joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001900
Capabilities:
Create directory
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
dec eax
push esi
jne 0x10001974
push eax
push str.C:UsersPublicLibrariesACDialog
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push str.2c45e0c3c2f3a2d54b8549b3d6f64e483701e6
push 0
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventA]
test eax, eax
je 0x10001934
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str.2c45e0c3c2f3a2d54b8549b3d6f64e483701e6
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
sub esp, 0x1c
mov esi, esp
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov dword [ebp + 0xc], esp
mov word [esi], ax
push 0x22
mov eax, 0x1000b1b0
call fcn.10001e80
call fcn.10001750
add esp, 0x1c
mov eax, 1
pop esi
pop ebp
ret 0xc

Function at 0x10005ff7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1000d360]
jne 0x10006001
repz ret
jmp fcn.100071ca
Function at 0x1000608a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1000d360]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.100034f9
and dword [ebp - 0x14], 0
cmp dword [0x100119a0], 0
mov dword [ebp - 0x18], eax
jne 0x1000613d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x100061e5
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x100061e5
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x100119a0], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x100119a4], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x100119a8], eax
call edi
push eax
call esi
mov dword [0x100119b0], eax
test eax, eax
je 0x1000613d
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x100119ac], eax
mov eax, dword [0x100119ac]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x10006196
cmp dword [0x100119b0], ecx
je 0x10006196
push eax
call esi
push dword [0x100119b0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x10006196
test ebx, ebx
je 0x10006196
call edi
test eax, eax
je 0x1000618d
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x1000618d
test byte [ebp - 8], 1
jne 0x10006196
or dword [ebp + 0x10], 0x200000
jmp 0x100061c9
mov eax, dword [0x100119a4]
cmp eax, dword [ebp - 0x18]
je 0x100061c9
push eax
call esi
test eax, eax
je 0x100061c9
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100061c9
mov eax, dword [0x100119a8]
cmp eax, dword [ebp - 0x18]
je 0x100061c9
push eax
call esi
test eax, eax
je 0x100061c9
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x100119a0]
call esi
test eax, eax
je 0x100061e5
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x100061e7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10005ff7
leave
ret
Function at 0x4aed84
Capabilities:
Encode data using base64
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp + 4], ecx
mov dword [esp], edx
mov edi, 0x58033c
lea ecx, [esp + 8]
mov dword [ecx], eax
mov eax, dword [esp]
mov dword [esp + 0xc], eax
xor ebx, ebx
xor esi, esi
mov eax, dword [esp + 4]
mov ebp, 3
cdq
idiv ebp
test eax, eax
jle 0x4aee48
mov edx, dword [ecx]
movzx edx, byte [edx + ebx]
shr edx, 2
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx]
and dl, 3
and edx, 0xff
shl edx, 4
mov ebp, dword [ecx]
movzx ebp, byte [ebp + ebx + 1]
shr ebp, 4
add edx, ebp
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 1], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx + 1]
and dl, 0xf
and edx, 0xff
shl edx, 2
mov ebp, dword [ecx]
movzx ebp, byte [ebp + ebx + 2]
shr ebp, 6
add edx, ebp
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 2], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx + 2]
and dl, 0x3f
and edx, 0xff
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 3], dl
add esi, 4
add ebx, 3
dec eax
jne 0x4aedbc
mov eax, dword [esp + 4]
mov ebp, 3
cdq
idiv ebp
dec edx
je 0x4aee5f
dec edx
je 0x4aeea0
jmp 0x4aeefd
mov eax, dword [ecx]
movzx eax, byte [eax + ebx]
shr eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi], al
mov eax, dword [ecx]
mov al, byte [eax + ebx]
and al, 3
and eax, 0xff
shl eax, 4
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 1], al
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 2], 0x3d
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 3], 0x3d
jmp 0x4aeefd
mov eax, dword [ecx]
movzx eax, byte [eax + ebx]
shr eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi], al
mov eax, dword [ecx]
mov al, byte [eax + ebx]
and al, 3
and eax, 0xff
shl eax, 4
mov edx, dword [ecx]
movzx edx, byte [edx + ebx + 1]
shr edx, 4
add eax, edx
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 1], al
mov eax, dword [ecx]
mov al, byte [eax + ebx + 1]
and al, 0xf
and eax, 0xff
shl eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 2], al
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 3], 0x3d
mov eax, dword [esp + 4]
add eax, 2
mov ecx, 3
cdq
idiv ecx
shl eax, 2
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4aef60
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp + 4], eax
mov dword [esp + 8], edx
xor esi, esi
xor edi, edi
xor eax, eax
mov ebp, ecx
test ebp, ebp
jns 0x4aef7d
add ebp, 3
sar ebp, 2
test ebp, ebp
jle 0x4af08f
mov edx, 4
mov eax, esp
mov ecx, dword [esp + 4]
movzx ecx, byte [ecx + esi]
cmp ecx, 0x3d
jg 0x4aefb0
je 0x4aeffc
sub ecx, 0x2b
je 0x4aeff2
sub ecx, 4
je 0x4aeff7
dec ecx
sub ecx, 0xa
jb 0x4aefe1
jmp 0x4aefff
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x4aefc2
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x4aefd0
jmp 0x4aefff
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x4aefff
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x4aefff
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x4aefff
mov byte [eax], 0x3e
jmp 0x4aefff
mov byte [eax], 0x3f
jmp 0x4aefff
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x4aef8f
mov al, byte [esp]
shl eax, 2
xor edx, edx
mov dl, byte [esp + 1]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi], al
lea eax, [edi + 1]
mov dl, byte [esp + 2]
cmp dl, 0xff
je 0x4af04f
cmp byte [esp + 3], 0xff
jne 0x4af04f
mov al, byte [esp + 1]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi + 1], al
lea eax, [edi + 2]
inc edi
jmp 0x4af087
cmp dl, 0xff
je 0x4af087
mov al, byte [esp + 1]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi + 1], al
mov eax, dword [esp + 8]
mov dl, byte [esp + 2]
shl edx, 6
or dl, byte [esp + 3]
mov byte [eax + edi + 2], dl
lea eax, [edi + 3]
add edi, 2
inc edi
dec ebp
jne 0x4aef88
add esp, 0xc
pop ebp
pop edi
pop esi
ret

