joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43a350
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x78]
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], 1
jmp 0x43a386
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [eax + 0x14]
jae 0x43a3e4
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x20]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
add edx, dword [eax + ecx*4]
push edx
call fcn.0043a2c0
add esp, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0xc]
jne 0x43a3e2
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x24]
mov eax, dword [ebp - 0x10]
mov cx, word [edx + eax*2]
mov word [ebp - 0x18], cx
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x1c]
movzx ecx, word [ebp - 0x18]
mov edx, dword [ebp + 8]
add edx, dword [eax + ecx*4]
mov eax, edx
jmp 0x43a3e6
jmp 0x43a37d
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x43a3f0
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov byte [ebp - 0x10], 0x6b
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xe], 0x72
mov byte [ebp - 0xd], 0x6e
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0xb], 0x6c
mov byte [ebp - 0xa], 0x33
mov byte [ebp - 9], 0x32
mov byte [ebp - 8], 0x2e
mov byte [ebp - 7], 0x64
mov byte [ebp - 6], 0x6c
mov byte [ebp - 5], 0x6c
mov byte [ebp - 4], 0
push ebx
push ecx
mov ebx, dword fs:[0x30]
mov ecx, dword [ebx + 0xc]
mov ecx, dword [ecx + 0x1c]
mov ecx, dword [ecx]
mov eax, dword [ecx + 8]
mov dword [ebp - 0x14], eax
pop ecx
pop ebx
push 0x3777cccb
mov eax, dword [ebp - 0x14]
push eax
call fcn.0043a350
add esp, 8
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x10]
push ecx
call dword [ebp - 0x18]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43a570
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov byte [ebp - 0x24], 0x47
mov byte [ebp - 0x23], 0x65
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0x53
mov byte [ebp - 0x20], 0x79
mov byte [ebp - 0x1f], 0x73
mov byte [ebp - 0x1e], 0x74
mov byte [ebp - 0x1d], 0x65
mov byte [ebp - 0x1c], 0x6d
mov byte [ebp - 0x1b], 0x44
mov byte [ebp - 0x1a], 0x69
mov byte [ebp - 0x19], 0x72
mov byte [ebp - 0x18], 0x65
mov byte [ebp - 0x17], 0x63
mov byte [ebp - 0x16], 0x74
mov byte [ebp - 0x15], 0x6f
mov byte [ebp - 0x14], 0x72
mov byte [ebp - 0x13], 0x79
mov byte [ebp - 0x12], 0x41
mov byte [ebp - 0x11], 0
lea eax, [ebp - 0x24]
push eax
call fcn.0043a680
add esp, 4
mov dword [ebp - 0x10], eax
push 0x1c368da0
call fcn.0043a470
add esp, 4
mov dword [ebp - 0xc], eax
push 0x104
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
add eax, 1
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x3c]
mov dl, byte [ecx]
mov byte [ebp - 0x41], dl
add dword [ebp - 0x3c], 1
cmp byte [ebp - 0x41], 0
jne 0x43a600
mov eax, dword [ebp - 0x3c]
sub eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x48]
mov byte [ecx - 2], 0
push 0x100050f0
mov edx, dword [ebp + 8]
push edx
call fcn.0043a500
add esp, 8
call dword [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x38]
push eax
call fcn.0043a250
add esp, 0xc
lea ecx, [ebp - 0x38]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0043a500
add esp, 8
mov byte [ebp - 8], 0x2e
mov byte [ebp - 7], 0x65
mov byte [ebp - 6], 0x78
mov byte [ebp - 5], 0x65
mov byte [ebp - 4], 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0043a500
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x43a7e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x174
push 0x74e3bb2e
call fcn.0043a470
add esp, 4
mov dword [ebp - 0x16c], eax
push 0x3749ca10
call fcn.0043a470
add esp, 4
mov dword [ebp - 0x14], eax
push 0x49f43cb7
call fcn.0043a470
add esp, 4
mov dword [ebp - 0x170], eax
mov dword [ebp - 0x28], 0x23ec5044
