joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421b30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x200
push esi
call fcn.00421140
mov ecx, dword [0x5b118c]
mov eax, dword [0x5b2ea4]
mov dword [esp + 0x14], ecx
mov ecx, 0x20
mov dword [esp + 4], eax
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x70], ecx
mov dword [esp + 0x7c], ecx
mov dword [esp + 0x80], ecx
mov edx, 0x40
mov dword [esp + 0xa0], ecx
xor esi, esi
mov eax, 3
mov ecx, 0x80
mov dword [esp + 0x8c], edx
mov dword [esp + 0x9c], edx
mov dword [esp + 0xd0], edx
mov dword [esp + 8], esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], 0x74656d70
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0x9c
mov dword [esp + 0x38], eax
mov dword [esp + 0x34], 0x666f6e74
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], 0xa0
mov dword [esp + 0x48], eax
mov dword [esp + 0x44], 0x62616c6c
mov dword [esp + 0x4c], esi
mov dword [esp + 0x50], esi
mov dword [esp + 0x58], eax
mov dword [esp + 0x54], 0x786f6e69
mov dword [esp + 0x60], esi
mov dword [esp + 0x68], eax
mov dword [esp + 0x64], 0x73706565
mov dword [esp + 0x6c], esi
mov dword [esp + 0x78], eax
mov dword [esp + 0x74], 0x6d6f6e79
mov dword [esp + 0x88], eax
mov dword [esp + 0x84], 0x61616161
mov dword [esp + 0x90], esi
mov dword [esp + 0x98], eax
mov dword [esp + 0x94], 0x72727272
mov dword [esp + 0xa8], eax
mov dword [esp + 0xa4], 0x6d323035
mov dword [esp + 0xac], ecx
mov dword [esp + 0xb0], 0x60
mov dword [esp + 0xb8], eax
mov dword [esp + 0xb4], 0x6d323036
mov dword [esp + 0xbc], ecx
mov dword [esp + 0xc0], 0x78
mov dword [esp + 0xc8], eax
mov dword [esp + 0xc4], 0x6d323034
mov dword [esp + 0xcc], esi
mov dword [esp + 0xd8], eax
mov dword [esp + 0xd4], 0x6d323031
mov dword [esp + 0xdc], esi
mov dword [esp + 0xe0], 0x58
mov dword [esp + 0xe8], eax
mov dword [esp + 0xe4], 0x6d323032
mov dword [esp + 0xec], esi
mov dword [esp + 0xf0], 0x70
mov dword [esp + 0xf8], eax
mov dword [esp + 0xf4], 0x6d323033
mov dword [esp + 0xfc], esi
mov dword [esp + 0x100], 0x88
mov dword [esp + 0x108], eax
mov dword [esp + 0x104], 0x6d313032
mov dword [esp + 0x10c], ecx
mov dword [esp + 0x110], 0x18
mov dword [esp + 0x118], eax
mov dword [esp + 0x114], 0x6f6e2b2b
mov dword [esp + 0x11c], ecx
mov edx, 0x30
mov dword [esp + 0x120], edx
mov dword [esp + 0x130], edx
lea edx, [esp + 4]
mov dword [esp + 0x128], eax
push edx
mov dword [esp + 0x128], 0x6f66662b
mov dword [esp + 0x130], 0xa8
mov dword [esp + 0x13c], eax
mov dword [esp + 0x138], 0x6e726567
mov dword [esp + 0x140], ecx
mov dword [esp + 0x144], 0x90
mov dword [esp + 0x148], esi
call fcn.004055b0
add esp, 4
call fcn.00405560
test eax, eax
jne 0x421dcd
push esi
call dword [sym.imp.USER32.dll_MessageBeep]
pop esi
add esp, 0x200
ret
Function at 0x429701
Capabilities:
Get file size

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
xor ebp, ebp
cmp edi, ebp
mov ebx, ecx
jne 0x42971b
mov eax, 0x80070057
jmp 0x429898
cmp dword [ebx + 0x104], 0xffffffff
je 0x42972b
mov ecx, ebx
call fcn.0042989f
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebp
mov eax, ecx
mov esi, edi
mov edi, ebx
push 0x10000080
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 4
push ebp
mov ecx, eax
push ebp
push 0xc0000000
and ecx, 3
push dword [esp + 0x2c]
rep movsb byte es:[edi], byte [esi]
mov dword [ebx + 0x114], ebp
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebx + 0x104], eax
je 0x4297e0
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x28
mov dword [ebx + 0x110], eax
sbb esi, esi
neg esi
mov dword [esp + 0x14], esi
je 0x429794
mov eax, 0x1000
jmp 0x42979d
add eax, 0xfff
and ax, 0xf000
push ebp
push eax
push ebp
push 4
push ebp
mov dword [ebx + 0x110], eax
push dword [ebx + 0x104]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, 0xffffffff
mov dword [ebx + 0x108], eax
je 0x4297e0
push dword [ebx + 0x110]
push ebp