Function at 0x4af11c
Capabilities:
Hash data with crc32

Disassembly:
push ebx
xor ebx, ebx
mov ecx, 0x5917a0
mov eax, ebx
mov edx, 8
test al, 1
je 0x4af138
shr eax, 1
xor eax, 0xedb88320
jmp 0x4af13a
shr eax, 1
dec edx
jne 0x4af12b
mov dword [ecx], eax
inc ebx
add ecx, 4
cmp ebx, 0x100
jne 0x4af124
pop ebx
ret
Function at 0x4af150
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x4af159
mov eax, dword [ebp - 4]
add esp, 0xfffffebc
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004a6a38
xor eax, eax
push ebp
push 0x4af239
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004af11c
mov eax, dword [0x590e0c]
mov byte [eax], 0
mov dword [ebx], reloc.WINMM.dll_midiStreamOut
mov edx, dword [ebp - 4]
lea eax, reloc.WINMM.dll_midiStreamOut
call fcn.004a4e7c
mov edx, 1
lea eax, reloc.WINMM.dll_midiStreamOut
call fcn.004a5218
call fcn.004a4ba8
test eax, eax
jne 0x4af216
lea eax, [ebp - 8]
push eax
lea edx, reloc.WINMM.dll_midiStreamOut
mov ecx, 0xfff1
lea eax, reloc.WINMM.dll_midiStreamOut
call fcn.004a4fcc
mov dx, word [ebp - 8]
test dx, dx
jbe 0x4af210
lea eax, reloc.WINMM.dll_midiStreamOut
xor ecx, ecx
mov cl, byte [eax]
mov esi, dword [ebx]
and esi, 0xff
xor ecx, esi
mov ecx, dword [ecx*4 + reloc.WINMM.dll_midiStreamOut]
mov esi, dword [ebx]
shr esi, 8
xor ecx, esi
mov dword [ebx], ecx
inc eax
dec dx
jne 0x4af1ec
cmp dword [ebp - 8], 0
jne 0x4af1c3
lea eax, reloc.WINMM.dll_midiStreamOut
call fcn.004a4fec
not dword [ebx]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4af240
lea eax, [ebp - 4]
call fcn.004a6588
ret

Function at 0x4ba718
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jbe 0x4ba738
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
mov bl, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x4ba726
pop edi
pop esi
pop ebx
ret
Function at 0x4c2fd4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
xor ebp, ebp
mov ebx, 0x591cb4
mov eax, ebp
shr eax, 1
and eax, 0xff
mov dword [esp], eax
mov esi, ebp
and esi, 1
mov eax, ebp
and eax, 0x200
shr eax, 8
or esi, eax
mov edx, dword [esi*4 + reloc.WINMM.dll_midiStreamOut]
mov eax, dword [esi*4 + reloc.WINMM.dll_midiStreamOut]
xor eax, dword [esp]
call fcn.004c2f70
mov edi, eax
shl edi, 0x18
mov eax, edi
call fcn.004c2fac
mov dword [ebx], eax
mov edx, dword [esi*4 + reloc.WINMM.dll_midiStreamOut]
mov eax, dword [esi*4 + reloc.WINMM.dll_midiStreamOut]
xor eax, dword [esp]
call fcn.004c2f70
mov edi, eax
shl edi, 0x10
mov eax, edi
call fcn.004c2fac
mov dword [ebx + reloc.WINMM.dll_midiStreamOut], eax
mov edx, dword [esi*4 + reloc.WINMM.dll_midiStreamOut]
mov eax, dword [esi*4 + reloc.WINMM.dll_midiStreamOut]
xor eax, dword [esp]
call fcn.004c2f70
mov edi, eax
shl edi, 8
mov eax, edi
call fcn.004c2fac
mov dword [ebx + reloc.WINMM.dll_midiStreamOut], eax
mov edx, dword [esi*4 + reloc.WINMM.dll_midiStreamOut]
mov eax, dword [esi*4 + reloc.WINMM.dll_midiStreamOut]
xor eax, dword [esp]
call fcn.004c2f70
mov edi, eax
mov eax, edi
call fcn.004c2fac
mov dword [ebx + reloc.WINMM.dll_midiStreamOut], eax
inc ebp
add ebx, 4
cmp ebp, 0x400
jne 0x4c2fe0
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4c3138
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
mov ecx, dword [eax + edx*4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
lea eax, [edx + eax*4 + 0x4c]
mov dword [ebp - 0x14], eax
xor ebx, ebx
mov eax, dword [ebp - 0x14]
xor edx, edx
mov dword [eax + ebx*4], edx
inc ebx
cmp ebx, 3
jne 0x4c316d
xor ebx, ebx
mov eax, ebx
mov esi, 3
xor edx, edx
div esi
mov eax, dword [ebp - 0x14]
lea eax, [eax + edx*4]
mov dword [ebp - 0x18], eax
xor eax, eax
lea edx, [eax + ecx]
and edx, 3
mov esi, dword [ebp - 8]
lea edx, [esi + edx*2]
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp - 0x1c]
mov dx, word [edx]
and dx, 1
movzx edx, dx
mov esi, dword [ebp - 0x18]
mov esi, dword [esi]
add esi, esi
or esi, edx
mov edi, dword [ebp - 0x18]
mov dword [edi], esi
mov esi, dword [ebp - 0x1c]
movzx esi, word [esi]
shr esi, 1
xor dx, 1
shl edx, 0xf
or si, dx
mov edx, dword [ebp - 0x1c]
mov word [edx], si
inc eax
cmp eax, 4
jne 0x4c3193
inc ebx
cmp ebx, 0xf
jne 0x4c317d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 8
jne 0x4c314f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x53c654
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.0053c804
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x53c752
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x53c6f5
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x53c738
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x53c70c
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x53c727
test al, 0x40
je 0x53c71e
mov ecx, dword [edi + 0x20]
jmp 0x53c725
test al, 0x80
je 0x53c738
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x53c738
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x53c6c4
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x59df02
Capabilities:
Encode data using xor

Disassembly:
mov dx, word [esp + 8]
mov byte [esp + 0x14], dh
jmp 0x59df11
lea esp, [esp + 1]
jmp 0x59df52
mov edx, dword [ecx + edi]
Function at 0x5a7799
Capabilities:
Encode data using xor

Disassembly:
jmp 0x5a77d7
add edi, 0xc
push edx
add esp, 1
push bx
lea esp, [esp + 1]
jmp 0x5ee25f
add esp, 4
lea esp, [esp + 1]
jmp 0x5a77bf

Function at 0x7484e1
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
call fcn.0074703c
jmp 0x7485b9
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x74857d
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x747037
push word [esp + 6]
pushfd
lea esp, [esp + 3]
mov dword [esp + 0x34], edi
lea esp, [esp + 0x34]
jmp 0x7484e6

Function at 0x40100b
Capabilities:
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x40109c
lea eax, [ebp - 0x104]
push eax
call fcn.004011ec
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x401165
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401038
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011a5
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401052
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011a5
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x40114a
mov word [ebx], 0x5c
push 0x401023
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011a5
mov dword [ebp - 0x108], eax
push 0x40102d
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x40119a
push 0x3e8
call eax
test eax, eax
je 0x40119a
call 0x40118a
add dword [esp], 0x1e76
call eax
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x401096
push 0x401057
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret
Function at 0x401380
Capabilities:
Clear file content
Write file on windows

Disassembly:
sub esp, 8
cmp dword [0x42e1c8], 0
push esi
je 0x401397
mov eax, 1
pop esi
add esp, 8
ret
cmp dword [0x42e1e4], 8
mov esi, dword [0x42e1d0]
jae 0x4013ab
mov esi, 0x42e1d0
call fcn.00401ef0
mov dword [0x42e1c8], eax
mov eax, dword [0x42e1a8]
cmp eax, 0xffffffff
je 0x4013d5
call fcn.00401f50
mov eax, dword [0x42e1a8]
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov eax, dword [0x42e1a8]
mov byte [esp + 4], 0xff
mov byte [esp + 5], 0xfe
cmp eax, 0xffffffff
je 0x401401
push 0
lea ecx, [esp + 0xc]
push ecx
push 2
lea edx, [esp + 0x10]
push edx
push eax
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [0x42e1c8]
pop esi
add esp, 8
ret

Function at 0x401410
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4246f0
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x42c3f8]
xor eax, esp
mov dword [esp + 0x4c], eax
push ebx
push esi
mov eax, dword [0x42c3f8]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
xor ebx, ebx
xor eax, eax
mov esi, ecx
mov dword [esp + 0x54], 7
mov dword [esp + 0x50], ebx
mov word [esp + 0x40], ax
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x6c], ebx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [esp + 0x1c]
movzx eax, word [esp + 0x1a]
movzx ecx, word [esp + 0x18]
push esi
push edx
movzx edx, word [esp + 0x1e]
push eax
movzx eax, word [esp + 0x1e]
push ecx
movzx ecx, word [esp + 0x20]
push edx
push eax
push ecx
push str.__4d__.2d__.2d__.2d:_.2d:_.2d___s_r_n
lea esi, [esp + 0x40]
call fcn.004020a0
add esp, 0x20
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x48]
mov byte [esp + 0x74], 1
call fcn.00401610
mov esi, 8
mov byte [esp + 0x68], bl
cmp dword [esp + 0x38], esi
jb 0x4014d0
mov edx, dword [esp + 0x24]
push edx
call fcn.00411e4d
add esp, 4
call fcn.00401380
test eax, eax
je 0x40150a
mov ecx, dword [esp + 0x40]
cmp dword [esp + 0x54], esi
jae 0x4014e7
lea ecx, [esp + 0x40]
mov eax, dword [0x42e1a8]
cmp eax, 0xffffffff
je 0x40150a
push ebx
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x58]
add edx, edx
push edx
push ecx
push eax
mov dword [esp + 0x20], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [esp + 0x54], esi
jb 0x40151d
mov eax, dword [esp + 0x40]
push eax
call fcn.00411e4d
add esp, 4
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.00411eb4
mov esp, ebp
pop ebp
ret
Function at 0x401990
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x424688
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x42c3f8]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x40]
xor edi, edi
push 0xffffffffffffffff
push edi
xor eax, eax
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], edi
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], edi
mov word [esp + 0x20], ax
call fcn.00401610
mov edx, dword [esp + 0x44]
mov eax, edx
mov dword [esp + 0x34], edi
lea esi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4019f0
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x18]
call fcn.00401ac0
mov esi, dword [esp + 0x3c]
push 0xffffffffffffffff
push edi
xor edx, edx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push eax
mov ecx, esi
mov word [esi + 4], dx
call fcn.00401610
cmp dword [esp + 0x28], 8
jb 0x401a3d
mov eax, dword [esp + 0x14]
push eax
call fcn.00411e4d
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x2c
ret

Function at 0x403b50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x24], ecx
push 0
mov ecx, dword [ebp - 0x24]
add ecx, 4
call fcn.00402f80
cmp dword [ebp - 0x24], 0
je 0x403b77
mov eax, dword [ebp - 0x24]
add eax, 4
mov dword [ebp - 0x28], eax
jmp 0x403b7e
mov dword [ebp - 0x28], 0
push 0
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.00408670
add esp, 8
push 0x80
mov ecx, 0x42d4c4
call fcn.00402f20
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [ebp - 0xc], eax
push 1
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 0x24]
add ecx, 4
call fcn.00402f50
push 0
mov ecx, dword [ebp - 0x24]
add ecx, 4
call fcn.00402f30
push eax
lea ecx, [ebp - 8]
call fcn.00407670
push 1
push 0xf060
lea ecx, [ebp - 8]
call fcn.004035c0
lea ecx, [ebp - 8]
call fcn.00403590
push 0x3f2
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x24]
add ecx, 4
call fcn.004032b0
mov ecx, eax
call fcn.004032a0
push eax
lea ecx, [ebp - 4]
call fcn.00403540
push 1
mov ecx, dword [ebp - 0x24]
add ecx, 0x24
call fcn.004032a0
push eax
lea ecx, [ebp - 4]
call fcn.004053d0
lea ecx, [ebp - 0x14]
call fcn.00405400
push 0xd5
lea ecx, [ebp - 0x14]
call fcn.00405420
lea ecx, [ebp - 0x14]
call fcn.004032a0
push eax
lea ecx, [ebp - 4]
call fcn.004053b0
push 0x3e9
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, dword [ebp - 0x24]
add ecx, 4
call fcn.004032b0
mov ecx, eax
call fcn.004032a0
push eax
lea ecx, [ebp - 0x10]
call fcn.00403540
push 0x258
push 1
lea ecx, [ebp - 0x10]
call fcn.004069c0
push 0
push 0
mov edx, dword [ebp - 0x24]
push edx
push 0x404010
push 0
push 0
call fcn.00411fc4
add esp, 0x18
mov dword [ebp - 0x20], 1
lea ecx, [ebp - 0x14]
call fcn.00405690
lea ecx, [ebp - 8]
call fcn.00403560
mov eax, dword [ebp - 0x20]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x404400
Capabilities:
Delete registry key
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push 0x4257f0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x40443c
push 0x42584c
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push str.Softwareduowanyy
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall
lea ecx, [ebp - 8]
call fcn.00405d60
push 0x4258e8
lea ecx, [ebp - 8]
call fcn.00406010
push 0x4258ec
lea ecx, [ebp - 8]
call fcn.00406010
lea ecx, [ebp - 8]
call fcn.004032a0
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea ecx, [ebp - 8]
call fcn.00405690
mov esp, ebp
pop ebp
ret