joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e67a4
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 4], 0x20a
push esi
mov esi, ecx
jne 0x4e67ee
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x4e67ee
call fcn.004e6030
test eax, eax
je 0x4e67ee
push dword [ebx + 0xc]
mov eax, dword [esi + 0x54]
push dword [ebx + 8]
mov ecx, dword [eax + 0xb4]
push dword [ebx + 4]
call fcn.00401b20
xor eax, eax
inc eax
jmp 0x4e6a06
cmp dword [ebx + 4], 0x100
push edi
jne 0x4e69fd
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
call edi
test ax, ax
jl 0x4e68eb
push 0x11
call edi
test ax, ax
jl 0x4e68eb
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x4e68eb
mov eax, dword [ebx + 8]
cmp eax, 0xd
je 0x4e685e
cmp eax, 0x20
jbe 0x4e68eb
cmp eax, 0x24
jbe 0x4e6851
cmp eax, 0x26
je 0x4e6851
cmp eax, 0x28
jne 0x4e68eb
call fcn.004e6030
test eax, eax
je 0x4e68eb
mov ecx, esi
call fcn.0040ee30
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
call fcn.004e6030
test eax, eax
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
je 0x4e6893
push dword [ebx + 0xc]
push dword [ebx + 8]
push dword [ebx + 4]
call fcn.00401b20
jmp 0x4e69f8
call fcn.0040cd98
test eax, eax
je 0x4e69f8
mov eax, dword [esi + 0x54]
add eax, 0xb8
push eax
mov ecx, esi
call fcn.0040cdd0
mov eax, dword [esi + 0x54]
mov eax, dword [eax + 0xb4]
test eax, eax
jne 0x4e68c1
xor edi, edi
jmp 0x4e68c4
mov edi, dword [eax + 0x20]
mov esi, dword [esi + 0x54]
mov ecx, dword [esi + 0xb4]
movzx esi, word [esi + 0x20]
call fcn.0040cd98
push edi
push esi
push 0x111
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x4e69f8
mov eax, dword [ebx + 8]
sub eax, 9
je 0x4e69c7
sub eax, 0x12
je 0x4e699f
sub eax, 0xb
je 0x4e690d
dec eax
dec eax
jne 0x4e69fd
push 0x12
call edi
test ax, ax
jl 0x4e69fd
push 0x11
call edi
test ax, ax
jl 0x4e69fd
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x4e69fd
call fcn.004e6030
test eax, eax
jne 0x4e69f8
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
push 1
call fcn.004e5faa
mov eax, dword [esi + 0x54]
mov eax, dword [eax + 0xb4]
push dword [eax + 0x20]
mov edi, dword [sym.imp.USER32.dll_GetParent]
call edi
push eax
call fcn.0040b70b
test eax, eax
je 0x4e69f8
mov esi, dword [esi + 0x54]
lea ebx, [esi + 0x90]
mov esi, dword [esi + 0xb4]
push dword [esi + 0x20]
call edi
push eax
call fcn.0040b70b
push 1
push ebx
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x4e69f8
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x4e69b3
push 0
call fcn.004e5faa
mov ecx, esi
call fcn.0040c866
test eax, eax
je 0x4e69fd
mov ecx, esi
call fcn.0040c866
jmp 0x4e69f1
push dword [esi + 0x20]
mov edi, dword [sym.imp.USER32.dll_GetParent]
call edi
push eax
call fcn.0040b70b
test eax, eax
je 0x4e69fd
push dword [esi + 0x20]
call edi
push eax
call fcn.0040b70b
push 0
push esi
mov ecx, eax
call fcn.00405b70
mov ecx, eax
call fcn.0040ee30
xor eax, eax
inc eax
jmp 0x4e6a05
push ebx
mov ecx, esi
call fcn.00409546
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4f3b0d
Capabilities:
Log keystrokes via polling
Open clipboard
Write clipboard data