push ebp
push 0xf001f
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edx, eax
cmp edx, ebp
mov dword [ebx + 0x10c], edx
jne 0x429810
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x4297f2
call esi
mov esi, eax
jmp 0x429802
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
mov ecx, ebx
call fcn.0042989f
mov eax, esi
jmp 0x429898
cmp esi, ebp
jne 0x429867
push 8
mov edi, str.D3DX_r_n
pop ecx
mov esi, edx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x42983f
cmp dword [edx + 8], ebp
jne 0x42983f
cmp dword [edx + 0x14], 0x10
jne 0x42983f
mov eax, dword [edx + 0x18]
cmp eax, 0x28
jb 0x42983f
cmp eax, dword [ebx + 0x110]
jbe 0x42985f
mov ecx, dword [ebx + 0x110]
xor eax, eax
mov esi, ecx
mov edi, edx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, esi
mov dword [esp + 0x14], 1
and ecx, 3
rep stosb byte es:[edi], al
mov esi, dword [esp + 0x14]
cmp esi, ebp
je 0x429896
mov eax, dword [str.D3DX_r_n]
mov dword [edx], eax
mov eax, dword [0x43ac24]
mov dword [edx + 4], eax
mov dword [edx + 8], ebp
mov dword [edx + 0xc], ebp
mov dword [edx + 0x10], ebp
mov dword [edx + 0x14], 0x10
mov dword [edx + 0x18], 0x28
mov dword [edx + 0x1c], ebp
mov dword [edx + 0x20], ebp
mov dword [edx + 0x24], ebp
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x42e7a7
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push ebx
push esi
push edi
mov ebx, ecx
call fcn.004296e6
test eax, eax
jne 0x42e838
lea eax, [ebp - 0x100]
push 0x100
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov esi, 0x43af94
mov edx, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp + edx - 0x100], 0x5c
repne scasb al, byte es:[edi]
not ecx
mov eax, ecx
lea edi, [ebp + edx - 0xff]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x100]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov ecx, ebx
call fcn.00429701
test eax, eax
jl 0x42e83a
mov ecx, ebx
call fcn.004296fa
cmp eax, 0x100000
jbe 0x42e838
mov ecx, ebx
call fcn.004298fa
lea eax, [ebp - 0x100]
mov ecx, ebx
push eax
call fcn.00429701
test eax, eax
jl 0x42e83a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x432c15
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x440df8
cmp edx, dword [eax]
je 0x432c37
add eax, 8
inc ecx
cmp eax, 0x440e88
jl 0x432c28
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x440df8]
jne 0x432d65
mov eax, dword [0x5b3278]
cmp eax, 1
je 0x432d3f
test eax, eax
jne 0x432c68
cmp dword [0x440c2c], 1
je 0x432d3f
cmp edx, 0xfc
je 0x432d65
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x432c9f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004357d0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00435ac0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x432ce2
lea eax, [ebp - 0x1a4]
push eax
call fcn.00435ac0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x43b414
push edi
call fcn.00435bd0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004357d0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004357e0
lea eax, [ebp - 0xa0]
push 0x43b3f4
push eax
call fcn.004357e0
push dword [esi + 0x440dfc]
lea eax, [ebp - 0xa0]
push eax
call fcn.004357e0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004362a4
add esp, 0x2c
pop edi
jmp 0x432d65
lea eax, [ebp + 8]
lea esi, [esi + 0x440dfc]
push 0
push eax
push dword [esi]
call fcn.00435ac0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..retplne
nop
mov ebx, 0x40de38
mov ecx, 0x35e323de
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
mov eax, section..reloc
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x4588449c
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219

Function at 0x4074e0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x5000]
push edi
or ebp, 0xffffffff
jmp 0x407502
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407509
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4074f8
mov eax, 1
add ebx, ebx
