joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44c25c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.0044bc8c
test byte [ebp + 0xd], 0xc0
jne 0x44c280
mov eax, dword [0x45b414]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x44c28d
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x44c2ba
je 0x44c2cc
sub ecx, 0x100
je 0x44c2da
sub ecx, 0x100
je 0x44c2e1
sub ecx, 0x100
je 0x44c2d3
jmp 0x44c2e8
sub ecx, 0x600
je 0x44c2e1
sub ecx, 0x100
je 0x44c2cc
jmp 0x44c2e8
mov edi, 1
jmp 0x44c2ed
mov edi, 2
jmp 0x44c2ed
mov edi, 4
jmp 0x44c2ed
mov edi, 5
jmp 0x44c2ed
mov edi, 3
test byte [ebp + 0xd], 1
je 0x44c314
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x45b964]
test al, 0x80
je 0x44c30d
mov ebx, 0x80
jmp 0x44c326
mov ebx, 1
jmp 0x44c326
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x44c326
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x44c338
je 0x44c341
dec eax
je 0x44c34a
jmp 0x44c353
mov dword [ebp - 4], 0x80000000
jmp 0x44c362
mov dword [ebp - 4], 0x40000000
jmp 0x44c362
mov dword [ebp - 4], 0xc0000000
jmp 0x44c362
push 1
call fcn.0044c04c
pop ecx
mov ebx, eax
jmp 0x44c44e
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x44c37e
sub eax, 0x10
je 0x44c385
sub eax, 0x10
je 0x44c38e
sub eax, 0x10
je 0x44c397
jmp 0x44c397
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x44c39e
mov dword [ebp - 8], 1
jmp 0x44c39e
mov dword [ebp - 8], 2
jmp 0x44c39e
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.dll_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x44c407
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x44c3fc
test byte [ebp + 0xd], 1
mov ebx, 0x50
jne 0x44c3fc
add ebx, 0xffffffb2
push ebx
call fcn.0044c04c
pop ecx
mov ebx, eax
jmp 0x44c44e
mov edi, esi
push edi
call fcn.0044c1c0
pop ecx
test eax, eax
je 0x44c41b
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x44c427
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.0044bd8c
add esp, 8
mov ebx, eax
inc eax
jne 0x44c44e
push 4
call fcn.0044c04c
pop ecx
push esi
call sub.KERNEL32.dll_CloseHandle
call fcn.0044bcc0
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44fd14
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
cmp dword [0x45c3a4], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x44fdcc
cmp byte [0x4551ba], 0
je 0x44fd86
push 0x50
lea eax, [ebp - 0x54]
push eax
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x54]
push edx
call fcn.0044f9b4
add esp, 8
mov ebx, eax
test eax, eax
jne 0x44fd6f
push 0x3a
lea edx, [ebp - 0x54]
push edx
call fcn.0044f9b4
add esp, 8
mov ebx, eax
test eax, eax
jne 0x44fd6f
lea ebx, [ebp - 0x54]
jmp 0x44fd70
inc ebx
call fcn.0044fccc
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.dll_MessageBoxA
jmp 0x44fded
push 0xfffffffffffffff4
call sub.KERNEL32.dll_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x45c3a8
push ebx
call sub.KERNEL32.dll_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.00445d30
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.dll_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x45c3ab
push ebx
call sub.KERNEL32.dll_WriteFile
jmp 0x44fded
cmp dword [0x45c3a4], 0xffffffff
je 0x44fded
mov eax, dword [0x45c3a4]
test eax, eax
je 0x44fded
cmp byte [eax], 0
je 0x44fded
push esi
push eax
call fcn.0044fe7c
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6fa0a690
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.6fa192d0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.6fa192d0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x6fa0a6f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x6fb27054]
test esi, esi
jle 0x6fa0a810
mov eax, dword [0x6fb27058]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x6fa0a724
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x6fa0a7a7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x6fa0a710
mov dword [esp], ebx
call fcn.6fa0aee0
