joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43e890
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x46e213
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00461939
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.00466fd1
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.0046850f
test eax, eax
je 0x43e9ac
mov ecx, dword [esp + 0x3c]
call fcn.00466ffe
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x43e970
push edi
mov ecx, esi
call fcn.0046466b
mov ecx, esi
call fcn.0043eb10
cmp dword [esp + 0x38], 1
jne 0x43e9a5
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.004647a6
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x4413e0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x441413
push esi
call fcn.004444d0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x44140c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x441499
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x441482
mov eax, dword [esi + 8]
test eax, eax
je 0x441437
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x44147e
cmp eax, 2
je 0x441482
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x44142a
cmp eax, 3
je 0x44145d
cmp eax, 1
jne 0x44142a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x44142a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x44142a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.004414c0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x4414a8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.004414c0
add esp, 4
pop esi
ret

Function at 0x44cfd0
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x44d073
test eax, eax
jbe 0x44d073
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x44d073
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x44d01e
xor esi, esi
jmp 0x44d024
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x44d04f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.0044ef70
add esi, eax
push esi
mov ebx, esi
call fcn.0044ef70
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x44d030
pop ebp
test edi, edi
pop edi
jne 0x44d073
test ebx, ebx
je 0x44d073
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.004513f0
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc
Function at 0x44d1b5
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x44d2cd
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x44d2cd
mov eax, dword [esi + 0x3c]
push eax
call fcn.00461d8b
mov esi, eax
test esi, esi
je 0x44d2cd
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x44d2cd
mov ecx, esi
call fcn.0044d120
cmp edi, eax
jge 0x44d2cd
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x44d253
mov dword [esp + 0x34], 1
jmp 0x44d2ae
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x44d2cd
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.0044c720
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc

Function at 0x46272e
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x462766
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004607e5
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004607bd
jmp 0x462772
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x463e23
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x463e65
call fcn.004698fa
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x463e65
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x463e5c
xor eax, eax
jmp 0x463e6d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00463e73
pop edi
pop esi
pop ebx
ret 4
Function at 0x469e2a
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x469e58
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x469e76
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00469d90
jmp 0x469e76
mov eax, dword [esi + 0x14]
test eax, eax
je 0x469e76
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00469d90
test edi, edi
mov eax, edi
jne 0x469e60
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x403c40
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, edx
mov edx, dword [ebx + 4]
sub edx, 0xd7b1
cmp edx, 2
ja 0x403c9c
push ecx
push 0
mov eax, esp
push 0
push eax
mov eax, dword [ebx + 8]
mul ecx
push eax
push esi
push dword [ebx]
call sub.kernel32.dll_ReadFile
dec eax
pop eax
pop ecx
jne 0x403c8e
xor edx, edx
div dword [ebx + 8]
mov edx, dword [esp + 0xc]
test edx, edx
je 0x403c83
mov dword [edx], eax
pop esi
pop ebx
ret 4
cmp eax, ecx
je 0x403c7e
mov eax, 0x64
jmp 0x403c93
call sub.kernel32.dll_GetLastError
call fcn.0040266c
xor eax, eax
jmp 0x403c7e
mov eax, 0x67
jmp 0x403c93

Function at 0x403ca4
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, edx
mov eax, dword [eax + 4]
sub eax, 0xd7b2
cmp eax, 1
ja 0x403cff
push ecx
push 0
mov eax, esp
push 0
push eax
mov eax, dword [ebx + 8]
mul ecx
push eax
push esi
push dword [ebx]
call sub.kernel32.dll_WriteFile
dec eax
pop eax
pop ecx
jne 0x403cf1
xor edx, edx
div dword [ebx + 8]
mov edx, dword [esp + 0xc]
test edx, edx
je 0x403ce6
mov dword [edx], eax
pop esi
pop ebx
ret 4
cmp eax, ecx
je 0x403ce1
mov eax, 0x65
jmp 0x403cf6
call sub.kernel32.dll_GetLastError
call fcn.0040266c
xor eax, eax
jmp 0x403ce1
mov eax, 0x67
jmp 0x403cf6

Function at 0x403d88
Capabilities:
Get file size

Disassembly:
push ebx
mov ebx, eax
mov edx, dword [ebx + 4]
sub edx, 0xd7b1
cmp edx, 2
ja 0x403db8
push 0
push dword [ebx]
call sub.kernel32.dll_GetFileSize
cmp eax, 0xffffffff
je 0x403dae
xor edx, edx
div dword [ebx + 8]
pop ebx
ret
call fcn.0040267c
or eax, 0xffffffff
jmp 0x403dac
mov eax, 0x67
call fcn.0040266c
or eax, 0xffffffff
jmp 0x403dac