jne 0x40751b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407510
jne 0x40752c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407510
xor ecx, ecx
sub eax, 3
jb 0x407540
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4075b2
mov ebp, eax
add ebx, ebx
jne 0x40754b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407558
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40757c
inc ecx
add ebx, ebx
jne 0x407568
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40755d
jne 0x407579
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40755d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40759c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40758d
jmp 0x4074fe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40759c
add edi, ecx
jmp 0x4074fe
pop esi
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x407604
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8284]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x82fc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4075b9
mov ecx, edi
jns 0x4075e8
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8300]
or eax, eax
je 0x4075fe
mov dword [ebx], eax
add ebx, 4
jmp 0x4075d6
call dword [esi + 0x8308]
mov ebp, dword [esi + 0x8304]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x407638
sub esp, 0xffffff80
jmp 0x402d94
Function at 0x4072ad
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x46bc7c], 0
jne 0x4072eb
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4072c1
mov dword [ecx*4 + 0x46bc78], eax
inc ecx
cmp ecx, 0x100
jl 0x4072bc
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x407318
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x46bc78]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4072f9
not eax
pop ebp
ret 0xc

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x5b4b15df
nop
nop
test eax, eax
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x6da672cc
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x42e06c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x401360
Capabilities:
Write file on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
movzx eax, byte [section..data]
mov edi, dword [ecx]
mov esi, dword [ecx + 4]
test al, 1
jne 0x4014a8
test edi, edi
jle 0x4013e5
xor ebx, ebx
jmp 0x401397
add ebx, 1
cmp edi, ebx
jle 0x4013e1
mov edx, eax
and edx, 1
je 0x401390
mov eax, dword [esi + ebx*4]
add ebx, 1
call fcn.00401060
mov dword [esp + 0xc], 0x40301d
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0x403034
mov dword [esp + 4], 0x402000
mov dword [esp], 0
call fcn.00401300
movzx eax, byte [section..data]
mov edx, eax
and edx, 1
cmp edi, ebx
jg 0x401397
test dl, dl
jne 0x401438
mov esi, dword [sym.imp.kernel32.dll_GetStdHandle]
mov dword [esp], 0xfffffff5
lea ebx, [ebp - 0x1c]
call esi
sub esp, 4
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 1
mov dword [esp + 4], 0x403021
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteConsoleA]
sub esp, 0x14
test eax, eax
je 0x401460
lea esp, [ebp - 0x10]
xor eax, eax
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
mov dword [esp + 0xc], 0x403021
mov dword [esp + 8], 0x403034
mov dword [esp + 4], 0x402000
mov dword [esp], 0
call fcn.00401300
jmp 0x4013e5
mov dword [esp], 0xfffffff5
call esi
sub esp, 4
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x403021
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteFile]
xor eax, eax
sub esp, 0x14
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
mov dword [esp + 0xc], str.stub:
mov dword [esp + 8], 0x403034
mov dword [esp + 4], 0x402000
mov dword [esp], 0
call fcn.00401300
test edi, edi
jle 0x4014dc
movzx eax, byte [section..data]
jmp 0x40138c
movzx edx, byte [section..data]
and edx, 1
jmp 0x4013e1

Function at 0x401ea0
Capabilities:
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sub.ucrtbase.dll__configure_wide_argv