Disassembly:
push 4
mov eax, 0x529151
call fcn.00502457
mov edi, ecx
mov esi, dword [ebp + 8]
cmp dword [esi + 4], 0x100
jne 0x4f3be6
mov ebx, dword [esi + 8]
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
and eax, 0x8000
je 0x4f3be6
cmp ebx, 0x43
je 0x4f3b4f
cmp ebx, 0x2d
jne 0x4f3be6
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4f3be6
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea ecx, [ebp - 0x10]
call fcn.004032a4
movzx ecx, byte [edi + 0xae]
and dword [ebp - 4], 0
push ecx
lea eax, [edi + 0xac]
movzx ecx, byte [eax + 1]
movzx eax, byte [eax]
push ecx
push eax
lea eax, [ebp - 0x10]
push str.RGB__d___d___d_
push eax
call fcn.004035e6
mov esi, dword [ebp - 0x10]
mov eax, dword [esi - 0xc]
add esp, 0x14
lea eax, [eax + eax + 2]
push eax
push 0x2000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
or dword [ebp - 4], 0xffffffff
lea ecx, [esi - 0x10]
call fcn.00401be0
mov esi, dword [ebp + 8]
push esi
mov ecx, edi
call fcn.00471532
call fcn.0050252f
ret 4

Function at 0x4fbcd3
Capabilities:
Log keystrokes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi]
push edi
call dword [eax + 0x150]
mov edi, eax
movzx eax, word [ebp + 8]
push 2
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
cmp byte [ebp + 0xc], 0
movzx eax, ax
jne 0x4fbd18
test edi, edi
jl 0x4fbd18
cmp ax, 0x20
je 0x4fbd0d
cmp word [ebp + 8], 0x71
jne 0x4fbd18
mov eax, dword [esi]
push edi
mov ecx, esi
call dword [eax + 0x168]
pop edi
pop esi
pop ebp
ret 8

Function at 0x50109b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x574978]
jne 0x5010a5
repz ret
jmp fcn.00508cd6
Function at 0x514c88
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0050863a
and dword [ebp - 4], 0
cmp dword [0x57bc44], 0
mov ebx, eax
jne 0x514d39
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x514dea
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x514dea
push eax
call fcn.005085c8
mov dword [esp], 0x552f40
push edi
mov dword [0x57bc44], eax
call esi
push eax
call fcn.005085c8
mov dword [esp], 0x552f2c
push edi
mov dword [0x57bc48], eax
call esi
push eax
call fcn.005085c8
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x57bc4c], eax
call esi
push eax
call fcn.005085c8
pop ecx
mov dword [0x57bc54], eax
test eax, eax
je 0x514d39
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.005085c8
pop ecx
mov dword [0x57bc50], eax
mov eax, dword [0x57bc50]
cmp eax, ebx
je 0x514d91
cmp dword [0x57bc54], ebx
je 0x514d91
push eax
call fcn.00508643
push dword [0x57bc54]
mov esi, eax
call fcn.00508643
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x514d91
test edi, edi
je 0x514d91
call esi
test eax, eax
je 0x514d88
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x514d88
test byte [ebp - 0xc], 1
jne 0x514d91
or dword [ebp + 0x10], 0x200000
jmp 0x514dca
mov eax, dword [0x57bc48]
cmp eax, ebx
je 0x514dca
push eax
call fcn.00508643
pop ecx
test eax, eax
je 0x514dca
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x514dca
mov eax, dword [0x57bc4c]
cmp eax, ebx
je 0x514dca
push eax
call fcn.00508643
pop ecx
test eax, eax
je 0x514dca
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x57bc44]
call fcn.00508643
pop ecx
test eax, eax
je 0x514dea
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x514dec
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x406e5a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x406e69
pop dword [ebp - 0x14]
mov eax, 0xa39fc25b
add eax, 0x5ca0ac0e
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x4d3cf
push 0
mov eax, 0x8050a1b6
sub eax, 0x800bef0e
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0x3d78
mov esi, eax
mov edx, 0x476e00
add edx, dword [ebp - 0x14]
mov edi, 0xf5dac3c7
sub edi, 0x8b7eb385
sub dword [ebp - 4], 0xe6f333a2
mov ebx, dword [edx]
mov dword [ebp - 0xc], 0xfa03a28
xor ebx, edi
xor dword [ebp - 8], 0x5d9a9093
mov dword [esi], ebx
add dword [ebp - 0x10], 0xd6643fa8
add esi, 0xe46ec081
add esi, 0x1b913f83
add edx, 4
loop 0x406ebc
add eax, 0x46b6a39
add eax, 0xfb957e7a
xor ebx, ebx
add ebx, eax
add eax, 0x24c49566
sub eax, 0x24c49561
mov ecx, 0x1857bdf8
add ecx, 0xe7e84208
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x43fbad
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46b5e8
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x43fbf0
push str.SystemFunction040
push dword [0x46b5e8]
call edi
push str.SystemFunction041
push dword [0x46b5e8]
mov dword [0x46b5f0], eax
call edi
mov dword [0x46b5f4], eax
jmp 0x43fbf5
mov eax, dword [0x46b5f4]
cmp dword [0x46b5f0], 0
je 0x43fc06
test eax, eax
jne 0x43fcad
push 0x46b5ec
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x43fcb7
push str.CryptProtectMemory
push dword [0x46b5ec]
call edi
cmp dword [0x46b5f0], 0
mov dword [0x46b5f8], eax
jne 0x43fc6b
test eax, eax
jne 0x43fc6b
call dword [sym.imp.kernel32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x28
push str.cryputil.cpp
call fcn.004037d3
jmp 0x43fcb7
push str.CryptUnprotectMemory
push dword [0x46b5ec]
call edi
cmp dword [0x46b5f4], 0
mov dword [0x46b5fc], eax
jne 0x43fcad
test eax, eax
jne 0x43fcad
call dword [sym.imp.kernel32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x2d
jmp 0x43fc5f
mov dword [0x46b600], 1
pop edi
mov eax, esi
pop esi
ret
Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408f6c
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x11e70b0f
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e3d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x27ce68f1
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x4027c0
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00403a88
test esi, esi
jne 0x4027f6
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00403b78
jmp 0x402814
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402664
mov edi, eax
test esi, esi
je 0x402814
cmp dword [ebx], 0
je 0x402814
dec esi
jmp 0x4027fd
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402824
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x410008], 0x8088405
inc edx
mov dword [ebx + 0x410008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403008
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x410014]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4030a0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403080
xor eax, eax
push ebp
push 0x403079
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4030bc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403080
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x410014]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x410014], ax
mov esp, ebp
pop ebp
ret