mov dword [ebp - 0x24], 0x33af2093
push 0
push 2
call dword [ebp - 0x16c]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x158], 0x128
lea eax, [ebp - 0x158]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [ebp - 0x14]
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 9], 0x72
mov byte [ebp - 8], 0x33
mov byte [ebp - 7], 0x32
mov byte [ebp - 6], 0x2e
mov byte [ebp - 5], 0x64
mov byte [ebp - 4], 0x6c
mov byte [ebp - 3], 0x6c
mov byte [ebp - 2], 0
lea edx, [ebp - 0xc]
push edx
call dword [0x1000504c]
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0
jne 0x43a8a7
lea eax, [ebp - 0xc]
push eax
call dword [0x10005040]
mov dword [ebp - 0x168], eax
mov byte [ebp - 0x164], 0x45
mov byte [ebp - 0x163], 0x6e
mov byte [ebp - 0x162], 0x75
mov byte [ebp - 0x161], 0x6d
mov byte [ebp - 0x160], 0x57
mov byte [ebp - 0x15f], 0x69
mov byte [ebp - 0x15e], 0x6e
mov byte [ebp - 0x15d], 0x64
mov byte [ebp - 0x15c], 0x6f
mov byte [ebp - 0x15b], 0x77
mov byte [ebp - 0x15a], 0x73
mov byte [ebp - 0x159], 0
lea ecx, [ebp - 0x164]
push ecx
mov edx, dword [ebp - 0x168]
push edx
call dword [0x10005004]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x150]
push ecx
call fcn.0043a6b0
add esp, 8
test eax, eax
je 0x43a991
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x150]
push eax
call fcn.0043a6b0
add esp, 8
test eax, eax
je 0x43a991
lea ecx, [ebp - 0x134]
push ecx
push 0x100050d0
call dword [0x1000500c]
test eax, eax
je 0x43a991
mov dword [0x10007128], 0
mov edx, dword [ebp - 0x150]
mov dword [ebp - 0x174], edx
lea eax, [ebp - 0x174]
push eax
push 0x10001550
call dword [ebp - 0x10]
cmp dword [0x10007128], 0xa
jbe 0x43a98d
mov eax, 1
jmp 0x43a9f3
xor eax, eax
jmp 0x43a9f3
lea ecx, [ebp - 0x158]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
call dword [ebp - 0x170]
test eax, eax
jne 0x43a912
mov byte [ebp - 0x20], 0x4d
mov byte [ebp - 0x1f], 0x69
mov byte [ebp - 0x1e], 0x6e
mov byte [ebp - 0x1d], 0x69
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0x1b], 0x6e
mov byte [ebp - 0x1a], 0x69
mov byte [ebp - 0x19], 0x66
mov byte [ebp - 0x18], 0x66
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x16], 0x72
mov byte [ebp - 0x15], 0
lea eax, [ebp - 0x20]
push eax
push 0
call dword [0x10005098]
test eax, eax
je 0x43a9f1
mov eax, 1
jmp 0x43a9f3
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x43c720
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x698
push 0x40566d67
call fcn.0043a470
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x110]
push ecx
call dword [0x10005054]
push 0x100050b0
lea edx, [ebp - 0x110]
push edx
call fcn.0043a500
add esp, 8
lea eax, [ebp - 0x250]
push eax
lea ecx, [ebp - 0x110]
push ecx
call dword [0x10005030]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x43c780
jmp 0x43c9d5
cmp dword [ebp - 0x250], 0x10
jne 0x43c7ef
movsx edx, byte [ebp - 0x224]
cmp edx, 0x2e
je 0x43c7ef
mov byte [ebp - 0x254], 0x5c
mov byte [ebp - 0x253], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x360]
push ecx
call dword [0x10005054]
lea edx, [ebp - 0x254]
push edx
lea eax, [ebp - 0x360]
push eax
call fcn.0043a500
add esp, 8
lea ecx, [ebp - 0x224]
push ecx
lea edx, [ebp - 0x360]
push edx
call fcn.0043a500
add esp, 8
lea eax, [ebp - 0x360]
push eax
call fcn.0043c720
add esp, 4
push 0x100050b8
lea ecx, [ebp - 0x224]
push ecx
call fcn.0043bcd0
add esp, 8
test eax, eax
je 0x43c875
lea edx, [ebp - 0x224]
push edx
call dword [0x10005000]
movsx eax, byte [ebp + eax - 0x225]
cmp eax, 0x74
jne 0x43c875
mov byte [ebp - 0x46c], 0x5c
mov byte [ebp - 0x46b], 0
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x468]
push edx
call dword [0x10005054]
lea eax, [ebp - 0x46c]
push eax
lea ecx, [ebp - 0x468]
push ecx