call sub.ucrtbase.dll__initialize_wide_environment
call 0x401f10
mov esi, dword [eax]
call sub.ucrtbase.dll___p___wargv
mov edi, dword [eax]
call sub.ucrtbase.dll__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.00401360
mov dword [esp], eax
call sub.ucrtbase.dll_exit
jmp dword [sym.imp.ucrtbase.dll___p___argc]
Function at 0x4badfd
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x5073f0]
xor eax, ebp
mov dword [ebp + 0x9c], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x74]
push eax
xor ebx, ebx
mov esi, 0x20019
push esi
push ebx
push 0x4f7d28
push reloc.OLEAUT32.dll_SysReAllocString
mov edi, ecx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4baeed
push edi
lea eax, [ebp - 0x6c]
push 0x4f7dc8
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x70]
push eax
push esi
push ebx
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4baeed
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push 0x4f7dd8
push dword [ebp - 0x70]
mov edi, 0x104
mov dword [ebp - 0x80], 1
mov dword [ebp - 0x78], edi
call esi
test eax, eax
jne 0x4baeab
cmp dword [ebp - 0x6c], 1
jne 0x4baeed
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push 0x4f7de8
push dword [ebp - 0x70]
mov dword [ebp - 0x78], edi
call esi
test eax, eax
jne 0x4baeed
mov esi, 0x4f7df8
push esi
call fcn.004c3f70
push eax
lea eax, [ebp - 0x6c]
push esi
push eax
call fcn.004c0c2e
add esp, 0x10
test eax, eax
jne 0x4baeed
mov dword [ebp - 0x7c], 1
cmp dword [ebp - 0x70], ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x4baefd
push dword [ebp - 0x70]
call esi
cmp dword [ebp - 0x74], ebx
je 0x4baf07
push dword [ebp - 0x74]
call esi
mov ecx, dword [ebp + 0x9c]
mov eax, dword [ebp - 0x7c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004c3f56
add ebp, 0xa0
leave
ret

Function at 0x4baf22
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [eax]
push edi
xor edi, edi
cmp eax, edi
mov dword [ebp - 4], 4
je 0x4baf64
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 8]
push ecx
push edi
push 0x4f7eec
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4baf64
cmp dword [ebp - 8], 4
jne 0x4baf64
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
inc edi
mov eax, edi
pop edi
leave
ret 4

Function at 0x4bb9b5
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xa0
mov eax, dword [0x5073f0]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
push 0x9a
lea eax, [ebp - 0x27]
push 0
push eax
mov byte [ebp - 0x28], 0
call fcn.004c4000
add esp, 0xc
push 0x9b
lea eax, [ebp - 0x28]
push eax
xor esi, esi
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x4bba0c
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x4bba0c
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov esi, dword [eax]
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004c3f56
add ebp, 0x78
leave
ret
Function at 0x4bba1e
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 8], ebx
xor esi, esi
mov dword [ebp - 4], 0x288
push dword [ebp - 4]
call fcn.004bc64f
mov edi, eax
test edi, edi
pop ecx
je 0x4bba6b
push dword [ebp - 4]
push 0
push edi
call fcn.004c4000
add esp, 0xc
lea eax, [ebp - 4]
push eax
push edi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
mov esi, eax
cmp esi, 0x6f
jne 0x4bba71
push edi
call fcn.004bd3ec
pop ecx
xor edi, edi
inc ebx
cmp ebx, 2
jl 0x4bba34
test esi, esi
jne 0x4bbab8
test edi, edi
mov esi, edi
je 0x4bbac3
push 6
lea eax, [esi + 0x10c]
push 0x4ee078
push eax
call fcn.004c36ea
add esp, 0xc
test eax, eax
jne 0x4bba9d
mov esi, dword [esi]
test esi, esi
jne 0x4bba7b
jmp 0x4bbab8
push 8
add esi, 0x194
push esi
push dword [ebp + 8]
call fcn.004c4140
add esp, 0xc
mov dword [ebp - 8], 1
test edi, edi
je 0x4bbac3
push edi
call fcn.004bd3ec
pop ecx
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4bbacb
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e58bb
mov eax, dword fs:[0]
push eax
mov eax, 0x3858
call fcn.004cddf0
