joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415460
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x417c60
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4262b8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 8], 0
je 0x4154a7
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x10]
call fcn.00416100
mov ebx, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
lea eax, [ebp - 0x10]
push 0x28
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push str.SA686A8B88_0784_4b2e_8B19_54DFC016617B
push eax
mov dword [ebp - 4], 0
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x415539
call esi
cmp eax, 0x8009000f
jne 0x4154fd
push 0x20
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push str.SA686A8B88_0784_4b2e_8B19_54DFC016617B
lea eax, [ebp - 0x10]
push eax
call ebx
test eax, eax
jne 0x415504
call esi
xor esi, esi
jmp 0x41559f
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push 1
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptGetUserKey]
test eax, eax
je 0x415539
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
lea ecx, [ebp - 0x10]
call fcn.004161a0
mov dword [edi + 8], eax
mov esi, 1
jmp 0x41559f
lea ecx, [ebp - 0x18]
call fcn.00416100
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 1
push eax
push 0
push 0
push 0x254
push 0x426538
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x41557e
call esi
push 0x30
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push str.SA686A8B88_0784_4b2e_8B19_54DFC016617B
lea eax, [ebp - 0x10]
push eax
call ebx
xor esi, esi
jmp 0x415597
lea ecx, [ebp - 0x10]
call fcn.004161a0
push eax
mov dword [edi + 8], eax
call fcn.004153a0
add esp, 4
mov esi, 1
lea ecx, [ebp - 0x18]
call fcn.00416120
lea ecx, [ebp - 0x10]
call fcn.00416130
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4155c0
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, ecx
mov dword [esi], 0
mov dword [esi + 4], 0
test eax, eax
je 0x415645
cmp dword [edi + 4], 0
je 0x415634
cmp dword [edi + 0xc], 0
je 0x415634
mov dword [esi], eax
inc eax
push eax
call sub.mfc140.dll_Ordinal_265
push dword [ebp + 8]
mov dword [esi + 4], eax
push dword [ebp + 0xc]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0x10
push esi
push dword [esi + 4]
push 0
push 1
push 0
push dword [edi + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x41563c
push dword [esi + 4]
call sub.mfc140.dll_Ordinal_266
add esp, 4
mov dword [esi], 0
mov dword [esi + 4], 0
pop edi
xor eax, eax
pop esi
pop ebp
ret 0xc
mov ecx, dword [esi + 4]
mov eax, dword [esi]
mov byte [ecx + eax], 0
pop edi
mov eax, 1
pop esi
pop ebp
ret 0xc
Function at 0x415650
Capabilities:
Encrypt data using des via winapi
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x417c88
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x4262b8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [ebp - 0x10]
call fcn.00416100
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0
push eax
push 0
push 0
push 0x8004
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x4156e8
push dword [ebp - 0x18]
lea ecx, [ebp - 0x10]
call fcn.00416140
push 0
push dword [ebp + 8]
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x4156e8
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push 1
push dword [ebp - 0x10]
push 0x6601
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x4156e8
mov esi, dword [ebp - 0x14]
jmp 0x4156ea
xor esi, esi
lea ecx, [ebp - 0x10]
call fcn.00416110
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x415710
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, ecx
mov dword [esi], 0
mov dword [esi + 4], 0
test eax, eax
jne 0x415739
pop edi
mov eax, 1
pop esi
pop ebp
ret 0xc
cmp dword [edi + 4], 0
je 0x4157ac
cmp dword [edi + 0xc], 0
je 0x4157ac
push 0
push esi
push 0
push 0
push 1
push 0
mov dword [esi], eax
push dword [edi + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x4157a6
push dword [esi]
call sub.mfc140.dll_Ordinal_265
push dword [ebp + 8]
mov dword [esi + 4], eax
