joyce8/EMBER2024-capa huggingface dataset:
Function at 0x767af0c0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x767c71f4]
cmp byte [eax + 0xc], 0
je 0x767af22d
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x767af226
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x767c8b90], 0
jne 0x767af114
push 0x767af234
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x767af23c
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x767c8b90], eax
cmp dword [0x767c6bc0], 0
jne 0x767af20f
push 0x767af24c
call sub.kernel32.dll_LoadLibraryA
mov dword [0x767c6bc0], eax
cmp dword [0x767c6bc0], 0
je 0x767af20f
push 0x767af258
mov eax, dword [0x767c6bc0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x767c8b94], eax
push 0x767af268
mov eax, dword [0x767c6bc0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x767c8b98], eax
push 0x767af27c
mov eax, dword [0x767c6bc0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x767c8b9c], eax
push 0x767af294
mov eax, dword [0x767c6bc0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x767c8ba0], eax
push 0x767af2ac
mov eax, dword [0x767c6bc0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x767c8ba4], eax
push 0x767af2c0
mov eax, dword [0x767c6bc0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x767c8ba8], eax
push 0x767af2d8
mov eax, dword [0x767c6bc0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x767c8bac], eax
push 0x767af2f0
mov eax, dword [0x767c6bc0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x767c8bb0], eax
push 0x767af30c
mov eax, dword [0x767c6bc0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x767c8bb4], eax
push 0x767af318
mov eax, dword [0x767c6bc0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x767c8bb8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x767af22d
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x767b30b8
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.76773e4c
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x767b3107
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.767740bc
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x767ba844
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x767ba894]
test si, 4
je 0x767ba858
or bl, 1
test si, 8
je 0x767ba862
or bl, 4
test si, 1
je 0x767ba86c
or bl, 8
test si, 2
je 0x767ba876
or bl, 0x10
test si, 0x10
je 0x767ba880
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x767ba88f
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x767ba898
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x767ba8d0]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x767ba8b1
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x767ba8c0
or bl, 4
test esi, 0x20000000
je 0x767ba8cb
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x767c0f78
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x767c0f8a
add esp, 0xfffffff0
call fcn.76773420
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.76789440
mov eax, dword [0x767c6ec4]
mov dword [eax + 4], ebx
mov dword [eax], 0x767c131c
mov eax, dword [0x767c6ed0]
mov dword [eax + 4], ebx
mov dword [eax], 0x767c1328
mov eax, ebx
call fcn.767c1334
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x76781730]
call fcn.767730cc
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x76781730]
call fcn.767730cc
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x76781730]
call fcn.767730cc
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x76781730]
call fcn.767730cc
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x76781730]
call fcn.767730cc
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x767bd750
push eax
push 0
push 0
mov eax, dword [0x767c7010]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x7678ae9c]
call fcn.7678c610
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x7678ae9c]
call fcn.7678c610
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x7678ae9c]
call fcn.7678c610
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.767c1754
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x767c1630
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x767c1630
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x767c1630
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x767c10c7
call fcn.76773478
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x767c1414
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x767c15bf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x767c15a0
mov dl, 1
mov eax, dword [0x76781b4c]
call fcn.767730cc
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.76773e4c
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x767c158f
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.767af420
test al, al
je 0x767c1582
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x767c15d0
lea eax, [ebp - 0x254]
call fcn.76778ad0
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x767c1582
xor eax, eax
push ebp
push 0x767c157b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x767c1608
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x767c1564
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.767740bc
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x767c1564
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.767740bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x767c1582
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x767c1485
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.76785630
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x767c15c6
lea eax, [ebp - 0x260]
call fcn.76773e4c
ret

Function at 0x767c1ef4
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x767c8bdc]
cmp byte [eax + 0xa5], 0
jne 0x767c1f65
cmp dword [0x767c8bf4], 0
jne 0x767c1f26
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x767c1eb0
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x767c8bf4], eax
cmp dword [0x767c8bf0], 0
jne 0x767c1f41
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x767c8bf0], eax
cmp dword [0x767c8bf8], 0
jne 0x767c1f65
push esp
push 0
push 0
push 0x767c1e54
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x767c8bf8], eax
pop edx
ret
Function at 0x767c205c
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x767c2073
add esp, 0xfffffff0
call fcn.76773420
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.76789440
mov eax, dword [0x767c6ffc]
cmp word [eax + 2], 0
jne 0x767c209b
mov eax, dword [0x767c6ffc]
mov dword [eax + 4], ebx
mov dword [eax], fcn.767c3734
mov eax, dword [0x767c70a8]
cmp word [eax + 2], 0
jne 0x767c20b5
mov eax, dword [0x767c70a8]
mov dword [eax + 4], ebx
mov dword [eax], fcn.767c392c
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x76781730]
call fcn.767730cc
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x76781730]
call fcn.767730cc
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x7678b97c]
call fcn.76792cf4
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x767c223c
mov eax, dword [0x767c6f24]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.767930c4
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x767c3ecc
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x767c6f24]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.7677c1a0
test eax, eax
je 0x767c21aa
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.767784c4
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.7677c1c8
test eax, eax
je 0x767c21be
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.767740bc
mov eax, dword [0x767c6e18]
cmp byte [eax], 0
jne 0x767c21f2
mov eax, ebx
call fcn.767c2364
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.767c40a8
mov eax, ebx
call fcn.767c4a6c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x767c2232
call fcn.76773478
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x767c25e4
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x767c8bdc]
cmp dword [eax + 0x30], 0
je 0x767c268e
cmp dword [ebx + 0x94], 0
jne 0x767c2688
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x767c2574
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x767c2688
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x767c264e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x767c2688
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.76783a98
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x767c265d
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x767c31f0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x767c3225
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.76773f3c
jmp 0x767c3232
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.76773ea0
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x767c4284
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x767c42c5
mov eax, esi
call fcn.767aaa4c
test al, al
je 0x767c42c5
mov eax, dword [ebx + 0x84]
call fcn.767aa748
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x767c42c5
push 0
mov eax, dword [ebx + 0x84]
call fcn.767aa748
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x41d968
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41d96e
ret

Function at 0x466e30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x74]
sub edi, dword [ebx + 0x6c]
jmp 0x466e5f
mov eax, dword [ebx + 0x2c]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x6c]
ja 0x466ede
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.0046538c
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], ebp
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x466eac
mov cx, word [esp]
sub cx, si
jmp 0x466eae
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x466e95
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x466ed4
mov cx, word [esp]
sub cx, si
jmp 0x466ed6
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x466ebd
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x466f3b
mov edx, dword [ebx + 0x38]
mov ecx, edi
add edx, dword [ebx + 0x6c]
mov eax, ebp
add edx, dword [ebx + 0x74]
call fcn.00466b04
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x466f26
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x6c]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x466f3b
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x466e3a
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x46cd5c
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x46cd8a
mov eax, ebx
call fcn.0046d810
cmp dword [ebx + 0x40], 0
je 0x46cd83
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x46cdfb
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x46cded
cmp dword [ebx + 8], 0
je 0x46cdac
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x46cdbe
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x46cded
cmp dword [ebx + 8], 0
je 0x46cd9f
cmp eax, 3
je 0x46cdd1
dec eax
jne 0x46cd9f
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x46cd9f
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x46cd9f
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x46ce19
cmp dword [ebx + 0x14], 0xcc
je 0x46ce19
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0046ce24
pop ebx
ret

Function at 0x47fba0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
call fcn.00406dc0
push eax
call fcn.00406e48
mov ebx, eax
call fcn.00406dd0
push eax
call fcn.00406e80
mov esi, eax
push pe_nt_image_headers32
call fcn.00406dc0
push eax
call fcn.00406f98
push 0xf
call fcn.00406dd0
push eax
call fcn.00406fa8
push 0xa
call fcn.0040dd58
rdtsc
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
push 0x1f4
call fcn.0040dd58
rdtsc
sub eax, dword [ebp - 4]
sbb edx, dword [ebp - 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
push esi
call fcn.00406dd0
push eax
call fcn.00406fa8
push ebx
call fcn.00406dc0
push eax
call fcn.00406f98
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x14], eax
fild qword [ebp - 0x18]
fdiv dword [0x47fc4c]
call fcn.00402b78
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4019c0
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
push str.VORs.txt
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x41e66c], eax
cmp eax, 0xffffffff
je 0x401b21
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [0x41c414], eax
test eax, eax
je 0x401b14
push 0
push 0x41c3bc
push eax
mov eax, dword [0x41e66c]
push 0x41c470
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [0x41c414]
xor eax, eax
mov dword [0x41c1e0], eax
test edx, edx
jbe 0x401b14
lea esp, [esp]
cmp byte [eax + 0x41c470], 0x5f
jne 0x401b06
test eax, eax
je 0x401a4e
cmp byte [eax + 0x41c46f], 0xa
jne 0x401b06
movzx ecx, byte [eax + 0x41c471]
inc eax
mov dl, byte [eax + 0x41c471]
inc eax
inc eax
mov byte [0x41c43c], cl
movzx ecx, byte [eax + 0x41c470]
add eax, 2
mov byte [0x41c43d], dl
lea edx, [eax + 0x41c470]
push edx
mov byte [0x41c43e], cl
mov dword [0x41c1e0], eax
call fcn.00402d7d
mov eax, dword [0x41c1e0]
mov cl, byte [eax + 0x41c470]
fst qword [0x41c1d8]
fmul qword [0x41b200]
mov edx, dword [0x41c414]
add esp, 4
fstp qword [0x41c1f0]
cmp cl, 0xd
je 0x401acb
cmp eax, edx
jae 0x401acb
cmp cl, 0x2f
je 0x401acb
mov cl, byte [eax + 0x41c471]
inc eax
cmp cl, 0xd
jne 0x401ab6
cmp byte [eax + 0x41c470], 0x2f
jne 0x401b06
inc eax
mov dword [0x41c1e0], eax
lea eax, [eax + 0x41c470]
push eax
call fcn.00402d7d
fst qword [0x41c2a0]
fmul qword [0x41b200]
mov edx, dword [0x41c414]
mov eax, dword [0x41c1e0]
add esp, 4
fstp qword [0x41e648]
inc eax
mov dword [0x41c1e0], eax
cmp eax, edx
jb 0x401a30
mov ecx, dword [0x41e66c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
ret
Function at 0x402a4c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41a004]
jne 0x402a56
repz ret
jmp fcn.00402f43

Function at 0x40bda3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004037b5
and dword [ebp - 4], 0
cmp dword [0x41c0e8], 0
mov ebx, eax
jne 0x40be54
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40bf05
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x413438
push edi
call esi
test eax, eax
je 0x40bf05
push eax
call fcn.00403743
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x41c0e8], eax
call esi
push eax
call fcn.00403743
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x41c0ec], eax
call esi
push eax
call fcn.00403743
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x41c0f0], eax
call esi
push eax
call fcn.00403743
pop ecx
mov dword [0x41c0f8], eax
test eax, eax
je 0x40be54
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00403743
pop ecx
mov dword [0x41c0f4], eax
mov eax, dword [0x41c0f4]
cmp eax, ebx
je 0x40beac
cmp dword [0x41c0f8], ebx
je 0x40beac
push eax
call fcn.004037be
push dword [0x41c0f8]
mov esi, eax
call fcn.004037be
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40beac
test edi, edi
je 0x40beac
call esi
test eax, eax
je 0x40bea3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40bea3
test byte [ebp - 0xc], 1
jne 0x40beac
or dword [ebp + 0x10], 0x200000
jmp 0x40bee5
mov eax, dword [0x41c0ec]
cmp eax, ebx
je 0x40bee5
push eax
call fcn.004037be
pop ecx
test eax, eax
je 0x40bee5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40bee5
mov eax, dword [0x41c0f0]
cmp eax, ebx
je 0x40bee5
push eax
call fcn.004037be
pop ecx
test eax, eax
je 0x40bee5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x41c0e8]
call fcn.004037be
pop ecx
test eax, eax
je 0x40bf05
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40bf07
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402258
Capabilities:
Check os version

Disassembly:
cmp dword [0x48c0a0], 0
push esi
push edi
jne 0x4022dd
mov edi, 0x114
mov esi, 0x48bf60
push edi
push 0
push esi
call fcn.0046d310
add esp, 0xc
mov dword [0x48bf60], edi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
call esi
mov ecx, dword [0x48bf64]
movzx edx, word [0x48bf68]
movzx eax, cx
shl eax, 0x10
or eax, edx
cmp ecx, 5
mov dword [0x48c0a0], eax
jb 0x4022dd
push 0x11c
mov edi, 0x48be40
push 0
push edi
call fcn.0046d310
add esp, 0xc
mov dword [0x48be40], 0x11c
push edi
call esi
mov eax, dword [0x48be44]
mov dword [0x48bf64], eax
mov eax, dword [0x48be48]
mov dword [0x48bf68], eax
mov edi, dword [esp + 0xc]
cmp dword [edi], 0
je 0x402351
push dword [0x48bf68]
push dword [0x48bf64]
push str.Windows__d._d
push edi
call fcn.004017cb
mov eax, dword [0x48bf70]
add esp, 0x10
cmp eax, 2
jne 0x402311
mov esi, str._Win32_NT
jmp 0x40232b
cmp eax, 1
jne 0x40231d
mov esi, str._Win32_WINDOWS
jmp 0x40232b
test eax, eax
mov esi, str._Win32s
je 0x40232b
mov esi, str._Unbekannt
mov eax, esi
test eax, eax
je 0x402338
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push eax
mov ecx, edi
call fcn.00401657
mov eax, dword [esp + 0x10]
test eax, eax
je 0x402351
mov ecx, dword [0x48bf70]
mov dword [eax], ecx
mov eax, dword [0x48c0a0]
pop edi
pop esi
ret
Function at 0x403744
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push esi
push edi
push 0x2001f
push dword [ebp + 8]
mov ebx, ecx
xor esi, esi
lea ecx, [ebp - 4]
push dword [ebx]
mov dword [ebp - 4], esi
call fcn.00403828
mov edi, eax
cmp edi, esi
je 0x403784
cmp dword [ebp - 4], esi
je 0x40377d
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x403821
lea eax, [ebp - 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push eax
push esi
push esi
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x214]
mov dword [ebp - 8], 0x100
push eax
push esi
push dword [ebp - 4]
call edi
test eax, eax
jne 0x4037f5
lea eax, [ebp - 0x214]
lea ecx, [ebp - 4]
push eax
call fcn.00403744
cmp eax, esi
mov dword [ebp - 0xc], eax
jne 0x4037e2
lea eax, [ebp - 0x14]
mov dword [ebp - 8], 0x100
push eax
push esi
push esi
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x214]
push eax
push esi
push dword [ebp - 4]
jmp 0x4037a7
cmp dword [ebp - 4], esi
je 0x4037f0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
jmp 0x403821
cmp dword [ebp - 4], esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x403808
push dword [ebp - 4]
call edi
mov dword [ebp - 4], esi
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp dword [ebp - 4], esi
mov ebx, eax
je 0x40381f
push dword [ebp - 4]
call edi
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 4