Function at 0x403908
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x411034], 0
je 0x403969
cmp word [0x411208], 0xd7b2
jne 0x403931
cmp dword [0x411210], 0
jbe 0x403931
mov eax, 0x411204
call dword [0x411220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x410060
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403990
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x410020], 0
jne 0x403985
push 0
push 0x410058
push 0x410060
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x40469c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x404702
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00403bf4
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402efc
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4046ec
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404709
lea eax, [ebp - 0x10]
call fcn.00403a88
ret
Function at 0x4052b0
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403dfc
xor eax, eax
push ebp
push 0x405304
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 4]
call fcn.00403e0c
mov ebx, eax
push ebx
call sub.kernel32.dll_SetFileAttributesA
push ebx
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40530b
lea eax, [ebp - 4]
call fcn.00403a88
ret

Function at 0x405314
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403dfc
mov eax, dword [ebp - 8]
call fcn.00403dfc
xor eax, eax
push ebp
push 0x405382
push dword fs:[eax]
mov dword fs:[eax], esp
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [ebp - 8]
call fcn.00403e0c
push eax
mov eax, dword [ebp - 4]
call fcn.00403e0c
push eax
call sub.kernel32.dll_CopyFileA
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405389
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403aac
ret

Function at 0x405404
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403dfc
xor eax, eax
push ebp
push 0x405455
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00403e0c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x405439
test al, 0x10
jne 0x40543d
xor ebx, ebx
jmp 0x40543f
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40545c
lea eax, [ebp - 4]
call fcn.00403a88
ret

