [esi + 0x217d4]
mov dword [0x8f68bc], edx
je 0x40aa09
call fcn.00402d90
test al, al
je 0x40aa09
push 0
push 0
push 0x8f68b8
push 0x402a50
push 0
push 0
call fcn.005df7d7
add esp, 0x18
mov dword [0x8f6a80], eax
call fcn.004094e0
call fcn.00409630
mov ecx, dword [esi + 0x1c]
mov eax, dword [esi + 0x5e4]
push ecx
push eax
push str.current_build_version_d__updater_data_version_d_n
call fcn.005b8f50
mov eax, dword [esi + 0x5e4]
add esp, 0xc
cmp eax, dword [esi + 0x1c]
jne 0x40aa3d
mov eax, esi
call fcn.0040a820
mov ebx, esi
call fcn.004098d0
mov ecx, esi
call fcn.00409fb0
call fcn.0040a780
push str.Validating_game_data_n
call fcn.005b8f50
add esp, 4
lea edx, [esi + 0x20df5]
push str.Validating_game_data
push edx
call fcn.00401ac0
add esp, 8
lea eax, [esi + 0x21600]
push eax
lea ecx, [esi + 0x215f8]
push ecx
push 0
lea ecx, [esi + 0x4e0]
call fcn.005cad80
test al, al
jne 0x40aa9c
push str.Game_data_is_damaged__please_restart_launcher_to_repair_damaged_files
mov eax, esi
call fcn.00408f30
push str.Validating_game_data___finished_n
call fcn.005b8f50
add esp, 4
mov eax, esi
call fcn.0040a820
push 0x32
call edi
jmp 0x40a9b0

Function at 0x40b810
Capabilities:
Create thread

Disassembly:
push esi
lea esi, [edi + 0x21638]
call fcn.00408520
push 0
push 0
push edi
push 0x40b450
push 0
push 0
call fcn.005df7d7
add esp, 0x18
mov dword [edi + 0x21630], eax
pop esi
ret

Function at 0x40b980
Capabilities:
Create thread

Disassembly:
lea edx, [edi + 0x219e8]
mov eax, edx
push esi
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40b990
sub eax, esi
pop esi
cmp eax, 0x13
je 0x40b9c7
mov eax, edx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40b9a4
sub eax, edx
cmp eax, 0x1d
je 0x40b9c7
push 0
push str.Create_Account
push str.Please_enter_Serial_Key_in_following_format:_nXXXX_XXXX_XXXX_XXXX_or_XXXXX_XXXXX_XXXXX_XXXXX_XXXXX
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
ret
push 0
push 0
push edi
push 0x40b840
push 0
push 0
call fcn.005df7d7
add esp, 0x18
mov dword [edi + 0x21630], eax
ret
Function at 0x40bd40
Capabilities:
Create thread

Disassembly:
lea eax, [edi + 0x217e4]
mov ecx, eax
push esi
lea esi, [ecx + 1]
lea esp, [esp]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x40bd50
sub ecx, esi
pop esi
cmp ecx, 4
jae 0x40bd7e
push 0
push str.Create_Account
push str.email_address_is_too_short
push 0
mov dword [edi + 0x217e0], 0
call dword [sym.imp.USER32.dll_MessageBoxA]
ret
call fcn.0040ba00
test eax, eax
jne 0x40bda0
push eax
push str.Create_Account
push str.email_address_is_not_valid
push eax
mov dword [edi + 0x217e0], eax
call dword [sym.imp.USER32.dll_MessageBoxA]
ret
lea ecx, [edi + 0x218e4]
lea eax, [edi + 0x21864]
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40bdd0
test dl, dl
je 0x40bdcc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40bdd0
add eax, 2
add ecx, 2
test dl, dl
jne 0x40bdb0
xor eax, eax
jmp 0x40bdd5
sbb eax, eax
sbb eax, 0xffffffff
push 0
test eax, eax
je 0x40bdf8
push str.Create_Account
push str.Passwords_do_not_match
push 0
mov dword [edi + 0x217e0], 0
call dword [sym.imp.USER32.dll_MessageBoxA]
ret
push 0
push edi
push 0x40b9f0
push 0
push 0
call fcn.005df7d7
add esp, 0x18
mov dword [edi + 0x21630], eax
ret

