joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c0e2
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x417f10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00408890
mov dword [ebp - 0x14], eax
cmp dword [0x81ecd8], esi
jne 0x40c1d5
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40c162
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40c2b5
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40c2b5
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40c2b5
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x81ecd8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x81ecdc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x81ece0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x81ece8], eax
test eax, eax
je 0x40c1d2
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x81ece4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40c1fa
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40c1ed
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40c20f
push 4
pop eax
jmp 0x40c2b7
cmp dword [ebp - 0x14], esi
je 0x40c20f
push dword [0x81ecd8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40c1f4
mov eax, dword [0x81ece4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40c26d
cmp dword [0x81ece8], edi
je 0x40c26d
push eax
call ebx
push dword [0x81ece8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40c26d
test eax, eax
je 0x40c26d
call ecx
test eax, eax
je 0x40c262
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40c262
test byte [ebp - 8], 1
jne 0x40c26d
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40c29d
mov eax, dword [0x81ecdc]
cmp eax, edi
je 0x40c29a
push eax
call ebx
test eax, eax
je 0x40c29a
call eax
mov esi, eax
test esi, esi
je 0x40c29a
mov eax, dword [0x81ece0]
cmp eax, edi
je 0x40c29a
push eax
call ebx
test eax, eax
je 0x40c29a
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x81ecd8]
call ebx
test eax, eax
je 0x40c2b5
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40c2b7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403da7
mov esp, ebp
pop ebp
ret
Function at 0x10007558
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x90
lea eax, [esp + 0x20]
lea ecx, [esp + 0x30]
mov dword [0x1028afc0], 0x1e02
mov dword [esp], eax
mov dword [esp + 0x1c], ecx
call fcn.100088d2
lea ecx, [0x100076af]
mov edx, dword [esp + 0x20]
mov dword [esp + 0x74], edx
mov dword [0x1028afc0], 0x3f2
mov dword [esp + 0x7c], 0x11cc00
mov edx, dword [0x1028afac]
mov dword [esp + 0x44], edx
mov edx, dword [0x1028afb0]
mov dword [esp + 0x30], edx
mov edx, dword [0x1028afb4]
mov dword [esp + 0x84], edx
mov edx, dword [0x1028afb8]
mov dword [esp + 0x78], edx
mov edx, dword [0x1028afbc]
mov dword [esp + 0x4c], edx
mov dword [0x1028afc4], 0xffffe050
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
jmp 0x1000767e
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0xc], ecx
jne 0x10007691
lea eax, [esp + 0x30]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x6c], ecx
mov dword [0x1028afc4], 0x983
mov dword [0x1028afc0], 0x297
mov edx, dword [esp + 0xc]
mov esi, dword [ecx + edx + 0x50]
mov dword [esp + 0x50], esi
mov esi, dword [esp + 0x28]
mov dword [esp], eax
mov dword [esp + 4], esi
call fcn.10008759
mov dword [0x1028afc4], 0x8f1
mov ecx, esp
lea edx, [esp + 0x30]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, dword [0x1028afc4]
mov dword [esp + 8], eax
mov eax, 2
mov ecx, dword [esp + 8]
add ecx, 0xffffde88
mov dword [0x1028afc0], ecx
lea esp, [ebp - 4]
pop esi
pop ebp
ret
mov eax, dword [esp + 0x14]
cmp word [eax], 0x5a4d
mov dword [esp + 0x10], eax
je 0x100075ef
mov eax, dword [esp + 0x10]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [0x1028afc0], 0x18db
mov dword [esp + 0x14], eax
jmp 0x1000767e
Function at 0x10007dd6
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x1028afcc], 0
mov byte [0x1028afd0], 0
mov edi, dword [0x1028afc4]
add edi, 0xfffff865
mov dword [0x1028afc4], edi
mov dword [0x1028afc8], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x10007f04