mov edi, eax
test eax, eax
je 0x6fa0a837
mov eax, dword [0x6fb27058]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.6fa0b020
mov edx, dword [0x6fb27058]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x6fa0a817
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x6fa0a7a0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x6fa0a7b0
add dword [0x6fb27054], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x6fb27058]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x6fa0a7a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.6fa0a690
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x6fa0a72e
mov eax, dword [0x6fb27058]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.6fa0a690
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.6fa0a690
lea esi, [esi]
nop
Function at 0x6fa0ab50
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x6fb27064
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x6fb2705c]
sub esp, 4
test ebx, ebx
je 0x6fa0aba5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x6fa0ab9e
test esi, esi
je 0x6fa0ab9e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x6fa0ab80
mov dword [esp], 0x6fb27064
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x6fa0aee0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x6fa00000], 0x5a4d
jne 0x6fa0af05
mov ecx, dword [0x6fa0003c]
cmp dword [ecx + 0x6fa00000], 0x4550
lea edx, [ecx + 0x6fa00000]
je 0x6fa0af10
ret
cmp word [ecx + 0x6fa00018], 0x10b
jne 0x6fa0af05
push esi
movzx eax, word [ecx + 0x6fa00014]
push ebx
movzx esi, word [ecx + 0x6fa00006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x6fa00000
test si, si
je 0x6fa0af58
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x6fa0af4e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x6fa0af5a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x6fa0af40
xor eax, eax
pop ebx
pop esi
ret

Function at 0x6fa10290
Capabilities:
Allocate thread local storage

Disassembly:
sub esp, 0x1c
mov dword [0x6fb270c0], 0xffffffff
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0xffff
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
sub esp, 0x10
mov dword [0x6fb270c4], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x6fa10300
mov dword [esp + 4], 0x6fa101a0
mov dword [esp], eax
mov dword [0x6fb270bc], eax
call fcn.6fa19b50
test eax, eax
jne 0x6fad6d79
add esp, 0x1c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x6fa102ea
Function at 0x6fa1c3c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ecx, 0x1a
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x80]
mov esi, 0x6fae0df5
push ebx
sub esp, 0x9c
mov eax, dword [str.not_enough_space_for_format_expansion__Please_submit_full_bug_report_at_https:__gcc.gnu.org_bugs__:_n]
mov dword [ebp - 0x81], eax
mov eax, dword [0x6fae0e59]
mov dword [ebp - 0x1c], eax
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp + 8]
lea eax, [edx + 0x84]
and eax, 0xfffffff0
call fcn.6fa0b1c0
mov ecx, 0x1a
sub esp, eax
lea esi, [ebp - 0x81]
lea ebx, [esp + 0x1b]
and ebx, 0xfffffff0
mov edi, ebx
lea eax, [ebx + 0x68]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 8], edx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x8c], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x8c]
mov byte [ebx + edx + 0x68], 0
mov dword [esp], ebx
call fcn.6fad5980
nop
nop
nop
nop
nop
nop
nop
push edi
push esi
push ebx
sub esp, 0x20
cmp byte [0x6fade248], 0
jne 0x6fa1c4e6
mov byte [0x6fade248], 1
call fcn.6fad37f0
test eax, eax
je 0x6fa1c4b4
mov ebx, dword [eax + 4]
xor eax, eax
cmp byte [ebx], 0x2a
mov dword [esp + 8], 0
sete al
mov dword [esp + 4], 0
add ebx, eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call fcn.6fa0a340
mov dword [esp], 2
mov esi, dword [fcn.6fa192d0]
mov edi, eax
call esi
mov dword [esp + 8], 0x30
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
call sub.msvcrt.dll_fwrite