call dword [0x1000502c]
lea edx, [ebp - 0x224]
push edx
lea eax, [ebp - 0x468]
push eax
call dword [0x1000502c]
lea ecx, [ebp - 0x468]
push ecx
call dword [0x10005074]
push 0x100050c0
lea edx, [ebp - 0x224]
push edx
call fcn.0043bcd0
add esp, 8
test eax, eax
je 0x43c9b2
lea eax, [ebp - 0x224]
push eax
call dword [0x10005000]
movsx ecx, byte [ebp + eax - 0x225]
cmp ecx, 0x65
jne 0x43c9b2
mov byte [ebp - 0x57c], 0x5c
mov byte [ebp - 0x57b], 0
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x578]
push eax
call dword [0x10005054]
lea ecx, [ebp - 0x57c]
push ecx
lea edx, [ebp - 0x578]
push edx
call fcn.0043a500
add esp, 8
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x578]
push ecx
call fcn.0043a500
add esp, 8
push 0
lea edx, [ebp - 0x578]
push edx
call fcn.0043bd30
add esp, 8
movzx eax, al
test eax, eax
je 0x43c9b2
push 0x104
lea ecx, [ebp - 0x698]
push ecx
call dword [0x10005028]
mov byte [ebp - 0x58c], 0x5c
mov byte [ebp - 0x58b], 0x5c
mov byte [ebp - 0x58a], 0x73
mov byte [ebp - 0x589], 0x79
mov byte [ebp - 0x588], 0x73
mov byte [ebp - 0x587], 0x74
mov byte [ebp - 0x586], 0x65
mov byte [ebp - 0x585], 0x6d
mov byte [ebp - 0x584], 0x2e
mov byte [ebp - 0x583], 0x65
mov byte [ebp - 0x582], 0x78
mov byte [ebp - 0x581], 0x65
mov byte [ebp - 0x580], 0
lea edx, [ebp - 0x58c]
push edx
lea eax, [ebp - 0x698]
push eax
call dword [0x1000502c]
lea ecx, [ebp - 0x698]
push ecx
lea edx, [ebp - 0x578]
push edx
call fcn.0043bd30
add esp, 8
push 0x64
call dword [ebp - 4]
lea eax, [ebp - 0x250]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [0x10005048]
test eax, eax
jne 0x43c780
mov edx, dword [ebp - 8]
push edx
call dword [0x1000506c]
mov esp, ebp
pop ebp
ret
Function at 0x65ff10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x6749fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0x660002
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.00663dff
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x660002
lea edx, [esp + 0x14]
push edx
push 0x67a140
call fcn.0065b6e0
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.0066420b
push 0x10
call fcn.006641d3
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0x65ffc5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.006501c0
jmp 0x65ffc7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.0065fb80
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0x65fff0
mov ecx, edi
call fcn.006502c0
push edi
call fcn.006641c8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x660021
inc ebx
cmp ebx, 0x20
jb 0x65ff3e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x6631b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00663140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00663140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00663140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00663140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x663230
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x20c
lea eax, [esp]
push ebx
mov ebx, dword [esp + 0x218]
push ebp
mov ebp, dword [esp + 0x218]
push esi
push eax
push 0xf003f
push 0
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x6632d6
mov edx, dword [esp + 0xc]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
lea ecx, [esp + 0x14]
push 0x104
push ecx
push eax
push edx
call edi
mov esi, eax
test esi, esi
jne 0x6632ae
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push ecx
call fcn.00663230
mov esi, eax
add esp, 8
test esi, esi
jne 0x6632ae
lea edx, [esp + 0x14]
push 0x104
push edx
push eax
mov eax, dword [esp + 0x1c]
push eax
call edi
mov esi, eax
test esi, esi
je 0x66327e
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 0x103
pop edi
je 0x6632ce
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x20c
ret
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop esi
pop ebp
pop ebx
add esp, 0x20c
ret

Function at 0x663bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x663c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x67587c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x663c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x663c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x401220
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
sub edx, 0x9a
rol esi, 0x21
ror edx, 0x99
rol ebx, 0x44
inc eax
rcr ebx, 0x2c
dec edi
imul edx
dec esi
not esi
imul edi
inc esi
dec esi
rcr edx, 0x70
rcl edi, 0x31
or edx, 0xb7
inc edx
not edx
rcl esi, 0x7b
sub edi, 0x1d
sbb eax, 0x21
add edx, 0xb1
ror edi, 0xc1
mov edi, 0x9f
rcr eax, 0x68
neg esi
dec esi
sbb ebx, 0x61
inc eax
and eax, 0x71
bswap eax
bswap edi
or eax, 0x15
dec ebx
add esi, 0xfe
rcl eax, 0xfa
or eax, 0x5e
mov esi, 0x4a
not esi
add esi, 0x58
rol edx, 0xf3
ror ebx, 0xdf
bswap ebx
inc edi
sbb edx, 0x1c
bswap eax
inc ebx
bswap ebx
dec edi
and edi, 0x5e
xor ecx, ecx
xor edi, edi
inc edx
dec edx
neg esi
not edx
dec ebx
add edx, 0x77
imul eax
dec esi
rol eax, 0xf9
mov eax, 0
inc ebx
dec edi
ror edi, 0x23
rol edi, 0xd4
imul esi
not edx
rcl eax, 0
rol eax, 0x46
dec esi
neg eax
neg eax
sbb esi, 0xf7
rcr ebx, 0xb5
neg ebx
dec ebx
and eax, 0x62
or edx, 0x7f
and edx, 0xbb
not esi
mov edx, 0x93
sub edi, 0x4c
imul esi
neg ebx
neg ebx
sub edi, 0xfa
not eax
rcr ebx, 0x3e
not esi
inc ebx
rcl esi, 0x27
neg edx
inc ebx
inc eax
imul edx
or edx, 0xb0
rol esi, 0x9f
or ebx, 0xb6
neg edx
bswap esi
sbb edx, 0x16
mov ecx, dword [ebp + 0xc]
inc edx
and edi, 0x87
ror ebx, 0xdf
rcr edi, 0x21
or edx, 0x19
rol esi, 0xa4
ror eax, 0x87
imul edi
imul esi
bswap ebx
not edi
dec eax
inc eax
rcr eax, 0x8f
or ebx, 0xaa
not esi
ror ebx, 0x89
ror ebx, 0x4b
sub esi, 0x7d
dec edx
or edx, 0xcc
sbb edx, 0xa7
add edi, 0xbb
inc ebx
ror edi, 0x18
rol esi, 0x72
or edx, 0xb3
neg edi
bswap eax
inc ebx
neg edx
imul esi
add edx, 0xca
ror edx, 0x8d
dec edx
neg eax
imul edi
imul edi
sub ebx, 0x1b
sbb edi, 0xd8
rcl edx, 0x6e
bswap edi
not edx
sub eax, 0xc9
and edx, 0xec
dec esi
imul edi
mov esi, 0xe1
dec edi
rcl edx, 0x52
mov edi, dword [ebp + 8]
xor ebx, ebx
mov eax, ebx
mov eax, ebx
not byte [edi]
xor eax, ebx
mov esi, ebx
xor ebx, ebx
xor ebx, eax
mov eax, ebx
xor eax, ebx
xor eax, esi
xor esi, eax
xor ebx, esi
add byte [edi], 0x79
mov ebx, ebx
xor eax, ebx
xor esi, eax
xor ebx, esi
mov eax, esi
mov eax, ebx
mov ebx, ebx
xor eax, esi
mov eax, ebx
sub byte [edi], 0x30
mov esi, ebx
xor esi, eax
mov esi, ebx
xor eax, ebx
mov eax, ebx
mov eax, esi
mov eax, ebx
xor ebx, eax
xor eax, eax
imul byte [edi]
inc edi
loop 0x4013ce
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x404f75
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x428200]
jne 0x404f7f
repz ret
jmp fcn.00407310
Function at 0x4055e5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404395
and dword [ebp - 4], 0
cmp dword [0x429390], 0
mov ebx, eax
jne 0x405696
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x405747
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x405747
push eax
call fcn.00404323
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x429390], eax
call esi
push eax
call fcn.00404323
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x429394], eax
call esi
push eax
call fcn.00404323
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x429398], eax
call esi
push eax
call fcn.00404323
pop ecx
mov dword [0x4293a0], eax
test eax, eax
je 0x405696
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404323
pop ecx
mov dword [0x42939c], eax
mov eax, dword [0x42939c]
cmp eax, ebx