push dword [ebp + 0xc]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0x10
lea eax, [ebp + 8]
push dword [esi]
push eax
push dword [esi + 4]
push 0
push 1
push 0
push dword [edi + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x41572e
push dword [esi + 4]
call sub.mfc140.dll_Ordinal_266
add esp, 4
mov dword [esi + 4], 0
mov dword [esi], 0
pop edi
xor eax, eax
pop esi
pop ebp
ret 0xc
Function at 0x415cb0
Capabilities:
Encrypt data using des via winapi
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x417d58
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4262b8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [ebp - 0x28]
call fcn.00416100
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0
push eax
push 0
push 0
push 0x8004
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x415d5e
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x28]
call fcn.00416140
push 0
push 0x14
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0xb9a04334
push eax
push dword [ebp - 0x28]
mov dword [ebp - 0x20], 0x9bf7c103
mov dword [ebp - 0x1c], 0x23cc6433
mov dword [ebp - 0x18], 0x268b0111
mov dword [ebp - 0x14], 0x2922dd9b
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x415d5e
lea eax, [esi + 0xc]
push eax
push 0
push dword [ebp - 0x28]
push 0x6601
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
lea ecx, [ebp - 0x28]
call fcn.00416110
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00413da6
mov esp, ebp
pop ebp
ret
Function at 0x415ec0
Capabilities:
Create new key via cryptacquirecontext
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x417dc0
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x4262b8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x14]
call fcn.00416100
push 0x20
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push dword [ebp + 0x14]
lea eax, [ebp + 0x14]
mov dword [ebp - 4], 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x415f16
xor esi, esi
jmp 0x415fbe
push dword [ebp + 0x14]
lea ecx, [ebp - 0x14]
call fcn.00416180
lea ecx, [ebp - 0x10]
call fcn.00416100
lea eax, [ebp + 0x14]
mov byte [ebp - 4], 1
push eax
push 0
push 0
push 0x8004
push dword [ebp - 0x14]
mov dword [ebp + 0x14], 0
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x415fb4
push dword [ebp + 0x14]
lea ecx, [ebp - 0x10]
call fcn.00416140
push 0
push dword [ebp + 8]
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x415fb4
mov esi, dword [ebp + 0x10]
push esi
push 0
push 0
push 0
push 2
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptSignHashA]
test eax, eax
je 0x415fb4
push dword [esi]
call sub.mfc140.dll_Ordinal_265
add esp, 4
mov dword [esi + 4], eax
push esi
push eax
push 0
push 0
push 2
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptSignHashA]
test eax, eax
jne 0x415fda
push dword [esi + 4]
call sub.mfc140.dll_Ordinal_266
add esp, 4
xor esi, esi
lea ecx, [ebp - 0x10]
call fcn.00416110
lea ecx, [ebp - 0x14]
call fcn.00416130
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov esi, 1
jmp 0x415fb6
Function at 0x415ff0
Capabilities:
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x1c]
mov esi, ecx
test edi, edi
je 0x416004
mov dword [edi], 1
lea eax, [ebp + 0x1c]
mov dword [ebp + 0x1c], 0
push eax
push 0
push 0
push 0x8004
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x416098
push 0
push dword [ebp + 8]
push dword [ebp + 0xc]
push dword [ebp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x41608f
mov eax, dword [ebp + 0x18]
cmp eax, 3
ja case.default.0x416042
jmp dword [eax*4 + 0x4160b4]
mov eax, dword [esi + 0x10]
jmp 0x416060
mov eax, dword [esi + 0x14]
jmp 0x416060
mov eax, dword [esi + 0x18]
jmp 0x416060
mov eax, dword [esi + 0x1c]
jmp 0x416060
mov eax, dword [ebp + 0x1c]
push 0
push 0
push eax
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push dword [ebp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptVerifySignatureA]
test eax, eax
jne 0x4160a0
test edi, edi
je 0x41608f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090006
jne 0x41608f
mov dword [edi], 0
push dword [ebp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
pop edi
xor eax, eax
pop esi
pop ebp
ret 0x18
push dword [ebp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
pop edi
mov eax, 1
pop esi
pop ebp
ret 0x18
Function at 0x401830
Capabilities:
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
sub esp, 0x140
mov eax, dword [0x425e80]
xor eax, esp
mov dword [esp + 0x13c], eax
fldz
push ebp
push esi
xor eax, eax
mov word [esp + 0x10], ax
xor ecx, ecx
mov word [esp + 8], cx
fstp dword [esp + 0xc]
push edi
xor edx, edx
mov word [esp + 0x18], dx
push 0x104
xor ebp, ebp
call fcn.0040b98a
add esp, 4
push ebp
mov esi, eax
push 2
mov dword [esp + 0x24], esi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
fld dword [0x4231b0]
fstp qword [0x423078]
mov edi, eax
fld dword [0x4231b0]
mov dword [esp + 0x18], edi
fadd qword [0x41f348]
fstp dword [0x4231b0]
test edi, edi
je 0x401a63
lea eax, [esp + 0x20]
push eax
push edi
mov dword [esp + 0x28], 0x128
call sub.KERNEL32.dll_Process32First
dec dword [esp + 0xc]
mov cx, word [esp + 0xc]
movsx edx, cx
add edx, dword [0x423a0c]
mov dword [esp + 0xc], edx
fild dword [esp + 0xc]
fstp qword [0x425d48]
test eax, eax
je 0x401a5c
push ebx
mov ebx, esi
lea eax, [esp + 0x48]
sub ebx, eax
mov edi, 1
lea eax, [esp + 0x48]
mov cl, byte [eax]
mov byte [ebx + eax], cl
add eax, edi
test cl, cl
jne 0x4018f8
push esi
call fcn.0041eb43
mov ecx, dword [esp + 0x158]
add esp, 4
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401935
test dl, dl
je 0x401931
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401935
add eax, 2
add ecx, 2
test dl, dl
jne 0x401915
xor eax, eax
jmp 0x40193a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x401a1c
mov ecx, 0xfffff734
mov word [esp + 0x10], cx
cmp dword [esp + 0x158], eax
je 0x401a47
mov edx, dword [esp + 0x2c]
push edx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4019da
dec word [0x423388]
mov ax, word [0x423388]
mov cx, word [esp + 0x18]
cwde
movsx edx, cx
sub eax, edx
mov dword [esp + 0x10], eax
push 0xffffffffffffffff
push esi
fild dword [esp + 0x18]
add ebp, edi
fadd dword [esp + 0x1c]
fmul qword [0x424a30]
fstp qword [0x424a30]
fld dword [esp + 0x1c]
fadd qword [0x41f348]
fstp dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x423054]
sub eax, 0x71b1ba80
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
fstp qword [0x423470]
add dword [0x423054], edi
add word [0x423194], di
mov cx, word [0x423194]
movsx edx, cx
mov esi, dword [esp + 0x20]
mov dword [esp + 0x10], edx
fild dword [esp + 0x10]
fsub qword [0x423a00]
mov ax, word [0x424a40]
movsx ecx, ax
mov dword [esp + 0x10], ecx
fild dword [esp + 0x10]
faddp st(1)
fmul dword [0x4231c4]
fstp dword [0x4231c4]
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x24]
push eax
mov edx, 0x6e4
mov dword [esp + 0x28], 0x128
push ecx
mov word [esp + 0x20], dx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4018f4
jmp 0x401a57
fld dword [esp + 0x14]
add ebp, edi
fsub qword [0x41f3a0]
fstp dword [esp + 0x14]
mov edi, dword [esp + 0x1c]
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.0040bdc5
mov ecx, dword [esp + 0x14c]
add esp, 4
pop edi
pop esi
mov eax, ebp
pop ebp
xor ecx, esp
call fcn.0040be53
add esp, 0x140
ret
Function at 0x401a90
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x64
fldz
push esi
fstp qword [esp + 0xc]
xor esi, esi
fldz
mov dword [esp + 0x24], 0x44
fstp dword [esp + 8]
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 4], esi
fld qword [esp + 0xc]
fld1
fsub st(1), st(0)
fxch st(1)
fstp qword [esp + 0xc]
fld dword [esp + 8]
fsub qword [0x41f3a8]
fadd qword [esp + 0xc]
call fcn.0040b890
mov dword [esp + 4], eax
fld qword [esp + 0xc]
fadd qword [esp + 0xc]
mov dword [esp + 0x30], esi
xor eax, eax
mov ecx, 1
fadd dword [0x423d58]
fstp dword [0x423218]
fadd qword [esp + 0xc]
mov word [esp + 0x56], ax
mov word [esp + 0x54], cx
lea eax, [esp + 0x14]
push eax
fstp qword [esp + 0x10]
mov eax, dword [esp + 0x70]
lea ecx, [esp + 0x28]
push ecx
push esi
push esi
mov dword [esp + 0x60], 1
mov dword [esp + 0x68], esi
dec dword [esp + 0x14]
mov edx, dword [esp + 0x14]
add edx, dword [esp + 0x14]
push 8
push esi
push esi
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0x8c]
fild dword [esp + 0x24]
push esi
push edx
fstp qword [0x4231c8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [esp + 4], 0x8bcc36fd
pop esi
add esp, 0x64
ret
Function at 0x402910
Capabilities:
Set registry value

Disassembly:
sub esp, 0x14
fldz
push ebp
fstp dword [esp + 4]
xor eax, eax
fldz
push 0x2e
mov word [esp + 8], ax
fstp qword [esp + 0x14]
push 0x42321c
call fcn.004016a0
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov ebp, eax
push ebp
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4029c0
push esi
push edi
push 0x34
push 0x423db0
call fcn.004016a0
mov edx, dword [esp + 0x2c]
mov esi, eax
mov eax, edx
add esp, 8
lea edi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402970
sub eax, edi
push eax
push edx
mov edx, dword [esp + 0x1c]
push 1
push 0
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
fldz
push 0x34
fstp qword [esp + 0x10]
push 0
mov dword [esp + 0x14], 0
push esi
call fcn.0040be70
fld qword [0x424d90]
fadd qword [0x41f3b8]
push esi
fstp qword [0x424d90]
call fcn.0040bdc5
add esp, 0x10
pop edi
pop esi
fldz
push 0x2e
push 0
fstp qword [esp + 0xc]
mov dword [esp + 0xc], 0
push ebp
call fcn.0040be70
fld qword [0x424d90]
fadd qword [0x41f3b8]
push ebp
fstp qword [0x424d90]
call fcn.0040bdc5
mov eax, dword [esp + 0x1c]
add esp, 0x10
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [0x423d04]
mov dword [esp + 4], ecx
fild dword [esp + 4]
fld qword [0x423a48]
fadd qword [esp + 0x10]
fsubp st(1)
call fcn.0040b890
mov dword [0x423d04], eax
fld qword [0x423a48]
fld1
pop ebp
fadd st(1), st(0)
fxch st(1)
fstp qword [0x423a48]
fadd qword [esp + 0xc]
fstp qword [esp + 0xc]
add esp, 0x14
ret

Function at 0x404090
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x14
fldz
push ebx
push esi
push edi
mov dword [esp + 0x14], 0
push 3
mov dword [esp + 0x10], 0
fstp dword [esp + 0x14]
push 0x423070
call fcn.004016a0
fld dword [0x423144]
mov ebx, dword [esp + 0x2c]
mov edi, eax
mov eax, dword [esp + 0x14]
mov ecx, 0x44b9bdf8
sub ecx, eax
mov dword [esp + 0x20], ecx
fisub dword [esp + 0x20]
push edi
push ebx
fstp dword [0x423144]
inc dword [esp + 0x1c]
call fcn.0040c6dd
mov edx, dword [0x423054]
add edx, dword [esp + 0x1c]
mov esi, eax
mov dword [esp + 0x1c], edx
dec dword [0x423054]
add esp, 0x10
test esi, esi
jne 0x404141
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [0x423960]
fadd qword [0x41f348]
fstp qword [0x423960]
fld qword [0x423960]
call fcn.0040b890
push edi
push ebx
mov dword [esp + 0x1c], eax
call fcn.0040c6dd
mov esi, eax
add esp, 8
test esi, esi
je 0x404159
push esi
push 1
lea eax, [esp + 0x30]
push 4
push eax
call fcn.0040c856
push esi
call fcn.0040c283
add esp, 0x14
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x18], ecx
fild dword [esp + 0x18]
xor eax, eax
push edi
fadd dword [esp + 0x14]
fadd dword [esp + 0x14]
fadd dword [0x4231f4]
fstp dword [0x4231f4]
fld dword [esp + 0x14]
mov word [edi], ax
fsub qword [0x41f348]
mov byte [edi + 2], al
fstp dword [esp + 0x14]
fldz
fstp qword [esp + 0x1c]
mov dword [esp + 0x1c], 0
fld qword [0x424d90]
fadd qword [0x41f3b8]
fstp qword [0x424d90]
call fcn.0040bdc5
mov edx, dword [esp + 0x18]
add esp, 4
imul edx, edx, 0x50ea058f
pop edi
pop esi
mov dword [esp + 0xc], edx
pop ebx
add esp, 0x14
ret
Function at 0x40be53
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x425e80]
jne 0x40be5d
repz ret
jmp fcn.00410021

Function at 0x416f24
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00411029
and dword [ebp - 4], 0
cmp dword [0x4280f4], 0
mov ebx, eax
jne 0x416fd5
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x417086
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x420b40
push edi
call esi