Function at 0x405e1c
Capabilities:
Create mailslot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403dfc
xor eax, eax
push ebp
push 0x405eba
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov ecx, esi
lea edx, [ebp - 0x24]
lea eax, [ebp - 0x10]
call fcn.00405d54
test al, al
je 0x405ea4
lea eax, [ebp - 0x10]
push eax
push 0xffffffffffffffff
push 0
mov eax, dword [ebp - 4]
call fcn.00403e0c
mov ebx, eax
push ebx
call sub.kernel32.dll_CreateMailslotA
mov dword [0x491ac0], eax
push 0
push 0x80
push 3
push 0
push 3
push 0x40000000
push ebx
call sub.kernel32.dll_CreateFileA_1
mov dword [0x491ac4], eax
cmp dword [0x491ac0], 0xffffffff
je 0x405e9e
cmp dword [0x491ac4], 0xffffffff
jne 0x405ea2
xor ebx, ebx
jmp 0x405ea4
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405ec1
lea eax, [ebp - 4]
call fcn.00403a88
ret
Function at 0x405f08
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp 0x40a7ca
cmp dword [esp + 8], 2
je 0x40a867
push ebp
mov ebp, esp
sub esp, 4
push edi
push esi
push ebx
lea eax, [ebp - 8]
push eax
push 0x40
lea eax, [fcn.00405f11]
lea ecx, [0x40a7ca]
sub ecx, eax
push ecx
lea eax, [fcn.00405f11]
push eax
call sub.kernel32.dll_VirtualProtect
lea eax, [0x405f18]
mov ecx, dword [0x491cd0]
mov dword [eax], ecx
call fcn.00405f11
mov ebx, eax
mov edi, 5
lea esi, [0x406541]
push esi
pop esi
lodsd eax, dword [esi]
add eax, ebx
push eax
call sub.kernel32.dll_LoadLibraryA
mov edx, eax
lodsd eax, dword [esi]
mov dword [eax], edx
lodsd eax, dword [esi]
mov ecx, eax
lodsd eax, dword [esi]
push esi
mov esi, eax
push ecx
push edx
lodsd eax, dword [esi]
add eax, ebx
push eax
push edx
call sub.kernel32.dll_GetProcAddress
mov ecx, eax
lodsd eax, dword [esi]
mov dword [eax], ecx
pop edx
pop ecx
loop 0x40a836
dec edi
jne 0x40a820
pop esi
call fcn.00405f11
mov ebx, eax
push 2
push dword [ebp + 8]
call fcn.0040903c
pop ebx
pop esi
pop edi
leave
ret 8
push ebp
mov ebp, esp
push edi
push esi
push ebx
call fcn.00405f11
mov ebx, eax
push dword [ebp + 8]
call fcn.004094cc
pop ebx
pop esi
pop edi
leave
ret 8

Function at 0x40ad58
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x40aea3
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [0x491cd0], eax
mov esi, fcn.00405f08
xor ebx, ebx
lea ecx, [ebp - 4]
mov edx, 0xd
mov al, 0x20
call fcn.00403f50
jmp 0x40adc5
lea eax, [ebp - 4]
call fcn.00403e5c
mov ecx, 0xd
mov edx, esi
call fcn.00404c2c
mov eax, dword [ebp - 4]
mov edx, 0x40aeb8
call fcn.00403d58
sete bl
test bl, bl
je 0x40adc4
mov eax, esi
sub eax, 0x2c
mov dword [0x491cd0], eax
inc esi
test bl, bl
je 0x40ad92
sub esi, 0x26
push 0x1c
lea eax, [ebp - 0x24]
push eax
push fcn.00405f08
call sub.kernel32.dll_VirtualQuery
lea eax, [ebp - 8]
push eax
push 0x40
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x24]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x40ae8d
mov eax, dword [0x493c90]
call fcn.00403c0c
push eax
mov eax, 0x493c90
call fcn.00403e5c
mov edx, eax
mov eax, esi
pop ecx
call fcn.00404c2c
add esi, 0x21
mov eax, 0x40aed0
call fcn.0040ac50
test eax, eax
jne 0x40ae2c
call sub.kernel32.dll_GetCurrentProcessId
mov dword [esi], eax
xor ebx, ebx
lea ecx, [ebp - 4]
mov edx, 0x19
mov al, 0x20
call fcn.00403f50
jmp 0x40ae89
lea eax, [ebp - 4]
call fcn.00403e5c
mov ecx, 0x19
mov edx, esi
call fcn.00404c2c
mov eax, dword [ebp - 4]
mov edx, 0x40aee0
call fcn.00403d58
sete bl
test bl, bl
je 0x40ae88
mov eax, dword [0x493c94]
call fcn.00403c0c
push eax
mov eax, 0x493c94
call fcn.00403e5c
mov edx, eax
mov eax, esi
pop ecx
call fcn.00404c2c
inc esi
test bl, bl
je 0x40ae41
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40aeaa
lea eax, [ebp - 4]
call fcn.00403a88
ret
Function at 0x40afdc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
push esi
mov esi, dword [ebp + 8]
push esi
push 0x3f1
pop ebx
mov eax, 0xfa230000
mov edx, 0x633af89e
mov edi, 0x3481a3c1
pop esi
push esi
push 8
pop ecx
lodsw ax, word [esi]
shl eax, 3
add eax, edi
xor edx, eax
add dh, cl
sete al
inc al
add edi, eax
loop 0x40b000
add edx, edi
dec ebx
jne 0x40affb
mov eax, edx
pop esi
pop esi
pop ebx
pop edi
pop ebp
ret 4