xor eax, eax
mov ecx, dword [0x1028afc4]
mov edx, ecx
add edx, 0x155b
mov dword [0x1028afc0], edx
mov dword [0x1028afc8], 0
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov edx, 0x100
add eax, 0xfffffb22
mov dword [0x1028afc4], eax
mov eax, dword [0x1028afcc]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + ecx]
add edi, eax
mov eax, ecx
xor ebx, ebx
mov dword [ebp - 0x28], edx
mov edx, ebx
mov ebx, dword [ebp - 0x10]
div ebx
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add edi, edx
mov eax, edi
cdq
mov edi, dword [ebp - 0x28]
idiv edi
mov dword [0x1028afcc], edx
mov esi, dword [ebp - 0x18]
mov bl, byte [esi + ecx]
mov byte [0x1028afd0], bl
mov dword [0x1028afc4], 0xc06
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov bl, byte [0x1028afd0]
mov ecx, dword [0x1028afcc]
mov byte [esi + ecx], bl
mov ecx, dword [0x1028afc0]
add ecx, 0x2167
mov dword [0x1028afc0], ecx
mov ecx, dword [0x1028afc8]
add ecx, 1
mov dword [0x1028afc8], ecx
mov edx, dword [0x1028afc4]
cmp ecx, 0x100
mov esi, edx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x20], ecx
jl 0x10007e4e
jmp 0x10007f39
mov eax, dword [ebp - 0x1c]
mov dword [0x1028afc4], 0xca1
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x1028afc8]
add eax, 1
mov dword [0x1028afc8], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x10007f04
jmp 0x10007e28
mov eax, dword [ebp - 0x2c]
add eax, 0x459
mov dword [0x1028afc4], eax
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10007f5b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x1028afc4], 0x1e81
mov dword [0x1028afc8], 0
mov dword [0x1028afcc], 0
mov dword [0x1028afd4], 0
mov dword [0x1028afc0], 0x26dd
cmp eax, 0
mov ebx, edi
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], edi
je 0x100080d2
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
add ecx, 1
mov dword [ebp - 0x2c], eax
mov eax, ecx
mov dword [ebp - 0x30], edx
cdq
idiv esi
mov dword [0x1028afc8], edx
mov dword [0x1028afc0], 0x4eb
mov ecx, dword [ebp - 0x20]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x30]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x1028afcc], edx
mov dword [0x1028afc4], 0xa9a
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x1028afd0], cl
mov dword [0x1028afc0], 0xffffe7ca
mov edi, dword [ebp - 0x20]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov edx, dword [0x1028afc4]
add edx, 0xffffe4a8
mov dword [0x1028afc0], edx
mov cl, byte [0x1028afd0]
mov edx, dword [0x1028afcc]
mov byte [edi + edx], cl
mov dword [0x1028afc4], 0x1f7a
mov edx, dword [0x1028afc8]
movzx edx, byte [edi + edx]
mov ebx, dword [0x1028afcc]
movzx ebx, byte [edi + ebx]
add ebx, edx
and ebx, 0xff
mov dword [0x1028afd4], ebx
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x2c]
mov cl, byte [edx + ecx]
xor cl, byte [edi + ebx]
mov ebx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x2c]
mov byte [ebx + edx], cl
mov dword [0x1028afc0], 0x1826
add edx, 1
mov ecx, dword [ebp - 0x10]
cmp edx, ecx
mov dword [ebp - 0x38], edx
je 0x100080d2
mov eax, dword [0x1028afcc]
mov ecx, dword [0x1028afc8]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x28], edx
jmp 0x10007fc8
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10008223
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x40
mov eax, dword [ebp + 8]
mov dword [0x1028afc0], 0x12db
mov dword [ebp - 0x10], eax
call fcn.100080da
xor ecx, ecx
mov edx, eax
mov dword [0x1028afc4], 0x983
mov esi, dword [eax + 0x3c]
mov dword [0x1028afc0], 0x297
mov esi, dword [eax + esi + 0x78]
mov dword [0x1028afc4], 0x1bf3
mov edi, edx
add edi, dword [eax + esi + 0x20]
mov dword [0x1028afc0], 0xfffffbb5
mov eax, dword [eax + esi + 0x18]
cmp eax, 0
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ecx
jne 0x100082d5
mov eax, dword [ebp - 0x24]
add esp, 0x40
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x28]
mov ecx, eax
mov edx, dword [ebp - 0x2c]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x31], bh
mov byte [ebp - 0x32], cl
jne 0x10008309