test eax, eax
je 0x417086
push eax
call fcn.00410fb7
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4280f4], eax
call esi
push eax
call fcn.00410fb7
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4280f8], eax
call esi
push eax
call fcn.00410fb7
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4280fc], eax
call esi
push eax
call fcn.00410fb7
pop ecx
mov dword [0x428104], eax
test eax, eax
je 0x416fd5
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00410fb7
pop ecx
mov dword [0x428100], eax
mov eax, dword [0x428100]
cmp eax, ebx
je 0x41702d
cmp dword [0x428104], ebx
je 0x41702d
push eax
call fcn.00411032
push dword [0x428104]
mov esi, eax
call fcn.00411032
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41702d
test edi, edi
je 0x41702d
call esi
test eax, eax
je 0x417024
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x417024
test byte [ebp - 0xc], 1
jne 0x41702d
or dword [ebp + 0x10], 0x200000
jmp 0x417066
mov eax, dword [0x4280f8]
cmp eax, ebx
je 0x417066
push eax
call fcn.00411032
pop ecx
test eax, eax
je 0x417066
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x417066
mov eax, dword [0x4280fc]
cmp eax, ebx
je 0x417066
push eax
call fcn.00411032
pop ecx
test eax, eax
je 0x417066
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4280f4]
call fcn.00411032
pop ecx
test eax, eax
je 0x417086
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x417088
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10002fa6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x10002fb5
pop dword [ebp - 0x24]
mov eax, 0x7f7c060f
sub eax, 0x6f7bd65a
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x3cc63830
sub dword [ebp - 0x34], 0xee73f2e5
mov dword [ebp - 0x30], 0xbfef226e
add dword [ebp - 0x30], 0x724429d7
mov dword [ebp - 0x2c], 0x57072436
add dword [ebp - 0x2c], 0xf5451ff8
mov dword [ebp - 0x28], 0x853de6a8
sub dword [ebp - 0x28], 0x853de6a8
lea eax, [ebp - 0x34]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x87978b77
add dword [ebp - 0x34], 0xecdadddf
mov dword [ebp - 0x30], 0x3f7a359a
add dword [ebp - 0x30], 0x1f22bdb
mov dword [ebp - 0x2c], 0x82f45875
sub dword [ebp - 0x2c], 0x1f84ec09
mov dword [ebp - 0x28], 0x49473da3
sub dword [ebp - 0x28], 0x49473da3
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0x2e21f7b8
add eax, 0xe1de9848
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x3376c
push 0
call eax
mov ecx, 0x3e4076d3
add ecx, 0xc1bfc269
mov edi, eax
mov ebx, 0xf741f505
sub ebx, 0xe7410d05
add ebx, dword [ebp - 0x24]
mov edx, 0xdc9a2c6e
sub edx, 0x9ac91fa9
xor dword [ebp - 0x10], edi
mov esi, dword [ebx]
add esi, edx
mov dword [ebp - 0x1c], 0x783dfce3
mov dword [edi], esi
sub dword [ebp - 0x1c], 0x2638c68e
add edi, 0x656aa5e4
sub edi, 0x656aa5e0
add ebx, 0x723a6a82
sub ebx, 0x723a6a7e
loop 0x100030d2
add eax, 0x60508ee3
add eax, 0x9fb048e0
mov ebx, eax
add eax, 0xb60ea600
sub eax, 0xb60ea5fb
mov ecx, 0x10000000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x100082ac
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x100082b6
repz ret
jmp fcn.1000869f
Function at 0x403640
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x455020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4036d8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4036b8
xor eax, eax
push ebp
push 0x4036b1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4036f4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4036b8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x455020]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x455020], ax
mov esp, ebp
pop ebp
ret

Function at 0x4044cc
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x457048], 0
je 0x40452d
cmp word [0x45721c], 0xd7b2
jne 0x4044f5
cmp dword [0x457224], 0
jbe 0x4044f5
mov eax, 0x457218
call dword [0x457234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404554
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x45502c], 0
jne 0x404549
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret