joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44af84
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x44af9b
add esp, 0xfffffff0
call fcn.004033e4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00418ecc
mov eax, dword [0x44ff34]
cmp word [eax + 2], 0
jne 0x44afc3
mov eax, dword [0x44ff34]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0044c65c
mov eax, dword [0x44ffdc]
cmp word [eax + 2], 0
jne 0x44afdd
mov eax, dword [0x44ffdc]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0044c854
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x4111c4]
call fcn.004030a8
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4111c4]
call fcn.004030a8
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41b0a0]
call fcn.00420d30
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x44b164
mov eax, dword [0x44fe5c]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00421100
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x44cdf4
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x44fe5c]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040bdb4
test eax, eax
je 0x44b0d2
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.0040816c
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040bddc
test eax, eax
je 0x44b0e6
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404080
mov eax, dword [0x44fd60]
cmp byte [eax], 0
jne 0x44b11a
mov eax, ebx
call fcn.0044b28c
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0044cfd0
mov eax, ebx
call fcn.0044d994
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x44b15a
call fcn.0040343c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44b50c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x451bb0]
cmp dword [eax + 0x30], 0
je 0x44b5b6
cmp dword [ebx + 0x94], 0
jne 0x44b5b0
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x44b49c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x44b5b0
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x44b576
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x44b5b0
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041352c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x44b585
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x44c118
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x44c14d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403f00
jmp 0x44c15a
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00403e64
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x44d1ac
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x44d1ed
mov eax, esi
call fcn.00433a30
test al, al
je 0x44d1ed
mov eax, dword [ebx + 0x84]
call fcn.00433758
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x44d1ed
push 0
mov eax, dword [ebx + 0x84]
call fcn.00433758
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x4017c0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x68
fldz
xor eax, eax
mov word [esp], ax
fst qword [esp + 0xc]
fstp qword [esp + 4]
xor ecx, ecx
fld qword [0x423098]
mov dword [esp + 0x24], 0x44
fsub qword [0x41e3a8]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], ecx
fsub qword [0x41e3a0]
fcomp qword [0x41e398]
fnstsw ax
test ah, 1
jne 0x401827
fld qword [esp + 4]
fsub qword [esp + 0xc]
mov dx, word [esp]
movsx eax, dx
mov dword [esp], eax
fild dword [esp]
faddp st(1)
fmul qword [0x422fc8]
fstp qword [0x422fc8]
fld qword [0x424c10]
xor edx, edx
fld dword [0x423040]
mov word [esp + 0x56], dx
fadd qword [0x41e390]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x50], 1
mov edx, 1
fsubp st(1)
fstp qword [0x424c10]
fld dword [0x423040]
mov dword [esp + 0x58], ecx
fsub qword [0x41e348]
fstp dword [0x423040]
fld qword [esp + 4]
fsub qword [esp + 0xc]
mov eax, dword [0x424d14]
mov dword [esp], eax
fild dword [esp]
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x74]
faddp st(1)
fmul qword [esp + 8]
mov word [esp + 0x58], dx
lea edx, [esp + 0x28]
push edx
push ecx
fstp qword [esp + 0x10]
push ecx
push 8
push ecx
push ecx
push ecx
mov ecx, dword [esp + 0x8c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
add esp, 0x68
ret

Function at 0x402360
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
fldz
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push esi
xor eax, eax
mov word [esp + 0xc], ax
fst dword [esp + 0x10]
push edi
fstp dword [esp + 0x18]
push ebx
call fcn.0040ab09
mov edi, dword [esp + 0x24]
push ebx
mov esi, eax
push edi
push esi