Function at 0x405398
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x4053d1
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403200
jmp 0x4053da
mov eax, ebx
mov edx, esi
call fcn.004031b4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4053e4
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405405
mov al, byte [esp]
jmp 0x405407
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4070a4
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x40f55c
mov eax, esi
mov edx, 8
test al, 1
je 0x4070c0
shr eax, 1
xor eax, 0xedb88320
jmp 0x4070c2
shr eax, 1
dec edx
jne 0x4070b3
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4070ac
pop esi
ret
Function at 0x4070d8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp byte [0x40f558], 0
jne 0x4070f6
call fcn.004070a4
mov byte [0x40f558], 1
mov eax, edi
test esi, esi
je 0x407121
mov edx, ebx
and dx, 0xff
xor ecx, ecx
mov cl, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x40f55c]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x4070fc
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x40af0c
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40af91
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x40af74
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.0040b208
mov eax, dword [ebp - 0xc]
call fcn.004033a0
push eax
call sub.kernel32.dll_GetFileAttributesA
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40af7b
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x40b008
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
mov esi, eax
call sub.kernel32.dll_GetCommandLineA_1
mov ebx, eax
xor eax, eax
mov dl, byte [ebx]
sub dl, 1
jb 0x40b034
sub dl, 0x1f
je 0x40b02c
sub dl, 2
je 0x40b028
jmp 0x40b030
xor al, 1
jmp 0x40b030
test al, al
je 0x40b034
inc ebx
jmp 0x40b015
inc ebx
cmp byte [ebx], 0x20
je 0x40b033
mov eax, esi
mov edx, ebx
call fcn.00403230
pop esi
pop ebx
ret

Function at 0x40b2c4
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call fcn.00404f20
add esp, 0x104
pop ebx
ret
Function at 0x40bad4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x78], ecx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
lea ebx, [ebp - 0x74]
xor eax, eax
push ebp
push 0x40bbc6
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x78]
mov eax, esi
call fcn.0040b258
push dword [ebp - 0x78]
push 0x40bbdc
push edi
lea eax, [ebp - 4]
mov edx, 3
call fcn.004032ac
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00402738
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004033a0
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x40bb5f
mov al, 0x66
call fcn.0040b990
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x40bb76
push ebx
call sub.user32.dll_TranslateMessage
push ebx
call sub.user32.dll_DispatchMessageA
push 1
push 0
push 0
push 0
push ebx
call sub.user32.dll_PeekMessageA
test eax, eax
jne 0x40bb6a
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x40bb76
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bbcd
lea eax, [ebp - 0x78]
call fcn.00403120
lea eax, [ebp - 4]
call fcn.00403120
ret

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x403030
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4067f0
push 0x405610
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x11c
push ebx
push esi
push edi
mov dword [ebp - 0x12c], ecx
xor edi, edi
mov dword [ebp - 0x1c], edi
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push edi
push str.SYSTEMCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x403097
mov eax, 0xfffffcdd
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 4], edi
mov dword [ebp - 0x128], edi
mov dword [ebp - 0x124], edi
mov ebx, dword [ebp + 8]
push 0x104
lea ecx, [ebp - 0x120]
push ecx
push edi
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x403113
push ebx
lea eax, [ebp - 0x120]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
mov ecx, dword [ebp - 0x12c]
call fcn.00403140
mov esi, eax
mov dword [ebp - 0x124], esi
test esi, esi
je 0x40310a
push 0xffffffffffffffff
lea edx, [ebp - 0x10]
push edx
call sub.MSVCRT.dll__local_unwind2
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
inc edi
mov dword [ebp - 0x128], edi
jmp 0x4030a9
mov dword [ebp - 4], 0xffffffff
call fcn.00403134
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x403480
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x406810
push 0x405610
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
lea eax, [ebp - 0x1c]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40351d
mov dword [ebp - 4], eax
lea eax, [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x20]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x403511
mov edx, dword [ebp - 0x20]
cmp edx, dword [ebp + 0x1c]
jne 0x403511
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
push eax
call sub.MSVCRT.dll__local_unwind2
add esp, 8
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov dword [ebp - 4], 0xffffffff
call fcn.00403532
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18

Function at 0x403540
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x406820
push 0x405610
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x4035fb
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4035fb
mov esi, dword [ebp + 0x10]
test esi, esi
jne 0x4035a0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
neg eax
sbb eax, eax
inc eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea edx, [ebp - 0x1c]
push edx
push 0xf003f
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4035fb
mov dword [ebp - 4], eax
push esi
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x4035ef
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
push ecx
call sub.MSVCRT.dll__local_unwind2
add esp, 8
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov dword [ebp - 4], 0xffffffff
call fcn.00403610
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x403850
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov edx, dword [esp + 8]
push ebx
push ebp
push esi
mov eax, dword [edx + 4]
mov edx, dword [edx]
push edi
mov dword [esp + 0x10], ecx
lea edi, [ecx + 0x64]
mov ebx, 0xc
mov esi, dword [edi + 4]
mov ecx, 0x20
sub eax, esi
mov esi, edx
and esi, 0x1f
mov ebp, eax
sub ecx, esi
sub edi, 8
shl ebp, cl
mov ecx, esi
mov esi, dword [edi + 8]
shr eax, cl
mov ecx, 0x20
or ebp, eax
xor ebp, edx
sub edx, esi
mov eax, ebp
mov ebp, edx
mov esi, eax
and esi, 0x1f
sub ecx, esi
shl ebp, cl
mov ecx, esi
shr edx, cl
or ebp, edx
xor ebp, eax
dec ebx
mov edx, ebp
jne 0x40386a
mov esi, dword [esp + 0x10]
pop edi
mov ecx, dword [esi + 8]
sub eax, ecx
mov ecx, dword [esp + 0x18]
mov dword [ecx + 4], eax
mov eax, dword [esi + 4]
sub edx, eax
pop esi
pop ebp
mov dword [ecx], edx
pop ebx
pop ecx
ret 8

Function at 0x4038d0
Capabilities:
Encrypt data using rc6

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov ebx, ecx
xor edx, edx
push edi
mov edi, dword [esp + 0x28]
mov dword [esp + 0x10], ebx
mov eax, 0xf
mov dword [esp + 0x20], edx
mov ecx, eax
shr ecx, 2
mov ebp, dword [esp + ecx*4 + 0x14]
lea esi, [esp + ecx*4 + 0x14]
xor ecx, ecx
mov cl, byte [eax + edi]
shl ebp, 8
add ecx, ebp
dec eax
cmp eax, 0xffffffff
mov dword [esi], ecx
jne 0x4038ec
lea eax, [ebx + 4]
mov ecx, 0x19
mov dword [eax], 0xb7e15163
mov esi, dword [eax]
add eax, 4
sub esi, 0x61c88647
dec ecx
mov dword [eax], esi
jne 0x403919
xor ebp, ebp
xor esi, esi
xor edi, edi
mov dword [esp + 0x28], 0x4e
jmp 0x40393d
mov ebx, dword [esp + 0x10]
mov ecx, dword [ebx + edx*4 + 4]
lea eax, [edx + 1]
lea edx, [esi + edi]
add edx, ecx
mov ecx, edx
shr ecx, 0x1d
shl edx, 3
or ecx, edx
mov dword [ebx + eax*4], ecx
mov edi, ecx
mov ecx, dword [esp + ebp*4 + 0x14]
add ecx, esi
lea ebx, [esi + edi]
and ebx, 0x1f
lea esi, [ecx + edi]
mov ecx, 0x20
sub ecx, ebx
mov edx, esi
shr edx, cl
mov ecx, ebx
shl esi, cl
mov ecx, 0x1a
or edx, esi
mov dword [esp + ebp*4 + 0x14], edx
mov esi, edx
xor edx, edx
div ecx
mov eax, dword [esp + 0x28]
inc ebp
and ebp, 3
dec eax
mov dword [esp + 0x28], eax
jne 0x403939
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
Function at 0x403a50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword fs:[0]
mov ecx, dword [esp + 4]
push 0xffffffffffffffff
push 0x405ce8
push eax
mov eax, dword [esp + 0x14]
mov dword fs:[0], esp
sub esp, 0x10
and ecx, 0xffff
push esi
push eax
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x403b12
push edi
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x403afc
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
lea ecx, [esp + 8]
mov esi, eax
call sub.MFC42.DLL_CFile::CFile
mov edx, dword [esp + 0x30]
push 0
push 0x1001
push edx
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0
call sub.MFC42.DLL_CFile::Open
test eax, eax
je 0x403aeb
push edi
push esi
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CFile::Write
lea ecx, [esp + 8]
call sub.MFC42.DLL_CFile::Close
lea ecx, [esp + 8]
mov dword [esp + 0x20], 0xffffffff
call fcn.0040543a
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret
mov ecx, dword [esp + 0x14]
xor eax, eax
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret