joyce8/EMBER2024-capa huggingface dataset:
Function at 0x444b20
Capabilities:
Initialize winhttp library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x444b49
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 4], 0
jne 0x444b91
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x48d8f4
push str._s:WinHttpOpen___failed:_d
mov eax, dword [ebp - 4]
push eax
call fcn.00445660
add esp, 0x10
jmp 0x444bda
mov dword [ebp - 8], 0x2a0
mov ecx, dword [ebp - 8]
or ecx, 0x800
mov dword [ebp - 8], ecx
push 4
lea edx, [ebp - 8]
push edx
push 0x54
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
test eax, eax
jne 0x444bda
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CJHHttp::OpenSession
push 0x48d988
mov edx, dword [ebp - 4]
push edx
call fcn.00445660
add esp, 0x10
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x444bec
mov dword [ebp - 0xc], 1
jmp 0x444bf3
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 0x14

Function at 0x445580
Capabilities:
Receive http response
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 0
je 0x445650
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x10], ecx
push 0
mov edx, dword [ebp - 0x10]
push edx
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x445650
cmp dword [ebp - 0x10], 0
je 0x44563b
mov dword [ebp - 0x24], 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x14], 0x10
jb 0x4455f3
mov dword [ebp - 0x14], 1
jmp 0x4455fa
mov dword [ebp - 0x14], 0
mov cl, byte [ebp - 0x14]
mov byte [ebp - 1], cl
movzx edx, byte [ebp - 1]
test edx, edx
je 0x445616
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x28], ecx
lea edx, [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpWriteData]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x445650
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 8
Function at 0x46c6c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47f960
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x3c]
and ecx, 1
je 0x46c78e
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x20]
mov ecx, dword [eax]
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], 0
je 0x46c713
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x30]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x20]
mov ecx, dword [edx]
add ecx, dword [eax]
mov dword [ebp - 0x18], ecx
jmp 0x46c726
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x2c]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x1c]
mov ecx, dword [edx]
add ecx, dword [eax]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x1000
jb 0x46c777
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x1c]
push ecx
call fcn.0041d010
add esp, 8
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call fcn.0041a2f9
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0xc]
mov dword [edx], 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x1c]
mov dword [ecx], 0
xor edx, edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x2c]
mov dword [ecx], edx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x10]
mov dword [eax], 0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x20]
mov dword [edx], 0
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x30]
mov dword [edx], eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x38], 0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x3c]
and edx, 0xfffffffe
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x3c], edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x15a0fa8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