call fcn.0040ace0
movzx edx, word [esp + 0x20]
mov ecx, dword [0x4267c4]
sub edi, 0x422004
lea ebp, [esi + ebx]
add edx, 0x4e4ae7a3
add esp, 0x10
add ecx, edi
mov eax, esi
mov word [esp + 0x10], dx
cmp esi, ebp
je 0x4023ca
lea ebx, [ebx]
mov dl, byte [ecx]
xor byte [eax], dl
inc eax
inc ecx
cmp eax, ebp
jne 0x4023c0
fld dword [esp + 0x14]
pop edi
fsub qword [0x41e418]
mov eax, esi
pop esi
pop ebp
fstp dword [esp + 8]
pop ebx
add esp, 0xc
ret
Function at 0x403ae0
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc
fldz
xor eax, eax
mov word [esp], ax
fstp dword [esp]
fldz
push ebx
push 0x2e
fstp qword [esp + 8]
push 0x422410
call fcn.00402360
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov ebx, eax
push ebx
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x403b5f
push esi
push edi
push 0x34
push 0x424e7c
call fcn.00402360
mov edx, dword [esp + 0x24]
mov esi, eax
mov eax, edx
add esp, 8
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403b37
sub eax, edi
push eax
push edx
mov edx, dword [esp + 0x1c]
push 1
push 0
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push esi
push 0x34
call fcn.00401b40
add esp, 8
pop edi
pop esi
fld dword [0x423078]
fadd qword [0x41e348]
fstp dword [0x423078]
fld qword [esp + 4]
fsub dword [0x423078]
call fcn.0040abf0
push ebx
push 0x2e
mov dword [0x424dac], eax
call fcn.00401b40
mov eax, dword [esp + 0x14]
add esp, 8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
add esp, 0xc
ret

Function at 0x403d50
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
fldz
push ebx
push esi
push edi
xor eax, eax
mov dword [esp + 0xc], 0
push 3
mov word [esp + 0x10], ax
fstp dword [esp + 0x14]
push 0x422f98
call fcn.00402360
mov ebx, dword [esp + 0x20]
mov edi, eax
push edi
push ebx
call fcn.0040b7fe
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x403da8
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
push ebx
call fcn.0040b7fe
mov esi, eax
add esp, 8
test esi, esi
je 0x403dc0
push esi
push 1
lea ecx, [esp + 0x24]
push 4
push ecx
call fcn.0040b977
push esi
call fcn.0040b3a4
add esp, 0x14
movzx edx, word [esp + 0xc]
imul edx, edx, 0xfdf464b8
push edi
push 3
mov word [esp + 0x14], dx
call fcn.00401b40
add esp, 8
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x404510
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x60
mov eax, dword [0x424fb0]
xor eax, esp
mov dword [esp + 0x5c], eax
push ebx
push ebp
push esi
push edi
fldz
xor eax, eax
mov word [esp + 0x10], ax
fst qword [esp + 0x1c]
fstp qword [esp + 0x14]
xor ecx, ecx
mov ebp, dword [esp + 0x78]
mov word [esp + 0x14], cx
mov esi, dword [esp + 0x74]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
xor edx, edx
mov word [esp + 0x14], dx
fld dword [0x4220c4]
fsub qword [0x41e590]
add ecx, ecx
mov edx, eax
add ecx, ecx
fcomp qword [0x41e588]
shr edx, 0x1d
add ecx, ecx
or ecx, edx
lea ebx, [eax*8]
mov eax, ecx
shr eax, 0x18
mov byte [esp + 0x24], al
mov eax, ecx
shr eax, 8
mov byte [esp + 0x26], al
fnstsw ax
mov edx, ecx
shr edx, 0x10
mov byte [esp + 0x25], dl
test ah, 0x41
jp 0x4045a8
movzx edx, word [esp + 0x10]
imul edx, edx, 0xb1979981
mov word [esp + 0x10], dx
jmp 0x4045ba
fld dword [0x424adc]
fmul qword [0x41e580]
fstp dword [0x424adc]
mov ax, word [esp + 0x10]
mov byte [esp + 0x27], cl
movsx ecx, ax
mov dword [esp + 0x10], ecx
fild dword [esp + 0x10]
fld qword [0x424b08]
fsub qword [0x41e578]
fsubp st(1)
call fcn.0040abf0
mov word [esp + 0x10], ax
fld qword [0x4220a8]
fadd qword [esp + 0x1c]
mov edx, ebx
shr edx, 0x18
mov byte [esp + 0x28], dl
fstp qword [esp + 0x1c]
mov eax, ebx
fld qword [0x4220a8]
shr eax, 0x10
fsub qword [0x41e348]
mov byte [esp + 0x29], al
mov ecx, ebx
shr ecx, 8
fstp qword [0x4220a8]
mov byte [esp + 0x2a], cl
fld qword [esp + 0x1c]
mov dx, word [esp + 0x14]
movsx eax, dx
add eax, 0x6a7a18c3
mov dword [esp + 0x10], eax
mov byte [esp + 0x2b], bl
mov eax, 0x44d8e299
fild dword [esp + 0x10]
mov edi, 0x38
fsubp st(1)
fstp qword [esp + 0x1c]
inc dword [esp + 0x14]
dec dword [esp + 0x14]
mov cx, word [esp + 0x14]
movsx edx, cx
sub eax, edx
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
fadd qword [0x422fd8]
fstp qword [0x422fd8]
mov eax, dword [esi]
and eax, 0x3f
cmp eax, 0x38
jb 0x404683
mov edi, 0x78
push 0x40
lea ecx, [esp + 0x30]
push 0
push ecx
sub edi, eax
call fcn.0040aa40
fld qword [0x41e570]
push edi
fstp qword [0x422f48]
lea edx, [esp + 0x3c]
push edx
push esi
mov byte [esp + 0x44], 0x80
call fcn.00404010
push 8
lea eax, [esp + 0x40]
push eax
push esi
call fcn.00404010
fld qword [esp + 0x40]
fsub qword [0x41e568]
lea eax, [esi + 8]
add esp, 0x24
lea ecx, [ebp + 2]
fsub qword [0x41e560]
mov esi, 8
fstp dword [0x424c70]
movzx edx, byte [eax + 3]
mov byte [ecx - 2], dl
movzx edx, byte [eax + 2]
mov byte [ecx - 1], dl
mov edx, dword [eax]
shr edx, 8
mov byte [ecx], dl
movzx edx, byte [eax]
mov byte [ecx + 1], dl
add eax, 4
add ecx, 4
sub esi, 1
jne 0x4046e1
mov ecx, dword [esp + 0x6c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040abd3
add esp, 0x60
ret
Function at 0x40abd3
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x424fb0]
jne 0x40abdd
repz ret
jmp fcn.0040f0c1

Function at 0x416054
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040f3ab
and dword [ebp - 4], 0
cmp dword [0x427234], 0
mov ebx, eax
jne 0x416105
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4161b6
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x41f9e8
push edi
call esi
test eax, eax
je 0x4161b6
push eax
call fcn.0040f339
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x427234], eax
call esi
push eax
call fcn.0040f339
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x427238], eax
call esi
push eax
call fcn.0040f339
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42723c], eax
call esi
push eax
call fcn.0040f339
pop ecx
mov dword [0x427244], eax
test eax, eax
je 0x416105
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040f339
pop ecx
mov dword [0x427240], eax
mov eax, dword [0x427240]
cmp eax, ebx
je 0x41615d
cmp dword [0x427244], ebx
je 0x41615d
push eax
call fcn.0040f3b4
push dword [0x427244]
mov esi, eax
call fcn.0040f3b4
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41615d
test edi, edi
je 0x41615d
call esi
test eax, eax
je 0x416154
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x416154
test byte [ebp - 0xc], 1
jne 0x41615d
or dword [ebp + 0x10], 0x200000
jmp 0x416196
mov eax, dword [0x427238]
cmp eax, ebx
je 0x416196
push eax
call fcn.0040f3b4
pop ecx
test eax, eax
je 0x416196
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x416196
mov eax, dword [0x42723c]
cmp eax, ebx
je 0x416196
push eax
call fcn.0040f3b4
pop ecx
test eax, eax
je 0x416196
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x427234]
call fcn.0040f3b4
pop ecx
test eax, eax
je 0x4161b6
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4161b8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x409888
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40995b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409974
push ebx
push 0x409980
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409908
mov al, 0x62
call fcn.00409460
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.0040985c
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409911
call fcn.0040985c
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409962
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409a14
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409ac8
jmp 0x409abd
cmp dword [esi + 0x10], 0x1000
jne 0x409aa9
test byte [esi + 0x15], 1
jne 0x409aa9
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409a68
cmp eax, 2
je 0x409a68
cmp eax, 0x10
je 0x409a68
cmp eax, 0x20
jne 0x409a7d
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409a7d
mov bl, 1
xor ebp, ebp
jmp 0x409a8e
mov eax, dword [esi]
add eax, ebp
call fcn.00409a0c
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409a81
test bl, bl
je 0x409aa9
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409ac8
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409a40
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x401198
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
and dword [ebp - 8], 0
lea eax, [ebp - 4]
push eax
push 4
push 0x40f244
call fcn.00403434
pop ecx
pop ecx
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x401282
push ebx
push esi
push edi
mov ebx, 0x40f967
push eax
push ebx
call fcn.00403464
pop ecx
mov dword [ebp - 0xc], eax
pop ecx
lea eax, [ebp - 0x110]
push 0x104
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x401276
lea eax, [ebp - 0x110]
push eax
call fcn.0040c438
xor edi, edi
pop ecx
cmp dword [ebp - 0xc], edi
jle 0x40126e
push edi
push ebx
call fcn.00403434
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.00403b7d
add esp, 0x10
test eax, eax
je 0x401268
push 0x40fb6f
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x401268
push 2
push str._rcgOAcM
call fcn.00403434
pop ecx
pop ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401261
lea ecx, [ebp - 0x110]
push ecx
push dword [ebp - 4]
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
inc edi
cmp edi, dword [ebp - 0xc]
jl 0x40120f
inc dword [ebp - 8]
jmp 0x4011df
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401284
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x814
lea eax, [ebp + 0xc]
push esi
and dword [ebp - 4], 0
push eax
push dword [ebp + 0xc]
mov esi, 0x400
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x4012b8
xor eax, eax
jmp 0x4013a4
push ebx
push edi
mov edi, 0x40f967
push 0
push edi
call fcn.00403464
pop ecx
mov dword [ebp + 8], eax
pop ecx
lea eax, [ebp - 8]
xor ebx, ebx
push eax
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push ebx
push eax
lea eax, [ebp - 0x414]
mov dword [ebp - 0xc], esi
push eax
mov dword [ebp - 8], esi
push dword [ebp - 4]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x401397
cmp dword [ebp - 0x10], 1
je 0x40130f
and byte [ebp - 0x814], al
lea eax, [ebp - 0x414]
push eax
call fcn.0040c438
lea eax, [ebp - 0x814]
push eax
call fcn.0040c438
cmp dword [ebp + 8], 0
pop ecx
pop ecx
jle 0x40138f
push ebx
push edi
call fcn.00403434
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.00403b7d
add esp, 0x10
test eax, eax
jne 0x401379
push dword [ebp - 0x14]
lea eax, [ebp - 0x814]
push eax
call fcn.00403b7d
pop ecx
test eax, eax
pop ecx
jne 0x401379
lea eax, [ebp - 0x414]
push str.____
push eax
call fcn.004072d0
pop ecx
test eax, eax
pop ecx
jne 0x401389
lea eax, [ebp - 0x414]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
inc ebx
cmp ebx, dword [ebp + 8]
jl 0x40132f
inc dword [ebp - 4]
jmp 0x4012cc
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop ebx
pop esi
leave
ret 8
Function at 0x4013fa
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x444
push ebx
push 0x40e0c0
call fcn.004074b0
xor ebx, ebx
mov dword [esp], 0x40fde0
push ebx
mov dword [ebp - 0x14], eax
call fcn.0040530f
push ebx
push 0x40fba1
call fcn.00403464
add esp, 0x10
mov dword [ebp - 4], eax
lea eax, [ebp - 0x444]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push dword [ebp + 8]
mov dword [ebp - 0x340], 0x224
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [ebp - 0x340]
mov dword [ebp - 0x18], eax
push ecx
push eax
call sub.KERNEL32.dll_Module32First
test eax, eax
je 0x4015ef
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.004073c0
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x444]
push eax
call fcn.0040c590
add esp, 0x10
test eax, eax
je 0x4015ef
push dword [ebp - 0x338]
push ebx
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x4015ef
push esi
mov esi, 0x80000
push edi
push esi
mov edi, 0x4119e0
push ebx
push edi
call fcn.00407360
mov eax, dword [ebp - 0x328]
add esp, 0xc
cmp eax, esi
jb 0x4014e1
mov eax, esi
cmp dword [ebp + 0xc], ebx
mov dword [ebp - 8], ebx
jne 0x401506
lea ecx, [ebp - 8]
push ecx
push eax
push edi
push dword [ebp - 0x32c]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x4015e1
cmp dword [ebp - 4], ebx
mov dword [ebp + 8], ebx
jbe 0x4015e1
push dword [ebp + 8]
push 0x40fba1
call fcn.00403434
push eax
mov dword [ebp - 0x10], eax
call fcn.004074b0
xor esi, esi
add esp, 0xc
cmp dword [ebp + 0xc], esi
mov ebx, eax
je 0x40153c
lea eax, [ebx + 0x6e]
mov dword [ebp - 8], eax
jmp 0x40153f
mov eax, dword [ebp - 8]
sub eax, ebx
sub eax, 0xa
je 0x4015d2
push dword [ebp - 0x14]
lea edi, [esi + 0x4119e0]
push edi
push 0x40e0c0
call fcn.0040c4e0
add esp, 0xc
test eax, eax
je 0x4015cb
cmp dword [ebp + 0xc], 0
jne 0x40158b
push ebx
push edi
push dword [ebp - 0x10]
call fcn.0040c4e0
add esp, 0xc
test eax, eax
je 0x40158b
mov eax, dword [ebp - 8]
inc esi
sub eax, ebx
sub eax, 0xa
cmp esi, eax
jb 0x40154a
jmp 0x4015d2
push 0
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push str._McoAwM_
call fcn.00403434
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.00403b7d
add esp, 0x10
test eax, eax
jne 0x4015cb
lea eax, [ebp - 0x11c]
push eax
call fcn.00403dfa
pop ecx
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp + 8], eax
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 4]
jb 0x401512
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop ebx
pop edi
pop esi
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop ebx
leave
ret 8