mov al, byte [ebp - 0x32]
test al, 1
jne 0x10008366
jmp 0x1000833d
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
add eax, dword [eax + ecx + 0x24]
mov dword [ebp - 0x38], eax
xor eax, eax
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x3c]
xor edx, edx
mov esi, dword [ebp - 0x14]
mov edi, dword [esi + eax*4]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edx
jmp 0x1000829f
mov eax, dword [ebp - 0x30]
add eax, 1
mov dword [ebp - 0x4c], eax
mov al, byte [ebp - 0x31]
cmp al, 0
setne cl
mov dl, byte [ebp - 0x32]
and dl, cl
mov esi, dword [ebp - 0x4c]
cmp esi, 0x20
setb cl
and dl, cl
test dl, 1
mov dword [ebp - 0x28], esi
jne 0x1000829f
jmp 0x100082c8
xor eax, eax
mov ecx, dword [ebp - 0x48]
add ecx, 2
mov edx, dword [ebp - 0x44]
add edx, 1
mov esi, dword [ebp - 0x18]
cmp edx, esi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x40], edx
jb 0x100082ed
jmp 0x10008294
mov eax, dword [ebp - 0x48]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
add edx, dword [edx + esi + 0x1c]
mov dword [0x1028afc0], 0xd83
mov edi, dword [ebp - 0x1c]
add edi, dword [edx + ecx*4]
mov dword [ebp - 0x24], edi
jmp 0x10008294
Function at 0x10008759
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x54
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [0x1028afc4], 0x1a92
mov dword [0x1028afc0], 0x2534
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x10008832
mov eax, dword [ebp - 0x34]
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [0x1028afc0], 0x1b3e
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x38], eax
call fcn.10007aa7
xor eax, eax
mov ecx, dword [ebp - 0x38]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [0x1028afc0], 0x105c
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0xc], ecx
mov ecx, dword [ebp - 0x38]
mov dword [edx + 0x40], ecx
mov dword [0x1028afc4], 0x1a71
add ecx, 0x1e36
mov esi, dword [ebp - 0x38]
cmp esi, 0
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x40], eax
je 0x10008829
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
add esp, 0x54
pop esi
pop ebp
ret
mov eax, dword [ebp - 0x30]
mov cl, byte [eax + 0x102777b6]
mov dl, byte [eax + 0x10277787]
sub dl, cl
mov byte [ebp + eax - 0x24], dl
add eax, 1
cmp eax, 0xe
mov dword [ebp - 0x30], eax
jne 0x10008832
lea eax, [ebp - 0x24]
mov dword [0x1028afc0], 0x18b3
mov dword [ebp - 0x44], eax
call fcn.100084bb
mov dword [esp], eax
mov eax, dword [ebp - 0x44]
mov dword [esp + 4], eax
call fcn.100085ba
mov ecx, dword [0x1028afc4]
add ecx, 0x65b
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
mov dword [0x1028afc4], eax
mov ecx, dword [ebp - 0x34]
cmp ecx, 0
jne 0x1000878a
xor eax, eax
add esp, 0x54
pop esi
pop ebp
ret
Function at 0x100088d2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x168
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [0x1028afc4], 0xa16
mov edx, ecx
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], ecx
jmp 0x10008a3d
lea eax, [0x10277795]
mov ecx, 0x20
lea edx, [ebp - 0x12c]
mov dword [0x1028afc0], 0x10db
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x20
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x140], ecx
call fcn.10007dd6
mov dword [0x1028afc0], 0x2503
mov eax, dword [ebp - 0x13c]
mov dword [esp], eax
mov ecx, dword [ebp - 0x144]
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov edx, dword [ebp - 0x148]
mov dword [esp + 0xc], edx
call fcn.10007f5b
xor eax, eax
mov ecx, dword [ebp - 0x144]
add ecx, 0xf74e8
mov edx, dword [ebp - 0x130]
mov dword [edx], ecx
mov dword [edx + 4], 0x11cc00
mov ecx, dword [ebp - 0x144]
add ecx, 0x2fddd
mov dword [edx + 8], ecx
mov dword [0x1028afc0], 0x14b
mov dword [edx + 0xc], 0x2020
mov dword [0x1028afc4], 0x112e
add esp, 0x168
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [ebp - 0x2c]
mov dword [0x1028afc4], 0xde3
mov dword [0x1028afc0], 0x18b3
mov dword [ebp - 0x14c], eax
call fcn.100084bb
mov dword [esp], eax
mov eax, dword [ebp - 0x14c]
mov dword [esp + 4], eax
call fcn.100085ba
mov ecx, eax
mov dword [0x1028afd8], eax