call fcn.015a9d27
mov byte [esp + 8], dh
lea esp, [esp + 0xc]
ja 0x15b68a5
sal al, cl
sub ebx, edi
or al, 0x9a
add ebx, esp
sub edi, 0xdbb0ce7f
or al, dh
sar di, cl
mov di, bp
mov edi, ebx
cmp al, 0x5f
mov al, 0x2e
pushal
pushal
repne scasb al, byte es:[edi]
mov dword [esp + 8], 0x59e2d8e8
lea esp, [esp + 0x40]
jne 0x15b34de
push esp
movzx ax, bl
pushal
mov byte [esp + 8], dl
mov byte [edi - 1], 0
movzx eax, dl
lea esp, [esp + 0x24]
jae 0x15a8dde
push ebx
lahf
lahf
lea eax, [0x167ab63]
push 0xbf379a4d
pushfd
lea esp, [esp + 8]
je 0x275bb24
push 0x997e19ef
mov dword [esp], 0x15a0ac4
pushfd
mov byte [esp], 0xe6
mov dword [esp], eax
pushal
pushal
push ebx
mov byte [esp + 0x1c], al
push dword [esp + 0x44]
ret 0x48
pushfd
push esp
mov dword [esp + 4], ebx
pushal
lea eax, [0x167ab63]
lea esp, [esp + 0x24]
jns 0x167fe52
pushal
pushal
push dword [esp + 8]
mov dword [esp + 0x40], 0x15a4452
call fcn.0275a013
cli
cwde
jp 0x15a8de4
dec ecx
invalid
pushfd
pushal
jmp 0x16a1739
mov byte [esp + 4], 0x18
mov dword [esp + 0x20], 0x15a4452
mov byte [esp + 4], dh
mov dword [esp + 0x1c], eax
push 0x402f0da6
pushfd
push dword [esp + 8]
push dword [esp + 0x28]
ret 0x2c
xor eax, 0xbbbebffa
outsb dx, byte [esi]
invalid
call fcn.015beaa7
xchg esp, eax
sub byte [edx], 0xbb
arpl sp, si
mov word [esi + ebp], es
fdiv qword [ebx - 0x52]
mov ss, esi
push cs
jecxz 0x275baf1
dec eax
lds esi, [edx + 0x70]
ficomp word [ebx + 0x10]
retf 0x7288

Function at 0x15a0fad
Capabilities:
Encrypt data using rc4 prga

Disassembly:
call fcn.015a9d27
mov byte [esp + 8], dh
lea esp, [esp + 0xc]
ja 0x15b68a5
sal al, cl
sub ebx, edi
or al, 0x9a
add ebx, esp
sub edi, 0xdbb0ce7f
or al, dh
sar di, cl
mov di, bp
mov edi, ebx
cmp al, 0x5f
mov al, 0x2e
pushal
pushal
repne scasb al, byte es:[edi]
mov dword [esp + 8], 0x59e2d8e8
lea esp, [esp + 0x40]
jne 0x15b34de
push esp
movzx ax, bl
pushal
mov byte [esp + 8], dl
mov byte [edi - 1], 0
movzx eax, dl
lea esp, [esp + 0x24]
jae 0x15a8dde
push ebx
lahf
lahf
lea eax, [0x167ab63]
push 0xbf379a4d
pushfd
lea esp, [esp + 8]
je 0x275bb24
push 0x997e19ef
mov dword [esp], 0x15a0ac4
pushfd
mov byte [esp], 0xe6
mov dword [esp], eax
pushal
pushal
push ebx
mov byte [esp + 0x1c], al
push dword [esp + 0x44]
ret 0x48
pushfd
push esp
mov dword [esp + 4], ebx
pushal
lea eax, [0x167ab63]
lea esp, [esp + 0x24]
jns 0x167fe52
pushal
pushal
push dword [esp + 8]
mov dword [esp + 0x40], 0x15a4452
call fcn.0275a013
cli
cwde
jp 0x15a8de4
dec ecx
invalid
pushfd
pushal
jmp 0x16a1739
mov byte [esp + 4], 0x18
mov dword [esp + 0x20], 0x15a4452
mov byte [esp + 4], dh
mov dword [esp + 0x1c], eax
push 0x402f0da6
pushfd
push dword [esp + 8]
push dword [esp + 0x28]
ret 0x2c
xor eax, 0xbbbebffa
outsb dx, byte [esi]
invalid
call fcn.015beaa7
xchg esp, eax
sub byte [edx], 0xbb
arpl sp, si
mov word [esi + ebp], es
fdiv qword [ebx - 0x52]
mov ss, esi
push cs
jecxz 0x275baf1
dec eax
lds esi, [edx + 0x70]
ficomp word [ebx + 0x10]
retf 0x7288
Function at 0x15b5790
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0xbcbb3b36
lea esp, [esp + 0x30]
jne 0x15c26a0
xchg ecx, esi
dec cl
neg cx
mov ecx, edi
btc esi, ebx
sub ecx, ebx
rcr esi, 1
cmp al, 0x74
sal esi, cl
stc
mov esi, esp
test al, 0xfc
test bl, 0x25
clc
push 0x9285090f
sub edi, 4
cmp sp, 0x3286
push dword [edi]
pop dword [esp]
bt sp, cx
cmc
cmc
cmp edi, ebx
push esp
lea esp, [esp + 4]