Function at 0x40bf90
Capabilities:
Create thread

Disassembly:
cmp dword [esi + 0x21618], 0
je 0x40bfb2
push 0
push 0x5d5
push str..Updater.cpp
push str.mainThread___NULL
call fcn.005b9260
add esp, 0x10
cmp dword [esi + 0x21630], 0
je 0x40bfd4
push 0
push 0x5d6
push str..Updater.cpp
push str.loginThread___NULL
call fcn.005b9260
add esp, 0x10
push 0
push 0
push esi
push 0x40ab80
push 0
push 0
call fcn.005df7d7
push 0
push 0
push esi
push 0x40b430
push 0
push 0
mov dword [esi + 0x21618], eax
call fcn.005df7d7
push 0
push 0
push esi
push 0x40b440
push 0
push 0
mov dword [esi + 0x21cf8], eax
call fcn.005df7d7
add esp, 0x48
mov dword [esi + 0x21628], eax
ret

Function at 0x40c0b0
Capabilities:
Terminate thread

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push str.CUpdater::Stop___n
mov esi, eax
call fcn.005b8f50
xor ebx, ebx
add esp, 4
cmp byte [esi + 0x20df4], bl
jne 0x40c0d4
mov eax, dword [esi + 0x21620]
mov edi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x8d8f7c
call edi
lea eax, [esi + 0x20dd4]
push eax
mov dword [esp + 0x14], eax
call edi
mov eax, dword [esi + 0x21618]
mov edi, dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, ebx
je 0x40c117
push ebx
push eax
call edi
mov ecx, dword [esi + 0x21618]
push ecx
call ebp
mov dword [esi + 0x21618], ebx
mov eax, dword [esi + 0x21cf8]
cmp eax, ebx
je 0x40c134
push ebx
push eax
call edi
mov edx, dword [esi + 0x21cf8]
push edx
call ebp
mov dword [esi + 0x21cf8], ebx
mov eax, dword [esi + 0x21630]
cmp eax, ebx
je 0x40c151
push ebx
push eax
call edi
mov eax, dword [esi + 0x21630]
push eax
call ebp
mov dword [esi + 0x21630], ebx
mov eax, dword [esi + 0x21628]
cmp eax, ebx
je 0x40c16e
push ebx
push eax
call edi
mov ecx, dword [esi + 0x21628]
push ecx
call ebp
mov dword [esi + 0x21628], ebx
mov edx, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push edx
call esi
push 0x8d8f7c
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x40e250
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
sub esp, 8
push esi
push edi
push 0x11
mov dword [esp + 0xc], 4
call fcn.005e0b23
mov edi, eax
push 0x288
mov dword [esp + 0x14], edi
call fcn.005e0b23
mov esi, eax
add esp, 8
test esi, esi
jne 0x40e28a
push str.Error_allocating_memory_needed_to_call_GetAdaptersinfo_n
call fcn.005e0bed
add esp, 4
lea eax, [esp + 8]
push eax
push esi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
jne 0x40e2ba
mov ecx, dword [esp + 8]
push ecx
call fcn.005e0b23
mov esi, eax
add esp, 4
test esi, esi
jne 0x40e2ba
push str.Error_allocating_memory_needed_to_call_GetAdaptersinfo_n
call fcn.005e0bed
add esp, 4
lea edx, [esp + 8]
push edx
push esi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x40e325
movzx eax, byte [esi + 0x199]
movzx ecx, byte [esi + 0x198]
movzx edx, byte [esi + 0x197]
push eax
movzx eax, byte [esi + 0x196]
push ecx
movzx ecx, byte [esi + 0x195]
push edx
movzx edx, byte [esi + 0x194]
push eax
push ecx
push edx
lea eax, [esp + 0x24]
push str._02X:_02X:_02X:_02X:_02X:_02X
push eax
call fcn.0040f250
push edi
add esi, 0x1b0
push esi
push str.Address:__s__mac:__s_n
call fcn.005e0bed
add esp, 0x2c
mov eax, edi
pop edi
pop esi
add esp, 8
ret
push esi
call fcn.005e0cb2
add esp, 4
pop edi
xor eax, eax
pop esi
add esp, 8
ret

Function at 0x40e980
Capabilities:
Set registry value

Disassembly:
sub esp, 0x28
push esi
push edi
push 0
lea eax, [esp + 0xc]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
mov edi, 0x1d50547a
lea esi, [esp + 0x28]
call fcn.0040f0a0
push eax
push bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
pop edi
pop esi
test eax, eax
jne 0x40e9e9
mov eax, ebx
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40e9c0
mov ecx, dword [esp]
sub eax, edx
inc eax
push eax
push ebx
push 1
push 0
push str.username
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 0x28
ret

Function at 0x40e9f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x2c
push esi
push edi
lea eax, [esp + 8]
push eax
push 0xf003f
push 0
mov edi, 0x1d50547a
lea esi, [esp + 0x1c]
call fcn.0040f0a0
push eax
push bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
pop edi
pop esi
test eax, eax
jne 0x40ea4f
mov edx, dword [esp + 0x30]
lea ecx, [esp + 4]
push ecx
push edx
push eax
push eax
mov eax, dword [esp + 0x10]
push str.username
push eax
mov dword [esp + 0x1c], 0x80
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
add esp, 0x2c
ret 4
Function at 0x40ea60
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x60
push esi
push edi
lea eax, [esp + 8]
push eax
push 0x20019
mov edi, str.JBVAQFZLVOIM_YAFZ__JDajnqASjLUKEQKESAFDjHL_UCn
push 0
sub edi, 0x2757e3bf
lea esi, [esp + 0x1f]
call fcn.0040f0e0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
setne al
pop edi
pop esi
test al, al
jne 0x40ead1
mov edx, dword [esp + 0x64]
mov eax, dword [esp]
lea ecx, [esp + 4]
push ecx
add edx, 0x132
push edx
push 0
push 0
push str.Identifier
push eax
mov dword [esp + 0x1c], 0x32
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
add esp, 0x60
ret 4

Function at 0x40eae0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x60
push ebx
push esi
push edi
mov edi, str._bhgp_vHn_T__W__3_
sub edi, 0x6ad66049
lea esi, [esp + 0x15]
mov ebx, eax
call fcn.0040f120
lea ecx, [esp + 0xc]
push ecx
push 0xf003f
push 0
push eax
push bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40eb26
call fcn.0040eb70
pop edi
pop esi
mov al, 1
pop ebx
add esp, 0x60
ret
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
add ebx, 0x100
push ebx
push 0
push 0
push str.hardwareid
push eax
mov dword [esp + 0x28], 0x32
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov al, 1
pop ebx
add esp, 0x60
ret

Function at 0x40eb70
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x230
mov eax, dword [0x70ee84]
xor eax, esp
mov dword [esp + 0x22c], eax
push esi
push edi
mov edi, 0x1c1dd2a7
lea esi, [esp + 0x11]
call fcn.0040f160
push 0
lea ecx, [esp + 0x10]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push eax
push bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40ec2b
push 0x1c8
push eax
lea edx, [esp + 0x70]
push edx
call fcn.005e3040
add esp, 0xc
lea eax, [esp + 0x68]
call fcn.004021c0
mov eax, dword [esp + 0x7c]
mov ecx, dword [esp + 0x78]
push eax
push ecx
lea esi, [ebx + 0x100]
push str.0x_I64x
mov edx, esi
call fcn.0040f1a0
mov eax, esi
add esp, 0xc
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40ec00
sub eax, edx
mov edx, dword [esp + 0xc]
inc eax
push eax
push esi
push 1
push 0
push str.hardwareid
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x234]
pop edi
pop esi
xor ecx, esp
call fcn.005dee98
mov esp, ebp
pop ebp
ret
Function at 0x40ec40
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x40
push esi
push edi
lea eax, [esp + 8]
push eax
push 0x20019
mov edi, 0x6e0f90
push 0
sub edi, 0x30964fd9
lea esi, [esp + 0x1d]
call fcn.0040f1c0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
setne al
pop edi
pop esi
test al, al
jne 0x40ecb1
mov edx, dword [esp + 0x44]
mov eax, dword [esp]
lea ecx, [esp + 4]
push ecx
add edx, 0x164
push edx
push 0
push 0
push str.ComputerName
push eax
mov dword [esp + 0x1c], 0x32
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
add esp, 0x40
ret 4

Function at 0x40f0e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, 2
xor ecx, ecx
jmp 0x40f0f0
mov al, byte [edi + ecx + 0x2757e3bf]
xor al, dl
inc edx
and edx, 0x800000ff
mov byte [ecx + esi], al
jns 0x40f10d
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 0x54
jl 0x40f0f0
mov byte [esi + 0x54], 0
mov eax, esi
ret
Function at 0x490d60
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c4
mov eax, dword [0x70ee84]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x1c4], 0x190
lea eax, [ebp - 0x1c4]
push eax
lea ecx, [ebp - 0x1c0]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x490da1
mov byte [ebp - 0x1c0], 0
lea edx, [ebp - 0x1c0]
push edx
mov ecx, dword [ebp + 8]
call fcn.00479520
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.005dee98
mov esp, ebp
pop ebp
ret

Function at 0x490de0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x70ee84]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x84], 0x76
lea eax, [ebp - 0x84]
push eax
lea ecx, [ebp - 0x80]
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
jne 0x490e21
mov byte [ebp - 0x80], 0
lea edx, [ebp - 0x80]
push edx
mov ecx, dword [ebp + 8]
call fcn.00479520
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005dee98
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x62c984
leave
bound eax, qword [eax]
push eax
push dword fs:[0]
mov dword fs:[0], esp
xor eax, eax
mov dword [eax], ecx
push eax
inc ebp
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x401080
arpl word [edx + esi], si
adc ebx, dword [edi - 0x54]
xchg ebx, eax
neg dl
push cs
dec ecx
mov eax, 0x7fb97088
add ah, ah
aam 0xeb
jp 0x40109d
mov byte [eax - 0x47], dh
jg 0x401033
mov ecx, 0xd4e4027f
in al, 0xd4
jmp 0x4010af
test eax, 0xcf33638c
adc ch, bl
js 0x400fd0
sbb ch, ah
daa
stosd dword es:[edi], eax
mov dword [0x540fb128], eax
xchg edi, eax
inc ecx
and dword [esi + esi*8 - 0x78], ebp
rcr byte [eax - 0x2e], 0xa4
sti
push ss
scasd eax, dword es:[edi]
jne 0x40108b
jl 0x40102c
salc
pushal
jbe 0x401085
daa
xchg esp, eax
lcall 0xa4e8, 0x1020bb2d
mov ebx, 0xa4e81020
push eax
in eax, dx
xor bl, ah
sti
bnd jg 0x401002
popal
lea ebp, [edx - 0x70bb56c6]
push ds
pop ss
cmp dword [eax + ebx*8 + 0x46], eax
and byte [eax - 0x702274c0], al
pop eax
test al, 0xc5
fisttp qword [edi + 0x3dc5a858]
lahf
mov ah, 0xc2
sub ecx, dword [0x6e1df55c]
cmp eax, 0x2bc2b49f
or eax, 0x6e1df55c
pop esp
cmc
sbb eax, 0x97530b6e
or edx, dword [ebx - 0x69]
in al, 0x34
sub dword [edi], edx
stosd dword es:[edi], eax
loop 0x4010a6
shr byte [edx - 0x45d61c4d], 1
arpl word [edi - 0x278de9a], dx
sub dword [edx + 0x21669763], edi
xchg ebp, edi
jo 0x4010b7
adc byte [ebx - 0x7b], dh
jae 0x40102e
xlatb
in al, dx
scasd eax, dword es:[edi]
rol dword [0xffffd0cf], 1
fisub dword [edx + 0x3d]
xchg edi, eax
xchg ebp, eax
push 0xa7e35ce0
iretd
loopne 0x401115
jecxz 0x401062
jmp 0x4010fb
inc edi
inc ebp
invalid
mov eax, dword [edi]
jmp 0x4010de
push es
aas
dec esp
sbb al, 0xb2
or ecx, esi
pushal
jp 0x40110e
xchg dword [edi], edi
push ebp
arpl word [edx], bx
xchg ebp, eax
and dword [ecx + 0x73], 0x27
push esi
leave
adc bh, byte [0xf1cfcb47]
mov ecx, dword [esi + 0x2afe0d5e]
push ebx
lcall 0x58e9, 0xe192ed67
pop eax
outsb dx, byte [esi]
sub byte [eax + 0x15], ah
mov ecx, 0x775fedc3
test byte [eax + 0x35], ch
setb byte [edi + eax*8 - 0x62]
inc edi
in eax, dx
sub cl, byte [eax - 0x71]
jbe 0x401126
dec edi
iretd
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219