je 0x4056ee
cmp dword [0x4293a0], ebx
je 0x4056ee
push eax
call fcn.0040439e
push dword [0x4293a0]
mov esi, eax
call fcn.0040439e
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4056ee
test edi, edi
je 0x4056ee
call esi
test eax, eax
je 0x4056e5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4056e5
test byte [ebp - 0xc], 1
jne 0x4056ee
or dword [ebp + 0x10], 0x200000
jmp 0x405727
mov eax, dword [0x429394]
cmp eax, ebx
je 0x405727
push eax
call fcn.0040439e
pop ecx
test eax, eax
je 0x405727
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x405727
mov eax, dword [0x429398]
cmp eax, ebx
je 0x405727
push eax
call fcn.0040439e
pop ecx
test eax, eax
je 0x405727
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x429390]
call fcn.0040439e
pop ecx
test eax, eax
je 0x405747
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x405749
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0xf01e10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
xor eax, eax
jne 0xf01e19
xor ecx, ecx
jne 0xf01e19
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
shl eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0xf01e60
mov eax, dword [ebp - 0xc]
jmp 0xf01ebd
cmp dword [ebp - 4], 1
je 0xf01e73
cmp dword [ebp - 4], 2
je 0xf01e73
mov eax, 0xd
jmp 0xf01ebd
cmp dword [ebp + 0xc], 0
je 0xf01eb1
cmp dword [ebp - 8], 0
je 0xf01ea9
mov eax, dword [ebp - 8]
xor edx, edx
mov ecx, 2
div ecx
test edx, edx
jne 0xf01ea0
mov edx, dword [ebp - 8]
shr edx, 1
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + edx*2 - 2]
test ecx, ecx
je 0xf01ea7
mov eax, 0xd
jmp 0xf01ebd
jmp 0xf01eb1
xor edx, edx
mov eax, dword [ebp + 0xc]
mov word [eax], dx
mov ecx, dword [ebp - 8]
shr ecx, 1
mov edx, dword [ebp + 0x10]
mov dword [edx], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc

Function at 0xf01fc0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
xor eax, eax
jne 0xf01fc9
xor ecx, ecx
jne 0xf01fc9
xor edx, edx
cmp dword [ebp + 0xc], 0
setne dl
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0
jne 0xf01fea
mov eax, 0xd
jmp 0xf02045
xor eax, eax
jne 0xf01fd1
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax*2]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2]
mov dword [ebp - 4], edx
cmp dword [ebp - 0xc], 1
jne 0xf01ffb
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 7
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esp, ebp
pop ebp
ret 8
Function at 0xf02050
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0xf0d018]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x230], ecx
lea ecx, [ebp - 0x14]
call fcn.00f01b30
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax + 4]
or ecx, 0x2001f
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00f01da0
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0xf020bb
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x224], edx
lea ecx, [ebp - 0x14]
call fcn.00f01b90
mov eax, dword [ebp - 0x224]
jmp 0xf0214c
mov dword [ebp - 4], 0x100
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x220]
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0xf02121
lea ecx, [ebp - 0x220]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00f02050
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0xf02118
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x228], edx
lea ecx, [ebp - 0x14]
call fcn.00f01b90
mov eax, dword [ebp - 0x228]
jmp 0xf0214c
mov dword [ebp - 4], 0x100
jmp 0xf020c2
lea ecx, [ebp - 0x14]
call fcn.00f01cd0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x230]
call fcn.00f01c10
mov dword [ebp - 0x22c], eax
lea ecx, [ebp - 0x14]
call fcn.00f01b90
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00f07458
mov esp, ebp
pop ebp
ret 4