ja 0x15b68a5
adc al, cl
rcr al, 1
rol al, 1
sub ebx, edi
bsr di, dx
not al
add ebx, esp
ror edi, cl
bsr edi, ebx
and edi, ebp
mov edi, ebx
pushfd
add al, 0x3e
sbb al, 0x5d
shr al, 2
mov al, 0x2e
push 0xcd393406
test ah, bh
bt edx, 0x10
pushfd
repne scasb al, byte es:[edi]
call fcn.015beace
js 0x15b579f
adc al, 0xa5
jge 0x15b582b
scasd eax, dword es:[edi]
fstp xword [esi - 0x77]
invalid
out 0x77, al
sub edi, dword [ecx + ebp*2 + 0x5df843de]
or ah, byte [ebx - 0x67d94ee8]
sub dword [esi - 0x4ea4ed5], edi
hlt

Function at 0x15b73a7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
movsx si, bl
mov esi, esp
sub ecx, ebx
pushfd
lea esp, [esp + 0x28]
jmp 0x15b689f

Function at 0x15b7a57
Capabilities:
Check for vm using instruction vpcext

Disassembly:
push 0x5dca7e46
mov dword [esp + 0xc], esp
lea esp, [esp + 0x2c]
jae fcn.015c26a9
shrd cx, ax, 7
add cx, 0xffa9
adc cl, al
clc
mov ebx, eax
rcl di, cl
stc
cmc
xadd edi, ecx
mov edi, eax
not cl
not cl
or cx, cx
bswap ecx
mov ecx, 0x104
pushal
bt di, 8
pushal
xor al, al
jmp 0x15bc744
jl 0x15bc73b
sbb byte [eax + eax*4 - 0x7f4d3836], bl
pushfd
repne scasb al, byte es:[edi]
mov dword [esp + 4], 0x39122826
mov byte [esp + 0xc], ah
mov byte [esp], 2
lea esp, [esp + 0x44]
jne 0x15c26a0
movzx ecx, al
sub cx, 0xb305
pushal
sbb ch, al
mov ecx, edi
clc
call fcn.015b73a7
jne 0x15bc715
push ebx
call [eax + 0xd]
mov ecx, 0x715d1d9
lcall 0x5cef, 0x2ac58f8c
mov cl, byte [eax - 0x17]
pop esi
invalid
Function at 0x15beeaf
Capabilities:
Encode data using xor

Disassembly:
pushfd
mov byte [esp], bh
inc ecx
lea esp, [esp + 4]
push 0xa9c30d3a
lea esp, [esp + 4]
jns 0x15bf9f0
call fcn.027376d4
pushfd
jmp 0x1685020
pushfd
pushfd
lea esp, [esp + 8]
call fcn.027376d4
pushal
pushfd
add dword [eax - 0x64], esp
push 0x33a0250b
adc ecx, ecx
call fcn.015ba38e
push esi
mov esi, 0xbc16c813
popal
xor byte [ecx - 0x26], ch
jl 0x15bf9fd
aad 0xb9
sub ecx, dword [eax]
xor dword [esi], 0x2ca658e3
loope 0x15bfa77
out 0x54, eax
stc
outsb dx, byte [esi]
fsubr dword [ecx + 0x29]
mov edx, 0xad1ca22c
pop ecx
cmc
xor dword [edi + 0x29], eax
popal
test byte [edx + 0x3da75fca], 0xff
ja 0x15bfa65
ja 0x15bf9fa
inc eax
dec edi
mov byte [ecx - 0x37], dl
and edi, ebp
inc esp
sub al, 0x64
int1
push ebp
out 0x22, al
lds ebp, [ebx - 0x40]
sbb esi, ecx
pushfd
cmp eax, 0xaceee644
les ebp, [ecx + 0x12]
fcom qword [ebp - 0x4d]
mov esp, 0x72c92bb6
mov eax, dword [0xec292bb5]
mov ch, 0x2b
sub esp, ebp
sub dl, byte [edi - 0x50db0e4]
cmc
and ecx, dword [ebp + 0x5f23f75a]
iretd
iretd
call fcn.015bfaec
pop ss
sub ebp, edi
cmp byte [ecx], 0xae
mov edx, 0x844cc617
mov eax, 0x6de1012c
wait
or al, 0xb9
adc eax, 0x5b03ba6
mov dl, 0x60
int1
or eax, 0x13df6ac1
mov edi, 0x74bab27
sal dword [ebp + 0x6b], 1
int1
mov dh, 2
xor byte [esi], ah
xchg edx, eax
lcall 0xc3cc, 0x389a549f
adc al, 4
pop ebx
enter 0x74bf, 0xffffffffffffff90
lahf
adc al, 0xb8
hlt
Function at 0x2738dde
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov word [esp], cx
lea esp, [esp + 0x50]
ja 0x15b68a5
pushal
call fcn.015bae82
fucom st(1)
and dword [ebp + 0x18b5b702], ebp
adc dword [ebp + 0x71], 0x854f9239
push 0x27
xchg esp, eax
xor eax, 0xb7f658a2
and al, 0x9e
das
loopne 0x15afcdf
ret 0x7f77
or dh, dh
push esp
invalid
push 0xf4a26178
clc
stc
sub edi, 4
add esp, 4
jns 0x275b094
cmc
push dword [edi]
cmc
test ah, dh
test cl, 0xd7
pushal
cmp edi, ebx
mov word [esp + 4], bx
jmp 0x1686b61
push dword [edx + ecx*4]
aaa
les edi, [esi + 0xf]
lodsb al, byte [esi]
sbb ecx, eax
scasd eax, dword es:[edi]
cmp byte [ebp + edi*8 - 0x2c], dh
ja 0x1686b9b
mov ah, 0x6f
popal
into
mov cs, word [ebp + 0xf677e7f]
mov eax, ecx
sub byte [ebp - 0x36], 0x7f
popal
in eax, 0x27
mov dword [0xd7739135], eax
xchg ecx, eax
jae 0x1686b1f
xor eax, dword [ebp - 0x71]
dec ebx
lodsd eax, dword [esi]
sub dword [ebx - 0x4e], edx
dec edx
adc al, bh
pop esi
mov dl, 0x18
dec eax
retf
pushfd
lea esp, [esp + 0x24]
ja 0x15b68a5
bt esi, 0x10
clc
ror al, 1
or al, dh
sub ebx, edi
pushal
neg di
movzx di, al
pushal
sub esp, 0xffffffc0
add ebx, esp
shl al, cl
pushfd
pushfd
mov edi, ebx
rol al, 6
mov al, 0x2e
stc
pushal
repne scasb al, byte es:[edi]
pushfd
lea esp, [esp + 0x2c]
jne 0x15b34de
aas
leave
dec dword [edi]
xchg esp, eax
rcr byte [eax + ebx*4 + 0xff47c6], 0xe8
sete al
pushfd
cwde
mov byte [edi - 1], 0
call fcn.015b61c5
inc ebx
pop edi
add al, ch
sbb dh, dh
inc dword [ebx + 0x5f]
aam 0x81
int 0x5e
or ah, byte [edi - 0x5fed5620]
out dx, al
sub bh, byte [edx - 0x5b189489]
adc ebp, ebx
jno 0x1686b45
dec ebp
xchg ecx, eax
cmp eax, 0x2bbe11bd
sti
mov word [ecx], fs
xchg esi, eax
js 0x1686ba7
aam 0x80
or edi, 0x6f
cld
adc byte [ebx + 0x51], ah
lea ebx, [edi - 0x1adff6fd]
mov bh, 0x33
mov eax, 0x7fc12bbd
rcl dword [ecx], 0xbe
sub al, 0x49
in eax, 0xf7
stosd dword es:[edi], eax
insb byte es:[edi], dx
cmp eax, 0x6641d366
add cl, byte [edx + 0x6fecfc86]
mov word [ebx - 0x74], gs
test eax, 0xfba54f
cld
std
fstp st(2)
push cs
in al, 0x9d
or bh, byte [ebx - 0x7904ee19]
cld
adc byte [ebx - 0xb968b68], dl
call 0x12106a33
and byte [edi + 0x6e949a55], 0x15
inc edi
push ecx
cld
cmp ebp, 0xce680caa
bound ebx, qword [ebp - 0x789284b7]
add dl, bh
popal
cmpsd dword [esi], dword es:[edi]
mov al, byte [0x64540594]
xchg edi, eax
xchg esi, eax
add edi, dword [0xf6674630]
push ebx
jmp 0x480ea903
jmp 0x15afc5a
pushfd
push dword [edi]
pop dword [esp]
test ch, 0xd
test si, 0xacc5
push edx
cmp dh, 0xaf
cmp edi, ebx
call fcn.0275e10d
popfd
mov eax, dword [0xad21e16d]
das
lds ecx, [esi - 0x2575a8cf]
sal ah, 0x94
sbb al, 0x16
mov ah, 0x21
pop ebp
mov cl, 0x1e
push esi
mov eax, 0x3d1207a
insd dword es:[edi], dx
add edi, dword [ecx - 0x63]
push edi
shl ebx, 0x9f
xor byte [edx], dl
clc
invalid
Function at 0x401220
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x402c51
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x218
push esi
push edi
lea eax, [esp + 0x18]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString_1
lea edx, [esp + 0x18]
mov dword [esp + 0x228], 0
push edx
call fcn.004011f0
add esp, 4
lea ecx, [esp + 0x10]
push eax
call sub.MFC42.DLL_CString::CString_1
mov eax, dword [esp + 0x10]
push 0x405420
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x230], 1
call sub.MFC42.DLL_CString::Replace
mov edi, dword [0x405414]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x11c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x11c]
push ecx
call fcn.004011f0
add esp, 4
lea ecx, [esp + 0xc]
push eax
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0x14]
mov byte [esp + 0x228], 2
call fcn.004027c8
mov edx, dword [esp + 8]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
push 1
push edx
push eax
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x228], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x228], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov dword [esp + 0x228], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x220]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x224
ret
Function at 0x401ba0
Capabilities:
Contain obfuscated stackstrings
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4036f0
push 0x4029f2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x1c], esi
or edi, 0xffffffff
mov dword [ebp - 0x34], edi
mov byte [ebp - 0x30], 0x52
mov byte [ebp - 0x2f], 0x65
mov byte [ebp - 0x2e], 0x67
mov dl, 0x69
mov byte [ebp - 0x2d], dl
mov byte [ebp - 0x2c], 0x73
mov al, 0x74
mov byte [ebp - 0x2b], al
mov cl, 0x72
mov byte [ebp - 0x2a], cl
mov byte [ebp - 0x29], 0x79
mov bl, 0x53
mov byte [ebp - 0x28], bl
mov byte [ebp - 0x27], dl
mov byte [ebp - 0x26], 0x7a
mov byte [ebp - 0x25], 0x65
mov byte [ebp - 0x24], 0x4c
mov byte [ebp - 0x23], dl
mov byte [ebp - 0x22], 0x6d
mov byte [ebp - 0x21], dl
mov byte [ebp - 0x20], al
mov byte [ebp - 0x1f], 0
mov dword [ebp - 4], esi
mov byte [ebp - 0x5c], bl
mov byte [ebp - 0x5b], 0x59
mov byte [ebp - 0x5a], bl
mov byte [ebp - 0x59], 0x54
mov byte [ebp - 0x58], 0x45
mov byte [ebp - 0x57], 0x4d
mov byte [ebp - 0x56], 0x5c
mov byte [ebp - 0x55], 0x43
mov byte [ebp - 0x54], 0x75
mov byte [ebp - 0x53], cl
mov byte [ebp - 0x52], cl
mov byte [ebp - 0x51], 0x65
mov byte [ebp - 0x50], 0x6e
mov byte [ebp - 0x4f], al
mov byte [ebp - 0x4e], 0x43
mov dl, 0x6f
mov byte [ebp - 0x4d], dl
mov byte [ebp - 0x4c], 0x6e
mov byte [ebp - 0x4b], al
mov byte [ebp - 0x4a], cl
mov byte [ebp - 0x49], dl
mov byte [ebp - 0x48], 0x6c
mov byte [ebp - 0x47], bl
mov byte [ebp - 0x46], 0x65
mov byte [ebp - 0x45], al
mov byte [ebp - 0x44], 0x5c
mov byte [ebp - 0x43], 0x43
mov byte [ebp - 0x42], dl
mov byte [ebp - 0x41], 0x6e
mov byte [ebp - 0x40], al
mov byte [ebp - 0x3f], cl
mov byte [ebp - 0x3e], dl
mov byte [ebp - 0x3d], 0x6c
mov byte [ebp - 0x3c], 0
lea eax, [ebp - 0x38]
push eax
push 0xf003f
push esi
lea ecx, [ebp - 0x5c]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401cfd
mov dword [ebp - 0x60], 4
lea edx, [ebp - 0x60]
push edx
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x64]
push ecx
push esi
lea edx, [ebp - 0x30]
push edx
mov eax, dword [ebp - 0x38]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401cda
mov esi, 1
jmp 0x401cfd
push 4
lea ecx, [ebp - 0x34]
push ecx
push 4
push esi
lea edx, [ebp - 0x30]
push edx
mov eax, dword [ebp - 0x38]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
neg esi
sbb esi, esi
and esi, 0xfffffffd
add esi, 2
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], edi
call fcn.00401d1e
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4024c0
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x402de8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov eax, dword [esp + 0x18]
push eax
push str.32770
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
test esi, esi
je 0x402529
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
lea ecx, [esp + 4]
push ecx
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x402529
mov edx, dword [esp + 4]
push edx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x402529
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x40141e
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x214
lea eax, [esp]
push ebp
push esi
mov esi, dword [esp + 0x228]
push edi
mov edi, dword [esp + 0x22c]
and esi, 0x300
push eax
mov eax, esi
and edi, 1
or eax, 9
push eax
push dword [esp + 0x230]
push dword [esp + 0x230]
call fcn.0040644f
test eax, eax
jne 0x401527
xor ebp, ebp
test byte [esp + 0x22c], 2
je 0x401493
push ebp
push ebp
push ebp
push ebp
lea eax, [esp + 0x20]
mov dword [esp + 0x20], ebp
push eax
lea eax, [esp + 0x28]
push eax
push ebp
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x401503
push 0x105
lea eax, [esp + 0x18]
push eax
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
jmp 0x4014ce
test edi, edi
jne 0x401503
push dword [esp + 0x22c]
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x14]
call fcn.0040141e
test eax, eax
jne 0x4014d8
push 0x105
lea eax, [esp + 0x18]
push eax
push edi
push dword [esp + 0x18]
call ebp
test eax, eax
je 0x4014a6
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.00406a5d
test eax, eax
jne 0x401514
push dword [esp + 0x228]
push dword [esp + 0x228]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x401527
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x3eb
jmp 0x401527
push 0
push esi
push dword [esp + 0x230]
push dword [esp + 0x230]
call eax
pop edi
pop esi
pop ebp
add esp, 0x214
ret 0xc
Function at 0x4032eb
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
push edi
xor edi, edi
test ecx, ecx
js 0x403314
mov eax, dword [0x429598]
push edi
add eax, ecx
push edi
push eax
push dword [0x40a014]
mov dword [0x40c954], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
call fcn.0040316c
test eax, eax
js 0x4033ea
push ebx
push esi
push 4
lea eax, [ebp + 8]
push eax
push dword [0x40a014]
call fcn.00406abf
test eax, eax
je 0x4033e5
push dword [ebp + 8]
add dword [0x40c954], 4
call fcn.0040316c
mov esi, eax
test esi, esi
js 0x4033e1
cmp dword [ebp + 0x10], edi
jne 0x4033b5
mov ecx, dword [ebp + 8]
test ecx, ecx
jle 0x4033e1
mov ebx, 0x4000
mov edi, 0x4149f8
cmp ecx, ebx
mov eax, ebx
cmovl eax, ecx
push eax
push edi
push dword [0x40a014]
mov dword [ebp - 4], eax
call fcn.00406abf
test eax, eax
je 0x4033e5
push dword [ebp - 4]
push edi
push dword [ebp + 0xc]
call fcn.00406b82
test eax, eax
je 0x4033b1
mov eax, dword [ebp - 4]
add esi, eax
mov ecx, dword [ebp + 8]
add dword [0x40c954], eax
sub ecx, eax
mov dword [ebp + 8], ecx
test ecx, ecx
jg 0x40336d
jmp 0x4033e1
push 0xfffffffffffffffe
jmp 0x4033e7
push edi
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0x14]
cmp dword [ebp + 8], eax
cmovl eax, dword [ebp + 8]
push eax
push dword [ebp + 0x10]
push dword [0x40a014]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4033e5
mov esi, dword [ebp - 4]
add dword [0x40c954], esi
mov eax, esi
jmp 0x4033e8
push 0xfffffffffffffffd
pop eax
pop esi
pop ebx
pop edi
leave
ret 0x10

Function at 0x40340d
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
cmp dword [ebp + 8], 0
je 0x403435
mov eax, dword [0x40c968]
test eax, eax
je 0x40342c
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
and dword [0x40c968], 0
leave
ret
cmp dword [0x40c968], 0
je 0x403447
push 0
call fcn.00406386
leave
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [0x429540]
jbe 0x4034b1
cmp dword [0x428538], 0
je 0x40348c
test byte [0x429634], 1
je 0x4034b1
call fcn.004033ef
push eax
lea eax, [ebp - 0x80]
push str....__d__
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
push 0
call fcn.00405ec0
leave
ret
push 0
push 0x40376b
push 0
push 0x6f
push dword [0x428534]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
push 5
push eax
mov dword [0x40c968], eax
call dword [sym.imp.USER32.dll_ShowWindow]
leave
ret