mov edx, dword [esp + 0x1c]
mov dword [esp], 2
test edx, edx
je 0x6fa1c4a4
call esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
mov dword [esp], 2
call esi
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x6fae15f9
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x6fad6164
jmp 0x6fad615c
call esi
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
jmp 0x6fa1c46a
mov dword [esp], 2
call dword [0x6fadd0a0]
mov dword [esp + 8], 0x2d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
call sub.msvcrt.dll_fwrite
jmp 0x6fad6157
mov dword [esp], 2
call dword [0x6fadd0a0]
mov dword [esp + 8], 0x1d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x6fae15a8
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
call sub.msvcrt.dll_abort
mov dword [esp], edi
call fcn.6fa19a38
call fcn.6fad3b20
call fcn.6fad36e0
call fcn.6fad3820
jmp 0x6fad6157
Function at 0x43f15a
Capabilities:
Parse pe header

Disassembly:
mov eax, dword [pe_dos_header]
mov eax, dword ds:[eax + 0x34]
mov ebp, dword ds:[eax + 0xb8]
jmp 0x43f168
push eax
push ecx
push esi
push ebp
mov eax, dword fs:[0x30]
test eax, eax
js 0x43f14a
mov eax, dword ds:[eax + 0xc]
mov esi, dword ds:[eax + 0x1c]
lodsd eax, dword [esi]
mov ebp, dword ds:[eax + 8]
mov dword [ebx + 0x60], ebp
mov eax, ebp
cmp word [eax], 0x5a4d
jne 0x43f145
add eax, 0x3c
mov ecx, dword [eax]
add ecx, dword [ebx + 0x60]
cmp word [ecx], 0x4550
jne 0x43f145
add ecx, 0x78
mov esi, dword [ecx]
add esi, dword [ebx + 0x60]
add esi, 0x18
lodsd eax, dword [esi]
mov dword [ebx + 0x64], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x68], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x6c], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x70], eax
pop ebp
pop esi
pop ecx
pop eax
ret

Function at 0x7ffe5437
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword fs:[0x30]
push edx
cdq
pop edx
cld
and bh, 0xff
cld
pushal
inc eax
popal
clc
push edx
cdq
pop edx
clc
pushal
inc eax
popal
nop
and bh, 0xff
cld
add eax, 0
nop
lea esp, [esp]
nop
call 0x7ffe5462
pop edx
nop
nop
clc
xor dx, dx
add edx, 0xd5e0
push es
pop ds
stc
xor ecx, ecx
cld
and bh, 0xff
mov cl, 0x1e
cld
clc
stc
xor byte [ecx + edx], 0xf4
loop 0x7ffe547d
push dword fs:[0x24]
clc
pop dword [edx + 0xa]
cld
lea esp, [esp]
mov cl, 0xff
cld
push edx
loop 0x7ffe5495
clc
stc
mov dword [edx + 0x11], 0xffffacbb
clc
mov ecx, dword [eax + 0x2c]
cld
cld
nop
cld
mov dword [edx + 0x1b], ecx
push es
pop ds
clc
mov dword [edx + 0x100], ecx
mov dword [eax + 0x2c], esp
nop
and bh, 0xff
cld
push 0
push 0
and bh, 0xff
push 0
push 0
add al, 0
nop
push 0x30
stc
push eax
pop eax
clc
push 0x20
and bh, 0xff
cld
cld
push 0
nop
and bh, 0xff
push 0
cld
add eax, 0
clc
add edx, 0xffff7f33
cld
cld
push edx
push edx
cdq
pop edx
cld
clc
push edx
push 0
clc
call dword [edx + 0x8210]
add esp, 0x3f8
clc
xor eax, eax
stc
pushal
inc eax
popal
inc eax
stc
nop
nop
ret 0xc
Function at 0x402ff3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00401e9d
and dword [ebp - 4], 0
cmp dword [0x40f660], 0
mov ebx, eax
jne 0x4030a4
push str.user32.dll
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x403155
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x403155
push eax
call fcn.00401e2b
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40f660], eax
call esi
push eax
call fcn.00401e2b
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40f664], eax
call esi
push eax
call fcn.00401e2b
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40f668], eax
call esi
push eax
call fcn.00401e2b
pop ecx
mov dword [0x40f670], eax
test eax, eax
je 0x4030a4
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00401e2b
pop ecx
mov dword [0x40f66c], eax
mov eax, dword [0x40f66c]
cmp eax, ebx
je 0x4030fc
cmp dword [0x40f670], ebx
je 0x4030fc
push eax
call fcn.00401ea6
push dword [0x40f670]
mov esi, eax
call fcn.00401ea6
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4030fc
test edi, edi
je 0x4030fc
call esi
test eax, eax
je 0x4030f3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4030f3
test byte [ebp - 0xc], 1
jne 0x4030fc
or dword [ebp + 0x10], 0x200000
jmp 0x403135
mov eax, dword [0x40f664]
cmp eax, ebx
je 0x403135
push eax
call fcn.00401ea6
pop ecx
test eax, eax
je 0x403135
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x403135
mov eax, dword [0x40f668]
cmp eax, ebx
je 0x403135
push eax
call fcn.00401ea6
pop ecx
test eax, eax
je 0x403135
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40f660]
call fcn.00401ea6
pop ecx
test eax, eax
je 0x403155
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x403157
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x404e88
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40e9f8]
jne 0x404e92
repz ret
jmp fcn.004065b5

Function at 0x4070e0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x40e9f8]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov word [ebp - 0x20c], ax
call fcn.00405110
add esp, 0xc
push 0x104
lea edx, [ebp - 0x20c]
push edx
push 0
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.shlwapi.dll_PathRemoveFileSpecW]
push 0x40c324
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.shlwapi.dll_PathAppendW]
lea edx, [ebp - 0x20c]
push edx
push 0
push 0x40c314
push str.jhn60ucwxib95qb76odfz0utbjlu8ne
call dword [sym.imp.kernel32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 4]
dec eax
neg eax
sbb eax, eax
xor ecx, ebp
inc eax
call fcn.00404e88
mov esp, ebp
pop ebp
ret
Function at 0x4072f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x40e9f8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
push 0x40faa8
call dword [sym.imp.kernel32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4073a5
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push ecx
lea edx, [ebp - 0x804]
push 0x400
push edx
call fcn.004079e5
push 0x40c364
lea eax, [ebp - 0x804]
push 0x400
push eax
call fcn.00407a02
lea eax, [ebp - 0x804]
add esp, 0x1c
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x407363
push edi
push 2
push 0
sub eax, edx
push 0
sar eax, 1
push esi
mov edi, eax
call dword [sym.imp.kernel32.dll_SetFilePointer]
push 0
lea ecx, [ebp - 0x808]
push ecx
lea edx, [edi + edi]
push edx
lea eax, [ebp - 0x804]
push eax
push esi
call dword [sym.imp.kernel32.dll_WriteFile]
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00404e88
mov esp, ebp
pop ebp
ret

Function at 0x4073c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
xor esi, esi
push 0x40c478
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call fcn.004072f0
mov edi, dword [ebp + 8]
mov ebx, dword [sym.imp.advapi32.dll_RegQueryValueExW]
add esp, 4
lea eax, [ebp - 4]
push eax
push esi
lea ecx, [ebp - 8]
push ecx
push esi
push str.v6lqte57r684fp81ojp1voa5ra2fbhqvoesdl7x7c48w90gd29m6kh7orx4
push edi
call ebx
cmp eax, esi
je 0x407414
push eax
push str.RegQueryValueEx_failed__error:__ld
call fcn.004072f0
add esp, 8
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
cmp eax, 1
je 0x407433
push eax
push str.y3ozolxx6q457qkoiefzpb2ywwarr
call fcn.004072f0
add esp, 8
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
xor ecx, ecx
shr eax, 1
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00407af4
mov esi, dword [ebp + 0xc]
push str.tjrhle1uglhwg9jda30vrxuefa3gvuf06zkomq8miokisq3
mov dword [esi], eax
call fcn.004072f0
mov ecx, dword [esi]
add esp, 8
lea eax, [ebp - 4]
push eax
push ecx
lea edx, [ebp - 8]
push edx
push 0
push str.v6lqte57r684fp81ojp1voa5ra2fbhqvoesdl7x7c48w90gd29m6kh7orx4
push edi
call ebx
test eax, eax
je 0x40749e
push eax
push str.RegQueryValueEx_failed__error:__ld
call fcn.004072f0
mov eax, dword [esi]
push eax
call fcn.00407a7f
add esp, 0xc
pop edi
mov dword [esi], 0
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4075b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x40e9f8]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x40faa8
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathW]
push str.babr0nrodi2j151tWarning:_RegDeleteValue_AutoLogonCount__failed__error:__ld
push 0x40faa8
call dword [sym.imp.shlwapi.dll_PathAppendW]
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.kernel32.dll_GetLocalTime]
movzx ecx, word [ebp - 0x11c]
movzx edx, word [ebp - 0x11e]
movzx eax, word [ebp - 0x120]
push ecx
movzx ecx, word [ebp - 0x122]
push edx
movzx edx, word [ebp - 0x126]
push eax
movzx eax, word [ebp - 0x128]
push ecx
push edx
push eax
push str._Log_started:__04hu__02hu__02hu__02hu:_02hu:_02hu
call fcn.004072f0
push 0x110
lea ecx, [ebp - 0x114]
push 0
push ecx
mov dword [ebp - 0x118], 0x114
call fcn.00405110
add esp, 0x28
lea edx, [ebp - 0x118]
push edx
call dword [sym.imp.kernel32.dll_GetVersionExW]
test eax, eax
je 0x407689
call fcn.00407180
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x114]
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x20
add eax, 0x20
push eax
push ecx
push edx
push 0x40c598
call fcn.004072f0
add esp, 0x10
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404e88
mov esp, ebp
pop ebp
ret
Function at 0x4076a0
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 8], 2
jl 0x40770e
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
push 0x40c9d8
push ecx
call dword [sym.imp.kernel32.dll_lstrcmpW]
test eax, eax
jne 0x40770e
call fcn.004070e0
test al, al
je 0x40770e
call fcn.004075b0
push 0x40c9ac
call fcn.004072f0
lea edx, [ebp + 8]
add esp, 4
push edx
call fcn.004071d0
or eax, 3
push eax
push 0
push str.i1nck4l9d0wler1jgotk5suuz2rvhbj9iapth2olcjgulr3b6b1wraqojumply93tt2qv9c0gw7
push 0x80000002
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
test eax, eax
je 0x407717
push eax
push 0x40c8f0
call fcn.004072f0
add esp, 8
mov eax, 1
mov esp, ebp
pop ebp
ret
push esi
push edi
push 0
push 0
push 0
push 0
push 6
call fcn.00407230
mov edi, dword [sym.imp.advapi32.dll_RegDeleteValueW]
add esp, 0x14
test al, al
jne 0x407808
push 0
push 0
push 0
push 2
push 5
call fcn.00407230
add esp, 0x14
test al, al
jne 0x4077c9
mov ecx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push ecx
mov dword [ebp - 4], 0
call fcn.004073c0
add esp, 8
test al, al
je 0x40778e
mov esi, dword [ebp - 4]
push esi
call fcn.004074b0
add esp, 4
test eax, eax
je 0x407799
push eax
push str.4wvzhdzy074j6ssq031fh79qxlcbb02k5qlzmttjCouldnt_open_Winlogon_key__error:__ld
call fcn.004072f0
push esi
call fcn.00407a7f
add esp, 0xc
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
push esi
call fcn.00407a7f
push str.x82c8gvoplco9bwvhr6jngmekkfdw9l
call fcn.004072f0
mov edx, dword [ebp + 8]
add esp, 8
push str.v6lqte57r684fp81ojp1voa5ra2fbhqvoesdl7x7c48w90gd29m6kh7orx4
push edx
call edi
test eax, eax
je 0x4077c9
push eax
push str.Warning:_RegDeleteValue_DefaultPassword__failed__error:__ld
call fcn.004072f0
add esp, 8
push str.3arq8snf5j4qh5jk271zy8f3sq4mr
mov dword [ebp - 8], 0x31
call fcn.004072f0
mov ecx, dword [ebp + 8]
add esp, 4
push 4
lea eax, [ebp - 8]
push eax
push 1
push 0
push str.cjf9301lp5qmsxm
push ecx
call dword [sym.imp.advapi32.dll_RegSetValueExW]
test eax, eax
je 0x407808
push eax
push str.Warning:_RegSetValueEx_failed__error:__ld
call fcn.004072f0
add esp, 8
push str.3y5un2zkuntxhcqg94gxlmswe4edu1
call fcn.004072f0
mov edx, dword [ebp + 8]
add esp, 4
push str.09v38cpoe1i7f80
push edx
call edi
test eax, eax
je 0x407832
push eax
push 0x40c660
call fcn.004072f0
add esp, 8
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x432006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
mov ebx, 0x40c7d0
mov ecx, 0x52011cba
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x432024
nop
mov eax, section..tls
nop
mov ebx, 0x42f314
nop
nop
mov ecx, 0x6ed84114
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219