mov eax, dword [0x5073f0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x371c], eax
lea eax, [ebp - 0x375c]
mov edi, ecx
or ebx, 0xffffffff
call fcn.004263e0
lea eax, [ebp - 0x3714]
call fcn.00434a50
and dword [ebp - 4], 0
lea esi, [ebp - 0x3718]
call fcn.00401d90
push 0x18e
lea eax, [ebp - 0x1a2]
push 0
mov byte [ebp - 4], 1
and word [ebp - 0x1a4], 0
push eax
call fcn.004c4000
add esp, 0xc
lea eax, [ebp - 0x1a4]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x4bbc2f
mov esi, dword [ebp - 0x371c]
lea eax, [ebp - 0x375c]
push eax
lea eax, [ebp - 0x3714]
push eax
mov dword [ebp - 0x3758], 0x4ede44
call fcn.00434bb0
test al, al
je 0x4bbc29
cmp dword [ebp - 0x1c8], 0xc8
jne 0x4bbc29
mov eax, dword [ebp - 0x1bc]
mov ecx, dword [ebp - 0x264c]
push dword [ebp - 0x1c0]
add ecx, eax
add ecx, dword [ebp - 0x1b8]
lea eax, [ebp - 0x3718]
push ecx
push eax
call fcn.0042b2a0
lea eax, [ebp - 0x3718]
push eax
mov edx, 0x4ea31c
call fcn.0042b260
push dword [ebp - 0x3718]
lea esi, [ebp - 0x3860]
call fcn.0044a2d0
mov byte [ebp - 4], 2
mov edx, dword [eax]
call fcn.00401c30
lea eax, [ebp - 0x385c]
mov byte [ebp - 4], 1
cmp dword [ebp - 0x3860], eax
je 0x4bbc19
push dword [ebp - 0x3860]
call fcn.004bef97
pop ecx
mov ebx, edi
call fcn.0042fba0
mov edi, eax
call fcn.0042fc20
xor ebx, ebx
call dword [sym.imp.WS2_32.dll_WSACleanup]
lea eax, [ebp - 0x3718]
mov byte [ebp - 4], 0
call fcn.004ba980
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3714]
call fcn.0042c590
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004c3f56
leave
ret
Function at 0x4bbdbc
Capabilities:
Encode data using xor

Disassembly:
push ebp
sub esp, 0x80
lea ebp, [esp - 4]
mov eax, dword [0x5073f0]
xor eax, ebp
mov dword [ebp + 0x80], eax
push 0x128
mov eax, 0x4e5219
call fcn.004c4ac7
mov eax, dword [ebp + 0x8c]
xor edi, edi
mov dword [ebp - 0x18], edi
push 0x7f
mov dword [ebp - 0x14], eax
xor ebx, ebx
lea eax, [ebp + 1]
push edi
inc ebx
push eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], 2
mov dword [ebp - 0x28], 3
mov dword [ebp - 0x24], 4
mov dword [ebp - 0x20], 5
mov byte [ebp], 0
call fcn.004c4000
add esp, 0xc
push 0x4f390c
lea esi, [ebp - 0xb4]
call fcn.0042c550
mov dword [ebp - 4], ebx
mov esi, dword [eax]
cmp esi, edi
je 0x4bbe74
push esi
call fcn.004c3f70
cmp eax, edi
pop ecx
mov dword [ebp - 0x1c], eax
jle 0x4bbe74
mov dword [ebp - 0x10], esi
lea eax, [ebp]
sub dword [ebp - 0x10], eax
mov eax, edi
cdq
push 5
pop esi
idiv esi
lea ecx, [ebp + edi]
mov al, byte [ebp + edx*4 - 0x30]
mov edx, dword [ebp - 0x10]
xor al, byte [edx + ecx]
inc edi
cmp edi, dword [ebp - 0x1c]
mov byte [ecx], al
jl 0x4bbe56
lea eax, [ebp - 0xb0]
mov byte [ebp - 4], 0
cmp dword [ebp - 0xb4], eax
je 0x4bbe92
push dword [ebp - 0xb4]
call fcn.004bef97
pop ecx
lea eax, [ebp]
push eax
lea esi, [ebp - 0x134]
call fcn.0044a2d0
mov dword [ebp - 4], 2
mov eax, dword [eax]
mov edi, dword [ebp - 0x14]
call fcn.004019f0
lea eax, [ebp - 0x130]
mov byte [ebp - 4], 0
cmp dword [ebp - 0x134], eax
mov dword [ebp - 0x18], ebx
je 0x4bbed3
push dword [ebp - 0x134]
call fcn.004bef97
pop ecx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x80]
xor ecx, ebp
call fcn.004c3f56
add ebp, 0x84
leave
ret

Function at 0x4bc2bc
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x5073f0]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.004bc1fb
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.004c4000
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x4bc30b
cmp dword [ebp - 0x1c], 5
jb 0x4bc323
jmp 0x4bc31f
cmp dword [ebp - 0x10], 1
jne 0x4bc323
cmp dword [ebp - 0x1c], 4
ja 0x4bc31f
jne 0x4bc323
cmp dword [ebp - 0x18], 0
jbe 0x4bc323
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x4e7938
call fcn.00449fe0
test eax, eax
jge 0x4bc344
mov byte [0x50e2f0], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004c3f56
add ebp, 0x78
leave
ret