Function at 0x40c928
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebx
add esp, 0xfffffff4
push esp
push 1
push 0
push 0x40c9bc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
push 0
push 0
push 0
push 0
push 0x40ca14
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov ebx, eax
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
test ebx, ebx
jne 0x40c9b5
xor eax, eax
mov dword [esp + 4], eax
lea eax, [esp + 8]
push eax
lea eax, [esp + 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x40ca28
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
push 4
lea eax, [esp + 8]
push eax
push 4
push 0
push 0x40ca14
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
add esp, 0xc
pop ebx
ret

Function at 0x40ca80
Capabilities:
Check os version

Disassembly:
push ebx
add esp, 0xffffff6c
xor ebx, ebx
mov dword [esp], 0x94
push esp
call 0x404b1c
test eax, eax
je 0x40cb02
mov eax, dword [esp + 4]
cmp eax, 5
jb 0x40cab2
cmp dword [esp + 8], 1
jb 0x40caae
mov bl, 9
jmp 0x40cb02
mov bl, 7
jmp 0x40cb02
cmp eax, 3
jbe 0x40cb00
cmp dword [esp + 0x10], 2
je 0x40cafc
and dword [esp + 0xc], 0xffff
mov eax, dword [esp + 8]
cmp eax, 0x5a
jae 0x40caf8
cmp eax, 0xa
jb 0x40cae6
cmp dword [esp + 0xc], 0x8ae
jb 0x40cae2
mov bl, 6
jmp 0x40cb02
mov bl, 5
jmp 0x40cb02
cmp dword [esp + 0xc], 0x3e8
jb 0x40caf4
mov bl, 4
jmp 0x40cb02
mov bl, 3
jmp 0x40cb02
mov bl, 8
jmp 0x40cb02
mov bl, 2
jmp 0x40cb02
mov bl, 1
mov eax, ebx
add esp, 0x94
pop ebx
ret
Function at 0x40cb94
Capabilities:
Get common file path
Get comspec environment variable
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor eax, eax
mov dword [ebp - 0x10c], eax
mov ebx, 0x493cc4
xor eax, eax
push ebp
push 0x40cd2b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x40cd40
call fcn.00403adc
lea eax, [ebp - 0x105]
mov edx, 0x105
xor ecx, ecx
call fcn.00402c24
push 0x105
lea eax, [ebp - 0x105]
push eax
push 0x40cd48
call sub.kernel32.dll_GetEnvironmentVariableA
lea eax, [ebx + 4]
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.00403bf4
lea eax, [ebx + 8]
mov edx, 0x40cd58
call fcn.00403adc
lea edx, [ebp - 0x10c]
mov eax, dword [ebx + 4]
call fcn.00405464
mov edx, dword [ebp - 0x10c]
lea eax, [ebx + 0xc]
call fcn.00403adc
lea eax, [ebx + 0xc]
call fcn.00405634
lea eax, [ebx + 0x10]
mov edx, 0x40cd6c
call fcn.00403adc
lea eax, [ebp - 0x105]
mov edx, 0x105
xor ecx, ecx
call fcn.00402c24
push 0x104
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebx + 0x14]
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.00403bf4
lea eax, [ebx + 0x14]
call fcn.00405634
lea eax, [ebx + 0x18]
mov edx, 0x40cd80
call fcn.00403adc
lea eax, [ebp - 0x105]
mov edx, 0x105
xor ecx, ecx
call fcn.00402c24
push 0x104
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebx + 0x1c]
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.00403bf4
lea eax, [ebx + 0x1c]
call fcn.00405634
lea eax, [ebx + 0x20]
mov edx, 0x40cd94
call fcn.00403adc
lea eax, [ebp - 0x105]
mov edx, 0x105
xor ecx, ecx
call fcn.00402c24
lea eax, [ebp - 0x105]
push eax
push 0x105
call sub.kernel32.dll_GetTempPathA
lea eax, [ebx + 0x24]
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.00403bf4
lea eax, [ebx + 0x24]
call fcn.00405634
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cd32
lea eax, [ebp - 0x10c]
call fcn.00403a88
ret