mov eax, esp
mov edx, dword [ebp - 0x148]
mov dword [eax + 4], edx
mov dword [eax + 0xc], 4
mov dword [eax + 8], 0x1000
mov dword [eax], 0
call ecx
sub esp, 0x10
xor ecx, ecx
mov edx, ecx
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x150], edx
mov dword [ebp - 0x154], ecx
jmp 0x10008ade
mov eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x134]
lea edx, section..data
imul esi, eax, 0x5c
mov edi, edx
add edi, esi
add edi, 0x38
mov esi, dword [edi]
imul edi, eax, 0x5c
add edx, edi
add edx, 4
movzx edx, word [edx]
xor edx, esi
add edx, ecx
add eax, 1
cmp eax, 0x34d
mov ecx, edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x138], eax
jne 0x10008a3d
xor eax, eax
mov dword [0x1028afc0], 0xccc
mov dword [ebp - 0x158], eax
mov eax, dword [ebp - 0x158]
mov ecx, eax
add ecx, 1
mov dl, byte [eax + 0x102777b6]
mov dh, byte [eax + 0x10277787]
sub dh, dl
mov byte [ebp + eax - 0x2c], dh
cmp ecx, 0xe
mov dword [ebp - 0x158], ecx
je 0x100089c3
jmp 0x10008aa8
mov eax, dword [ebp - 0x154]
mov ecx, dword [ebp - 0x150]
lea edx, section..data
imul esi, eax, 0x5c
mov edi, edx
add edi, esi
add edi, 0x38
mov esi, dword [edi]
imul edi, eax, 0x5c
mov ebx, edx
add ebx, edi
mov edi, dword [ebx]
imul ebx, eax, 0x5c
add edx, ebx
add edx, 4
movzx edx, word [edx]
xor edx, esi
mov esi, dword [ebp - 0x144]
add esi, ecx
mov dword [esp], esi
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], edx
call fcn.10007cf8
mov eax, dword [ebp - 0x164]
mov ecx, dword [ebp - 0x160]
add eax, ecx
mov edx, dword [ebp - 0x15c]
add edx, 1
cmp edx, 0x34d
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x154], edx
je 0x10008906
jmp 0x10008ade
Function at 0x403364
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x48400c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4033fc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4033dc
xor eax, eax
push ebp
push 0x4033d5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403418
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4033dc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x48400c]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x48400c], ax
mov esp, ebp
pop ebp
ret

Function at 0x404100
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x48604c], 0
je 0x404161
cmp word [0x486220], 0xd7b2
jne 0x404129
cmp dword [0x486228], 0
jbe 0x404129
mov eax, 0x48621c
call dword [0x486238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x484054
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404188
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x48401c], 0
jne 0x40417d
push 0
push 0x484074
push 0x484054
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4048d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.00404634
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.004045e9
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x404912
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
popal
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
invalid
invalid
cld

Function at 0x4049b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
Function at 0x4049ec
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
inc ebp
mov al, byte [0xa145c633]
mov byte cs:[ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.00404634
push eax
push esi
push dword [ebp + 8]
call fcn.004045e9
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00404634
push eax
push esi
push dword [ebp + 8]
call fcn.004045e9
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00404624
loopne 0x404ac4
inc ebp
invalid
jae 0x404a8e

Function at 0x404a10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
inc ebp
mov al, byte [0xa145c633]
mov byte cs:[ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.00404634
push eax
push esi
push dword [ebp + 8]
call fcn.004045e9
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00404634
push eax
push esi
push dword [ebp + 8]
call fcn.004045e9
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00404624
loopne 0x404ac4
inc ebp
invalid
jae 0x404a8e