joyce8/EMBER2024-capa huggingface dataset:
Function at 0x442b90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0x2001f
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x442bee
cmp dword [ebp - 8], 0
je 0x442bee
mov eax, dword [ebp + 0x20]
push eax
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0x18]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x443610
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x487b30]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x114
push 0
lea eax, [ebp - 0x120]
push eax
call fcn.00459470
add esp, 0xc
mov dword [ebp - 0x120], 0x114
lea ecx, [ebp - 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
jne 0x44366b
cmp dword [ebp - 0x118], 2
jne 0x44366b
mov eax, 8
jmp 0x443686
cmp dword [ebp - 0x11c], 5
jne 0x443684
cmp dword [ebp - 0x118], 1
jb 0x443684
mov eax, 5
jmp 0x443686
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004567ae
mov esp, ebp
pop ebp
ret

Function at 0x4436d0
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x48ddd8], 0
jne 0x4436f2
push 0
push 0
push 0x4436a0
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x48ddd8], eax
mov eax, dword [0x48ddd8]
pop ebp
ret

Function at 0x443c40
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov dword [edx], 0x67452301
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], 0x10325476
mov esp, ebp
pop ebp
ret

Function at 0x4567ae
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x487b30]
jne 0x4567b8
repz ret
jmp fcn.0045b282
Function at 0x458211
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x458242
call fcn.004597b0
mov dword [eax], esi
call fcn.0045979d
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00456e98
add esp, 0x14
push 0x16
pop eax
jmp 0x458297
test dword [ebp + 0xc], 0xfffffff9
jne 0x45821e
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x45826f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004597c3
pop ecx
call fcn.0045979d
mov eax, dword [eax]
jmp 0x458297
test al, 0x10
jne 0x458295
test al, 1
je 0x458295
test byte [ebp + 0xc], 2
je 0x458295
call fcn.004597b0
mov dword [eax], 5
call fcn.0045979d
mov dword [eax], 0xd
jmp 0x458266
xor eax, eax
pop esi
pop ebp
ret

Function at 0x46532a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0045ac91
and dword [ebp - 4], 0
cmp dword [0x48db58], 0
mov ebx, eax
jne 0x4653db
push 0x473b1c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x46548c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x473b10
push edi
call esi
test eax, eax
je 0x46548c
push eax
call fcn.0045ac1f
mov dword [esp], 0x473b00
push edi
mov dword [0x48db58], eax
call esi
push eax
call fcn.0045ac1f
mov dword [esp], 0x473aec
push edi
mov dword [0x48db5c], eax
call esi
push eax
call fcn.0045ac1f
mov dword [esp], 0x473ad0
push edi
mov dword [0x48db60], eax
call esi
push eax
call fcn.0045ac1f
pop ecx
mov dword [0x48db68], eax
test eax, eax
je 0x4653db
push 0x473ab8
push edi
call esi
push eax
call fcn.0045ac1f
pop ecx
mov dword [0x48db64], eax
mov eax, dword [0x48db64]
cmp eax, ebx
je 0x465433
cmp dword [0x48db68], ebx
je 0x465433
push eax
call fcn.0045ac9a
push dword [0x48db68]
mov esi, eax
call fcn.0045ac9a
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x465433
test edi, edi
je 0x465433
call esi
test eax, eax
je 0x46542a
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x46542a
test byte [ebp - 0xc], 1
jne 0x465433
or dword [ebp + 0x10], 0x200000
jmp 0x46546c
mov eax, dword [0x48db5c]
cmp eax, ebx
je 0x46546c
push eax
call fcn.0045ac9a
pop ecx
test eax, eax
je 0x46546c
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x46546c
mov eax, dword [0x48db60]
cmp eax, ebx
je 0x46546c
push eax
call fcn.0045ac9a
pop ecx
test eax, eax
je 0x46546c
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x48db58]
call fcn.0045ac9a
pop ecx
test eax, eax
je 0x46548c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x46548e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x46c2f7
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x48dc28], 0
push esi
jne 0x46c26a
call fcn.0046c190
test eax, eax
je 0x46c2ad
mov eax, dword [0x48dc28]
cmp eax, 1
jne 0x46c28b
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x46c2ad
pop esi
ret
push eax
call dword [0x48dc30]
test eax, eax
jne 0x46c2f5
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x46c2b1
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x48dc28]
call dword [0x48dc30]
mov edi, eax
test edi, edi
je 0x46c2d6
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x46c2f2
mov edi, esi
add esi, 0xff0
push edi
push dword [0x48dc28]
call dword [0x48dc2c]
add edi, 0x10
cmp edi, esi
jb 0x46c2de
mov eax, edi
pop edi
pop esi
ret
jmp 0x46c257
Function at 0x100032c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001ec5b
mov eax, dword fs:[0]
push eax
sub esp, 0x430
mov eax, dword [0x1002f0ac]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [esi + 0x4bc], 0
jne 0x1000349a
call fcn.100049a0
test eax, eax
je 0x10003415
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.1000d390
mov eax, dword [ebp + 8]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x1000332a
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.10001b40
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.1000d390
mov edi, dword [ebp + 0xc]
add esp, 0x14
cmp dword [edi + 0x14], 8
jb 0x1000335a
mov eax, dword [edi]
jmp 0x1000335c
mov eax, edi
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.10001b40
add esp, 8
cmp dword [edi + 0x10], 0
jne 0x10003385
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.100034c0
jmp 0x1000349a
xor eax, eax
mov dword [ebp - 0x424], 7
mov dword [ebp - 0x428], 0
mov word [ebp - 0x438], ax
push 0x10020394
lea ecx, [ebp - 0x438]
mov dword [ebp - 4], eax
call fcn.100012c0
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x438]
call fcn.10003270
push 0x10020398
lea ecx, [ebp - 0x438]
call fcn.10003270
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x438]
call fcn.10003270
cmp dword [ebp - 0x424], 8
lea eax, [ebp - 0x438]
mov ecx, esi
cmovae eax, dword [ebp - 0x438]
push eax
call fcn.100034c0
lea ecx, [ebp - 0x438]
call fcn.10001200
jmp 0x1000349a
push 0x104
lea edi, [esi + 0xa8]
mov byte [esi + 0x4bc], 1
push 0
push edi
call fcn.1000d390
mov eax, dword [ebp + 8]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x1000343d
mov eax, dword [eax]
push eax
push edi
call fcn.10001b40
push 0x104
lea edi, [esi + 0x2b0]
push 0
push edi
call fcn.1000d390
mov eax, dword [ebp + 0xc]
add esp, 0x14
cmp dword [eax + 0x14], 8
jb 0x10003465
mov eax, dword [eax]
push eax
push edi
call fcn.10001b40
mov eax, dword [ebp + 0x10]
add esp, 8
mov eax, dword [eax]
mov dword [esi + 0x4b8], eax
lea eax, [ebp - 0x43c]
push eax
push 0
push esi
push 0x10003520
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000a58c
mov esp, ebp
pop ebp
ret 0xc

Function at 0x100034c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push 0x44
lea eax, [ebp - 0x54]
push 0
push eax
call fcn.1000d390
add esp, 0xc
mov dword [ebp - 0x54], 0x44
lea eax, [ebp - 0x10]
xorps xmm0, xmm0
movups xmmword [ebp - 0x10], xmm0
push eax
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
push dword [ebp + 8]
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x10003519
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret 4
Function at 0x10003950
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001ed30
mov eax, dword fs:[0]
push eax
sub esp, 0x264
mov eax, dword [0x1002f0ac]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x270], ebx
mov eax, dword [ebp + 8]
test eax, eax
je 0x10003aeb
push eax
lea ecx, [ebp - 0x40]
call fcn.100011a0
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 0
push eax
mov ecx, ebx
call fcn.10004a30
push 0x22c
lea eax, [ebp - 0x26c]
push 0
push eax
call fcn.1000d390
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x10003ad2
lea eax, [ebp - 0x26c]
mov dword [ebp - 0x26c], 0x22c
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x10003acb
nop word [eax + eax]
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
cmp word [ebp - 0x248], ax
je 0x10003a35
lea eax, [ebp - 0x248]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10003a26
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x28]
call fcn.10001920
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
mov ecx, ebx
call fcn.10004a30
cmp dword [ebp - 0x2c], 8
lea ecx, [ebp - 0x40]
push dword [ebp - 0x30]
cmovae ecx, dword [ebp - 0x40]
lea eax, [ebp - 0x28]
mov esi, dword [ebp - 0x14]
cmp esi, 8
mov ebx, dword [ebp - 0x28]
push ecx
push dword [ebp - 0x18]
cmovae eax, ebx
push eax
call fcn.100014f0
add esp, 0x10
test eax, eax
je 0x10003ab4
mov byte [ebp - 4], 0
cmp esi, 8
jb 0x10003a98
lea eax, [esi + 1]
push eax
push ebx
lea ecx, [ebp - 0x28]
call fcn.10001a20
lea eax, [ebp - 0x26c]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x10003acb
mov ebx, dword [ebp - 0x270]
jmp 0x10003a00
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x264]
lea ecx, [ebp - 0x28]
call fcn.10001200
jmp 0x10003ad4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
mov ecx, dword [ebp - 0x2c]
cmp ecx, 8
jb 0x10003ae9
inc ecx
push ecx
push dword [ebp - 0x40]
lea ecx, [ebp - 0x40]
call fcn.10001a20
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000a58c
mov esp, ebp
pop ebp
ret 4
Function at 0x100049a0
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x1002f0ac]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x11c
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.1000d390
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 5
jg 0x10004a12
cmp dword [ebp - 0x118], 2
jg 0x10004a12
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000a58c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.1000a58c
mov esp, ebp
pop ebp
ret
Function at 0x10007b10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001f126
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x1002f0ac]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0x60
push 0
push esi
mov byte [ebp - 4], 1
call ebx
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x10007bbc
push 2
push eax
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x10007bbc
call fcn.10005ea0
mov esi, eax
jmp 0x10007cac
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x10007bdf
call fcn.10005ea0
jmp 0x10007c9f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
test ebx, ebx
jne 0x10007bfd
call fcn.10005ea0
jmp 0x10007c9f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x41c], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x10007c1e
mov esi, 0x8007000e
jmp 0x10007ca1
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.10005cd0
jmp 0x10007c48
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
jne 0x10007c5f
mov esi, 0x8007000e
jmp 0x10007ca1
push esi
push dword [ebp - 0x418]
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x10007c7f
call fcn.10005ea0
jmp 0x10007c9f
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.100079b0
mov esi, eax
test edi, edi
je 0x10007cac
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x10007cd0
lea ecx, [ebp - 0x418]
call fcn.10006630
nop word [eax + eax]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1000a58c
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10008500
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
test ebx, ebx
jne 0x10008519
lea eax, [ebx + 0xd]
pop ebx
mov esp, ebp
pop ebp
ret 8
push esi
push edi
xor esi, esi
mov edx, ebx
nop
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10008525
sub eax, edi
sar eax, 1
lea ecx, [eax + 1]
lea edx, [edx + ecx*2]
lea esi, [esi + ecx*2]
cmp ecx, 1
jne 0x10008520
mov eax, dword [ebp - 4]
push esi
push ebx
push 7
push 0
push dword [ebp + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x10008560
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
test edx, edx
jne 0x10008575
lea eax, [edx + 0xd]
pop esi
pop ebp
ret 0xc
mov eax, edx
push edi
lea edi, [eax + 2]
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10008580
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push dword [ebp + 0x10]
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x1001a36f
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1001a02f
Function at 0x10001044
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, 0x10014efc
sub byte [esi - 0x1a3], 0xd8
pop esi
jmp 0x1000107d
jmp 0x100010a4
xor eax, eax
jmp 0x10001414
call fcn.100010ab
test eax, eax
jne 0x10001422
ret
push ebp
push eax
mov eax, 0x10015143
add dword [eax - 0x3c], 0x25b5642c
xor byte [eax - 0x365], 0xf5
pop eax
push ebx
mov ebx, eax
call fcn.1000121c
sub esp, 4
push esi
pop dword [0x10014db5]
mov dword [esp], 0x35485406
add dword [esp], 0x343216f8
push eax
call fcn.1000125f
push 0x40
push 0x71bbe571
push ecx
inc ecx
not ecx
mov ecx, 0x71bbd571
xor dword [esp + 4], ecx
pop ecx
mov ecx, 0xe640
pushal
sbb dword [0x10014dec], 0xc7771e73
call fcn.1000121c
mov edx, eax
or dword [0x10014dbf], ecx
sub esp, 4
mov dword [esp], 0xf8db8669
push edi
mov edi, 0x10014ff3
add word [edi + 0xc1], 0xf648
sub word [edi - 0xfa], 0xfce1
pop edi
add dword [esp], 0x343216f8
push edx
xor word [0x10014fff], 0x6a06
jmp loc.10021000

Function at 0x1000121c
Capabilities:
Access peb ldr_data

Disassembly:
push esi
jmp 0x1000123c
xor eax, eax
mov eax, dword fs:[eax + 0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
pop esi
ret

Function at 0x1000125f
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push ebx
push edx
push ecx
mov ecx, 0x10014e79
xor dword [ecx - 0x121], 0x1638db40
pop ecx
push esi
push edi
mov ebx, dword [ebp + 8]
mov ecx, ebx
add ebx, dword [ebx + 0x3c]
push dword [ebx + 0x7c]
push 0x9c830a79
pop dword [0x10014f30]
mov ebx, dword [ebx + 0x78]
add ebx, ecx
add dword [esp], ebx
push edi
mov edi, 0x10015138
xor dword [edi - 0x326], 0x411f6b3b
mov byte [edi - 0x258], 0x58
pop edi
mov edi, dword [ebx + 0x20]
add edi, ecx
xor esi, esi
lea edx, [edi + esi*4]
mov edx, dword [edx]
jmp 0x100012f4
jmp 0x1000132b
jmp 0x10001351
add edx, ecx
mov dword [ebp - 4], edx
xor eax, eax
rol eax, 7
xor al, byte [edx]
inc edx
cmp byte [edx], 0
jne 0x10001358
mov dword [0x10014d6c], edi
cmp eax, dword [ebp + 0xc]
je 0x10001380
inc esi
cmp esi, dword [ebx + 0x18]
jb 0x100012b7
mov edx, dword [ebx + 0x24]
add edx, ecx
movzx edx, word [edx + esi*2]
push edi
mov edi, 0x10014d8f
and byte [edi + 0xfc], 0xef
mov word [edi + 0x185], 0x3fc
pop edi
mov eax, dword [ebx + 0x1c]
add eax, ecx
mov eax, dword [eax + edx*4]
add eax, ecx
pop ecx
cmp eax, ebx
jbe 0x100013fb
cmp eax, ecx
jae 0x100013fb
push edi
mov edi, 0x10014e35
sbb word [edi + 0xbf], 0x63e8
and word [edi + 0x31f], 0x6a01
pop edi
push dword [ebp - 4]
push dword [ebp + 8]
sub esp, 4
mov dword [esp], 0xeb8ed3f6
add dword [esp], 0x343216f8
push dword [ebp + 8]
jmp 0x10021810
pop edi
pop esi
push ecx
mov ecx, 0x10015162
sub dword [ecx - 0x2bf], 0x15bc800
pop ecx
pop edx
pop ebx
leave
ret 8
Function at 0x405d5f
Capabilities:
Delete file

Disassembly:
push 8
mov eax, 0x549ef0
call fcn.00530016
xor edi, edi
push edi
push str.HttpGetFile
push dword [ebp + 8]
mov dword [ebp - 4], edi
call fcn.00415c07
mov esi, eax
add esp, 0xc
test esi, esi
je 0x405dd5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.DownloadModuleUpdateINI_1__0x_x_
call fcn.00410863
mov eax, dword [ebp + 0x10]
pop ecx
pop ecx
cmp esi, 0x4e27
jne 0x405db0
mov dword [eax], 5
jmp 0x405e64
cmp esi, 0x4e23
jne 0x405dc3
mov dword [eax], 0xa
jmp 0x405e64
push esi
mov dword [eax], 0x20
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x405e64
lea eax, [ebp - 0x10]
push edi
push eax
call fcn.00411761
mov eax, dword [0x5b5a4c]
add eax, 0xfffffff0
mov byte [ebp - 4], 1
push eax
call fcn.004051bd
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
push edi
push edi
push edi
push edi
push edi
push 1
push 0xffffffffffffffff
push esi
push 1
push edi
push edi
push dword [ebp - 0x10]
mov byte [ebp - 4], 2
push dword [ebp + 8]
call fcn.00415a21
add esp, 0x40
test eax, eax
jne 0x405e42
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.DownloadModuleUpdateINI_2_0x_x_
call fcn.00410863
mov eax, dword [ebp + 0x10]
pop ecx
pop ecx
push dword [ebp - 0x10]
mov dword [eax], 5
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x405e51
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push eax
call fcn.004028b3
xor edi, edi
inc edi
lea ecx, [esi - 0x10]
call fcn.00409f91
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00409f91
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00409f91
mov eax, edi
call fcn.0052ffe4
ret

Function at 0x407bf3
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x5b01a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x24
lea eax, [ebp - 0x144]
push 0
push eax
call fcn.0052ee30
mov esi, 0x11c
lea eax, [ebp - 0x120]
push esi
push 0
push eax
call fcn.0052ee30
add esp, 0x18
mov dword [ebp - 0x120], esi
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
pop esi
test eax, eax
je 0x407cb4
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x407c6c
lea ecx, [ebp - 0x144]
push ecx
call eax
jmp 0x407c79
lea eax, [ebp - 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [ebp - 0x110], 2
jne 0x407cab
cmp dword [ebp - 0x11c], 4
jbe 0x407cb4
mov eax, dword [ebp + 8]
cmp dword [ebp - 0x11c], eax
jae 0x407c9a
xor al, al
jmp 0x407cb6
jne 0x407cb4
mov eax, dword [ebp - 0x118]
cmp eax, dword [ebp + 0xc]
sbb al, al
inc al
jmp 0x407cb6
cmp dword [ebp - 0x110], 1
je 0x407c96
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052cea9
mov esp, ebp
pop ebp
ret